@cmmd-center/forge 0.13.20 → 0.13.21

package/dist/bin.cjs

@@ -17245,7 +17245,8 @@ const ExecutionEnvironmentAuthCapabilities = require_Schema$1.Struct({
 	ownerBootstrapPromotion: require_Schema$1.Boolean,
 	bearerBootstrap: require_Schema$1.Boolean,
 	desktopBootstrap: require_Schema$1.Boolean,
-	providerCredentialBroker: require_Schema$1.Boolean
+	providerCredentialBroker: require_Schema$1.Boolean,
+	cloudOwnerAssertion: require_Schema$1.optionalKey(require_Schema$1.Boolean)
 });
 const ExecutionEnvironmentToolCapabilities = require_Schema$1.Struct({
 	agents: require_Schema$1.Boolean,
@@ -66231,7 +66232,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.20";
+var version$1 = "0.13.21";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -68356,6 +68357,7 @@ function extractCookieValue(setCookieHeaders, name) {
 	}
 	return null;
 }
+/** @internal exported for the other owner lanes and their tests. */
 function readCmmdJsonResponse(response, fallbackMessage) {
 	return require_Schema$1.gen(function* () {
 		const payload = yield* require_Schema$1.tryPromise({
@@ -68617,11 +68619,14 @@ function cmmdUserCredential(payload) {
 /**
 * Read one CMMD token-exchange response into the credential set Forge stores.
 *
-* Both owner lanes redeem the same `cmmd-forge-web` authorization code — the
-* browser OAuth callback and Cloud's password login — so they see the same
-* bundle shape. Reading it in one place is what keeps them from drifting on
-* which field carries the PAT; callers still own their own error reporting,
-* which is the only part that legitimately differs between the two.
+* Every owner lane that redeems a CMMD grant — the browser OAuth callback,
+* Cloud's password login, the cookie-shaped session renew, and the bearer
+* device-session redeem in cloudOwnerDeviceSession.ts — sees the same bundle
+* shape. Reading it in one place is what keeps them from drifting on which
+* field carries the PAT; callers still own their own error reporting, which
+* is the only part that legitimately differs between them.
+*
+* @internal exported for the other owner lanes and their tests.
 */
 function resolveCmmdTokenBundleCredentials(tokenResult) {
 	return require_Schema$1.gen(function* () {
@@ -298212,7 +298217,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "6acacb9afbe43fd2b2053436daaddaec3459a517";
+	return "69e84f7ffb374290143d188cb9b7312e17ee2f90";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -298340,9 +298345,10 @@ function executionEnvironmentCapabilities(serverConfig) {
 		auth: {
 			cmmd: true,
 			ownerBootstrapPromotion: !isRuntime && !isCloudShell,
-			bearerBootstrap: true,
+			bearerBootstrap: !isCloudShell,
 			desktopBootstrap: serverConfig.mode === "desktop" || serverConfig.desktopBootstrapToken !== void 0,
-			providerCredentialBroker: false
+			providerCredentialBroker: false,
+			cloudOwnerAssertion: isCloudShell
 		},
 		tools: {
 			agents: isExecutionPlane,
@@ -298434,6 +298440,145 @@ const makeServerEnvironment = require_Schema$1.fn("makeServerEnvironment")(funct
 });
 const ServerEnvironmentLive = require_Schema$1.effect(ServerEnvironment, makeServerEnvironment());
 //#endregion
+//#region src/auth/http/cloudOwnerDeviceSession.ts
+/**
+* Native OAuth clients allowed to redeem a Forge Cloud session grant through
+* this bearer lane. Starts with only the mobile client from FOR-36841's
+* companion CMMD change; widen deliberately, not by accident.
+*/
+const CLOUD_NATIVE_OAUTH_CLIENT_IDS = new Set(["cmmd-forge-mobile"]);
+const CloudOwnerSessionRedeemInput = require_Schema$1.Struct({
+	sessionGrant: require_Schema$1.String,
+	clientId: require_Schema$1.String
+});
+function outsideCloudShell() {
+	return require_Schema$1.fail(new AuthError({
+		message: "Forge Cloud session redemption is unavailable.",
+		status: 403
+	}));
+}
+function redeemSessionGrantWithCmmd(input) {
+	return require_Schema$1.tryPromise({
+		try: () => fetch(resolveCommandAppEndpoint("/api/mcp-server/oauth/token"), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				grant_type: "forge_session_grant",
+				grant_token: input.sessionGrant,
+				client_id: input.clientId
+			})
+		}),
+		catch: (cause) => new AuthError({
+			message: "Failed to redeem the Forge Cloud session grant with CMMD.",
+			status: 500,
+			cause
+		})
+	}).pipe(require_Schema$1.flatMap((response) => readCmmdJsonResponse(response, "Failed to redeem the Forge Cloud session grant with CMMD.")));
+}
+const cloudOwnerSessionRedeemRouteLayer = add$1("POST", "/api/auth/cloud/session", require_Schema$1.gen(function* () {
+	const serverAuth = yield* ServerAuth;
+	if (serverAuth.isForgeCloudShell?.() !== true) return yield* outsideCloudShell();
+	const request = yield* require_HttpServer.HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
+	yield* serverAuth.authenticateHttpRequest(request);
+	const payload = yield* require_HttpServer.schemaBodyJson(CloudOwnerSessionRedeemInput).pipe(require_Schema$1.mapError((cause) => new AuthError({
+		message: "Invalid Forge Cloud session redeem payload.",
+		status: 400,
+		cause
+	})));
+	if (!CLOUD_NATIVE_OAUTH_CLIENT_IDS.has(payload.clientId)) return yield* new AuthError({
+		message: "Unknown Forge Cloud native client.",
+		status: 403
+	});
+	const tokenResult = yield* redeemSessionGrantWithCmmd(payload);
+	const { tokenObj, cmmdIdentity, userId, accessToken, mcpToken, refreshToken, forgeOwnerAssertion, sessionGrantExpiresAt, isJwt, patToStore, jwtToStore } = yield* resolveCmmdTokenBundleCredentials(tokenResult);
+	if (!cmmdIdentity || !userId || !patToStore) {
+		yield* require_Schema$1.logError("Forge Cloud session redeem: CMMD token response incomplete.", {
+			clientId: payload.clientId,
+			tokenResponse: describeCmmdTokenResponseForLog({
+				tokenObj,
+				tokenResult,
+				accessToken,
+				mcpToken,
+				refreshToken,
+				isJwt,
+				userId,
+				patToStore,
+				jwtToStore
+			})
+		});
+		return yield* new AuthError({
+			message: "CMMD did not return a complete redeemed Forge Cloud session.",
+			status: 500
+		});
+	}
+	const assertion = yield* validateCloudOwnerCallbackAssertion({
+		serverAuth,
+		assertionToken: forgeOwnerAssertion,
+		authenticatedUserId: userId
+	});
+	if (!assertion) return yield* require_Schema$1.die(/* @__PURE__ */ new Error("Expected a redeemed Forge Cloud owner assertion for a native client."));
+	yield* persistCloudOwnerArtifacts({
+		assertion,
+		accessToken: patToStore,
+		identity: cmmdIdentity,
+		jwtToken: jwtToStore,
+		refreshToken,
+		sessionGrant: payload.sessionGrant,
+		sessionGrantExpiresAt
+	});
+	yield* require_Schema$1.logInfo("Forge Cloud owner session redeemed.", {
+		sessionId: assertion.sessionId,
+		clientId: payload.clientId,
+		userId
+	});
+	return require_HttpServer.jsonUnsafe({
+		assertion: assertion.token,
+		assertionExpiresAt: require_Schema$1.toUtc(assertion.expiresAt),
+		sessionGrantExpiresAt,
+		user: {
+			id: assertion.userId,
+			email: cmmdIdentity.email
+		}
+	}, { status: 200 });
+}).pipe(require_Schema$1.catchTag("AuthError", (error) => respondToAuthError(error))));
+/**
+* Seam for CMMD-side session-grant revocation.
+*
+* As of FOR-36841, CMMD does not expose an endpoint to revoke a
+* `forge_session_grant` token server-side (confirm with the CMMD change
+* before wiring this in). When it does, call it here, best-effort: a failure
+* revoking at CMMD must never block the local row deletion below, which is
+* this endpoint's actual guarantee. Left as a documented no-op rather than a
+* guess at CMMD's eventual route shape.
+*/
+function revokeCmmdSessionGrantBestEffort(_sessionId) {
+	return require_Schema$1.void_;
+}
+const cloudOwnerSessionRevokeRouteLayer = add$1("POST", "/api/auth/cloud/session/revoke", require_Schema$1.gen(function* () {
+	const serverAuth = yield* ServerAuth;
+	if (serverAuth.isForgeCloudShell?.() !== true) return yield* outsideCloudShell();
+	const request = yield* require_HttpServer.HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
+	const session = yield* serverAuth.authenticateHttpRequest(request);
+	yield* clearCommandAccessTokenForSession(session.sessionId).pipe(require_Schema$1.mapError((cause) => new AuthError({
+		message: "Failed to revoke the Forge Cloud owner session.",
+		status: 500,
+		cause
+	})));
+	yield* revokeCmmdSessionGrantBestEffort(session.sessionId);
+	yield* require_Schema$1.logInfo("Forge Cloud owner session revoked.", { sessionId: session.sessionId });
+	return require_HttpServer.empty({ status: 204 });
+}).pipe(require_Schema$1.catchTag("AuthError", (error) => respondToAuthError(error))));
+//#endregion
 //#region src/docs/http.ts
 const SCALAR_API_REFERENCE_URL = "https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1";
 const SCALAR_API_REFERENCE_INTEGRITY = "sha384-SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W";
@@ -300567,6 +300712,24 @@ function readWebSocketUpgradeToken(params) {
 }
 //#endregion
 //#region src/auth/Layers/ForgeCloudOwnerAuthentication.ts
+const BEARER_PREFIX = "Bearer ";
+/**
+* Reads a Forge Cloud owner assertion presented as `Authorization: Bearer
+* <assertion>`, alongside the cookie read below.
+*
+* Deliberately its own parser rather than a shared one: `ServerAuth.ts`
+* carries a bearer reader for the local bootstrap/pairing/desktop lanes, and
+* those must stay untouched by this change. This function is only ever
+* called from `authenticateForgeCloudOwnerRequest`, which itself only runs
+* when `serverConfig.forgeCloudShellMode === true` — so a non-cloud server's
+* bearer lanes never pass through here.
+*/
+function readForgeCloudOwnerBearerToken(request) {
+	const header = request.headers["authorization"];
+	if (typeof header !== "string" || !header.startsWith(BEARER_PREFIX)) return null;
+	const token = header.slice(7).trim();
+	return token.length > 0 ? token : null;
+}
 function assertionVerifierConfig(config) {
 	const publicKey = config.forgeCloudOwnerAssertionPublicKey;
 	const keyId = config.forgeCloudOwnerAssertionKeyId;
@@ -300594,7 +300757,7 @@ function authenticateForgeCloudOwnerRequest(request, config) {
 			message: "Forge Cloud owner assertion verification is misconfigured.",
 			status: 500
 		});
-		const token = request.cookies[FORGE_CLOUD_OWNER_ASSERTION_COOKIE];
+		const token = request.cookies["forge_cloud_owner_assertion"] ?? readForgeCloudOwnerBearerToken(request);
 		if (!token) return yield* new AuthError({
 			message: "Authentication required.",
 			status: 401
@@ -321763,7 +321926,7 @@ const MiscRuntimeLayerLive = require_Schema$1.mergeAll(AnalyticsServiceLayerLive
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(require_Schema$1.provideMerge(CheckpointingLayerLive), require_Schema$1.provideMerge(GitLayerLive), require_Schema$1.provideMerge(OrchestrationLayerLive), require_Schema$1.provideMerge(ProviderLayerLive), require_Schema$1.provideMerge(TerminalLayerLive), require_Schema$1.provideMerge(AgentBrowserManagerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(require_Schema$1.provide$1(ThreadDevRuntimeLive)))), require_Schema$1.provideMerge(PersistenceLayerLive), require_Schema$1.provideMerge(KeybindingsLive), require_Schema$1.provideMerge(ProviderRegistryLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ServerSettingsLive, UsageServiceLive.pipe(require_Schema$1.provide$1(ServerSettingsLive), require_Schema$1.provide$1(UsageSessionLookupLive), require_Schema$1.provide$1(UsageRecordedSourceLive.pipe(require_Schema$1.provide$1(OrchestrationLayerLive), require_Schema$1.provide$1(RuntimeReplicationOutboxLive), require_Schema$1.provide$1(ProviderSessionRuntimeRepositoryLive), require_Schema$1.provide$1(TextGenerationSessionRepositoryLive)))))), require_Schema$1.provideMerge(WorkspaceLayerLive), require_Schema$1.provideMerge(WorkspaceReadinessStateLive), require_Schema$1.provideMerge(ProjectFaviconResolverLive), require_Schema$1.provideMerge(RepositoryIdentityResolverLive), require_Schema$1.provideMerge(ServerEnvironmentLive), require_Schema$1.provideMerge(AuthLayerLive), require_Schema$1.provideMerge(ServerSecretStoreLayerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(require_Schema$1.provide$1(PersistenceLayerLive)))), require_Schema$1.provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(require_Schema$1.provideMerge(RuntimeDependenciesWithoutPullRequestsLive), require_Schema$1.provideMerge(cmmdProjectIdentityResolverLive.pipe(require_Schema$1.provide$1(RuntimeDependenciesWithoutPullRequestsLive))), require_Schema$1.provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(require_Schema$1.provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = require_Schema$1.mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
+const makeRoutesLayer = require_Schema$1.mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, cloudOwnerSessionRedeemRouteLayer, cloudOwnerSessionRevokeRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
 const makeServerLayer = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath({ preferProcessPath: config.forgeCmmdRuntimeMode === true });

package/dist/bin.mjs

@@ -17203,7 +17203,8 @@ const ExecutionEnvironmentAuthCapabilities = Struct({
 	ownerBootstrapPromotion: Boolean$1,
 	bearerBootstrap: Boolean$1,
 	desktopBootstrap: Boolean$1,
-	providerCredentialBroker: Boolean$1
+	providerCredentialBroker: Boolean$1,
+	cloudOwnerAssertion: optionalKey(Boolean$1)
 });
 const ExecutionEnvironmentToolCapabilities = Struct({
 	agents: Boolean$1,
@@ -65936,7 +65937,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.20";
+var version$1 = "0.13.21";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -68060,6 +68061,7 @@ function extractCookieValue(setCookieHeaders, name) {
 	}
 	return null;
 }
+/** @internal exported for the other owner lanes and their tests. */
 function readCmmdJsonResponse(response, fallbackMessage) {
 	return gen(function* () {
 		const payload = yield* tryPromise({
@@ -68321,11 +68323,14 @@ function cmmdUserCredential(payload) {
 /**
 * Read one CMMD token-exchange response into the credential set Forge stores.
 *
-* Both owner lanes redeem the same `cmmd-forge-web` authorization code — the
-* browser OAuth callback and Cloud's password login — so they see the same
-* bundle shape. Reading it in one place is what keeps them from drifting on
-* which field carries the PAT; callers still own their own error reporting,
-* which is the only part that legitimately differs between the two.
+* Every owner lane that redeems a CMMD grant — the browser OAuth callback,
+* Cloud's password login, the cookie-shaped session renew, and the bearer
+* device-session redeem in cloudOwnerDeviceSession.ts — sees the same bundle
+* shape. Reading it in one place is what keeps them from drifting on which
+* field carries the PAT; callers still own their own error reporting, which
+* is the only part that legitimately differs between them.
+*
+* @internal exported for the other owner lanes and their tests.
 */
 function resolveCmmdTokenBundleCredentials(tokenResult) {
 	return gen(function* () {
@@ -297643,7 +297648,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "6acacb9afbe43fd2b2053436daaddaec3459a517";
+	return "69e84f7ffb374290143d188cb9b7312e17ee2f90";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -297771,9 +297776,10 @@ function executionEnvironmentCapabilities(serverConfig) {
 		auth: {
 			cmmd: true,
 			ownerBootstrapPromotion: !isRuntime && !isCloudShell,
-			bearerBootstrap: true,
+			bearerBootstrap: !isCloudShell,
 			desktopBootstrap: serverConfig.mode === "desktop" || serverConfig.desktopBootstrapToken !== void 0,
-			providerCredentialBroker: false
+			providerCredentialBroker: false,
+			cloudOwnerAssertion: isCloudShell
 		},
 		tools: {
 			agents: isExecutionPlane,
@@ -297863,6 +297869,145 @@ const ServerEnvironmentLive = effect(ServerEnvironment, fn$1("makeServerEnvironm
 	};
 })());
 //#endregion
+//#region src/auth/http/cloudOwnerDeviceSession.ts
+/**
+* Native OAuth clients allowed to redeem a Forge Cloud session grant through
+* this bearer lane. Starts with only the mobile client from FOR-36841's
+* companion CMMD change; widen deliberately, not by accident.
+*/
+const CLOUD_NATIVE_OAUTH_CLIENT_IDS = new Set(["cmmd-forge-mobile"]);
+const CloudOwnerSessionRedeemInput = Struct({
+	sessionGrant: String$1,
+	clientId: String$1
+});
+function outsideCloudShell() {
+	return fail(new AuthError({
+		message: "Forge Cloud session redemption is unavailable.",
+		status: 403
+	}));
+}
+function redeemSessionGrantWithCmmd(input) {
+	return tryPromise({
+		try: () => fetch(resolveCommandAppEndpoint("/api/mcp-server/oauth/token"), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				grant_type: "forge_session_grant",
+				grant_token: input.sessionGrant,
+				client_id: input.clientId
+			})
+		}),
+		catch: (cause) => new AuthError({
+			message: "Failed to redeem the Forge Cloud session grant with CMMD.",
+			status: 500,
+			cause
+		})
+	}).pipe(flatMap((response) => readCmmdJsonResponse(response, "Failed to redeem the Forge Cloud session grant with CMMD.")));
+}
+const cloudOwnerSessionRedeemRouteLayer = add$1("POST", "/api/auth/cloud/session", gen(function* () {
+	const serverAuth = yield* ServerAuth;
+	if (serverAuth.isForgeCloudShell?.() !== true) return yield* outsideCloudShell();
+	const request = yield* HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
+	yield* serverAuth.authenticateHttpRequest(request);
+	const payload = yield* schemaBodyJson(CloudOwnerSessionRedeemInput).pipe(mapError((cause) => new AuthError({
+		message: "Invalid Forge Cloud session redeem payload.",
+		status: 400,
+		cause
+	})));
+	if (!CLOUD_NATIVE_OAUTH_CLIENT_IDS.has(payload.clientId)) return yield* new AuthError({
+		message: "Unknown Forge Cloud native client.",
+		status: 403
+	});
+	const tokenResult = yield* redeemSessionGrantWithCmmd(payload);
+	const { tokenObj, cmmdIdentity, userId, accessToken, mcpToken, refreshToken, forgeOwnerAssertion, sessionGrantExpiresAt, isJwt, patToStore, jwtToStore } = yield* resolveCmmdTokenBundleCredentials(tokenResult);
+	if (!cmmdIdentity || !userId || !patToStore) {
+		yield* logError("Forge Cloud session redeem: CMMD token response incomplete.", {
+			clientId: payload.clientId,
+			tokenResponse: describeCmmdTokenResponseForLog({
+				tokenObj,
+				tokenResult,
+				accessToken,
+				mcpToken,
+				refreshToken,
+				isJwt,
+				userId,
+				patToStore,
+				jwtToStore
+			})
+		});
+		return yield* new AuthError({
+			message: "CMMD did not return a complete redeemed Forge Cloud session.",
+			status: 500
+		});
+	}
+	const assertion = yield* validateCloudOwnerCallbackAssertion({
+		serverAuth,
+		assertionToken: forgeOwnerAssertion,
+		authenticatedUserId: userId
+	});
+	if (!assertion) return yield* die$1(/* @__PURE__ */ new Error("Expected a redeemed Forge Cloud owner assertion for a native client."));
+	yield* persistCloudOwnerArtifacts({
+		assertion,
+		accessToken: patToStore,
+		identity: cmmdIdentity,
+		jwtToken: jwtToStore,
+		refreshToken,
+		sessionGrant: payload.sessionGrant,
+		sessionGrantExpiresAt
+	});
+	yield* logInfo("Forge Cloud owner session redeemed.", {
+		sessionId: assertion.sessionId,
+		clientId: payload.clientId,
+		userId
+	});
+	return jsonUnsafe({
+		assertion: assertion.token,
+		assertionExpiresAt: toUtc(assertion.expiresAt),
+		sessionGrantExpiresAt,
+		user: {
+			id: assertion.userId,
+			email: cmmdIdentity.email
+		}
+	}, { status: 200 });
+}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+/**
+* Seam for CMMD-side session-grant revocation.
+*
+* As of FOR-36841, CMMD does not expose an endpoint to revoke a
+* `forge_session_grant` token server-side (confirm with the CMMD change
+* before wiring this in). When it does, call it here, best-effort: a failure
+* revoking at CMMD must never block the local row deletion below, which is
+* this endpoint's actual guarantee. Left as a documented no-op rather than a
+* guess at CMMD's eventual route shape.
+*/
+function revokeCmmdSessionGrantBestEffort(_sessionId) {
+	return void_$1;
+}
+const cloudOwnerSessionRevokeRouteLayer = add$1("POST", "/api/auth/cloud/session/revoke", gen(function* () {
+	const serverAuth = yield* ServerAuth;
+	if (serverAuth.isForgeCloudShell?.() !== true) return yield* outsideCloudShell();
+	const request = yield* HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
+	const session = yield* serverAuth.authenticateHttpRequest(request);
+	yield* clearCommandAccessTokenForSession(session.sessionId).pipe(mapError((cause) => new AuthError({
+		message: "Failed to revoke the Forge Cloud owner session.",
+		status: 500,
+		cause
+	})));
+	yield* revokeCmmdSessionGrantBestEffort(session.sessionId);
+	yield* logInfo("Forge Cloud owner session revoked.", { sessionId: session.sessionId });
+	return empty$6({ status: 204 });
+}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+//#endregion
 //#region src/docs/http.ts
 const SCALAR_API_REFERENCE_URL = "https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1";
 const SCALAR_API_REFERENCE_INTEGRITY = "sha384-SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W";
@@ -299983,6 +300128,24 @@ function readWebSocketUpgradeToken(params) {
 }
 //#endregion
 //#region src/auth/Layers/ForgeCloudOwnerAuthentication.ts
+const BEARER_PREFIX = "Bearer ";
+/**
+* Reads a Forge Cloud owner assertion presented as `Authorization: Bearer
+* <assertion>`, alongside the cookie read below.
+*
+* Deliberately its own parser rather than a shared one: `ServerAuth.ts`
+* carries a bearer reader for the local bootstrap/pairing/desktop lanes, and
+* those must stay untouched by this change. This function is only ever
+* called from `authenticateForgeCloudOwnerRequest`, which itself only runs
+* when `serverConfig.forgeCloudShellMode === true` — so a non-cloud server's
+* bearer lanes never pass through here.
+*/
+function readForgeCloudOwnerBearerToken(request) {
+	const header = request.headers["authorization"];
+	if (typeof header !== "string" || !header.startsWith(BEARER_PREFIX)) return null;
+	const token = header.slice(7).trim();
+	return token.length > 0 ? token : null;
+}
 function assertionVerifierConfig(config) {
 	const publicKey = config.forgeCloudOwnerAssertionPublicKey;
 	const keyId = config.forgeCloudOwnerAssertionKeyId;
@@ -300010,7 +300173,7 @@ function authenticateForgeCloudOwnerRequest(request, config) {
 			message: "Forge Cloud owner assertion verification is misconfigured.",
 			status: 500
 		});
-		const token = request.cookies[FORGE_CLOUD_OWNER_ASSERTION_COOKIE];
+		const token = request.cookies["forge_cloud_owner_assertion"] ?? readForgeCloudOwnerBearerToken(request);
 		if (!token) return yield* new AuthError({
 			message: "Authentication required.",
 			status: 401
@@ -321069,7 +321232,7 @@ const MiscRuntimeLayerLive = mergeAll(AnalyticsServiceLayerLive, OpenLive, Serve
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(provideMerge(CheckpointingLayerLive), provideMerge(GitLayerLive), provideMerge(OrchestrationLayerLive), provideMerge(ProviderLayerLive), provideMerge(TerminalLayerLive), provideMerge(AgentBrowserManagerLive), provideMerge(mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(provide$1(ThreadDevRuntimeLive)))), provideMerge(PersistenceLayerLive), provideMerge(KeybindingsLive), provideMerge(ProviderRegistryLive), provideMerge(mergeAll(ServerSettingsLive, UsageServiceLive.pipe(provide$1(ServerSettingsLive), provide$1(UsageSessionLookupLive), provide$1(UsageRecordedSourceLive.pipe(provide$1(OrchestrationLayerLive), provide$1(RuntimeReplicationOutboxLive), provide$1(ProviderSessionRuntimeRepositoryLive), provide$1(TextGenerationSessionRepositoryLive)))))), provideMerge(WorkspaceLayerLive), provideMerge(WorkspaceReadinessStateLive), provideMerge(ProjectFaviconResolverLive), provideMerge(RepositoryIdentityResolverLive), provideMerge(ServerEnvironmentLive), provideMerge(AuthLayerLive), provideMerge(ServerSecretStoreLayerLive), provideMerge(mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(provide$1(PersistenceLayerLive)))), provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(provideMerge(RuntimeDependenciesWithoutPullRequestsLive), provideMerge(cmmdProjectIdentityResolverLive.pipe(provide$1(RuntimeDependenciesWithoutPullRequestsLive))), provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
+const makeRoutesLayer = mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, cloudOwnerSessionRedeemRouteLayer, cloudOwnerSessionRevokeRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
 const runServer = launch$1(unwrap(gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath({ preferProcessPath: config.forgeCmmdRuntimeMode === true });