@cmmd-center/forge 0.13.20 → 0.13.22

package/dist/bin.mjs

@@ -22,7 +22,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
+import os, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -17203,7 +17203,8 @@ const ExecutionEnvironmentAuthCapabilities = Struct({
 	ownerBootstrapPromotion: Boolean$1,
 	bearerBootstrap: Boolean$1,
 	desktopBootstrap: Boolean$1,
-	providerCredentialBroker: Boolean$1
+	providerCredentialBroker: Boolean$1,
+	cloudOwnerAssertion: optionalKey(Boolean$1)
 });
 const ExecutionEnvironmentToolCapabilities = Struct({
 	agents: Boolean$1,
@@ -50548,7 +50549,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = $U.release().split(".");
+		const osRelease = os.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -52991,7 +52992,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$3 = __require("os");
+	const os$4 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53013,7 +53014,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$3.userInfo();
+				const userInfo = os$4.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -65936,7 +65937,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.20";
+var version$1 = "0.13.22";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -68060,6 +68061,7 @@ function extractCookieValue(setCookieHeaders, name) {
 	}
 	return null;
 }
+/** @internal exported for the other owner lanes and their tests. */
 function readCmmdJsonResponse(response, fallbackMessage) {
 	return gen(function* () {
 		const payload = yield* tryPromise({
@@ -68321,11 +68323,14 @@ function cmmdUserCredential(payload) {
 /**
 * Read one CMMD token-exchange response into the credential set Forge stores.
 *
-* Both owner lanes redeem the same `cmmd-forge-web` authorization code — the
-* browser OAuth callback and Cloud's password login — so they see the same
-* bundle shape. Reading it in one place is what keeps them from drifting on
-* which field carries the PAT; callers still own their own error reporting,
-* which is the only part that legitimately differs between the two.
+* Every owner lane that redeems a CMMD grant — the browser OAuth callback,
+* Cloud's password login, the cookie-shaped session renew, and the bearer
+* device-session redeem in cloudOwnerDeviceSession.ts — sees the same bundle
+* shape. Reading it in one place is what keeps them from drifting on which
+* field carries the PAT; callers still own their own error reporting, which
+* is the only part that legitimately differs between them.
+*
+* @internal exported for the other owner lanes and their tests.
 */
 function resolveCmmdTokenBundleCredentials(tokenResult) {
 	return gen(function* () {
@@ -69277,22 +69282,52 @@ const deriveServerPaths = fn$1(function* (baseDir, _devUrl, _mode) {
 		secretsDir: join(stateDir, "secrets")
 	};
 });
-const ensureServerDirectories = fn$1(function* (derivedPaths) {
+/**
+* Create `dir`, healing the one case a recursive mkdir cannot: a symlink whose
+* target no longer exists.
+*
+* A recursive mkdir is a no-op when the path is already a directory, but it
+* fails when the path is a DANGLING symlink, because nothing on the way down
+* resolves. bun reports that as EEXIST and node as ENOENT; either way the call
+* raises instead of recreating what the link points at.
+*
+* That shape is normal on a CMMD cloud runtime. The regenerable cache
+* directories there are symlinks onto the sprite's machine-local /tmp, which is
+* a separate device that is NOT part of the checkpointed overlay, so a wipe
+* leaves the links behind and takes their targets. Only provisioning recreated
+* them, and provisioning does not re-run on a restart, so a wiped store meant
+* the server raised at boot, exited 1, and did so again on every supervisor
+* restart for as long as the runtime existed.
+*
+* Observed live on cloud runtime 33dff4ee: /forge/caches pointed at
+* /tmp/forge-store/caches, the target was gone, and the server failed to boot
+* 974 times between 2026-09-15 and 2026-09-16. Recreating the target directory
+* by hand was the whole repair, which is what this does automatically.
+*
+* Healing is deliberately narrow. A path that is not a symlink, or a symlink
+* whose target cannot be created, re-raises the original error rather than
+* inventing a directory somewhere the caller did not ask for.
+*/
+const ensureDirectory = fn$1(function* (dir) {
 	const fs = yield* FileSystem;
+	const path = yield* Path$2;
+	yield* fs.makeDirectory(dir, { recursive: true }).pipe(catch_((error) => fs.readLink(dir).pipe(flatMap((target) => fs.makeDirectory(path.resolve(path.dirname(dir), target), { recursive: true })), mapError(() => error))));
+});
+const ensureServerDirectories = fn$1(function* (derivedPaths) {
 	const path = yield* Path$2;
 	yield* all([
-		fs.makeDirectory(derivedPaths.stateDir, { recursive: true }),
-		fs.makeDirectory(derivedPaths.logsDir, { recursive: true }),
-		fs.makeDirectory(derivedPaths.providerLogsDir, { recursive: true }),
-		fs.makeDirectory(derivedPaths.terminalLogsDir, { recursive: true }),
-		fs.makeDirectory(derivedPaths.attachmentsDir, { recursive: true }),
-		fs.makeDirectory(derivedPaths.worktreesDir, { recursive: true }),
-		fs.makeDirectory(path.dirname(derivedPaths.keybindingsConfigPath), { recursive: true }),
-		fs.makeDirectory(path.dirname(derivedPaths.settingsPath), { recursive: true }),
-		fs.makeDirectory(derivedPaths.providerStatusCacheDir, { recursive: true }),
-		fs.makeDirectory(path.dirname(derivedPaths.anonymousIdPath), { recursive: true }),
-		fs.makeDirectory(path.dirname(derivedPaths.environmentMetadataPath), { recursive: true }),
-		fs.makeDirectory(path.dirname(derivedPaths.serverRuntimeStatePath), { recursive: true })
+		ensureDirectory(derivedPaths.stateDir),
+		ensureDirectory(derivedPaths.logsDir),
+		ensureDirectory(derivedPaths.providerLogsDir),
+		ensureDirectory(derivedPaths.terminalLogsDir),
+		ensureDirectory(derivedPaths.attachmentsDir),
+		ensureDirectory(derivedPaths.worktreesDir),
+		ensureDirectory(path.dirname(derivedPaths.keybindingsConfigPath)),
+		ensureDirectory(path.dirname(derivedPaths.settingsPath)),
+		ensureDirectory(derivedPaths.providerStatusCacheDir),
+		ensureDirectory(path.dirname(derivedPaths.anonymousIdPath)),
+		ensureDirectory(path.dirname(derivedPaths.environmentMetadataPath)),
+		ensureDirectory(path.dirname(derivedPaths.serverRuntimeStatePath))
 	], { concurrency: "unbounded" });
 });
 /**
@@ -75784,7 +75819,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -75792,8 +75827,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$2.arch();
-	var platform = process.env.npm_config_platform || os$2.platform();
+	var arch = process.env.npm_config_arch || os$3.arch();
+	var platform = process.env.npm_config_platform || os$3.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -93481,7 +93516,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-D8mGyWmt.mjs"),
+		try: () => import("./open-FIgTDosf.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -190957,7 +190992,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -201157,12 +201192,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$1 = "https://code.claude.com/docs/en", kKe = [
+var os$2 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$1}/iam#permission-modes`
+			docLink: `${os$2}/iam#permission-modes`
 		}
 	},
 	{
@@ -201177,7 +201212,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$1}/settings#environment-variables`
+			docLink: `${os$2}/settings#environment-variables`
 		}
 	},
 	{
@@ -201188,14 +201223,14 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$1}/hooks`
+			docLink: `${os$2}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$1}/hooks#exec-form-and-shell-form`
+			docLink: `${os$2}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -201210,7 +201245,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$1}/settings`
+			docLink: `${os$2}/settings`
 		}
 	},
 	{
@@ -201225,13 +201260,13 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$1}/iam#working-directories`
+			docLink: `${os$2}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$1}/iam#configuring-permissions`,
-	env: `${os$1}/settings#environment-variables`,
-	hooks: `${os$1}/hooks`
+	permissions: `${os$2}/iam#configuring-permissions`,
+	env: `${os$2}/settings#environment-variables`,
+	hooks: `${os$2}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -268541,7 +268576,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -268672,14 +268707,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -268687,7 +268722,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -297643,7 +297678,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "6acacb9afbe43fd2b2053436daaddaec3459a517";
+	return "c9bc6514eb0d5f3c0eff3b12d396a11f7a96abef";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -297771,9 +297806,10 @@ function executionEnvironmentCapabilities(serverConfig) {
 		auth: {
 			cmmd: true,
 			ownerBootstrapPromotion: !isRuntime && !isCloudShell,
-			bearerBootstrap: true,
+			bearerBootstrap: !isCloudShell,
 			desktopBootstrap: serverConfig.mode === "desktop" || serverConfig.desktopBootstrapToken !== void 0,
-			providerCredentialBroker: false
+			providerCredentialBroker: false,
+			cloudOwnerAssertion: isCloudShell
 		},
 		tools: {
 			agents: isExecutionPlane,
@@ -297863,6 +297899,145 @@ const ServerEnvironmentLive = effect(ServerEnvironment, fn$1("makeServerEnvironm
 	};
 })());
 //#endregion
+//#region src/auth/http/cloudOwnerDeviceSession.ts
+/**
+* Native OAuth clients allowed to redeem a Forge Cloud session grant through
+* this bearer lane. Starts with only the mobile client from FOR-36841's
+* companion CMMD change; widen deliberately, not by accident.
+*/
+const CLOUD_NATIVE_OAUTH_CLIENT_IDS = new Set(["cmmd-forge-mobile"]);
+const CloudOwnerSessionRedeemInput = Struct({
+	sessionGrant: String$1,
+	clientId: String$1
+});
+function outsideCloudShell() {
+	return fail(new AuthError({
+		message: "Forge Cloud session redemption is unavailable.",
+		status: 403
+	}));
+}
+function redeemSessionGrantWithCmmd(input) {
+	return tryPromise({
+		try: () => fetch(resolveCommandAppEndpoint("/api/mcp-server/oauth/token"), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				grant_type: "forge_session_grant",
+				grant_token: input.sessionGrant,
+				client_id: input.clientId
+			})
+		}),
+		catch: (cause) => new AuthError({
+			message: "Failed to redeem the Forge Cloud session grant with CMMD.",
+			status: 500,
+			cause
+		})
+	}).pipe(flatMap((response) => readCmmdJsonResponse(response, "Failed to redeem the Forge Cloud session grant with CMMD.")));
+}
+const cloudOwnerSessionRedeemRouteLayer = add$1("POST", "/api/auth/cloud/session", gen(function* () {
+	const serverAuth = yield* ServerAuth;
+	if (serverAuth.isForgeCloudShell?.() !== true) return yield* outsideCloudShell();
+	const request = yield* HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
+	yield* serverAuth.authenticateHttpRequest(request);
+	const payload = yield* schemaBodyJson(CloudOwnerSessionRedeemInput).pipe(mapError((cause) => new AuthError({
+		message: "Invalid Forge Cloud session redeem payload.",
+		status: 400,
+		cause
+	})));
+	if (!CLOUD_NATIVE_OAUTH_CLIENT_IDS.has(payload.clientId)) return yield* new AuthError({
+		message: "Unknown Forge Cloud native client.",
+		status: 403
+	});
+	const tokenResult = yield* redeemSessionGrantWithCmmd(payload);
+	const { tokenObj, cmmdIdentity, userId, accessToken, mcpToken, refreshToken, forgeOwnerAssertion, sessionGrantExpiresAt, isJwt, patToStore, jwtToStore } = yield* resolveCmmdTokenBundleCredentials(tokenResult);
+	if (!cmmdIdentity || !userId || !patToStore) {
+		yield* logError("Forge Cloud session redeem: CMMD token response incomplete.", {
+			clientId: payload.clientId,
+			tokenResponse: describeCmmdTokenResponseForLog({
+				tokenObj,
+				tokenResult,
+				accessToken,
+				mcpToken,
+				refreshToken,
+				isJwt,
+				userId,
+				patToStore,
+				jwtToStore
+			})
+		});
+		return yield* new AuthError({
+			message: "CMMD did not return a complete redeemed Forge Cloud session.",
+			status: 500
+		});
+	}
+	const assertion = yield* validateCloudOwnerCallbackAssertion({
+		serverAuth,
+		assertionToken: forgeOwnerAssertion,
+		authenticatedUserId: userId
+	});
+	if (!assertion) return yield* die$1(/* @__PURE__ */ new Error("Expected a redeemed Forge Cloud owner assertion for a native client."));
+	yield* persistCloudOwnerArtifacts({
+		assertion,
+		accessToken: patToStore,
+		identity: cmmdIdentity,
+		jwtToken: jwtToStore,
+		refreshToken,
+		sessionGrant: payload.sessionGrant,
+		sessionGrantExpiresAt
+	});
+	yield* logInfo("Forge Cloud owner session redeemed.", {
+		sessionId: assertion.sessionId,
+		clientId: payload.clientId,
+		userId
+	});
+	return jsonUnsafe({
+		assertion: assertion.token,
+		assertionExpiresAt: toUtc(assertion.expiresAt),
+		sessionGrantExpiresAt,
+		user: {
+			id: assertion.userId,
+			email: cmmdIdentity.email
+		}
+	}, { status: 200 });
+}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+/**
+* Seam for CMMD-side session-grant revocation.
+*
+* As of FOR-36841, CMMD does not expose an endpoint to revoke a
+* `forge_session_grant` token server-side (confirm with the CMMD change
+* before wiring this in). When it does, call it here, best-effort: a failure
+* revoking at CMMD must never block the local row deletion below, which is
+* this endpoint's actual guarantee. Left as a documented no-op rather than a
+* guess at CMMD's eventual route shape.
+*/
+function revokeCmmdSessionGrantBestEffort(_sessionId) {
+	return void_$1;
+}
+const cloudOwnerSessionRevokeRouteLayer = add$1("POST", "/api/auth/cloud/session/revoke", gen(function* () {
+	const serverAuth = yield* ServerAuth;
+	if (serverAuth.isForgeCloudShell?.() !== true) return yield* outsideCloudShell();
+	const request = yield* HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
+	const session = yield* serverAuth.authenticateHttpRequest(request);
+	yield* clearCommandAccessTokenForSession(session.sessionId).pipe(mapError((cause) => new AuthError({
+		message: "Failed to revoke the Forge Cloud owner session.",
+		status: 500,
+		cause
+	})));
+	yield* revokeCmmdSessionGrantBestEffort(session.sessionId);
+	yield* logInfo("Forge Cloud owner session revoked.", { sessionId: session.sessionId });
+	return empty$6({ status: 204 });
+}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+//#endregion
 //#region src/docs/http.ts
 const SCALAR_API_REFERENCE_URL = "https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1";
 const SCALAR_API_REFERENCE_INTEGRITY = "sha384-SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W";
@@ -299983,6 +300158,24 @@ function readWebSocketUpgradeToken(params) {
 }
 //#endregion
 //#region src/auth/Layers/ForgeCloudOwnerAuthentication.ts
+const BEARER_PREFIX = "Bearer ";
+/**
+* Reads a Forge Cloud owner assertion presented as `Authorization: Bearer
+* <assertion>`, alongside the cookie read below.
+*
+* Deliberately its own parser rather than a shared one: `ServerAuth.ts`
+* carries a bearer reader for the local bootstrap/pairing/desktop lanes, and
+* those must stay untouched by this change. This function is only ever
+* called from `authenticateForgeCloudOwnerRequest`, which itself only runs
+* when `serverConfig.forgeCloudShellMode === true` — so a non-cloud server's
+* bearer lanes never pass through here.
+*/
+function readForgeCloudOwnerBearerToken(request) {
+	const header = request.headers["authorization"];
+	if (typeof header !== "string" || !header.startsWith(BEARER_PREFIX)) return null;
+	const token = header.slice(7).trim();
+	return token.length > 0 ? token : null;
+}
 function assertionVerifierConfig(config) {
 	const publicKey = config.forgeCloudOwnerAssertionPublicKey;
 	const keyId = config.forgeCloudOwnerAssertionKeyId;
@@ -300010,7 +300203,7 @@ function authenticateForgeCloudOwnerRequest(request, config) {
 			message: "Forge Cloud owner assertion verification is misconfigured.",
 			status: 500
 		});
-		const token = request.cookies[FORGE_CLOUD_OWNER_ASSERTION_COOKIE];
+		const token = request.cookies["forge_cloud_owner_assertion"] ?? readForgeCloudOwnerBearerToken(request);
 		if (!token) return yield* new AuthError({
 			message: "Authentication required.",
 			status: 401
@@ -321069,7 +321262,7 @@ const MiscRuntimeLayerLive = mergeAll(AnalyticsServiceLayerLive, OpenLive, Serve
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(provideMerge(CheckpointingLayerLive), provideMerge(GitLayerLive), provideMerge(OrchestrationLayerLive), provideMerge(ProviderLayerLive), provideMerge(TerminalLayerLive), provideMerge(AgentBrowserManagerLive), provideMerge(mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(provide$1(ThreadDevRuntimeLive)))), provideMerge(PersistenceLayerLive), provideMerge(KeybindingsLive), provideMerge(ProviderRegistryLive), provideMerge(mergeAll(ServerSettingsLive, UsageServiceLive.pipe(provide$1(ServerSettingsLive), provide$1(UsageSessionLookupLive), provide$1(UsageRecordedSourceLive.pipe(provide$1(OrchestrationLayerLive), provide$1(RuntimeReplicationOutboxLive), provide$1(ProviderSessionRuntimeRepositoryLive), provide$1(TextGenerationSessionRepositoryLive)))))), provideMerge(WorkspaceLayerLive), provideMerge(WorkspaceReadinessStateLive), provideMerge(ProjectFaviconResolverLive), provideMerge(RepositoryIdentityResolverLive), provideMerge(ServerEnvironmentLive), provideMerge(AuthLayerLive), provideMerge(ServerSecretStoreLayerLive), provideMerge(mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(provide$1(PersistenceLayerLive)))), provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(provideMerge(RuntimeDependenciesWithoutPullRequestsLive), provideMerge(cmmdProjectIdentityResolverLive.pipe(provide$1(RuntimeDependenciesWithoutPullRequestsLive))), provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
+const makeRoutesLayer = mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, cloudOwnerSessionRedeemRouteLayer, cloudOwnerSessionRevokeRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
 const runServer = launch$1(unwrap(gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath({ preferProcessPath: config.forgeCmmdRuntimeMode === true });
@@ -321999,7 +322192,7 @@ const connectLoginCommand = make$34("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-D8mGyWmt.mjs")).default;
+			const open = (await import("./open-FIgTDosf.mjs")).default;
 			await open(url);
 			return true;
 		},