@cmmd-center/forge 0.13.46 → 0.13.48

package/dist/bin.mjs

@@ -23,7 +23,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
+import os, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -21163,7 +21163,8 @@ Literals([
 	"deprecation.notice",
 	"files.persisted",
 	"runtime.warning",
-	"runtime.error"
+	"runtime.error",
+	"codeweb.workspace.required"
 ]);
 const SessionStartedType = Literal("session.started");
 const SessionConfiguredType = Literal("session.configured");
@@ -21209,6 +21210,7 @@ const McpOauthCompletedType = Literal("mcp.oauth.completed");
 const ModelReroutedType = Literal("model.rerouted");
 const ConfigWarningType = Literal("config.warning");
 const DeprecationNoticeType = Literal("deprecation.notice");
+const CodewebWorkspaceRequiredType = Literal("codeweb.workspace.required");
 const FilesPersistedType = Literal("files.persisted");
 const RuntimeWarningType = Literal("runtime.warning");
 const RuntimeErrorType = Literal("runtime.error");
@@ -21502,6 +21504,12 @@ const DeprecationNoticePayload = Struct({
 	summary: TrimmedNonEmptyStringSchema$2,
 	details: optional$4(TrimmedNonEmptyStringSchema$2)
 });
+/**
+* CodeWeb's mint answered `workspace_required` (forge#3408): the person must
+* open the signed, single-use URL once to pick a Workspace. Forge surfaces
+* it instead of seating an unauthenticated CodeWeb server.
+*/
+const CodewebWorkspaceRequiredPayload = Struct({ chooseWorkspaceUrl: String$1 });
 const FilesPersistedPayload = Struct({
 	files: ArraySchema(Struct({
 		filename: TrimmedNonEmptyStringSchema$2,
@@ -21742,6 +21750,11 @@ Union([
 		type: DeprecationNoticeType,
 		payload: DeprecationNoticePayload
 	}),
+	Struct({
+		...ProviderRuntimeEventBase.fields,
+		type: CodewebWorkspaceRequiredType,
+		payload: CodewebWorkspaceRequiredPayload
+	}),
 	Struct({
 		...ProviderRuntimeEventBase.fields,
 		type: FilesPersistedType,
@@ -26722,12 +26735,12 @@ function encodeCmmdRuntimeThreadWorkspaceMetadata(workspace) {
 }
 //#endregion
 //#region ../../packages/contracts/src/cmmdRuntimeToolActivity.ts
-function isRecord$23(value) {
+function isRecord$24(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function encodeCmmdRuntimeToolActivityPayload(kind, payload) {
 	return {
-		...isRecord$23(payload) ? payload : { sourcePayload: payload },
+		...isRecord$24(payload) ? payload : { sourcePayload: payload },
 		forgeToolActivity: {
 			schemaVersion: 1,
 			source: "native",
@@ -26750,7 +26763,7 @@ const WORKTREE_LAUNCH_ACTIVITY_KINDS = new Set([
 ]);
 function encodeCmmdRuntimeWorktreeLaunchActivityPayload(kind, payload) {
 	return {
-		...isRecord$23(payload) ? payload : { sourcePayload: payload },
+		...isRecord$24(payload) ? payload : { sourcePayload: payload },
 		forgeWorktreeLaunchActivity: {
 			schemaVersion: 1,
 			source: "native",
@@ -26770,7 +26783,7 @@ function isCmmdRuntimeWorktreeLaunchActivityKind(kind) {
 const CMMD_RUNTIME_PLAN_ACTIVITY_KIND = "turn.plan.updated";
 function encodeCmmdRuntimePlanActivityPayload(kind, payload) {
 	return {
-		...isRecord$23(payload) ? payload : { sourcePayload: payload },
+		...isRecord$24(payload) ? payload : { sourcePayload: payload },
 		forgePlanActivity: {
 			schemaVersion: 1,
 			source: "native",
@@ -26779,15 +26792,15 @@ function encodeCmmdRuntimePlanActivityPayload(kind, payload) {
 	};
 }
 function decodeCmmdRuntimePlanActivity(payload) {
-	if (!isRecord$23(payload)) return null;
+	if (!isRecord$24(payload)) return null;
 	const metadata = payload["forgePlanActivity"];
-	if (!isRecord$23(metadata)) return null;
+	if (!isRecord$24(metadata)) return null;
 	if (metadata["schemaVersion"] !== 1 || metadata["source"] !== "native" || metadata["kind"] !== "turn.plan.updated") return null;
 	const rawPlan = payload["plan"];
 	return {
 		kind: CMMD_RUNTIME_PLAN_ACTIVITY_KIND,
 		plan: Array.isArray(rawPlan) ? rawPlan.flatMap((entry) => {
-			if (!isRecord$23(entry)) return [];
+			if (!isRecord$24(entry)) return [];
 			const step = entry["step"];
 			const status = entry["status"];
 			if (typeof step !== "string" || step.trim().length === 0) return [];
@@ -30803,13 +30816,13 @@ async function completePendingDesktopRelayIdentityRotation(input) {
 }
 //#endregion
 //#region ../../packages/relay-host/src/internal/desktopRelayJws.ts
-function isRecord$22(value) {
+function isRecord$23(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function decodeBase64UrlJson$1(value) {
 	try {
 		const decoded = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-		return isRecord$22(decoded) ? decoded : null;
+		return isRecord$23(decoded) ? decoded : null;
 	} catch {
 		return null;
 	}
@@ -30963,11 +30976,11 @@ var DesktopRelayControlPlaneError = class extends Error {
 		this.name = "DesktopRelayControlPlaneError";
 	}
 };
-function isRecord$21(value) {
+function isRecord$22(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseErrorPayload(value) {
-	return isRecord$21(value) ? value : {};
+	return isRecord$22(value) ? value : {};
 }
 function messageFromErrorPayload(payload, fallback) {
 	return typeof payload.error === "string" && payload.error.trim().length > 0 ? payload.error.trim() : fallback;
@@ -31065,7 +31078,7 @@ async function postControlPlane(input) {
 		const errorPayload = parseErrorPayload(payload);
 		throw new DesktopRelayControlPlaneError(typeof errorPayload.code === "string" && errorPayload.code.trim().length > 0 ? errorPayload.code.trim() : `CMMD_HTTP_${response.status}`, messageFromErrorPayload(errorPayload, `CMMD relay request failed (${response.status}).`), response.status === 408 || response.status === 429 || response.status >= 500);
 	}
-	if (!isRecord$21(payload) || !("data" in payload)) throw new DesktopRelayControlPlaneError("CONTROL_PLANE_INVALID_RESPONSE", "CMMD returned an invalid Forge relay response.", false);
+	if (!isRecord$22(payload) || !("data" in payload)) throw new DesktopRelayControlPlaneError("CONTROL_PLANE_INVALID_RESPONSE", "CMMD returned an invalid Forge relay response.", false);
 	return payload.data;
 }
 function resolveRegisteredDevice(input) {
@@ -50560,7 +50573,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = $U.release().split(".");
+		const osRelease = os.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53003,7 +53016,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$3 = __require("os");
+	const os$4 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53025,7 +53038,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$3.userInfo();
+				const userInfo = os$4.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -65948,7 +65961,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.46";
+var version$1 = "0.13.48";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -69417,6 +69430,7 @@ var ServerConfig = class ServerConfig extends Service$1()("forge/config/ServerCo
 			forgeCodexHomePath: void 0,
 			forgeClaudeConfigPath: void 0,
 			forgeApexBaseUrl: void 0,
+			codewebServiceToken: void 0,
 			cloudProjectsRoot: DEFAULT_CLOUD_PROJECTS_ROOT,
 			...overrides
 		};
@@ -72620,12 +72634,12 @@ function resolveDesktopRelayControlPlaneTarget(path, configuredRuntimeId) {
 		code: "RELAY_OPERATION_DENIED"
 	};
 }
-function isRecord$20(value) {
+function isRecord$21(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function relayControlPlaneBodyMatchesRuntime(path, body, configuredRuntimeId) {
 	if (path !== "/api/forge/context/devices/register") return true;
-	if (!isRecord$20(body) || !isRecord$20(body.runtime)) return false;
+	if (!isRecord$21(body) || !isRecord$21(body.runtime)) return false;
 	return body.runtime.runtimeId === configuredRuntimeId;
 }
 /** Matches the client id `connect login` used, so CMMD accepts the refresh. */
@@ -72640,7 +72654,7 @@ function forbiddenResponse() {
 	return errorResponse(403, "RELAY_BRIDGE_FORBIDDEN", "Desktop relay bridge access denied.");
 }
 function relayProxyErrorResponse(error) {
-	if (error instanceof CmmdProxyRequestError && isRecord$20(error.body)) {
+	if (error instanceof CmmdProxyRequestError && isRecord$21(error.body)) {
 		const code = typeof error.body.code === "string" ? error.body.code : error.code;
 		const message = typeof error.body.error === "string" ? error.body.error : error.detail;
 		return errorResponse(error.status >= 500 ? 502 : error.status, code, message ?? "CMMD relay coordination failed.");
@@ -75830,7 +75844,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -75838,8 +75852,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$2.arch();
-	var platform = process.env.npm_config_platform || os$2.platform();
+	var arch = process.env.npm_config_arch || os$3.arch();
+	var platform = process.env.npm_config_platform || os$3.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -77193,10 +77207,10 @@ var CheckpointDiffQuery = class extends Service$1()("forge/checkpointing/Service
 * Forge server with neither configured has no attached desktop, which is a
 * normal configuration for web and cloud — not an error.
 */
-const DEFAULT_TIMEOUT_MS$5 = 15e3;
+const DEFAULT_TIMEOUT_MS$6 = 15e3;
 function createHostBridgeComputerManager(options) {
 	const fetchImpl = options.fetchImpl ?? fetch;
-	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS$5;
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS$6;
 	return { execute: async ({ command }) => {
 		const response = await fetchImpl(`${options.url}/agent-computer/host-bridge`, {
 			method: "POST",
@@ -77347,7 +77361,7 @@ async function recordDisplayToWebm(input) {
 * permission.
 */
 const DEFAULT_DISPLAY = ":99";
-const DEFAULT_TIMEOUT_MS$4 = 15e3;
+const DEFAULT_TIMEOUT_MS$5 = 15e3;
 /** Screenshots are megabytes of PNG on stdout; the 1 MB execFile default truncates them. */
 const SCREENSHOT_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
 const TYPE_DELAY_MS = 12;
@@ -77648,7 +77662,7 @@ async function executeDisplaySurfaceCommand(command, deps) {
 }
 function createX11ComputerManager(options = {}) {
 	const display = options.display ?? DEFAULT_DISPLAY;
-	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS$4;
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS$5;
 	const runner = options.runner ?? defaultRunner(display, timeoutMs);
 	const launcher = options.launcher ?? defaultLauncher();
 	const launch = async (file, args) => {
@@ -93527,7 +93541,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-2-reBrpv.mjs"),
+		try: () => import("./open-yHTUkd2Y.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -95098,7 +95112,7 @@ const REPLICA_THREAD_STATUSES = [
 ];
 //#endregion
 //#region src/runtimeReplication/replicaDecodeModel.ts
-function isRecord$19(value) {
+function isRecord$20(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNonBlankString(value) {
@@ -95118,7 +95132,7 @@ function nullableInteger(value) {
 	return value === null || typeof value === "number" && Number.isSafeInteger(value);
 }
 function unwrapEnvelope(payload, expectedDomain) {
-	if (!isRecord$19(payload) || !isRecord$19(payload.meta) || !isRecord$19(payload.data)) return null;
+	if (!isRecord$20(payload) || !isRecord$20(payload.meta) || !isRecord$20(payload.data)) return null;
 	const { domain, timestamp, version } = payload.meta;
 	if (!isNonBlankString(domain) || expectedDomain !== void 0 && domain !== expectedDomain || version !== "1.0" || !isIsoDateTime(timestamp)) return null;
 	return payload.data;
@@ -95131,12 +95145,12 @@ function hasValidRuntimeIdentity(value) {
 	].includes(String(value.runtimeKind)) && typeof value.displayName === "string" && typeof value.status === "string";
 }
 function decodeRuntime$1(value) {
-	if (!isRecord$19(value) || !hasValidRuntimeIdentity(value)) return null;
-	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === void 0 || value.metadata === null || isRecord$19(value.metadata))) return null;
+	if (!isRecord$20(value) || !hasValidRuntimeIdentity(value)) return null;
+	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === void 0 || value.metadata === null || isRecord$20(value.metadata))) return null;
 	return value;
 }
 function decodeProject(value) {
-	if (!isRecord$19(value) || !isNonBlankString(value.projectId) || typeof value.title !== "string" || !nullableString(value.githubRepoFullName) || !nullableString(value.branch)) return null;
+	if (!isRecord$20(value) || !isNonBlankString(value.projectId) || typeof value.title !== "string" || !nullableString(value.githubRepoFullName) || !nullableString(value.branch)) return null;
 	return {
 		projectId: value.projectId,
 		title: value.title,
@@ -95145,11 +95159,11 @@ function decodeProject(value) {
 	};
 }
 function decodeThread$1(value) {
-	if (!isRecord$19(value) || !isNonBlankString(value.threadId) || typeof value.title !== "string" || !isReplicaThreadStatus(value.status) || !nullableString(value.model) || !nullableString(value.branch) || !(value.lastActivityAt === null || isIsoDateTime(value.lastActivityAt)) || !(value.metadata === void 0 || value.metadata === null || isRecord$19(value.metadata))) return null;
+	if (!isRecord$20(value) || !isNonBlankString(value.threadId) || typeof value.title !== "string" || !isReplicaThreadStatus(value.status) || !nullableString(value.model) || !nullableString(value.branch) || !(value.lastActivityAt === null || isIsoDateTime(value.lastActivityAt)) || !(value.metadata === void 0 || value.metadata === null || isRecord$20(value.metadata))) return null;
 	return value;
 }
 function decodeSummary(value) {
-	if (!isRecord$19(value) || !nullableString(value.conversationId)) return null;
+	if (!isRecord$20(value) || !nullableString(value.conversationId)) return null;
 	const project = decodeProject(value.project);
 	const thread = decodeThread$1(value.thread);
 	return project === null || thread === null ? null : {
@@ -95260,7 +95274,7 @@ function isNonNegativeInt(value) {
 /** `usage` is null for an Unreported turn, otherwise exactly the five buckets. */
 function isValidTurnUsageTokens(value) {
 	if (value === null) return true;
-	if (!isRecord$19(value)) return false;
+	if (!isRecord$20(value)) return false;
 	return turnUsageTokenKeys.every((key) => isNonNegativeInt(value[key])) && Object.keys(value).every((key) => turnUsageTokenKeys.includes(key));
 }
 /** The row itself: no text, no status, and the turn it belongs to. */
@@ -95269,7 +95283,7 @@ function hasValidTurnUsageEnvelope(value) {
 }
 /** What the row records: who ran it, what it spent, and what it says of itself. */
 function hasValidTurnUsageRecord(payload) {
-	return isRecord$19(payload) && isNonBlankString(payload.provider) && isNonBlankString(payload.model) && "usage" in payload && isValidTurnUsageTokens(payload.usage) && hasValidTurnUsageAttribution(payload);
+	return isRecord$20(payload) && isNonBlankString(payload.provider) && isNonBlankString(payload.model) && "usage" in payload && isValidTurnUsageTokens(payload.usage) && hasValidTurnUsageAttribution(payload);
 }
 /** A turn_usage row: no text, no status, and its record in `payload`. */
 function hasValidTurnUsagePayload(value) {
@@ -95306,7 +95320,7 @@ function hasValidEventPayload(value) {
 	return isNonBlankString(value.text) && value.status === null;
 }
 function decodeEvent$1(value) {
-	if (!isRecord$19(value) || !hasValidEventFields(value) || !hasValidEventPayload(value)) return null;
+	if (!isRecord$20(value) || !hasValidEventFields(value) || !hasValidEventPayload(value)) return null;
 	return value;
 }
 function decodeEvents(data) {
@@ -95327,11 +95341,11 @@ function decodeReplicaThreadDetail(payload) {
 	const thread = decodeThread$1(data.thread);
 	const reachability = decodeReachability(data.reachability);
 	const events = decodeEvents(data);
-	if (runtime === null || project === null || thread === null || reachability === null || events === null || !isRecord$19(data.execution) || typeof data.execution.available !== "boolean" || ![
+	if (runtime === null || project === null || thread === null || reachability === null || events === null || !isRecord$20(data.execution) || typeof data.execution.available !== "boolean" || ![
 		null,
 		"runtime_offline",
 		"runtime_unavailable"
-	].includes(data.execution.reason) || (data.execution.available ? data.execution.reason !== null : data.execution.reason === null) || !isRecord$19(data.replication) || data.replication.protocolVersion !== 2 || !isNonBlankString(data.replication.generationId) || !Number.isSafeInteger(data.replication.acknowledgedSequence) || Number(data.replication.acknowledgedSequence) < 0 || !isNonBlankString(data.replication.headHash)) return null;
+	].includes(data.execution.reason) || (data.execution.available ? data.execution.reason !== null : data.execution.reason === null) || !isRecord$20(data.replication) || data.replication.protocolVersion !== 2 || !isNonBlankString(data.replication.generationId) || !Number.isSafeInteger(data.replication.acknowledgedSequence) || Number(data.replication.acknowledgedSequence) < 0 || !isNonBlankString(data.replication.headHash)) return null;
 	return {
 		conversationId: data.conversationId,
 		runtime,
@@ -96406,7 +96420,7 @@ function resolveRuntimeReplicationRuntimeId(config) {
 }
 //#endregion
 //#region src/usage/providerTokenBuckets.ts
-function isRecord$18(value) {
+function isRecord$19(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function count(record, ...keys) {
@@ -96427,7 +96441,7 @@ function reportedOrNull(tokens) {
 * the app server sends camelCase.
 */
 function codexTokenBuckets(value) {
-	if (!isRecord$18(value)) return null;
+	if (!isRecord$19(value)) return null;
 	const inputTokens = count(value, "input_tokens", "inputTokens");
 	const cachedInputTokens = count(value, "cached_input_tokens", "cachedInputTokens");
 	const cacheCreationTokens = count(value, "cache_write_input_tokens", "cacheWriteInputTokens");
@@ -96446,7 +96460,7 @@ function codexTokenBuckets(value) {
 * tokens into output and does not break them out, so reasoning stays zero.
 */
 function claudeTokenBuckets(value) {
-	if (!isRecord$18(value)) return null;
+	if (!isRecord$19(value)) return null;
 	return reportedOrNull({
 		uncachedInputTokens: count(value, "input_tokens", "inputTokens"),
 		cachedInputTokens: count(value, "cache_read_input_tokens", "cacheReadInputTokens"),
@@ -97388,7 +97402,7 @@ const replicaTurnStatuses = new Set([
 	"cancelled",
 	"interrupted"
 ]);
-function isRecord$17(value) {
+function isRecord$18(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function replicaSourceSequence(value) {
@@ -97401,7 +97415,7 @@ function replicaSourceTurn(sourceTurnId) {
 	return typeof sourceTurnId === "string" && sourceTurnId.length > 0 ? { turnId: sourceTurnId } : {};
 }
 function replicaActivitySource(activity) {
-	if (!activity.kind.startsWith("replica.") || !isRecord$17(activity.payload)) return null;
+	if (!activity.kind.startsWith("replica.") || !isRecord$18(activity.payload)) return null;
 	const sourceSequence = replicaSourceSequence(activity.sequence);
 	const eventId = replicaSourceEventId(activity.payload.sourceEventId);
 	if (sourceSequence === null || eventId === null) return null;
@@ -97414,7 +97428,7 @@ function replicaActivitySource(activity) {
 }
 function replicaSummaryEvent(activity, source) {
 	if (activity.kind !== "replica.activity_summary" && activity.kind !== "replica.error_summary") return null;
-	const sourceText = isRecord$17(activity.payload) ? activity.payload.text : null;
+	const sourceText = isRecord$18(activity.payload) ? activity.payload.text : null;
 	return {
 		sourceSequence: source.sourceSequence,
 		event: {
@@ -97427,7 +97441,7 @@ function replicaSummaryEvent(activity, source) {
 	};
 }
 function replicaTurnEvent(activity, source) {
-	const status = isRecord$17(activity.payload) ? activity.payload.status : null;
+	const status = isRecord$18(activity.payload) ? activity.payload.status : null;
 	if (activity.kind !== "replica.turn_status" || !replicaTurnStatuses.has(status)) return null;
 	return {
 		sourceSequence: source.sourceSequence,
@@ -97441,7 +97455,7 @@ function replicaTurnEvent(activity, source) {
 	};
 }
 function replicaToolCallEvent(activity, source) {
-	if (activity.kind !== "replica.tool_call" || !isRecord$17(activity.payload)) return null;
+	if (activity.kind !== "replica.tool_call" || !isRecord$18(activity.payload)) return null;
 	const sourceText = activity.payload.text;
 	const status = activity.payload.status;
 	if (typeof sourceText !== "string" || typeof status !== "string") return null;
@@ -97459,9 +97473,9 @@ function replicaToolCallEvent(activity, source) {
 	};
 }
 function replicaTurnUsageEvent(activity, source) {
-	if (activity.kind !== "replica.turn_usage" || !isRecord$17(activity.payload)) return null;
+	if (activity.kind !== "replica.turn_usage" || !isRecord$18(activity.payload)) return null;
 	const usage = activity.payload.payload;
-	if (!("turnId" in source.turn) || !isRecord$17(usage)) return null;
+	if (!("turnId" in source.turn) || !isRecord$18(usage)) return null;
 	const provider = usage.provider;
 	const model = usage.model;
 	if (typeof provider !== "string" || typeof model !== "string" || !("usage" in usage)) return null;
@@ -98329,9 +98343,9 @@ function isUsageSessionLookupRuntimeNotFound(error) {
 async function isRuntimeNotFoundResponse(response) {
 	if (response.status !== 404) return false;
 	const body = await response.json().catch(() => null);
-	return isRecord$16(body) && body["code"] === "RUNTIME_NOT_FOUND";
+	return isRecord$17(body) && body["code"] === "RUNTIME_NOT_FOUND";
 }
-function isRecord$16(value) {
+function isRecord$17(value) {
 	return typeof value === "object" && value !== null;
 }
 /**
@@ -98343,11 +98357,11 @@ function isRecord$16(value) {
 * no count on the page saying so.
 */
 function decodeHeldSessions(body) {
-	const held = isRecord$16(body) && isRecord$16(body["data"]) ? body["data"]["held"] : void 0;
+	const held = isRecord$17(body) && isRecord$17(body["data"]) ? body["data"]["held"] : void 0;
 	if (!Array.isArray(held)) throw new Error("The usage session lookup returned an invalid body.");
 	return held.map((row) => {
-		const providerSessionId = isRecord$16(row) ? row["providerSessionId"] : void 0;
-		const runtimeId = isRecord$16(row) ? row["runtimeId"] : void 0;
+		const providerSessionId = isRecord$17(row) ? row["providerSessionId"] : void 0;
+		const runtimeId = isRecord$17(row) ? row["runtimeId"] : void 0;
 		if (typeof providerSessionId !== "string" || typeof runtimeId !== "string") throw new Error("The usage session lookup returned an invalid held row.");
 		return {
 			providerSessionId,
@@ -101157,7 +101171,7 @@ function emptyConfig(source, path) {
 		issues: []
 	};
 }
-function isRecord$15(value) {
+function isRecord$16(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringArray(value) {
@@ -101185,7 +101199,7 @@ function terminalsFromValue(value) {
 			name: `Terminal ${index + 1}`,
 			command: terminal.trim()
 		}];
-		if (!isRecord$15(terminal)) return [];
+		if (!isRecord$16(terminal)) return [];
 		const command = typeof terminal.command === "string" ? terminal.command.trim() : "";
 		if (!command) return [];
 		return [{
@@ -101224,7 +101238,7 @@ function readConfigFile(source, path) {
 			}]
 		};
 	}
-	if (!isRecord$15(parsed)) return {
+	if (!isRecord$16(parsed)) return {
 		...emptyConfig(source, path),
 		issues: [{
 			severity: "blocked",
@@ -102394,7 +102408,7 @@ const CLAUDE_IDENTITY_KEYS = new Set([
 	"credentialGenerationId"
 ]);
 const CLAUDE_IDENTITY_OPTIONAL_KEYS = new Set(["providerAccountIdentity"]);
-function isRecord$14(value) {
+function isRecord$15(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isStrictRfc3339DateTime(value) {
@@ -102423,7 +102437,7 @@ function hasAllowedKeys(value, required, optional) {
 	return keys.every((key) => required.has(key) || optional.has(key)) && [...required].every((key) => keys.includes(key));
 }
 function parseDeliveryIdentity(value, provider) {
-	if (!isRecord$14(value)) return null;
+	if (!isRecord$15(value)) return null;
 	if (provider === "openai") return parseCodexDeliveryIdentity(value);
 	if (provider === "anthropic") return parseClaudeDeliveryIdentity(value);
 	return null;
@@ -102458,7 +102472,7 @@ function parseClaudeDeliveryIdentity(value) {
 	};
 }
 function parseProviderRuntimeDeliveryReceipt(value, expected) {
-	if (!isRecord$14(value) || !hasExactKeys$2(value, RECEIPT_KEYS)) return null;
+	if (!isRecord$15(value) || !hasExactKeys$2(value, RECEIPT_KEYS)) return null;
 	const identity = parseDeliveryIdentity(value.identity, expected.provider);
 	if (!identity || typeof value.receiptId !== "string" || value.receiptId.length === 0 || value.receiptId.length > 256 || value.runtimeId !== expected.runtimeId || value.machineId !== expected.machineId || value.credentialEpoch !== expected.credentialEpoch || !Number.isInteger(value.credentialEpoch) || value.credentialEpoch < 0 || !isStrictRfc3339DateTime(value.issuedAt) || value.expiresAt !== expected.expiresAt || value.expiresAt !== null && !isStrictRfc3339DateTime(value.expiresAt)) return null;
 	return {
@@ -102480,8 +102494,8 @@ function providerDeliveryBindingFromReceipt(receipt) {
 	};
 }
 function readProviderDeliveryBinding(value) {
-	if (!isRecord$14(value) || !hasExactKeys$2(value, BINDING_KEYS)) return null;
-	const identityProvider = isRecord$14(value.identity) ? value.identity.provider : void 0;
+	if (!isRecord$15(value) || !hasExactKeys$2(value, BINDING_KEYS)) return null;
+	const identityProvider = isRecord$15(value.identity) ? value.identity.provider : void 0;
 	const tokenProvider = identityProvider === "codex" ? "openai" : identityProvider === "claude" ? "anthropic" : null;
 	if (!tokenProvider) return null;
 	const identity = parseDeliveryIdentity(value.identity, tokenProvider);
@@ -149815,12 +149829,12 @@ function decodeProviderKind(providerName, operation) {
 		detail: `Unknown persisted provider '${providerName}'.`
 	}));
 }
-function isRecord$13(value) {
+function isRecord$14(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function mergeRuntimePayload(existing, next) {
 	if (next === void 0) return existing ?? null;
-	if (isRecord$13(existing) && isRecord$13(next)) return {
+	if (isRecord$14(existing) && isRecord$14(next)) return {
 		...existing,
 		...next
 	};
@@ -151784,7 +151798,7 @@ const PAGINATION_KEYS = new Set([
 	"total",
 	"hasMore"
 ]);
-function isRecord$12(value) {
+function isRecord$13(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasOnlyKeys(value, allowed) {
@@ -151797,17 +151811,17 @@ function isRfc3339(value) {
 	return typeof value === "string" && RFC3339.test(value) && Number.isFinite(Date.parse(value));
 }
 function isEnvelopeMeta(value) {
-	if (!isRecord$12(value) || !hasExactKeys$1(value, META_KEYS)) return false;
+	if (!isRecord$13(value) || !hasExactKeys$1(value, META_KEYS)) return false;
 	return typeof value.domain === "string" && value.domain.length > 0 && isRfc3339(value.timestamp) && typeof value.version === "string" && value.version.length > 0;
 }
 function isPagination(value) {
-	if (!isRecord$12(value) || !hasExactKeys$1(value, PAGINATION_KEYS)) return false;
+	if (!isRecord$13(value) || !hasExactKeys$1(value, PAGINATION_KEYS)) return false;
 	return Number.isInteger(value.page) && value.page >= 0 && Number.isInteger(value.limit) && value.limit >= 0 && Number.isInteger(value.total) && value.total >= 0 && typeof value.hasMore === "boolean";
 }
 function readLocalProviderAccountId(authJson) {
 	try {
 		const value = JSON.parse(authJson);
-		if (!isRecord$12(value) || value.auth_mode !== "chatgpt" || !isRecord$12(value.tokens)) return null;
+		if (!isRecord$13(value) || value.auth_mode !== "chatgpt" || !isRecord$13(value.tokens)) return null;
 		const providerAccountId = value.tokens.account_id;
 		if (typeof providerAccountId !== "string") return null;
 		const normalized = providerAccountId.trim();
@@ -151820,13 +151834,13 @@ function resolveLocalAuthJsonPath(homePath) {
 	return join(homePath?.trim() || process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "auth.json");
 }
 function parseCodexAccountIdentityEnvelope(value) {
-	if (!isRecord$12(value) || !hasOnlyKeys(value, ENVELOPE_KEYS)) return null;
+	if (!isRecord$13(value) || !hasOnlyKeys(value, ENVELOPE_KEYS)) return null;
 	if (!("data" in value) || !("meta" in value) || !isEnvelopeMeta(value.meta)) return null;
 	if (value.pagination !== void 0 && !isPagination(value.pagination)) return null;
 	return readCodexAccountIdentity(value.data);
 }
 function readCodexAccountIdentity(value) {
-	if (!isRecord$12(value) || !hasExactKeys$1(value, IDENTITY_KEYS)) return null;
+	if (!isRecord$13(value) || !hasExactKeys$1(value, IDENTITY_KEYS)) return null;
 	if (value.kind !== "provider_account" || value.provider !== "codex" || typeof value.providerAccountIdentity !== "string" || !PROVIDER_ACCOUNT_IDENTITY$1.test(value.providerAccountIdentity)) return null;
 	return {
 		kind: "provider_account",
@@ -191045,7 +191059,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -201245,12 +201259,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$1 = "https://code.claude.com/docs/en", kKe = [
+var os$2 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$1}/iam#permission-modes`
+			docLink: `${os$2}/iam#permission-modes`
 		}
 	},
 	{
@@ -201265,7 +201279,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$1}/settings#environment-variables`
+			docLink: `${os$2}/settings#environment-variables`
 		}
 	},
 	{
@@ -201276,14 +201290,14 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$1}/hooks`
+			docLink: `${os$2}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$1}/hooks#exec-form-and-shell-form`
+			docLink: `${os$2}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -201298,7 +201312,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$1}/settings`
+			docLink: `${os$2}/settings`
 		}
 	},
 	{
@@ -201313,13 +201327,13 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$1}/iam#working-directories`
+			docLink: `${os$2}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$1}/iam#configuring-permissions`,
-	env: `${os$1}/settings#environment-variables`,
-	hooks: `${os$1}/hooks`
+	permissions: `${os$2}/iam#configuring-permissions`,
+	env: `${os$2}/settings#environment-variables`,
+	hooks: `${os$2}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -211104,7 +211118,7 @@ function isShellSafeCommandPath(command) {
 }
 //#endregion
 //#region src/provider/providerSnapshot.ts
-const DEFAULT_TIMEOUT_MS$3 = 4e3;
+const DEFAULT_TIMEOUT_MS$4 = 4e3;
 function resolveForgeBrowserSkillPath(cwd = process.cwd()) {
 	const candidates = [
 		Path$1.resolve(cwd, ".agents/skills/browser/SKILL.md"),
@@ -213598,8 +213612,8 @@ function cliSelectsOsStore(input) {
 	if (input.env[CLAUDE_FORCE_OS_CREDENTIAL_STORE_ENV] === "1") return true;
 	const config = readConfig(input);
 	if (config === null) return false;
-	const features = isRecord$11(config.parsed) ? config.parsed[CACHED_FEATURES_KEY] : void 0;
-	const flag = isRecord$11(features) ? features[OS_STORE_FLAG_KEY] : void 0;
+	const features = isRecord$12(config.parsed) ? config.parsed[CACHED_FEATURES_KEY] : void 0;
+	const flag = isRecord$12(features) ? features[OS_STORE_FLAG_KEY] : void 0;
 	return typeof flag === "boolean" ? flag : null;
 }
 /**
@@ -213627,7 +213641,7 @@ function hasSessionBus(input) {
 	const runtimeDirectory = input.env.XDG_RUNTIME_DIR?.trim();
 	return runtimeDirectory ? input.fileExists(join(runtimeDirectory, "bus")) : false;
 }
-function isRecord$11(value) {
+function isRecord$12(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
@@ -214298,7 +214312,7 @@ const checkClaudeProviderStatus = fn$1("checkClaudeProviderStatus")(function* (r
 	const capabilitiesProbeInput = claudeCapabilitiesProbeInput(claudeSettings.binaryPath, effectiveConfigPath);
 	const discovery = yield* resolveClaudeDiscovery(capabilitiesProbeInput, resolveSlashCommands, resolveModels);
 	const models = modelsForClaudeCliVersion(providerModelsFromSettings(resolveClaudeProviderModels(discovery.models), PROVIDER$12, claudeSettings.customModels, DEFAULT_CLAUDE_MODEL_CAPABILITIES, endpointProfileDisplayNames(claudeSettings)), parsedVersion);
-	const authProbe = yield* runClaudeCommand(["auth", "status"]).pipe(timeoutOption(DEFAULT_TIMEOUT_MS$3), result);
+	const authProbe = yield* runClaudeCommand(["auth", "status"]).pipe(timeoutOption(DEFAULT_TIMEOUT_MS$4), result);
 	return yield* withClaudeCredentialAnswers(buildClaudeProviderFromAuthProbe({
 		authProbe,
 		authMetadata: yield* resolveClaudeAuthMetadata(authProbe, capabilitiesProbeInput, resolveSubscriptionType),
@@ -214344,7 +214358,7 @@ const makePendingClaudeProvider = (claudeSettings) => {
 * A refresh can wait behind a check that already holds the provider's refresh
 * permit before running its own, so it gets two check budgets.
 */
-const CREDENTIAL_ANSWER_REFRESH_TIMEOUT_MS = 2 * (CLAUDE_VERSION_PROBE_TIMEOUT_MS + CAPABILITIES_PROBE_TIMEOUT_MS$1 + DEFAULT_TIMEOUT_MS$3);
+const CREDENTIAL_ANSWER_REFRESH_TIMEOUT_MS = 2 * (CLAUDE_VERSION_PROBE_TIMEOUT_MS + CAPABILITIES_PROBE_TIMEOUT_MS$1 + DEFAULT_TIMEOUT_MS$4);
 /** The gap after each answer refresh, and the pause before a restart. */
 const CREDENTIAL_ANSWER_REFRESH_SPACING = seconds(1);
 /**
@@ -214509,6 +214523,114 @@ function resolveCodewebMcpEnabled(input) {
 	return input.grant ? input.grant.enabled : input.setting;
 }
 //#endregion
+//#region src/codeweb/AgentTokenMint.ts
+/**
+* CodeWeb Agent Token mint client (forge#3408; contract CodeWeb#175/#179).
+*
+* ADR-011: the person never runs a browser dance for tokens when the mint
+* succeeds. Forge mints silently at session construction with the shared
+* service credential and the caller's CMMD identity, and holds the returned
+* plaintext only in memory for that session — CodeWeb returns it exactly
+* once and this module never logs it.
+*
+* Every failure mode folds into a closed result union instead of throwing:
+* a CodeWeb outage must never fail (or even delay beyond the timeout) a
+* session start.
+*
+* @module AgentTokenMint
+*/
+/** The mint endpoint lives beside the MCP server on the same CodeWeb host. */
+const CODEWEB_MINT_URL = new URL("/forge/agent-tokens", CODEWEB_MCP_SERVER_URL).toString();
+/** Bounded so a CodeWeb outage cannot stall session construction (ADR-011). */
+const DEFAULT_TIMEOUT_MS$3 = 3e3;
+function createCodewebAgentTokenMintClient(input) {
+	const fetchImpl = input.fetchImpl ?? fetch;
+	const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS$3;
+	return { mint: async ({ cmmdUserId }) => {
+		try {
+			const response = await fetchImpl(CODEWEB_MINT_URL, {
+				method: "POST",
+				headers: {
+					"X-Forge-Service-Token": input.serviceToken,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify({ cmmd_user_id: cmmdUserId }),
+				signal: AbortSignal.timeout(timeoutMs)
+			});
+			return parseMintResponse(response.status, await response.json());
+		} catch {
+			return { status: "unavailable" };
+		}
+	} };
+}
+function parseMintResponse(httpStatus, body) {
+	if (httpStatus === 404) return { status: "unknown_identity" };
+	if (!isRecord$11(body)) return { status: "unavailable" };
+	if (body["status"] === "minted" && typeof body["token"] === "string") return {
+		status: "minted",
+		token: body["token"]
+	};
+	if (body["status"] === "already_issued") return { status: "already_issued" };
+	if (body["status"] === "workspace_required" && typeof body["choose_workspace_url"] === "string") return {
+		status: "workspace_required",
+		chooseWorkspaceUrl: body["choose_workspace_url"]
+	};
+	return { status: "unavailable" };
+}
+function isRecord$11(value) {
+	return typeof value === "object" && value !== null;
+}
+//#endregion
+//#region src/codeweb/CodewebMcpSessionAuth.ts
+/**
+* Per-session CodeWeb MCP auth decision (forge#3408).
+*
+* Runs once at session construction when the CodeWeb injection is enabled:
+* resolves the owning CMMD identity for the thread, mints an Agent Token
+* with the shared service credential, and classifies the outcome. The
+* classification decides what the provider surfaces:
+*
+*  - `authorized` — carry `Authorization: Bearer <token>` on the entry.
+*  - `ungated` — register without credentials: no CMMD identity or service
+*    credential is available (local/dev), or CodeWeb already issued a token
+*    Forge does not hold (`already_issued`, `unknown_identity`). The
+*    client-side MCP OAuth challenge (CodeWeb#22) is the recovery path that
+*    keeps tools usable in the same session.
+*  - `workspace_required` — omit the entry and surface the one-time
+*    choose-your-Workspace link instead. Registering an unauthenticated
+*    server for a user who provably cannot authenticate would only burn
+*    agent turns on 401s; the surfaced link is the actionable step, and the
+*    next session mints silently.
+*  - `omitted` — the mint endpoint was unreachable or answered unexpectedly.
+*    Fail closed to no entry for this session: a broken mint must not seat a
+*    permanently-failing server in every session. ADR-011: session start
+*    never depends on CodeWeb being up.
+*
+* @module CodewebMcpSessionAuth
+*/
+function resolveCodewebMcpInjection(input) {
+	if (!input.enabled) return succeed({ kind: "disabled" });
+	const ownerSessionId = readThreadSessionId(input.threadId);
+	const cmmdUserId = ownerSessionId === null ? null : readCmmdUserIdentityForSession(ownerSessionId)?.id ?? null;
+	if (cmmdUserId === null || input.serviceToken === void 0) return succeed({ kind: "ungated" });
+	const mintClient = input.mintClient ?? createCodewebAgentTokenMintClient({ serviceToken: input.serviceToken });
+	return promise(() => mintClient.mint({ cmmdUserId })).pipe(map$3((mint) => {
+		switch (mint.status) {
+			case "minted": return {
+				kind: "authorized",
+				bearerToken: mint.token
+			};
+			case "workspace_required": return {
+				kind: "workspace_required",
+				chooseWorkspaceUrl: mint.chooseWorkspaceUrl
+			};
+			case "already_issued":
+			case "unknown_identity": return { kind: "ungated" };
+			case "unavailable": return { kind: "omitted" };
+		}
+	}));
+}
+//#endregion
 //#region src/cmmdData/cmmdContextMcpServer.ts
 /**
 * CMMD Context MCP server (in-process, read-only).
@@ -215385,14 +215507,30 @@ function buildClaudeMcpServers(input) {
 		[GITHUB_MCP_SERVER_NAME]: createGitHubMcpServer(input.runBrokeredGitHubTool, input.threadId, input.serverSettings),
 		...input.computerManager ? { [COMPUTER_MCP_SERVER_NAME]: createComputerMcpServer(input.computerManager, input.threadId) } : {},
 		...input.cmmdSidekickTools ? { "cmmd-sidekick-tools": createCmmdSidekickToolsMcpServer(input.cmmdSidekickTools.session, input.cmmdSidekickTools.tools) } : {},
-		...resolveCodewebMcpEnabled({
-			grant: input.codewebMcpGrant,
-			setting: input.serverSettings.codewebMcp
-		}) ? { [CODEWEB_MCP_SERVER_NAME]: {
+		...codewebEntryForInjection(input.codewebMcpInjection)
+	};
+}
+/**
+* CodeWeb entry per the session auth decision: `authorized` carries the
+* minted Agent Token (plaintext appears exactly once, held in memory for
+* this session); `ungated` registers without credentials so the client-side
+* MCP OAuth challenge can run; `workspace_required` and `omitted` seat
+* nothing — the surfaced link and the next session's mint retry are the
+* recovery paths.
+*/
+function codewebEntryForInjection(injection) {
+	switch (injection.kind) {
+		case "authorized": return { [CODEWEB_MCP_SERVER_NAME]: {
+			type: "http",
+			url: CODEWEB_MCP_SERVER_URL,
+			headers: { Authorization: `Bearer ${injection.bearerToken}` }
+		} };
+		case "ungated": return { [CODEWEB_MCP_SERVER_NAME]: {
 			type: "http",
 			url: CODEWEB_MCP_SERVER_URL
-		} } : {}
-	};
+		} };
+		default: return {};
+	}
 }
 function claudeQueryWorkingDirectoryOptions(cwd) {
 	return cwd ? {
@@ -217631,6 +217769,25 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			detail: error.message,
 			cause: error
 		})));
+		const codewebMcpInjection = yield* resolveCodewebMcpInjection({
+			enabled: resolveCodewebMcpEnabled({
+				grant: cmmdSidekickResolution.codewebMcpGrant,
+				setting: serverSettings.codewebMcp
+			}),
+			threadId,
+			serviceToken: serverConfig.codewebServiceToken
+		});
+		if (codewebMcpInjection.kind === "workspace_required") {
+			const stamp = yield* makeEventStamp();
+			yield* offerRuntimeEvent({
+				type: "codeweb.workspace.required",
+				eventId: stamp.eventId,
+				provider: PROVIDER$11,
+				createdAt: stamp.createdAt,
+				threadId,
+				payload: { chooseWorkspaceUrl: codewebMcpInjection.chooseWorkspaceUrl }
+			});
+		}
 		const claudeSettings = serverSettings.providers.claudeAgent;
 		const claudeBinaryPath = claudeSettings.binaryPath;
 		const { selectedAccountIdentity, claudeCredentialDirectory } = yield* resolveSelectedCredentialDirectory(input, resumeState, claudeBinaryPath);
@@ -217671,7 +217828,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			resolveCmmdPat,
 			devServerToolDeps,
 			cmmdSidekickTools: cmmdSidekickResolution.registration,
-			codewebMcpGrant: cmmdSidekickResolution.codewebMcpGrant,
+			codewebMcpInjection,
 			runBrokeredGitHubTool,
 			serverSettings
 		}), threadId);
@@ -222491,7 +222648,10 @@ function buildAcpMcpServers(input) {
 		type: "http",
 		name: CODEWEB_MCP_SERVER_NAME,
 		url: CODEWEB_MCP_SERVER_URL,
-		headers: []
+		headers: input.codewebBearerToken ? [{
+			name: "Authorization",
+			value: `Bearer ${input.codewebBearerToken}`
+		}] : []
 	}];
 }
 var AcpSessionRuntime = class AcpSessionRuntime extends Service$1()("forge/provider/acp/AcpSessionRuntime") {
@@ -223006,7 +223166,7 @@ const checkCursorProviderStatus = fn$1("checkCursorProviderStatus")(function* ()
 			message: "Cursor is disabled in Forge settings."
 		}
 	});
-	const versionProbe = yield* runCursorCommand(cursorSettings.binaryPath, ["--version"]).pipe(timeoutOption(DEFAULT_TIMEOUT_MS$3), result);
+	const versionProbe = yield* runCursorCommand(cursorSettings.binaryPath, ["--version"]).pipe(timeoutOption(DEFAULT_TIMEOUT_MS$4), result);
 	if (isFailure$1(versionProbe)) {
 		const error = versionProbe.failure;
 		return buildServerProvider({
@@ -269300,7 +269460,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -269431,14 +269591,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -269446,7 +269606,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -289189,6 +289349,16 @@ function runtimeStatusEventToActivities(event) {
 			summary: "Runtime error",
 			payload: { message: truncateDetail(event.payload.message) }
 		}];
+		case "codeweb.workspace.required": return [{
+			...activityBase(event),
+			tone: "info",
+			kind: "codeweb.workspace.required",
+			summary: "CodeWeb: choose your Workspace to enable its tools",
+			payload: {
+				detail: `One-time setup: open ${event.payload.chooseWorkspaceUrl} to choose your CodeWeb Workspace, then retry.`,
+				chooseWorkspaceUrl: event.payload.chooseWorkspaceUrl
+			}
+		}];
 		case "runtime.warning": return [{
 			...activityBase(event),
 			tone: "info",
@@ -294078,7 +294248,7 @@ const checkOpenCodeProviderStatus = fn$1("checkOpenCodeProviderStatus")(function
 			message: "OpenCode is disabled in Forge settings."
 		}
 	});
-	const versionProbe = yield* runOpenCodeCommand(opencodeSettings.binaryPath, ["--version"]).pipe(timeoutOption(DEFAULT_TIMEOUT_MS$3), result);
+	const versionProbe = yield* runOpenCodeCommand(opencodeSettings.binaryPath, ["--version"]).pipe(timeoutOption(DEFAULT_TIMEOUT_MS$4), result);
 	if (isFailure$1(versionProbe)) {
 		const error = versionProbe.failure;
 		return buildServerProvider({
@@ -297340,7 +297510,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "94219ed51a87e35a63d9bdc1b81bfe21c7977c17";
+	return "3d38f5e907e83b83422e19db2ab78ada5d96f94a";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -321329,6 +321499,7 @@ const EnvServerConfig = all$1({
 	forgeCodexHomePath: string$7("FORGE_CODEX_HOME").pipe(option$1, map$8(getOrUndefined)),
 	forgeClaudeConfigPath: string$7("FORGE_CLAUDE_CONFIG_PATH").pipe(option$1, map$8(getOrUndefined)),
 	forgeApexBaseUrl: string$7("FORGE_APEX_BASE_URL").pipe(option$1, map$8(getOrUndefined)),
+	codewebServiceToken: string$7("FORGE_CODEWEB_SERVICE_TOKEN").pipe(option$1, map$8(getOrUndefined)),
 	browserWebRtcIceServers: string$7("FORGE_BROWSER_WEBRTC_ICE_SERVERS").pipe(option$1, map$8(getOrUndefined)),
 	browserWebRtcCloudflareTurnKeyId: string$7("FORGE_BROWSER_WEBRTC_CLOUDFLARE_TURN_KEY_ID").pipe(option$1, map$8(getOrUndefined)),
 	browserWebRtcCloudflareTurnKeyApiToken: string$7("FORGE_BROWSER_WEBRTC_CLOUDFLARE_TURN_KEY_API_TOKEN").pipe(option$1, map$8(getOrUndefined)),
@@ -321523,6 +321694,7 @@ const resolveServerConfig = (flags, cliLogLevel, options) => gen(function* () {
 		forgeCodexHomePath: env.forgeCodexHomePath,
 		forgeClaudeConfigPath: env.forgeClaudeConfigPath,
 		forgeApexBaseUrl: env.forgeApexBaseUrl,
+		codewebServiceToken: env.codewebServiceToken,
 		cloudProjectsRoot: env.cloudProjectsRoot ?? "/projects"
 	};
 	if (config.forgeCloudShellMode === true && (!config.forgeCloudOwnerAssertionPublicKey?.trim() || !config.forgeCloudOwnerAssertionKeyId?.trim())) return yield* die$1(/* @__PURE__ */ new Error("FORGE_CMMD_CLOUD_OWNER_ASSERTION_PUBLIC_KEY and FORGE_CMMD_CLOUD_OWNER_ASSERTION_KEY_ID are required in cloud-shell mode; runtime ticket keys are not accepted for Cloud owner assertions."));
@@ -321631,16 +321803,16 @@ const findActiveProjectTarget = fn$1("findActiveProjectTarget")(function* (input
 		workspaceRoot: resolved.workspaceRoot
 	};
 });
-const fetchLiveOrchestrationSnapshot = (origin, bearerToken$1) => runLiveServerRequest(get$7(`${origin}/api/orchestration/snapshot`).pipe(acceptJson, bearerToken(bearerToken$1)), matchStatus({
+const fetchLiveOrchestrationSnapshot = (origin, bearerToken$2) => runLiveServerRequest(get$7(`${origin}/api/orchestration/snapshot`).pipe(acceptJson, bearerToken(bearerToken$2)), matchStatus({
 	"2xx": decodeOrchestrationReadModelResponse,
 	orElse: (response) => readErrorMessageFromResponse(response).pipe(flatMap((message) => fail(new Error(message))))
 }));
 const ProjectLeadExplanationEnvelope = Struct({ data: ProjectLeadExplanationSchema });
-const fetchLiveProjectLeadExplanation = (origin, bearerToken$3, projectId) => runLiveServerRequest(get$7(`${origin}/api/cmmd/projects/${projectId}/project-lead/explain`).pipe(acceptJson, bearerToken(bearerToken$3)), matchStatus({
+const fetchLiveProjectLeadExplanation = (origin, bearerToken$1, projectId) => runLiveServerRequest(get$7(`${origin}/api/cmmd/projects/${projectId}/project-lead/explain`).pipe(acceptJson, bearerToken(bearerToken$1)), matchStatus({
 	"2xx": (response) => schemaBodyJson$1(ProjectLeadExplanationEnvelope)(response).pipe(map$3((body) => body.data)),
 	orElse: (response) => readErrorMessageFromResponse(response).pipe(flatMap((message) => fail(new Error(message))))
 }));
-const dispatchLiveOrchestrationCommand = (origin, bearerToken$2, command) => post(`${origin}/api/orchestration/dispatch`).pipe(acceptJson, bearerToken(bearerToken$2), bodyJson(command), flatMap((request) => runLiveServerRequest(request, matchStatus({
+const dispatchLiveOrchestrationCommand = (origin, bearerToken$3, command) => post(`${origin}/api/orchestration/dispatch`).pipe(acceptJson, bearerToken(bearerToken$3), bodyJson(command), flatMap((request) => runLiveServerRequest(request, matchStatus({
 	"2xx": () => void_$1,
 	orElse: (response) => readErrorMessageFromResponse(response).pipe(flatMap((message) => fail(new Error(message))))
 }))));
@@ -321941,7 +322113,7 @@ const connectLoginCommand = make$34("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-2-reBrpv.mjs")).default;
+			const open = (await import("./open-yHTUkd2Y.mjs")).default;
 			await open(url);
 			return true;
 		},