@cmmd-center/forge 0.13.49 → 0.13.50

package/dist/bin.cjs

@@ -66257,7 +66257,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.49";
+var version$1 = "0.13.50";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -89213,6 +89213,13 @@ function errorFromBody(body, fallback) {
 	}
 	return fallback;
 }
+function codeFromBody(body) {
+	if (body && typeof body === "object") {
+		const code = body["code"];
+		if (typeof code === "string") return code;
+	}
+	return null;
+}
 function shouldRefreshCmmdBrokerJwt(status) {
 	return status === 401 || status === 403;
 }
@@ -89335,9 +89342,10 @@ var GitHubBroker = class {
 		} : auth);
 	}
 	async status(auth) {
-		const grant = this.resolveRuntimeGrant();
-		if (grant) return this.cmmdRuntimeJson(grant, "status");
-		return this.cmmdJson(auth, "/api/github-oauth/status");
+		return this.cmmdRequest(auth, {
+			jwtPath: "/api/github-oauth/status",
+			runtimeResource: "status"
+		});
 	}
 	async workspaceStatus(input) {
 		const cwdValidation = validateCwd(input.cwd);
@@ -89526,12 +89534,16 @@ var GitHubBroker = class {
 	async listRepositories(auth, input = {}) {
 		const search = new URLSearchParams();
 		if (input.search?.trim()) search.set("search", input.search.trim());
-		const grant = this.resolveRuntimeGrant();
-		if (grant) return this.cmmdRuntimeJson(grant, "repos", { search: search.size > 0 ? search : void 0 });
-		return this.cmmdJson(auth, "/api/forge/github/repos", { search: search.size > 0 ? search : void 0 });
+		return this.cmmdRequest(auth, {
+			jwtPath: "/api/forge/github/repos",
+			runtimeResource: "repos",
+			search: search.size > 0 ? search : void 0
+		});
 	}
 	async createRepository(auth, input) {
-		return this.cmmdJson(auth, "/api/forge/github/repos", {
+		return this.cmmdRequest(auth, {
+			jwtPath: "/api/forge/github/repos",
+			runtimeResource: "repos",
 			method: "POST",
 			body: {
 				owner: input.owner,
@@ -90191,6 +90203,21 @@ var GitHubBroker = class {
 			}
 		};
 	}
+	/**
+	* The only way this broker calls CMMD as the person. Every operation names
+	* both routes, because a managed runtime acts on its runtime grant and never
+	* on a user JWT (CMMD ADR-015): it holds no refreshable JWT, so the JWT path
+	* there reports a session expiry that signing in cannot fix. A cloud runtime
+	* with no usable grant fails closed. Desktop and local keep the JWT path.
+	*/
+	async cmmdRequest(auth, operation) {
+		const { jwtPath, runtimeResource, ...options } = operation;
+		const grant = this.resolveRuntimeGrant();
+		if (grant) return this.cmmdRuntimeJson(grant, runtimeResource, options);
+		const missingGrantFailure = this.missingRuntimeGrantFailure();
+		if (missingGrantFailure) return missingGrantFailure;
+		return this.cmmdJson(auth, jwtPath, options);
+	}
 	async cmmdJson(auth, path, options = {}) {
 		const jwt = await this.resolveJwt(auth);
 		if (!jwt) return {
@@ -90275,6 +90302,22 @@ var GitHubBroker = class {
 			token: token.trim()
 		};
 	}
+	/**
+	* A cloud runtime with no usable grant must not fall back to the person's JWT.
+	* `githubWriteIdentity: "my-account"` is the deliberate opposite choice for git
+	* credentials, so those paths pass `allowMyAccount`.
+	*/
+	missingRuntimeGrantFailure(options = {}) {
+		if (options.allowMyAccount && this.githubWriteIdentity === "my-account") return null;
+		const failure = classifyMissingRuntimeGrant({
+			isCmmdCloudRuntimeMode: this.isCmmdCloudRuntimeMode,
+			hasRuntimeGrant: false
+		});
+		return failure ? {
+			ok: false,
+			...failure
+		} : null;
+	}
 	async resolveInstallationToken(auth, repoFullName) {
 		const runtimeGrant = this.resolveRuntimeGrant("github");
 		if (runtimeGrant) {
@@ -90282,6 +90325,8 @@ var GitHubBroker = class {
 			if (!token.ok) return token;
 			return token.token ?? invalidInstallationTokenResult();
 		}
+		const missingGrantFailure = this.missingRuntimeGrantFailure({ allowMyAccount: true });
+		if (missingGrantFailure) return missingGrantFailure;
 		const jwt = await this.resolveJwt(auth);
 		if (!jwt) return cmmdReauthRequiredResult();
 		let token = await this.fetchInstallationToken(jwt, repoFullName);
@@ -90636,16 +90681,8 @@ var GitHubBroker = class {
 				repoFullName
 			};
 		}
-		const missingGrantFailure = this.githubWriteIdentity === "my-account" ? null : classifyMissingRuntimeGrant({
-			isCmmdCloudRuntimeMode: this.isCmmdCloudRuntimeMode,
-			hasRuntimeGrant: runtimeGrant !== null
-		});
-		if (missingGrantFailure) return {
-			ok: false,
-			code: missingGrantFailure.code,
-			userActionRequired: missingGrantFailure.userActionRequired,
-			error: missingGrantFailure.error
-		};
+		const missingGrantFailure = this.missingRuntimeGrantFailure({ allowMyAccount: true });
+		if (missingGrantFailure) return missingGrantFailure;
 		const jwt = await this.resolveJwt(auth);
 		if (!jwt) return cmmdReauthRequiredResult();
 		let token = await this.fetchInstallationToken(jwt, repoFullName);
@@ -90710,7 +90747,7 @@ var GitHubBroker = class {
 		};
 	}
 	/**
-	* GET a grant-authenticated GitHub read endpoint from inside a managed runtime. The
+	* Call a grant-authenticated GitHub endpoint from inside a managed runtime. The
 	* runtime grant token (scope `github`) stands in for the user JWT — CMMD
 	* resolves identity server-side and returns the same body as the JWT routes,
 	* so callers get an identical `GitHubBrokerResult`. `resource` is the trailing
@@ -90719,18 +90756,21 @@ var GitHubBroker = class {
 	*/
 	async cmmdRuntimeJson(grant, resource, options = {}) {
 		const response = await this.fetchImpl(makeUrl(this.commandAppUrl, `/api/forge/runtimes/${encodeURIComponent(grant.runtimeId)}/github/${resource}`, options.search), {
-			method: "GET",
-			headers: { Authorization: `Bearer ${grant.token}` }
-		});
-		const body = await parseResponseBody(response);
-		if (!response.ok) return {
+			method: options.method ?? "GET",
+			headers: {
+				Authorization: `Bearer ${grant.token}`,
+				...options.body !== void 0 ? { "Content-Type": "application/json" } : {}
+			},
+			...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
+			signal: AbortSignal.timeout(GITHUB_BROKER_REQUEST_TIMEOUT_MS)
+		}).catch(() => null);
+		if (response === null) return {
 			ok: false,
-			status: response.status,
-			code: response.status === 401 ? "GITHUB_AUTH_REQUIRED" : "GITHUB_BROKER_REQUEST_FAILED",
-			...response.status === 401 ? { userActionRequired: "connect_github" } : {},
-			error: errorFromBody(body, `GitHub runtime request failed with status ${response.status}.`),
-			data: body
+			code: "GITHUB_BROKER_REQUEST_FAILED",
+			error: "CMMD could not be reached for this GitHub request. Retry in a moment."
 		};
+		const body = await parseResponseBody(response);
+		if (!response.ok) return runtimeGrantRequestFailure(response.status, body);
 		return {
 			ok: true,
 			status: response.status,
@@ -90857,6 +90897,34 @@ function parseWorkspaceStatus(stdout) {
 function isGitHubCliCredential(value) {
 	return "token" in value && "repoFullName" in value;
 }
+function runtimeGrantRequestFailure(status, body) {
+	const cmmdCode = codeFromBody(body);
+	const grantFailure = cmmdCode?.startsWith("RUNTIME_GRANT_") ? classifyMissingRuntimeGrant({
+		isCmmdCloudRuntimeMode: true,
+		hasRuntimeGrant: false
+	}) : null;
+	if (grantFailure) return {
+		ok: false,
+		status,
+		...grantFailure,
+		data: body
+	};
+	if (status === 401) return {
+		ok: false,
+		status,
+		code: "GITHUB_AUTH_REQUIRED",
+		userActionRequired: "connect_github",
+		error: errorFromBody(body, `GitHub runtime request failed with status ${status}.`),
+		data: body
+	};
+	return {
+		ok: false,
+		status,
+		code: cmmdCode ?? "GITHUB_BROKER_REQUEST_FAILED",
+		error: errorFromBody(body, `GitHub runtime request failed with status ${status}.`),
+		data: body
+	};
+}
 function cmmdReauthRequiredResult() {
 	return {
 		ok: false,
@@ -298065,7 +298133,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "efe4f61b3d4a7de342d1d80983113ff48dd26235";
+	return "64478cf3c507c24bc59b83783ca2eb2ddd93de2c";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;

package/dist/bin.mjs

@@ -23,7 +23,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
+import os, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -50573,7 +50573,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = $U.release().split(".");
+		const osRelease = os.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53016,7 +53016,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$3 = __require("os");
+	const os$4 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53038,7 +53038,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$3.userInfo();
+				const userInfo = os$4.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -65961,7 +65961,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.49";
+var version$1 = "0.13.50";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -75844,7 +75844,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -75852,8 +75852,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$2.arch();
-	var platform = process.env.npm_config_platform || os$2.platform();
+	var arch = process.env.npm_config_arch || os$3.arch();
+	var platform = process.env.npm_config_platform || os$3.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -88857,6 +88857,13 @@ function errorFromBody(body, fallback) {
 	}
 	return fallback;
 }
+function codeFromBody(body) {
+	if (body && typeof body === "object") {
+		const code = body["code"];
+		if (typeof code === "string") return code;
+	}
+	return null;
+}
 function shouldRefreshCmmdBrokerJwt(status) {
 	return status === 401 || status === 403;
 }
@@ -88979,9 +88986,10 @@ var GitHubBroker = class {
 		} : auth);
 	}
 	async status(auth) {
-		const grant = this.resolveRuntimeGrant();
-		if (grant) return this.cmmdRuntimeJson(grant, "status");
-		return this.cmmdJson(auth, "/api/github-oauth/status");
+		return this.cmmdRequest(auth, {
+			jwtPath: "/api/github-oauth/status",
+			runtimeResource: "status"
+		});
 	}
 	async workspaceStatus(input) {
 		const cwdValidation = validateCwd(input.cwd);
@@ -89170,12 +89178,16 @@ var GitHubBroker = class {
 	async listRepositories(auth, input = {}) {
 		const search = new URLSearchParams();
 		if (input.search?.trim()) search.set("search", input.search.trim());
-		const grant = this.resolveRuntimeGrant();
-		if (grant) return this.cmmdRuntimeJson(grant, "repos", { search: search.size > 0 ? search : void 0 });
-		return this.cmmdJson(auth, "/api/forge/github/repos", { search: search.size > 0 ? search : void 0 });
+		return this.cmmdRequest(auth, {
+			jwtPath: "/api/forge/github/repos",
+			runtimeResource: "repos",
+			search: search.size > 0 ? search : void 0
+		});
 	}
 	async createRepository(auth, input) {
-		return this.cmmdJson(auth, "/api/forge/github/repos", {
+		return this.cmmdRequest(auth, {
+			jwtPath: "/api/forge/github/repos",
+			runtimeResource: "repos",
 			method: "POST",
 			body: {
 				owner: input.owner,
@@ -89835,6 +89847,21 @@ var GitHubBroker = class {
 			}
 		};
 	}
+	/**
+	* The only way this broker calls CMMD as the person. Every operation names
+	* both routes, because a managed runtime acts on its runtime grant and never
+	* on a user JWT (CMMD ADR-015): it holds no refreshable JWT, so the JWT path
+	* there reports a session expiry that signing in cannot fix. A cloud runtime
+	* with no usable grant fails closed. Desktop and local keep the JWT path.
+	*/
+	async cmmdRequest(auth, operation) {
+		const { jwtPath, runtimeResource, ...options } = operation;
+		const grant = this.resolveRuntimeGrant();
+		if (grant) return this.cmmdRuntimeJson(grant, runtimeResource, options);
+		const missingGrantFailure = this.missingRuntimeGrantFailure();
+		if (missingGrantFailure) return missingGrantFailure;
+		return this.cmmdJson(auth, jwtPath, options);
+	}
 	async cmmdJson(auth, path, options = {}) {
 		const jwt = await this.resolveJwt(auth);
 		if (!jwt) return {
@@ -89919,6 +89946,22 @@ var GitHubBroker = class {
 			token: token.trim()
 		};
 	}
+	/**
+	* A cloud runtime with no usable grant must not fall back to the person's JWT.
+	* `githubWriteIdentity: "my-account"` is the deliberate opposite choice for git
+	* credentials, so those paths pass `allowMyAccount`.
+	*/
+	missingRuntimeGrantFailure(options = {}) {
+		if (options.allowMyAccount && this.githubWriteIdentity === "my-account") return null;
+		const failure = classifyMissingRuntimeGrant({
+			isCmmdCloudRuntimeMode: this.isCmmdCloudRuntimeMode,
+			hasRuntimeGrant: false
+		});
+		return failure ? {
+			ok: false,
+			...failure
+		} : null;
+	}
 	async resolveInstallationToken(auth, repoFullName) {
 		const runtimeGrant = this.resolveRuntimeGrant("github");
 		if (runtimeGrant) {
@@ -89926,6 +89969,8 @@ var GitHubBroker = class {
 			if (!token.ok) return token;
 			return token.token ?? invalidInstallationTokenResult();
 		}
+		const missingGrantFailure = this.missingRuntimeGrantFailure({ allowMyAccount: true });
+		if (missingGrantFailure) return missingGrantFailure;
 		const jwt = await this.resolveJwt(auth);
 		if (!jwt) return cmmdReauthRequiredResult();
 		let token = await this.fetchInstallationToken(jwt, repoFullName);
@@ -90280,16 +90325,8 @@ var GitHubBroker = class {
 				repoFullName
 			};
 		}
-		const missingGrantFailure = this.githubWriteIdentity === "my-account" ? null : classifyMissingRuntimeGrant({
-			isCmmdCloudRuntimeMode: this.isCmmdCloudRuntimeMode,
-			hasRuntimeGrant: runtimeGrant !== null
-		});
-		if (missingGrantFailure) return {
-			ok: false,
-			code: missingGrantFailure.code,
-			userActionRequired: missingGrantFailure.userActionRequired,
-			error: missingGrantFailure.error
-		};
+		const missingGrantFailure = this.missingRuntimeGrantFailure({ allowMyAccount: true });
+		if (missingGrantFailure) return missingGrantFailure;
 		const jwt = await this.resolveJwt(auth);
 		if (!jwt) return cmmdReauthRequiredResult();
 		let token = await this.fetchInstallationToken(jwt, repoFullName);
@@ -90354,7 +90391,7 @@ var GitHubBroker = class {
 		};
 	}
 	/**
-	* GET a grant-authenticated GitHub read endpoint from inside a managed runtime. The
+	* Call a grant-authenticated GitHub endpoint from inside a managed runtime. The
 	* runtime grant token (scope `github`) stands in for the user JWT — CMMD
 	* resolves identity server-side and returns the same body as the JWT routes,
 	* so callers get an identical `GitHubBrokerResult`. `resource` is the trailing
@@ -90363,18 +90400,21 @@ var GitHubBroker = class {
 	*/
 	async cmmdRuntimeJson(grant, resource, options = {}) {
 		const response = await this.fetchImpl(makeUrl(this.commandAppUrl, `/api/forge/runtimes/${encodeURIComponent(grant.runtimeId)}/github/${resource}`, options.search), {
-			method: "GET",
-			headers: { Authorization: `Bearer ${grant.token}` }
-		});
-		const body = await parseResponseBody(response);
-		if (!response.ok) return {
+			method: options.method ?? "GET",
+			headers: {
+				Authorization: `Bearer ${grant.token}`,
+				...options.body !== void 0 ? { "Content-Type": "application/json" } : {}
+			},
+			...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
+			signal: AbortSignal.timeout(GITHUB_BROKER_REQUEST_TIMEOUT_MS)
+		}).catch(() => null);
+		if (response === null) return {
 			ok: false,
-			status: response.status,
-			code: response.status === 401 ? "GITHUB_AUTH_REQUIRED" : "GITHUB_BROKER_REQUEST_FAILED",
-			...response.status === 401 ? { userActionRequired: "connect_github" } : {},
-			error: errorFromBody(body, `GitHub runtime request failed with status ${response.status}.`),
-			data: body
+			code: "GITHUB_BROKER_REQUEST_FAILED",
+			error: "CMMD could not be reached for this GitHub request. Retry in a moment."
 		};
+		const body = await parseResponseBody(response);
+		if (!response.ok) return runtimeGrantRequestFailure(response.status, body);
 		return {
 			ok: true,
 			status: response.status,
@@ -90501,6 +90541,34 @@ function parseWorkspaceStatus(stdout) {
 function isGitHubCliCredential(value) {
 	return "token" in value && "repoFullName" in value;
 }
+function runtimeGrantRequestFailure(status, body) {
+	const cmmdCode = codeFromBody(body);
+	const grantFailure = cmmdCode?.startsWith("RUNTIME_GRANT_") ? classifyMissingRuntimeGrant({
+		isCmmdCloudRuntimeMode: true,
+		hasRuntimeGrant: false
+	}) : null;
+	if (grantFailure) return {
+		ok: false,
+		status,
+		...grantFailure,
+		data: body
+	};
+	if (status === 401) return {
+		ok: false,
+		status,
+		code: "GITHUB_AUTH_REQUIRED",
+		userActionRequired: "connect_github",
+		error: errorFromBody(body, `GitHub runtime request failed with status ${status}.`),
+		data: body
+	};
+	return {
+		ok: false,
+		status,
+		code: cmmdCode ?? "GITHUB_BROKER_REQUEST_FAILED",
+		error: errorFromBody(body, `GitHub runtime request failed with status ${status}.`),
+		data: body
+	};
+}
 function cmmdReauthRequiredResult() {
 	return {
 		ok: false,
@@ -93541,7 +93609,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-2-reBrpv.mjs"),
+		try: () => import("./open-yHTUkd2Y.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -191059,7 +191127,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -201259,12 +201327,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$1 = "https://code.claude.com/docs/en", kKe = [
+var os$2 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$1}/iam#permission-modes`
+			docLink: `${os$2}/iam#permission-modes`
 		}
 	},
 	{
@@ -201279,7 +201347,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$1}/settings#environment-variables`
+			docLink: `${os$2}/settings#environment-variables`
 		}
 	},
 	{
@@ -201290,14 +201358,14 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$1}/hooks`
+			docLink: `${os$2}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$1}/hooks#exec-form-and-shell-form`
+			docLink: `${os$2}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -201312,7 +201380,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$1}/settings`
+			docLink: `${os$2}/settings`
 		}
 	},
 	{
@@ -201327,13 +201395,13 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$1}/iam#working-directories`
+			docLink: `${os$2}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$1}/iam#configuring-permissions`,
-	env: `${os$1}/settings#environment-variables`,
-	hooks: `${os$1}/hooks`
+	permissions: `${os$2}/iam#configuring-permissions`,
+	env: `${os$2}/settings#environment-variables`,
+	hooks: `${os$2}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -269460,7 +269528,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -269591,14 +269659,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -269606,7 +269674,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -297510,7 +297578,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "efe4f61b3d4a7de342d1d80983113ff48dd26235";
+	return "64478cf3c507c24bc59b83783ca2eb2ddd93de2c";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -322113,7 +322181,7 @@ const connectLoginCommand = make$34("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-2-reBrpv.mjs")).default;
+			const open = (await import("./open-yHTUkd2Y.mjs")).default;
 			await open(url);
 			return true;
 		},