@cmmd-center/forge 0.13.63 → 0.13.65

package/dist/bin.cjs

@@ -66257,7 +66257,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.63";
+var version$1 = "0.13.65";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -89347,6 +89347,62 @@ var GitHubBroker = class {
 			runtimeResource: "status"
 		});
 	}
+	/**
+	* On a "github" scope cache miss, re-requests it once through the existing
+	* CMMD client before the caller refuses (CMMD-Center/forge#3496,
+	* CMMD-Center/forge#3498). CMMD delivers the grant proactively on
+	* thread.create and the kick, so a miss on a woken runtime is a cache or
+	* ticket TTL problem, not a missing request: this closes the gap where the
+	* ticket lands in the broker authority cache mid-request, and logs the
+	* outcome on failure so the cause is visible instead of a silent refusal.
+	*
+	* A CMMD cloud runtime (every sprite) must still make this round trip
+	* itself: `status()`'s own grant gate fails closed before ever reaching
+	* the network for that runtime class (ADR-015 — it must never fall
+	* through to the human JWT), so this uses `probeRuntimeGithubGrantDelivery`
+	* instead, which makes the identical round trip without that JWT
+	* fallback.
+	*/
+	async requestRuntimeGithubGrant() {
+		const cached = this.runtimeGrantAuthContext("github");
+		if (cached) return cached;
+		const runtimeId = process.env.FORGE_CMMD_RUNTIME_ID?.trim();
+		if (!runtimeId) return null;
+		if (this.isCmmdCloudRuntimeMode) await this.probeRuntimeGithubGrantDelivery(runtimeId);
+		else await this.status({
+			sessionId: AuthSessionId.make(`cmmd-runtime:${runtimeId}`),
+			subject: `runtime:${runtimeId}`
+		});
+		const grant = this.runtimeGrantAuthContext("github");
+		if (!grant) console.warn(`[github-broker] re-requested the github scope grant for runtime ${runtimeId}: still missing after one network round trip`);
+		return grant;
+	}
+	/**
+	* The cloud-runtime half of `requestRuntimeGithubGrant`'s re-request.
+	*
+	* CMMD's status route always requires a Bearer that already carries the
+	* "github" scope (verified server-side against the presented ticket's own
+	* claims — see `forge-runtime-grants.routes.ts` on CMMD main), and there is
+	* no separate CMMD route that mints a "github"-scoped grant on demand. So
+	* this call's own response can never carry a grant to install; its purpose
+	* is the wait. CMMD delivers a fresh grant on this same runtime's inbound
+	* thread.create/kick requests (`ServerAuth.authenticateHttpRequest` /
+	* `authenticateWebSocketUpgrade`, which install it into the broker
+	* authority cache as a side effect of authenticating each request), and a
+	* delivery already in flight when the caller checked the cache gets this
+	* round trip's worth of extra time to land before the caller gives up.
+	* Bounded by the same timeout as every other runtime-grant call, and
+	* deliberately unauthenticated: sending no Bearer is exactly as
+	* informative to CMMD as sending one lacking the required scope, and
+	* skips resolving one for a request whose own response is never used.
+	*/
+	async probeRuntimeGithubGrantDelivery(runtimeId) {
+		const response = await this.fetchImpl(makeUrl(this.commandAppUrl, `/api/forge/runtimes/${encodeURIComponent(runtimeId)}/github/status`), {
+			method: "GET",
+			signal: AbortSignal.timeout(GITHUB_BROKER_REQUEST_TIMEOUT_MS)
+		}).catch(() => null);
+		if (response !== null) await parseResponseBody(response);
+	}
 	async workspaceStatus(input) {
 		const cwdValidation = validateCwd(input.cwd);
 		if (cwdValidation) return cwdValidation;
@@ -97853,6 +97909,235 @@ function serializeProviderCatalog(providers) {
 	return catalog;
 }
 //#endregion
+//#region src/provider/personalClaudeInVm.ts
+/**
+* CMMD writes this marker when it activates a personal Claude subscription
+* inside a running sprite. Activation always happens after boot, so a
+* boot-time env var alone cannot reflect it (FOR-36249).
+*
+* CMMD names the file in the Service env (FORGE_PERSONAL_CLAUDE_MARKER_PATH).
+* Without that, the marker sits directly under FORGE_HOME, which is the same
+* guest home CMMD derives every sprite path from. A server with neither has no
+* sprite home to look in, and a desktop never has a marker, so it reads none.
+*/
+const PERSONAL_CLAUDE_IN_VM_MARKER_NAME = ".forge-personal-claude-in-vm";
+const PERSONAL_CLAUDE_GENERATION_FILE_NAME = ".forge-personal-claude-generation";
+function markerPath(env) {
+	if (env.FORGE_PERSONAL_CLAUDE_MARKER_PATH) return env.FORGE_PERSONAL_CLAUDE_MARKER_PATH;
+	if (env.FORGE_HOME) return (0, node_path.join)(env.FORGE_HOME, PERSONAL_CLAUDE_IN_VM_MARKER_NAME);
+	return null;
+}
+/**
+* True when this runtime should offer the personal Claude subscription lane.
+*
+* Accepts either signal: the boot-time env var (backward compatible) or the
+* activation marker on disk. Reading the marker at call time lets the provider
+* catalog and the per-turn readiness guard self-heal once CMMD delivers,
+* without a sprite reboot. Callers still verify the credential is non-empty
+* before treating it as usable; this only decides whether the lane is active.
+*/
+function personalClaudeInVmEnabled(env = process.env) {
+	if (env.FORGE_PERSONAL_CLAUDE_IN_VM === "true") return true;
+	const marker = markerPath(env);
+	if (!marker) return false;
+	try {
+		return (0, node_fs.existsSync)(marker);
+	} catch {
+		return false;
+	}
+}
+/** Exported at boot. This is the restart proof CMMD waits on, so it must never read the file. */
+function bootExportedPersonalClaudeGenerationHash(env = process.env) {
+	return env.FORGE_PERSONAL_CLAUDE_GENERATION_HASH?.trim() ?? "";
+}
+/**
+* The sha256 of the Claude credential generation this runtime holds, or "" when
+* it holds none. The readiness guard compares it with the generation CMMD
+* applied. The restart proof must not use it; it uses the boot-exported hash.
+*
+* The boot preload exports FORGE_PERSONAL_CLAUDE_GENERATION_HASH, but only when
+* the marker already exists at boot. Activation in place writes the generation
+* file and touches the marker without setting any env, so an empty variable
+* falls back to that file, hashed the way the preload hashes it. CMMD puts the
+* file beside the marker in the guest home and names no path for it. A marker
+* with no generation file is a legacy runtime, and gets no hash here either.
+*/
+function personalClaudeGenerationHash(env = process.env) {
+	const exported = bootExportedPersonalClaudeGenerationHash(env);
+	if (exported) return exported;
+	const marker = markerPath(env);
+	if (!marker) return "";
+	try {
+		if (!(0, node_fs.existsSync)(marker)) return "";
+		const generation = (0, node_fs.readFileSync)((0, node_path.join)((0, node_path.dirname)(marker), PERSONAL_CLAUDE_GENERATION_FILE_NAME), "utf8").trim();
+		return generation ? (0, node_crypto.createHash)("sha256").update(generation).digest("hex") : "";
+	} catch {
+		return "";
+	}
+}
+//#endregion
+//#region src/provider/providerAuthFailureCopy.ts
+/**
+* Rewrite provider auth failures into an action the user can actually take.
+*
+* The provider SDKs assume they are running under a human at a terminal, so
+* their auth errors name CLI verbs: Claude's is literally
+* `Not logged in · Please run /login`. On Forge Cloud that reaches a browser
+* user who has no terminal, no shell, and no way to run `/login` — the turn
+* dies in ~3 s naming an action that does not exist for them (observed live
+* 2026-08-05).
+*
+* CMMD already writes the right shape for the Codex egress path — "Connect
+* ChatGPT in Settings > Providers, then retry" — which names a destination the
+* user can click. This gives the provider-SDK failures the same treatment.
+*
+* Scope is deliberately narrow. Only messages that clearly identify a
+* *credential* problem are rewritten; everything else passes through verbatim,
+* because a rewritten unknown error loses detail an operator needs and risks
+* telling the user to reconnect an account that was never the problem.
+*/
+/**
+* Signatures of "you have no usable credential", matched case-insensitively.
+*
+* Kept as explicit patterns rather than a broad /auth/i so that genuine
+* mid-turn failures mentioning authorization (a tool hitting a 403 on some
+* unrelated API, say) are not misreported as "your subscription is
+* disconnected".
+*/
+const CREDENTIAL_FAILURE_PATTERNS = [
+	/\bnot logged in\b/i,
+	/\bplease run\s*\/login\b/i,
+	/\brun\s*\/login\b/i,
+	/\blogin required\b/i,
+	/\bnot authenticated\b/i,
+	/\bno credentials? found\b/i,
+	/\binvalid api key\b/i,
+	/\bauthentication_error\b/i
+];
+/**
+* Claude's words for a delivered credential whose refresh chain is dead.
+*
+* Deliberately NOT in CREDENTIAL_FAILURE_PATTERNS. On a runtime whose Claude
+* credential CMMD delivers, this is not "you are signed out" and reconnecting
+* in Settings is not the fix: CMMD's authority rotates the refresh token on
+* every refresh, the snapshot in the guest dies at the next rotation, and the
+* repair is a re-delivery the next send triggers (FOR-36425, CMMD-36441).
+* Anywhere else the credential is the user's own local login, so the CLI text
+* still passes through untouched.
+*/
+const DELIVERED_CREDENTIAL_EXPIRED_PATTERN = /\boauth session expired\b/i;
+const DELIVERED_CLAUDE_CREDENTIAL_EXPIRED_COPY = "The delivered Claude credential expired. CMMD refreshes it on the next send, so retry this turn.";
+/** True when the message is about a missing/unusable credential, not a tool failure. */
+function isProviderCredentialFailure(message) {
+	return CREDENTIAL_FAILURE_PATTERNS.some((pattern) => pattern.test(message));
+}
+/**
+* Map a ProviderKind to the account name a user would recognise.
+*
+* NOTE the literal is `claudeAgent`, not `claude`. This read `"claude"` and so
+* never matched, silently degrading every Claude auth failure to the generic
+* fallback — "Forge Cloud has no **this provider** subscription connected."
+* Same provider-name drift class as the model-mapping fix (#2103/#2105).
+*
+* The names come from the shared PROVIDER_ACCOUNT_NAMES map rather than a local
+* switch: this file's copy was the ONLY correct provider→label mapping in the
+* codebase while four client call sites reimplemented it as binary ternaries.
+* One Record over ProviderKind means a new provider is a compile error in one
+* place instead of five sentences that read wrong in production.
+*
+* Providers that do not sell a personal subscription stay generic on purpose —
+* "Forge Cloud has no Ollama subscription connected" names something that does
+* not exist.
+*/
+function providerLabel(provider) {
+	return supportsPersonalSubscription(provider) ? PROVIDER_ACCOUNT_NAMES[provider] : "this provider";
+}
+/**
+* Return the message to show for a failed turn.
+*
+* `surface` decides the destination: a cloud runtime has no terminal, so it is
+* pointed at Settings; a local/desktop runtime CAN run the CLI login, so its
+* copy still offers that as the concrete fix rather than sending someone to a
+* settings page that is not how they authenticate.
+*/
+function rewriteProviderAuthFailure(input) {
+	const original = input.message ?? "";
+	if (original.length === 0) return {
+		message: original,
+		rewritten: false
+	};
+	if (input.deliveredClaudeCredential === true && DELIVERED_CREDENTIAL_EXPIRED_PATTERN.test(original)) return {
+		message: DELIVERED_CLAUDE_CREDENTIAL_EXPIRED_COPY,
+		rewritten: true
+	};
+	if (!isProviderCredentialFailure(original)) return {
+		message: original,
+		rewritten: false
+	};
+	const who = providerLabel(input.provider);
+	return {
+		message: input.surface === "cloud" ? `Forge Cloud has no ${who} subscription connected for your account. Open Settings > Providers to connect one, then retry this turn.` : `This runtime is not signed in to ${who}. Connect it from Settings > Providers, then retry this turn.`,
+		rewritten: true
+	};
+}
+/**
+* Convenience for call sites that just want the string to show.
+*
+* Exists so adapters do not each re-derive the surface and re-handle the
+* undefined case inline — that inlining is what pushed
+* ClaudeAdapter.handleResultMessage over the cyclomatic gate. Returns
+* `undefined` unchanged so "no error" stays distinguishable from "empty error".
+*/
+function providerAuthFailureMessage(message, provider, env = process.env) {
+	if (message === void 0) return void 0;
+	return rewriteProviderAuthFailure({
+		message,
+		provider,
+		surface: env.FORGE_CMMD_RUNTIME_MODE === "true" ? "cloud" : "local",
+		deliveredClaudeCredential: provider === "claudeAgent" && personalClaudeInVmEnabled(env)
+	}).message;
+}
+//#endregion
+//#region src/orchestration/turnFailureReason.ts
+/**
+* Machine-readable reasons for a turn that failed before it produced any
+* assistant output, replicated to CMMD on the `turn_status` event
+* (CMMD-Center/forge#3496, CMMD-Center/CMMD#5272). Codes match the catalog
+* CMMD renders actions from (CMMD-Center/CMMD#5289): a code CMMD does not
+* recognize degrades to its own generic fallback, so a new Forge failure
+* class is safe to ship before CMMD's catalog knows about it.
+*/
+const GITHUB_GRANT_DETAIL_PATTERN = /exact scoped runtime GitHub grant/i;
+/**
+* The exact-machine broker's own wording (`providerEgressToken.ts`) for all
+* three reasons it could not produce a provider token: an incomplete runtime
+* identity, no owner session bound to the request, or no live broker
+* authority. Every one of those is a real authentication refusal, not a
+* workspace or adapter failure, and the prefix is unique to that code path.
+*/
+const EXACT_MACHINE_BROKER_AUTHORITY_PATTERN = /provider token issuance requires a live exact-machine broker authority/i;
+/**
+* Classifies a `provider.turn.start.failed` activity's detail. This activity
+* kind also covers non-auth causes (a draining runtime, a missing user
+* message, a rejected workspace, a start-timeout cleanup failure), so only
+* text that names a known authentication refusal is reported as one; every
+* other detail degrades to `unspecified_failure` rather than telling CMMD to
+* offer a reconnect action credentials cannot fix.
+*/
+function classifyProviderTurnStartFailureReason(detail) {
+	const message = detail.trim().length > 0 ? detail : "The provider could not start a session for this run.";
+	return {
+		code: GITHUB_GRANT_DETAIL_PATTERN.test(detail) ? "provider_start_refused_github_grant" : EXACT_MACHINE_BROKER_AUTHORITY_PATTERN.test(detail) || isProviderCredentialFailure(detail) ? "provider_start_refused_auth" : "unspecified_failure",
+		message
+	};
+}
+function checkpointTimeoutReason(detail) {
+	return {
+		code: "checkpoint_timeout",
+		message: detail.trim().length > 0 ? detail : "The workspace checkpoint timed out before the turn could start."
+	};
+}
+//#endregion
 //#region src/runtimeReplication/replicaSerializer.ts
 const replicaTurnStatuses = new Set([
 	"pending",
@@ -98193,6 +98478,53 @@ function serializeFailureActivity(activity) {
 		}
 	};
 }
+/** Only the pre-turn baseline capture sets this; a post-turn capture failure
+* never blocked the turn from starting and must not fail it retroactively. */
+function blocksTurnStart(activity) {
+	const payload = activity.payload;
+	if (!payload || typeof payload !== "object") return false;
+	return payload.blocksTurnStart === true;
+}
+function isCheckpointTimeoutDetail(detail) {
+	return /timed out/i.test(detail);
+}
+/**
+* The structured reason a turn never started, when this activity is one of
+* the two known causes (CMMD-Center/forge#3496): the provider refused to
+* start a session, or the pre-turn checkpoint that must precede it timed out.
+* `null` for every other activity, including a checkpoint failure that did
+* not block turn start or was not a timeout.
+*/
+function turnStartFailureReason(activity) {
+	const detail = failureDetail(activity);
+	if (activity.kind === "provider.turn.start.failed") return classifyProviderTurnStartFailureReason(detail ?? "");
+	if (activity.kind === "checkpoint.capture.failed" && blocksTurnStart(activity) && detail !== null && isCheckpointTimeoutDetail(detail)) return checkpointTimeoutReason(detail);
+	return null;
+}
+/**
+* Replicates a turn-start failure as `turn_status: failed` with a structured
+* `reason`, alongside (not instead of) the free-text `error_summary` above:
+* CMMD fails the owning Work Session from this event
+* (CMMD-Center/CMMD#5272/#5286), which `error_summary` alone cannot drive.
+*/
+function serializeTurnStartFailureStatus(activity) {
+	const reason = turnStartFailureReason(activity);
+	if (reason === null) return null;
+	return {
+		sourceSequence: null,
+		event: {
+			eventId: `activity:${activity.id}:turn-status`,
+			occurredAt: canonicalRuntimeEventTimestamp(activity.createdAt),
+			...eventTurn(activity.turnId),
+			kind: "turn_status",
+			status: "failed",
+			reason: {
+				code: reason.code,
+				message: text(reason.message, 2e3) ?? reason.message
+			}
+		}
+	};
+}
 const turnUsageKeys = [
 	"uncachedInputTokens",
 	"cachedInputTokens",
@@ -98541,7 +98873,7 @@ function serializeRuntimeThreadEvents(thread) {
 	});
 	const recordedTurns = serializeRecordedTurns(thread);
 	const textGenerations = serializeTextGenerations(thread);
-	return [
+	const priorEvents = [
 		...messages,
 		...replicaActivities,
 		...toolActivities,
@@ -98550,7 +98882,15 @@ function serializeRuntimeThreadEvents(thread) {
 		...failureActivities,
 		...recordedTurns,
 		...textGenerations
-	].toSorted((left, right) => {
+	];
+	const latestPriorOccurredAt = priorEvents.reduce((latest, entry) => latest === null || entry.event.occurredAt > latest ? entry.event.occurredAt : latest, null);
+	const turnStartFailureStatuses = thread.activities.flatMap((activity) => {
+		const event = serializeTurnStartFailureStatus(activity);
+		if (event === null) return [];
+		if (latestPriorOccurredAt !== null && event.event.occurredAt < latestPriorOccurredAt) return [];
+		return [event];
+	});
+	return [...priorEvents, ...turnStartFailureStatuses].toSorted((left, right) => {
 		if (left.sourceSequence !== null && right.sourceSequence !== null) return left.sourceSequence - right.sourceSequence;
 		if (left.sourceSequence !== null) return -1;
 		if (right.sourceSequence !== null) return 1;
@@ -152498,7 +152838,7 @@ async function prepareWorkspaceRepositoryDependencies(input) {
 	const dependencies = resolveWorkspaceEnvironmentConfig(input.cwd).repositoryDependencies;
 	if (dependencies.length === 0) return [];
 	const broker = input.broker ?? new GitHubBroker();
-	const auth = broker.runtimeGrantAuthContext("github");
+	const auth = broker.runtimeGrantAuthContext("github") ?? await broker.requestRuntimeGithubGrant?.() ?? null;
 	if (auth === null) throw new Error("Repository dependencies require an exact scoped runtime GitHub grant.");
 	const readOrigin = input.readOrigin ?? readOriginFromGit;
 	const resolved = resolveRepositoryDependencies(dependencies, input.cloudProjectsRoot);
@@ -213506,73 +213846,6 @@ function primaryClaudeCredentialMatchesPrepared(env, preparedDirectory) {
 	}
 }
 //#endregion
-//#region src/provider/personalClaudeInVm.ts
-/**
-* CMMD writes this marker when it activates a personal Claude subscription
-* inside a running sprite. Activation always happens after boot, so a
-* boot-time env var alone cannot reflect it (FOR-36249).
-*
-* CMMD names the file in the Service env (FORGE_PERSONAL_CLAUDE_MARKER_PATH).
-* Without that, the marker sits directly under FORGE_HOME, which is the same
-* guest home CMMD derives every sprite path from. A server with neither has no
-* sprite home to look in, and a desktop never has a marker, so it reads none.
-*/
-const PERSONAL_CLAUDE_IN_VM_MARKER_NAME = ".forge-personal-claude-in-vm";
-const PERSONAL_CLAUDE_GENERATION_FILE_NAME = ".forge-personal-claude-generation";
-function markerPath(env) {
-	if (env.FORGE_PERSONAL_CLAUDE_MARKER_PATH) return env.FORGE_PERSONAL_CLAUDE_MARKER_PATH;
-	if (env.FORGE_HOME) return (0, node_path.join)(env.FORGE_HOME, PERSONAL_CLAUDE_IN_VM_MARKER_NAME);
-	return null;
-}
-/**
-* True when this runtime should offer the personal Claude subscription lane.
-*
-* Accepts either signal: the boot-time env var (backward compatible) or the
-* activation marker on disk. Reading the marker at call time lets the provider
-* catalog and the per-turn readiness guard self-heal once CMMD delivers,
-* without a sprite reboot. Callers still verify the credential is non-empty
-* before treating it as usable; this only decides whether the lane is active.
-*/
-function personalClaudeInVmEnabled(env = process.env) {
-	if (env.FORGE_PERSONAL_CLAUDE_IN_VM === "true") return true;
-	const marker = markerPath(env);
-	if (!marker) return false;
-	try {
-		return (0, node_fs.existsSync)(marker);
-	} catch {
-		return false;
-	}
-}
-/** Exported at boot. This is the restart proof CMMD waits on, so it must never read the file. */
-function bootExportedPersonalClaudeGenerationHash(env = process.env) {
-	return env.FORGE_PERSONAL_CLAUDE_GENERATION_HASH?.trim() ?? "";
-}
-/**
-* The sha256 of the Claude credential generation this runtime holds, or "" when
-* it holds none. The readiness guard compares it with the generation CMMD
-* applied. The restart proof must not use it; it uses the boot-exported hash.
-*
-* The boot preload exports FORGE_PERSONAL_CLAUDE_GENERATION_HASH, but only when
-* the marker already exists at boot. Activation in place writes the generation
-* file and touches the marker without setting any env, so an empty variable
-* falls back to that file, hashed the way the preload hashes it. CMMD puts the
-* file beside the marker in the guest home and names no path for it. A marker
-* with no generation file is a legacy runtime, and gets no hash here either.
-*/
-function personalClaudeGenerationHash(env = process.env) {
-	const exported = bootExportedPersonalClaudeGenerationHash(env);
-	if (exported) return exported;
-	const marker = markerPath(env);
-	if (!marker) return "";
-	try {
-		if (!(0, node_fs.existsSync)(marker)) return "";
-		const generation = (0, node_fs.readFileSync)((0, node_path.join)((0, node_path.dirname)(marker), PERSONAL_CLAUDE_GENERATION_FILE_NAME), "utf8").trim();
-		return generation ? (0, node_crypto.createHash)("sha256").update(generation).digest("hex") : "";
-	} catch {
-		return "";
-	}
-}
-//#endregion
 //#region src/provider/claudeCredentialContainment.ts
 /**
 * Containment for provider credentials inherited by the Claude Agent SDK child.
@@ -215656,128 +215929,6 @@ function createGitHubMcpServer(runBrokeredTool, threadId, settings) {
 	});
 }
 //#endregion
-//#region src/provider/providerAuthFailureCopy.ts
-/**
-* Rewrite provider auth failures into an action the user can actually take.
-*
-* The provider SDKs assume they are running under a human at a terminal, so
-* their auth errors name CLI verbs: Claude's is literally
-* `Not logged in · Please run /login`. On Forge Cloud that reaches a browser
-* user who has no terminal, no shell, and no way to run `/login` — the turn
-* dies in ~3 s naming an action that does not exist for them (observed live
-* 2026-08-05).
-*
-* CMMD already writes the right shape for the Codex egress path — "Connect
-* ChatGPT in Settings > Providers, then retry" — which names a destination the
-* user can click. This gives the provider-SDK failures the same treatment.
-*
-* Scope is deliberately narrow. Only messages that clearly identify a
-* *credential* problem are rewritten; everything else passes through verbatim,
-* because a rewritten unknown error loses detail an operator needs and risks
-* telling the user to reconnect an account that was never the problem.
-*/
-/**
-* Signatures of "you have no usable credential", matched case-insensitively.
-*
-* Kept as explicit patterns rather than a broad /auth/i so that genuine
-* mid-turn failures mentioning authorization (a tool hitting a 403 on some
-* unrelated API, say) are not misreported as "your subscription is
-* disconnected".
-*/
-const CREDENTIAL_FAILURE_PATTERNS = [
-	/\bnot logged in\b/i,
-	/\bplease run\s*\/login\b/i,
-	/\brun\s*\/login\b/i,
-	/\blogin required\b/i,
-	/\bnot authenticated\b/i,
-	/\bno credentials? found\b/i,
-	/\binvalid api key\b/i,
-	/\bauthentication_error\b/i
-];
-/**
-* Claude's words for a delivered credential whose refresh chain is dead.
-*
-* Deliberately NOT in CREDENTIAL_FAILURE_PATTERNS. On a runtime whose Claude
-* credential CMMD delivers, this is not "you are signed out" and reconnecting
-* in Settings is not the fix: CMMD's authority rotates the refresh token on
-* every refresh, the snapshot in the guest dies at the next rotation, and the
-* repair is a re-delivery the next send triggers (FOR-36425, CMMD-36441).
-* Anywhere else the credential is the user's own local login, so the CLI text
-* still passes through untouched.
-*/
-const DELIVERED_CREDENTIAL_EXPIRED_PATTERN = /\boauth session expired\b/i;
-const DELIVERED_CLAUDE_CREDENTIAL_EXPIRED_COPY = "The delivered Claude credential expired. CMMD refreshes it on the next send, so retry this turn.";
-/** True when the message is about a missing/unusable credential, not a tool failure. */
-function isProviderCredentialFailure(message) {
-	return CREDENTIAL_FAILURE_PATTERNS.some((pattern) => pattern.test(message));
-}
-/**
-* Map a ProviderKind to the account name a user would recognise.
-*
-* NOTE the literal is `claudeAgent`, not `claude`. This read `"claude"` and so
-* never matched, silently degrading every Claude auth failure to the generic
-* fallback — "Forge Cloud has no **this provider** subscription connected."
-* Same provider-name drift class as the model-mapping fix (#2103/#2105).
-*
-* The names come from the shared PROVIDER_ACCOUNT_NAMES map rather than a local
-* switch: this file's copy was the ONLY correct provider→label mapping in the
-* codebase while four client call sites reimplemented it as binary ternaries.
-* One Record over ProviderKind means a new provider is a compile error in one
-* place instead of five sentences that read wrong in production.
-*
-* Providers that do not sell a personal subscription stay generic on purpose —
-* "Forge Cloud has no Ollama subscription connected" names something that does
-* not exist.
-*/
-function providerLabel(provider) {
-	return supportsPersonalSubscription(provider) ? PROVIDER_ACCOUNT_NAMES[provider] : "this provider";
-}
-/**
-* Return the message to show for a failed turn.
-*
-* `surface` decides the destination: a cloud runtime has no terminal, so it is
-* pointed at Settings; a local/desktop runtime CAN run the CLI login, so its
-* copy still offers that as the concrete fix rather than sending someone to a
-* settings page that is not how they authenticate.
-*/
-function rewriteProviderAuthFailure(input) {
-	const original = input.message ?? "";
-	if (original.length === 0) return {
-		message: original,
-		rewritten: false
-	};
-	if (input.deliveredClaudeCredential === true && DELIVERED_CREDENTIAL_EXPIRED_PATTERN.test(original)) return {
-		message: DELIVERED_CLAUDE_CREDENTIAL_EXPIRED_COPY,
-		rewritten: true
-	};
-	if (!isProviderCredentialFailure(original)) return {
-		message: original,
-		rewritten: false
-	};
-	const who = providerLabel(input.provider);
-	return {
-		message: input.surface === "cloud" ? `Forge Cloud has no ${who} subscription connected for your account. Open Settings > Providers to connect one, then retry this turn.` : `This runtime is not signed in to ${who}. Connect it from Settings > Providers, then retry this turn.`,
-		rewritten: true
-	};
-}
-/**
-* Convenience for call sites that just want the string to show.
-*
-* Exists so adapters do not each re-derive the surface and re-handle the
-* undefined case inline — that inlining is what pushed
-* ClaudeAdapter.handleResultMessage over the cyclomatic gate. Returns
-* `undefined` unchanged so "no error" stays distinguishable from "empty error".
-*/
-function providerAuthFailureMessage(message, provider, env = process.env) {
-	if (message === void 0) return void 0;
-	return rewriteProviderAuthFailure({
-		message,
-		provider,
-		surface: env.FORGE_CMMD_RUNTIME_MODE === "true" ? "cloud" : "local",
-		deliveredClaudeCredential: provider === "claudeAgent" && personalClaudeInVmEnabled(env)
-	}).message;
-}
-//#endregion
 //#region src/provider/missingWorkspaceCopy.ts
 /**
 * Refuse a turn whose checkout folder is gone, and say so.
@@ -234138,6 +234289,8 @@ const CheckpointDiffQueryLive = require_Schema$1.effect(CheckpointDiffQuery, mak
 * @module CheckpointStoreLive
 */
 const CHECKPOINT_PATH_OUTPUT_MAX_BYTES = 16 * 1024 * 1024;
+const CheckpointCaptureTimeoutConfig = require_Config.number("FORGE_CHECKPOINT_CAPTURE_TIMEOUT_MS").pipe(require_Config.withDefault(6e4));
+const EFFECT_TIMER_MAX_MS = 2147483647;
 function parseNullSeparatedPaths(output) {
 	return output.split("\0").filter((entry) => entry.length > 0);
 }
@@ -234145,7 +234298,7 @@ const makeCheckpointStore = require_Schema$1.gen(function* () {
 	const fs = yield* require_Path.FileSystem;
 	const path = yield* require_Path.Path;
 	const git = yield* GitCore;
-	const resolveHeadCommit = (cwd) => git.execute({
+	const resolveHeadCommit = (cwd, timeoutMs) => git.execute({
 		operation: "CheckpointStore.resolveHeadCommit",
 		cwd,
 		args: [
@@ -234154,7 +234307,8 @@ const makeCheckpointStore = require_Schema$1.gen(function* () {
 			"--quiet",
 			"HEAD^{commit}"
 		],
-		allowNonZeroExit: true
+		allowNonZeroExit: true,
+		...timeoutMs !== void 0 ? { timeoutMs } : {}
 	}).pipe(require_Schema$1.map((result) => {
 		if (result.code !== 0) return null;
 		const commit = result.stdout.trim();
@@ -234193,7 +234347,9 @@ const makeCheckpointStore = require_Schema$1.gen(function* () {
 	}).pipe(require_Schema$1.map((result) => result.code === 0 && result.stdout.trim() === "true"), require_Schema$1.catch_(() => require_Schema$1.succeed(false)));
 	const captureCheckpoint = require_Schema$1.fn("captureCheckpoint")(function* (input) {
 		const operation = "CheckpointStore.captureCheckpoint";
-		const headCommit = yield* resolveHeadCommit(input.cwd);
+		const captureTimeoutMs = yield* CheckpointCaptureTimeoutConfig.asEffect().pipe(require_Schema$1.orDie);
+		if (!Number.isFinite(captureTimeoutMs) || captureTimeoutMs <= 0 || captureTimeoutMs > EFFECT_TIMER_MAX_MS) return yield* require_Schema$1.die(/* @__PURE__ */ new Error(`FORGE_CHECKPOINT_CAPTURE_TIMEOUT_MS must be a finite number greater than zero and at most ${EFFECT_TIMER_MAX_MS}, got ${captureTimeoutMs}.`));
+		const headCommit = yield* resolveHeadCommit(input.cwd, captureTimeoutMs);
 		const [trackedPathResult, untrackedPathResult] = yield* require_Schema$1.all([git.execute({
 			operation,
 			cwd: input.cwd,
@@ -234210,7 +234366,8 @@ const makeCheckpointStore = require_Schema$1.gen(function* () {
 				"-z",
 				"--"
 			],
-			maxOutputBytes: CHECKPOINT_PATH_OUTPUT_MAX_BYTES
+			maxOutputBytes: CHECKPOINT_PATH_OUTPUT_MAX_BYTES,
+			timeoutMs: captureTimeoutMs
 		}), git.execute({
 			operation,
 			cwd: input.cwd,
@@ -234221,7 +234378,8 @@ const makeCheckpointStore = require_Schema$1.gen(function* () {
 				"-z",
 				"--"
 			],
-			maxOutputBytes: CHECKPOINT_PATH_OUTPUT_MAX_BYTES
+			maxOutputBytes: CHECKPOINT_PATH_OUTPUT_MAX_BYTES,
+			timeoutMs: captureTimeoutMs
 		})], { concurrency: 2 });
 		const changedPaths = [...new Set([...parseNullSeparatedPaths(trackedPathResult.stdout), ...parseNullSeparatedPaths(untrackedPathResult.stdout)])];
 		if (headCommit && changedPaths.length === 0) {
@@ -234232,7 +234390,8 @@ const makeCheckpointStore = require_Schema$1.gen(function* () {
 					"update-ref",
 					input.checkpointRef,
 					headCommit
-				]
+				],
+				timeoutMs: captureTimeoutMs
 			});
 			return;
 		}
@@ -234250,13 +234409,15 @@ const makeCheckpointStore = require_Schema$1.gen(function* () {
 				operation,
 				cwd: input.cwd,
 				args: ["read-tree", headCommit],
-				env: commitEnv
+				env: commitEnv,
+				timeoutMs: captureTimeoutMs
 			});
 			else yield* git.execute({
 				operation,
 				cwd: input.cwd,
 				args: ["read-tree", "--empty"],
-				env: commitEnv
+				env: commitEnv,
+				timeoutMs: captureTimeoutMs
 			});
 			if (changedPaths.length > 0) yield* git.execute({
 				operation,
@@ -234269,13 +234430,15 @@ const makeCheckpointStore = require_Schema$1.gen(function* () {
 					"--pathspec-file-nul"
 				],
 				stdin: changedPaths.map((changedPath) => `${changedPath}\0`).join(""),
-				env: commitEnv
+				env: commitEnv,
+				timeoutMs: captureTimeoutMs
 			});
 			const treeOid = (yield* git.execute({
 				operation,
 				cwd: input.cwd,
 				args: ["write-tree"],
-				env: commitEnv
+				env: commitEnv,
+				timeoutMs: captureTimeoutMs
 			})).stdout.trim();
 			if (treeOid.length === 0) return yield* new GitCommandError({
 				operation,
@@ -234293,7 +234456,8 @@ const makeCheckpointStore = require_Schema$1.gen(function* () {
 					"-m",
 					message
 				],
-				env: commitEnv
+				env: commitEnv,
+				timeoutMs: captureTimeoutMs
 			})).stdout.trim();
 			if (commitOid.length === 0) return yield* new GitCommandError({
 				operation,
@@ -234308,7 +234472,8 @@ const makeCheckpointStore = require_Schema$1.gen(function* () {
 					"update-ref",
 					input.checkpointRef,
 					commitOid
-				]
+				],
+				timeoutMs: captureTimeoutMs
 			});
 		}), (tempDir) => fs.remove(tempDir, { recursive: true })).pipe(require_Schema$1.catchTags({ PlatformError: (error) => require_Schema$1.fail(new CheckpointInvariantError({
 			operation: "CheckpointStore.captureCheckpoint",
@@ -292201,7 +292366,7 @@ const make$8 = require_Schema$1.gen(function* () {
 				summary: "Agent turn blocked",
 				detail: "Forge runtime is updating after the current turn. New agent turns are paused until the runtime finishes draining.",
 				turnId: null,
-				createdAt: input.createdAt
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
 			});
 			return;
 		}
@@ -292436,7 +292601,7 @@ const make$8 = require_Schema$1.gen(function* () {
 				summary: "Agent turn blocked",
 				detail: workspaceError,
 				turnId: null,
-				createdAt: event.payload.createdAt
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
 			});
 			return;
 		}
@@ -293528,7 +293693,10 @@ const make$7 = require_Schema$1.gen(function* () {
 			tone: "error",
 			kind: "checkpoint.capture.failed",
 			summary: "Checkpoint capture failed",
-			payload: { detail: input.detail },
+			payload: {
+				detail: input.detail,
+				...input.blocksTurnStart ? { blocksTurnStart: true } : {}
+			},
 			turnId: input.turnId,
 			createdAt: input.createdAt
 		},
@@ -293814,7 +293982,13 @@ const make$7 = require_Schema$1.gen(function* () {
 		yield* checkpointStore.captureCheckpoint({
 			cwd: checkpointCwd,
 			checkpointRef: baselineCheckpointRef
-		});
+		}).pipe(require_Schema$1.catch_((error) => appendCaptureFailureActivity({
+			threadId,
+			turnId: null,
+			detail: error.message,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			blocksTurnStart: true
+		}).pipe(require_Schema$1.catch_(() => require_Schema$1.void_))));
 		yield* receiptBus.publish({
 			type: "checkpoint.baseline.captured",
 			threadId,
@@ -298206,7 +298380,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "63701057dccde6ea0a120ebb0a1e1ae8c461b056";
+	return "06c11aad2e4673f13061c7bed6d0a4cb63ff8122";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;