@cmmd-center/forge 0.13.77 → 0.13.79

package/dist/bin.cjs

@@ -2,18 +2,18 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-BhaIgcZK.cjs");
-const require_Schema$1 = require("./Schema-CDCJ3xZo.cjs");
-const require_Path = require("./Path-BQOH_fWQ.cjs");
-const require_NodeTerminal = require("./NodeTerminal-CO-i-6Je.cjs");
-const require_NodeServices = require("./NodeServices-CtC4a-h5.cjs");
-const require_HttpServer = require("./HttpServer-BBzRBmVt.cjs");
-const require_Config = require("./Config-CwKCCk14.cjs");
-const require_Cache = require("./Cache-BmGc_2BZ.cjs");
-const require_SqlError = require("./SqlError-g4pLzNWR.cjs");
+const require_Schema$1 = require("./Schema-DxddW8-V.cjs");
+const require_Path = require("./Path-Dp3btyUm.cjs");
+const require_NodeTerminal = require("./NodeTerminal-DQESKR0W.cjs");
+const require_NodeServices = require("./NodeServices-BkfWZHfh.cjs");
+const require_HttpServer = require("./HttpServer-DZ6iaxyk.cjs");
+const require_Config = require("./Config-pbf0GGHJ.cjs");
+const require_Cache = require("./Cache-D-JaJz5Q.cjs");
+const require_SqlError = require("./SqlError-BqOsoG0V.cjs");
 const require_Mime = require("./Mime-Bilnh8zE.cjs");
 const require_esm = require("./esm-BZhXwX5p.cjs");
 const require_runtimeControlAuthority = require("./runtimeControlAuthority-DCitZFTk.cjs");
-const require_PTY = require("./PTY-B4ZctbwQ.cjs");
+const require_PTY = require("./PTY-C8ypptmz.cjs");
 const require_settle = require("./settle-B6Rn65UV.cjs");
 let node_child_process = require("node:child_process");
 node_child_process = require_chunk.__toESM(node_child_process);
@@ -66275,7 +66275,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.77";
+var version$1 = "0.13.79";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -76953,7 +76953,7 @@ const makeNoSerialization$1 = /* @__PURE__ */ require_Schema$1.fnUntraced(functi
 		const span = disableTracing ? void 0 : yield* require_Schema$1.makeSpanScoped(`${spanPrefix}.${rpc._tag}`, { attributes: options.spanAttributes });
 		const fiber = require_Path.getCurrent();
 		const id = generateRequestId();
-		const scope = require_Schema$1.getUnsafe(fiber.context, require_Schema$1.Scope);
+		const scope = require_Schema$1.getUnsafe$1(fiber.context, require_Schema$1.Scope);
 		yield* require_Schema$1.addFinalizerExit(scope, (exit) => {
 			if (!entries.has(id)) return require_Schema$1.void_;
 			entries.delete(id);
@@ -77444,7 +77444,7 @@ const makeNoSerialization = /* @__PURE__ */ require_Schema$1.fnUntraced(function
 	});
 });
 const applyMiddleware = (context, handler, options) => {
-	for (const service of options.rpc.middlewares) handler = require_Schema$1.getUnsafe(context, service)(handler, options);
+	for (const service of options.rpc.middlewares) handler = require_Schema$1.getUnsafe$1(context, service)(handler, options);
 	return handler;
 };
 /**
@@ -115412,7 +115412,7 @@ const fromPool = /* @__PURE__ */ require_Schema$1.fnUntraced(function* (options)
 	}, client ? require_Schema$1.succeed(client) : reserveRaw);
 	const reserveRaw = require_Schema$1.callback((resume) => {
 		const fiber = require_Path.getCurrent();
-		const scope = require_Schema$1.getUnsafe(fiber.context, require_Schema$1.Scope);
+		const scope = require_Schema$1.getUnsafe$1(fiber.context, require_Schema$1.Scope);
 		let cause = void 0;
 		function onError(cause_) {
 			cause = cause_;
@@ -119238,8 +119238,8 @@ require_Schema$1.effectDiscard(runMigrations());
 //#endregion
 //#region src/persistence/Layers/Sqlite.ts
 const defaultSqliteClientLoaders = {
-	bun: () => Promise.resolve().then(() => require("./SqliteClient-k0pbfeIC.cjs")),
-	node: () => Promise.resolve().then(() => require("./NodeSqliteClient-CPsJxxdD.cjs"))
+	bun: () => Promise.resolve().then(() => require("./SqliteClient-BgoGs_ji.cjs")),
+	node: () => Promise.resolve().then(() => require("./NodeSqliteClient-VL8Dgl03.cjs"))
 };
 const makeRuntimeSqliteLayer = require_Schema$1.fn("makeRuntimeSqliteLayer")(function* (config) {
 	const loader = defaultSqliteClientLoaders[process.versions.bun !== void 0 ? "bun" : "node"];
@@ -213922,6 +213922,7 @@ function categorizePublicProviderError(message) {
 	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
 	if (/\bmodel\b[\s\S]*\b(not\s+(found|available|supported)|does\s+not\s+exist|unsupported|invalid|unknown)\b/.test(m) || /\b(unsupported|unknown|invalid)\b[\s\S]*\bmodel\b/.test(m) || /\b(model_not_found|invalid_model|model_not_supported)\b/.test(m)) return "The selected model isn't available right now. Pick a different model and retry.";
 	if (isProviderRateOrQuotaError(m)) return "The AI service is rate-limited or out of quota. Wait a moment and retry.";
+	if (/_credential_reconnect_required\b/.test(m)) return "The workspace AI credential needs to be reconnected. Reconnect it in Settings > Providers, then retry.";
 	if (/\b(unauthorized|forbidden|authentication\s+(failed|error|required)|invalid\s+api\s+key|expired\s+(token|credential))\b/.test(m) || /\b40[13]\b/.test(m)) return "Workspace AI authentication failed. Reconnect the workspace and retry.";
 	if (/\b(timed?\s*out|timeout|overloaded|service\s+unavailable)\b/.test(m) || /\b50[234]\b/.test(m)) return "The AI service is temporarily overloaded. Retry in a moment.";
 	return null;
@@ -292537,6 +292538,52 @@ function applyThreadGoalPreamble(goal, input) {
 	return trimmedInput.length > 0 ? `${preamble}\n\n${trimmedInput}` : preamble;
 }
 //#endregion
+//#region src/orchestration/providerRetryableFailure.ts
+/**
+* Classifies a provider turn-start failure as a retryable rate-limit or
+* transient-availability failure (429/503), a terminal failure that names why
+* it will never clear on its own, or unrecognized (null).
+*
+* CMMD-Center/forge#3558: a 429 from CMMD's provider egress used to leave no
+* trace at all, because nothing in the turn-start path recognized it as a
+* distinct, retryable failure. `ProviderCommandReactor` uses this to decide
+* whether to retry a turn start with backoff, and to name the provider,
+* status and Retry-After in the `provider.turn.start.failed` activity CMMD's
+* watchdog reads once retries are exhausted.
+*
+* Reuses `isProviderRateOrQuotaError` (the same predicate the public-copy
+* sanitizer uses to recognize a rate-limit message) rather than restating its
+* word list here.
+*/
+const SERVICE_UNAVAILABLE_PATTERN = /\b(503|service\s+unavailable)\b/i;
+const RATE_LIMITED_PAST_TENSE_PATTERN = /\brate[\s-]?limit(?:ed|ing)?\b/i;
+const QUOTA_OR_USAGE_LIMIT_PATTERN = /\b(usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/i;
+const EXPLICIT_429_PATTERN = /\b429\b/;
+const RETRY_AFTER_SECONDS_PATTERN = /retry-after[^0-9]{0,10}(\d+)|(?:try again|retry)\s+in\s+(\d+)\s*(?:s\b|sec(?:onds?)?\b)?/i;
+function parseRetryAfterSeconds(detail) {
+	const match = detail.match(RETRY_AFTER_SECONDS_PATTERN);
+	if (!match) return null;
+	const raw = match[1] ?? match[2];
+	const seconds = raw ? Number(raw) : NaN;
+	return Number.isFinite(seconds) ? seconds : null;
+}
+function classifyRetryableProviderFailure(detail) {
+	if (!detail || detail.trim().length === 0) return null;
+	if (QUOTA_OR_USAGE_LIMIT_PATTERN.test(detail) && !EXPLICIT_429_PATTERN.test(detail)) return {
+		kind: "terminal",
+		reason: "quota",
+		message: detail
+	};
+	const isRateLimited = isProviderRateOrQuotaError(detail) || RATE_LIMITED_PAST_TENSE_PATTERN.test(detail);
+	const isUnavailable = SERVICE_UNAVAILABLE_PATTERN.test(detail);
+	if (!isRateLimited && !isUnavailable) return null;
+	return {
+		kind: "retryable",
+		status: isRateLimited ? 429 : 503,
+		retryAfterSeconds: parseRetryAfterSeconds(detail)
+	};
+}
+//#endregion
 //#region src/orchestration/Layers/ProviderCommandReactor.ts
 function toNonEmptyProviderInput(value) {
 	const normalized = value?.trim();
@@ -292557,6 +292604,40 @@ const HANDLED_TURN_START_KEY_MAX = 1e4;
 const HANDLED_TURN_START_KEY_TTL = require_Schema$1.minutes(30);
 const DEFAULT_RUNTIME_MODE = "full-access";
 const DEFAULT_THREAD_TITLE = "New thread";
+/**
+* Bounds retrying a turn-start ack (`turn/start`) that failed with a
+* retryable status (429/503). Kept well under `withProviderTurnStartTimeout`'s
+* 45 s budget: a Retry-After longer than fits here would otherwise blow that
+* timeout and end the turn as an unreplicated `provider.turn.start.timeout`
+* instead of the replicated `provider.turn.start.failed` CMMD's watchdog reads
+* (CMMD-Center/forge#3558).
+*/
+const PROVIDER_RETRY_MAX_ATTEMPTS = 3;
+const PROVIDER_RETRY_BASE_DELAY = require_Schema$1.millis(100);
+/** The longest this loop will ever wait for a single attempt's Retry-After. */
+const PROVIDER_RETRY_MAX_DELAY_PER_ATTEMPT = require_Schema$1.seconds(20);
+/**
+* The longest this loop will ever sleep in total, across every attempt,
+* counted from the first failure. Two sleeps at the per-attempt cap above
+* would already reach 40s on their own, leaving nothing for the
+* `ensureSessionForThread` preamble work and the `sendTurn` round trips that
+* share `withProviderTurnStartTimeout`'s 45s budget with this loop. 30s keeps
+* 15s of headroom for that other work. A Retry-After that would need more
+* than what remains fails the turn immediately and names the real ask,
+* rather than sleeping a truncated amount and 429ing again anyway once it
+* wakes up (CMMD-Center/forge#3558 review item 4).
+*/
+const PROVIDER_RETRY_TOTAL_SLEEP_BUDGET = require_Schema$1.seconds(30);
+/**
+* How long the reactor watches for `turn.started` (or a terminal failure)
+* after a turn-start ack succeeds, before treating silence as a failure.
+* Codex retries a 429 internally and reports every attempt as a bare `error`
+* notification with `willRetry`, none of which reach CMMD on their own
+* (mapped to `runtime.warning`, which does not replicate) — this is the
+* budget for those internal retries to either land or report a final failure
+* (CMMD-Center/forge#3558).
+*/
+const PROVIDER_TURN_START_WATCH_BUDGET = require_Schema$1.minutes(3);
 const isProviderValidationError = require_Schema$1.is(ProviderValidationError);
 const isProviderKind = require_Schema$1.is(ProviderKind);
 function isPathInsideRoot(candidatePath, rootPath) {
@@ -292701,6 +292782,176 @@ function takeValidatedContinuationSession(input) {
 function discardOwnedContinuationSession(staged, threadId) {
 	if (staged?.threadId === threadId) takeExactThreadContinuationSession(staged);
 }
+/** The message text and, when the error carries one, the provider name it named. */
+function sendTurnFailureDetail(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	const provider = error !== null && typeof error === "object" && "provider" in error && typeof error.provider === "string" ? error.provider : void 0;
+	return provider !== void 0 ? {
+		message,
+		provider
+	} : { message };
+}
+/**
+* The delay before the next `sendTurn` attempt: the provider's own
+* Retry-After when it gave one, otherwise exponential backoff from
+* `PROVIDER_RETRY_BASE_DELAY`. Deliberately not capped here --
+* `sendTurnWithRetry` decides whether the desired delay fits the per-attempt
+* and total budgets, and fails outright rather than silently sleeping less
+* than the provider asked for (CMMD-Center/forge#3558 review item 4).
+*/
+function desiredRetryDelay(input) {
+	if (input.retryAfterSeconds !== null) return require_Schema$1.seconds(input.retryAfterSeconds);
+	return require_Schema$1.times(PROVIDER_RETRY_BASE_DELAY, 2 ** (input.attempt - 1));
+}
+/**
+* The `provider.turn.start.failed` detail once retries are exhausted. Names
+* the provider, the status every attempt answered, how many attempts ran, and
+* the Retry-After the provider asked for, so CMMD's watchdog (and whoever
+* reads the failed Work Session) knows this was a rate limit rather than an
+* unspecified refusal.
+*/
+function retryExhaustedFailureDetail(input) {
+	const providerLabel = input.provider ? `The ${input.provider} provider` : "The provider";
+	const retryAfter = input.classified.retryAfterSeconds !== null ? ` It asked to retry after ${input.classified.retryAfterSeconds}s.` : "";
+	return `${providerLabel} responded ${input.classified.status} on every attempt (${input.attempts} of ${input.attempts}).${retryAfter} ${input.underlyingMessage}`;
+}
+/**
+* The `provider.turn.start.failed` detail when honoring the provider's own
+* Retry-After would need more time than `PROVIDER_RETRY_MAX_DELAY_PER_ATTEMPT`
+* or the loop's remaining `PROVIDER_RETRY_TOTAL_SLEEP_BUDGET` allow. Fails the
+* turn immediately and names the real ask, rather than sleeping a truncated
+* amount and 429ing again once it wakes up (CMMD-Center/forge#3558 review
+* item 4).
+*/
+function retryBudgetExceededFailureDetail(input) {
+	return `${input.provider ? `The ${input.provider} provider` : "The provider"} asked to retry after ${input.classified.retryAfterSeconds !== null ? `${input.classified.retryAfterSeconds}s` : "an unspecified time"}, longer than Forge allows for a turn-start retry (stopped after ${input.attempts} of ${PROVIDER_RETRY_MAX_ATTEMPTS} attempts). ${input.underlyingMessage}`;
+}
+/**
+* The `provider.turn.start.failed` detail when the turn-start ack succeeded
+* but no `turn.started`, no terminal failure, and (past the watch budget) no
+* event at all ever arrived for it — Codex retrying a 429 with no observable
+* progress until it either recovers or gives up.
+*/
+function turnStartWatchTimedOutDetail(lastRetrySignal) {
+	if (lastRetrySignal === null) return "The provider accepted the turn but never reported it starting, and reported no error either.";
+	if (lastRetrySignal.kind === "terminal") return `The provider reported a failure that will not clear by retrying, and never started the turn. ${lastRetrySignal.message}`;
+	const retryAfter = lastRetrySignal.retryAfterSeconds !== null ? ` It last asked to retry after ${lastRetrySignal.retryAfterSeconds}s.` : "";
+	return `The provider kept answering ${lastRetrySignal.status} without ever starting the turn or reporting a final error.${retryAfter}`;
+}
+/**
+* The events that end the watch started after a turn-start ack: the turn
+* actually starting, that same turn completing (a Codex retry loop can settle
+* `turn/completed` with no `turn/started` in between), or a runtime error for
+* THIS turn (Codex's final `error` notification once `willRetry` turns false
+* — see `mapCodexRuntimeErrorEvent`).
+*
+* `runtime.error` matches when it carries no turn id at all (a genuine
+* session-level error) or carries this exact turn's id. This buffer starts
+* before the ack (`openTurnStartEventBuffer`), so a `runtime.error` for a
+* DIFFERENT, still-in-flight turn on the same thread is now visible to this
+* watch too; without the turn id check, that event would wrongly end this
+* turn's watch (forge-runtime-supervision's async-hold-and-refresh interleaving
+* review).
+*/
+function isTurnStartWatchTerminalEvent(event, turnId) {
+	if (event.type === "turn.started") return event.turnId === turnId;
+	if (event.type === "turn.completed") return event.turnId === turnId;
+	return event.type === "runtime.error" && (event.turnId === void 0 || event.turnId === turnId);
+}
+/**
+* Retries `sendTurn` on a retryable ack failure (429/503), with backoff
+* bounded by `PROVIDER_RETRY_MAX_ATTEMPTS`, `PROVIDER_RETRY_MAX_DELAY_PER_ATTEMPT`
+* and `PROVIDER_RETRY_TOTAL_SLEEP_BUDGET`. A non-retryable failure (401, the
+* #3552 broker-authority miss, quota exhaustion, an unrelated adapter error)
+* fails on the first attempt.
+*
+* Never resubmits after an ack succeeds: codex has already created the turn
+* by then, and a second `turn/start` would duplicate it and resend the
+* user's message. Once retries are exhausted — or the provider's own
+* Retry-After would need more time than this loop allows — the failure this
+* raises names the provider, the status, and the real Retry-After, rather
+* than whatever the underlying adapter error happened to say.
+*
+* Exported and kept at module scope (out of `ProviderCommandReactor`'s
+* `make`) so it can be tested directly against a fake clock, without a real
+* 20-30s wait (CMMD-Center/forge#3558 review item 4).
+*/
+const sendTurnWithRetry = require_Schema$1.fn("sendTurnWithRetry")(function* (input) {
+	let attempt = 1;
+	let totalSlept = require_Schema$1.zero;
+	while (true) {
+		const outcome = yield* require_Schema$1.result(input.sendTurn(input.turnInput));
+		if (outcome._tag === "Success") return outcome.success;
+		const { message, provider } = sendTurnFailureDetail(outcome.failure);
+		const classified = classifyRetryableProviderFailure(message);
+		if (classified === null || classified.kind === "terminal") return yield* outcome.failure;
+		const desired = desiredRetryDelay({
+			attempt,
+			retryAfterSeconds: classified.retryAfterSeconds
+		});
+		const remainingBudget = require_Schema$1.subtract(PROVIDER_RETRY_TOTAL_SLEEP_BUDGET, totalSlept);
+		const exceedsBudget = require_Schema$1.isGreaterThan$1(desired, PROVIDER_RETRY_MAX_DELAY_PER_ATTEMPT) || require_Schema$1.isGreaterThan$1(desired, remainingBudget);
+		if (attempt >= PROVIDER_RETRY_MAX_ATTEMPTS || exceedsBudget) return yield* new ProviderAdapterRequestError({
+			provider: provider ?? "provider",
+			method: "turn/start",
+			detail: exceedsBudget ? retryBudgetExceededFailureDetail({
+				provider,
+				classified,
+				attempts: attempt,
+				underlyingMessage: message
+			}) : retryExhaustedFailureDetail({
+				provider,
+				classified,
+				attempts: attempt,
+				underlyingMessage: message
+			}),
+			cause: outcome.failure
+		});
+		yield* require_Schema$1.sleep(desired);
+		totalSlept = require_Schema$1.sum(totalSlept, desired);
+		attempt += 1;
+	}
+});
+/**
+* Runs the flow after a turn-start ack attempt. On a failed or skipped ack,
+* closes the event buffer and reports through `onFailure`/`onSkipped`; on a
+* successful ack, hands off to `onSent`, which forks the turn-start watch
+* that then owns the buffer for the rest of its life.
+*
+* Wrapped in its own `Effect.onInterrupt` covering `send` through `onSent`:
+* an interrupt landing anywhere in that span — mid-ack, mid the retry's own
+* backoff, or in the gap between a successful ack and the watch actually
+* being forked — still closes the buffer. Once `onSent` returns (the watch
+* has been forked), this effect has completed normally and the wrapper no
+* longer applies from there on; the watch's own `Effect.ensuring` owns the
+* buffer from that point (CodeRabbit on CMMD-Center/forge#3558: the buffer
+* never closed on a pre-fork interrupt).
+*
+* Deliberately does not release the turn-start hold: that stays the
+* caller's job. `recoverProviderTurnStartTimeout`'s `releaseHold` and
+* `processDomainEventSafely`'s own `Effect.onInterrupt` already cover every
+* path that can end this attempt (review items 3 and 7), and releasing here
+* too would let the hold go before a failure activity this same interrupt
+* is still writing has landed.
+*
+* Extracted to module scope — like `sendTurnWithRetry` above — so this
+* interrupt-safety claim can be exercised directly with `Deferred` and
+* `Fiber.interrupt`, without the full reactor test harness.
+*/
+const runTurnStartAckOutcome = (input) => require_Schema$1.gen(function* () {
+	const sendExit = yield* input.send.pipe(require_Schema$1.exit);
+	if (require_Schema$1.isFailure(sendExit)) {
+		yield* input.close;
+		yield* input.onFailure(sendExit.cause);
+		return;
+	}
+	if (sendExit.value._tag === "skipped") {
+		yield* input.close;
+		yield* input.onSkipped;
+		return;
+	}
+	yield* input.onSent(sendExit.value.turnId);
+}).pipe(require_Schema$1.onInterrupt(() => input.close));
 function buildGeneratedWorktreeBranchName(raw) {
 	const normalized = raw.trim().toLowerCase().replace(/^refs\/heads\//, "").replace(/['"`]/g, "");
 	const branchFragment = (normalized.startsWith(`forge/`) ? normalized.slice(`${WORKTREE_BRANCH_PREFIX}/`.length) : normalized).replace(/[^a-z0-9/_-]+/g, "-").replace(/\/+/g, "/").replace(/-+/g, "-").replace(/^[./_-]+|[./_-]+$/g, "").slice(0, 64).replace(/[./_-]+$/g, "");
@@ -292715,12 +292966,48 @@ const make$8 = require_Schema$1.gen(function* () {
 	const serverSettingsService = yield* ServerSettingsService;
 	const serverConfig = yield* ServerConfig;
 	const runtimeDrainState = yield* RuntimeDrainState;
+	const spriteTaskHoldReactor = yield* require_Schema$1.serviceOption(SpriteTaskHoldReactor);
+	const holdTurnStart = (key) => require_Schema$1.isSome(spriteTaskHoldReactor) ? spriteTaskHoldReactor.value.holdTurnStart(key) : require_Schema$1.void_;
+	const releaseTurnStart = (key) => require_Schema$1.isSome(spriteTaskHoldReactor) ? spriteTaskHoldReactor.value.releaseTurnStart(key) : require_Schema$1.void_;
 	const handledTurnStartKeys = yield* require_Cache.make({
 		capacity: HANDLED_TURN_START_KEY_MAX,
 		timeToLive: HANDLED_TURN_START_KEY_TTL,
 		lookup: () => require_Schema$1.succeed(true)
 	});
 	const hasHandledTurnStartRecently = (key) => require_Cache.getOption(handledTurnStartKeys, key).pipe(require_Schema$1.flatMap((cached) => require_Cache.set(handledTurnStartKeys, key, true).pipe(require_Schema$1.as(require_Schema$1.isSome(cached)))));
+	/**
+	* Per-attempt buffers of `providerService.streamEvents`, keyed by the same
+	* turn-start attempt key `holdTurnStart` uses — not by thread id: two
+	* overlapping turn-start attempts on one thread each need their own buffer,
+	* fed from before each one's own ack (see the doc comment on `holdTurnStart`
+	* calls below, and forge-runtime-supervision's interleaving review).
+	* `startTurnStartEventRouter` is the one place that ever reads
+	* `providerService.streamEvents` for this purpose, subscribed once for the
+	* reactor's whole lifetime, exactly like `SpriteTaskHoldReactor.start`, so no
+	* attempt ever races to open its own subscription in time for its ack
+	* (CMMD-Center/forge#3558 review item 1).
+	*/
+	const turnStartEventBuffers = /* @__PURE__ */ new Map();
+	const openTurnStartEventBuffer = (key, threadId) => require_Schema$1.gen(function* () {
+		const queue = yield* require_Path.unbounded();
+		turnStartEventBuffers.set(key, {
+			threadId,
+			queue
+		});
+		return queue;
+	});
+	const closeTurnStartEventBuffer = (key, queue) => require_Schema$1.sync(() => {
+		if (turnStartEventBuffers.get(key)?.queue === queue) turnStartEventBuffers.delete(key);
+	}).pipe(require_Schema$1.andThen(require_Path.shutdown(queue)));
+	/**
+	* Started once from `start()`. Fans out every provider event to every
+	* currently-open buffer for its thread — plural, not a single lookup,
+	* because two turn-start attempts can be in flight on the same thread at
+	* once (CMMD-Center/forge#3558 review item 1).
+	*/
+	const startTurnStartEventRouter = require_Schema$1.fn("startTurnStartEventRouter")(function* () {
+		yield* require_Schema$1.forkScoped(require_Path.runForEach(providerService.streamEvents, (event) => require_Schema$1.forEach(Array.from(turnStartEventBuffers.values()).filter((entry) => entry.threadId === event.threadId), (entry) => require_Path.offer(entry.queue, event), { discard: true })));
+	});
 	const threadModelSelections = /* @__PURE__ */ new Map();
 	/**
 	* The providerAccountId each LIVE provider session was actually started with.
@@ -292877,9 +293164,87 @@ const make$8 = require_Schema$1.gen(function* () {
 		yield* bindSessionToThread(startedSession);
 		return startedSession.threadId;
 	});
+	/**
+	* Waits for a turn-start ack to either start (or complete) or fail, after
+	* the provider has already accepted it. Codex's own 429 retries surface as
+	* an `error` notification with `willRetry`, mapped to `runtime.warning`
+	* while retries continue and to `runtime.error` only once they stop
+	* (`mapCodexRuntimeErrorEvent`); `runtime.warning` never replicates to CMMD,
+	* so without this a turn that fails this way never told CMMD anything
+	* happened at all (CMMD-Center/forge#3558).
+	*
+	* Reads from `events`, a per-attempt buffer opened by
+	* `openTurnStartEventBuffer` BEFORE the ack was sent, rather than
+	* subscribing to `providerService.streamEvents` directly here: a fresh
+	* subscription opened only now would miss a `turn.started` published in the
+	* gap between the ack and this call (review item 1).
+	*/
+	const watchTurnStartOutcome = require_Schema$1.fn("watchTurnStartOutcome")(function* (input) {
+		const lastRetrySignal = yield* require_HttpServer.make$3(null);
+		const terminalEvent = yield* require_Path.fromQueue(input.events).pipe(require_Path.mapEffect((event) => require_Schema$1.gen(function* () {
+			if (event.type === "runtime.warning") {
+				const classified = classifyRetryableProviderFailure(event.payload.message);
+				if (classified) yield* require_HttpServer.set(lastRetrySignal, classified);
+			}
+			return event;
+		})), require_Path.filter((event) => isTurnStartWatchTerminalEvent(event, input.turnId)), require_Path.runHead).pipe(require_Schema$1.timeout(PROVIDER_TURN_START_WATCH_BUDGET), require_Schema$1.catchTag("TimeoutError", () => require_Schema$1.succeed(require_Schema$1.none())));
+		if (require_Schema$1.isNone(terminalEvent)) return {
+			_tag: "TimedOut",
+			lastRetrySignal: yield* require_HttpServer.get$1(lastRetrySignal)
+		};
+		const event = terminalEvent.value;
+		if (event.type === "turn.started") return { _tag: "Started" };
+		if (event.type === "turn.completed") return {
+			_tag: "Failed",
+			detail: event.payload.errorMessage ?? "The provider ended the turn with no error detail."
+		};
+		return {
+			_tag: "Failed",
+			detail: event.payload.message
+		};
+	});
+	/**
+	* Finalizes a turn-start watch: releases the turn-start hold and closes its
+	* event buffer, only AFTER the outcome is durably handled — either the turn
+	* started, or the `provider.turn.start.failed` activity has actually been
+	* persisted. No blanket `Effect.ensuring` for the release: if
+	* `appendProviderFailureActivity` itself fails, the hold stays held rather
+	* than being released with no durable record of why the turn failed
+	* (review item 2). `Effect.onInterrupt` covers the one case that ordering
+	* cannot: a shutdown while this watch is still waiting. A write mid-shutdown
+	* is not reliable, so that path only releases the hold; the turn is left
+	* for CMMD's own sweep rather than ended with an event here (review item 7).
+	* The event buffer itself always closes, via `Effect.ensuring`: it is a
+	* local resource with nothing durable riding on its cleanup order.
+	*/
+	const watchTurnStartAndFinalize = (input) => require_Schema$1.gen(function* () {
+		const outcome = yield* watchTurnStartOutcome({
+			threadId: input.threadId,
+			turnId: input.turnId,
+			events: input.events
+		});
+		if (outcome._tag === "Started") {
+			yield* releaseTurnStart(input.holdKey);
+			return;
+		}
+		const detail = outcome._tag === "Failed" ? outcome.detail : turnStartWatchTimedOutDetail(outcome.lastRetrySignal);
+		yield* appendProviderFailureActivity({
+			threadId: input.threadId,
+			kind: "provider.turn.start.failed",
+			summary: "Provider turn start failed",
+			detail: publicProviderFailureDetail(detail),
+			turnId: input.turnId,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		yield* releaseTurnStart(input.holdKey);
+	}).pipe(require_Schema$1.catchCause((cause) => require_Schema$1.hasInterruptsOnly(cause) ? require_Schema$1.void_ : require_Schema$1.logWarning("provider command reactor turn-start watch failed", {
+		threadId: input.threadId,
+		turnId: input.turnId,
+		cause: require_Schema$1.pretty(cause)
+	})), require_Schema$1.onInterrupt(() => releaseTurnStart(input.holdKey)), require_Schema$1.ensuring(closeTurnStartEventBuffer(input.holdKey, input.events)));
 	const sendTurnForThread = require_Schema$1.fn("sendTurnForThread")(function* (input) {
 		const thread = yield* resolveThread(input.threadId);
-		if (!thread) return;
+		if (!thread) return { _tag: "skipped" };
 		if (yield* runtimeDrainState.isDraining) {
 			yield* appendProviderFailureActivity({
 				threadId: input.threadId,
@@ -292889,7 +293254,7 @@ const make$8 = require_Schema$1.gen(function* () {
 				turnId: null,
 				createdAt: (/* @__PURE__ */ new Date()).toISOString()
 			});
-			return;
+			return { _tag: "skipped" };
 		}
 		yield* ensureSessionForThread(input.threadId, input.createdAt, input.modelSelection !== void 0 ? { modelSelection: input.modelSelection } : {});
 		if (input.modelSelection !== void 0) threadModelSelections.set(input.threadId, input.modelSelection);
@@ -292913,13 +293278,19 @@ const make$8 = require_Schema$1.gen(function* () {
 			...requestedModelSelection,
 			model: activeSession.model
 		} : requestedModelSelection : input.modelSelection;
-		yield* providerService.sendTurn({
-			threadId: input.threadId,
-			...normalizedInput ? { input: normalizedInput } : {},
-			...normalizedAttachments.length > 0 ? { attachments: normalizedAttachments } : {},
-			...modelForTurn !== void 0 ? { modelSelection: modelForTurn } : {},
-			...input.interactionMode !== void 0 ? { interactionMode: input.interactionMode } : {}
-		});
+		return {
+			_tag: "sent",
+			turnId: (yield* sendTurnWithRetry({
+				sendTurn: providerService.sendTurn,
+				turnInput: {
+					threadId: input.threadId,
+					...normalizedInput ? { input: normalizedInput } : {},
+					...normalizedAttachments.length > 0 ? { attachments: normalizedAttachments } : {},
+					...modelForTurn !== void 0 ? { modelSelection: modelForTurn } : {},
+					...input.interactionMode !== void 0 ? { interactionMode: input.interactionMode } : {}
+				}
+			})).turnId
+		};
 	});
 	const maybeGenerateAndRenameWorktreeBranchForFirstTurn = require_Schema$1.fn("maybeGenerateAndRenameWorktreeBranchForFirstTurn")(function* (input) {
 		if (!input.branch || !input.worktreePath) return;
@@ -293099,7 +293470,8 @@ const make$8 = require_Schema$1.gen(function* () {
 		});
 	});
 	const processTurnStartRequested = require_Schema$1.fn("processTurnStartRequested")(function* (event) {
-		if (yield* hasHandledTurnStartRecently(turnStartKeyForEvent(event))) return;
+		const key = turnStartKeyForEvent(event);
+		if (yield* hasHandledTurnStartRecently(key)) return;
 		const thread = yield* resolveThread(event.payload.threadId);
 		if (!thread) return;
 		const message = thread.messages.find((entry) => entry.id === event.payload.messageId);
@@ -293150,21 +293522,35 @@ const make$8 = require_Schema$1.gen(function* () {
 				...generationInput
 			}).pipe(require_Schema$1.forkScoped);
 		}
-		yield* sendTurnForThread({
-			threadId: event.payload.threadId,
-			messageText: message.text,
-			...message.attachments !== void 0 ? { attachments: message.attachments } : {},
-			...event.payload.modelSelection !== void 0 ? { modelSelection: event.payload.modelSelection } : {},
-			interactionMode: event.payload.interactionMode,
-			createdAt: event.payload.createdAt
-		}).pipe(require_Schema$1.catchCause((cause) => appendProviderFailureActivity({
-			threadId: event.payload.threadId,
-			kind: "provider.turn.start.failed",
-			summary: "Provider turn start failed",
-			detail: publicProviderFailureDetailFromCause(cause),
-			turnId: null,
-			createdAt: (/* @__PURE__ */ new Date()).toISOString()
-		})));
+		const turnStartHoldKey = key;
+		yield* require_Schema$1.uninterruptible(holdTurnStart(turnStartHoldKey));
+		const turnStartEvents = yield* openTurnStartEventBuffer(turnStartHoldKey, event.payload.threadId);
+		yield* runTurnStartAckOutcome({
+			send: sendTurnForThread({
+				threadId: event.payload.threadId,
+				messageText: message.text,
+				...message.attachments !== void 0 ? { attachments: message.attachments } : {},
+				...event.payload.modelSelection !== void 0 ? { modelSelection: event.payload.modelSelection } : {},
+				interactionMode: event.payload.interactionMode,
+				createdAt: event.payload.createdAt
+			}),
+			close: closeTurnStartEventBuffer(turnStartHoldKey, turnStartEvents),
+			onFailure: (cause) => appendProviderFailureActivity({
+				threadId: event.payload.threadId,
+				kind: "provider.turn.start.failed",
+				summary: "Provider turn start failed",
+				detail: publicProviderFailureDetailFromCause(cause),
+				turnId: null,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			}).pipe(require_Schema$1.andThen(releaseTurnStart(turnStartHoldKey))),
+			onSkipped: releaseTurnStart(turnStartHoldKey),
+			onSent: (turnId) => watchTurnStartAndFinalize({
+				threadId: event.payload.threadId,
+				turnId,
+				holdKey: turnStartHoldKey,
+				events: turnStartEvents
+			}).pipe(require_Schema$1.forkScoped)
+		});
 	});
 	const processTurnInterruptRequested = require_Schema$1.fn("processTurnInterruptRequested")(function* (event) {
 		const thread = yield* resolveThread(event.payload.threadId);
@@ -293386,6 +293772,7 @@ const make$8 = require_Schema$1.gen(function* () {
 	});
 	const recoverTimedOutProviderTurnStart = (event) => recoverProviderTurnStartTimeout({
 		cleanup: stopTimedOutProviderSession(event),
+		releaseHold: releaseTurnStart(turnStartKeyForEvent(event)),
 		markRecoverable: appendRecoverableTurnStartTimeout(event),
 		markCleanupFailed: (cause) => appendProviderFailureActivity({
 			threadId: event.payload.threadId,
@@ -293398,7 +293785,7 @@ const make$8 = require_Schema$1.gen(function* () {
 	});
 	const processDomainEventSafely = (event) => {
 		const operation = processDomainEvent(event);
-		return (event.type === "thread.turn-start-requested" ? withProviderTurnStartTimeout(operation, recoverTimedOutProviderTurnStart(event)) : operation).pipe(require_Schema$1.catchCause((cause) => {
+		return (event.type === "thread.turn-start-requested" ? withProviderTurnStartTimeout(operation, recoverTimedOutProviderTurnStart(event)).pipe(require_Schema$1.onInterrupt(() => releaseTurnStart(turnStartKeyForEvent(event)))) : operation).pipe(require_Schema$1.catchCause((cause) => {
 			if (require_Schema$1.hasInterruptsOnly(cause)) return require_Schema$1.failCause(cause);
 			return require_Schema$1.logWarning("provider command reactor failed to process event", {
 				eventType: event.type,
@@ -293441,6 +293828,7 @@ const make$8 = require_Schema$1.gen(function* () {
 				if (event.type === "thread.meta-updated" && event.payload.regenerateTitle === true) return yield* titleRegenerationWorker.enqueue(event);
 			});
 			yield* clearInterruptedThreadTitleRegenerations().pipe(require_Schema$1.catchCause((cause) => require_Schema$1.logWarning("provider command reactor failed to sweep interrupted title regenerations", { cause: require_Schema$1.pretty(cause) })));
+			yield* startTurnStartEventRouter();
 			yield* require_Schema$1.forkScoped(require_Path.runForEach(orchestrationEngine.streamDomainEvents, processEvent));
 		}),
 		drain: require_Schema$1.all([worker.drain, titleRegenerationWorker.drain], {
@@ -293457,7 +293845,7 @@ function recoverProviderTurnStartTimeout(input) {
 	return input.cleanup.pipe(require_Schema$1.matchEffect({
 		onFailure: input.markCleanupFailed,
 		onSuccess: () => input.markRecoverable
-	}));
+	}), require_Schema$1.ensuring(input.releaseHold));
 }
 (() => {
 	try {
@@ -294703,6 +295091,16 @@ const CheckpointReactorLive = require_Schema$1.effect(CheckpointReactor, make$7)
 const LAUNCH_HOLD_MAX_REFRESHES = 10;
 /** The hold id of a pending turn start. The thread names it until turn.started arrives. */
 const launchHoldId = (threadId) => `launch-${threadId}`;
+/**
+* Refresh budget for a turn-start hold (`holdTurnStart`): about ten minutes, matching the launch
+* hold's own budget. `ProviderCommandReactor` bounds its own retry-and-watch window well inside
+* this; the budget here is the backstop if that watch is itself interrupted (a server restart, a
+* bug) without releasing the hold.
+*/
+const TURN_START_HOLD_MAX_REFRESHES = 10;
+/** The hold id for `holdTurnStart` / `releaseTurnStart`. Distinct from `launchHoldId` on purpose:
+* see the shape's doc comment on `holdTurnStart`. */
+const turnStartHoldId = (key) => `turn-start-${key}`;
 const make$6 = require_Schema$1.gen(function* () {
 	const providerService = yield* ProviderService;
 	const manager = makeSpriteTaskHoldManager(process.env, (message, cause) => {
@@ -294765,10 +295163,21 @@ const make$6 = require_Schema$1.gen(function* () {
 		launchCallers.delete(threadId);
 		await manager.release(launchHoldId(threadId));
 	});
+	/** Takes a turn-start hold. Registered with no thread id: see the shape's doc comment. */
+	const holdTurnStart = (key) => require_Schema$1.promise(async () => {
+		if (manager === null) return;
+		await manager.acquire(turnStartHoldId(key), null, { maxRefreshes: TURN_START_HOLD_MAX_REFRESHES });
+	});
+	const releaseTurnStart = (key) => require_Schema$1.promise(async () => {
+		if (manager === null) return;
+		await manager.release(turnStartHoldId(key));
+	});
 	return {
 		start,
 		holdLaunch,
 		releaseLaunch,
+		holdTurnStart,
+		releaseTurnStart,
 		releaseAll: onManager((taskHolds) => taskHolds.releaseAll())
 	};
 });
@@ -298914,7 +299323,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "8a3582256f668ba9a5af98e78fd83977c7fd34c9";
+	return "61b334c338ab47d92fe5f27155bf40ab9c7e3fed";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -322653,13 +323062,13 @@ const gitUrlCloneRouteLayer = add$1("POST", "/api/cloud/git/clone-url", require_
 //#endregion
 //#region src/server.ts
 const PtyAdapterLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
-	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunPTY-BiTlUj63.cjs")))).layer;
-	else return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodePTY-BJ7874MO.cjs")))).layer;
+	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunPTY-DkR9y_Jg.cjs")))).layer;
+	else return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodePTY-DkaJNgpi.cjs")))).layer;
 }));
 const HttpServerLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
-	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunHttpServer-CXndtc1j.cjs")))).layer(bunHttpServerOptions(config));
-	const [NodeHttpServer, NodeHttp] = yield* require_Schema$1.all([require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeHttpServer-B4dCKqYY.cjs"))), require_Schema$1.promise(() => import("node:http"))]);
+	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunHttpServer-DTG5XWSi.cjs")))).layer(bunHttpServerOptions(config));
+	const [NodeHttpServer, NodeHttp] = yield* require_Schema$1.all([require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeHttpServer-RV5QsVeb.cjs"))), require_Schema$1.promise(() => import("node:http"))]);
 	return NodeHttpServer.layer(NodeHttp.createServer, {
 		host: config.host,
 		port: config.port
@@ -322667,10 +323076,10 @@ const HttpServerLive = require_Schema$1.unwrap(require_Schema$1.gen(function* ()
 }));
 const PlatformServicesLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	if (typeof Bun !== "undefined") {
-		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunServices-DsWG7VM1.cjs")));
+		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunServices-blx5Lx2N.cjs")));
 		return layer;
 	} else {
-		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeServices-BvdIc9Vh.cjs")));
+		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeServices-CocSeCvl.cjs")));
 		return layer;
 	}
 }));