@cmmd-center/forge 0.13.8 → 0.13.9

package/dist/bin.cjs

@@ -66289,7 +66289,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.8";
+var version$1 = "0.13.9";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -88064,14 +88064,18 @@ function resolveRuntimeGitHubGrantAuthFromEnv(headers) {
 }
 function buildCmmdRuntimeGrantFetchRequest(auth, repoFullName) {
 	return {
-		url: new URL(`/api/forge/runtimes/${encodeURIComponent(auth.runtimeId)}/github/installation-token`, resolveCommandAppUrl()).toString(),
+		url: new URL(`/api/forge/runtimes/${encodeURIComponent(auth.runtimeId)}/scm/credential`, resolveCommandAppUrl()).toString(),
 		init: {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${auth.token}`,
 				"Content-Type": "application/json"
 			},
-			body: JSON.stringify({ repo_full_name: repoFullName })
+			body: JSON.stringify({
+				provider: "github",
+				host: "github.com",
+				repository_path: repoFullName
+			})
 		}
 	};
 }
@@ -88533,10 +88537,19 @@ function fetchInstallationTokenForAuth(auth, repoFullName) {
 			ok: false,
 			...lastError
 		};
-		if (tokenResp.ok) return {
-			ok: true,
-			token: (yield* require_Schema$1.promise(() => tokenResp.json())).token
-		};
+		if (tokenResp.ok) {
+			const tokenData = yield* require_Schema$1.promise(() => tokenResp.json());
+			const token = auth.kind === "cmmd-runtime-ticket" ? tokenData.credential : tokenData.token;
+			if (typeof token === "string" && token.trim().length > 0) return {
+				ok: true,
+				token: token.trim()
+			};
+			return {
+				ok: false,
+				status: 502,
+				error: "CMMD returned an invalid source-control credential response."
+			};
+		}
 		const err = yield* require_Schema$1.promise(() => tokenResp.json().catch(() => ({})));
 		lastError = {
 			status: tokenResp.status,
@@ -89458,23 +89471,38 @@ var GitHubBroker = class {
 	async cloneRepository(auth, input) {
 		const cloneInput = validateCloneInput(input);
 		if ("ok" in cloneInput) return cloneInput;
-		const { branch } = cloneInput;
+		let { branch } = cloneInput;
 		const gitToken = await this.resolveInstallationToken(auth, input.repoFullName);
 		if (typeof gitToken !== "string") return gitToken;
-		const initFailure = await this.runCloneGitStep([
+		try {
+			await (0, node_fs_promises.mkdir)(input.destination);
+		} catch (error) {
+			if (isNodeErrorWithCode(error, "EEXIST")) return cloneDestinationExistsResult();
+			return {
+				ok: false,
+				code: "GITHUB_CLONE_DESTINATION_CREATE_FAILED",
+				error: "Could not create the clone destination."
+			};
+		}
+		const initFailure = await this.runCloneGitStep(branch === null ? ["init", input.destination] : [
 			"init",
 			"-b",
 			branch,
 			input.destination
 		], "GITHUB_CLONE_INIT_FAILED", "Could not initialize the clone destination.");
-		if (initFailure) return initFailure;
+		if (initFailure) return removeFailedCloneDestination(input.destination, initFailure);
 		const configured = await this.configureProjectGitCredential({
 			cwd: input.destination,
 			repoFullName: input.repoFullName,
 			token: gitToken,
 			remoteMode: "add"
 		});
-		if (!configured.ok) return configured;
+		if (!configured.ok) return removeFailedCloneDestination(input.destination, configured);
+		if (branch === null) {
+			const defaultBranch = await this.resolveRemoteDefaultBranch(input.destination);
+			if (typeof defaultBranch !== "string") return removeFailedCloneDestination(input.destination, defaultBranch);
+			branch = defaultBranch;
+		}
 		const fetchFailure = await this.runCloneGitStep([
 			"-C",
 			input.destination,
@@ -89484,7 +89512,7 @@ var GitHubBroker = class {
 			"origin",
 			branch
 		], "GITHUB_CLONE_FETCH_FAILED", "Could not fetch the requested repository branch.", { timeoutMs: 12e4 });
-		if (fetchFailure) return fetchFailure;
+		if (fetchFailure) return removeFailedCloneDestination(input.destination, fetchFailure);
 		const checkoutFailure = await this.runCloneGitStep([
 			"-C",
 			input.destination,
@@ -89493,7 +89521,7 @@ var GitHubBroker = class {
 			branch,
 			"FETCH_HEAD"
 		], "GITHUB_CLONE_CHECKOUT_FAILED", "Could not check out the requested repository branch.");
-		if (checkoutFailure) return checkoutFailure;
+		if (checkoutFailure) return removeFailedCloneDestination(input.destination, checkoutFailure);
 		return {
 			ok: true,
 			data: {
@@ -90103,9 +90131,9 @@ var GitHubBroker = class {
 		};
 	}
 	async resolveInstallationToken(auth, repoFullName) {
-		const runtimeGrant = this.resolveRuntimeGrant();
+		const runtimeGrant = this.resolveRuntimeGrant("scm");
 		if (runtimeGrant) {
-			const token = await this.fetchRuntimeInstallationToken(runtimeGrant, repoFullName);
+			const token = await this.fetchRuntimeScmCredential(runtimeGrant, repoFullName);
 			if (!token.ok) return token;
 			return token.token ?? invalidInstallationTokenResult();
 		}
@@ -90488,7 +90516,7 @@ var GitHubBroker = class {
 			repoFullName
 		};
 	}
-	resolveRuntimeGrant() {
+	resolveRuntimeGrant(requiredScope = "github") {
 		if (this.runtimeRole !== "user-vm") return null;
 		const runtimeId = process.env.FORGE_CMMD_RUNTIME_ID?.trim();
 		if (!runtimeId) return null;
@@ -90498,7 +90526,7 @@ var GitHubBroker = class {
 				runtimeId,
 				machineId: identity.machineId,
 				credentialEpoch: identity.credentialEpoch,
-				requiredScope: "github"
+				requiredScope
 			});
 			return authority ? {
 				runtimeId,
@@ -90512,8 +90540,8 @@ var GitHubBroker = class {
 			token: legacyToken
 		} : null;
 	}
-	runtimeGrantAuthContext() {
-		const grant = this.resolveRuntimeGrant();
+	runtimeGrantAuthContext(requiredScope = "github") {
+		const grant = this.resolveRuntimeGrant(requiredScope);
 		if (grant === null) return null;
 		return {
 			sessionId: grant.sessionId ?? AuthSessionId.make(`cmmd-runtime:${grant.runtimeId}`),
@@ -90565,13 +90593,33 @@ var GitHubBroker = class {
 		};
 	}
 	async fetchRuntimeInstallationToken(grant, repoFullName) {
-		const response = await this.fetchImpl(makeUrl(this.commandAppUrl, `/api/forge/runtimes/${encodeURIComponent(grant.runtimeId)}/github/installation-token`), {
+		return this.fetchRuntimeCredential(grant, {
+			url: makeUrl(this.commandAppUrl, `/api/forge/runtimes/${encodeURIComponent(grant.runtimeId)}/github/installation-token`),
+			requestBody: { repo_full_name: repoFullName },
+			responseField: "token",
+			label: "GitHub installation token"
+		});
+	}
+	async fetchRuntimeScmCredential(grant, repoFullName) {
+		return this.fetchRuntimeCredential(grant, {
+			url: makeUrl(this.commandAppUrl, `/api/forge/runtimes/${encodeURIComponent(grant.runtimeId)}/scm/credential`),
+			requestBody: {
+				provider: "github",
+				host: "github.com",
+				repository_path: repoFullName
+			},
+			responseField: "credential",
+			label: "GitHub source-control credential"
+		});
+	}
+	async fetchRuntimeCredential(grant, input) {
+		const response = await this.fetchImpl(input.url, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${grant.token}`,
 				"Content-Type": "application/json"
 			},
-			body: JSON.stringify({ repo_full_name: repoFullName }),
+			body: JSON.stringify(input.requestBody),
 			signal: AbortSignal.timeout(GITHUB_BROKER_REQUEST_TIMEOUT_MS)
 		});
 		const body = await parseResponseBody(response);
@@ -90580,10 +90628,10 @@ var GitHubBroker = class {
 			status: response.status,
 			code: response.status === 401 ? "GITHUB_AUTH_REQUIRED" : "GITHUB_BROKER_REQUEST_FAILED",
 			...response.status === 401 ? { userActionRequired: "connect_github" } : {},
-			error: errorFromBody(body, `GitHub installation token request failed with status ${response.status}.`),
+			error: errorFromBody(body, `${input.label} request failed with status ${response.status}.`),
 			data: body
 		};
-		const token = typeof body === "object" && body !== null ? body.token : null;
+		const token = typeof body === "object" && body !== null ? body[input.responseField] : null;
 		if (typeof token !== "string" || token.trim().length === 0) return invalidInstallationTokenResult();
 		return {
 			ok: true,
@@ -90602,6 +90650,25 @@ var GitHubBroker = class {
 		const branch = result.result.stdout.trim();
 		return branch.length > 0 ? branch : null;
 	}
+	async resolveRemoteDefaultBranch(cwd) {
+		const result = await this.runGit([
+			"-C",
+			cwd,
+			"ls-remote",
+			"--symref",
+			"origin",
+			"HEAD"
+		], { allowNonZeroExit: true });
+		if (!isGitRunResult(result)) return result;
+		if (result.result.code !== 0) return gitCommandFailure("GITHUB_DEFAULT_BRANCH_LOOKUP_FAILED", result.result.stderr, "Could not determine the repository default branch.");
+		const branch = /^ref:\s+refs\/heads\/([^\s]+)\s+HEAD$/m.exec(result.result.stdout)?.[1];
+		if (branch === void 0) return {
+			ok: false,
+			code: "GITHUB_DEFAULT_BRANCH_RESPONSE_INVALID",
+			error: "GitHub did not return a valid default branch for the repository."
+		};
+		return validateGitBranchName(branch) ?? branch;
+	}
 };
 function isCmmdCloudRuntimeModeEnv() {
 	return process.env.FORGE_CMMD_RUNTIME_MODE === "true" || process.env.FORGE_CMMD_RUNTIME_MODE === "1";
@@ -90686,20 +90753,40 @@ function validateCloneDestination(destination) {
 		code: "GITHUB_CLONE_DESTINATION_INVALID",
 		error: "An absolute clone destination is required."
 	};
-	if ((0, node_fs.existsSync)(destination)) return {
+	if ((0, node_fs.existsSync)(destination)) return cloneDestinationExistsResult();
+	return null;
+}
+function cloneDestinationExistsResult() {
+	return {
 		ok: false,
 		code: "GITHUB_CLONE_DESTINATION_EXISTS",
 		error: "Clone destination already exists; choose a new empty path."
 	};
-	return null;
+}
+function isNodeErrorWithCode(error, code) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+async function removeFailedCloneDestination(destination, failure) {
+	try {
+		await (0, node_fs_promises.rm)(destination, {
+			recursive: true,
+			force: true
+		});
+		return failure;
+	} catch {
+		return {
+			...failure,
+			error: `${failure.error ?? "Clone failed."} The incomplete clone destination could not be removed.`
+		};
+	}
 }
 function validateCloneInput(input) {
 	const repoFullNameValidation = validateRepoFullName(input.repoFullName);
 	if (repoFullNameValidation) return repoFullNameValidation;
 	const destinationValidation = validateCloneDestination(input.destination);
 	if (destinationValidation) return destinationValidation;
-	const branch = input.branch?.trim() || "main";
-	return validateGitBranchName(branch) ?? { branch };
+	const branch = input.branch?.trim() || null;
+	return branch === null ? { branch } : validateGitBranchName(branch) ?? { branch };
 }
 function validateGitBranchName(branch) {
 	if (branch.length === 0 || branch.startsWith("-") || Array.from(branch).some((character) => {
@@ -93872,6 +93959,17 @@ const admitNormalizedDispatchCommand = (command, admit) => require_Schema$1.unin
 //#region src/orchestration/bootstrapCommandCoordinator.ts
 const MAX_COMPLETED_COMMANDS_PER_ENGINE = 256;
 const commandsByEngine = /* @__PURE__ */ new WeakMap();
+const sealBootstrapCommand = (engine, commandId) => {
+	const entry = commandsByEngine.get(engine)?.get(commandId);
+	if (entry) entry.cancellable = false;
+};
+const cancelBootstrapCommand = (engine, threadId) => require_Schema$1.promise(async () => {
+	const entry = [...commandsByEngine.get(engine)?.values() ?? []].find((candidate) => candidate.threadId === threadId && !candidate.completed && candidate.cancellable);
+	if (!entry) return false;
+	entry.controller.abort();
+	await entry.promise.catch(() => void 0);
+	return true;
+});
 const toBootstrapError = (error) => require_Schema$1.is(OrchestrationDispatchCommandError)(error) ? error : new OrchestrationDispatchCommandError({
 	message: error instanceof Error ? error.message : "Bootstrap command failed.",
 	cause: error
@@ -93891,7 +93989,7 @@ const pruneCompletedCommands = (commands) => {
 * the registry to one server runtime, so reconnects share work while separate
 * runtimes remain isolated.
 */
-const runBootstrapCommand = (engine, commandId, bootstrapEffect) => {
+const runBootstrapCommand = (engine, commandId, bootstrapEffect, threadId) => {
 	let commands = commandsByEngine.get(engine);
 	if (commands === void 0) {
 		commands = /* @__PURE__ */ new Map();
@@ -93904,16 +94002,21 @@ const runBootstrapCommand = (engine, commandId, bootstrapEffect) => {
 	});
 	pruneCompletedCommands(commands);
 	let entry;
-	const promise = require_Schema$1.runPromise(bootstrapEffect).then((result) => {
+	const controller = new AbortController();
+	const promise = Promise.resolve().then(() => require_Schema$1.runPromise(bootstrapEffect, { signal: controller.signal })).then((result) => {
 		entry.completed = true;
 		return result;
 	}, (error) => {
-		commands.delete(commandId);
+		entry.completed = true;
+		if (!controller.signal.aborted) commands.delete(commandId);
 		throw error;
 	});
 	entry = {
 		promise,
-		completed: false
+		completed: false,
+		threadId,
+		controller,
+		cancellable: true
 	};
 	commands.set(commandId, entry);
 	return require_Schema$1.tryPromise({
@@ -93923,6 +94026,10 @@ const runBootstrapCommand = (engine, commandId, bootstrapEffect) => {
 };
 //#endregion
 //#region src/orchestration/bootstrapDispatch.ts
+const interruptBootstrapTurnStart = (engine, command) => require_Schema$1.gen(function* () {
+	if (yield* cancelBootstrapCommand(engine, command.threadId)) return { sequence: (yield* engine.getReadModel()).snapshotSequence };
+	return yield* engine.dispatch(command);
+});
 const MAX_BOOTSTRAP_OUTPUT_LINE_LENGTH = 1e3;
 const toBootstrapDispatchCommandCauseError = (cause) => {
 	const error = require_Schema$1.squash(cause);
@@ -94009,6 +94116,7 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 	const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
 	const baseBranchLabel = bootstrapWorktree.baseBranch ?? "<default>";
 	const requestedPayload = {
+		turnRequestedAt: input.command.createdAt,
 		projectCwd: bootstrapWorktree.projectCwd,
 		baseBranch: bootstrapWorktree.baseBranch,
 		branch: bootstrapWorktree.branch,
@@ -94029,6 +94137,16 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 		branch: bootstrapWorktree.baseBranch,
 		newBranch: bootstrapWorktree.branch,
 		path: null,
+		onStage: (update) => appendWorktreeActivity({
+			orchestrationEngine: input.orchestrationEngine,
+			threadId: input.command.threadId,
+			commandId: CommandId.make(`server:worktree-stage:${input.command.commandId}:${crypto.randomUUID()}`),
+			kind: "worktree.stage",
+			summary: "Preparing worktree",
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			payload: update,
+			tone: "info"
+		}).pipe(require_Schema$1.asVoid, require_Schema$1.ignore),
 		progress: {
 			onStdoutLine: (line) => {
 				const detail = truncateBootstrapOutputLine(line);
@@ -94068,6 +94186,7 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 			}
 		}
 	}).pipe(require_Schema$1.catchCause((cause) => {
+		if (require_Schema$1.hasInterruptsOnly(cause)) return require_Schema$1.failCause(cause);
 		const error = require_Schema$1.squash(cause);
 		const detail = error instanceof Error ? error.message : "Unknown worktree failure.";
 		return appendWorktreeActivity({
@@ -94194,7 +94313,16 @@ const dispatchBootstrapTurnStart = (input, command) => require_Schema$1.gen(func
 				worktreePath
 			}),
 			onSuccess: (setupResult) => {
-				if (setupResult.status !== "started") return require_Schema$1.void_;
+				if (setupResult.status !== "started") return appendSetupScriptActivity({
+					orchestrationEngine,
+					threadId: command.threadId,
+					commandId: bootstrapCommandId(command, "setup-script-skipped"),
+					kind: "setup-script.skipped",
+					summary: "No setup script configured",
+					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+					payload: {},
+					tone: "info"
+				}).pipe(require_Schema$1.asVoid, require_Schema$1.ignore);
 				return recordSetupScriptStarted({
 					requestedAt,
 					worktreePath,
@@ -94224,13 +94352,33 @@ const dispatchBootstrapTurnStart = (input, command) => require_Schema$1.gen(func
 			targetProjectCwd = preparedWorktree.projectCwd;
 		}
 		yield* runSetupProgram();
+		if (bootstrap?.prepareWorktree) yield* appendWorktreeActivity({
+			orchestrationEngine,
+			threadId: command.threadId,
+			commandId: bootstrapCommandId(command, "launch-agent-starting"),
+			kind: "launch.agent-starting",
+			summary: "Starting agent",
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			payload: { setupRequested: bootstrap.runSetupScript === true },
+			tone: "info"
+		}).pipe(require_Schema$1.ignore);
+		sealBootstrapCommand(orchestrationEngine, command.commandId);
 		return yield* orchestrationEngine.dispatch(finalTurnStartCommand);
 	});
-	return yield* runBootstrapCommand(orchestrationEngine, command.commandId, bootstrapProgram.pipe(require_Schema$1.catchCause((cause) => {
+	return yield* runBootstrapCommand(orchestrationEngine, command.commandId, bootstrapProgram.pipe(require_Schema$1.onInterrupt(() => appendWorktreeActivity({
+		orchestrationEngine,
+		threadId: command.threadId,
+		commandId: bootstrapCommandId(command, "launch-cancelled"),
+		kind: "launch.cancelled",
+		summary: "Launch cancelled",
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		payload: {},
+		tone: "info"
+	}).pipe(require_Schema$1.ignore)), require_Schema$1.catchCause((cause) => {
 		const dispatchError = toBootstrapDispatchCommandCauseError(cause);
 		if (require_Schema$1.hasInterruptsOnly(cause)) return require_Schema$1.fail(dispatchError);
 		return cleanupCreatedThread().pipe(require_Schema$1.flatMap(() => require_Schema$1.fail(dispatchError)));
-	})));
+	})), command.threadId);
 });
 //#endregion
 //#region src/orchestration/Services/OrchestrationEngine.ts
@@ -100946,6 +101094,7 @@ function emptyConfig(source, path) {
 		terminals: [],
 		systemPackages: [],
 		secrets: [],
+		repositoryDependencies: [],
 		issues: []
 	};
 }
@@ -101031,6 +101180,7 @@ function readConfigFile(source, path) {
 		terminals: terminalsFromValue(parsed.terminals),
 		systemPackages: stringArray(parsed.systemPackages ?? parsed.aptPackages ?? parsed.packages),
 		secrets: stringArray(parsed.secrets ?? parsed.envSecrets),
+		repositoryDependencies: stringArray(parsed.repositoryDependencies),
 		issues: []
 	};
 }
@@ -101443,6 +101593,7 @@ const EMPTY_WORKSPACE_ENVIRONMENT_CONFIG = {
 	terminals: [],
 	systemPackages: [],
 	secrets: [],
+	repositoryDependencies: [],
 	issues: []
 };
 function buildCwdCheck(cwdExists) {
@@ -106250,7 +106401,7 @@ const makeWsRpcLayer = (currentSessionId, currentUserId) => WsRpcGroup.toLayer(r
 			git,
 			gitStatusBroadcaster,
 			projectSetupScriptRunner
-		}, normalizedCommand) : orchestrationEngine.dispatch(normalizedCommand).pipe(require_Schema$1.mapError((cause) => toDispatchCommandError(cause, "Failed to dispatch orchestration command")));
+		}, normalizedCommand) : (normalizedCommand.type === "thread.turn.interrupt" ? interruptBootstrapTurnStart(orchestrationEngine, normalizedCommand) : orchestrationEngine.dispatch(normalizedCommand)).pipe(require_Schema$1.mapError((cause) => toDispatchCommandError(cause, "Failed to dispatch orchestration command")));
 		return startup.enqueueCommand(dispatchEffect).pipe(require_Schema$1.mapError((cause) => toDispatchCommandError(cause, "Failed to dispatch orchestration command")));
 	};
 	const loadServerConfig = require_Schema$1.gen(function* () {
@@ -151620,6 +151771,86 @@ async function attestCodexLocalAccountIdentity(input) {
 	return identity;
 }
 //#endregion
+//#region src/workspace/workspaceRepositoryDependencies.ts
+function repositoryFullName(value) {
+	return value.trim().match(/^(?:https?:\/\/)?github\.com\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?\/?$/i)?.[1] ?? null;
+}
+function dependencyDestination(cloudProjectsRoot, repoFullName) {
+	const root = (0, node_path.resolve)(cloudProjectsRoot);
+	const destination = (0, node_path.resolve)((0, node_path.join)(root, (0, node_path.basename)(repoFullName)));
+	const pathFromRoot = (0, node_path.relative)(root, destination);
+	if (pathFromRoot.startsWith("..") || pathFromRoot === "") throw new Error(`Repository dependency ${repoFullName} has an unsafe destination.`);
+	return destination;
+}
+async function readOriginFromGit(destination) {
+	const result = await runProcess("git", [
+		"-C",
+		destination,
+		"remote",
+		"get-url",
+		"origin"
+	], {
+		allowNonZeroExit: true,
+		timeoutMs: 1e4
+	});
+	return result.code === 0 ? result.stdout.trim() : null;
+}
+function resolveRepositoryDependencies(declarations, cloudProjectsRoot) {
+	const destinations = /* @__PURE__ */ new Set();
+	return declarations.map((declaration) => {
+		const repoFullName = repositoryFullName(declaration);
+		if (repoFullName === null) throw new Error(`Unsupported repository dependency: ${declaration}`);
+		const destination = dependencyDestination(cloudProjectsRoot, repoFullName);
+		if (destinations.has(destination)) throw new Error(`Repository dependencies collide at ${destination}.`);
+		destinations.add(destination);
+		return {
+			repoFullName,
+			destination
+		};
+	});
+}
+async function prepareRepositoryDependency(input) {
+	const { repoFullName, destination } = input.dependency;
+	if ((0, node_fs.existsSync)(destination)) {
+		const origin = await input.readOrigin(destination);
+		const existingRepo = origin === null ? null : parseRepoFullNameFromRemoteUrl(origin);
+		if (existingRepo?.toLowerCase() !== repoFullName.toLowerCase()) throw new Error(`Repository dependency destination ${destination} contains ${existingRepo ?? "no GitHub repository"} instead of ${repoFullName}.`);
+		return {
+			repoFullName,
+			destination,
+			outcome: "existing"
+		};
+	}
+	const result = await input.broker.cloneRepository(input.auth, {
+		repoFullName,
+		destination
+	});
+	if (!result.ok) throw new Error(`Could not prepare repository dependency ${repoFullName}: ${result.error ?? result.code ?? "clone failed"}`);
+	return {
+		repoFullName,
+		destination,
+		outcome: "cloned"
+	};
+}
+async function prepareWorkspaceRepositoryDependencies(input) {
+	if (!input.runtimeMode) return [];
+	const dependencies = resolveWorkspaceEnvironmentConfig(input.cwd).repositoryDependencies;
+	if (dependencies.length === 0) return [];
+	const broker = input.broker ?? new GitHubBroker();
+	const auth = broker.runtimeGrantAuthContext("scm");
+	if (auth === null) throw new Error("Repository dependencies require an exact scoped runtime SCM grant.");
+	const readOrigin = input.readOrigin ?? readOriginFromGit;
+	const resolved = resolveRepositoryDependencies(dependencies, input.cloudProjectsRoot);
+	const prepared = [];
+	for (const dependency of resolved) prepared.push(await prepareRepositoryDependency({
+		dependency,
+		broker,
+		auth,
+		readOrigin
+	}));
+	return prepared;
+}
+//#endregion
 //#region src/codexAppServerManager.ts
 const CODEX_LOGIN_STATUS_TIMEOUT_MS = 5e3;
 const CODEX_SKILLS_LIST_TIMEOUT_MS = 4e3;
@@ -151954,6 +152185,11 @@ var CodexAppServerManager = class extends node_events.EventEmitter {
 		let context;
 		try {
 			const resolvedCwd = input.cwd ?? process.cwd();
+			await prepareWorkspaceRepositoryDependencies({
+				cwd: resolvedCwd,
+				cloudProjectsRoot: process.env.FORGE_CLOUD_PROJECTS_ROOT?.trim() || "/projects",
+				runtimeMode: process.env.FORGE_CMMD_RUNTIME_MODE === "true"
+			});
 			let workspacePreflightReport = runWorkspaceEnvironmentPreflight({
 				cwd: resolvedCwd,
 				env: process.env
@@ -217040,6 +217276,19 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 		const resumeState = readClaudeResumeState(input.resumeCursor);
 		const threadId = input.threadId;
 		const { existingResumeSessionId, newSessionId, sessionId } = yield* resolveClaudeStartSessionIds(resumeState);
+		const workspaceCwd = input.cwd;
+		if (workspaceCwd) yield* require_Schema$1.tryPromise({
+			try: () => prepareWorkspaceRepositoryDependencies({
+				cwd: workspaceCwd,
+				cloudProjectsRoot: serverConfig.cloudProjectsRoot ?? "/projects",
+				runtimeMode: serverConfig.forgeCmmdRuntimeMode === true
+			}),
+			catch: (cause) => new ProviderAdapterValidationError({
+				provider: PROVIDER$11,
+				operation: "startSession",
+				issue: cause instanceof Error ? cause.message : "Could not prepare declared repository dependencies."
+			})
+		});
 		const runtimeContext = yield* require_Schema$1.context();
 		const runFork = require_Schema$1.runForkWith(runtimeContext);
 		const runPromise = require_Schema$1.runPromiseWith(runtimeContext);
@@ -233379,12 +233628,12 @@ const collectOutput = require_Schema$1.fn("collectOutput")(function* (input, str
 	let lineBuffer = "";
 	let truncated = false;
 	const emitCompleteLines = require_Schema$1.fn("emitCompleteLines")(function* (flush) {
-		let newlineIndex = lineBuffer.indexOf("\n");
+		let newlineIndex = lineBuffer.search(/[\r\n]/);
 		while (newlineIndex >= 0) {
 			const line = lineBuffer.slice(0, newlineIndex).replace(/\r$/, "");
 			lineBuffer = lineBuffer.slice(newlineIndex + 1);
 			if (line.length > 0 && onLine) yield* onLine(line);
-			newlineIndex = lineBuffer.indexOf("\n");
+			newlineIndex = lineBuffer.search(/[\r\n]/);
 		}
 		if (flush) {
 			const trailing = lineBuffer.replace(/\r$/, "");
@@ -233533,6 +233782,7 @@ const makeGitCore = require_Schema$1.fn("makeGitCore")(function* (options) {
 		operation,
 		cwd,
 		args,
+		...options.env ? { env: options.env } : {},
 		...options.stdin !== void 0 ? { stdin: options.stdin } : {},
 		allowNonZeroExit: true,
 		...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
@@ -234256,12 +234506,19 @@ const makeGitCore = require_Schema$1.fn("makeGitCore")(function* (options) {
 		};
 	});
 	const createWorktree = require_Schema$1.fn("createWorktree")(function* (input) {
+		const report = (stage, status, detail) => input.onStage?.({
+			stage,
+			status,
+			...detail ? { detail } : {}
+		}) ?? require_Schema$1.void_;
+		yield* report("resolve", "running");
 		const base = input.branch ?? (yield* resolveDefaultBaseBranch(input.cwd));
 		const startPoint = yield* resolveWorktreeStartPoint({
 			cwd: input.cwd,
 			base,
 			creatingNewBranch: input.newBranch !== void 0
 		});
+		yield* report("resolve", "done", startPoint);
 		const targetBranch = input.newBranch ?? base;
 		const sanitizedBranch = targetBranch.replace(/\//g, "-");
 		const repoName = path.basename(input.cwd);
@@ -234273,7 +234530,10 @@ const makeGitCore = require_Schema$1.fn("makeGitCore")(function* (options) {
 			limit: 200
 		})).branches.find((branch) => branch.isRemote !== true && branch.name === targetBranch && branch.worktreePath !== null && node_path.default.resolve(branch.worktreePath) === canonicalWorktreePath);
 		if (existingBranch?.worktreePath) {
+			yield* report("checkout", "skipped", "Existing worktree");
+			yield* report("dependencies", "running");
 			yield* setupSharedWorktreeDependencies(input.cwd, existingBranch.worktreePath);
+			yield* report("dependencies", "done");
 			return { worktree: {
 				path: worktreePath,
 				branch: targetBranch
@@ -234292,11 +234552,19 @@ const makeGitCore = require_Schema$1.fn("makeGitCore")(function* (options) {
 			worktreePath,
 			startPoint
 		];
+		yield* report("checkout", "running");
 		yield* executeGit("GitCore.createWorktree", input.cwd, args, {
 			fallbackErrorMessage: "git worktree add failed",
+			env: {
+				GIT_PROGRESS_DELAY: "0",
+				LC_ALL: "C"
+			},
 			...input.progress ? { progress: input.progress } : {}
 		});
+		yield* report("checkout", "done");
+		yield* report("dependencies", "running");
 		yield* setupSharedWorktreeDependencies(input.cwd, worktreePath);
+		yield* report("dependencies", "done");
 		return { worktree: {
 			path: worktreePath,
 			branch: targetBranch
@@ -297109,7 +297377,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "ab022129e97b79359ffb5998de13084bb9f28c79";
+	return "339f0da718657526651ad84cacb841446f1bb38b";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -298935,6 +299203,10 @@ const AuthSessionRepositoryLive = require_Schema$1.effect(AuthSessionRepository,
 const SIGNING_SECRET_NAME = "server-signing-key";
 const DEFAULT_SESSION_TTL = require_Schema$1.days(30);
 const DEFAULT_WEBSOCKET_TOKEN_TTL = require_Schema$1.minutes(5);
+const toSessionCredentialError = (message) => (cause) => new SessionCredentialError({
+	message,
+	cause
+});
 const SessionClaims = require_Schema$1.Struct({
 	v: require_Schema$1.Literal(1),
 	kind: require_Schema$1.Literal("session"),
@@ -298991,10 +299263,6 @@ const makeSessionCredentialService = require_Schema$1.gen(function* () {
 		port: serverConfig.port,
 		host: serverConfig.host
 	});
-	const toSessionCredentialError = (message) => (cause) => new SessionCredentialError({
-		message,
-		cause
-	});
 	const emitUpsert = (clientSession) => require_Path.publish(changesPubSub, {
 		type: "clientUpserted",
 		clientSession
@@ -299155,15 +299423,28 @@ const makeSessionCredentialService = require_Schema$1.gen(function* () {
 		if (require_Schema$1.isSome(row)) {
 			if (row.value.revokedAt !== null) return yield* new SessionCredentialError({ message: "Websocket session revoked." });
 			if (row.value.expiresAt.epochMilliseconds <= now) return yield* new SessionCredentialError({ message: "Websocket session expired." });
-		} else if (!(statelessCookieSessions && claims.method === "browser-session-cookie")) return yield* new SessionCredentialError({ message: "Unknown websocket session." });
+		} else {
+			const cloudOwnerSession = serverConfig.forgeCloudShellMode === true && claims.method === "proxy-asserted" && forgeCloudOwnerSessionExpiresAt(claims.sid) !== null;
+			if (cloudOwnerSession && isExpiredForgeCloudOwnerSession(claims.sid, now)) return yield* new SessionCredentialError({ message: "Websocket session expired." });
+			if (statelessCookieSessions && (claims.method === "browser-session-cookie" || cloudOwnerSession)) return {
+				sessionId: claims.sid,
+				token,
+				method: claims.method,
+				client: createDefaultClientMetadata(),
+				expiresAt: require_Schema$1.makeUnsafe(claims.exp),
+				subject: claims.sub,
+				role: claims.role
+			};
+			return yield* new SessionCredentialError({ message: "Unknown websocket session." });
+		}
 		return {
 			sessionId: claims.sid,
 			token,
-			method: require_Schema$1.isSome(row) ? row.value.method : claims.method,
-			client: require_Schema$1.isSome(row) ? toClientMetadata(row.value.client) : createDefaultClientMetadata(),
-			expiresAt: require_Schema$1.isSome(row) ? row.value.expiresAt : require_Schema$1.makeUnsafe(claims.exp),
-			subject: require_Schema$1.isSome(row) ? row.value.subject : claims.sub,
-			role: require_Schema$1.isSome(row) ? row.value.role : claims.role
+			method: row.value.method,
+			client: toClientMetadata(row.value.client),
+			expiresAt: row.value.expiresAt,
+			subject: row.value.subject,
+			role: row.value.role
 		};
 	}).pipe(require_Schema$1.mapError((cause) => cause instanceof SessionCredentialError ? cause : new SessionCredentialError({
 		message: "Failed to verify websocket token.",
@@ -299441,6 +299722,18 @@ function verifyForgeCloudOwnerCallbackAssertion(assertion, config) {
 //#endregion
 //#region src/auth/Layers/ServerAuth.ts
 const AUTHORIZATION_PREFIX = "Bearer ";
+function classifyWebSocketTokenFailure(cause) {
+	switch (cause.message) {
+		case "Malformed websocket token.": return "malformed";
+		case "Invalid websocket token signature.": return "invalid_signature";
+		case "Invalid websocket token payload.": return "invalid_payload";
+		case "Websocket token expired.": return "expired_token";
+		case "Websocket session revoked.": return "revoked_parent_session";
+		case "Websocket session expired.": return "expired_parent_session";
+		case "Unknown websocket session.": return "unknown_parent_session";
+		default: return "verification_failed";
+	}
+}
 function toBootstrapExchangeAuthError(cause) {
 	if (cause.status === 500) return new AuthError({
 		message: "Failed to validate bootstrap credential.",
@@ -299743,7 +300036,6 @@ const makeServerAuth = require_Schema$1.gen(function* () {
 		expiresAt: require_Schema$1.toUtc(issued.expiresAt)
 	})));
 	const authenticateWebSocketUpgrade = (request) => require_Schema$1.gen(function* () {
-		if (serverConfig.forgeCloudShellMode === true) return yield* authenticateRequest(request);
 		if (serverConfig.forgeCmmdRuntimeMode) {
 			if (serverConfig.forgeCmmdAuthRuntime) {
 				const authConfig = readCmmdAuthRuntimeConfig(serverConfig);
@@ -299800,7 +300092,7 @@ const makeServerAuth = require_Schema$1.gen(function* () {
 		const requestUrl = require_HttpServer.toURL(request);
 		if (require_Schema$1.isSome(requestUrl)) {
 			const websocketToken = readWebSocketUpgradeToken(requestUrl.value.searchParams);
-			if (websocketToken) return yield* sessions.verifyWebSocketToken(websocketToken).pipe(require_Schema$1.map((session) => ({
+			if (websocketToken) return yield* sessions.verifyWebSocketToken(websocketToken).pipe(require_Schema$1.tapError((cause) => require_Schema$1.logWarning("Rejected websocket token.").pipe(require_Schema$1.annotateLogs({ category: classifyWebSocketTokenFailure(cause) }))), require_Schema$1.map((session) => ({
 				sessionId: session.sessionId,
 				subject: session.subject,
 				method: session.method,
@@ -305889,7 +306181,7 @@ const orchestrationDispatchRouteLayer = add$1("POST", "/api/orchestration/dispat
 		}).pipe(require_Schema$1.mapError((cause) => new OrchestrationDispatchCommandError({
 			message: "Failed to dispatch orchestration command.",
 			cause
-		}))) : orchestrationEngine.dispatch(normalizedCommand).pipe(require_Schema$1.mapError((cause) => new OrchestrationDispatchCommandError({
+		}))) : (normalizedCommand.type === "thread.turn.interrupt" ? interruptBootstrapTurnStart(orchestrationEngine, normalizedCommand) : orchestrationEngine.dispatch(normalizedCommand)).pipe(require_Schema$1.mapError((cause) => new OrchestrationDispatchCommandError({
 			message: "Failed to dispatch orchestration command.",
 			cause
 		})));