@cmmd-center/forge 0.13.8 → 0.13.9

package/dist/bin.mjs

@@ -22,7 +22,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
+import os, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -50614,7 +50614,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = $U.release().split(".");
+		const osRelease = os.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53057,7 +53057,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$3 = __require("os");
+	const os$4 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53079,7 +53079,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$3.userInfo();
+				const userInfo = os$4.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66002,7 +66002,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.8";
+var version$1 = "0.13.9";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -75215,7 +75215,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -75223,8 +75223,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$2.arch();
-	var platform = process.env.npm_config_platform || os$2.platform();
+	var arch = process.env.npm_config_arch || os$3.arch();
+	var platform = process.env.npm_config_platform || os$3.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -87718,14 +87718,18 @@ function resolveRuntimeGitHubGrantAuthFromEnv(headers) {
 }
 function buildCmmdRuntimeGrantFetchRequest(auth, repoFullName) {
 	return {
-		url: new URL(`/api/forge/runtimes/${encodeURIComponent(auth.runtimeId)}/github/installation-token`, resolveCommandAppUrl()).toString(),
+		url: new URL(`/api/forge/runtimes/${encodeURIComponent(auth.runtimeId)}/scm/credential`, resolveCommandAppUrl()).toString(),
 		init: {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${auth.token}`,
 				"Content-Type": "application/json"
 			},
-			body: JSON.stringify({ repo_full_name: repoFullName })
+			body: JSON.stringify({
+				provider: "github",
+				host: "github.com",
+				repository_path: repoFullName
+			})
 		}
 	};
 }
@@ -88187,10 +88191,19 @@ function fetchInstallationTokenForAuth(auth, repoFullName) {
 			ok: false,
 			...lastError
 		};
-		if (tokenResp.ok) return {
-			ok: true,
-			token: (yield* promise(() => tokenResp.json())).token
-		};
+		if (tokenResp.ok) {
+			const tokenData = yield* promise(() => tokenResp.json());
+			const token = auth.kind === "cmmd-runtime-ticket" ? tokenData.credential : tokenData.token;
+			if (typeof token === "string" && token.trim().length > 0) return {
+				ok: true,
+				token: token.trim()
+			};
+			return {
+				ok: false,
+				status: 502,
+				error: "CMMD returned an invalid source-control credential response."
+			};
+		}
 		const err = yield* promise(() => tokenResp.json().catch(() => ({})));
 		lastError = {
 			status: tokenResp.status,
@@ -89112,23 +89125,38 @@ var GitHubBroker = class {
 	async cloneRepository(auth, input) {
 		const cloneInput = validateCloneInput(input);
 		if ("ok" in cloneInput) return cloneInput;
-		const { branch } = cloneInput;
+		let { branch } = cloneInput;
 		const gitToken = await this.resolveInstallationToken(auth, input.repoFullName);
 		if (typeof gitToken !== "string") return gitToken;
-		const initFailure = await this.runCloneGitStep([
+		try {
+			await mkdir(input.destination);
+		} catch (error) {
+			if (isNodeErrorWithCode(error, "EEXIST")) return cloneDestinationExistsResult();
+			return {
+				ok: false,
+				code: "GITHUB_CLONE_DESTINATION_CREATE_FAILED",
+				error: "Could not create the clone destination."
+			};
+		}
+		const initFailure = await this.runCloneGitStep(branch === null ? ["init", input.destination] : [
 			"init",
 			"-b",
 			branch,
 			input.destination
 		], "GITHUB_CLONE_INIT_FAILED", "Could not initialize the clone destination.");
-		if (initFailure) return initFailure;
+		if (initFailure) return removeFailedCloneDestination(input.destination, initFailure);
 		const configured = await this.configureProjectGitCredential({
 			cwd: input.destination,
 			repoFullName: input.repoFullName,
 			token: gitToken,
 			remoteMode: "add"
 		});
-		if (!configured.ok) return configured;
+		if (!configured.ok) return removeFailedCloneDestination(input.destination, configured);
+		if (branch === null) {
+			const defaultBranch = await this.resolveRemoteDefaultBranch(input.destination);
+			if (typeof defaultBranch !== "string") return removeFailedCloneDestination(input.destination, defaultBranch);
+			branch = defaultBranch;
+		}
 		const fetchFailure = await this.runCloneGitStep([
 			"-C",
 			input.destination,
@@ -89138,7 +89166,7 @@ var GitHubBroker = class {
 			"origin",
 			branch
 		], "GITHUB_CLONE_FETCH_FAILED", "Could not fetch the requested repository branch.", { timeoutMs: 12e4 });
-		if (fetchFailure) return fetchFailure;
+		if (fetchFailure) return removeFailedCloneDestination(input.destination, fetchFailure);
 		const checkoutFailure = await this.runCloneGitStep([
 			"-C",
 			input.destination,
@@ -89147,7 +89175,7 @@ var GitHubBroker = class {
 			branch,
 			"FETCH_HEAD"
 		], "GITHUB_CLONE_CHECKOUT_FAILED", "Could not check out the requested repository branch.");
-		if (checkoutFailure) return checkoutFailure;
+		if (checkoutFailure) return removeFailedCloneDestination(input.destination, checkoutFailure);
 		return {
 			ok: true,
 			data: {
@@ -89757,9 +89785,9 @@ var GitHubBroker = class {
 		};
 	}
 	async resolveInstallationToken(auth, repoFullName) {
-		const runtimeGrant = this.resolveRuntimeGrant();
+		const runtimeGrant = this.resolveRuntimeGrant("scm");
 		if (runtimeGrant) {
-			const token = await this.fetchRuntimeInstallationToken(runtimeGrant, repoFullName);
+			const token = await this.fetchRuntimeScmCredential(runtimeGrant, repoFullName);
 			if (!token.ok) return token;
 			return token.token ?? invalidInstallationTokenResult();
 		}
@@ -90142,7 +90170,7 @@ var GitHubBroker = class {
 			repoFullName
 		};
 	}
-	resolveRuntimeGrant() {
+	resolveRuntimeGrant(requiredScope = "github") {
 		if (this.runtimeRole !== "user-vm") return null;
 		const runtimeId = process.env.FORGE_CMMD_RUNTIME_ID?.trim();
 		if (!runtimeId) return null;
@@ -90152,7 +90180,7 @@ var GitHubBroker = class {
 				runtimeId,
 				machineId: identity.machineId,
 				credentialEpoch: identity.credentialEpoch,
-				requiredScope: "github"
+				requiredScope
 			});
 			return authority ? {
 				runtimeId,
@@ -90166,8 +90194,8 @@ var GitHubBroker = class {
 			token: legacyToken
 		} : null;
 	}
-	runtimeGrantAuthContext() {
-		const grant = this.resolveRuntimeGrant();
+	runtimeGrantAuthContext(requiredScope = "github") {
+		const grant = this.resolveRuntimeGrant(requiredScope);
 		if (grant === null) return null;
 		return {
 			sessionId: grant.sessionId ?? AuthSessionId.make(`cmmd-runtime:${grant.runtimeId}`),
@@ -90219,13 +90247,33 @@ var GitHubBroker = class {
 		};
 	}
 	async fetchRuntimeInstallationToken(grant, repoFullName) {
-		const response = await this.fetchImpl(makeUrl(this.commandAppUrl, `/api/forge/runtimes/${encodeURIComponent(grant.runtimeId)}/github/installation-token`), {
+		return this.fetchRuntimeCredential(grant, {
+			url: makeUrl(this.commandAppUrl, `/api/forge/runtimes/${encodeURIComponent(grant.runtimeId)}/github/installation-token`),
+			requestBody: { repo_full_name: repoFullName },
+			responseField: "token",
+			label: "GitHub installation token"
+		});
+	}
+	async fetchRuntimeScmCredential(grant, repoFullName) {
+		return this.fetchRuntimeCredential(grant, {
+			url: makeUrl(this.commandAppUrl, `/api/forge/runtimes/${encodeURIComponent(grant.runtimeId)}/scm/credential`),
+			requestBody: {
+				provider: "github",
+				host: "github.com",
+				repository_path: repoFullName
+			},
+			responseField: "credential",
+			label: "GitHub source-control credential"
+		});
+	}
+	async fetchRuntimeCredential(grant, input) {
+		const response = await this.fetchImpl(input.url, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${grant.token}`,
 				"Content-Type": "application/json"
 			},
-			body: JSON.stringify({ repo_full_name: repoFullName }),
+			body: JSON.stringify(input.requestBody),
 			signal: AbortSignal.timeout(GITHUB_BROKER_REQUEST_TIMEOUT_MS)
 		});
 		const body = await parseResponseBody(response);
@@ -90234,10 +90282,10 @@ var GitHubBroker = class {
 			status: response.status,
 			code: response.status === 401 ? "GITHUB_AUTH_REQUIRED" : "GITHUB_BROKER_REQUEST_FAILED",
 			...response.status === 401 ? { userActionRequired: "connect_github" } : {},
-			error: errorFromBody(body, `GitHub installation token request failed with status ${response.status}.`),
+			error: errorFromBody(body, `${input.label} request failed with status ${response.status}.`),
 			data: body
 		};
-		const token = typeof body === "object" && body !== null ? body.token : null;
+		const token = typeof body === "object" && body !== null ? body[input.responseField] : null;
 		if (typeof token !== "string" || token.trim().length === 0) return invalidInstallationTokenResult();
 		return {
 			ok: true,
@@ -90256,6 +90304,25 @@ var GitHubBroker = class {
 		const branch = result.result.stdout.trim();
 		return branch.length > 0 ? branch : null;
 	}
+	async resolveRemoteDefaultBranch(cwd) {
+		const result = await this.runGit([
+			"-C",
+			cwd,
+			"ls-remote",
+			"--symref",
+			"origin",
+			"HEAD"
+		], { allowNonZeroExit: true });
+		if (!isGitRunResult(result)) return result;
+		if (result.result.code !== 0) return gitCommandFailure("GITHUB_DEFAULT_BRANCH_LOOKUP_FAILED", result.result.stderr, "Could not determine the repository default branch.");
+		const branch = /^ref:\s+refs\/heads\/([^\s]+)\s+HEAD$/m.exec(result.result.stdout)?.[1];
+		if (branch === void 0) return {
+			ok: false,
+			code: "GITHUB_DEFAULT_BRANCH_RESPONSE_INVALID",
+			error: "GitHub did not return a valid default branch for the repository."
+		};
+		return validateGitBranchName(branch) ?? branch;
+	}
 };
 function isCmmdCloudRuntimeModeEnv() {
 	return process.env.FORGE_CMMD_RUNTIME_MODE === "true" || process.env.FORGE_CMMD_RUNTIME_MODE === "1";
@@ -90340,20 +90407,40 @@ function validateCloneDestination(destination) {
 		code: "GITHUB_CLONE_DESTINATION_INVALID",
 		error: "An absolute clone destination is required."
 	};
-	if (existsSync(destination)) return {
+	if (existsSync(destination)) return cloneDestinationExistsResult();
+	return null;
+}
+function cloneDestinationExistsResult() {
+	return {
 		ok: false,
 		code: "GITHUB_CLONE_DESTINATION_EXISTS",
 		error: "Clone destination already exists; choose a new empty path."
 	};
-	return null;
+}
+function isNodeErrorWithCode(error, code) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+async function removeFailedCloneDestination(destination, failure) {
+	try {
+		await rm(destination, {
+			recursive: true,
+			force: true
+		});
+		return failure;
+	} catch {
+		return {
+			...failure,
+			error: `${failure.error ?? "Clone failed."} The incomplete clone destination could not be removed.`
+		};
+	}
 }
 function validateCloneInput(input) {
 	const repoFullNameValidation = validateRepoFullName(input.repoFullName);
 	if (repoFullNameValidation) return repoFullNameValidation;
 	const destinationValidation = validateCloneDestination(input.destination);
 	if (destinationValidation) return destinationValidation;
-	const branch = input.branch?.trim() || "main";
-	return validateGitBranchName(branch) ?? { branch };
+	const branch = input.branch?.trim() || null;
+	return branch === null ? { branch } : validateGitBranchName(branch) ?? { branch };
 }
 function validateGitBranchName(branch) {
 	if (branch.length === 0 || branch.startsWith("-") || Array.from(branch).some((character) => {
@@ -93331,7 +93418,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-D8mGyWmt.mjs"),
+		try: () => import("./open-FIgTDosf.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -93518,6 +93605,17 @@ const admitNormalizedDispatchCommand = (command, admit) => uninterruptibleMask$1
 //#region src/orchestration/bootstrapCommandCoordinator.ts
 const MAX_COMPLETED_COMMANDS_PER_ENGINE = 256;
 const commandsByEngine = /* @__PURE__ */ new WeakMap();
+const sealBootstrapCommand = (engine, commandId) => {
+	const entry = commandsByEngine.get(engine)?.get(commandId);
+	if (entry) entry.cancellable = false;
+};
+const cancelBootstrapCommand = (engine, threadId) => promise(async () => {
+	const entry = [...commandsByEngine.get(engine)?.values() ?? []].find((candidate) => candidate.threadId === threadId && !candidate.completed && candidate.cancellable);
+	if (!entry) return false;
+	entry.controller.abort();
+	await entry.promise.catch(() => void 0);
+	return true;
+});
 const toBootstrapError = (error) => is$1(OrchestrationDispatchCommandError)(error) ? error : new OrchestrationDispatchCommandError({
 	message: error instanceof Error ? error.message : "Bootstrap command failed.",
 	cause: error
@@ -93537,7 +93635,7 @@ const pruneCompletedCommands = (commands) => {
 * the registry to one server runtime, so reconnects share work while separate
 * runtimes remain isolated.
 */
-const runBootstrapCommand = (engine, commandId, bootstrapEffect) => {
+const runBootstrapCommand = (engine, commandId, bootstrapEffect, threadId) => {
 	let commands = commandsByEngine.get(engine);
 	if (commands === void 0) {
 		commands = /* @__PURE__ */ new Map();
@@ -93550,16 +93648,21 @@ const runBootstrapCommand = (engine, commandId, bootstrapEffect) => {
 	});
 	pruneCompletedCommands(commands);
 	let entry;
-	const promise = runPromise(bootstrapEffect).then((result) => {
+	const controller = new AbortController();
+	const promise = Promise.resolve().then(() => runPromise(bootstrapEffect, { signal: controller.signal })).then((result) => {
 		entry.completed = true;
 		return result;
 	}, (error) => {
-		commands.delete(commandId);
+		entry.completed = true;
+		if (!controller.signal.aborted) commands.delete(commandId);
 		throw error;
 	});
 	entry = {
 		promise,
-		completed: false
+		completed: false,
+		threadId,
+		controller,
+		cancellable: true
 	};
 	commands.set(commandId, entry);
 	return tryPromise({
@@ -93569,6 +93672,10 @@ const runBootstrapCommand = (engine, commandId, bootstrapEffect) => {
 };
 //#endregion
 //#region src/orchestration/bootstrapDispatch.ts
+const interruptBootstrapTurnStart = (engine, command) => gen(function* () {
+	if (yield* cancelBootstrapCommand(engine, command.threadId)) return { sequence: (yield* engine.getReadModel()).snapshotSequence };
+	return yield* engine.dispatch(command);
+});
 const MAX_BOOTSTRAP_OUTPUT_LINE_LENGTH = 1e3;
 const toBootstrapDispatchCommandCauseError = (cause) => {
 	const error = squash(cause);
@@ -93655,6 +93762,7 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 	const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
 	const baseBranchLabel = bootstrapWorktree.baseBranch ?? "<default>";
 	const requestedPayload = {
+		turnRequestedAt: input.command.createdAt,
 		projectCwd: bootstrapWorktree.projectCwd,
 		baseBranch: bootstrapWorktree.baseBranch,
 		branch: bootstrapWorktree.branch,
@@ -93675,6 +93783,16 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 		branch: bootstrapWorktree.baseBranch,
 		newBranch: bootstrapWorktree.branch,
 		path: null,
+		onStage: (update) => appendWorktreeActivity({
+			orchestrationEngine: input.orchestrationEngine,
+			threadId: input.command.threadId,
+			commandId: CommandId.make(`server:worktree-stage:${input.command.commandId}:${crypto.randomUUID()}`),
+			kind: "worktree.stage",
+			summary: "Preparing worktree",
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			payload: update,
+			tone: "info"
+		}).pipe(asVoid, ignore),
 		progress: {
 			onStdoutLine: (line) => {
 				const detail = truncateBootstrapOutputLine(line);
@@ -93714,6 +93832,7 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 			}
 		}
 	}).pipe(catchCause((cause) => {
+		if (hasInterruptsOnly(cause)) return failCause$1(cause);
 		const error = squash(cause);
 		const detail = error instanceof Error ? error.message : "Unknown worktree failure.";
 		return appendWorktreeActivity({
@@ -93840,7 +93959,16 @@ const dispatchBootstrapTurnStart = (input, command) => gen(function* () {
 				worktreePath
 			}),
 			onSuccess: (setupResult) => {
-				if (setupResult.status !== "started") return void_$1;
+				if (setupResult.status !== "started") return appendSetupScriptActivity({
+					orchestrationEngine,
+					threadId: command.threadId,
+					commandId: bootstrapCommandId(command, "setup-script-skipped"),
+					kind: "setup-script.skipped",
+					summary: "No setup script configured",
+					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+					payload: {},
+					tone: "info"
+				}).pipe(asVoid, ignore);
 				return recordSetupScriptStarted({
 					requestedAt,
 					worktreePath,
@@ -93870,13 +93998,33 @@ const dispatchBootstrapTurnStart = (input, command) => gen(function* () {
 			targetProjectCwd = preparedWorktree.projectCwd;
 		}
 		yield* runSetupProgram();
+		if (bootstrap?.prepareWorktree) yield* appendWorktreeActivity({
+			orchestrationEngine,
+			threadId: command.threadId,
+			commandId: bootstrapCommandId(command, "launch-agent-starting"),
+			kind: "launch.agent-starting",
+			summary: "Starting agent",
+			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+			payload: { setupRequested: bootstrap.runSetupScript === true },
+			tone: "info"
+		}).pipe(ignore);
+		sealBootstrapCommand(orchestrationEngine, command.commandId);
 		return yield* orchestrationEngine.dispatch(finalTurnStartCommand);
 	});
-	return yield* runBootstrapCommand(orchestrationEngine, command.commandId, bootstrapProgram.pipe(catchCause((cause) => {
+	return yield* runBootstrapCommand(orchestrationEngine, command.commandId, bootstrapProgram.pipe(onInterrupt(() => appendWorktreeActivity({
+		orchestrationEngine,
+		threadId: command.threadId,
+		commandId: bootstrapCommandId(command, "launch-cancelled"),
+		kind: "launch.cancelled",
+		summary: "Launch cancelled",
+		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+		payload: {},
+		tone: "info"
+	}).pipe(ignore)), catchCause((cause) => {
 		const dispatchError = toBootstrapDispatchCommandCauseError(cause);
 		if (hasInterruptsOnly(cause)) return fail(dispatchError);
 		return cleanupCreatedThread().pipe(flatMap(() => fail(dispatchError)));
-	})));
+	})), command.threadId);
 });
 //#endregion
 //#region src/orchestration/Services/OrchestrationEngine.ts
@@ -100555,6 +100703,7 @@ function emptyConfig(source, path) {
 		terminals: [],
 		systemPackages: [],
 		secrets: [],
+		repositoryDependencies: [],
 		issues: []
 	};
 }
@@ -100640,6 +100789,7 @@ function readConfigFile(source, path) {
 		terminals: terminalsFromValue(parsed.terminals),
 		systemPackages: stringArray(parsed.systemPackages ?? parsed.aptPackages ?? parsed.packages),
 		secrets: stringArray(parsed.secrets ?? parsed.envSecrets),
+		repositoryDependencies: stringArray(parsed.repositoryDependencies),
 		issues: []
 	};
 }
@@ -101052,6 +101202,7 @@ const EMPTY_WORKSPACE_ENVIRONMENT_CONFIG = {
 	terminals: [],
 	systemPackages: [],
 	secrets: [],
+	repositoryDependencies: [],
 	issues: []
 };
 function buildCwdCheck(cwdExists) {
@@ -105854,7 +106005,7 @@ const makeWsRpcLayer = (currentSessionId, currentUserId) => WsRpcGroup.toLayer(g
 			git,
 			gitStatusBroadcaster,
 			projectSetupScriptRunner
-		}, normalizedCommand) : orchestrationEngine.dispatch(normalizedCommand).pipe(mapError((cause) => toDispatchCommandError(cause, "Failed to dispatch orchestration command")));
+		}, normalizedCommand) : (normalizedCommand.type === "thread.turn.interrupt" ? interruptBootstrapTurnStart(orchestrationEngine, normalizedCommand) : orchestrationEngine.dispatch(normalizedCommand)).pipe(mapError((cause) => toDispatchCommandError(cause, "Failed to dispatch orchestration command")));
 		return startup.enqueueCommand(dispatchEffect).pipe(mapError((cause) => toDispatchCommandError(cause, "Failed to dispatch orchestration command")));
 	};
 	const loadServerConfig = gen(function* () {
@@ -151203,6 +151354,86 @@ async function attestCodexLocalAccountIdentity(input) {
 	return identity;
 }
 //#endregion
+//#region src/workspace/workspaceRepositoryDependencies.ts
+function repositoryFullName(value) {
+	return value.trim().match(/^(?:https?:\/\/)?github\.com\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?\/?$/i)?.[1] ?? null;
+}
+function dependencyDestination(cloudProjectsRoot, repoFullName) {
+	const root = resolve(cloudProjectsRoot);
+	const destination = resolve(join(root, basename(repoFullName)));
+	const pathFromRoot = relative(root, destination);
+	if (pathFromRoot.startsWith("..") || pathFromRoot === "") throw new Error(`Repository dependency ${repoFullName} has an unsafe destination.`);
+	return destination;
+}
+async function readOriginFromGit(destination) {
+	const result = await runProcess("git", [
+		"-C",
+		destination,
+		"remote",
+		"get-url",
+		"origin"
+	], {
+		allowNonZeroExit: true,
+		timeoutMs: 1e4
+	});
+	return result.code === 0 ? result.stdout.trim() : null;
+}
+function resolveRepositoryDependencies(declarations, cloudProjectsRoot) {
+	const destinations = /* @__PURE__ */ new Set();
+	return declarations.map((declaration) => {
+		const repoFullName = repositoryFullName(declaration);
+		if (repoFullName === null) throw new Error(`Unsupported repository dependency: ${declaration}`);
+		const destination = dependencyDestination(cloudProjectsRoot, repoFullName);
+		if (destinations.has(destination)) throw new Error(`Repository dependencies collide at ${destination}.`);
+		destinations.add(destination);
+		return {
+			repoFullName,
+			destination
+		};
+	});
+}
+async function prepareRepositoryDependency(input) {
+	const { repoFullName, destination } = input.dependency;
+	if (existsSync(destination)) {
+		const origin = await input.readOrigin(destination);
+		const existingRepo = origin === null ? null : parseRepoFullNameFromRemoteUrl(origin);
+		if (existingRepo?.toLowerCase() !== repoFullName.toLowerCase()) throw new Error(`Repository dependency destination ${destination} contains ${existingRepo ?? "no GitHub repository"} instead of ${repoFullName}.`);
+		return {
+			repoFullName,
+			destination,
+			outcome: "existing"
+		};
+	}
+	const result = await input.broker.cloneRepository(input.auth, {
+		repoFullName,
+		destination
+	});
+	if (!result.ok) throw new Error(`Could not prepare repository dependency ${repoFullName}: ${result.error ?? result.code ?? "clone failed"}`);
+	return {
+		repoFullName,
+		destination,
+		outcome: "cloned"
+	};
+}
+async function prepareWorkspaceRepositoryDependencies(input) {
+	if (!input.runtimeMode) return [];
+	const dependencies = resolveWorkspaceEnvironmentConfig(input.cwd).repositoryDependencies;
+	if (dependencies.length === 0) return [];
+	const broker = input.broker ?? new GitHubBroker();
+	const auth = broker.runtimeGrantAuthContext("scm");
+	if (auth === null) throw new Error("Repository dependencies require an exact scoped runtime SCM grant.");
+	const readOrigin = input.readOrigin ?? readOriginFromGit;
+	const resolved = resolveRepositoryDependencies(dependencies, input.cloudProjectsRoot);
+	const prepared = [];
+	for (const dependency of resolved) prepared.push(await prepareRepositoryDependency({
+		dependency,
+		broker,
+		auth,
+		readOrigin
+	}));
+	return prepared;
+}
+//#endregion
 //#region src/codexAppServerManager.ts
 const CODEX_LOGIN_STATUS_TIMEOUT_MS = 5e3;
 const CODEX_SKILLS_LIST_TIMEOUT_MS = 4e3;
@@ -151537,6 +151768,11 @@ var CodexAppServerManager = class extends EventEmitter$1 {
 		let context;
 		try {
 			const resolvedCwd = input.cwd ?? process.cwd();
+			await prepareWorkspaceRepositoryDependencies({
+				cwd: resolvedCwd,
+				cloudProjectsRoot: process.env.FORGE_CLOUD_PROJECTS_ROOT?.trim() || "/projects",
+				runtimeMode: process.env.FORGE_CMMD_RUNTIME_MODE === "true"
+			});
 			let workspacePreflightReport = runWorkspaceEnvironmentPreflight({
 				cwd: resolvedCwd,
 				env: process.env
@@ -190311,7 +190547,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -200511,12 +200747,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$1 = "https://code.claude.com/docs/en", kKe = [
+var os$2 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$1}/iam#permission-modes`
+			docLink: `${os$2}/iam#permission-modes`
 		}
 	},
 	{
@@ -200531,7 +200767,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$1}/settings#environment-variables`
+			docLink: `${os$2}/settings#environment-variables`
 		}
 	},
 	{
@@ -200542,14 +200778,14 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$1}/hooks`
+			docLink: `${os$2}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$1}/hooks#exec-form-and-shell-form`
+			docLink: `${os$2}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -200564,7 +200800,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$1}/settings`
+			docLink: `${os$2}/settings`
 		}
 	},
 	{
@@ -200579,13 +200815,13 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$1}/iam#working-directories`
+			docLink: `${os$2}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$1}/iam#configuring-permissions`,
-	env: `${os$1}/settings#environment-variables`,
-	hooks: `${os$1}/hooks`
+	permissions: `${os$2}/iam#configuring-permissions`,
+	env: `${os$2}/settings#environment-variables`,
+	hooks: `${os$2}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -216617,6 +216853,19 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 		const resumeState = readClaudeResumeState(input.resumeCursor);
 		const threadId = input.threadId;
 		const { existingResumeSessionId, newSessionId, sessionId } = yield* resolveClaudeStartSessionIds(resumeState);
+		const workspaceCwd = input.cwd;
+		if (workspaceCwd) yield* tryPromise({
+			try: () => prepareWorkspaceRepositoryDependencies({
+				cwd: workspaceCwd,
+				cloudProjectsRoot: serverConfig.cloudProjectsRoot ?? "/projects",
+				runtimeMode: serverConfig.forgeCmmdRuntimeMode === true
+			}),
+			catch: (cause) => new ProviderAdapterValidationError({
+				provider: PROVIDER$11,
+				operation: "startSession",
+				issue: cause instanceof Error ? cause.message : "Could not prepare declared repository dependencies."
+			})
+		});
 		const runtimeContext = yield* context();
 		const runFork = runForkWith(runtimeContext);
 		const runPromise = runPromiseWith(runtimeContext);
@@ -232923,12 +233172,12 @@ const collectOutput = fn$1("collectOutput")(function* (input, stream, maxOutputB
 	let lineBuffer = "";
 	let truncated = false;
 	const emitCompleteLines = fn$1("emitCompleteLines")(function* (flush) {
-		let newlineIndex = lineBuffer.indexOf("\n");
+		let newlineIndex = lineBuffer.search(/[\r\n]/);
 		while (newlineIndex >= 0) {
 			const line = lineBuffer.slice(0, newlineIndex).replace(/\r$/, "");
 			lineBuffer = lineBuffer.slice(newlineIndex + 1);
 			if (line.length > 0 && onLine) yield* onLine(line);
-			newlineIndex = lineBuffer.indexOf("\n");
+			newlineIndex = lineBuffer.search(/[\r\n]/);
 		}
 		if (flush) {
 			const trailing = lineBuffer.replace(/\r$/, "");
@@ -233076,6 +233325,7 @@ const GitCoreLive = effect(GitCore, fn$1("makeGitCore")(function* (options) {
 		operation,
 		cwd,
 		args,
+		...options.env ? { env: options.env } : {},
 		...options.stdin !== void 0 ? { stdin: options.stdin } : {},
 		allowNonZeroExit: true,
 		...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
@@ -233797,12 +234047,19 @@ const GitCoreLive = effect(GitCore, fn$1("makeGitCore")(function* (options) {
 		};
 	});
 	const createWorktree = fn$1("createWorktree")(function* (input) {
+		const report = (stage, status, detail) => input.onStage?.({
+			stage,
+			status,
+			...detail ? { detail } : {}
+		}) ?? void_$1;
+		yield* report("resolve", "running");
 		const base = input.branch ?? (yield* resolveDefaultBaseBranch(input.cwd));
 		const startPoint = yield* resolveWorktreeStartPoint({
 			cwd: input.cwd,
 			base,
 			creatingNewBranch: input.newBranch !== void 0
 		});
+		yield* report("resolve", "done", startPoint);
 		const targetBranch = input.newBranch ?? base;
 		const sanitizedBranch = targetBranch.replace(/\//g, "-");
 		const repoName = path$10.basename(input.cwd);
@@ -233814,7 +234071,10 @@ const GitCoreLive = effect(GitCore, fn$1("makeGitCore")(function* (options) {
 			limit: 200
 		})).branches.find((branch) => branch.isRemote !== true && branch.name === targetBranch && branch.worktreePath !== null && path.resolve(branch.worktreePath) === canonicalWorktreePath);
 		if (existingBranch?.worktreePath) {
+			yield* report("checkout", "skipped", "Existing worktree");
+			yield* report("dependencies", "running");
 			yield* setupSharedWorktreeDependencies(input.cwd, existingBranch.worktreePath);
+			yield* report("dependencies", "done");
 			return { worktree: {
 				path: worktreePath,
 				branch: targetBranch
@@ -233833,11 +234093,19 @@ const GitCoreLive = effect(GitCore, fn$1("makeGitCore")(function* (options) {
 			worktreePath,
 			startPoint
 		];
+		yield* report("checkout", "running");
 		yield* executeGit("GitCore.createWorktree", input.cwd, args, {
 			fallbackErrorMessage: "git worktree add failed",
+			env: {
+				GIT_PROGRESS_DELAY: "0",
+				LC_ALL: "C"
+			},
 			...input.progress ? { progress: input.progress } : {}
 		});
+		yield* report("checkout", "done");
+		yield* report("dependencies", "running");
 		yield* setupSharedWorktreeDependencies(input.cwd, worktreePath);
+		yield* report("dependencies", "done");
 		return { worktree: {
 			path: worktreePath,
 			branch: targetBranch
@@ -267442,7 +267710,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -267573,14 +267841,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -267588,7 +267856,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -296549,7 +296817,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "ab022129e97b79359ffb5998de13084bb9f28c79";
+	return "339f0da718657526651ad84cacb841446f1bb38b";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -298361,6 +298629,10 @@ const AuthSessionRepositoryLive = effect(AuthSessionRepository, gen(function* ()
 const SIGNING_SECRET_NAME = "server-signing-key";
 const DEFAULT_SESSION_TTL = days(30);
 const DEFAULT_WEBSOCKET_TOKEN_TTL = minutes(5);
+const toSessionCredentialError = (message) => (cause) => new SessionCredentialError({
+	message,
+	cause
+});
 const SessionClaims = Struct({
 	v: Literal(1),
 	kind: Literal("session"),
@@ -298417,10 +298689,6 @@ const SessionCredentialServiceLive = effect(SessionCredentialService, gen(functi
 		port: serverConfig.port,
 		host: serverConfig.host
 	});
-	const toSessionCredentialError = (message) => (cause) => new SessionCredentialError({
-		message,
-		cause
-	});
 	const emitUpsert = (clientSession) => publish(changesPubSub, {
 		type: "clientUpserted",
 		clientSession
@@ -298581,15 +298849,28 @@ const SessionCredentialServiceLive = effect(SessionCredentialService, gen(functi
 		if (isSome(row)) {
 			if (row.value.revokedAt !== null) return yield* new SessionCredentialError({ message: "Websocket session revoked." });
 			if (row.value.expiresAt.epochMilliseconds <= now) return yield* new SessionCredentialError({ message: "Websocket session expired." });
-		} else if (!(statelessCookieSessions && claims.method === "browser-session-cookie")) return yield* new SessionCredentialError({ message: "Unknown websocket session." });
+		} else {
+			const cloudOwnerSession = serverConfig.forgeCloudShellMode === true && claims.method === "proxy-asserted" && forgeCloudOwnerSessionExpiresAt(claims.sid) !== null;
+			if (cloudOwnerSession && isExpiredForgeCloudOwnerSession(claims.sid, now)) return yield* new SessionCredentialError({ message: "Websocket session expired." });
+			if (statelessCookieSessions && (claims.method === "browser-session-cookie" || cloudOwnerSession)) return {
+				sessionId: claims.sid,
+				token,
+				method: claims.method,
+				client: createDefaultClientMetadata(),
+				expiresAt: makeUnsafe$5(claims.exp),
+				subject: claims.sub,
+				role: claims.role
+			};
+			return yield* new SessionCredentialError({ message: "Unknown websocket session." });
+		}
 		return {
 			sessionId: claims.sid,
 			token,
-			method: isSome(row) ? row.value.method : claims.method,
-			client: isSome(row) ? toClientMetadata(row.value.client) : createDefaultClientMetadata(),
-			expiresAt: isSome(row) ? row.value.expiresAt : makeUnsafe$5(claims.exp),
-			subject: isSome(row) ? row.value.subject : claims.sub,
-			role: isSome(row) ? row.value.role : claims.role
+			method: row.value.method,
+			client: toClientMetadata(row.value.client),
+			expiresAt: row.value.expiresAt,
+			subject: row.value.subject,
+			role: row.value.role
 		};
 	}).pipe(mapError((cause) => cause instanceof SessionCredentialError ? cause : new SessionCredentialError({
 		message: "Failed to verify websocket token.",
@@ -298866,6 +299147,18 @@ function verifyForgeCloudOwnerCallbackAssertion(assertion, config) {
 //#endregion
 //#region src/auth/Layers/ServerAuth.ts
 const AUTHORIZATION_PREFIX = "Bearer ";
+function classifyWebSocketTokenFailure(cause) {
+	switch (cause.message) {
+		case "Malformed websocket token.": return "malformed";
+		case "Invalid websocket token signature.": return "invalid_signature";
+		case "Invalid websocket token payload.": return "invalid_payload";
+		case "Websocket token expired.": return "expired_token";
+		case "Websocket session revoked.": return "revoked_parent_session";
+		case "Websocket session expired.": return "expired_parent_session";
+		case "Unknown websocket session.": return "unknown_parent_session";
+		default: return "verification_failed";
+	}
+}
 function toBootstrapExchangeAuthError(cause) {
 	if (cause.status === 500) return new AuthError({
 		message: "Failed to validate bootstrap credential.",
@@ -299168,7 +299461,6 @@ const ServerAuthLive = effect(ServerAuth, gen(function* () {
 		expiresAt: toUtc(issued.expiresAt)
 	})));
 	const authenticateWebSocketUpgrade = (request) => gen(function* () {
-		if (serverConfig.forgeCloudShellMode === true) return yield* authenticateRequest(request);
 		if (serverConfig.forgeCmmdRuntimeMode) {
 			if (serverConfig.forgeCmmdAuthRuntime) {
 				const authConfig = readCmmdAuthRuntimeConfig(serverConfig);
@@ -299225,7 +299517,7 @@ const ServerAuthLive = effect(ServerAuth, gen(function* () {
 		const requestUrl = toURL(request);
 		if (isSome(requestUrl)) {
 			const websocketToken = readWebSocketUpgradeToken(requestUrl.value.searchParams);
-			if (websocketToken) return yield* sessions.verifyWebSocketToken(websocketToken).pipe(map$3((session) => ({
+			if (websocketToken) return yield* sessions.verifyWebSocketToken(websocketToken).pipe(tapError((cause) => logWarning$1("Rejected websocket token.").pipe(annotateLogs({ category: classifyWebSocketTokenFailure(cause) }))), map$3((session) => ({
 				sessionId: session.sessionId,
 				subject: session.subject,
 				method: session.method,
@@ -305264,7 +305556,7 @@ const orchestrationDispatchRouteLayer = add$1("POST", "/api/orchestration/dispat
 		}).pipe(mapError((cause) => new OrchestrationDispatchCommandError({
 			message: "Failed to dispatch orchestration command.",
 			cause
-		}))) : orchestrationEngine.dispatch(normalizedCommand).pipe(mapError((cause) => new OrchestrationDispatchCommandError({
+		}))) : (normalizedCommand.type === "thread.turn.interrupt" ? interruptBootstrapTurnStart(orchestrationEngine, normalizedCommand) : orchestrationEngine.dispatch(normalizedCommand)).pipe(mapError((cause) => new OrchestrationDispatchCommandError({
 			message: "Failed to dispatch orchestration command.",
 			cause
 		})));
@@ -320701,7 +320993,7 @@ const connectLoginCommand = make$34("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-D8mGyWmt.mjs")).default;
+			const open = (await import("./open-FIgTDosf.mjs")).default;
 			await open(url);
 			return true;
 		},