@cmmd-center/forge 0.13.89 → 0.13.91

package/dist/bin.mjs

@@ -23,7 +23,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import os, { homedir, networkInterfaces, tmpdir } from "node:os";
+import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -17793,6 +17793,7 @@ const OrchestrationThread = Struct({
 	parentThreadId: NullOr(ThreadId).pipe(withDecodingDefault(succeed(null))),
 	status: ThreadStatus.pipe(withDecodingDefault(succeed("idle"))),
 	workerRole: NullOr(WorkerRole).pipe(withDecodingDefault(succeed(null))),
+	workSessionId: optionalKey(NullOr(String$1)),
 	pendingAutoCreatePrompt: optional$4(NullOr(AutoCreateTaskPrompt)).pipe(withDecodingDefault(succeed(null))),
 	goal: NullOr(TrimmedNonEmptyString).pipe(withDecodingDefault(succeed(null))),
 	titleRegeneration: NullOr(ThreadTitleRegeneration).pipe(withDecodingDefault(succeed(null))),
@@ -17940,6 +17941,15 @@ const ProjectDeleteCommand = Struct({
 	commandId: CommandId,
 	projectId: ProjectId
 });
+/**
+* The CMMD Work Session id a command may carry (forge#3466 review, nit 9).
+* CMMD's capability broker requires 1 to 256 characters; bounding it here
+* rejects a malformed id at the door instead of letting decide-time code find
+* out. Command-only: the read model and its events keep decoding a plain
+* string so a row or a journaled event written before this bound existed
+* still loads.
+*/
+const CommandWorkSessionId = TrimmedNonEmptyString.check(isMaxLength(256));
 const ThreadCreateCommand = Struct({
 	type: Literal("thread.create"),
 	commandId: CommandId,
@@ -17953,6 +17963,7 @@ const ThreadCreateCommand = Struct({
 	worktreePath: NullOr(TrimmedNonEmptyString),
 	anchorKind: optional$4(CmmdAnchorKind),
 	anchorCmmdId: optional$4(NullOr(String$1)),
+	workSessionId: optional$4(NullOr(CommandWorkSessionId)),
 	goal: optional$4(NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: optional$4(NullOr(LinkedPullRequest)),
 	kind: optional$4(ThreadKind),
@@ -18062,7 +18073,8 @@ const ThreadTurnStartCommand = Struct({
 	anchorCmmdId: optional$4(NullOr(String$1)),
 	kind: optional$4(ThreadKind),
 	parentThreadId: optional$4(NullOr(ThreadId)),
-	createdAt: IsoDateTime
+	createdAt: IsoDateTime,
+	workSessionId: optional$4(NullOr(CommandWorkSessionId))
 });
 const ClientThreadTurnStartCommand = Struct({
 	type: Literal("thread.turn.start"),
@@ -18085,7 +18097,8 @@ const ClientThreadTurnStartCommand = Struct({
 	anchorCmmdId: optional$4(NullOr(String$1)),
 	kind: optional$4(ThreadKind),
 	parentThreadId: optional$4(NullOr(ThreadId)),
-	createdAt: IsoDateTime
+	createdAt: IsoDateTime,
+	workSessionId: optional$4(NullOr(CommandWorkSessionId))
 });
 const ThreadTurnInterruptCommand = Struct({
 	type: Literal("thread.turn.interrupt"),
@@ -18361,6 +18374,7 @@ const ThreadCreatedPayload$1 = Struct({
 	settledOverride: optional$4(SettledOverride),
 	anchorKind: CmmdAnchorKind.pipe(withDecodingDefault(succeed("scratch"))),
 	anchorCmmdId: NullOr(String$1).pipe(withDecodingDefault(succeed(null))),
+	workSessionId: optionalKey(NullOr(String$1)),
 	goal: optionalKey(NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: optionalKey(NullOr(LinkedPullRequest)),
 	kind: ThreadKind.pipe(withDecodingDefault(succeed("master"))),
@@ -18402,6 +18416,7 @@ const ThreadMetaUpdatedPayload$1 = Struct({
 	status: optional$4(ThreadStatus),
 	parentThreadId: optional$4(NullOr(ThreadId)),
 	workerRole: optional$4(NullOr(WorkerRole)),
+	workSessionId: optional$4(NullOr(String$1)),
 	goal: optional$4(NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: optional$4(NullOr(LinkedPullRequest)),
 	regenerateTitle: optional$4(Literal(true)),
@@ -50617,7 +50632,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = os.release().split(".");
+		const osRelease = $U.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53060,7 +53075,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$4 = __require("os");
+	const os$3 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53082,7 +53097,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$4.userInfo();
+				const userInfo = os$3.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66005,7 +66020,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.89";
+var version$1 = "0.13.91";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -76051,7 +76066,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$3 = __require("os");
+	var os$2 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -76059,8 +76074,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$3.arch();
-	var platform = process.env.npm_config_platform || os$3.platform();
+	var arch = process.env.npm_config_arch || os$2.arch();
+	var platform = process.env.npm_config_platform || os$2.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -87586,7 +87601,8 @@ const brokerScopes = new Set([
 	"github",
 	"provider",
 	"package",
-	"scm"
+	"scm",
+	"sidekick"
 ]);
 const defaultOwnerId = "interactive";
 const authorities = /* @__PURE__ */ new Map();
@@ -87740,6 +87756,19 @@ function readRuntimeBrokerAuthorityForRuntime(input) {
 }
 //#endregion
 //#region src/runtimeAuth/runtimeBrokerIdentity.ts
+/**
+* Whether this process is a CMMD-managed per-project cloud runtime (a
+* sprite), never a local Forge desktop or dev process. Shared by
+* `GitHubBroker.resolveRuntimeGrant` and
+* `cmmdWorkSessionCapabilityBroker.resolveWorkSessionSidekickRuntimeGrant`
+* (forge#3466 review, should-fix 4) so the two runtime-grant resolvers gate
+* on the same runtime-role signal instead of each inferring it separately.
+* Mirrors the env parsing `providerEgressToken.ts` and `ServerEnvironment.ts`
+* already use for the same signal.
+*/
+function isCmmdCloudRuntimeModeEnv() {
+	return process.env.FORGE_CMMD_RUNTIME_MODE === "true" || process.env.FORGE_CMMD_RUNTIME_MODE === "1";
+}
 function classifyRuntimeBrokerIdentity(input) {
 	const machineId = input.machineId?.trim();
 	const credentialEpoch = input.credentialEpoch;
@@ -90764,9 +90793,6 @@ var GitHubBroker = class {
 		return validateGitBranchName(branch) ?? branch;
 	}
 };
-function isCmmdCloudRuntimeModeEnv() {
-	return process.env.FORGE_CMMD_RUNTIME_MODE === "true" || process.env.FORGE_CMMD_RUNTIME_MODE === "1";
-}
 function inferGitHubBrokerRuntimeRole() {
 	if (isCmmdCloudRuntimeModeEnv()) return "user-vm";
 	return "local";
@@ -93893,7 +93919,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-yHTUkd2Y.mjs"),
+		try: () => import("./open-2-reBrpv.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -115274,7 +115300,7 @@ const postgresSchemaStatements = [
 	"CREATE TABLE IF NOT EXISTS checkpoint_diff_blobs (\n      thread_id TEXT NOT NULL,\n      from_turn_count INTEGER NOT NULL,\n      to_turn_count INTEGER NOT NULL,\n      diff TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      UNIQUE (thread_id, from_turn_count, to_turn_count)\n    )",
 	"CREATE TABLE IF NOT EXISTS provider_session_runtime (\n      thread_id TEXT PRIMARY KEY,\n      provider_name TEXT NOT NULL,\n      adapter_key TEXT NOT NULL,\n      runtime_mode TEXT NOT NULL DEFAULT 'full-access',\n      status TEXT NOT NULL,\n      last_seen_at TEXT NOT NULL,\n      resume_cursor_json TEXT,\n      runtime_payload_json TEXT\n    )",
 	"CREATE TABLE IF NOT EXISTS projection_projects (\n      project_id TEXT PRIMARY KEY,\n      title TEXT NOT NULL,\n      workspace_root TEXT NOT NULL,\n      scripts_json TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , default_model_selection_json TEXT, default_thread_env_mode TEXT, cmmd_registration_json TEXT)",
-	"CREATE TABLE IF NOT EXISTS projection_threads (\n      thread_id TEXT PRIMARY KEY,\n      project_id TEXT NOT NULL,\n      title TEXT NOT NULL,\n      branch TEXT,\n      worktree_path TEXT,\n      latest_turn_id TEXT,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access', interaction_mode TEXT NOT NULL DEFAULT 'default', model_selection_json TEXT, archived_at TEXT, latest_user_message_at TEXT, pending_approval_count INTEGER NOT NULL DEFAULT 0, pending_user_input_count INTEGER NOT NULL DEFAULT 0, has_actionable_proposed_plan INTEGER NOT NULL DEFAULT 0, kind TEXT NOT NULL DEFAULT 'master', parent_thread_id TEXT, status TEXT NOT NULL DEFAULT 'idle', anchor_kind TEXT NOT NULL DEFAULT 'scratch', anchor_cmmd_id TEXT, worker_role TEXT DEFAULT NULL, goal TEXT, pending_auto_create_prompt_json TEXT, title_regeneration_json TEXT, rate_limit_status_json TEXT, linked_pull_request_json TEXT, settled_at TEXT, settled_override TEXT)",
+	"CREATE TABLE IF NOT EXISTS projection_threads (\n      thread_id TEXT PRIMARY KEY,\n      project_id TEXT NOT NULL,\n      title TEXT NOT NULL,\n      branch TEXT,\n      worktree_path TEXT,\n      latest_turn_id TEXT,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access', interaction_mode TEXT NOT NULL DEFAULT 'default', model_selection_json TEXT, archived_at TEXT, latest_user_message_at TEXT, pending_approval_count INTEGER NOT NULL DEFAULT 0, pending_user_input_count INTEGER NOT NULL DEFAULT 0, has_actionable_proposed_plan INTEGER NOT NULL DEFAULT 0, kind TEXT NOT NULL DEFAULT 'master', parent_thread_id TEXT, status TEXT NOT NULL DEFAULT 'idle', anchor_kind TEXT NOT NULL DEFAULT 'scratch', anchor_cmmd_id TEXT, worker_role TEXT DEFAULT NULL, goal TEXT, pending_auto_create_prompt_json TEXT, title_regeneration_json TEXT, rate_limit_status_json TEXT, linked_pull_request_json TEXT, settled_at TEXT, settled_override TEXT, work_session_id TEXT)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_messages (\n      message_id TEXT PRIMARY KEY,\n      thread_id TEXT NOT NULL,\n      turn_id TEXT,\n      role TEXT NOT NULL,\n      text TEXT NOT NULL,\n      is_streaming INTEGER NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL\n    , attachments_json TEXT)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_activities (\n      activity_id TEXT PRIMARY KEY,\n      thread_id TEXT NOT NULL,\n      turn_id TEXT,\n      tone TEXT NOT NULL,\n      kind TEXT NOT NULL,\n      summary TEXT NOT NULL,\n      payload_json TEXT NOT NULL,\n      created_at TEXT NOT NULL\n    , sequence INTEGER)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_sessions (\n      thread_id TEXT PRIMARY KEY,\n      status TEXT NOT NULL,\n      provider_name TEXT,\n      provider_session_id TEXT,\n      provider_thread_id TEXT,\n      active_turn_id TEXT,\n      last_error TEXT,\n      updated_at TEXT NOT NULL\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access')",
@@ -115595,7 +115621,8 @@ const postgresUpgradeMigrations = new Map([
           LIMIT 1
         )
         WHERE model_selection_json IS NULL`
-	]]
+	]],
+	[77, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_id TEXT`]]
 ]);
 function requirePostgresUpgradeStatements(version) {
 	const statements = postgresUpgradeMigrations.get(version);
@@ -115621,15 +115648,15 @@ const runPostgresMigrations = fn$1("runPostgresMigrations")(function* () {
         ORDER BY version DESC
         LIMIT 1
       `)[0]?.version ?? 0;
-		if (currentVersion > 76) return yield* die$1(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 76.`));
+		if (currentVersion > 77) return yield* die$1(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 77.`));
 		if (currentVersion === 0) {
 			for (const statement of postgresSchemaStatements) yield* sql.unsafe(statement);
 			yield* sql`
           INSERT INTO forge_schema_migrations (version)
-          VALUES (${76})
+          VALUES (${77})
           ON CONFLICT (version) DO NOTHING
         `;
-		} else for (let version = currentVersion + 1; version <= 76; version += 1) {
+		} else for (let version = currentVersion + 1; version <= 77; version += 1) {
 			const statements = yield* sync$1(() => requirePostgresUpgradeStatements(version));
 			for (const statement of statements) yield* sql.unsafe(statement);
 			yield* sql`
@@ -118413,6 +118440,18 @@ var _076_ProjectionTurnsModelSelection_default = gen(function* () {
   `;
 });
 //#endregion
+//#region src/persistence/Migrations/077_ProjectionThreadWorkSessionId.ts
+/** Stores the CMMD Work Session id a kicked thread's root turn belongs to (forge#3466). */
+var _077_ProjectionThreadWorkSessionId_default = gen(function* () {
+	const sql = yield* SqlClient;
+	if (!(yield* sql`
+    PRAGMA table_info(projection_threads)
+  `).some((column) => column.name === "work_session_id")) yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN work_session_id TEXT
+    `;
+});
+//#endregion
 //#region src/persistence/Migrations.ts
 /**
 * MigrationsLive - Migration runner with inline loader
@@ -118813,6 +118852,11 @@ const migrationEntries = [
 		76,
 		"ProjectionTurnsModelSelection",
 		_076_ProjectionTurnsModelSelection_default
+	],
+	[
+		77,
+		"ProjectionThreadWorkSessionId",
+		_077_ProjectionThreadWorkSessionId_default
 	]
 ];
 const makeMigrationLoader = (throughId) => fromRecord(Object.fromEntries(migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -152169,10 +152213,10 @@ function getOpenAiProviderEgressProxyConfig(input) {
 		message: `Workspace OpenAI provider egress is configured, but OPENAI_BASE_URL does not point at ${OPENAI_PROVIDER_EGRESS_PATH}. Refusing to start Codex with a stale or raw OPENAI_API_KEY.`
 	};
 }
-function configuredRuntimeMachineId() {
+function configuredRuntimeMachineId$1() {
 	return process.env.FORGE_CMMD_RUNTIME_MACHINE_ID?.trim() || null;
 }
-function configuredRuntimeCredentialEpoch() {
+function configuredRuntimeCredentialEpoch$1() {
 	const raw = process.env.FORGE_CMMD_RUNTIME_CREDENTIAL_EPOCH?.trim();
 	return raw === void 0 ? void 0 : Number(raw);
 }
@@ -152243,15 +152287,15 @@ function resolveBrokerTicketOutcome(input) {
 function providerEgressRequiresOwnerSession() {
 	if (!canIssueCmmdRuntimeProviderEgressToken()) return false;
 	return classifyRuntimeBrokerIdentity({
-		machineId: configuredRuntimeMachineId() ?? void 0,
-		credentialEpoch: configuredRuntimeCredentialEpoch(),
+		machineId: configuredRuntimeMachineId$1() ?? void 0,
+		credentialEpoch: configuredRuntimeCredentialEpoch$1(),
 		brokerAuthorityMode: process.env.FORGE_CMMD_RUNTIME_BROKER_AUTHORITY_MODE
 	}).mode === "exact";
 }
 function runtimeProviderBrokerToken(input) {
 	const identity = classifyRuntimeBrokerIdentity({
-		machineId: configuredRuntimeMachineId() ?? void 0,
-		credentialEpoch: configuredRuntimeCredentialEpoch(),
+		machineId: configuredRuntimeMachineId$1() ?? void 0,
+		credentialEpoch: configuredRuntimeCredentialEpoch$1(),
 		brokerAuthorityMode: process.env.FORGE_CMMD_RUNTIME_BROKER_AUTHORITY_MODE
 	});
 	if (identity.mode !== "exact") return resolveBrokerTicketOutcome({
@@ -152366,7 +152410,8 @@ async function issueCmmdRuntimeProviderEgressCredential(input) {
 		body: JSON.stringify({
 			provider: input.provider,
 			...providerEgressModelBodyFields(input),
-			...input.provider === "openai" && input.providerAccountId ? { provider_account_id: input.providerAccountId } : {}
+			...input.provider === "openai" && input.providerAccountId ? { provider_account_id: input.providerAccountId } : {},
+			...input.threadId ? { thread_id: input.threadId } : {}
 		})
 	});
 	if (!response.ok) throw new Error(await describeProviderTokenFailure(response));
@@ -152391,8 +152436,8 @@ function runtimeCredentialFromGrant(provider, payload, controlPlaneUrl) {
 	return deliveryBoundRuntimeCredential(provider, payload, controlPlaneUrl);
 }
 function deliveryBoundRuntimeCredential(provider, payload, controlPlaneUrl) {
-	const runtimeMachineId = configuredRuntimeMachineId();
-	const runtimeCredentialEpoch = configuredRuntimeCredentialEpoch();
+	const runtimeMachineId = configuredRuntimeMachineId$1();
+	const runtimeCredentialEpoch = configuredRuntimeCredentialEpoch$1();
 	if (!runtimeMachineId || runtimeCredentialEpoch === void 0) throw new Error("Provider proxy token response was missing exact runtime authority.");
 	const deliveryReceipt = parseProviderRuntimeDeliveryReceipt(payload.deliveryReceipt, {
 		provider,
@@ -191832,7 +191877,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -202032,12 +202077,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$2 = "https://code.claude.com/docs/en", kKe = [
+var os$1 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$2}/iam#permission-modes`
+			docLink: `${os$1}/iam#permission-modes`
 		}
 	},
 	{
@@ -202052,7 +202097,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$2}/settings#environment-variables`
+			docLink: `${os$1}/settings#environment-variables`
 		}
 	},
 	{
@@ -202063,14 +202108,14 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$2}/hooks`
+			docLink: `${os$1}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$2}/hooks#exec-form-and-shell-form`
+			docLink: `${os$1}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -202085,7 +202130,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$2}/settings`
+			docLink: `${os$1}/settings`
 		}
 	},
 	{
@@ -202100,13 +202145,13 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$2}/iam#working-directories`
+			docLink: `${os$1}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$2}/iam#configuring-permissions`,
-	env: `${os$2}/settings#environment-variables`,
-	hooks: `${os$2}/hooks`
+	permissions: `${os$1}/iam#configuring-permissions`,
+	env: `${os$1}/settings#environment-variables`,
+	hooks: `${os$1}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -211534,7 +211579,7 @@ function createCodexCmmdSidekickDynamicToolHandler(session) {
 //#region src/cmmdData/cmmdDelegatedToolCatalog.ts
 const CATALOG_PATH = "/api/forge/context/sidekick/tools/catalog";
 const EXECUTE_PATH = "/api/forge/context/sidekick/tools/execute";
-const AUTH_REQUIRED = {
+const AUTH_REQUIRED$1 = {
 	ok: false,
 	code: "CMMD_AUTH_REQUIRED"
 };
@@ -211542,11 +211587,32 @@ function upstreamErrorCode(error) {
 	if (error && typeof error === "object" && "code" in error && typeof error.code === "string") return error.code;
 	return "CMMD_REST_ERROR";
 }
-async function listCatalog(resolveJwt, scope) {
+/**
+* The Work Session lane, tried before the owner-JWT lane ever runs
+* (forge#3466 review, should-fix 3). A headless sprite's Work Session thread
+* never carries an owner JWT (CMMD ADR-015), so trying that lane first only
+* spends a lookup before falling through to the same broker call every time
+* — and on a sprite in runtime mode, the owner's browser and CMMD's kick
+* authenticate into the same synthetic session, so a resolved JWT there is
+* never legitimately this Work Session's own. Reading fresh on every call,
+* not once at construction, is what makes blocker 1's fix work: session
+* start, the ~30-second renewal, and a post-`capability_invalid` re-mint all
+* land here, so a Retry that rebinds the thread mid-session is picked up on
+* its very next mint instead of being stuck asking for the session that just
+* failed. Returns null (not a failure) for a person-started thread, which
+* supplies no `readWorkSessionId` and keeps today's owner lane byte for byte.
+*/
+async function resolveViaWorkSession(workSessionCapability, scope) {
+	const workSessionId = workSessionCapability.readWorkSessionId ? await workSessionCapability.readWorkSessionId() : null;
+	if (workSessionId === null) return null;
+	return workSessionCapability.requestCapability ? workSessionCapability.requestCapability(workSessionId, scope.threadId) : AUTH_REQUIRED$1;
+}
+async function listCatalog(resolveJwt, workSessionCapability, scope) {
+	const viaWorkSession = await resolveViaWorkSession(workSessionCapability, scope);
+	if (viaWorkSession !== null) return viaWorkSession;
 	const sessionId = readThreadSessionId(scope.threadId);
-	if (!sessionId) return AUTH_REQUIRED;
-	const jwt = await resolveJwt(sessionId);
-	if (!jwt) return AUTH_REQUIRED;
+	const jwt = sessionId ? await resolveJwt(sessionId) : null;
+	if (!jwt) return AUTH_REQUIRED$1;
 	const body = { forgeThreadId: scope.threadId };
 	if (scope.projectId !== void 0) body["projectId"] = scope.projectId;
 	if (scope.forgeAgentId !== void 0) body["forgeAgentId"] = scope.forgeAgentId;
@@ -211596,9 +211662,9 @@ async function execute(request) {
 		};
 	}
 }
-function createCmmdDelegatedToolCatalogClient(resolveJwt) {
+function createCmmdDelegatedToolCatalogClient(resolveJwt, workSessionCapability = {}) {
 	return {
-		listCatalog: (scope) => listCatalog(resolveJwt, scope),
+		listCatalog: (scope) => listCatalog(resolveJwt, workSessionCapability, scope),
 		execute
 	};
 }
@@ -211653,9 +211719,144 @@ function createCmmdSidekickToolSession(client, scope) {
 	};
 }
 //#endregion
+//#region src/cmmdData/cmmdWorkSessionCapabilityBroker.ts
+/**
+* CMMD's Work Session Sidekick-capability broker client (forge#3466,
+* CMMD#5026).
+*
+* A headless sprite runs a Work Session's root thread with no owner JWT or
+* PAT: nobody signed in. `cmmdDelegatedToolCatalog.ts`'s owner-JWT lane falls
+* through to this one instead, presenting the runtime's OWN grant (never a
+* JWT, per CMMD ADR-015) plus the Work Session id CMMD stamped on the thread,
+* and getting back the same delegated Sidekick capability shape the owner
+* lane mints.
+*/
+const SIDEKICK_CAPABILITY_TIMEOUT_MS = 1e4;
+const AUTH_REQUIRED = {
+	ok: false,
+	code: "CMMD_AUTH_REQUIRED"
+};
+function configuredRuntimeMachineId() {
+	return process.env.FORGE_CMMD_RUNTIME_MACHINE_ID?.trim() || void 0;
+}
+function configuredRuntimeCredentialEpoch() {
+	const raw = process.env.FORGE_CMMD_RUNTIME_CREDENTIAL_EPOCH?.trim();
+	return raw === void 0 ? void 0 : Number(raw);
+}
+/**
+* The runtime's own bearer for the "sidekick" broker scope.
+*
+* Follows the same exact-machine / legacy split as
+* `GitHubBroker.resolveRuntimeGrant`, including its `runtimeRole !== "user-vm"`
+* gate (forge#3466 review, should-fix 4, via the resolver both share:
+* `isCmmdCloudRuntimeModeEnv`): an exact-machine runtime presents whatever
+* ticket CMMD already delivered into the broker-authority cache for this
+* scope (an inbound request installs it as a side effect of authenticating;
+* CMMD's runtime ticket carries `sidekick` alongside `provider`/`github`/etc,
+* so it lands there the same way). A legacy runtime presents its one
+* portable grant token. A runtime with no id, an identity that is neither
+* exact nor legacy, or a role that isn't a managed CMMD cloud runtime at
+* all, has nothing to present — a local Forge with a stray
+* `FORGE_CMMD_RUNTIME_ID` left over from a legacy config must never present
+* its portable grant token as though it were a sprite.
+*/
+function resolveWorkSessionSidekickRuntimeGrant() {
+	if (!isCmmdCloudRuntimeModeEnv()) return null;
+	const runtimeId = process.env.FORGE_CMMD_RUNTIME_ID?.trim();
+	if (!runtimeId) return null;
+	const identity = classifyRuntimeBrokerIdentity({
+		machineId: configuredRuntimeMachineId(),
+		credentialEpoch: configuredRuntimeCredentialEpoch(),
+		brokerAuthorityMode: process.env.FORGE_CMMD_RUNTIME_BROKER_AUTHORITY_MODE
+	});
+	if (identity.mode === "exact") {
+		const authority = readRuntimeBrokerAuthorityForRuntime({
+			runtimeId,
+			machineId: identity.machineId,
+			credentialEpoch: identity.credentialEpoch,
+			requiredScope: "sidekick"
+		});
+		return authority ? {
+			runtimeId,
+			token: authority.token
+		} : null;
+	}
+	if (identity.mode === "invalid") return null;
+	const legacyToken = runtimeGrantToken();
+	return legacyToken ? {
+		runtimeId,
+		token: legacyToken
+	} : null;
+}
+function isRawSidekickCapabilityResponse(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return Array.isArray(record.tools) && typeof record.catalogVersion === "string" && typeof record.capabilitySessionId === "number" && typeof record.capabilityToken === "string" && typeof record.expiresAt === "string";
+}
+/**
+* Mints a Work Session Sidekick capability straight from CMMD, for a thread
+* whose owner JWT never resolved.
+*
+* The mint route answers a bare JSON body, never CMMD's forge-context
+* `{ data: ... }` envelope the owner-JWT catalog route uses, so this never
+* unwraps `.data`. Always resolves, never throws: a missing runtime grant, a
+* network failure, and a refusal from CMMD (the broker feature flag is off,
+* the Work Session ended, this runtime is not its starter, ...) all fold to
+* the same `CMMD_AUTH_REQUIRED` the owner-JWT lane already returns on any
+* auth failure, so callers need exactly one failure branch. The refusal's
+* own code is logged, not returned, so an operator can still tell the cases
+* apart.
+*/
+async function requestWorkSessionSidekickCapability(workSessionId, threadId, deps = {}) {
+	const grant = (deps.resolveRuntimeGrant ?? resolveWorkSessionSidekickRuntimeGrant)();
+	if (!grant) {
+		console.warn(`[cmmd-work-session-capability] no runtime grant for the sidekick scope (thread ${threadId}, work session ${workSessionId})`);
+		return AUTH_REQUIRED;
+	}
+	const fetchImpl = deps.fetch ?? fetch;
+	const url = resolveCommandAppEndpoint(`/api/forge/runtimes/${encodeURIComponent(grant.runtimeId)}/sidekick-capability`);
+	let response;
+	try {
+		response = await fetchImpl(url, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${grant.token}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({ workSessionId }),
+			signal: AbortSignal.timeout(SIDEKICK_CAPABILITY_TIMEOUT_MS)
+		});
+	} catch (error) {
+		console.warn("[cmmd-work-session-capability] broker request failed:", error instanceof Error ? error.message : String(error));
+		return AUTH_REQUIRED;
+	}
+	if (!response.ok) {
+		const body = await response.json().catch(() => null);
+		const code = body && typeof body === "object" && typeof body.code === "string" ? body.code : `HTTP_${response.status}`;
+		console.warn(`[cmmd-work-session-capability] broker refused the mint (${code})`);
+		return AUTH_REQUIRED;
+	}
+	const data = await response.json().catch(() => null);
+	if (!isRawSidekickCapabilityResponse(data)) {
+		console.warn("[cmmd-work-session-capability] broker returned an unexpected mint response");
+		return AUTH_REQUIRED;
+	}
+	return {
+		ok: true,
+		tools: data.tools,
+		catalogVersion: data.catalogVersion,
+		capabilitySessionId: data.capabilitySessionId,
+		capabilityToken: data.capabilityToken,
+		expiresAt: data.expiresAt
+	};
+}
+//#endregion
 //#region src/cmmdData/resolveCmmdSidekickToolCatalog.ts
-async function resolveCmmdSidekickToolCatalog(resolveJwt, threadId) {
-	const session = createCmmdSidekickToolSession(createCmmdDelegatedToolCatalogClient(resolveJwt), { threadId });
+async function resolveCmmdSidekickToolCatalog(resolveJwt, threadId, options = {}) {
+	const session = createCmmdSidekickToolSession(createCmmdDelegatedToolCatalogClient(resolveJwt, {
+		...options.readWorkSessionId !== void 0 ? { readWorkSessionId: options.readWorkSessionId } : {},
+		requestCapability: options.requestWorkSessionCapability ?? requestWorkSessionSidekickCapability
+	}), { threadId });
 	const catalog = await session.getCatalog();
 	return {
 		session,
@@ -211674,6 +211875,33 @@ async function resolveCmmdSidekickJwt(input) {
 		...binding?.subject ? { subject: binding.subject } : {}
 	});
 }
+const decodeWorkSessionIdRows = decodeUnknownEffect(ArraySchema(Struct({ workSessionId: NullOr(String$1) })));
+/**
+* Reads the CMMD Work Session id CMMD stamped on a thread's `thread.create`,
+* straight from the projected thread row (forge#3466). Null for a
+* person-started thread, for a thread projected before this field existed,
+* and for a thread id with no projected row at all.
+*
+* A minimal raw-SQL read against `projection_threads`, deliberately not
+* routed through `ProjectionThreadRepository`: the adapters that need this
+* (`ClaudeAdapter.ts`, `CodexAdapter.ts`) already capture only
+* `SqlClient.SqlClient` at session-build time (see `readThreadAuthSession`
+* in `GitHubAgentToolStore.ts` for the established pattern this follows), and
+* widening that capture to a second service for one column is not worth the
+* risk to every other call sharing it.
+*/
+function readThreadWorkSessionId(threadId) {
+	return gen(function* () {
+		return (yield* decodeWorkSessionIdRows(yield* (yield* SqlClient)`
+      SELECT work_session_id AS "workSessionId"
+      FROM projection_threads
+      WHERE thread_id = ${threadId}
+      LIMIT 1
+    `))[0]?.workSessionId ?? null;
+	}).pipe(tapError((error) => sync$1(() => {
+		console.warn(`[cmmd-work-session-thread-lookup] failed to read work_session_id for thread ${threadId}:`, error instanceof Error ? error.message : String(error));
+	})), orElseSucceed(() => null));
+}
 //#endregion
 //#region ../../packages/shared/src/computerUsePermission.ts
 /**
@@ -213263,13 +213491,14 @@ const makeCodexAdapter = fn$1("makeCodexAdapter")(function* (options) {
 			const jwt = readCommandJwtForSession(binding.sessionId);
 			return jwt ? { jwt } : null;
 		} });
+		const readCmmdWorkSessionId = () => runWithRuntimeContext(readThreadWorkSessionId(input.threadId));
 		const { session: cmmdSidekickToolSession, tools: cmmdSidekickTools } = yield* promise(() => resolveCmmdSidekickToolCatalog((sessionId) => resolveCmmdSidekickJwt({
 			threadId: input.threadId,
 			sessionId,
 			logPrefix: "codex-cmmd-sidekick",
 			readThreadAuth: (threadId) => runWithRuntimeContext(readThreadAuthSession(threadId)),
 			resolveJwt: (options) => runWithRuntimeContext(resolveCmmdJwtForSession(options))
-		}), input.threadId));
+		}), input.threadId, { readWorkSessionId: readCmmdWorkSessionId }));
 		const cmmdSidekickToolNames = new Set(cmmdSidekickTools.map((tool) => tool.name));
 		const devServerToolDeps = {
 			threadDevRuntime,
@@ -215381,6 +215610,21 @@ const SIGNIN_REQUIRED = {
 	action: "notify_human",
 	message: "Not signed in to CMMD for this session. Continue from repository evidence and tell the user to sign in to CMMD to enable project context."
 };
+/**
+* Same failure as {@link SIGNIN_REQUIRED} (no CMMD sign-in exists for this
+* session), but for a headless Work Session runtime that was never going to
+* have one: nobody is present to sign in (CMMD ADR-015). Telling the agent
+* to ask a human to sign in is wrong there. When CMMD's Sidekick capability
+* broker minted delegated tools for this Work Session (forge#3466,
+* CMMD#5026), point at them instead of dead-ending.
+*/
+const WORK_SESSION_CONTEXT_VIA_DELEGATED_TOOLS = {
+	ok: false,
+	code: "signin_required",
+	retryable: false,
+	action: "skip",
+	message: "No CMMD sign-in for this session, but this Work Session has delegated Sidekick tools. Call cmmd_get_agent_plan (or get_task) from cmmd-sidekick-tools for the task packet and current context, then continue from there."
+};
 /** Map a thrown CMMD client error to a recoverable envelope. */
 function errorEnvelope(err) {
 	if (isCmmdMcpAuthError$2(err)) return {
@@ -215443,12 +215687,13 @@ function projectIdToToolArg(projectId) {
 * mutation arg. The `action` arg of CMMD's multiplexed tools is hardcoded to a
 * read inside contextBuilder and never surfaced to the LLM.
 */
-function makeCmmdContextHandlers(resolvePat) {
+function makeCmmdContextHandlers(resolvePat, options = {}) {
+	const noPatEnvelope = options.hasWorkSessionPacketTool ? WORK_SESSION_CONTEXT_VIA_DELEGATED_TOOLS : SIGNIN_REQUIRED;
 	return {
 		getCurrentContext: async () => {
 			try {
 				const pat = await resolvePat();
-				if (!pat) return envelope(SIGNIN_REQUIRED);
+				if (!pat) return envelope(noPatEnvelope);
 				const snapshot = await buildCurrentContextSnapshot(pat, {
 					maxCampaigns: 3,
 					maxProjects: 5,
@@ -215481,7 +215726,7 @@ function makeCmmdContextHandlers(resolvePat) {
 					message: "Provide a non-empty `query` to search the CMMD knowledge base."
 				});
 				const pat = await resolvePat();
-				if (!pat) return envelope(SIGNIN_REQUIRED);
+				if (!pat) return envelope(noPatEnvelope);
 				const effectiveLimit = clampLimit(limit, DEFAULT_BRAIN_LIMIT, MAX_BRAIN_LIMIT);
 				const result = await callCmmdTool$2(pat, "search_brain_documents", {
 					query: trimmedQuery,
@@ -215535,7 +215780,7 @@ function makeCmmdContextHandlers(resolvePat) {
 					message: "Provide a `projectId` (from cmmd_get_current_context data.projects[].id)."
 				});
 				const pat = await resolvePat();
-				if (!pat) return envelope(SIGNIN_REQUIRED);
+				if (!pat) return envelope(noPatEnvelope);
 				const result = await callCmmdTool$2(pat, "list_board_tasks", { project_id: projectIdToToolArg(trimmedId) });
 				if (result.isError) return envelope(isErrorEnvelope(result));
 				const text = extractMcpToolText$2(result);
@@ -215564,8 +215809,8 @@ function makeCmmdContextHandlers(resolvePat) {
 *                    when the user is not authenticated with CMMD. Called per
 *                    tool invocation so a mid-session token refresh is picked up.
 */
-function createCmmdContextMcpServer(threadId, resolvePat) {
-	const handlers = makeCmmdContextHandlers(resolvePat);
+function createCmmdContextMcpServer(threadId, resolvePat, options = {}) {
+	const handlers = makeCmmdContextHandlers(resolvePat, options);
 	return z1e({
 		name: "cmmd-context",
 		tools: [
@@ -216088,7 +216333,7 @@ function buildClaudeMcpServers(input) {
 	return {
 		"forge-browser": createBrowserMcpServer(input.browserManager, input.threadId, browserToolScope(input.browserToolEnvironmentId)),
 		"forge-dev-server": createDevServerMcpServer(input.devServerToolDeps, input.threadId),
-		"cmmd-context": createCmmdContextMcpServer(input.threadId, input.resolveCmmdPat),
+		"cmmd-context": createCmmdContextMcpServer(input.threadId, input.resolveCmmdPat, { hasWorkSessionPacketTool: input.hasWorkSessionPacketTool }),
 		[GITHUB_MCP_SERVER_NAME]: createGitHubMcpServer(input.runBrokeredGitHubTool, input.threadId, input.serverSettings),
 		...input.computerManager ? { [COMPUTER_MCP_SERVER_NAME]: createComputerMcpServer(input.computerManager, input.threadId) } : {},
 		...input.cmmdSidekickTools ? { "cmmd-sidekick-tools": createCmmdSidekickToolsMcpServer(input.cmmdSidekickTools.session, input.cmmdSidekickTools.tools) } : {},
@@ -216132,19 +216377,47 @@ function claudePermissionQueryOptions(permissionMode) {
 function createClaudePromptStream(promptQueue) {
 	return fromQueue(promptQueue).pipe(filter$2((item) => item.type === "message"), map$7((item) => item.message), catchCause$1((cause) => hasInterruptsOnly(cause) ? empty$5 : failCause$5(cause)), toAsyncIterable);
 }
-function createCmmdPatResolver(threadId) {
+function createCmmdPatResolver(threadId, readWorkSessionId) {
 	return async () => {
+		if (await readWorkSessionId() !== null) return null;
 		const ownerSessionId = readThreadSessionId(threadId);
 		if (!ownerSessionId) return null;
 		return readCommandAccessTokenForSession(ownerSessionId);
 	};
 }
-function resolveCmmdSidekickTools(resolveJwt, threadId) {
-	return promise(() => resolveCmmdSidekickToolCatalog(resolveJwt, threadId)).pipe(map$3((resolved) => ({
+function resolveCmmdSidekickTools(resolveJwt, threadId, readWorkSessionId) {
+	return promise(() => resolveCmmdSidekickToolCatalog(resolveJwt, threadId, { readWorkSessionId })).pipe(map$3((resolved) => ({
 		registration: resolved.tools.length > 0 ? resolved : null,
 		codewebMcpGrant: resolved.codewebMcp
 	})));
 }
+/**
+* Name of the delegated tool that returns a Work Session's task packet
+* (CMMD's Agent Plan family, ADR-029). Forge's Sidekick capability broker
+* always mounts this for a Work Session (CMMD's `forge-surface.ts` curated
+* allowlist, verified 2026-09-26), so its presence in the granted catalog is
+* exactly "a Work Session capability exists for this thread". See
+* `cmmdContextMcpServer.ts`'s no-PAT branch (forge#3466).
+*/
+const WORK_SESSION_PACKET_TOOL_NAME = "cmmd_get_agent_plan";
+/**
+* Whether `cmmd-context`'s no-PAT branch should point at delegated tools
+* instead of asking the user to sign in (forge#3466 review, should-fix 5).
+*
+* Gating on `workSessionId !== null` alone, without a separate "which lane
+* minted this" tag, is sound because `cmmdDelegatedToolCatalog.ts`'s
+* `listCatalog` (should-fix 3) structurally never calls the owner-JWT lane
+* once a Work Session id is present — it returns straight from the broker
+* call or `AUTH_REQUIRED`. So a non-null `workSessionId` here can only ever
+* pair with a broker-minted registration. Before that reorder, the owner-JWT
+* catalog (the full, unnarrowed Sidekick catalog) also contains
+* `cmmd_get_agent_plan`, so checking the tool name alone told a
+* person-started thread with a resolved JWT but no PAT that it had Work
+* Session tools when it never did.
+*/
+function hasWorkSessionPacketTool(workSessionId, registration) {
+	return workSessionId !== null && (registration?.tools.some((tool) => tool.name === WORK_SESSION_PACKET_TOOL_NAME) ?? false);
+}
 function buildDevServerToolDeps(input) {
 	return {
 		threadDevRuntime: input.threadDevRuntime,
@@ -218320,7 +218593,8 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 		const runPromise = runPromiseWith(runtimeContext);
 		const browserToolEnvironmentId = yield* resolveBrowserToolEnvironmentId();
 		const computerManager = resolveComputerManager(serverConfig);
-		const resolveCmmdPat = createCmmdPatResolver(threadId);
+		const readWorkSessionId = () => runWithSqlRuntimeContext(readThreadWorkSessionId(threadId));
+		const resolveCmmdPat = createCmmdPatResolver(threadId, readWorkSessionId);
 		const resolveCmmdSidekickJwtForSession = (sessionId) => resolveCmmdSidekickJwt({
 			threadId,
 			sessionId,
@@ -218328,7 +218602,8 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			readThreadAuth: (targetThreadId) => runWithSqlRuntimeContext(readThreadAuthSession(targetThreadId)),
 			resolveJwt: (options) => runWithSqlRuntimeContext(resolveCmmdJwtForSession(options))
 		});
-		const cmmdSidekickResolution = yield* resolveCmmdSidekickTools(resolveCmmdSidekickJwtForSession, threadId);
+		const workSessionId = yield* promise(readWorkSessionId);
+		const cmmdSidekickResolution = yield* resolveCmmdSidekickTools(resolveCmmdSidekickJwtForSession, threadId, readWorkSessionId);
 		const devServerToolDeps = buildDevServerToolDeps({
 			threadDevRuntime,
 			devTunnel,
@@ -218413,6 +218688,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			resolveCmmdPat,
 			devServerToolDeps,
 			cmmdSidekickTools: cmmdSidekickResolution.registration,
+			hasWorkSessionPacketTool: hasWorkSessionPacketTool(workSessionId, cmmdSidekickResolution.registration),
 			codewebMcpInjection,
 			runBrokeredGitHubTool,
 			serverSettings
@@ -270408,7 +270684,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -270539,14 +270815,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -270554,7 +270830,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -287818,6 +288094,7 @@ const ProjectionThread = Struct({
 	parentThreadId: NullOr(ThreadId).pipe(withDecodingDefault(succeed(null))),
 	anchorKind: CmmdAnchorKind.pipe(withDecodingDefault(succeed("scratch"))),
 	anchorCmmdId: NullOr(String$1).pipe(withDecodingDefault(succeed(null))),
+	workSessionId: optionalKey(NullOr(String$1)),
 	linkedPullRequest: optionalKey(NullOr(LinkedPullRequest)),
 	status: ThreadStatus.pipe(withDecodingDefault(succeed("idle"))),
 	workerRole: NullOr(WorkerRole).pipe(withDecodingDefault(succeed(null))),
@@ -298928,7 +299205,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "394b2a7cd449282f2845ec5fa3bd9093f20b8bb8";
+	return "6a8d2900640fafdaeaeaf45ddfa1f1cf70c212d7";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -302558,6 +302835,7 @@ const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function*
 					updatedAt: command.createdAt,
 					anchorKind: anchor.anchorKind,
 					anchorCmmdId: anchor.anchorCmmdId,
+					workSessionId: command.workSessionId ?? null,
 					goal: command.goal ?? null,
 					linkedPullRequest: command.linkedPullRequest ?? null,
 					kind,
@@ -302867,7 +303145,8 @@ const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function*
 			const providerSwitchSelection = command.modelSelection !== void 0 && command.modelSelection.provider !== targetThread.modelSelection.provider ? command.modelSelection : void 0;
 			const accountSelection = turnAccountSelection(targetThread.modelSelection, command.modelSelection);
 			const turnModelSelection = providerSwitchSelection ?? accountSelection;
-			if (!shouldUpdateAnchor && !turnModelSelection) return [userMessageEvent, turnStartRequestedEvent];
+			const shouldRebindWorkSession = command.workSessionId !== void 0 && command.workSessionId !== null && command.workSessionId !== targetThread.workSessionId;
+			if (!shouldUpdateAnchor && !turnModelSelection && !shouldRebindWorkSession) return [userMessageEvent, turnStartRequestedEvent];
 			return [
 				{
 					...withEventBase({
@@ -302882,6 +303161,7 @@ const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function*
 						anchorKind: nextAnchor.anchorKind,
 						anchorCmmdId: nextAnchor.anchorCmmdId,
 						...turnModelSelection ? { modelSelection: turnModelSelection } : {},
+						...shouldRebindWorkSession ? { workSessionId: command.workSessionId } : {},
 						updatedAt: command.createdAt
 					}
 				},
@@ -303405,12 +303685,22 @@ function retainThreadActivitiesAfterRevert(activities, retainedTurnIds) {
 function retainThreadProposedPlansAfterRevert(proposedPlans, retainedTurnIds) {
 	return proposedPlans.filter((proposedPlan) => proposedPlan.turnId === null || retainedTurnIds.has(proposedPlan.turnId));
 }
+/**
+* Orders an unsequenced activity before a sequenced one, matching the SQL
+* projection's own `ORDER BY CASE WHEN sequence IS NULL THEN 0 ELSE 1 END
+* ASC, sequence ASC`. Zero means neither operand settles the order (both
+* missing, or both present and equal), so the caller falls back to a
+* timestamp/id tiebreak.
+*/
+function compareOptionalActivitySequence(left, right) {
+	const leftHasSequence = left !== void 0;
+	const rightHasSequence = right !== void 0;
+	if (leftHasSequence !== rightHasSequence) return leftHasSequence ? 1 : -1;
+	return leftHasSequence && rightHasSequence ? left - right : 0;
+}
 function compareThreadActivities(left, right) {
-	if (left.sequence !== void 0 && right.sequence !== void 0) {
-		if (left.sequence !== right.sequence) return left.sequence - right.sequence;
-	} else if (left.sequence !== void 0) return 1;
-	else if (right.sequence !== void 0) return -1;
-	return left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id);
+	const bySequence = compareOptionalActivitySequence(left.sequence, right.sequence);
+	return bySequence !== 0 ? bySequence : left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id);
 }
 function createEmptyReadModel(nowIso) {
 	return {
@@ -303441,6 +303731,7 @@ function projectEvent(model, event) {
 				worktreePath: payload.worktreePath,
 				anchorKind: payload.anchorKind,
 				anchorCmmdId: payload.anchorCmmdId,
+				workSessionId: payload.workSessionId ?? null,
 				goal: payload.goal ?? null,
 				linkedPullRequest: payload.linkedPullRequest ?? null,
 				titleRegeneration: null,
@@ -303521,6 +303812,7 @@ function projectEvent(model, event) {
 				...payload.goal !== void 0 ? { goal: payload.goal } : {},
 				...payload.linkedPullRequest !== void 0 ? { linkedPullRequest: payload.linkedPullRequest } : {},
 				...payload.titleRegeneration !== void 0 ? { titleRegeneration: payload.titleRegeneration } : {},
+				...payload.workSessionId !== void 0 ? { workSessionId: payload.workSessionId } : {},
 				updatedAt: payload.updatedAt
 			})
 		})));
@@ -304571,6 +304863,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           parent_thread_id,
           anchor_kind,
           anchor_cmmd_id,
+          work_session_id,
           linked_pull_request_json,
           status,
           worker_role,
@@ -304603,6 +304896,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           ${row.parentThreadId},
           ${row.anchorKind},
           ${row.anchorCmmdId},
+          ${row.workSessionId ?? null},
           ${row.linkedPullRequest == null ? null : JSON.stringify(row.linkedPullRequest)},
           ${row.status},
           ${row.workerRole},
@@ -304635,6 +304929,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           parent_thread_id = excluded.parent_thread_id,
           anchor_kind = excluded.anchor_kind,
           anchor_cmmd_id = excluded.anchor_cmmd_id,
+          work_session_id = excluded.work_session_id,
           linked_pull_request_json = excluded.linked_pull_request_json,
           status = excluded.status,
           worker_role = excluded.worker_role,
@@ -304672,6 +304967,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -304711,6 +305007,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -304892,6 +305189,14 @@ function collectThreadUserInputAttachmentRelativePaths(threadId, events) {
 	}
 	return relativePaths;
 }
+/**
+* Coalesces an optional Work Session id to the persisted default. Top-level
+* so the `??` here does not count against `applyThreadsProjection`'s own
+* complexity budget. See forge#3466.
+*/
+function projectedWorkSessionId(workSessionId) {
+	return workSessionId ?? null;
+}
 const runAttachmentSideEffects = fn$1("runAttachmentSideEffects")(function* (sideEffects) {
 	const serverConfig = yield* service(ServerConfig);
 	const fileSystem = yield* service(FileSystem);
@@ -305054,6 +305359,7 @@ const OrchestrationProjectionPipelineLive = effect(OrchestrationProjectionPipeli
 					parentThreadId: event.payload.parentThreadId,
 					anchorKind: event.payload.anchorKind,
 					anchorCmmdId: event.payload.anchorCmmdId,
+					workSessionId: projectedWorkSessionId(event.payload.workSessionId),
 					linkedPullRequest: event.payload.linkedPullRequest ?? null,
 					status: event.payload.status,
 					workerRole: event.payload.workerRole,
@@ -305091,6 +305397,7 @@ const OrchestrationProjectionPipelineLive = effect(OrchestrationProjectionPipeli
 					parentThreadId: thread.parentThreadId,
 					anchorKind: thread.anchorKind,
 					anchorCmmdId: thread.anchorCmmdId,
+					workSessionId: projectedWorkSessionId(thread.workSessionId),
 					linkedPullRequest: thread.linkedPullRequest ?? null,
 					status: thread.status,
 					workerRole: thread.workerRole,
@@ -305159,6 +305466,7 @@ const OrchestrationProjectionPipelineLive = effect(OrchestrationProjectionPipeli
 					...event.payload.goal !== void 0 ? { goal: event.payload.goal } : {},
 					...event.payload.linkedPullRequest !== void 0 ? { linkedPullRequest: event.payload.linkedPullRequest } : {},
 					...event.payload.titleRegeneration !== void 0 ? { titleRegeneration: event.payload.titleRegeneration } : {},
+					...event.payload.workSessionId !== void 0 ? { workSessionId: projectedWorkSessionId(event.payload.workSessionId) } : {},
 					updatedAt: event.payload.updatedAt
 				});
 				return;
@@ -306157,6 +306465,16 @@ function probeProjectAvailability(fs, workspaceRoot) {
 function toPersistenceSqlOrDecodeError(sqlOperation, decodeOperation) {
 	return (cause) => isSchemaError(cause) ? toPersistenceDecodeError(decodeOperation)(cause) : toPersistenceSqlError(sqlOperation)(cause);
 }
+/**
+* `{ workSessionId }` when the row carries one, an empty object when absent,
+* so the built thread's optionalKey field round-trips without ever getting
+* assigned an explicit `undefined` (exactOptionalPropertyTypes). Pulled out
+* of the two thread builders that call it so this file's already-flagged
+* high-complexity functions do not pick up the branch. See forge#3466.
+*/
+function workSessionIdField(workSessionId) {
+	return workSessionId !== void 0 ? { workSessionId } : {};
+}
 const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQuery, gen(function* () {
 	const sql = yield* SqlClient;
 	const repositoryIdentityResolver = yield* RepositoryIdentityResolver;
@@ -306209,6 +306527,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -306247,6 +306566,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -306351,6 +306671,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -306683,6 +307004,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -306995,6 +307317,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
 			session: sessionsByThread.get(row.threadId) ?? null,
 			anchorKind: row.anchorKind,
 			anchorCmmdId: row.anchorCmmdId,
+			...workSessionIdField(row.workSessionId),
 			linkedPullRequest: row.linkedPullRequest,
 			kind: row.kind,
 			parentThreadId: row.parentThreadId,
@@ -307244,6 +307567,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
 			session: isSome(sessionRow) ? mapSessionRow(sessionRow.value) : null,
 			anchorKind: threadRow.value.anchorKind,
 			anchorCmmdId: threadRow.value.anchorCmmdId,
+			...workSessionIdField(threadRow.value.workSessionId),
 			linkedPullRequest: threadRow.value.linkedPullRequest,
 			kind: threadRow.value.kind,
 			parentThreadId: threadRow.value.parentThreadId,
@@ -323577,7 +323901,7 @@ const connectLoginCommand = make$34("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-yHTUkd2Y.mjs")).default;
+			const open = (await import("./open-2-reBrpv.mjs")).default;
 			await open(url);
 			return true;
 		},