@cmmd-center/forge 0.13.90 → 0.13.92

package/dist/bin.cjs

@@ -17845,6 +17845,7 @@ const OrchestrationThread = require_Schema$1.Struct({
 	parentThreadId: require_Schema$1.NullOr(ThreadId).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	status: ThreadStatus.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed("idle"))),
 	workerRole: require_Schema$1.NullOr(WorkerRole).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
+	workSessionId: require_Schema$1.optionalKey(require_Schema$1.NullOr(require_Schema$1.String)),
 	pendingAutoCreatePrompt: require_Schema$1.optional(require_Schema$1.NullOr(AutoCreateTaskPrompt)).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	goal: require_Schema$1.NullOr(TrimmedNonEmptyString).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	titleRegeneration: require_Schema$1.NullOr(ThreadTitleRegeneration).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
@@ -18000,6 +18001,15 @@ const ProjectDeleteCommand = require_Schema$1.Struct({
 	commandId: CommandId,
 	projectId: ProjectId
 });
+/**
+* The CMMD Work Session id a command may carry (forge#3466 review, nit 9).
+* CMMD's capability broker requires 1 to 256 characters; bounding it here
+* rejects a malformed id at the door instead of letting decide-time code find
+* out. Command-only: the read model and its events keep decoding a plain
+* string so a row or a journaled event written before this bound existed
+* still loads.
+*/
+const CommandWorkSessionId = TrimmedNonEmptyString.check(require_Schema$1.isMaxLength(256));
 const ThreadCreateCommand = require_Schema$1.Struct({
 	type: require_Schema$1.Literal("thread.create"),
 	commandId: CommandId,
@@ -18013,6 +18023,7 @@ const ThreadCreateCommand = require_Schema$1.Struct({
 	worktreePath: require_Schema$1.NullOr(TrimmedNonEmptyString),
 	anchorKind: require_Schema$1.optional(CmmdAnchorKind),
 	anchorCmmdId: require_Schema$1.optional(require_Schema$1.NullOr(require_Schema$1.String)),
+	workSessionId: require_Schema$1.optional(require_Schema$1.NullOr(CommandWorkSessionId)),
 	goal: require_Schema$1.optional(require_Schema$1.NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: require_Schema$1.optional(require_Schema$1.NullOr(LinkedPullRequest)),
 	kind: require_Schema$1.optional(ThreadKind),
@@ -18122,7 +18133,8 @@ const ThreadTurnStartCommand = require_Schema$1.Struct({
 	anchorCmmdId: require_Schema$1.optional(require_Schema$1.NullOr(require_Schema$1.String)),
 	kind: require_Schema$1.optional(ThreadKind),
 	parentThreadId: require_Schema$1.optional(require_Schema$1.NullOr(ThreadId)),
-	createdAt: IsoDateTime
+	createdAt: IsoDateTime,
+	workSessionId: require_Schema$1.optional(require_Schema$1.NullOr(CommandWorkSessionId))
 });
 const ClientThreadTurnStartCommand = require_Schema$1.Struct({
 	type: require_Schema$1.Literal("thread.turn.start"),
@@ -18145,7 +18157,8 @@ const ClientThreadTurnStartCommand = require_Schema$1.Struct({
 	anchorCmmdId: require_Schema$1.optional(require_Schema$1.NullOr(require_Schema$1.String)),
 	kind: require_Schema$1.optional(ThreadKind),
 	parentThreadId: require_Schema$1.optional(require_Schema$1.NullOr(ThreadId)),
-	createdAt: IsoDateTime
+	createdAt: IsoDateTime,
+	workSessionId: require_Schema$1.optional(require_Schema$1.NullOr(CommandWorkSessionId))
 });
 const ThreadTurnInterruptCommand = require_Schema$1.Struct({
 	type: require_Schema$1.Literal("thread.turn.interrupt"),
@@ -18441,6 +18454,7 @@ const ThreadCreatedPayload$1 = require_Schema$1.Struct({
 	settledOverride: require_Schema$1.optional(SettledOverride),
 	anchorKind: CmmdAnchorKind.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed("scratch"))),
 	anchorCmmdId: require_Schema$1.NullOr(require_Schema$1.String).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
+	workSessionId: require_Schema$1.optionalKey(require_Schema$1.NullOr(require_Schema$1.String)),
 	goal: require_Schema$1.optionalKey(require_Schema$1.NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: require_Schema$1.optionalKey(require_Schema$1.NullOr(LinkedPullRequest)),
 	kind: ThreadKind.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed("master"))),
@@ -18482,6 +18496,7 @@ const ThreadMetaUpdatedPayload$1 = require_Schema$1.Struct({
 	status: require_Schema$1.optional(ThreadStatus),
 	parentThreadId: require_Schema$1.optional(require_Schema$1.NullOr(ThreadId)),
 	workerRole: require_Schema$1.optional(require_Schema$1.NullOr(WorkerRole)),
+	workSessionId: require_Schema$1.optional(require_Schema$1.NullOr(require_Schema$1.String)),
 	goal: require_Schema$1.optional(require_Schema$1.NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: require_Schema$1.optional(require_Schema$1.NullOr(LinkedPullRequest)),
 	regenerateTitle: require_Schema$1.optional(require_Schema$1.Literal(true)),
@@ -66296,7 +66311,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.90";
+var version$1 = "0.13.92";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -87937,7 +87952,8 @@ const brokerScopes = new Set([
 	"github",
 	"provider",
 	"package",
-	"scm"
+	"scm",
+	"sidekick"
 ]);
 const defaultOwnerId = "interactive";
 const authorities = /* @__PURE__ */ new Map();
@@ -88091,6 +88107,19 @@ function readRuntimeBrokerAuthorityForRuntime(input) {
 }
 //#endregion
 //#region src/runtimeAuth/runtimeBrokerIdentity.ts
+/**
+* Whether this process is a CMMD-managed per-project cloud runtime (a
+* sprite), never a local Forge desktop or dev process. Shared by
+* `GitHubBroker.resolveRuntimeGrant` and
+* `cmmdWorkSessionCapabilityBroker.resolveWorkSessionSidekickRuntimeGrant`
+* (forge#3466 review, should-fix 4) so the two runtime-grant resolvers gate
+* on the same runtime-role signal instead of each inferring it separately.
+* Mirrors the env parsing `providerEgressToken.ts` and `ServerEnvironment.ts`
+* already use for the same signal.
+*/
+function isCmmdCloudRuntimeModeEnv() {
+	return process.env.FORGE_CMMD_RUNTIME_MODE === "true" || process.env.FORGE_CMMD_RUNTIME_MODE === "1";
+}
 function classifyRuntimeBrokerIdentity(input) {
 	const machineId = input.machineId?.trim();
 	const credentialEpoch = input.credentialEpoch;
@@ -91115,9 +91144,6 @@ var GitHubBroker = class {
 		return validateGitBranchName(branch) ?? branch;
 	}
 };
-function isCmmdCloudRuntimeModeEnv() {
-	return process.env.FORGE_CMMD_RUNTIME_MODE === "true" || process.env.FORGE_CMMD_RUNTIME_MODE === "1";
-}
 function inferGitHubBrokerRuntimeRole() {
 	if (isCmmdCloudRuntimeModeEnv()) return "user-vm";
 	return "local";
@@ -115686,7 +115712,7 @@ const postgresSchemaStatements = [
 	"CREATE TABLE IF NOT EXISTS checkpoint_diff_blobs (\n      thread_id TEXT NOT NULL,\n      from_turn_count INTEGER NOT NULL,\n      to_turn_count INTEGER NOT NULL,\n      diff TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      UNIQUE (thread_id, from_turn_count, to_turn_count)\n    )",
 	"CREATE TABLE IF NOT EXISTS provider_session_runtime (\n      thread_id TEXT PRIMARY KEY,\n      provider_name TEXT NOT NULL,\n      adapter_key TEXT NOT NULL,\n      runtime_mode TEXT NOT NULL DEFAULT 'full-access',\n      status TEXT NOT NULL,\n      last_seen_at TEXT NOT NULL,\n      resume_cursor_json TEXT,\n      runtime_payload_json TEXT\n    )",
 	"CREATE TABLE IF NOT EXISTS projection_projects (\n      project_id TEXT PRIMARY KEY,\n      title TEXT NOT NULL,\n      workspace_root TEXT NOT NULL,\n      scripts_json TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , default_model_selection_json TEXT, default_thread_env_mode TEXT, cmmd_registration_json TEXT)",
-	"CREATE TABLE IF NOT EXISTS projection_threads (\n      thread_id TEXT PRIMARY KEY,\n      project_id TEXT NOT NULL,\n      title TEXT NOT NULL,\n      branch TEXT,\n      worktree_path TEXT,\n      latest_turn_id TEXT,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access', interaction_mode TEXT NOT NULL DEFAULT 'default', model_selection_json TEXT, archived_at TEXT, latest_user_message_at TEXT, pending_approval_count INTEGER NOT NULL DEFAULT 0, pending_user_input_count INTEGER NOT NULL DEFAULT 0, has_actionable_proposed_plan INTEGER NOT NULL DEFAULT 0, kind TEXT NOT NULL DEFAULT 'master', parent_thread_id TEXT, status TEXT NOT NULL DEFAULT 'idle', anchor_kind TEXT NOT NULL DEFAULT 'scratch', anchor_cmmd_id TEXT, worker_role TEXT DEFAULT NULL, goal TEXT, pending_auto_create_prompt_json TEXT, title_regeneration_json TEXT, rate_limit_status_json TEXT, linked_pull_request_json TEXT, settled_at TEXT, settled_override TEXT)",
+	"CREATE TABLE IF NOT EXISTS projection_threads (\n      thread_id TEXT PRIMARY KEY,\n      project_id TEXT NOT NULL,\n      title TEXT NOT NULL,\n      branch TEXT,\n      worktree_path TEXT,\n      latest_turn_id TEXT,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access', interaction_mode TEXT NOT NULL DEFAULT 'default', model_selection_json TEXT, archived_at TEXT, latest_user_message_at TEXT, pending_approval_count INTEGER NOT NULL DEFAULT 0, pending_user_input_count INTEGER NOT NULL DEFAULT 0, has_actionable_proposed_plan INTEGER NOT NULL DEFAULT 0, kind TEXT NOT NULL DEFAULT 'master', parent_thread_id TEXT, status TEXT NOT NULL DEFAULT 'idle', anchor_kind TEXT NOT NULL DEFAULT 'scratch', anchor_cmmd_id TEXT, worker_role TEXT DEFAULT NULL, goal TEXT, pending_auto_create_prompt_json TEXT, title_regeneration_json TEXT, rate_limit_status_json TEXT, linked_pull_request_json TEXT, settled_at TEXT, settled_override TEXT, work_session_id TEXT)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_messages (\n      message_id TEXT PRIMARY KEY,\n      thread_id TEXT NOT NULL,\n      turn_id TEXT,\n      role TEXT NOT NULL,\n      text TEXT NOT NULL,\n      is_streaming INTEGER NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL\n    , attachments_json TEXT)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_activities (\n      activity_id TEXT PRIMARY KEY,\n      thread_id TEXT NOT NULL,\n      turn_id TEXT,\n      tone TEXT NOT NULL,\n      kind TEXT NOT NULL,\n      summary TEXT NOT NULL,\n      payload_json TEXT NOT NULL,\n      created_at TEXT NOT NULL\n    , sequence INTEGER)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_sessions (\n      thread_id TEXT PRIMARY KEY,\n      status TEXT NOT NULL,\n      provider_name TEXT,\n      provider_session_id TEXT,\n      provider_thread_id TEXT,\n      active_turn_id TEXT,\n      last_error TEXT,\n      updated_at TEXT NOT NULL\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access')",
@@ -116007,7 +116033,8 @@ const postgresUpgradeMigrations = new Map([
           LIMIT 1
         )
         WHERE model_selection_json IS NULL`
-	]]
+	]],
+	[77, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_id TEXT`]]
 ]);
 function requirePostgresUpgradeStatements(version) {
 	const statements = postgresUpgradeMigrations.get(version);
@@ -116033,15 +116060,15 @@ const runPostgresMigrations = require_Schema$1.fn("runPostgresMigrations")(funct
         ORDER BY version DESC
         LIMIT 1
       `)[0]?.version ?? 0;
-		if (currentVersion > 76) return yield* require_Schema$1.die(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 76.`));
+		if (currentVersion > 77) return yield* require_Schema$1.die(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 77.`));
 		if (currentVersion === 0) {
 			for (const statement of postgresSchemaStatements) yield* sql.unsafe(statement);
 			yield* sql`
           INSERT INTO forge_schema_migrations (version)
-          VALUES (${76})
+          VALUES (${77})
           ON CONFLICT (version) DO NOTHING
         `;
-		} else for (let version = currentVersion + 1; version <= 76; version += 1) {
+		} else for (let version = currentVersion + 1; version <= 77; version += 1) {
 			const statements = yield* require_Schema$1.sync(() => requirePostgresUpgradeStatements(version));
 			for (const statement of statements) yield* sql.unsafe(statement);
 			yield* sql`
@@ -118826,6 +118853,18 @@ var _076_ProjectionTurnsModelSelection_default = require_Schema$1.gen(function*
   `;
 });
 //#endregion
+//#region src/persistence/Migrations/077_ProjectionThreadWorkSessionId.ts
+/** Stores the CMMD Work Session id a kicked thread's root turn belongs to (forge#3466). */
+var _077_ProjectionThreadWorkSessionId_default = require_Schema$1.gen(function* () {
+	const sql = yield* require_SqlError.SqlClient;
+	if (!(yield* sql`
+    PRAGMA table_info(projection_threads)
+  `).some((column) => column.name === "work_session_id")) yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN work_session_id TEXT
+    `;
+});
+//#endregion
 //#region src/persistence/Migrations.ts
 /**
 * MigrationsLive - Migration runner with inline loader
@@ -119226,6 +119265,11 @@ const migrationEntries = [
 		76,
 		"ProjectionTurnsModelSelection",
 		_076_ProjectionTurnsModelSelection_default
+	],
+	[
+		77,
+		"ProjectionThreadWorkSessionId",
+		_077_ProjectionThreadWorkSessionId_default
 	]
 ];
 const makeMigrationLoader = (throughId) => fromRecord(Object.fromEntries(migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -152591,10 +152635,10 @@ function getOpenAiProviderEgressProxyConfig(input) {
 		message: `Workspace OpenAI provider egress is configured, but OPENAI_BASE_URL does not point at ${OPENAI_PROVIDER_EGRESS_PATH}. Refusing to start Codex with a stale or raw OPENAI_API_KEY.`
 	};
 }
-function configuredRuntimeMachineId() {
+function configuredRuntimeMachineId$1() {
 	return process.env.FORGE_CMMD_RUNTIME_MACHINE_ID?.trim() || null;
 }
-function configuredRuntimeCredentialEpoch() {
+function configuredRuntimeCredentialEpoch$1() {
 	const raw = process.env.FORGE_CMMD_RUNTIME_CREDENTIAL_EPOCH?.trim();
 	return raw === void 0 ? void 0 : Number(raw);
 }
@@ -152665,15 +152709,15 @@ function resolveBrokerTicketOutcome(input) {
 function providerEgressRequiresOwnerSession() {
 	if (!canIssueCmmdRuntimeProviderEgressToken()) return false;
 	return classifyRuntimeBrokerIdentity({
-		machineId: configuredRuntimeMachineId() ?? void 0,
-		credentialEpoch: configuredRuntimeCredentialEpoch(),
+		machineId: configuredRuntimeMachineId$1() ?? void 0,
+		credentialEpoch: configuredRuntimeCredentialEpoch$1(),
 		brokerAuthorityMode: process.env.FORGE_CMMD_RUNTIME_BROKER_AUTHORITY_MODE
 	}).mode === "exact";
 }
 function runtimeProviderBrokerToken(input) {
 	const identity = classifyRuntimeBrokerIdentity({
-		machineId: configuredRuntimeMachineId() ?? void 0,
-		credentialEpoch: configuredRuntimeCredentialEpoch(),
+		machineId: configuredRuntimeMachineId$1() ?? void 0,
+		credentialEpoch: configuredRuntimeCredentialEpoch$1(),
 		brokerAuthorityMode: process.env.FORGE_CMMD_RUNTIME_BROKER_AUTHORITY_MODE
 	});
 	if (identity.mode !== "exact") return resolveBrokerTicketOutcome({
@@ -152814,8 +152858,8 @@ function runtimeCredentialFromGrant(provider, payload, controlPlaneUrl) {
 	return deliveryBoundRuntimeCredential(provider, payload, controlPlaneUrl);
 }
 function deliveryBoundRuntimeCredential(provider, payload, controlPlaneUrl) {
-	const runtimeMachineId = configuredRuntimeMachineId();
-	const runtimeCredentialEpoch = configuredRuntimeCredentialEpoch();
+	const runtimeMachineId = configuredRuntimeMachineId$1();
+	const runtimeCredentialEpoch = configuredRuntimeCredentialEpoch$1();
 	if (!runtimeMachineId || runtimeCredentialEpoch === void 0) throw new Error("Provider proxy token response was missing exact runtime authority.");
 	const deliveryReceipt = parseProviderRuntimeDeliveryReceipt(payload.deliveryReceipt, {
 		provider,
@@ -211957,7 +212001,7 @@ function createCodexCmmdSidekickDynamicToolHandler(session) {
 //#region src/cmmdData/cmmdDelegatedToolCatalog.ts
 const CATALOG_PATH = "/api/forge/context/sidekick/tools/catalog";
 const EXECUTE_PATH = "/api/forge/context/sidekick/tools/execute";
-const AUTH_REQUIRED = {
+const AUTH_REQUIRED$1 = {
 	ok: false,
 	code: "CMMD_AUTH_REQUIRED"
 };
@@ -211965,11 +212009,32 @@ function upstreamErrorCode(error) {
 	if (error && typeof error === "object" && "code" in error && typeof error.code === "string") return error.code;
 	return "CMMD_REST_ERROR";
 }
-async function listCatalog(resolveJwt, scope) {
+/**
+* The Work Session lane, tried before the owner-JWT lane ever runs
+* (forge#3466 review, should-fix 3). A headless sprite's Work Session thread
+* never carries an owner JWT (CMMD ADR-015), so trying that lane first only
+* spends a lookup before falling through to the same broker call every time
+* — and on a sprite in runtime mode, the owner's browser and CMMD's kick
+* authenticate into the same synthetic session, so a resolved JWT there is
+* never legitimately this Work Session's own. Reading fresh on every call,
+* not once at construction, is what makes blocker 1's fix work: session
+* start, the ~30-second renewal, and a post-`capability_invalid` re-mint all
+* land here, so a Retry that rebinds the thread mid-session is picked up on
+* its very next mint instead of being stuck asking for the session that just
+* failed. Returns null (not a failure) for a person-started thread, which
+* supplies no `readWorkSessionId` and keeps today's owner lane byte for byte.
+*/
+async function resolveViaWorkSession(workSessionCapability, scope) {
+	const workSessionId = workSessionCapability.readWorkSessionId ? await workSessionCapability.readWorkSessionId() : null;
+	if (workSessionId === null) return null;
+	return workSessionCapability.requestCapability ? workSessionCapability.requestCapability(workSessionId, scope.threadId) : AUTH_REQUIRED$1;
+}
+async function listCatalog(resolveJwt, workSessionCapability, scope) {
+	const viaWorkSession = await resolveViaWorkSession(workSessionCapability, scope);
+	if (viaWorkSession !== null) return viaWorkSession;
 	const sessionId = readThreadSessionId(scope.threadId);
-	if (!sessionId) return AUTH_REQUIRED;
-	const jwt = await resolveJwt(sessionId);
-	if (!jwt) return AUTH_REQUIRED;
+	const jwt = sessionId ? await resolveJwt(sessionId) : null;
+	if (!jwt) return AUTH_REQUIRED$1;
 	const body = { forgeThreadId: scope.threadId };
 	if (scope.projectId !== void 0) body["projectId"] = scope.projectId;
 	if (scope.forgeAgentId !== void 0) body["forgeAgentId"] = scope.forgeAgentId;
@@ -212019,9 +212084,9 @@ async function execute(request) {
 		};
 	}
 }
-function createCmmdDelegatedToolCatalogClient(resolveJwt) {
+function createCmmdDelegatedToolCatalogClient(resolveJwt, workSessionCapability = {}) {
 	return {
-		listCatalog: (scope) => listCatalog(resolveJwt, scope),
+		listCatalog: (scope) => listCatalog(resolveJwt, workSessionCapability, scope),
 		execute
 	};
 }
@@ -212076,9 +212141,144 @@ function createCmmdSidekickToolSession(client, scope) {
 	};
 }
 //#endregion
+//#region src/cmmdData/cmmdWorkSessionCapabilityBroker.ts
+/**
+* CMMD's Work Session Sidekick-capability broker client (forge#3466,
+* CMMD#5026).
+*
+* A headless sprite runs a Work Session's root thread with no owner JWT or
+* PAT: nobody signed in. `cmmdDelegatedToolCatalog.ts`'s owner-JWT lane falls
+* through to this one instead, presenting the runtime's OWN grant (never a
+* JWT, per CMMD ADR-015) plus the Work Session id CMMD stamped on the thread,
+* and getting back the same delegated Sidekick capability shape the owner
+* lane mints.
+*/
+const SIDEKICK_CAPABILITY_TIMEOUT_MS = 1e4;
+const AUTH_REQUIRED = {
+	ok: false,
+	code: "CMMD_AUTH_REQUIRED"
+};
+function configuredRuntimeMachineId() {
+	return process.env.FORGE_CMMD_RUNTIME_MACHINE_ID?.trim() || void 0;
+}
+function configuredRuntimeCredentialEpoch() {
+	const raw = process.env.FORGE_CMMD_RUNTIME_CREDENTIAL_EPOCH?.trim();
+	return raw === void 0 ? void 0 : Number(raw);
+}
+/**
+* The runtime's own bearer for the "sidekick" broker scope.
+*
+* Follows the same exact-machine / legacy split as
+* `GitHubBroker.resolveRuntimeGrant`, including its `runtimeRole !== "user-vm"`
+* gate (forge#3466 review, should-fix 4, via the resolver both share:
+* `isCmmdCloudRuntimeModeEnv`): an exact-machine runtime presents whatever
+* ticket CMMD already delivered into the broker-authority cache for this
+* scope (an inbound request installs it as a side effect of authenticating;
+* CMMD's runtime ticket carries `sidekick` alongside `provider`/`github`/etc,
+* so it lands there the same way). A legacy runtime presents its one
+* portable grant token. A runtime with no id, an identity that is neither
+* exact nor legacy, or a role that isn't a managed CMMD cloud runtime at
+* all, has nothing to present — a local Forge with a stray
+* `FORGE_CMMD_RUNTIME_ID` left over from a legacy config must never present
+* its portable grant token as though it were a sprite.
+*/
+function resolveWorkSessionSidekickRuntimeGrant() {
+	if (!isCmmdCloudRuntimeModeEnv()) return null;
+	const runtimeId = process.env.FORGE_CMMD_RUNTIME_ID?.trim();
+	if (!runtimeId) return null;
+	const identity = classifyRuntimeBrokerIdentity({
+		machineId: configuredRuntimeMachineId(),
+		credentialEpoch: configuredRuntimeCredentialEpoch(),
+		brokerAuthorityMode: process.env.FORGE_CMMD_RUNTIME_BROKER_AUTHORITY_MODE
+	});
+	if (identity.mode === "exact") {
+		const authority = readRuntimeBrokerAuthorityForRuntime({
+			runtimeId,
+			machineId: identity.machineId,
+			credentialEpoch: identity.credentialEpoch,
+			requiredScope: "sidekick"
+		});
+		return authority ? {
+			runtimeId,
+			token: authority.token
+		} : null;
+	}
+	if (identity.mode === "invalid") return null;
+	const legacyToken = require_runtimeControlAuthority.runtimeGrantToken();
+	return legacyToken ? {
+		runtimeId,
+		token: legacyToken
+	} : null;
+}
+function isRawSidekickCapabilityResponse(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	return Array.isArray(record.tools) && typeof record.catalogVersion === "string" && typeof record.capabilitySessionId === "number" && typeof record.capabilityToken === "string" && typeof record.expiresAt === "string";
+}
+/**
+* Mints a Work Session Sidekick capability straight from CMMD, for a thread
+* whose owner JWT never resolved.
+*
+* The mint route answers a bare JSON body, never CMMD's forge-context
+* `{ data: ... }` envelope the owner-JWT catalog route uses, so this never
+* unwraps `.data`. Always resolves, never throws: a missing runtime grant, a
+* network failure, and a refusal from CMMD (the broker feature flag is off,
+* the Work Session ended, this runtime is not its starter, ...) all fold to
+* the same `CMMD_AUTH_REQUIRED` the owner-JWT lane already returns on any
+* auth failure, so callers need exactly one failure branch. The refusal's
+* own code is logged, not returned, so an operator can still tell the cases
+* apart.
+*/
+async function requestWorkSessionSidekickCapability(workSessionId, threadId, deps = {}) {
+	const grant = (deps.resolveRuntimeGrant ?? resolveWorkSessionSidekickRuntimeGrant)();
+	if (!grant) {
+		console.warn(`[cmmd-work-session-capability] no runtime grant for the sidekick scope (thread ${threadId}, work session ${workSessionId})`);
+		return AUTH_REQUIRED;
+	}
+	const fetchImpl = deps.fetch ?? fetch;
+	const url = resolveCommandAppEndpoint(`/api/forge/runtimes/${encodeURIComponent(grant.runtimeId)}/sidekick-capability`);
+	let response;
+	try {
+		response = await fetchImpl(url, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${grant.token}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({ workSessionId }),
+			signal: AbortSignal.timeout(SIDEKICK_CAPABILITY_TIMEOUT_MS)
+		});
+	} catch (error) {
+		console.warn("[cmmd-work-session-capability] broker request failed:", error instanceof Error ? error.message : String(error));
+		return AUTH_REQUIRED;
+	}
+	if (!response.ok) {
+		const body = await response.json().catch(() => null);
+		const code = body && typeof body === "object" && typeof body.code === "string" ? body.code : `HTTP_${response.status}`;
+		console.warn(`[cmmd-work-session-capability] broker refused the mint (${code})`);
+		return AUTH_REQUIRED;
+	}
+	const data = await response.json().catch(() => null);
+	if (!isRawSidekickCapabilityResponse(data)) {
+		console.warn("[cmmd-work-session-capability] broker returned an unexpected mint response");
+		return AUTH_REQUIRED;
+	}
+	return {
+		ok: true,
+		tools: data.tools,
+		catalogVersion: data.catalogVersion,
+		capabilitySessionId: data.capabilitySessionId,
+		capabilityToken: data.capabilityToken,
+		expiresAt: data.expiresAt
+	};
+}
+//#endregion
 //#region src/cmmdData/resolveCmmdSidekickToolCatalog.ts
-async function resolveCmmdSidekickToolCatalog(resolveJwt, threadId) {
-	const session = createCmmdSidekickToolSession(createCmmdDelegatedToolCatalogClient(resolveJwt), { threadId });
+async function resolveCmmdSidekickToolCatalog(resolveJwt, threadId, options = {}) {
+	const session = createCmmdSidekickToolSession(createCmmdDelegatedToolCatalogClient(resolveJwt, {
+		...options.readWorkSessionId !== void 0 ? { readWorkSessionId: options.readWorkSessionId } : {},
+		requestCapability: options.requestWorkSessionCapability ?? requestWorkSessionSidekickCapability
+	}), { threadId });
 	const catalog = await session.getCatalog();
 	return {
 		session,
@@ -212098,6 +212298,36 @@ async function resolveCmmdSidekickJwt(input) {
 	});
 }
 //#endregion
+//#region src/cmmdData/cmmdWorkSessionThreadLookup.ts
+const WorkSessionIdRow = require_Schema$1.Struct({ workSessionId: require_Schema$1.NullOr(require_Schema$1.String) });
+const decodeWorkSessionIdRows = require_Schema$1.decodeUnknownEffect(require_Schema$1.ArraySchema(WorkSessionIdRow));
+/**
+* Reads the CMMD Work Session id CMMD stamped on a thread's `thread.create`,
+* straight from the projected thread row (forge#3466). Null for a
+* person-started thread, for a thread projected before this field existed,
+* and for a thread id with no projected row at all.
+*
+* A minimal raw-SQL read against `projection_threads`, deliberately not
+* routed through `ProjectionThreadRepository`: the adapters that need this
+* (`ClaudeAdapter.ts`, `CodexAdapter.ts`) already capture only
+* `SqlClient.SqlClient` at session-build time (see `readThreadAuthSession`
+* in `GitHubAgentToolStore.ts` for the established pattern this follows), and
+* widening that capture to a second service for one column is not worth the
+* risk to every other call sharing it.
+*/
+function readThreadWorkSessionId(threadId) {
+	return require_Schema$1.gen(function* () {
+		return (yield* decodeWorkSessionIdRows(yield* (yield* require_SqlError.SqlClient)`
+      SELECT work_session_id AS "workSessionId"
+      FROM projection_threads
+      WHERE thread_id = ${threadId}
+      LIMIT 1
+    `))[0]?.workSessionId ?? null;
+	}).pipe(require_Schema$1.tapError((error) => require_Schema$1.sync(() => {
+		console.warn(`[cmmd-work-session-thread-lookup] failed to read work_session_id for thread ${threadId}:`, error instanceof Error ? error.message : String(error));
+	})), require_Schema$1.orElseSucceed(() => null));
+}
+//#endregion
 //#region ../../packages/shared/src/computerUsePermission.ts
 /**
 * Single source of truth for the computer-use permission default.
@@ -213688,13 +213918,14 @@ const makeCodexAdapter = require_Schema$1.fn("makeCodexAdapter")(function* (opti
 			const jwt = readCommandJwtForSession(binding.sessionId);
 			return jwt ? { jwt } : null;
 		} });
+		const readCmmdWorkSessionId = () => runWithRuntimeContext(readThreadWorkSessionId(input.threadId));
 		const { session: cmmdSidekickToolSession, tools: cmmdSidekickTools } = yield* require_Schema$1.promise(() => resolveCmmdSidekickToolCatalog((sessionId) => resolveCmmdSidekickJwt({
 			threadId: input.threadId,
 			sessionId,
 			logPrefix: "codex-cmmd-sidekick",
 			readThreadAuth: (threadId) => runWithRuntimeContext(readThreadAuthSession(threadId)),
 			resolveJwt: (options) => runWithRuntimeContext(resolveCmmdJwtForSession(options))
-		}), input.threadId));
+		}), input.threadId, { readWorkSessionId: readCmmdWorkSessionId }));
 		const cmmdSidekickToolNames = new Set(cmmdSidekickTools.map((tool) => tool.name));
 		const devServerToolDeps = {
 			threadDevRuntime,
@@ -215809,6 +216040,21 @@ const SIGNIN_REQUIRED = {
 	action: "notify_human",
 	message: "Not signed in to CMMD for this session. Continue from repository evidence and tell the user to sign in to CMMD to enable project context."
 };
+/**
+* Same failure as {@link SIGNIN_REQUIRED} (no CMMD sign-in exists for this
+* session), but for a headless Work Session runtime that was never going to
+* have one: nobody is present to sign in (CMMD ADR-015). Telling the agent
+* to ask a human to sign in is wrong there. When CMMD's Sidekick capability
+* broker minted delegated tools for this Work Session (forge#3466,
+* CMMD#5026), point at them instead of dead-ending.
+*/
+const WORK_SESSION_CONTEXT_VIA_DELEGATED_TOOLS = {
+	ok: false,
+	code: "signin_required",
+	retryable: false,
+	action: "skip",
+	message: "No CMMD sign-in for this session, but this Work Session has delegated Sidekick tools. Call cmmd_get_agent_plan (or get_task) from cmmd-sidekick-tools for the task packet and current context, then continue from there."
+};
 /** Map a thrown CMMD client error to a recoverable envelope. */
 function errorEnvelope(err) {
 	if (isCmmdMcpAuthError$2(err)) return {
@@ -215871,12 +216117,13 @@ function projectIdToToolArg(projectId) {
 * mutation arg. The `action` arg of CMMD's multiplexed tools is hardcoded to a
 * read inside contextBuilder and never surfaced to the LLM.
 */
-function makeCmmdContextHandlers(resolvePat) {
+function makeCmmdContextHandlers(resolvePat, options = {}) {
+	const noPatEnvelope = options.hasWorkSessionPacketTool ? WORK_SESSION_CONTEXT_VIA_DELEGATED_TOOLS : SIGNIN_REQUIRED;
 	return {
 		getCurrentContext: async () => {
 			try {
 				const pat = await resolvePat();
-				if (!pat) return envelope(SIGNIN_REQUIRED);
+				if (!pat) return envelope(noPatEnvelope);
 				const snapshot = await buildCurrentContextSnapshot(pat, {
 					maxCampaigns: 3,
 					maxProjects: 5,
@@ -215909,7 +216156,7 @@ function makeCmmdContextHandlers(resolvePat) {
 					message: "Provide a non-empty `query` to search the CMMD knowledge base."
 				});
 				const pat = await resolvePat();
-				if (!pat) return envelope(SIGNIN_REQUIRED);
+				if (!pat) return envelope(noPatEnvelope);
 				const effectiveLimit = clampLimit(limit, DEFAULT_BRAIN_LIMIT, MAX_BRAIN_LIMIT);
 				const result = await callCmmdTool$2(pat, "search_brain_documents", {
 					query: trimmedQuery,
@@ -215963,7 +216210,7 @@ function makeCmmdContextHandlers(resolvePat) {
 					message: "Provide a `projectId` (from cmmd_get_current_context data.projects[].id)."
 				});
 				const pat = await resolvePat();
-				if (!pat) return envelope(SIGNIN_REQUIRED);
+				if (!pat) return envelope(noPatEnvelope);
 				const result = await callCmmdTool$2(pat, "list_board_tasks", { project_id: projectIdToToolArg(trimmedId) });
 				if (result.isError) return envelope(isErrorEnvelope(result));
 				const text = extractMcpToolText$2(result);
@@ -215992,8 +216239,8 @@ function makeCmmdContextHandlers(resolvePat) {
 *                    when the user is not authenticated with CMMD. Called per
 *                    tool invocation so a mid-session token refresh is picked up.
 */
-function createCmmdContextMcpServer(threadId, resolvePat) {
-	const handlers = makeCmmdContextHandlers(resolvePat);
+function createCmmdContextMcpServer(threadId, resolvePat, options = {}) {
+	const handlers = makeCmmdContextHandlers(resolvePat, options);
 	return z1e({
 		name: "cmmd-context",
 		tools: [
@@ -216516,7 +216763,7 @@ function buildClaudeMcpServers(input) {
 	return {
 		"forge-browser": createBrowserMcpServer(input.browserManager, input.threadId, browserToolScope(input.browserToolEnvironmentId)),
 		"forge-dev-server": createDevServerMcpServer(input.devServerToolDeps, input.threadId),
-		"cmmd-context": createCmmdContextMcpServer(input.threadId, input.resolveCmmdPat),
+		"cmmd-context": createCmmdContextMcpServer(input.threadId, input.resolveCmmdPat, { hasWorkSessionPacketTool: input.hasWorkSessionPacketTool }),
 		[GITHUB_MCP_SERVER_NAME]: createGitHubMcpServer(input.runBrokeredGitHubTool, input.threadId, input.serverSettings),
 		...input.computerManager ? { [COMPUTER_MCP_SERVER_NAME]: createComputerMcpServer(input.computerManager, input.threadId) } : {},
 		...input.cmmdSidekickTools ? { "cmmd-sidekick-tools": createCmmdSidekickToolsMcpServer(input.cmmdSidekickTools.session, input.cmmdSidekickTools.tools) } : {},
@@ -216560,19 +216807,47 @@ function claudePermissionQueryOptions(permissionMode) {
 function createClaudePromptStream(promptQueue) {
 	return require_Path.fromQueue(promptQueue).pipe(require_Path.filter((item) => item.type === "message"), require_Path.map((item) => item.message), require_Path.catchCause((cause) => require_Schema$1.hasInterruptsOnly(cause) ? require_Path.empty : require_Path.failCause(cause)), require_Path.toAsyncIterable);
 }
-function createCmmdPatResolver(threadId) {
+function createCmmdPatResolver(threadId, readWorkSessionId) {
 	return async () => {
+		if (await readWorkSessionId() !== null) return null;
 		const ownerSessionId = readThreadSessionId(threadId);
 		if (!ownerSessionId) return null;
 		return readCommandAccessTokenForSession(ownerSessionId);
 	};
 }
-function resolveCmmdSidekickTools(resolveJwt, threadId) {
-	return require_Schema$1.promise(() => resolveCmmdSidekickToolCatalog(resolveJwt, threadId)).pipe(require_Schema$1.map((resolved) => ({
+function resolveCmmdSidekickTools(resolveJwt, threadId, readWorkSessionId) {
+	return require_Schema$1.promise(() => resolveCmmdSidekickToolCatalog(resolveJwt, threadId, { readWorkSessionId })).pipe(require_Schema$1.map((resolved) => ({
 		registration: resolved.tools.length > 0 ? resolved : null,
 		codewebMcpGrant: resolved.codewebMcp
 	})));
 }
+/**
+* Name of the delegated tool that returns a Work Session's task packet
+* (CMMD's Agent Plan family, ADR-029). Forge's Sidekick capability broker
+* always mounts this for a Work Session (CMMD's `forge-surface.ts` curated
+* allowlist, verified 2026-09-26), so its presence in the granted catalog is
+* exactly "a Work Session capability exists for this thread". See
+* `cmmdContextMcpServer.ts`'s no-PAT branch (forge#3466).
+*/
+const WORK_SESSION_PACKET_TOOL_NAME = "cmmd_get_agent_plan";
+/**
+* Whether `cmmd-context`'s no-PAT branch should point at delegated tools
+* instead of asking the user to sign in (forge#3466 review, should-fix 5).
+*
+* Gating on `workSessionId !== null` alone, without a separate "which lane
+* minted this" tag, is sound because `cmmdDelegatedToolCatalog.ts`'s
+* `listCatalog` (should-fix 3) structurally never calls the owner-JWT lane
+* once a Work Session id is present — it returns straight from the broker
+* call or `AUTH_REQUIRED`. So a non-null `workSessionId` here can only ever
+* pair with a broker-minted registration. Before that reorder, the owner-JWT
+* catalog (the full, unnarrowed Sidekick catalog) also contains
+* `cmmd_get_agent_plan`, so checking the tool name alone told a
+* person-started thread with a resolved JWT but no PAT that it had Work
+* Session tools when it never did.
+*/
+function hasWorkSessionPacketTool(workSessionId, registration) {
+	return workSessionId !== null && (registration?.tools.some((tool) => tool.name === WORK_SESSION_PACKET_TOOL_NAME) ?? false);
+}
 function buildDevServerToolDeps(input) {
 	return {
 		threadDevRuntime: input.threadDevRuntime,
@@ -218749,7 +219024,8 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 		const runPromise = require_Schema$1.runPromiseWith(runtimeContext);
 		const browserToolEnvironmentId = yield* resolveBrowserToolEnvironmentId();
 		const computerManager = resolveComputerManager(serverConfig);
-		const resolveCmmdPat = createCmmdPatResolver(threadId);
+		const readWorkSessionId = () => runWithSqlRuntimeContext(readThreadWorkSessionId(threadId));
+		const resolveCmmdPat = createCmmdPatResolver(threadId, readWorkSessionId);
 		const resolveCmmdSidekickJwtForSession = (sessionId) => resolveCmmdSidekickJwt({
 			threadId,
 			sessionId,
@@ -218757,7 +219033,8 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 			readThreadAuth: (targetThreadId) => runWithSqlRuntimeContext(readThreadAuthSession(targetThreadId)),
 			resolveJwt: (options) => runWithSqlRuntimeContext(resolveCmmdJwtForSession(options))
 		});
-		const cmmdSidekickResolution = yield* resolveCmmdSidekickTools(resolveCmmdSidekickJwtForSession, threadId);
+		const workSessionId = yield* require_Schema$1.promise(readWorkSessionId);
+		const cmmdSidekickResolution = yield* resolveCmmdSidekickTools(resolveCmmdSidekickJwtForSession, threadId, readWorkSessionId);
 		const devServerToolDeps = buildDevServerToolDeps({
 			threadDevRuntime,
 			devTunnel,
@@ -218842,6 +219119,7 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 			resolveCmmdPat,
 			devServerToolDeps,
 			cmmdSidekickTools: cmmdSidekickResolution.registration,
+			hasWorkSessionPacketTool: hasWorkSessionPacketTool(workSessionId, cmmdSidekickResolution.registration),
 			codewebMcpInjection,
 			runBrokeredGitHubTool,
 			serverSettings
@@ -288305,6 +288583,7 @@ const ProjectionThread = require_Schema$1.Struct({
 	parentThreadId: require_Schema$1.NullOr(ThreadId).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	anchorKind: CmmdAnchorKind.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed("scratch"))),
 	anchorCmmdId: require_Schema$1.NullOr(require_Schema$1.String).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
+	workSessionId: require_Schema$1.optionalKey(require_Schema$1.NullOr(require_Schema$1.String)),
 	linkedPullRequest: require_Schema$1.optionalKey(require_Schema$1.NullOr(LinkedPullRequest)),
 	status: ThreadStatus.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed("idle"))),
 	workerRole: require_Schema$1.NullOr(WorkerRole).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
@@ -299479,7 +299758,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "9608e243c924d4030658e7cc80c7be65887b2073";
+	return "00cc2d653acc035bf8de4ed64006a9af5c4d6362";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -303129,6 +303408,7 @@ const decideOrchestrationCommand = require_Schema$1.fn("decideOrchestrationComma
 					updatedAt: command.createdAt,
 					anchorKind: anchor.anchorKind,
 					anchorCmmdId: anchor.anchorCmmdId,
+					workSessionId: command.workSessionId ?? null,
 					goal: command.goal ?? null,
 					linkedPullRequest: command.linkedPullRequest ?? null,
 					kind,
@@ -303438,7 +303718,8 @@ const decideOrchestrationCommand = require_Schema$1.fn("decideOrchestrationComma
 			const providerSwitchSelection = command.modelSelection !== void 0 && command.modelSelection.provider !== targetThread.modelSelection.provider ? command.modelSelection : void 0;
 			const accountSelection = turnAccountSelection(targetThread.modelSelection, command.modelSelection);
 			const turnModelSelection = providerSwitchSelection ?? accountSelection;
-			if (!shouldUpdateAnchor && !turnModelSelection) return [userMessageEvent, turnStartRequestedEvent];
+			const shouldRebindWorkSession = command.workSessionId !== void 0 && command.workSessionId !== null && command.workSessionId !== targetThread.workSessionId;
+			if (!shouldUpdateAnchor && !turnModelSelection && !shouldRebindWorkSession) return [userMessageEvent, turnStartRequestedEvent];
 			return [
 				{
 					...withEventBase({
@@ -303453,6 +303734,7 @@ const decideOrchestrationCommand = require_Schema$1.fn("decideOrchestrationComma
 						anchorKind: nextAnchor.anchorKind,
 						anchorCmmdId: nextAnchor.anchorCmmdId,
 						...turnModelSelection ? { modelSelection: turnModelSelection } : {},
+						...shouldRebindWorkSession ? { workSessionId: command.workSessionId } : {},
 						updatedAt: command.createdAt
 					}
 				},
@@ -303976,12 +304258,22 @@ function retainThreadActivitiesAfterRevert(activities, retainedTurnIds) {
 function retainThreadProposedPlansAfterRevert(proposedPlans, retainedTurnIds) {
 	return proposedPlans.filter((proposedPlan) => proposedPlan.turnId === null || retainedTurnIds.has(proposedPlan.turnId));
 }
+/**
+* Orders an unsequenced activity before a sequenced one, matching the SQL
+* projection's own `ORDER BY CASE WHEN sequence IS NULL THEN 0 ELSE 1 END
+* ASC, sequence ASC`. Zero means neither operand settles the order (both
+* missing, or both present and equal), so the caller falls back to a
+* timestamp/id tiebreak.
+*/
+function compareOptionalActivitySequence(left, right) {
+	const leftHasSequence = left !== void 0;
+	const rightHasSequence = right !== void 0;
+	if (leftHasSequence !== rightHasSequence) return leftHasSequence ? 1 : -1;
+	return leftHasSequence && rightHasSequence ? left - right : 0;
+}
 function compareThreadActivities(left, right) {
-	if (left.sequence !== void 0 && right.sequence !== void 0) {
-		if (left.sequence !== right.sequence) return left.sequence - right.sequence;
-	} else if (left.sequence !== void 0) return 1;
-	else if (right.sequence !== void 0) return -1;
-	return left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id);
+	const bySequence = compareOptionalActivitySequence(left.sequence, right.sequence);
+	return bySequence !== 0 ? bySequence : left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id);
 }
 function createEmptyReadModel(nowIso) {
 	return {
@@ -304012,6 +304304,7 @@ function projectEvent(model, event) {
 				worktreePath: payload.worktreePath,
 				anchorKind: payload.anchorKind,
 				anchorCmmdId: payload.anchorCmmdId,
+				workSessionId: payload.workSessionId ?? null,
 				goal: payload.goal ?? null,
 				linkedPullRequest: payload.linkedPullRequest ?? null,
 				titleRegeneration: null,
@@ -304092,6 +304385,7 @@ function projectEvent(model, event) {
 				...payload.goal !== void 0 ? { goal: payload.goal } : {},
 				...payload.linkedPullRequest !== void 0 ? { linkedPullRequest: payload.linkedPullRequest } : {},
 				...payload.titleRegeneration !== void 0 ? { titleRegeneration: payload.titleRegeneration } : {},
+				...payload.workSessionId !== void 0 ? { workSessionId: payload.workSessionId } : {},
 				updatedAt: payload.updatedAt
 			})
 		})));
@@ -305156,6 +305450,7 @@ const makeProjectionThreadRepository = require_Schema$1.gen(function* () {
           parent_thread_id,
           anchor_kind,
           anchor_cmmd_id,
+          work_session_id,
           linked_pull_request_json,
           status,
           worker_role,
@@ -305188,6 +305483,7 @@ const makeProjectionThreadRepository = require_Schema$1.gen(function* () {
           ${row.parentThreadId},
           ${row.anchorKind},
           ${row.anchorCmmdId},
+          ${row.workSessionId ?? null},
           ${row.linkedPullRequest == null ? null : JSON.stringify(row.linkedPullRequest)},
           ${row.status},
           ${row.workerRole},
@@ -305220,6 +305516,7 @@ const makeProjectionThreadRepository = require_Schema$1.gen(function* () {
           parent_thread_id = excluded.parent_thread_id,
           anchor_kind = excluded.anchor_kind,
           anchor_cmmd_id = excluded.anchor_cmmd_id,
+          work_session_id = excluded.work_session_id,
           linked_pull_request_json = excluded.linked_pull_request_json,
           status = excluded.status,
           worker_role = excluded.worker_role,
@@ -305257,6 +305554,7 @@ const makeProjectionThreadRepository = require_Schema$1.gen(function* () {
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -305296,6 +305594,7 @@ const makeProjectionThreadRepository = require_Schema$1.gen(function* () {
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -305478,6 +305777,14 @@ function collectThreadUserInputAttachmentRelativePaths(threadId, events) {
 	}
 	return relativePaths;
 }
+/**
+* Coalesces an optional Work Session id to the persisted default. Top-level
+* so the `??` here does not count against `applyThreadsProjection`'s own
+* complexity budget. See forge#3466.
+*/
+function projectedWorkSessionId(workSessionId) {
+	return workSessionId ?? null;
+}
 const runAttachmentSideEffects = require_Schema$1.fn("runAttachmentSideEffects")(function* (sideEffects) {
 	const serverConfig = yield* require_Schema$1.service(ServerConfig);
 	const fileSystem = yield* require_Schema$1.service(require_Path.FileSystem);
@@ -305643,6 +305950,7 @@ const makeOrchestrationProjectionPipeline = require_Schema$1.fn("makeOrchestrati
 					parentThreadId: event.payload.parentThreadId,
 					anchorKind: event.payload.anchorKind,
 					anchorCmmdId: event.payload.anchorCmmdId,
+					workSessionId: projectedWorkSessionId(event.payload.workSessionId),
 					linkedPullRequest: event.payload.linkedPullRequest ?? null,
 					status: event.payload.status,
 					workerRole: event.payload.workerRole,
@@ -305681,6 +305989,7 @@ const makeOrchestrationProjectionPipeline = require_Schema$1.fn("makeOrchestrati
 					parentThreadId: thread.parentThreadId,
 					anchorKind: thread.anchorKind,
 					anchorCmmdId: thread.anchorCmmdId,
+					workSessionId: projectedWorkSessionId(thread.workSessionId),
 					linkedPullRequest: thread.linkedPullRequest ?? null,
 					status: thread.status,
 					workerRole: thread.workerRole,
@@ -305749,6 +306058,7 @@ const makeOrchestrationProjectionPipeline = require_Schema$1.fn("makeOrchestrati
 					...event.payload.goal !== void 0 ? { goal: event.payload.goal } : {},
 					...event.payload.linkedPullRequest !== void 0 ? { linkedPullRequest: event.payload.linkedPullRequest } : {},
 					...event.payload.titleRegeneration !== void 0 ? { titleRegeneration: event.payload.titleRegeneration } : {},
+					...event.payload.workSessionId !== void 0 ? { workSessionId: projectedWorkSessionId(event.payload.workSessionId) } : {},
 					updatedAt: event.payload.updatedAt
 				});
 				return;
@@ -306749,6 +307059,16 @@ function probeProjectAvailability(fs, workspaceRoot) {
 function toPersistenceSqlOrDecodeError(sqlOperation, decodeOperation) {
 	return (cause) => require_Schema$1.isSchemaError(cause) ? toPersistenceDecodeError(decodeOperation)(cause) : toPersistenceSqlError(sqlOperation)(cause);
 }
+/**
+* `{ workSessionId }` when the row carries one, an empty object when absent,
+* so the built thread's optionalKey field round-trips without ever getting
+* assigned an explicit `undefined` (exactOptionalPropertyTypes). Pulled out
+* of the two thread builders that call it so this file's already-flagged
+* high-complexity functions do not pick up the branch. See forge#3466.
+*/
+function workSessionIdField(workSessionId) {
+	return workSessionId !== void 0 ? { workSessionId } : {};
+}
 const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
 	const sql = yield* require_SqlError.SqlClient;
 	const repositoryIdentityResolver = yield* RepositoryIdentityResolver;
@@ -306801,6 +307121,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -306839,6 +307160,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -306943,6 +307265,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -307275,6 +307598,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
           parent_thread_id AS "parentThreadId",
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
+          work_session_id AS "workSessionId",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -307587,6 +307911,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
 			session: sessionsByThread.get(row.threadId) ?? null,
 			anchorKind: row.anchorKind,
 			anchorCmmdId: row.anchorCmmdId,
+			...workSessionIdField(row.workSessionId),
 			linkedPullRequest: row.linkedPullRequest,
 			kind: row.kind,
 			parentThreadId: row.parentThreadId,
@@ -307836,6 +308161,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
 			session: require_Schema$1.isSome(sessionRow) ? mapSessionRow(sessionRow.value) : null,
 			anchorKind: threadRow.value.anchorKind,
 			anchorCmmdId: threadRow.value.anchorCmmdId,
+			...workSessionIdField(threadRow.value.workSessionId),
 			linkedPullRequest: threadRow.value.linkedPullRequest,
 			kind: threadRow.value.kind,
 			parentThreadId: threadRow.value.parentThreadId,
@@ -322947,6 +323273,11 @@ try {
   }
 }
 `;
+const toReading = (result) => ({
+	result,
+	probedAt: (/* @__PURE__ */ new Date()).toISOString()
+});
+const MAX_LINGERING_PROBES = 2;
 function createRuntimeFilesystemHealthRoute(input) {
 	return require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 		let child = null;
@@ -322954,15 +323285,19 @@ function createRuntimeFilesystemHealthRoute(input) {
 		let cached = null;
 		let closed = false;
 		let shutdown = null;
+		const lingering = /* @__PURE__ */ new Set();
 		yield* require_Schema$1.addFinalizer(() => require_Schema$1.sync(() => {
 			closed = true;
 			shutdown?.();
 		}));
 		const probe = () => {
-			if (closed) return Promise.resolve("unavailable");
+			if (closed) return Promise.resolve(toReading("unavailable"));
 			if (pending) return pending;
-			if (cached && performance.now() < cached.expiresAt) return Promise.resolve(cached.result);
-			if (child) return Promise.resolve("timeout");
+			if (cached && performance.now() < cached.expiresAt) return Promise.resolve(cached.reading);
+			if (lingering.size >= MAX_LINGERING_PROBES) return Promise.resolve({
+				...toReading("timeout"),
+				lingeringProbes: lingering.size
+			});
 			pending = new Promise((resolve) => {
 				const current = (0, node_child_process.spawn)(process.execPath, [
 					"--eval",
@@ -322976,46 +323311,58 @@ function createRuntimeFilesystemHealthRoute(input) {
 				current.unref();
 				const timer = setTimeout(() => {
 					current.kill("SIGKILL");
-					resolve("timeout");
+					lingering.add(current);
+					if (child === current) {
+						child = null;
+						shutdown = null;
+					}
+					resolve(toReading("timeout"));
 				}, input.timeoutMs ?? 3e3);
 				shutdown = () => {
 					clearTimeout(timer);
 					current.kill("SIGKILL");
-					resolve("unavailable");
+					resolve(toReading("unavailable"));
 				};
 				current.once("error", () => {
 					clearTimeout(timer);
+					lingering.delete(current);
 					if (!current.pid && child === current) {
 						child = null;
 						shutdown = null;
 					}
-					resolve("unavailable");
+					resolve(toReading("unavailable"));
 				});
 				current.once("exit", (code) => {
 					clearTimeout(timer);
+					lingering.delete(current);
 					if (child === current) {
 						child = null;
 						shutdown = null;
 					}
-					resolve(code === 0 ? "healthy" : "io_error");
+					resolve(toReading(code === 0 ? "healthy" : "io_error"));
 				});
-			}).catch(() => "unavailable").then((result) => {
+			}).catch(() => toReading("unavailable")).then((settled) => {
 				pending = null;
-				cached = {
-					result,
+				if (settled.result === "healthy") cached = {
+					reading: settled,
 					expiresAt: performance.now() + (input.cacheMs ?? 1e4)
 				};
-				return result;
+				return settled;
 			});
 			return pending;
 		};
 		return add$1("GET", "/api/runtime/filesystem-health", require_Schema$1.gen(function* () {
-			const result = yield* require_Schema$1.promise(probe);
-			const healthy = result === "healthy";
+			const outcome = yield* require_Schema$1.promise(probe);
+			const healthy = outcome.result === "healthy";
 			return require_HttpServer.jsonUnsafe({
 				service: "cmmd-forge-runtime",
 				filesystem: healthy ? "healthy" : "unhealthy",
-				...healthy ? {} : { reason: result }
+				probedAt: outcome.probedAt,
+				uptimeSeconds: process.uptime(),
+				...healthy ? {} : {
+					reason: outcome.result,
+					...outcome.lingeringProbes === void 0 ? {} : { lingeringProbes: outcome.lingeringProbes }
+				}
 			}, {
 				status: healthy ? 200 : 503,
 				headers: { "cache-control": "no-store" }