@cmmd-center/forge 0.13.92 → 0.13.93

package/dist/bin.cjs

@@ -27077,12 +27077,12 @@ function encodeCmmdRuntimeThreadWorkspaceMetadata(workspace) {
 }
 //#endregion
 //#region ../../packages/contracts/src/cmmdRuntimeToolActivity.ts
-function isRecord$24(value) {
+function isRecord$25(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function encodeCmmdRuntimeToolActivityPayload(kind, payload) {
 	return {
-		...isRecord$24(payload) ? payload : { sourcePayload: payload },
+		...isRecord$25(payload) ? payload : { sourcePayload: payload },
 		forgeToolActivity: {
 			schemaVersion: 1,
 			source: "native",
@@ -27105,7 +27105,7 @@ const WORKTREE_LAUNCH_ACTIVITY_KINDS = new Set([
 ]);
 function encodeCmmdRuntimeWorktreeLaunchActivityPayload(kind, payload) {
 	return {
-		...isRecord$24(payload) ? payload : { sourcePayload: payload },
+		...isRecord$25(payload) ? payload : { sourcePayload: payload },
 		forgeWorktreeLaunchActivity: {
 			schemaVersion: 1,
 			source: "native",
@@ -27125,7 +27125,7 @@ function isCmmdRuntimeWorktreeLaunchActivityKind(kind) {
 const CMMD_RUNTIME_PLAN_ACTIVITY_KIND = "turn.plan.updated";
 function encodeCmmdRuntimePlanActivityPayload(kind, payload) {
 	return {
-		...isRecord$24(payload) ? payload : { sourcePayload: payload },
+		...isRecord$25(payload) ? payload : { sourcePayload: payload },
 		forgePlanActivity: {
 			schemaVersion: 1,
 			source: "native",
@@ -27134,15 +27134,15 @@ function encodeCmmdRuntimePlanActivityPayload(kind, payload) {
 	};
 }
 function decodeCmmdRuntimePlanActivity(payload) {
-	if (!isRecord$24(payload)) return null;
+	if (!isRecord$25(payload)) return null;
 	const metadata = payload["forgePlanActivity"];
-	if (!isRecord$24(metadata)) return null;
+	if (!isRecord$25(metadata)) return null;
 	if (metadata["schemaVersion"] !== 1 || metadata["source"] !== "native" || metadata["kind"] !== "turn.plan.updated") return null;
 	const rawPlan = payload["plan"];
 	return {
 		kind: CMMD_RUNTIME_PLAN_ACTIVITY_KIND,
 		plan: Array.isArray(rawPlan) ? rawPlan.flatMap((entry) => {
-			if (!isRecord$24(entry)) return [];
+			if (!isRecord$25(entry)) return [];
 			const step = entry["step"];
 			const status = entry["status"];
 			if (typeof step !== "string" || step.trim().length === 0) return [];
@@ -31166,13 +31166,13 @@ async function completePendingDesktopRelayIdentityRotation(input) {
 }
 //#endregion
 //#region ../../packages/relay-host/src/internal/desktopRelayJws.ts
-function isRecord$23(value) {
+function isRecord$24(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function decodeBase64UrlJson$1(value) {
 	try {
 		const decoded = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-		return isRecord$23(decoded) ? decoded : null;
+		return isRecord$24(decoded) ? decoded : null;
 	} catch {
 		return null;
 	}
@@ -31326,11 +31326,11 @@ var DesktopRelayControlPlaneError = class extends Error {
 		this.name = "DesktopRelayControlPlaneError";
 	}
 };
-function isRecord$22(value) {
+function isRecord$23(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseErrorPayload(value) {
-	return isRecord$22(value) ? value : {};
+	return isRecord$23(value) ? value : {};
 }
 function messageFromErrorPayload(payload, fallback) {
 	return typeof payload.error === "string" && payload.error.trim().length > 0 ? payload.error.trim() : fallback;
@@ -31428,7 +31428,7 @@ async function postControlPlane(input) {
 		const errorPayload = parseErrorPayload(payload);
 		throw new DesktopRelayControlPlaneError(typeof errorPayload.code === "string" && errorPayload.code.trim().length > 0 ? errorPayload.code.trim() : `CMMD_HTTP_${response.status}`, messageFromErrorPayload(errorPayload, `CMMD relay request failed (${response.status}).`), response.status === 408 || response.status === 429 || response.status >= 500);
 	}
-	if (!isRecord$22(payload) || !("data" in payload)) throw new DesktopRelayControlPlaneError("CONTROL_PLANE_INVALID_RESPONSE", "CMMD returned an invalid Forge relay response.", false);
+	if (!isRecord$23(payload) || !("data" in payload)) throw new DesktopRelayControlPlaneError("CONTROL_PLANE_INVALID_RESPONSE", "CMMD returned an invalid Forge relay response.", false);
 	return payload.data;
 }
 function resolveRegisteredDevice(input) {
@@ -66311,7 +66311,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.92";
+var version$1 = "0.13.93";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -66927,17 +66927,17 @@ function readCmmdAvatarUrl(raw) {
 }
 //#endregion
 //#region src/cmmdIdentity.ts
-function readTrimmedString$2(value) {
+function readTrimmedString$3(value) {
 	return typeof value === "string" ? value.trim() || null : null;
 }
 function asRecord$14(value) {
 	return value && typeof value === "object" ? value : null;
 }
 function readDirectPlanLabelFromRecord(obj) {
-	return readTrimmedString$2(obj["planLabel"]) ?? readTrimmedString$2(obj["plan_label"]) ?? readTrimmedString$2(obj["planName"]) ?? readTrimmedString$2(obj["plan_name"]) ?? readTrimmedString$2(obj["subscriptionPlan"]) ?? readTrimmedString$2(obj["subscription_plan"]) ?? readTrimmedString$2(obj["billingPlan"]) ?? readTrimmedString$2(obj["billing_plan"]);
+	return readTrimmedString$3(obj["planLabel"]) ?? readTrimmedString$3(obj["plan_label"]) ?? readTrimmedString$3(obj["planName"]) ?? readTrimmedString$3(obj["plan_name"]) ?? readTrimmedString$3(obj["subscriptionPlan"]) ?? readTrimmedString$3(obj["subscription_plan"]) ?? readTrimmedString$3(obj["billingPlan"]) ?? readTrimmedString$3(obj["billing_plan"]);
 }
 function readNestedPlanLabelFromRecord(obj) {
-	return readDirectPlanLabelFromRecord(obj) ?? readTrimmedString$2(obj["displayName"]) ?? readTrimmedString$2(obj["display_name"]) ?? readTrimmedString$2(obj["name"]) ?? readTrimmedString$2(obj["label"]) ?? readTrimmedString$2(obj["tier"]);
+	return readDirectPlanLabelFromRecord(obj) ?? readTrimmedString$3(obj["displayName"]) ?? readTrimmedString$3(obj["display_name"]) ?? readTrimmedString$3(obj["name"]) ?? readTrimmedString$3(obj["label"]) ?? readTrimmedString$3(obj["tier"]);
 }
 function readCmmdPlanLabel(obj) {
 	const direct = readDirectPlanLabelFromRecord(obj);
@@ -70780,11 +70780,23 @@ function createCloudflareTurnIceServerResolver(options) {
 //#region src/http.ts
 const PROJECT_FAVICON_CACHE_CONTROL = "public, max-age=3600";
 const PROJECT_FAVICON_MISS_CACHE_CONTROL = "public, max-age=300";
+/**
+* Origins allowed to embed Forge's SPA (CMMD /forge iframe). Docs keep their
+* own CSP with frame-ancestors 'none'. Do not put a broad * here.
+*/
+const CMMD_FRAME_ANCESTORS = [
+	"https://cmmd.ai",
+	"https://*.cmmd.ai",
+	"http://127.0.0.1:3015",
+	"http://localhost:3015",
+	"http://127.0.0.1:3000",
+	"http://localhost:3000"
+];
 const BROWSER_DOCUMENT_SECURITY_HEADERS = {
 	"permissions-policy": "camera=(), microphone=(), geolocation=()",
 	"referrer-policy": "no-referrer",
 	"x-content-type-options": "nosniff",
-	"x-frame-options": "DENY"
+	"content-security-policy": `frame-ancestors ${CMMD_FRAME_ANCESTORS.join(" ")}`
 };
 const STATIC_IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
 const STATIC_REVALIDATE_CACHE_CONTROL = "no-cache";
@@ -70806,19 +70818,31 @@ function normalizeConfiguredCorsOrigin(value) {
 const CONFIGURED_CORS_ORIGINS = [normalizeConfiguredCorsOrigin(process.env.VITE_DEV_SERVER_URL), normalizeConfiguredCorsOrigin(process.env.FORGE_EXTRA_CORS_ORIGIN)].filter((origin) => origin !== void 0);
 const ALLOWED_CORS_ORIGINS = new Set([
 	"http://localhost:3000",
+	"http://localhost:3015",
 	"http://localhost:5733",
 	"http://localhost:13773",
 	"http://localhost:5173",
 	"http://127.0.0.1:3000",
+	"http://127.0.0.1:3015",
 	"http://127.0.0.1:5733",
 	"http://127.0.0.1:13773",
 	"http://127.0.0.1:5173",
+	"https://cmmd.ai",
 	"https://forge-cloud.cmmd.ai",
 	"forge://app",
 	...CONFIGURED_CORS_ORIGINS
 ]);
+function isCmmdAiCorsOrigin(origin) {
+	try {
+		const url = new URL(origin);
+		if (url.protocol !== "https:") return false;
+		return url.hostname === "cmmd.ai" || url.hostname.endsWith(".cmmd.ai");
+	} catch {
+		return false;
+	}
+}
 function isAllowedCorsOrigin(origin) {
-	return ALLOWED_CORS_ORIGINS.has(origin);
+	return ALLOWED_CORS_ORIGINS.has(origin) || isCmmdAiCorsOrigin(origin);
 }
 const browserApiCorsLayer = middleware(require_HttpServer.cors({
 	allowedOrigins: isAllowedCorsOrigin,
@@ -71922,7 +71946,7 @@ const EMPTY_PARSED_ERROR = {
 function asRecord$13(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
-function readTrimmedString$1(value) {
+function readTrimmedString$2(value) {
 	return (typeof value === "string" ? value.trim() : "") || null;
 }
 function readErrorEnvelope(record) {
@@ -71931,7 +71955,7 @@ function readErrorEnvelope(record) {
 function readUpstreamErrorCode(body) {
 	const record = asRecord$13(body);
 	if (record === null) return null;
-	return readTrimmedString$1(record["code"]) ?? readTrimmedString$1(readErrorEnvelope(record)?.["code"]);
+	return readTrimmedString$2(record["code"]) ?? readTrimmedString$2(readErrorEnvelope(record)?.["code"]);
 }
 function readErrorMessage$2(raw) {
 	const record = asRecord$13(raw);
@@ -73174,12 +73198,12 @@ function resolveDesktopRelayControlPlaneTarget(path, configuredRuntimeId) {
 		code: "RELAY_OPERATION_DENIED"
 	};
 }
-function isRecord$21(value) {
+function isRecord$22(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function relayControlPlaneBodyMatchesRuntime(path, body, configuredRuntimeId) {
 	if (path !== "/api/forge/context/devices/register") return true;
-	if (!isRecord$21(body) || !isRecord$21(body.runtime)) return false;
+	if (!isRecord$22(body) || !isRecord$22(body.runtime)) return false;
 	return body.runtime.runtimeId === configuredRuntimeId;
 }
 /** Matches the client id `connect login` used, so CMMD accepts the refresh. */
@@ -73194,7 +73218,7 @@ function forbiddenResponse() {
 	return errorResponse(403, "RELAY_BRIDGE_FORBIDDEN", "Desktop relay bridge access denied.");
 }
 function relayProxyErrorResponse(error) {
-	if (error instanceof CmmdProxyRequestError && isRecord$21(error.body)) {
+	if (error instanceof CmmdProxyRequestError && isRecord$22(error.body)) {
 		const code = typeof error.body.code === "string" ? error.body.code : error.code;
 		const message = typeof error.body.error === "string" ? error.body.error : error.detail;
 		return errorResponse(error.status >= 500 ? 502 : error.status, code, message ?? "CMMD relay coordination failed.");
@@ -95888,7 +95912,7 @@ const REPLICA_THREAD_STATUSES = [
 ];
 //#endregion
 //#region src/runtimeReplication/replicaDecodeModel.ts
-function isRecord$20(value) {
+function isRecord$21(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNonBlankString(value) {
@@ -95908,7 +95932,7 @@ function nullableInteger(value) {
 	return value === null || typeof value === "number" && Number.isSafeInteger(value);
 }
 function unwrapEnvelope(payload, expectedDomain) {
-	if (!isRecord$20(payload) || !isRecord$20(payload.meta) || !isRecord$20(payload.data)) return null;
+	if (!isRecord$21(payload) || !isRecord$21(payload.meta) || !isRecord$21(payload.data)) return null;
 	const { domain, timestamp, version } = payload.meta;
 	if (!isNonBlankString(domain) || expectedDomain !== void 0 && domain !== expectedDomain || version !== "1.0" || !isIsoDateTime(timestamp)) return null;
 	return payload.data;
@@ -95921,12 +95945,12 @@ function hasValidRuntimeIdentity(value) {
 	].includes(String(value.runtimeKind)) && typeof value.displayName === "string" && typeof value.status === "string";
 }
 function decodeRuntime$1(value) {
-	if (!isRecord$20(value) || !hasValidRuntimeIdentity(value)) return null;
-	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === void 0 || value.metadata === null || isRecord$20(value.metadata))) return null;
+	if (!isRecord$21(value) || !hasValidRuntimeIdentity(value)) return null;
+	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === void 0 || value.metadata === null || isRecord$21(value.metadata))) return null;
 	return value;
 }
 function decodeProject(value) {
-	if (!isRecord$20(value) || !isNonBlankString(value.projectId) || typeof value.title !== "string" || !nullableString(value.githubRepoFullName) || !nullableString(value.branch)) return null;
+	if (!isRecord$21(value) || !isNonBlankString(value.projectId) || typeof value.title !== "string" || !nullableString(value.githubRepoFullName) || !nullableString(value.branch)) return null;
 	return {
 		projectId: value.projectId,
 		title: value.title,
@@ -95935,11 +95959,11 @@ function decodeProject(value) {
 	};
 }
 function decodeThread$1(value) {
-	if (!isRecord$20(value) || !isNonBlankString(value.threadId) || typeof value.title !== "string" || !isReplicaThreadStatus(value.status) || !nullableString(value.model) || !nullableString(value.branch) || !(value.lastActivityAt === null || isIsoDateTime(value.lastActivityAt)) || !(value.metadata === void 0 || value.metadata === null || isRecord$20(value.metadata))) return null;
+	if (!isRecord$21(value) || !isNonBlankString(value.threadId) || typeof value.title !== "string" || !isReplicaThreadStatus(value.status) || !nullableString(value.model) || !nullableString(value.branch) || !(value.lastActivityAt === null || isIsoDateTime(value.lastActivityAt)) || !(value.metadata === void 0 || value.metadata === null || isRecord$21(value.metadata))) return null;
 	return value;
 }
 function decodeSummary(value) {
-	if (!isRecord$20(value) || !nullableString(value.conversationId)) return null;
+	if (!isRecord$21(value) || !nullableString(value.conversationId)) return null;
 	const project = decodeProject(value.project);
 	const thread = decodeThread$1(value.thread);
 	return project === null || thread === null ? null : {
@@ -96050,7 +96074,7 @@ function isNonNegativeInt(value) {
 /** `usage` is null for an Unreported turn, otherwise exactly the five buckets. */
 function isValidTurnUsageTokens(value) {
 	if (value === null) return true;
-	if (!isRecord$20(value)) return false;
+	if (!isRecord$21(value)) return false;
 	return turnUsageTokenKeys.every((key) => isNonNegativeInt(value[key])) && Object.keys(value).every((key) => turnUsageTokenKeys.includes(key));
 }
 /** The row itself: no text, no status, and the turn it belongs to. */
@@ -96059,7 +96083,7 @@ function hasValidTurnUsageEnvelope(value) {
 }
 /** What the row records: who ran it, what it spent, and what it says of itself. */
 function hasValidTurnUsageRecord(payload) {
-	return isRecord$20(payload) && isNonBlankString(payload.provider) && isNonBlankString(payload.model) && "usage" in payload && isValidTurnUsageTokens(payload.usage) && hasValidTurnUsageAttribution(payload);
+	return isRecord$21(payload) && isNonBlankString(payload.provider) && isNonBlankString(payload.model) && "usage" in payload && isValidTurnUsageTokens(payload.usage) && hasValidTurnUsageAttribution(payload);
 }
 /** A turn_usage row: no text, no status, and its record in `payload`. */
 function hasValidTurnUsagePayload(value) {
@@ -96096,7 +96120,7 @@ function hasValidEventPayload(value) {
 	return isNonBlankString(value.text) && value.status === null;
 }
 function decodeEvent$1(value) {
-	if (!isRecord$20(value) || !hasValidEventFields(value) || !hasValidEventPayload(value)) return null;
+	if (!isRecord$21(value) || !hasValidEventFields(value) || !hasValidEventPayload(value)) return null;
 	return value;
 }
 function decodeEvents(data) {
@@ -96117,11 +96141,11 @@ function decodeReplicaThreadDetail(payload) {
 	const thread = decodeThread$1(data.thread);
 	const reachability = decodeReachability(data.reachability);
 	const events = decodeEvents(data);
-	if (runtime === null || project === null || thread === null || reachability === null || events === null || !isRecord$20(data.execution) || typeof data.execution.available !== "boolean" || ![
+	if (runtime === null || project === null || thread === null || reachability === null || events === null || !isRecord$21(data.execution) || typeof data.execution.available !== "boolean" || ![
 		null,
 		"runtime_offline",
 		"runtime_unavailable"
-	].includes(data.execution.reason) || (data.execution.available ? data.execution.reason !== null : data.execution.reason === null) || !isRecord$20(data.replication) || data.replication.protocolVersion !== 2 || !isNonBlankString(data.replication.generationId) || !Number.isSafeInteger(data.replication.acknowledgedSequence) || Number(data.replication.acknowledgedSequence) < 0 || !isNonBlankString(data.replication.headHash)) return null;
+	].includes(data.execution.reason) || (data.execution.available ? data.execution.reason !== null : data.execution.reason === null) || !isRecord$21(data.replication) || data.replication.protocolVersion !== 2 || !isNonBlankString(data.replication.generationId) || !Number.isSafeInteger(data.replication.acknowledgedSequence) || Number(data.replication.acknowledgedSequence) < 0 || !isNonBlankString(data.replication.headHash)) return null;
 	return {
 		conversationId: data.conversationId,
 		runtime,
@@ -97197,7 +97221,7 @@ function resolveRuntimeReplicationRuntimeId(config) {
 }
 //#endregion
 //#region src/usage/providerTokenBuckets.ts
-function isRecord$19(value) {
+function isRecord$20(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function count(record, ...keys) {
@@ -97218,7 +97242,7 @@ function reportedOrNull(tokens) {
 * the app server sends camelCase.
 */
 function codexTokenBuckets(value) {
-	if (!isRecord$19(value)) return null;
+	if (!isRecord$20(value)) return null;
 	const inputTokens = count(value, "input_tokens", "inputTokens");
 	const cachedInputTokens = count(value, "cached_input_tokens", "cachedInputTokens");
 	const cacheCreationTokens = count(value, "cache_write_input_tokens", "cacheWriteInputTokens");
@@ -97237,7 +97261,7 @@ function codexTokenBuckets(value) {
 * tokens into output and does not break them out, so reasoning stays zero.
 */
 function claudeTokenBuckets(value) {
-	if (!isRecord$19(value)) return null;
+	if (!isRecord$20(value)) return null;
 	return reportedOrNull({
 		uncachedInputTokens: count(value, "input_tokens", "inputTokens"),
 		cachedInputTokens: count(value, "cache_read_input_tokens", "cacheReadInputTokens"),
@@ -98408,7 +98432,7 @@ const replicaTurnStatuses = new Set([
 	"cancelled",
 	"interrupted"
 ]);
-function isRecord$18(value) {
+function isRecord$19(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function replicaSourceSequence(value) {
@@ -98421,7 +98445,7 @@ function replicaSourceTurn(sourceTurnId) {
 	return typeof sourceTurnId === "string" && sourceTurnId.length > 0 ? { turnId: sourceTurnId } : {};
 }
 function replicaActivitySource(activity) {
-	if (!activity.kind.startsWith("replica.") || !isRecord$18(activity.payload)) return null;
+	if (!activity.kind.startsWith("replica.") || !isRecord$19(activity.payload)) return null;
 	const sourceSequence = replicaSourceSequence(activity.sequence);
 	const eventId = replicaSourceEventId(activity.payload.sourceEventId);
 	if (sourceSequence === null || eventId === null) return null;
@@ -98434,7 +98458,7 @@ function replicaActivitySource(activity) {
 }
 function replicaSummaryEvent(activity, source) {
 	if (activity.kind !== "replica.activity_summary" && activity.kind !== "replica.error_summary") return null;
-	const sourceText = isRecord$18(activity.payload) ? activity.payload.text : null;
+	const sourceText = isRecord$19(activity.payload) ? activity.payload.text : null;
 	return {
 		sourceSequence: source.sourceSequence,
 		event: {
@@ -98447,7 +98471,7 @@ function replicaSummaryEvent(activity, source) {
 	};
 }
 function replicaTurnEvent(activity, source) {
-	const status = isRecord$18(activity.payload) ? activity.payload.status : null;
+	const status = isRecord$19(activity.payload) ? activity.payload.status : null;
 	if (activity.kind !== "replica.turn_status" || !replicaTurnStatuses.has(status)) return null;
 	return {
 		sourceSequence: source.sourceSequence,
@@ -98461,7 +98485,7 @@ function replicaTurnEvent(activity, source) {
 	};
 }
 function replicaToolCallEvent(activity, source) {
-	if (activity.kind !== "replica.tool_call" || !isRecord$18(activity.payload)) return null;
+	if (activity.kind !== "replica.tool_call" || !isRecord$19(activity.payload)) return null;
 	const sourceText = activity.payload.text;
 	const status = activity.payload.status;
 	if (typeof sourceText !== "string" || typeof status !== "string") return null;
@@ -98479,9 +98503,9 @@ function replicaToolCallEvent(activity, source) {
 	};
 }
 function replicaTurnUsageEvent(activity, source) {
-	if (activity.kind !== "replica.turn_usage" || !isRecord$18(activity.payload)) return null;
+	if (activity.kind !== "replica.turn_usage" || !isRecord$19(activity.payload)) return null;
 	const usage = activity.payload.payload;
-	if (!("turnId" in source.turn) || !isRecord$18(usage)) return null;
+	if (!("turnId" in source.turn) || !isRecord$19(usage)) return null;
 	const provider = usage.provider;
 	const model = usage.model;
 	if (typeof provider !== "string" || typeof model !== "string" || !("usage" in usage)) return null;
@@ -99405,9 +99429,9 @@ function isUsageSessionLookupRuntimeNotFound(error) {
 async function isRuntimeNotFoundResponse(response) {
 	if (response.status !== 404) return false;
 	const body = await response.json().catch(() => null);
-	return isRecord$17(body) && body["code"] === "RUNTIME_NOT_FOUND";
+	return isRecord$18(body) && body["code"] === "RUNTIME_NOT_FOUND";
 }
-function isRecord$17(value) {
+function isRecord$18(value) {
 	return typeof value === "object" && value !== null;
 }
 /**
@@ -99419,11 +99443,11 @@ function isRecord$17(value) {
 * no count on the page saying so.
 */
 function decodeHeldSessions(body) {
-	const held = isRecord$17(body) && isRecord$17(body["data"]) ? body["data"]["held"] : void 0;
+	const held = isRecord$18(body) && isRecord$18(body["data"]) ? body["data"]["held"] : void 0;
 	if (!Array.isArray(held)) throw new Error("The usage session lookup returned an invalid body.");
 	return held.map((row) => {
-		const providerSessionId = isRecord$17(row) ? row["providerSessionId"] : void 0;
-		const runtimeId = isRecord$17(row) ? row["runtimeId"] : void 0;
+		const providerSessionId = isRecord$18(row) ? row["providerSessionId"] : void 0;
+		const runtimeId = isRecord$18(row) ? row["runtimeId"] : void 0;
 		if (typeof providerSessionId !== "string" || typeof runtimeId !== "string") throw new Error("The usage session lookup returned an invalid held row.");
 		return {
 			providerSessionId,
@@ -102238,7 +102262,7 @@ function emptyConfig(source, path) {
 		issues: []
 	};
 }
-function isRecord$16(value) {
+function isRecord$17(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringArray(value) {
@@ -102266,7 +102290,7 @@ function terminalsFromValue(value) {
 			name: `Terminal ${index + 1}`,
 			command: terminal.trim()
 		}];
-		if (!isRecord$16(terminal)) return [];
+		if (!isRecord$17(terminal)) return [];
 		const command = typeof terminal.command === "string" ? terminal.command.trim() : "";
 		if (!command) return [];
 		return [{
@@ -102305,7 +102329,7 @@ function readConfigFile(source, path) {
 			}]
 		};
 	}
-	if (!isRecord$16(parsed)) return {
+	if (!isRecord$17(parsed)) return {
 		...emptyConfig(source, path),
 		issues: [{
 			severity: "blocked",
@@ -103519,7 +103543,7 @@ const CLAUDE_IDENTITY_KEYS = new Set([
 	"credentialGenerationId"
 ]);
 const CLAUDE_IDENTITY_OPTIONAL_KEYS = new Set(["providerAccountIdentity"]);
-function isRecord$15(value) {
+function isRecord$16(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isStrictRfc3339DateTime(value) {
@@ -103548,7 +103572,7 @@ function hasAllowedKeys(value, required, optional) {
 	return keys.every((key) => required.has(key) || optional.has(key)) && [...required].every((key) => keys.includes(key));
 }
 function parseDeliveryIdentity(value, provider) {
-	if (!isRecord$15(value)) return null;
+	if (!isRecord$16(value)) return null;
 	if (provider === "openai") return parseCodexDeliveryIdentity(value);
 	if (provider === "anthropic") return parseClaudeDeliveryIdentity(value);
 	return null;
@@ -103583,7 +103607,7 @@ function parseClaudeDeliveryIdentity(value) {
 	};
 }
 function parseProviderRuntimeDeliveryReceipt(value, expected) {
-	if (!isRecord$15(value) || !hasExactKeys$2(value, RECEIPT_KEYS)) return null;
+	if (!isRecord$16(value) || !hasExactKeys$2(value, RECEIPT_KEYS)) return null;
 	const identity = parseDeliveryIdentity(value.identity, expected.provider);
 	if (!identity || typeof value.receiptId !== "string" || value.receiptId.length === 0 || value.receiptId.length > 256 || value.runtimeId !== expected.runtimeId || value.machineId !== expected.machineId || value.credentialEpoch !== expected.credentialEpoch || !Number.isInteger(value.credentialEpoch) || value.credentialEpoch < 0 || !isStrictRfc3339DateTime(value.issuedAt) || value.expiresAt !== expected.expiresAt || value.expiresAt !== null && !isStrictRfc3339DateTime(value.expiresAt)) return null;
 	return {
@@ -103605,8 +103629,8 @@ function providerDeliveryBindingFromReceipt(receipt) {
 	};
 }
 function readProviderDeliveryBinding(value) {
-	if (!isRecord$15(value) || !hasExactKeys$2(value, BINDING_KEYS)) return null;
-	const identityProvider = isRecord$15(value.identity) ? value.identity.provider : void 0;
+	if (!isRecord$16(value) || !hasExactKeys$2(value, BINDING_KEYS)) return null;
+	const identityProvider = isRecord$16(value.identity) ? value.identity.provider : void 0;
 	const tokenProvider = identityProvider === "codex" ? "openai" : identityProvider === "claude" ? "anthropic" : null;
 	if (!tokenProvider) return null;
 	const identity = parseDeliveryIdentity(value.identity, tokenProvider);
@@ -151008,12 +151032,12 @@ function decodeProviderKind(providerName, operation) {
 		detail: `Unknown persisted provider '${providerName}'.`
 	}));
 }
-function isRecord$14(value) {
+function isRecord$15(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function mergeRuntimePayload(existing, next) {
 	if (next === void 0) return existing ?? null;
-	if (isRecord$14(existing) && isRecord$14(next)) return {
+	if (isRecord$15(existing) && isRecord$15(next)) return {
 		...existing,
 		...next
 	};
@@ -153038,7 +153062,7 @@ const PAGINATION_KEYS = new Set([
 	"total",
 	"hasMore"
 ]);
-function isRecord$13(value) {
+function isRecord$14(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasOnlyKeys(value, allowed) {
@@ -153051,17 +153075,17 @@ function isRfc3339(value) {
 	return typeof value === "string" && RFC3339.test(value) && Number.isFinite(Date.parse(value));
 }
 function isEnvelopeMeta(value) {
-	if (!isRecord$13(value) || !hasExactKeys$1(value, META_KEYS)) return false;
+	if (!isRecord$14(value) || !hasExactKeys$1(value, META_KEYS)) return false;
 	return typeof value.domain === "string" && value.domain.length > 0 && isRfc3339(value.timestamp) && typeof value.version === "string" && value.version.length > 0;
 }
 function isPagination(value) {
-	if (!isRecord$13(value) || !hasExactKeys$1(value, PAGINATION_KEYS)) return false;
+	if (!isRecord$14(value) || !hasExactKeys$1(value, PAGINATION_KEYS)) return false;
 	return Number.isInteger(value.page) && value.page >= 0 && Number.isInteger(value.limit) && value.limit >= 0 && Number.isInteger(value.total) && value.total >= 0 && typeof value.hasMore === "boolean";
 }
 function readLocalProviderAccountId(authJson) {
 	try {
 		const value = JSON.parse(authJson);
-		if (!isRecord$13(value) || value.auth_mode !== "chatgpt" || !isRecord$13(value.tokens)) return null;
+		if (!isRecord$14(value) || value.auth_mode !== "chatgpt" || !isRecord$14(value.tokens)) return null;
 		const providerAccountId = value.tokens.account_id;
 		if (typeof providerAccountId !== "string") return null;
 		const normalized = providerAccountId.trim();
@@ -153074,13 +153098,13 @@ function resolveLocalAuthJsonPath(homePath) {
 	return (0, node_path.join)(homePath?.trim() || process.env.CODEX_HOME?.trim() || (0, node_path.join)((0, node_os.homedir)(), ".codex"), "auth.json");
 }
 function parseCodexAccountIdentityEnvelope(value) {
-	if (!isRecord$13(value) || !hasOnlyKeys(value, ENVELOPE_KEYS)) return null;
+	if (!isRecord$14(value) || !hasOnlyKeys(value, ENVELOPE_KEYS)) return null;
 	if (!("data" in value) || !("meta" in value) || !isEnvelopeMeta(value.meta)) return null;
 	if (value.pagination !== void 0 && !isPagination(value.pagination)) return null;
 	return readCodexAccountIdentity(value.data);
 }
 function readCodexAccountIdentity(value) {
-	if (!isRecord$13(value) || !hasExactKeys$1(value, IDENTITY_KEYS)) return null;
+	if (!isRecord$14(value) || !hasExactKeys$1(value, IDENTITY_KEYS)) return null;
 	if (value.kind !== "provider_account" || value.provider !== "codex" || typeof value.providerAccountIdentity !== "string" || !PROVIDER_ACCOUNT_IDENTITY$1.test(value.providerAccountIdentity)) return null;
 	return {
 		kind: "provider_account",
@@ -212698,7 +212722,7 @@ const MAX_WORKER_PLAN_ITEMS = 5;
 function asRecord$10(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
-function readTrimmedString(value) {
+function readTrimmedString$1(value) {
 	return typeof value === "string" ? value.trim() : void 0;
 }
 function isValidWorkerSlug(value) {
@@ -212712,9 +212736,9 @@ function isValidWorkerSummary(value) {
 }
 function decodeWorkerPlanItem(value) {
 	const item = asRecord$10(value);
-	const slug = readTrimmedString(item?.slug);
-	const title = readTrimmedString(item?.title);
-	const summary = readTrimmedString(item?.summary);
+	const slug = readTrimmedString$1(item?.slug);
+	const title = readTrimmedString$1(item?.title);
+	const summary = readTrimmedString$1(item?.summary);
 	if (!isValidWorkerSlug(slug)) return void 0;
 	if (!isValidWorkerTitle(title)) return void 0;
 	if (!isValidWorkerSummary(summary)) return void 0;
@@ -214978,8 +215002,8 @@ function cliSelectsOsStore(input) {
 	if (input.env[CLAUDE_FORCE_OS_CREDENTIAL_STORE_ENV] === "1") return true;
 	const config = readConfig(input);
 	if (config === null) return false;
-	const features = isRecord$12(config.parsed) ? config.parsed[CACHED_FEATURES_KEY] : void 0;
-	const flag = isRecord$12(features) ? features[OS_STORE_FLAG_KEY] : void 0;
+	const features = isRecord$13(config.parsed) ? config.parsed[CACHED_FEATURES_KEY] : void 0;
+	const flag = isRecord$13(features) ? features[OS_STORE_FLAG_KEY] : void 0;
 	return typeof flag === "boolean" ? flag : null;
 }
 /**
@@ -215007,7 +215031,7 @@ function hasSessionBus(input) {
 	const runtimeDirectory = input.env.XDG_RUNTIME_DIR?.trim();
 	return runtimeDirectory ? input.fileExists((0, node_path.join)(runtimeDirectory, "bus")) : false;
 }
-function isRecord$12(value) {
+function isRecord$13(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
@@ -215931,7 +215955,7 @@ function createCodewebAgentTokenMintClient(input) {
 }
 function parseMintResponse(httpStatus, body) {
 	if (httpStatus === 404) return { status: "unknown_identity" };
-	if (!isRecord$11(body)) return { status: "unavailable" };
+	if (!isRecord$12(body)) return { status: "unavailable" };
 	if (body["status"] === "minted" && typeof body["token"] === "string") return {
 		status: "minted",
 		token: body["token"]
@@ -215943,7 +215967,7 @@ function parseMintResponse(httpStatus, body) {
 	};
 	return { status: "unavailable" };
 }
-function isRecord$11(value) {
+function isRecord$12(value) {
 	return typeof value === "object" && value !== null;
 }
 //#endregion
@@ -223018,7 +223042,7 @@ function deriveToolActivityPresentation(input) {
 }
 //#endregion
 //#region src/provider/acp/AcpRuntimeModel.ts
-function isRecord$10(value) {
+function isRecord$11(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function extractModelConfigId(sessionResponse) {
@@ -223090,7 +223114,7 @@ function extractCommandFromTitle(title) {
 	return /`([^`]+)`/.exec(title)?.[1]?.trim() || void 0;
 }
 function extractToolCallCommand(rawInput, title) {
-	if (isRecord$10(rawInput)) {
+	if (isRecord$11(rawInput)) {
 		const directCommand = normalizeCommandValue(rawInput.command);
 		if (directCommand) return directCommand;
 		const executable = typeof rawInput.executable === "string" ? rawInput.executable.trim() : "";
@@ -224957,11 +224981,11 @@ function settlePendingUserInputsAsEmptyAnswers(pendingUserInputs) {
 	const pendingEntries = Array.from(pendingUserInputs.values());
 	return require_Schema$1.forEach(pendingEntries, (pending) => require_Schema$1.succeed$2(pending.answers, {}).pipe(require_Schema$1.ignore), { discard: true });
 }
-function isRecord$9(value) {
+function isRecord$10(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseCursorResume(raw) {
-	if (!isRecord$9(raw)) return void 0;
+	if (!isRecord$10(raw)) return void 0;
 	if (raw.schemaVersion !== CURSOR_RESUME_VERSION) return void 0;
 	if (typeof raw.sessionId !== "string" || !raw.sessionId.trim()) return void 0;
 	return { sessionId: raw.sessionId.trim() };
@@ -234518,7 +234542,7 @@ function readinessData(value) {
 	return decodeClaudeRuntimeReadiness(value.data);
 }
 function decodeClaudeRuntimeReadiness(value) {
-	if (!isRecord$8(value) || !hasValidClaudeRuntimeReadinessFields(value)) throw new ClaudeRuntimeReadinessError(CLAUDE_READINESS_COPY.unavailable);
+	if (!isRecord$9(value) || !hasValidClaudeRuntimeReadinessFields(value)) throw new ClaudeRuntimeReadinessError(CLAUDE_READINESS_COPY.unavailable);
 	return value;
 }
 function hasValidClaudeRuntimeReadinessFields(value) {
@@ -234527,7 +234551,7 @@ function hasValidClaudeRuntimeReadinessFields(value) {
 function isNullableString$1(value) {
 	return value === null || typeof value === "string";
 }
-function isRecord$8(value) {
+function isRecord$9(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isRuntimeTicketSession(sessionId) {
@@ -288978,7 +289002,7 @@ function renderPipelineWorkerTaskPacket(input) {
 		"Recommended loop: forge-fix"
 	].join("\n\n");
 }
-function isRecord$7(value) {
+function isRecord$8(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function nonEmptyStrings(value) {
@@ -289092,7 +289116,7 @@ function decodeStatefulGoldenPath(value, index, errors) {
 	};
 }
 function decodeGoldenPath(value, index, errors) {
-	if (!isRecord$7(value)) {
+	if (!isRecord$8(value)) {
 		errors.push(`workers[${index}].goldenPath must be an object`);
 		return null;
 	}
@@ -289102,7 +289126,7 @@ function decodeGoldenPath(value, index, errors) {
 	return null;
 }
 function decodeWorker(value, index, errors) {
-	if (!isRecord$7(value)) {
+	if (!isRecord$8(value)) {
 		errors.push(`workers[${index}] must be an object`);
 		return null;
 	}
@@ -289162,7 +289186,7 @@ function decodeLegacyFileScopes(value, index, errors) {
 	return scopes.map(normalizeScope);
 }
 function decodeLegacyWorker(value, index, errors) {
-	if (!isRecord$7(value)) {
+	if (!isRecord$8(value)) {
 		errors.push(`workers[${index}] must be an object`);
 		return null;
 	}
@@ -289224,7 +289248,7 @@ function validateMode(mode, riskLevel, workers, errors) {
 }
 function decodePipelineWorkerPlan(value) {
 	const errors = [];
-	if (!isRecord$7(value)) return {
+	if (!isRecord$8(value)) return {
 		ok: false,
 		errors: ["worker plan must be an object"]
 	};
@@ -290098,7 +290122,7 @@ var ApprovedWorkerPlanInvariantError = class extends Error {
 		this.name = "ApprovedWorkerPlanInvariantError";
 	}
 };
-function isRecord$6(value) {
+function isRecord$7(value) {
 	return typeof value === "object" && value !== null;
 }
 function exactPositiveInteger(value) {
@@ -290113,7 +290137,7 @@ function assertApprovedWorkerIdentity(worker, expected) {
 	if (worker.id !== expected.workerThreadId || worker.kind !== "worker" || worker.parentThreadId !== expected.masterThreadId || worker.projectId !== expected.projectId || worker.anchorKind !== "task" || worker.anchorCmmdId !== expected.taskId || worker.branch !== expected.branch || worker.worktreePath !== expected.worktreePath) throw new ApprovedWorkerPlanInvariantError(`Existing worker '${expected.workerThreadId}' does not match the approved plan identity.`);
 }
 function activityMatchesPrompt(thread, kind, promptId) {
-	return thread.activities.some((activity) => activity.kind === kind && isRecord$6(activity.payload) && activity.payload["promptId"] === promptId);
+	return thread.activities.some((activity) => activity.kind === kind && isRecord$7(activity.payload) && activity.payload["promptId"] === promptId);
 }
 function workerIdentity(prompt, slug) {
 	const token = (0, node_crypto.createHash)("sha256").update(`${prompt.masterThreadId}\n${prompt.promptId}\n${slug}`).digest("hex").slice(0, 24);
@@ -299758,7 +299782,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "00cc2d653acc035bf8de4ed64006a9af5c4d6362";
+	return "52671486a7eccd32066591f8c8125252a3a6084a";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -299981,6 +300005,219 @@ const makeServerEnvironment = require_Schema$1.fn("makeServerEnvironment")(funct
 });
 const ServerEnvironmentLive = require_Schema$1.effect(ServerEnvironment, makeServerEnvironment());
 //#endregion
+//#region src/auth/http/cmmdEmbedExchange.ts
+function oauthSubjectForUserId(userId) {
+	return `user:${userId}`;
+}
+const EmbedExchangeInput = require_Schema$1.Struct({ code: require_Schema$1.String });
+function isRecord$6(value) {
+	return typeof value === "object" && value !== null;
+}
+function readTrimmedString(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function readFiniteNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function identityFromRedeemed(redeemed) {
+	return normalizeCmmdUserIdentity(redeemed.user) ?? {
+		id: String(redeemed.userId),
+		firstName: null,
+		lastName: null,
+		email: `user-${redeemed.userId}@embed.local`,
+		username: redeemed.displayName?.trim() || `user-${redeemed.userId}`
+	};
+}
+function optionalRedeemedFields(body) {
+	const refreshToken = readTrimmedString(body.refreshToken);
+	const displayName = typeof body.displayName === "string" ? body.displayName : void 0;
+	const forgeOwnerAssertion = readTrimmedString(body.forgeOwnerAssertion);
+	const sessionGrant = readTrimmedString(body.sessionGrant);
+	const sessionGrantExpiresAt = typeof body.sessionGrantExpiresAt === "string" ? body.sessionGrantExpiresAt : void 0;
+	return {
+		...refreshToken !== void 0 ? { refreshToken } : {},
+		...displayName !== void 0 ? { displayName } : {},
+		...forgeOwnerAssertion !== void 0 ? { forgeOwnerAssertion } : {},
+		...sessionGrant !== void 0 ? { sessionGrant } : {},
+		...sessionGrantExpiresAt !== void 0 ? { sessionGrantExpiresAt } : {}
+	};
+}
+function readRedeemedEmbedHandoff(body) {
+	if (!isRecord$6(body)) return null;
+	const accessToken = readTrimmedString(body.accessToken);
+	const mcpToken = readTrimmedString(body.mcpToken);
+	const organizationId = readFiniteNumber(body.organizationId);
+	const userId = readFiniteNumber(body.userId);
+	if (accessToken === void 0 || mcpToken === void 0 || accessToken.length < 24 || mcpToken.length < 24 || organizationId === null || userId === null) return null;
+	return {
+		accessToken,
+		mcpToken,
+		organizationId,
+		userId,
+		user: body.user,
+		...optionalRedeemedFields(body)
+	};
+}
+function redeemEmbedCodeWithCmmd(code) {
+	return require_Schema$1.tryPromise({
+		try: () => fetch(resolveCommandAppEndpoint("/api/forge/embed/handoff/redeem"), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ code })
+		}),
+		catch: (cause) => new AuthError({
+			message: "Failed to redeem the CMMD embed handoff with CMMD.",
+			status: 500,
+			cause
+		})
+	}).pipe(require_Schema$1.flatMap((response) => require_Schema$1.tryPromise({
+		try: async () => {
+			const text = await response.text();
+			let json = null;
+			if (text.length > 0) try {
+				json = JSON.parse(text);
+			} catch {
+				json = null;
+			}
+			return {
+				ok: response.ok,
+				status: response.status,
+				json
+			};
+		},
+		catch: (cause) => new AuthError({
+			message: "Failed to read the CMMD embed handoff response.",
+			status: 500,
+			cause
+		})
+	})), require_Schema$1.flatMap(({ ok, status, json }) => {
+		if (!ok) return require_Schema$1.fail(new AuthError({
+			message: status === 400 || status === 401 || status === 404 ? "CMMD embed handoff code is invalid or expired." : "CMMD rejected the embed handoff redeem.",
+			status: status === 400 || status === 401 || status === 404 ? 401 : 500
+		}));
+		const redeemed = readRedeemedEmbedHandoff(json);
+		if (!redeemed) return require_Schema$1.fail(new AuthError({
+			message: "CMMD returned an incomplete embed handoff payload.",
+			status: 500
+		}));
+		return require_Schema$1.succeed(redeemed);
+	}));
+}
+function persistLocalEmbedSession(input) {
+	return require_Schema$1.gen(function* () {
+		yield* setCommandAccessTokenForSession(input.sessionId, input.redeemed.mcpToken).pipe(require_Schema$1.mapError((cause) => new AuthError({
+			message: "Failed to persist CMMD access token.",
+			status: 500,
+			cause
+		})));
+		yield* setCommandJwtForSession(input.sessionId, input.redeemed.accessToken, input.redeemed.refreshToken ? { refreshToken: input.redeemed.refreshToken } : {}).pipe(require_Schema$1.mapError((cause) => new AuthError({
+			message: "Failed to persist CMMD JWT.",
+			status: 500,
+			cause
+		})));
+		const identity = identityFromRedeemed(input.redeemed);
+		yield* setCmmdUserIdentityForSession(input.sessionId, identity).pipe(require_Schema$1.mapError((cause) => new AuthError({
+			message: "Failed to persist CMMD identity.",
+			status: 500,
+			cause
+		})));
+		return identity;
+	});
+}
+const authCmmdEmbedExchangeRouteLayer = add$1("POST", "/api/auth/cmmd-embed/exchange", require_Schema$1.gen(function* () {
+	const request = yield* require_HttpServer.HttpServerRequest;
+	const limited = rateLimitOrRespond({
+		routeClass: "auth-bootstrap",
+		clientKey: clientKeyFromRequest(request)
+	});
+	if (limited) return limited;
+	const code = (yield* require_HttpServer.schemaBodyJson(EmbedExchangeInput).pipe(require_Schema$1.mapError((cause) => new AuthError({
+		message: "Invalid CMMD embed handoff payload.",
+		status: 400,
+		cause
+	})))).code.trim();
+	if (code.length < 16) return yield* new AuthError({
+		message: "Invalid CMMD embed handoff code.",
+		status: 401
+	});
+	const redeemed = yield* redeemEmbedCodeWithCmmd(code);
+	const serverAuth = yield* ServerAuth;
+	const sessions = yield* SessionCredentialService;
+	if (serverAuth.isForgeCloudShell?.() === true) {
+		const assertionToken = redeemed.forgeOwnerAssertion?.trim();
+		const sessionGrant = redeemed.sessionGrant?.trim();
+		if (!assertionToken || !sessionGrant) return yield* new AuthError({
+			message: "CMMD embed handoff did not include Forge Cloud owner credentials.",
+			status: 500
+		});
+		const assertion = yield* validateCloudOwnerCallbackAssertion({
+			serverAuth,
+			assertionToken,
+			authenticatedUserId: redeemed.userId
+		});
+		if (!assertion) return yield* new AuthError({
+			message: "CMMD embed handoff owner assertion was rejected.",
+			status: 401
+		});
+		const identity = identityFromRedeemed(redeemed);
+		yield* persistCloudOwnerArtifacts({
+			assertion,
+			accessToken: redeemed.mcpToken,
+			identity,
+			jwtToken: redeemed.accessToken,
+			refreshToken: redeemed.refreshToken,
+			sessionGrant,
+			sessionGrantExpiresAt: redeemed.sessionGrantExpiresAt
+		});
+		let response = yield* require_HttpServer.jsonUnsafe({
+			authenticated: true,
+			organizationId: redeemed.organizationId,
+			cloudShell: true
+		}, { status: 200 }).pipe(require_HttpServer.setCookie(FORGE_CLOUD_OWNER_ASSERTION_COOKIE, assertion.token, cloudOwnerAssertionCookieOptions(assertion)));
+		const grantExpiresAt = redeemed.sessionGrantExpiresAt ? new Date(redeemed.sessionGrantExpiresAt) : new Date(Date.now() + 2160 * 60 * 60 * 1e3);
+		response = yield* response.pipe(require_HttpServer.setCookie(FORGE_CLOUD_SESSION_GRANT_COOKIE, sessionGrant, cloudOwnerSessionGrantCookieOptions({
+			token: sessionGrant,
+			expiresAt: grantExpiresAt
+		})));
+		return response;
+	}
+	const issued = yield* sessions.issue({
+		method: "browser-session-cookie",
+		role: "owner",
+		subject: oauthSubjectForUserId(redeemed.userId),
+		client: deriveAuthClientMetadata({
+			request,
+			label: "CMMD embed"
+		})
+	}).pipe(require_Schema$1.mapError((cause) => new AuthError({
+		message: "Failed to issue authenticated session.",
+		cause
+	})));
+	const cmmdIdentity = yield* persistLocalEmbedSession({
+		sessionId: issued.sessionId,
+		redeemed
+	});
+	if (redeemed.sessionGrant) yield* setCommandSessionGrantForSession(issued.sessionId, redeemed.sessionGrant).pipe(require_Schema$1.ignore({ log: false }));
+	const secure = shouldUseSecureCookie(forgePublicUrlForRequest(request));
+	return yield* require_HttpServer.jsonUnsafe({
+		authenticated: true,
+		role: issued.role,
+		sessionMethod: issued.method,
+		expiresAt: require_Schema$1.toUtc(issued.expiresAt),
+		cmmdIdentity,
+		organizationId: redeemed.organizationId,
+		cloudShell: false
+	}, { status: 200 }).pipe(require_HttpServer.setCookie(sessions.cookieName, issued.token, {
+		expires: require_Schema$1.toDate(issued.expiresAt),
+		httpOnly: true,
+		path: "/",
+		sameSite: "lax",
+		secure
+	}));
+}).pipe(require_Schema$1.catchTag("AuthError", (error) => respondToAuthError(error))));
+//#endregion
 //#region src/auth/http/cloudOwnerDeviceSession.ts
 /**
 * Native OAuth clients allowed to redeem a Forge Cloud session grant through
@@ -300124,7 +300361,10 @@ const cloudOwnerSessionRevokeRouteLayer = add$1("POST", "/api/auth/cloud/session
 const SCALAR_API_REFERENCE_URL = "https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1";
 const SCALAR_API_REFERENCE_INTEGRITY = "sha384-SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W";
 const API_DOCS_SECURITY_HEADERS = {
-	...BROWSER_DOCUMENT_SECURITY_HEADERS,
+	"permissions-policy": BROWSER_DOCUMENT_SECURITY_HEADERS["permissions-policy"],
+	"referrer-policy": BROWSER_DOCUMENT_SECURITY_HEADERS["referrer-policy"],
+	"x-content-type-options": BROWSER_DOCUMENT_SECURITY_HEADERS["x-content-type-options"],
+	"x-frame-options": "DENY",
 	"content-security-policy": [
 		"default-src 'none'",
 		"script-src 'self' https://cdn.jsdelivr.net",
@@ -323667,7 +323907,7 @@ const MiscRuntimeLayerLive = require_Schema$1.mergeAll(AnalyticsServiceLayerLive
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(require_Schema$1.provideMerge(CheckpointingLayerLive), require_Schema$1.provideMerge(GitLayerLive), require_Schema$1.provideMerge(OrchestrationLayerLive), require_Schema$1.provideMerge(ProviderLayerLive), require_Schema$1.provideMerge(TerminalLayerLive), require_Schema$1.provideMerge(AgentBrowserManagerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(require_Schema$1.provide$1(ThreadDevRuntimeLive)))), require_Schema$1.provideMerge(PersistenceLayerLive), require_Schema$1.provideMerge(KeybindingsLive), require_Schema$1.provideMerge(ProviderRegistryLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ServerSettingsLive, UsageServiceLive.pipe(require_Schema$1.provide$1(ServerSettingsLive), require_Schema$1.provide$1(UsageSessionLookupLive), require_Schema$1.provide$1(UsageRecordedSourceLive.pipe(require_Schema$1.provide$1(OrchestrationLayerLive), require_Schema$1.provide$1(RuntimeReplicationOutboxLive), require_Schema$1.provide$1(ProviderSessionRuntimeRepositoryLive), require_Schema$1.provide$1(TextGenerationSessionRepositoryLive)))))), require_Schema$1.provideMerge(WorkspaceLayerLive), require_Schema$1.provideMerge(WorkspaceReadinessStateLive), require_Schema$1.provideMerge(ProjectFaviconResolverLive), require_Schema$1.provideMerge(RepositoryIdentityResolverLive), require_Schema$1.provideMerge(ServerEnvironmentLive), require_Schema$1.provideMerge(AuthLayerLive), require_Schema$1.provideMerge(ServerSecretStoreLayerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(require_Schema$1.provide$1(PersistenceLayerLive)))), require_Schema$1.provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(require_Schema$1.provideMerge(RuntimeDependenciesWithoutPullRequestsLive), require_Schema$1.provideMerge(cmmdProjectIdentityResolverLive.pipe(require_Schema$1.provide$1(RuntimeDependenciesWithoutPullRequestsLive))), require_Schema$1.provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(require_Schema$1.provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = require_Schema$1.mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, cloudOwnerSessionRedeemRouteLayer, cloudOwnerSessionRevokeRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeEnvironmentsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
+const makeRoutesLayer = require_Schema$1.mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authCmmdEmbedExchangeRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, cloudOwnerSessionRedeemRouteLayer, cloudOwnerSessionRevokeRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeEnvironmentsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
 const makeServerLayer = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath({ preferProcessPath: config.forgeCmmdRuntimeMode === true });