@cmmd-center/forge 0.13.94 → 0.13.95

package/dist/bin.mjs

@@ -23,7 +23,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import os, { homedir, networkInterfaces, tmpdir } from "node:os";
+import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -22813,6 +22813,25 @@ const ProviderUnavailableDetail = Literals([
 	"reconnect-required"
 ]);
 /**
+* Whether the check behind this snapshot's `installed`/`status`/`auth`/`models`
+* fields actually completed (`confirmed`), or a probe failed, timed out, or
+* errored before it could answer (`could-not-check`). Absent means the
+* snapshot predates this field and carries no opinion either way.
+*
+* Deliberately not a new `ProviderUnavailableReason` member, and not folded
+* into `ProviderUnavailableDetail`. That union is the wire vocabulary a
+* separate CMMD receiver already validates with a `.strict()` schema (see
+* `docs/adr/withheld-providers-carry-their-reason.md`), and a value that
+* receiver has never heard of fails the whole snapshot, which its outbox then
+* retries forever. A brand new field costs a receiver that has never heard of
+* it nothing: Effect Schema drops an unrecognized struct property instead of
+* failing the decode, and `serializeProviderCatalog`
+* (`apps/server/src/runtimeReplication/providerCatalog.ts`) never copies this
+* field to that wire in the first place, so the CMMD-facing shape does not
+* change at all.
+*/
+const ProviderAvailabilityCheck = Literals(["confirmed", "could-not-check"]);
+/**
 * Whether the provider CLI honours the credential-directory variable, as this
 * Environment's probe found. `inconclusive` is a probe that ran and could not
 * tell. It is not `unsupported`, and it is never reported as `supported`. The
@@ -22869,6 +22888,8 @@ const ServerProvider = Struct({
 	availability: optional$4(ProviderAvailability),
 	unavailableReason: optional$4(ProviderUnavailableReason),
 	unavailableDetail: optional$4(ProviderUnavailableDetail),
+	availabilityCheck: optional$4(ProviderAvailabilityCheck),
+	lastConfirmedAt: optional$4(IsoDateTime),
 	credentialDirectory: optional$4(ProviderCredentialDirectoryAnswer),
 	credentialStore: optional$4(ProviderCredentialStore),
 	slashCommands: ArraySchema(ServerProviderSlashCommand).pipe(withDecodingDefault(succeed([]))),
@@ -50632,7 +50653,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = os.release().split(".");
+		const osRelease = $U.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53075,7 +53096,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$4 = __require("os");
+	const os$3 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53097,7 +53118,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$4.userInfo();
+				const userInfo = os$3.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66020,7 +66041,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.94";
+var version$1 = "0.13.95";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -76090,7 +76111,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$3 = __require("os");
+	var os$2 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -76098,8 +76119,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$3.arch();
-	var platform = process.env.npm_config_platform || os$3.platform();
+	var arch = process.env.npm_config_arch || os$2.arch();
+	var platform = process.env.npm_config_platform || os$2.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -93943,7 +93964,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-yHTUkd2Y.mjs"),
+		try: () => import("./open-2-reBrpv.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -191901,7 +191922,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -202101,12 +202122,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$2 = "https://code.claude.com/docs/en", kKe = [
+var os$1 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$2}/iam#permission-modes`
+			docLink: `${os$1}/iam#permission-modes`
 		}
 	},
 	{
@@ -202121,7 +202142,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$2}/settings#environment-variables`
+			docLink: `${os$1}/settings#environment-variables`
 		}
 	},
 	{
@@ -202132,14 +202153,14 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$2}/hooks`
+			docLink: `${os$1}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$2}/hooks#exec-form-and-shell-form`
+			docLink: `${os$1}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -202154,7 +202175,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$2}/settings`
+			docLink: `${os$1}/settings`
 		}
 	},
 	{
@@ -202169,13 +202190,13 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$2}/iam#working-directories`
+			docLink: `${os$1}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$2}/iam#configuring-permissions`,
-	env: `${os$2}/settings#environment-variables`,
-	hooks: `${os$2}/hooks`
+	permissions: `${os$1}/iam#configuring-permissions`,
+	env: `${os$1}/settings#environment-variables`,
+	hooks: `${os$1}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -212178,6 +212199,17 @@ function isCommandMissingCause(error) {
 	const lower = error.message.toLowerCase();
 	return lower.includes("enoent") || lower.includes("notfound");
 }
+/**
+* The one thing a spawn failure answers for sure when it is command-missing
+* shaped: the binary is not there. Any other spawn failure (a permissions
+* error, a crashed shell, a Sprite freeze mid-spawn) never actually asked the
+* CLI anything, so it is not evidence the binary is missing (forge#3588).
+* Shared by every provider Layer's version-probe failure branch so the
+* classification reads the same way everywhere it is made.
+*/
+function availabilityCheckForSpawnFailure(commandMissing) {
+	return commandMissing ? "confirmed" : "could-not-check";
+}
 const spawnAndCollect = (binaryPath, command) => gen(function* () {
 	const child = yield* (yield* ChildProcessSpawner).spawn(command);
 	const [stdout, stderr, exitCode] = yield* all([
@@ -212284,6 +212316,7 @@ function buildServerProvider(input) {
 		auth: input.probe.auth,
 		checkedAt: input.checkedAt,
 		...input.probe.message ? { message: input.probe.message } : {},
+		...input.probe.availabilityCheck ? { availabilityCheck: input.probe.availabilityCheck } : {},
 		models: input.models,
 		slashCommands: [...input.slashCommands ?? []],
 		skills: [...withForgeBuiltInSkills(input.skills)]
@@ -214365,17 +214398,27 @@ const makeManagedServerProvider = fn$1("makeManagedServerProvider")(function* (i
 	});
 	yield* runForEach(input.streamSettings, (nextSettings) => asVoid(applySnapshot(nextSettings))).pipe(forkScoped);
 	const refreshFailureCount = yield* make$50(0);
+	const QUICK_RETRY_MS = 5e3;
+	const MAX_QUICK_RETRIES = 3;
+	const quickRetriesSoFar = yield* make$50(0);
 	yield* forever$1(gen(function* () {
 		const failureCount = yield* get$6(refreshFailureCount);
+		const quickRetriesDone = yield* get$6(quickRetriesSoFar);
 		const baseMs = 6e4;
-		yield* sleep$4(millis(Math.min(baseMs * Math.pow(2, failureCount), 3e5)));
-		if (isFailure(yield* refreshSnapshot().pipe(tapError((e) => sync$1(() => captureServerError(e))), exit))) {
+		const backoffMs = Math.min(baseMs * Math.pow(2, failureCount), 3e5);
+		yield* sleep$4(millis(quickRetriesDone > 0 ? QUICK_RETRY_MS : backoffMs));
+		const result = yield* refreshSnapshot().pipe(tapError((e) => sync$1(() => captureServerError(e))), exit);
+		if (isFailure(result)) {
 			yield* update$4(refreshFailureCount, (n) => Math.min(n + 1, 4));
+			yield* set$3(quickRetriesSoFar, 0);
 			yield* logInfo("Provider refresh failed, backing off", {
 				failureCount: failureCount + 1,
 				nextDelayMs: Math.min(baseMs * Math.pow(2, failureCount + 1), 3e5)
 			});
-		} else yield* set$3(refreshFailureCount, 0);
+		} else {
+			yield* set$3(refreshFailureCount, 0);
+			yield* set$3(quickRetriesSoFar, result.value.availabilityCheck === "could-not-check" && quickRetriesDone < MAX_QUICK_RETRIES ? quickRetriesDone + 1 : 0);
+		}
 	})).pipe(forkScoped);
 	return {
 		getSnapshot: input.getSettings.pipe(flatMap(applySnapshot), tapError(logError), orDie),
@@ -215028,7 +215071,8 @@ function buildClaudeProviderFromAuthProbe(input) {
 				version: input.parsedVersion,
 				status: "warning",
 				auth: { status: "unknown" },
-				message: error instanceof Error ? `Could not verify Claude authentication status: ${error.message}.` : "Could not verify Claude authentication status."
+				message: error instanceof Error ? `Could not verify Claude authentication status: ${error.message}.` : "Could not verify Claude authentication status.",
+				availabilityCheck: "could-not-check"
 			}
 		});
 	}
@@ -215049,7 +215093,8 @@ function buildClaudeProviderFromAuthProbe(input) {
 				status: "warning",
 				auth: { status: "unknown" },
 				message: "Could not verify Claude authentication status. Timed out while running command."
-			}
+			},
+			availabilityCheck: "could-not-check"
 		}
 	});
 	const parsed = parseClaudeAuthStatusFromOutput(input.authProbe.success.value, { proxiedCredential: input.provenance.credentialScope === "proxied" });
@@ -215068,7 +215113,8 @@ function buildClaudeProviderFromAuthProbe(input) {
 				...input.authMetadata ? input.authMetadata : {},
 				provenance: input.provenance
 			},
-			...parsed.message ? { message: parsed.message } : {}
+			...parsed.message ? { message: parsed.message } : {},
+			availabilityCheck: "confirmed"
 		}
 	});
 }
@@ -215134,7 +215180,8 @@ function claudeVersionProbeTimeoutProvider(input) {
 			version: null,
 			status: "error",
 			auth: { status: "unknown" },
-			message: "Claude Agent CLI is installed but failed to run. Timed out while running command."
+			message: "Claude Agent CLI is installed but failed to run. Timed out while running command.",
+			availabilityCheck: "could-not-check"
 		}
 	});
 }
@@ -215166,7 +215213,8 @@ const nativeClaudeProviderStatus = fn$1("nativeClaudeProviderStatus")(function*
 				status: usable ? "authenticated" : "unauthenticated",
 				provenance: input.provenance
 			},
-			...usable ? {} : { message: claudeNativeCredentialUnusableMessage() }
+			...usable ? {} : { message: claudeNativeCredentialUnusableMessage() },
+			availabilityCheck: "confirmed"
 		}
 	});
 });
@@ -215212,23 +215260,26 @@ const checkClaudeProviderStatus = fn$1("checkClaudeProviderStatus")(function* (r
 			version: null,
 			status: "warning",
 			auth: { status: "unknown" },
-			message: "Claude is disabled in Forge settings."
+			message: "Claude is disabled in Forge settings.",
+			availabilityCheck: "confirmed"
 		}
 	});
 	const versionProbe = yield* runClaudeCommand(["--version"]).pipe(timeoutOption(CLAUDE_VERSION_PROBE_TIMEOUT_MS), result);
 	if (isFailure$1(versionProbe)) {
 		const error = versionProbe.failure;
+		const commandMissing = isCommandMissingCause(error);
 		return buildServerProvider({
 			provider: PROVIDER$12,
 			enabled: claudeSettings.enabled,
 			checkedAt,
 			models: fallbackModels,
 			probe: {
-				installed: !isCommandMissingCause(error),
+				installed: !commandMissing,
 				version: null,
 				status: "error",
 				auth: { status: "unknown" },
-				message: isCommandMissingCause(error) ? "Claude Agent CLI (`claude`) is not installed or not on PATH." : `Failed to execute Claude Agent CLI health check: ${error instanceof Error ? error.message : String(error)}.`
+				message: commandMissing ? "Claude Agent CLI (`claude`) is not installed or not on PATH." : `Failed to execute Claude Agent CLI health check: ${error instanceof Error ? error.message : String(error)}.`,
+				availabilityCheck: availabilityCheckForSpawnFailure(commandMissing)
 			}
 		});
 	}
@@ -215251,7 +215302,8 @@ const checkClaudeProviderStatus = fn$1("checkClaudeProviderStatus")(function* (r
 				version: parsedVersion,
 				status: "error",
 				auth: { status: "unknown" },
-				message: detail ? `Claude Agent CLI is installed but failed to run. ${detail}` : "Claude Agent CLI is installed but failed to run."
+				message: detail ? `Claude Agent CLI is installed but failed to run. ${detail}` : "Claude Agent CLI is installed but failed to run.",
+				availabilityCheck: "confirmed"
 			}
 		});
 	}
@@ -237357,23 +237409,26 @@ const checkCodexProviderStatus = fn$1("checkCodexProviderStatus")(function* (res
 				status: "unknown",
 				provenance
 			},
-			message: "Codex is disabled in Forge settings."
+			message: "Codex is disabled in Forge settings.",
+			availabilityCheck: "confirmed"
 		}
 	});
 	const versionProbe = yield* runCodexCommand(["--version"]).pipe(timeoutOption(CODEX_VERSION_PROBE_TIMEOUT_MS), result);
 	if (isFailure$1(versionProbe)) {
 		const error = versionProbe.failure;
+		const commandMissing = isCommandMissingCause(error);
 		return buildServerProvider({
 			provider: PROVIDER$4,
 			enabled: codexSettings.enabled,
 			checkedAt,
 			models: fallbackModels,
 			probe: {
-				installed: !isCommandMissingCause(error),
+				installed: !commandMissing,
 				version: null,
 				status: "error",
 				auth: { status: "unknown" },
-				message: isCommandMissingCause(error) ? "Codex CLI (`codex`) is not installed or not on PATH." : `Failed to execute Codex CLI health check: ${error.message}.`
+				message: commandMissing ? "Codex CLI (`codex`) is not installed or not on PATH." : `Failed to execute Codex CLI health check: ${error.message}.`,
+				availabilityCheck: availabilityCheckForSpawnFailure(commandMissing)
 			}
 		});
 	}
@@ -237387,7 +237442,8 @@ const checkCodexProviderStatus = fn$1("checkCodexProviderStatus")(function* (res
 			version: null,
 			status: "error",
 			auth: { status: "unknown" },
-			message: "Codex CLI is installed but failed to run. Timed out while running command."
+			message: "Codex CLI is installed but failed to run. Timed out while running command.",
+			availabilityCheck: "could-not-check"
 		}
 	});
 	const version = versionProbe.success.value;
@@ -237404,7 +237460,8 @@ const checkCodexProviderStatus = fn$1("checkCodexProviderStatus")(function* (res
 				version: parsedVersion,
 				status: "error",
 				auth: { status: "unknown" },
-				message: detail ? `Codex CLI is installed but failed to run. ${detail}` : "Codex CLI is installed but failed to run."
+				message: detail ? `Codex CLI is installed but failed to run. ${detail}` : "Codex CLI is installed but failed to run.",
+				availabilityCheck: "confirmed"
 			}
 		});
 	}
@@ -237418,7 +237475,8 @@ const checkCodexProviderStatus = fn$1("checkCodexProviderStatus")(function* (res
 			version: parsedVersion,
 			status: "error",
 			auth: { status: "unknown" },
-			message: formatCodexCliUpgradeMessage(parsedVersion)
+			message: formatCodexCliUpgradeMessage(parsedVersion),
+			availabilityCheck: "confirmed"
 		}
 	});
 	const skills = (resolveSkills ? yield* resolveSkills({
@@ -237443,7 +237501,8 @@ const checkCodexProviderStatus = fn$1("checkCodexProviderStatus")(function* (res
 			version: parsedVersion,
 			status: "ready",
 			auth: { status: "unknown" },
-			message: "Using a custom Codex model provider; OpenAI login check skipped."
+			message: "Using a custom Codex model provider; OpenAI login check skipped.",
+			availabilityCheck: "confirmed"
 		}
 	});
 	const authProbe = yield* runCodexCommand(["login", "status"]).pipe(timeoutOption(CODEX_AUTH_PROBE_TIMEOUT_MS), result);
@@ -237465,7 +237524,8 @@ const checkCodexProviderStatus = fn$1("checkCodexProviderStatus")(function* (res
 				version: parsedVersion,
 				status: "warning",
 				auth: { status: "unknown" },
-				message: `Could not verify Codex authentication status: ${error.message}.`
+				message: `Could not verify Codex authentication status: ${error.message}.`,
+				availabilityCheck: "could-not-check"
 			}
 		});
 	}
@@ -237480,7 +237540,8 @@ const checkCodexProviderStatus = fn$1("checkCodexProviderStatus")(function* (res
 			version: parsedVersion,
 			status: "warning",
 			auth: { status: "unknown" },
-			message: "Codex authentication status check did not respond in time. The agent can still run; refresh the provider from Settings to retry."
+			message: "Codex authentication status check did not respond in time. The agent can still run; refresh the provider from Settings to retry.",
+			availabilityCheck: "could-not-check"
 		}
 	});
 	const parsed = parseAuthStatusFromOutput(authProbe.success.value);
@@ -237507,7 +237568,8 @@ const checkCodexProviderStatus = fn$1("checkCodexProviderStatus")(function* (res
 					...accountEmail ? { accountLabel: accountEmail } : {}
 				}
 			},
-			...parsed.message ? { message: parsed.message } : {}
+			...parsed.message ? { message: parsed.message } : {},
+			availabilityCheck: "confirmed"
 		}
 	});
 });
@@ -270714,7 +270776,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -270845,14 +270907,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -270860,7 +270922,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -296175,6 +296237,31 @@ const loadProviders = (codexProvider, claudeProvider, ollamaProvider, cmmdProvid
 	opencodeProvider.getSnapshot
 ], { concurrency: "unbounded" });
 const haveProvidersChanged = (previousProviders, nextProviders) => !equals(previousProviders, nextProviders);
+/**
+* Keep publishing a previous good reading, marked stale, across a probe that
+* could not check rather than replacing it with a false "not on this
+* environment" (forge#3588).
+*
+* A Sprite freezes the cgroup about a second after the last inbound request,
+* so a probe already in flight at the freeze resumes into a timeout that
+* proves nothing: `checkCodexProviderStatus`/`checkClaudeProviderStatus` mark
+* exactly that shape `availabilityCheck: "could-not-check"`. When the last
+* thing this registry confirmed for the same provider was available, this
+* keeps publishing THAT reading rather than the fresh could-not-check one,
+* stamped stale with the time it was last confirmed. A provider with no prior
+* confirmed reading, or one whose previous reading was itself withheld, has
+* nothing to carry forward, so the fresh (still unavailable) reading stands.
+*/
+function carryForwardStaleReading(incoming, previous) {
+	if (incoming.availabilityCheck !== "could-not-check") return incoming;
+	if (previous === void 0 || previous.availability !== "available") return incoming;
+	return {
+		...previous,
+		checkedAt: incoming.checkedAt,
+		availabilityCheck: "could-not-check",
+		lastConfirmedAt: previous.lastConfirmedAt ?? previous.checkedAt
+	};
+}
 const ProviderRegistryLive = effect(ProviderRegistry, gen(function* () {
 	const config = yield* ServerConfig;
 	const codexProvider = yield* CodexProvider;
@@ -296212,15 +296299,25 @@ const ProviderRegistryLive = effect(ProviderRegistry, gen(function* () {
 		error
 	})), ignore);
 	const upsertProviders = fn$1("upsertProviders")(function* (incomingProviders, options) {
-		const nextProviders = incomingProviders.map((provider) => withProviderAvailability(provider));
-		const [previousProviders, providers] = yield* modify$3(providersRef, (previousProviders) => {
-			const mergedProviders = new Map(previousProviders.map((provider) => [provider.provider, provider]));
-			for (const provider of nextProviders) mergedProviders.set(provider.provider, provider);
+		const withAvailability = incomingProviders.map((provider) => withProviderAvailability(provider));
+		const [previousProviders, providers, resolvedProviders] = yield* modify$3(providersRef, (previousProviders) => {
+			const previousByKind = new Map(previousProviders.map((provider) => [provider.provider, provider]));
+			const mergedProviders = new Map(previousByKind);
+			const resolvedProviders = [];
+			for (const provider of withAvailability) {
+				const resolved = carryForwardStaleReading(provider, previousByKind.get(provider.provider));
+				resolvedProviders.push(resolved);
+				mergedProviders.set(provider.provider, resolved);
+			}
 			const providers = orderProviderSnapshots([...mergedProviders.values()]);
-			return [[previousProviders, providers], providers];
+			return [[
+				previousProviders,
+				providers,
+				resolvedProviders
+			], providers];
 		});
 		if (haveProvidersChanged(previousProviders, providers)) {
-			yield* forEach(nextProviders, persistProvider, {
+			yield* forEach(resolvedProviders, persistProvider, {
 				concurrency: "unbounded",
 				discard: true
 			});
@@ -299235,7 +299332,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "bb958274b2ec30ab04e69fa421419a546b6490de";
+	return "88bc45ce168df8c9acf36ad6734d8a66bcb353ec";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -324168,7 +324265,7 @@ const connectLoginCommand = make$34("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-yHTUkd2Y.mjs")).default;
+			const open = (await import("./open-2-reBrpv.mjs")).default;
 			await open(url);
 			return true;
 		},