@cmmd-center/forge 0.13.96 → 0.13.97

package/dist/bin.mjs

@@ -23,7 +23,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import os, { homedir, networkInterfaces, tmpdir } from "node:os";
+import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -50653,7 +50653,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = os.release().split(".");
+		const osRelease = $U.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53096,7 +53096,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$4 = __require("os");
+	const os$3 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53118,7 +53118,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$4.userInfo();
+				const userInfo = os$3.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66041,7 +66041,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.96";
+var version$1 = "0.13.97";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -76111,7 +76111,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$3 = __require("os");
+	var os$2 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -76119,8 +76119,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$3.arch();
-	var platform = process.env.npm_config_platform || os$3.platform();
+	var arch = process.env.npm_config_arch || os$2.arch();
+	var platform = process.env.npm_config_platform || os$2.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -93964,7 +93964,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-yHTUkd2Y.mjs"),
+		try: () => import("./open-2-reBrpv.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -98014,6 +98014,119 @@ function providerAuthFailureMessage(message, provider, env = process.env) {
 	}).message;
 }
 //#endregion
+//#region ../../packages/shared/src/publicProviderCopy.ts
+const PUBLIC_PROVIDER_LEAK_PATTERNS = [
+	/\bDeepSeek\b/i,
+	/\bKimi\b/i,
+	/\bMoonshot\b/i,
+	/\bdeepseek[-._a-z0-9]*\b/i,
+	/\bkimi[-._a-z0-9]*\b/i,
+	/\bmoonshot[-._a-z0-9]*\b/i,
+	/\bAPEX_API_KEY\b/,
+	/\bDEEPSEEK_API_KEY\b/,
+	/\bKIMI_API_KEY\b/,
+	/\bOPENAI_API_KEY\b/,
+	/\bANTHROPIC_API_KEY\b/,
+	/\bCURSOR_API_KEY\b/,
+	/\bOPENCODE_API_KEY\b/,
+	/\bforge_proxy_[A-Za-z0-9._-]+\b/,
+	/\bProviderValidationError\b/,
+	/\/forge-server\/node_modules\//,
+	/https?:\/\/[^\s'"<>)]*\/api\/provider-egress\/[^\s'"<>)]*/i,
+	/https?:\/\/[^\s'"<>)]*(?:apex|deepseek|moonshot|kimi)[^\s'"<>)]*/i
+];
+const DEFAULT_PUBLIC_PROVIDER_ERROR = "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
+function isProviderRateOrQuotaError(message) {
+	if (!message) return false;
+	const normalized = message.toLowerCase();
+	return /\b(rate[\s-]?limit|too\s+many\s+requests|usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/.test(normalized) || /\b429\b/.test(normalized);
+}
+function providerLifecycleOrAccountCopy(message) {
+	if (/\bbound to provider account\b/.test(message) && /\bcannot use provider account\b/.test(message)) return "Forge could not switch this conversation to the selected AI account. Retry the account switch.";
+	if (/\bforge_runtime_repairing\b/.test(message) || /\bthis turn was interrupted because the environment is being repaired\b/.test(message)) return "This turn was interrupted because the environment is being repaired. Retry after the repair finishes.";
+	if (/\bforge_runtime_stopped\b/.test(message) || /\bthis turn was interrupted because the environment was stopped\b/.test(message)) return "This turn was interrupted because the environment was stopped. Start the environment and retry.";
+	return null;
+}
+/**
+* Infer a SAFE, clearer failure category from a (possibly leaky) provider error.
+*
+* Returns a canned, user-facing message — it never echoes the raw input, so it
+* is safe to use even when the source message contains provider internals.
+* Used to give actionable feedback ("model isn't available", "rate-limited",
+* "auth failed") instead of the blanket "CMMD is temporarily unavailable."
+* Returns null when no category can be confidently inferred.
+*/
+function categorizePublicProviderError(message) {
+	if (!message) return null;
+	const m = message.toLowerCase();
+	const lifecycleOrAccountCopy = providerLifecycleOrAccountCopy(m);
+	if (lifecycleOrAccountCopy !== null) return lifecycleOrAccountCopy;
+	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
+	if (/\bmodel\b[\s\S]*\b(not\s+(found|available|supported)|does\s+not\s+exist|unsupported|invalid|unknown)\b/.test(m) || /\b(unsupported|unknown|invalid)\b[\s\S]*\bmodel\b/.test(m) || /\b(model_not_found|invalid_model|model_not_supported)\b/.test(m)) return "The selected model isn't available right now. Pick a different model and retry.";
+	if (isProviderRateOrQuotaError(m)) return "The AI service is rate-limited or out of quota. Wait a moment and retry.";
+	if (/_credential_reconnect_required\b/.test(m)) return "The workspace AI credential needs to be reconnected. Reconnect it in Settings > Providers, then retry.";
+	if (/\b(unauthorized|forbidden|authentication\s+(failed|error|required)|invalid\s+api\s+key|expired\s+(token|credential))\b/.test(m) || /\b40[13]\b/.test(m)) return "Workspace AI authentication failed. Reconnect the workspace and retry.";
+	if (/\b(timed?\s*out|timeout|overloaded|service\s+unavailable)\b/.test(m) || /\b50[234]\b/.test(m)) return "The AI service is temporarily overloaded. Retry in a moment.";
+	return null;
+}
+function containsPublicProviderLeak(message) {
+	if (!message) return false;
+	return PUBLIC_PROVIDER_LEAK_PATTERNS.some((pattern) => pattern.test(message));
+}
+function sanitizePublicProviderText(message, options = {}) {
+	if (message === void 0 || message === null) return null;
+	const trimmed = message.trim();
+	if (trimmed.length === 0) return null;
+	if (!containsPublicProviderLeak(trimmed)) return trimmed;
+	return categorizePublicProviderError(trimmed) ?? options.fallback ?? "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
+}
+//#endregion
+//#region src/orchestration/providerRetryableFailure.ts
+/**
+* Classifies a provider turn-start failure as a retryable rate-limit or
+* transient-availability failure (429/503), a terminal failure that names why
+* it will never clear on its own, or unrecognized (null).
+*
+* CMMD-Center/forge#3558: a 429 from CMMD's provider egress used to leave no
+* trace at all, because nothing in the turn-start path recognized it as a
+* distinct, retryable failure. `ProviderCommandReactor` uses this to decide
+* whether to retry a turn start with backoff, and to name the provider,
+* status and Retry-After in the `provider.turn.start.failed` activity CMMD's
+* watchdog reads once retries are exhausted.
+*
+* Reuses `isProviderRateOrQuotaError` (the same predicate the public-copy
+* sanitizer uses to recognize a rate-limit message) rather than restating its
+* word list here.
+*/
+const SERVICE_UNAVAILABLE_PATTERN = /\b(503|service\s+unavailable)\b/i;
+const RATE_LIMITED_PAST_TENSE_PATTERN = /\brate[\s-]?limit(?:ed|ing)?\b/i;
+const QUOTA_OR_USAGE_LIMIT_PATTERN = /\b(usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/i;
+const EXPLICIT_429_PATTERN = /\b429\b/;
+const RETRY_AFTER_SECONDS_PATTERN = /retry-after[^0-9]{0,10}(\d+)|(?:try again|retry)\s+in\s+(\d+)\s*(?:s\b|sec(?:onds?)?\b)?/i;
+function parseRetryAfterSeconds(detail) {
+	const match = detail.match(RETRY_AFTER_SECONDS_PATTERN);
+	if (!match) return null;
+	const raw = match[1] ?? match[2];
+	const seconds = raw ? Number(raw) : NaN;
+	return Number.isFinite(seconds) ? seconds : null;
+}
+function classifyRetryableProviderFailure(detail) {
+	if (!detail || detail.trim().length === 0) return null;
+	if (QUOTA_OR_USAGE_LIMIT_PATTERN.test(detail) && !EXPLICIT_429_PATTERN.test(detail)) return {
+		kind: "terminal",
+		reason: "quota",
+		message: detail
+	};
+	const isRateLimited = isProviderRateOrQuotaError(detail) || RATE_LIMITED_PAST_TENSE_PATTERN.test(detail);
+	const isUnavailable = SERVICE_UNAVAILABLE_PATTERN.test(detail);
+	if (!isRateLimited && !isUnavailable) return null;
+	return {
+		kind: "retryable",
+		status: isRateLimited ? 429 : 503,
+		retryAfterSeconds: parseRetryAfterSeconds(detail)
+	};
+}
+//#endregion
 //#region src/orchestration/turnFailureReason.ts
 /**
 * Machine-readable reasons for a turn that failed before it produced any
@@ -98047,6 +98160,31 @@ function classifyProviderTurnStartFailureReason(detail) {
 		message
 	};
 }
+/**
+* Classifies a turn that ended mid-flight, after it had already started
+* (CMMD-Center/forge#3562 piece A): a `runtime.error` that reached CMMD as
+* `error_summary`, now also read into a `turn_status: failed` reason.
+*
+* `provider_turn_failed` is the code CMMD's own error_summary heuristic
+* already assigns this class of failure
+* (`shared/forge-work-session-failure-reasons.ts`), so a Forge-sent
+* `turn_status` carrying it lines up with what CMMD already infers instead
+* of teaching it a new code for the common case. `provider_usage_limit`
+* reuses the same wording `classifyRetryableProviderFailure` already treats
+* as a wall that will not clear by retrying (CMMD-Center/forge#3558): a
+* usage-limit message inside a turn that already ended is worth naming
+* specifically, even without the fuller upstream port (see the piece A PR's
+* follow-up issue) that would stop Codex from retrying against that wall in
+* the first place.
+*/
+function classifyMidTurnFailureReason(detail) {
+	const message = detail && detail.trim().length > 0 ? detail : "The runtime reported an error while this run was in progress.";
+	const classified = classifyRetryableProviderFailure(detail);
+	return {
+		code: classified?.kind === "terminal" && classified.reason === "quota" ? "provider_usage_limit" : "provider_turn_failed",
+		message
+	};
+}
 function checkpointTimeoutReason(detail) {
 	return {
 		code: "checkpoint_timeout",
@@ -98181,6 +98319,108 @@ function serializeReplicaMessage(message) {
 	};
 }
 //#endregion
+//#region src/orchestration/turnTerminalStatus.ts
+/**
+* Shared vocabulary between the reactor that records how a turn ended
+* (`Layers/CheckpointReactor.ts`, on the provider's own `turn.completed`
+* event) and the serializer that turns that record into CMMD's `turn_status`
+* terminal event (`runtimeReplication/turnTerminalStatusSerializer.ts`).
+* CMMD-Center/forge#3562 piece A, CMMD-Center/CMMD#5822.
+*/
+/** The activity kind this durable record uses. Never sent to CMMD as-is: the
+* serializer reads it and emits the wire `turn_status` event instead. */
+const TURN_TERMINAL_STATUS_ACTIVITY_KIND = "turn.terminal-status";
+/**
+* CMMD's three-way outcome from the provider's own four-way `turn.completed`
+* state. `cancelled` and `interrupted` both read as `interrupted`: neither
+* the provider wording nor CMMD's Work Session UI distinguishes an
+* operator-cancelled turn from one the provider gave up on mid-flight.
+*/
+function turnTerminalOutcomeFromRuntimeState(state) {
+	if (state === "failed") return "failed";
+	if (state === "completed") return "completed";
+	return "interrupted";
+}
+/**
+* Deterministic activity id for a turn's terminal record: never
+* `crypto.randomUUID()`. The projector replaces an activity by id
+* (`thread.activity-appended`), so a redelivered `turn.completed` for the
+* same turn lands on the same row instead of adding a second one, and the
+* serializer's own `eventId` (`activity:<id>`) inherits the same guarantee.
+*/
+function turnTerminalStatusActivityId(turnId) {
+	return `turn-terminal:${turnId}`;
+}
+//#endregion
+//#region src/runtimeReplication/eventFormatting.ts
+/**
+* Small formatting helpers shared by every source `serializer.ts` folds into
+* a thread's replicated event list. Kept in their own module, with no
+* dependency on `serializer.ts` itself, so a narrower serializer (such as
+* `turnTerminalStatusSerializer.ts`) can reuse them without creating an
+* import cycle back into the file that assembles the full event list.
+*/
+function text(value, max) {
+	const normalized = value.trim();
+	return normalized ? normalized.slice(0, max) : null;
+}
+function canonicalRuntimeEventTimestamp(value) {
+	let timestamp = new Date(value);
+	if (Number.isNaN(timestamp.getTime())) {
+		const legacyBsdNanoseconds = value.match(/^(.*:\d{2})\.\d+NZ$/);
+		timestamp = new Date(legacyBsdNanoseconds ? `${legacyBsdNanoseconds[1]}Z` : value);
+	}
+	if (Number.isNaN(timestamp.getTime())) throw new Error(`Invalid runtime event timestamp: ${value}`);
+	return timestamp.toISOString();
+}
+//#endregion
+//#region src/runtimeReplication/turnTerminalStatusSerializer.ts
+function outcomeOf(payload) {
+	if (!payload || typeof payload !== "object") return null;
+	const outcome = payload.outcome;
+	return outcome === "completed" || outcome === "interrupted" || outcome === "failed" ? outcome : null;
+}
+function errorMessageOf(payload) {
+	if (!payload || typeof payload !== "object") return null;
+	const message = payload.errorMessage;
+	return typeof message === "string" && message.trim().length > 0 ? message : null;
+}
+/**
+* Turns the one durable activity `Layers/CheckpointReactor.ts` records when a
+* turn ends into CMMD's `turn_status` terminal event (CMMD-Center/forge#3562
+* piece A, CMMD-Center/CMMD#5822): `completed`, `interrupted`, or `failed`
+* with a structured `reason`. `error_summary` (`serializeFailureActivity` in
+* `serializer.ts`) keeps replicating separately for a mid-turn failure; this
+* is added next to it, never instead of it.
+*
+* The activity's own id is deterministic (`turn-terminal:<turnId>`,
+* `turnTerminalStatusActivityId`), so this event's `eventId` -- built from
+* that id the same way every other activity-sourced event on this thread is
+* (`activity:<id>`) -- can never collide with a second, different terminal
+* status for the same turn: there is exactly one activity row to read it
+* from, and the reactor that writes that row never overwrites it once set.
+*/
+function serializeTurnTerminalStatusActivity(activity) {
+	if (activity.kind !== "turn.terminal-status" || !activity.turnId) return null;
+	const outcome = outcomeOf(activity.payload);
+	if (outcome === null) return null;
+	const reason = outcome === "failed" ? classifyMidTurnFailureReason(errorMessageOf(activity.payload)) : null;
+	return {
+		sourceSequence: null,
+		event: {
+			eventId: `activity:${activity.id}`,
+			occurredAt: canonicalRuntimeEventTimestamp(activity.createdAt),
+			turnId: activity.turnId,
+			kind: "turn_status",
+			status: outcome,
+			...reason ? { reason: {
+				code: reason.code,
+				message: text(reason.message, 2e3) ?? reason.message
+			} } : {}
+		}
+	};
+}
+//#endregion
 //#region src/runtimeReplication/serializer.ts
 function threadStatus(thread) {
 	if (thread.archivedAt) return "archived";
@@ -98247,19 +98487,6 @@ function serializeRuntimeInventory(snapshot, providerInventory) {
 		...providerInventory === void 0 ? {} : { providers: serializeProviderCatalog(providerInventory) }
 	};
 }
-function text(value, max) {
-	const normalized = value.trim();
-	return normalized ? normalized.slice(0, max) : null;
-}
-function canonicalRuntimeEventTimestamp(value) {
-	let timestamp = new Date(value);
-	if (Number.isNaN(timestamp.getTime())) {
-		const legacyBsdNanoseconds = value.match(/^(.*:\d{2})\.\d+NZ$/);
-		timestamp = new Date(legacyBsdNanoseconds ? `${legacyBsdNanoseconds[1]}Z` : value);
-	}
-	if (Number.isNaN(timestamp.getTime())) throw new Error(`Invalid runtime event timestamp: ${value}`);
-	return timestamp.toISOString();
-}
 /** Spread onto an event: present only when the projection knows the turn. */
 function eventTurn(turnId) {
 	return turnId ? { turnId } : {};
@@ -98564,10 +98791,13 @@ function foldReportedUsage(reported) {
 * model, so a mid-thread switch used to republish a finished turn as a second
 * row for spend that happened once (FOR-36388, fixed in FOR-36438).
 */
-/** Turns named on this thread's own rows; hydrated replica rows carry no local turn. */
+/** Turns named on this thread's own rows; hydrated replica rows carry no local
+* turn, and the terminal-status activity (CMMD-Center/forge#3562 piece A) is
+* a wire-protocol source in its own right, not a Usage signal, so it is
+* excluded the same way a `replica.*` activity is. */
 function localTurnIds(thread) {
 	const fromMessages = thread.messages.filter((message) => !message.streaming).map((message) => message.turnId);
-	const fromActivities = thread.activities.filter((activity) => !activity.kind.startsWith("replica.")).map((activity) => activity.turnId);
+	const fromActivities = thread.activities.filter((activity) => !activity.kind.startsWith("replica.") && activity.kind !== "turn.terminal-status").map((activity) => activity.turnId);
 	const turnIds = /* @__PURE__ */ new Set();
 	for (const turnId of [...fromMessages, ...fromActivities]) if (turnId) turnIds.add(turnId);
 	return turnIds;
@@ -98577,8 +98807,12 @@ function settledTurnIds(thread) {
 	if (thread.latestTurn?.state === "running") turnIds.delete(thread.latestTurn.turnId);
 	return turnIds;
 }
+/** A turn's own activities for Usage derivation, excluding the terminal-status
+* activity: that record's own `createdAt` (the turn's very end) must never
+* shift `turnLatestAt`, or an already-acknowledged usage row would rehash
+* the moment a turn that used to have no terminal activity gains one. */
 function turnActivities(thread, turnId) {
-	return thread.activities.filter((activity) => activity.turnId === turnId).toSorted((left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id));
+	return thread.activities.filter((activity) => activity.turnId === turnId && activity.kind !== "turn.terminal-status").toSorted((left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id));
 }
 /** The last thing that happened in the turn: what the Recorded turn is stamped with. */
 function turnLatestAt(thread, turnId, activities) {
@@ -98787,6 +99021,10 @@ function serializeRuntimeThreadEvents(thread) {
 		const event = serializePlanActivity(activity);
 		return event === null ? [] : [event];
 	});
+	const turnTerminalStatuses = thread.activities.flatMap((activity) => {
+		const event = serializeTurnTerminalStatusActivity(activity);
+		return event === null ? [] : [event];
+	});
 	const recordedTurns = serializeRecordedTurns(thread);
 	const textGenerations = serializeTextGenerations(thread);
 	const priorEvents = [
@@ -98796,6 +99034,7 @@ function serializeRuntimeThreadEvents(thread) {
 		...worktreeLaunchActivities,
 		...planActivities,
 		...failureActivities,
+		...turnTerminalStatuses,
 		...recordedTurns,
 		...textGenerations
 	];
@@ -191922,7 +192161,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -202122,12 +202361,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$2 = "https://code.claude.com/docs/en", kKe = [
+var os$1 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$2}/iam#permission-modes`
+			docLink: `${os$1}/iam#permission-modes`
 		}
 	},
 	{
@@ -202142,7 +202381,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$2}/settings#environment-variables`
+			docLink: `${os$1}/settings#environment-variables`
 		}
 	},
 	{
@@ -202153,14 +202392,14 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$2}/hooks`
+			docLink: `${os$1}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$2}/hooks#exec-form-and-shell-form`
+			docLink: `${os$1}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -202175,7 +202414,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$2}/settings`
+			docLink: `${os$1}/settings`
 		}
 	},
 	{
@@ -202190,13 +202429,13 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$2}/iam#working-directories`
+			docLink: `${os$1}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$2}/iam#configuring-permissions`,
-	env: `${os$2}/settings#environment-variables`,
-	hooks: `${os$2}/hooks`
+	permissions: `${os$1}/iam#configuring-permissions`,
+	env: `${os$1}/settings#environment-variables`,
+	hooks: `${os$1}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -213749,73 +213988,6 @@ const makeCodexAdapter = fn$1("makeCodexAdapter")(function* (options) {
 function makeCodexAdapterLive(options) {
 	return effect(CodexAdapter, makeCodexAdapter(options));
 }
-//#endregion
-//#region ../../packages/shared/src/publicProviderCopy.ts
-const PUBLIC_PROVIDER_LEAK_PATTERNS = [
-	/\bDeepSeek\b/i,
-	/\bKimi\b/i,
-	/\bMoonshot\b/i,
-	/\bdeepseek[-._a-z0-9]*\b/i,
-	/\bkimi[-._a-z0-9]*\b/i,
-	/\bmoonshot[-._a-z0-9]*\b/i,
-	/\bAPEX_API_KEY\b/,
-	/\bDEEPSEEK_API_KEY\b/,
-	/\bKIMI_API_KEY\b/,
-	/\bOPENAI_API_KEY\b/,
-	/\bANTHROPIC_API_KEY\b/,
-	/\bCURSOR_API_KEY\b/,
-	/\bOPENCODE_API_KEY\b/,
-	/\bforge_proxy_[A-Za-z0-9._-]+\b/,
-	/\bProviderValidationError\b/,
-	/\/forge-server\/node_modules\//,
-	/https?:\/\/[^\s'"<>)]*\/api\/provider-egress\/[^\s'"<>)]*/i,
-	/https?:\/\/[^\s'"<>)]*(?:apex|deepseek|moonshot|kimi)[^\s'"<>)]*/i
-];
-const DEFAULT_PUBLIC_PROVIDER_ERROR = "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
-function isProviderRateOrQuotaError(message) {
-	if (!message) return false;
-	const normalized = message.toLowerCase();
-	return /\b(rate[\s-]?limit|too\s+many\s+requests|usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/.test(normalized) || /\b429\b/.test(normalized);
-}
-function providerLifecycleOrAccountCopy(message) {
-	if (/\bbound to provider account\b/.test(message) && /\bcannot use provider account\b/.test(message)) return "Forge could not switch this conversation to the selected AI account. Retry the account switch.";
-	if (/\bforge_runtime_repairing\b/.test(message) || /\bthis turn was interrupted because the environment is being repaired\b/.test(message)) return "This turn was interrupted because the environment is being repaired. Retry after the repair finishes.";
-	if (/\bforge_runtime_stopped\b/.test(message) || /\bthis turn was interrupted because the environment was stopped\b/.test(message)) return "This turn was interrupted because the environment was stopped. Start the environment and retry.";
-	return null;
-}
-/**
-* Infer a SAFE, clearer failure category from a (possibly leaky) provider error.
-*
-* Returns a canned, user-facing message — it never echoes the raw input, so it
-* is safe to use even when the source message contains provider internals.
-* Used to give actionable feedback ("model isn't available", "rate-limited",
-* "auth failed") instead of the blanket "CMMD is temporarily unavailable."
-* Returns null when no category can be confidently inferred.
-*/
-function categorizePublicProviderError(message) {
-	if (!message) return null;
-	const m = message.toLowerCase();
-	const lifecycleOrAccountCopy = providerLifecycleOrAccountCopy(m);
-	if (lifecycleOrAccountCopy !== null) return lifecycleOrAccountCopy;
-	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
-	if (/\bmodel\b[\s\S]*\b(not\s+(found|available|supported)|does\s+not\s+exist|unsupported|invalid|unknown)\b/.test(m) || /\b(unsupported|unknown|invalid)\b[\s\S]*\bmodel\b/.test(m) || /\b(model_not_found|invalid_model|model_not_supported)\b/.test(m)) return "The selected model isn't available right now. Pick a different model and retry.";
-	if (isProviderRateOrQuotaError(m)) return "The AI service is rate-limited or out of quota. Wait a moment and retry.";
-	if (/_credential_reconnect_required\b/.test(m)) return "The workspace AI credential needs to be reconnected. Reconnect it in Settings > Providers, then retry.";
-	if (/\b(unauthorized|forbidden|authentication\s+(failed|error|required)|invalid\s+api\s+key|expired\s+(token|credential))\b/.test(m) || /\b40[13]\b/.test(m)) return "Workspace AI authentication failed. Reconnect the workspace and retry.";
-	if (/\b(timed?\s*out|timeout|overloaded|service\s+unavailable)\b/.test(m) || /\b50[234]\b/.test(m)) return "The AI service is temporarily overloaded. Retry in a moment.";
-	return null;
-}
-function containsPublicProviderLeak(message) {
-	if (!message) return false;
-	return PUBLIC_PROVIDER_LEAK_PATTERNS.some((pattern) => pattern.test(message));
-}
-function sanitizePublicProviderText(message, options = {}) {
-	if (message === void 0 || message === null) return null;
-	const trimmed = message.trim();
-	if (trimmed.length === 0) return null;
-	if (!containsPublicProviderLeak(trimmed)) return trimmed;
-	return categorizePublicProviderError(trimmed) ?? options.fallback ?? "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
-}
 function resolveApexBaseUrl(settings, config) {
 	return config?.forgeApexBaseUrl || settings.baseUrl || "https://apex.cmmd.ai";
 }
@@ -270788,7 +270960,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -270919,14 +271091,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -270934,7 +271106,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -292518,52 +292690,6 @@ function applyThreadGoalPreamble(goal, input) {
 	return trimmedInput.length > 0 ? `${preamble}\n\n${trimmedInput}` : preamble;
 }
 //#endregion
-//#region src/orchestration/providerRetryableFailure.ts
-/**
-* Classifies a provider turn-start failure as a retryable rate-limit or
-* transient-availability failure (429/503), a terminal failure that names why
-* it will never clear on its own, or unrecognized (null).
-*
-* CMMD-Center/forge#3558: a 429 from CMMD's provider egress used to leave no
-* trace at all, because nothing in the turn-start path recognized it as a
-* distinct, retryable failure. `ProviderCommandReactor` uses this to decide
-* whether to retry a turn start with backoff, and to name the provider,
-* status and Retry-After in the `provider.turn.start.failed` activity CMMD's
-* watchdog reads once retries are exhausted.
-*
-* Reuses `isProviderRateOrQuotaError` (the same predicate the public-copy
-* sanitizer uses to recognize a rate-limit message) rather than restating its
-* word list here.
-*/
-const SERVICE_UNAVAILABLE_PATTERN = /\b(503|service\s+unavailable)\b/i;
-const RATE_LIMITED_PAST_TENSE_PATTERN = /\brate[\s-]?limit(?:ed|ing)?\b/i;
-const QUOTA_OR_USAGE_LIMIT_PATTERN = /\b(usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/i;
-const EXPLICIT_429_PATTERN = /\b429\b/;
-const RETRY_AFTER_SECONDS_PATTERN = /retry-after[^0-9]{0,10}(\d+)|(?:try again|retry)\s+in\s+(\d+)\s*(?:s\b|sec(?:onds?)?\b)?/i;
-function parseRetryAfterSeconds(detail) {
-	const match = detail.match(RETRY_AFTER_SECONDS_PATTERN);
-	if (!match) return null;
-	const raw = match[1] ?? match[2];
-	const seconds = raw ? Number(raw) : NaN;
-	return Number.isFinite(seconds) ? seconds : null;
-}
-function classifyRetryableProviderFailure(detail) {
-	if (!detail || detail.trim().length === 0) return null;
-	if (QUOTA_OR_USAGE_LIMIT_PATTERN.test(detail) && !EXPLICIT_429_PATTERN.test(detail)) return {
-		kind: "terminal",
-		reason: "quota",
-		message: detail
-	};
-	const isRateLimited = isProviderRateOrQuotaError(detail) || RATE_LIMITED_PAST_TENSE_PATTERN.test(detail);
-	const isUnavailable = SERVICE_UNAVAILABLE_PATTERN.test(detail);
-	if (!isRateLimited && !isUnavailable) return null;
-	return {
-		kind: "retryable",
-		status: isRateLimited ? 429 : 503,
-		retryAfterSeconds: parseRetryAfterSeconds(detail)
-	};
-}
-//#endregion
 //#region src/orchestration/Layers/ProviderCommandReactor.ts
 function toNonEmptyProviderInput(value) {
 	const normalized = value?.trim();
@@ -294739,12 +294865,62 @@ const CheckpointReactorLive = effect(CheckpointReactor, gen(function* () {
 			createdAt: input.createdAt
 		});
 	});
+	/**
+	* The one durable, deterministic-id activity that records how a turn ended
+	* (CMMD-Center/forge#3562 piece A, CMMD-Center/CMMD#5822): `completed`,
+	* `interrupted` (an abort or a provider cancellation), or `failed` with the
+	* provider's own error message. Recorded here, ahead of every
+	* checkpoint-specific early return below, so it fires for every turn
+	* regardless of whether this workspace can capture a git checkpoint at
+	* all -- unlike a checkpoint, this never depends on `resolveCheckpointCwd`.
+	*
+	* The activity id is derived from the turn id, never `crypto.randomUUID()`,
+	* so a redelivered `turn.completed` for the same turn replaces the same
+	* row rather than adding a second one. The guard below additionally
+	* refuses to touch a turn that already has one: first write wins, so a
+	* later, different signal for the same turn can never overwrite an
+	* outcome CMMD may already have acknowledged.
+	*
+	* Deriving the wire `turn_status` event from a new activity recorded at
+	* the moment the turn actually ends -- not from `thread.latestTurn` or
+	* `thread.checkpoints`, both of which already hold outcomes for turns that
+	* settled before this shipped -- is deliberate: those would insert a brand
+	* new event into history CMMD already acknowledged for every existing
+	* thread, which `RuntimeThreadHistoryConflict` exists specifically to
+	* reject (CMMD-Center/forge#3497). A turn that settled before this shipped
+	* gets no terminal event; only a turn that ends after it does.
+	*/
+	const recordTurnTerminalStatus = fn$1("recordTurnTerminalStatus")(function* (event, thread, turnId) {
+		const activityId = turnTerminalStatusActivityId(turnId);
+		if (thread.activities.some((activity) => activity.id === activityId)) return;
+		const outcome = turnTerminalOutcomeFromRuntimeState(event.payload.state);
+		const recordedAt = (/* @__PURE__ */ new Date()).toISOString();
+		yield* orchestrationEngine.dispatch({
+			type: "thread.activity.append",
+			commandId: serverCommandId$1("turn-terminal-status"),
+			threadId: event.threadId,
+			activity: {
+				id: EventId.make(activityId),
+				tone: outcome === "failed" ? "error" : "info",
+				kind: TURN_TERMINAL_STATUS_ACTIVITY_KIND,
+				summary: `Turn ${outcome}`,
+				payload: {
+					outcome,
+					...outcome === "failed" && event.payload.errorMessage ? { errorMessage: event.payload.errorMessage } : {}
+				},
+				turnId,
+				createdAt: recordedAt
+			},
+			createdAt: recordedAt
+		});
+	});
 	const captureCheckpointFromTurnCompletion = fn$1("captureCheckpointFromTurnCompletion")(function* (event) {
 		const turnId = toTurnId(event.turnId);
 		if (!turnId) return;
 		const readModel = yield* orchestrationEngine.getReadModel();
 		const thread = readModel.threads.find((entry) => entry.id === event.threadId);
 		if (!thread) return;
+		yield* recordTurnTerminalStatus(event, thread, turnId);
 		if (thread.session?.activeTurnId && !sameId(thread.session.activeTurnId, turnId)) return;
 		if (thread.checkpoints.some((checkpoint) => checkpoint.turnId === turnId && checkpoint.status !== "missing")) return;
 		const checkpointCwd = yield* resolveCheckpointCwd({
@@ -299501,7 +299677,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "96780e9bb987ecd23f530709589bda1b4b5791e5";
+	return "c825d8a74e28836b97016dbd8c2abc730841a622";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -324464,7 +324640,7 @@ const connectLoginCommand = make$33("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-yHTUkd2Y.mjs")).default;
+			const open = (await import("./open-2-reBrpv.mjs")).default;
 			await open(url);
 			return true;
 		},