@cmmd-center/forge 0.13.96 → 0.13.98

package/dist/bin.cjs

@@ -66332,7 +66332,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.96";
+var version$1 = "0.13.98";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -98404,6 +98404,119 @@ function providerAuthFailureMessage(message, provider, env = process.env) {
 	}).message;
 }
 //#endregion
+//#region ../../packages/shared/src/publicProviderCopy.ts
+const PUBLIC_PROVIDER_LEAK_PATTERNS = [
+	/\bDeepSeek\b/i,
+	/\bKimi\b/i,
+	/\bMoonshot\b/i,
+	/\bdeepseek[-._a-z0-9]*\b/i,
+	/\bkimi[-._a-z0-9]*\b/i,
+	/\bmoonshot[-._a-z0-9]*\b/i,
+	/\bAPEX_API_KEY\b/,
+	/\bDEEPSEEK_API_KEY\b/,
+	/\bKIMI_API_KEY\b/,
+	/\bOPENAI_API_KEY\b/,
+	/\bANTHROPIC_API_KEY\b/,
+	/\bCURSOR_API_KEY\b/,
+	/\bOPENCODE_API_KEY\b/,
+	/\bforge_proxy_[A-Za-z0-9._-]+\b/,
+	/\bProviderValidationError\b/,
+	/\/forge-server\/node_modules\//,
+	/https?:\/\/[^\s'"<>)]*\/api\/provider-egress\/[^\s'"<>)]*/i,
+	/https?:\/\/[^\s'"<>)]*(?:apex|deepseek|moonshot|kimi)[^\s'"<>)]*/i
+];
+const DEFAULT_PUBLIC_PROVIDER_ERROR = "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
+function isProviderRateOrQuotaError(message) {
+	if (!message) return false;
+	const normalized = message.toLowerCase();
+	return /\b(rate[\s-]?limit|too\s+many\s+requests|usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/.test(normalized) || /\b429\b/.test(normalized);
+}
+function providerLifecycleOrAccountCopy(message) {
+	if (/\bbound to provider account\b/.test(message) && /\bcannot use provider account\b/.test(message)) return "Forge could not switch this conversation to the selected AI account. Retry the account switch.";
+	if (/\bforge_runtime_repairing\b/.test(message) || /\bthis turn was interrupted because the environment is being repaired\b/.test(message)) return "This turn was interrupted because the environment is being repaired. Retry after the repair finishes.";
+	if (/\bforge_runtime_stopped\b/.test(message) || /\bthis turn was interrupted because the environment was stopped\b/.test(message)) return "This turn was interrupted because the environment was stopped. Start the environment and retry.";
+	return null;
+}
+/**
+* Infer a SAFE, clearer failure category from a (possibly leaky) provider error.
+*
+* Returns a canned, user-facing message — it never echoes the raw input, so it
+* is safe to use even when the source message contains provider internals.
+* Used to give actionable feedback ("model isn't available", "rate-limited",
+* "auth failed") instead of the blanket "CMMD is temporarily unavailable."
+* Returns null when no category can be confidently inferred.
+*/
+function categorizePublicProviderError(message) {
+	if (!message) return null;
+	const m = message.toLowerCase();
+	const lifecycleOrAccountCopy = providerLifecycleOrAccountCopy(m);
+	if (lifecycleOrAccountCopy !== null) return lifecycleOrAccountCopy;
+	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
+	if (/\bmodel\b[\s\S]*\b(not\s+(found|available|supported)|does\s+not\s+exist|unsupported|invalid|unknown)\b/.test(m) || /\b(unsupported|unknown|invalid)\b[\s\S]*\bmodel\b/.test(m) || /\b(model_not_found|invalid_model|model_not_supported)\b/.test(m)) return "The selected model isn't available right now. Pick a different model and retry.";
+	if (isProviderRateOrQuotaError(m)) return "The AI service is rate-limited or out of quota. Wait a moment and retry.";
+	if (/_credential_reconnect_required\b/.test(m)) return "The workspace AI credential needs to be reconnected. Reconnect it in Settings > Providers, then retry.";
+	if (/\b(unauthorized|forbidden|authentication\s+(failed|error|required)|invalid\s+api\s+key|expired\s+(token|credential))\b/.test(m) || /\b40[13]\b/.test(m)) return "Workspace AI authentication failed. Reconnect the workspace and retry.";
+	if (/\b(timed?\s*out|timeout|overloaded|service\s+unavailable)\b/.test(m) || /\b50[234]\b/.test(m)) return "The AI service is temporarily overloaded. Retry in a moment.";
+	return null;
+}
+function containsPublicProviderLeak(message) {
+	if (!message) return false;
+	return PUBLIC_PROVIDER_LEAK_PATTERNS.some((pattern) => pattern.test(message));
+}
+function sanitizePublicProviderText(message, options = {}) {
+	if (message === void 0 || message === null) return null;
+	const trimmed = message.trim();
+	if (trimmed.length === 0) return null;
+	if (!containsPublicProviderLeak(trimmed)) return trimmed;
+	return categorizePublicProviderError(trimmed) ?? options.fallback ?? "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
+}
+//#endregion
+//#region src/orchestration/providerRetryableFailure.ts
+/**
+* Classifies a provider turn-start failure as a retryable rate-limit or
+* transient-availability failure (429/503), a terminal failure that names why
+* it will never clear on its own, or unrecognized (null).
+*
+* CMMD-Center/forge#3558: a 429 from CMMD's provider egress used to leave no
+* trace at all, because nothing in the turn-start path recognized it as a
+* distinct, retryable failure. `ProviderCommandReactor` uses this to decide
+* whether to retry a turn start with backoff, and to name the provider,
+* status and Retry-After in the `provider.turn.start.failed` activity CMMD's
+* watchdog reads once retries are exhausted.
+*
+* Reuses `isProviderRateOrQuotaError` (the same predicate the public-copy
+* sanitizer uses to recognize a rate-limit message) rather than restating its
+* word list here.
+*/
+const SERVICE_UNAVAILABLE_PATTERN = /\b(503|service\s+unavailable)\b/i;
+const RATE_LIMITED_PAST_TENSE_PATTERN = /\brate[\s-]?limit(?:ed|ing)?\b/i;
+const QUOTA_OR_USAGE_LIMIT_PATTERN = /\b(usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/i;
+const EXPLICIT_429_PATTERN = /\b429\b/;
+const RETRY_AFTER_SECONDS_PATTERN = /retry-after[^0-9]{0,10}(\d+)|(?:try again|retry)\s+in\s+(\d+)\s*(?:s\b|sec(?:onds?)?\b)?/i;
+function parseRetryAfterSeconds(detail) {
+	const match = detail.match(RETRY_AFTER_SECONDS_PATTERN);
+	if (!match) return null;
+	const raw = match[1] ?? match[2];
+	const seconds = raw ? Number(raw) : NaN;
+	return Number.isFinite(seconds) ? seconds : null;
+}
+function classifyRetryableProviderFailure(detail) {
+	if (!detail || detail.trim().length === 0) return null;
+	if (QUOTA_OR_USAGE_LIMIT_PATTERN.test(detail) && !EXPLICIT_429_PATTERN.test(detail)) return {
+		kind: "terminal",
+		reason: "quota",
+		message: detail
+	};
+	const isRateLimited = isProviderRateOrQuotaError(detail) || RATE_LIMITED_PAST_TENSE_PATTERN.test(detail);
+	const isUnavailable = SERVICE_UNAVAILABLE_PATTERN.test(detail);
+	if (!isRateLimited && !isUnavailable) return null;
+	return {
+		kind: "retryable",
+		status: isRateLimited ? 429 : 503,
+		retryAfterSeconds: parseRetryAfterSeconds(detail)
+	};
+}
+//#endregion
 //#region src/orchestration/turnFailureReason.ts
 /**
 * Machine-readable reasons for a turn that failed before it produced any
@@ -98437,6 +98550,31 @@ function classifyProviderTurnStartFailureReason(detail) {
 		message
 	};
 }
+/**
+* Classifies a turn that ended mid-flight, after it had already started
+* (CMMD-Center/forge#3562 piece A): a `runtime.error` that reached CMMD as
+* `error_summary`, now also read into a `turn_status: failed` reason.
+*
+* `provider_turn_failed` is the code CMMD's own error_summary heuristic
+* already assigns this class of failure
+* (`shared/forge-work-session-failure-reasons.ts`), so a Forge-sent
+* `turn_status` carrying it lines up with what CMMD already infers instead
+* of teaching it a new code for the common case. `provider_usage_limit`
+* reuses the same wording `classifyRetryableProviderFailure` already treats
+* as a wall that will not clear by retrying (CMMD-Center/forge#3558): a
+* usage-limit message inside a turn that already ended is worth naming
+* specifically, even without the fuller upstream port (see the piece A PR's
+* follow-up issue) that would stop Codex from retrying against that wall in
+* the first place.
+*/
+function classifyMidTurnFailureReason(detail) {
+	const message = detail && detail.trim().length > 0 ? detail : "The runtime reported an error while this run was in progress.";
+	const classified = classifyRetryableProviderFailure(detail);
+	return {
+		code: classified?.kind === "terminal" && classified.reason === "quota" ? "provider_usage_limit" : "provider_turn_failed",
+		message
+	};
+}
 function checkpointTimeoutReason(detail) {
 	return {
 		code: "checkpoint_timeout",
@@ -98571,6 +98709,108 @@ function serializeReplicaMessage(message) {
 	};
 }
 //#endregion
+//#region src/orchestration/turnTerminalStatus.ts
+/**
+* Shared vocabulary between the reactor that records how a turn ended
+* (`Layers/CheckpointReactor.ts`, on the provider's own `turn.completed`
+* event) and the serializer that turns that record into CMMD's `turn_status`
+* terminal event (`runtimeReplication/turnTerminalStatusSerializer.ts`).
+* CMMD-Center/forge#3562 piece A, CMMD-Center/CMMD#5822.
+*/
+/** The activity kind this durable record uses. Never sent to CMMD as-is: the
+* serializer reads it and emits the wire `turn_status` event instead. */
+const TURN_TERMINAL_STATUS_ACTIVITY_KIND = "turn.terminal-status";
+/**
+* CMMD's three-way outcome from the provider's own four-way `turn.completed`
+* state. `cancelled` and `interrupted` both read as `interrupted`: neither
+* the provider wording nor CMMD's Work Session UI distinguishes an
+* operator-cancelled turn from one the provider gave up on mid-flight.
+*/
+function turnTerminalOutcomeFromRuntimeState(state) {
+	if (state === "failed") return "failed";
+	if (state === "completed") return "completed";
+	return "interrupted";
+}
+/**
+* Deterministic activity id for a turn's terminal record: never
+* `crypto.randomUUID()`. The projector replaces an activity by id
+* (`thread.activity-appended`), so a redelivered `turn.completed` for the
+* same turn lands on the same row instead of adding a second one, and the
+* serializer's own `eventId` (`activity:<id>`) inherits the same guarantee.
+*/
+function turnTerminalStatusActivityId(turnId) {
+	return `turn-terminal:${turnId}`;
+}
+//#endregion
+//#region src/runtimeReplication/eventFormatting.ts
+/**
+* Small formatting helpers shared by every source `serializer.ts` folds into
+* a thread's replicated event list. Kept in their own module, with no
+* dependency on `serializer.ts` itself, so a narrower serializer (such as
+* `turnTerminalStatusSerializer.ts`) can reuse them without creating an
+* import cycle back into the file that assembles the full event list.
+*/
+function text(value, max) {
+	const normalized = value.trim();
+	return normalized ? normalized.slice(0, max) : null;
+}
+function canonicalRuntimeEventTimestamp(value) {
+	let timestamp = new Date(value);
+	if (Number.isNaN(timestamp.getTime())) {
+		const legacyBsdNanoseconds = value.match(/^(.*:\d{2})\.\d+NZ$/);
+		timestamp = new Date(legacyBsdNanoseconds ? `${legacyBsdNanoseconds[1]}Z` : value);
+	}
+	if (Number.isNaN(timestamp.getTime())) throw new Error(`Invalid runtime event timestamp: ${value}`);
+	return timestamp.toISOString();
+}
+//#endregion
+//#region src/runtimeReplication/turnTerminalStatusSerializer.ts
+function outcomeOf(payload) {
+	if (!payload || typeof payload !== "object") return null;
+	const outcome = payload.outcome;
+	return outcome === "completed" || outcome === "interrupted" || outcome === "failed" ? outcome : null;
+}
+function errorMessageOf(payload) {
+	if (!payload || typeof payload !== "object") return null;
+	const message = payload.errorMessage;
+	return typeof message === "string" && message.trim().length > 0 ? message : null;
+}
+/**
+* Turns the one durable activity `Layers/CheckpointReactor.ts` records when a
+* turn ends into CMMD's `turn_status` terminal event (CMMD-Center/forge#3562
+* piece A, CMMD-Center/CMMD#5822): `completed`, `interrupted`, or `failed`
+* with a structured `reason`. `error_summary` (`serializeFailureActivity` in
+* `serializer.ts`) keeps replicating separately for a mid-turn failure; this
+* is added next to it, never instead of it.
+*
+* The activity's own id is deterministic (`turn-terminal:<turnId>`,
+* `turnTerminalStatusActivityId`), so this event's `eventId` -- built from
+* that id the same way every other activity-sourced event on this thread is
+* (`activity:<id>`) -- can never collide with a second, different terminal
+* status for the same turn: there is exactly one activity row to read it
+* from, and the reactor that writes that row never overwrites it once set.
+*/
+function serializeTurnTerminalStatusActivity(activity) {
+	if (activity.kind !== "turn.terminal-status" || !activity.turnId) return null;
+	const outcome = outcomeOf(activity.payload);
+	if (outcome === null) return null;
+	const reason = outcome === "failed" ? classifyMidTurnFailureReason(errorMessageOf(activity.payload)) : null;
+	return {
+		sourceSequence: null,
+		event: {
+			eventId: `activity:${activity.id}`,
+			occurredAt: canonicalRuntimeEventTimestamp(activity.createdAt),
+			turnId: activity.turnId,
+			kind: "turn_status",
+			status: outcome,
+			...reason ? { reason: {
+				code: reason.code,
+				message: text(reason.message, 2e3) ?? reason.message
+			} } : {}
+		}
+	};
+}
+//#endregion
 //#region src/runtimeReplication/serializer.ts
 function threadStatus(thread) {
 	if (thread.archivedAt) return "archived";
@@ -98637,19 +98877,6 @@ function serializeRuntimeInventory(snapshot, providerInventory) {
 		...providerInventory === void 0 ? {} : { providers: serializeProviderCatalog(providerInventory) }
 	};
 }
-function text(value, max) {
-	const normalized = value.trim();
-	return normalized ? normalized.slice(0, max) : null;
-}
-function canonicalRuntimeEventTimestamp(value) {
-	let timestamp = new Date(value);
-	if (Number.isNaN(timestamp.getTime())) {
-		const legacyBsdNanoseconds = value.match(/^(.*:\d{2})\.\d+NZ$/);
-		timestamp = new Date(legacyBsdNanoseconds ? `${legacyBsdNanoseconds[1]}Z` : value);
-	}
-	if (Number.isNaN(timestamp.getTime())) throw new Error(`Invalid runtime event timestamp: ${value}`);
-	return timestamp.toISOString();
-}
 /** Spread onto an event: present only when the projection knows the turn. */
 function eventTurn(turnId) {
 	return turnId ? { turnId } : {};
@@ -98954,10 +99181,13 @@ function foldReportedUsage(reported) {
 * model, so a mid-thread switch used to republish a finished turn as a second
 * row for spend that happened once (FOR-36388, fixed in FOR-36438).
 */
-/** Turns named on this thread's own rows; hydrated replica rows carry no local turn. */
+/** Turns named on this thread's own rows; hydrated replica rows carry no local
+* turn, and the terminal-status activity (CMMD-Center/forge#3562 piece A) is
+* a wire-protocol source in its own right, not a Usage signal, so it is
+* excluded the same way a `replica.*` activity is. */
 function localTurnIds(thread) {
 	const fromMessages = thread.messages.filter((message) => !message.streaming).map((message) => message.turnId);
-	const fromActivities = thread.activities.filter((activity) => !activity.kind.startsWith("replica.")).map((activity) => activity.turnId);
+	const fromActivities = thread.activities.filter((activity) => !activity.kind.startsWith("replica.") && activity.kind !== "turn.terminal-status").map((activity) => activity.turnId);
 	const turnIds = /* @__PURE__ */ new Set();
 	for (const turnId of [...fromMessages, ...fromActivities]) if (turnId) turnIds.add(turnId);
 	return turnIds;
@@ -98967,8 +99197,12 @@ function settledTurnIds(thread) {
 	if (thread.latestTurn?.state === "running") turnIds.delete(thread.latestTurn.turnId);
 	return turnIds;
 }
+/** A turn's own activities for Usage derivation, excluding the terminal-status
+* activity: that record's own `createdAt` (the turn's very end) must never
+* shift `turnLatestAt`, or an already-acknowledged usage row would rehash
+* the moment a turn that used to have no terminal activity gains one. */
 function turnActivities(thread, turnId) {
-	return thread.activities.filter((activity) => activity.turnId === turnId).toSorted((left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id));
+	return thread.activities.filter((activity) => activity.turnId === turnId && activity.kind !== "turn.terminal-status").toSorted((left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id));
 }
 /** The last thing that happened in the turn: what the Recorded turn is stamped with. */
 function turnLatestAt(thread, turnId, activities) {
@@ -99177,6 +99411,10 @@ function serializeRuntimeThreadEvents(thread) {
 		const event = serializePlanActivity(activity);
 		return event === null ? [] : [event];
 	});
+	const turnTerminalStatuses = thread.activities.flatMap((activity) => {
+		const event = serializeTurnTerminalStatusActivity(activity);
+		return event === null ? [] : [event];
+	});
 	const recordedTurns = serializeRecordedTurns(thread);
 	const textGenerations = serializeTextGenerations(thread);
 	const priorEvents = [
@@ -99186,6 +99424,7 @@ function serializeRuntimeThreadEvents(thread) {
 		...worktreeLaunchActivities,
 		...planActivities,
 		...failureActivities,
+		...turnTerminalStatuses,
 		...recordedTurns,
 		...textGenerations
 	];
@@ -214176,73 +214415,6 @@ const makeCodexAdapter = require_Schema$1.fn("makeCodexAdapter")(function* (opti
 function makeCodexAdapterLive(options) {
 	return require_Schema$1.effect(CodexAdapter, makeCodexAdapter(options));
 }
-//#endregion
-//#region ../../packages/shared/src/publicProviderCopy.ts
-const PUBLIC_PROVIDER_LEAK_PATTERNS = [
-	/\bDeepSeek\b/i,
-	/\bKimi\b/i,
-	/\bMoonshot\b/i,
-	/\bdeepseek[-._a-z0-9]*\b/i,
-	/\bkimi[-._a-z0-9]*\b/i,
-	/\bmoonshot[-._a-z0-9]*\b/i,
-	/\bAPEX_API_KEY\b/,
-	/\bDEEPSEEK_API_KEY\b/,
-	/\bKIMI_API_KEY\b/,
-	/\bOPENAI_API_KEY\b/,
-	/\bANTHROPIC_API_KEY\b/,
-	/\bCURSOR_API_KEY\b/,
-	/\bOPENCODE_API_KEY\b/,
-	/\bforge_proxy_[A-Za-z0-9._-]+\b/,
-	/\bProviderValidationError\b/,
-	/\/forge-server\/node_modules\//,
-	/https?:\/\/[^\s'"<>)]*\/api\/provider-egress\/[^\s'"<>)]*/i,
-	/https?:\/\/[^\s'"<>)]*(?:apex|deepseek|moonshot|kimi)[^\s'"<>)]*/i
-];
-const DEFAULT_PUBLIC_PROVIDER_ERROR = "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
-function isProviderRateOrQuotaError(message) {
-	if (!message) return false;
-	const normalized = message.toLowerCase();
-	return /\b(rate[\s-]?limit|too\s+many\s+requests|usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/.test(normalized) || /\b429\b/.test(normalized);
-}
-function providerLifecycleOrAccountCopy(message) {
-	if (/\bbound to provider account\b/.test(message) && /\bcannot use provider account\b/.test(message)) return "Forge could not switch this conversation to the selected AI account. Retry the account switch.";
-	if (/\bforge_runtime_repairing\b/.test(message) || /\bthis turn was interrupted because the environment is being repaired\b/.test(message)) return "This turn was interrupted because the environment is being repaired. Retry after the repair finishes.";
-	if (/\bforge_runtime_stopped\b/.test(message) || /\bthis turn was interrupted because the environment was stopped\b/.test(message)) return "This turn was interrupted because the environment was stopped. Start the environment and retry.";
-	return null;
-}
-/**
-* Infer a SAFE, clearer failure category from a (possibly leaky) provider error.
-*
-* Returns a canned, user-facing message — it never echoes the raw input, so it
-* is safe to use even when the source message contains provider internals.
-* Used to give actionable feedback ("model isn't available", "rate-limited",
-* "auth failed") instead of the blanket "CMMD is temporarily unavailable."
-* Returns null when no category can be confidently inferred.
-*/
-function categorizePublicProviderError(message) {
-	if (!message) return null;
-	const m = message.toLowerCase();
-	const lifecycleOrAccountCopy = providerLifecycleOrAccountCopy(m);
-	if (lifecycleOrAccountCopy !== null) return lifecycleOrAccountCopy;
-	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
-	if (/\bmodel\b[\s\S]*\b(not\s+(found|available|supported)|does\s+not\s+exist|unsupported|invalid|unknown)\b/.test(m) || /\b(unsupported|unknown|invalid)\b[\s\S]*\bmodel\b/.test(m) || /\b(model_not_found|invalid_model|model_not_supported)\b/.test(m)) return "The selected model isn't available right now. Pick a different model and retry.";
-	if (isProviderRateOrQuotaError(m)) return "The AI service is rate-limited or out of quota. Wait a moment and retry.";
-	if (/_credential_reconnect_required\b/.test(m)) return "The workspace AI credential needs to be reconnected. Reconnect it in Settings > Providers, then retry.";
-	if (/\b(unauthorized|forbidden|authentication\s+(failed|error|required)|invalid\s+api\s+key|expired\s+(token|credential))\b/.test(m) || /\b40[13]\b/.test(m)) return "Workspace AI authentication failed. Reconnect the workspace and retry.";
-	if (/\b(timed?\s*out|timeout|overloaded|service\s+unavailable)\b/.test(m) || /\b50[234]\b/.test(m)) return "The AI service is temporarily overloaded. Retry in a moment.";
-	return null;
-}
-function containsPublicProviderLeak(message) {
-	if (!message) return false;
-	return PUBLIC_PROVIDER_LEAK_PATTERNS.some((pattern) => pattern.test(message));
-}
-function sanitizePublicProviderText(message, options = {}) {
-	if (message === void 0 || message === null) return null;
-	const trimmed = message.trim();
-	if (trimmed.length === 0) return null;
-	if (!containsPublicProviderLeak(trimmed)) return trimmed;
-	return categorizePublicProviderError(trimmed) ?? options.fallback ?? "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
-}
 function resolveApexBaseUrl(settings, config) {
 	return config?.forgeApexBaseUrl || settings.baseUrl || "https://apex.cmmd.ai";
 }
@@ -293037,52 +293209,6 @@ function applyThreadGoalPreamble(goal, input) {
 	return trimmedInput.length > 0 ? `${preamble}\n\n${trimmedInput}` : preamble;
 }
 //#endregion
-//#region src/orchestration/providerRetryableFailure.ts
-/**
-* Classifies a provider turn-start failure as a retryable rate-limit or
-* transient-availability failure (429/503), a terminal failure that names why
-* it will never clear on its own, or unrecognized (null).
-*
-* CMMD-Center/forge#3558: a 429 from CMMD's provider egress used to leave no
-* trace at all, because nothing in the turn-start path recognized it as a
-* distinct, retryable failure. `ProviderCommandReactor` uses this to decide
-* whether to retry a turn start with backoff, and to name the provider,
-* status and Retry-After in the `provider.turn.start.failed` activity CMMD's
-* watchdog reads once retries are exhausted.
-*
-* Reuses `isProviderRateOrQuotaError` (the same predicate the public-copy
-* sanitizer uses to recognize a rate-limit message) rather than restating its
-* word list here.
-*/
-const SERVICE_UNAVAILABLE_PATTERN = /\b(503|service\s+unavailable)\b/i;
-const RATE_LIMITED_PAST_TENSE_PATTERN = /\brate[\s-]?limit(?:ed|ing)?\b/i;
-const QUOTA_OR_USAGE_LIMIT_PATTERN = /\b(usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/i;
-const EXPLICIT_429_PATTERN = /\b429\b/;
-const RETRY_AFTER_SECONDS_PATTERN = /retry-after[^0-9]{0,10}(\d+)|(?:try again|retry)\s+in\s+(\d+)\s*(?:s\b|sec(?:onds?)?\b)?/i;
-function parseRetryAfterSeconds(detail) {
-	const match = detail.match(RETRY_AFTER_SECONDS_PATTERN);
-	if (!match) return null;
-	const raw = match[1] ?? match[2];
-	const seconds = raw ? Number(raw) : NaN;
-	return Number.isFinite(seconds) ? seconds : null;
-}
-function classifyRetryableProviderFailure(detail) {
-	if (!detail || detail.trim().length === 0) return null;
-	if (QUOTA_OR_USAGE_LIMIT_PATTERN.test(detail) && !EXPLICIT_429_PATTERN.test(detail)) return {
-		kind: "terminal",
-		reason: "quota",
-		message: detail
-	};
-	const isRateLimited = isProviderRateOrQuotaError(detail) || RATE_LIMITED_PAST_TENSE_PATTERN.test(detail);
-	const isUnavailable = SERVICE_UNAVAILABLE_PATTERN.test(detail);
-	if (!isRateLimited && !isUnavailable) return null;
-	return {
-		kind: "retryable",
-		status: isRateLimited ? 429 : 503,
-		retryAfterSeconds: parseRetryAfterSeconds(detail)
-	};
-}
-//#endregion
 //#region src/orchestration/Layers/ProviderCommandReactor.ts
 function toNonEmptyProviderInput(value) {
 	const normalized = value?.trim();
@@ -295260,12 +295386,62 @@ const make$6 = require_Schema$1.gen(function* () {
 			createdAt: input.createdAt
 		});
 	});
+	/**
+	* The one durable, deterministic-id activity that records how a turn ended
+	* (CMMD-Center/forge#3562 piece A, CMMD-Center/CMMD#5822): `completed`,
+	* `interrupted` (an abort or a provider cancellation), or `failed` with the
+	* provider's own error message. Recorded here, ahead of every
+	* checkpoint-specific early return below, so it fires for every turn
+	* regardless of whether this workspace can capture a git checkpoint at
+	* all -- unlike a checkpoint, this never depends on `resolveCheckpointCwd`.
+	*
+	* The activity id is derived from the turn id, never `crypto.randomUUID()`,
+	* so a redelivered `turn.completed` for the same turn replaces the same
+	* row rather than adding a second one. The guard below additionally
+	* refuses to touch a turn that already has one: first write wins, so a
+	* later, different signal for the same turn can never overwrite an
+	* outcome CMMD may already have acknowledged.
+	*
+	* Deriving the wire `turn_status` event from a new activity recorded at
+	* the moment the turn actually ends -- not from `thread.latestTurn` or
+	* `thread.checkpoints`, both of which already hold outcomes for turns that
+	* settled before this shipped -- is deliberate: those would insert a brand
+	* new event into history CMMD already acknowledged for every existing
+	* thread, which `RuntimeThreadHistoryConflict` exists specifically to
+	* reject (CMMD-Center/forge#3497). A turn that settled before this shipped
+	* gets no terminal event; only a turn that ends after it does.
+	*/
+	const recordTurnTerminalStatus = require_Schema$1.fn("recordTurnTerminalStatus")(function* (event, thread, turnId) {
+		const activityId = turnTerminalStatusActivityId(turnId);
+		if (thread.activities.some((activity) => activity.id === activityId)) return;
+		const outcome = turnTerminalOutcomeFromRuntimeState(event.payload.state);
+		const recordedAt = (/* @__PURE__ */ new Date()).toISOString();
+		yield* orchestrationEngine.dispatch({
+			type: "thread.activity.append",
+			commandId: serverCommandId$1("turn-terminal-status"),
+			threadId: event.threadId,
+			activity: {
+				id: EventId.make(activityId),
+				tone: outcome === "failed" ? "error" : "info",
+				kind: TURN_TERMINAL_STATUS_ACTIVITY_KIND,
+				summary: `Turn ${outcome}`,
+				payload: {
+					outcome,
+					...outcome === "failed" && event.payload.errorMessage ? { errorMessage: event.payload.errorMessage } : {}
+				},
+				turnId,
+				createdAt: recordedAt
+			},
+			createdAt: recordedAt
+		});
+	});
 	const captureCheckpointFromTurnCompletion = require_Schema$1.fn("captureCheckpointFromTurnCompletion")(function* (event) {
 		const turnId = toTurnId(event.turnId);
 		if (!turnId) return;
 		const readModel = yield* orchestrationEngine.getReadModel();
 		const thread = readModel.threads.find((entry) => entry.id === event.threadId);
 		if (!thread) return;
+		yield* recordTurnTerminalStatus(event, thread, turnId);
 		if (thread.session?.activeTurnId && !sameId(thread.session.activeTurnId, turnId)) return;
 		if (thread.checkpoints.some((checkpoint) => checkpoint.turnId === turnId && checkpoint.status !== "missing")) return;
 		const checkpointCwd = yield* resolveCheckpointCwd({
@@ -300054,7 +300230,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "96780e9bb987ecd23f530709589bda1b4b5791e5";
+	return "af7d46dcc7bdd81e6994e3590d9fca779411f1c4";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;