@cmmd-center/forge 0.14.1 → 0.14.2

package/dist/bin.cjs

@@ -27136,14 +27136,15 @@ function nonEmptyString$3(value) {
 }
 /**
 * Resolve the operational Sprite name for provision / connect / readiness gates.
+* Only the authoritative `spriteName` counts: missing, empty, and explicit-null
+* values all resolve to null.
 *
-* @see CmmdRuntimeSpriteIdentitySource for the dual-contract rules.
+* @see CmmdRuntimeSpriteIdentitySource for the identity rules.
 */
 function resolveCmmdRuntimeSpriteName(runtime) {
-	if (Object.hasOwn(runtime, "spriteName")) return nonEmptyString$3(runtime.spriteName);
-	return nonEmptyString$3(runtime.flyMachineId);
+	return nonEmptyString$3(runtime.spriteName);
 }
-/** True when the payload carries an operational Sprite name after dual-read. */
+/** True when the payload carries an authoritative Sprite name. */
 function hasCmmdRuntimeSpriteIdentity(runtime) {
 	return resolveCmmdRuntimeSpriteName(runtime) !== null;
 }
@@ -27218,7 +27219,8 @@ const WORKTREE_LAUNCH_ACTIVITY_KINDS = new Set([
 	"setup-script.skipped",
 	"setup-script.failed",
 	"launch.agent-starting",
-	"launch.cancelled"
+	"launch.cancelled",
+	"checkout-launch"
 ]);
 function encodeCmmdRuntimeWorktreeLaunchActivityPayload(kind, payload) {
 	return {
@@ -27272,6 +27274,258 @@ function decodeCmmdRuntimePlanActivity(payload) {
 	};
 }
 //#endregion
+//#region ../../packages/contracts/src/checkoutLaunch.ts
+/**
+* One Checkout launch snapshot for a thread.
+*
+* Upstream (`pingdotgg/t3code`, WorktreeSetupTracker) owns this shape: one
+* snapshot, fixed activity id, handoff when the agent stage is done and the
+* turn has started. Forge keeps its own stage names. The admission wait is
+* the first stage of this same snapshot, because a shared Environment can be
+* busy before any Checkout activity exists.
+*/
+const CHECKOUT_LAUNCH_ACTIVITY_KIND = "checkout-launch";
+const PREPARATION_STAGES = [
+	{
+		id: "resolve",
+		label: "Resolve base branch"
+	},
+	{
+		id: "checkout",
+		label: "Check out files"
+	},
+	{
+		id: "dependencies",
+		label: "Prepare dependencies"
+	},
+	{
+		id: "setup",
+		label: "Start setup script"
+	},
+	{
+		id: "agent",
+		label: "Start agent"
+	}
+];
+function checkoutLaunchActivityId(threadId) {
+	return `checkout-launch:${threadId}`;
+}
+function preparationStages(statusFor, detailFor = () => null) {
+	return PREPARATION_STAGES.map((stage) => ({
+		id: stage.id,
+		label: stage.label,
+		status: statusFor(stage.id),
+		detail: detailFor(stage.id)
+	}));
+}
+function beginPreparationCheckoutLaunch(input) {
+	return {
+		phase: "running",
+		stages: preparationStages((id) => id === "resolve" ? "running" : "pending"),
+		startedAt: input.startedAt,
+		completedAt: null,
+		error: null,
+		cancellable: true,
+		worktreePath: input.worktreePath ?? null,
+		turnStartedAt: null
+	};
+}
+function replaceStage(snapshot, id, patch) {
+	return {
+		...snapshot,
+		stages: snapshot.stages.map((stage) => stage.id === id ? {
+			...stage,
+			...patch
+		} : stage)
+	};
+}
+function ensurePreparation(snapshot, startedAt) {
+	if (snapshot && snapshot.stages.some((stage) => stage.id === "resolve")) return snapshot;
+	return beginPreparationCheckoutLaunch({
+		startedAt: snapshot?.startedAt ?? startedAt,
+		worktreePath: snapshot?.worktreePath ?? null
+	});
+}
+function settlePhase(snapshot) {
+	if (snapshot.phase === "failed" || snapshot.phase === "cancelled") return snapshot;
+	const agent = snapshot.stages.find((stage) => stage.id === "agent");
+	const setup = snapshot.stages.find((stage) => stage.id === "setup");
+	const agentDone = agent?.status === "done" && snapshot.turnStartedAt !== null;
+	const setupStillRunning = setup?.status === "running";
+	if (!agentDone || setupStillRunning) return snapshot;
+	return {
+		...snapshot,
+		phase: "done",
+		completedAt: snapshot.completedAt ?? snapshot.turnStartedAt,
+		cancellable: false
+	};
+}
+function payloadString(payload, key) {
+	const value = payload?.[key];
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+function payloadNumber(payload, key) {
+	const value = payload?.[key];
+	return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+const STAGE_IDS = new Set([
+	"resolve",
+	"checkout",
+	"dependencies",
+	"setup",
+	"agent"
+]);
+const STAGE_STATUSES = new Set([
+	"done",
+	"failed",
+	"skipped",
+	"running"
+]);
+const LAUNCH_FAILING_STAGES = new Set([
+	"resolve",
+	"checkout",
+	"dependencies"
+]);
+function stageIdFromPayload(payload) {
+	const id = payloadString(payload, "id") ?? payloadString(payload, "stage");
+	return id !== null && STAGE_IDS.has(id) ? id : null;
+}
+function stageStatus(status) {
+	return status !== null && STAGE_STATUSES.has(status) ? status : "running";
+}
+function applyStage(snapshot, event) {
+	const id = stageIdFromPayload(event.payload);
+	if (!id) return snapshot;
+	snapshot = ensurePreparation(snapshot, event.createdAt);
+	const nextStatus = stageStatus(payloadString(event.payload, "status"));
+	const percent = payloadNumber(event.payload, "percent");
+	const detail = percent !== null ? `${Math.round(percent)}%` : payloadString(event.payload, "detail");
+	const next = replaceStage(snapshot, id, {
+		status: nextStatus,
+		detail
+	});
+	if (nextStatus !== "failed" || !LAUNCH_FAILING_STAGES.has(id)) return next;
+	return {
+		...next,
+		phase: "failed",
+		error: event.summary ?? next.error,
+		completedAt: event.createdAt,
+		cancellable: false
+	};
+}
+/**
+* Fold one launch activity into the snapshot. A recorded `checkout-launch`
+* payload replaces the snapshot. Older per-step activities still fold so a
+* thread that never received the snapshot does not go blank.
+*/
+function reduceCheckoutLaunch(snapshot, event) {
+	if (event.kind === "checkout-launch") return readCheckoutLaunchSnapshot(event) ?? snapshot;
+	if (event.kind === "worktree.requested") return beginPreparationCheckoutLaunch({
+		startedAt: snapshot?.startedAt ?? event.createdAt,
+		worktreePath: payloadString(event.payload, "worktreePath") ?? snapshot?.worktreePath ?? null
+	});
+	if (!snapshot && event.kind !== "worktree.stage" && event.kind !== "worktree.failed") snapshot = beginPreparationCheckoutLaunch({ startedAt: event.createdAt });
+	if (!snapshot) return snapshot;
+	return CHECKOUT_LAUNCH_EVENT_HANDLERS[event.kind]?.(snapshot, event) ?? snapshot;
+}
+function setSetup(snapshot, event, status, detail) {
+	return replaceStage(ensurePreparation(snapshot, event.createdAt), "setup", {
+		status,
+		detail
+	});
+}
+function applyCreated(snapshot, event) {
+	return {
+		...snapshot,
+		worktreePath: payloadString(event.payload, "worktreePath") ?? snapshot.worktreePath
+	};
+}
+function applyOutput(snapshot, event) {
+	const detail = payloadString(event.payload, "detail") ?? event.summary ?? null;
+	const match = detail ? /Updating files:\s+(\d+)%/.exec(detail) : null;
+	if (!match) return snapshot;
+	return replaceStage(ensurePreparation(snapshot, event.createdAt), "checkout", {
+		status: "running",
+		detail: `${match[1]}%`
+	});
+}
+function applyAgentStarting(snapshot, event) {
+	const prepared = ensurePreparation(snapshot, event.createdAt);
+	return {
+		...replaceStage(event.payload?.setupRequested === false ? setSetup(prepared, event, "skipped", "Not requested") : prepared, "agent", {
+			status: "running",
+			detail: event.summary ?? "Starting agent"
+		}),
+		cancellable: false
+	};
+}
+function applyFailed(snapshot, event) {
+	snapshot = ensurePreparation(snapshot, event.createdAt);
+	const detail = payloadString(event.payload, "detail") ?? event.summary ?? snapshot.error;
+	const running = snapshot.stages.find((stage) => stage.status === "running");
+	return {
+		...running ? replaceStage(snapshot, running.id, {
+			status: "failed",
+			detail
+		}) : snapshot,
+		phase: "failed",
+		error: detail ?? "Checkout launch failed",
+		completedAt: event.createdAt,
+		cancellable: false
+	};
+}
+function applyCancelled(snapshot, event) {
+	return {
+		...snapshot,
+		phase: "cancelled",
+		error: event.summary ?? "Launch cancelled",
+		completedAt: event.createdAt,
+		cancellable: false
+	};
+}
+const CHECKOUT_LAUNCH_EVENT_HANDLERS = {
+	"worktree.stage": applyStage,
+	"worktree.created": applyCreated,
+	"worktree.output": applyOutput,
+	"setup-script.skipped": (snapshot, event) => setSetup(snapshot, event, "skipped", event.summary ?? "No setup script configured"),
+	"setup-script.running": (snapshot, event) => setSetup(snapshot, event, "running", event.summary ?? null),
+	"setup-script.started": (snapshot, event) => setSetup(snapshot, event, "done", event.summary ?? "Running in terminal"),
+	"setup-script.completed": (snapshot, event) => setSetup(snapshot, event, "done", event.summary ?? null),
+	"setup-script.failed": (snapshot, event) => setSetup(snapshot, event, "failed", event.summary ?? "Setup script failed"),
+	"launch.agent-starting": applyAgentStarting,
+	"worktree.failed": applyFailed,
+	"launch.cancelled": applyCancelled
+};
+function withCheckoutLaunchTurnStarted(snapshot, turnStartedAt) {
+	if (!turnStartedAt) return snapshot;
+	const agent = snapshot.stages.find((stage) => stage.id === "agent");
+	return settlePhase({
+		...agent && (agent.status === "running" || agent.status === "done") ? replaceStage(snapshot, "agent", {
+			status: "done",
+			detail: agent.detail
+		}) : snapshot,
+		turnStartedAt
+	});
+}
+function readCheckoutLaunchSnapshot(activity) {
+	if (activity.kind !== "checkout-launch") return null;
+	const payload = activity.payload;
+	if (!payload || typeof payload !== "object") return null;
+	const record = payload;
+	if (record.phase !== "running" && record.phase !== "done" && record.phase !== "failed" && record.phase !== "cancelled") return null;
+	if (!Array.isArray(record.stages) || typeof record.startedAt !== "string") return null;
+	return {
+		phase: record.phase,
+		stages: record.stages,
+		startedAt: record.startedAt,
+		completedAt: record.completedAt ?? null,
+		error: record.error ?? null,
+		cancellable: record.cancellable === true,
+		worktreePath: record.worktreePath ?? null,
+		turnStartedAt: record.turnStartedAt ?? null
+	};
+}
+//#endregion
 //#region ../../packages/contracts/src/cmmdProjectPatch.ts
 const CMMD_PROJECT_PATCH_FIELDS = {
 	title: "requiredText",
@@ -66433,7 +66687,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.14.1";
+var version$1 = "0.14.2";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -66719,6 +66973,12 @@ function deriveAuthClientMetadata(input) {
 * Hosts a PaaS assigns automatically. They are reachable, but they are not the
 * domain the product is registered under, so they must never end up in an OAuth
 * `redirect_uri`.
+*
+* The hosted web channels (forge#3557) are the deliberate exception: their
+* `.up.railway.app` hosts ARE product surfaces, the operator enumerates them in
+* `FORGE_WEB_CHANNEL_ORIGINS`, and CMMD's `cmmd-forge-web` OAuth client lists
+* their callback URIs as registered redirect URIs. Every other platform host
+* stays excluded.
 */
 const PLATFORM_DEFAULT_HOST_SUFFIXES = [".up.railway.app"];
 function isPlatformDefaultHost(hostname) {
@@ -66757,6 +67017,41 @@ function resolveForgePublicUrl(env = process.env) {
 	if (canonicalDomain.toLowerCase() === configuredHost.toLowerCase()) return configured;
 	return `https://${canonicalDomain}`.replace(/\/$/, "");
 }
+/**
+* Hosted web channel origins (forge#3557) allowed to complete OAuth against
+* this server, from `FORGE_WEB_CHANNEL_ORIGINS`.
+*
+* The channels serve the web bundle from their own domains and forward `/api`
+* here with `x-forwarded-host` set to the channel host. Login must build its
+* `redirect_uri` from that host, or CMMD's authorize round-trip returns the
+* browser to `FORGE_PUBLIC_URL` — an origin where the login's state and PKCE
+* cookies do not exist. Because anything on the internet can also send this
+* server an `x-forwarded-host` header, the accepted hosts are never inferred
+* from the request: the operator enumerates the exact channel origins, and
+* only those count.
+*
+* Entries are comma-separated origins (`https://host[:port]`); a bare hostname
+* assumes https. Every entry normalizes to its URL origin, so stray path,
+* query, or userinfo components never reach a redirect URI. Whitespace,
+* trailing slashes, and unparseable entries are dropped.
+*/
+function resolveForgeWebChannelOrigins(env = process.env) {
+	return (env.FORGE_WEB_CHANNEL_ORIGINS ?? "").split(",").map((entry) => entry.trim().replace(/\/+$/, "")).filter((entry) => entry.length > 0).map((entry) => entry.includes("://") ? entry : `https://${entry}`).filter((entry) => URL.canParse(entry)).map((entry) => new URL(entry).origin).filter((origin) => origin !== "null");
+}
+/**
+* The allowlisted channel origin for a forwarded host, or null when the host
+* is not one. Matching is on the URL host — hostname plus explicit port — so
+* an entry with a port only matches that exact host:port, and a lookalike or
+* suffix host never matches. The returned origin is the operator's registered
+* form, scheme included, so it is exactly the redirect URI CMMD's client
+* registry holds.
+*/
+function matchForgeWebChannelOrigin(forwardedHost, env = process.env) {
+	const candidate = forwardedHost.trim().toLowerCase();
+	if (!candidate) return null;
+	for (const origin of resolveForgeWebChannelOrigins(env)) if (new URL(origin).host.toLowerCase() === candidate) return origin;
+	return null;
+}
 function forgeConfiguredPublicUrl() {
 	return resolveForgePublicUrl();
 }
@@ -66798,7 +67093,11 @@ function forgePublicUrlForRequest(request) {
 	const forwardedHost = normalizeForwardedHeaderValue(request.headers["x-forwarded-host"]);
 	const forwardedProto = normalizeForwardedHeaderValue(request.headers["x-forwarded-proto"]) ?? "https";
 	if (forwardedHost && (isLoopbackOAuthHost(forwardedHost) || isPrivateDevOAuthHost(forwardedHost))) return `${forwardedProto === "https" ? "https" : "http"}://${forwardedHost}`.replace(/\/$/, "");
-	if (forwardedHost) return forgeConfiguredPublicUrl();
+	if (forwardedHost) {
+		const channelOrigin = matchForgeWebChannelOrigin(forwardedHost);
+		if (channelOrigin) return channelOrigin;
+		return forgeConfiguredPublicUrl();
+	}
 	const directHost = normalizeForwardedHeaderValue(request.headers["host"]);
 	if (directHost && (isLoopbackOAuthHost(directHost) || isPrivateDevOAuthHost(directHost))) return `http://${directHost}`.replace(/\/$/, "");
 	return forgeConfiguredPublicUrl();
@@ -70750,6 +71049,19 @@ function createCloudflareTurnIceServerResolver(options) {
 }
 //#endregion
 //#region src/http.ts
+/**
+* What the catch-all does with a non-API GET. A managed cloud surface is
+* runtime-only no matter what files exist on disk — the web client's single
+* home is the static channels (forge#3567) — while a local server either
+* serves its bundle or reports itself unconfigured.
+*/
+function resolveWebServingOutcome(input) {
+	if (input.managedCloudSurface) return { kind: "runtime-only" };
+	return input.staticDir ? {
+		kind: "serve",
+		staticDir: input.staticDir
+	} : { kind: "unconfigured" };
+}
 const PROJECT_FAVICON_CACHE_CONTROL = "public, max-age=3600";
 const PROJECT_FAVICON_MISS_CACHE_CONTROL = "public, max-age=300";
 /**
@@ -71012,8 +71324,16 @@ const staticAndDevRouteLayer = add$1("GET", "*", require_Schema$1.gen(function*
 	}, { status: 404 });
 	const config = yield* ServerConfig;
 	if (config.devUrl && isLoopbackHostname(url.value.hostname)) return require_HttpServer.redirect(resolveDevRedirectUrl(config.devUrl, url.value), { status: 302 });
-	const staticDir = config.staticDir ?? (config.devUrl ? yield* resolveStaticDir() : void 0);
-	if (!staticDir) return require_HttpServer.text("No static directory configured and no dev URL set.", { status: 503 });
+	const outcome = resolveWebServingOutcome({
+		staticDir: config.staticDir ?? (config.devUrl ? yield* resolveStaticDir() : void 0),
+		managedCloudSurface: (config.forgeCloudShellMode ?? false) || (config.forgeCmmdRuntimeMode ?? false)
+	});
+	if (outcome.kind === "runtime-only") return require_HttpServer.jsonUnsafe({
+		error: "not_found",
+		message: "This server does not serve the web client."
+	}, { status: 404 });
+	if (outcome.kind === "unconfigured") return require_HttpServer.text("No static directory configured and no dev URL set.", { status: 503 });
+	const staticDir = outcome.staticDir;
 	const fileSystem = yield* require_Path.FileSystem;
 	const path = yield* require_Path.Path;
 	const staticRoot = path.resolve(staticDir);
@@ -88846,7 +89166,7 @@ function refreshForgeManagedGitHubRemoteCredentials(input, dependencies = {
 			}));
 			isCacheManaged = helper.code === 0 && helper.stdout.includes("cache");
 		}
-		if (!isEmbedded && !isCacheManaged) return {
+		if (!isEmbedded && !isCacheManaged && !input.allowUnmanagedRemote) return {
 			status: 200,
 			body: {
 				refreshed: false,
@@ -94548,6 +94868,37 @@ const toBootstrapDispatchCommandCauseError = (cause) => {
 	});
 };
 const bootstrapCommandId = (command, stage) => CommandId.make(`server:${stage}:${command.commandId}`);
+const publishCheckoutLaunchSnapshot = (input) => input.orchestrationEngine.dispatch({
+	type: "thread.activity.append",
+	commandId: CommandId.make(`server:checkout-launch:${crypto.randomUUID()}`),
+	threadId: input.threadId,
+	activity: {
+		id: EventId.make(checkoutLaunchActivityId(input.threadId)),
+		tone: input.snapshot.phase === "failed" ? "error" : "info",
+		kind: CHECKOUT_LAUNCH_ACTIVITY_KIND,
+		summary: "Checkout launch",
+		payload: input.snapshot,
+		turnId: null,
+		createdAt: input.createdAt
+	},
+	createdAt: input.createdAt
+});
+const recordCheckoutLaunchEvent = (input) => {
+	const next = reduceCheckoutLaunch(input.launch.snapshot, {
+		kind: input.kind,
+		createdAt: input.createdAt,
+		summary: input.summary,
+		payload: input.payload
+	});
+	input.launch.snapshot = next;
+	if (!next) return require_Schema$1.void_;
+	return publishCheckoutLaunchSnapshot({
+		orchestrationEngine: input.orchestrationEngine,
+		threadId: input.threadId,
+		snapshot: next,
+		createdAt: input.createdAt
+	});
+};
 const appendSetupScriptActivity = (input) => input.orchestrationEngine.dispatch({
 	type: "thread.activity.append",
 	commandId: input.commandId,
@@ -94562,7 +94913,15 @@ const appendSetupScriptActivity = (input) => input.orchestrationEngine.dispatch(
 		createdAt: input.createdAt
 	},
 	createdAt: input.createdAt
-});
+}).pipe(require_Schema$1.andThen(() => recordCheckoutLaunchEvent({
+	orchestrationEngine: input.orchestrationEngine,
+	threadId: input.threadId,
+	launch: input.launch,
+	kind: input.kind,
+	summary: input.summary,
+	createdAt: input.createdAt,
+	payload: input.payload
+})));
 const appendWorktreeActivity = (input) => input.orchestrationEngine.dispatch({
 	type: "thread.activity.append",
 	commandId: input.commandId,
@@ -94577,7 +94936,15 @@ const appendWorktreeActivity = (input) => input.orchestrationEngine.dispatch({
 		createdAt: input.createdAt
 	},
 	createdAt: input.createdAt
-});
+}).pipe(require_Schema$1.andThen(() => recordCheckoutLaunchEvent({
+	orchestrationEngine: input.orchestrationEngine,
+	threadId: input.threadId,
+	launch: input.launch,
+	kind: input.kind,
+	summary: input.summary,
+	createdAt: input.createdAt,
+	payload: input.payload
+})));
 const truncateBootstrapOutputLine = (line) => {
 	const trimmed = line.trim();
 	if (trimmed.length <= MAX_BOOTSTRAP_OUTPUT_LINE_LENGTH) return trimmed;
@@ -94687,9 +95054,11 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 		summary: "Creating worktree",
 		createdAt: requestedAt,
 		payload: requestedPayload,
-		tone: "info"
+		tone: "info",
+		launch: input.launch
 	});
 	if (bootstrapWorktree.startFromOrigin) {
+		if (input.refreshSourceControlCredentials) yield* input.refreshSourceControlCredentials(projectCwd);
 		if (!input.git.fetch) return yield* require_Schema$1.fail(/* @__PURE__ */ new Error("Git fetch is unavailable for origin worktree preparation."));
 		yield* input.git.fetch({
 			cwd: projectCwd,
@@ -94711,7 +95080,8 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 					detail,
 					stage: "fetch"
 				},
-				tone: "error"
+				tone: "error",
+				launch: input.launch
 			}).pipe(require_Schema$1.andThen(require_Schema$1.failCause(cause)));
 		}));
 	}
@@ -94729,7 +95099,8 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 			summary: "Preparing worktree",
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 			payload: update,
-			tone: "info"
+			tone: "info",
+			launch: input.launch
 		}).pipe(require_Schema$1.asVoid, require_Schema$1.ignore),
 		progress: {
 			onStdoutLine: (line) => {
@@ -94747,7 +95118,8 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 						stream: "stdout",
 						detail
 					},
-					tone: "info"
+					tone: "info",
+					launch: input.launch
 				}).pipe(require_Schema$1.asVoid, require_Schema$1.ignore);
 			},
 			onStderrLine: (line) => {
@@ -94765,7 +95137,8 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 						stream: "stderr",
 						detail
 					},
-					tone: "info"
+					tone: "info",
+					launch: input.launch
 				}).pipe(require_Schema$1.asVoid, require_Schema$1.ignore);
 			}
 		}
@@ -94784,7 +95157,8 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 				...requestedPayload,
 				detail
 			},
-			tone: "error"
+			tone: "error",
+			launch: input.launch
 		}).pipe(require_Schema$1.andThen(require_Schema$1.failCause(cause)));
 	}));
 	const worktreePath = worktree.worktree.path;
@@ -94808,7 +95182,8 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 			worktreePath,
 			checkedOutBranch: worktree.worktree.branch
 		},
-		tone: "info"
+		tone: "info",
+		launch: input.launch
 	});
 	return {
 		worktreePath,
@@ -94824,6 +95199,7 @@ const dispatchBootstrapTurnStart$1 = (input, command) => require_Schema$1.gen(fu
 	let targetProjectCwd = bootstrap?.prepareWorktree?.projectCwd;
 	let targetWorktreePath = bootstrap?.createThread?.worktreePath ?? null;
 	let worktreeFailureReported = false;
+	const launch = { snapshot: null };
 	const cleanupCreatedThread = () => createdThread && !worktreeFailureReported ? orchestrationEngine.dispatch({
 		type: "thread.delete",
 		commandId: bootstrapCommandId(command, "bootstrap-thread-delete"),
@@ -94842,7 +95218,8 @@ const dispatchBootstrapTurnStart$1 = (input, command) => require_Schema$1.gen(fu
 				detail,
 				worktreePath: record.worktreePath
 			},
-			tone: "error"
+			tone: "error",
+			launch
 		}).pipe(require_Schema$1.ignoreCause({ log: false }), require_Schema$1.flatMap(() => require_Schema$1.logWarning("bootstrap turn start failed to launch setup script", {
 			threadId: command.threadId,
 			worktreePath: record.worktreePath,
@@ -94864,7 +95241,8 @@ const dispatchBootstrapTurnStart$1 = (input, command) => require_Schema$1.gen(fu
 			summary: "Starting setup script",
 			createdAt: record.requestedAt,
 			payload,
-			tone: "info"
+			tone: "info",
+			launch
 		}), appendSetupScriptActivity({
 			orchestrationEngine,
 			threadId: command.threadId,
@@ -94873,7 +95251,8 @@ const dispatchBootstrapTurnStart$1 = (input, command) => require_Schema$1.gen(fu
 			summary: "Setup script started",
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 			payload,
-			tone: "info"
+			tone: "info",
+			launch
 		})]).pipe(require_Schema$1.asVoid, require_Schema$1.catch_((error) => require_Schema$1.logWarning("bootstrap turn start launched setup script but failed to record setup activity", {
 			threadId: command.threadId,
 			worktreePath: record.worktreePath,
@@ -94905,7 +95284,8 @@ const dispatchBootstrapTurnStart$1 = (input, command) => require_Schema$1.gen(fu
 					summary: "No setup script configured",
 					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 					payload: {},
-					tone: "info"
+					tone: "info",
+					launch
 				}).pipe(require_Schema$1.asVoid, require_Schema$1.ignore);
 				return recordSetupScriptStarted({
 					requestedAt,
@@ -94926,7 +95306,9 @@ const dispatchBootstrapTurnStart$1 = (input, command) => require_Schema$1.gen(fu
 			orchestrationEngine,
 			git,
 			gitStatusBroadcaster,
-			command
+			...input.refreshSourceControlCredentials ? { refreshSourceControlCredentials: input.refreshSourceControlCredentials } : {},
+			command,
+			launch
 		}).pipe(require_Schema$1.catchCause((cause) => {
 			if (!require_Schema$1.hasInterruptsOnly(cause)) worktreeFailureReported = true;
 			return require_Schema$1.failCause(cause);
@@ -94944,10 +95326,22 @@ const dispatchBootstrapTurnStart$1 = (input, command) => require_Schema$1.gen(fu
 			summary: "Starting agent",
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 			payload: { setupRequested: bootstrap.runSetupScript === true },
-			tone: "info"
+			tone: "info",
+			launch
 		}).pipe(require_Schema$1.ignore);
 		sealBootstrapCommand(orchestrationEngine, command.commandId);
-		return yield* orchestrationEngine.dispatch(finalTurnStartCommand);
+		const started = yield* orchestrationEngine.dispatch(finalTurnStartCommand);
+		if (launch.snapshot && bootstrap?.prepareWorktree) {
+			const settledAt = (/* @__PURE__ */ new Date()).toISOString();
+			launch.snapshot = withCheckoutLaunchTurnStarted(launch.snapshot, settledAt);
+			yield* publishCheckoutLaunchSnapshot({
+				orchestrationEngine,
+				threadId: command.threadId,
+				snapshot: launch.snapshot,
+				createdAt: settledAt
+			}).pipe(require_Schema$1.ignore);
+		}
+		return started;
 	});
 	return yield* runBootstrapCommand(orchestrationEngine, command.commandId, bootstrapProgram.pipe(require_Schema$1.onInterrupt(() => appendWorktreeActivity({
 		orchestrationEngine,
@@ -94957,7 +95351,8 @@ const dispatchBootstrapTurnStart$1 = (input, command) => require_Schema$1.gen(fu
 		summary: "Launch cancelled",
 		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 		payload: {},
-		tone: "info"
+		tone: "info",
+		launch
 	}).pipe(require_Schema$1.ignore)), require_Schema$1.catchCause((cause) => {
 		const dispatchError = toBootstrapDispatchCommandCauseError(cause);
 		if (require_Schema$1.hasInterruptsOnly(cause)) return require_Schema$1.fail(dispatchError);
@@ -291634,6 +292029,21 @@ function readProviderAccountId(selection) {
 	return "providerAccountId" in selection ? selection.providerAccountId : void 0;
 }
 //#endregion
+//#region src/orchestration/expiredProviderEgressToken.ts
+const EXPIRED_PROVIDER_EGRESS_TOKEN = "Provider egress token is invalid or expired";
+/**
+* The CMMD egress authorizer uses this sentence for a token it will not
+* accept. A workspace reconnect 401 is a different failure and must not
+* take this path.
+*
+* The token lives in the provider process environment. Stopping that process
+* lets the next session start mint a new one. A later send of this same turn
+* delivers the user message a second time, so the recovery stops at the session.
+*/
+function isExpiredProviderEgressTokenError(message) {
+	return typeof message === "string" && message.includes(EXPIRED_PROVIDER_EGRESS_TOKEN);
+}
+//#endregion
 //#region src/persistence/Layers/ProjectionTurns.ts
 const ProjectionTurnDbRowSchema = ProjectionTurn.mapFields(require_Schema$1.assign({
 	checkpointFiles: require_Schema$1.fromJsonString(require_Schema$1.ArraySchema(OrchestrationCheckpointFile)),
@@ -293528,6 +293938,7 @@ const make$8 = require_Schema$1.fn("make")(function* () {
 	const handleRuntimeError = require_Schema$1.fn("handleRuntimeError")(function* (event, thread, eventTurnId, activeTurnId) {
 		if (event.type !== "runtime.error") return;
 		if (!shouldApplyRuntimeErrorEvent(activeTurnId, eventTurnId)) return;
+		if (isExpiredProviderEgressTokenError(event.payload.message)) yield* providerService.stopSession({ threadId: thread.id }).pipe(require_Schema$1.catchCause(() => require_Schema$1.void_));
 		yield* orchestrationEngine.dispatch({
 			type: "thread.session.set",
 			commandId: providerCommandId(event, "runtime-error-session-set"),
@@ -301215,7 +301626,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "c541d41e992712a7ab25a9ae28ee5e3815e77426";
+	return "a00cf0b653c5ad41933b286a3f108c74a8b61780";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -310454,6 +310865,26 @@ function readNonEmptyString(value) {
 //#region src/orchestration/http.ts
 const DISPATCH_CAUSE_DETAIL_LIMIT = 500;
 const DISPATCH_CAUSE_MAX_DEPTH = 8;
+const resolveBootstrapGithubAuth = (input) => {
+	const runtimeGrantAuth = resolveRuntimeGitHubGrantAuth(input.config, input.headers);
+	return runtimeGrantAuth ? require_Schema$1.succeed(runtimeGrantAuth) : resolveCmmdJwtForSession({
+		sessionId: input.session.sessionId,
+		subject: input.session.subject,
+		logPrefix: "bootstrap-github"
+	});
+};
+const refreshBootstrapSourceControlCredentials = (input) => require_Schema$1.gen(function* () {
+	if (!input.auth) return yield* require_Schema$1.fail(/* @__PURE__ */ new Error("CMMD GitHub authorization is unavailable for Work Session bootstrap."));
+	const result = yield* refreshForgeManagedGitHubRemoteCredentials({
+		cwd: input.cwd,
+		auth: typeof input.auth === "object" ? input.auth : {
+			kind: "cmmd-jwt",
+			jwt: input.auth
+		},
+		allowUnmanagedRemote: true
+	}, void 0, input.forgeGitCredentialCache ? "cache" : "embed");
+	if (result.status >= 400) return yield* require_Schema$1.fail(new Error(typeof result.body.error === "string" ? result.body.error : "CMMD GitHub authorization failed for Work Session bootstrap."));
+});
 /**
 * Render the underlying failure of a dispatch refusal as a single line.
 *
@@ -310894,7 +311325,9 @@ const orchestrationSnapshotRouteLayer = add$1("GET", "/api/orchestration/snapsho
 	return require_HttpServer.jsonUnsafe(snapshot, { status: 200 });
 }).pipe(require_Schema$1.catchTag("AuthError", respondToOrchestrationAuthError), require_Schema$1.catchTag("OrchestrationGetSnapshotError", respondToOrchestrationHttpError)));
 const orchestrationDispatchRouteLayer = add$1("POST", "/api/orchestration/dispatch", require_Schema$1.gen(function* () {
+	const request = yield* require_HttpServer.HttpServerRequest;
 	const session = yield* authenticateOwnerSession$1;
+	const config = yield* ServerConfig;
 	const orchestrationEngine = yield* OrchestrationEngineService;
 	const startup = yield* ServerRuntimeStartup;
 	const { result } = yield* admitNormalizedDispatchCommand(yield* require_HttpServer.schemaBodyJson(ClientOrchestrationCommand).pipe(require_Schema$1.mapError((cause) => new OrchestrationDispatchCommandError({
@@ -310912,6 +311345,11 @@ const orchestrationDispatchRouteLayer = add$1("POST", "/api/orchestration/dispat
 		});
 		if (admissionRefusal !== null) return yield* new OrchestrationDispatchCommandError({ message: admissionRefusal });
 		if (normalizedCommand.type === "thread.turn.start") recordThreadSession(normalizedCommand.threadId, session.sessionId);
+		const bootstrapGithubAuth = normalizedCommand.type === "thread.turn.start" && normalizedCommand.bootstrap ? yield* resolveBootstrapGithubAuth({
+			config,
+			headers: request.headers,
+			session
+		}) : null;
 		const dispatchEffect = normalizedCommand.type === "thread.turn.start" && normalizedCommand.bootstrap ? require_Schema$1.gen(function* () {
 			const git = yield* require_Schema$1.serviceOption(GitCore);
 			const gitStatusBroadcaster = yield* require_Schema$1.serviceOption(GitStatusBroadcaster);
@@ -310921,7 +311359,12 @@ const orchestrationDispatchRouteLayer = add$1("POST", "/api/orchestration/dispat
 				orchestrationEngine,
 				git: git.value,
 				gitStatusBroadcaster: gitStatusBroadcaster.value,
-				projectSetupScriptRunner: projectSetupScriptRunner.value
+				projectSetupScriptRunner: projectSetupScriptRunner.value,
+				refreshSourceControlCredentials: (cwd) => refreshBootstrapSourceControlCredentials({
+					forgeGitCredentialCache: config.forgeGitCredentialCache,
+					auth: bootstrapGithubAuth,
+					cwd
+				})
 			}, normalizedCommand);
 		}).pipe(require_Schema$1.mapError((cause) => new OrchestrationDispatchCommandError({
 			message: "Failed to dispatch orchestration command.",
@@ -314090,12 +314533,15 @@ registerProxyRoute({
 	orgIdSource: "none"
 });
 const cmmdForgeCloudProjectsListRouteLayer = add$1("GET", "/api/cmmd/forge-cloud-projects", require_Schema$1.gen(function* () {
+	const request = yield* require_HttpServer.HttpServerRequest;
+	const organizationId = normalizeOrgIdQueryParam(new URL(request.url, "http://localhost").searchParams.get("orgId"));
 	const { session, jwt: accessToken } = yield* makeCmmdProxyAccessTokenEffect("forge-cloud-projects");
 	if (!accessToken) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const upstreamUrl = `${resolveCommandAppUrl()}${CMMD_CLOUD_PROJECTS_PATH}`;
 	const upstreamOrError = yield* fetchCmmdUpstreamWithRetry(() => fetch(upstreamUrl, { headers: {
 		Authorization: `Bearer ${accessToken}`,
-		Accept: "application/json"
+		Accept: "application/json",
+		...organizationId !== void 0 ? { "X-Organization-ID": organizationId } : {}
 	} }), "idempotent");
 	if (!upstreamOrError.ok) return require_HttpServer.jsonUnsafe({
 		error: "CMMD is unreachable. Check your connection.",
@@ -314199,10 +314645,11 @@ const FORGE_RUNTIMES_KICKOFF_FRAME = new TextEncoder().encode(": ok\n\n");
 * is the designed failure mode. Retrying here would stack a second backoff
 * inside the first and delay the frame the client is waiting on.
 */
-function makeFetchForgeCatalogFrameEffect(proxy, upstreamUrl, accessToken) {
+function makeFetchForgeCatalogFrameEffect(proxy, upstreamUrl, accessToken, organizationId) {
 	return require_Schema$1.tryPromise(() => fetch(upstreamUrl, { headers: {
 		Authorization: `Bearer ${accessToken}`,
-		Accept: "application/json"
+		Accept: "application/json",
+		...organizationId !== void 0 ? { "X-Organization-ID": organizationId } : {}
 	} }).then(async (res) => {
 		if (res.status === 401 || res.status === 403) {
 			console.warn(`[${proxy.logTag}] upstream auth failure: ${res.status}`);
@@ -314227,9 +314674,11 @@ function makeFetchForgeCatalogFrameEffect(proxy, upstreamUrl, accessToken) {
 */
 function makeForgeCatalogEventsHandler(proxy, upstreamUrl) {
 	return require_Schema$1.gen(function* () {
+		const request = yield* require_HttpServer.HttpServerRequest;
+		const organizationId = normalizeOrgIdQueryParam(new URL(request.url, "http://localhost").searchParams.get("orgId"));
 		const { session, jwt: accessToken } = yield* makeCmmdProxyAccessTokenEffect(proxy.logTag);
 		if (!accessToken) return yield* respondCmmdConnectionRequired(session.sessionId);
-		const fetchFrame = makeFetchForgeCatalogFrameEffect(proxy, upstreamUrl, accessToken);
+		const fetchFrame = makeFetchForgeCatalogFrameEffect(proxy, upstreamUrl, accessToken, organizationId);
 		const dataStream = require_Path.concat(require_Path.fromEffect(fetchFrame), require_Path.tick(FORGE_RUNTIMES_POLL_INTERVAL).pipe(require_Path.mapEffect(() => fetchFrame))).pipe(require_Path.filter((frame) => frame !== null));
 		const keepaliveStream = require_Path.tick(FORGE_RUNTIMES_KEEPALIVE_INTERVAL).pipe(require_Path.map(() => FORGE_RUNTIMES_KEEPALIVE_FRAME));
 		const frames = require_Path.concat(require_Path.succeed(FORGE_RUNTIMES_KICKOFF_FRAME), require_Path.merge(dataStream, keepaliveStream)).pipe(require_Path.ensuring(require_Schema$1.sync(() => {
@@ -314720,10 +315169,7 @@ function isLegacyRuntimeConnection(value, expectedRuntimeId) {
 	return [
 		runtime.runtimeId === expectedRuntimeId,
 		runtime.runtimeCapabilityMode === "legacy_env",
-		hasCmmdRuntimeSpriteIdentity({
-			...Object.hasOwn(runtime, "spriteName") ? { spriteName: typeof runtime.spriteName === "string" ? runtime.spriteName : null } : {},
-			...Object.hasOwn(runtime, "flyMachineId") ? { flyMachineId: typeof runtime.flyMachineId === "string" ? runtime.flyMachineId : null } : {}
-		}),
+		hasCmmdRuntimeSpriteIdentity({ spriteName: typeof runtime.spriteName === "string" ? runtime.spriteName : null }),
 		!Object.hasOwn(runtime, "brokerAuthorityAttestedForgeGitCommit"),
 		runtime.brokerAuthorityAttestedImageRef === null,
 		runtime.brokerAuthorityAttestedImageVersion === null,
@@ -327262,7 +327708,7 @@ const resolveServerConfig = (flags, cliLogLevel, options) => require_Schema$1.ge
 	const isManagedCloudSurface = (env.forgeCmmdRuntimeMode ?? false) || (env.forgeCloudShellMode ?? false);
 	const autoBootstrapProjectFromCwd = require_Schema$1.getOrElse(resolveOptionPrecedence(require_Schema$1.fromUndefinedOr(options?.forceAutoBootstrapProjectFromCwd), isHeadlessStartup ? require_Schema$1.some(false) : require_Schema$1.none(), normalizedFlags.autoBootstrapProjectFromCwd, require_Schema$1.fromUndefinedOr(env.autoBootstrapProjectFromCwd), require_Schema$1.fromUndefinedOr(bootstrap?.autoBootstrapProjectFromCwd)), () => mode === "web" && !isManagedCloudSurface);
 	const logWebSocketEvents = require_Schema$1.getOrElse(resolveOptionPrecedence(normalizedFlags.logWebSocketEvents, require_Schema$1.fromUndefinedOr(env.logWebSocketEvents), require_Schema$1.fromUndefinedOr(bootstrap?.logWebSocketEvents)), () => Boolean(devUrl));
-	const staticDir = devUrl ? void 0 : yield* resolveStaticDir();
+	const staticDir = devUrl || isManagedCloudSurface ? void 0 : yield* resolveStaticDir();
 	const host = require_Schema$1.getOrElse(resolveOptionPrecedence(normalizedFlags.host, require_Schema$1.fromUndefinedOr(env.host), require_Schema$1.fromUndefinedOr(bootstrap?.host)), () => mode === "desktop" ? "127.0.0.1" : void 0);
 	const logLevel = require_Schema$1.getOrElse(cliLogLevel, () => env.logLevel);
 	const browserWebRtcIceServers = parseBrowserWebRtcIceServers(env.browserWebRtcIceServers);
@@ -327446,16 +327892,16 @@ const findActiveProjectTarget = require_Schema$1.fn("findActiveProjectTarget")(f
 		workspaceRoot: resolved.workspaceRoot
 	};
 });
-const fetchLiveOrchestrationSnapshot = (origin, bearerToken$2) => runLiveServerRequest(require_HttpServer.get(`${origin}/api/orchestration/snapshot`).pipe(require_HttpServer.acceptJson, require_HttpServer.bearerToken(bearerToken$2)), require_HttpServer.matchStatus({
+const fetchLiveOrchestrationSnapshot = (origin, bearerToken$3) => runLiveServerRequest(require_HttpServer.get(`${origin}/api/orchestration/snapshot`).pipe(require_HttpServer.acceptJson, require_HttpServer.bearerToken(bearerToken$3)), require_HttpServer.matchStatus({
 	"2xx": decodeOrchestrationReadModelResponse,
 	orElse: (response) => readErrorMessageFromResponse(response).pipe(require_Schema$1.flatMap((message) => require_Schema$1.fail(new Error(message))))
 }));
 const ProjectLeadExplanationEnvelope = require_Schema$1.Struct({ data: ProjectLeadExplanationSchema });
-const fetchLiveProjectLeadExplanation = (origin, bearerToken$1, projectId) => runLiveServerRequest(require_HttpServer.get(`${origin}/api/cmmd/projects/${projectId}/project-lead/explain`).pipe(require_HttpServer.acceptJson, require_HttpServer.bearerToken(bearerToken$1)), require_HttpServer.matchStatus({
+const fetchLiveProjectLeadExplanation = (origin, bearerToken$2, projectId) => runLiveServerRequest(require_HttpServer.get(`${origin}/api/cmmd/projects/${projectId}/project-lead/explain`).pipe(require_HttpServer.acceptJson, require_HttpServer.bearerToken(bearerToken$2)), require_HttpServer.matchStatus({
 	"2xx": (response) => require_HttpServer.schemaBodyJson$1(ProjectLeadExplanationEnvelope)(response).pipe(require_Schema$1.map((body) => body.data)),
 	orElse: (response) => readErrorMessageFromResponse(response).pipe(require_Schema$1.flatMap((message) => require_Schema$1.fail(new Error(message))))
 }));
-const dispatchLiveOrchestrationCommand = (origin, bearerToken$3, command) => require_HttpServer.post(`${origin}/api/orchestration/dispatch`).pipe(require_HttpServer.acceptJson, require_HttpServer.bearerToken(bearerToken$3), require_HttpServer.bodyJson(command), require_Schema$1.flatMap((request) => runLiveServerRequest(request, require_HttpServer.matchStatus({
+const dispatchLiveOrchestrationCommand = (origin, bearerToken$1, command) => require_HttpServer.post(`${origin}/api/orchestration/dispatch`).pipe(require_HttpServer.acceptJson, require_HttpServer.bearerToken(bearerToken$1), require_HttpServer.bodyJson(command), require_Schema$1.flatMap((request) => runLiveServerRequest(request, require_HttpServer.matchStatus({
 	"2xx": () => require_Schema$1.void_,
 	orElse: (response) => readErrorMessageFromResponse(response).pipe(require_Schema$1.flatMap((message) => require_Schema$1.fail(new Error(message))))
 }))));