@cmmd-center/forge 0.14.1 → 0.14.2

package/dist/bin.mjs

@@ -23,7 +23,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import os, { homedir, networkInterfaces, tmpdir } from "node:os";
+import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -26852,14 +26852,15 @@ function nonEmptyString$3(value) {
 }
 /**
 * Resolve the operational Sprite name for provision / connect / readiness gates.
+* Only the authoritative `spriteName` counts: missing, empty, and explicit-null
+* values all resolve to null.
 *
-* @see CmmdRuntimeSpriteIdentitySource for the dual-contract rules.
+* @see CmmdRuntimeSpriteIdentitySource for the identity rules.
 */
 function resolveCmmdRuntimeSpriteName(runtime) {
-	if (Object.hasOwn(runtime, "spriteName")) return nonEmptyString$3(runtime.spriteName);
-	return nonEmptyString$3(runtime.flyMachineId);
+	return nonEmptyString$3(runtime.spriteName);
 }
-/** True when the payload carries an operational Sprite name after dual-read. */
+/** True when the payload carries an authoritative Sprite name. */
 function hasCmmdRuntimeSpriteIdentity(runtime) {
 	return resolveCmmdRuntimeSpriteName(runtime) !== null;
 }
@@ -26934,7 +26935,8 @@ const WORKTREE_LAUNCH_ACTIVITY_KINDS = new Set([
 	"setup-script.skipped",
 	"setup-script.failed",
 	"launch.agent-starting",
-	"launch.cancelled"
+	"launch.cancelled",
+	"checkout-launch"
 ]);
 function encodeCmmdRuntimeWorktreeLaunchActivityPayload(kind, payload) {
 	return {
@@ -26988,6 +26990,258 @@ function decodeCmmdRuntimePlanActivity(payload) {
 	};
 }
 //#endregion
+//#region ../../packages/contracts/src/checkoutLaunch.ts
+/**
+* One Checkout launch snapshot for a thread.
+*
+* Upstream (`pingdotgg/t3code`, WorktreeSetupTracker) owns this shape: one
+* snapshot, fixed activity id, handoff when the agent stage is done and the
+* turn has started. Forge keeps its own stage names. The admission wait is
+* the first stage of this same snapshot, because a shared Environment can be
+* busy before any Checkout activity exists.
+*/
+const CHECKOUT_LAUNCH_ACTIVITY_KIND = "checkout-launch";
+const PREPARATION_STAGES = [
+	{
+		id: "resolve",
+		label: "Resolve base branch"
+	},
+	{
+		id: "checkout",
+		label: "Check out files"
+	},
+	{
+		id: "dependencies",
+		label: "Prepare dependencies"
+	},
+	{
+		id: "setup",
+		label: "Start setup script"
+	},
+	{
+		id: "agent",
+		label: "Start agent"
+	}
+];
+function checkoutLaunchActivityId(threadId) {
+	return `checkout-launch:${threadId}`;
+}
+function preparationStages(statusFor, detailFor = () => null) {
+	return PREPARATION_STAGES.map((stage) => ({
+		id: stage.id,
+		label: stage.label,
+		status: statusFor(stage.id),
+		detail: detailFor(stage.id)
+	}));
+}
+function beginPreparationCheckoutLaunch(input) {
+	return {
+		phase: "running",
+		stages: preparationStages((id) => id === "resolve" ? "running" : "pending"),
+		startedAt: input.startedAt,
+		completedAt: null,
+		error: null,
+		cancellable: true,
+		worktreePath: input.worktreePath ?? null,
+		turnStartedAt: null
+	};
+}
+function replaceStage(snapshot, id, patch) {
+	return {
+		...snapshot,
+		stages: snapshot.stages.map((stage) => stage.id === id ? {
+			...stage,
+			...patch
+		} : stage)
+	};
+}
+function ensurePreparation(snapshot, startedAt) {
+	if (snapshot && snapshot.stages.some((stage) => stage.id === "resolve")) return snapshot;
+	return beginPreparationCheckoutLaunch({
+		startedAt: snapshot?.startedAt ?? startedAt,
+		worktreePath: snapshot?.worktreePath ?? null
+	});
+}
+function settlePhase(snapshot) {
+	if (snapshot.phase === "failed" || snapshot.phase === "cancelled") return snapshot;
+	const agent = snapshot.stages.find((stage) => stage.id === "agent");
+	const setup = snapshot.stages.find((stage) => stage.id === "setup");
+	const agentDone = agent?.status === "done" && snapshot.turnStartedAt !== null;
+	const setupStillRunning = setup?.status === "running";
+	if (!agentDone || setupStillRunning) return snapshot;
+	return {
+		...snapshot,
+		phase: "done",
+		completedAt: snapshot.completedAt ?? snapshot.turnStartedAt,
+		cancellable: false
+	};
+}
+function payloadString(payload, key) {
+	const value = payload?.[key];
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+function payloadNumber(payload, key) {
+	const value = payload?.[key];
+	return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+const STAGE_IDS = new Set([
+	"resolve",
+	"checkout",
+	"dependencies",
+	"setup",
+	"agent"
+]);
+const STAGE_STATUSES = new Set([
+	"done",
+	"failed",
+	"skipped",
+	"running"
+]);
+const LAUNCH_FAILING_STAGES = new Set([
+	"resolve",
+	"checkout",
+	"dependencies"
+]);
+function stageIdFromPayload(payload) {
+	const id = payloadString(payload, "id") ?? payloadString(payload, "stage");
+	return id !== null && STAGE_IDS.has(id) ? id : null;
+}
+function stageStatus(status) {
+	return status !== null && STAGE_STATUSES.has(status) ? status : "running";
+}
+function applyStage(snapshot, event) {
+	const id = stageIdFromPayload(event.payload);
+	if (!id) return snapshot;
+	snapshot = ensurePreparation(snapshot, event.createdAt);
+	const nextStatus = stageStatus(payloadString(event.payload, "status"));
+	const percent = payloadNumber(event.payload, "percent");
+	const detail = percent !== null ? `${Math.round(percent)}%` : payloadString(event.payload, "detail");
+	const next = replaceStage(snapshot, id, {
+		status: nextStatus,
+		detail
+	});
+	if (nextStatus !== "failed" || !LAUNCH_FAILING_STAGES.has(id)) return next;
+	return {
+		...next,
+		phase: "failed",
+		error: event.summary ?? next.error,
+		completedAt: event.createdAt,
+		cancellable: false
+	};
+}
+/**
+* Fold one launch activity into the snapshot. A recorded `checkout-launch`
+* payload replaces the snapshot. Older per-step activities still fold so a
+* thread that never received the snapshot does not go blank.
+*/
+function reduceCheckoutLaunch(snapshot, event) {
+	if (event.kind === "checkout-launch") return readCheckoutLaunchSnapshot(event) ?? snapshot;
+	if (event.kind === "worktree.requested") return beginPreparationCheckoutLaunch({
+		startedAt: snapshot?.startedAt ?? event.createdAt,
+		worktreePath: payloadString(event.payload, "worktreePath") ?? snapshot?.worktreePath ?? null
+	});
+	if (!snapshot && event.kind !== "worktree.stage" && event.kind !== "worktree.failed") snapshot = beginPreparationCheckoutLaunch({ startedAt: event.createdAt });
+	if (!snapshot) return snapshot;
+	return CHECKOUT_LAUNCH_EVENT_HANDLERS[event.kind]?.(snapshot, event) ?? snapshot;
+}
+function setSetup(snapshot, event, status, detail) {
+	return replaceStage(ensurePreparation(snapshot, event.createdAt), "setup", {
+		status,
+		detail
+	});
+}
+function applyCreated(snapshot, event) {
+	return {
+		...snapshot,
+		worktreePath: payloadString(event.payload, "worktreePath") ?? snapshot.worktreePath
+	};
+}
+function applyOutput(snapshot, event) {
+	const detail = payloadString(event.payload, "detail") ?? event.summary ?? null;
+	const match = detail ? /Updating files:\s+(\d+)%/.exec(detail) : null;
+	if (!match) return snapshot;
+	return replaceStage(ensurePreparation(snapshot, event.createdAt), "checkout", {
+		status: "running",
+		detail: `${match[1]}%`
+	});
+}
+function applyAgentStarting(snapshot, event) {
+	const prepared = ensurePreparation(snapshot, event.createdAt);
+	return {
+		...replaceStage(event.payload?.setupRequested === false ? setSetup(prepared, event, "skipped", "Not requested") : prepared, "agent", {
+			status: "running",
+			detail: event.summary ?? "Starting agent"
+		}),
+		cancellable: false
+	};
+}
+function applyFailed(snapshot, event) {
+	snapshot = ensurePreparation(snapshot, event.createdAt);
+	const detail = payloadString(event.payload, "detail") ?? event.summary ?? snapshot.error;
+	const running = snapshot.stages.find((stage) => stage.status === "running");
+	return {
+		...running ? replaceStage(snapshot, running.id, {
+			status: "failed",
+			detail
+		}) : snapshot,
+		phase: "failed",
+		error: detail ?? "Checkout launch failed",
+		completedAt: event.createdAt,
+		cancellable: false
+	};
+}
+function applyCancelled(snapshot, event) {
+	return {
+		...snapshot,
+		phase: "cancelled",
+		error: event.summary ?? "Launch cancelled",
+		completedAt: event.createdAt,
+		cancellable: false
+	};
+}
+const CHECKOUT_LAUNCH_EVENT_HANDLERS = {
+	"worktree.stage": applyStage,
+	"worktree.created": applyCreated,
+	"worktree.output": applyOutput,
+	"setup-script.skipped": (snapshot, event) => setSetup(snapshot, event, "skipped", event.summary ?? "No setup script configured"),
+	"setup-script.running": (snapshot, event) => setSetup(snapshot, event, "running", event.summary ?? null),
+	"setup-script.started": (snapshot, event) => setSetup(snapshot, event, "done", event.summary ?? "Running in terminal"),
+	"setup-script.completed": (snapshot, event) => setSetup(snapshot, event, "done", event.summary ?? null),
+	"setup-script.failed": (snapshot, event) => setSetup(snapshot, event, "failed", event.summary ?? "Setup script failed"),
+	"launch.agent-starting": applyAgentStarting,
+	"worktree.failed": applyFailed,
+	"launch.cancelled": applyCancelled
+};
+function withCheckoutLaunchTurnStarted(snapshot, turnStartedAt) {
+	if (!turnStartedAt) return snapshot;
+	const agent = snapshot.stages.find((stage) => stage.id === "agent");
+	return settlePhase({
+		...agent && (agent.status === "running" || agent.status === "done") ? replaceStage(snapshot, "agent", {
+			status: "done",
+			detail: agent.detail
+		}) : snapshot,
+		turnStartedAt
+	});
+}
+function readCheckoutLaunchSnapshot(activity) {
+	if (activity.kind !== "checkout-launch") return null;
+	const payload = activity.payload;
+	if (!payload || typeof payload !== "object") return null;
+	const record = payload;
+	if (record.phase !== "running" && record.phase !== "done" && record.phase !== "failed" && record.phase !== "cancelled") return null;
+	if (!Array.isArray(record.stages) || typeof record.startedAt !== "string") return null;
+	return {
+		phase: record.phase,
+		stages: record.stages,
+		startedAt: record.startedAt,
+		completedAt: record.completedAt ?? null,
+		error: record.error ?? null,
+		cancellable: record.cancellable === true,
+		worktreePath: record.worktreePath ?? null,
+		turnStartedAt: record.turnStartedAt ?? null
+	};
+}
+//#endregion
 //#region ../../packages/contracts/src/cmmdProjectPatch.ts
 const CMMD_PROJECT_PATCH_FIELDS = {
 	title: "requiredText",
@@ -50753,7 +51007,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = os.release().split(".");
+		const osRelease = $U.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53196,7 +53450,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$4 = __require("os");
+	const os$3 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53218,7 +53472,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$4.userInfo();
+				const userInfo = os$3.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66141,7 +66395,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.14.1";
+var version$1 = "0.14.2";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -66427,6 +66681,12 @@ function deriveAuthClientMetadata(input) {
 * Hosts a PaaS assigns automatically. They are reachable, but they are not the
 * domain the product is registered under, so they must never end up in an OAuth
 * `redirect_uri`.
+*
+* The hosted web channels (forge#3557) are the deliberate exception: their
+* `.up.railway.app` hosts ARE product surfaces, the operator enumerates them in
+* `FORGE_WEB_CHANNEL_ORIGINS`, and CMMD's `cmmd-forge-web` OAuth client lists
+* their callback URIs as registered redirect URIs. Every other platform host
+* stays excluded.
 */
 const PLATFORM_DEFAULT_HOST_SUFFIXES = [".up.railway.app"];
 function isPlatformDefaultHost(hostname) {
@@ -66465,6 +66725,41 @@ function resolveForgePublicUrl(env = process.env) {
 	if (canonicalDomain.toLowerCase() === configuredHost.toLowerCase()) return configured;
 	return `https://${canonicalDomain}`.replace(/\/$/, "");
 }
+/**
+* Hosted web channel origins (forge#3557) allowed to complete OAuth against
+* this server, from `FORGE_WEB_CHANNEL_ORIGINS`.
+*
+* The channels serve the web bundle from their own domains and forward `/api`
+* here with `x-forwarded-host` set to the channel host. Login must build its
+* `redirect_uri` from that host, or CMMD's authorize round-trip returns the
+* browser to `FORGE_PUBLIC_URL` — an origin where the login's state and PKCE
+* cookies do not exist. Because anything on the internet can also send this
+* server an `x-forwarded-host` header, the accepted hosts are never inferred
+* from the request: the operator enumerates the exact channel origins, and
+* only those count.
+*
+* Entries are comma-separated origins (`https://host[:port]`); a bare hostname
+* assumes https. Every entry normalizes to its URL origin, so stray path,
+* query, or userinfo components never reach a redirect URI. Whitespace,
+* trailing slashes, and unparseable entries are dropped.
+*/
+function resolveForgeWebChannelOrigins(env = process.env) {
+	return (env.FORGE_WEB_CHANNEL_ORIGINS ?? "").split(",").map((entry) => entry.trim().replace(/\/+$/, "")).filter((entry) => entry.length > 0).map((entry) => entry.includes("://") ? entry : `https://${entry}`).filter((entry) => URL.canParse(entry)).map((entry) => new URL(entry).origin).filter((origin) => origin !== "null");
+}
+/**
+* The allowlisted channel origin for a forwarded host, or null when the host
+* is not one. Matching is on the URL host — hostname plus explicit port — so
+* an entry with a port only matches that exact host:port, and a lookalike or
+* suffix host never matches. The returned origin is the operator's registered
+* form, scheme included, so it is exactly the redirect URI CMMD's client
+* registry holds.
+*/
+function matchForgeWebChannelOrigin(forwardedHost, env = process.env) {
+	const candidate = forwardedHost.trim().toLowerCase();
+	if (!candidate) return null;
+	for (const origin of resolveForgeWebChannelOrigins(env)) if (new URL(origin).host.toLowerCase() === candidate) return origin;
+	return null;
+}
 function forgeConfiguredPublicUrl() {
 	return resolveForgePublicUrl();
 }
@@ -66506,7 +66801,11 @@ function forgePublicUrlForRequest(request) {
 	const forwardedHost = normalizeForwardedHeaderValue(request.headers["x-forwarded-host"]);
 	const forwardedProto = normalizeForwardedHeaderValue(request.headers["x-forwarded-proto"]) ?? "https";
 	if (forwardedHost && (isLoopbackOAuthHost(forwardedHost) || isPrivateDevOAuthHost(forwardedHost))) return `${forwardedProto === "https" ? "https" : "http"}://${forwardedHost}`.replace(/\/$/, "");
-	if (forwardedHost) return forgeConfiguredPublicUrl();
+	if (forwardedHost) {
+		const channelOrigin = matchForgeWebChannelOrigin(forwardedHost);
+		if (channelOrigin) return channelOrigin;
+		return forgeConfiguredPublicUrl();
+	}
 	const directHost = normalizeForwardedHeaderValue(request.headers["host"]);
 	if (directHost && (isLoopbackOAuthHost(directHost) || isPrivateDevOAuthHost(directHost))) return `http://${directHost}`.replace(/\/$/, "");
 	return forgeConfiguredPublicUrl();
@@ -70439,6 +70738,19 @@ function createCloudflareTurnIceServerResolver(options) {
 }
 //#endregion
 //#region src/http.ts
+/**
+* What the catch-all does with a non-API GET. A managed cloud surface is
+* runtime-only no matter what files exist on disk — the web client's single
+* home is the static channels (forge#3567) — while a local server either
+* serves its bundle or reports itself unconfigured.
+*/
+function resolveWebServingOutcome(input) {
+	if (input.managedCloudSurface) return { kind: "runtime-only" };
+	return input.staticDir ? {
+		kind: "serve",
+		staticDir: input.staticDir
+	} : { kind: "unconfigured" };
+}
 const PROJECT_FAVICON_CACHE_CONTROL = "public, max-age=3600";
 const PROJECT_FAVICON_MISS_CACHE_CONTROL = "public, max-age=300";
 /**
@@ -70697,8 +71009,16 @@ const staticAndDevRouteLayer = add$1("GET", "*", gen(function* () {
 	}, { status: 404 });
 	const config = yield* ServerConfig;
 	if (config.devUrl && isLoopbackHostname(url.value.hostname)) return redirect(resolveDevRedirectUrl(config.devUrl, url.value), { status: 302 });
-	const staticDir = config.staticDir ?? (config.devUrl ? yield* resolveStaticDir() : void 0);
-	if (!staticDir) return text$2("No static directory configured and no dev URL set.", { status: 503 });
+	const outcome = resolveWebServingOutcome({
+		staticDir: config.staticDir ?? (config.devUrl ? yield* resolveStaticDir() : void 0),
+		managedCloudSurface: (config.forgeCloudShellMode ?? false) || (config.forgeCmmdRuntimeMode ?? false)
+	});
+	if (outcome.kind === "runtime-only") return jsonUnsafe({
+		error: "not_found",
+		message: "This server does not serve the web client."
+	}, { status: 404 });
+	if (outcome.kind === "unconfigured") return text$2("No static directory configured and no dev URL set.", { status: 503 });
+	const staticDir = outcome.staticDir;
 	const fileSystem = yield* FileSystem;
 	const path = yield* Path$2;
 	const staticRoot = path.resolve(staticDir);
@@ -75908,7 +76228,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$3 = __require("os");
+	var os$2 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -75916,8 +76236,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$3.arch();
-	var platform = process.env.npm_config_platform || os$3.platform();
+	var arch = process.env.npm_config_arch || os$2.arch();
+	var platform = process.env.npm_config_platform || os$2.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -88494,7 +88814,7 @@ function refreshForgeManagedGitHubRemoteCredentials(input, dependencies = {
 			}));
 			isCacheManaged = helper.code === 0 && helper.stdout.includes("cache");
 		}
-		if (!isEmbedded && !isCacheManaged) return {
+		if (!isEmbedded && !isCacheManaged && !input.allowUnmanagedRemote) return {
 			status: 200,
 			body: {
 				refreshed: false,
@@ -93761,7 +94081,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-yHTUkd2Y.mjs"),
+		try: () => import("./open-2-reBrpv.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -94188,6 +94508,37 @@ const toBootstrapDispatchCommandCauseError = (cause) => {
 	});
 };
 const bootstrapCommandId = (command, stage) => CommandId.make(`server:${stage}:${command.commandId}`);
+const publishCheckoutLaunchSnapshot = (input) => input.orchestrationEngine.dispatch({
+	type: "thread.activity.append",
+	commandId: CommandId.make(`server:checkout-launch:${crypto.randomUUID()}`),
+	threadId: input.threadId,
+	activity: {
+		id: EventId.make(checkoutLaunchActivityId(input.threadId)),
+		tone: input.snapshot.phase === "failed" ? "error" : "info",
+		kind: CHECKOUT_LAUNCH_ACTIVITY_KIND,
+		summary: "Checkout launch",
+		payload: input.snapshot,
+		turnId: null,
+		createdAt: input.createdAt
+	},
+	createdAt: input.createdAt
+});
+const recordCheckoutLaunchEvent = (input) => {
+	const next = reduceCheckoutLaunch(input.launch.snapshot, {
+		kind: input.kind,
+		createdAt: input.createdAt,
+		summary: input.summary,
+		payload: input.payload
+	});
+	input.launch.snapshot = next;
+	if (!next) return void_$1;
+	return publishCheckoutLaunchSnapshot({
+		orchestrationEngine: input.orchestrationEngine,
+		threadId: input.threadId,
+		snapshot: next,
+		createdAt: input.createdAt
+	});
+};
 const appendSetupScriptActivity = (input) => input.orchestrationEngine.dispatch({
 	type: "thread.activity.append",
 	commandId: input.commandId,
@@ -94202,7 +94553,15 @@ const appendSetupScriptActivity = (input) => input.orchestrationEngine.dispatch(
 		createdAt: input.createdAt
 	},
 	createdAt: input.createdAt
-});
+}).pipe(andThen(() => recordCheckoutLaunchEvent({
+	orchestrationEngine: input.orchestrationEngine,
+	threadId: input.threadId,
+	launch: input.launch,
+	kind: input.kind,
+	summary: input.summary,
+	createdAt: input.createdAt,
+	payload: input.payload
+})));
 const appendWorktreeActivity = (input) => input.orchestrationEngine.dispatch({
 	type: "thread.activity.append",
 	commandId: input.commandId,
@@ -94217,7 +94576,15 @@ const appendWorktreeActivity = (input) => input.orchestrationEngine.dispatch({
 		createdAt: input.createdAt
 	},
 	createdAt: input.createdAt
-});
+}).pipe(andThen(() => recordCheckoutLaunchEvent({
+	orchestrationEngine: input.orchestrationEngine,
+	threadId: input.threadId,
+	launch: input.launch,
+	kind: input.kind,
+	summary: input.summary,
+	createdAt: input.createdAt,
+	payload: input.payload
+})));
 const truncateBootstrapOutputLine = (line) => {
 	const trimmed = line.trim();
 	if (trimmed.length <= MAX_BOOTSTRAP_OUTPUT_LINE_LENGTH) return trimmed;
@@ -94327,9 +94694,11 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 		summary: "Creating worktree",
 		createdAt: requestedAt,
 		payload: requestedPayload,
-		tone: "info"
+		tone: "info",
+		launch: input.launch
 	});
 	if (bootstrapWorktree.startFromOrigin) {
+		if (input.refreshSourceControlCredentials) yield* input.refreshSourceControlCredentials(projectCwd);
 		if (!input.git.fetch) return yield* fail(/* @__PURE__ */ new Error("Git fetch is unavailable for origin worktree preparation."));
 		yield* input.git.fetch({
 			cwd: projectCwd,
@@ -94351,7 +94720,8 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 					detail,
 					stage: "fetch"
 				},
-				tone: "error"
+				tone: "error",
+				launch: input.launch
 			}).pipe(andThen(failCause$1(cause)));
 		}));
 	}
@@ -94369,7 +94739,8 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 			summary: "Preparing worktree",
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 			payload: update,
-			tone: "info"
+			tone: "info",
+			launch: input.launch
 		}).pipe(asVoid, ignore),
 		progress: {
 			onStdoutLine: (line) => {
@@ -94387,7 +94758,8 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 						stream: "stdout",
 						detail
 					},
-					tone: "info"
+					tone: "info",
+					launch: input.launch
 				}).pipe(asVoid, ignore);
 			},
 			onStderrLine: (line) => {
@@ -94405,7 +94777,8 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 						stream: "stderr",
 						detail
 					},
-					tone: "info"
+					tone: "info",
+					launch: input.launch
 				}).pipe(asVoid, ignore);
 			}
 		}
@@ -94424,7 +94797,8 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 				...requestedPayload,
 				detail
 			},
-			tone: "error"
+			tone: "error",
+			launch: input.launch
 		}).pipe(andThen(failCause$1(cause)));
 	}));
 	const worktreePath = worktree.worktree.path;
@@ -94448,7 +94822,8 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 			worktreePath,
 			checkedOutBranch: worktree.worktree.branch
 		},
-		tone: "info"
+		tone: "info",
+		launch: input.launch
 	});
 	return {
 		worktreePath,
@@ -94464,6 +94839,7 @@ const dispatchBootstrapTurnStart$1 = (input, command) => gen(function* () {
 	let targetProjectCwd = bootstrap?.prepareWorktree?.projectCwd;
 	let targetWorktreePath = bootstrap?.createThread?.worktreePath ?? null;
 	let worktreeFailureReported = false;
+	const launch = { snapshot: null };
 	const cleanupCreatedThread = () => createdThread && !worktreeFailureReported ? orchestrationEngine.dispatch({
 		type: "thread.delete",
 		commandId: bootstrapCommandId(command, "bootstrap-thread-delete"),
@@ -94482,7 +94858,8 @@ const dispatchBootstrapTurnStart$1 = (input, command) => gen(function* () {
 				detail,
 				worktreePath: record.worktreePath
 			},
-			tone: "error"
+			tone: "error",
+			launch
 		}).pipe(ignoreCause({ log: false }), flatMap(() => logWarning$1("bootstrap turn start failed to launch setup script", {
 			threadId: command.threadId,
 			worktreePath: record.worktreePath,
@@ -94504,7 +94881,8 @@ const dispatchBootstrapTurnStart$1 = (input, command) => gen(function* () {
 			summary: "Starting setup script",
 			createdAt: record.requestedAt,
 			payload,
-			tone: "info"
+			tone: "info",
+			launch
 		}), appendSetupScriptActivity({
 			orchestrationEngine,
 			threadId: command.threadId,
@@ -94513,7 +94891,8 @@ const dispatchBootstrapTurnStart$1 = (input, command) => gen(function* () {
 			summary: "Setup script started",
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 			payload,
-			tone: "info"
+			tone: "info",
+			launch
 		})]).pipe(asVoid, catch_((error) => logWarning$1("bootstrap turn start launched setup script but failed to record setup activity", {
 			threadId: command.threadId,
 			worktreePath: record.worktreePath,
@@ -94545,7 +94924,8 @@ const dispatchBootstrapTurnStart$1 = (input, command) => gen(function* () {
 					summary: "No setup script configured",
 					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 					payload: {},
-					tone: "info"
+					tone: "info",
+					launch
 				}).pipe(asVoid, ignore);
 				return recordSetupScriptStarted({
 					requestedAt,
@@ -94566,7 +94946,9 @@ const dispatchBootstrapTurnStart$1 = (input, command) => gen(function* () {
 			orchestrationEngine,
 			git,
 			gitStatusBroadcaster,
-			command
+			...input.refreshSourceControlCredentials ? { refreshSourceControlCredentials: input.refreshSourceControlCredentials } : {},
+			command,
+			launch
 		}).pipe(catchCause((cause) => {
 			if (!hasInterruptsOnly(cause)) worktreeFailureReported = true;
 			return failCause$1(cause);
@@ -94584,10 +94966,22 @@ const dispatchBootstrapTurnStart$1 = (input, command) => gen(function* () {
 			summary: "Starting agent",
 			createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 			payload: { setupRequested: bootstrap.runSetupScript === true },
-			tone: "info"
+			tone: "info",
+			launch
 		}).pipe(ignore);
 		sealBootstrapCommand(orchestrationEngine, command.commandId);
-		return yield* orchestrationEngine.dispatch(finalTurnStartCommand);
+		const started = yield* orchestrationEngine.dispatch(finalTurnStartCommand);
+		if (launch.snapshot && bootstrap?.prepareWorktree) {
+			const settledAt = (/* @__PURE__ */ new Date()).toISOString();
+			launch.snapshot = withCheckoutLaunchTurnStarted(launch.snapshot, settledAt);
+			yield* publishCheckoutLaunchSnapshot({
+				orchestrationEngine,
+				threadId: command.threadId,
+				snapshot: launch.snapshot,
+				createdAt: settledAt
+			}).pipe(ignore);
+		}
+		return started;
 	});
 	return yield* runBootstrapCommand(orchestrationEngine, command.commandId, bootstrapProgram.pipe(onInterrupt(() => appendWorktreeActivity({
 		orchestrationEngine,
@@ -94597,7 +94991,8 @@ const dispatchBootstrapTurnStart$1 = (input, command) => gen(function* () {
 		summary: "Launch cancelled",
 		createdAt: (/* @__PURE__ */ new Date()).toISOString(),
 		payload: {},
-		tone: "info"
+		tone: "info",
+		launch
 	}).pipe(ignore)), catchCause((cause) => {
 		const dispatchError = toBootstrapDispatchCommandCauseError(cause);
 		if (hasInterruptsOnly(cause)) return fail(dispatchError);
@@ -192236,7 +192631,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -202436,12 +202831,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$2 = "https://code.claude.com/docs/en", kKe = [
+var os$1 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$2}/iam#permission-modes`
+			docLink: `${os$1}/iam#permission-modes`
 		}
 	},
 	{
@@ -202456,7 +202851,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$2}/settings#environment-variables`
+			docLink: `${os$1}/settings#environment-variables`
 		}
 	},
 	{
@@ -202467,14 +202862,14 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$2}/hooks`
+			docLink: `${os$1}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$2}/hooks#exec-form-and-shell-form`
+			docLink: `${os$1}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -202489,7 +202884,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$2}/settings`
+			docLink: `${os$1}/settings`
 		}
 	},
 	{
@@ -202504,13 +202899,13 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$2}/iam#working-directories`
+			docLink: `${os$1}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$2}/iam#configuring-permissions`,
-	env: `${os$2}/settings#environment-variables`,
-	hooks: `${os$2}/hooks`
+	permissions: `${os$1}/iam#configuring-permissions`,
+	env: `${os$1}/settings#environment-variables`,
+	hooks: `${os$1}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -271648,7 +272043,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -271779,14 +272174,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -271794,7 +272189,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -291118,6 +291513,21 @@ function readProviderAccountId(selection) {
 	return "providerAccountId" in selection ? selection.providerAccountId : void 0;
 }
 //#endregion
+//#region src/orchestration/expiredProviderEgressToken.ts
+const EXPIRED_PROVIDER_EGRESS_TOKEN = "Provider egress token is invalid or expired";
+/**
+* The CMMD egress authorizer uses this sentence for a token it will not
+* accept. A workspace reconnect 401 is a different failure and must not
+* take this path.
+*
+* The token lives in the provider process environment. Stopping that process
+* lets the next session start mint a new one. A later send of this same turn
+* delivers the user message a second time, so the recovery stops at the session.
+*/
+function isExpiredProviderEgressTokenError(message) {
+	return typeof message === "string" && message.includes(EXPIRED_PROVIDER_EGRESS_TOKEN);
+}
+//#endregion
 //#region src/persistence/Layers/ProjectionTurns.ts
 const ProjectionTurnDbRowSchema = ProjectionTurn.mapFields(assign({
 	checkpointFiles: fromJsonString(ArraySchema(OrchestrationCheckpointFile)),
@@ -293010,6 +293420,7 @@ const ProviderRuntimeIngestionLive = effect(ProviderRuntimeIngestionService, fn$
 	const handleRuntimeError = fn$1("handleRuntimeError")(function* (event, thread, eventTurnId, activeTurnId) {
 		if (event.type !== "runtime.error") return;
 		if (!shouldApplyRuntimeErrorEvent(activeTurnId, eventTurnId)) return;
+		if (isExpiredProviderEgressTokenError(event.payload.message)) yield* providerService.stopSession({ threadId: thread.id }).pipe(catchCause(() => void_$1));
 		yield* orchestrationEngine.dispatch({
 			type: "thread.session.set",
 			commandId: providerCommandId(event, "runtime-error-session-set"),
@@ -300659,7 +301070,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "c541d41e992712a7ab25a9ae28ee5e3815e77426";
+	return "a00cf0b653c5ad41933b286a3f108c74a8b61780";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -309835,6 +310246,26 @@ function readNonEmptyString(value) {
 //#region src/orchestration/http.ts
 const DISPATCH_CAUSE_DETAIL_LIMIT = 500;
 const DISPATCH_CAUSE_MAX_DEPTH = 8;
+const resolveBootstrapGithubAuth = (input) => {
+	const runtimeGrantAuth = resolveRuntimeGitHubGrantAuth(input.config, input.headers);
+	return runtimeGrantAuth ? succeed(runtimeGrantAuth) : resolveCmmdJwtForSession({
+		sessionId: input.session.sessionId,
+		subject: input.session.subject,
+		logPrefix: "bootstrap-github"
+	});
+};
+const refreshBootstrapSourceControlCredentials = (input) => gen(function* () {
+	if (!input.auth) return yield* fail(/* @__PURE__ */ new Error("CMMD GitHub authorization is unavailable for Work Session bootstrap."));
+	const result = yield* refreshForgeManagedGitHubRemoteCredentials({
+		cwd: input.cwd,
+		auth: typeof input.auth === "object" ? input.auth : {
+			kind: "cmmd-jwt",
+			jwt: input.auth
+		},
+		allowUnmanagedRemote: true
+	}, void 0, input.forgeGitCredentialCache ? "cache" : "embed");
+	if (result.status >= 400) return yield* fail(new Error(typeof result.body.error === "string" ? result.body.error : "CMMD GitHub authorization failed for Work Session bootstrap."));
+});
 /**
 * Render the underlying failure of a dispatch refusal as a single line.
 *
@@ -310273,7 +310704,9 @@ const orchestrationSnapshotRouteLayer = add$1("GET", "/api/orchestration/snapsho
 	}))), { status: 200 });
 }).pipe(catchTag("AuthError", respondToOrchestrationAuthError), catchTag("OrchestrationGetSnapshotError", respondToOrchestrationHttpError)));
 const orchestrationDispatchRouteLayer = add$1("POST", "/api/orchestration/dispatch", gen(function* () {
+	const request = yield* HttpServerRequest;
 	const session = yield* authenticateOwnerSession$1;
+	const config = yield* ServerConfig;
 	const orchestrationEngine = yield* OrchestrationEngineService;
 	const startup = yield* ServerRuntimeStartup;
 	const { result } = yield* admitNormalizedDispatchCommand(yield* schemaBodyJson(ClientOrchestrationCommand).pipe(mapError((cause) => new OrchestrationDispatchCommandError({
@@ -310291,6 +310724,11 @@ const orchestrationDispatchRouteLayer = add$1("POST", "/api/orchestration/dispat
 		});
 		if (admissionRefusal !== null) return yield* new OrchestrationDispatchCommandError({ message: admissionRefusal });
 		if (normalizedCommand.type === "thread.turn.start") recordThreadSession(normalizedCommand.threadId, session.sessionId);
+		const bootstrapGithubAuth = normalizedCommand.type === "thread.turn.start" && normalizedCommand.bootstrap ? yield* resolveBootstrapGithubAuth({
+			config,
+			headers: request.headers,
+			session
+		}) : null;
 		const dispatchEffect = normalizedCommand.type === "thread.turn.start" && normalizedCommand.bootstrap ? gen(function* () {
 			const git = yield* serviceOption(GitCore);
 			const gitStatusBroadcaster = yield* serviceOption(GitStatusBroadcaster);
@@ -310300,7 +310738,12 @@ const orchestrationDispatchRouteLayer = add$1("POST", "/api/orchestration/dispat
 				orchestrationEngine,
 				git: git.value,
 				gitStatusBroadcaster: gitStatusBroadcaster.value,
-				projectSetupScriptRunner: projectSetupScriptRunner.value
+				projectSetupScriptRunner: projectSetupScriptRunner.value,
+				refreshSourceControlCredentials: (cwd) => refreshBootstrapSourceControlCredentials({
+					forgeGitCredentialCache: config.forgeGitCredentialCache,
+					auth: bootstrapGithubAuth,
+					cwd
+				})
 			}, normalizedCommand);
 		}).pipe(mapError((cause) => new OrchestrationDispatchCommandError({
 			message: "Failed to dispatch orchestration command.",
@@ -313463,12 +313906,15 @@ registerProxyRoute({
 	orgIdSource: "none"
 });
 const cmmdForgeCloudProjectsListRouteLayer = add$1("GET", "/api/cmmd/forge-cloud-projects", gen(function* () {
+	const request = yield* HttpServerRequest;
+	const organizationId = normalizeOrgIdQueryParam(new URL(request.url, "http://localhost").searchParams.get("orgId"));
 	const { session, jwt: accessToken } = yield* makeCmmdProxyAccessTokenEffect("forge-cloud-projects");
 	if (!accessToken) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const upstreamUrl = `${resolveCommandAppUrl()}${CMMD_CLOUD_PROJECTS_PATH}`;
 	const upstreamOrError = yield* fetchCmmdUpstreamWithRetry(() => fetch(upstreamUrl, { headers: {
 		Authorization: `Bearer ${accessToken}`,
-		Accept: "application/json"
+		Accept: "application/json",
+		...organizationId !== void 0 ? { "X-Organization-ID": organizationId } : {}
 	} }), "idempotent");
 	if (!upstreamOrError.ok) return jsonUnsafe({
 		error: "CMMD is unreachable. Check your connection.",
@@ -313572,10 +314018,11 @@ const FORGE_RUNTIMES_KICKOFF_FRAME = new TextEncoder().encode(": ok\n\n");
 * is the designed failure mode. Retrying here would stack a second backoff
 * inside the first and delay the frame the client is waiting on.
 */
-function makeFetchForgeCatalogFrameEffect(proxy, upstreamUrl, accessToken) {
+function makeFetchForgeCatalogFrameEffect(proxy, upstreamUrl, accessToken, organizationId) {
 	return tryPromise(() => fetch(upstreamUrl, { headers: {
 		Authorization: `Bearer ${accessToken}`,
-		Accept: "application/json"
+		Accept: "application/json",
+		...organizationId !== void 0 ? { "X-Organization-ID": organizationId } : {}
 	} }).then(async (res) => {
 		if (res.status === 401 || res.status === 403) {
 			console.warn(`[${proxy.logTag}] upstream auth failure: ${res.status}`);
@@ -313600,9 +314047,11 @@ function makeFetchForgeCatalogFrameEffect(proxy, upstreamUrl, accessToken) {
 */
 function makeForgeCatalogEventsHandler(proxy, upstreamUrl) {
 	return gen(function* () {
+		const request = yield* HttpServerRequest;
+		const organizationId = normalizeOrgIdQueryParam(new URL(request.url, "http://localhost").searchParams.get("orgId"));
 		const { session, jwt: accessToken } = yield* makeCmmdProxyAccessTokenEffect(proxy.logTag);
 		if (!accessToken) return yield* respondCmmdConnectionRequired(session.sessionId);
-		const fetchFrame = makeFetchForgeCatalogFrameEffect(proxy, upstreamUrl, accessToken);
+		const fetchFrame = makeFetchForgeCatalogFrameEffect(proxy, upstreamUrl, accessToken, organizationId);
 		const dataStream = concat$2(fromEffect(fetchFrame), tick(FORGE_RUNTIMES_POLL_INTERVAL).pipe(mapEffect$1(() => fetchFrame))).pipe(filter$2((frame) => frame !== null));
 		const keepaliveStream = tick(FORGE_RUNTIMES_KEEPALIVE_INTERVAL).pipe(map$7(() => FORGE_RUNTIMES_KEEPALIVE_FRAME));
 		return stream(concat$2(succeed$4(FORGE_RUNTIMES_KICKOFF_FRAME), merge$4(dataStream, keepaliveStream)).pipe(ensuring$1(sync$1(() => {
@@ -314092,10 +314541,7 @@ function isLegacyRuntimeConnection(value, expectedRuntimeId) {
 	return [
 		runtime.runtimeId === expectedRuntimeId,
 		runtime.runtimeCapabilityMode === "legacy_env",
-		hasCmmdRuntimeSpriteIdentity({
-			...Object.hasOwn(runtime, "spriteName") ? { spriteName: typeof runtime.spriteName === "string" ? runtime.spriteName : null } : {},
-			...Object.hasOwn(runtime, "flyMachineId") ? { flyMachineId: typeof runtime.flyMachineId === "string" ? runtime.flyMachineId : null } : {}
-		}),
+		hasCmmdRuntimeSpriteIdentity({ spriteName: typeof runtime.spriteName === "string" ? runtime.spriteName : null }),
 		!Object.hasOwn(runtime, "brokerAuthorityAttestedForgeGitCommit"),
 		runtime.brokerAuthorityAttestedImageRef === null,
 		runtime.brokerAuthorityAttestedImageVersion === null,
@@ -326582,7 +327028,7 @@ const resolveServerConfig = (flags, cliLogLevel, options) => gen(function* () {
 	const isManagedCloudSurface = (env.forgeCmmdRuntimeMode ?? false) || (env.forgeCloudShellMode ?? false);
 	const autoBootstrapProjectFromCwd = getOrElse(resolveOptionPrecedence(fromUndefinedOr(options?.forceAutoBootstrapProjectFromCwd), isHeadlessStartup ? some(false) : none$4(), normalizedFlags.autoBootstrapProjectFromCwd, fromUndefinedOr(env.autoBootstrapProjectFromCwd), fromUndefinedOr(bootstrap?.autoBootstrapProjectFromCwd)), () => mode === "web" && !isManagedCloudSurface);
 	const logWebSocketEvents = getOrElse(resolveOptionPrecedence(normalizedFlags.logWebSocketEvents, fromUndefinedOr(env.logWebSocketEvents), fromUndefinedOr(bootstrap?.logWebSocketEvents)), () => Boolean(devUrl));
-	const staticDir = devUrl ? void 0 : yield* resolveStaticDir();
+	const staticDir = devUrl || isManagedCloudSurface ? void 0 : yield* resolveStaticDir();
 	const host = getOrElse(resolveOptionPrecedence(normalizedFlags.host, fromUndefinedOr(env.host), fromUndefinedOr(bootstrap?.host)), () => mode === "desktop" ? "127.0.0.1" : void 0);
 	const logLevel = getOrElse(cliLogLevel, () => env.logLevel);
 	const browserWebRtcIceServers = parseBrowserWebRtcIceServers(env.browserWebRtcIceServers);
@@ -326766,16 +327212,16 @@ const findActiveProjectTarget = fn$1("findActiveProjectTarget")(function* (input
 		workspaceRoot: resolved.workspaceRoot
 	};
 });
-const fetchLiveOrchestrationSnapshot = (origin, bearerToken$2) => runLiveServerRequest(get$7(`${origin}/api/orchestration/snapshot`).pipe(acceptJson, bearerToken(bearerToken$2)), matchStatus({
+const fetchLiveOrchestrationSnapshot = (origin, bearerToken$3) => runLiveServerRequest(get$7(`${origin}/api/orchestration/snapshot`).pipe(acceptJson, bearerToken(bearerToken$3)), matchStatus({
 	"2xx": decodeOrchestrationReadModelResponse,
 	orElse: (response) => readErrorMessageFromResponse(response).pipe(flatMap((message) => fail(new Error(message))))
 }));
 const ProjectLeadExplanationEnvelope = Struct({ data: ProjectLeadExplanationSchema });
-const fetchLiveProjectLeadExplanation = (origin, bearerToken$1, projectId) => runLiveServerRequest(get$7(`${origin}/api/cmmd/projects/${projectId}/project-lead/explain`).pipe(acceptJson, bearerToken(bearerToken$1)), matchStatus({
+const fetchLiveProjectLeadExplanation = (origin, bearerToken$2, projectId) => runLiveServerRequest(get$7(`${origin}/api/cmmd/projects/${projectId}/project-lead/explain`).pipe(acceptJson, bearerToken(bearerToken$2)), matchStatus({
 	"2xx": (response) => schemaBodyJson$1(ProjectLeadExplanationEnvelope)(response).pipe(map$3((body) => body.data)),
 	orElse: (response) => readErrorMessageFromResponse(response).pipe(flatMap((message) => fail(new Error(message))))
 }));
-const dispatchLiveOrchestrationCommand = (origin, bearerToken$3, command) => post(`${origin}/api/orchestration/dispatch`).pipe(acceptJson, bearerToken(bearerToken$3), bodyJson(command), flatMap((request) => runLiveServerRequest(request, matchStatus({
+const dispatchLiveOrchestrationCommand = (origin, bearerToken$1, command) => post(`${origin}/api/orchestration/dispatch`).pipe(acceptJson, bearerToken(bearerToken$1), bodyJson(command), flatMap((request) => runLiveServerRequest(request, matchStatus({
 	"2xx": () => void_$1,
 	orElse: (response) => readErrorMessageFromResponse(response).pipe(flatMap((message) => fail(new Error(message))))
 }))));
@@ -327076,7 +327522,7 @@ const connectLoginCommand = make$33("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-yHTUkd2Y.mjs")).default;
+			const open = (await import("./open-2-reBrpv.mjs")).default;
 			await open(url);
 			return true;
 		},