@cmmd-center/forge 0.9.13 → 0.9.15

package/dist/bin.mjs

@@ -11,7 +11,7 @@ import { a as make$48, i as keys, n as getOption, o as makeWith$1, r as invalida
 import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$49, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-B2g5pJux.mjs";
 import { r as wrapper_default, t as Mime_default } from "./Mime-Dq9IoNiV.mjs";
 import { a as diag, c as SpanKind$1, d as TraceFlags, f as ROOT_CONTEXT, i as propagation, l as isSpanContextValid, m as DiagLogLevel, n as init_esm$1, o as context$1, p as createContextKey, r as trace, s as SpanStatusCode, t as esm_exports$1 } from "./esm-wLIF-u3N.mjs";
-import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicketRefreshProof, d as createReadOnceFileTokenAccessor, i as sendRuntimeControlHeartbeat, l as runtimeGrantToken, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, r as readRuntimeControlAuthority, s as verifyCmmdRuntimeTicket, t as bootstrapRuntimeControlAuthority, u as setRuntimeGrantToken } from "./runtimeControlAuthority-akIBTI-S.mjs";
+import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicket, d as setRuntimeGrantToken, f as createReadOnceFileTokenAccessor, i as sendRuntimeControlHeartbeat, l as verifyCmmdRuntimeTicketRefreshProof, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, r as readRuntimeControlAuthority, s as verifyCmmdClaudeUsageTicket, t as bootstrapRuntimeControlAuthority, u as runtimeGrantToken } from "./runtimeControlAuthority-COHmz_WT.mjs";
 import { n as PtySpawnError, t as PtyAdapter } from "./PTY-Cx_YKiEO.mjs";
 import { createRequire } from "node:module";
 import * as HE from "node:child_process";
@@ -22,7 +22,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import os, { homedir, networkInterfaces, tmpdir } from "node:os";
+import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -32066,7 +32066,7 @@ function requiredString(value, minimumLength = 1) {
 	if (typeof value !== "string" || value.length < minimumLength) return identityCorrupt();
 	return value;
 }
-function positiveInteger$1(value) {
+function positiveInteger$2(value) {
 	if (!Number.isInteger(value) || Number(value) <= 0) return identityCorrupt();
 	return Number(value);
 }
@@ -32086,7 +32086,7 @@ function parseChallenge(value) {
 	if (!value || typeof value !== "object") return identityCorrupt();
 	const record = value;
 	return {
-		deviceId: positiveInteger$1(record.deviceId),
+		deviceId: positiveInteger$2(record.deviceId),
 		challengeId: requiredString(record.challengeId, 8),
 		signingPayload: requiredString(record.signingPayload),
 		currentKeyId: requiredString(record.currentKeyId),
@@ -49482,7 +49482,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = os.release().split(".");
+		const osRelease = $U.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -51925,7 +51925,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$4 = __require("os");
+	const os$3 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -51947,7 +51947,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$4.userInfo();
+				const userInfo = os$3.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -64870,7 +64870,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.13";
+var version$1 = "0.9.15";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -65343,7 +65343,7 @@ function readCmmdAvatarUrl(raw) {
 function readTrimmedString$2(value) {
 	return typeof value === "string" ? value.trim() || null : null;
 }
-function asRecord$11(value) {
+function asRecord$12(value) {
 	return value && typeof value === "object" ? value : null;
 }
 function readDirectPlanLabelFromRecord(obj) {
@@ -65355,26 +65355,26 @@ function readNestedPlanLabelFromRecord(obj) {
 function readCmmdPlanLabel(obj) {
 	const direct = readDirectPlanLabelFromRecord(obj);
 	if (direct) return direct;
-	const plan = asRecord$11(obj["plan"]);
+	const plan = asRecord$12(obj["plan"]);
 	if (plan) {
 		const label = readNestedPlanLabelFromRecord(plan);
 		if (label) return label;
 	}
-	const subscription = asRecord$11(obj["subscription"]);
+	const subscription = asRecord$12(obj["subscription"]);
 	if (subscription) {
 		const label = readNestedPlanLabelFromRecord(subscription);
 		if (label) return label;
-		const subscriptionPlan = asRecord$11(subscription["plan"]);
+		const subscriptionPlan = asRecord$12(subscription["plan"]);
 		if (subscriptionPlan) {
 			const nestedLabel = readNestedPlanLabelFromRecord(subscriptionPlan);
 			if (nestedLabel) return nestedLabel;
 		}
 	}
-	const billing = asRecord$11(obj["billing"]);
+	const billing = asRecord$12(obj["billing"]);
 	if (billing) {
 		const label = readNestedPlanLabelFromRecord(billing);
 		if (label) return label;
-		const billingPlan = asRecord$11(billing["plan"]);
+		const billingPlan = asRecord$12(billing["plan"]);
 		if (billingPlan) return readNestedPlanLabelFromRecord(billingPlan);
 	}
 	return null;
@@ -65511,7 +65511,7 @@ function constantTimeEqual(left, right) {
 function integerSeconds(value) {
 	return Number.isSafeInteger(value) && value >= 0 ? value : null;
 }
-function positiveInteger(value) {
+function positiveInteger$1(value) {
 	return Number.isSafeInteger(value) && value > 0 ? value : null;
 }
 function parseAssertion(token) {
@@ -65538,7 +65538,7 @@ function hasExpectedPayloadContext(payload) {
 function readRequiredClaims(payload) {
 	const subject = nonEmptyString$1(payload["sub"]);
 	if (!subject) return null;
-	const userId = positiveInteger(payload["user_id"]);
+	const userId = positiveInteger$1(payload["user_id"]);
 	if (!userId) return null;
 	const jti = nonEmptyString$1(payload["jti"]);
 	if (!jti) return null;
@@ -66692,13 +66692,13 @@ function validateCommandBootstrapPayload(payload) {
 		});
 		const payloadIdentity = normalizeCmmdUserIdentity(payload.user);
 		if (payloadIdentity) {
-			const cmmdIdentity = payloadIdentity.avatarUrl ? payloadIdentity : mergeCmmdUserIdentity(payloadIdentity, yield* fetchOptionalCmmdIdentityForAccessToken(payload.accessToken));
+			const cmmdIdentity = payloadIdentity.avatarUrl ? payloadIdentity : mergeCmmdUserIdentity(payloadIdentity, yield* fetchOptionalCmmdIdentityForAccessToken(cmmdUserCredential(payload)));
 			return {
 				subjectUserId: cmmdIdentity.id,
 				cmmdIdentity
 			};
 		}
-		const tokenIdentity = yield* fetchCmmdIdentityForAccessToken(payload.accessToken);
+		const tokenIdentity = yield* fetchCmmdIdentityForAccessToken(cmmdUserCredential(payload));
 		if (tokenIdentity) return {
 			subjectUserId: tokenIdentity.id,
 			cmmdIdentity: tokenIdentity
@@ -66791,6 +66791,23 @@ function isCmmdJwtToken(token) {
 	return token?.startsWith("eyJ") ?? false;
 }
 /**
+* The credential CMMD's userinfo accepts.
+*
+* Since CMMD's OAuth update, `access_token` is a JWT and the personal access
+* token arrives separately as `mcp_token`. userinfo authenticates the PAT and
+* rejects the JWT with `INVALID_OR_NON_USER_TOKEN`, so presenting the JWT
+* resolves no identity: the bootstrap then finds no subject and answers 401,
+* even though the sign-in itself succeeded and the caller did nothing wrong.
+*
+* `resolveCmmdTokenBundleCredentials` already draws this distinction for the
+* owner lanes. This is the same rule for the bootstrap lane, which had only ever
+* seen the pre-update shape where `access_token` was itself the PAT.
+*/
+function cmmdUserCredential(payload) {
+	const pat = payload.mcpToken?.trim();
+	return isCmmdJwtToken(payload.accessToken) && pat ? pat : payload.accessToken;
+}
+/**
 * Read one CMMD token-exchange response into the credential set Forge stores.
 *
 * Both owner lanes redeem the same `cmmd-forge-web` authorization code — the
@@ -69135,22 +69152,22 @@ const EMPTY_PARSED_ERROR = {
 	message: null,
 	raw: null
 };
-function asRecord$10(value) {
+function asRecord$11(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function readTrimmedString$1(value) {
 	return (typeof value === "string" ? value.trim() : "") || null;
 }
 function readErrorEnvelope(record) {
-	return asRecord$10(record["error"]);
+	return asRecord$11(record["error"]);
 }
 function readUpstreamErrorCode(body) {
-	const record = asRecord$10(body);
+	const record = asRecord$11(body);
 	if (record === null) return null;
 	return readTrimmedString$1(record["code"]) ?? readTrimmedString$1(readErrorEnvelope(record)?.["code"]);
 }
 function readErrorMessage$2(raw) {
-	const record = asRecord$10(raw);
+	const record = asRecord$11(raw);
 	if (record === null) return null;
 	const error = record["error"];
 	const nestedMessage = readErrorEnvelope(record)?.["message"];
@@ -69782,7 +69799,7 @@ function buildProxyErrorResponse(error) {
 		code: error.code
 	}, { status: 403 });
 	if (error instanceof CmmdProxyRequestError) {
-		const status = error.status >= 500 ? 502 : error.status;
+		const status = error.status === 503 ? 503 : error.status >= 500 ? 502 : error.status;
 		return jsonUnsafe({
 			error: error.detail ?? "CMMD REST request failed.",
 			code: error.code,
@@ -73483,7 +73500,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$3 = __require("os");
+	var os$2 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -73491,8 +73508,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$3.arch();
-	var platform = process.env.npm_config_platform || os$3.platform();
+	var arch = process.env.npm_config_arch || os$2.arch();
+	var platform = process.env.npm_config_platform || os$2.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -91150,7 +91167,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-FIgTDosf.mjs"),
+		try: () => import("./open-D8mGyWmt.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -92509,7 +92526,7 @@ function hasValidRuntimeIdentity(value) {
 }
 function decodeRuntime$1(value) {
 	if (!isRecord$16(value) || !hasValidRuntimeIdentity(value)) return null;
-	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableInteger(value.projectId) || !nullableString(value.projectName) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === null || isRecord$16(value.metadata))) return null;
+	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === null || isRecord$16(value.metadata))) return null;
 	return value;
 }
 function decodeProject(value) {
@@ -92820,8 +92837,6 @@ function replicaRuntimeMatches(left, right) {
 		[left.status, right.status],
 		[left.endpointUrl, right.endpointUrl],
 		[left.deviceId, right.deviceId],
-		[left.projectId, right.projectId],
-		[left.projectName, right.projectName],
 		[left.workspaceRoot, right.workspaceRoot],
 		[left.githubRepoFullName, right.githubRepoFullName],
 		[left.lastSeenAt, right.lastSeenAt]
@@ -96479,7 +96494,7 @@ const EMPTY_PLAN_VALUES = new Set([
 	"none",
 	"null"
 ]);
-function asRecord$9(value) {
+function asRecord$10(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
 	return value;
 }
@@ -96496,7 +96511,7 @@ function decodeJwtClaims(token) {
 	try {
 		const decoded = Buffer.from(payload, "base64url");
 		if (decoded.byteLength > MAX_CLAIMS_BYTES) return void 0;
-		return asRecord$9(JSON.parse(decoded.toString("utf8")));
+		return asRecord$10(JSON.parse(decoded.toString("utf8")));
 	} catch {
 		return;
 	}
@@ -96518,7 +96533,7 @@ function findPlanType(claims) {
 	const direct = fromRecord(claims);
 	if (direct) return direct;
 	for (const value of Object.values(claims)) {
-		const nested = asRecord$9(value);
+		const nested = asRecord$10(value);
 		if (!nested) continue;
 		const found = fromRecord(nested);
 		if (found) return found;
@@ -96535,7 +96550,7 @@ function readCodexAuthIdentity(authJson) {
 	} catch {
 		return {};
 	}
-	const claims = decodeJwtClaims(asRecord$9(asRecord$9(parsed)?.tokens)?.id_token);
+	const claims = decodeJwtClaims(asRecord$10(asRecord$10(parsed)?.tokens)?.id_token);
 	if (!claims) return {};
 	const email = findEmail(claims);
 	const planType = findPlanType(claims);
@@ -96732,11 +96747,6 @@ function recordClaudeRateLimitTelemetry(info, generationHash = currentClaudeUsag
 		observedAt: [fiveHourObservedAt, sevenDayObservedAt].filter((value) => value !== null).toSorted()[0]
 	});
 }
-function getLatestClaudeRateLimitTelemetry(generationHash = currentClaudeUsageGenerationHash(), providerAccountId) {
-	if (generationHash === null) return null;
-	const cacheKey = providerAccountId ? `${providerAccountId}:${generationHash}` : generationHash;
-	return cachedSnapshots.get(cacheKey) ?? null;
-}
 //#endregion
 //#region src/providerAuth/ClaudeDeviceAuth.ts
 const AUTHORIZE_URL_PATTERN = /https:\/\/[^\s]*\/oauth\/authorize\?[^\s]+/u;
@@ -97115,17 +97125,23 @@ async function loadClaudeAccountMetadataFromCli(homePath) {
 function extractClaudeCredentialGenerationId(response) {
 	if (typeof response !== "object" || response === null || !("data" in response)) return null;
 	const data = response.data;
-	if (typeof data !== "object" || data === null || !("connected" in data) || !data.connected) return null;
-	if (!("generationId" in data) || typeof data.generationId !== "string") return null;
-	const generationId = data.generationId.trim();
+	if (typeof data !== "object" || data === null) return null;
+	if ("connected" in data && data.connected === true && "generationId" in data && typeof data.generationId === "string") {
+		const generationId = data.generationId.trim();
+		return generationId.length > 0 ? generationId : null;
+	}
+	if (!("account" in data) || typeof data.account !== "object" || data.account === null) return null;
+	const account = data.account;
+	if (!("credentialGenerationId" in account) || typeof account.credentialGenerationId !== "string") return null;
+	const generationId = account.credentialGenerationId.trim();
 	return generationId.length > 0 ? generationId : null;
 }
 function extractClaudeProviderAccountId(response) {
-	const generationId = extractClaudeCredentialGenerationId(response);
-	if (generationId !== null) return generationId;
 	if (typeof response !== "object" || response === null || !("data" in response)) return null;
 	const data = response.data;
-	if (typeof data !== "object" || data === null || !("account" in data)) return null;
+	if (typeof data !== "object" || data === null) return null;
+	if ("connected" in data && data.connected === true) return extractClaudeCredentialGenerationId(response);
+	if (!("account" in data)) return null;
 	const account = data.account;
 	if (typeof account !== "object" || account === null || !("providerAccountId" in account) || typeof account.providerAccountId !== "string") return null;
 	const providerAccountId = account.providerAccountId.trim();
@@ -97153,7 +97169,7 @@ async function publishClaudeUsageAfterSync(input) {
 			path: input.auth.path === AUTH_RUNTIME_CLAUDE_CREDENTIAL_PATH ? AUTH_RUNTIME_CLAUDE_USAGE_PATH : USER_CLAUDE_USAGE_PATH,
 			body: {
 				providerAccountId: input.providerAccountId,
-				credentialGenerationId: input.providerAccountId,
+				credentialGenerationId: input.credentialGenerationId,
 				accountEmail: input.accountEmail,
 				accountDisplayName: input.accountDisplayName,
 				planType: input.planType,
@@ -97170,11 +97186,13 @@ async function publishClaudeUsageAfterSync(input) {
 }
 async function finalizeClaudeCredentialSync(input) {
 	const providerAccountId = extractClaudeProviderAccountId(input.response);
-	if (providerAccountId === null) return null;
-	if (input.auth.path === USER_CLAUDE_CREDENTIAL_PATH) setLocalClaudeUsageGeneration(providerAccountId);
+	const credentialGenerationId = extractClaudeCredentialGenerationId(input.response);
+	if (providerAccountId === null || credentialGenerationId === null) return null;
+	if (input.auth.path === USER_CLAUDE_CREDENTIAL_PATH) setLocalClaudeUsageGeneration(credentialGenerationId);
 	return publishClaudeUsageAfterSync({
 		auth: input.auth,
 		providerAccountId,
+		credentialGenerationId,
 		accountEmail: input.accountEmail,
 		accountDisplayName: input.accountDisplayName,
 		planType: input.planType,
@@ -184355,7 +184373,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -194555,12 +194573,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$2 = "https://code.claude.com/docs/en", kKe = [
+var os$1 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$2}/iam#permission-modes`
+			docLink: `${os$1}/iam#permission-modes`
 		}
 	},
 	{
@@ -194575,7 +194593,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$2}/settings#environment-variables`
+			docLink: `${os$1}/settings#environment-variables`
 		}
 	},
 	{
@@ -194586,14 +194604,14 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$2}/hooks`
+			docLink: `${os$1}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$2}/hooks#exec-form-and-shell-form`
+			docLink: `${os$1}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -194608,7 +194626,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$2}/settings`
+			docLink: `${os$1}/settings`
 		}
 	},
 	{
@@ -194623,13 +194641,13 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$2}/iam#working-directories`
+			docLink: `${os$1}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$2}/iam#configuring-permissions`,
-	env: `${os$2}/settings#environment-variables`,
-	hooks: `${os$2}/hooks`
+	permissions: `${os$1}/iam#configuring-permissions`,
+	env: `${os$1}/settings#environment-variables`,
+	hooks: `${os$1}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -203517,7 +203535,7 @@ const collectStreamAsString = (stream) => stream.pipe(decodeText$1(), runFold(()
 //#region src/orchestration/WorkerPlanCodexTools.ts
 const FORGE_PROPOSE_WORKER_TASKS_TOOL = "forge_propose_worker_tasks";
 const MAX_WORKER_PLAN_ITEMS = 5;
-function asRecord$8(value) {
+function asRecord$9(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function readTrimmedString(value) {
@@ -203533,7 +203551,7 @@ function isValidWorkerSummary(value) {
 	return value !== void 0 && value.length > 0 && value.length <= 4e3;
 }
 function decodeWorkerPlanItem(value) {
-	const item = asRecord$8(value);
+	const item = asRecord$9(value);
 	const slug = readTrimmedString(item?.slug);
 	const title = readTrimmedString(item?.title);
 	const summary = readTrimmedString(item?.summary);
@@ -203597,7 +203615,7 @@ function createWorkerPlanDynamicTools() {
 function createWorkerPlanDynamicToolHandler() {
 	return async (input) => {
 		if (input.tool !== "forge_propose_worker_tasks") throw new Error(`Unsupported worker-plan tool: ${input.tool}`);
-		if (!decodeWorkerPlanItems(asRecord$8(input.arguments)?.items)) throw new Error("Worker plans require one to five unique, fully described items.");
+		if (!decodeWorkerPlanItems(asRecord$9(input.arguments)?.items)) throw new Error("Worker plans require one to five unique, fully described items.");
 		return {
 			success: true,
 			contentItems: [{
@@ -205315,25 +205333,25 @@ const AUTH_METHOD_CONTAINER_KEYS = [
 /** Lift an unknown value into `Option<string>` if it is a non-empty string. */
 const asNonEmptyString = (v) => typeof v === "string" && v.length > 0 ? some(v) : none$4();
 /** Lift an unknown value into `Option<Record>` if it is a plain object. */
-const asRecord$7 = (v) => typeof v === "object" && v !== null && !globalThis.Array.isArray(v) ? some(v) : none$4();
+const asRecord$8 = (v) => typeof v === "object" && v !== null && !globalThis.Array.isArray(v) ? some(v) : none$4();
 /**
 * Walk an unknown parsed JSON value looking for a subscription/plan
 * identifier, returning the first match as an `Option`.
 */
 function findSubscriptionType(value) {
 	if (globalThis.Array.isArray(value)) return firstSomeOf(value.map(findSubscriptionType));
-	return asRecord$7(value).pipe(flatMap$2((record) => {
+	return asRecord$8(value).pipe(flatMap$2((record) => {
 		const direct = firstSomeOf(SUBSCRIPTION_TYPE_KEYS.map((key) => asNonEmptyString(record[key])));
 		if (isSome(direct)) return direct;
-		return firstSomeOf(SUBSCRIPTION_CONTAINER_KEYS.map((key) => asRecord$7(record[key]).pipe(flatMap$2(findSubscriptionType))));
+		return firstSomeOf(SUBSCRIPTION_CONTAINER_KEYS.map((key) => asRecord$8(record[key]).pipe(flatMap$2(findSubscriptionType))));
 	}));
 }
 function findAuthMethod(value) {
 	if (globalThis.Array.isArray(value)) return firstSomeOf(value.map(findAuthMethod));
-	return asRecord$7(value).pipe(flatMap$2((record) => {
+	return asRecord$8(value).pipe(flatMap$2((record) => {
 		const direct = firstSomeOf(AUTH_METHOD_KEYS.map((key) => asNonEmptyString(record[key])));
 		if (isSome(direct)) return direct;
-		return firstSomeOf(AUTH_METHOD_CONTAINER_KEYS.map((key) => asRecord$7(record[key]).pipe(flatMap$2(findAuthMethod))));
+		return firstSomeOf(AUTH_METHOD_CONTAINER_KEYS.map((key) => asRecord$8(record[key]).pipe(flatMap$2(findAuthMethod))));
 	}));
 }
 /**
@@ -206481,7 +206499,7 @@ function userInputQuestionsFromToolInput(toolInput) {
 	return (Array.isArray(toolInput.questions) ? toolInput.questions : []).map((question, idx) => userInputQuestionFromUnknown(question, idx));
 }
 function userInputQuestionFromUnknown(question, idx) {
-	const value = asRecord$6(question) ?? {};
+	const value = asRecord$7(question) ?? {};
 	return {
 		id: typeof value.header === "string" ? value.header : `q-${idx}`,
 		header: typeof value.header === "string" ? value.header : `Question ${idx + 1}`,
@@ -206491,13 +206509,13 @@ function userInputQuestionFromUnknown(question, idx) {
 	};
 }
 function userInputOptionFromUnknown(option) {
-	const value = asRecord$6(option) ?? {};
+	const value = asRecord$7(option) ?? {};
 	return {
 		label: typeof value.label === "string" ? value.label : "",
 		description: typeof value.description === "string" ? value.description : ""
 	};
 }
-function asRecord$6(value) {
+function asRecord$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function permissionResultFromDecision(decision, toolInput, suggestions) {
@@ -207304,7 +207322,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 	const updateResumeCursor = fn$1("updateResumeCursor")(function* (context) {
 		const threadId = context.session.threadId;
 		if (!threadId) return;
-		const providerDeliveryBinding = readProviderDeliveryBinding(asRecord$6(context.session.resumeCursor)?.providerDeliveryBinding);
+		const providerDeliveryBinding = readProviderDeliveryBinding(asRecord$7(context.session.resumeCursor)?.providerDeliveryBinding);
 		const resumeCursor = {
 			threadId,
 			...context.resumeSessionId ? { resume: context.resumeSessionId } : {},
@@ -212370,7 +212388,7 @@ function makeAcpContentDeltaEvent(input) {
 }
 //#endregion
 //#region ../../packages/shared/src/toolActivity.ts
-function asRecord$5(value) {
+function asRecord$6(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function asTrimmedString(value) {
@@ -212396,10 +212414,10 @@ function extractCommandFromTitle$1(title) {
 	return /`([^`]+)`/u.exec(title)?.[1]?.trim() || void 0;
 }
 function extractToolCommand(data, title) {
-	const item = asRecord$5(data?.item);
-	const itemInput = asRecord$5(item?.input);
-	const itemResult = asRecord$5(item?.result);
-	const rawInput = asRecord$5(data?.rawInput);
+	const item = asRecord$6(data?.item);
+	const itemInput = asRecord$6(item?.input);
+	const itemResult = asRecord$6(item?.result);
+	const rawInput = asRecord$6(data?.rawInput);
 	const direct = [
 		normalizeCommandValue$1(item?.command),
 		normalizeCommandValue$1(itemInput?.command),
@@ -212427,7 +212445,7 @@ function collectPaths(value, paths, seen, depth) {
 		}
 		return;
 	}
-	const record = asRecord$5(value);
+	const record = asRecord$6(value);
 	if (!record) return;
 	for (const key of [
 		"path",
@@ -212486,7 +212504,7 @@ function deriveToolActivityPresentation(input) {
 	const title = asTrimmedString(input.title);
 	const detail = stripTrailingExitCode(asTrimmedString(input.detail));
 	const fallbackSummary = asTrimmedString(input.fallbackSummary) ?? "Tool";
-	const data = asRecord$5(input.data);
+	const data = asRecord$6(input.data);
 	const command = extractToolCommand(data, title);
 	const primaryPath = extractPrimaryPath(data);
 	const action = classifyToolAction({
@@ -212510,7 +212528,7 @@ function deriveToolActivityPresentation(input) {
 		...primaryPath ? { detail: primaryPath } : {}
 	};
 	if (action === "search") {
-		const query = asTrimmedString(asRecord$5(data?.rawInput)?.query) ?? asTrimmedString(asRecord$5(data?.rawInput)?.pattern) ?? asTrimmedString(asRecord$5(data?.rawInput)?.searchTerm);
+		const query = asTrimmedString(asRecord$6(data?.rawInput)?.query) ?? asTrimmedString(asRecord$6(data?.rawInput)?.pattern) ?? asTrimmedString(asRecord$6(data?.rawInput)?.searchTerm);
 		return {
 			summary: "Searched files",
 			...query ? { detail: query } : {}
@@ -258882,7 +258900,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -259013,14 +259031,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -259028,7 +259046,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -278901,7 +278919,7 @@ function makeApprovedWorkerPlanEventState() {
 function promptKey(masterThreadId, promptId) {
 	return `${masterThreadId}\n${promptId}`;
 }
-function asRecord$4(value) {
+function asRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 function exactMaterializedTaskIds(value, expectedCount) {
@@ -278911,7 +278929,7 @@ function exactMaterializedTaskIds(value, expectedCount) {
 }
 function readyBatchFromActivity(state, event) {
 	if (event.payload.activity.kind !== "plan.task-creation.batch-succeeded") return null;
-	const payload = asRecord$4(event.payload.activity.payload);
+	const payload = asRecord$5(event.payload.activity.payload);
 	const promptId = payload?.["promptId"];
 	if (typeof promptId !== "string") return null;
 	const key = promptKey(event.payload.threadId, promptId);
@@ -280049,7 +280067,7 @@ function runtimeGrantNeedsRefresh(token, identity, nowSeconds = Math.floor(Date.
 	return claims.expiresAtSeconds - nowSeconds <= RUNTIME_GRANT_REFRESH_SKEW_SECONDS;
 }
 /** Narrow an unknown to a plain object, or null. */
-function asRecord$3(value) {
+function asRecord$4(value) {
 	return value !== null && typeof value === "object" ? value : null;
 }
 /** The raw (untrimmed) string when it is present and not blank, else null. */
@@ -280061,7 +280079,7 @@ function asTimestamp(value) {
 	return typeof value === "string" && Number.isFinite(Date.parse(value)) ? value : null;
 }
 function parseRuntimeGrantRefreshResponse(runtimeId, value) {
-	const data = asRecord$3(asRecord$3(value)?.data);
+	const data = asRecord$4(asRecord$4(value)?.data);
 	if (!data || data.runtimeId !== runtimeId) return null;
 	const grantToken = asNonBlankString(data.grantToken);
 	const expiresAt = asTimestamp(data.expiresAt);
@@ -296157,6 +296175,74 @@ const LocalAutomationSchedulerLive = effectDiscard(gen(function* () {
 	yield* forkScoped(startup.awaitCommandReady.pipe(andThen(forever$1(tick.pipe(andThen(sleep$4("60 seconds")))))));
 }));
 //#endregion
+//#region src/command/providerUsageEnvironment.ts
+function asRecord$3(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function positiveInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
+}
+function readEnvironmentId(value) {
+	return typeof value === "string" && value.trim() !== "" ? value : null;
+}
+function readEligibleStatus(value) {
+	return value === "running" || value === "suspended" ? value : null;
+}
+function isOwnedRuntime(row, ownerUserId) {
+	return positiveInteger(row["userId"]) === ownerUserId;
+}
+function readRuntimeId(row) {
+	const runtimeId = row["runtimeId"];
+	return typeof runtimeId === "string" && runtimeId.trim() !== "" ? runtimeId : null;
+}
+function readCandidate(runtime, ownerUserId) {
+	const row = asRecord$3(runtime);
+	if (row === null || !isOwnedRuntime(row, ownerUserId) || row["desiredState"] !== "running") return null;
+	const organizationId = positiveInteger(row["organizationId"]);
+	const environmentId = readEnvironmentId(row["environmentId"]);
+	const runtimeId = readRuntimeId(row);
+	const status = readEligibleStatus(row["status"]);
+	if (organizationId === null || environmentId === null || runtimeId === null || status === null) return null;
+	return {
+		organizationId,
+		environmentId,
+		runtimeId,
+		status
+	};
+}
+function candidateKey(candidate) {
+	return `${candidate.organizationId}:${candidate.environmentId ?? ""}`;
+}
+function statusRank(status) {
+	return status === "running" ? 0 : 1;
+}
+function deduplicateCandidates(candidates) {
+	const byEnvironment = /* @__PURE__ */ new Map();
+	for (const candidate of candidates) {
+		const key = candidateKey(candidate);
+		const existing = byEnvironment.get(key);
+		if (existing === void 0 || statusRank(candidate.status) < statusRank(existing.status)) byEnvironment.set(key, candidate);
+	}
+	return [...byEnvironment.values()];
+}
+/**
+* Selects one authenticated owner's Environment from CMMD's projectless runtime
+* catalog. A tied best candidate fails closed, so Forge never chooses an
+* organization from browser input.
+*/
+function selectProviderUsageEnvironment(rawCatalog, ownerUserId) {
+	const runtimes = asRecord$3(asRecord$3(rawCatalog)?.["data"])?.["runtimes"];
+	if (!Array.isArray(runtimes)) return { kind: "unavailable" };
+	const candidates = deduplicateCandidates(runtimes.map((runtime) => readCandidate(runtime, ownerUserId)).filter((candidate) => candidate !== null));
+	const bestRank = Math.min(...candidates.map((candidate) => statusRank(candidate.status)));
+	const bestCandidates = candidates.filter((candidate) => statusRank(candidate.status) === bestRank);
+	if (bestCandidates.length !== 1) return { kind: "unavailable" };
+	return {
+		kind: "ready",
+		organizationId: bestCandidates[0].organizationId
+	};
+}
+//#endregion
 //#region src/command/wsToken.ts
 /**
 * Build the WS token response given an optional PAT and the configured CMMD
@@ -296193,13 +296279,13 @@ function resolveWsUrl(baseUrl) {
 const callCmmdTool = legacyCmmdToolBridge.callTool;
 const extractMcpToolText = legacyCmmdToolBridge.extractText;
 const isCmmdMcpAuthError = legacyCmmdToolBridge.isAuthError;
-var ClaudeUsageReadError = class extends TaggedError("ClaudeUsageReadError") {};
 /**
 * CMMD-side path for the PROJECT-keyed Forge Cloud catalog. Shared by the list
 * proxy, the SSE poll-and-emit proxy, and the register/unregister proxies so the
 * upstream contract lives in exactly one place.
 */
 const CMMD_CLOUD_PROJECTS_PATH = "/api/forge/context/cloud-projects";
+const CMMD_RUNTIMES_PATH = "/api/forge/context/runtimes";
 /**
 * Authenticate the browser session and resolve the CMMD JWT to forward
 * upstream. Returns null when no token could be resolved, which every caller
@@ -296323,6 +296409,10 @@ const cmmdBillingSeriesRouteLayer = registerProxyRoute({
 const cmmdRestUnavailable = () => new CmmdProxyAuthenticationRequiredError("CMMD connection required. Reconnect CMMD to continue.");
 function runCmmdRestProxy(session, proxy, dependencies = {}) {
 	return gen(function* () {
+		if (dependencies.jwt !== void 0) {
+			const explicitJwt = dependencies.jwt;
+			return yield* promise(() => (dependencies.runProxy ?? runProxy)(() => proxy(explicitJwt)));
+		}
 		const resolveJwt = dependencies.resolveJwt ?? resolveCmmdJwtForSession;
 		const jwt = yield* resolveJwt({
 			sessionId: session.sessionId,
@@ -297863,59 +297953,6 @@ const cmmdSetProviderAccountDefaultRouteLayer = registerProxyRoute({
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const resolveConnectedClaudeGeneration = (session) => gen(function* () {
-	const outcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
-		method: "GET",
-		jwt,
-		path: "/api/forge/context/providers/claude/credential"
-	}));
-	if (!outcome.ok) return outcome;
-	const state = unwrapForgeEnvelope(outcome.value);
-	if (state === null || typeof state !== "object" || !("connected" in state) || state.connected !== true || !("generationId" in state) || typeof state.generationId !== "string") return {
-		ok: true,
-		value: null
-	};
-	return {
-		ok: true,
-		value: {
-			generationId: state.generationId,
-			generationHash: createHash("sha256").update(state.generationId).digest("hex")
-		}
-	};
-});
-/**
-* The GET path is read-only. The explicit per-account POST refresh invokes
-* this helper and propagates any CMMD forward failure to the caller.
-*/
-const forwardClaudeUsageTelemetry = (session, requestedProviderAccountId, activelyPoll = false, fetchClaudeUsage = fetchClaudeUsageViaOfficialClient) => gen(function* () {
-	const credentialOutcome = yield* resolveConnectedClaudeGeneration(session);
-	if (!credentialOutcome.ok) return credentialOutcome;
-	if (credentialOutcome.value === null) return null;
-	const { generationId, generationHash } = credentialOutcome.value;
-	const providerAccountId = requestedProviderAccountId ?? generationId;
-	const activeSnapshot = activelyPoll && providerAccountId === generationId ? yield* tryPromise({
-		try: () => fetchClaudeUsage({ binaryPath: resolveClaudeBinaryPath("claude") }),
-		catch: (cause) => new ClaudeUsageReadError({ cause })
-	}).pipe(orElseSucceed(() => null)) : null;
-	const snapshot = activeSnapshot ? {
-		...activeSnapshot,
-		observedAt: (/* @__PURE__ */ new Date()).toISOString()
-	} : getLatestClaudeRateLimitTelemetry(generationHash, providerAccountId);
-	if (!snapshot) return null;
-	return yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
-		method: "POST",
-		jwt,
-		path: "/api/forge/context/providers/usage/claude/telemetry",
-		body: {
-			providerAccountId,
-			credentialGenerationId: generationId,
-			source: activeSnapshot ? "active_poll" : "passive_sdk_telemetry",
-			fiveHour: snapshot.fiveHour,
-			sevenDay: snapshot.sevenDay,
-			observedAt: snapshot.observedAt
-		}
-	}));
-});
 const cmmdGetProviderUsageRouteLayer = add$1("GET", "/api/cmmd/providers/usage", gen(function* () {
 	const request = yield* HttpServerRequest;
 	const outcome = yield* runCmmdRestProxy(yield* (yield* ServerAuth).authenticateHttpRequest(request), (jwt) => cmmdGateway.request({
@@ -297936,15 +297973,62 @@ function parseProviderUsageRefreshInput(rawBody) {
 		providerAccountId: body.providerAccountId
 	};
 }
-const cmmdRefreshProviderUsageRouteLayer = add$1("POST", "/api/cmmd/providers/usage/refresh", gen(function* () {
-	const request = yield* HttpServerRequest;
-	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	const input = parseProviderUsageRefreshInput(yield* request.json);
-	if (input === null) return jsonUnsafe({ error: "provider and providerAccountId must identify a connected provider account" }, { status: 400 });
-	const claudeOutcome = input.provider === "claude" ? yield* forwardClaudeUsageTelemetry(session, input.providerAccountId, true) : null;
-	if (input.provider === "claude" && claudeOutcome !== null && !claudeOutcome.ok) return buildProxyErrorResponse(claudeOutcome.error);
-	if (input.provider === "claude" && claudeOutcome === null) return jsonUnsafe({ error: "No exact-account Claude usage observation is available in this runtime." }, { status: 503 });
-	if (input.provider === "codex") {
+function resolveProviderUsageOwnerUserId(session) {
+	const identity = readCmmdUserIdentityForSession(session.sessionId);
+	const userId = identity === null ? NaN : Number(identity.id);
+	return Number.isSafeInteger(userId) && userId > 0 ? userId : null;
+}
+function buildClaudeUsageRefreshErrorResponse(error) {
+	return jsonUnsafe({
+		error: "Claude usage refresh is unavailable.",
+		code: "CLAUDE_USAGE_REFRESH_UNAVAILABLE"
+	}, { status: error instanceof CmmdProxyRequestError && error.status === 503 ? 503 : 502 });
+}
+function makeRefreshProviderUsageHandler(dependencies = {}) {
+	return gen(function* () {
+		const request = yield* HttpServerRequest;
+		const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
+		const input = parseProviderUsageRefreshInput(yield* request.json);
+		if (input === null) return jsonUnsafe({ error: "provider and providerAccountId must identify a connected provider account" }, { status: 400 });
+		if (input.provider === "claude") {
+			const requestJwt = yield* (dependencies.resolveJwt ?? resolveCmmdJwtForSession)({
+				sessionId: session.sessionId,
+				subject: session.subject,
+				logPrefix: "claude-usage-refresh"
+			});
+			if (!requestJwt) return buildClaudeUsageRefreshErrorResponse(/* @__PURE__ */ new Error("CMMD authentication required."));
+			const ownerUserId = resolveProviderUsageOwnerUserId(session);
+			if (ownerUserId === null) return jsonUnsafe({
+				error: "CMMD owner identity is unavailable for Claude usage refresh.",
+				code: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE"
+			}, { status: 503 });
+			const catalogOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
+				method: "GET",
+				jwt,
+				path: CMMD_RUNTIMES_PATH
+			}), { jwt: requestJwt });
+			if (!catalogOutcome.ok) return buildClaudeUsageRefreshErrorResponse(catalogOutcome.error);
+			const target = selectProviderUsageEnvironment(catalogOutcome.value, ownerUserId);
+			if (target.kind === "unavailable") return jsonUnsafe({
+				error: "No owned Environment with running intent is available for Claude usage refresh.",
+				code: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE"
+			}, { status: 503 });
+			const refreshOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
+				method: "POST",
+				jwt,
+				path: "/api/forge/context/providers/usage/claude/refresh",
+				body: { providerAccountId: input.providerAccountId },
+				orgId: String(target.organizationId)
+			}), { jwt: requestJwt });
+			if (!refreshOutcome.ok) return buildClaudeUsageRefreshErrorResponse(refreshOutcome.error);
+			const snapshotOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
+				method: "GET",
+				jwt,
+				path: "/api/forge/context/providers/usage"
+			}), { jwt: requestJwt });
+			if (!snapshotOutcome.ok) return buildClaudeUsageRefreshErrorResponse(snapshotOutcome.error);
+			return jsonUnsafe(unwrapForgeEnvelope(snapshotOutcome.value), { status: 200 });
+		}
 		const refreshOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
 			method: "POST",
 			jwt,
@@ -297952,16 +298036,16 @@ const cmmdRefreshProviderUsageRouteLayer = add$1("POST", "/api/cmmd/providers/us
 			body: { providerAccountId: input.providerAccountId }
 		}));
 		if (!refreshOutcome.ok) return buildProxyErrorResponse(refreshOutcome.error);
-		if (claudeOutcome !== null && !claudeOutcome.ok) return buildProxyErrorResponse(claudeOutcome.error);
-	}
-	const outcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
-		method: "GET",
-		jwt,
-		path: "/api/forge/context/providers/usage"
-	}));
-	if (!outcome.ok) return buildProxyErrorResponse(outcome.error);
-	return jsonUnsafe(unwrapForgeEnvelope(outcome.value), { status: 200 });
-}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+		const snapshotOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
+			method: "GET",
+			jwt,
+			path: "/api/forge/context/providers/usage"
+		}));
+		if (!snapshotOutcome.ok) return buildProxyErrorResponse(snapshotOutcome.error);
+		return jsonUnsafe(unwrapForgeEnvelope(snapshotOutcome.value), { status: 200 });
+	}).pipe(catchTag("AuthError", (error) => respondToAuthError(error)));
+}
+const cmmdRefreshProviderUsageRouteLayer = add$1("POST", "/api/cmmd/providers/usage/refresh", makeRefreshProviderUsageHandler());
 const cmmdGetUserCodexCredentialRouteLayer = registerProxyRoute({
 	forgePath: "/api/cmmd/providers/codex/credential",
 	method: "GET",
@@ -308993,6 +309077,82 @@ const claudeNativeGenerationProofRouteLayer = add$1("GET", "/api/runtime/provide
 		generationHash: yield* readUsableClaudeGenerationHash(config)
 	});
 }));
+const defaultClaudeUsageRouteDependencies = {
+	readCredential: async (token) => {
+		const base = process.env.FORGE_CMMD_RUNTIME_CONTROL_PLANE_URL?.trim() ?? "";
+		if (!base) return null;
+		const response = await fetch(`${base.replace(/\/+$/u, "")}/api/forge/context/auth-runtime-claude-credential`, {
+			headers: {
+				authorization: `Bearer ${token}`,
+				accept: "application/json"
+			},
+			signal: AbortSignal.timeout(2e4)
+		});
+		return response.ok ? response.text() : null;
+	},
+	createDirectory: () => mkdtemp(join(tmpdir(), "forge-claude-usage-")),
+	writeCredential: (directory, credential) => writeFile(join(directory, ".credentials.json"), credential, { mode: 384 }),
+	loadUsage: (directory) => fetchClaudeUsageViaOfficialClient({
+		binaryPath: resolveClaudeBinaryPath("claude"),
+		claudeConfigDir: directory
+	}),
+	removeDirectory: (directory) => rm(directory, {
+		recursive: true,
+		force: false
+	}),
+	now: () => /* @__PURE__ */ new Date()
+};
+const claudeUsageHandler = (dependencies) => gen(function* () {
+	const request = yield* HttpServerRequest;
+	const config = yield* ServerConfig;
+	const token = claudeReadinessToken(request.headers.authorization);
+	const required = completeClaudeReadinessExpectations(config);
+	if (!token || !required) return unauthorizedClaudeReadinessResponse();
+	const claims = verifyCmmdClaudeUsageTicket(token, required);
+	if (!claims) return unauthorizedClaudeReadinessResponse();
+	const claimed = claimClaudeReadinessJti({
+		jti: claims.jti,
+		expiresAtSeconds: claims.expiresAtSeconds,
+		nowSeconds: Math.floor(Date.now() / 1e3)
+	});
+	if (claimed === "replayed") return unauthorizedClaudeReadinessResponse();
+	if (claimed === "capacity_exhausted") return jsonUnsafe({ error: "temporarily_unavailable" }, { status: 503 });
+	return yield* promise(async () => {
+		let directory = null;
+		let response = jsonUnsafe({ error: "temporarily_unavailable" }, { status: 503 });
+		try {
+			directory = await dependencies.createDirectory();
+			const credentialJson = await dependencies.readCredential(token);
+			if (credentialJson !== null && isClaudeSubscriptionCredential(credentialJson)) {
+				await dependencies.writeCredential(directory, credentialJson);
+				const usage = await dependencies.loadUsage(directory);
+				response = jsonUnsafe({
+					fiveHour: usage.fiveHour,
+					sevenDay: usage.sevenDay,
+					observedAt: dependencies.now().toISOString(),
+					receipt: {
+						orgId: claims.orgId,
+						userId: claims.userId,
+						runtimeId: claims.runtimeId,
+						machineId: claims.machineId,
+						credentialEpoch: claims.credentialEpoch,
+						providerAccountId: claims.providerAccountId,
+						credentialGenerationId: claims.generationId
+					}
+				}, { headers: { "cache-control": "no-store" } });
+			}
+		} catch {}
+		if (directory === null) return response;
+		try {
+			await dependencies.removeDirectory(directory);
+		} catch {
+			return jsonUnsafe({ error: "temporarily_unavailable" }, { status: 503 });
+		}
+		return response;
+	});
+});
+const createClaudeUsageRouteLayer = (dependencies = defaultClaudeUsageRouteDependencies) => add$1("POST", "/api/runtime/provider-usage/claude", claudeUsageHandler(dependencies));
+const claudeUsageRouteLayer = createClaudeUsageRouteLayer();
 /**
 * FINDING-CB1 — workspace readiness SSE endpoint.
 *
@@ -309336,7 +309496,7 @@ const MiscRuntimeLayerLive = mergeAll(AnalyticsServiceLayerLive, OpenLive, Serve
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(provideMerge(CheckpointingLayerLive), provideMerge(GitLayerLive), provideMerge(OrchestrationLayerLive), provideMerge(ProviderLayerLive), provideMerge(TerminalLayerLive), provideMerge(AgentBrowserManagerLive), provideMerge(mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(provide$1(ThreadDevRuntimeLive)))), provideMerge(PersistenceLayerLive), provideMerge(KeybindingsLive), provideMerge(ProviderRegistryLive), provideMerge(mergeAll(ServerSettingsLive, UsageServiceLive.pipe(provide$1(ServerSettingsLive)))), provideMerge(WorkspaceLayerLive), provideMerge(WorkspaceReadinessStateLive), provideMerge(ProjectFaviconResolverLive), provideMerge(RepositoryIdentityResolverLive), provideMerge(ServerEnvironmentLive), provideMerge(AuthLayerLive), provideMerge(ServerSecretStoreLayerLive), provideMerge(mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(provide$1(PersistenceLayerLive)))), provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(provideMerge(RuntimeDependenciesWithoutPullRequestsLive), provideMerge(cmmdProjectIdentityResolverLive.pipe(provide$1(RuntimeDependenciesWithoutPullRequestsLive))), provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = mergeAll(authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, cmmdCreateBrainDocRouteLayer, cmmdUpdateTaskRouteLayer, cmmdUpsertTaskPullRequestRouteLayer, ...cmmdPullRequestRouteLayers, cmmdAddTaskCommentRouteLayer, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdSearchTasksRouteLayer, cmmdGetTaskCommentsRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdGetOrgMembersRouteLayer, cmmdSimHostsRouteLayer, cmmdSimLeaseReadRouteLayer, cmmdSimLeaseClaimRouteLayer, cmmdSimLeaseReleaseRouteLayer, cmmdSimLeaseRenewRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdGetTaskAttachmentsRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdDeleteTaskCommentRouteLayer, cmmdGetProjectRepositoryRouteLayer, cmmdListProjectRepositoriesRouteLayer, cmmdArchiveTaskRouteLayer, cmmdUnarchiveTaskRouteLayer, cmmdListTasksRouteLayer, cmmdCreateTaskRouteLayer, cmmdListCampaignsRouteLayer, cmmdGetCampaignRouteLayer, cmmdCreateCampaignRouteLayer, cmmdUpdateCampaignRouteLayer, cmmdDeleteCampaignRouteLayer, cmmdListSavedViewsRouteLayer, cmmdCreateSavedViewRouteLayer, cmmdImportSavedViewRouteLayer, cmmdUpdateSavedViewRouteLayer, cmmdDeleteSavedViewRouteLayer, cmmdListProjectsRouteLayer, cmmdGetProjectRouteLayer, cmmdCreateProjectRouteLayer, cmmdDeleteProjectRouteLayer, cmmdMoveProjectRouteLayer, cmmdGetProjectMembersRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdGetProjectMilestonesRouteLayer, cmmdCreateProjectMilestoneRouteLayer, cmmdUpdateProjectMilestoneRouteLayer, cmmdDeleteProjectMilestoneRouteLayer, cmmdGetProjectUpdatesRouteLayer, cmmdCreateProjectUpdateRouteLayer, cmmdUpdateProjectUpdateRouteLayer, cmmdDeleteProjectUpdateRouteLayer, cmmdImproveProjectContentRouteLayer, cmmdCreateProjectTaskDraftRouteLayer, cmmdGetProjectTaskDraftRouteLayer, cmmdUpdateProjectTaskDraftRouteLayer, cmmdPreviewProjectTaskDraftRouteLayer, cmmdCommitProjectTaskDraftRouteLayer, cmmdDiscardProjectTaskDraftRouteLayer, cmmdGetProjectLeadPlanRouteLayer, cmmdActivateProjectLeadAuthorityRouteLayer, cmmdGetProjectLeadReadinessRouteLayer, cmmdGetProjectLeadCapabilitiesRouteLayer, cmmdGetProjectLeadSummaryRouteLayer, cmmdGetProjectLeadDetailRouteLayer, cmmdGetProjectLeadBriefingRouteLayer, cmmdListProjectLeadEventsRouteLayer, cmmdExplainProjectLeadRouteLayer, cmmdPauseProjectLeadRouteLayer, cmmdResumeProjectLeadRouteLayer, cmmdReserveProjectLeadTaskRouteLayer, cmmdReleaseProjectLeadReservationRouteLayer, cmmdReconcileProjectLeadRouteLayer, cmmdResolveProjectLeadAttentionRouteLayer, cmmdClaimProjectLeadControllerRouteLayer, cmmdRenewProjectLeadControllerClaimRouteLayer, cmmdYieldProjectLeadControllerClaimRouteLayer, cmmdAcknowledgeProjectLeadControllerEventRouteLayer, cmmdRecordProjectLeadControllerDecisionRouteLayer, cmmdListForgeAutomationPresetsRouteLayer, cmmdListUserForgeAutomationRulesRouteLayer, cmmdCreateUserForgeAutomationRuleRouteLayer, cmmdUpdateUserForgeAutomationRuleRouteLayer, cmmdListUserForgeAutomationRunsRouteLayer, cmmdStartUserForgeAutomationRunRouteLayer, cmmdListForgeAutomationRulesRouteLayer, cmmdCreateForgeAutomationRuleRouteLayer, cmmdUpdateForgeAutomationRuleRouteLayer, cmmdListForgeAutomationRunsRouteLayer, cmmdStartForgeAutomationRunRouteLayer, cmmdGetForgeAutomationRunRouteLayer, cmmdRetryForgeAutomationRunRouteLayer, cmmdCancelForgeAutomationRunRouteLayer, cmmdApproveForgeAutomationEscalationRouteLayer, cmmdRejectForgeAutomationEscalationRouteLayer, cmmdListProjectAgentMembersRouteLayer, cmmdCreateProjectAgentMemberRouteLayer, cmmdGetProjectAgentMemberRouteLayer, cmmdRenameProjectAgentMemberRouteLayer, cmmdRetireProjectAgentMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, cmmdListProjectAgentMemberInstancesRouteLayer, cmmdPreviewProjectAgentMemberConsolidationRouteLayer, cmmdApplyProjectAgentMemberConsolidationRouteLayer, cmmdPutProjectTaskAssignmentRouteLayer, cmmdListProjectBoardRouteLayer, cmmdGetProjectTaskWorkflowRouteLayer, cmmdUpdateProjectTaskWorkflowRouteLayer, cmmdCreateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskStatusRouteLayer, cmmdListTaskExecutionOptionsRouteLayer, cmmdCreateTaskWorkSessionRouteLayer, cmmdListProjectWorkSessionsRouteLayer, cmmdGetWorkSessionRouteLayer, cmmdUpdateWorkSessionRouteLayer, cmmdAttachWorkSessionThreadRouteLayer, cmmdListTaskConversationsRouteLayer, cmmdLinkTaskConversationRouteLayer, cmmdGetTaskHistoryRouteLayer, cmmdGetTaskConversationRouteLayer, cmmdSpawnForgeThreadFromBoardTaskRouteLayer, cmmdListCenterBoardRouteLayer, cmmdCreateCenterBoardTaskRouteLayer, cmmdCreateFeedbackRouteLayer, cmmdUpdateCenterBoardTaskRouteLayer, cmmdMoveCenterBoardTaskRouteLayer, cmmdMoveProjectBoardTaskRouteLayer, cmmdArchiveProjectBoardTaskRouteLayer, cmmdUnarchiveProjectBoardTaskRouteLayer, cmmdArchiveCenterBoardTaskRouteLayer, cmmdUnarchiveCenterBoardTaskRouteLayer, cmmdBootstrapRouteLayer, cmmdGetAccountPreferencesRouteLayer, cmmdUpdateAccountPreferencesRouteLayer, cmmdGetOrgProviderPolicyRouteLayer, cmmdListChatsRouteLayer, cmmdGetChatRouteLayer, cmmdListDevicesRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRegisterDeviceRouteLayer, cmmdHeartbeatRuntimeRouteLayer, cmmdGrantRuntimeAccessRouteLayer, cmmdRevokeRuntimeAccessRouteLayer, cmmdCreateRelayControlRouteLayer, cmmdCreateRelayActionGrantRouteLayer, cmmdReplaceRuntimeInventoryRouteLayer, cmmdListRuntimeInventoryRouteLayer, cmmdGetRuntimeDiagnosticsRouteLayer, cmmdProvisionAuthRuntimeRouteLayer, cmmdGetAuthRuntimeRouteLayer, cmmdDestroyAuthRuntimeRouteLayer, cmmdConnectAuthRuntimeRouteLayer, cmmdGetProviderAccountsRouteLayer, cmmdDeleteProviderAccountRouteLayer, cmmdSetProviderAccountDefaultRouteLayer, cmmdGetProviderUsageRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdGetUserCodexCredentialRouteLayer, cmmdDeleteUserCodexCredentialRouteLayer, cmmdGetUserClaudeCredentialRouteLayer, cmmdDeleteUserClaudeCredentialRouteLayer, cmmdGetClaudeRuntimeReadinessRouteLayer, cmmdAppendRuntimeThreadEventsRouteLayer, cmmdGetRuntimeThreadReplicaRouteLayer, cmmdRenameDeviceRouteLayer, cmmdRevokeDeviceRouteLayer, cmmdInstallConnectorRouteLayer, cmmdListConnectorsRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeCloudProjectRegisterRouteLayer, cmmdForgeCloudProjectUnregisterRouteLayer, cmmdForgeCloudProjectLifecyclePreflightRouteLayer, cmmdForgeCloudProjectRemovalRouteLayer, cmmdForgeCloudProjectRemovalPreviewRouteLayer, cmmdForgeCloudProjectRemovalReceiptRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, cmmdGetTaskRouteLayer, commandUpdateTaskRouteLayer, mobileProviderCatalogRouteLayer, cmmdUsageSummaryRouteLayer, cmmdBillingRouteLayer, cmmdBillingSeriesRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, claudeNativeGenerationProofRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
+const makeRoutesLayer = mergeAll(authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, cmmdCreateBrainDocRouteLayer, cmmdUpdateTaskRouteLayer, cmmdUpsertTaskPullRequestRouteLayer, ...cmmdPullRequestRouteLayers, cmmdAddTaskCommentRouteLayer, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdSearchTasksRouteLayer, cmmdGetTaskCommentsRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdGetOrgMembersRouteLayer, cmmdSimHostsRouteLayer, cmmdSimLeaseReadRouteLayer, cmmdSimLeaseClaimRouteLayer, cmmdSimLeaseReleaseRouteLayer, cmmdSimLeaseRenewRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdGetTaskAttachmentsRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdDeleteTaskCommentRouteLayer, cmmdGetProjectRepositoryRouteLayer, cmmdListProjectRepositoriesRouteLayer, cmmdArchiveTaskRouteLayer, cmmdUnarchiveTaskRouteLayer, cmmdListTasksRouteLayer, cmmdCreateTaskRouteLayer, cmmdListCampaignsRouteLayer, cmmdGetCampaignRouteLayer, cmmdCreateCampaignRouteLayer, cmmdUpdateCampaignRouteLayer, cmmdDeleteCampaignRouteLayer, cmmdListSavedViewsRouteLayer, cmmdCreateSavedViewRouteLayer, cmmdImportSavedViewRouteLayer, cmmdUpdateSavedViewRouteLayer, cmmdDeleteSavedViewRouteLayer, cmmdListProjectsRouteLayer, cmmdGetProjectRouteLayer, cmmdCreateProjectRouteLayer, cmmdDeleteProjectRouteLayer, cmmdMoveProjectRouteLayer, cmmdGetProjectMembersRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdGetProjectMilestonesRouteLayer, cmmdCreateProjectMilestoneRouteLayer, cmmdUpdateProjectMilestoneRouteLayer, cmmdDeleteProjectMilestoneRouteLayer, cmmdGetProjectUpdatesRouteLayer, cmmdCreateProjectUpdateRouteLayer, cmmdUpdateProjectUpdateRouteLayer, cmmdDeleteProjectUpdateRouteLayer, cmmdImproveProjectContentRouteLayer, cmmdCreateProjectTaskDraftRouteLayer, cmmdGetProjectTaskDraftRouteLayer, cmmdUpdateProjectTaskDraftRouteLayer, cmmdPreviewProjectTaskDraftRouteLayer, cmmdCommitProjectTaskDraftRouteLayer, cmmdDiscardProjectTaskDraftRouteLayer, cmmdGetProjectLeadPlanRouteLayer, cmmdActivateProjectLeadAuthorityRouteLayer, cmmdGetProjectLeadReadinessRouteLayer, cmmdGetProjectLeadCapabilitiesRouteLayer, cmmdGetProjectLeadSummaryRouteLayer, cmmdGetProjectLeadDetailRouteLayer, cmmdGetProjectLeadBriefingRouteLayer, cmmdListProjectLeadEventsRouteLayer, cmmdExplainProjectLeadRouteLayer, cmmdPauseProjectLeadRouteLayer, cmmdResumeProjectLeadRouteLayer, cmmdReserveProjectLeadTaskRouteLayer, cmmdReleaseProjectLeadReservationRouteLayer, cmmdReconcileProjectLeadRouteLayer, cmmdResolveProjectLeadAttentionRouteLayer, cmmdClaimProjectLeadControllerRouteLayer, cmmdRenewProjectLeadControllerClaimRouteLayer, cmmdYieldProjectLeadControllerClaimRouteLayer, cmmdAcknowledgeProjectLeadControllerEventRouteLayer, cmmdRecordProjectLeadControllerDecisionRouteLayer, cmmdListForgeAutomationPresetsRouteLayer, cmmdListUserForgeAutomationRulesRouteLayer, cmmdCreateUserForgeAutomationRuleRouteLayer, cmmdUpdateUserForgeAutomationRuleRouteLayer, cmmdListUserForgeAutomationRunsRouteLayer, cmmdStartUserForgeAutomationRunRouteLayer, cmmdListForgeAutomationRulesRouteLayer, cmmdCreateForgeAutomationRuleRouteLayer, cmmdUpdateForgeAutomationRuleRouteLayer, cmmdListForgeAutomationRunsRouteLayer, cmmdStartForgeAutomationRunRouteLayer, cmmdGetForgeAutomationRunRouteLayer, cmmdRetryForgeAutomationRunRouteLayer, cmmdCancelForgeAutomationRunRouteLayer, cmmdApproveForgeAutomationEscalationRouteLayer, cmmdRejectForgeAutomationEscalationRouteLayer, cmmdListProjectAgentMembersRouteLayer, cmmdCreateProjectAgentMemberRouteLayer, cmmdGetProjectAgentMemberRouteLayer, cmmdRenameProjectAgentMemberRouteLayer, cmmdRetireProjectAgentMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, cmmdListProjectAgentMemberInstancesRouteLayer, cmmdPreviewProjectAgentMemberConsolidationRouteLayer, cmmdApplyProjectAgentMemberConsolidationRouteLayer, cmmdPutProjectTaskAssignmentRouteLayer, cmmdListProjectBoardRouteLayer, cmmdGetProjectTaskWorkflowRouteLayer, cmmdUpdateProjectTaskWorkflowRouteLayer, cmmdCreateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskStatusRouteLayer, cmmdListTaskExecutionOptionsRouteLayer, cmmdCreateTaskWorkSessionRouteLayer, cmmdListProjectWorkSessionsRouteLayer, cmmdGetWorkSessionRouteLayer, cmmdUpdateWorkSessionRouteLayer, cmmdAttachWorkSessionThreadRouteLayer, cmmdListTaskConversationsRouteLayer, cmmdLinkTaskConversationRouteLayer, cmmdGetTaskHistoryRouteLayer, cmmdGetTaskConversationRouteLayer, cmmdSpawnForgeThreadFromBoardTaskRouteLayer, cmmdListCenterBoardRouteLayer, cmmdCreateCenterBoardTaskRouteLayer, cmmdCreateFeedbackRouteLayer, cmmdUpdateCenterBoardTaskRouteLayer, cmmdMoveCenterBoardTaskRouteLayer, cmmdMoveProjectBoardTaskRouteLayer, cmmdArchiveProjectBoardTaskRouteLayer, cmmdUnarchiveProjectBoardTaskRouteLayer, cmmdArchiveCenterBoardTaskRouteLayer, cmmdUnarchiveCenterBoardTaskRouteLayer, cmmdBootstrapRouteLayer, cmmdGetAccountPreferencesRouteLayer, cmmdUpdateAccountPreferencesRouteLayer, cmmdGetOrgProviderPolicyRouteLayer, cmmdListChatsRouteLayer, cmmdGetChatRouteLayer, cmmdListDevicesRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRegisterDeviceRouteLayer, cmmdHeartbeatRuntimeRouteLayer, cmmdGrantRuntimeAccessRouteLayer, cmmdRevokeRuntimeAccessRouteLayer, cmmdCreateRelayControlRouteLayer, cmmdCreateRelayActionGrantRouteLayer, cmmdReplaceRuntimeInventoryRouteLayer, cmmdListRuntimeInventoryRouteLayer, cmmdGetRuntimeDiagnosticsRouteLayer, cmmdProvisionAuthRuntimeRouteLayer, cmmdGetAuthRuntimeRouteLayer, cmmdDestroyAuthRuntimeRouteLayer, cmmdConnectAuthRuntimeRouteLayer, cmmdGetProviderAccountsRouteLayer, cmmdDeleteProviderAccountRouteLayer, cmmdSetProviderAccountDefaultRouteLayer, cmmdGetProviderUsageRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdGetUserCodexCredentialRouteLayer, cmmdDeleteUserCodexCredentialRouteLayer, cmmdGetUserClaudeCredentialRouteLayer, cmmdDeleteUserClaudeCredentialRouteLayer, cmmdGetClaudeRuntimeReadinessRouteLayer, cmmdAppendRuntimeThreadEventsRouteLayer, cmmdGetRuntimeThreadReplicaRouteLayer, cmmdRenameDeviceRouteLayer, cmmdRevokeDeviceRouteLayer, cmmdInstallConnectorRouteLayer, cmmdListConnectorsRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeCloudProjectRegisterRouteLayer, cmmdForgeCloudProjectUnregisterRouteLayer, cmmdForgeCloudProjectLifecyclePreflightRouteLayer, cmmdForgeCloudProjectRemovalRouteLayer, cmmdForgeCloudProjectRemovalPreviewRouteLayer, cmmdForgeCloudProjectRemovalReceiptRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, cmmdGetTaskRouteLayer, commandUpdateTaskRouteLayer, mobileProviderCatalogRouteLayer, cmmdUsageSummaryRouteLayer, cmmdBillingRouteLayer, cmmdBillingSeriesRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
 const runServer = launch$1(unwrap(gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath();
@@ -310266,7 +310426,7 @@ const connectLoginCommand = make$32("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-FIgTDosf.mjs")).default;
+			const open = (await import("./open-D8mGyWmt.mjs")).default;
 			await open(url);
 			return true;
 		},