@cmmd-center/forge 0.9.14 → 0.9.15

package/dist/bin.cjs

@@ -65123,7 +65123,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.14";
+var version$1 = "0.9.15";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -66945,13 +66945,13 @@ function validateCommandBootstrapPayload(payload) {
 		});
 		const payloadIdentity = normalizeCmmdUserIdentity(payload.user);
 		if (payloadIdentity) {
-			const cmmdIdentity = payloadIdentity.avatarUrl ? payloadIdentity : mergeCmmdUserIdentity(payloadIdentity, yield* fetchOptionalCmmdIdentityForAccessToken(payload.accessToken));
+			const cmmdIdentity = payloadIdentity.avatarUrl ? payloadIdentity : mergeCmmdUserIdentity(payloadIdentity, yield* fetchOptionalCmmdIdentityForAccessToken(cmmdUserCredential(payload)));
 			return {
 				subjectUserId: cmmdIdentity.id,
 				cmmdIdentity
 			};
 		}
-		const tokenIdentity = yield* fetchCmmdIdentityForAccessToken(payload.accessToken);
+		const tokenIdentity = yield* fetchCmmdIdentityForAccessToken(cmmdUserCredential(payload));
 		if (tokenIdentity) return {
 			subjectUserId: tokenIdentity.id,
 			cmmdIdentity: tokenIdentity
@@ -67044,6 +67044,23 @@ function isCmmdJwtToken(token) {
 	return token?.startsWith("eyJ") ?? false;
 }
 /**
+* The credential CMMD's userinfo accepts.
+*
+* Since CMMD's OAuth update, `access_token` is a JWT and the personal access
+* token arrives separately as `mcp_token`. userinfo authenticates the PAT and
+* rejects the JWT with `INVALID_OR_NON_USER_TOKEN`, so presenting the JWT
+* resolves no identity: the bootstrap then finds no subject and answers 401,
+* even though the sign-in itself succeeded and the caller did nothing wrong.
+*
+* `resolveCmmdTokenBundleCredentials` already draws this distinction for the
+* owner lanes. This is the same rule for the bootstrap lane, which had only ever
+* seen the pre-update shape where `access_token` was itself the PAT.
+*/
+function cmmdUserCredential(payload) {
+	const pat = payload.mcpToken?.trim();
+	return isCmmdJwtToken(payload.accessToken) && pat ? pat : payload.accessToken;
+}
+/**
 * Read one CMMD token-exchange response into the credential set Forge stores.
 *
 * Both owner lanes redeem the same `cmmd-forge-web` authorization code — the
@@ -92830,7 +92847,7 @@ function hasValidRuntimeIdentity(value) {
 }
 function decodeRuntime$1(value) {
 	if (!isRecord$16(value) || !hasValidRuntimeIdentity(value)) return null;
-	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableInteger(value.projectId) || !nullableString(value.projectName) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === null || isRecord$16(value.metadata))) return null;
+	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === null || isRecord$16(value.metadata))) return null;
 	return value;
 }
 function decodeProject(value) {
@@ -93141,8 +93158,6 @@ function replicaRuntimeMatches(left, right) {
 		[left.status, right.status],
 		[left.endpointUrl, right.endpointUrl],
 		[left.deviceId, right.deviceId],
-		[left.projectId, right.projectId],
-		[left.projectName, right.projectName],
 		[left.workspaceRoot, right.workspaceRoot],
 		[left.githubRepoFullName, right.githubRepoFullName],
 		[left.lastSeenAt, right.lastSeenAt]

package/dist/bin.mjs

@@ -22,7 +22,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import os, { homedir, networkInterfaces, tmpdir } from "node:os";
+import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -49482,7 +49482,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = os.release().split(".");
+		const osRelease = $U.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -51925,7 +51925,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$4 = __require("os");
+	const os$3 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -51947,7 +51947,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$4.userInfo();
+				const userInfo = os$3.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -64870,7 +64870,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.14";
+var version$1 = "0.9.15";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -66692,13 +66692,13 @@ function validateCommandBootstrapPayload(payload) {
 		});
 		const payloadIdentity = normalizeCmmdUserIdentity(payload.user);
 		if (payloadIdentity) {
-			const cmmdIdentity = payloadIdentity.avatarUrl ? payloadIdentity : mergeCmmdUserIdentity(payloadIdentity, yield* fetchOptionalCmmdIdentityForAccessToken(payload.accessToken));
+			const cmmdIdentity = payloadIdentity.avatarUrl ? payloadIdentity : mergeCmmdUserIdentity(payloadIdentity, yield* fetchOptionalCmmdIdentityForAccessToken(cmmdUserCredential(payload)));
 			return {
 				subjectUserId: cmmdIdentity.id,
 				cmmdIdentity
 			};
 		}
-		const tokenIdentity = yield* fetchCmmdIdentityForAccessToken(payload.accessToken);
+		const tokenIdentity = yield* fetchCmmdIdentityForAccessToken(cmmdUserCredential(payload));
 		if (tokenIdentity) return {
 			subjectUserId: tokenIdentity.id,
 			cmmdIdentity: tokenIdentity
@@ -66791,6 +66791,23 @@ function isCmmdJwtToken(token) {
 	return token?.startsWith("eyJ") ?? false;
 }
 /**
+* The credential CMMD's userinfo accepts.
+*
+* Since CMMD's OAuth update, `access_token` is a JWT and the personal access
+* token arrives separately as `mcp_token`. userinfo authenticates the PAT and
+* rejects the JWT with `INVALID_OR_NON_USER_TOKEN`, so presenting the JWT
+* resolves no identity: the bootstrap then finds no subject and answers 401,
+* even though the sign-in itself succeeded and the caller did nothing wrong.
+*
+* `resolveCmmdTokenBundleCredentials` already draws this distinction for the
+* owner lanes. This is the same rule for the bootstrap lane, which had only ever
+* seen the pre-update shape where `access_token` was itself the PAT.
+*/
+function cmmdUserCredential(payload) {
+	const pat = payload.mcpToken?.trim();
+	return isCmmdJwtToken(payload.accessToken) && pat ? pat : payload.accessToken;
+}
+/**
 * Read one CMMD token-exchange response into the credential set Forge stores.
 *
 * Both owner lanes redeem the same `cmmd-forge-web` authorization code — the
@@ -73483,7 +73500,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$3 = __require("os");
+	var os$2 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -73491,8 +73508,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$3.arch();
-	var platform = process.env.npm_config_platform || os$3.platform();
+	var arch = process.env.npm_config_arch || os$2.arch();
+	var platform = process.env.npm_config_platform || os$2.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -91150,7 +91167,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-FIgTDosf.mjs"),
+		try: () => import("./open-D8mGyWmt.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -92509,7 +92526,7 @@ function hasValidRuntimeIdentity(value) {
 }
 function decodeRuntime$1(value) {
 	if (!isRecord$16(value) || !hasValidRuntimeIdentity(value)) return null;
-	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableInteger(value.projectId) || !nullableString(value.projectName) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === null || isRecord$16(value.metadata))) return null;
+	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === null || isRecord$16(value.metadata))) return null;
 	return value;
 }
 function decodeProject(value) {
@@ -92820,8 +92837,6 @@ function replicaRuntimeMatches(left, right) {
 		[left.status, right.status],
 		[left.endpointUrl, right.endpointUrl],
 		[left.deviceId, right.deviceId],
-		[left.projectId, right.projectId],
-		[left.projectName, right.projectName],
 		[left.workspaceRoot, right.workspaceRoot],
 		[left.githubRepoFullName, right.githubRepoFullName],
 		[left.lastSeenAt, right.lastSeenAt]
@@ -184358,7 +184373,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -194558,12 +194573,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$2 = "https://code.claude.com/docs/en", kKe = [
+var os$1 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$2}/iam#permission-modes`
+			docLink: `${os$1}/iam#permission-modes`
 		}
 	},
 	{
@@ -194578,7 +194593,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$2}/settings#environment-variables`
+			docLink: `${os$1}/settings#environment-variables`
 		}
 	},
 	{
@@ -194589,14 +194604,14 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$2}/hooks`
+			docLink: `${os$1}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$2}/hooks#exec-form-and-shell-form`
+			docLink: `${os$1}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -194611,7 +194626,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$2}/settings`
+			docLink: `${os$1}/settings`
 		}
 	},
 	{
@@ -194626,13 +194641,13 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$2}/iam#working-directories`
+			docLink: `${os$1}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$2}/iam#configuring-permissions`,
-	env: `${os$2}/settings#environment-variables`,
-	hooks: `${os$2}/hooks`
+	permissions: `${os$1}/iam#configuring-permissions`,
+	env: `${os$1}/settings#environment-variables`,
+	hooks: `${os$1}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -258885,7 +258900,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -259016,14 +259031,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -259031,7 +259046,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -310411,7 +310426,7 @@ const connectLoginCommand = make$32("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-FIgTDosf.mjs")).default;
+			const open = (await import("./open-D8mGyWmt.mjs")).default;
 			await open(url);
 			return true;
 		},

package/dist/{open-FIgTDosf.mjs → open-D8mGyWmt.mjs}

@@ -2,7 +2,7 @@
 
 import childProcess, { execFile } from "node:child_process";
 import fs from "node:fs";
-import os from "node:os";
+import $U from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import process from "node:process";
@@ -49,7 +49,7 @@ function isInsideContainer() {
 //#region ../../node_modules/.bun/is-wsl@3.1.1/node_modules/is-wsl/index.js
 const isWsl = () => {
 	if (process.platform !== "linux") return false;
-	if (os.release().toLowerCase().includes("microsoft")) {
+	if ($U.release().toLowerCase().includes("microsoft")) {
 		if (isInsideContainer()) return false;
 		return true;
 	}
@@ -589,4 +589,4 @@ defineLazyProperty(apps, "safari", () => detectPlatformBinary({ darwin: "Safari"
 //#endregion
 export { apps, open as default, openApp };
 
-//# sourceMappingURL=open-FIgTDosf.mjs.map
+//# sourceMappingURL=open-D8mGyWmt.mjs.map

package/package.json

@@ -9,7 +9,7 @@
     "cmmd-forge": "dist/bin.mjs"
   },
   "type": "module",
-  "version": "0.9.14",
+  "version": "0.9.15",
   "engines": {
     "node": "^22.16 || ^23.11 || >=24.10"
   },