@cmmd-center/forge 0.9.14 → 0.9.16

package/dist/bin.mjs

@@ -22,7 +22,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import os, { homedir, networkInterfaces, tmpdir } from "node:os";
+import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -49482,7 +49482,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = os.release().split(".");
+		const osRelease = $U.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -51925,7 +51925,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$4 = __require("os");
+	const os$3 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -51947,7 +51947,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$4.userInfo();
+				const userInfo = os$3.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -64870,7 +64870,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.14";
+var version$1 = "0.9.16";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -66692,13 +66692,13 @@ function validateCommandBootstrapPayload(payload) {
 		});
 		const payloadIdentity = normalizeCmmdUserIdentity(payload.user);
 		if (payloadIdentity) {
-			const cmmdIdentity = payloadIdentity.avatarUrl ? payloadIdentity : mergeCmmdUserIdentity(payloadIdentity, yield* fetchOptionalCmmdIdentityForAccessToken(payload.accessToken));
+			const cmmdIdentity = payloadIdentity.avatarUrl ? payloadIdentity : mergeCmmdUserIdentity(payloadIdentity, yield* fetchOptionalCmmdIdentityForAccessToken(cmmdUserCredential(payload)));
 			return {
 				subjectUserId: cmmdIdentity.id,
 				cmmdIdentity
 			};
 		}
-		const tokenIdentity = yield* fetchCmmdIdentityForAccessToken(payload.accessToken);
+		const tokenIdentity = yield* fetchCmmdIdentityForAccessToken(cmmdUserCredential(payload));
 		if (tokenIdentity) return {
 			subjectUserId: tokenIdentity.id,
 			cmmdIdentity: tokenIdentity
@@ -66791,6 +66791,23 @@ function isCmmdJwtToken(token) {
 	return token?.startsWith("eyJ") ?? false;
 }
 /**
+* The credential CMMD's userinfo accepts.
+*
+* Since CMMD's OAuth update, `access_token` is a JWT and the personal access
+* token arrives separately as `mcp_token`. userinfo authenticates the PAT and
+* rejects the JWT with `INVALID_OR_NON_USER_TOKEN`, so presenting the JWT
+* resolves no identity: the bootstrap then finds no subject and answers 401,
+* even though the sign-in itself succeeded and the caller did nothing wrong.
+*
+* `resolveCmmdTokenBundleCredentials` already draws this distinction for the
+* owner lanes. This is the same rule for the bootstrap lane, which had only ever
+* seen the pre-update shape where `access_token` was itself the PAT.
+*/
+function cmmdUserCredential(payload) {
+	const pat = payload.mcpToken?.trim();
+	return isCmmdJwtToken(payload.accessToken) && pat ? pat : payload.accessToken;
+}
+/**
 * Read one CMMD token-exchange response into the credential set Forge stores.
 *
 * Both owner lanes redeem the same `cmmd-forge-web` authorization code — the
@@ -73483,7 +73500,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$3 = __require("os");
+	var os$2 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -73491,8 +73508,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$3.arch();
-	var platform = process.env.npm_config_platform || os$3.platform();
+	var arch = process.env.npm_config_arch || os$2.arch();
+	var platform = process.env.npm_config_platform || os$2.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -91150,7 +91167,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-FIgTDosf.mjs"),
+		try: () => import("./open-D8mGyWmt.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -91947,8 +91964,8 @@ const ProjectionThread = Struct({
 	createdAt: IsoDateTime,
 	updatedAt: IsoDateTime,
 	archivedAt: NullOr(IsoDateTime),
-	settledAt: optional$4(NullOr(IsoDateTime)),
-	settledOverride: optional$4(NullOr(Literals(["settled", "active"]))),
+	settledAt: NullOr(IsoDateTime),
+	settledOverride: NullOr(Literals(["settled", "active"])),
 	latestUserMessageAt: NullOr(IsoDateTime),
 	pendingApprovalCount: NonNegativeInt,
 	pendingUserInputCount: NonNegativeInt,
@@ -92133,16 +92150,23 @@ const FORGE_GIT_COMMIT_PATTERN = /^[0-9a-f]{7,40}$/i;
 /**
 * Resolve the commit this forge checkout actually booted from, so the
 * heartbeat can report it and CMMD can tell a stale Sprite from a current
-* one. Sprites clone forge ONLY at bootstrap (see the CMMD-side bootstrap
-* script) and nothing else refreshes them, so this value never changes for
-* the life of the process — resolve it once and cache it.
-*
-* `git rev-parse HEAD` run with the process's own cwd (`apps/server`, a
-* subdirectory of the cloned repo) walks up to find `.git` on its own; no
-* `-C` path is needed. Returns `undefined` (never throws) when there is no
-* git checkout to read — local dev run from a tarball, or any environment
-* this simply does not apply to — so the heartbeat body omits the field
-* exactly like an older Forge build that doesn't know about it yet.
+* one. The commit cannot change for the life of the process, so resolve it
+* once and cache it.
+*
+* This comment used to say Sprites clone forge at bootstrap and read their
+* commit from that checkout. They do not. A cloud runtime installs the
+* published `@cmmd-center/forge` tarball and has no `.git` anywhere near it,
+* which is why its descriptor reported no commit at all until the server
+* started baking one into its bundle. See `../environment/buildIdentity.ts`,
+* which calls this only as its last rung.
+*
+* `git rev-parse HEAD` run with the process's own cwd walks up to find `.git`
+* on its own, so no `-C` path is needed. That also means a cwd inside some
+* unrelated repository answers with that repository's HEAD, which is one more
+* reason this is the last rung rather than the first. Returns `undefined`
+* (never throws) when there is no checkout to read, so the heartbeat body
+* omits the field exactly like an older Forge build that does not know about
+* it yet.
 */
 let cached$1 = null;
 async function resolveForgeGitCommit(execImpl = (command, args) => execFileAsync$6(command, [...args], { timeout: 5e3 })) {
@@ -92509,7 +92533,7 @@ function hasValidRuntimeIdentity(value) {
 }
 function decodeRuntime$1(value) {
 	if (!isRecord$16(value) || !hasValidRuntimeIdentity(value)) return null;
-	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableInteger(value.projectId) || !nullableString(value.projectName) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === null || isRecord$16(value.metadata))) return null;
+	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === null || isRecord$16(value.metadata))) return null;
 	return value;
 }
 function decodeProject(value) {
@@ -92820,8 +92844,6 @@ function replicaRuntimeMatches(left, right) {
 		[left.status, right.status],
 		[left.endpointUrl, right.endpointUrl],
 		[left.deviceId, right.deviceId],
-		[left.projectId, right.projectId],
-		[left.projectName, right.projectName],
 		[left.workspaceRoot, right.workspaceRoot],
 		[left.githubRepoFullName, right.githubRepoFullName],
 		[left.lastSeenAt, right.lastSeenAt]
@@ -184358,7 +184380,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -194558,12 +194580,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$2 = "https://code.claude.com/docs/en", kKe = [
+var os$1 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$2}/iam#permission-modes`
+			docLink: `${os$1}/iam#permission-modes`
 		}
 	},
 	{
@@ -194578,7 +194600,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$2}/settings#environment-variables`
+			docLink: `${os$1}/settings#environment-variables`
 		}
 	},
 	{
@@ -194589,14 +194611,14 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$2}/hooks`
+			docLink: `${os$1}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$2}/hooks#exec-form-and-shell-form`
+			docLink: `${os$1}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -194611,7 +194633,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$2}/settings`
+			docLink: `${os$1}/settings`
 		}
 	},
 	{
@@ -194626,13 +194648,13 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$2}/iam#working-directories`
+			docLink: `${os$1}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$2}/iam#configuring-permissions`,
-	env: `${os$2}/settings#environment-variables`,
-	hooks: `${os$2}/hooks`
+	permissions: `${os$1}/iam#configuring-permissions`,
+	env: `${os$1}/settings#environment-variables`,
+	hooks: `${os$1}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -206237,7 +206259,7 @@ function createDevServerMcpServer(deps, threadId) {
 * per provider — this module only adapts descriptor + result shapes.
 *
 * Without it a Claude agent has no brokered push path at all and falls back to
-* raw `git`, which the runtime deliberately blocks via `GIT_ASKPASS=/bin/false`.
+* raw `git`, which has no authenticated remote credentials in the agent runtime.
 *
 * The catalog is filtered through `applyPluginSkillPermissionsToDynamicTools`,
 * exactly as the Codex surface filters its dynamic tools. `settings` is required
@@ -258885,7 +258907,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -259016,14 +259038,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -259031,7 +259053,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -287313,13 +287335,32 @@ const ObservabilityLive = unwrap(gen(function* () {
 //#region ../../packages/shared/src/buildCommit.ts
 const COMMIT_SHA_PATTERN$1 = /^[0-9a-f]{40}$/i;
 /**
+* Whether a value is a full commit sha.
+*
+* Exported so each surface can keep its own list of env names while sharing one
+* definition of "valid". Surfaces genuinely differ: Railway injects
+* RAILWAY_GIT_COMMIT_SHA into the cloud shell build, while the desktop release
+* workflows pass VITE_SENTRY_COMMIT_SHA. What must not differ is the check.
+*/
+function isFullCommitSha(value) {
+	const candidate = value?.trim();
+	return candidate !== void 0 && candidate !== "" && COMMIT_SHA_PATTERN$1.test(candidate);
+}
+/**
 * Build identity from the environment.
 *
 * `.dockerignore` excludes `.git`, so `git rev-parse HEAD` cannot resolve inside
 * the Railway container — the surface where "which commit is live?" is asked
 * most. The commit therefore has to arrive as env there, with git left as the
-* fallback for surfaces that genuinely are checkouts (a sprite clones forge at
-* bootstrap; desktop and dev run from a repo).
+* fallback for surfaces that genuinely are checkouts (desktop and dev run from
+* a repo).
+*
+* A cloud runtime is neither: it installs the published `@cmmd-center/forge`
+* tarball, so it has no build variables and no `.git`, and both rungs below
+* return nothing there. That is why the server bakes the commit into its bundle
+* at build time and reads that first — see `apps/server/src/environment/
+* buildIdentity.ts`. This comment previously claimed a sprite clones forge at
+* bootstrap; it does not, and believing it cost a diagnosis.
 *
 * `RAILWAY_GIT_COMMIT_SHA` is injected by the platform, which is what lets this
 * work on the cloud shell with no Dockerfile plumbing. `FORGE_BUILD_COMMIT`
@@ -287337,6 +287378,30 @@ function resolveBuildCommitFromEnv(env) {
 	}
 }
 //#endregion
+//#region src/environment/buildIdentity.ts
+/**
+* Which commit this server was built from.
+*
+* @module
+*/
+/**
+* The commit baked into this bundle, if it is a bundle at all.
+*
+* `typeof` rather than a bare reference: running from source there is no such
+* binding, and a bare reference is a ReferenceError that would take the whole
+* environment descriptor down instead of reporting an honest "unknown".
+*/
+function readBakedBuildCommit() {
+	return "e65edd4d1b8a361863a52b171b5e73295d691e11";
+}
+async function resolveServerBuildCommit(input) {
+	if (isFullCommitSha(input.baked)) return input.baked;
+	const fromEnv = resolveBuildCommitFromEnv(input.env);
+	if (fromEnv !== void 0) return fromEnv;
+	const fromGit = await input.readGitCommit();
+	return isFullCommitSha(fromGit) ? fromGit : void 0;
+}
+//#endregion
 //#region src/environment/Layers/ServerEnvironmentLabel.ts
 function normalizeLabel(value) {
 	const trimmed = value?.trim();
@@ -287484,7 +287549,11 @@ const ServerEnvironmentLive = effect(ServerEnvironment, fn$1("makeServerEnvironm
 	const writeMetadata = (metadata) => fileSystem.writeFileString(serverConfig.environmentMetadataPath, `${JSON.stringify(metadata, null, 2)}\n`);
 	const displayNameOverrideRef = yield* make$47(normalizeDisplayName((yield* readMetadata).displayName ?? null));
 	const posthog = yield* PosthogPublicConfig.asEffect();
-	const buildCommit = resolveBuildCommitFromEnv(process.env) ?? (yield* promise(() => resolveForgeGitCommit()));
+	const buildCommit = yield* promise(() => resolveServerBuildCommit({
+		baked: readBakedBuildCommit(),
+		env: process.env,
+		readGitCommit: resolveForgeGitCommit
+	}));
 	const buildDescriptor = gen(function* () {
 		const displayNameOverride = yield* get$5(displayNameOverrideRef);
 		const os = platformOs();
@@ -296228,6 +296297,71 @@ function selectProviderUsageEnvironment(rawCatalog, ownerUserId) {
 	};
 }
 //#endregion
+//#region src/command/claudeUsageRefreshFailure.ts
+/**
+* Why a Claude usage refresh failed, in words the Usage page can show.
+*
+* CMMD answers a failed refresh with a machine reason (`runtime_not_active`,
+* `credential_changed`, …). The Shell used to collapse every one of them into
+* "Claude usage refresh is unavailable.", so the card could only say the
+* refresh failed, never what to do about it.
+*
+* The mapping is a closed allowlist in both directions: a reason CMMD may add
+* later falls back to the generic code, and the text a client sees is written
+* here, never forwarded from upstream. That keeps a credential or runtime
+* detail in a CMMD error body from reaching the browser.
+*/
+const FAILURE_TEXT = {
+	CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE: "Refresh needs your Environment running.",
+	CLAUDE_USAGE_CREDENTIAL_NOT_READY: "The Claude credential is not applied to your Environment yet.",
+	CLAUDE_USAGE_REFRESH_IN_PROGRESS: "A refresh for this account is already running.",
+	CLAUDE_USAGE_PROBE_FAILED: "Your Environment could not read Claude usage.",
+	CLAUDE_USAGE_RECONNECT_REQUIRED: "Reconnect this Claude account to refresh usage.",
+	CLAUDE_USAGE_ACCOUNT_NOT_FOUND: "This Claude account is no longer connected.",
+	CLAUDE_USAGE_REFRESH_UNAVAILABLE: "Claude usage refresh is unavailable."
+};
+/** Verbatim from CMMD `personal-claude-usage.ts` and `provider-usage-service.ts`. */
+const CODE_BY_UPSTREAM_REASON = {
+	runtime_not_active: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE",
+	claude_native_delivery_disabled: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE",
+	runtime_identity_mismatch: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE",
+	credential_generation_not_applied: "CLAUDE_USAGE_CREDENTIAL_NOT_READY",
+	credential_generation_unavailable: "CLAUDE_USAGE_CREDENTIAL_NOT_READY",
+	credential_changed: "CLAUDE_USAGE_CREDENTIAL_NOT_READY",
+	refresh_in_progress: "CLAUDE_USAGE_REFRESH_IN_PROGRESS",
+	usage_probe_failed: "CLAUDE_USAGE_PROBE_FAILED",
+	usage_receipt_invalid: "CLAUDE_USAGE_PROBE_FAILED",
+	usage_output_invalid: "CLAUDE_USAGE_PROBE_FAILED"
+};
+function failure(code, status) {
+	return {
+		status,
+		body: {
+			error: FAILURE_TEXT[code],
+			code
+		}
+	};
+}
+/**
+* CMMD sends the reason as `{ "error": "<reason>" }`. Anything else, including
+* a longer sentence that happens to start with an allowlisted word, is treated
+* as unknown.
+*/
+function readAllowlistedReasonCode(body) {
+	if (body === null || typeof body !== "object") return null;
+	const reason = body.error;
+	if (typeof reason !== "string") return null;
+	return Object.hasOwn(CODE_BY_UPSTREAM_REASON, reason) ? CODE_BY_UPSTREAM_REASON[reason] ?? null : null;
+}
+function describeClaudeUsageRefreshFailure(error) {
+	if (!(error instanceof CmmdProxyRequestError)) return failure("CLAUDE_USAGE_REFRESH_UNAVAILABLE", 502);
+	if (error.status === 409) return failure("CLAUDE_USAGE_RECONNECT_REQUIRED", 409);
+	if (error.status === 404) return failure("CLAUDE_USAGE_ACCOUNT_NOT_FOUND", 404);
+	const reasonCode = readAllowlistedReasonCode(error.body);
+	if (reasonCode !== null) return failure(reasonCode, 503);
+	return failure("CLAUDE_USAGE_REFRESH_UNAVAILABLE", error.status === 503 ? 503 : 502);
+}
+//#endregion
 //#region src/command/wsToken.ts
 /**
 * Build the WS token response given an optional PAT and the configured CMMD
@@ -297964,10 +298098,8 @@ function resolveProviderUsageOwnerUserId(session) {
 	return Number.isSafeInteger(userId) && userId > 0 ? userId : null;
 }
 function buildClaudeUsageRefreshErrorResponse(error) {
-	return jsonUnsafe({
-		error: "Claude usage refresh is unavailable.",
-		code: "CLAUDE_USAGE_REFRESH_UNAVAILABLE"
-	}, { status: error instanceof CmmdProxyRequestError && error.status === 503 ? 503 : 502 });
+	const failure = describeClaudeUsageRefreshFailure(error);
+	return jsonUnsafe(failure.body, { status: failure.status });
 }
 function makeRefreshProviderUsageHandler(dependencies = {}) {
 	return gen(function* () {
@@ -310411,7 +310543,7 @@ const connectLoginCommand = make$32("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-FIgTDosf.mjs")).default;
+			const open = (await import("./open-D8mGyWmt.mjs")).default;
 			await open(url);
 			return true;
 		},