@cmmd-center/forge 0.9.2 → 0.9.3

package/dist/bin.cjs

@@ -32042,6 +32042,25 @@ function readHiddenLine(input) {
 	});
 }
 //#endregion
+//#region src/connect/loginRedirect.ts
+/**
+* The OAuth redirect URI for `connect login --email`.
+*
+* This names where the *client* lives, not where CMMD lives. Sending CMMD's own
+* origin is rejected with a 400 — which is exactly how password login first
+* shipped broken.
+*
+* The exchange never actually fetches this URL: both legs run in-process and
+* the authorization code is read off the redirect's Location header. It only
+* has to match a URI CMMD accepts. CMMD follows the usual native-app rule of
+* matching loopback redirects on any port, so the configured port is sent
+* as-is, keeping the CLI consistent with what the browser flow would use.
+*/
+const DEFAULT_PORT$1 = 3e3;
+function resolveLoginRedirectUri(input) {
+	return `http://localhost:${typeof input.port === "number" && Number.isInteger(input.port) && input.port > 0 && input.port <= 65535 ? input.port : DEFAULT_PORT$1}/api/auth/callback`;
+}
+//#endregion
 //#region src/connect/passwordLogin.ts
 async function runPasswordLogin(deps) {
 	const email = deps.email.trim();
@@ -63823,7 +63842,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.2";
+var version$1 = "0.9.3";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -66398,11 +66417,14 @@ function resolveConnectDeviceIdentity(identityPath, options) {
 function resolveConnectRelayConfig(stateDir) {
 	if (!readConnectState(node_path.join(stateDir, "connect.json")).linked) return {
 		linked: false,
-		bridgeToken: void 0
+		bridgeToken: void 0,
+		runtimeId: void 0
 	};
+	const secrets = resolveConnectDeviceSecrets(node_path.join(stateDir, "connect-device.json"));
 	return {
 		linked: true,
-		bridgeToken: resolveConnectDeviceSecrets(node_path.join(stateDir, "connect-device.json")).bridgeToken
+		bridgeToken: secrets.bridgeToken,
+		runtimeId: secrets.runtimeId
 	};
 }
 //#endregion
@@ -66568,6 +66590,7 @@ var ServerConfig = class ServerConfig extends require_Schema$1.Service()("forge/
 			desktopBootstrapToken: void 0,
 			desktopRelayBridgeToken: void 0,
 			connectRelayBridgeToken: void 0,
+			connectRelayRuntimeId: void 0,
 			connectRelayLinked: false,
 			connectDisplayName: "forge",
 			connectPlatform: "linux",
@@ -68733,6 +68756,20 @@ function registerProxyRoute(route) {
 	return add$1(route.method, route.forgePath, handler);
 }
 //#endregion
+//#region src/connect/credentialRefresh.ts
+async function refreshConnectCredential(deps) {
+	if (deps.refreshToken.length === 0) return null;
+	try {
+		return toConnectCredential(await deps.postJson(`${deps.commandAppUrl}/api/mcp-server/oauth/token`, {
+			grant_type: "refresh_token",
+			refresh_token: deps.refreshToken,
+			client_id: deps.clientId
+		}));
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/relay/localBridge.ts
 const DESKTOP_RELAY_CONTEXT_HEADER = "x-forge-relay-context";
 const decodeRelayContext = require_Schema$1.decodeUnknownSync(RelayLocalBridgeContext);
@@ -69006,6 +69043,30 @@ function makeRelayDeliveryMiddlewareLayer(context, inbox, reconcileInterruptedCo
 	});
 }
 //#endregion
+//#region src/relay/bridgeAccess.ts
+function relayBridgeAccessAllowed(input) {
+	if (!input.isLoopback) return false;
+	if (!bridgeTokenMatches(input.suppliedToken, input.expectedToken)) return false;
+	return input.mode === "desktop" || input.connectLinked;
+}
+function resolveAuthorizedBridgeRuntimeId(input) {
+	const isDesktop = input.mode === "desktop";
+	if (!relayBridgeAccessAllowed({
+		mode: input.mode,
+		connectLinked: input.connectLinked,
+		isLoopback: input.isLoopback,
+		suppliedToken: input.suppliedToken,
+		expectedToken: isDesktop ? input.desktopToken : input.connectToken
+	})) return null;
+	return (isDesktop ? input.desktopRuntimeId : input.connectRuntimeId) ?? null;
+}
+//#endregion
+//#region src/relay/controlPlaneAuthority.ts
+function selectControlPlaneAuthority(input) {
+	if (input.mode === "desktop") return "session";
+	return input.connectLinked ? "credential" : null;
+}
+//#endregion
 //#region src/desktop/relayOwnerSession.ts
 var DesktopRelayOwnerSessionError = class extends require_Schema$1.TaggedError("DesktopRelayOwnerSessionError") {};
 const resolveDesktopRelayOwnerSession = (request) => require_Schema$1.gen(function* () {
@@ -69101,6 +69162,8 @@ function relayControlPlaneBodyMatchesRuntime(path, body, configuredRuntimeId) {
 	if (!isRecord$17(body) || !isRecord$17(body.runtime)) return false;
 	return body.runtime.runtimeId === configuredRuntimeId;
 }
+/** Matches the client id `connect login` used, so CMMD accepts the refresh. */
+const CONNECT_CONTROL_PLANE_CLIENT_ID = "cmmd-forge-web";
 function errorResponse(status, code, error) {
 	return require_HttpServer.jsonUnsafe({
 		error,
@@ -69119,9 +69182,16 @@ function relayProxyErrorResponse(error) {
 	return buildProxyErrorResponse(error);
 }
 function authorizedBridgeRuntimeId(request, config) {
-	if (config.mode !== "desktop" || !isLoopbackRelayRequest(request)) return null;
-	if (!bridgeTokenMatches(request.headers["x-forge-relay-bridge-token"], config.desktopRelayBridgeToken)) return null;
-	return config.desktopRelayRuntimeId ?? null;
+	return resolveAuthorizedBridgeRuntimeId({
+		mode: config.mode === "desktop" ? "desktop" : "web",
+		connectLinked: config.connectRelayLinked,
+		isLoopback: isLoopbackRelayRequest(request),
+		suppliedToken: request.headers[DESKTOP_RELAY_BRIDGE_TOKEN_HEADER],
+		desktopToken: config.desktopRelayBridgeToken,
+		connectToken: config.connectRelayBridgeToken,
+		desktopRuntimeId: config.desktopRelayRuntimeId,
+		connectRuntimeId: config.connectRelayRuntimeId
+	});
 }
 function validateBridgeOperation(request, runtimeId) {
 	if (request.runtimeId !== runtimeId) return {
@@ -69148,9 +69218,10 @@ function validateBridgeOperation(request, runtimeId) {
 }
 function dispatchRelayControlPlaneOperation(input) {
 	return require_Schema$1.gen(function* () {
-		const resolveJwt = (forceRefresh = false) => resolveCmmdJwtForSession({
-			sessionId: input.owner.sessionId,
-			subject: input.owner.subject,
+		const caller = input.caller;
+		const resolveJwt = (forceRefresh = false) => caller.kind === "credential" ? forceRefresh ? require_Schema$1.promise(() => caller.renew()) : require_Schema$1.succeed(caller.accessToken) : resolveCmmdJwtForSession({
+			sessionId: caller.sessionId,
+			subject: caller.subject,
 			logPrefix: "desktop-relay-control-plane",
 			forceRefresh
 		});
@@ -69172,19 +69243,57 @@ function dispatchRelayControlPlaneOperation(input) {
 }
 const desktopRelayControlPlaneRouteLayer = add$1("POST", DESKTOP_RELAY_CONTROL_PLANE_PATH, require_Schema$1.gen(function* () {
 	const request = yield* require_HttpServer.HttpServerRequest;
-	const runtimeId = authorizedBridgeRuntimeId(request, yield* ServerConfig);
+	const config = yield* ServerConfig;
+	const runtimeId = authorizedBridgeRuntimeId(request, config);
 	if (!runtimeId) return forbiddenResponse();
 	const decoded = yield* require_HttpServer.schemaBodyJson(DesktopRelayControlPlaneRequest).pipe(require_Schema$1.result);
 	if (require_Schema$1.isFailure$1(decoded)) return errorResponse(400, "RELAY_BRIDGE_REQUEST_INVALID", "Invalid relay bridge request.");
 	const operation = validateBridgeOperation(decoded.success, runtimeId);
 	if (!operation.ok) return operation.response;
+	const authority = selectControlPlaneAuthority({
+		mode: config.mode === "desktop" ? "desktop" : "web",
+		connectLinked: config.connectRelayLinked
+	});
+	if (authority === null) return forbiddenResponse();
+	if (authority === "credential") {
+		const credential = readConnectCredential(node_path.join(config.stateDir, "connect-credential.json"), createFileSecretStorage({ keyPath: node_path.join(config.stateDir, "connect-secret.key") }));
+		if (!credential) return errorResponse(401, "CMMD_AUTH_REQUIRED", "This machine is not signed in to CMMD. Run `cmmd-forge connect login`.");
+		const credentialPath = node_path.join(config.stateDir, "connect-credential.json");
+		const secrets = createFileSecretStorage({ keyPath: node_path.join(config.stateDir, "connect-secret.key") });
+		return yield* dispatchRelayControlPlaneOperation({
+			caller: {
+				kind: "credential",
+				accessToken: credential.accessToken,
+				renew: async () => {
+					const renewed = await refreshConnectCredential({
+						commandAppUrl: resolveCommandAppUrl(),
+						clientId: CONNECT_CONTROL_PLANE_CLIENT_ID,
+						refreshToken: credential.refreshToken,
+						postJson: async (url, body) => await (await fetch(url, {
+							method: "POST",
+							headers: { "content-type": "application/json" },
+							body: JSON.stringify(body)
+						})).json()
+					});
+					if (!renewed) return null;
+					writeConnectCredential(credentialPath, secrets, renewed);
+					return renewed.accessToken;
+				}
+			},
+			path: operation.path,
+			body: operation.body
+		});
+	}
 	const ownerResult = yield* resolveDesktopRelayOwnerSession(request).pipe(require_Schema$1.result);
 	if (require_Schema$1.isFailure$1(ownerResult)) {
 		const error = ownerResult.failure;
 		return errorResponse(error.status, error.code, error.message);
 	}
 	return yield* dispatchRelayControlPlaneOperation({
-		owner: ownerResult.success,
+		caller: {
+			kind: "session",
+			...ownerResult.success
+		},
 		path: operation.path,
 		body: operation.body
 	});
@@ -97901,13 +98010,6 @@ async function reconcileCmmdWorkRunPrMerged(deps, input) {
 	};
 }
 //#endregion
-//#region src/relay/bridgeAccess.ts
-function relayBridgeAccessAllowed(input) {
-	if (!input.isLoopback) return false;
-	if (!bridgeTokenMatches(input.suppliedToken, input.expectedToken)) return false;
-	return input.mode === "desktop" || input.connectLinked;
-}
-//#endregion
 //#region ../../packages/shared/src/sessionScopes.ts
 /**
 * Which RPC scopes a direct-WebSocket session holds, by its role.
@@ -307752,6 +307854,7 @@ const resolveServerConfig = (flags, cliLogLevel, options) => require_Schema$1.ge
 		desktopBootstrapToken,
 		desktopRelayBridgeToken,
 		connectRelayBridgeToken: connectRelay.bridgeToken,
+		connectRelayRuntimeId: connectRelay.runtimeId,
 		connectRelayLinked: connectRelay.linked,
 		connectDisplayName: node_os.hostname(),
 		connectPlatform,
@@ -308171,7 +308274,8 @@ const connectLoginCommand = make$32("login", {
 	noBrowser: noBrowserLoginFlag,
 	email: loginEmailFlag
 }).pipe(withDescription$1("Sign this machine in to CMMD so it can be offered over the relay."), withHandler((flags) => require_Schema$1.gen(function* () {
-	const stateDir = (yield* resolveCliAuthConfig(flags, yield* LogLevel)).stateDir;
+	const config = yield* resolveCliAuthConfig(flags, yield* LogLevel);
+	const stateDir = config.stateDir;
 	const startedAt = Date.now();
 	const emailOption = flags.email;
 	if (require_Schema$1.isSome(emailOption)) {
@@ -308186,7 +308290,7 @@ const connectLoginCommand = make$32("login", {
 			exchange: (email, secret) => require_Schema$1.runPromise(exchangeCmmdPasswordForOAuthToken({
 				email,
 				password: secret,
-				redirectUri: `${resolveCommandAppUrl()}/api/auth/callback`
+				redirectUri: resolveLoginRedirectUri({ port: config.port })
 			})).catch((cause) => {
 				if (isRejectedCredential(cause)) return {};
 				throw cause;

package/dist/bin.mjs

@@ -31816,6 +31816,25 @@ function readHiddenLine(input) {
 	});
 }
 //#endregion
+//#region src/connect/loginRedirect.ts
+/**
+* The OAuth redirect URI for `connect login --email`.
+*
+* This names where the *client* lives, not where CMMD lives. Sending CMMD's own
+* origin is rejected with a 400 — which is exactly how password login first
+* shipped broken.
+*
+* The exchange never actually fetches this URL: both legs run in-process and
+* the authorization code is read off the redirect's Location header. It only
+* has to match a URI CMMD accepts. CMMD follows the usual native-app rule of
+* matching loopback redirects on any port, so the configured port is sent
+* as-is, keeping the CLI consistent with what the browser flow would use.
+*/
+const DEFAULT_PORT$1 = 3e3;
+function resolveLoginRedirectUri(input) {
+	return `http://localhost:${typeof input.port === "number" && Number.isInteger(input.port) && input.port > 0 && input.port <= 65535 ? input.port : DEFAULT_PORT$1}/api/auth/callback`;
+}
+//#endregion
 //#region src/connect/passwordLogin.ts
 async function runPasswordLogin(deps) {
 	const email = deps.email.trim();
@@ -63597,7 +63616,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.2";
+var version$1 = "0.9.3";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -66164,11 +66183,14 @@ function resolveConnectDeviceIdentity(identityPath, options) {
 function resolveConnectRelayConfig(stateDir) {
 	if (!readConnectState(Path$1.join(stateDir, "connect.json")).linked) return {
 		linked: false,
-		bridgeToken: void 0
+		bridgeToken: void 0,
+		runtimeId: void 0
 	};
+	const secrets = resolveConnectDeviceSecrets(Path$1.join(stateDir, "connect-device.json"));
 	return {
 		linked: true,
-		bridgeToken: resolveConnectDeviceSecrets(Path$1.join(stateDir, "connect-device.json")).bridgeToken
+		bridgeToken: secrets.bridgeToken,
+		runtimeId: secrets.runtimeId
 	};
 }
 //#endregion
@@ -66326,6 +66348,7 @@ var ServerConfig = class ServerConfig extends Service$1()("forge/config/ServerCo
 			desktopBootstrapToken: void 0,
 			desktopRelayBridgeToken: void 0,
 			connectRelayBridgeToken: void 0,
+			connectRelayRuntimeId: void 0,
 			connectRelayLinked: false,
 			connectDisplayName: "forge",
 			connectPlatform: "linux",
@@ -68487,6 +68510,20 @@ function registerProxyRoute(route) {
 	return add$1(route.method, route.forgePath, handler);
 }
 //#endregion
+//#region src/connect/credentialRefresh.ts
+async function refreshConnectCredential(deps) {
+	if (deps.refreshToken.length === 0) return null;
+	try {
+		return toConnectCredential(await deps.postJson(`${deps.commandAppUrl}/api/mcp-server/oauth/token`, {
+			grant_type: "refresh_token",
+			refresh_token: deps.refreshToken,
+			client_id: deps.clientId
+		}));
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/relay/localBridge.ts
 const DESKTOP_RELAY_CONTEXT_HEADER = "x-forge-relay-context";
 const decodeRelayContext = decodeUnknownSync(RelayLocalBridgeContext);
@@ -68759,6 +68796,30 @@ function makeRelayDeliveryMiddlewareLayer(context, inbox, reconcileInterruptedCo
 	});
 }
 //#endregion
+//#region src/relay/bridgeAccess.ts
+function relayBridgeAccessAllowed(input) {
+	if (!input.isLoopback) return false;
+	if (!bridgeTokenMatches(input.suppliedToken, input.expectedToken)) return false;
+	return input.mode === "desktop" || input.connectLinked;
+}
+function resolveAuthorizedBridgeRuntimeId(input) {
+	const isDesktop = input.mode === "desktop";
+	if (!relayBridgeAccessAllowed({
+		mode: input.mode,
+		connectLinked: input.connectLinked,
+		isLoopback: input.isLoopback,
+		suppliedToken: input.suppliedToken,
+		expectedToken: isDesktop ? input.desktopToken : input.connectToken
+	})) return null;
+	return (isDesktop ? input.desktopRuntimeId : input.connectRuntimeId) ?? null;
+}
+//#endregion
+//#region src/relay/controlPlaneAuthority.ts
+function selectControlPlaneAuthority(input) {
+	if (input.mode === "desktop") return "session";
+	return input.connectLinked ? "credential" : null;
+}
+//#endregion
 //#region src/desktop/relayOwnerSession.ts
 var DesktopRelayOwnerSessionError = class extends TaggedError("DesktopRelayOwnerSessionError") {};
 const resolveDesktopRelayOwnerSession = (request) => gen(function* () {
@@ -68854,6 +68915,8 @@ function relayControlPlaneBodyMatchesRuntime(path, body, configuredRuntimeId) {
 	if (!isRecord$17(body) || !isRecord$17(body.runtime)) return false;
 	return body.runtime.runtimeId === configuredRuntimeId;
 }
+/** Matches the client id `connect login` used, so CMMD accepts the refresh. */
+const CONNECT_CONTROL_PLANE_CLIENT_ID = "cmmd-forge-web";
 function errorResponse(status, code, error) {
 	return jsonUnsafe({
 		error,
@@ -68872,9 +68935,16 @@ function relayProxyErrorResponse(error) {
 	return buildProxyErrorResponse(error);
 }
 function authorizedBridgeRuntimeId(request, config) {
-	if (config.mode !== "desktop" || !isLoopbackRelayRequest(request)) return null;
-	if (!bridgeTokenMatches(request.headers["x-forge-relay-bridge-token"], config.desktopRelayBridgeToken)) return null;
-	return config.desktopRelayRuntimeId ?? null;
+	return resolveAuthorizedBridgeRuntimeId({
+		mode: config.mode === "desktop" ? "desktop" : "web",
+		connectLinked: config.connectRelayLinked,
+		isLoopback: isLoopbackRelayRequest(request),
+		suppliedToken: request.headers[DESKTOP_RELAY_BRIDGE_TOKEN_HEADER],
+		desktopToken: config.desktopRelayBridgeToken,
+		connectToken: config.connectRelayBridgeToken,
+		desktopRuntimeId: config.desktopRelayRuntimeId,
+		connectRuntimeId: config.connectRelayRuntimeId
+	});
 }
 function validateBridgeOperation(request, runtimeId) {
 	if (request.runtimeId !== runtimeId) return {
@@ -68901,9 +68971,10 @@ function validateBridgeOperation(request, runtimeId) {
 }
 function dispatchRelayControlPlaneOperation(input) {
 	return gen(function* () {
-		const resolveJwt = (forceRefresh = false) => resolveCmmdJwtForSession({
-			sessionId: input.owner.sessionId,
-			subject: input.owner.subject,
+		const caller = input.caller;
+		const resolveJwt = (forceRefresh = false) => caller.kind === "credential" ? forceRefresh ? promise(() => caller.renew()) : succeed(caller.accessToken) : resolveCmmdJwtForSession({
+			sessionId: caller.sessionId,
+			subject: caller.subject,
 			logPrefix: "desktop-relay-control-plane",
 			forceRefresh
 		});
@@ -68925,19 +68996,57 @@ function dispatchRelayControlPlaneOperation(input) {
 }
 const desktopRelayControlPlaneRouteLayer = add$1("POST", DESKTOP_RELAY_CONTROL_PLANE_PATH, gen(function* () {
 	const request = yield* HttpServerRequest;
-	const runtimeId = authorizedBridgeRuntimeId(request, yield* ServerConfig);
+	const config = yield* ServerConfig;
+	const runtimeId = authorizedBridgeRuntimeId(request, config);
 	if (!runtimeId) return forbiddenResponse();
 	const decoded = yield* schemaBodyJson(DesktopRelayControlPlaneRequest).pipe(result);
 	if (isFailure$1(decoded)) return errorResponse(400, "RELAY_BRIDGE_REQUEST_INVALID", "Invalid relay bridge request.");
 	const operation = validateBridgeOperation(decoded.success, runtimeId);
 	if (!operation.ok) return operation.response;
+	const authority = selectControlPlaneAuthority({
+		mode: config.mode === "desktop" ? "desktop" : "web",
+		connectLinked: config.connectRelayLinked
+	});
+	if (authority === null) return forbiddenResponse();
+	if (authority === "credential") {
+		const credential = readConnectCredential(Path$1.join(config.stateDir, "connect-credential.json"), createFileSecretStorage({ keyPath: Path$1.join(config.stateDir, "connect-secret.key") }));
+		if (!credential) return errorResponse(401, "CMMD_AUTH_REQUIRED", "This machine is not signed in to CMMD. Run `cmmd-forge connect login`.");
+		const credentialPath = Path$1.join(config.stateDir, "connect-credential.json");
+		const secrets = createFileSecretStorage({ keyPath: Path$1.join(config.stateDir, "connect-secret.key") });
+		return yield* dispatchRelayControlPlaneOperation({
+			caller: {
+				kind: "credential",
+				accessToken: credential.accessToken,
+				renew: async () => {
+					const renewed = await refreshConnectCredential({
+						commandAppUrl: resolveCommandAppUrl(),
+						clientId: CONNECT_CONTROL_PLANE_CLIENT_ID,
+						refreshToken: credential.refreshToken,
+						postJson: async (url, body) => await (await fetch(url, {
+							method: "POST",
+							headers: { "content-type": "application/json" },
+							body: JSON.stringify(body)
+						})).json()
+					});
+					if (!renewed) return null;
+					writeConnectCredential(credentialPath, secrets, renewed);
+					return renewed.accessToken;
+				}
+			},
+			path: operation.path,
+			body: operation.body
+		});
+	}
 	const ownerResult = yield* resolveDesktopRelayOwnerSession(request).pipe(result);
 	if (isFailure$1(ownerResult)) {
 		const error = ownerResult.failure;
 		return errorResponse(error.status, error.code, error.message);
 	}
 	return yield* dispatchRelayControlPlaneOperation({
-		owner: ownerResult.success,
+		caller: {
+			kind: "session",
+			...ownerResult.success
+		},
 		path: operation.path,
 		body: operation.body
 	});
@@ -97589,13 +97698,6 @@ async function reconcileCmmdWorkRunPrMerged(deps, input) {
 	};
 }
 //#endregion
-//#region src/relay/bridgeAccess.ts
-function relayBridgeAccessAllowed(input) {
-	if (!input.isLoopback) return false;
-	if (!bridgeTokenMatches(input.suppliedToken, input.expectedToken)) return false;
-	return input.mode === "desktop" || input.connectLinked;
-}
-//#endregion
 //#region ../../packages/shared/src/sessionScopes.ts
 /**
 * Which RPC scopes a direct-WebSocket session holds, by its role.
@@ -307155,6 +307257,7 @@ const resolveServerConfig = (flags, cliLogLevel, options) => gen(function* () {
 		desktopBootstrapToken,
 		desktopRelayBridgeToken,
 		connectRelayBridgeToken: connectRelay.bridgeToken,
+		connectRelayRuntimeId: connectRelay.runtimeId,
 		connectRelayLinked: connectRelay.linked,
 		connectDisplayName: NodeOS.hostname(),
 		connectPlatform,
@@ -307573,7 +307676,8 @@ const connectLoginCommand = make$32("login", {
 	noBrowser: noBrowserLoginFlag,
 	email: loginEmailFlag
 }).pipe(withDescription$1("Sign this machine in to CMMD so it can be offered over the relay."), withHandler((flags) => gen(function* () {
-	const stateDir = (yield* resolveCliAuthConfig(flags, yield* LogLevel)).stateDir;
+	const config = yield* resolveCliAuthConfig(flags, yield* LogLevel);
+	const stateDir = config.stateDir;
 	const startedAt = Date.now();
 	const emailOption = flags.email;
 	if (isSome(emailOption)) {
@@ -307588,7 +307692,7 @@ const connectLoginCommand = make$32("login", {
 			exchange: (email, secret) => runPromise(exchangeCmmdPasswordForOAuthToken({
 				email,
 				password: secret,
-				redirectUri: `${resolveCommandAppUrl()}/api/auth/callback`
+				redirectUri: resolveLoginRedirectUri({ port: config.port })
 			})).catch((cause) => {
 				if (isRejectedCredential(cause)) return {};
 				throw cause;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmmd-center/forge",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -45,6 +45,7 @@
   "devDependencies": {
     "@cmmd-forge/client-runtime": "0.0.0-alpha.1",
     "@cmmd-forge/contracts": "0.9.0",
+    "@cmmd-forge/relay-host": "0.0.0-alpha.1",
     "@cmmd-forge/shared": "0.0.0-alpha.1",
     "@cmmd-forge/web": "0.9.0",
     "@effect/language-service": "0.84.2",
@@ -56,8 +57,7 @@
     "effect-acp": "0.0.1",
     "tsdown": "0.21.4",
     "typescript": "^5.7.3",
-    "vitest": "^4.1.10",
-    "@cmmd-forge/relay-host": "0.0.0-alpha.1"
+    "vitest": "^4.1.10"
   },
   "engines": {
     "node": "^22.16 || ^23.11 || >=24.10"