@cmmd-center/forge 0.9.4 → 0.9.5

package/dist/bin.cjs

@@ -12,7 +12,7 @@ const require_Cache = require("./Cache-XSj5g7uG.cjs");
 const require_SqlError = require("./SqlError-C2mi8_tp.cjs");
 const require_esm = require("./esm-Do7HVhLA.cjs");
 const require_Mime = require("./Mime-CyHbecis.cjs");
-const require_runtimeControlAuthority = require("./runtimeControlAuthority-Dx6Y5LPI.cjs");
+const require_runtimeControlAuthority = require("./runtimeControlAuthority-SNBF5Mjy.cjs");
 const require_PTY = require("./PTY-U3JQnLXS.cjs");
 let node_child_process = require("node:child_process");
 node_child_process = require_chunk.__toESM(node_child_process);
@@ -67803,7 +67803,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.4";
+var version$1 = "0.9.5";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -99120,14 +99120,9 @@ function mapClaudeRateLimitInfo(info) {
 }
 const cachedSnapshots = /* @__PURE__ */ new Map();
 let localClaudeGenerationHash = null;
-let localClaudeGenerationId = null;
 function setLocalClaudeUsageGeneration(generationId) {
-	localClaudeGenerationId = generationId;
 	localClaudeGenerationHash = (0, node_crypto.createHash)("sha256").update(generationId).digest("hex");
 }
-function currentClaudeUsageGenerationId() {
-	return localClaudeGenerationId;
-}
 function currentClaudeUsageGenerationHash() {
 	const value = process.env.FORGE_PERSONAL_CLAUDE_GENERATION_HASH?.trim() ?? "";
 	return /^[a-f0-9]{64}$/.test(value) ? value : localClaudeGenerationHash;
@@ -99547,6 +99542,16 @@ function extractClaudeProviderAccountId(response) {
 	const providerAccountId = account.providerAccountId.trim();
 	return providerAccountId.length > 0 ? providerAccountId : null;
 }
+/**
+* Logs a usage-publish failure, or does nothing when there was none. The null
+* check lives here rather than in syncClaudeCredentialForSession so that
+* reporting the failure costs that generator no branches.
+*/
+const logUsagePublishFailure = (failure, path) => failure === null ? require_Schema$1.void_ : require_Schema$1.logWarning("cmmd-claude-cred-sync: usage publish failed after deposit", {
+	error: failure.cause instanceof Error ? failure.cause.message : String(failure.cause),
+	stack: failure.cause instanceof Error ? failure.cause.stack : void 0,
+	path
+});
 async function publishClaudeUsageAfterSync(input) {
 	try {
 		const usage = await input.loadUsage({
@@ -99569,13 +99574,16 @@ async function publishClaudeUsageAfterSync(input) {
 				observedAt: (/* @__PURE__ */ new Date()).toISOString()
 			}
 		});
-	} catch {}
+		return null;
+	} catch (cause) {
+		return { cause };
+	}
 }
 async function finalizeClaudeCredentialSync(input) {
 	const providerAccountId = extractClaudeProviderAccountId(input.response);
-	if (providerAccountId === null) return;
+	if (providerAccountId === null) return null;
 	if (input.auth.path === USER_CLAUDE_CREDENTIAL_PATH) setLocalClaudeUsageGeneration(providerAccountId);
-	await publishClaudeUsageAfterSync({
+	return publishClaudeUsageAfterSync({
 		auth: input.auth,
 		providerAccountId,
 		accountEmail: input.accountEmail,
@@ -99630,7 +99638,7 @@ function syncClaudeCredentialForSession(input) {
 			}
 		})).pipe(require_Schema$1.orElseSucceed(() => null));
 		if (response === null) return { status: "failed" };
-		yield* require_Schema$1.promise(() => finalizeClaudeCredentialSync({
+		yield* logUsagePublishFailure(yield* require_Schema$1.promise(() => finalizeClaudeCredentialSync({
 			response,
 			auth,
 			accountEmail,
@@ -99638,7 +99646,7 @@ function syncClaudeCredentialForSession(input) {
 			planType: metadata.planType ?? probedMetadata.planType ?? null,
 			...input.homePath ? { homePath: input.homePath } : {},
 			loadUsage: input.loadUsage ?? fetchClaudeUsageViaOfficialClient
-		}));
+		})), auth.path);
 		return { status: "synced" };
 	});
 }
@@ -289919,6 +289927,95 @@ const makeRuntimeServerSecretStore = require_Schema$1.gen(function* () {
 	return (yield* ServerConfig).forgeCloudShellMode === true ? yield* makePostgresServerSecretStore : yield* makeLocalServerSecretStore;
 });
 const ServerSecretStoreRuntimeLive = require_Schema$1.effect(ServerSecretStore, makeRuntimeServerSecretStore);
+//#endregion
+//#region src/runtimeAuth/controlAuthorityRetry.ts
+/**
+* When to try for control authority again.
+*
+* CMMD ships continuously, so a Forge Cloud runtime will outlive restarts of its
+* own control plane. Obtaining authority is therefore not a startup-time
+* question: a runtime that asks once, gets an infrastructure page mid-deploy and
+* gives up stays unauthenticated until something happens to restart it while
+* CMMD is healthy. Measured: hours, on a Sprite whose guest was serving fine the
+* whole time.
+*
+* Two shapes of failure arrive here and they need opposite answers, which is why
+* `retryable` is decided at the boundary that saw the response rather than
+* guessed at here.
+*/
+/** First backoff. Short on purpose: a deploy cutover is seconds, not minutes. */
+const BASE_DELAY_MS = 1e3;
+/**
+* Ceiling. Unbounded doubling turns a long outage into a long TAIL: an hour down
+* would be followed by up to an hour of avoidable downtime after recovery.
+*/
+const MAX_DELAY_MS = 6e4;
+/**
+* Spread, as a fraction of the delay. A fleet loses authority at the same
+* instant when the control plane restarts, so without this every runtime
+* retries in lockstep and the recovering CMMD takes the whole fleet at once.
+*
+* Kept below 1 so jitter can only ADD: a later attempt must never be scheduled
+* sooner than an earlier one, or backoff stops meaning anything.
+*/
+const JITTER_FRACTION = .25;
+function nextControlAuthorityAttempt(input) {
+	if (!input.retryable) return {
+		retry: false,
+		delayMs: 0
+	};
+	const exponent = Math.max(0, input.consecutiveFailures - 1);
+	const cap = MAX_DELAY_MS / (1 + JITTER_FRACTION);
+	const base = Math.min(BASE_DELAY_MS * 2 ** exponent, cap);
+	const random = input.random ?? Math.random;
+	return {
+		retry: true,
+		delayMs: Math.round(base * (1 + JITTER_FRACTION * random()))
+	};
+}
+/** Bounded retry budget. The next connect starts a fresh one. */
+const DEFAULT_MAX_ATTEMPTS = 8;
+/**
+* Keep asking for control authority while asking again could plausibly work.
+*
+* Bounded rather than infinite: a loop that gives up and says so lets the caller
+* log something actionable, and a connect or a heartbeat will start a fresh
+* budget anyway. An unbounded loop would hide the condition in exactly the way
+* the original `.catch(() => false)` did.
+*/
+async function bootstrapWithRetry(input) {
+	const maxAttempts = input.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+	let lastError;
+	for (let attempts = 1; attempts <= maxAttempts; attempts += 1) {
+		let retryable = true;
+		try {
+			if (await input.attempt()) return {
+				ok: true,
+				attempts
+			};
+		} catch (error) {
+			lastError = error;
+			retryable = typeof error === "object" && error !== null && "retryable" in error && error.retryable === true;
+		}
+		if (!retryable) return {
+			ok: false,
+			attempts,
+			lastError
+		};
+		if (attempts === maxAttempts) break;
+		const next = nextControlAuthorityAttempt({
+			consecutiveFailures: attempts,
+			retryable: true,
+			...input.random ? { random: input.random } : {}
+		});
+		await input.sleep(next.delayMs);
+	}
+	return {
+		ok: false,
+		attempts: maxAttempts,
+		lastError
+	};
+}
 var AuthControlPlaneError = class extends require_Schema$1.TaggedError("AuthControlPlaneError") {};
 var AuthControlPlane = class extends require_Schema$1.Service()("forge/AuthControlPlane") {};
 //#endregion
@@ -291118,19 +291215,24 @@ async function bootstrapControlAuthorityFromConnect(input) {
 	const credentialEpoch = input.verified.credentialEpoch;
 	const hasConnectScope = input.verified.scope.includes("http") || input.verified.scope.includes("ws");
 	if (!controlPlaneUrl || !provisioningGrant || machineId === null || credentialEpoch === null || !hasConnectScope) return;
-	await require_runtimeControlAuthority.bootstrapRuntimeControlAuthority({
-		identity: {
-			controlPlaneUrl,
-			publicKeyPem: input.runtimeAuthConfig.publicKeyPem,
-			orgId: input.verified.orgId,
-			userId: input.verified.userId,
-			projectId: input.verified.projectId,
-			runtimeId: input.verified.runtimeId,
-			machineId,
-			credentialEpoch
-		},
-		connectToken: input.token,
-		provisioningGrant
+	await bootstrapWithRetry({
+		attempt: () => require_runtimeControlAuthority.bootstrapRuntimeControlAuthority({
+			identity: {
+				controlPlaneUrl,
+				publicKeyPem: input.runtimeAuthConfig.publicKeyPem,
+				orgId: input.verified.orgId,
+				userId: input.verified.userId,
+				projectId: input.verified.projectId,
+				runtimeId: input.verified.runtimeId,
+				machineId,
+				credentialEpoch
+			},
+			connectToken: input.token,
+			provisioningGrant
+		}),
+		sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+	}).then((result) => {
+		if (!result.ok && result.lastError !== void 0) throw result.lastError;
 	}).catch((error) => {
 		console.error("[bootstrapControlAuthorityFromConnect] failed to establish runtime control authority; every heartbeat will report null until the next successful connect", {
 			runtimeId: input.verified.runtimeId,
@@ -296504,6 +296606,32 @@ const readPersistedServerRuntimeState = (path) => require_Schema$1.gen(function*
 	return yield* decodePersistedServerRuntimeState(trimmed).pipe(require_Schema$1.option);
 });
 //#endregion
+//#region src/orchestration/turnAdmission.ts
+/**
+* Whether a turn can actually run, as opposed to merely being accepted.
+*
+* A Forge Cloud runtime reaches its provider through CMMD, so without control
+* authority it cannot start a turn at all. It could still ACCEPT one: the
+* command validates, the thread and worktree are created, the user message is
+* recorded, and the turn then sits at `pending` forever with nothing surfaced.
+*
+* Measured on forge-cmmd-r03ad897c5e90 while CMMD was redeploying: HTTP 200 on
+* dispatch, five user messages, zero assistant messages, every turn stuck with
+* `started_at` empty. The client had no way to know.
+*
+* Kept as a pure function because the interesting part is the RULE, not the
+* plumbing: it is only cloud runtimes, only turns, and only when authority is
+* genuinely absent.
+*/
+/** Commands that need a provider, and therefore need control authority. */
+const TURN_COMMANDS = new Set(["thread.turn.start"]);
+function refuseTurnWithoutControlAuthority(input) {
+	if (!input.cmmdRuntimeMode) return null;
+	if (!TURN_COMMANDS.has(input.commandType)) return null;
+	if (input.hasControlAuthority) return null;
+	return "This runtime has no CMMD control authority, so a turn cannot reach a provider and would queue without ever running. The runtime re-establishes authority on its own; retry shortly.";
+}
+//#endregion
 //#region ../../packages/shared/src/forgeCommands.ts
 /**
 * Forge loop commands (`/forge-*`) — the one trigger surface shared by humans
@@ -297072,6 +297200,16 @@ const orchestrationDispatchRouteLayer = add$1("POST", "/api/orchestration/dispat
 		message: "Invalid orchestration command payload.",
 		cause
 	}))));
+	const admissionRefusal = refuseTurnWithoutControlAuthority({
+		commandType: normalizedCommand.type,
+		cmmdRuntimeMode: process.env.FORGE_CMMD_RUNTIME_MODE === "true",
+		hasControlAuthority: require_runtimeControlAuthority.readRuntimeControlAuthority({
+			runtimeId: process.env.FORGE_CMMD_RUNTIME_ID ?? "",
+			machineId: process.env.FORGE_CMMD_RUNTIME_MACHINE_ID ?? "",
+			credentialEpoch: Number(process.env.FORGE_CMMD_RUNTIME_CREDENTIAL_EPOCH ?? "0")
+		}) !== null
+	});
+	if (admissionRefusal !== null) return yield* new OrchestrationDispatchCommandError({ message: admissionRefusal });
 	const dispatchEffect = normalizedCommand.type === "thread.turn.start" && normalizedCommand.bootstrap ? require_Schema$1.gen(function* () {
 		const git = yield* require_Schema$1.serviceOption(GitCore);
 		const gitStatusBroadcaster = yield* require_Schema$1.serviceOption(GitStatusBroadcaster);
@@ -299394,7 +299532,7 @@ const cmmdSetProviderAccountDefaultRouteLayer = registerProxyRoute({
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const resolveConnectedClaudeGenerationHash = (session) => require_Schema$1.gen(function* () {
+const resolveConnectedClaudeGeneration = (session) => require_Schema$1.gen(function* () {
 	const outcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
 		method: "GET",
 		jwt,
@@ -299408,18 +299546,22 @@ const resolveConnectedClaudeGenerationHash = (session) => require_Schema$1.gen(f
 	};
 	return {
 		ok: true,
-		value: (0, node_crypto.createHash)("sha256").update(state.generationId).digest("hex")
+		value: {
+			generationId: state.generationId,
+			generationHash: (0, node_crypto.createHash)("sha256").update(state.generationId).digest("hex")
+		}
 	};
 });
 /**
 * The GET path is read-only. The explicit per-account POST refresh invokes
 * this helper and propagates any CMMD forward failure to the caller.
 */
-const forwardClaudeUsageTelemetry = (session, providerAccountId = currentClaudeUsageGenerationId() ?? "", activelyPoll = false, fetchClaudeUsage = fetchClaudeUsageViaOfficialClient) => require_Schema$1.gen(function* () {
-	const credentialOutcome = yield* resolveConnectedClaudeGenerationHash(session);
+const forwardClaudeUsageTelemetry = (session, requestedProviderAccountId, activelyPoll = false, fetchClaudeUsage = fetchClaudeUsageViaOfficialClient) => require_Schema$1.gen(function* () {
+	const credentialOutcome = yield* resolveConnectedClaudeGeneration(session);
 	if (!credentialOutcome.ok) return credentialOutcome;
-	const generationId = currentClaudeUsageGenerationId();
-	if (credentialOutcome.value === null || generationId === null) return null;
+	if (credentialOutcome.value === null) return null;
+	const { generationId, generationHash } = credentialOutcome.value;
+	const providerAccountId = requestedProviderAccountId ?? generationId;
 	const activeSnapshot = activelyPoll && providerAccountId === generationId ? yield* require_Schema$1.tryPromise({
 		try: () => fetchClaudeUsage({ binaryPath: resolveClaudeBinaryPath("claude") }),
 		catch: (cause) => new ClaudeUsageReadError({ cause })
@@ -299427,7 +299569,7 @@ const forwardClaudeUsageTelemetry = (session, providerAccountId = currentClaudeU
 	const snapshot = activeSnapshot ? {
 		...activeSnapshot,
 		observedAt: (/* @__PURE__ */ new Date()).toISOString()
-	} : getLatestClaudeRateLimitTelemetry(credentialOutcome.value, providerAccountId);
+	} : getLatestClaudeRateLimitTelemetry(generationHash, providerAccountId);
 	if (!snapshot) return null;
 	return yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
 		method: "POST",

package/dist/bin.mjs

@@ -11,7 +11,7 @@ import { a as make$48, i as keys, n as getOption, o as makeWith$1, r as invalida
 import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$49, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-1c-3v7GY.mjs";
 import { a as diag, c as SpanKind$1, d as TraceFlags, f as ROOT_CONTEXT, i as propagation, l as isSpanContextValid, m as DiagLogLevel, n as init_esm$1, o as context$1, p as createContextKey, r as trace, s as SpanStatusCode, t as esm_exports$1 } from "./esm-Ce1GqbVk.mjs";
 import { t as Mime_default } from "./Mime-BITO-E1U.mjs";
-import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicketRefreshProof, d as createReadOnceFileTokenAccessor, i as sendRuntimeControlHeartbeat, l as runtimeGrantToken, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, r as readRuntimeControlAuthority, s as verifyCmmdRuntimeTicket, t as bootstrapRuntimeControlAuthority, u as setRuntimeGrantToken } from "./runtimeControlAuthority-Dm9z5ziU.mjs";
+import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicketRefreshProof, d as createReadOnceFileTokenAccessor, i as sendRuntimeControlHeartbeat, l as runtimeGrantToken, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, r as readRuntimeControlAuthority, s as verifyCmmdRuntimeTicket, t as bootstrapRuntimeControlAuthority, u as setRuntimeGrantToken } from "./runtimeControlAuthority-L85w5RTn.mjs";
 import { n as PtySpawnError, t as PtyAdapter } from "./PTY-CBkE5akF.mjs";
 import { createRequire } from "node:module";
 import * as HE from "node:child_process";
@@ -67570,7 +67570,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.4";
+var version$1 = "0.9.5";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -98815,14 +98815,9 @@ function mapClaudeRateLimitInfo(info) {
 }
 const cachedSnapshots = /* @__PURE__ */ new Map();
 let localClaudeGenerationHash = null;
-let localClaudeGenerationId = null;
 function setLocalClaudeUsageGeneration(generationId) {
-	localClaudeGenerationId = generationId;
 	localClaudeGenerationHash = createHash("sha256").update(generationId).digest("hex");
 }
-function currentClaudeUsageGenerationId() {
-	return localClaudeGenerationId;
-}
 function currentClaudeUsageGenerationHash() {
 	const value = process.env.FORGE_PERSONAL_CLAUDE_GENERATION_HASH?.trim() ?? "";
 	return /^[a-f0-9]{64}$/.test(value) ? value : localClaudeGenerationHash;
@@ -99242,6 +99237,16 @@ function extractClaudeProviderAccountId(response) {
 	const providerAccountId = account.providerAccountId.trim();
 	return providerAccountId.length > 0 ? providerAccountId : null;
 }
+/**
+* Logs a usage-publish failure, or does nothing when there was none. The null
+* check lives here rather than in syncClaudeCredentialForSession so that
+* reporting the failure costs that generator no branches.
+*/
+const logUsagePublishFailure = (failure, path) => failure === null ? void_$1 : logWarning$1("cmmd-claude-cred-sync: usage publish failed after deposit", {
+	error: failure.cause instanceof Error ? failure.cause.message : String(failure.cause),
+	stack: failure.cause instanceof Error ? failure.cause.stack : void 0,
+	path
+});
 async function publishClaudeUsageAfterSync(input) {
 	try {
 		const usage = await input.loadUsage({
@@ -99264,13 +99269,16 @@ async function publishClaudeUsageAfterSync(input) {
 				observedAt: (/* @__PURE__ */ new Date()).toISOString()
 			}
 		});
-	} catch {}
+		return null;
+	} catch (cause) {
+		return { cause };
+	}
 }
 async function finalizeClaudeCredentialSync(input) {
 	const providerAccountId = extractClaudeProviderAccountId(input.response);
-	if (providerAccountId === null) return;
+	if (providerAccountId === null) return null;
 	if (input.auth.path === USER_CLAUDE_CREDENTIAL_PATH) setLocalClaudeUsageGeneration(providerAccountId);
-	await publishClaudeUsageAfterSync({
+	return publishClaudeUsageAfterSync({
 		auth: input.auth,
 		providerAccountId,
 		accountEmail: input.accountEmail,
@@ -99325,7 +99333,7 @@ function syncClaudeCredentialForSession(input) {
 			}
 		})).pipe(orElseSucceed(() => null));
 		if (response === null) return { status: "failed" };
-		yield* promise(() => finalizeClaudeCredentialSync({
+		yield* logUsagePublishFailure(yield* promise(() => finalizeClaudeCredentialSync({
 			response,
 			auth,
 			accountEmail,
@@ -99333,7 +99341,7 @@ function syncClaudeCredentialForSession(input) {
 			planType: metadata.planType ?? probedMetadata.planType ?? null,
 			...input.homePath ? { homePath: input.homePath } : {},
 			loadUsage: input.loadUsage ?? fetchClaudeUsageViaOfficialClient
-		}));
+		})), auth.path);
 		return { status: "synced" };
 	});
 }
@@ -289444,6 +289452,95 @@ effect(ServerSecretStore, makeLocalServerSecretStore);
 const ServerSecretStoreRuntimeLive = effect(ServerSecretStore, gen(function* () {
 	return (yield* ServerConfig).forgeCloudShellMode === true ? yield* makePostgresServerSecretStore : yield* makeLocalServerSecretStore;
 }));
+//#endregion
+//#region src/runtimeAuth/controlAuthorityRetry.ts
+/**
+* When to try for control authority again.
+*
+* CMMD ships continuously, so a Forge Cloud runtime will outlive restarts of its
+* own control plane. Obtaining authority is therefore not a startup-time
+* question: a runtime that asks once, gets an infrastructure page mid-deploy and
+* gives up stays unauthenticated until something happens to restart it while
+* CMMD is healthy. Measured: hours, on a Sprite whose guest was serving fine the
+* whole time.
+*
+* Two shapes of failure arrive here and they need opposite answers, which is why
+* `retryable` is decided at the boundary that saw the response rather than
+* guessed at here.
+*/
+/** First backoff. Short on purpose: a deploy cutover is seconds, not minutes. */
+const BASE_DELAY_MS = 1e3;
+/**
+* Ceiling. Unbounded doubling turns a long outage into a long TAIL: an hour down
+* would be followed by up to an hour of avoidable downtime after recovery.
+*/
+const MAX_DELAY_MS = 6e4;
+/**
+* Spread, as a fraction of the delay. A fleet loses authority at the same
+* instant when the control plane restarts, so without this every runtime
+* retries in lockstep and the recovering CMMD takes the whole fleet at once.
+*
+* Kept below 1 so jitter can only ADD: a later attempt must never be scheduled
+* sooner than an earlier one, or backoff stops meaning anything.
+*/
+const JITTER_FRACTION = .25;
+function nextControlAuthorityAttempt(input) {
+	if (!input.retryable) return {
+		retry: false,
+		delayMs: 0
+	};
+	const exponent = Math.max(0, input.consecutiveFailures - 1);
+	const cap = MAX_DELAY_MS / (1 + JITTER_FRACTION);
+	const base = Math.min(BASE_DELAY_MS * 2 ** exponent, cap);
+	const random = input.random ?? Math.random;
+	return {
+		retry: true,
+		delayMs: Math.round(base * (1 + JITTER_FRACTION * random()))
+	};
+}
+/** Bounded retry budget. The next connect starts a fresh one. */
+const DEFAULT_MAX_ATTEMPTS = 8;
+/**
+* Keep asking for control authority while asking again could plausibly work.
+*
+* Bounded rather than infinite: a loop that gives up and says so lets the caller
+* log something actionable, and a connect or a heartbeat will start a fresh
+* budget anyway. An unbounded loop would hide the condition in exactly the way
+* the original `.catch(() => false)` did.
+*/
+async function bootstrapWithRetry(input) {
+	const maxAttempts = input.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+	let lastError;
+	for (let attempts = 1; attempts <= maxAttempts; attempts += 1) {
+		let retryable = true;
+		try {
+			if (await input.attempt()) return {
+				ok: true,
+				attempts
+			};
+		} catch (error) {
+			lastError = error;
+			retryable = typeof error === "object" && error !== null && "retryable" in error && error.retryable === true;
+		}
+		if (!retryable) return {
+			ok: false,
+			attempts,
+			lastError
+		};
+		if (attempts === maxAttempts) break;
+		const next = nextControlAuthorityAttempt({
+			consecutiveFailures: attempts,
+			retryable: true,
+			...input.random ? { random: input.random } : {}
+		});
+		await input.sleep(next.delayMs);
+	}
+	return {
+		ok: false,
+		attempts: maxAttempts,
+		lastError
+	};
+}
 var AuthControlPlaneError = class extends TaggedError("AuthControlPlaneError") {};
 var AuthControlPlane = class extends Service$1()("forge/AuthControlPlane") {};
 //#endregion
@@ -290636,19 +290733,24 @@ async function bootstrapControlAuthorityFromConnect(input) {
 	const credentialEpoch = input.verified.credentialEpoch;
 	const hasConnectScope = input.verified.scope.includes("http") || input.verified.scope.includes("ws");
 	if (!controlPlaneUrl || !provisioningGrant || machineId === null || credentialEpoch === null || !hasConnectScope) return;
-	await bootstrapRuntimeControlAuthority({
-		identity: {
-			controlPlaneUrl,
-			publicKeyPem: input.runtimeAuthConfig.publicKeyPem,
-			orgId: input.verified.orgId,
-			userId: input.verified.userId,
-			projectId: input.verified.projectId,
-			runtimeId: input.verified.runtimeId,
-			machineId,
-			credentialEpoch
-		},
-		connectToken: input.token,
-		provisioningGrant
+	await bootstrapWithRetry({
+		attempt: () => bootstrapRuntimeControlAuthority({
+			identity: {
+				controlPlaneUrl,
+				publicKeyPem: input.runtimeAuthConfig.publicKeyPem,
+				orgId: input.verified.orgId,
+				userId: input.verified.userId,
+				projectId: input.verified.projectId,
+				runtimeId: input.verified.runtimeId,
+				machineId,
+				credentialEpoch
+			},
+			connectToken: input.token,
+			provisioningGrant
+		}),
+		sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+	}).then((result) => {
+		if (!result.ok && result.lastError !== void 0) throw result.lastError;
 	}).catch((error) => {
 		console.error("[bootstrapControlAuthorityFromConnect] failed to establish runtime control authority; every heartbeat will report null until the next successful connect", {
 			runtimeId: input.verified.runtimeId,
@@ -295985,6 +296087,32 @@ const readPersistedServerRuntimeState = (path) => gen(function* () {
 	return yield* decodePersistedServerRuntimeState(trimmed).pipe(option);
 });
 //#endregion
+//#region src/orchestration/turnAdmission.ts
+/**
+* Whether a turn can actually run, as opposed to merely being accepted.
+*
+* A Forge Cloud runtime reaches its provider through CMMD, so without control
+* authority it cannot start a turn at all. It could still ACCEPT one: the
+* command validates, the thread and worktree are created, the user message is
+* recorded, and the turn then sits at `pending` forever with nothing surfaced.
+*
+* Measured on forge-cmmd-r03ad897c5e90 while CMMD was redeploying: HTTP 200 on
+* dispatch, five user messages, zero assistant messages, every turn stuck with
+* `started_at` empty. The client had no way to know.
+*
+* Kept as a pure function because the interesting part is the RULE, not the
+* plumbing: it is only cloud runtimes, only turns, and only when authority is
+* genuinely absent.
+*/
+/** Commands that need a provider, and therefore need control authority. */
+const TURN_COMMANDS = new Set(["thread.turn.start"]);
+function refuseTurnWithoutControlAuthority(input) {
+	if (!input.cmmdRuntimeMode) return null;
+	if (!TURN_COMMANDS.has(input.commandType)) return null;
+	if (input.hasControlAuthority) return null;
+	return "This runtime has no CMMD control authority, so a turn cannot reach a provider and would queue without ever running. The runtime re-establishes authority on its own; retry shortly.";
+}
+//#endregion
 //#region ../../packages/shared/src/forgeCommands.ts
 /** Root of the repo-local skill contracts. */
 const FORGE_SKILLS_DIR = ".agents/skills";
@@ -296539,6 +296667,16 @@ const orchestrationDispatchRouteLayer = add$1("POST", "/api/orchestration/dispat
 		message: "Invalid orchestration command payload.",
 		cause
 	}))));
+	const admissionRefusal = refuseTurnWithoutControlAuthority({
+		commandType: normalizedCommand.type,
+		cmmdRuntimeMode: process.env.FORGE_CMMD_RUNTIME_MODE === "true",
+		hasControlAuthority: readRuntimeControlAuthority({
+			runtimeId: process.env.FORGE_CMMD_RUNTIME_ID ?? "",
+			machineId: process.env.FORGE_CMMD_RUNTIME_MACHINE_ID ?? "",
+			credentialEpoch: Number(process.env.FORGE_CMMD_RUNTIME_CREDENTIAL_EPOCH ?? "0")
+		}) !== null
+	});
+	if (admissionRefusal !== null) return yield* new OrchestrationDispatchCommandError({ message: admissionRefusal });
 	const dispatchEffect = normalizedCommand.type === "thread.turn.start" && normalizedCommand.bootstrap ? gen(function* () {
 		const git = yield* serviceOption(GitCore);
 		const gitStatusBroadcaster = yield* serviceOption(GitStatusBroadcaster);
@@ -298851,7 +298989,7 @@ const cmmdSetProviderAccountDefaultRouteLayer = registerProxyRoute({
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const resolveConnectedClaudeGenerationHash = (session) => gen(function* () {
+const resolveConnectedClaudeGeneration = (session) => gen(function* () {
 	const outcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
 		method: "GET",
 		jwt,
@@ -298865,18 +299003,22 @@ const resolveConnectedClaudeGenerationHash = (session) => gen(function* () {
 	};
 	return {
 		ok: true,
-		value: createHash("sha256").update(state.generationId).digest("hex")
+		value: {
+			generationId: state.generationId,
+			generationHash: createHash("sha256").update(state.generationId).digest("hex")
+		}
 	};
 });
 /**
 * The GET path is read-only. The explicit per-account POST refresh invokes
 * this helper and propagates any CMMD forward failure to the caller.
 */
-const forwardClaudeUsageTelemetry = (session, providerAccountId = currentClaudeUsageGenerationId() ?? "", activelyPoll = false, fetchClaudeUsage = fetchClaudeUsageViaOfficialClient) => gen(function* () {
-	const credentialOutcome = yield* resolveConnectedClaudeGenerationHash(session);
+const forwardClaudeUsageTelemetry = (session, requestedProviderAccountId, activelyPoll = false, fetchClaudeUsage = fetchClaudeUsageViaOfficialClient) => gen(function* () {
+	const credentialOutcome = yield* resolveConnectedClaudeGeneration(session);
 	if (!credentialOutcome.ok) return credentialOutcome;
-	const generationId = currentClaudeUsageGenerationId();
-	if (credentialOutcome.value === null || generationId === null) return null;
+	if (credentialOutcome.value === null) return null;
+	const { generationId, generationHash } = credentialOutcome.value;
+	const providerAccountId = requestedProviderAccountId ?? generationId;
 	const activeSnapshot = activelyPoll && providerAccountId === generationId ? yield* tryPromise({
 		try: () => fetchClaudeUsage({ binaryPath: resolveClaudeBinaryPath("claude") }),
 		catch: (cause) => new ClaudeUsageReadError({ cause })
@@ -298884,7 +299026,7 @@ const forwardClaudeUsageTelemetry = (session, providerAccountId = currentClaudeU
 	const snapshot = activeSnapshot ? {
 		...activeSnapshot,
 		observedAt: (/* @__PURE__ */ new Date()).toISOString()
-	} : getLatestClaudeRateLimitTelemetry(credentialOutcome.value, providerAccountId);
+	} : getLatestClaudeRateLimitTelemetry(generationHash, providerAccountId);
 	if (!snapshot) return null;
 	return yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
 		method: "POST",

package/dist/runtimeBootstrap.cjs

@@ -2,7 +2,7 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-BhaIgcZK.cjs");
-const require_runtimeControlAuthority = require("./runtimeControlAuthority-Dx6Y5LPI.cjs");
+const require_runtimeControlAuthority = require("./runtimeControlAuthority-SNBF5Mjy.cjs");
 exports.bootstrapRuntimeControlAuthorityFromNarrowGrant = require_runtimeControlAuthority.bootstrapRuntimeControlAuthorityFromNarrowGrant;
 exports.setRuntimeGrantToken = require_runtimeControlAuthority.setRuntimeGrantToken;
 exports.verifyCmmdRuntimeTicket = require_runtimeControlAuthority.verifyCmmdRuntimeTicket;

package/dist/runtimeBootstrap.mjs

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 
-import { n as bootstrapRuntimeControlAuthorityFromNarrowGrant, s as verifyCmmdRuntimeTicket, u as setRuntimeGrantToken } from "./runtimeControlAuthority-Dm9z5ziU.mjs";
+import { n as bootstrapRuntimeControlAuthorityFromNarrowGrant, s as verifyCmmdRuntimeTicket, u as setRuntimeGrantToken } from "./runtimeControlAuthority-L85w5RTn.mjs";
 export { bootstrapRuntimeControlAuthorityFromNarrowGrant, setRuntimeGrantToken, verifyCmmdRuntimeTicket };

package/dist/{runtimeControlAuthority-Dm9z5ziU.mjs → runtimeControlAuthority-L85w5RTn.mjs}

@@ -249,13 +249,40 @@ const CONTROL_AUTHORITY_SCOPES = new Set(["heartbeat", "replication"]);
 var RuntimeControlAuthorityError = class extends Error {
 	status;
 	code;
+	/**
+	* Whether trying again could plausibly succeed.
+	*
+	* A restarting control plane and a wrong credential both fail here and need
+	* opposite responses: the first must be retried until the deploy finishes,
+	* the second must not be retried at all. Without this the caller cannot tell
+	* them apart and picks wrong in one direction or the other.
+	*/
+	retryable;
 	constructor(input) {
 		super(input.message);
 		this.name = "RuntimeControlAuthorityError";
 		this.status = input.status ?? null;
 		this.code = input.code;
+		this.retryable = input.retryable ?? false;
 	}
 };
+/** Longest body prefix quoted into an error message. */
+const CONTROL_AUTHORITY_BODY_PREVIEW = 180;
+/**
+* A short, credential-free description of a body that would not parse.
+*
+* The point is to identify the RESPONDER. A proxy error page says who it is in
+* its first line, and that one line is the whole difference between "CMMD is
+* redeploying" and a multi-hour dig through a guest.
+*
+* Redacted because this lands in logs and the responder is not always the one
+* we think it is: anything resembling a JWT or a long opaque token is stripped
+* rather than trusted to be harmless.
+*/
+function describeUnparsableBody(body) {
+	const collapsed = body.replace(/[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{6,}/g, "<redacted-jwt>").replace(/[A-Za-z0-9_-]{40,}/g, "<redacted>").replace(/\s+/g, " ").trim();
+	return collapsed.length > CONTROL_AUTHORITY_BODY_PREVIEW ? `${collapsed.slice(0, CONTROL_AUTHORITY_BODY_PREVIEW)}…` : collapsed;
+}
 let authority = null;
 let bootstrapInFlight = null;
 function normalizedControlPlaneUrl(value) {
@@ -352,15 +379,18 @@ async function readControlAuthorityResponse(response) {
 	if (!response.ok) throw new RuntimeControlAuthorityError({
 		status: response.status,
 		code: "CMMD_RUNTIME_CONTROL_AUTHORITY_REJECTED",
+		retryable: response.status >= 500,
 		message: `CMMD runtime control authority request failed (${response.status}).`
 	});
+	const raw = await response.text().catch(() => "");
 	try {
-		return await response.json();
+		return JSON.parse(raw);
 	} catch {
 		throw new RuntimeControlAuthorityError({
 			status: response.status,
 			code: "CMMD_RUNTIME_CONTROL_AUTHORITY_INVALID_RESPONSE",
-			message: "CMMD runtime control authority returned invalid JSON."
+			retryable: true,
+			message: `CMMD runtime control authority returned ${response.status} with a non-JSON body (content-type: ${response.headers.get("content-type") ?? "none"}): ${describeUnparsableBody(raw) || "<empty>"}`
 		});
 	}
 }
@@ -502,4 +532,4 @@ async function sendRuntimeControlHeartbeat(input) {
 //#endregion
 export { verifyCmmdAuthRuntimeTicket as a, verifyCmmdRuntimeTicketRefreshProof as c, createReadOnceFileTokenAccessor as d, sendRuntimeControlHeartbeat as i, runtimeGrantToken as l, bootstrapRuntimeControlAuthorityFromNarrowGrant as n, verifyCmmdClaudeReadinessTicket as o, readRuntimeControlAuthority as r, verifyCmmdRuntimeTicket as s, bootstrapRuntimeControlAuthority as t, setRuntimeGrantToken as u };
 
-//# sourceMappingURL=runtimeControlAuthority-Dm9z5ziU.mjs.map
+//# sourceMappingURL=runtimeControlAuthority-L85w5RTn.mjs.map

package/dist/{runtimeControlAuthority-Dx6Y5LPI.cjs → runtimeControlAuthority-SNBF5Mjy.cjs}

@@ -250,13 +250,40 @@ const CONTROL_AUTHORITY_SCOPES = new Set(["heartbeat", "replication"]);
 var RuntimeControlAuthorityError = class extends Error {
 	status;
 	code;
+	/**
+	* Whether trying again could plausibly succeed.
+	*
+	* A restarting control plane and a wrong credential both fail here and need
+	* opposite responses: the first must be retried until the deploy finishes,
+	* the second must not be retried at all. Without this the caller cannot tell
+	* them apart and picks wrong in one direction or the other.
+	*/
+	retryable;
 	constructor(input) {
 		super(input.message);
 		this.name = "RuntimeControlAuthorityError";
 		this.status = input.status ?? null;
 		this.code = input.code;
+		this.retryable = input.retryable ?? false;
 	}
 };
+/** Longest body prefix quoted into an error message. */
+const CONTROL_AUTHORITY_BODY_PREVIEW = 180;
+/**
+* A short, credential-free description of a body that would not parse.
+*
+* The point is to identify the RESPONDER. A proxy error page says who it is in
+* its first line, and that one line is the whole difference between "CMMD is
+* redeploying" and a multi-hour dig through a guest.
+*
+* Redacted because this lands in logs and the responder is not always the one
+* we think it is: anything resembling a JWT or a long opaque token is stripped
+* rather than trusted to be harmless.
+*/
+function describeUnparsableBody(body) {
+	const collapsed = body.replace(/[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{6,}/g, "<redacted-jwt>").replace(/[A-Za-z0-9_-]{40,}/g, "<redacted>").replace(/\s+/g, " ").trim();
+	return collapsed.length > CONTROL_AUTHORITY_BODY_PREVIEW ? `${collapsed.slice(0, CONTROL_AUTHORITY_BODY_PREVIEW)}…` : collapsed;
+}
 let authority = null;
 let bootstrapInFlight = null;
 function normalizedControlPlaneUrl(value) {
@@ -353,15 +380,18 @@ async function readControlAuthorityResponse(response) {
 	if (!response.ok) throw new RuntimeControlAuthorityError({
 		status: response.status,
 		code: "CMMD_RUNTIME_CONTROL_AUTHORITY_REJECTED",
+		retryable: response.status >= 500,
 		message: `CMMD runtime control authority request failed (${response.status}).`
 	});
+	const raw = await response.text().catch(() => "");
 	try {
-		return await response.json();
+		return JSON.parse(raw);
 	} catch {
 		throw new RuntimeControlAuthorityError({
 			status: response.status,
 			code: "CMMD_RUNTIME_CONTROL_AUTHORITY_INVALID_RESPONSE",
-			message: "CMMD runtime control authority returned invalid JSON."
+			retryable: true,
+			message: `CMMD runtime control authority returned ${response.status} with a non-JSON body (content-type: ${response.headers.get("content-type") ?? "none"}): ${describeUnparsableBody(raw) || "<empty>"}`
 		});
 	}
 }
@@ -568,4 +598,4 @@ Object.defineProperty(exports, "verifyCmmdRuntimeTicketRefreshProof", {
 	}
 });
 
-//# sourceMappingURL=runtimeControlAuthority-Dx6Y5LPI.cjs.map
+//# sourceMappingURL=runtimeControlAuthority-SNBF5Mjy.cjs.map

package/package.json

@@ -9,7 +9,7 @@
     "cmmd-forge": "dist/bin.mjs"
   },
   "type": "module",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "engines": {
     "node": "^22.16 || ^23.11 || >=24.10"
   },