@cmmd-center/forge 0.9.4 → 0.9.6

package/dist/bin.cjs

@@ -2,18 +2,18 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-BhaIgcZK.cjs");
-const require_Schema$1 = require("./Schema-Bij_WAra.cjs");
-const require_Path = require("./Path-CsbBuCFB.cjs");
-const require_NodeTerminal = require("./NodeTerminal-B9u7fFYa.cjs");
-const require_NodeServices = require("./NodeServices-BISZRY3e.cjs");
-const require_HttpServer = require("./HttpServer-aJkhz6yu.cjs");
-const require_Config = require("./Config-DMA9WqtC.cjs");
-const require_Cache = require("./Cache-XSj5g7uG.cjs");
-const require_SqlError = require("./SqlError-C2mi8_tp.cjs");
+const require_Schema$1 = require("./Schema-DaFukK_y.cjs");
+const require_Path = require("./Path-qpublmG3.cjs");
+const require_NodeTerminal = require("./NodeTerminal-D86oor5_.cjs");
+const require_NodeServices = require("./NodeServices-BjmXNhpe.cjs");
+const require_HttpServer = require("./HttpServer-BTcgkY38.cjs");
+const require_Config = require("./Config-BHRBB8XM.cjs");
+const require_Cache = require("./Cache-BRhFH80U.cjs");
+const require_SqlError = require("./SqlError-CsWFS-OU.cjs");
 const require_esm = require("./esm-Do7HVhLA.cjs");
 const require_Mime = require("./Mime-CyHbecis.cjs");
-const require_runtimeControlAuthority = require("./runtimeControlAuthority-Dx6Y5LPI.cjs");
-const require_PTY = require("./PTY-U3JQnLXS.cjs");
+const require_runtimeControlAuthority = require("./runtimeControlAuthority-SNBF5Mjy.cjs");
+const require_PTY = require("./PTY-BB84iC10.cjs");
 let node_child_process = require("node:child_process");
 node_child_process = require_chunk.__toESM(node_child_process);
 let node_stream = require("node:stream");
@@ -17640,6 +17640,7 @@ const ExecutionEnvironmentCapabilities = require_Schema$1.Struct({
 	pullRequests: require_Schema$1.optionalKey(require_Schema$1.Boolean),
 	threadPullRequestLinking: require_Schema$1.optionalKey(require_Schema$1.Boolean),
 	cloudMode: require_Schema$1.Boolean.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(false))),
+	threadSettlement: require_Schema$1.optionalKey(require_Schema$1.Boolean),
 	posthogPublicKey: require_Schema$1.NullOr(require_Schema$1.String).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	posthogHost: require_Schema$1.NullOr(require_Schema$1.String).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	runtime: require_Schema$1.optionalKey(ExecutionEnvironmentRuntimeCapabilities),
@@ -67803,7 +67804,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.4";
+var version$1 = "0.9.5";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -68205,6 +68206,30 @@ const respondToAuthError = (error) => require_Schema$1.gen(function* () {
 	}));
 	return response;
 });
+const OAUTH_ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+/**
+* The one exchange this endpoint performs, or the reason it will not.
+*
+* Returns a message rather than a boolean so the route can say which field was
+* wrong: an operator debugging a pairing failure otherwise cannot tell an
+* unsupported grant from an unsupported token type.
+*/
+function rejectUnsupportedTokenExchange(input) {
+	if (input.grant_type !== "urn:ietf:params:oauth:grant-type:token-exchange") return "Unsupported grant_type.";
+	if (input.subject_token_type !== "urn:t3:params:oauth:token-type:environment-bootstrap") return "Unsupported subject_token_type.";
+	if (input.requested_token_type !== "urn:ietf:params:oauth:token-type:access_token") return "Unsupported requested_token_type.";
+	return null;
+}
+/**
+* `expires_in` is a duration in seconds; a session carries an absolute instant.
+*
+* Clamped at zero so a session that expired between issuance and this call is
+* reported as already expired rather than as a negative lifetime, which a client
+* could read as a very large unsigned value.
+*/
+function accessTokenExpiresInSeconds(remainingMillis) {
+	return Math.max(0, Math.floor(remainingMillis / 1e3));
+}
 //#endregion
 //#region ../../packages/shared/src/cmmdIdentity.ts
 const MAX_CMMD_AVATAR_URL_LENGTH = 256 * 1024;
@@ -69404,6 +69429,16 @@ const CommandOAuthDeviceInput = require_Schema$1.Struct({
 	return_url: require_Schema$1.optionalKey(require_Schema$1.String),
 	scope: require_Schema$1.optionalKey(require_Schema$1.String)
 });
+const OAuthTokenExchangeInput = require_Schema$1.Struct({
+	grant_type: require_Schema$1.String,
+	subject_token: require_Schema$1.String,
+	subject_token_type: require_Schema$1.String,
+	requested_token_type: require_Schema$1.String,
+	scope: require_Schema$1.optional(require_Schema$1.String),
+	client_label: require_Schema$1.optional(require_Schema$1.String),
+	client_device_type: require_Schema$1.optional(require_Schema$1.String),
+	client_os: require_Schema$1.optional(require_Schema$1.String)
+});
 const CommandOAuthTokenInput = require_Schema$1.Struct({
 	grant_type: require_Schema$1.String,
 	device_code: require_Schema$1.String,
@@ -70246,6 +70281,51 @@ const authBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/bearer"
 	const result = yield* serverAuth.exchangeBootstrapCredentialForBearerSession(payload.credential, deriveAuthClientMetadata({ request }));
 	return require_HttpServer.jsonUnsafe(result, { status: 200 });
 }).pipe(require_Schema$1.catchTag("AuthError", (error) => respondToAuthError(error))));
+/**
+* FORGE COMPAT. `POST /oauth/token` — the RFC 8693 token exchange the vendored
+* t3code client uses to turn a pairing credential into a bearer token.
+*
+* Forge's own clients call `/api/auth/bootstrap/bearer` with JSON. The mobile app
+* cannot: the endpoint is baked into the vendored contract
+* (packages/t3-contracts/src/environmentHttp.ts) as a form-urlencoded OAuth
+* exchange, and without it every attempt to add an environment fails with a 404 —
+* which leaves the whole app unusable, since no screen works before an
+* environment exists.
+*
+* This is a shape adapter, not a second way to authenticate. It performs no
+* validation of its own and mints nothing: it forwards the subject token to the
+* same `exchangeBootstrapCredentialForBearerSession` the JSON route uses, so the
+* credential rules, expiry and session issuance stay in one place. The only work
+* here is vocabulary — form encoding in, OAuth field names out.
+*
+* Same pattern as the vcs.* handlers in ws.ts: the Forge server speaks upstream's
+* dialect over Forge's own services, rather than the vendored client being patched
+* to speak Forge's.
+*/
+const authOAuthTokenExchangeRouteLayer = add$1("POST", "/oauth/token", require_Schema$1.gen(function* () {
+	const request = yield* require_HttpServer.HttpServerRequest;
+	const serverAuth = yield* ServerAuth;
+	const payload = yield* require_HttpServer.schemaBodyUrlParams(OAuthTokenExchangeInput).pipe(require_Schema$1.mapError((cause) => new AuthError({
+		message: "Invalid token exchange payload.",
+		status: 400,
+		cause
+	})));
+	const refusal = rejectUnsupportedTokenExchange(payload);
+	if (refusal !== null) return yield* new AuthError({
+		message: refusal,
+		status: 400
+	});
+	const session = yield* serverAuth.exchangeBootstrapCredentialForBearerSession(payload.subject_token, deriveAuthClientMetadata({ request }));
+	const now$6 = yield* require_Schema$1.now;
+	const expiresInSeconds = accessTokenExpiresInSeconds(require_Schema$1.toMillis(require_Schema$1.distance(now$6, session.expiresAt)));
+	return require_HttpServer.jsonUnsafe({
+		access_token: session.sessionToken,
+		issued_token_type: OAUTH_ACCESS_TOKEN_TYPE,
+		token_type: "Bearer",
+		expires_in: expiresInSeconds,
+		scope: payload.scope ?? session.role
+	}, { status: 200 });
+}).pipe(require_Schema$1.catchTag("AuthError", (error) => respondToAuthError(error))));
 const authWebSocketTokenRouteLayer = add$1("POST", "/api/auth/ws-token", require_Schema$1.gen(function* () {
 	const request = yield* require_HttpServer.HttpServerRequest;
 	const serverAuth = yield* ServerAuth;
@@ -99120,14 +99200,9 @@ function mapClaudeRateLimitInfo(info) {
 }
 const cachedSnapshots = /* @__PURE__ */ new Map();
 let localClaudeGenerationHash = null;
-let localClaudeGenerationId = null;
 function setLocalClaudeUsageGeneration(generationId) {
-	localClaudeGenerationId = generationId;
 	localClaudeGenerationHash = (0, node_crypto.createHash)("sha256").update(generationId).digest("hex");
 }
-function currentClaudeUsageGenerationId() {
-	return localClaudeGenerationId;
-}
 function currentClaudeUsageGenerationHash() {
 	const value = process.env.FORGE_PERSONAL_CLAUDE_GENERATION_HASH?.trim() ?? "";
 	return /^[a-f0-9]{64}$/.test(value) ? value : localClaudeGenerationHash;
@@ -99547,6 +99622,16 @@ function extractClaudeProviderAccountId(response) {
 	const providerAccountId = account.providerAccountId.trim();
 	return providerAccountId.length > 0 ? providerAccountId : null;
 }
+/**
+* Logs a usage-publish failure, or does nothing when there was none. The null
+* check lives here rather than in syncClaudeCredentialForSession so that
+* reporting the failure costs that generator no branches.
+*/
+const logUsagePublishFailure = (failure, path) => failure === null ? require_Schema$1.void_ : require_Schema$1.logWarning("cmmd-claude-cred-sync: usage publish failed after deposit", {
+	error: failure.cause instanceof Error ? failure.cause.message : String(failure.cause),
+	stack: failure.cause instanceof Error ? failure.cause.stack : void 0,
+	path
+});
 async function publishClaudeUsageAfterSync(input) {
 	try {
 		const usage = await input.loadUsage({
@@ -99569,13 +99654,16 @@ async function publishClaudeUsageAfterSync(input) {
 				observedAt: (/* @__PURE__ */ new Date()).toISOString()
 			}
 		});
-	} catch {}
+		return null;
+	} catch (cause) {
+		return { cause };
+	}
 }
 async function finalizeClaudeCredentialSync(input) {
 	const providerAccountId = extractClaudeProviderAccountId(input.response);
-	if (providerAccountId === null) return;
+	if (providerAccountId === null) return null;
 	if (input.auth.path === USER_CLAUDE_CREDENTIAL_PATH) setLocalClaudeUsageGeneration(providerAccountId);
-	await publishClaudeUsageAfterSync({
+	return publishClaudeUsageAfterSync({
 		auth: input.auth,
 		providerAccountId,
 		accountEmail: input.accountEmail,
@@ -99630,7 +99718,7 @@ function syncClaudeCredentialForSession(input) {
 			}
 		})).pipe(require_Schema$1.orElseSucceed(() => null));
 		if (response === null) return { status: "failed" };
-		yield* require_Schema$1.promise(() => finalizeClaudeCredentialSync({
+		yield* logUsagePublishFailure(yield* require_Schema$1.promise(() => finalizeClaudeCredentialSync({
 			response,
 			auth,
 			accountEmail,
@@ -99638,7 +99726,7 @@ function syncClaudeCredentialForSession(input) {
 			planType: metadata.planType ?? probedMetadata.planType ?? null,
 			...input.homePath ? { homePath: input.homePath } : {},
 			loadUsage: input.loadUsage ?? fetchClaudeUsageViaOfficialClient
-		}));
+		})), auth.path);
 		return { status: "synced" };
 	});
 }
@@ -113685,8 +113773,8 @@ require_Schema$1.effectDiscard(runMigrations());
 //#endregion
 //#region src/persistence/Layers/Sqlite.ts
 const defaultSqliteClientLoaders = {
-	bun: () => Promise.resolve().then(() => require("./SqliteClient-CdAhI4lb.cjs")),
-	node: () => Promise.resolve().then(() => require("./NodeSqliteClient-SsUCk9mA.cjs"))
+	bun: () => Promise.resolve().then(() => require("./SqliteClient-BpjZWL6O.cjs")),
+	node: () => Promise.resolve().then(() => require("./NodeSqliteClient-CG_mPdVp.cjs"))
 };
 const makeRuntimeSqliteLayer = require_Schema$1.fn("makeRuntimeSqliteLayer")(function* (config) {
 	const loader = defaultSqliteClientLoaders[process.versions.bun !== void 0 ? "bun" : "node"];
@@ -147034,22 +147122,58 @@ function runtimeAuthoritySessionId(input) {
 	if (input.authSessionId) return input.authSessionId;
 	return input.threadId ? readThreadSessionId(input.threadId) : null;
 }
+/**
+* Pure mapping from the three preconditions to an outcome.
+*
+* Split out so the reason can be tested without an Effect runtime, env vars or
+* module mocking — the decision is the thing worth pinning, not the plumbing
+* around it.
+*/
+function resolveBrokerTicketOutcome(input) {
+	if (input.identityMode === "legacy") return {
+		kind: "ticket",
+		token: input.legacyGrantToken
+	};
+	if (input.identityMode === "invalid") return {
+		kind: "unavailable",
+		reason: "runtime identity is incomplete or invalid"
+	};
+	if (!input.sessionId) return {
+		kind: "unavailable",
+		reason: "no owner session is bound to this request"
+	};
+	return input.brokerAuthority ? {
+		kind: "ticket",
+		token: input.brokerAuthority
+	} : {
+		kind: "unavailable",
+		reason: "no live broker authority for this session"
+	};
+}
 function runtimeProviderBrokerToken(input) {
 	const identity = classifyRuntimeBrokerIdentity({
 		machineId: configuredRuntimeMachineId() ?? void 0,
 		credentialEpoch: configuredRuntimeCredentialEpoch(),
 		brokerAuthorityMode: process.env.FORGE_CMMD_RUNTIME_BROKER_AUTHORITY_MODE
 	});
-	if (identity.mode === "legacy") return require_runtimeControlAuthority.runtimeGrantToken();
-	if (identity.mode === "invalid") return null;
+	if (identity.mode !== "exact") return resolveBrokerTicketOutcome({
+		identityMode: identity.mode,
+		legacyGrantToken: identity.mode === "legacy" ? require_runtimeControlAuthority.runtimeGrantToken() : null,
+		sessionId: null,
+		brokerAuthority: null
+	});
 	const sessionId = runtimeAuthoritySessionId(input);
-	if (!sessionId) return null;
-	return readRuntimeBrokerAuthority({
+	return resolveBrokerTicketOutcome({
+		identityMode: "exact",
+		legacyGrantToken: null,
 		sessionId,
-		runtimeId: process.env.FORGE_CMMD_RUNTIME_ID,
-		machineId: identity.machineId,
-		credentialEpoch: identity.credentialEpoch,
-		requiredScope: "provider"
+		brokerAuthority: sessionId ? readRuntimeBrokerAuthority({
+			sessionId,
+			runtimeId: process.env.FORGE_CMMD_RUNTIME_ID,
+			machineId: identity.machineId,
+			credentialEpoch: identity.credentialEpoch,
+			requiredScope: "provider"
+		}) : null
 	});
 }
 async function fetchRuntimeProviderGrant(input) {
@@ -147094,8 +147218,9 @@ const issueProviderEgressCredential = (input) => require_Schema$1.tryPromise({
 async function issueCmmdRuntimeProviderEgressCredential(input) {
 	const controlPlaneUrl = process.env.FORGE_COMMAND_APP_URL.replace(/\/+$/, "");
 	const runtimeId = encodeURIComponent(process.env.FORGE_CMMD_RUNTIME_ID);
-	const runtimeGrantToken = runtimeProviderBrokerToken(input);
-	if (!runtimeGrantToken) throw new Error("Provider token issuance requires a live exact-machine broker authority for this runtime epoch.");
+	const brokerTicket = runtimeProviderBrokerToken(input);
+	if (brokerTicket.kind === "unavailable") throw new Error(`Provider token issuance requires a live exact-machine broker authority for this runtime epoch (${brokerTicket.reason}).`);
+	const runtimeGrantToken = brokerTicket.token;
 	const response = await fetchRuntimeProviderGrant({
 		url: `${controlPlaneUrl}/api/forge/runtimes/${runtimeId}/provider/token`,
 		token: runtimeGrantToken,
@@ -205343,6 +205468,48 @@ function applyPluginSkillPermissionsToDynamicTools(tools, settings) {
 	});
 }
 //#endregion
+//#region src/github/forgeGitHubToolHandler.ts
+/**
+* Shared wiring for Forge's brokered GitHub tools.
+*
+* Both provider surfaces run the same handler: Codex exposes the tools
+* natively, Claude reaches them over in-process MCP (`GitHubMcpServer.ts`).
+* The auth binding, the write confirmation gate and the audit trail live here
+* so a new surface cannot accidentally omit one — the handler's own defaults
+* are deliberately inert (no audit, never confirmed), which is safe for tests
+* but wrong for a real turn.
+*/
+function createForgeGitHubToolHandlerOptions(deps) {
+	const { runWithRuntimeContext } = deps;
+	return {
+		broker: new GitHubBroker({
+			resolveJwt: (auth) => runWithRuntimeContext(resolveCmmdJwtForSession({
+				sessionId: auth.sessionId,
+				logPrefix: deps.logPrefix,
+				...auth.subject !== void 0 ? { subject: auth.subject } : {},
+				...auth.forceRefresh !== void 0 ? { forceRefresh: auth.forceRefresh } : {}
+			})),
+			githubWriteIdentity: deps.githubWriteIdentity
+		}),
+		resolveAuth: async (threadId) => {
+			const binding = await runWithRuntimeContext(readThreadAuthSession(threadId));
+			return binding ? {
+				sessionId: binding.sessionId,
+				...binding.subject ? { subject: binding.subject } : {}
+			} : null;
+		},
+		recordAudit: (auditEvent) => runWithRuntimeContext(recordGitHubToolAuditEvent(auditEvent).pipe(require_Schema$1.asVoid)),
+		createConfirmation: (confirmation) => runWithRuntimeContext(createGitHubToolConfirmation(confirmation)),
+		isConfirmed: (confirmation) => runWithRuntimeContext(consumeApprovedOrLatestGitHubToolConfirmation({
+			confirmationId: confirmation.confirmationId,
+			threadId: confirmation.threadId,
+			toolName: confirmation.toolName,
+			request: confirmation.request
+		})),
+		bypassWriteConfirmation: deps.bypassWriteConfirmation
+	};
+}
+//#endregion
 //#region src/provider/shellSafety.ts
 const SHELL_SAFE_COMMAND_PATH_PATTERN = /^[A-Za-z0-9_.\-/\\:]+$/;
 function isShellSafeCommandPath(command) {
@@ -206633,33 +206800,12 @@ const makeCodexAdapter = require_Schema$1.fn("makeCodexAdapter")(function* (opti
 		}));
 		const browserToolEnvironmentId = yield* resolveBrowserToolEnvironmentId$1();
 		const computerManager = resolveComputerManager(serverConfig);
-		const githubDynamicToolHandler = createCodexGitHubDynamicToolHandler({
-			broker: new GitHubBroker({
-				resolveJwt: (auth) => runWithRuntimeContext(resolveCmmdJwtForSession({
-					sessionId: auth.sessionId,
-					logPrefix: "codex-github",
-					...auth.subject !== void 0 ? { subject: auth.subject } : {},
-					...auth.forceRefresh !== void 0 ? { forceRefresh: auth.forceRefresh } : {}
-				})),
-				githubWriteIdentity: settings.githubWriteIdentity
-			}),
-			resolveAuth: async (threadId) => {
-				const binding = await runWithRuntimeContext(readThreadAuthSession(threadId));
-				return binding ? {
-					sessionId: binding.sessionId,
-					...binding.subject ? { subject: binding.subject } : {}
-				} : null;
-			},
-			recordAudit: (auditEvent) => runWithRuntimeContext(recordGitHubToolAuditEvent(auditEvent).pipe(require_Schema$1.asVoid)),
-			createConfirmation: (confirmation) => runWithRuntimeContext(createGitHubToolConfirmation(confirmation)),
-			isConfirmed: (confirmation) => runWithRuntimeContext(consumeApprovedOrLatestGitHubToolConfirmation({
-				confirmationId: confirmation.confirmationId,
-				threadId: confirmation.threadId,
-				toolName: confirmation.toolName,
-				request: confirmation.request
-			})),
+		const githubDynamicToolHandler = createCodexGitHubDynamicToolHandler(createForgeGitHubToolHandlerOptions({
+			runWithRuntimeContext,
+			githubWriteIdentity: settings.githubWriteIdentity,
+			logPrefix: "codex-github",
 			bypassWriteConfirmation: input.runtimeMode === "full-access"
-		});
+		}));
 		const cmmdConnectorDynamicToolHandler = createCodexCmmdConnectorDynamicToolHandler({ resolveAuth: async (threadId) => {
 			const binding = await runWithRuntimeContext(readThreadAuthSession(threadId));
 			if (!binding) return null;
@@ -208206,6 +208352,62 @@ function createDevServerMcpServer(deps, threadId) {
 	});
 }
 //#endregion
+//#region src/github/GitHubMcpServer.ts
+/**
+* Brokered Forge GitHub tools, exposed to the Claude surface (in-process MCP).
+*
+* The Codex app-server consumes these tools as native dynamic tools; Claude
+* reaches them through MCP instead. Both surfaces dispatch the SAME handler
+* (`createCodexGitHubDynamicToolHandler`), so auth resolution, the write
+* confirmation gate and the audit trail are shared rather than reimplemented
+* per provider — this module only adapts descriptor + result shapes.
+*
+* Without it a Claude agent has no brokered push path at all and falls back to
+* raw `git`, which the runtime deliberately blocks via `GIT_ASKPASS=/bin/false`.
+*
+* Result envelopes are relayed verbatim as tool content: the web approval card
+* is built by scanning tool results for `userActionRequired`, so summarising or
+* reshaping the payload here would silently strip the user's ability to approve
+* a write.
+*/
+const GITHUB_MCP_SERVER_NAME = "forge-github";
+/** Joins the brokered result's content items back into a single text payload. */
+function readResultText(contentItems) {
+	return contentItems.map((item) => item.text).filter((text) => typeof text === "string").join("\n");
+}
+/**
+* Factored out of `createGitHubMcpServer` (mirroring the Sidekick tools server)
+* so dispatch and envelope handling are testable without the SDK's `tool()` /
+* `createSdkMcpServer` machinery.
+*/
+function buildGitHubToolHandlers(runBrokeredTool, threadId) {
+	return createCodexGitHubDynamicTools().map((descriptor) => ({
+		name: descriptor.name,
+		description: descriptor.description,
+		inputSchema: jsonSchemaToZodShape(descriptor.inputSchema),
+		handler: async (args) => {
+			const result = await runBrokeredTool({
+				threadId,
+				tool: descriptor.name,
+				arguments: args
+			});
+			return {
+				content: [{
+					type: "text",
+					text: readResultText(result.contentItems)
+				}],
+				...result.success ? {} : { isError: true }
+			};
+		}
+	}));
+}
+function createGitHubMcpServer(runBrokeredTool, threadId) {
+	return z1e({
+		name: GITHUB_MCP_SERVER_NAME,
+		tools: buildGitHubToolHandlers(runBrokeredTool, threadId).map((entry) => U1e(entry.name, entry.description, entry.inputSchema, entry.handler))
+	});
+}
+//#endregion
 //#region src/provider/providerAuthFailureCopy.ts
 /**
 * Rewrite provider auth failures into an action the user can actually take.
@@ -208510,6 +208712,7 @@ function buildClaudeMcpServers(input) {
 		"forge-browser": createBrowserMcpServer(input.browserManager, input.threadId, browserToolScope(input.browserToolEnvironmentId)),
 		"forge-dev-server": createDevServerMcpServer(input.devServerToolDeps, input.threadId),
 		"cmmd-context": createCmmdContextMcpServer(input.threadId, input.resolveCmmdPat),
+		[GITHUB_MCP_SERVER_NAME]: createGitHubMcpServer(input.runBrokeredGitHubTool, input.threadId),
 		...input.computerManager ? { [COMPUTER_MCP_SERVER_NAME]: createComputerMcpServer(input.computerManager, input.threadId) } : {},
 		...input.cmmdSidekickTools ? { "cmmd-sidekick-tools": createCmmdSidekickToolsMcpServer(input.cmmdSidekickTools.session, input.cmmdSidekickTools.tools) } : {}
 	};
@@ -210520,6 +210723,12 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 		const permissionMode = permissionModeForRuntimeMode(input.runtimeMode);
 		const settings = claudeQuerySettings(modelConfig.thinking, modelConfig.fastMode);
 		const systemPrompt = buildClaudeSystemPrompt(modelConfig.endpointProfile, serverSettings.coauthorIncludeForge);
+		const runBrokeredGitHubTool = createCodexGitHubDynamicToolHandler(createForgeGitHubToolHandlerOptions({
+			runWithRuntimeContext: runWithSqlRuntimeContext,
+			githubWriteIdentity: serverSettings.githubWriteIdentity,
+			logPrefix: "claude-github",
+			bypassWriteConfirmation: input.runtimeMode === "full-access"
+		}));
 		const queryRuntime = yield* createClaudeQueryRuntime(prompt, buildClaudeQueryOptions({
 			cwd: input.cwd,
 			effectiveApiModelId: modelConfig.effectiveApiModelId,
@@ -210539,7 +210748,8 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 			computerManager,
 			resolveCmmdPat,
 			devServerToolDeps,
-			cmmdSidekickTools
+			cmmdSidekickTools,
+			runBrokeredGitHubTool
 		}), threadId);
 		const session = buildClaudeProviderSession({
 			threadId,
@@ -283540,7 +283750,9 @@ const make$8 = require_Schema$1.gen(function* () {
 			projects: readModel.projects
 		});
 		if (!cwd) return "Forge could not resolve the project folder for this thread.";
-		if (serverConfig.forgeCmmdRuntimeMode === true && !isPathInsideAnyRoot(cwd, [serverConfig.cloudProjectsRoot, serverConfig.worktreesDir])) return "Forge blocked this agent turn because the project folder is outside the managed runtime workspace.";
+		const isCloudExecutionRuntime = serverConfig.forgeCmmdRuntimeMode === true;
+		const managedRoots = [serverConfig.cloudProjectsRoot, serverConfig.worktreesDir];
+		if (isCloudExecutionRuntime && !isPathInsideAnyRoot(cwd, managedRoots)) return `Forge blocked this agent turn because the project folder is outside the managed runtime workspace. Folder: ${cwd}. Managed roots: ${managedRoots.join(", ")}.`;
 		if (thread.anchorKind === "task" && project?.repositoryIdentity == null && !isGitWorkspace(cwd)) return "Forge created this task thread, but the project folder is not a Git repository yet. Import or link the repository before starting an agent turn.";
 		return null;
 	});
@@ -288942,6 +289154,7 @@ function executionEnvironmentCapabilities(serverConfig) {
 		repositoryIdentity: true,
 		pullRequests: isExecutionPlane,
 		threadPullRequestLinking: isExecutionPlane,
+		threadSettlement: isExecutionPlane,
 		cloudMode: serverConfig.forgeCmmdRuntimeMode === true || isCloudShell,
 		runtime: {
 			topology: runtimeTopology(serverConfig),
@@ -289919,6 +290132,95 @@ const makeRuntimeServerSecretStore = require_Schema$1.gen(function* () {
 	return (yield* ServerConfig).forgeCloudShellMode === true ? yield* makePostgresServerSecretStore : yield* makeLocalServerSecretStore;
 });
 const ServerSecretStoreRuntimeLive = require_Schema$1.effect(ServerSecretStore, makeRuntimeServerSecretStore);
+//#endregion
+//#region src/runtimeAuth/controlAuthorityRetry.ts
+/**
+* When to try for control authority again.
+*
+* CMMD ships continuously, so a Forge Cloud runtime will outlive restarts of its
+* own control plane. Obtaining authority is therefore not a startup-time
+* question: a runtime that asks once, gets an infrastructure page mid-deploy and
+* gives up stays unauthenticated until something happens to restart it while
+* CMMD is healthy. Measured: hours, on a Sprite whose guest was serving fine the
+* whole time.
+*
+* Two shapes of failure arrive here and they need opposite answers, which is why
+* `retryable` is decided at the boundary that saw the response rather than
+* guessed at here.
+*/
+/** First backoff. Short on purpose: a deploy cutover is seconds, not minutes. */
+const BASE_DELAY_MS = 1e3;
+/**
+* Ceiling. Unbounded doubling turns a long outage into a long TAIL: an hour down
+* would be followed by up to an hour of avoidable downtime after recovery.
+*/
+const MAX_DELAY_MS = 6e4;
+/**
+* Spread, as a fraction of the delay. A fleet loses authority at the same
+* instant when the control plane restarts, so without this every runtime
+* retries in lockstep and the recovering CMMD takes the whole fleet at once.
+*
+* Kept below 1 so jitter can only ADD: a later attempt must never be scheduled
+* sooner than an earlier one, or backoff stops meaning anything.
+*/
+const JITTER_FRACTION = .25;
+function nextControlAuthorityAttempt(input) {
+	if (!input.retryable) return {
+		retry: false,
+		delayMs: 0
+	};
+	const exponent = Math.max(0, input.consecutiveFailures - 1);
+	const cap = MAX_DELAY_MS / (1 + JITTER_FRACTION);
+	const base = Math.min(BASE_DELAY_MS * 2 ** exponent, cap);
+	const random = input.random ?? Math.random;
+	return {
+		retry: true,
+		delayMs: Math.round(base * (1 + JITTER_FRACTION * random()))
+	};
+}
+/** Bounded retry budget. The next connect starts a fresh one. */
+const DEFAULT_MAX_ATTEMPTS = 8;
+/**
+* Keep asking for control authority while asking again could plausibly work.
+*
+* Bounded rather than infinite: a loop that gives up and says so lets the caller
+* log something actionable, and a connect or a heartbeat will start a fresh
+* budget anyway. An unbounded loop would hide the condition in exactly the way
+* the original `.catch(() => false)` did.
+*/
+async function bootstrapWithRetry(input) {
+	const maxAttempts = input.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+	let lastError;
+	for (let attempts = 1; attempts <= maxAttempts; attempts += 1) {
+		let retryable = true;
+		try {
+			if (await input.attempt()) return {
+				ok: true,
+				attempts
+			};
+		} catch (error) {
+			lastError = error;
+			retryable = typeof error === "object" && error !== null && "retryable" in error && error.retryable === true;
+		}
+		if (!retryable) return {
+			ok: false,
+			attempts,
+			lastError
+		};
+		if (attempts === maxAttempts) break;
+		const next = nextControlAuthorityAttempt({
+			consecutiveFailures: attempts,
+			retryable: true,
+			...input.random ? { random: input.random } : {}
+		});
+		await input.sleep(next.delayMs);
+	}
+	return {
+		ok: false,
+		attempts: maxAttempts,
+		lastError
+	};
+}
 var AuthControlPlaneError = class extends require_Schema$1.TaggedError("AuthControlPlaneError") {};
 var AuthControlPlane = class extends require_Schema$1.Service()("forge/AuthControlPlane") {};
 //#endregion
@@ -291118,19 +291420,24 @@ async function bootstrapControlAuthorityFromConnect(input) {
 	const credentialEpoch = input.verified.credentialEpoch;
 	const hasConnectScope = input.verified.scope.includes("http") || input.verified.scope.includes("ws");
 	if (!controlPlaneUrl || !provisioningGrant || machineId === null || credentialEpoch === null || !hasConnectScope) return;
-	await require_runtimeControlAuthority.bootstrapRuntimeControlAuthority({
-		identity: {
-			controlPlaneUrl,
-			publicKeyPem: input.runtimeAuthConfig.publicKeyPem,
-			orgId: input.verified.orgId,
-			userId: input.verified.userId,
-			projectId: input.verified.projectId,
-			runtimeId: input.verified.runtimeId,
-			machineId,
-			credentialEpoch
-		},
-		connectToken: input.token,
-		provisioningGrant
+	await bootstrapWithRetry({
+		attempt: () => require_runtimeControlAuthority.bootstrapRuntimeControlAuthority({
+			identity: {
+				controlPlaneUrl,
+				publicKeyPem: input.runtimeAuthConfig.publicKeyPem,
+				orgId: input.verified.orgId,
+				userId: input.verified.userId,
+				projectId: input.verified.projectId,
+				runtimeId: input.verified.runtimeId,
+				machineId,
+				credentialEpoch
+			},
+			connectToken: input.token,
+			provisioningGrant
+		}),
+		sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+	}).then((result) => {
+		if (!result.ok && result.lastError !== void 0) throw result.lastError;
 	}).catch((error) => {
 		console.error("[bootstrapControlAuthorityFromConnect] failed to establish runtime control authority; every heartbeat will report null until the next successful connect", {
 			runtimeId: input.verified.runtimeId,
@@ -296504,6 +296811,32 @@ const readPersistedServerRuntimeState = (path) => require_Schema$1.gen(function*
 	return yield* decodePersistedServerRuntimeState(trimmed).pipe(require_Schema$1.option);
 });
 //#endregion
+//#region src/orchestration/turnAdmission.ts
+/**
+* Whether a turn can actually run, as opposed to merely being accepted.
+*
+* A Forge Cloud runtime reaches its provider through CMMD, so without control
+* authority it cannot start a turn at all. It could still ACCEPT one: the
+* command validates, the thread and worktree are created, the user message is
+* recorded, and the turn then sits at `pending` forever with nothing surfaced.
+*
+* Measured on forge-cmmd-r03ad897c5e90 while CMMD was redeploying: HTTP 200 on
+* dispatch, five user messages, zero assistant messages, every turn stuck with
+* `started_at` empty. The client had no way to know.
+*
+* Kept as a pure function because the interesting part is the RULE, not the
+* plumbing: it is only cloud runtimes, only turns, and only when authority is
+* genuinely absent.
+*/
+/** Commands that need a provider, and therefore need control authority. */
+const TURN_COMMANDS = new Set(["thread.turn.start"]);
+function refuseTurnWithoutControlAuthority(input) {
+	if (!input.cmmdRuntimeMode) return null;
+	if (!TURN_COMMANDS.has(input.commandType)) return null;
+	if (input.hasControlAuthority) return null;
+	return "This runtime has no CMMD control authority, so a turn cannot reach a provider and would queue without ever running. The runtime re-establishes authority on its own; retry shortly.";
+}
+//#endregion
 //#region ../../packages/shared/src/forgeCommands.ts
 /**
 * Forge loop commands (`/forge-*`) — the one trigger surface shared by humans
@@ -297072,6 +297405,16 @@ const orchestrationDispatchRouteLayer = add$1("POST", "/api/orchestration/dispat
 		message: "Invalid orchestration command payload.",
 		cause
 	}))));
+	const admissionRefusal = refuseTurnWithoutControlAuthority({
+		commandType: normalizedCommand.type,
+		cmmdRuntimeMode: process.env.FORGE_CMMD_RUNTIME_MODE === "true",
+		hasControlAuthority: require_runtimeControlAuthority.readRuntimeControlAuthority({
+			runtimeId: process.env.FORGE_CMMD_RUNTIME_ID ?? "",
+			machineId: process.env.FORGE_CMMD_RUNTIME_MACHINE_ID ?? "",
+			credentialEpoch: Number(process.env.FORGE_CMMD_RUNTIME_CREDENTIAL_EPOCH ?? "0")
+		}) !== null
+	});
+	if (admissionRefusal !== null) return yield* new OrchestrationDispatchCommandError({ message: admissionRefusal });
 	const dispatchEffect = normalizedCommand.type === "thread.turn.start" && normalizedCommand.bootstrap ? require_Schema$1.gen(function* () {
 		const git = yield* require_Schema$1.serviceOption(GitCore);
 		const gitStatusBroadcaster = yield* require_Schema$1.serviceOption(GitStatusBroadcaster);
@@ -299394,7 +299737,7 @@ const cmmdSetProviderAccountDefaultRouteLayer = registerProxyRoute({
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const resolveConnectedClaudeGenerationHash = (session) => require_Schema$1.gen(function* () {
+const resolveConnectedClaudeGeneration = (session) => require_Schema$1.gen(function* () {
 	const outcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
 		method: "GET",
 		jwt,
@@ -299408,18 +299751,22 @@ const resolveConnectedClaudeGenerationHash = (session) => require_Schema$1.gen(f
 	};
 	return {
 		ok: true,
-		value: (0, node_crypto.createHash)("sha256").update(state.generationId).digest("hex")
+		value: {
+			generationId: state.generationId,
+			generationHash: (0, node_crypto.createHash)("sha256").update(state.generationId).digest("hex")
+		}
 	};
 });
 /**
 * The GET path is read-only. The explicit per-account POST refresh invokes
 * this helper and propagates any CMMD forward failure to the caller.
 */
-const forwardClaudeUsageTelemetry = (session, providerAccountId = currentClaudeUsageGenerationId() ?? "", activelyPoll = false, fetchClaudeUsage = fetchClaudeUsageViaOfficialClient) => require_Schema$1.gen(function* () {
-	const credentialOutcome = yield* resolveConnectedClaudeGenerationHash(session);
+const forwardClaudeUsageTelemetry = (session, requestedProviderAccountId, activelyPoll = false, fetchClaudeUsage = fetchClaudeUsageViaOfficialClient) => require_Schema$1.gen(function* () {
+	const credentialOutcome = yield* resolveConnectedClaudeGeneration(session);
 	if (!credentialOutcome.ok) return credentialOutcome;
-	const generationId = currentClaudeUsageGenerationId();
-	if (credentialOutcome.value === null || generationId === null) return null;
+	if (credentialOutcome.value === null) return null;
+	const { generationId, generationHash } = credentialOutcome.value;
+	const providerAccountId = requestedProviderAccountId ?? generationId;
 	const activeSnapshot = activelyPoll && providerAccountId === generationId ? yield* require_Schema$1.tryPromise({
 		try: () => fetchClaudeUsage({ binaryPath: resolveClaudeBinaryPath("claude") }),
 		catch: (cause) => new ClaudeUsageReadError({ cause })
@@ -299427,7 +299774,7 @@ const forwardClaudeUsageTelemetry = (session, providerAccountId = currentClaudeU
 	const snapshot = activeSnapshot ? {
 		...activeSnapshot,
 		observedAt: (/* @__PURE__ */ new Date()).toISOString()
-	} : getLatestClaudeRateLimitTelemetry(credentialOutcome.value, providerAccountId);
+	} : getLatestClaudeRateLimitTelemetry(generationHash, providerAccountId);
 	if (!snapshot) return null;
 	return yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
 		method: "POST",
@@ -310761,16 +311108,16 @@ const gitUrlCloneRouteLayer = add$1("POST", "/api/cloud/git/clone-url", require_
 //#endregion
 //#region src/server.ts
 const PtyAdapterLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
-	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunPTY-2icf7sRj.cjs")))).layer;
-	else return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodePTY-cb7HIasY.cjs")))).layer;
+	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunPTY-BjHFZATJ.cjs")))).layer;
+	else return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodePTY-Bd9mvI6U.cjs")))).layer;
 }));
 const HttpServerLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
-	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunHttpServer-DOAuw4Iq.cjs")))).layer({
+	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunHttpServer-Dxx0kzQc.cjs")))).layer({
 		port: config.port,
 		...config.host ? { hostname: config.host } : {}
 	});
-	const [NodeHttpServer, NodeHttp] = yield* require_Schema$1.all([require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeHttpServer-D_ismXpd.cjs"))), require_Schema$1.promise(() => import("node:http"))]);
+	const [NodeHttpServer, NodeHttp] = yield* require_Schema$1.all([require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeHttpServer-D6YVHsL8.cjs"))), require_Schema$1.promise(() => import("node:http"))]);
 	return NodeHttpServer.layer(NodeHttp.createServer, {
 		host: config.host,
 		port: config.port
@@ -310778,10 +311125,10 @@ const HttpServerLive = require_Schema$1.unwrap(require_Schema$1.gen(function* ()
 }));
 const PlatformServicesLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	if (typeof Bun !== "undefined") {
-		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunServices-CiNXNzHD.cjs")));
+		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunServices-U1VBnEJS.cjs")));
 		return layer;
 	} else {
-		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeServices-BAl07hlH.cjs")));
+		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeServices-BcQL_53W.cjs")));
 		return layer;
 	}
 }));
@@ -310849,7 +311196,7 @@ const MiscRuntimeLayerLive = require_Schema$1.mergeAll(AnalyticsServiceLayerLive
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(require_Schema$1.provideMerge(CheckpointingLayerLive), require_Schema$1.provideMerge(GitLayerLive), require_Schema$1.provideMerge(OrchestrationLayerLive), require_Schema$1.provideMerge(ProviderLayerLive), require_Schema$1.provideMerge(TerminalLayerLive), require_Schema$1.provideMerge(AgentBrowserManagerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(require_Schema$1.provide$1(ThreadDevRuntimeLive)))), require_Schema$1.provideMerge(PersistenceLayerLive), require_Schema$1.provideMerge(KeybindingsLive), require_Schema$1.provideMerge(ProviderRegistryLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ServerSettingsLive, UsageServiceLive.pipe(require_Schema$1.provide$1(ServerSettingsLive)))), require_Schema$1.provideMerge(WorkspaceLayerLive), require_Schema$1.provideMerge(WorkspaceReadinessStateLive), require_Schema$1.provideMerge(ProjectFaviconResolverLive), require_Schema$1.provideMerge(RepositoryIdentityResolverLive), require_Schema$1.provideMerge(ServerEnvironmentLive), require_Schema$1.provideMerge(AuthLayerLive), require_Schema$1.provideMerge(ServerSecretStoreLayerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(require_Schema$1.provide$1(PersistenceLayerLive)))), require_Schema$1.provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(require_Schema$1.provideMerge(RuntimeDependenciesWithoutPullRequestsLive), require_Schema$1.provideMerge(cmmdProjectIdentityResolverLive.pipe(require_Schema$1.provide$1(RuntimeDependenciesWithoutPullRequestsLive))), require_Schema$1.provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(require_Schema$1.provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = require_Schema$1.mergeAll(authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, cmmdCreateBrainDocRouteLayer, cmmdUpdateTaskRouteLayer, cmmdUpsertTaskPullRequestRouteLayer, ...cmmdPullRequestRouteLayers, cmmdAddTaskCommentRouteLayer, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdSearchTasksRouteLayer, cmmdGetTaskCommentsRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdGetOrgMembersRouteLayer, cmmdSimHostsRouteLayer, cmmdSimLeaseReadRouteLayer, cmmdSimLeaseClaimRouteLayer, cmmdSimLeaseReleaseRouteLayer, cmmdSimLeaseRenewRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdGetTaskAttachmentsRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdDeleteTaskCommentRouteLayer, cmmdGetProjectRepositoryRouteLayer, cmmdListProjectRepositoriesRouteLayer, cmmdArchiveTaskRouteLayer, cmmdUnarchiveTaskRouteLayer, cmmdListTasksRouteLayer, cmmdCreateTaskRouteLayer, cmmdListCampaignsRouteLayer, cmmdGetCampaignRouteLayer, cmmdCreateCampaignRouteLayer, cmmdUpdateCampaignRouteLayer, cmmdDeleteCampaignRouteLayer, cmmdListSavedViewsRouteLayer, cmmdCreateSavedViewRouteLayer, cmmdImportSavedViewRouteLayer, cmmdUpdateSavedViewRouteLayer, cmmdDeleteSavedViewRouteLayer, cmmdListProjectsRouteLayer, cmmdGetProjectRouteLayer, cmmdCreateProjectRouteLayer, cmmdDeleteProjectRouteLayer, cmmdMoveProjectRouteLayer, cmmdGetProjectMembersRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdGetProjectMilestonesRouteLayer, cmmdCreateProjectMilestoneRouteLayer, cmmdUpdateProjectMilestoneRouteLayer, cmmdDeleteProjectMilestoneRouteLayer, cmmdGetProjectUpdatesRouteLayer, cmmdCreateProjectUpdateRouteLayer, cmmdUpdateProjectUpdateRouteLayer, cmmdDeleteProjectUpdateRouteLayer, cmmdImproveProjectContentRouteLayer, cmmdCreateProjectTaskDraftRouteLayer, cmmdGetProjectTaskDraftRouteLayer, cmmdUpdateProjectTaskDraftRouteLayer, cmmdPreviewProjectTaskDraftRouteLayer, cmmdCommitProjectTaskDraftRouteLayer, cmmdDiscardProjectTaskDraftRouteLayer, cmmdGetProjectLeadPlanRouteLayer, cmmdActivateProjectLeadAuthorityRouteLayer, cmmdGetProjectLeadReadinessRouteLayer, cmmdGetProjectLeadCapabilitiesRouteLayer, cmmdGetProjectLeadSummaryRouteLayer, cmmdGetProjectLeadDetailRouteLayer, cmmdGetProjectLeadBriefingRouteLayer, cmmdListProjectLeadEventsRouteLayer, cmmdExplainProjectLeadRouteLayer, cmmdPauseProjectLeadRouteLayer, cmmdResumeProjectLeadRouteLayer, cmmdReserveProjectLeadTaskRouteLayer, cmmdReleaseProjectLeadReservationRouteLayer, cmmdReconcileProjectLeadRouteLayer, cmmdResolveProjectLeadAttentionRouteLayer, cmmdClaimProjectLeadControllerRouteLayer, cmmdRenewProjectLeadControllerClaimRouteLayer, cmmdYieldProjectLeadControllerClaimRouteLayer, cmmdAcknowledgeProjectLeadControllerEventRouteLayer, cmmdRecordProjectLeadControllerDecisionRouteLayer, cmmdListForgeAutomationPresetsRouteLayer, cmmdListUserForgeAutomationRulesRouteLayer, cmmdCreateUserForgeAutomationRuleRouteLayer, cmmdUpdateUserForgeAutomationRuleRouteLayer, cmmdListUserForgeAutomationRunsRouteLayer, cmmdStartUserForgeAutomationRunRouteLayer, cmmdListForgeAutomationRulesRouteLayer, cmmdCreateForgeAutomationRuleRouteLayer, cmmdUpdateForgeAutomationRuleRouteLayer, cmmdListForgeAutomationRunsRouteLayer, cmmdStartForgeAutomationRunRouteLayer, cmmdGetForgeAutomationRunRouteLayer, cmmdRetryForgeAutomationRunRouteLayer, cmmdCancelForgeAutomationRunRouteLayer, cmmdApproveForgeAutomationEscalationRouteLayer, cmmdRejectForgeAutomationEscalationRouteLayer, cmmdListProjectAgentMembersRouteLayer, cmmdCreateProjectAgentMemberRouteLayer, cmmdGetProjectAgentMemberRouteLayer, cmmdRenameProjectAgentMemberRouteLayer, cmmdRetireProjectAgentMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, cmmdListProjectAgentMemberInstancesRouteLayer, cmmdPreviewProjectAgentMemberConsolidationRouteLayer, cmmdApplyProjectAgentMemberConsolidationRouteLayer, cmmdPutProjectTaskAssignmentRouteLayer, cmmdListProjectBoardRouteLayer, cmmdGetProjectTaskWorkflowRouteLayer, cmmdUpdateProjectTaskWorkflowRouteLayer, cmmdCreateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskStatusRouteLayer, cmmdListTaskExecutionOptionsRouteLayer, cmmdCreateTaskWorkSessionRouteLayer, cmmdListProjectWorkSessionsRouteLayer, cmmdGetWorkSessionRouteLayer, cmmdUpdateWorkSessionRouteLayer, cmmdAttachWorkSessionThreadRouteLayer, cmmdListTaskConversationsRouteLayer, cmmdLinkTaskConversationRouteLayer, cmmdGetTaskHistoryRouteLayer, cmmdGetTaskConversationRouteLayer, cmmdSpawnForgeThreadFromBoardTaskRouteLayer, cmmdListCenterBoardRouteLayer, cmmdCreateCenterBoardTaskRouteLayer, cmmdCreateFeedbackRouteLayer, cmmdUpdateCenterBoardTaskRouteLayer, cmmdMoveCenterBoardTaskRouteLayer, cmmdMoveProjectBoardTaskRouteLayer, cmmdArchiveProjectBoardTaskRouteLayer, cmmdUnarchiveProjectBoardTaskRouteLayer, cmmdArchiveCenterBoardTaskRouteLayer, cmmdUnarchiveCenterBoardTaskRouteLayer, cmmdBootstrapRouteLayer, cmmdGetAccountPreferencesRouteLayer, cmmdUpdateAccountPreferencesRouteLayer, cmmdGetOrgProviderPolicyRouteLayer, cmmdListChatsRouteLayer, cmmdGetChatRouteLayer, cmmdListDevicesRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRegisterDeviceRouteLayer, cmmdHeartbeatRuntimeRouteLayer, cmmdGrantRuntimeAccessRouteLayer, cmmdRevokeRuntimeAccessRouteLayer, cmmdCreateRelayControlRouteLayer, cmmdCreateRelayActionGrantRouteLayer, cmmdReplaceRuntimeInventoryRouteLayer, cmmdListRuntimeInventoryRouteLayer, cmmdGetRuntimeDiagnosticsRouteLayer, cmmdProvisionAuthRuntimeRouteLayer, cmmdGetAuthRuntimeRouteLayer, cmmdDestroyAuthRuntimeRouteLayer, cmmdConnectAuthRuntimeRouteLayer, cmmdGetProviderAccountsRouteLayer, cmmdDeleteProviderAccountRouteLayer, cmmdSetProviderAccountDefaultRouteLayer, cmmdGetProviderUsageRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdGetUserCodexCredentialRouteLayer, cmmdDeleteUserCodexCredentialRouteLayer, cmmdGetUserClaudeCredentialRouteLayer, cmmdDeleteUserClaudeCredentialRouteLayer, cmmdGetClaudeRuntimeReadinessRouteLayer, cmmdAppendRuntimeThreadEventsRouteLayer, cmmdGetRuntimeThreadReplicaRouteLayer, cmmdRenameDeviceRouteLayer, cmmdRevokeDeviceRouteLayer, cmmdInstallConnectorRouteLayer, cmmdListConnectorsRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeCloudProjectRegisterRouteLayer, cmmdForgeCloudProjectUnregisterRouteLayer, cmmdForgeCloudProjectLifecyclePreflightRouteLayer, cmmdForgeCloudProjectRemovalRouteLayer, cmmdForgeCloudProjectRemovalReceiptRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, cmmdGetTaskRouteLayer, commandUpdateTaskRouteLayer, mobileProviderCatalogRouteLayer, cmmdUsageSummaryRouteLayer, cmmdBillingRouteLayer, cmmdBillingSeriesRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, claudeNativeGenerationProofRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
+const makeRoutesLayer = require_Schema$1.mergeAll(authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, cmmdCreateBrainDocRouteLayer, cmmdUpdateTaskRouteLayer, cmmdUpsertTaskPullRequestRouteLayer, ...cmmdPullRequestRouteLayers, cmmdAddTaskCommentRouteLayer, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdSearchTasksRouteLayer, cmmdGetTaskCommentsRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdGetOrgMembersRouteLayer, cmmdSimHostsRouteLayer, cmmdSimLeaseReadRouteLayer, cmmdSimLeaseClaimRouteLayer, cmmdSimLeaseReleaseRouteLayer, cmmdSimLeaseRenewRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdGetTaskAttachmentsRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdDeleteTaskCommentRouteLayer, cmmdGetProjectRepositoryRouteLayer, cmmdListProjectRepositoriesRouteLayer, cmmdArchiveTaskRouteLayer, cmmdUnarchiveTaskRouteLayer, cmmdListTasksRouteLayer, cmmdCreateTaskRouteLayer, cmmdListCampaignsRouteLayer, cmmdGetCampaignRouteLayer, cmmdCreateCampaignRouteLayer, cmmdUpdateCampaignRouteLayer, cmmdDeleteCampaignRouteLayer, cmmdListSavedViewsRouteLayer, cmmdCreateSavedViewRouteLayer, cmmdImportSavedViewRouteLayer, cmmdUpdateSavedViewRouteLayer, cmmdDeleteSavedViewRouteLayer, cmmdListProjectsRouteLayer, cmmdGetProjectRouteLayer, cmmdCreateProjectRouteLayer, cmmdDeleteProjectRouteLayer, cmmdMoveProjectRouteLayer, cmmdGetProjectMembersRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdGetProjectMilestonesRouteLayer, cmmdCreateProjectMilestoneRouteLayer, cmmdUpdateProjectMilestoneRouteLayer, cmmdDeleteProjectMilestoneRouteLayer, cmmdGetProjectUpdatesRouteLayer, cmmdCreateProjectUpdateRouteLayer, cmmdUpdateProjectUpdateRouteLayer, cmmdDeleteProjectUpdateRouteLayer, cmmdImproveProjectContentRouteLayer, cmmdCreateProjectTaskDraftRouteLayer, cmmdGetProjectTaskDraftRouteLayer, cmmdUpdateProjectTaskDraftRouteLayer, cmmdPreviewProjectTaskDraftRouteLayer, cmmdCommitProjectTaskDraftRouteLayer, cmmdDiscardProjectTaskDraftRouteLayer, cmmdGetProjectLeadPlanRouteLayer, cmmdActivateProjectLeadAuthorityRouteLayer, cmmdGetProjectLeadReadinessRouteLayer, cmmdGetProjectLeadCapabilitiesRouteLayer, cmmdGetProjectLeadSummaryRouteLayer, cmmdGetProjectLeadDetailRouteLayer, cmmdGetProjectLeadBriefingRouteLayer, cmmdListProjectLeadEventsRouteLayer, cmmdExplainProjectLeadRouteLayer, cmmdPauseProjectLeadRouteLayer, cmmdResumeProjectLeadRouteLayer, cmmdReserveProjectLeadTaskRouteLayer, cmmdReleaseProjectLeadReservationRouteLayer, cmmdReconcileProjectLeadRouteLayer, cmmdResolveProjectLeadAttentionRouteLayer, cmmdClaimProjectLeadControllerRouteLayer, cmmdRenewProjectLeadControllerClaimRouteLayer, cmmdYieldProjectLeadControllerClaimRouteLayer, cmmdAcknowledgeProjectLeadControllerEventRouteLayer, cmmdRecordProjectLeadControllerDecisionRouteLayer, cmmdListForgeAutomationPresetsRouteLayer, cmmdListUserForgeAutomationRulesRouteLayer, cmmdCreateUserForgeAutomationRuleRouteLayer, cmmdUpdateUserForgeAutomationRuleRouteLayer, cmmdListUserForgeAutomationRunsRouteLayer, cmmdStartUserForgeAutomationRunRouteLayer, cmmdListForgeAutomationRulesRouteLayer, cmmdCreateForgeAutomationRuleRouteLayer, cmmdUpdateForgeAutomationRuleRouteLayer, cmmdListForgeAutomationRunsRouteLayer, cmmdStartForgeAutomationRunRouteLayer, cmmdGetForgeAutomationRunRouteLayer, cmmdRetryForgeAutomationRunRouteLayer, cmmdCancelForgeAutomationRunRouteLayer, cmmdApproveForgeAutomationEscalationRouteLayer, cmmdRejectForgeAutomationEscalationRouteLayer, cmmdListProjectAgentMembersRouteLayer, cmmdCreateProjectAgentMemberRouteLayer, cmmdGetProjectAgentMemberRouteLayer, cmmdRenameProjectAgentMemberRouteLayer, cmmdRetireProjectAgentMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, cmmdListProjectAgentMemberInstancesRouteLayer, cmmdPreviewProjectAgentMemberConsolidationRouteLayer, cmmdApplyProjectAgentMemberConsolidationRouteLayer, cmmdPutProjectTaskAssignmentRouteLayer, cmmdListProjectBoardRouteLayer, cmmdGetProjectTaskWorkflowRouteLayer, cmmdUpdateProjectTaskWorkflowRouteLayer, cmmdCreateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskStatusRouteLayer, cmmdListTaskExecutionOptionsRouteLayer, cmmdCreateTaskWorkSessionRouteLayer, cmmdListProjectWorkSessionsRouteLayer, cmmdGetWorkSessionRouteLayer, cmmdUpdateWorkSessionRouteLayer, cmmdAttachWorkSessionThreadRouteLayer, cmmdListTaskConversationsRouteLayer, cmmdLinkTaskConversationRouteLayer, cmmdGetTaskHistoryRouteLayer, cmmdGetTaskConversationRouteLayer, cmmdSpawnForgeThreadFromBoardTaskRouteLayer, cmmdListCenterBoardRouteLayer, cmmdCreateCenterBoardTaskRouteLayer, cmmdCreateFeedbackRouteLayer, cmmdUpdateCenterBoardTaskRouteLayer, cmmdMoveCenterBoardTaskRouteLayer, cmmdMoveProjectBoardTaskRouteLayer, cmmdArchiveProjectBoardTaskRouteLayer, cmmdUnarchiveProjectBoardTaskRouteLayer, cmmdArchiveCenterBoardTaskRouteLayer, cmmdUnarchiveCenterBoardTaskRouteLayer, cmmdBootstrapRouteLayer, cmmdGetAccountPreferencesRouteLayer, cmmdUpdateAccountPreferencesRouteLayer, cmmdGetOrgProviderPolicyRouteLayer, cmmdListChatsRouteLayer, cmmdGetChatRouteLayer, cmmdListDevicesRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRegisterDeviceRouteLayer, cmmdHeartbeatRuntimeRouteLayer, cmmdGrantRuntimeAccessRouteLayer, cmmdRevokeRuntimeAccessRouteLayer, cmmdCreateRelayControlRouteLayer, cmmdCreateRelayActionGrantRouteLayer, cmmdReplaceRuntimeInventoryRouteLayer, cmmdListRuntimeInventoryRouteLayer, cmmdGetRuntimeDiagnosticsRouteLayer, cmmdProvisionAuthRuntimeRouteLayer, cmmdGetAuthRuntimeRouteLayer, cmmdDestroyAuthRuntimeRouteLayer, cmmdConnectAuthRuntimeRouteLayer, cmmdGetProviderAccountsRouteLayer, cmmdDeleteProviderAccountRouteLayer, cmmdSetProviderAccountDefaultRouteLayer, cmmdGetProviderUsageRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdGetUserCodexCredentialRouteLayer, cmmdDeleteUserCodexCredentialRouteLayer, cmmdGetUserClaudeCredentialRouteLayer, cmmdDeleteUserClaudeCredentialRouteLayer, cmmdGetClaudeRuntimeReadinessRouteLayer, cmmdAppendRuntimeThreadEventsRouteLayer, cmmdGetRuntimeThreadReplicaRouteLayer, cmmdRenameDeviceRouteLayer, cmmdRevokeDeviceRouteLayer, cmmdInstallConnectorRouteLayer, cmmdListConnectorsRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeCloudProjectRegisterRouteLayer, cmmdForgeCloudProjectUnregisterRouteLayer, cmmdForgeCloudProjectLifecyclePreflightRouteLayer, cmmdForgeCloudProjectRemovalRouteLayer, cmmdForgeCloudProjectRemovalReceiptRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, cmmdGetTaskRouteLayer, commandUpdateTaskRouteLayer, mobileProviderCatalogRouteLayer, cmmdUsageSummaryRouteLayer, cmmdBillingRouteLayer, cmmdBillingSeriesRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, claudeNativeGenerationProofRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
 const makeServerLayer = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath();