@cmmd-center/forge 0.9.5 → 0.9.6

package/dist/{SqliteClient-CdAhI4lb.cjs → SqliteClient-BpjZWL6O.cjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 require("./chunk-BhaIgcZK.cjs");
-const require_Schema = require("./Schema-Bij_WAra.cjs");
-const require_Path = require("./Path-CsbBuCFB.cjs");
-const require_Config = require("./Config-DMA9WqtC.cjs");
-const require_SqlError = require("./SqlError-C2mi8_tp.cjs");
+const require_Schema = require("./Schema-DaFukK_y.cjs");
+const require_Path = require("./Path-qpublmG3.cjs");
+const require_Config = require("./Config-BHRBB8XM.cjs");
+const require_SqlError = require("./SqlError-CsWFS-OU.cjs");
 let bun_sqlite = require("bun:sqlite");
 //#region ../../node_modules/.bun/@effect+sql-sqlite-bun@4.0.0-beta.45+4dcb167d4624bd06/node_modules/@effect/sql-sqlite-bun/dist/SqliteClient.js
 /**
@@ -124,4 +124,4 @@ exports.layer = layer;
 exports.layerConfig = layerConfig;
 exports.make = make;
 
-//# sourceMappingURL=SqliteClient-CdAhI4lb.cjs.map
+//# sourceMappingURL=SqliteClient-BpjZWL6O.cjs.map

package/dist/{SqliteClient-aoOb51gB.mjs → SqliteClient-CA7vjiUj.mjs}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
-import { Ac as Service, Ci as uninterruptibleMask, Da as addFinalizer$1, Ea as Scope, Ic as getUnsafe, Kn as fail, Lc as make$1, Nc as get, Qn as flatMap, Sr as map, Tn as as, Xl as identity, ai as succeed, ba as provide, jc as add, ki as withFiber, li as sync, lr as gen, pa as effectContext, ui as tap, vi as try_, yn as addFinalizer } from "./Schema-CTXk8IgN.mjs";
-import { Wt as getCurrent, bt as make$2, m as die } from "./Path-Bwl3ltR5.mjs";
-import { h as unwrap } from "./Config-DrOyN3WS.mjs";
-import { S as layer$1, c as SqlError, f as classifySqliteError, h as make$3, m as SqlClient, p as SafeIntegers, v as defaultTransforms, x as makeCompilerSqlite } from "./SqlError-1c-3v7GY.mjs";
+import { Dn as as, Fc as get, Jn as fail, Mc as Service, Nc as add, Oa as Scope, Ql as identity, Rc as getUnsafe, Sa as provide, Ti as uninterruptibleMask, bi as try_, di as sync, dr as gen, er as flatMap, fi as tap, ha as effectContext, ji as withFiber, ka as addFinalizer$1, si as succeed, wr as map, xn as addFinalizer, zc as make$1 } from "./Schema-CKuz8TX8.mjs";
+import { Wt as getCurrent, bt as make$2, m as die } from "./Path-DJTwK58E.mjs";
+import { h as unwrap } from "./Config-To1VEqlB.mjs";
+import { S as layer$1, c as SqlError, f as classifySqliteError, h as make$3, m as SqlClient, p as SafeIntegers, v as defaultTransforms, x as makeCompilerSqlite } from "./SqlError-DhK0hV8S.mjs";
 import { Database } from "bun:sqlite";
 //#region ../../node_modules/.bun/@effect+sql-sqlite-bun@4.0.0-beta.45+4dcb167d4624bd06/node_modules/@effect/sql-sqlite-bun/dist/SqliteClient.js
 /**
@@ -118,4 +118,4 @@ const layer = (config) => effectContext(map(make(config), (client) => make$1(Sql
 //#endregion
 export { SqliteClient, TypeId, layer, layerConfig, make };
 
-//# sourceMappingURL=SqliteClient-aoOb51gB.mjs.map
+//# sourceMappingURL=SqliteClient-CA7vjiUj.mjs.map

package/dist/bin.cjs

@@ -2,18 +2,18 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-BhaIgcZK.cjs");
-const require_Schema$1 = require("./Schema-Bij_WAra.cjs");
-const require_Path = require("./Path-CsbBuCFB.cjs");
-const require_NodeTerminal = require("./NodeTerminal-B9u7fFYa.cjs");
-const require_NodeServices = require("./NodeServices-BISZRY3e.cjs");
-const require_HttpServer = require("./HttpServer-aJkhz6yu.cjs");
-const require_Config = require("./Config-DMA9WqtC.cjs");
-const require_Cache = require("./Cache-XSj5g7uG.cjs");
-const require_SqlError = require("./SqlError-C2mi8_tp.cjs");
+const require_Schema$1 = require("./Schema-DaFukK_y.cjs");
+const require_Path = require("./Path-qpublmG3.cjs");
+const require_NodeTerminal = require("./NodeTerminal-D86oor5_.cjs");
+const require_NodeServices = require("./NodeServices-BjmXNhpe.cjs");
+const require_HttpServer = require("./HttpServer-BTcgkY38.cjs");
+const require_Config = require("./Config-BHRBB8XM.cjs");
+const require_Cache = require("./Cache-BRhFH80U.cjs");
+const require_SqlError = require("./SqlError-CsWFS-OU.cjs");
 const require_esm = require("./esm-Do7HVhLA.cjs");
 const require_Mime = require("./Mime-CyHbecis.cjs");
 const require_runtimeControlAuthority = require("./runtimeControlAuthority-SNBF5Mjy.cjs");
-const require_PTY = require("./PTY-U3JQnLXS.cjs");
+const require_PTY = require("./PTY-BB84iC10.cjs");
 let node_child_process = require("node:child_process");
 node_child_process = require_chunk.__toESM(node_child_process);
 let node_stream = require("node:stream");
@@ -17640,6 +17640,7 @@ const ExecutionEnvironmentCapabilities = require_Schema$1.Struct({
 	pullRequests: require_Schema$1.optionalKey(require_Schema$1.Boolean),
 	threadPullRequestLinking: require_Schema$1.optionalKey(require_Schema$1.Boolean),
 	cloudMode: require_Schema$1.Boolean.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(false))),
+	threadSettlement: require_Schema$1.optionalKey(require_Schema$1.Boolean),
 	posthogPublicKey: require_Schema$1.NullOr(require_Schema$1.String).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	posthogHost: require_Schema$1.NullOr(require_Schema$1.String).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	runtime: require_Schema$1.optionalKey(ExecutionEnvironmentRuntimeCapabilities),
@@ -68205,6 +68206,30 @@ const respondToAuthError = (error) => require_Schema$1.gen(function* () {
 	}));
 	return response;
 });
+const OAUTH_ACCESS_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:access_token";
+/**
+* The one exchange this endpoint performs, or the reason it will not.
+*
+* Returns a message rather than a boolean so the route can say which field was
+* wrong: an operator debugging a pairing failure otherwise cannot tell an
+* unsupported grant from an unsupported token type.
+*/
+function rejectUnsupportedTokenExchange(input) {
+	if (input.grant_type !== "urn:ietf:params:oauth:grant-type:token-exchange") return "Unsupported grant_type.";
+	if (input.subject_token_type !== "urn:t3:params:oauth:token-type:environment-bootstrap") return "Unsupported subject_token_type.";
+	if (input.requested_token_type !== "urn:ietf:params:oauth:token-type:access_token") return "Unsupported requested_token_type.";
+	return null;
+}
+/**
+* `expires_in` is a duration in seconds; a session carries an absolute instant.
+*
+* Clamped at zero so a session that expired between issuance and this call is
+* reported as already expired rather than as a negative lifetime, which a client
+* could read as a very large unsigned value.
+*/
+function accessTokenExpiresInSeconds(remainingMillis) {
+	return Math.max(0, Math.floor(remainingMillis / 1e3));
+}
 //#endregion
 //#region ../../packages/shared/src/cmmdIdentity.ts
 const MAX_CMMD_AVATAR_URL_LENGTH = 256 * 1024;
@@ -69404,6 +69429,16 @@ const CommandOAuthDeviceInput = require_Schema$1.Struct({
 	return_url: require_Schema$1.optionalKey(require_Schema$1.String),
 	scope: require_Schema$1.optionalKey(require_Schema$1.String)
 });
+const OAuthTokenExchangeInput = require_Schema$1.Struct({
+	grant_type: require_Schema$1.String,
+	subject_token: require_Schema$1.String,
+	subject_token_type: require_Schema$1.String,
+	requested_token_type: require_Schema$1.String,
+	scope: require_Schema$1.optional(require_Schema$1.String),
+	client_label: require_Schema$1.optional(require_Schema$1.String),
+	client_device_type: require_Schema$1.optional(require_Schema$1.String),
+	client_os: require_Schema$1.optional(require_Schema$1.String)
+});
 const CommandOAuthTokenInput = require_Schema$1.Struct({
 	grant_type: require_Schema$1.String,
 	device_code: require_Schema$1.String,
@@ -70246,6 +70281,51 @@ const authBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/bearer"
 	const result = yield* serverAuth.exchangeBootstrapCredentialForBearerSession(payload.credential, deriveAuthClientMetadata({ request }));
 	return require_HttpServer.jsonUnsafe(result, { status: 200 });
 }).pipe(require_Schema$1.catchTag("AuthError", (error) => respondToAuthError(error))));
+/**
+* FORGE COMPAT. `POST /oauth/token` — the RFC 8693 token exchange the vendored
+* t3code client uses to turn a pairing credential into a bearer token.
+*
+* Forge's own clients call `/api/auth/bootstrap/bearer` with JSON. The mobile app
+* cannot: the endpoint is baked into the vendored contract
+* (packages/t3-contracts/src/environmentHttp.ts) as a form-urlencoded OAuth
+* exchange, and without it every attempt to add an environment fails with a 404 —
+* which leaves the whole app unusable, since no screen works before an
+* environment exists.
+*
+* This is a shape adapter, not a second way to authenticate. It performs no
+* validation of its own and mints nothing: it forwards the subject token to the
+* same `exchangeBootstrapCredentialForBearerSession` the JSON route uses, so the
+* credential rules, expiry and session issuance stay in one place. The only work
+* here is vocabulary — form encoding in, OAuth field names out.
+*
+* Same pattern as the vcs.* handlers in ws.ts: the Forge server speaks upstream's
+* dialect over Forge's own services, rather than the vendored client being patched
+* to speak Forge's.
+*/
+const authOAuthTokenExchangeRouteLayer = add$1("POST", "/oauth/token", require_Schema$1.gen(function* () {
+	const request = yield* require_HttpServer.HttpServerRequest;
+	const serverAuth = yield* ServerAuth;
+	const payload = yield* require_HttpServer.schemaBodyUrlParams(OAuthTokenExchangeInput).pipe(require_Schema$1.mapError((cause) => new AuthError({
+		message: "Invalid token exchange payload.",
+		status: 400,
+		cause
+	})));
+	const refusal = rejectUnsupportedTokenExchange(payload);
+	if (refusal !== null) return yield* new AuthError({
+		message: refusal,
+		status: 400
+	});
+	const session = yield* serverAuth.exchangeBootstrapCredentialForBearerSession(payload.subject_token, deriveAuthClientMetadata({ request }));
+	const now$6 = yield* require_Schema$1.now;
+	const expiresInSeconds = accessTokenExpiresInSeconds(require_Schema$1.toMillis(require_Schema$1.distance(now$6, session.expiresAt)));
+	return require_HttpServer.jsonUnsafe({
+		access_token: session.sessionToken,
+		issued_token_type: OAUTH_ACCESS_TOKEN_TYPE,
+		token_type: "Bearer",
+		expires_in: expiresInSeconds,
+		scope: payload.scope ?? session.role
+	}, { status: 200 });
+}).pipe(require_Schema$1.catchTag("AuthError", (error) => respondToAuthError(error))));
 const authWebSocketTokenRouteLayer = add$1("POST", "/api/auth/ws-token", require_Schema$1.gen(function* () {
 	const request = yield* require_HttpServer.HttpServerRequest;
 	const serverAuth = yield* ServerAuth;
@@ -113693,8 +113773,8 @@ require_Schema$1.effectDiscard(runMigrations());
 //#endregion
 //#region src/persistence/Layers/Sqlite.ts
 const defaultSqliteClientLoaders = {
-	bun: () => Promise.resolve().then(() => require("./SqliteClient-CdAhI4lb.cjs")),
-	node: () => Promise.resolve().then(() => require("./NodeSqliteClient-SsUCk9mA.cjs"))
+	bun: () => Promise.resolve().then(() => require("./SqliteClient-BpjZWL6O.cjs")),
+	node: () => Promise.resolve().then(() => require("./NodeSqliteClient-CG_mPdVp.cjs"))
 };
 const makeRuntimeSqliteLayer = require_Schema$1.fn("makeRuntimeSqliteLayer")(function* (config) {
 	const loader = defaultSqliteClientLoaders[process.versions.bun !== void 0 ? "bun" : "node"];
@@ -147042,22 +147122,58 @@ function runtimeAuthoritySessionId(input) {
 	if (input.authSessionId) return input.authSessionId;
 	return input.threadId ? readThreadSessionId(input.threadId) : null;
 }
+/**
+* Pure mapping from the three preconditions to an outcome.
+*
+* Split out so the reason can be tested without an Effect runtime, env vars or
+* module mocking — the decision is the thing worth pinning, not the plumbing
+* around it.
+*/
+function resolveBrokerTicketOutcome(input) {
+	if (input.identityMode === "legacy") return {
+		kind: "ticket",
+		token: input.legacyGrantToken
+	};
+	if (input.identityMode === "invalid") return {
+		kind: "unavailable",
+		reason: "runtime identity is incomplete or invalid"
+	};
+	if (!input.sessionId) return {
+		kind: "unavailable",
+		reason: "no owner session is bound to this request"
+	};
+	return input.brokerAuthority ? {
+		kind: "ticket",
+		token: input.brokerAuthority
+	} : {
+		kind: "unavailable",
+		reason: "no live broker authority for this session"
+	};
+}
 function runtimeProviderBrokerToken(input) {
 	const identity = classifyRuntimeBrokerIdentity({
 		machineId: configuredRuntimeMachineId() ?? void 0,
 		credentialEpoch: configuredRuntimeCredentialEpoch(),
 		brokerAuthorityMode: process.env.FORGE_CMMD_RUNTIME_BROKER_AUTHORITY_MODE
 	});
-	if (identity.mode === "legacy") return require_runtimeControlAuthority.runtimeGrantToken();
-	if (identity.mode === "invalid") return null;
+	if (identity.mode !== "exact") return resolveBrokerTicketOutcome({
+		identityMode: identity.mode,
+		legacyGrantToken: identity.mode === "legacy" ? require_runtimeControlAuthority.runtimeGrantToken() : null,
+		sessionId: null,
+		brokerAuthority: null
+	});
 	const sessionId = runtimeAuthoritySessionId(input);
-	if (!sessionId) return null;
-	return readRuntimeBrokerAuthority({
+	return resolveBrokerTicketOutcome({
+		identityMode: "exact",
+		legacyGrantToken: null,
 		sessionId,
-		runtimeId: process.env.FORGE_CMMD_RUNTIME_ID,
-		machineId: identity.machineId,
-		credentialEpoch: identity.credentialEpoch,
-		requiredScope: "provider"
+		brokerAuthority: sessionId ? readRuntimeBrokerAuthority({
+			sessionId,
+			runtimeId: process.env.FORGE_CMMD_RUNTIME_ID,
+			machineId: identity.machineId,
+			credentialEpoch: identity.credentialEpoch,
+			requiredScope: "provider"
+		}) : null
 	});
 }
 async function fetchRuntimeProviderGrant(input) {
@@ -147102,8 +147218,9 @@ const issueProviderEgressCredential = (input) => require_Schema$1.tryPromise({
 async function issueCmmdRuntimeProviderEgressCredential(input) {
 	const controlPlaneUrl = process.env.FORGE_COMMAND_APP_URL.replace(/\/+$/, "");
 	const runtimeId = encodeURIComponent(process.env.FORGE_CMMD_RUNTIME_ID);
-	const runtimeGrantToken = runtimeProviderBrokerToken(input);
-	if (!runtimeGrantToken) throw new Error("Provider token issuance requires a live exact-machine broker authority for this runtime epoch.");
+	const brokerTicket = runtimeProviderBrokerToken(input);
+	if (brokerTicket.kind === "unavailable") throw new Error(`Provider token issuance requires a live exact-machine broker authority for this runtime epoch (${brokerTicket.reason}).`);
+	const runtimeGrantToken = brokerTicket.token;
 	const response = await fetchRuntimeProviderGrant({
 		url: `${controlPlaneUrl}/api/forge/runtimes/${runtimeId}/provider/token`,
 		token: runtimeGrantToken,
@@ -205351,6 +205468,48 @@ function applyPluginSkillPermissionsToDynamicTools(tools, settings) {
 	});
 }
 //#endregion
+//#region src/github/forgeGitHubToolHandler.ts
+/**
+* Shared wiring for Forge's brokered GitHub tools.
+*
+* Both provider surfaces run the same handler: Codex exposes the tools
+* natively, Claude reaches them over in-process MCP (`GitHubMcpServer.ts`).
+* The auth binding, the write confirmation gate and the audit trail live here
+* so a new surface cannot accidentally omit one — the handler's own defaults
+* are deliberately inert (no audit, never confirmed), which is safe for tests
+* but wrong for a real turn.
+*/
+function createForgeGitHubToolHandlerOptions(deps) {
+	const { runWithRuntimeContext } = deps;
+	return {
+		broker: new GitHubBroker({
+			resolveJwt: (auth) => runWithRuntimeContext(resolveCmmdJwtForSession({
+				sessionId: auth.sessionId,
+				logPrefix: deps.logPrefix,
+				...auth.subject !== void 0 ? { subject: auth.subject } : {},
+				...auth.forceRefresh !== void 0 ? { forceRefresh: auth.forceRefresh } : {}
+			})),
+			githubWriteIdentity: deps.githubWriteIdentity
+		}),
+		resolveAuth: async (threadId) => {
+			const binding = await runWithRuntimeContext(readThreadAuthSession(threadId));
+			return binding ? {
+				sessionId: binding.sessionId,
+				...binding.subject ? { subject: binding.subject } : {}
+			} : null;
+		},
+		recordAudit: (auditEvent) => runWithRuntimeContext(recordGitHubToolAuditEvent(auditEvent).pipe(require_Schema$1.asVoid)),
+		createConfirmation: (confirmation) => runWithRuntimeContext(createGitHubToolConfirmation(confirmation)),
+		isConfirmed: (confirmation) => runWithRuntimeContext(consumeApprovedOrLatestGitHubToolConfirmation({
+			confirmationId: confirmation.confirmationId,
+			threadId: confirmation.threadId,
+			toolName: confirmation.toolName,
+			request: confirmation.request
+		})),
+		bypassWriteConfirmation: deps.bypassWriteConfirmation
+	};
+}
+//#endregion
 //#region src/provider/shellSafety.ts
 const SHELL_SAFE_COMMAND_PATH_PATTERN = /^[A-Za-z0-9_.\-/\\:]+$/;
 function isShellSafeCommandPath(command) {
@@ -206641,33 +206800,12 @@ const makeCodexAdapter = require_Schema$1.fn("makeCodexAdapter")(function* (opti
 		}));
 		const browserToolEnvironmentId = yield* resolveBrowserToolEnvironmentId$1();
 		const computerManager = resolveComputerManager(serverConfig);
-		const githubDynamicToolHandler = createCodexGitHubDynamicToolHandler({
-			broker: new GitHubBroker({
-				resolveJwt: (auth) => runWithRuntimeContext(resolveCmmdJwtForSession({
-					sessionId: auth.sessionId,
-					logPrefix: "codex-github",
-					...auth.subject !== void 0 ? { subject: auth.subject } : {},
-					...auth.forceRefresh !== void 0 ? { forceRefresh: auth.forceRefresh } : {}
-				})),
-				githubWriteIdentity: settings.githubWriteIdentity
-			}),
-			resolveAuth: async (threadId) => {
-				const binding = await runWithRuntimeContext(readThreadAuthSession(threadId));
-				return binding ? {
-					sessionId: binding.sessionId,
-					...binding.subject ? { subject: binding.subject } : {}
-				} : null;
-			},
-			recordAudit: (auditEvent) => runWithRuntimeContext(recordGitHubToolAuditEvent(auditEvent).pipe(require_Schema$1.asVoid)),
-			createConfirmation: (confirmation) => runWithRuntimeContext(createGitHubToolConfirmation(confirmation)),
-			isConfirmed: (confirmation) => runWithRuntimeContext(consumeApprovedOrLatestGitHubToolConfirmation({
-				confirmationId: confirmation.confirmationId,
-				threadId: confirmation.threadId,
-				toolName: confirmation.toolName,
-				request: confirmation.request
-			})),
+		const githubDynamicToolHandler = createCodexGitHubDynamicToolHandler(createForgeGitHubToolHandlerOptions({
+			runWithRuntimeContext,
+			githubWriteIdentity: settings.githubWriteIdentity,
+			logPrefix: "codex-github",
 			bypassWriteConfirmation: input.runtimeMode === "full-access"
-		});
+		}));
 		const cmmdConnectorDynamicToolHandler = createCodexCmmdConnectorDynamicToolHandler({ resolveAuth: async (threadId) => {
 			const binding = await runWithRuntimeContext(readThreadAuthSession(threadId));
 			if (!binding) return null;
@@ -208214,6 +208352,62 @@ function createDevServerMcpServer(deps, threadId) {
 	});
 }
 //#endregion
+//#region src/github/GitHubMcpServer.ts
+/**
+* Brokered Forge GitHub tools, exposed to the Claude surface (in-process MCP).
+*
+* The Codex app-server consumes these tools as native dynamic tools; Claude
+* reaches them through MCP instead. Both surfaces dispatch the SAME handler
+* (`createCodexGitHubDynamicToolHandler`), so auth resolution, the write
+* confirmation gate and the audit trail are shared rather than reimplemented
+* per provider — this module only adapts descriptor + result shapes.
+*
+* Without it a Claude agent has no brokered push path at all and falls back to
+* raw `git`, which the runtime deliberately blocks via `GIT_ASKPASS=/bin/false`.
+*
+* Result envelopes are relayed verbatim as tool content: the web approval card
+* is built by scanning tool results for `userActionRequired`, so summarising or
+* reshaping the payload here would silently strip the user's ability to approve
+* a write.
+*/
+const GITHUB_MCP_SERVER_NAME = "forge-github";
+/** Joins the brokered result's content items back into a single text payload. */
+function readResultText(contentItems) {
+	return contentItems.map((item) => item.text).filter((text) => typeof text === "string").join("\n");
+}
+/**
+* Factored out of `createGitHubMcpServer` (mirroring the Sidekick tools server)
+* so dispatch and envelope handling are testable without the SDK's `tool()` /
+* `createSdkMcpServer` machinery.
+*/
+function buildGitHubToolHandlers(runBrokeredTool, threadId) {
+	return createCodexGitHubDynamicTools().map((descriptor) => ({
+		name: descriptor.name,
+		description: descriptor.description,
+		inputSchema: jsonSchemaToZodShape(descriptor.inputSchema),
+		handler: async (args) => {
+			const result = await runBrokeredTool({
+				threadId,
+				tool: descriptor.name,
+				arguments: args
+			});
+			return {
+				content: [{
+					type: "text",
+					text: readResultText(result.contentItems)
+				}],
+				...result.success ? {} : { isError: true }
+			};
+		}
+	}));
+}
+function createGitHubMcpServer(runBrokeredTool, threadId) {
+	return z1e({
+		name: GITHUB_MCP_SERVER_NAME,
+		tools: buildGitHubToolHandlers(runBrokeredTool, threadId).map((entry) => U1e(entry.name, entry.description, entry.inputSchema, entry.handler))
+	});
+}
+//#endregion
 //#region src/provider/providerAuthFailureCopy.ts
 /**
 * Rewrite provider auth failures into an action the user can actually take.
@@ -208518,6 +208712,7 @@ function buildClaudeMcpServers(input) {
 		"forge-browser": createBrowserMcpServer(input.browserManager, input.threadId, browserToolScope(input.browserToolEnvironmentId)),
 		"forge-dev-server": createDevServerMcpServer(input.devServerToolDeps, input.threadId),
 		"cmmd-context": createCmmdContextMcpServer(input.threadId, input.resolveCmmdPat),
+		[GITHUB_MCP_SERVER_NAME]: createGitHubMcpServer(input.runBrokeredGitHubTool, input.threadId),
 		...input.computerManager ? { [COMPUTER_MCP_SERVER_NAME]: createComputerMcpServer(input.computerManager, input.threadId) } : {},
 		...input.cmmdSidekickTools ? { "cmmd-sidekick-tools": createCmmdSidekickToolsMcpServer(input.cmmdSidekickTools.session, input.cmmdSidekickTools.tools) } : {}
 	};
@@ -210528,6 +210723,12 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 		const permissionMode = permissionModeForRuntimeMode(input.runtimeMode);
 		const settings = claudeQuerySettings(modelConfig.thinking, modelConfig.fastMode);
 		const systemPrompt = buildClaudeSystemPrompt(modelConfig.endpointProfile, serverSettings.coauthorIncludeForge);
+		const runBrokeredGitHubTool = createCodexGitHubDynamicToolHandler(createForgeGitHubToolHandlerOptions({
+			runWithRuntimeContext: runWithSqlRuntimeContext,
+			githubWriteIdentity: serverSettings.githubWriteIdentity,
+			logPrefix: "claude-github",
+			bypassWriteConfirmation: input.runtimeMode === "full-access"
+		}));
 		const queryRuntime = yield* createClaudeQueryRuntime(prompt, buildClaudeQueryOptions({
 			cwd: input.cwd,
 			effectiveApiModelId: modelConfig.effectiveApiModelId,
@@ -210547,7 +210748,8 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 			computerManager,
 			resolveCmmdPat,
 			devServerToolDeps,
-			cmmdSidekickTools
+			cmmdSidekickTools,
+			runBrokeredGitHubTool
 		}), threadId);
 		const session = buildClaudeProviderSession({
 			threadId,
@@ -283548,7 +283750,9 @@ const make$8 = require_Schema$1.gen(function* () {
 			projects: readModel.projects
 		});
 		if (!cwd) return "Forge could not resolve the project folder for this thread.";
-		if (serverConfig.forgeCmmdRuntimeMode === true && !isPathInsideAnyRoot(cwd, [serverConfig.cloudProjectsRoot, serverConfig.worktreesDir])) return "Forge blocked this agent turn because the project folder is outside the managed runtime workspace.";
+		const isCloudExecutionRuntime = serverConfig.forgeCmmdRuntimeMode === true;
+		const managedRoots = [serverConfig.cloudProjectsRoot, serverConfig.worktreesDir];
+		if (isCloudExecutionRuntime && !isPathInsideAnyRoot(cwd, managedRoots)) return `Forge blocked this agent turn because the project folder is outside the managed runtime workspace. Folder: ${cwd}. Managed roots: ${managedRoots.join(", ")}.`;
 		if (thread.anchorKind === "task" && project?.repositoryIdentity == null && !isGitWorkspace(cwd)) return "Forge created this task thread, but the project folder is not a Git repository yet. Import or link the repository before starting an agent turn.";
 		return null;
 	});
@@ -288950,6 +289154,7 @@ function executionEnvironmentCapabilities(serverConfig) {
 		repositoryIdentity: true,
 		pullRequests: isExecutionPlane,
 		threadPullRequestLinking: isExecutionPlane,
+		threadSettlement: isExecutionPlane,
 		cloudMode: serverConfig.forgeCmmdRuntimeMode === true || isCloudShell,
 		runtime: {
 			topology: runtimeTopology(serverConfig),
@@ -310903,16 +311108,16 @@ const gitUrlCloneRouteLayer = add$1("POST", "/api/cloud/git/clone-url", require_
 //#endregion
 //#region src/server.ts
 const PtyAdapterLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
-	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunPTY-2icf7sRj.cjs")))).layer;
-	else return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodePTY-cb7HIasY.cjs")))).layer;
+	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunPTY-BjHFZATJ.cjs")))).layer;
+	else return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodePTY-Bd9mvI6U.cjs")))).layer;
 }));
 const HttpServerLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
-	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunHttpServer-DOAuw4Iq.cjs")))).layer({
+	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunHttpServer-Dxx0kzQc.cjs")))).layer({
 		port: config.port,
 		...config.host ? { hostname: config.host } : {}
 	});
-	const [NodeHttpServer, NodeHttp] = yield* require_Schema$1.all([require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeHttpServer-D_ismXpd.cjs"))), require_Schema$1.promise(() => import("node:http"))]);
+	const [NodeHttpServer, NodeHttp] = yield* require_Schema$1.all([require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeHttpServer-D6YVHsL8.cjs"))), require_Schema$1.promise(() => import("node:http"))]);
 	return NodeHttpServer.layer(NodeHttp.createServer, {
 		host: config.host,
 		port: config.port
@@ -310920,10 +311125,10 @@ const HttpServerLive = require_Schema$1.unwrap(require_Schema$1.gen(function* ()
 }));
 const PlatformServicesLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	if (typeof Bun !== "undefined") {
-		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunServices-CiNXNzHD.cjs")));
+		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunServices-U1VBnEJS.cjs")));
 		return layer;
 	} else {
-		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeServices-BAl07hlH.cjs")));
+		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeServices-BcQL_53W.cjs")));
 		return layer;
 	}
 }));
@@ -310991,7 +311196,7 @@ const MiscRuntimeLayerLive = require_Schema$1.mergeAll(AnalyticsServiceLayerLive
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(require_Schema$1.provideMerge(CheckpointingLayerLive), require_Schema$1.provideMerge(GitLayerLive), require_Schema$1.provideMerge(OrchestrationLayerLive), require_Schema$1.provideMerge(ProviderLayerLive), require_Schema$1.provideMerge(TerminalLayerLive), require_Schema$1.provideMerge(AgentBrowserManagerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(require_Schema$1.provide$1(ThreadDevRuntimeLive)))), require_Schema$1.provideMerge(PersistenceLayerLive), require_Schema$1.provideMerge(KeybindingsLive), require_Schema$1.provideMerge(ProviderRegistryLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ServerSettingsLive, UsageServiceLive.pipe(require_Schema$1.provide$1(ServerSettingsLive)))), require_Schema$1.provideMerge(WorkspaceLayerLive), require_Schema$1.provideMerge(WorkspaceReadinessStateLive), require_Schema$1.provideMerge(ProjectFaviconResolverLive), require_Schema$1.provideMerge(RepositoryIdentityResolverLive), require_Schema$1.provideMerge(ServerEnvironmentLive), require_Schema$1.provideMerge(AuthLayerLive), require_Schema$1.provideMerge(ServerSecretStoreLayerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(require_Schema$1.provide$1(PersistenceLayerLive)))), require_Schema$1.provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(require_Schema$1.provideMerge(RuntimeDependenciesWithoutPullRequestsLive), require_Schema$1.provideMerge(cmmdProjectIdentityResolverLive.pipe(require_Schema$1.provide$1(RuntimeDependenciesWithoutPullRequestsLive))), require_Schema$1.provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(require_Schema$1.provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = require_Schema$1.mergeAll(authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, cmmdCreateBrainDocRouteLayer, cmmdUpdateTaskRouteLayer, cmmdUpsertTaskPullRequestRouteLayer, ...cmmdPullRequestRouteLayers, cmmdAddTaskCommentRouteLayer, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdSearchTasksRouteLayer, cmmdGetTaskCommentsRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdGetOrgMembersRouteLayer, cmmdSimHostsRouteLayer, cmmdSimLeaseReadRouteLayer, cmmdSimLeaseClaimRouteLayer, cmmdSimLeaseReleaseRouteLayer, cmmdSimLeaseRenewRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdGetTaskAttachmentsRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdDeleteTaskCommentRouteLayer, cmmdGetProjectRepositoryRouteLayer, cmmdListProjectRepositoriesRouteLayer, cmmdArchiveTaskRouteLayer, cmmdUnarchiveTaskRouteLayer, cmmdListTasksRouteLayer, cmmdCreateTaskRouteLayer, cmmdListCampaignsRouteLayer, cmmdGetCampaignRouteLayer, cmmdCreateCampaignRouteLayer, cmmdUpdateCampaignRouteLayer, cmmdDeleteCampaignRouteLayer, cmmdListSavedViewsRouteLayer, cmmdCreateSavedViewRouteLayer, cmmdImportSavedViewRouteLayer, cmmdUpdateSavedViewRouteLayer, cmmdDeleteSavedViewRouteLayer, cmmdListProjectsRouteLayer, cmmdGetProjectRouteLayer, cmmdCreateProjectRouteLayer, cmmdDeleteProjectRouteLayer, cmmdMoveProjectRouteLayer, cmmdGetProjectMembersRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdGetProjectMilestonesRouteLayer, cmmdCreateProjectMilestoneRouteLayer, cmmdUpdateProjectMilestoneRouteLayer, cmmdDeleteProjectMilestoneRouteLayer, cmmdGetProjectUpdatesRouteLayer, cmmdCreateProjectUpdateRouteLayer, cmmdUpdateProjectUpdateRouteLayer, cmmdDeleteProjectUpdateRouteLayer, cmmdImproveProjectContentRouteLayer, cmmdCreateProjectTaskDraftRouteLayer, cmmdGetProjectTaskDraftRouteLayer, cmmdUpdateProjectTaskDraftRouteLayer, cmmdPreviewProjectTaskDraftRouteLayer, cmmdCommitProjectTaskDraftRouteLayer, cmmdDiscardProjectTaskDraftRouteLayer, cmmdGetProjectLeadPlanRouteLayer, cmmdActivateProjectLeadAuthorityRouteLayer, cmmdGetProjectLeadReadinessRouteLayer, cmmdGetProjectLeadCapabilitiesRouteLayer, cmmdGetProjectLeadSummaryRouteLayer, cmmdGetProjectLeadDetailRouteLayer, cmmdGetProjectLeadBriefingRouteLayer, cmmdListProjectLeadEventsRouteLayer, cmmdExplainProjectLeadRouteLayer, cmmdPauseProjectLeadRouteLayer, cmmdResumeProjectLeadRouteLayer, cmmdReserveProjectLeadTaskRouteLayer, cmmdReleaseProjectLeadReservationRouteLayer, cmmdReconcileProjectLeadRouteLayer, cmmdResolveProjectLeadAttentionRouteLayer, cmmdClaimProjectLeadControllerRouteLayer, cmmdRenewProjectLeadControllerClaimRouteLayer, cmmdYieldProjectLeadControllerClaimRouteLayer, cmmdAcknowledgeProjectLeadControllerEventRouteLayer, cmmdRecordProjectLeadControllerDecisionRouteLayer, cmmdListForgeAutomationPresetsRouteLayer, cmmdListUserForgeAutomationRulesRouteLayer, cmmdCreateUserForgeAutomationRuleRouteLayer, cmmdUpdateUserForgeAutomationRuleRouteLayer, cmmdListUserForgeAutomationRunsRouteLayer, cmmdStartUserForgeAutomationRunRouteLayer, cmmdListForgeAutomationRulesRouteLayer, cmmdCreateForgeAutomationRuleRouteLayer, cmmdUpdateForgeAutomationRuleRouteLayer, cmmdListForgeAutomationRunsRouteLayer, cmmdStartForgeAutomationRunRouteLayer, cmmdGetForgeAutomationRunRouteLayer, cmmdRetryForgeAutomationRunRouteLayer, cmmdCancelForgeAutomationRunRouteLayer, cmmdApproveForgeAutomationEscalationRouteLayer, cmmdRejectForgeAutomationEscalationRouteLayer, cmmdListProjectAgentMembersRouteLayer, cmmdCreateProjectAgentMemberRouteLayer, cmmdGetProjectAgentMemberRouteLayer, cmmdRenameProjectAgentMemberRouteLayer, cmmdRetireProjectAgentMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, cmmdListProjectAgentMemberInstancesRouteLayer, cmmdPreviewProjectAgentMemberConsolidationRouteLayer, cmmdApplyProjectAgentMemberConsolidationRouteLayer, cmmdPutProjectTaskAssignmentRouteLayer, cmmdListProjectBoardRouteLayer, cmmdGetProjectTaskWorkflowRouteLayer, cmmdUpdateProjectTaskWorkflowRouteLayer, cmmdCreateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskStatusRouteLayer, cmmdListTaskExecutionOptionsRouteLayer, cmmdCreateTaskWorkSessionRouteLayer, cmmdListProjectWorkSessionsRouteLayer, cmmdGetWorkSessionRouteLayer, cmmdUpdateWorkSessionRouteLayer, cmmdAttachWorkSessionThreadRouteLayer, cmmdListTaskConversationsRouteLayer, cmmdLinkTaskConversationRouteLayer, cmmdGetTaskHistoryRouteLayer, cmmdGetTaskConversationRouteLayer, cmmdSpawnForgeThreadFromBoardTaskRouteLayer, cmmdListCenterBoardRouteLayer, cmmdCreateCenterBoardTaskRouteLayer, cmmdCreateFeedbackRouteLayer, cmmdUpdateCenterBoardTaskRouteLayer, cmmdMoveCenterBoardTaskRouteLayer, cmmdMoveProjectBoardTaskRouteLayer, cmmdArchiveProjectBoardTaskRouteLayer, cmmdUnarchiveProjectBoardTaskRouteLayer, cmmdArchiveCenterBoardTaskRouteLayer, cmmdUnarchiveCenterBoardTaskRouteLayer, cmmdBootstrapRouteLayer, cmmdGetAccountPreferencesRouteLayer, cmmdUpdateAccountPreferencesRouteLayer, cmmdGetOrgProviderPolicyRouteLayer, cmmdListChatsRouteLayer, cmmdGetChatRouteLayer, cmmdListDevicesRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRegisterDeviceRouteLayer, cmmdHeartbeatRuntimeRouteLayer, cmmdGrantRuntimeAccessRouteLayer, cmmdRevokeRuntimeAccessRouteLayer, cmmdCreateRelayControlRouteLayer, cmmdCreateRelayActionGrantRouteLayer, cmmdReplaceRuntimeInventoryRouteLayer, cmmdListRuntimeInventoryRouteLayer, cmmdGetRuntimeDiagnosticsRouteLayer, cmmdProvisionAuthRuntimeRouteLayer, cmmdGetAuthRuntimeRouteLayer, cmmdDestroyAuthRuntimeRouteLayer, cmmdConnectAuthRuntimeRouteLayer, cmmdGetProviderAccountsRouteLayer, cmmdDeleteProviderAccountRouteLayer, cmmdSetProviderAccountDefaultRouteLayer, cmmdGetProviderUsageRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdGetUserCodexCredentialRouteLayer, cmmdDeleteUserCodexCredentialRouteLayer, cmmdGetUserClaudeCredentialRouteLayer, cmmdDeleteUserClaudeCredentialRouteLayer, cmmdGetClaudeRuntimeReadinessRouteLayer, cmmdAppendRuntimeThreadEventsRouteLayer, cmmdGetRuntimeThreadReplicaRouteLayer, cmmdRenameDeviceRouteLayer, cmmdRevokeDeviceRouteLayer, cmmdInstallConnectorRouteLayer, cmmdListConnectorsRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeCloudProjectRegisterRouteLayer, cmmdForgeCloudProjectUnregisterRouteLayer, cmmdForgeCloudProjectLifecyclePreflightRouteLayer, cmmdForgeCloudProjectRemovalRouteLayer, cmmdForgeCloudProjectRemovalReceiptRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, cmmdGetTaskRouteLayer, commandUpdateTaskRouteLayer, mobileProviderCatalogRouteLayer, cmmdUsageSummaryRouteLayer, cmmdBillingRouteLayer, cmmdBillingSeriesRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, claudeNativeGenerationProofRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
+const makeRoutesLayer = require_Schema$1.mergeAll(authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, cmmdCreateBrainDocRouteLayer, cmmdUpdateTaskRouteLayer, cmmdUpsertTaskPullRequestRouteLayer, ...cmmdPullRequestRouteLayers, cmmdAddTaskCommentRouteLayer, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdSearchTasksRouteLayer, cmmdGetTaskCommentsRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdGetOrgMembersRouteLayer, cmmdSimHostsRouteLayer, cmmdSimLeaseReadRouteLayer, cmmdSimLeaseClaimRouteLayer, cmmdSimLeaseReleaseRouteLayer, cmmdSimLeaseRenewRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdGetTaskAttachmentsRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdDeleteTaskCommentRouteLayer, cmmdGetProjectRepositoryRouteLayer, cmmdListProjectRepositoriesRouteLayer, cmmdArchiveTaskRouteLayer, cmmdUnarchiveTaskRouteLayer, cmmdListTasksRouteLayer, cmmdCreateTaskRouteLayer, cmmdListCampaignsRouteLayer, cmmdGetCampaignRouteLayer, cmmdCreateCampaignRouteLayer, cmmdUpdateCampaignRouteLayer, cmmdDeleteCampaignRouteLayer, cmmdListSavedViewsRouteLayer, cmmdCreateSavedViewRouteLayer, cmmdImportSavedViewRouteLayer, cmmdUpdateSavedViewRouteLayer, cmmdDeleteSavedViewRouteLayer, cmmdListProjectsRouteLayer, cmmdGetProjectRouteLayer, cmmdCreateProjectRouteLayer, cmmdDeleteProjectRouteLayer, cmmdMoveProjectRouteLayer, cmmdGetProjectMembersRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdGetProjectMilestonesRouteLayer, cmmdCreateProjectMilestoneRouteLayer, cmmdUpdateProjectMilestoneRouteLayer, cmmdDeleteProjectMilestoneRouteLayer, cmmdGetProjectUpdatesRouteLayer, cmmdCreateProjectUpdateRouteLayer, cmmdUpdateProjectUpdateRouteLayer, cmmdDeleteProjectUpdateRouteLayer, cmmdImproveProjectContentRouteLayer, cmmdCreateProjectTaskDraftRouteLayer, cmmdGetProjectTaskDraftRouteLayer, cmmdUpdateProjectTaskDraftRouteLayer, cmmdPreviewProjectTaskDraftRouteLayer, cmmdCommitProjectTaskDraftRouteLayer, cmmdDiscardProjectTaskDraftRouteLayer, cmmdGetProjectLeadPlanRouteLayer, cmmdActivateProjectLeadAuthorityRouteLayer, cmmdGetProjectLeadReadinessRouteLayer, cmmdGetProjectLeadCapabilitiesRouteLayer, cmmdGetProjectLeadSummaryRouteLayer, cmmdGetProjectLeadDetailRouteLayer, cmmdGetProjectLeadBriefingRouteLayer, cmmdListProjectLeadEventsRouteLayer, cmmdExplainProjectLeadRouteLayer, cmmdPauseProjectLeadRouteLayer, cmmdResumeProjectLeadRouteLayer, cmmdReserveProjectLeadTaskRouteLayer, cmmdReleaseProjectLeadReservationRouteLayer, cmmdReconcileProjectLeadRouteLayer, cmmdResolveProjectLeadAttentionRouteLayer, cmmdClaimProjectLeadControllerRouteLayer, cmmdRenewProjectLeadControllerClaimRouteLayer, cmmdYieldProjectLeadControllerClaimRouteLayer, cmmdAcknowledgeProjectLeadControllerEventRouteLayer, cmmdRecordProjectLeadControllerDecisionRouteLayer, cmmdListForgeAutomationPresetsRouteLayer, cmmdListUserForgeAutomationRulesRouteLayer, cmmdCreateUserForgeAutomationRuleRouteLayer, cmmdUpdateUserForgeAutomationRuleRouteLayer, cmmdListUserForgeAutomationRunsRouteLayer, cmmdStartUserForgeAutomationRunRouteLayer, cmmdListForgeAutomationRulesRouteLayer, cmmdCreateForgeAutomationRuleRouteLayer, cmmdUpdateForgeAutomationRuleRouteLayer, cmmdListForgeAutomationRunsRouteLayer, cmmdStartForgeAutomationRunRouteLayer, cmmdGetForgeAutomationRunRouteLayer, cmmdRetryForgeAutomationRunRouteLayer, cmmdCancelForgeAutomationRunRouteLayer, cmmdApproveForgeAutomationEscalationRouteLayer, cmmdRejectForgeAutomationEscalationRouteLayer, cmmdListProjectAgentMembersRouteLayer, cmmdCreateProjectAgentMemberRouteLayer, cmmdGetProjectAgentMemberRouteLayer, cmmdRenameProjectAgentMemberRouteLayer, cmmdRetireProjectAgentMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, cmmdListProjectAgentMemberInstancesRouteLayer, cmmdPreviewProjectAgentMemberConsolidationRouteLayer, cmmdApplyProjectAgentMemberConsolidationRouteLayer, cmmdPutProjectTaskAssignmentRouteLayer, cmmdListProjectBoardRouteLayer, cmmdGetProjectTaskWorkflowRouteLayer, cmmdUpdateProjectTaskWorkflowRouteLayer, cmmdCreateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskStatusRouteLayer, cmmdListTaskExecutionOptionsRouteLayer, cmmdCreateTaskWorkSessionRouteLayer, cmmdListProjectWorkSessionsRouteLayer, cmmdGetWorkSessionRouteLayer, cmmdUpdateWorkSessionRouteLayer, cmmdAttachWorkSessionThreadRouteLayer, cmmdListTaskConversationsRouteLayer, cmmdLinkTaskConversationRouteLayer, cmmdGetTaskHistoryRouteLayer, cmmdGetTaskConversationRouteLayer, cmmdSpawnForgeThreadFromBoardTaskRouteLayer, cmmdListCenterBoardRouteLayer, cmmdCreateCenterBoardTaskRouteLayer, cmmdCreateFeedbackRouteLayer, cmmdUpdateCenterBoardTaskRouteLayer, cmmdMoveCenterBoardTaskRouteLayer, cmmdMoveProjectBoardTaskRouteLayer, cmmdArchiveProjectBoardTaskRouteLayer, cmmdUnarchiveProjectBoardTaskRouteLayer, cmmdArchiveCenterBoardTaskRouteLayer, cmmdUnarchiveCenterBoardTaskRouteLayer, cmmdBootstrapRouteLayer, cmmdGetAccountPreferencesRouteLayer, cmmdUpdateAccountPreferencesRouteLayer, cmmdGetOrgProviderPolicyRouteLayer, cmmdListChatsRouteLayer, cmmdGetChatRouteLayer, cmmdListDevicesRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRegisterDeviceRouteLayer, cmmdHeartbeatRuntimeRouteLayer, cmmdGrantRuntimeAccessRouteLayer, cmmdRevokeRuntimeAccessRouteLayer, cmmdCreateRelayControlRouteLayer, cmmdCreateRelayActionGrantRouteLayer, cmmdReplaceRuntimeInventoryRouteLayer, cmmdListRuntimeInventoryRouteLayer, cmmdGetRuntimeDiagnosticsRouteLayer, cmmdProvisionAuthRuntimeRouteLayer, cmmdGetAuthRuntimeRouteLayer, cmmdDestroyAuthRuntimeRouteLayer, cmmdConnectAuthRuntimeRouteLayer, cmmdGetProviderAccountsRouteLayer, cmmdDeleteProviderAccountRouteLayer, cmmdSetProviderAccountDefaultRouteLayer, cmmdGetProviderUsageRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdGetUserCodexCredentialRouteLayer, cmmdDeleteUserCodexCredentialRouteLayer, cmmdGetUserClaudeCredentialRouteLayer, cmmdDeleteUserClaudeCredentialRouteLayer, cmmdGetClaudeRuntimeReadinessRouteLayer, cmmdAppendRuntimeThreadEventsRouteLayer, cmmdGetRuntimeThreadReplicaRouteLayer, cmmdRenameDeviceRouteLayer, cmmdRevokeDeviceRouteLayer, cmmdInstallConnectorRouteLayer, cmmdListConnectorsRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeCloudProjectRegisterRouteLayer, cmmdForgeCloudProjectUnregisterRouteLayer, cmmdForgeCloudProjectLifecyclePreflightRouteLayer, cmmdForgeCloudProjectRemovalRouteLayer, cmmdForgeCloudProjectRemovalReceiptRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, cmmdGetTaskRouteLayer, commandUpdateTaskRouteLayer, mobileProviderCatalogRouteLayer, cmmdUsageSummaryRouteLayer, cmmdBillingRouteLayer, cmmdBillingSeriesRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, claudeNativeGenerationProofRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
 const makeServerLayer = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath();