@agentrific/server 0.1.4 → 0.1.6

package/cli.js

@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@agentrific/server",
-      version: "0.1.4",
+      version: "0.1.6",
       description: "Self-hosted control plane for long-running coding agents",
       keywords: [
         "agentrific",
@@ -245,7 +245,7 @@ function createPairingLink(payload) {
   link.searchParams.set("data", JSON.stringify(PairingPayloadSchema.parse(payload)));
   return link.toString();
 }
-var cronBounds, AutomationConfigSchema, AutomationStateSchema, SessionStatusSchema, AgentKindSchema, ModelReferenceSchema, ModelIdentitySchema, ModelOptionSchema, ModelCatalogSchema, GitFlowSchema, GitDeliverySchema, DeliveryRequestSchema, RunPreparationSchema, SessionSchema, MAX_ATTACHMENTS, MAX_ATTACHMENT_BYTES, AttachmentSchema, AttachmentIdsSchema, CreateSessionSchema, SendMessageSchema, SessionEventSchema, RecordedEventSchema, EventHistorySchema, ServerEventSchema, ServerSettingsSchema, ConnectionsStatusSchema, UpdateSettingsSchema, ProjectSchema, TaskStatusSchema, TaskSchema, CreateTaskSchema, UpdateTaskSchema, PROTOCOL_VERSION, ServerUpdateStatusSchema, ServerHealthSchema, PairingPayloadSchema, PairingRequestSchema, DeviceSchema, PairingResultSchema, HandshakeSchema, HandshakeAckSchema;
+var cronBounds, AutomationConfigSchema, AutomationStateSchema, SessionStatusSchema, AgentKindSchema, ModelReferenceSchema, ModelIdentitySchema, ModelOptionSchema, ModelCatalogSchema, GitFlowSchema, GitDeliverySchema, DeliveryRequestSchema, RunPreparationSchema, SessionSchema, MAX_ATTACHMENTS, MAX_ATTACHMENT_BYTES, AttachmentSchema, AttachmentIdsSchema, CreateSessionSchema, SendMessageSchema, SessionEventSchema, RecordedEventSchema, EventHistorySchema, ServerEventSchema, ServerSettingsSchema, ConnectionsStatusSchema, UpdateSettingsSchema, ProjectSchema, TaskStatusSchema, TaskSchema, CreateTaskSchema, UpdateTaskSchema, PROTOCOL_VERSION, ServerUpdateStatusSchema, ServerHealthSchema, PairingPayloadSchema, PairingInvitationSchema, PairingRequestSchema, DeviceSchema, PairingResultSchema, HandshakeSchema, HandshakeAckSchema;
 var init_src = __esm({
   "../../packages/contracts/src/index.ts"() {
     cronBounds = [
@@ -519,6 +519,11 @@ var init_src = __esm({
       serverId: z2.string().uuid(),
       pairingId: z2.string().regex(/^[a-f0-9]{64}$/)
     });
+    PairingInvitationSchema = z2.object({
+      payload: PairingPayloadSchema,
+      pin: z2.string().regex(/^\d{6}$/),
+      expiresAt: z2.number()
+    });
     PairingRequestSchema = z2.object({
       pairingId: z2.string().regex(/^[a-f0-9]{64}$/),
       pin: z2.string().regex(/^\d{6}$/),
@@ -727,15 +732,519 @@ var init_control = __esm({
   }
 });
 
+// src/cli-output.ts
+import { styleText } from "node:util";
+function printHeading(title) {
+  console.log();
+  console.log(styleText("bold", "      #######  ##"));
+  console.log(styleText("bold", "    ###     #####"));
+  console.log(`    ${styleText("bold", "##       ####")}    ${styleText("bold", "AGENTRIFIC")}`);
+  console.log(
+    `    ${styleText("bold", "##   ")}${styleText(["bold", "yellow"], "o")}${styleText("bold", "   ####")}    ${styleText("dim", `${title} \xB7 v${serverVersion}`)}`
+  );
+  console.log(styleText("bold", "    ##       ####"));
+  console.log(styleText("bold", "    ###     #####"));
+  console.log(styleText("bold", "      #######  ##"));
+  console.log();
+}
+function printDetail(label2, value) {
+  console.log(`  ${styleText("dim", "\u203A")} ${styleText("dim", label2.padEnd(10))} ${value}`);
+}
+function printShortcuts(pairingAvailable = false) {
+  console.log();
+  console.log(`  ${styleText("dim", "\u203A")} Press ${styleText("bold", "p")}       \u2502 pair a device`);
+  if (pairingAvailable)
+    console.log(
+      `  ${styleText("dim", "\u203A")} Press ${styleText("bold", "j")}       \u2502 show pairing JSON`
+    );
+  console.log(`  ${styleText("dim", "\u203A")} Press ${styleText("bold", "?")}       \u2502 show shortcuts`);
+  console.log(
+    `  ${styleText("dim", "\u203A")} Press ${styleText("bold", "Ctrl+C")}  \u2502 stop the server
+`
+  );
+}
+function printError(message) {
+  console.error(`
+  ${styleText(["bold", "red"], "Error")} ${message}
+`);
+}
+function printHelp() {
+  printHeading("server");
+  console.log(`  ${styleText("bold", "Usage")} agentrific <command> [options]
+`);
+  for (const [command, description] of [
+    ["init", "Configure the server"],
+    ["start", "Start the server \xB7 press p to pair"],
+    ["pair", "Print a fresh pairing QR code and PIN"],
+    ["devices", "List enrolled devices"],
+    ["revoke <id>", "Revoke a device's access"],
+    ["status", "Show server status"],
+    ["maintenance enter/resume/drain", "Pause new work, resume, or wait for work to finish"],
+    ["service install/uninstall/restart", "Manage the background service"],
+    ["logs", "Follow server logs"],
+    ["update --check", "Check for a newer release"]
+  ])
+    console.log(`  ${styleText("cyan", command.padEnd(34))}${description}`);
+  console.log(`
+  ${styleText("bold", "Options")}
+`);
+  for (const [option, description] of [
+    ["--data-dir <path>", "Use a specific server data directory"],
+    ["--public-url <https-url>", "Use your tunnel URL without prompting"],
+    ["--no-interactive", "Disable prompts and keyboard shortcuts"],
+    ["--show-payload", "Print manual JSON with the pairing QR code"],
+    ["--timeout-ms <0-60000>", "Set the maintenance drain timeout"],
+    ["--version", "Print the server version"],
+    ["--help", "Show this help"]
+  ])
+    console.log(`  ${styleText("cyan", option.padEnd(34))}${description}`);
+  console.log("\n  Connect using Tailscale Serve, cloudflared, or another HTTPS tunnel.\n");
+}
+var init_cli_output = __esm({
+  "src/cli-output.ts"() {
+    "use strict";
+    init_version();
+  }
+});
+
+// src/pairing.ts
+import { z as z4 } from "zod";
+import { styleText as styleText2 } from "node:util";
+import { emitKeypressEvents } from "node:readline";
+import qrcode from "qrcode-terminal";
+function printManualPairing(invitation) {
+  if (Date.now() >= invitation.expiresAt) {
+    printError("This invitation expired. Generate a fresh pairing QR code.");
+    return;
+  }
+  console.log(styleText2("dim", "\n  Manual entry \xB7 paste this JSON into Pairing payload:\n"));
+  console.log(`  ${invitation.payload}
+`);
+}
+function waitForManualPairing(invitation) {
+  console.log(styleText2("dim", "  Press j to show manual entry \xB7 Enter or q to finish.\n"));
+  return new Promise((resolve) => {
+    const input = process.stdin;
+    const previousRaw = input.isRaw;
+    const timeout = setTimeout(
+      () => {
+        console.log(
+          styleText2("dim", "\n  Pairing invitation expired. Run agentrific pair again.\n")
+        );
+        close();
+      },
+      Math.max(0, invitation.expiresAt - Date.now())
+    );
+    function close() {
+      clearTimeout(timeout);
+      input.removeListener("keypress", pressed);
+      input.removeListener("end", close);
+      process.removeListener("SIGINT", interrupted);
+      process.removeListener("SIGTERM", terminated);
+      input.setRawMode(previousRaw);
+      input.pause();
+      resolve();
+    }
+    function interrupted() {
+      process.exitCode = 130;
+      close();
+    }
+    function terminated() {
+      process.exitCode = 143;
+      close();
+    }
+    function pressed(text, key) {
+      if (key.ctrl && key.name === "c") {
+        interrupted();
+        return;
+      }
+      if (key.ctrl || key.meta) return;
+      if (text?.toLowerCase() === "j") {
+        printManualPairing(invitation);
+        close();
+      } else if (text?.toLowerCase() === "q" || key.name === "return" || key.name === "escape") {
+        close();
+      }
+    }
+    emitKeypressEvents(input);
+    input.setRawMode(true);
+    input.on("keypress", pressed);
+    input.once("end", close);
+    process.once("SIGINT", interrupted);
+    process.once("SIGTERM", terminated);
+    input.resume();
+  });
+}
+function pairingOrigin(url) {
+  const endpoint = new URL(url);
+  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.pathname !== "/")
+    throw new Error("Use the HTTPS server origin without a path or credentials.");
+  if (endpoint.protocol !== "https:" && !(process.env.NODE_ENV !== "production" && endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname)))
+    throw new Error("Use HTTPS. Localhost HTTP is for development builds only.");
+  return endpoint.origin;
+}
+async function printPairing(dataDir, url) {
+  if (!url)
+    throw new Error(
+      "Specify --public-url with your Tailscale Serve or Cloudflare Tunnel HTTPS address."
+    );
+  const origin = pairingOrigin(url);
+  const grant = z4.object({
+    pairingId: z4.string(),
+    pin: z4.string(),
+    expiresAt: z4.number(),
+    serverId: z4.string()
+  }).parse(await controlRequest(dataDir, { command: "pair" }));
+  const invitation = {
+    v: 1,
+    url: origin,
+    serverId: grant.serverId,
+    pairingId: grant.pairingId
+  };
+  const payload = JSON.stringify(invitation);
+  const link = createPairingLink(invitation);
+  printHeading("pairing");
+  console.log("  1. Scan below with your phone camera and tap Open Agentrific if offered.");
+  console.log("  2. Or open Agentrific and choose Scan pairing QR code.");
+  console.log("  3. Enter the PIN, then confirm pairing.\n");
+  qrcode.generate(link, { small: true }, (code) => {
+    console.log(
+      code.split("\n").map((line) => `  ${line}`).join("\n")
+    );
+  });
+  console.log();
+  printDetail("PIN:", styleText2(["bold", "yellow"], grant.pin));
+  printDetail("Server", styleText2("cyan", origin));
+  printDetail("Expires", "In five minutes \xB7 one device per code");
+  console.log("\n  Pairing grants this device access to run agents as your host user.\n");
+  return { payload, expiresAt: grant.expiresAt };
+}
+var init_pairing = __esm({
+  "src/pairing.ts"() {
+    "use strict";
+    init_src();
+    init_control();
+    init_cli_output();
+  }
+});
+
+// ../../packages/contracts/src/push.ts
+import { z as z6 } from "zod";
+function pushSigningText(installationId, operation, request) {
+  return [
+    "agentrific-push-v1",
+    installationId,
+    operation,
+    request.bindingId,
+    request.timestamp,
+    request.nonce,
+    request.payload
+  ].join("\n");
+}
+var PUSH_API_URL, PushKindSchema, PushPreferencesSchema, PushPublicKeySchema, PushInstallationSchema, PushRegistrationSchema, PushEnrollmentSchema, PushGrantSchema, PushPullRequestUrlSchema, PushEventSchema, PushSignedRequestSchema, PushEntitlementSchema, PushServerStatusSchema;
+var init_push = __esm({
+  "../../packages/contracts/src/push.ts"() {
+    "use strict";
+    PUSH_API_URL = "https://api.agentrific.com";
+    PushKindSchema = z6.enum([
+      "started",
+      "completed",
+      "needs_input",
+      "prepared",
+      "drafting_pr",
+      "pr_created",
+      "failed"
+    ]);
+    PushPreferencesSchema = z6.array(PushKindSchema).max(7);
+    PushPublicKeySchema = z6.string().regex(/^[a-f0-9]{64}$/);
+    PushInstallationSchema = z6.object({ installationId: z6.string().uuid(), token: z6.string().regex(/^[a-f0-9]{64}$/) }).strict();
+    PushRegistrationSchema = z6.object({
+      expoToken: z6.string().regex(/^(Expo|Exponent)PushToken\[[A-Za-z0-9_-]+\]$/),
+      preferences: PushPreferencesSchema
+    }).strict();
+    PushEnrollmentSchema = z6.object({ serverId: z6.string().uuid(), publicKey: PushPublicKeySchema }).strict();
+    PushGrantSchema = PushEnrollmentSchema.extend({
+      installationId: z6.string().uuid(),
+      bindingId: z6.string().uuid(),
+      grant: z6.string().regex(/^[a-f0-9]{64}$/),
+      expiresAt: z6.number()
+    }).strict();
+    PushPullRequestUrlSchema = z6.string().max(512).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/);
+    PushEventSchema = z6.object({
+      eventId: z6.string().uuid(),
+      sessionId: z6.string().uuid(),
+      kind: PushKindSchema,
+      taskTitle: z6.string().trim().min(1).max(160).optional(),
+      prUrl: PushPullRequestUrlSchema.optional()
+    }).strict();
+    PushSignedRequestSchema = z6.object({
+      bindingId: z6.string().uuid(),
+      timestamp: z6.number().int(),
+      nonce: z6.string().uuid(),
+      payload: z6.string().max(2048),
+      signature: z6.string().regex(/^[a-f0-9]{128}$/)
+    }).strict();
+    PushEntitlementSchema = z6.object({ active: z6.boolean(), expiresAt: z6.number().nullable() }).strict();
+    PushServerStatusSchema = z6.object({
+      publicKey: PushPublicKeySchema,
+      bindings: z6.array(
+        z6.object({
+          bindingId: z6.string().uuid(),
+          installationId: z6.string().uuid(),
+          deviceId: z6.string().uuid()
+        })
+      ),
+      pending: z6.number().int().nonnegative(),
+      error: z6.string().nullable()
+    });
+  }
+});
+
+// src/push.ts
+import {
+  generateKeyPairSync,
+  createPrivateKey,
+  createPublicKey,
+  sign,
+  randomUUID
+} from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path4 from "node:path";
+import { Effect as Effect3 } from "effect";
+function pushKind(session, previous) {
+  if (session.gitDelivery?.status === "pr_opened" && previous?.gitDelivery?.status !== "pr_opened")
+    return "pr_created";
+  if (["merged", "no_changes"].includes(session.gitDelivery?.status ?? "") && session.gitDelivery?.status !== previous?.gitDelivery?.status)
+    return "completed";
+  if (session.gitDelivery?.status === "failed" && previous?.gitDelivery?.status !== "failed")
+    return "failed";
+  if (session.gitDelivery?.stage === "opening_pr" && previous?.gitDelivery?.stage !== "opening_pr")
+    return "drafting_pr";
+  if (session.preparation?.status === "ready" && previous?.preparation?.status !== "ready")
+    return "prepared";
+  if (session.status === previous?.status) return void 0;
+  switch (session.status) {
+    case "running":
+      return "started";
+    case "completed":
+      return session.gitFlow ? void 0 : "completed";
+    case "waiting_for_input":
+      return "needs_input";
+    case "failed":
+      return "failed";
+    default:
+      return void 0;
+  }
+}
+function registerPushRoutes(app2, push2, security2) {
+  function deviceId(authorization) {
+    const device = security2.authenticate((authorization ?? "").slice(7));
+    if (!device) throw new Error("Pair this device");
+    return device.id;
+  }
+  app2.get("/api/push", (request) => push2.status(deviceId(request.headers.authorization)));
+  app2.post("/api/push/bind", async (request, reply) => {
+    const grant = PushGrantSchema.safeParse(request.body);
+    if (!grant.success) return reply.code(400).send({ error: "Invalid notification enrolment" });
+    try {
+      return await push2.bind(grant.data, deviceId(request.headers.authorization));
+    } catch {
+      return reply.code(400).send({ error: "Could not enable notifications. Check your subscription and try again." });
+    }
+  });
+  app2.delete("/api/push/bind", (request) => {
+    push2.unbind(deviceId(request.headers.authorization));
+    return { disabled: true };
+  });
+}
+var ServerPush;
+var init_push2 = __esm({
+  "src/push.ts"() {
+    "use strict";
+    init_push();
+    ServerPush = class {
+      constructor(store2, serverId, directory, transport = fetch, apiUrl = PUSH_API_URL) {
+        this.store = store2;
+        this.serverId = serverId;
+        this.transport = transport;
+        this.apiUrl = apiUrl;
+        mkdirSync(directory, { recursive: true, mode: 448 });
+        const filename = path4.join(directory, "push-signing-key.pem");
+        if (!existsSync(filename))
+          writeFileSync(
+            filename,
+            generateKeyPairSync("ed25519").privateKey.export({ format: "pem", type: "pkcs8" }),
+            { mode: 384, flag: "wx" }
+          );
+        this.key = createPrivateKey(readFileSync(filename));
+        this.publicKey = createPublicKey(this.key).export({ format: "der", type: "spki" }).subarray(-32).toString("hex");
+      }
+      store;
+      serverId;
+      transport;
+      apiUrl;
+      key;
+      publicKey;
+      draining;
+      timer;
+      stopped = false;
+      pending(session, previous) {
+        const kind = pushKind(session, previous);
+        const state = Effect3.runSync(this.store.pushState());
+        if (!kind || !state.bindings.length) return void 0;
+        return {
+          eventId: randomUUID(),
+          sessionId: session.id,
+          kind,
+          taskTitle: session.title.replace(/[\r\n\t]+/g, " ").trim().slice(0, 160) || void 0,
+          prUrl: kind === "pr_created" ? PushPullRequestUrlSchema.safeParse(session.gitDelivery?.url).data : void 0,
+          remaining: state.bindings,
+          createdAt: Date.now(),
+          attempts: 0,
+          nextAt: Date.now()
+        };
+      }
+      status(deviceId) {
+        const state = Effect3.runSync(this.store.pushState());
+        return {
+          publicKey: this.publicKey,
+          bindings: state.bindings.filter((binding) => binding.deviceId === deviceId),
+          pending: Effect3.runSync(this.store.pendingPush()).length,
+          error: state.error
+        };
+      }
+      async send(installationId, bindingId, operation, payload) {
+        const request = { bindingId, timestamp: Date.now(), nonce: randomUUID(), payload };
+        const signature = sign(
+          null,
+          Buffer.from(pushSigningText(installationId, operation, request)),
+          this.key
+        ).toString("hex");
+        return this.transport(`${this.apiUrl}/v1/installations/${installationId}/${operation}`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ ...request, signature }),
+          signal: AbortSignal.timeout(1e4),
+          redirect: "error"
+        });
+      }
+      async bind(grant, deviceId) {
+        if (grant.serverId !== this.serverId || grant.publicKey !== this.publicKey || grant.expiresAt <= Date.now())
+          throw new Error("Grant does not match this server or has expired");
+        const existing = Effect3.runSync(this.store.pushState());
+        if (existing.bindings.length >= 10 && !existing.bindings.some((binding) => binding.deviceId === deviceId))
+          throw new Error("Server notification binding limit reached");
+        const response = await this.send(
+          grant.installationId,
+          grant.bindingId,
+          "redeem",
+          JSON.stringify({ grant: grant.grant })
+        );
+        if (!response.ok)
+          throw new Error("Notification enrolment failed; enable push again to obtain a fresh grant");
+        const state = Effect3.runSync(this.store.pushState());
+        state.bindings = state.bindings.filter((binding) => binding.deviceId !== deviceId);
+        state.bindings.push({
+          installationId: grant.installationId,
+          bindingId: grant.bindingId,
+          deviceId
+        });
+        state.error = null;
+        await Effect3.runPromise(this.store.savePushState(state));
+        return this.status(deviceId);
+      }
+      unbind(deviceId) {
+        const state = Effect3.runSync(this.store.pushState());
+        state.bindings = state.bindings.filter((binding) => binding.deviceId !== deviceId);
+        Effect3.runSync(this.store.savePushState(state));
+      }
+      start() {
+        this.timer = setInterval(() => void this.flush(), 5e3);
+        this.timer.unref();
+        void this.flush();
+      }
+      flush() {
+        if (this.stopped) return Promise.resolve();
+        this.draining ??= this.drain().catch(() => {
+          const state = Effect3.runSync(this.store.pushState());
+          state.error = "Notification delivery temporarily unavailable";
+          Effect3.runSync(this.store.savePushState(state));
+        }).finally(() => {
+          this.draining = void 0;
+        });
+        return this.draining;
+      }
+      async drain() {
+        for (const job of Effect3.runSync(this.store.pendingPush())) {
+          if (job.createdAt + 36e5 < Date.now() || job.attempts >= 12) {
+            Effect3.runSync(this.store.removePush(job.eventId));
+            continue;
+          }
+          if (job.nextAt > Date.now()) continue;
+          const remaining = [];
+          for (const binding of job.remaining) {
+            const state2 = Effect3.runSync(this.store.pushState());
+            const device = Effect3.runSync(this.store.devices()).find(
+              (device2) => device2.id === binding.deviceId
+            );
+            if (!device || device.revokedAt !== null || !state2.bindings.some((current) => current.bindingId === binding.bindingId))
+              continue;
+            try {
+              const response = await this.send(
+                binding.installationId,
+                binding.bindingId,
+                "events",
+                JSON.stringify({
+                  eventId: job.eventId,
+                  sessionId: job.sessionId,
+                  kind: job.kind,
+                  taskTitle: job.taskTitle,
+                  prUrl: job.prUrl
+                })
+              );
+              if (response.ok) continue;
+              if ([401, 403, 404].includes(response.status)) {
+                this.unbind(binding.deviceId);
+                continue;
+              }
+              remaining.push(binding);
+            } catch {
+              remaining.push(binding);
+            }
+          }
+          if (!remaining.length) Effect3.runSync(this.store.removePush(job.eventId));
+          else
+            Effect3.runSync(
+              this.store.savePendingPush({
+                ...job,
+                remaining,
+                attempts: job.attempts + 1,
+                nextAt: Date.now() + Math.min(3e5, 5e3 * 2 ** job.attempts)
+              })
+            );
+          const state = Effect3.runSync(this.store.pushState());
+          state.error = remaining.length ? "Notification delivery pending; check subscription and connectivity" : null;
+          Effect3.runSync(this.store.savePushState(state));
+        }
+      }
+      async close() {
+        this.stopped = true;
+        clearInterval(this.timer);
+        await this.draining;
+      }
+    };
+  }
+});
+
 // src/attachments.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { createReadStream, createWriteStream } from "node:fs";
 import { mkdir as mkdir3, readFile as readFile2, rm, stat as stat2, readdir } from "node:fs/promises";
-import path4 from "node:path";
+import path5 from "node:path";
 import { pipeline } from "node:stream/promises";
 import sharp from "sharp";
-import { Context, Data, Effect as Effect3, Layer } from "effect";
-import { z as z6 } from "zod";
+import { Context, Data, Effect as Effect4, Layer } from "effect";
+import { z as z7 } from "zod";
 var AttachmentError, textExtensions, imageMimes, AttachmentFiles, Attachments;
 var init_attachments = __esm({
   "src/attachments.ts"() {
@@ -790,10 +1299,10 @@ var init_attachments = __esm({
       root;
       store;
       directory(id) {
-        return path4.join(this.root, z6.string().uuid().parse(id));
+        return path5.join(this.root, z7.string().uuid().parse(id));
       }
       io(operation) {
-        return Effect3.tryPromise({
+        return Effect4.tryPromise({
           try: operation,
           catch: (cause) => new AttachmentError({
             message: cause instanceof Error ? cause.message : "Attachment operation failed."
@@ -802,12 +1311,12 @@ var init_attachments = __esm({
       }
       upload(projectId, part) {
         return this.io(async () => {
-          const id = randomUUID();
+          const id = randomUUID2();
           const directory = this.directory(id);
-          const source = path4.join(directory, "source");
-          const nameField = z6.object({ type: z6.literal("field"), value: z6.string() }).safeParse(part.fields.name);
+          const source = path5.join(directory, "source");
+          const nameField = z7.object({ type: z7.literal("field"), value: z7.string() }).safeParse(part.fields.name);
           const originalName = nameField.success ? nameField.data.value : part.filename;
-          const name = path4.basename(originalName.replaceAll("\\", "/")).replace(new RegExp("\\p{Cc}", "gu"), "").slice(0, 180) || "attachment";
+          const name = path5.basename(originalName.replaceAll("\\", "/")).replace(new RegExp("\\p{Cc}", "gu"), "").slice(0, 180) || "attachment";
           await mkdir3(directory, { recursive: true });
           try {
             await pipeline(part.file, createWriteStream(source, { flags: "wx" }));
@@ -823,7 +1332,7 @@ var init_attachments = __esm({
               ...metadata,
               createdAt: (/* @__PURE__ */ new Date()).toISOString()
             });
-            await Effect3.runPromise(this.store.saveAttachment(attachment));
+            await Effect4.runPromise(this.store.saveAttachment(attachment));
             return attachment;
           } catch (error) {
             await rm(directory, { recursive: true, force: true });
@@ -835,10 +1344,10 @@ var init_attachments = __esm({
         const metadata = await sharp(source, { limitInputPixels: 4e7 }).metadata().catch(() => null);
         const mimeType = metadata?.format && imageMimes.get(metadata.format);
         if (mimeType) {
-          await sharp(source, { limitInputPixels: 4e7 }).rotate().resize({ width: 2048, height: 2048, fit: "inside", withoutEnlargement: true }).png().toFile(path4.join(path4.dirname(source), "preview.png"));
+          await sharp(source, { limitInputPixels: 4e7 }).rotate().resize({ width: 2048, height: 2048, fit: "inside", withoutEnlargement: true }).png().toFile(path5.join(path5.dirname(source), "preview.png"));
           return { kind: "image", mimeType };
         }
-        if (!textExtensions.has(path4.extname(name).toLowerCase()))
+        if (!textExtensions.has(path5.extname(name).toLowerCase()))
           throw new Error(
             "Choose a PNG, JPEG, WebP, GIF, or text/code file. PDF and Office documents aren't supported yet."
           );
@@ -854,12 +1363,12 @@ var init_attachments = __esm({
             throw new Error("Choose up to five different files.");
           const attachments2 = [];
           for (const id of ids) {
-            const attachment = await Effect3.runPromise(this.store.getAttachment(id));
+            const attachment = await Effect4.runPromise(this.store.getAttachment(id));
             if (!attachment || attachment.projectId !== projectId)
               throw new Error(
                 "An attachment is unavailable for this project. Remove it and upload it again."
               );
-            await stat2(path4.join(this.directory(id), "source"));
+            await stat2(path5.join(this.directory(id), "source"));
             attachments2.push(attachment);
           }
           return attachments2;
@@ -867,7 +1376,7 @@ var init_attachments = __esm({
       }
       content(attachment, preview) {
         return createReadStream(
-          path4.join(
+          path5.join(
             this.directory(attachment.id),
             preview && attachment.kind === "image" ? "preview.png" : "source"
           )
@@ -878,9 +1387,9 @@ var init_attachments = __esm({
           const images = [];
           const sections = [];
           for (const attachment of attachments2) {
-            const source = path4.join(this.directory(attachment.id), "source");
+            const source = path5.join(this.directory(attachment.id), "source");
             if (attachment.kind === "image") {
-              const bytes = await readFile2(path4.join(this.directory(attachment.id), "preview.png"));
+              const bytes = await readFile2(path5.join(this.directory(attachment.id), "preview.png"));
               images.push({ type: "image", data: bytes.toString("base64"), mimeType: "image/png" });
               sections.push(`Image attachment: ${JSON.stringify(attachment.name)}`);
             } else {
@@ -903,18 +1412,18 @@ ${text.slice(0, 12e3)}${text.length > 12e3 ? "\n[Preview truncated; use the read
       cleanup() {
         return this.io(async () => {
           const cutoff = Date.now() - 24 * 60 * 60 * 1e3;
-          const expired = await Effect3.runPromise(
+          const expired = await Effect4.runPromise(
             this.store.expiredAttachments(new Date(cutoff).toISOString())
           );
           for (const attachment of expired) {
-            if (await Effect3.runPromise(this.store.deleteAttachment(attachment.id)))
+            if (await Effect4.runPromise(this.store.deleteAttachment(attachment.id)))
               await rm(this.directory(attachment.id), { recursive: true, force: true });
           }
           await mkdir3(this.root, { recursive: true });
           for (const entry of await readdir(this.root, { withFileTypes: true })) {
-            if (!entry.isDirectory() || !z6.string().uuid().safeParse(entry.name).success) continue;
+            if (!entry.isDirectory() || !z7.string().uuid().safeParse(entry.name).success) continue;
             const directory = this.directory(entry.name);
-            if ((await stat2(directory)).mtimeMs < cutoff && !await Effect3.runPromise(this.store.getAttachment(entry.name)))
+            if ((await stat2(directory)).mtimeMs < cutoff && !await Effect4.runPromise(this.store.getAttachment(entry.name)))
               await rm(directory, { recursive: true, force: true });
           }
         });
@@ -1000,24 +1509,24 @@ var init_event_server = __esm({
 });
 
 // src/security.ts
-import { createHash, randomBytes, randomInt, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
-import { Effect as Effect4 } from "effect";
-import { z as z7 } from "zod";
+import { createHash, randomBytes, randomInt, randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
+import { Effect as Effect5 } from "effect";
+import { z as z8 } from "zod";
 async function registerSecurity(app2, security2, version, allowedOrigins2) {
   app2.addHook("onRequest", async (request, reply) => {
-    const path11 = new URL(request.url, "http://localhost");
+    const path13 = new URL(request.url, "http://localhost");
     reply.header("Cache-Control", "no-store");
     if (request.method === "OPTIONS") return;
     if (request.headers.origin && !allowedOrigins2.includes(request.headers.origin))
       return reply.code(403).send({ error: "Browser origin is not allowed." });
-    if (path11.pathname === "/health" || path11.pathname === "/api/auth/pair" && request.method === "POST")
+    if (path13.pathname === "/health" || path13.pathname === "/api/auth/pair" && request.method === "POST")
       return;
     const authorization = request.headers.authorization ?? "";
     const token = authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
-    const asset = request.method === "GET" && /^\/api\/projects\/[^/]+\/attachments\/[^/]+\/content$/.test(path11.pathname);
-    const ticket = path11.searchParams.get("ticket");
-    path11.searchParams.delete("ticket");
-    if (!security2.authenticate(token) && !(asset && ticket && security2.redeemTicket(ticket, path11.pathname + path11.search, false)))
+    const asset = request.method === "GET" && /^\/api\/projects\/[^/]+\/attachments\/[^/]+\/content$/.test(path13.pathname);
+    const ticket = path13.searchParams.get("ticket");
+    path13.searchParams.delete("ticket");
+    if (!security2.authenticate(token) && !(asset && ticket && security2.redeemTicket(ticket, path13.pathname + path13.search, false)))
       return reply.code(401).send({ error: "Pair this device with your server.", code: "UNAUTHORIZED" });
     if (!asset && request.headers["x-agentrific-protocol"] !== String(PROTOCOL_VERSION))
       return reply.code(409).send({
@@ -1041,6 +1550,29 @@ async function registerSecurity(app2, security2, version, allowedOrigins2) {
     const result = await security2.pair(input.data, request.ip);
     return result ?? reply.code(401).send({ error: "Pairing expired, locked, or invalid. Run agentrific pair again." });
   });
+  app2.post("/api/auth/pairing-invitation", (_request, reply) => {
+    const publicUrl = process.env.AGENTRIFIC_PUBLIC_URL;
+    if (!publicUrl)
+      return reply.code(503).send({
+        error: "Configure the server\u2019s public HTTPS URL and restart the server before pairing a device."
+      });
+    let url;
+    try {
+      url = pairingOrigin(publicUrl);
+    } catch {
+      return reply.code(503).send({ error: "The server\u2019s public URL is invalid. Configure a public HTTPS origin." });
+    }
+    try {
+      const grant = security2.createPairing();
+      return {
+        payload: { v: 1, url, serverId: grant.serverId, pairingId: grant.pairingId },
+        pin: grant.pin,
+        expiresAt: grant.expiresAt
+      };
+    } catch {
+      return reply.code(429).send({ error: "Too many pending pairing codes. Wait five minutes and try again." });
+    }
+  });
   app2.get("/api/auth/session", (request) => ({
     serverId: security2.serverId,
     device: security2.authenticate((request.headers.authorization ?? "").slice(7))
@@ -1049,8 +1581,8 @@ async function registerSecurity(app2, security2, version, allowedOrigins2) {
     ticket: security2.ticket((request.headers.authorization ?? "").slice(7), "/api/events")
   }));
   app2.post("/api/auth/asset-ticket", (request, reply) => {
-    const input = z7.object({
-      path: z7.string().regex(/^\/api\/projects\/[^/?]+\/attachments\/[^/?]+\/content(?:\?preview=1)?$/)
+    const input = z8.object({
+      path: z8.string().regex(/^\/api\/projects\/[^/?]+\/attachments\/[^/?]+\/content(?:\?preview=1)?$/)
     }).safeParse(request.body);
     if (!input.success) return reply.code(400).send({ error: "Choose a valid attachment." });
     return {
@@ -1063,6 +1595,7 @@ var init_security = __esm({
   "src/security.ts"() {
     "use strict";
     init_src();
+    init_pairing();
     secret = () => randomBytes(32).toString("hex");
     digest = (value) => createHash("sha256").update(value).digest("hex");
     ServerSecurity = class {
@@ -1112,36 +1645,36 @@ var init_security = __esm({
         const token = secret();
         const now = Date.now();
         const device = {
-          id: randomUUID2(),
+          id: randomUUID3(),
           name: input.deviceName,
           platform: input.platform,
           createdAt: now,
           lastSeenAt: now,
           revokedAt: null
         };
-        await Effect4.runPromise(this.store.saveDevice(device, digest(token)));
+        await Effect5.runPromise(this.store.saveDevice(device, digest(token)));
         return { deviceId: device.id, deviceToken: token, serverId: this.serverId };
       }
       authenticate(token) {
         if (!/^[a-f0-9]{64}$/.test(token)) return void 0;
-        return Effect4.runSync(this.store.deviceForToken(digest(token)));
+        return Effect5.runSync(this.store.deviceForToken(digest(token)));
       }
-      ticket(token, path11) {
+      ticket(token, path13) {
         this.prune();
         if (!this.authenticate(token) || this.tickets.size >= 1e4) return void 0;
         const value = secret();
-        this.tickets.set(value, { tokenHash: digest(token), expiresAt: Date.now() + 6e4, path: path11 });
+        this.tickets.set(value, { tokenHash: digest(token), expiresAt: Date.now() + 6e4, path: path13 });
         return value;
       }
-      redeemTicket(value, path11, consume = true) {
+      redeemTicket(value, path13, consume = true) {
         this.prune();
         const ticket = this.tickets.get(value);
-        if (!ticket || ticket.path !== path11) return void 0;
+        if (!ticket || ticket.path !== path13) return void 0;
         if (consume) this.tickets.delete(value);
-        return Effect4.runSync(this.store.deviceForToken(ticket.tokenHash));
+        return Effect5.runSync(this.store.deviceForToken(ticket.tokenHash));
       }
       async revoke(id) {
-        const revoked = await Effect4.runPromise(this.store.revokeDevice(id));
+        const revoked = await Effect5.runPromise(this.store.revokeDevice(id));
         for (const [socket, owner] of this.sockets)
           if (owner === id) socket.close(4401, "Device revoked");
         return revoked;
@@ -1195,9 +1728,9 @@ var init_maintenance = __esm({
       }
       attach(app2) {
         app2.addHook("onRequest", async (request, reply) => {
-          const path11 = request.url.split("?")[0];
+          const path13 = request.url.split("?")[0];
           if (["GET", "HEAD", "OPTIONS"].includes(request.method)) return;
-          const allowed = path11.startsWith("/api/auth/") || /^\/api\/sessions\/[^/]+\/stop$/.test(path11);
+          const allowed = path13.startsWith("/api/auth/") || /^\/api\/sessions\/[^/]+\/stop$/.test(path13);
           if (this.paused && !allowed)
             return reply.code(503).send({ code: "MAINTENANCE", error: new MaintenanceError().message });
           this.requests.add(request.id);
@@ -1211,22 +1744,27 @@ var init_maintenance = __esm({
 });
 
 // src/tasks.ts
-import { Effect as Effect5, Semaphore } from "effect";
+import { Effect as Effect6, Semaphore } from "effect";
 function withTaskLock(id, operation) {
   let lock = locks.get(id);
   if (!lock) {
     lock = Semaphore.makeUnsafe(1);
     locks.set(id, lock);
   }
-  return Effect5.runPromise(
+  return Effect6.runPromise(
     lock.withPermit(
-      Effect5.tryPromise({
+      Effect6.tryPromise({
         try: operation,
         catch: (cause) => cause
       })
     )
   );
 }
+async function sessionTaskLockId(store2, session) {
+  if (session.taskId) return session.taskId;
+  const tasks = await Effect6.runPromise(store2.listTasks(session.projectId, true));
+  return tasks.find((task) => task.sessionId === session.id)?.id ?? `session-${session.id}`;
+}
 function taskStatusForSession(status, session) {
   if (session?.gitDelivery?.status === "pending") return "running";
   if (status === "completed" && session?.gitFlow && !["merged", "no_changes", "pr_opened"].includes(session.gitDelivery?.status ?? ""))
@@ -1263,8 +1801,8 @@ function sessionTask(session) {
   });
 }
 async function boardTasks(store2, projectId) {
-  const tasks = await Effect5.runPromise(store2.listTasks(projectId, true));
-  const sessions = await Effect5.runPromise(store2.list());
+  const tasks = await Effect6.runPromise(store2.listTasks(projectId, true));
+  const sessions = await Effect6.runPromise(store2.list());
   const linkedSessionIds = new Set(
     tasks.flatMap((task) => task.sessionId ? [task.sessionId] : [])
   );
@@ -1283,10 +1821,10 @@ async function boardTasks(store2, projectId) {
   return [...linkedTasks, ...legacyTasks].map((task) => TaskSchema.parse(task)).sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
 }
 async function findTask(store2, id) {
-  const saved = await Effect5.runPromise(store2.getTask(id));
+  const saved = await Effect6.runPromise(store2.getTask(id));
   if (saved?.deletedAt) throw new TaskActionError("Task not found.", 404);
   if (saved) return saved;
-  const session = id.startsWith("session-") ? await Effect5.runPromise(store2.get(id.slice("session-".length))) : void 0;
+  const session = id.startsWith("session-") ? await Effect6.runPromise(store2.get(id.slice("session-".length))) : void 0;
   if (!session || session.taskId) throw new TaskActionError("Task not found.", 404);
   return sessionTask(session);
 }
@@ -1302,7 +1840,7 @@ function editTask(store2, id, input, resolveAttachments) {
         throw new TaskActionError("Attachment validation is unavailable.", 400);
       files = await resolveAttachments(task.projectId, attachmentIds);
     }
-    return Effect5.runPromise(
+    return Effect6.runPromise(
       store2.saveTask({
         ...task,
         ...updates2,
@@ -1313,16 +1851,25 @@ function editTask(store2, id, input, resolveAttachments) {
     );
   });
 }
-function deleteTask(store2, id) {
+function deleteTask(store2, id, cleanup = async () => {
+}) {
   return withTaskLock(id, async () => {
     const task = await findTask(store2, id);
-    const sessions = await Effect5.runPromise(store2.list());
+    const sessions = await Effect6.runPromise(store2.list());
     if (sessions.some(
       (session) => (session.taskId === task.id || session.id === task.sessionId) && (["starting", "running", "queued"].includes(session.status) || session.gitDelivery?.status === "pending")
     ))
       throw new TaskActionError("Stop the task's running agent before deleting it.", 409);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    await Effect5.runPromise(store2.saveTask({ ...task, deletedAt: now, updatedAt: now }));
+    const associated = sessions.filter(
+      (session) => session.taskId === task.id || session.id === task.sessionId
+    );
+    for (const session of associated) await cleanup(session);
+    await Effect6.runPromise(
+      store2.purgeTask(
+        task.id,
+        associated.map((session) => session.id)
+      )
+    );
   });
 }
 var TaskActionError, locks;
@@ -1342,7 +1889,7 @@ var init_tasks = __esm({
 });
 
 // src/automation.ts
-import { Effect as Effect6 } from "effect";
+import { Effect as Effect7 } from "effect";
 function activeAgents(sessions) {
   return sessions.filter(
     (session) => ["starting", "running", "queued"].includes(session.status) || session.gitDelivery?.status === "pending"
@@ -1371,18 +1918,18 @@ var init_automation = __esm({
       start;
       canStart;
       async snapshot() {
-        const state = await Effect6.runPromise(this.store.automation());
+        const state = await Effect7.runPromise(this.store.automation());
         return {
           ...state,
           queue: automationQueue(await boardTasks(this.store), state),
-          active: activeAgents(await Effect6.runPromise(this.store.list()))
+          active: activeAgents(await Effect7.runPromise(this.store.list()))
         };
       }
       // ponytail: one server process owns this SQLite database; use a durable lease before adding replicas.
       configure(config) {
         return withTaskLock("automation", async () => {
-          const state = await Effect6.runPromise(this.store.automation());
-          await Effect6.runPromise(this.store.saveAutomation({ ...state, config, error: null }));
+          const state = await Effect7.runPromise(this.store.automation());
+          await Effect7.runPromise(this.store.saveAutomation({ ...state, config, error: null }));
           return this.snapshot();
         });
       }
@@ -1394,7 +1941,7 @@ var init_automation = __esm({
             throw new TaskActionError("Queue changed. Refresh and try again.", 409);
           const order = ids.filter((id) => id !== taskId);
           order.splice(beforeId === null ? order.length : order.indexOf(beforeId), 0, taskId);
-          await Effect6.runPromise(
+          await Effect7.runPromise(
             this.store.saveAutomation({
               config: snapshot.config,
               lastMinute: snapshot.lastMinute,
@@ -1407,22 +1954,22 @@ var init_automation = __esm({
       }
       tick(now = /* @__PURE__ */ new Date()) {
         return withTaskLock("automation", async () => {
-          let state = await Effect6.runPromise(this.store.automation());
+          let state = await Effect7.runPromise(this.store.automation());
           const minute = now.toISOString().slice(0, 16);
           if (!this.canStart() || !state.config.enabled || state.lastMinute !== null && state.lastMinute >= minute || !cronMatches(state.config.cron, now))
             return;
           state = { ...state, lastMinute: minute, error: null };
-          await Effect6.runPromise(this.store.saveAutomation(state));
+          await Effect7.runPromise(this.store.saveAutomation(state));
           const queue = automationQueue(await boardTasks(this.store), state);
           for (const task of queue) {
             if (!this.canStart()) break;
-            if (activeAgents(await Effect6.runPromise(this.store.list())) >= state.config.parallelism)
+            if (activeAgents(await Effect7.runPromise(this.store.list())) >= state.config.parallelism)
               break;
             try {
               await this.start(task.id);
             } catch (error) {
               if (error instanceof MaintenanceError) break;
-              await Effect6.runPromise(
+              await Effect7.runPromise(
                 this.store.saveAutomation({
                   ...state,
                   config: { ...state.config, enabled: false },
@@ -1453,9 +2000,9 @@ var init_git_flow = __esm({
 });
 
 // src/runtime.ts
-import path5 from "node:path";
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { Context as Context2, Data as Data2, Effect as Effect7, Fiber, Layer as Layer2, Semaphore as Semaphore2 } from "effect";
+import path6 from "node:path";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { Context as Context2, Data as Data2, Effect as Effect8, Fiber, Layer as Layer2, Semaphore as Semaphore2 } from "effect";
 var AgentError, AgentController, AgentSessions;
 var init_runtime = __esm({
   "src/runtime.ts"() {
@@ -1500,20 +2047,20 @@ var init_runtime = __esm({
         this.emit({ type: "session.updated", session: entry.session });
       }
       operation(action) {
-        return Effect7.tryPromise({
+        return Effect8.tryPromise({
           try: action,
           catch: (cause) => new AgentError({ message: String(cause), cause })
         });
       }
       open(session) {
-        return Effect7.gen({ self: this }, function* () {
+        return Effect8.gen({ self: this }, function* () {
           const existing = this.active.get(session.id);
           if (existing) return existing;
-          const agent = yield* Effect7.tryPromise({
+          const agent = yield* Effect8.tryPromise({
             try: () => this.factory.open(
               session.id,
-              session.workspacePath ?? path5.join(this.worktreesRoot, session.id),
-              path5.join(this.sessionsRoot, session.id),
+              session.workspacePath ?? path6.join(this.worktreesRoot, session.id),
+              path6.join(this.sessionsRoot, session.id),
               session.model,
               session
             ),
@@ -1536,14 +2083,14 @@ var init_runtime = __esm({
         });
       }
       run(entry, message) {
-        return Effect7.gen({ self: this }, function* () {
+        return Effect8.gen({ self: this }, function* () {
           let next = message;
           while (next !== void 0) {
             const current = next;
             yield* this.operation(
               () => entry.agent.prompt(gitFlowPrompt(entry.session, current.text), current.attachments)
             );
-            next = yield* Effect7.sync(() => {
+            next = yield* Effect8.sync(() => {
               const queued = entry.stopping ? void 0 : entry.pending.shift();
               if (queued === void 0) {
                 entry.running = false;
@@ -1555,19 +2102,19 @@ var init_runtime = __esm({
               yield* this.operation(() => this.onSettled(entry.session));
           }
         }).pipe(
-          Effect7.catch(
-            (error) => Effect7.sync(() => {
+          Effect8.catch(
+            (error) => Effect8.sync(() => {
               entry.pending.length = 0;
               entry.running = false;
               this.emit({ type: "error", sessionId: entry.session.id, message: error.message });
               this.status(entry, entry.stopping ? "stopped" : "failed");
             })
           ),
-          Effect7.onInterrupt(
+          Effect8.onInterrupt(
             () => this.operation(() => entry.agent.abort()).pipe(
-              Effect7.orDie,
-              Effect7.ensuring(
-                Effect7.sync(() => {
+              Effect8.orDie,
+              Effect8.ensuring(
+                Effect8.sync(() => {
                   entry.pending.length = 0;
                   entry.running = false;
                   this.status(entry, "stopped");
@@ -1575,16 +2122,16 @@ var init_runtime = __esm({
               )
             )
           ),
-          Effect7.ensuring(Effect7.sync(() => this.working.delete(entry.session.id)))
+          Effect8.ensuring(Effect8.sync(() => this.working.delete(entry.session.id)))
         );
       }
-      send(session, message, attachments2 = [], messageId = randomUUID3()) {
+      send(session, message, attachments2 = [], messageId = randomUUID4()) {
         return this.lock(session.id).withPermit(
-          Effect7.gen({ self: this }, function* () {
+          Effect8.gen({ self: this }, function* () {
             if (this.closed)
-              return yield* Effect7.fail(new AgentError({ message: "Server is shutting down" }));
+              return yield* Effect8.fail(new AgentError({ message: "Server is shutting down" }));
             if (!session.branch && (session.gitFlow || !session.workspacePath))
-              return yield* Effect7.fail(new AgentError({ message: "Session checkout is not ready" }));
+              return yield* Effect8.fail(new AgentError({ message: "Session checkout is not ready" }));
             if (this.hasMessage(session.id, messageId)) return;
             const entry = yield* this.open(session);
             yield* this.operation(async () => entry.agent.validateAttachments?.(attachments2));
@@ -1603,7 +2150,7 @@ var init_runtime = __esm({
             entry.stopping = false;
             this.status(entry, "running");
             this.working.add(session.id);
-            entry.fiber = yield* Effect7.forkIn(
+            entry.fiber = yield* Effect8.forkIn(
               this.run(entry, { text: message, attachments: attachments2 }),
               this.scope,
               {
@@ -1611,22 +2158,22 @@ var init_runtime = __esm({
               }
             );
           })
-        ).pipe(Effect7.uninterruptible);
+        ).pipe(Effect8.uninterruptible);
       }
       setModel(session, model) {
         return this.lock(session.id).withPermit(
-          Effect7.gen({ self: this }, function* () {
+          Effect8.gen({ self: this }, function* () {
             if (this.closed)
-              return yield* Effect7.fail(new AgentError({ message: "Server is shutting down" }));
+              return yield* Effect8.fail(new AgentError({ message: "Server is shutting down" }));
             const entry = yield* this.open(session);
             if (entry.running || entry.pending.length)
-              return yield* Effect7.fail(
+              return yield* Effect8.fail(
                 new AgentError({
                   message: "Wait for this reply to finish before changing the model."
                 })
               );
             if (!entry.agent.setModel)
-              return yield* Effect7.fail(
+              return yield* Effect8.fail(
                 new AgentError({ message: "This agent does not support model selection." })
               );
             yield* this.operation(() => entry.agent.setModel(model));
@@ -1638,10 +2185,10 @@ var init_runtime = __esm({
             this.emit({ type: "session.updated", session: entry.session });
             return entry.session;
           })
-        ).pipe(Effect7.uninterruptible);
+        ).pipe(Effect8.uninterruptible);
       }
       stopEntry(entry) {
-        return Effect7.gen({ self: this }, function* () {
+        return Effect8.gen({ self: this }, function* () {
           entry.stopping = true;
           entry.pending.length = 0;
           yield* this.operation(() => entry.agent.abort());
@@ -1651,7 +2198,7 @@ var init_runtime = __esm({
       }
       stop(session) {
         return this.lock(session.id).withPermit(
-          Effect7.gen({ self: this }, function* () {
+          Effect8.gen({ self: this }, function* () {
             const entry = this.active.get(session.id);
             if (entry) {
               yield* this.stopEntry(entry);
@@ -1662,14 +2209,26 @@ var init_runtime = __esm({
               });
             }
           })
-        ).pipe(Effect7.uninterruptible);
+        ).pipe(Effect8.uninterruptible);
+      }
+      forget(id) {
+        return this.lock(id).withPermit(
+          Effect8.sync(() => {
+            const entry = this.active.get(id);
+            if (!entry) return;
+            if (entry.running) throw new Error("Cannot delete an active run.");
+            entry.unsubscribe();
+            entry.agent.dispose();
+            this.active.delete(id);
+          })
+        );
       }
       close() {
-        return Effect7.gen({ self: this }, function* () {
+        return Effect8.gen({ self: this }, function* () {
           this.closed = true;
           for (const [id, lock] of this.locks) {
             yield* lock.withPermit(
-              Effect7.gen({ self: this }, function* () {
+              Effect8.gen({ self: this }, function* () {
                 const entry = this.active.get(id);
                 if (!entry) return;
                 if (entry.running) yield* this.stopEntry(entry);
@@ -1689,8 +2248,8 @@ var init_runtime = __esm({
       }) {
         return Layer2.effect(
           this,
-          Effect7.gen(function* () {
-            const scope = yield* Effect7.scope;
+          Effect8.gen(function* () {
+            const scope = yield* Effect8.scope;
             const controller = new AgentController(
               factory,
               emit,
@@ -1700,7 +2259,7 @@ var init_runtime = __esm({
               hasMessage,
               onSettled
             );
-            yield* Effect7.addFinalizer(() => controller.close().pipe(Effect7.orDie));
+            yield* Effect8.addFinalizer(() => controller.close().pipe(Effect8.orDie));
             return controller;
           })
         );
@@ -1757,17 +2316,17 @@ var init_workflow_command = __esm({
 });
 
 // src/workflow-schema.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var DeliveryJobSchema, PreparationJobSchema, WorkflowJobSchema;
 var init_workflow_schema = __esm({
   "src/workflow-schema.ts"() {
     "use strict";
     init_src();
-    DeliveryJobSchema = z8.object({
-      kind: z8.literal("delivery"),
-      sessionId: z8.string(),
+    DeliveryJobSchema = z9.object({
+      kind: z9.literal("delivery"),
+      sessionId: z9.string(),
       request: DeliveryRequestSchema,
-      phase: z8.enum([
+      phase: z9.enum([
         "validating",
         "drafting",
         "committing",
@@ -1777,25 +2336,25 @@ var init_workflow_schema = __esm({
         "opening_pr",
         "delivered"
       ]),
-      attempt: z8.number().int().positive(),
-      commitSha: z8.string().optional(),
-      title: z8.string(),
-      body: z8.string(),
-      logs: z8.string().default(""),
-      failed: z8.boolean().default(false),
-      result: z8.enum(["merged", "pr_opened", "no_changes"]).optional(),
-      url: z8.string().optional(),
-      message: z8.string().optional()
+      attempt: z9.number().int().positive(),
+      commitSha: z9.string().optional(),
+      title: z9.string(),
+      body: z9.string(),
+      logs: z9.string().default(""),
+      failed: z9.boolean().default(false),
+      result: z9.enum(["merged", "pr_opened", "no_changes"]).optional(),
+      url: z9.string().optional(),
+      message: z9.string().optional()
     });
-    PreparationJobSchema = z8.object({
-      kind: z8.literal("preparation"),
-      sessionId: z8.string(),
-      projectPath: z8.string(),
+    PreparationJobSchema = z9.object({
+      kind: z9.literal("preparation"),
+      sessionId: z9.string(),
+      projectPath: z9.string(),
       input: CreateSessionSchema,
-      stage: z8.enum(["creating", "installing", "ready", "failed"]),
-      logs: z8.string().default("")
+      stage: z9.enum(["creating", "installing", "ready", "failed"]),
+      logs: z9.string().default("")
     });
-    WorkflowJobSchema = z8.discriminatedUnion("kind", [
+    WorkflowJobSchema = z9.discriminatedUnion("kind", [
       DeliveryJobSchema,
       PreparationJobSchema
     ]);
@@ -1803,8 +2362,8 @@ var init_workflow_schema = __esm({
 });
 
 // src/delivery.ts
-import { Effect as Effect8 } from "effect";
-import { z as z9 } from "zod";
+import { Effect as Effect9 } from "effect";
+import { z as z10 } from "zod";
 var DeliveryCoordinator;
 var init_delivery = __esm({
   "src/delivery.ts"() {
@@ -1827,20 +2386,20 @@ var init_delivery = __esm({
         return [...this.workers.keys()].map((id) => `delivery:${id}`);
       }
       async session(id) {
-        const session = await Effect8.runPromise(this.store.get(id));
+        const session = await Effect9.runPromise(this.store.get(id));
         if (!session?.gitFlow || !session.branch || !session.workspacePath)
           throw new Error("This run does not have a ready Git flow workspace.");
         return session;
       }
       async job(id) {
-        const raw = await Effect8.runPromise(this.store.workflow(`delivery:${id}`));
+        const raw = await Effect9.runPromise(this.store.workflow(`delivery:${id}`));
         return raw === void 0 ? void 0 : DeliveryJobSchema.parse(raw);
       }
       git(session, args, signal) {
         return this.command(session.workspacePath, "git", args, signal);
       }
       async record(job) {
-        await Effect8.runPromise(this.store.saveWorkflow(`delivery:${job.sessionId}`, job));
+        await Effect9.runPromise(this.store.saveWorkflow(`delivery:${job.sessionId}`, job));
         const session = await this.session(job.sessionId);
         const delivery2 = {
           status: job.failed ? "failed" : job.result ?? "pending",
@@ -2029,7 +2588,7 @@ Agentrific run ${id}.`;
         return (await this.session(id)).gitDelivery;
       }
       async recover() {
-        const jobs = await Effect8.runPromise(this.store.workflows());
+        const jobs = await Effect9.runPromise(this.store.workflows());
         for (const raw of jobs) {
           const parsed = DeliveryJobSchema.safeParse(raw);
           if (!parsed.success) continue;
@@ -2103,11 +2662,11 @@ ${workflowError(error instanceof Error ? error : String(error))}`
                 "--json",
                 "url,state,headRefOid"
               ]);
-              const prs = z9.array(
-                z9.object({
-                  url: z9.string().url(),
-                  state: z9.string(),
-                  headRefOid: z9.string().optional()
+              const prs = z10.array(
+                z10.object({
+                  url: z10.string().url(),
+                  state: z10.string(),
+                  headRefOid: z10.string().optional()
                 })
               ).parse(JSON.parse(existing));
               const open = prs.find(
@@ -2151,9 +2710,9 @@ ${workflowError(error instanceof Error ? error : String(error))}`
 
 // src/preparation.ts
 import { mkdir as mkdir4, readFile as readFile3 } from "node:fs/promises";
-import path6 from "node:path";
-import { Effect as Effect9 } from "effect";
-import { z as z10 } from "zod";
+import path7 from "node:path";
+import { Effect as Effect10 } from "effect";
+import { z as z11 } from "zod";
 var PreparationCoordinator;
 var init_preparation = __esm({
   "src/preparation.ts"() {
@@ -2190,8 +2749,8 @@ var init_preparation = __esm({
             job.logs = workflowLog(`${job.logs}
 ${message}${logs ? `
 ${logs}` : ""}`);
-            await Effect9.runPromise(this.store.saveWorkflow(`preparation:${session.id}`, job));
-            const current = await Effect9.runPromise(this.store.get(session.id));
+            await Effect10.runPromise(this.store.saveWorkflow(`preparation:${session.id}`, job));
+            const current = await Effect10.runPromise(this.store.get(session.id));
             this.options.publish({
               type: "session.updated",
               session: {
@@ -2210,7 +2769,7 @@ ${logs}` : ""}`);
             await record("installing", "Installing run dependencies\u2026");
             await this.install(workspace, command);
             await record("ready", "Workspace ready.");
-            return await Effect9.runPromise(this.store.get(session.id));
+            return await Effect10.runPromise(this.store.get(session.id));
           } catch (error) {
             const step = job.stage === "installing" ? "Dependency installation failed" : "Workspace preparation failed";
             await record(
@@ -2254,7 +2813,7 @@ ${logs}` : ""}`);
         const workspace = session.workspacePath;
         if (branchAtWorkspace !== void 0)
           throw new Error("The run workspace already exists on a different branch.");
-        await mkdir4(path6.dirname(workspace), { recursive: true });
+        await mkdir4(path7.dirname(workspace), { recursive: true });
         try {
           await command(
             projectPath,
@@ -2274,12 +2833,12 @@ ${logs}` : ""}`);
         }
       }
       async install(workspace, command) {
-        const packageFile = await readFile3(path6.join(workspace, "package.json"), "utf8").catch(
+        const packageFile = await readFile3(path7.join(workspace, "package.json"), "utf8").catch(
           () => void 0
         );
         if (!packageFile) return;
-        const metadata = z10.object({ packageManager: z10.string().optional() }).parse(JSON.parse(packageFile));
-        const has = async (name) => readFile3(path6.join(workspace, name)).then(
+        const metadata = z11.object({ packageManager: z11.string().optional() }).parse(JSON.parse(packageFile));
+        const has = async (name) => readFile3(path7.join(workspace, name)).then(
           () => true,
           () => false
         );
@@ -2292,10 +2851,10 @@ ${logs}` : ""}`);
         else if (await has("package-lock.json")) await command(workspace, "npm", ["ci"]);
       }
       async retry(id) {
-        const raw = await Effect9.runPromise(this.store.workflow(`preparation:${id}`));
+        const raw = await Effect10.runPromise(this.store.workflow(`preparation:${id}`));
         const job = PreparationJobSchema.parse(raw);
         return withTaskLock(`repository:${job.projectPath}`, async () => {
-          const session = await Effect9.runPromise(this.store.get(id));
+          const session = await Effect10.runPromise(this.store.get(id));
           if (!session || session.preparation?.status !== "failed")
             throw new Error("This run does not need preparation retried.");
           const prepared = await this.prepare(session, job.projectPath, job.input);
@@ -2303,11 +2862,11 @@ ${logs}` : ""}`);
         });
       }
       async recover() {
-        for (const raw of await Effect9.runPromise(this.store.workflows())) {
+        for (const raw of await Effect10.runPromise(this.store.workflows())) {
           const parsed = PreparationJobSchema.safeParse(raw);
           if (!parsed.success) continue;
           const job = parsed.data;
-          const session = await Effect9.runPromise(this.store.get(job.sessionId));
+          const session = await Effect10.runPromise(this.store.get(job.sessionId));
           if (!session) continue;
           if (job.stage === "failed") {
             if (session.preparation?.status === "failed") continue;
@@ -2338,7 +2897,7 @@ ${logs}` : ""}`);
             });
             continue;
           }
-          await Effect9.runPromise(
+          await Effect10.runPromise(
             this.store.saveWorkflow(`preparation:${session.id}`, { ...job, stage: "failed" })
           );
           this.options.publish({
@@ -2362,7 +2921,7 @@ ${logs}` : ""}`);
 
 // src/delivery-writer.ts
 import { createAgentSession, SessionManager } from "@earendil-works/pi-coding-agent";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 function deliveryWriter(models2, createSession = createAgentSession) {
   return async (run, input, diff, signal) => {
     signal?.throwIfAborted();
@@ -2403,12 +2962,12 @@ var DraftSchema;
 var init_delivery_writer = __esm({
   "src/delivery-writer.ts"() {
     "use strict";
-    DraftSchema = z11.object({ title: z11.string().trim().min(1).max(120), body: z11.string().trim().min(1).max(1e4) }).strict();
+    DraftSchema = z12.object({ title: z12.string().trim().min(1).max(120), body: z12.string().trim().min(1).max(1e4) }).strict();
   }
 });
 
 // src/models.ts
-import { Effect as Effect10 } from "effect";
+import { Effect as Effect11 } from "effect";
 var legacyModel, makers, ServerModels;
 var init_models = __esm({
   "src/models.ts"() {
@@ -2477,7 +3036,7 @@ var init_models = __esm({
         await this.refreshing;
       }
       async defaultReference() {
-        return await Effect10.runPromise(this.store.defaultModel()) ?? legacyModel;
+        return await Effect11.runPromise(this.store.defaultModel()) ?? legacyModel;
       }
       async defaultIdentity() {
         const selected = await this.defaultReference();
@@ -2513,7 +3072,7 @@ var init_models = __esm({
       }
       async setDefault(reference) {
         await this.resolve(reference);
-        await Effect10.runPromise(this.store.setDefaultModel(reference));
+        await Effect11.runPromise(this.store.setDefaultModel(reference));
         return this.identity(reference.platformId, reference.modelId);
       }
     };
@@ -2558,13 +3117,13 @@ var init_delivery_tool = __esm({
 });
 
 // src/pi.ts
-import { Effect as Effect11 } from "effect";
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { Effect as Effect12 } from "effect";
+import { randomUUID as randomUUID5 } from "node:crypto";
 import {
   createAgentSession as createAgentSession2,
   SessionManager as SessionManager2
 } from "@earendil-works/pi-coding-agent";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function toolOutput(value) {
   const parsed = ToolResultSchema.safeParse(value);
   const text = parsed.success ? parsed.data.content?.filter((part) => part.type === "text").map((part) => part.text || "").join("\n") || "Completed without text output." : boundedJson(value, 4e3);
@@ -2596,7 +3155,7 @@ function createPiFactory(files, models2, delivery2, createSession = createAgentS
             );
         },
         async prompt(message, attachments2 = []) {
-          const context = await Effect11.runPromise(files.prepare(attachments2));
+          const context = await Effect12.runPromise(files.prepare(attachments2));
           await session.prompt(message + context.context, { images: context.images });
           const last = session.messages.at(-1);
           if (last?.role === "assistant" && last.stopReason === "error") {
@@ -2633,7 +3192,7 @@ function createPiFactory(files, models2, delivery2, createSession = createAgentS
           function handleMessage(event) {
             if (event.type === "message_start" && event.message.role === "assistant") {
               flushText();
-              assistantMessageId = randomUUID4();
+              assistantMessageId = randomUUID5();
               emit({
                 type: "message.started",
                 sessionId,
@@ -2644,7 +3203,7 @@ function createPiFactory(files, models2, delivery2, createSession = createAgentS
               return true;
             }
             if (event.type === "message_update" && event.assistantMessageEvent.type === "text_delta") {
-              if (!assistantMessageId) assistantMessageId = randomUUID4();
+              if (!assistantMessageId) assistantMessageId = randomUUID5();
               pendingText += event.assistantMessageEvent.delta;
               setActivity("responding");
               if (!flushTimer) flushTimer = setTimeout(flushText, 50);
@@ -2722,8 +3281,8 @@ var init_pi = __esm({
     "use strict";
     init_models();
     init_delivery_tool();
-    ToolResultSchema = z12.object({
-      content: z12.array(z12.object({ type: z12.string(), text: z12.string().optional() })).optional()
+    ToolResultSchema = z13.object({
+      content: z13.array(z13.object({ type: z13.string(), text: z13.string().optional() })).optional()
     }).passthrough();
     boundedJson = (value, limit) => {
       let text;
@@ -2739,18 +3298,18 @@ var init_pi = __esm({
 
 // src/projects.ts
 import { access as access2, readdir as readdir2, realpath, stat as stat3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { randomUUID as randomUUID5 } from "node:crypto";
-import { z as z13 } from "zod";
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { z as z14 } from "zod";
 import { constants as constants2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import path7 from "node:path";
-import { Effect as Effect12, Semaphore as Semaphore3 } from "effect";
+import path8 from "node:path";
+import { Effect as Effect13, Semaphore as Semaphore3 } from "effect";
 function resolveProjectsRoot(input) {
-  return Effect12.tryPromise({
+  return Effect13.tryPromise({
     try: async () => {
       const trimmed = input.trim();
-      const expanded = trimmed === "~" ? homedir3() : trimmed.startsWith("~/") ? path7.join(homedir3(), trimmed.slice(2)) : trimmed;
-      if (!path7.isAbsolute(expanded))
+      const expanded = trimmed === "~" ? homedir3() : trimmed.startsWith("~/") ? path8.join(homedir3(), trimmed.slice(2)) : trimmed;
+      if (!path8.isAbsolute(expanded))
         throw new Error("Use an absolute server path or a path beginning with ~/.");
       const resolved = await realpath(expanded);
       if (!(await stat3(resolved)).isDirectory())
@@ -2772,61 +3331,61 @@ function projectLock(store2) {
   return lock;
 }
 async function gitDirectory(directory) {
-  const location = path7.join(directory, ".git");
+  const location = path8.join(directory, ".git");
   const info = await stat3(location);
   if (info.isDirectory()) return location;
   const contents = await readFile4(location, "utf8");
   const match = /^gitdir: (.+)\s*$/m.exec(contents);
   if (!match) throw new Error("Invalid Git worktree metadata.");
-  const resolved = await realpath(path7.resolve(directory, match[1].trim()));
+  const resolved = await realpath(path8.resolve(directory, match[1].trim()));
   if (!(await stat3(resolved)).isDirectory()) throw new Error("Git directory is missing.");
   return resolved;
 }
 async function identity(directory, preferred) {
-  const filename = path7.join(await gitDirectory(directory), "agentrific-project-id");
+  const filename = path8.join(await gitDirectory(directory), "agentrific-project-id");
   try {
     return ProjectId.parse(await readFile4(filename, "utf8"));
   } catch (error) {
-    if (!z13.object({ code: z13.literal("ENOENT") }).safeParse(error).success) throw error;
-    const legacyFilename = path7.join(await gitDirectory(directory), "chatplans-project-id");
+    if (!z14.object({ code: z14.literal("ENOENT") }).safeParse(error).success) throw error;
+    const legacyFilename = path8.join(await gitDirectory(directory), "chatplans-project-id");
     const legacy = await readFile4(legacyFilename, "utf8").catch((cause) => {
-      if (!z13.object({ code: z13.literal("ENOENT") }).safeParse(cause).success) throw cause;
+      if (!z14.object({ code: z14.literal("ENOENT") }).safeParse(cause).success) throw cause;
       return null;
     });
-    const id = legacy === null ? preferred ?? randomUUID5() : ProjectId.parse(legacy);
+    const id = legacy === null ? preferred ?? randomUUID6() : ProjectId.parse(legacy);
     try {
       await writeFile3(filename, id + "\n", { flag: "wx" });
       return id;
     } catch (writeError) {
-      if (!z13.object({ code: z13.literal("EEXIST") }).safeParse(writeError).success) throw writeError;
+      if (!z14.object({ code: z14.literal("EEXIST") }).safeParse(writeError).success) throw writeError;
       return ProjectId.parse(await readFile4(filename, "utf8"));
     }
   }
 }
 function scanProjects(root, store2) {
-  return Effect12.tryPromise({
+  return Effect13.tryPromise({
     try: async () => {
       root = await realpath(root);
-      const registered = await Effect12.runPromise(store2.registeredProjects(root));
+      const registered = await Effect13.runPromise(store2.registeredProjects(root));
       const found = [];
       const entries = await readdir2(root, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const directory = path7.join(root, entry.name);
-        if (!await stat3(path7.join(directory, ".git")).catch(() => null)) continue;
+        const directory = path8.join(root, entry.name);
+        if (!await stat3(path8.join(directory, ".git")).catch(() => null)) continue;
         const previous = registered.find((project2) => project2.path === directory);
         let id = await identity(directory, previous?.available ? void 0 : previous?.id);
         let existing = registered.find((project2) => project2.id === id);
-        if (found.some((project2) => project2.id === id) || existing && existing.path !== directory && await stat3(path7.join(existing.path, ".git")).catch(() => null)) {
-          id = randomUUID5();
+        if (found.some((project2) => project2.id === id) || existing && existing.path !== directory && await stat3(path8.join(existing.path, ".git")).catch(() => null)) {
+          id = randomUUID6();
           await writeFile3(
-            path7.join(await gitDirectory(directory), "agentrific-project-id"),
+            path8.join(await gitDirectory(directory), "agentrific-project-id"),
             id + "\n"
           );
           existing = void 0;
         }
         const project = { id, name: entry.name, path: directory, available: true };
-        await Effect12.runPromise(store2.relocateProject(project, existing?.path));
+        await Effect13.runPromise(store2.relocateProject(project, existing?.path));
         found.push(project);
       }
       return [
@@ -2841,26 +3400,26 @@ function discoverProjects(root, store2) {
   return projectLock(store2).withPermit(scanProjects(root, store2));
 }
 function reconnectProject(root, id, input, store2) {
-  return Effect12.tryPromise({
+  return Effect13.tryPromise({
     try: async () => {
-      const projects = await Effect12.runPromise(scanProjects(root, store2));
+      const projects = await Effect13.runPromise(scanProjects(root, store2));
       const previous = projects.find((project2) => project2.id === id);
       if (!previous || previous.available)
         throw new Error("Only a missing project can be reconnected.");
-      const sessions = await Effect12.runPromise(store2.list());
+      const sessions = await Effect13.runPromise(store2.list());
       if (sessions.some(
         (session) => session.projectId === id && ["starting", "running", "queued"].includes(session.status)
       ))
         throw new Error("Stop this project's running sessions before reconnecting its folder.");
-      const directory = await Effect12.runPromise(resolveProjectsRoot(input));
-      if (path7.dirname(directory) !== await realpath(root))
+      const directory = await Effect13.runPromise(resolveProjectsRoot(input));
+      if (path8.dirname(directory) !== await realpath(root))
         throw new Error("Choose a Git repository directly inside the configured projects folder.");
-      const filename = path7.join(await gitDirectory(directory), "agentrific-project-id");
+      const filename = path8.join(await gitDirectory(directory), "agentrific-project-id");
       const replacedId = await identity(directory);
-      const project = { id, name: path7.basename(directory), path: directory, available: true };
+      const project = { id, name: path8.basename(directory), path: directory, available: true };
       await writeFile3(filename, id + "\n");
       try {
-        await Effect12.runPromise(store2.relocateProject(project, previous.path, replacedId));
+        await Effect13.runPromise(store2.relocateProject(project, previous.path, replacedId));
       } catch (error) {
         await writeFile3(filename, replacedId + "\n");
         throw error;
@@ -2875,34 +3434,86 @@ var init_projects = __esm({
   "src/projects.ts"() {
     "use strict";
     locks2 = /* @__PURE__ */ new WeakMap();
-    ProjectId = z13.string().trim().min(1).max(255);
+    ProjectId = z14.string().trim().min(1).max(255);
+  }
+});
+
+// src/push-schema.ts
+import { z as z15 } from "zod";
+var PushBindingSchema, PushStateSchema, PendingPushSchema;
+var init_push_schema = __esm({
+  "src/push-schema.ts"() {
+    "use strict";
+    init_push();
+    PushBindingSchema = z15.object({
+      bindingId: z15.string().uuid(),
+      installationId: z15.string().uuid(),
+      deviceId: z15.string().uuid()
+    });
+    PushStateSchema = z15.object({
+      bindings: z15.array(PushBindingSchema).max(10),
+      error: z15.string().nullable()
+    });
+    PendingPushSchema = PushEventSchema.extend({
+      remaining: z15.array(PushBindingSchema),
+      createdAt: z15.number(),
+      attempts: z15.number().int().nonnegative(),
+      nextAt: z15.number()
+    });
   }
 });
 
 // src/store.ts
-import { mkdirSync } from "node:fs";
-import path8 from "node:path";
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import path9 from "node:path";
 import { DatabaseSync } from "node:sqlite";
-import { Context as Context3, Data as Data3, Effect as Effect13, Layer as Layer3 } from "effect";
-import { z as z14 } from "zod";
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { Context as Context3, Data as Data3, Effect as Effect14, Layer as Layer3 } from "effect";
+import { z as z16 } from "zod";
+import { randomUUID as randomUUID7 } from "node:crypto";
 var StorageError, PayloadRow, EventRow, SqliteSessionStore, SessionStore;
 var init_store = __esm({
   "src/store.ts"() {
     "use strict";
+    init_push_schema();
     init_src();
     init_src();
     init_workflow_schema();
     init_src();
     StorageError = class extends Data3.TaggedError("StorageError") {
     };
-    PayloadRow = z14.object({ payload: z14.string() });
-    EventRow = z14.object({ sequence: z14.number(), recorded_at: z14.string(), payload: z14.string() });
+    PayloadRow = z16.object({ payload: z16.string() });
+    EventRow = z16.object({ sequence: z16.number(), recorded_at: z16.string(), payload: z16.string() });
     SqliteSessionStore = class {
       constructor(db) {
         this.db = db;
       }
       db;
+      pushState() {
+        return this.query(() => {
+          const row = this.db.prepare("SELECT payload FROM settings WHERE id = 'push-state'").get();
+          return row ? PushStateSchema.parse(JSON.parse(PayloadRow.parse(row).payload)) : { bindings: [], error: null };
+        });
+      }
+      savePushState(state) {
+        return this.query(
+          () => this.db.prepare(
+            "INSERT INTO settings(id, payload) VALUES ('push-state', ?) ON CONFLICT(id) DO UPDATE SET payload = excluded.payload"
+          ).run(JSON.stringify(PushStateSchema.parse(state)))
+        );
+      }
+      pendingPush() {
+        return this.query(
+          () => this.db.prepare("SELECT payload FROM push_outbox ORDER BY rowid LIMIT 100").all().map((row) => PendingPushSchema.parse(JSON.parse(PayloadRow.parse(row).payload)))
+        );
+      }
+      savePendingPush(job) {
+        return this.query(
+          () => this.db.prepare("UPDATE push_outbox SET payload = ? WHERE id = ?").run(JSON.stringify(PendingPushSchema.parse(job)), job.eventId)
+        );
+      }
+      removePush(eventId) {
+        return this.query(() => this.db.prepare("DELETE FROM push_outbox WHERE id = ?").run(eventId));
+      }
       serverUpdateStatus() {
         return this.query(() => {
           const row = this.db.prepare("SELECT payload FROM settings WHERE id = 'server-update-status'").get();
@@ -2918,11 +3529,11 @@ var init_store = __esm({
       }
       serverIdentity() {
         return this.query(() => {
-          this.db.prepare("INSERT OR IGNORE INTO settings(id, payload) VALUES ('server-id', ?)").run(JSON.stringify(randomUUID6()));
+          this.db.prepare("INSERT OR IGNORE INTO settings(id, payload) VALUES ('server-id', ?)").run(JSON.stringify(randomUUID7()));
           const row = PayloadRow.parse(
             this.db.prepare("SELECT payload FROM settings WHERE id = 'server-id'").get()
           );
-          return z14.string().uuid().parse(JSON.parse(row.payload));
+          return z16.string().uuid().parse(JSON.parse(row.payload));
         });
       }
       saveDevice(device, tokenHash) {
@@ -2959,7 +3570,7 @@ var init_store = __esm({
         });
       }
       query(operation) {
-        return Effect13.try({
+        return Effect14.try({
           try: operation,
           catch: (cause) => new StorageError({
             message: cause instanceof Error ? cause.message : "Session storage operation failed",
@@ -3010,10 +3621,10 @@ var init_store = __esm({
       `).all();
           const insert = this.db.prepare("INSERT OR IGNORE INTO projects(id, payload) VALUES (?, ?)");
           for (const row of legacy) {
-            const id = z14.object({ id: z14.string() }).parse(row).id;
+            const id = z16.object({ id: z16.string() }).parse(row).id;
             insert.run(
               id,
-              JSON.stringify({ id, name: id, path: path8.join(root, id), available: false })
+              JSON.stringify({ id, name: id, path: path9.join(root, id), available: false })
             );
           }
           return this.db.prepare("SELECT payload FROM projects").all().map((row) => ProjectSchema.parse(JSON.parse(PayloadRow.parse(row).payload)));
@@ -3050,7 +3661,7 @@ var init_store = __esm({
         this.db.prepare(
           "UPDATE workflows SET payload = json_set(payload, '$.projectPath', ?) WHERE json_extract(payload, '$.kind') = 'preparation' AND json_extract(payload, '$.projectPath') = ?"
         ).run(project.path, previousPath);
-        const relocate = (workspace) => workspace === previousPath || workspace.startsWith(`${previousPath}${path8.sep}`) ? project.path + workspace.slice(previousPath.length) : workspace;
+        const relocate = (workspace) => workspace === previousPath || workspace.startsWith(`${previousPath}${path9.sep}`) ? project.path + workspace.slice(previousPath.length) : workspace;
         for (const row of this.db.prepare("SELECT id, payload FROM sessions WHERE json_extract(payload, '$.projectId') = ?").all(project.id)) {
           const session = SessionSchema.parse(JSON.parse(PayloadRow.parse(row).payload));
           if (session.workspacePath) {
@@ -3125,6 +3736,31 @@ var init_store = __esm({
           return row ? TaskSchema.parse(JSON.parse(PayloadRow.parse(row).payload)) : void 0;
         });
       }
+      purgeTask(id, sessionIds) {
+        return this.query(() => {
+          this.db.exec("BEGIN IMMEDIATE");
+          try {
+            for (const sessionId of sessionIds) {
+              this.db.prepare("DELETE FROM events WHERE session_id = ?").run(sessionId);
+              this.db.prepare("DELETE FROM push_outbox WHERE json_extract(payload, '$.sessionId') = ?").run(sessionId);
+              this.db.prepare("DELETE FROM workflows WHERE json_extract(payload, '$.sessionId') = ?").run(sessionId);
+              this.db.prepare("DELETE FROM sessions WHERE id = ?").run(sessionId);
+            }
+            this.db.prepare("DELETE FROM tasks WHERE id = ?").run(id);
+            this.db.exec(`UPDATE attachments SET claimed = 0 WHERE NOT EXISTS (
+          SELECT 1 FROM tasks, json_each(tasks.payload, '$.attachments') AS file
+          WHERE json_extract(file.value, '$.id') = attachments.id
+        ) AND NOT EXISTS (
+          SELECT 1 FROM events, json_each(events.payload, '$.attachments') AS file
+          WHERE json_extract(file.value, '$.id') = attachments.id
+        )`);
+            this.db.exec("COMMIT");
+          } catch (error) {
+            this.db.exec("ROLLBACK");
+            throw error;
+          }
+        });
+      }
       saveAttachment(attachment) {
         return this.query(() => {
           this.db.prepare("INSERT INTO attachments(id, payload) VALUES (?, ?)").run(attachment.id, JSON.stringify(AttachmentSchema.parse(attachment)));
@@ -3181,7 +3817,7 @@ var init_store = __esm({
           }
         });
       }
-      append(event) {
+      append(event, notification) {
         return this.query(() => {
           const sessionId = event.type === "session.updated" ? event.session.id : event.sessionId;
           const recordedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -3194,6 +3830,14 @@ var init_store = __esm({
             }
             if (event.type === "message.user") this.claimAttachments(event.attachments ?? []);
             const result = this.db.prepare("INSERT INTO events(session_id, recorded_at, payload) VALUES (?, ?, ?)").run(sessionId, recordedAt, JSON.stringify(event));
+            if (notification) {
+              const count = z16.object({ total: z16.number() }).parse(this.db.prepare("SELECT COUNT(*) AS total FROM push_outbox").get());
+              if (count.total >= 1e3)
+                this.db.prepare(
+                  "DELETE FROM push_outbox WHERE rowid IN (SELECT rowid FROM push_outbox ORDER BY rowid LIMIT 1)"
+                ).run();
+              this.db.prepare("INSERT INTO push_outbox(id, payload) VALUES (?, ?)").run(notification.eventId, JSON.stringify(PendingPushSchema.parse(notification)));
+            }
             const record = RecordedEventSchema.parse({
               sequence: Number(result.lastInsertRowid),
               recordedAt,
@@ -3230,13 +3874,16 @@ var init_store = __esm({
       static layer(filename) {
         return Layer3.effect(
           this,
-          Effect13.acquireRelease(
-            Effect13.try({
+          Effect14.acquireRelease(
+            Effect14.try({
               try: () => {
-                mkdirSync(path8.dirname(filename), { recursive: true });
+                mkdirSync2(path9.dirname(filename), { recursive: true });
                 const db = new DatabaseSync(filename);
+                chmodSync(filename, 384);
+                for (const suffix of ["-wal", "-shm"])
+                  if (existsSync2(filename + suffix)) chmodSync(filename + suffix, 384);
                 try {
-                  const schema = z14.object({ user_version: z14.number() }).parse(db.prepare("PRAGMA user_version").get());
+                  const schema = z16.object({ user_version: z16.number() }).parse(db.prepare("PRAGMA user_version").get());
                   if (schema.user_version > 1)
                     throw new Error("This database requires a newer Agentrific server.");
                   db.exec(`
@@ -3247,6 +3894,7 @@ var init_store = __esm({
               CREATE TABLE IF NOT EXISTS settings(id TEXT PRIMARY KEY, payload TEXT NOT NULL);
               CREATE TABLE IF NOT EXISTS sessions(id TEXT PRIMARY KEY, payload TEXT NOT NULL);
               CREATE TABLE IF NOT EXISTS tasks(id TEXT PRIMARY KEY, payload TEXT NOT NULL);
+              CREATE TABLE IF NOT EXISTS push_outbox(id TEXT PRIMARY KEY, payload TEXT NOT NULL);
               CREATE TABLE IF NOT EXISTS workflows(id TEXT PRIMARY KEY, payload TEXT NOT NULL);
               CREATE TABLE IF NOT EXISTS attachments(id TEXT PRIMARY KEY, payload TEXT NOT NULL, claimed INTEGER NOT NULL DEFAULT 0);
               CREATE TABLE IF NOT EXISTS events(sequence INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL REFERENCES sessions(id), recorded_at TEXT NOT NULL, payload TEXT NOT NULL);
@@ -3262,14 +3910,85 @@ var init_store = __esm({
               },
               catch: (cause) => new StorageError({ message: "Could not open session database", cause })
             }),
-            (db) => Effect13.sync(() => db.close())
-          ).pipe(Effect13.map((db) => new SqliteSessionStore(db)))
+            (db) => Effect14.sync(() => db.close())
+          ).pipe(Effect14.map((db) => new SqliteSessionStore(db)))
         );
       }
     };
   }
 });
 
+// src/worktree-cleanup.ts
+import { lstat, rm as rm2 } from "node:fs/promises";
+import path10 from "node:path";
+import { Effect as Effect15 } from "effect";
+async function removeRunFiles(dataRoot2, sessionId) {
+  if (path10.basename(sessionId) !== sessionId || sessionId === "." || sessionId === "..")
+    throw new Error("Invalid session directory.");
+  await rm2(path10.join(dataRoot2, "pi", sessionId), { recursive: true, force: true });
+}
+var WorktreeCleanup;
+var init_worktree_cleanup = __esm({
+  "src/worktree-cleanup.ts"() {
+    "use strict";
+    init_tasks();
+    init_workflow_command();
+    WorktreeCleanup = class {
+      constructor(store2, root, projectsRoot) {
+        this.store = store2;
+        this.root = root;
+        this.projectsRoot = projectsRoot;
+      }
+      store;
+      root;
+      projectsRoot;
+      async remove(session, discardChanges = true) {
+        if (session.gitFlow?.workspace !== "worktree" || !session.workspacePath) return;
+        const workspace = path10.resolve(session.workspacePath);
+        const info = await lstat(workspace).catch((error) => {
+          if (error.code === "ENOENT") return void 0;
+          throw error;
+        });
+        if (workspace !== path10.join(this.root, session.id) || path10.basename(session.id) !== session.id) {
+          if (!info) return;
+          throw new Error("Refusing to remove a worktree outside the managed workspaces directory.");
+        }
+        if (info?.isSymbolicLink()) throw new Error("Refusing to remove a symlink worktree.");
+        const job = await Effect15.runPromise(this.store.workflow(`preparation:${session.id}`));
+        const projects = await Effect15.runPromise(this.store.registeredProjects(this.projectsRoot));
+        const project = job?.kind === "preparation" ? job.projectPath : projects.find((item) => item.id === session.projectId)?.path;
+        if (!project) throw new Error("Reconnect the project before removing its worktree.");
+        if (info) {
+          await workflowCommand(project, "git", [
+            "worktree",
+            "remove",
+            ...discardChanges ? ["--force"] : [],
+            workspace
+          ]);
+        } else {
+          await workflowCommand(project, "git", ["worktree", "prune"]);
+        }
+      }
+      async prune(maxAgeDays, now = Date.now()) {
+        if (!Number.isFinite(maxAgeDays) || maxAgeDays <= 0) return;
+        const sessions = await Effect15.runPromise(this.store.list());
+        const failures = [];
+        for (const session of sessions) {
+          const lockId = await sessionTaskLockId(this.store, session);
+          await withTaskLock(lockId, async () => {
+            const current = await Effect15.runPromise(this.store.get(session.id));
+            if (!current || taskStatusForSession(current.status, current) !== "done" || now - Date.parse(current.updatedAt) < maxAgeDays * 864e5)
+              return;
+            await this.remove(current, false);
+          }).catch((error) => failures.push(error));
+        }
+        if (failures.length)
+          throw new AggregateError(failures, "Some completed worktrees could not be pruned.");
+      }
+    };
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 import Fastify from "fastify";
@@ -3277,18 +3996,18 @@ import pretty from "pino-pretty";
 import { styleText as styleText4 } from "node:util";
 import cors from "@fastify/cors";
 import multipart from "@fastify/multipart";
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 import { realpath as realpath2 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
-import path9 from "node:path";
+import path11 from "node:path";
 import { WebSocket } from "ws";
-import { Effect as Effect14, ManagedRuntime } from "effect";
-import { z as z15 } from "zod";
+import { Effect as Effect16, ManagedRuntime } from "effect";
+import { z as z17 } from "zod";
 import { ModelRuntime } from "@earendil-works/pi-coding-agent";
 function publish(event, workflowUpdate = false) {
-  const previous = event.type === "session.updated" ? Effect14.runSync(store.get(event.session.id)) : void 0;
+  const previous = event.type === "session.updated" ? Effect16.runSync(store.get(event.session.id)) : void 0;
   const emittedEvent = event.type === "session.updated" && previous && !workflowUpdate ? {
     type: "session.updated",
     session: {
@@ -3297,7 +4016,8 @@ function publish(event, workflowUpdate = false) {
       preparation: previous.preparation
     }
   } : event;
-  const record = Effect14.runSync(store.append(emittedEvent));
+  const notification = emittedEvent.type === "session.updated" ? push.pending(emittedEvent.session, previous) : void 0;
+  const record = Effect16.runSync(store.append(emittedEvent, notification));
   const message = JSON.stringify({ type: "event", record });
   for (const client of security.sockets.keys()) {
     if (!(client instanceof WebSocket) || client.readyState !== WebSocket.OPEN) continue;
@@ -3337,26 +4057,26 @@ async function selectSessionModel(input, hasImages) {
   }
 }
 async function resolveSessionProject(projectId) {
-  const projectsRoot = await Effect14.runPromise(store.projectsRoot(defaultProjectsRoot));
-  const project = (await Effect14.runPromise(discoverProjects(projectsRoot, store))).find(
+  const projectsRoot = await Effect16.runPromise(store.projectsRoot(defaultProjectsRoot));
+  const project = (await Effect16.runPromise(discoverProjects(projectsRoot, store))).find(
     (item) => item.id === projectId && item.available
   );
   if (!project)
     return { error: "Project folder is missing. Reconnect it before starting a run.", status: 404 };
   const projectPath = await realpath2(project.path);
   const resolvedRoot = await realpath2(projectsRoot);
-  if (path9.dirname(projectPath) !== resolvedRoot)
+  if (path11.dirname(projectPath) !== resolvedRoot)
     return { error: "Project path is outside projects root.", status: 400 };
   return { projectPath };
 }
 async function resolveSessionWorkspace(id, gitFlow, projectPath) {
-  const worktreePath = path9.join(worktreesRoot, id);
+  const worktreePath = path11.join(worktreesRoot, id);
   const branch = gitFlow ? `agentrific/${id.slice(0, 8)}` : null;
   const useProjectCheckout = gitFlow?.workspace === "checkout";
   const workspacePath = !gitFlow || useProjectCheckout ? projectPath : worktreePath;
   if (useProjectCheckout) {
     const serverPath = await realpath2(process.cwd());
-    if (serverPath === projectPath || serverPath.startsWith(`${projectPath}${path9.sep}`))
+    if (serverPath === projectPath || serverPath.startsWith(`${projectPath}${path11.sep}`))
       return {
         error: "The server runs from this project. Choose a worktree for this task.",
         status: 409
@@ -3380,7 +4100,7 @@ async function createAndStartSession(input) {
   const projectPath = location.projectPath;
   let files;
   try {
-    files = await Effect14.runPromise(
+    files = await Effect16.runPromise(
       attachments.resolve(input.projectId, input.attachmentIds ?? [])
     );
   } catch (error) {
@@ -3393,11 +4113,11 @@ async function createAndStartSession(input) {
   if (selection.error !== void 0) return { error: selection.error, status: selection.status };
   const selectedModel = selection.model;
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const task = input.taskId ? await Effect14.runPromise(store.getTask(input.taskId)) : void 0;
+  const task = input.taskId ? await Effect16.runPromise(store.getTask(input.taskId)) : void 0;
   if (input.taskId && sessionTaskUnavailable(task, input.projectId))
     return { error: "Task not found.", status: 404 };
   const session = SessionSchema.parse({
-    id: randomUUID7(),
+    id: randomUUID8(),
     taskId: input.taskId ?? null,
     projectId: input.projectId,
     title: task?.title ?? input.prompt.slice(0, 80),
@@ -3422,7 +4142,7 @@ async function createAndStartSession(input) {
     );
   } catch (error) {
     if (task)
-      await Effect14.runPromise(
+      await Effect16.runPromise(
         store.saveTask({ ...task, sessionId: session.id, updatedAt: (/* @__PURE__ */ new Date()).toISOString() })
       );
     return {
@@ -3431,7 +4151,7 @@ async function createAndStartSession(input) {
     };
   }
   try {
-    await Effect14.runPromise(runtime.send(running, input.prompt, files));
+    await Effect16.runPromise(runtime.send(running, input.prompt, files));
   } catch (error) {
     publish({
       type: "session.updated",
@@ -3440,18 +4160,18 @@ async function createAndStartSession(input) {
     publish({ type: "error", sessionId: session.id, message: String(error) });
     return { error: "Could not start the agent session.", status: 500 };
   }
-  return { session: await Effect14.runPromise(store.get(session.id)), status: 201 };
+  return { session: await Effect16.runPromise(store.get(session.id)), status: 201 };
 }
 function startTask(id, instructionsOverride, automated = false) {
   return withTaskLock(
     "agent-dispatch",
     () => withTaskLock(id, async () => {
       maintenance.assertReady();
-      const task = await Effect14.runPromise(store.getTask(id));
+      const task = await Effect16.runPromise(store.getTask(id));
       if (!task || task.deletedAt) throw new TaskActionError("Task not found.", 404);
       if (automated) {
-        const state = await Effect14.runPromise(store.automation());
-        if (activeAgents(await Effect14.runPromise(store.list())) >= state.config.parallelism) return;
+        const state = await Effect16.runPromise(store.automation());
+        if (activeAgents(await Effect16.runPromise(store.list())) >= state.config.parallelism) return;
         const backlog = await boardTasks(store);
         if (!backlog.some((item) => item.id === id && item.status === "backlog")) return;
       }
@@ -3459,7 +4179,7 @@ function startTask(id, instructionsOverride, automated = false) {
       const prompt = instructions ? `${task.title}
 
 ${instructions}` : task.title;
-      const linkedSession = task.sessionId ? await Effect14.runPromise(store.get(task.sessionId)) : void 0;
+      const linkedSession = task.sessionId ? await Effect16.runPromise(store.get(task.sessionId)) : void 0;
       if (linkedSession && (["starting", "running", "queued"].includes(linkedSession.status) || linkedSession.gitDelivery?.status === "pending"))
         throw new TaskActionError("This task already has a running agent.", 409);
       const result = await createAndStartSession({
@@ -3473,7 +4193,7 @@ ${instructions}` : task.title;
       });
       if (!result.session)
         throw new TaskActionError(result.error ?? "Could not start task.", result.status);
-      const updatedTask = await Effect14.runPromise(
+      const updatedTask = await Effect16.runPromise(
         store.saveTask({
           ...task,
           status: taskStatusForSession(result.session.status, result.session),
@@ -3485,11 +4205,17 @@ ${instructions}` : task.title;
     })
   );
 }
-var host, port, defaultProjectsRoot, worktreesRoot, execFileAsync, app, dataRoot, releaseLock, effects, store, security, allowedOrigins, attachmentEffects, attachments, attachmentCleanup, models, delivery, preparation, agentEffects, runtime, updates, maintenance, stopUpdateDiscovery, HistoryQuery, StartTaskBody, automation, automationTimer, closeControl;
+async function withSessionTaskLock(id, operation) {
+  const session = await Effect16.runPromise(store.get(id));
+  const lockId = session ? await sessionTaskLockId(store, session) : `session-${id}`;
+  return withTaskLock(lockId, operation);
+}
+var host, port, defaultProjectsRoot, worktreesRoot, execFileAsync, app, dataRoot, releaseLock, effects, store, security, testPushUrl, push, allowedOrigins, attachmentEffects, attachments, attachmentCleanup, models, delivery, preparation, agentEffects, runtime, worktreeCleanup, maxWorktreeAgeDays, pruneWorktrees, worktreeCleanupTimer, updates, maintenance, stopUpdateDiscovery, HistoryQuery, StartTaskBody, automation, automationTimer, closeControl;
 var init_index = __esm({
   async "src/index.ts"() {
     "use strict";
     init_warnings();
+    init_push2();
     init_attachments();
     init_event_server();
     init_security();
@@ -3508,11 +4234,12 @@ var init_index = __esm({
     init_projects();
     init_store();
     init_tasks();
+    init_worktree_cleanup();
     host = process.env.AGENTRIFIC_HOST ?? "127.0.0.1";
     port = Number(process.env.AGENTRIFIC_PORT ?? 4318);
-    defaultProjectsRoot = path9.resolve(process.env.AGENTRIFIC_PROJECTS_DIR ?? "./projects");
-    worktreesRoot = path9.resolve(
-      process.env.AGENTRIFIC_WORKTREES_DIR ?? path9.join(homedir4(), ".agentrific", "workspaces")
+    defaultProjectsRoot = path11.resolve(process.env.AGENTRIFIC_PROJECTS_DIR ?? "./projects");
+    worktreesRoot = path11.resolve(
+      process.env.AGENTRIFIC_WORKTREES_DIR ?? path11.join(homedir4(), ".agentrific", "workspaces")
     );
     execFileAsync = promisify3(execFile3);
     if (host !== "127.0.0.1" && host !== "::1")
@@ -3535,13 +4262,18 @@ var init_index = __esm({
         }
       }
     });
-    dataRoot = path9.resolve(process.env.AGENTRIFIC_DATA_DIR ?? "./data");
+    dataRoot = path11.resolve(process.env.AGENTRIFIC_DATA_DIR ?? "./data");
     releaseLock = await acquireServerLock(dataRoot);
-    effects = ManagedRuntime.make(SessionStore.layer(path9.join(dataRoot, "sessions.sqlite")));
+    effects = ManagedRuntime.make(SessionStore.layer(path11.join(dataRoot, "sessions.sqlite")));
     store = await effects.runPromise(SessionStore);
-    security = new ServerSecurity(store, await Effect14.runPromise(store.serverIdentity()));
+    security = new ServerSecurity(store, await Effect16.runPromise(store.serverIdentity()));
+    testPushUrl = process.env.AGENTRIFIC_PUSH_TEST_URL;
+    if (testPushUrl && (process.env.AGENTRIFIC_TEST_MODE !== "1" || !new URL(testPushUrl).hostname.endsWith(".ts.net") || new URL(testPushUrl).protocol !== "https:"))
+      throw new Error("Test relay requires explicit test mode and Tailscale HTTPS.");
+    push = new ServerPush(store, security.serverId, dataRoot, fetch, testPushUrl);
     allowedOrigins = [
       .../* @__PURE__ */ new Set([
+        "agentrific-desktop://app",
         ...(process.env.AGENTRIFIC_ALLOWED_ORIGINS ?? "http://localhost:8081,http://127.0.0.1:8081").split(","),
         `http://${host === "::1" ? "[::1]" : host}:${port}`,
         ...process.env.AGENTRIFIC_PUBLIC_URL ? [new URL(process.env.AGENTRIFIC_PUBLIC_URL).origin] : []
@@ -3552,14 +4284,15 @@ var init_index = __esm({
       methods: ["GET", "POST", "PATCH", "DELETE"]
     });
     await registerSecurity(app, security, serverVersion, allowedOrigins);
+    registerPushRoutes(app, push, security);
     attachmentEffects = ManagedRuntime.make(
-      Attachments.layer(path9.join(dataRoot, "attachments"), store)
+      Attachments.layer(path11.join(dataRoot, "attachments"), store)
     );
     attachments = await attachmentEffects.runPromise(Attachments);
-    await Effect14.runPromise(attachments.cleanup());
+    await Effect16.runPromise(attachments.cleanup());
     attachmentCleanup = setInterval(
       () => {
-        void Effect14.runPromise(attachments.cleanup()).catch((error) => app.log.error(error));
+        void Effect16.runPromise(attachments.cleanup()).catch((error) => app.log.error(error));
       },
       60 * 60 * 1e3
     );
@@ -3570,14 +4303,14 @@ var init_index = __esm({
     app.post(
       "/api/projects/:projectId/attachments",
       async (request, reply) => {
-        const root = await Effect14.runPromise(store.projectsRoot(defaultProjectsRoot));
-        const projects = await Effect14.runPromise(discoverProjects(root, store));
+        const root = await Effect16.runPromise(store.projectsRoot(defaultProjectsRoot));
+        const projects = await Effect16.runPromise(discoverProjects(root, store));
         if (!projects.some((project) => project.id === request.params.projectId && project.available))
           return reply.code(404).send({ error: "Project not found." });
         try {
           const file = await request.file();
           if (!file) return reply.code(400).send({ error: "Choose a file to upload." });
-          return reply.code(201).send(await Effect14.runPromise(attachments.upload(request.params.projectId, file)));
+          return reply.code(201).send(await Effect16.runPromise(attachments.upload(request.params.projectId, file)));
         } catch (error) {
           return reply.code(400).send({ error: error instanceof Error ? error.message : "Upload failed." });
         }
@@ -3586,7 +4319,7 @@ var init_index = __esm({
     app.get(
       "/api/projects/:projectId/attachments/:id/content",
       async (request, reply) => {
-        const attachment = await Effect14.runPromise(store.getAttachment(request.params.id));
+        const attachment = await Effect16.runPromise(store.getAttachment(request.params.id));
         if (!attachment || attachment.projectId !== request.params.projectId)
           return reply.code(404).send({ error: "Attachment not found." });
         const preview = request.query.preview === "1" && attachment.kind === "image";
@@ -3604,8 +4337,8 @@ var init_index = __esm({
       publish: (event) => publish(event, true),
       draft: deliveryWriter(models),
       projectPath: async (session) => {
-        const projectsRoot = await Effect14.runPromise(store.projectsRoot(defaultProjectsRoot));
-        const project = (await Effect14.runPromise(discoverProjects(projectsRoot, store))).find(
+        const projectsRoot = await Effect16.runPromise(store.projectsRoot(defaultProjectsRoot));
+        const project = (await Effect16.runPromise(discoverProjects(projectsRoot, store))).find(
           (item) => item.id === session.projectId && item.available
         );
         if (!project) throw new Error("Reconnect the project folder before delivering changes.");
@@ -3618,12 +4351,27 @@ var init_index = __esm({
         createPiFactory(attachments, models, delivery),
         publish,
         worktreesRoot,
-        path9.join(dataRoot, "pi"),
-        (sessionId, messageId) => Effect14.runSync(store.hasMessage(sessionId, messageId)),
+        path11.join(dataRoot, "pi"),
+        (sessionId, messageId) => Effect16.runSync(store.hasMessage(sessionId, messageId)),
         (session) => delivery.settled(session.id)
       )
     );
     runtime = await agentEffects.runPromise(AgentSessions);
+    worktreeCleanup = new WorktreeCleanup(store, worktreesRoot, defaultProjectsRoot);
+    maxWorktreeAgeDays = Number(process.env.AGENTRIFIC_DONE_WORKTREE_MAX_AGE_DAYS ?? 0);
+    if (!Number.isInteger(maxWorktreeAgeDays) || maxWorktreeAgeDays < 0)
+      throw new Error("AGENTRIFIC_DONE_WORKTREE_MAX_AGE_DAYS must be a nonnegative integer.");
+    pruneWorktrees = () => withTaskLock("worktree-pruning", async () => {
+      await worktreeCleanup.prune(maxWorktreeAgeDays);
+    });
+    worktreeCleanupTimer = setInterval(
+      () => {
+        void pruneWorktrees().catch((error) => app.log.error(error));
+      },
+      60 * 60 * 1e3
+    );
+    worktreeCleanupTimer.unref();
+    void pruneWorktrees().catch((error) => app.log.error(error));
     updates = new UpdateDiscovery(store);
     maintenance = new Maintenance(() => [
       ...runtime.workloads(),
@@ -3639,7 +4387,7 @@ var init_index = __esm({
       () => maintenance.ready(),
       (error) => app.log.error(error)
     );
-    for (const session of await Effect14.runPromise(store.list())) {
+    for (const session of await Effect16.runPromise(store.list())) {
       if (session.gitDelivery?.status === "pending") {
         publish(
           {
@@ -3669,7 +4417,7 @@ var init_index = __esm({
     await delivery.recover();
     app.get("/api/connections", async () => githubCliStatus());
     app.get("/api/settings", async () => ({
-      projectsRoot: await Effect14.runPromise(store.projectsRoot(defaultProjectsRoot)),
+      projectsRoot: await Effect16.runPromise(store.projectsRoot(defaultProjectsRoot)),
       defaultModel: await models.defaultIdentity()
     }));
     app.get("/api/models", async (_request, reply) => {
@@ -3697,7 +4445,7 @@ var init_index = __esm({
       try {
         const defaultModel = await models.setDefault(parsed.data);
         return {
-          projectsRoot: await Effect14.runPromise(store.projectsRoot(defaultProjectsRoot)),
+          projectsRoot: await Effect16.runPromise(store.projectsRoot(defaultProjectsRoot)),
           defaultModel
         };
       } catch {
@@ -3706,54 +4454,57 @@ var init_index = __esm({
         });
       }
     });
-    app.post("/api/sessions/:id/model", async (request, reply) => {
-      const parsed = ModelReferenceSchema.safeParse(request.body);
-      const session = await Effect14.runPromise(store.get(request.params.id));
-      if (!session) return reply.code(404).send({ error: "Session not found." });
-      if (!parsed.success)
-        return reply.code(400).send({ error: "Choose a model from the server catalogue." });
-      try {
-        await models.resolve(parsed.data);
-        return await Effect14.runPromise(runtime.setModel(session, parsed.data));
-      } catch {
-        return reply.code(409).send({
-          error: "Could not change the model. Wait for the current reply to finish and choose an available model."
-        });
-      }
-    });
+    app.post(
+      "/api/sessions/:id/model",
+      async (request, reply) => withSessionTaskLock(request.params.id, async () => {
+        const parsed = ModelReferenceSchema.safeParse(request.body);
+        const session = await Effect16.runPromise(store.get(request.params.id));
+        if (!session) return reply.code(404).send({ error: "Session not found." });
+        if (!parsed.success)
+          return reply.code(400).send({ error: "Choose a model from the server catalogue." });
+        try {
+          await models.resolve(parsed.data);
+          return await Effect16.runPromise(runtime.setModel(session, parsed.data));
+        } catch {
+          return reply.code(409).send({
+            error: "Could not change the model. Wait for the current reply to finish and choose an available model."
+          });
+        }
+      })
+    );
     app.post("/api/settings", async (request, reply) => {
       const parsed = UpdateSettingsSchema.safeParse(request.body);
       if (!parsed.success) return reply.code(400).send({ error: "Enter a projects folder." });
-      const result = await Effect14.runPromise(
-        resolveProjectsRoot(parsed.data.projectsRoot).pipe(Effect14.result)
+      const result = await Effect16.runPromise(
+        resolveProjectsRoot(parsed.data.projectsRoot).pipe(Effect16.result)
       );
       if (result._tag === "Failure") return reply.code(400).send({ error: result.failure.message });
-      return Effect14.runPromise(store.setProjectsRoot(result.success));
+      return Effect16.runPromise(store.setProjectsRoot(result.success));
     });
     app.get("/api/projects", async (_request, reply) => {
-      const root = await Effect14.runPromise(store.projectsRoot(defaultProjectsRoot));
-      const result = await Effect14.runPromise(discoverProjects(root, store).pipe(Effect14.result));
+      const root = await Effect16.runPromise(store.projectsRoot(defaultProjectsRoot));
+      const result = await Effect16.runPromise(discoverProjects(root, store).pipe(Effect16.result));
       if (result._tag === "Failure") return reply.code(400).send({ error: result.failure.message });
       return result.success;
     });
     app.get("/api/projects/:id", async (request, reply) => {
-      const root = await Effect14.runPromise(store.projectsRoot(defaultProjectsRoot));
-      const result = await Effect14.runPromise(discoverProjects(root, store).pipe(Effect14.result));
+      const root = await Effect16.runPromise(store.projectsRoot(defaultProjectsRoot));
+      const result = await Effect16.runPromise(discoverProjects(root, store).pipe(Effect16.result));
       if (result._tag === "Failure") return reply.code(400).send({ error: result.failure.message });
       const project = result.success.find((item) => item.id === request.params.id);
       return project ?? reply.code(404).send({ error: "Project not found on this server." });
     });
     app.post("/api/projects/:id/reconnect", async (request, reply) => {
-      const parsed = z15.object({ path: z15.string().trim().min(1).max(4096) }).safeParse(request.body);
+      const parsed = z17.object({ path: z17.string().trim().min(1).max(4096) }).safeParse(request.body);
       if (!parsed.success)
         return reply.code(400).send({ error: "Enter the project's new folder path." });
-      const root = await Effect14.runPromise(store.projectsRoot(defaultProjectsRoot));
-      const result = await Effect14.runPromise(
-        reconnectProject(root, request.params.id, parsed.data.path, store).pipe(Effect14.result)
+      const root = await Effect16.runPromise(store.projectsRoot(defaultProjectsRoot));
+      const result = await Effect16.runPromise(
+        reconnectProject(root, request.params.id, parsed.data.path, store).pipe(Effect16.result)
       );
       return result._tag === "Failure" ? reply.code(400).send({ error: result.failure.message }) : result.success;
     });
-    app.get("/api/sessions", () => Effect14.runPromise(store.list()));
+    app.get("/api/sessions", () => Effect16.runPromise(store.list()));
     app.get(
       "/api/tasks",
       (request) => boardTasks(store, request.query.projectId)
@@ -3766,15 +4517,15 @@ var init_index = __esm({
         if (!github.githubCli.authenticated)
           return reply.code(400).send({ error: "GitHub CLI must be authenticated on the server to open a PR." });
       }
-      const projectsRoot = await Effect14.runPromise(store.projectsRoot(defaultProjectsRoot));
-      const projects = await Effect14.runPromise(
-        discoverProjects(projectsRoot, store).pipe(Effect14.result)
+      const projectsRoot = await Effect16.runPromise(store.projectsRoot(defaultProjectsRoot));
+      const projects = await Effect16.runPromise(
+        discoverProjects(projectsRoot, store).pipe(Effect16.result)
       );
       if (projects._tag === "Failure" || !projects.success.some((project) => project.id === parsed.data.projectId && project.available))
         return reply.code(404).send({ error: "Project not found in the server's projects folder." });
       let files;
       try {
-        files = await Effect14.runPromise(
+        files = await Effect16.runPromise(
           attachments.resolve(parsed.data.projectId, parsed.data.attachmentIds ?? [])
         );
       } catch (error) {
@@ -3782,7 +4533,7 @@ var init_index = __esm({
       }
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const task = TaskSchema.parse({
-        id: randomUUID7(),
+        id: randomUUID8(),
         ...parsed.data,
         attachments: files,
         status: "backlog",
@@ -3790,7 +4541,7 @@ var init_index = __esm({
         createdAt: now,
         updatedAt: now
       });
-      return reply.code(201).send(await Effect14.runPromise(store.saveTask(task)));
+      return reply.code(201).send(await Effect16.runPromise(store.saveTask(task)));
     });
     app.patch("/api/tasks/:id", async (request, reply) => {
       const parsed = UpdateTaskSchema.safeParse(request.body);
@@ -3805,8 +4556,8 @@ var init_index = __esm({
             return reply.code(400).send({ error: "GitHub CLI must be authenticated on the server to open a PR." });
         }
         return await editTask(store, request.params.id, parsed.data, async (projectId, ids) => {
-          const result = await Effect14.runPromise(
-            attachments.resolve(projectId, ids).pipe(Effect14.result)
+          const result = await Effect16.runPromise(
+            attachments.resolve(projectId, ids).pipe(Effect16.result)
           );
           if (result._tag === "Failure") throw new TaskActionError(result.failure.message, 400);
           return result.success;
@@ -3819,7 +4570,12 @@ var init_index = __esm({
     });
     app.delete("/api/tasks/:id", async (request, reply) => {
       try {
-        await deleteTask(store, request.params.id);
+        await deleteTask(store, request.params.id, async (session) => {
+          await Effect16.runPromise(runtime.forget(session.id));
+          await worktreeCleanup.remove(session);
+          await removeRunFiles(dataRoot, session.id);
+        });
+        await Effect16.runPromise(attachments.cleanup());
         return reply.code(204).send();
       } catch (error) {
         if (error instanceof TaskActionError)
@@ -3828,31 +4584,34 @@ var init_index = __esm({
       }
     });
     app.get("/api/sessions/:id", async (request, reply) => {
-      const session = await Effect14.runPromise(store.get(request.params.id));
+      const session = await Effect16.runPromise(store.get(request.params.id));
       if (!session) return reply.code(404).send({ error: "Session not found." });
       return session;
     });
-    app.post("/api/sessions/:id/delivery", async (request, reply) => {
-      const session = await Effect14.runPromise(store.get(request.params.id));
-      if (!session) return reply.code(404).send({ error: "Session not found." });
-      try {
-        const result = await delivery.retry(session.id);
-        return reply.code(202).send(result);
-      } catch (error) {
-        return reply.code(409).send({ error: error instanceof Error ? error.message : "Delivery could not be retried." });
-      }
-    });
+    app.post(
+      "/api/sessions/:id/delivery",
+      async (request, reply) => withSessionTaskLock(request.params.id, async () => {
+        const session = await Effect16.runPromise(store.get(request.params.id));
+        if (!session) return reply.code(404).send({ error: "Session not found." });
+        try {
+          const result = await delivery.retry(session.id);
+          return reply.code(202).send(result);
+        } catch (error) {
+          return reply.code(409).send({ error: error instanceof Error ? error.message : "Delivery could not be retried." });
+        }
+      })
+    );
     app.post(
       "/api/sessions/:id/preparation/retry",
-      async (request, reply) => {
+      async (request, reply) => withSessionTaskLock(request.params.id, async () => {
         let preparedSession;
         try {
           const prepared = await preparation.retry(request.params.id);
           preparedSession = prepared.session;
-          const files = await Effect14.runPromise(
+          const files = await Effect16.runPromise(
             attachments.resolve(prepared.session.projectId, prepared.input.attachmentIds ?? [])
           );
-          await Effect14.runPromise(runtime.send(prepared.session, prepared.input.prompt, files));
+          await Effect16.runPromise(runtime.send(prepared.session, prepared.input.prompt, files));
           return reply.code(202).send(prepared.session);
         } catch (error) {
           if (preparedSession) {
@@ -3866,18 +4625,18 @@ var init_index = __esm({
             error: error instanceof Error ? error.message : "Preparation could not be retried."
           });
         }
-      }
+      })
     );
-    HistoryQuery = z15.object({
-      after: z15.coerce.number().int().nonnegative().default(0),
-      limit: z15.coerce.number().int().min(1).max(1e3).default(500)
+    HistoryQuery = z17.object({
+      after: z17.coerce.number().int().nonnegative().default(0),
+      limit: z17.coerce.number().int().min(1).max(1e3).default(500)
     });
     app.get("/api/sessions/:id/events", async (request, reply) => {
       const query = HistoryQuery.safeParse(request.query);
       if (!query.success) return reply.code(400).send({ error: "Invalid history cursor or limit." });
-      const session = await Effect14.runPromise(store.get(request.params.id));
+      const session = await Effect16.runPromise(store.get(request.params.id));
       if (!session) return reply.code(404).send({ error: "Session not found." });
-      return Effect14.runPromise(store.history(session.id, query.data.after, query.data.limit));
+      return Effect16.runPromise(store.history(session.id, query.data.after, query.data.limit));
     });
     app.post("/api/sessions", async (request, reply) => {
       const parsed = CreateSessionSchema.safeParse(request.body);
@@ -3889,7 +4648,7 @@ var init_index = __esm({
       if (!result.session) return reply.code(result.status).send({ error: result.error });
       return reply.code(201).send(result.session);
     });
-    StartTaskBody = z15.object({ prompt: z15.string().trim().max(2e4).optional() }).default({});
+    StartTaskBody = z17.object({ prompt: z17.string().trim().max(2e4).optional() }).default({});
     app.post("/api/tasks/:id/start", async (request, reply) => {
       const body = StartTaskBody.safeParse(request.body ?? {});
       if (!body.success) return reply.code(400).send({ error: "The task prompt is too long." });
@@ -3913,8 +4672,8 @@ var init_index = __esm({
       const parsed = AutomationConfigSchema.safeParse(request.body);
       if (!parsed.success)
         return reply.code(400).send({ error: parsed.error.issues.map((issue) => issue.message).join(" ") });
-      const root = await Effect14.runPromise(store.projectsRoot(defaultProjectsRoot));
-      const projects = await Effect14.runPromise(discoverProjects(root, store));
+      const root = await Effect16.runPromise(store.projectsRoot(defaultProjectsRoot));
+      const projects = await Effect16.runPromise(discoverProjects(root, store));
       if (parsed.data.projectIds.some(
         (id) => !projects.some((project) => project.id === id && project.available)
       ))
@@ -3924,7 +4683,7 @@ var init_index = __esm({
       return automation.configure(parsed.data);
     });
     app.patch("/api/automation/queue", async (request, reply) => {
-      const parsed = z15.object({ taskId: z15.string().min(1), beforeId: z15.string().min(1).nullable() }).safeParse(request.body);
+      const parsed = z17.object({ taskId: z17.string().min(1), beforeId: z17.string().min(1).nullable() }).safeParse(request.body);
       if (!parsed.success)
         return reply.code(400).send({ error: "Choose a task and a queue position." });
       try {
@@ -3941,8 +4700,8 @@ var init_index = __esm({
     automationTimer.unref();
     app.post(
       "/api/sessions/:id/messages",
-      async (request, reply) => {
-        const session = await Effect14.runPromise(store.get(request.params.id));
+      async (request, reply) => withSessionTaskLock(request.params.id, async () => {
+        const session = await Effect16.runPromise(store.get(request.params.id));
         if (!session) return reply.code(404).send({ error: "Session not found." });
         const parsed = SendMessageSchema.safeParse(request.body);
         if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
@@ -3950,27 +4709,30 @@ var init_index = __esm({
           await delivery.assertCanWork(session.id);
           if (session.preparation && session.preparation.status !== "ready")
             throw new Error("Retry workspace preparation before sending a message.");
-          const files = await Effect14.runPromise(
+          const files = await Effect16.runPromise(
             attachments.resolve(session.projectId, parsed.data.attachmentIds ?? [])
           );
-          await Effect14.runPromise(
+          await Effect16.runPromise(
             runtime.send(session, parsed.data.message, files, parsed.data.clientMessageId)
           );
           return reply.code(202).send({ accepted: true });
         } catch (error) {
           return reply.code(409).send({ error: String(error) });
         }
-      }
+      })
+    );
+    app.post(
+      "/api/sessions/:id/stop",
+      async (request, reply) => withSessionTaskLock(request.params.id, async () => {
+        const session = await Effect16.runPromise(store.get(request.params.id));
+        if (!session) return reply.code(404).send({ error: "Session not found." });
+        await Effect16.runPromise(runtime.stop(session));
+        return reply.code(202).send({ accepted: true });
+      })
     );
-    app.post("/api/sessions/:id/stop", async (request, reply) => {
-      const session = await Effect14.runPromise(store.get(request.params.id));
-      if (!session) return reply.code(404).send({ error: "Session not found." });
-      await Effect14.runPromise(runtime.stop(session));
-      return reply.code(202).send({ accepted: true });
-    });
     attachEventServer(app, security, allowedOrigins, () => ({
       type: "snapshot",
-      sessions: Effect14.runSync(store.list())
+      sessions: Effect16.runSync(store.list())
     }));
     closeControl = await startControl(
       dataRoot,
@@ -3982,20 +4744,25 @@ var init_index = __esm({
         connectedDevices: new Set(security.sockets.values()).size,
         connectedSockets: security.sockets.size,
         memory: process.memoryUsage().rss,
-        activeRuns: activeAgents(Effect14.runSync(store.list())),
+        activeRuns: activeAgents(Effect16.runSync(store.list())),
         maintenance: maintenance.status()
       }),
       maintenance
     );
+    push.start();
     app.addHook("onClose", async () => {
+      await push.close();
       maintenance.enter();
       stopUpdateDiscovery();
       await updates.settle();
       clearInterval(attachmentCleanup);
+      clearInterval(worktreeCleanupTimer);
+      await withTaskLock("worktree-pruning", async () => {
+      });
       clearInterval(automationTimer);
       await withTaskLock("automation", async () => {
       });
-      await Effect14.runPromise(runtime.close());
+      await Effect16.runPromise(runtime.close());
       await agentEffects.dispose();
       await attachmentEffects.dispose();
       await effects.dispose();
@@ -4018,7 +4785,7 @@ var init_index = __esm({
 init_warnings();
 import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import path10 from "node:path";
+import path12 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/service.ts
@@ -4114,204 +4881,21 @@ async function installService(platform, directory, filename, domain, dataDir, cl
 init_updates();
 init_control();
 init_version();
+init_pairing();
 import { spawn as spawn2 } from "node:child_process";
 import { parseArgs } from "node:util";
-import { z as z16 } from "zod";
-
-// src/pairing.ts
-init_src();
-init_control();
-import { z as z4 } from "zod";
-import { styleText as styleText2 } from "node:util";
-import { emitKeypressEvents } from "node:readline";
-import qrcode from "qrcode-terminal";
-
-// src/cli-output.ts
-init_version();
-import { styleText } from "node:util";
-function printHeading(title) {
-  console.log();
-  console.log(styleText("bold", "      #######  ##"));
-  console.log(styleText("bold", "    ###     #####"));
-  console.log(`    ${styleText("bold", "##       ####")}    ${styleText("bold", "AGENTRIFIC")}`);
-  console.log(
-    `    ${styleText("bold", "##   ")}${styleText(["bold", "yellow"], "o")}${styleText("bold", "   ####")}    ${styleText("dim", `${title} \xB7 v${serverVersion}`)}`
-  );
-  console.log(styleText("bold", "    ##       ####"));
-  console.log(styleText("bold", "    ###     #####"));
-  console.log(styleText("bold", "      #######  ##"));
-  console.log();
-}
-function printDetail(label2, value) {
-  console.log(`  ${styleText("dim", "\u203A")} ${styleText("dim", label2.padEnd(10))} ${value}`);
-}
-function printShortcuts(pairingAvailable = false) {
-  console.log();
-  console.log(`  ${styleText("dim", "\u203A")} Press ${styleText("bold", "p")}       \u2502 pair a device`);
-  if (pairingAvailable)
-    console.log(
-      `  ${styleText("dim", "\u203A")} Press ${styleText("bold", "j")}       \u2502 show pairing JSON`
-    );
-  console.log(`  ${styleText("dim", "\u203A")} Press ${styleText("bold", "?")}       \u2502 show shortcuts`);
-  console.log(
-    `  ${styleText("dim", "\u203A")} Press ${styleText("bold", "Ctrl+C")}  \u2502 stop the server
-`
-  );
-}
-function printError(message) {
-  console.error(`
-  ${styleText(["bold", "red"], "Error")} ${message}
-`);
-}
-function printHelp() {
-  printHeading("server");
-  console.log(`  ${styleText("bold", "Usage")} agentrific <command> [options]
-`);
-  for (const [command, description] of [
-    ["init", "Configure the server"],
-    ["start", "Start the server \xB7 press p to pair"],
-    ["pair", "Print a fresh pairing QR code and PIN"],
-    ["devices", "List enrolled devices"],
-    ["revoke <id>", "Revoke a device's access"],
-    ["status", "Show server status"],
-    ["maintenance enter/resume/drain", "Pause new work, resume, or wait for work to finish"],
-    ["service install/uninstall/restart", "Manage the background service"],
-    ["logs", "Follow server logs"],
-    ["update --check", "Check for a newer release"]
-  ])
-    console.log(`  ${styleText("cyan", command.padEnd(34))}${description}`);
-  console.log(`
-  ${styleText("bold", "Options")}
-`);
-  for (const [option, description] of [
-    ["--data-dir <path>", "Use a specific server data directory"],
-    ["--public-url <https-url>", "Use your tunnel URL without prompting"],
-    ["--no-interactive", "Disable prompts and keyboard shortcuts"],
-    ["--show-payload", "Print manual JSON with the pairing QR code"],
-    ["--timeout-ms <0-60000>", "Set the maintenance drain timeout"],
-    ["--version", "Print the server version"],
-    ["--help", "Show this help"]
-  ])
-    console.log(`  ${styleText("cyan", option.padEnd(34))}${description}`);
-  console.log("\n  Connect using Tailscale Serve, cloudflared, or another HTTPS tunnel.\n");
-}
-
-// src/pairing.ts
-function printManualPairing(invitation) {
-  if (Date.now() >= invitation.expiresAt) {
-    printError("This invitation expired. Generate a fresh pairing QR code.");
-    return;
-  }
-  console.log(styleText2("dim", "\n  Manual entry \xB7 paste this JSON into Pairing payload:\n"));
-  console.log(`  ${invitation.payload}
-`);
-}
-function waitForManualPairing(invitation) {
-  console.log(styleText2("dim", "  Press j to show manual entry \xB7 Enter or q to finish.\n"));
-  return new Promise((resolve) => {
-    const input = process.stdin;
-    const previousRaw = input.isRaw;
-    const timeout = setTimeout(
-      () => {
-        console.log(
-          styleText2("dim", "\n  Pairing invitation expired. Run agentrific pair again.\n")
-        );
-        close();
-      },
-      Math.max(0, invitation.expiresAt - Date.now())
-    );
-    function close() {
-      clearTimeout(timeout);
-      input.removeListener("keypress", pressed);
-      input.removeListener("end", close);
-      process.removeListener("SIGINT", interrupted);
-      process.removeListener("SIGTERM", terminated);
-      input.setRawMode(previousRaw);
-      input.pause();
-      resolve();
-    }
-    function interrupted() {
-      process.exitCode = 130;
-      close();
-    }
-    function terminated() {
-      process.exitCode = 143;
-      close();
-    }
-    function pressed(text, key) {
-      if (key.ctrl && key.name === "c") {
-        interrupted();
-        return;
-      }
-      if (key.ctrl || key.meta) return;
-      if (text?.toLowerCase() === "j") {
-        printManualPairing(invitation);
-        close();
-      } else if (text?.toLowerCase() === "q" || key.name === "return" || key.name === "escape") {
-        close();
-      }
-    }
-    emitKeypressEvents(input);
-    input.setRawMode(true);
-    input.on("keypress", pressed);
-    input.once("end", close);
-    process.once("SIGINT", interrupted);
-    process.once("SIGTERM", terminated);
-    input.resume();
-  });
-}
-function pairingOrigin(url) {
-  const endpoint = new URL(url);
-  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.pathname !== "/")
-    throw new Error("Use the HTTPS server origin without a path or credentials.");
-  if (endpoint.protocol !== "https:" && !(process.env.NODE_ENV !== "production" && endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname)))
-    throw new Error("Use HTTPS. Localhost HTTP is for development builds only.");
-  return endpoint.origin;
-}
-async function printPairing(dataDir, url) {
-  if (!url)
-    throw new Error(
-      "Specify --public-url with your Tailscale Serve or Cloudflare Tunnel HTTPS address."
-    );
-  const origin = pairingOrigin(url);
-  const grant = z4.object({
-    pairingId: z4.string(),
-    pin: z4.string(),
-    expiresAt: z4.number(),
-    serverId: z4.string()
-  }).parse(await controlRequest(dataDir, { command: "pair" }));
-  const invitation = {
-    v: 1,
-    url: origin,
-    serverId: grant.serverId,
-    pairingId: grant.pairingId
-  };
-  const payload = JSON.stringify(invitation);
-  const link = createPairingLink(invitation);
-  printHeading("pairing");
-  console.log("  1. Scan below with your phone camera and tap Open Agentrific if offered.");
-  console.log("  2. Or open Agentrific and choose Scan pairing QR code.");
-  console.log("  3. Enter the PIN, then confirm pairing.\n");
-  qrcode.generate(link, { small: true }, (code) => {
-    console.log(
-      code.split("\n").map((line) => `  ${line}`).join("\n")
-    );
-  });
-  console.log();
-  printDetail("PIN:", styleText2(["bold", "yellow"], grant.pin));
-  printDetail("Server", styleText2("cyan", origin));
-  printDetail("Expires", "In five minutes \xB7 one device per code");
-  console.log("\n  Pairing grants this device access to run agents as your host user.\n");
-  return { payload, expiresAt: grant.expiresAt };
-}
+import { z as z18 } from "zod";
 
 // src/terminal.ts
+init_pairing();
+init_cli_output();
 import { createInterface } from "node:readline/promises";
 import select from "@inquirer/select";
 import { emitKeypressEvents as emitKeypressEvents2 } from "node:readline";
 import { styleText as styleText3 } from "node:util";
 
 // src/tunnels.ts
+init_cli_output();
 import { spawn } from "node:child_process";
 import { access, stat } from "node:fs/promises";
 import { constants } from "node:fs";
@@ -4780,10 +5364,11 @@ function startTerminal(dataDir, publicUrl, tunnel) {
 }
 
 // src/cli.ts
-var ConfigSchema = z16.object({
-  dataDir: z16.string(),
-  projectsDir: z16.string(),
-  publicUrl: z16.string().url().optional()
+init_cli_output();
+var ConfigSchema = z18.object({
+  dataDir: z18.string(),
+  projectsDir: z18.string(),
+  publicUrl: z18.string().url().optional()
 });
 function parseCommandArgs() {
   return parseArgs({
@@ -4811,15 +5396,15 @@ async function main() {
     printHelp();
     return;
   }
-  const dataDir = path10.resolve(
-    values["data-dir"] ?? process.env.AGENTRIFIC_DATA_DIR ?? path10.join(homedir5(), ".agentrific")
+  const dataDir = path12.resolve(
+    values["data-dir"] ?? process.env.AGENTRIFIC_DATA_DIR ?? path12.join(homedir5(), ".agentrific")
   );
-  const filename = path10.join(dataDir, "config.json");
+  const filename = path12.join(dataDir, "config.json");
   const config = ConfigSchema.parse(
     JSON.parse(
       await readFile5(filename, "utf8").catch((error) => {
-        if (!z16.object({ code: z16.literal("ENOENT") }).safeParse(error).success) throw error;
-        return JSON.stringify({ dataDir, projectsDir: path10.join(homedir5(), "projects") });
+        if (!z18.object({ code: z18.literal("ENOENT") }).safeParse(error).success) throw error;
+        return JSON.stringify({ dataDir, projectsDir: path12.join(homedir5(), "projects") });
       })
     )
   );
@@ -4891,7 +5476,7 @@ async function serviceCommand({ positionals, dataDir }) {
   return;
 }
 async function logsCommand({ dataDir }) {
-  const child = process.platform === "linux" ? spawn2("journalctl", ["--user", "-u", "agentrific.service", "-f"], { stdio: "inherit" }) : spawn2("tail", ["-F", path10.join(dataDir, "logs", "server.log")], { stdio: "inherit" });
+  const child = process.platform === "linux" ? spawn2("journalctl", ["--user", "-u", "agentrific.service", "-f"], { stdio: "inherit" }) : spawn2("tail", ["-F", path12.join(dataDir, "logs", "server.log")], { stdio: "inherit" });
   child.on("error", (error) => {
     console.error(error.message);
     process.exitCode = 1;
@@ -4925,11 +5510,11 @@ async function pairCommand({ values, dataDir, config }) {
   return;
 }
 async function maintenanceCommand({ values, positionals, dataDir }) {
-  const action = z16.enum(["enter", "resume", "drain"]).parse(positionals[1]);
+  const action = z18.enum(["enter", "resume", "drain"]).parse(positionals[1]);
   const result = await controlRequest(dataDir, {
     command: "maintenance",
     action,
-    timeoutMs: z16.coerce.number().int().min(0).max(6e4).parse(values["timeout-ms"] ?? 3e4)
+    timeoutMs: z18.coerce.number().int().min(0).max(6e4).parse(values["timeout-ms"] ?? 3e4)
   });
   console.log(JSON.stringify(result, null, 2));
   if (action === "drain" && "drained" in result && !result.drained) process.exitCode = 1;
@@ -4938,7 +5523,7 @@ async function maintenanceCommand({ values, positionals, dataDir }) {
 async function devicesCommand({ dataDir, command }) {
   console.log(
     JSON.stringify(
-      await controlRequest(dataDir, { command: z16.enum(["devices", "status"]).parse(command) }),
+      await controlRequest(dataDir, { command: z18.enum(["devices", "status"]).parse(command) }),
       null,
       2
     )
@@ -4946,7 +5531,7 @@ async function devicesCommand({ dataDir, command }) {
   return;
 }
 async function revokeCommand({ positionals, dataDir }) {
-  const id = z16.string().uuid().parse(positionals[1]);
+  const id = z18.string().uuid().parse(positionals[1]);
   console.log(JSON.stringify(await controlRequest(dataDir, { command: "revoke", id })));
   return;
 }