@akshar5/cohall 0.2.0

package/bin/cohall.js

@@ -0,0 +1,3129 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// packages/protocol/src/index.ts
+import { Schema } from "effect";
+var version = "0.2.0", bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
+  expected: "an ISO-8601 UTC timestamp"
+})).pipe(Schema.brand(name)), DeviceId, ThreadId, MessageId, TaskId, AuthSessionId, Timestamp, Platform, Provider, DeviceStatus, TaskStatus, MessageRole, ConnectionRole, AuthSession, CreatePairingInput, PairingCredential, ExchangePairingInput, SessionCredential, PairingResult, Capability, Workspace, Device, Thread, Message, Task, ThreadContext, CreateTaskInput, SocketEvent, ErrorResponse, terminalTaskStatuses, isTerminalTask = (task) => terminalTaskStatuses.has(task.status), now = () => Timestamp.make(new Date().toISOString()), makeDeviceId = () => DeviceId.make(crypto.randomUUID()), makeThreadId = () => ThreadId.make(crypto.randomUUID()), makeMessageId = () => MessageId.make(crypto.randomUUID()), makeTaskId = () => TaskId.make(crypto.randomUUID()), makeAuthSessionId = () => AuthSessionId.make(crypto.randomUUID()), decodeCreatePairingInput, decodeExchangePairingInput, decodeCreateTaskInput, decodeDevice, decodeSocketEvent;
+var init_src = __esm(() => {
+  DeviceId = uuid("DeviceId");
+  ThreadId = uuid("ThreadId");
+  MessageId = uuid("MessageId");
+  TaskId = uuid("TaskId");
+  AuthSessionId = uuid("AuthSessionId");
+  Timestamp = isoTimestamp("Timestamp");
+  Platform = Schema.Literals(["darwin", "linux", "windows", "unknown"]);
+  Provider = Schema.Literals(["codex", "claude-code", "opencode"]);
+  DeviceStatus = Schema.Literals(["online", "busy", "offline"]);
+  TaskStatus = Schema.Literals([
+    "queued",
+    "assigned",
+    "running",
+    "cancelling",
+    "completed",
+    "failed",
+    "cancelled"
+  ]);
+  MessageRole = Schema.Literals(["human", "agent", "system"]);
+  ConnectionRole = Schema.Literals(["client", "device"]);
+  AuthSession = Schema.Struct({
+    id: AuthSessionId,
+    label: bounded(128),
+    role: ConnectionRole,
+    createdAt: Timestamp,
+    expiresAt: Timestamp,
+    lastSeenAt: Timestamp,
+    deviceId: Schema.optionalKey(DeviceId),
+    revokedAt: Schema.optionalKey(Timestamp)
+  });
+  CreatePairingInput = Schema.Struct({
+    label: bounded(128),
+    roles: boundedArray(ConnectionRole, 2)
+  });
+  PairingCredential = Schema.Struct({
+    token: bounded(256),
+    expiresAt: Timestamp
+  });
+  ExchangePairingInput = Schema.Struct({
+    token: bounded(256)
+  });
+  SessionCredential = Schema.Struct({
+    token: bounded(256),
+    session: AuthSession
+  });
+  PairingResult = Schema.Struct({
+    credentials: boundedArray(SessionCredential, 2)
+  });
+  Capability = Schema.Struct({
+    id: bounded(64),
+    label: bounded(128),
+    detail: Schema.optionalKey(optionalText(512))
+  });
+  Workspace = Schema.Struct({
+    path: bounded(4096),
+    label: bounded(256)
+  });
+  Device = Schema.Struct({
+    id: DeviceId,
+    name: bounded(128),
+    hostname: bounded(256),
+    platform: Platform,
+    architecture: bounded(64),
+    status: DeviceStatus,
+    providers: boundedArray(Provider, 3),
+    capabilities: boundedArray(Capability, 64),
+    workspaces: boundedArray(Workspace, 64),
+    version: bounded(32),
+    lastSeenAt: Timestamp,
+    connectedAt: Schema.optionalKey(Timestamp)
+  });
+  Thread = Schema.Struct({
+    id: ThreadId,
+    title: bounded(256),
+    createdAt: Timestamp,
+    updatedAt: Timestamp,
+    defaultDeviceId: Schema.optionalKey(DeviceId)
+  });
+  Message = Schema.Struct({
+    id: MessageId,
+    threadId: ThreadId,
+    role: MessageRole,
+    authorName: bounded(128),
+    content: optionalText(131072),
+    createdAt: Timestamp,
+    taskId: Schema.optionalKey(TaskId),
+    deviceId: Schema.optionalKey(DeviceId)
+  });
+  Task = Schema.Struct({
+    id: TaskId,
+    threadId: ThreadId,
+    prompt: bounded(131072),
+    context: Schema.optionalKey(optionalText(131072)),
+    provider: Provider,
+    status: TaskStatus,
+    sourceDeviceId: Schema.optionalKey(DeviceId),
+    targetDeviceId: DeviceId,
+    parentTaskId: Schema.optionalKey(TaskId),
+    workspace: Schema.optionalKey(bounded(4096)),
+    providerSessionId: Schema.optionalKey(bounded(4096)),
+    result: Schema.optionalKey(optionalText(131072)),
+    error: Schema.optionalKey(optionalText(16384)),
+    createdAt: Timestamp,
+    updatedAt: Timestamp,
+    startedAt: Schema.optionalKey(Timestamp),
+    completedAt: Schema.optionalKey(Timestamp)
+  });
+  ThreadContext = Schema.Struct({
+    thread: Thread,
+    messages: boundedArray(Message, 20),
+    tasks: boundedArray(Task, 20),
+    truncated: Schema.Boolean
+  });
+  CreateTaskInput = Schema.Struct({
+    threadId: Schema.optionalKey(ThreadId),
+    title: Schema.optionalKey(bounded(256)),
+    prompt: bounded(131072),
+    context: Schema.optionalKey(optionalText(131072)),
+    provider: Schema.optionalKey(Provider),
+    targetDeviceId: Schema.optionalKey(DeviceId),
+    parentTaskId: Schema.optionalKey(TaskId),
+    workspace: Schema.optionalKey(bounded(4096))
+  });
+  SocketEvent = Schema.TaggedUnion({
+    Authenticate: { token: bounded(256) },
+    Connected: { serverVersion: bounded(32), connectedAt: Timestamp },
+    DeviceHello: { device: Device },
+    DeviceHeartbeat: { deviceId: DeviceId, status: DeviceStatus },
+    TaskAssigned: { task: Task },
+    TaskAccepted: { taskId: TaskId },
+    TaskFinished: {
+      taskId: TaskId,
+      result: optionalText(131072),
+      providerSessionId: Schema.optionalKey(bounded(4096))
+    },
+    TaskFailed: { taskId: TaskId, error: bounded(16384) },
+    TaskCancelled: { taskId: TaskId },
+    TaskSettled: { taskId: TaskId },
+    CancelTask: { taskId: TaskId },
+    Error: { code: bounded(64), message: bounded(2048) }
+  });
+  ErrorResponse = Schema.Struct({
+    error: bounded(2048)
+  });
+  terminalTaskStatuses = new Set([
+    "completed",
+    "failed",
+    "cancelled"
+  ]);
+  decodeCreatePairingInput = Schema.decodeUnknownEffect(CreatePairingInput);
+  decodeExchangePairingInput = Schema.decodeUnknownEffect(ExchangePairingInput);
+  decodeCreateTaskInput = Schema.decodeUnknownEffect(CreateTaskInput);
+  decodeDevice = Schema.decodeUnknownEffect(Device);
+  decodeSocketEvent = Schema.decodeUnknownEffect(SocketEvent);
+});
+
+// apps/relay/src/config.ts
+import { Effect as Effect8, Schema as Schema8 } from "effect";
+import { access as access3, chmod as chmod2, mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir as homedir3, platform as platform4 } from "node:os";
+import { join as join4, resolve as resolve2 } from "node:path";
+var RelayConfiguration, defaultDataDirectory = () => {
+  if (platform4() === "win32") {
+    return join4(process.env.LOCALAPPDATA ?? join4(homedir3(), "AppData", "Local"), "Cohall");
+  }
+  if (platform4() === "darwin") {
+    return join4(homedir3(), "Library", "Application Support", "Cohall", "relay");
+  }
+  return join4(process.env.XDG_DATA_HOME ?? join4(homedir3(), ".local", "share"), "cohall");
+}, generatedToken = () => Array.from(crypto.getRandomValues(new Uint8Array(32)), (value) => value.toString(16).padStart(2, "0")).join(""), tokenFrom = async (path) => {
+  if (await access3(path).then(() => true).catch(() => false)) {
+    return (await readFile3(path, "utf8")).trim();
+  }
+  const token = generatedToken();
+  await writeFile3(path, `${token}
+`, { mode: 384 });
+  if (platform4() !== "win32") {
+    await chmod2(path, 384);
+  }
+  return token;
+}, booleanEnvironment = (name) => {
+  const value = process.env[name];
+  if (value === undefined || value === "false" || value === "0") {
+    return false;
+  }
+  if (value === "true" || value === "1") {
+    return true;
+  }
+  throw new Error(`${name} must be true or false`);
+}, isLoopback = (host) => host === "127.0.0.1" || host === "localhost" || host === "::1", loadEnvironmentConfiguration;
+var init_config = __esm(() => {
+  RelayConfiguration = Schema8.Struct({
+    host: Schema8.NonEmptyString,
+    port: Schema8.Int.check(Schema8.isBetween({ minimum: 1, maximum: 65535 })),
+    token: Schema8.NonEmptyString,
+    dataDirectory: Schema8.NonEmptyString,
+    databasePath: Schema8.NonEmptyString,
+    allowRemote: Schema8.Boolean
+  });
+  loadEnvironmentConfiguration = Effect8.tryPromise({
+    try: async () => {
+      const host = process.env.COHALL_RELAY_HOST ?? "127.0.0.1";
+      const port = Number(process.env.COHALL_RELAY_PORT ?? "8787");
+      const allowRemote = booleanEnvironment("COHALL_RELAY_ALLOW_REMOTE");
+      if (!isLoopback(host) && !allowRemote) {
+        throw new Error("Remote relay binding is disabled. Use a private network or TLS reverse proxy, then set COHALL_RELAY_ALLOW_REMOTE=true.");
+      }
+      const dataDirectory = resolve2(process.env.COHALL_DATA_DIR ?? defaultDataDirectory());
+      await mkdir3(dataDirectory, { recursive: true, mode: 448 });
+      if (platform4() !== "win32") {
+        await chmod2(dataDirectory, 448);
+      }
+      const token = process.env.COHALL_TOKEN ?? await tokenFrom(join4(dataDirectory, "owner-token"));
+      return Schema8.decodeUnknownSync(RelayConfiguration)({
+        host,
+        port,
+        token,
+        dataDirectory,
+        databasePath: join4(dataDirectory, "cohall.db"),
+        allowRemote
+      });
+    },
+    catch: (cause) => cause instanceof Error ? cause : new Error(String(cause))
+  });
+});
+
+// apps/relay/src/hub.ts
+import { WebSocket as WebSocket2 } from "ws";
+
+class Hub {
+  #principals = new Map;
+  #devices = new Map;
+  #deviceIds = new Map;
+  attach(socket, principal) {
+    this.#principals.set(socket, principal);
+    if (socket.data.authDeadline !== undefined) {
+      clearTimeout(socket.data.authDeadline);
+      socket.data.authDeadline = undefined;
+    }
+  }
+  isAuthorized(socket) {
+    const principal = this.#principals.get(socket);
+    if (principal === undefined) {
+      return false;
+    }
+    if (principal.expiresAt !== undefined && Date.parse(principal.expiresAt) <= Date.now()) {
+      socket.close(4003, "Session expired");
+      return false;
+    }
+    return true;
+  }
+  boundDeviceId(socket) {
+    return this.#principals.get(socket)?.boundDeviceId;
+  }
+  registerDevice(deviceId, socket) {
+    const previous = this.#devices.get(deviceId);
+    if (previous !== undefined && previous !== socket && previous.readyState === WebSocket2.OPEN) {
+      return false;
+    }
+    this.#devices.set(deviceId, socket);
+    this.#deviceIds.set(socket, deviceId);
+    return true;
+  }
+  detach(socket) {
+    if (socket.data.authDeadline !== undefined) {
+      clearTimeout(socket.data.authDeadline);
+    }
+    this.#principals.delete(socket);
+    const deviceId = this.#deviceIds.get(socket);
+    this.#deviceIds.delete(socket);
+    if (deviceId === undefined || this.#devices.get(deviceId) !== socket) {
+      return;
+    }
+    this.#devices.delete(deviceId);
+    return deviceId;
+  }
+  deviceId(socket) {
+    return this.#deviceIds.get(socket);
+  }
+  closeSession(sessionId) {
+    for (const [socket, principal] of this.#principals) {
+      if (principal.sessionId === sessionId) {
+        socket.close(4003, "Session revoked");
+      }
+    }
+  }
+  hasDevice(deviceId) {
+    return this.#devices.get(deviceId)?.readyState === WebSocket2.OPEN;
+  }
+  sendToDevice(deviceId, event) {
+    const socket = this.#devices.get(deviceId);
+    if (socket?.readyState !== WebSocket2.OPEN || !this.isAuthorized(socket)) {
+      return false;
+    }
+    try {
+      socket.send(JSON.stringify(event));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+var init_hub = () => {};
+
+// apps/relay/src/database.ts
+import { DatabaseSync } from "node:sqlite";
+
+class Statement {
+  #statement;
+  constructor(statement) {
+    this.#statement = statement;
+  }
+  get(...parameters) {
+    const row = this.#statement.get(...parameters);
+    return row === undefined ? null : row;
+  }
+  all(...parameters) {
+    return this.#statement.all(...parameters);
+  }
+  run(...parameters) {
+    const result = this.#statement.run(...parameters);
+    return { changes: Number(result.changes) };
+  }
+}
+
+class Database {
+  #database;
+  constructor(path) {
+    this.#database = new DatabaseSync(path);
+  }
+  query(sql) {
+    return new Statement(this.#database.prepare(sql));
+  }
+  exec(sql) {
+    this.#database.exec(sql);
+  }
+  transaction(operation) {
+    return () => {
+      this.#database.exec("BEGIN IMMEDIATE");
+      try {
+        const result = operation();
+        this.#database.exec("COMMIT");
+        return result;
+      } catch (cause) {
+        this.#database.exec("ROLLBACK");
+        throw cause;
+      }
+    };
+  }
+  close() {
+    this.#database.close();
+  }
+}
+var init_database = () => {};
+
+// apps/relay/src/store.ts
+var exports_store = {};
+__export(exports_store, {
+  layerFromDatabase: () => layerFromDatabase,
+  layer: () => layer2,
+  Service: () => Service2,
+  RelayStore: () => exports_store,
+  PersistenceError: () => PersistenceError
+});
+import { Context as Context2, Effect as Effect9, Layer as Layer2, Schema as Schema9 } from "effect";
+import { createHash, randomBytes } from "node:crypto";
+var PersistenceError, Service2, operationError = (operation) => (cause) => new PersistenceError({
+  operation,
+  message: cause instanceof Error ? cause.message : String(cause)
+}), decode = (operation, schema, value) => Schema9.decodeUnknownEffect(schema)(value).pipe(Effect9.mapError(operationError(operation))), threadFromRow = (row) => decode("RelayStore.decodeThread", Thread, {
+  id: row.id,
+  title: row.title,
+  createdAt: row.created_at,
+  updatedAt: row.updated_at,
+  ...row.default_device_id === null ? {} : { defaultDeviceId: row.default_device_id }
+}), messageFromRow = (row) => decode("RelayStore.decodeMessage", Message, {
+  id: row.id,
+  threadId: row.thread_id,
+  role: row.role === "tool" ? "agent" : row.role,
+  authorName: row.author_name,
+  content: row.content,
+  createdAt: row.created_at,
+  ...row.task_id === null ? {} : { taskId: row.task_id },
+  ...row.device_id === null ? {} : { deviceId: row.device_id }
+}), deviceFromRow = (row) => decode("RelayStore.decodeDevice", Device, {
+  id: row.id,
+  name: row.name,
+  hostname: row.hostname,
+  platform: row.platform,
+  architecture: row.architecture,
+  status: row.status,
+  providers: JSON.parse(row.providers_json),
+  capabilities: JSON.parse(row.capabilities_json),
+  workspaces: JSON.parse(row.workspaces_json),
+  version: row.version,
+  lastSeenAt: row.last_seen_at,
+  ...row.connected_at === null ? {} : { connectedAt: row.connected_at }
+}), taskFromRow = (row) => decode("RelayStore.decodeTask", Task, {
+  id: row.id,
+  threadId: row.thread_id,
+  prompt: row.prompt,
+  provider: row.provider,
+  status: row.status,
+  targetDeviceId: row.target_device_id,
+  createdAt: row.created_at,
+  updatedAt: row.updated_at,
+  ...row.context === null ? {} : { context: row.context },
+  ...row.source_device_id === null ? {} : { sourceDeviceId: row.source_device_id },
+  ...row.parent_task_id === null ? {} : { parentTaskId: row.parent_task_id },
+  ...row.workspace === null ? {} : { workspace: row.workspace },
+  ...row.provider_session_id === null ? {} : { providerSessionId: row.provider_session_id },
+  ...row.result === null ? {} : { result: row.result },
+  ...row.error === null ? {} : { error: row.error },
+  ...row.started_at === null ? {} : { startedAt: row.started_at },
+  ...row.completed_at === null ? {} : { completedAt: row.completed_at }
+}), rolesFromRow = (row) => Schema9.decodeUnknownSync(Schema9.Array(ConnectionRole))(JSON.parse(row.roles_json)), authSessionFromRow = (row) => {
+  const roles = rolesFromRow(row);
+  const role = roles[0];
+  return role === undefined ? Effect9.fail(new PersistenceError({
+    operation: "RelayStore.decodeAuthSession",
+    message: `Session ${row.id} has no role`
+  })) : decode("RelayStore.decodeAuthSession", AuthSession, {
+    id: row.id,
+    label: row.label,
+    role,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    lastSeenAt: row.last_seen_at,
+    ...row.bound_device_id === null ? {} : { deviceId: row.bound_device_id },
+    ...row.revoked_at === null ? {} : { revokedAt: row.revoked_at }
+  });
+}, secret = (prefix) => {
+  return `cohall_${prefix}_${randomBytes(32).toString("hex")}`;
+}, tokenHash = (token) => createHash("sha256").update(token).digest("hex"), providerName = (provider) => {
+  switch (provider) {
+    case "codex":
+      return "Codex";
+    case "claude-code":
+      return "Claude Code";
+    case "opencode":
+      return "OpenCode";
+  }
+}, recentWithin = (items, byteBudget) => {
+  const encoder = new TextEncoder;
+  const selected = [];
+  let bytes = 0;
+  for (let index = items.length - 1;index >= 0; index -= 1) {
+    const item = items[index];
+    if (item === undefined) {
+      continue;
+    }
+    const itemBytes = encoder.encode(JSON.stringify(item)).byteLength;
+    if (bytes + itemBytes > byteBudget) {
+      break;
+    }
+    bytes += itemBytes;
+    selected.unshift(item);
+  }
+  return { items: selected, truncated: selected.length < items.length };
+}, makeService = (db) => {
+  const queryTask = (taskId) => db.query("SELECT * FROM tasks WHERE id = ?").get(taskId);
+  const getTask = Effect9.fn("RelayStore.getTask")(function* (taskId) {
+    const row = yield* Effect9.try({
+      try: () => queryTask(taskId),
+      catch: operationError("RelayStore.getTask")
+    });
+    if (row === null) {
+      return yield* Effect9.fail(new PersistenceError({
+        operation: "RelayStore.getTask",
+        message: `Unknown task ${taskId}`
+      }));
+    }
+    return yield* taskFromRow(row);
+  });
+  const listDevices = Effect9.fn("RelayStore.listDevices")(function* () {
+    const rows = yield* Effect9.try({
+      try: () => db.query("SELECT * FROM devices ORDER BY name COLLATE NOCASE, id").all(),
+      catch: operationError("RelayStore.listDevices")
+    });
+    return yield* Effect9.forEach(rows, deviceFromRow);
+  });
+  const recover = Effect9.fn("RelayStore.recover")(function* () {
+    yield* Effect9.try({
+      try: () => db.transaction(() => {
+        const timestamp = now();
+        db.query("UPDATE devices SET status = 'offline'").run();
+        db.query("UPDATE tasks SET status = 'queued', updated_at = ? WHERE status IN ('assigned', 'running')").run(timestamp);
+        db.query("DELETE FROM auth_pairings WHERE expires_at <= ? OR used_at IS NOT NULL").run(timestamp);
+        db.query("UPDATE auth_sessions SET revoked_at = ? WHERE revoked_at IS NULL AND roles_json LIKE '%,%'").run(timestamp);
+      })(),
+      catch: operationError("RelayStore.recover")
+    });
+  });
+  const upsertDevice = Effect9.fn("RelayStore.upsertDevice")(function* (device) {
+    yield* Effect9.try({
+      try: () => db.query(`INSERT INTO devices (
+            id, name, hostname, platform, architecture, status, providers_json,
+            capabilities_json, workspaces_json, version, last_seen_at, connected_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT(id) DO UPDATE SET
+            name = excluded.name, hostname = excluded.hostname, platform = excluded.platform,
+            architecture = excluded.architecture, status = excluded.status,
+            providers_json = excluded.providers_json, capabilities_json = excluded.capabilities_json,
+            workspaces_json = excluded.workspaces_json, version = excluded.version,
+            last_seen_at = excluded.last_seen_at, connected_at = excluded.connected_at`).run(device.id, device.name, device.hostname, device.platform, device.architecture, device.status, JSON.stringify(device.providers), JSON.stringify(device.capabilities), JSON.stringify(device.workspaces), device.version, device.lastSeenAt, device.connectedAt ?? null),
+      catch: operationError("RelayStore.upsertDevice")
+    });
+    return device;
+  });
+  const updateDeviceStatus = Effect9.fn("RelayStore.updateDeviceStatus")(function* (deviceId, status) {
+    const timestamp = now();
+    const result = yield* Effect9.try({
+      try: () => db.query("UPDATE devices SET status = ?, last_seen_at = ? WHERE id = ?").run(status, timestamp, deviceId),
+      catch: operationError("RelayStore.updateDeviceStatus")
+    });
+    if (result.changes !== 1) {
+      return yield* Effect9.fail(new PersistenceError({
+        operation: "RelayStore.updateDeviceStatus",
+        message: `Unknown device ${deviceId}`
+      }));
+    }
+    const row = db.query("SELECT * FROM devices WHERE id = ?").get(deviceId);
+    if (row === null) {
+      return yield* Effect9.fail(new PersistenceError({
+        operation: "RelayStore.updateDeviceStatus.read",
+        message: `Device ${deviceId} disappeared after update`
+      }));
+    }
+    return yield* deviceFromRow(row);
+  });
+  const createDelegation2 = Effect9.fn("RelayStore.createDelegation")(function* (input, targetDeviceId, sourceDeviceId, providerSessionId) {
+    const timestamp = now();
+    const threadId = input.threadId ?? makeThreadId();
+    const task = Task.make({
+      id: makeTaskId(),
+      threadId,
+      prompt: input.prompt,
+      provider: input.provider ?? "codex",
+      status: "queued",
+      targetDeviceId,
+      createdAt: timestamp,
+      updatedAt: timestamp,
+      ...input.context === undefined ? {} : { context: input.context },
+      ...sourceDeviceId === undefined ? {} : { sourceDeviceId },
+      ...input.parentTaskId === undefined ? {} : { parentTaskId: input.parentTaskId },
+      ...input.workspace === undefined ? {} : { workspace: input.workspace },
+      ...providerSessionId === undefined ? {} : { providerSessionId }
+    });
+    const thread = input.threadId === undefined ? Thread.make({
+      id: threadId,
+      title: input.title ?? input.prompt.slice(0, 72),
+      createdAt: timestamp,
+      updatedAt: timestamp
+    }) : undefined;
+    const message = Message.make({
+      id: makeMessageId(),
+      threadId,
+      role: "human",
+      authorName: sourceDeviceId === undefined ? "User" : "Remote agent",
+      content: input.prompt,
+      createdAt: timestamp,
+      taskId: task.id,
+      ...sourceDeviceId === undefined ? {} : { deviceId: sourceDeviceId }
+    });
+    yield* Effect9.try({
+      try: () => db.transaction(() => {
+        const outstanding = db.query(`SELECT COUNT(*) AS count FROM tasks WHERE target_device_id = ?
+               AND status IN ('queued', 'assigned', 'running', 'cancelling')`).get(targetDeviceId);
+        if ((outstanding?.count ?? 0) >= 100) {
+          throw new Error(`Device ${targetDeviceId} has reached its outstanding task limit`);
+        }
+        if (thread !== undefined) {
+          db.query("INSERT INTO threads (id, title, created_at, updated_at) VALUES (?, ?, ?, ?)").run(thread.id, thread.title, thread.createdAt, thread.updatedAt);
+        } else if (db.query("SELECT id FROM threads WHERE id = ?").get(threadId) === null) {
+          throw new Error(`Unknown thread ${threadId}`);
+        }
+        db.query(`INSERT INTO tasks (
+              id, thread_id, prompt, context, provider, status, source_device_id,
+              target_device_id, parent_task_id, workspace, provider_session_id,
+              created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(task.id, task.threadId, task.prompt, task.context ?? null, task.provider, task.status, task.sourceDeviceId ?? null, task.targetDeviceId, task.parentTaskId ?? null, task.workspace ?? null, task.providerSessionId ?? null, task.createdAt, task.updatedAt);
+        db.query(`INSERT INTO messages (
+              id, thread_id, role, kind, author_id, author_name, content, created_at,
+              task_id, device_id
+            ) VALUES (?, ?, ?, 'chat', ?, ?, ?, ?, ?, ?)`).run(message.id, message.threadId, message.role, sourceDeviceId ?? "user", message.authorName, message.content, message.createdAt, message.taskId ?? null, message.deviceId ?? null);
+        db.query("UPDATE threads SET updated_at = ? WHERE id = ?").run(timestamp, threadId);
+      })(),
+      catch: operationError("RelayStore.createDelegation")
+    });
+    return task;
+  });
+  const threadContext2 = Effect9.fn("RelayStore.threadContext")(function* (threadId) {
+    const threadRow = yield* Effect9.try({
+      try: () => db.query("SELECT * FROM threads WHERE id = ?").get(threadId),
+      catch: operationError("RelayStore.threadContext.thread")
+    });
+    if (threadRow === null) {
+      return yield* Effect9.fail(new PersistenceError({
+        operation: "RelayStore.threadContext",
+        message: `Unknown thread ${threadId}`
+      }));
+    }
+    const [messageRows, taskRows] = yield* Effect9.try({
+      try: () => [
+        db.query(`SELECT * FROM (
+                 SELECT * FROM messages WHERE thread_id = ?
+                 ORDER BY created_at DESC, id DESC LIMIT 21
+               ) ORDER BY created_at, id`).all(threadId),
+        db.query(`SELECT * FROM (
+                 SELECT * FROM tasks WHERE thread_id = ?
+                 ORDER BY created_at DESC, id DESC LIMIT 21
+               ) ORDER BY created_at, id`).all(threadId)
+      ],
+      catch: operationError("RelayStore.threadContext.items")
+    });
+    const [thread, messages, tasks] = yield* Effect9.all([
+      threadFromRow(threadRow),
+      Effect9.forEach(messageRows.slice(-20), messageFromRow),
+      Effect9.forEach(taskRows.slice(-20), taskFromRow)
+    ]);
+    const recentMessages = recentWithin(messages, 256 * 1024);
+    const recentTasks = recentWithin(tasks, 768 * 1024);
+    return ThreadContext.make({
+      thread,
+      messages: recentMessages.items,
+      tasks: recentTasks.items,
+      truncated: messageRows.length > 20 || taskRows.length > 20 || recentMessages.truncated || recentTasks.truncated
+    });
+  });
+  const pendingTasksFor = Effect9.fn("RelayStore.pendingTasksFor")(function* (deviceId) {
+    const rows = yield* Effect9.try({
+      try: () => db.query(`SELECT * FROM tasks WHERE target_device_id = ?
+           AND status IN ('queued', 'cancelling') ORDER BY created_at, id LIMIT 100`).all(deviceId),
+      catch: operationError("RelayStore.pendingTasksFor")
+    });
+    return yield* Effect9.forEach(rows, taskFromRow);
+  });
+  const transition = Effect9.fn("RelayStore.transition")(function* (taskId, expected, update) {
+    const current = yield* getTask(taskId);
+    if (!expected.includes(current.status)) {
+      return current;
+    }
+    const placeholders = expected.map(() => "?").join(", ");
+    yield* Effect9.try({
+      try: () => db.query(`UPDATE tasks SET status = ?, provider_session_id = ?, result = ?, error = ?,
+           started_at = ?, completed_at = ?, updated_at = ?
+           WHERE id = ? AND status IN (${placeholders})`).run(update.status ?? current.status, update.providerSessionId ?? current.providerSessionId ?? null, update.result ?? current.result ?? null, update.error ?? current.error ?? null, update.startedAt ?? current.startedAt ?? null, update.completedAt ?? current.completedAt ?? null, now(), taskId, ...expected),
+      catch: operationError("RelayStore.transition")
+    });
+    return yield* getTask(taskId);
+  });
+  const assignTask = Effect9.fn("RelayStore.assignTask")(function* (taskId) {
+    const current = yield* getTask(taskId);
+    if (current.status !== "queued") {
+      return current;
+    }
+    yield* Effect9.try({
+      try: () => db.query(`UPDATE tasks SET status = 'assigned', updated_at = ?
+             WHERE id = ? AND status = 'queued' AND NOT EXISTS (
+               SELECT 1 FROM tasks active
+               WHERE active.target_device_id = ? AND active.id <> ?
+                 AND active.status IN ('assigned', 'running', 'cancelling')
+             )`).run(now(), taskId, current.targetDeviceId, taskId),
+      catch: operationError("RelayStore.assignTask")
+    });
+    return yield* getTask(taskId);
+  });
+  const requireTarget = Effect9.fn("RelayStore.requireTarget")(function* (taskId, deviceId) {
+    const task = yield* getTask(taskId);
+    if (task.targetDeviceId !== deviceId) {
+      return yield* Effect9.fail(new PersistenceError({
+        operation: "RelayStore.requireTarget",
+        message: `Task ${taskId} belongs to another device`
+      }));
+    }
+    return task;
+  });
+  const terminal = Effect9.fn("RelayStore.terminal")(function* (taskId, deviceId, status, result, error, providerSessionId) {
+    const current = yield* requireTarget(taskId, deviceId);
+    if (["completed", "failed", "cancelled"].includes(current.status)) {
+      return current;
+    }
+    const timestamp = now();
+    yield* Effect9.try({
+      try: () => db.transaction(() => {
+        const updated = db.query(`UPDATE tasks SET status = ?, result = ?, error = ?, provider_session_id = ?,
+             completed_at = ?, updated_at = ? WHERE id = ?
+             AND status NOT IN ('completed', 'failed', 'cancelled')`).run(status, result ?? null, error ?? null, providerSessionId ?? current.providerSessionId ?? null, timestamp, timestamp, taskId);
+        if (updated.changes !== 1) {
+          return;
+        }
+        if (providerSessionId !== undefined) {
+          db.query(`INSERT INTO provider_sessions (thread_id, device_id, provider, session_id, updated_at)
+               VALUES (?, ?, ?, ?, ?)
+               ON CONFLICT(thread_id, device_id, provider) DO UPDATE SET
+               session_id = excluded.session_id, updated_at = excluded.updated_at`).run(current.threadId, deviceId, current.provider, providerSessionId, timestamp);
+        }
+        const content = result ?? error;
+        if (content !== undefined) {
+          const role = status === "completed" ? "agent" : "system";
+          db.query(`INSERT INTO messages (
+                id, thread_id, role, kind, author_id, author_name, content, created_at,
+                task_id, device_id
+              ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(makeMessageId(), current.threadId, role, status === "failed" ? "error" : "chat", deviceId, status === "completed" ? providerName(current.provider) : "Cohall", content, timestamp, taskId, deviceId);
+          db.query("UPDATE threads SET updated_at = ? WHERE id = ?").run(timestamp, current.threadId);
+        }
+      })(),
+      catch: operationError("RelayStore.terminal")
+    });
+    return yield* getTask(taskId);
+  });
+  const requestCancellation = Effect9.fn("RelayStore.requestCancellation")(function* (taskId) {
+    const current = yield* getTask(taskId);
+    if (["completed", "failed", "cancelled"].includes(current.status)) {
+      return current;
+    }
+    return current.status === "queued" ? yield* transition(taskId, ["queued"], { status: "cancelled", completedAt: now() }) : yield* transition(taskId, ["assigned", "running", "cancelling"], {
+      status: "cancelling"
+    });
+  });
+  const requeueTasksFor = Effect9.fn("RelayStore.requeueTasksFor")(function* (deviceId) {
+    yield* Effect9.try({
+      try: () => db.query(`UPDATE tasks SET status = 'queued', updated_at = ?
+           WHERE target_device_id = ? AND status IN ('assigned', 'running')`).run(now(), deviceId),
+      catch: operationError("RelayStore.requeueTasksFor")
+    });
+  });
+  const sessionFor = Effect9.fn("RelayStore.sessionFor")(function* (threadId, deviceId, provider) {
+    const row = yield* Effect9.try({
+      try: () => db.query(`SELECT session_id FROM provider_sessions
+           WHERE thread_id = ? AND device_id = ? AND provider = ?`).get(threadId, deviceId, provider),
+      catch: operationError("RelayStore.sessionFor")
+    });
+    return row?.session_id;
+  });
+  const createPairing = Effect9.fn("RelayStore.createPairing")(function* (input) {
+    const roles = [...new Set(input.roles)];
+    if (roles.length === 0) {
+      return yield* Effect9.fail(new PersistenceError({
+        operation: "RelayStore.createPairing",
+        message: "A pairing must allow at least one role"
+      }));
+    }
+    const token = secret("pair");
+    const expiresAt = new Date(Date.now() + 10 * 60 * 1000).toISOString();
+    yield* Effect9.try({
+      try: () => db.query(`INSERT INTO auth_pairings (token_hash, label, roles_json, expires_at, created_at)
+           VALUES (?, ?, ?, ?, ?)`).run(tokenHash(token), input.label, JSON.stringify(roles), expiresAt, now()),
+      catch: operationError("RelayStore.createPairing")
+    });
+    return PairingCredential.make({ token, expiresAt: Timestamp.make(expiresAt) });
+  });
+  const exchangePairing2 = Effect9.fn("RelayStore.exchangePairing")(function* (token) {
+    const timestamp = now();
+    const expiresAt = new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString();
+    const created = yield* Effect9.try({
+      try: () => db.transaction(() => {
+        const pairing = db.query(`SELECT * FROM auth_pairings
+             WHERE token_hash = ? AND used_at IS NULL AND expires_at > ?`).get(tokenHash(token), timestamp);
+        if (pairing === null) {
+          throw new Error("Pairing credential is invalid, expired, or already used");
+        }
+        const roles = Schema9.decodeUnknownSync(Schema9.Array(ConnectionRole))(JSON.parse(pairing.roles_json));
+        const deviceId = roles.includes("device") ? makeDeviceId() : undefined;
+        const consumed = db.query("UPDATE auth_pairings SET used_at = ? WHERE token_hash = ? AND used_at IS NULL").run(timestamp, pairing.token_hash);
+        if (consumed.changes !== 1) {
+          throw new Error("Pairing credential was already used");
+        }
+        return [...new Set(roles)].map((role) => {
+          const sessionToken = secret("session");
+          const row = {
+            id: makeAuthSessionId(),
+            token_hash: tokenHash(sessionToken),
+            label: pairing.label,
+            roles_json: JSON.stringify([role]),
+            created_at: timestamp,
+            expires_at: expiresAt,
+            last_seen_at: timestamp,
+            bound_device_id: role === "device" ? deviceId ?? null : null,
+            revoked_at: null
+          };
+          db.query(`INSERT INTO auth_sessions (
+                id, token_hash, label, roles_json, created_at, expires_at, last_seen_at,
+                bound_device_id
+              ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(row.id, row.token_hash, row.label, row.roles_json, row.created_at, row.expires_at, row.last_seen_at, row.bound_device_id);
+          return { token: sessionToken, row };
+        });
+      })(),
+      catch: operationError("RelayStore.exchangePairing")
+    });
+    const credentials = yield* Effect9.forEach(created, ({ token: sessionToken, row }) => authSessionFromRow(row).pipe(Effect9.map((session) => ({ token: sessionToken, session }))));
+    return PairingResult.make({ credentials });
+  });
+  const authenticateSession = Effect9.fn("RelayStore.authenticateSession")(function* (token, role) {
+    const row = yield* Effect9.try({
+      try: () => db.query(`SELECT * FROM auth_sessions
+           WHERE token_hash = ? AND revoked_at IS NULL AND expires_at > ?`).get(tokenHash(token), now()),
+      catch: operationError("RelayStore.authenticateSession")
+    });
+    if (row === null || !rolesFromRow(row).includes(role)) {
+      return;
+    }
+    const lastSeenAt = now();
+    yield* Effect9.try({
+      try: () => db.query("UPDATE auth_sessions SET last_seen_at = ? WHERE id = ?").run(lastSeenAt, row.id),
+      catch: operationError("RelayStore.authenticateSession.touch")
+    });
+    const session = yield* authSessionFromRow(row);
+    return AuthSession.make({ ...session, lastSeenAt });
+  });
+  const listAuthSessions = Effect9.fn("RelayStore.listAuthSessions")(function* () {
+    const rows = yield* Effect9.try({
+      try: () => db.query("SELECT * FROM auth_sessions ORDER BY created_at DESC, id LIMIT 1000").all(),
+      catch: operationError("RelayStore.listAuthSessions")
+    });
+    return yield* Effect9.forEach(rows, authSessionFromRow);
+  });
+  const revokeAuthSession = Effect9.fn("RelayStore.revokeAuthSession")(function* (sessionId) {
+    const revokedAt = now();
+    const result = yield* Effect9.try({
+      try: () => db.query("UPDATE auth_sessions SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL").run(revokedAt, sessionId),
+      catch: operationError("RelayStore.revokeAuthSession")
+    });
+    if (result.changes !== 1) {
+      return yield* Effect9.fail(new PersistenceError({
+        operation: "RelayStore.revokeAuthSession",
+        message: `Unknown or already revoked session ${sessionId}`
+      }));
+    }
+    const row = db.query("SELECT * FROM auth_sessions WHERE id = ?").get(sessionId);
+    if (row === null) {
+      return yield* Effect9.fail(new PersistenceError({
+        operation: "RelayStore.revokeAuthSession.read",
+        message: `Session ${sessionId} disappeared after revocation`
+      }));
+    }
+    return yield* authSessionFromRow(row);
+  });
+  return Service2.of({
+    recover,
+    listDevices,
+    upsertDevice,
+    heartbeat: (deviceId, status) => updateDeviceStatus(deviceId, status),
+    markDeviceOffline: (deviceId) => updateDeviceStatus(deviceId, "offline"),
+    createDelegation: createDelegation2,
+    getTask,
+    threadContext: threadContext2,
+    pendingTasksFor,
+    assignTask,
+    rollbackAssignment: (taskId) => transition(taskId, ["assigned"], { status: "queued" }),
+    acceptTask: (taskId, deviceId) => requireTarget(taskId, deviceId).pipe(Effect9.flatMap(() => transition(taskId, ["assigned"], { status: "running", startedAt: now() }))),
+    finishTask: (taskId, deviceId, result, providerSessionId) => terminal(taskId, deviceId, "completed", result, undefined, providerSessionId),
+    failTask: (taskId, deviceId, error) => terminal(taskId, deviceId, "failed", undefined, error),
+    acknowledgeCancellation: (taskId, deviceId) => terminal(taskId, deviceId, "cancelled"),
+    requestCancellation,
+    requeueTasksFor,
+    sessionFor,
+    createPairing,
+    exchangePairing: exchangePairing2,
+    authenticateSession,
+    listAuthSessions,
+    revokeAuthSession
+  });
+}, migrate = (db) => Effect9.try({
+  try: () => {
+    db.exec("PRAGMA journal_mode = WAL");
+    db.exec("PRAGMA foreign_keys = ON");
+    db.exec("PRAGMA busy_timeout = 5000");
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS devices (
+          id TEXT PRIMARY KEY, name TEXT NOT NULL, hostname TEXT NOT NULL,
+          platform TEXT NOT NULL, architecture TEXT NOT NULL, status TEXT NOT NULL,
+          providers_json TEXT NOT NULL, capabilities_json TEXT NOT NULL,
+          workspaces_json TEXT NOT NULL, version TEXT NOT NULL, last_seen_at TEXT NOT NULL,
+          connected_at TEXT
+        );
+        CREATE TABLE IF NOT EXISTS threads (
+          id TEXT PRIMARY KEY, title TEXT NOT NULL, created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL, archived_at TEXT,
+          default_device_id TEXT REFERENCES devices(id)
+        );
+        CREATE TABLE IF NOT EXISTS messages (
+          id TEXT PRIMARY KEY, thread_id TEXT NOT NULL REFERENCES threads(id) ON DELETE CASCADE,
+          role TEXT NOT NULL, kind TEXT NOT NULL DEFAULT 'chat', author_id TEXT NOT NULL,
+          author_name TEXT NOT NULL, content TEXT NOT NULL, created_at TEXT NOT NULL,
+          task_id TEXT, reply_to TEXT, device_id TEXT REFERENCES devices(id)
+        );
+        CREATE INDEX IF NOT EXISTS messages_thread_created ON messages(thread_id, created_at);
+        CREATE TABLE IF NOT EXISTS tasks (
+          id TEXT PRIMARY KEY, thread_id TEXT NOT NULL REFERENCES threads(id) ON DELETE CASCADE,
+          prompt TEXT NOT NULL, context TEXT, provider TEXT NOT NULL, status TEXT NOT NULL,
+          source_device_id TEXT REFERENCES devices(id),
+          target_device_id TEXT NOT NULL REFERENCES devices(id), parent_task_id TEXT,
+          workspace TEXT, provider_session_id TEXT, result TEXT, error TEXT,
+          created_at TEXT NOT NULL, updated_at TEXT NOT NULL, started_at TEXT, completed_at TEXT
+        );
+        CREATE INDEX IF NOT EXISTS tasks_thread_created ON tasks(thread_id, created_at);
+        CREATE INDEX IF NOT EXISTS tasks_target_status ON tasks(target_device_id, status);
+        CREATE TABLE IF NOT EXISTS provider_sessions (
+          thread_id TEXT NOT NULL REFERENCES threads(id) ON DELETE CASCADE,
+          device_id TEXT NOT NULL REFERENCES devices(id) ON DELETE CASCADE,
+          provider TEXT NOT NULL, session_id TEXT NOT NULL, updated_at TEXT NOT NULL,
+          PRIMARY KEY(thread_id, device_id, provider)
+        );
+        CREATE TABLE IF NOT EXISTS auth_pairings (
+          token_hash TEXT PRIMARY KEY, label TEXT NOT NULL, roles_json TEXT NOT NULL,
+          expires_at TEXT NOT NULL, created_at TEXT NOT NULL, used_at TEXT
+        );
+        CREATE TABLE IF NOT EXISTS auth_sessions (
+          id TEXT PRIMARY KEY, token_hash TEXT NOT NULL UNIQUE, label TEXT NOT NULL,
+          roles_json TEXT NOT NULL, created_at TEXT NOT NULL, expires_at TEXT NOT NULL,
+          last_seen_at TEXT NOT NULL, bound_device_id TEXT, revoked_at TEXT
+        );
+        CREATE INDEX IF NOT EXISTS auth_sessions_token ON auth_sessions(token_hash);
+      `);
+  },
+  catch: operationError("RelayStore.migrate")
+}), layer2 = (path) => Layer2.effect(Service2, Effect9.acquireRelease(Effect9.try({
+  try: () => new Database(path),
+  catch: operationError("RelayStore.open")
+}).pipe(Effect9.tap(migrate)), (db) => Effect9.sync(() => db.close())).pipe(Effect9.map(makeService))), layerFromDatabase = (db) => Layer2.effect(Service2, migrate(db).pipe(Effect9.map(() => makeService(db))));
+var init_store = __esm(() => {
+  init_src();
+  init_database();
+  init_store();
+  PersistenceError = class PersistenceError extends Schema9.TaggedErrorClass()("RelayStore.PersistenceError", { operation: Schema9.String, message: Schema9.String }) {
+  };
+  Service2 = class Service2 extends Context2.Service()("@cohall/RelayStore") {
+  };
+});
+
+// apps/relay/src/main.ts
+var exports_main = {};
+__export(exports_main, {
+  runRelay: () => runRelay
+});
+import { Effect as Effect10, ManagedRuntime, Schema as Schema10 } from "effect";
+import { createHash as createHash2, timingSafeEqual } from "node:crypto";
+import { access as access4, chmod as chmod3 } from "node:fs/promises";
+import { createServer } from "node:http";
+import { platform as platform5 } from "node:os";
+import { WebSocketServer } from "ws";
+var RequestError, json = (value, status = 200) => Response.json(value, {
+  status,
+  headers: {
+    "cache-control": "no-store",
+    "x-content-type-options": "nosniff"
+  }
+}), requestBody = (request, limit) => {
+  if (request.method === "GET" || request.method === "HEAD") {
+    return Promise.resolve(undefined);
+  }
+  return new Promise((resolve3, reject) => {
+    const chunks = [];
+    let size = 0;
+    const cleanup = () => {
+      request.off("data", onData);
+      request.off("end", onEnd);
+      request.off("error", onError);
+    };
+    const onData = (chunk) => {
+      size += chunk.byteLength;
+      if (size <= limit) {
+        chunks.push(chunk);
+        return;
+      }
+      cleanup();
+      reject(new Error("Request body exceeded 256 KiB"));
+    };
+    const onEnd = () => {
+      cleanup();
+      resolve3(Buffer.concat(chunks, size));
+    };
+    const onError = (cause) => {
+      cleanup();
+      reject(cause);
+    };
+    request.on("data", onData);
+    request.once("end", onEnd);
+    request.once("error", onError);
+  });
+}, webRequest = async (request) => {
+  const headers = new Headers;
+  for (let index = 0;index < request.rawHeaders.length; index += 2) {
+    const name = request.rawHeaders[index];
+    const value = request.rawHeaders[index + 1];
+    if (name !== undefined && value !== undefined) {
+      headers.append(name, value);
+    }
+  }
+  const payload = await requestBody(request, 256 * 1024);
+  return new Request(new URL(request.url ?? "/", "http://cohall.local"), {
+    method: request.method ?? "GET",
+    headers,
+    ...payload === undefined ? {} : { body: new Uint8Array(payload) }
+  });
+}, sendResponse = async (target, response) => {
+  target.statusCode = response.status;
+  response.headers.forEach((value, name) => target.setHeader(name, value));
+  target.end(Buffer.from(await response.arrayBuffer()));
+}, socketText = (message) => {
+  if (Buffer.isBuffer(message)) {
+    return message.toString("utf8");
+  }
+  if (message instanceof ArrayBuffer) {
+    return Buffer.from(message).toString("utf8");
+  }
+  if (Array.isArray(message)) {
+    return Buffer.concat(message).toString("utf8");
+  }
+  return Buffer.from(message).toString("utf8");
+}, rejectUpgrade = (socket, status, message) => {
+  socket.write(`HTTP/1.1 ${status} ${message}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+  if ("destroy" in socket && typeof socket.destroy === "function") {
+    socket.destroy();
+  }
+}, body = (request, decode2) => Effect10.tryPromise({
+  try: () => request.json(),
+  catch: () => new RequestError({ status: 400, message: "Expected a JSON request body" })
+}).pipe(Effect10.flatMap(decode2), Effect10.mapError((cause) => cause instanceof RequestError ? cause : new RequestError({ status: 400, message: String(cause).slice(0, 2048) }))), pathId = (schema, value) => Schema10.decodeUnknownEffect(schema)(value).pipe(Effect10.mapError(() => new RequestError({ status: 400, message: `Invalid identifier: ${value}` }))), scoreDevice = (device, input, sourceDeviceId) => {
+  const prompt = `${input.prompt} ${input.context ?? ""}`.toLowerCase();
+  const needsXcode = /\b(xcode|ios|macos|swiftui|app store)\b/.test(prompt);
+  const needsBrowser = /\b(browser|chrome|youtube|twitter|logged[- ]?in|signed[- ]?in|x\.com)\b/.test(prompt);
+  return (device.status === "offline" ? 0 : 100) + (input.workspace !== undefined && device.workspaces.some((workspace) => input.workspace === workspace.path || input.workspace?.startsWith(`${workspace.path}/`)) ? 80 : 0) + (needsXcode && device.capabilities.some((capability) => capability.id === "xcode") ? 60 : 0) + (needsBrowser && device.capabilities.some((capability) => capability.id === "browser-session") ? 40 : 0) + (sourceDeviceId === device.id ? -5 : 0);
+}, chooseDevice = (input, sourceDeviceId) => Effect10.gen(function* () {
+  const store = yield* exports_store.Service;
+  const devices = yield* store.listDevices().pipe(Effect10.mapError((cause) => new RequestError({ status: 500, message: cause.message })));
+  const provider = input.provider ?? "codex";
+  if (input.targetDeviceId !== undefined) {
+    const target = devices.find((device) => device.id === input.targetDeviceId);
+    if (target === undefined) {
+      return yield* new RequestError({
+        status: 404,
+        message: `Unknown target device ${input.targetDeviceId}`
+      });
+    }
+    if (!target.providers.includes(provider)) {
+      return yield* new RequestError({
+        status: 409,
+        message: `${target.name} does not advertise the ${provider} provider`
+      });
+    }
+    return target.id;
+  }
+  const selected = devices.filter((device) => device.providers.includes(provider)).sort((left, right) => scoreDevice(right, input, sourceDeviceId) - scoreDevice(left, input, sourceDeviceId))[0];
+  if (selected === undefined) {
+    return yield* new RequestError({
+      status: 409,
+      message: `No Cohall device advertises the ${provider} provider`
+    });
+  }
+  return selected.id;
+}), runRelay = async () => {
+  const configuration = await Effect10.runPromise(loadEnvironmentConfiguration);
+  process.umask(63);
+  const runtime = ManagedRuntime.make(exports_store.layer(configuration.databasePath));
+  const run2 = (effect) => runtime.runPromise(effect);
+  await run2(Effect10.gen(function* () {
+    const store = yield* exports_store.Service;
+    yield* store.recover();
+  }));
+  if (platform5() !== "win32" && await access4(configuration.databasePath).then(() => true).catch(() => false)) {
+    await chmod3(configuration.databasePath, 384);
+  }
+  const hub = new Hub;
+  let connections = 0;
+  const tokenDigest = (token) => createHash2("sha256").update(token).digest();
+  const ownerToken = (token) => timingSafeEqual(tokenDigest(token), tokenDigest(configuration.token));
+  const authenticate = async (token, role) => {
+    if (ownerToken(token)) {
+      return "owner";
+    }
+    return run2(Effect10.gen(function* () {
+      const store = yield* exports_store.Service;
+      return yield* store.authenticateSession(token, role);
+    })).catch(() => {
+      return;
+    });
+  };
+  const principalFor = async (request) => {
+    const authorization = request.headers.get("authorization");
+    if (authorization?.startsWith("Bearer ") !== true) {
+      return;
+    }
+    return authenticate(authorization.slice("Bearer ".length), "client");
+  };
+  const dispatch = async (task) => {
+    const assigned = await run2(Effect10.gen(function* () {
+      const store = yield* exports_store.Service;
+      return yield* store.assignTask(task.id);
+    }));
+    if (assigned.status !== "assigned") {
+      return assigned;
+    }
+    if (hub.sendToDevice(assigned.targetDeviceId, SocketEvent.make({ _tag: "TaskAssigned", task: assigned }))) {
+      return assigned;
+    }
+    return run2(Effect10.gen(function* () {
+      const store = yield* exports_store.Service;
+      return yield* store.rollbackAssignment(task.id);
+    }));
+  };
+  const dispatchPending = async (deviceId) => {
+    const tasks = await run2(Effect10.gen(function* () {
+      const store = yield* exports_store.Service;
+      return yield* store.pendingTasksFor(deviceId);
+    }));
+    for (const task of tasks) {
+      if (task.status === "cancelling") {
+        hub.sendToDevice(deviceId, SocketEvent.make({ _tag: "CancelTask", taskId: task.id }));
+      } else {
+        await dispatch(task);
+      }
+    }
+  };
+  const sendError = (socket, code, message) => {
+    socket.send(JSON.stringify(SocketEvent.make({
+      _tag: "Error",
+      code: code.slice(0, 64),
+      message: message.slice(0, 2048)
+    })));
+  };
+  const handleSocketEvent = async (socket, input) => {
+    const event = await Effect10.runPromise(Effect10.try({
+      try: () => JSON.parse(socketText(input)),
+      catch: () => new RequestError({ status: 400, message: "Invalid socket JSON" })
+    }).pipe(Effect10.flatMap(decodeSocketEvent))).catch((cause) => {
+      sendError(socket, "invalid_event", cause instanceof Error ? cause.message : String(cause));
+      return;
+    });
+    if (event === undefined) {
+      return;
+    }
+    if (!hub.isAuthorized(socket)) {
+      if (event._tag !== "Authenticate") {
+        socket.close(4003, "Authentication required");
+        return;
+      }
+      const principal = await authenticate(event.token, "device");
+      if (principal === undefined) {
+        socket.close(4003, "Authentication failed");
+        return;
+      }
+      hub.attach(socket, {
+        ...principal === "owner" ? {} : { sessionId: principal.id },
+        ...principal === "owner" || principal.deviceId === undefined ? {} : { boundDeviceId: principal.deviceId },
+        ...principal === "owner" ? {} : { expiresAt: principal.expiresAt }
+      });
+      socket.send(JSON.stringify(SocketEvent.make({ _tag: "Connected", serverVersion: version, connectedAt: now() })));
+      return;
+    }
+    if (event._tag === "Authenticate") {
+      return;
+    }
+    if (event._tag === "DeviceHello") {
+      const bound = hub.boundDeviceId(socket);
+      if (bound !== undefined && bound !== event.device.id) {
+        socket.close(4003, "Device identity does not match its session");
+        return;
+      }
+      const device = Device.make({
+        ...event.device,
+        status: "online",
+        connectedAt: now(),
+        lastSeenAt: now()
+      });
+      if (!hub.registerDevice(device.id, socket)) {
+        socket.close(4009, "Device is already connected");
+        return;
+      }
+      await run2(Effect10.gen(function* () {
+        const store = yield* exports_store.Service;
+        yield* store.upsertDevice(device);
+      }));
+      await dispatchPending(device.id);
+      return;
+    }
+    const deviceId = hub.deviceId(socket);
+    if (deviceId === undefined) {
+      sendError(socket, "device_hello_required", "Send DeviceHello before device events");
+      return;
+    }
+    const settle = (taskId) => {
+      socket.send(JSON.stringify(SocketEvent.make({ _tag: "TaskSettled", taskId })));
+    };
+    const processed = await run2(Effect10.gen(function* () {
+      const store = yield* exports_store.Service;
+      switch (event._tag) {
+        case "DeviceHeartbeat":
+          if (event.deviceId === deviceId) {
+            yield* store.heartbeat(deviceId, event.status === "busy" ? "busy" : "online");
+          }
+          return;
+        case "TaskAccepted":
+          yield* store.acceptTask(event.taskId, deviceId);
+          return;
+        case "TaskFinished":
+          yield* store.finishTask(event.taskId, deviceId, event.result, event.providerSessionId);
+          return;
+        case "TaskFailed":
+          yield* store.failTask(event.taskId, deviceId, event.error);
+          return;
+        case "TaskCancelled":
+          yield* store.acknowledgeCancellation(event.taskId, deviceId);
+          return;
+        case "Connected":
+        case "TaskAssigned":
+        case "TaskSettled":
+        case "CancelTask":
+        case "Error":
+          return;
+      }
+    })).then(() => true).catch((cause) => {
+      sendError(socket, "event_failed", cause instanceof Error ? cause.message : String(cause));
+      return false;
+    });
+    if (processed && (event._tag === "TaskFinished" || event._tag === "TaskFailed" || event._tag === "TaskCancelled")) {
+      settle(event.taskId);
+      await dispatchPending(deviceId);
+    }
+  };
+  const api = async (request, url) => {
+    if (url.pathname === "/api/health" && request.method === "GET") {
+      return json({ ok: true, version });
+    }
+    if (url.pathname === "/api/auth/pair" && request.method === "POST") {
+      return run2(Effect10.gen(function* () {
+        const store = yield* exports_store.Service;
+        const input = yield* body(request, decodeExchangePairingInput);
+        return yield* store.exchangePairing(input.token);
+      })).then((value) => json(value, 201)).catch(() => json({ error: "Pairing credential is invalid, expired, or already used" }, 401));
+    }
+    const principal = await principalFor(request);
+    if (principal === undefined) {
+      return json({ error: "Unauthorized" }, 401);
+    }
+    const ownerOnly = url.pathname.startsWith("/api/auth/");
+    if (ownerOnly && principal !== "owner") {
+      return json({ error: "Owner token required" }, 403);
+    }
+    const sourceDeviceId = principal === "owner" ? undefined : principal.deviceId;
+    const effect = Effect10.gen(function* () {
+      const store = yield* exports_store.Service;
+      if (url.pathname === "/api/auth/pairings" && request.method === "POST") {
+        const input = yield* body(request, decodeCreatePairingInput);
+        return json(yield* store.createPairing(input), 201);
+      }
+      if (url.pathname === "/api/auth/sessions" && request.method === "GET") {
+        return json(yield* store.listAuthSessions());
+      }
+      const revoke = url.pathname.match(/^\/api\/auth\/sessions\/([^/]+)\/revoke$/);
+      if (request.method === "POST" && revoke?.[1] !== undefined) {
+        const id = yield* pathId(AuthSessionId, revoke[1]);
+        const session = yield* store.revokeAuthSession(id);
+        hub.closeSession(id);
+        return json(session);
+      }
+      if (url.pathname === "/api/devices" && request.method === "GET") {
+        return json(yield* store.listDevices());
+      }
+      if (url.pathname === "/api/tasks" && request.method === "POST") {
+        const input = yield* body(request, decodeCreateTaskInput);
+        const target = yield* chooseDevice(input, sourceDeviceId);
+        const providerSessionId = input.threadId === undefined ? undefined : yield* store.sessionFor(input.threadId, target, input.provider ?? "codex");
+        const task2 = yield* store.createDelegation(input, target, sourceDeviceId, providerSessionId);
+        return json(yield* Effect10.tryPromise(() => dispatch(task2)), 201);
+      }
+      const task = url.pathname.match(/^\/api\/tasks\/([^/]+)$/);
+      if (request.method === "GET" && task?.[1] !== undefined) {
+        return json(yield* store.getTask(yield* pathId(TaskId, task[1])));
+      }
+      const cancel2 = url.pathname.match(/^\/api\/tasks\/([^/]+)\/cancel$/);
+      if (request.method === "POST" && cancel2?.[1] !== undefined) {
+        const id = yield* pathId(TaskId, cancel2[1]);
+        const updated = yield* store.requestCancellation(id);
+        if (updated.status === "cancelling") {
+          hub.sendToDevice(updated.targetDeviceId, SocketEvent.make({ _tag: "CancelTask", taskId: id }));
+        }
+        return json(updated);
+      }
+      const thread = url.pathname.match(/^\/api\/threads\/([^/]+)$/);
+      if (request.method === "GET" && thread?.[1] !== undefined) {
+        return json(yield* store.threadContext(yield* pathId(ThreadId, thread[1])));
+      }
+      return yield* new RequestError({ status: 404, message: "Route not found" });
+    }).pipe(Effect10.mapError((cause) => cause instanceof RequestError ? cause : new RequestError({
+      status: cause._tag !== "RelayStore.PersistenceError" ? 500 : cause.message.startsWith("Unknown") ? 404 : cause.message.includes("outstanding task limit") ? 429 : 500,
+      message: cause.message
+    })));
+    return run2(effect).catch((cause) => cause instanceof RequestError ? json({ error: cause.status === 500 ? "Relay request failed" : cause.message }, cause.status) : json({ error: "Relay request failed" }, 500));
+  };
+  const websocketServer = new WebSocketServer({
+    noServer: true,
+    maxPayload: 256 * 1024,
+    perMessageDeflate: false
+  });
+  websocketServer.on("connection", (rawSocket) => {
+    const socket = rawSocket;
+    socket.data = {
+      processing: Promise.resolve(),
+      authDeadline: undefined,
+      preAuthFrameReceived: false,
+      queuedMessages: 0,
+      closed: false
+    };
+    connections += 1;
+    socket.data.authDeadline = setTimeout(() => {
+      if (!hub.isAuthorized(socket)) {
+        socket.close(4003, "Authentication timeout");
+      }
+    }, 5000);
+    let alive = true;
+    socket.on("pong", () => {
+      alive = true;
+    });
+    const heartbeat = setInterval(() => {
+      if (!alive) {
+        socket.terminate();
+        return;
+      }
+      alive = false;
+      socket.ping();
+    }, 30000);
+    heartbeat.unref();
+    socket.on("message", (message) => {
+      if (!hub.isAuthorized(socket)) {
+        const size = Buffer.byteLength(socketText(message));
+        if (socket.data.preAuthFrameReceived || size > 1024) {
+          socket.close(4003, "Only one authentication frame is allowed");
+          return;
+        }
+        socket.data.preAuthFrameReceived = true;
+        socket.data.processing = handleSocketEvent(socket, message).catch((cause) => {
+          sendError(socket, "event_failed", cause instanceof Error ? cause.message : String(cause));
+        });
+        return;
+      }
+      if (socket.data.queuedMessages >= 8) {
+        socket.close(4008, "Message queue limit reached");
+        return;
+      }
+      socket.data.queuedMessages += 1;
+      socket.data.processing = socket.data.processing.then(() => socket.data.closed ? undefined : handleSocketEvent(socket, message)).catch((cause) => {
+        sendError(socket, "event_failed", cause instanceof Error ? cause.message : String(cause));
+      }).finally(() => {
+        socket.data.queuedMessages = Math.max(0, socket.data.queuedMessages - 1);
+      });
+    });
+    socket.once("close", () => {
+      clearInterval(heartbeat);
+      socket.data.closed = true;
+      connections = Math.max(0, connections - 1);
+      const deviceId = hub.detach(socket);
+      if (deviceId === undefined) {
+        return;
+      }
+      run2(Effect10.gen(function* () {
+        const store = yield* exports_store.Service;
+        yield* store.requeueTasksFor(deviceId);
+        yield* store.markDeviceOffline(deviceId);
+      })).catch((cause) => console.error(cause));
+    });
+  });
+  const server = createServer((incoming, outgoing) => {
+    webRequest(incoming).then((request) => {
+      const url = new URL(request.url);
+      return url.pathname.startsWith("/api/") ? api(request, url) : json({ name: "Cohall relay", version, status: "running" });
+    }).then((response) => sendResponse(outgoing, response)).catch((cause) => sendResponse(outgoing, json({ error: cause instanceof Error ? cause.message : "Invalid request" }, cause instanceof Error && cause.message.includes("256 KiB") ? 413 : 400)));
+  });
+  server.on("upgrade", (request, socket, head) => {
+    const url = new URL(request.url ?? "/", "http://cohall.local");
+    if (url.pathname !== "/ws/device") {
+      rejectUpgrade(socket, 404, "Not Found");
+      return;
+    }
+    if (connections >= 1024) {
+      rejectUpgrade(socket, 503, "Service Unavailable");
+      return;
+    }
+    websocketServer.handleUpgrade(request, socket, head, (websocket) => {
+      websocketServer.emit("connection", websocket, request);
+    });
+  });
+  await new Promise((resolve3, reject) => {
+    server.once("error", reject);
+    server.listen(configuration.port, configuration.host, () => {
+      server.off("error", reject);
+      resolve3();
+    });
+  });
+  console.log(`Cohall relay listening on http://${configuration.host}:${configuration.port}`);
+  let stopping = false;
+  const shutdown = async () => {
+    if (stopping) {
+      return;
+    }
+    stopping = true;
+    for (const socket of websocketServer.clients) {
+      socket.close(1001, "Relay shutting down");
+    }
+    await new Promise((resolve3) => server.close(() => resolve3()));
+    websocketServer.close();
+    await runtime.dispose();
+  };
+  process.once("SIGINT", () => void shutdown());
+  process.once("SIGTERM", () => void shutdown());
+};
+var init_main = __esm(async () => {
+  init_src();
+  init_config();
+  init_hub();
+  init_store();
+  RequestError = class RequestError extends Schema10.TaggedErrorClass()("Relay.RequestError", {
+    status: Schema10.Int,
+    message: Schema10.String
+  }) {
+  };
+  if (false) {}
+});
+
+// apps/device/src/main.ts
+init_src();
+import { Effect as Effect11 } from "effect";
+
+// packages/client/src/index.ts
+init_src();
+var exports_src = {};
+__export(exports_src, {
+  make: () => make,
+  layer: () => layer,
+  exchangePairing: () => exchangePairing,
+  Service: () => Service,
+  RelayRequestError: () => RelayRequestError,
+  RelayDecodeError: () => RelayDecodeError,
+  RelayClient: () => exports_src
+});
+import { Context, Effect, Layer, Schema as Schema2 } from "effect";
+
+class RelayRequestError extends Schema2.TaggedErrorClass()("RelayClient.RequestError", {
+  operation: Schema2.String,
+  message: Schema2.String,
+  status: Schema2.optionalKey(Schema2.Number)
+}) {
+}
+
+class RelayDecodeError extends Schema2.TaggedErrorClass()("RelayClient.DecodeError", { operation: Schema2.String, message: Schema2.String }) {
+}
+
+class Service extends Context.Service()("@cohall/RelayClient") {
+}
+var normalizeBaseUrl = (url) => url.replace(/\/+$/, "");
+var jsonBody = async (response, operation) => {
+  if (response.body === null) {
+    throw new RelayDecodeError({ operation, message: "Relay returned an empty response" });
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  while (true) {
+    const chunk = await reader.read();
+    if (chunk.done) {
+      break;
+    }
+    size += chunk.value.byteLength;
+    if (size > 2 * 1024 * 1024) {
+      await reader.cancel();
+      throw new RelayDecodeError({ operation, message: "Relay response exceeded 2 MiB" });
+    }
+    chunks.push(chunk.value);
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const text = new TextDecoder().decode(bytes);
+  try {
+    return JSON.parse(text);
+  } catch (cause) {
+    throw new RelayDecodeError({
+      operation,
+      message: cause instanceof Error ? cause.message : String(cause)
+    });
+  }
+};
+var responseMessage = async (response, operation) => {
+  const json = await jsonBody(response, operation).catch(() => {
+    return;
+  });
+  const decoded = Schema2.decodeUnknownOption(ErrorResponse)(json);
+  return decoded._tag === "Some" ? decoded.value.error : `${response.status} ${response.statusText}`.trim();
+};
+var make = (options) => {
+  const baseUrl = normalizeBaseUrl(options.baseUrl);
+  const request = (operation, path, schema, init) => Effect.gen(function* () {
+    const response = yield* Effect.tryPromise({
+      try: (signal) => fetch(`${baseUrl}${path}`, {
+        ...init,
+        signal: AbortSignal.any([signal, AbortSignal.timeout(30000)]),
+        headers: {
+          authorization: `Bearer ${options.token}`,
+          "content-type": "application/json",
+          ...init?.headers
+        }
+      }),
+      catch: (cause) => new RelayRequestError({
+        operation,
+        message: cause instanceof Error ? cause.message : String(cause)
+      })
+    });
+    if (!response.ok) {
+      return yield* Effect.fail(new RelayRequestError({
+        operation,
+        message: yield* Effect.promise(() => responseMessage(response, operation)),
+        status: response.status
+      }));
+    }
+    const json = yield* Effect.tryPromise({
+      try: () => jsonBody(response, operation),
+      catch: (cause) => cause instanceof RelayDecodeError ? cause : new RelayDecodeError({ operation, message: String(cause) })
+    });
+    return yield* Schema2.decodeUnknownEffect(schema)(json).pipe(Effect.mapError((cause) => new RelayDecodeError({ operation, message: String(cause) })));
+  });
+  return Service.of({
+    devices: () => request("RelayClient.devices", "/api/devices", Schema2.Array(Device)),
+    createTask: (input) => request("RelayClient.createTask", "/api/tasks", Task, {
+      method: "POST",
+      body: JSON.stringify(input)
+    }),
+    getTask: (taskId) => request("RelayClient.getTask", `/api/tasks/${encodeURIComponent(taskId)}`, Task),
+    cancelTask: (taskId) => request("RelayClient.cancelTask", `/api/tasks/${encodeURIComponent(taskId)}/cancel`, Task, {
+      method: "POST"
+    }),
+    threadContext: (threadId) => request("RelayClient.threadContext", `/api/threads/${encodeURIComponent(threadId)}`, ThreadContext),
+    createPairing: (input) => request("RelayClient.createPairing", "/api/auth/pairings", PairingCredential, {
+      method: "POST",
+      body: JSON.stringify(input)
+    }),
+    authSessions: () => request("RelayClient.authSessions", "/api/auth/sessions", Schema2.Array(AuthSession)),
+    revokeAuthSession: (sessionId) => request("RelayClient.revokeAuthSession", `/api/auth/sessions/${encodeURIComponent(sessionId)}/revoke`, AuthSession, { method: "POST" })
+  });
+};
+var exchangePairing = (baseUrl, input) => Effect.gen(function* () {
+  const operation = "RelayClient.exchangePairing";
+  const response = yield* Effect.tryPromise({
+    try: (signal) => fetch(`${normalizeBaseUrl(baseUrl)}/api/auth/pair`, {
+      method: "POST",
+      signal: AbortSignal.any([signal, AbortSignal.timeout(30000)]),
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(input)
+    }),
+    catch: (cause) => new RelayRequestError({
+      operation,
+      message: cause instanceof Error ? cause.message : String(cause)
+    })
+  });
+  if (!response.ok) {
+    return yield* Effect.fail(new RelayRequestError({
+      operation,
+      message: yield* Effect.promise(() => responseMessage(response, operation)),
+      status: response.status
+    }));
+  }
+  const json = yield* Effect.tryPromise({
+    try: () => jsonBody(response, operation),
+    catch: (cause) => cause instanceof RelayDecodeError ? cause : new RelayDecodeError({ operation, message: String(cause) })
+  });
+  return yield* Schema2.decodeUnknownEffect(PairingResult)(json).pipe(Effect.mapError((cause) => new RelayDecodeError({ operation, message: String(cause) })));
+});
+var layer = (options) => Layer.succeed(Service, make(options));
+
+// apps/device/src/cli.ts
+init_src();
+
+// packages/providers/src/index.ts
+init_src();
+import { Effect as Effect2, Schema as Schema3 } from "effect";
+import { accessSync, constants } from "node:fs";
+import { platform } from "node:os";
+import { delimiter, extname, isAbsolute, join } from "node:path";
+import { spawn } from "node:child_process";
+
+class ProviderUnavailableError extends Schema3.TaggedErrorClass()("CohallProvider.Unavailable", { provider: Provider, message: Schema3.String }) {
+}
+
+class ProviderRunError extends Schema3.TaggedErrorClass()("CohallProvider.RunError", {
+  provider: Provider,
+  message: Schema3.String,
+  exitCode: Schema3.optionalKey(Schema3.Number)
+}) {
+}
+var executables = {
+  codex: "codex",
+  "claude-code": "claude",
+  opencode: "opencode"
+};
+var providerEnvironment = () => Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.startsWith("COHALL_")));
+var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : undefined;
+var text = (value) => typeof value === "string" ? value : undefined;
+var executableCandidates = (command) => {
+  if (platform() !== "win32" || extname(command).length > 0) {
+    return [command];
+  }
+  return (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter((extension) => extension.length > 0).map((extension) => `${command}${extension.toLowerCase()}`);
+};
+var findExecutable = (command) => {
+  const paths = isAbsolute(command) || command.includes("/") || command.includes("\\") ? [""] : (process.env.PATH ?? "").split(delimiter);
+  for (const directory of paths) {
+    for (const candidate of executableCandidates(command)) {
+      const path = directory.length === 0 ? candidate : join(directory, candidate);
+      try {
+        accessSync(path, platform() === "win32" ? constants.F_OK : constants.X_OK);
+        return path;
+      } catch {
+        continue;
+      }
+    }
+  }
+  return;
+};
+var available = (provider) => findExecutable(executables[provider]) !== undefined;
+var availableProviders = () => Provider.literals.filter(available);
+var boundedText = (stream, limit, onOverflow) => new Promise((resolve, reject) => {
+  const chunks = [];
+  let size = 0;
+  const cleanup = () => {
+    stream.off("data", onData);
+    stream.off("end", onEnd);
+    stream.off("error", onError);
+  };
+  const onData = (chunk) => {
+    const bytes = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+    size += bytes.byteLength;
+    if (size <= limit) {
+      chunks.push(bytes);
+      return;
+    }
+    cleanup();
+    onOverflow();
+    reject(new Error(`Provider output exceeded ${Math.floor(limit / 1024)} KiB`));
+  };
+  const onEnd = () => {
+    cleanup();
+    resolve(Buffer.concat(chunks, size).toString("utf8"));
+  };
+  const onError = (cause) => {
+    cleanup();
+    reject(cause);
+  };
+  stream.on("data", onData);
+  stream.once("end", onEnd);
+  stream.once("error", onError);
+});
+var codexCommand = (options) => {
+  const common = [
+    "--json",
+    "-c",
+    'approval_policy="never"',
+    ...options.model === undefined ? [] : ["--model", options.model],
+    ...options.sandbox === undefined ? [] : ["-c", `sandbox_mode=${JSON.stringify(options.sandbox)}`]
+  ];
+  return options.sessionId === undefined ? ["codex", "exec", ...common, "-"] : ["codex", "exec", "resume", ...common, options.sessionId, "-"];
+};
+var claudeCommand = (options) => [
+  "claude",
+  "-p",
+  "--output-format",
+  "json",
+  ...options.model === undefined ? [] : ["--model", options.model],
+  ...options.sessionId === undefined ? [] : ["--resume", options.sessionId]
+];
+var opencodeCommand = (options) => [
+  "opencode",
+  "run",
+  "--format",
+  "json",
+  ...options.model === undefined ? [] : ["--model", options.model],
+  ...options.sessionId === undefined ? [] : ["--session", options.sessionId]
+];
+var command = (options) => {
+  switch (options.provider) {
+    case "codex":
+      return codexCommand(options);
+    case "claude-code":
+      return claudeCommand(options);
+    case "opencode":
+      return opencodeCommand(options);
+  }
+};
+var parseCodex = (stdout, existingSession) => {
+  let result = "";
+  let sessionId = existingSession;
+  for (const line of stdout.split(`
+`)) {
+    if (line.trim().length === 0) {
+      continue;
+    }
+    const event = record(JSON.parse(line));
+    if (event === undefined) {
+      continue;
+    }
+    if (text(event.type) === "thread.started") {
+      sessionId = text(event.thread_id) ?? sessionId;
+    }
+    if (text(event.type) !== "item.completed") {
+      continue;
+    }
+    const item = record(event.item);
+    if (text(item?.type) === "agent_message") {
+      result = text(item?.text) ?? text(item?.content) ?? result;
+    }
+  }
+  return {
+    result: result || "Codex completed the task without a text response.",
+    ...sessionId === undefined ? {} : { sessionId }
+  };
+};
+var parseClaude = (stdout, existingSession) => {
+  const value = record(JSON.parse(stdout));
+  const result = text(value?.result) ?? text(value?.content);
+  if (result === undefined) {
+    throw new Error("Claude Code returned JSON without a result");
+  }
+  const sessionId = text(value?.session_id) ?? text(value?.sessionId) ?? existingSession;
+  return { result, ...sessionId === undefined ? {} : { sessionId } };
+};
+var textFromPart = (value) => {
+  const part = record(value);
+  if (part === undefined) {
+    return;
+  }
+  return text(part.text) ?? text(part.content) ?? text(record(part.part)?.text);
+};
+var parseOpenCode = (stdout, existingSession) => {
+  let result = "";
+  let sessionId = existingSession;
+  for (const line of stdout.split(`
+`)) {
+    if (line.trim().length === 0) {
+      continue;
+    }
+    const event = record(JSON.parse(line));
+    if (event === undefined) {
+      continue;
+    }
+    sessionId = text(event.sessionID) ?? text(event.sessionId) ?? text(event.session_id) ?? text(record(event.info)?.sessionID) ?? sessionId;
+    const content = textFromPart(event.part) ?? textFromPart(event) ?? text(event.result);
+    if (content !== undefined && content.length > 0) {
+      result = content;
+    }
+  }
+  if (result.length === 0) {
+    throw new Error("OpenCode completed without a text response");
+  }
+  return { result, ...sessionId === undefined ? {} : { sessionId } };
+};
+var parse = (options, stdout) => {
+  switch (options.provider) {
+    case "codex":
+      return parseCodex(stdout, options.sessionId);
+    case "claude-code":
+      return parseClaude(stdout, options.sessionId);
+    case "opencode":
+      return parseOpenCode(stdout, options.sessionId);
+  }
+};
+var byteLength = (value) => new TextEncoder().encode(value).byteLength;
+var run = (options) => Effect2.tryPromise({
+  try: async (signal) => {
+    if (!available(options.provider)) {
+      throw new ProviderUnavailableError({
+        provider: options.provider,
+        message: `${executables[options.provider]} is not available on this device`
+      });
+    }
+    const [executable, ...arguments_] = command(options);
+    if (executable === undefined) {
+      throw new ProviderRunError({
+        provider: options.provider,
+        message: `No command is configured for ${options.provider}`
+      });
+    }
+    const child = spawn(executable, arguments_, {
+      cwd: options.cwd,
+      env: {
+        ...providerEnvironment(),
+        COHALL_PROVIDER: options.provider,
+        COHALL_THREAD_ID: options.threadId
+      },
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const exited = new Promise((resolve, reject) => {
+      child.once("error", reject);
+      child.once("exit", (code) => resolve(code ?? 1));
+    });
+    let killTimer;
+    const terminate = () => {
+      if (child.exitCode !== null) {
+        return;
+      }
+      child.kill("SIGTERM");
+      killTimer ??= setTimeout(() => {
+        if (child.exitCode === null) {
+          child.kill("SIGKILL");
+        }
+      }, 5000);
+      killTimer.unref();
+    };
+    signal.addEventListener("abort", terminate, { once: true });
+    child.stdin.end(options.prompt);
+    const [stdout, stderr, exitCode] = await Promise.all([
+      boundedText(child.stdout, 1024 * 1024, terminate),
+      boundedText(child.stderr, 64 * 1024, terminate),
+      exited
+    ]);
+    signal.removeEventListener("abort", terminate);
+    if (killTimer !== undefined && child.exitCode !== null) {
+      clearTimeout(killTimer);
+    }
+    if (exitCode !== 0) {
+      throw new ProviderRunError({
+        provider: options.provider,
+        message: (stderr.trim() || `${executables[options.provider]} exited with status ${exitCode}`).slice(0, 16384),
+        exitCode
+      });
+    }
+    const result = parse(options, stdout);
+    if (byteLength(result.result) > 131072) {
+      throw new ProviderRunError({
+        provider: options.provider,
+        message: "Provider result exceeded 128 KiB"
+      });
+    }
+    if (result.sessionId !== undefined && byteLength(result.sessionId) > 4096) {
+      throw new ProviderRunError({
+        provider: options.provider,
+        message: "Provider session ID exceeded 4 KiB"
+      });
+    }
+    return result;
+  },
+  catch: (cause) => {
+    if (cause instanceof ProviderUnavailableError || cause instanceof ProviderRunError) {
+      return cause;
+    }
+    return new ProviderRunError({
+      provider: options.provider,
+      message: (cause instanceof Error ? cause.message : String(cause)).slice(0, 16384)
+    });
+  }
+});
+
+// apps/device/src/cli.ts
+import { Effect as Effect5, Schema as Schema6 } from "effect";
+import { access as access2, mkdir as mkdir2, readFile as readFile2, stat, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname2, join as join3 } from "node:path";
+
+// skills/cohall/SKILL.md
+var SKILL_default = `---
+name: cohall
+description: Delegate work to an agent on another user-owned device through the Cohall CLI. Use when a task needs machine-local state or capabilities such as a signed-in browser, Xcode, a simulator, Docker, deployment access, a repository checkout, or tools unavailable on the current device.
+---
+
+# Cohall
+
+Cohall sends a focused task to an agent running on another device. The target
+keeps its local files, credentials, browser state, provider login, skills, and
+permissions. The relay carries prompts, final results, and task state; it is not
+a lead agent.
+
+## Delegate work
+
+1. List devices unless the target is already explicit:
+
+   \`\`\`bash
+   npx -y @akshar5/cohall devices
+   \`\`\`
+
+2. Choose a target whose provider, workspaces, platform, and capabilities fit
+   the task. Stay local when another device offers no material advantage.
+
+3. Delegate one concrete outcome. Send only the context the target needs:
+
+   \`\`\`bash
+   npx -y @akshar5/cohall delegate \\
+     --target @macbook \\
+     --provider codex \\
+     --workspace /Users/me/dev/project \\
+     --prompt 'Inspect the authenticated dashboard and identify why deployment 184 failed.' \\
+     --context 'Focus on events after 15:00 UTC. Return evidence and source URLs.'
+   \`\`\`
+
+   Providers are \`codex\`, \`claude-code\`, and \`opencode\`. Omit \`--provider\` to
+   use Codex. Omit \`--target\` only when Cohall may choose a matching device.
+
+4. The command waits by default and returns JSON. Treat work as successful only
+   when \`status\` is \`completed\`; use \`result\` in the current task. Report a
+   \`failed\`, \`cancelled\`, or \`cancelling\` state accurately.
+
+5. Reuse \`thread_id\` for related follow-ups so the target provider can resume
+   its local session:
+
+   \`\`\`bash
+   npx -y @akshar5/cohall delegate \\
+     --thread 11111111-1111-4111-8111-111111111111 \\
+     --target @macbook \\
+     --prompt 'Check whether yesterday’s deployment failed for the same reason.'
+   \`\`\`
+
+When an agent running as a Cohall task delegates again, \`COHALL_THREAD_ID\`
+automatically carries the current thread. Pass \`--thread\` explicitly from an
+ordinary shell or a separate agent turn.
+
+## Context and safety
+
+- Include the goal, constraints, relevant prior findings, and expected evidence.
+- Do not paste a full private transcript when a short brief is sufficient.
+- Never send provider credentials, Cohall tokens, cookies, or browser-profile data.
+- Request a path only when the target advertises a matching workspace root.
+- Use the same thread for clarification instead of creating duplicate tasks.
+- Do not submit the same work through both CLI and MCP.
+- Respect user confirmation requirements for consequential actions on the target.
+
+## Asynchronous work
+
+Queue work when the current agent can make independent progress:
+
+\`\`\`bash
+npx -y @akshar5/cohall delegate --target @linux --no-wait \\
+  --prompt 'Run the project test suite and report failures.'
+npx -y @akshar5/cohall status <task-id>
+npx -y @akshar5/cohall wait <task-id> --timeout 1800
+\`\`\`
+
+The timeout error includes the task ID and last known status. The task continues
+unless cancelled:
+
+\`\`\`bash
+npx -y @akshar5/cohall cancel <task-id>
+\`\`\`
+
+Active cancellation is acknowledged by the target device; \`cancelling\` means
+the provider process has not confirmed termination yet.
+
+## Read shared context
+
+\`\`\`bash
+npx -y @akshar5/cohall thread <thread-id>
+\`\`\`
+
+This returns a byte-bounded recent window of prompts, final responses, and task
+states. Check \`truncated\`; older history remains on the relay when it is true.
+
+## Input forms
+
+Use \`--prompt-file\` or stdin for multiline work without shell interpolation:
+
+\`\`\`bash
+npx -y @akshar5/cohall delegate --target @macbook --prompt - <<'COHALL_PROMPT'
+Analyze the authenticated pages in the attached task context.
+Return the shared conclusions, disagreements, and source URLs.
+COHALL_PROMPT
+\`\`\`
+
+Only one input may read stdin. Use \`--context-file\` when the prompt uses stdin.
+
+## Diagnostics
+
+If a command cannot connect or no target is available, run:
+
+\`\`\`bash
+npx -y @akshar5/cohall doctor
+npx -y @akshar5/cohall devices
+\`\`\`
+
+Return the diagnostic failure to the user rather than claiming remote work ran.
+`;
+
+// apps/device/src/config.ts
+init_src();
+import { Effect as Effect3, Schema as Schema4 } from "effect";
+import { access, chmod, mkdir, readFile, realpath, rename, writeFile } from "node:fs/promises";
+import { homedir, hostname, platform as platform2 } from "node:os";
+import { dirname, join as join2, resolve } from "node:path";
+var WorkspaceList = Schema4.Array(Schema4.NonEmptyString).check(Schema4.isMaxLength(64));
+var Sandbox = Schema4.Literals(["read-only", "workspace-write", "danger-full-access"]);
+var StoredConfiguration = Schema4.Struct({
+  version: Schema4.Literal(1),
+  relayUrl: Schema4.NonEmptyString,
+  deviceId: DeviceId,
+  deviceName: Schema4.NonEmptyString,
+  workspaces: WorkspaceList,
+  clientToken: Schema4.optionalKey(Schema4.NonEmptyString),
+  deviceToken: Schema4.optionalKey(Schema4.NonEmptyString),
+  model: Schema4.optionalKey(Schema4.NonEmptyString),
+  sandbox: Schema4.optionalKey(Sandbox)
+});
+var ClientConfiguration = Schema4.Struct({
+  relayUrl: Schema4.NonEmptyString,
+  token: Schema4.NonEmptyString,
+  mcpThreadId: Schema4.optionalKey(Schema4.String)
+});
+var DeviceConfiguration = Schema4.Struct({
+  relayUrl: Schema4.NonEmptyString,
+  token: Schema4.NonEmptyString,
+  id: DeviceId,
+  name: Schema4.NonEmptyString,
+  workspaces: WorkspaceList,
+  model: Schema4.optionalKey(Schema4.NonEmptyString),
+  sandbox: Schema4.optionalKey(Sandbox)
+});
+var defaultConfigDirectory = () => {
+  if (platform2() === "win32") {
+    return join2(process.env.APPDATA ?? join2(homedir(), "AppData", "Roaming"), "Cohall");
+  }
+  if (platform2() === "darwin") {
+    return join2(homedir(), "Library", "Application Support", "Cohall");
+  }
+  return join2(process.env.XDG_CONFIG_HOME ?? join2(homedir(), ".config"), "cohall");
+};
+var configurationPath = () => resolve(process.env.COHALL_CONFIG ?? join2(defaultConfigDirectory(), "config.json"));
+var normalizeRelayUrl = (input) => {
+  const url = new URL(input);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("Relay URL must use http or https");
+  }
+  if (url.username.length > 0 || url.password.length > 0 || url.search.length > 0 || url.hash.length > 0) {
+    throw new Error("Relay URL cannot include credentials, a query, or a fragment");
+  }
+  if (url.pathname !== "/" && url.pathname !== "") {
+    throw new Error("Relay URL cannot include a path");
+  }
+  url.pathname = "/";
+  return url.toString().replace(/\/$/, "");
+};
+var parseWorkspaces = (workspaceList, workspaceJson) => Effect3.tryPromise({
+  try: async () => {
+    const values = workspaceJson === undefined ? workspaceList.split(",").map((workspace) => workspace.trim()).filter((workspace) => workspace.length > 0) : Schema4.decodeUnknownSync(WorkspaceList)(JSON.parse(workspaceJson));
+    const canonical = await Promise.all(values.map((workspace) => realpath(resolve(workspace))));
+    return [...new Set(canonical)];
+  },
+  catch: (cause) => new Error(`Workspace roots must be existing paths; JSON input must be an array of paths: ${cause instanceof Error ? cause.message : String(cause)}`)
+});
+var readStoredConfiguration = async () => {
+  const path = configurationPath();
+  if (!await access(path).then(() => true).catch(() => false)) {
+    return;
+  }
+  if (platform2() !== "win32") {
+    await chmod(path, 384);
+  }
+  try {
+    return Schema4.decodeUnknownSync(StoredConfiguration)(JSON.parse(await readFile(path, "utf8")));
+  } catch (cause) {
+    throw new Error(`Invalid Cohall configuration at ${path}: ${String(cause)}`);
+  }
+};
+var writeStoredConfiguration = async (configuration) => {
+  const path = configurationPath();
+  const directory = dirname(path);
+  const temporary = `${path}.${process.pid}.tmp`;
+  await mkdir(directory, { recursive: true, mode: 448 });
+  if (platform2() !== "win32") {
+    await chmod(directory, 448);
+  }
+  await writeFile(temporary, `${JSON.stringify(configuration, null, 2)}
+`, { mode: 384 });
+  await rename(temporary, path);
+  if (platform2() !== "win32") {
+    await chmod(path, 384);
+  }
+};
+var makeStoredConfiguration = async (input) => {
+  const existing = await readStoredConfiguration();
+  const canonicalWorkspaces = input.workspaces === undefined ? existing?.workspaces ?? [] : await Effect3.runPromise(parseWorkspaces("", JSON.stringify(input.workspaces)));
+  const clientToken = input.clientToken ?? existing?.clientToken;
+  const deviceToken = input.deviceToken ?? existing?.deviceToken;
+  return StoredConfiguration.make({
+    version: 1,
+    relayUrl: normalizeRelayUrl(input.relayUrl),
+    deviceId: existing?.deviceId ?? makeDeviceId(),
+    deviceName: input.deviceName ?? existing?.deviceName ?? hostname(),
+    workspaces: canonicalWorkspaces,
+    ...clientToken === undefined ? {} : { clientToken },
+    ...deviceToken === undefined ? {} : { deviceToken },
+    ...existing?.model === undefined ? {} : { model: existing.model },
+    ...existing?.sandbox === undefined ? {} : { sandbox: existing.sandbox }
+  });
+};
+var environmentWorkspaces = async (stored) => {
+  const list = process.env.COHALL_DEVICE_WORKSPACES;
+  const json = process.env.COHALL_DEVICE_WORKSPACES_JSON;
+  if (list === undefined && json === undefined) {
+    return stored?.workspaces ?? [];
+  }
+  return Effect3.runPromise(parseWorkspaces(list ?? "", json));
+};
+var environmentProvider = () => process.env.COHALL_MODEL ?? process.env.COHALL_CODEX_MODEL;
+var environmentSandbox = () => {
+  const value = process.env.COHALL_SANDBOX ?? process.env.COHALL_CODEX_SANDBOX;
+  return value === undefined ? undefined : Schema4.decodeUnknownSync(Sandbox)(value);
+};
+var storedOrDefaults = async () => {
+  const stored = await readStoredConfiguration();
+  return stored ?? StoredConfiguration.make({
+    version: 1,
+    relayUrl: "http://127.0.0.1:8787",
+    deviceId: makeDeviceId(),
+    deviceName: hostname(),
+    workspaces: []
+  });
+};
+var loadClientConfiguration = Effect3.tryPromise({
+  try: async () => {
+    const stored = await storedOrDefaults();
+    const token = process.env.COHALL_CLIENT_TOKEN ?? stored.clientToken;
+    if (token === undefined) {
+      throw new Error(`No client credential. Run cohall join with a pairing token on stdin or set COHALL_CLIENT_TOKEN.`);
+    }
+    return ClientConfiguration.make({
+      relayUrl: normalizeRelayUrl(process.env.COHALL_RELAY_URL ?? stored.relayUrl),
+      token,
+      ...process.env.COHALL_THREAD_ID === undefined ? {} : { mcpThreadId: process.env.COHALL_THREAD_ID }
+    });
+  },
+  catch: (cause) => cause instanceof Error ? cause : new Error(String(cause))
+});
+var loadOwnerConfiguration = Effect3.tryPromise({
+  try: async () => {
+    const stored = await storedOrDefaults();
+    const token = process.env.COHALL_TOKEN;
+    if (token === undefined) {
+      throw new Error("No owner credential. Set COHALL_TOKEN on the owner-authenticated machine.");
+    }
+    return ClientConfiguration.make({
+      relayUrl: normalizeRelayUrl(process.env.COHALL_RELAY_URL ?? stored.relayUrl),
+      token
+    });
+  },
+  catch: (cause) => cause instanceof Error ? cause : new Error(String(cause))
+});
+var loadDeviceConfiguration = Effect3.tryPromise({
+  try: async () => {
+    const stored = await storedOrDefaults();
+    const token = process.env.COHALL_DEVICE_TOKEN ?? stored.deviceToken;
+    if (token === undefined) {
+      throw new Error(`No device credential. Run cohall join with a pairing token on stdin or set COHALL_DEVICE_TOKEN.`);
+    }
+    const workspaces = await environmentWorkspaces(stored);
+    if (workspaces.length === 0) {
+      throw new Error("No device workspace roots are configured");
+    }
+    const model = environmentProvider() ?? stored.model;
+    const sandbox = environmentSandbox() ?? stored.sandbox;
+    return DeviceConfiguration.make({
+      relayUrl: normalizeRelayUrl(process.env.COHALL_RELAY_URL ?? stored.relayUrl),
+      token,
+      id: process.env.COHALL_DEVICE_ID === undefined ? stored.deviceId : DeviceId.make(process.env.COHALL_DEVICE_ID),
+      name: process.env.COHALL_DEVICE_NAME ?? stored.deviceName,
+      workspaces,
+      ...model === undefined ? {} : { model },
+      ...sandbox === undefined ? {} : { sandbox }
+    });
+  },
+  catch: (cause) => cause instanceof Error ? cause : new Error(String(cause))
+});
+var knownProviders = Provider.literals;
+
+// apps/device/src/delegation.ts
+init_src();
+import { Effect as Effect4, Schema as Schema5 } from "effect";
+
+class DeviceSelectionError extends Schema5.TaggedErrorClass()("Cohall.DeviceSelectionError", { message: Schema5.String, devices: Schema5.Array(Schema5.String) }) {
+}
+
+class TaskWaitTimeoutError extends Schema5.TaggedErrorClass()("Cohall.TaskWaitTimeoutError", { message: Schema5.String, taskId: TaskId, status: TaskStatus }) {
+}
+var TaskResult = Schema5.Struct({
+  task_id: TaskId,
+  thread_id: ThreadId,
+  status: TaskStatus,
+  provider: Provider,
+  target_device_id: DeviceId,
+  result: Schema5.optionalKey(Schema5.String),
+  error: Schema5.optionalKey(Schema5.String)
+});
+var matchingDevices = (devices, target) => {
+  const normalized = target.replace(/^@/, "").toLowerCase();
+  const byId = devices.find((device) => device.id === target);
+  return byId === undefined ? devices.filter((device) => device.name.toLowerCase() === normalized || device.hostname.toLowerCase() === normalized) : [byId];
+};
+var taskResult = (task) => TaskResult.make({
+  task_id: task.id,
+  thread_id: task.threadId,
+  status: task.status,
+  provider: task.provider,
+  target_device_id: task.targetDeviceId,
+  ...task.result === undefined ? {} : { result: task.result },
+  ...task.error === undefined ? {} : { error: task.error }
+});
+var createDelegation = Effect4.fn("Cohall.createDelegation")(function* (client, configuration, options) {
+  const devices = yield* client.devices();
+  const matches = options.target === undefined ? [] : matchingDevices(devices, options.target);
+  if (options.target !== undefined && matches.length !== 1) {
+    return yield* new DeviceSelectionError({
+      message: matches.length === 0 ? `No Cohall device matches ${options.target}` : `${options.target} is ambiguous; use a device ID`,
+      devices: matches.length === 0 ? devices.map((device) => `${device.name} (${device.id})`) : matches.map((device) => `${device.name} (${device.id})`)
+    });
+  }
+  if (devices.length === 0) {
+    return yield* new DeviceSelectionError({
+      message: "No Cohall devices are registered",
+      devices: []
+    });
+  }
+  const target = matches[0];
+  const inheritedThread = configuration.mcpThreadId;
+  return yield* client.createTask({
+    prompt: options.prompt,
+    ...target === undefined ? {} : { targetDeviceId: target.id },
+    ...options.threadId !== undefined ? { threadId: options.threadId } : inheritedThread === undefined ? {} : { threadId: ThreadId.make(inheritedThread) },
+    ...options.context === undefined ? {} : { context: options.context },
+    ...options.workspace === undefined ? {} : { workspace: options.workspace },
+    ...options.provider === undefined ? {} : { provider: options.provider }
+  });
+});
+var waitForTask = Effect4.fn("Cohall.waitForTask")(function* (client, initial, timeoutSeconds) {
+  const deadline = Date.now() + timeoutSeconds * 1000;
+  let task = initial;
+  while (!isTerminalTask(task)) {
+    if (Date.now() >= deadline) {
+      return yield* new TaskWaitTimeoutError({
+        message: `Task ${task.id} is still ${task.status} after ${timeoutSeconds} seconds`,
+        taskId: task.id,
+        status: task.status
+      });
+    }
+    yield* Effect4.sleep("1 second");
+    task = yield* client.getTask(task.id);
+  }
+  return task;
+});
+var threadContext = Effect4.fn("Cohall.threadContext")(function* (client, threadId) {
+  return yield* client.threadContext(threadId);
+});
+
+// apps/device/src/cli.ts
+var valueOptions = new Set([
+  "context",
+  "context-file",
+  "label",
+  "model",
+  "name",
+  "prompt",
+  "prompt-file",
+  "provider",
+  "relay",
+  "sandbox",
+  "target",
+  "thread",
+  "timeout",
+  "token-file",
+  "workspace"
+]);
+var flagOptions = new Set(["client-only", "no-wait"]);
+var aliases = new Map([
+  ["-c", "context"],
+  ["-p", "prompt"],
+  ["-t", "target"],
+  ["-T", "thread"],
+  ["-w", "workspace"]
+]);
+var help = `Cohall connects agents running on your own devices.
+
+Usage:
+  cohall join --relay <url> --workspace <path> [--token-file <path>]
+  cohall configure [--relay url] [--name name] [--workspace path] [--model id]
+  cohall config
+  cohall devices
+  cohall delegate [prompt] [--target @device] [--provider provider]
+                  [--context text] [--thread uuid] [--workspace path]
+                  [--timeout seconds] [--no-wait]
+  cohall status <task-id>
+  cohall wait <task-id> [--timeout seconds]
+  cohall cancel <task-id>
+  cohall thread <thread-id>
+  cohall pair [--label name] [--client-only]
+  cohall sessions
+  cohall revoke <session-id>
+  cohall doctor
+  cohall device
+  cohall relay
+  cohall mcp
+  cohall skill [install [agents|claude|opencode|all]]
+  cohall integrations
+
+Providers: codex, claude-code, opencode.
+Configuration is stored per user; environment variables override it.`;
+var parseArguments = (values) => {
+  const options = new Map;
+  const positionals = [];
+  for (let index = 0;index < values.length; index += 1) {
+    const argument = values[index];
+    if (argument === undefined) {
+      break;
+    }
+    if (argument === "--") {
+      positionals.push(...values.slice(index + 1));
+      break;
+    }
+    if (!argument.startsWith("-")) {
+      positionals.push(argument);
+      continue;
+    }
+    const separator = argument.indexOf("=");
+    const rawName = separator === -1 ? argument : argument.slice(0, separator);
+    const inline = separator === -1 ? undefined : argument.slice(separator + 1);
+    const name = aliases.get(rawName) ?? rawName.replace(/^--/, "");
+    if (flagOptions.has(name)) {
+      if (inline !== undefined) {
+        throw new Error(`--${name} does not accept a value`);
+      }
+      options.set(name, true);
+      continue;
+    }
+    if (!valueOptions.has(name)) {
+      throw new Error(`Unknown option: ${argument}`);
+    }
+    const value = inline ?? values[index + 1];
+    if (value === undefined || inline === undefined && value.startsWith("-") && value !== "-") {
+      throw new Error(`${rawName} requires a value`);
+    }
+    const previous = options.get(name);
+    options.set(name, previous === undefined || previous === true ? [value] : [...previous, value]);
+    if (inline === undefined) {
+      index += 1;
+    }
+  }
+  return { options, positionals };
+};
+var values = (arguments_, name) => {
+  const option = arguments_.options.get(name);
+  if (option === true) {
+    throw new Error(`--${name} requires a value`);
+  }
+  return option ?? [];
+};
+var option = (arguments_, name) => {
+  const found = values(arguments_, name);
+  if (found.length > 1 && name !== "workspace") {
+    throw new Error(`--${name} may only be specified once`);
+  }
+  return found[0];
+};
+var allowOptions = (arguments_, names) => {
+  const allowed = new Set(names);
+  for (const name of arguments_.options.keys()) {
+    if (!allowed.has(name)) {
+      throw new Error(`--${name} is not valid for this command`);
+    }
+  }
+};
+var noPositionals = (arguments_, command2) => {
+  if (arguments_.positionals.length > 0) {
+    throw new Error(`${command2} does not accept positional arguments`);
+  }
+};
+var identifier = (arguments_, label) => {
+  const value = arguments_.positionals[0];
+  if (value === undefined) {
+    throw new Error(`${label} is required`);
+  }
+  if (arguments_.positionals.length > 1) {
+    throw new Error(`Unexpected arguments after ${label}`);
+  }
+  return value;
+};
+var print = (value) => console.log(JSON.stringify(value, null, 2));
+var readInput = async (arguments_, name) => {
+  const direct = option(arguments_, name);
+  const path = option(arguments_, `${name}-file`);
+  if (direct !== undefined && path !== undefined) {
+    throw new Error(`Use either --${name} or --${name}-file, not both`);
+  }
+  if (path !== undefined) {
+    if (!await access2(path).then(() => true).catch(() => false)) {
+      throw new Error(`File does not exist: ${path}`);
+    }
+    if ((await stat(path)).size > 131072) {
+      throw new Error(`${name} file exceeds 128 KiB`);
+    }
+    return readFile2(path, "utf8");
+  }
+  const result = direct === "-" ? await readStdin(131072, name) : direct;
+  if (result !== undefined && result.length > 131072) {
+    throw new Error(`${name} exceeds 128 KiB`);
+  }
+  return result;
+};
+var readStdin = async (limit, label) => {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of process.stdin) {
+    const bytes = typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk);
+    size += bytes.byteLength;
+    if (size > limit) {
+      throw new Error(`${label} exceeds ${Math.floor(limit / 1024)} KiB`);
+    }
+    chunks.push(bytes);
+  }
+  return Buffer.concat(chunks, size).toString("utf8");
+};
+var timeout = (arguments_) => {
+  const seconds = Number(option(arguments_, "timeout") ?? "900");
+  if (!Number.isInteger(seconds) || seconds < 5 || seconds > 86400) {
+    throw new Error("--timeout must be an integer between 5 and 86400");
+  }
+  return seconds;
+};
+var pairingToken = async (arguments_) => {
+  const path = option(arguments_, "token-file");
+  if (path !== undefined && !await access2(path).then(() => true).catch(() => false)) {
+    throw new Error(`Pairing token file does not exist: ${path}`);
+  }
+  if (path !== undefined && (await stat(path)).size > 512) {
+    throw new Error("Pairing token file exceeds 512 bytes");
+  }
+  const token = (path === undefined ? await readStdin(512, "Pairing token") : await readFile2(path, "utf8")).trim();
+  if (token.length === 0 || new TextEncoder().encode(token).byteLength > 256) {
+    throw new Error("Provide a pairing token on stdin or with --token-file");
+  }
+  return token;
+};
+var client = async () => {
+  const configuration = await Effect5.runPromise(loadClientConfiguration);
+  return {
+    configuration,
+    relay: exports_src.make({ baseUrl: configuration.relayUrl, token: configuration.token })
+  };
+};
+var ownerClient = async () => {
+  const configuration = await Effect5.runPromise(loadOwnerConfiguration);
+  return {
+    configuration,
+    relay: exports_src.make({ baseUrl: configuration.relayUrl, token: configuration.token })
+  };
+};
+var installSkill = async (target) => {
+  const roots = {
+    agents: join3(homedir2(), ".agents", "skills", "cohall", "SKILL.md"),
+    claude: join3(homedir2(), ".claude", "skills", "cohall", "SKILL.md"),
+    opencode: join3(homedir2(), ".config", "opencode", "skills", "cohall", "SKILL.md")
+  };
+  const selected = target === "all" ? Object.values(roots) : (target in roots) ? [roots[target]] : undefined;
+  if (selected === undefined) {
+    throw new Error("Skill target must be agents, claude, opencode, or all");
+  }
+  for (const path of selected) {
+    await mkdir2(dirname2(path), { recursive: true });
+    await writeFile2(path, SKILL_default);
+  }
+  return selected;
+};
+var printHelp = () => console.log(help);
+var printSkill = () => console.log(SKILL_default.trimEnd());
+var runCli = async (command2, raw) => {
+  const arguments_ = parseArguments(raw);
+  if (command2 === "join") {
+    allowOptions(arguments_, ["client-only", "name", "relay", "token-file", "workspace"]);
+    noPositionals(arguments_, command2);
+    const token = await pairingToken(arguments_);
+    const relayUrl = normalizeRelayUrl(option(arguments_, "relay") ?? "http://127.0.0.1:8787");
+    const existing = await readStoredConfiguration();
+    const suppliedWorkspaces = values(arguments_, "workspace");
+    const workspaces = suppliedWorkspaces.length === 0 ? existing?.workspaces : suppliedWorkspaces;
+    const deviceName = option(arguments_, "name");
+    if (!arguments_.options.has("client-only") && (workspaces?.length ?? 0) === 0) {
+      throw new Error("At least one --workspace is required when joining a device");
+    }
+    const draft = await makeStoredConfiguration({
+      relayUrl,
+      ...deviceName === undefined ? {} : { deviceName },
+      ...workspaces === undefined ? {} : { workspaces }
+    });
+    const paired = await Effect5.runPromise(exchangePairing(relayUrl, { token }));
+    const clientToken = paired.credentials.find((credential) => credential.session.role === "client")?.token;
+    const deviceToken = paired.credentials.find((credential) => credential.session.role === "device")?.token;
+    const deviceId = paired.credentials.find((credential) => credential.session.role === "device")?.session.deviceId;
+    if (!arguments_.options.has("client-only") && deviceToken === undefined) {
+      throw new Error("The pairing credential did not include device access");
+    }
+    const configuration2 = StoredConfiguration.make({
+      ...draft,
+      deviceId: deviceId ?? draft.deviceId,
+      ...clientToken === undefined ? {} : { clientToken },
+      ...deviceToken === undefined ? {} : { deviceToken }
+    });
+    await writeStoredConfiguration(configuration2);
+    print({
+      configured: true,
+      config_path: configurationPath(),
+      relay_url: configuration2.relayUrl,
+      device_id: configuration2.deviceId,
+      roles: paired.credentials.map((credential) => credential.session.role),
+      workspaces: configuration2.workspaces
+    });
+    return;
+  }
+  if (command2 === "config") {
+    allowOptions(arguments_, []);
+    noPositionals(arguments_, command2);
+    const configuration2 = await readStoredConfiguration();
+    print({
+      config_path: configurationPath(),
+      configured: configuration2 !== undefined,
+      ...configuration2 === undefined ? {} : {
+        relay_url: configuration2.relayUrl,
+        device_id: configuration2.deviceId,
+        device_name: configuration2.deviceName,
+        workspaces: configuration2.workspaces,
+        client_credential: configuration2.clientToken !== undefined,
+        device_credential: configuration2.deviceToken !== undefined,
+        model: configuration2.model,
+        sandbox: configuration2.sandbox
+      }
+    });
+    return;
+  }
+  if (command2 === "configure") {
+    allowOptions(arguments_, ["model", "name", "relay", "sandbox", "workspace"]);
+    noPositionals(arguments_, command2);
+    const existing = await readStoredConfiguration();
+    const relayUrl = normalizeRelayUrl(option(arguments_, "relay") ?? existing?.relayUrl ?? "http://127.0.0.1:8787");
+    const supplied = values(arguments_, "workspace");
+    const workspaces = supplied.length === 0 ? existing?.workspaces ?? [] : await Effect5.runPromise(parseWorkspaces("", JSON.stringify(supplied)));
+    const sandbox = option(arguments_, "sandbox");
+    const model = option(arguments_, "model") ?? existing?.model;
+    const configuration2 = StoredConfiguration.make({
+      version: 1,
+      relayUrl,
+      deviceId: existing?.deviceId ?? makeDeviceId(),
+      deviceName: option(arguments_, "name") ?? existing?.deviceName ?? "cohall-device",
+      workspaces,
+      ...existing?.clientToken === undefined ? {} : { clientToken: existing.clientToken },
+      ...existing?.deviceToken === undefined ? {} : { deviceToken: existing.deviceToken },
+      ...model === undefined ? {} : { model },
+      ...(sandbox ?? existing?.sandbox) === undefined ? {} : {
+        sandbox: Schema6.decodeUnknownSync(Schema6.Literals(["read-only", "workspace-write", "danger-full-access"]))(sandbox ?? existing?.sandbox)
+      }
+    });
+    await writeStoredConfiguration(configuration2);
+    print({ configured: true, config_path: configurationPath() });
+    return;
+  }
+  if (command2 === "skill") {
+    allowOptions(arguments_, []);
+    if (arguments_.positionals.length === 0) {
+      printSkill();
+      return;
+    }
+    if (arguments_.positionals[0] !== "install" || arguments_.positionals.length > 2) {
+      throw new Error("Usage: cohall skill [install [agents|claude|opencode|all]]");
+    }
+    print({ installed: await installSkill(arguments_.positionals[1] ?? "all") });
+    return;
+  }
+  if (command2 === "integrations") {
+    allowOptions(arguments_, []);
+    noPositionals(arguments_, command2);
+    print({
+      cli_skill: "npx -y @akshar5/cohall skill install all",
+      codex_mcp: "codex mcp add cohall -- npx -y @akshar5/cohall mcp",
+      claude_mcp: "claude mcp add --scope user cohall -- npx -y @akshar5/cohall mcp",
+      opencode_mcp: "Run opencode mcp add and use: npx -y @akshar5/cohall mcp"
+    });
+    return;
+  }
+  if (command2 === "doctor") {
+    allowOptions(arguments_, []);
+    noPositionals(arguments_, command2);
+    const configuration2 = await readStoredConfiguration();
+    const relayUrl = normalizeRelayUrl(process.env.COHALL_RELAY_URL ?? configuration2?.relayUrl ?? "http://127.0.0.1:8787");
+    const response = await fetch(`${relayUrl}/api/health`, {
+      signal: AbortSignal.timeout(1e4)
+    }).catch(() => {
+      return;
+    });
+    print({
+      relay: response?.ok === true ? "reachable" : "unreachable",
+      relay_url: relayUrl,
+      config_path: configurationPath(),
+      client_credential: process.env.COHALL_CLIENT_TOKEN !== undefined || configuration2?.clientToken !== undefined,
+      device_credential: process.env.COHALL_DEVICE_TOKEN !== undefined || configuration2?.deviceToken !== undefined,
+      workspaces: configuration2?.workspaces ?? [],
+      providers: Object.fromEntries(Provider.literals.map((provider) => [
+        provider,
+        findExecutable(provider === "claude-code" ? "claude" : provider) ?? "not found"
+      ]))
+    });
+    return;
+  }
+  if (command2 === "pair" || command2 === "sessions" || command2 === "revoke") {
+    const { configuration: configuration2, relay: relay2 } = await ownerClient();
+    if (command2 === "pair") {
+      allowOptions(arguments_, ["client-only", "label"]);
+      noPositionals(arguments_, command2);
+      const roles = arguments_.options.has("client-only") ? ["client"] : ["client", "device"];
+      const credential = await Effect5.runPromise(relay2.createPairing({ label: option(arguments_, "label") ?? "Cohall device", roles }));
+      print({
+        relay_url: configuration2.relayUrl,
+        pairing_token: credential.token,
+        expires_at: credential.expiresAt,
+        roles
+      });
+      return;
+    }
+    if (command2 === "sessions") {
+      allowOptions(arguments_, []);
+      noPositionals(arguments_, command2);
+      print(await Effect5.runPromise(relay2.authSessions()));
+      return;
+    }
+    allowOptions(arguments_, []);
+    print(await Effect5.runPromise(relay2.revokeAuthSession(Schema6.decodeUnknownSync(AuthSessionId)(identifier(arguments_, "session id")))));
+    return;
+  }
+  const { configuration, relay } = await client();
+  if (command2 === "devices") {
+    allowOptions(arguments_, []);
+    noPositionals(arguments_, command2);
+    print(await Effect5.runPromise(relay.devices()));
+    return;
+  }
+  if (command2 === "delegate") {
+    allowOptions(arguments_, [
+      "context",
+      "context-file",
+      "no-wait",
+      "prompt",
+      "prompt-file",
+      "provider",
+      "target",
+      "thread",
+      "timeout",
+      "workspace"
+    ]);
+    if (option(arguments_, "prompt") === "-" && option(arguments_, "context") === "-") {
+      throw new Error("Only one of --prompt and --context may read from stdin");
+    }
+    const suppliedPrompt = await readInput(arguments_, "prompt");
+    const prompt = suppliedPrompt ?? arguments_.positionals.join(" ");
+    if (prompt.trim().length === 0) {
+      throw new Error("A prompt is required");
+    }
+    if (suppliedPrompt !== undefined && arguments_.positionals.length > 0) {
+      throw new Error("Use either a positional prompt or --prompt, not both");
+    }
+    const context = await readInput(arguments_, "context");
+    const target = option(arguments_, "target");
+    const thread = option(arguments_, "thread");
+    const workspace = option(arguments_, "workspace");
+    const provider = option(arguments_, "provider");
+    const task = await Effect5.runPromise(createDelegation(relay, configuration, {
+      prompt,
+      ...target === undefined ? {} : { target },
+      ...context === undefined ? {} : { context },
+      ...thread === undefined ? {} : { threadId: Schema6.decodeUnknownSync(ThreadId)(thread) },
+      ...workspace === undefined ? {} : { workspace },
+      ...provider === undefined ? {} : { provider: Schema6.decodeUnknownSync(Provider)(provider) }
+    }));
+    print(taskResult(arguments_.options.has("no-wait") ? task : await Effect5.runPromise(waitForTask(relay, task, timeout(arguments_)))));
+    return;
+  }
+  if (command2 === "status") {
+    allowOptions(arguments_, []);
+    const id = Schema6.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
+    print(taskResult(await Effect5.runPromise(relay.getTask(id))));
+    return;
+  }
+  if (command2 === "wait") {
+    allowOptions(arguments_, ["timeout"]);
+    const id = Schema6.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
+    const task = await Effect5.runPromise(relay.getTask(id));
+    print(taskResult(await Effect5.runPromise(waitForTask(relay, task, timeout(arguments_)))));
+    return;
+  }
+  if (command2 === "cancel") {
+    allowOptions(arguments_, []);
+    const id = Schema6.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
+    print(taskResult(await Effect5.runPromise(relay.cancelTask(id))));
+    return;
+  }
+  if (command2 === "thread") {
+    allowOptions(arguments_, []);
+    const id = Schema6.decodeUnknownSync(ThreadId)(identifier(arguments_, "thread id"));
+    print(await Effect5.runPromise(threadContext(relay, id)));
+    return;
+  }
+  throw new Error(`Unknown Cohall command: ${command2}`);
+};
+
+// apps/device/src/daemon.ts
+init_src();
+import { Effect as Effect6, Schedule, Schema as Schema7 } from "effect";
+import { realpath as realpath2 } from "node:fs/promises";
+import { arch, hostname as hostname2, platform as platform3 } from "node:os";
+import { basename, isAbsolute as isAbsolute2, relative } from "node:path";
+import { WebSocket } from "ws";
+
+class DeviceConnectionError extends Schema7.TaggedErrorClass()("Device.ConnectionError", { message: Schema7.String }) {
+}
+var socketUrl = (configuration) => {
+  const url = new URL(configuration.relayUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  url.pathname = "/ws/device";
+  return url.toString();
+};
+var providerLabel = (provider) => {
+  switch (provider) {
+    case "codex":
+      return "Codex";
+    case "claude-code":
+      return "Claude Code";
+    case "opencode":
+      return "OpenCode";
+  }
+};
+var capabilities = (providers) => {
+  const values2 = providers.map((provider) => ({
+    id: provider,
+    label: providerLabel(provider),
+    detail: `Uses this device's local ${providerLabel(provider)} login, configuration, and tools`
+  }));
+  if (findExecutable("google-chrome") !== undefined || findExecutable("chromium") !== undefined || platform3() === "darwin") {
+    values2.push({ id: "browser-session", label: "Signed-in browser" });
+  }
+  if (findExecutable("xcodebuild") !== undefined) {
+    values2.push({ id: "xcode", label: "Xcode" });
+  }
+  if (findExecutable("docker") !== undefined) {
+    values2.push({ id: "docker", label: "Docker" });
+  }
+  return values2;
+};
+var describeDevice = (configuration, status = "online") => {
+  const operatingSystem = platform3();
+  const platformName = operatingSystem === "darwin" || operatingSystem === "linux" ? operatingSystem : operatingSystem === "win32" ? "windows" : "unknown";
+  const providers = availableProviders();
+  return Device.make({
+    id: configuration.id,
+    name: configuration.name,
+    hostname: hostname2(),
+    platform: platformName,
+    architecture: arch(),
+    status,
+    providers,
+    capabilities: capabilities(providers),
+    workspaces: configuration.workspaces.map((path) => ({
+      path,
+      label: basename(path) || path
+    })),
+    version,
+    lastSeenAt: now()
+  });
+};
+var allowedWorkspace = async (configuration, requested) => {
+  const selected = requested ?? configuration.workspaces[0];
+  if (selected === undefined) {
+    throw new Error("No workspace is configured on this device");
+  }
+  const candidate = await realpath2(selected);
+  const allowed = configuration.workspaces.some((root) => {
+    const child = relative(root, candidate);
+    return child === "" || !child.startsWith("..") && !isAbsolute2(child);
+  });
+  if (!allowed) {
+    throw new Error(`Workspace ${candidate} is outside this device's configured workspace roots`);
+  }
+  return candidate;
+};
+var promptFor = (task, deviceName) => {
+  const context = task.context === undefined ? "" : `
+
+Relevant context supplied by the sending agent:
+${task.context}`;
+  return [
+    `You are the Cohall agent running on ${deviceName}.`,
+    "Complete the delegated task using this device's local workspace, tools, credentials, and signed-in services.",
+    "Never read, reveal, copy, or use Cohall configuration files or Cohall authentication tokens.",
+    "Return a concise, complete result with the evidence the sending agent needs.",
+    `
+Task:
+${task.prompt}${context}`
+  ].join(`
+`);
+};
+var send = (state, event) => {
+  if (state.socket?.readyState === WebSocket.OPEN) {
+    state.socket.send(JSON.stringify(event));
+  }
+};
+var sendTerminal = (state, taskId, event) => {
+  const payload = JSON.stringify(event);
+  state.terminal.set(taskId, payload);
+  if (state.socket?.readyState === WebSocket.OPEN) {
+    state.socket.send(payload);
+  }
+};
+var remember = (state, taskId) => {
+  state.completed.add(taskId);
+  if (state.completed.size <= 1000) {
+    return;
+  }
+  const oldest = state.completed.values().next();
+  if (!oldest.done) {
+    state.completed.delete(oldest.value);
+    state.terminal.delete(oldest.value);
+  }
+};
+var sessionKey = (task) => `${task.threadId}:${task.provider}`;
+var execute = (configuration, state, task) => {
+  if (state.tasks.has(task.id) || state.completed.has(task.id)) {
+    return;
+  }
+  const controller = new AbortController;
+  state.tasks.set(task.id, controller);
+  send(state, SocketEvent.make({ _tag: "TaskAccepted", taskId: task.id }));
+  const workflow = Effect6.gen(function* () {
+    const cwd = yield* Effect6.tryPromise({
+      try: () => allowedWorkspace(configuration, task.workspace),
+      catch: (cause) => new ProviderRunError({
+        provider: task.provider,
+        message: cause instanceof Error ? cause.message : String(cause)
+      })
+    });
+    const sessionId = task.providerSessionId ?? state.sessions.get(sessionKey(task));
+    return yield* run({
+      provider: task.provider,
+      threadId: task.threadId,
+      prompt: promptFor(task, configuration.name),
+      cwd,
+      ...sessionId === undefined ? {} : { sessionId },
+      ...configuration.model === undefined ? {} : { model: configuration.model },
+      ...configuration.sandbox === undefined ? {} : { sandbox: configuration.sandbox }
+    });
+  });
+  Effect6.runPromise(workflow, { signal: controller.signal }).then((result) => {
+    if (result.sessionId !== undefined) {
+      state.sessions.set(sessionKey(task), result.sessionId);
+    }
+    remember(state, task.id);
+    sendTerminal(state, task.id, SocketEvent.make({
+      _tag: "TaskFinished",
+      taskId: task.id,
+      result: result.result,
+      ...result.sessionId === undefined ? {} : { providerSessionId: result.sessionId }
+    }));
+  }).catch((cause) => {
+    remember(state, task.id);
+    sendTerminal(state, task.id, controller.signal.aborted ? SocketEvent.make({ _tag: "TaskCancelled", taskId: task.id }) : SocketEvent.make({
+      _tag: "TaskFailed",
+      taskId: task.id,
+      error: (cause instanceof Error ? cause.message : String(cause)).slice(0, 16384)
+    }));
+  }).finally(() => {
+    state.tasks.delete(task.id);
+    const next = state.queue.shift();
+    if (next !== undefined) {
+      execute(configuration, state, next);
+    }
+  });
+};
+var schedule = (configuration, state, task) => {
+  if (state.tasks.has(task.id) || state.completed.has(task.id) || state.queue.some((queued) => queued.id === task.id)) {
+    return;
+  }
+  if (task.providerSessionId !== undefined) {
+    state.sessions.set(sessionKey(task), task.providerSessionId);
+  }
+  if (state.tasks.size > 0) {
+    if (state.queue.length >= 100) {
+      state.socket?.close(4008, "Task queue limit reached");
+      return;
+    }
+    state.queue.push(task);
+    return;
+  }
+  execute(configuration, state, task);
+};
+var cancel = (state, taskId) => {
+  const running = state.tasks.get(taskId);
+  if (running !== undefined) {
+    running.abort();
+    return;
+  }
+  const index = state.queue.findIndex((task) => task.id === taskId);
+  if (index !== -1) {
+    state.queue.splice(index, 1);
+  }
+  remember(state, taskId);
+  sendTerminal(state, taskId, SocketEvent.make({ _tag: "TaskCancelled", taskId }));
+};
+var connect = (configuration, state) => Effect6.tryPromise({
+  try: (signal) => new Promise((complete) => {
+    const socket = new WebSocket(socketUrl(configuration));
+    const heartbeat = setInterval(() => {
+      send(state, SocketEvent.make({
+        _tag: "DeviceHeartbeat",
+        deviceId: configuration.id,
+        status: state.tasks.size > 0 ? "busy" : "online"
+      }));
+    }, 15000);
+    let closed = false;
+    const close = () => {
+      if (closed) {
+        return;
+      }
+      closed = true;
+      clearInterval(heartbeat);
+      if (state.socket === socket) {
+        state.socket = undefined;
+      }
+      complete();
+    };
+    signal.addEventListener("abort", () => {
+      socket.close();
+      close();
+    }, { once: true });
+    socket.once("open", () => {
+      socket.send(JSON.stringify(SocketEvent.make({ _tag: "Authenticate", token: configuration.token })));
+    });
+    socket.on("message", (message) => {
+      const text2 = Buffer.isBuffer(message) ? message.toString("utf8") : message instanceof ArrayBuffer ? Buffer.from(message).toString("utf8") : Array.isArray(message) ? Buffer.concat(message).toString("utf8") : Buffer.from(message).toString("utf8");
+      state.processing = state.processing.then(async () => {
+        const event = await Effect6.runPromise(Effect6.try({
+          try: () => JSON.parse(text2),
+          catch: () => new DeviceConnectionError({ message: "Relay sent invalid JSON" })
+        }).pipe(Effect6.flatMap(decodeSocketEvent)));
+        if (event._tag === "Connected") {
+          state.socket = socket;
+          socket.send(JSON.stringify(SocketEvent.make({
+            _tag: "DeviceHello",
+            device: describeDevice(configuration, state.tasks.size > 0 ? "busy" : "online")
+          })));
+          for (const payload of state.terminal.values()) {
+            socket.send(payload);
+          }
+          return;
+        }
+        if (event._tag === "TaskAssigned") {
+          schedule(configuration, state, event.task);
+          return;
+        }
+        if (event._tag === "CancelTask") {
+          cancel(state, event.taskId);
+          return;
+        }
+        if (event._tag === "TaskSettled") {
+          state.terminal.delete(event.taskId);
+          return;
+        }
+        if (event._tag === "Error") {
+          console.error(`Relay error: ${event.message}`);
+        }
+      }).catch((cause) => {
+        console.error(`Invalid relay event: ${cause instanceof Error ? cause.message : String(cause)}`);
+      });
+    });
+    socket.once("close", close);
+    socket.once("error", () => socket.close());
+  }),
+  catch: (cause) => new DeviceConnectionError({
+    message: cause instanceof Error ? cause.message : String(cause)
+  })
+});
+var runDaemon = (configuration) => {
+  const state = {
+    socket: undefined,
+    processing: Promise.resolve(),
+    terminal: new Map,
+    queue: [],
+    sessions: new Map,
+    tasks: new Map,
+    completed: new Set
+  };
+  return connect(configuration, state).pipe(Effect6.repeat({ schedule: Schedule.spaced("2 seconds") }), Effect6.ensuring(Effect6.sync(() => {
+    state.socket?.close();
+    for (const controller of state.tasks.values()) {
+      controller.abort();
+    }
+  })));
+};
+
+// apps/device/src/mcp.ts
+init_src();
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { Effect as Effect7 } from "effect";
+import * as z from "zod/v4";
+var output = (value) => ({
+  content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
+});
+var runMcp = async (configuration) => {
+  const client2 = exports_src.make({
+    baseUrl: configuration.relayUrl,
+    token: configuration.token
+  });
+  const server = new McpServer({ name: "cohall", version });
+  server.registerTool("list_devices", {
+    title: "List Cohall devices",
+    description: "List devices, their availability, local providers, capabilities, and allowed workspaces.",
+    inputSchema: {}
+  }, async () => output(await Effect7.runPromise(client2.devices())));
+  server.registerTool("delegate", {
+    title: "Delegate work to another device",
+    description: "Send focused work to another Cohall device. Include only relevant context; Cohall cannot read the host transcript. Reuse thread_id for related follow-ups.",
+    inputSchema: {
+      prompt: z.string().min(1).max(131072),
+      target: z.string().optional().describe("Device name, @name, hostname, or ID"),
+      provider: z.enum(["codex", "claude-code", "opencode"]).default("codex"),
+      context: z.string().max(131072).optional(),
+      thread_id: z.string().uuid().optional(),
+      workspace: z.string().max(4096).optional(),
+      wait: z.boolean().default(true),
+      timeout_seconds: z.number().int().min(5).max(86400).default(900)
+    }
+  }, async ({ prompt, target, provider, context, thread_id, workspace, wait, timeout_seconds }) => {
+    const task = await Effect7.runPromise(createDelegation(client2, configuration, {
+      prompt,
+      provider,
+      ...target === undefined ? {} : { target },
+      ...context === undefined ? {} : { context },
+      ...thread_id === undefined ? {} : { threadId: ThreadId.make(thread_id) },
+      ...workspace === undefined ? {} : { workspace }
+    }));
+    return output(taskResult(wait ? await Effect7.runPromise(waitForTask(client2, task, timeout_seconds)) : task));
+  });
+  server.registerTool("task_status", {
+    title: "Get delegated task status",
+    description: "Read the current state and result of a Cohall task.",
+    inputSchema: { task_id: z.string().uuid() }
+  }, async ({ task_id }) => output(taskResult(await Effect7.runPromise(client2.getTask(TaskId.make(task_id))))));
+  server.registerTool("wait_task", {
+    title: "Wait for delegated work",
+    description: "Wait for a Cohall task to finish and return its final result.",
+    inputSchema: {
+      task_id: z.string().uuid(),
+      timeout_seconds: z.number().int().min(5).max(86400).default(900)
+    }
+  }, async ({ task_id, timeout_seconds }) => {
+    const task = await Effect7.runPromise(client2.getTask(TaskId.make(task_id)));
+    return output(taskResult(await Effect7.runPromise(waitForTask(client2, task, timeout_seconds))));
+  });
+  server.registerTool("cancel_task", {
+    title: "Cancel delegated work",
+    description: "Request cancellation and return its acknowledged or pending state.",
+    inputSchema: { task_id: z.string().uuid() }
+  }, async ({ task_id }) => output(taskResult(await Effect7.runPromise(client2.cancelTask(TaskId.make(task_id))))));
+  server.registerTool("thread_context", {
+    title: "Read a Cohall thread",
+    description: "Read shared task prompts and final results for a cross-device thread.",
+    inputSchema: { thread_id: z.string().uuid() }
+  }, async ({ thread_id }) => output(await Effect7.runPromise(threadContext(client2, ThreadId.make(thread_id)))));
+  await server.connect(new StdioServerTransport);
+};
+
+// apps/device/src/main.ts
+var main = async () => {
+  const command2 = process.argv[2];
+  if (command2 === undefined || command2 === "help" || command2 === "--help" || command2 === "-h") {
+    printHelp();
+    return;
+  }
+  if (command2 === "--version" || command2 === "version") {
+    console.log(version);
+    return;
+  }
+  if (command2 === "relay") {
+    const { runRelay: runRelay2 } = await init_main().then(() => exports_main);
+    await runRelay2();
+    return;
+  }
+  if (command2 === "device") {
+    const configuration = await Effect11.runPromise(loadDeviceConfiguration);
+    await Effect11.runPromise(runDaemon(configuration));
+    return;
+  }
+  if (command2 === "mcp") {
+    const configuration = await Effect11.runPromise(loadClientConfiguration);
+    await runMcp(configuration);
+    return;
+  }
+  await runCli(command2, process.argv.slice(3));
+};
+await main().catch((cause) => {
+  console.error(JSON.stringify({ error: cause instanceof Error ? cause.message : String(cause) }, null, 2));
+  process.exitCode = 1;
+});
+
+//# debugId=7CC47D186DE52B1264756E2164756E21