@akshar5/cohall 0.3.4 → 0.4.1

package/bin/cohall.js

@@ -17,7 +17,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // packages/protocol/src/index.ts
 import { Schema } from "effect";
-var version = "0.3.4", bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
+var version = "0.4.1", bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
   expected: "an ISO-8601 UTC timestamp"
 })).pipe(Schema.brand(name)), DeviceId, ThreadId, MessageId, TaskId, AuthSessionId, Timestamp, Platform, Provider, DeviceStatus, TaskStatus, TaskTraceEventKind, MessageRole, ConnectionRole, AuthSession, CreatePairingInput, PairingCredential, ExchangePairingInput, SessionCredential, PairingResult, Capability, Workspace, Device, Thread, Message, Task, TaskTraceEvent, TaskTrace, ThreadContext, CreateTaskInput, SocketEvent, ErrorResponse, terminalTaskStatuses, isTerminalTask = (task) => terminalTaskStatuses.has(task.status), now = () => Timestamp.make(new Date().toISOString()), makeDeviceId = () => DeviceId.make(crypto.randomUUID()), makeThreadId = () => ThreadId.make(crypto.randomUUID()), makeMessageId = () => MessageId.make(crypto.randomUUID()), makeTaskId = () => TaskId.make(crypto.randomUUID()), makeAuthSessionId = () => AuthSessionId.make(crypto.randomUUID()), decodeCreatePairingInput, decodeExchangePairingInput, decodeCreateTaskInput, decodeDevice, decodeSocketEvent;
 var init_src = __esm(() => {
@@ -201,27 +201,27 @@ var init_src = __esm(() => {
 });
 
 // apps/relay/src/config.ts
-import { Effect as Effect8, Schema as Schema8 } from "effect";
-import { access as access3, chmod as chmod2, mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import { Effect as Effect8, Schema as Schema9 } from "effect";
+import { access as access3, chmod as chmod4, mkdir as mkdir4, readFile as readFile4, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir4, platform as platform4 } from "node:os";
-import { join as join4, resolve as resolve2 } from "node:path";
+import { join as join5, resolve as resolve2 } from "node:path";
 var RelayConfiguration, defaultDataDirectory = () => {
   if (platform4() === "win32") {
-    return join4(process.env.LOCALAPPDATA ?? join4(homedir4(), "AppData", "Local"), "Cohall");
+    return join5(process.env.LOCALAPPDATA ?? join5(homedir4(), "AppData", "Local"), "Cohall");
   }
   if (platform4() === "darwin") {
-    return join4(homedir4(), "Library", "Application Support", "Cohall", "relay");
+    return join5(homedir4(), "Library", "Application Support", "Cohall", "relay");
   }
-  return join4(process.env.XDG_DATA_HOME ?? join4(homedir4(), ".local", "share"), "cohall");
+  return join5(process.env.XDG_DATA_HOME ?? join5(homedir4(), ".local", "share"), "cohall");
 }, generatedToken = () => Array.from(crypto.getRandomValues(new Uint8Array(32)), (value) => value.toString(16).padStart(2, "0")).join(""), tokenFrom = async (path) => {
   if (await access3(path).then(() => true).catch(() => false)) {
-    return (await readFile3(path, "utf8")).trim();
+    return (await readFile4(path, "utf8")).trim();
   }
   const token = generatedToken();
-  await writeFile3(path, `${token}
+  await writeFile5(path, `${token}
 `, { mode: 384 });
   if (platform4() !== "win32") {
-    await chmod2(path, 384);
+    await chmod4(path, 384);
   }
   return token;
 }, booleanEnvironment = (name) => {
@@ -235,13 +235,13 @@ var RelayConfiguration, defaultDataDirectory = () => {
   throw new Error(`${name} must be true or false`);
 }, isLoopback = (host) => host === "127.0.0.1" || host === "localhost" || host === "::1", loadEnvironmentConfiguration;
 var init_config = __esm(() => {
-  RelayConfiguration = Schema8.Struct({
-    host: Schema8.NonEmptyString,
-    port: Schema8.Int.check(Schema8.isBetween({ minimum: 1, maximum: 65535 })),
-    token: Schema8.NonEmptyString,
-    dataDirectory: Schema8.NonEmptyString,
-    databasePath: Schema8.NonEmptyString,
-    allowRemote: Schema8.Boolean
+  RelayConfiguration = Schema9.Struct({
+    host: Schema9.NonEmptyString,
+    port: Schema9.Int.check(Schema9.isBetween({ minimum: 1, maximum: 65535 })),
+    token: Schema9.NonEmptyString,
+    dataDirectory: Schema9.NonEmptyString,
+    databasePath: Schema9.NonEmptyString,
+    allowRemote: Schema9.Boolean
   });
   loadEnvironmentConfiguration = Effect8.tryPromise({
     try: async () => {
@@ -252,17 +252,17 @@ var init_config = __esm(() => {
         throw new Error("Remote relay binding is disabled. Use a private network or TLS reverse proxy, then set COHALL_RELAY_ALLOW_REMOTE=true.");
       }
       const dataDirectory = resolve2(process.env.COHALL_DATA_DIR ?? defaultDataDirectory());
-      await mkdir3(dataDirectory, { recursive: true, mode: 448 });
+      await mkdir4(dataDirectory, { recursive: true, mode: 448 });
       if (platform4() !== "win32") {
-        await chmod2(dataDirectory, 448);
+        await chmod4(dataDirectory, 448);
       }
-      const token = process.env.COHALL_TOKEN ?? await tokenFrom(join4(dataDirectory, "owner-token"));
-      return Schema8.decodeUnknownSync(RelayConfiguration)({
+      const token = process.env.COHALL_TOKEN ?? await tokenFrom(join5(dataDirectory, "owner-token"));
+      return Schema9.decodeUnknownSync(RelayConfiguration)({
         host,
         port,
         token,
         dataDirectory,
-        databasePath: join4(dataDirectory, "cohall.db"),
+        databasePath: join5(dataDirectory, "cohall.db"),
         allowRemote
       });
     },
@@ -408,12 +408,12 @@ __export(exports_store, {
   RelayStore: () => exports_store,
   PersistenceError: () => PersistenceError
 });
-import { Context as Context2, Effect as Effect9, Layer as Layer2, Schema as Schema9 } from "effect";
+import { Context as Context2, Effect as Effect9, Layer as Layer2, Schema as Schema10 } from "effect";
 import { createHash, randomBytes } from "node:crypto";
 var PersistenceError, Service2, operationError = (operation) => (cause) => new PersistenceError({
   operation,
   message: cause instanceof Error ? cause.message : String(cause)
-}), decode = (operation, schema, value) => Schema9.decodeUnknownEffect(schema)(value).pipe(Effect9.mapError(operationError(operation))), threadFromRow = (row) => decode("RelayStore.decodeThread", Thread, {
+}), decode = (operation, schema, value) => Schema10.decodeUnknownEffect(schema)(value).pipe(Effect9.mapError(operationError(operation))), threadFromRow = (row) => decode("RelayStore.decodeThread", Thread, {
   id: row.id,
   title: row.title,
   createdAt: row.created_at,
@@ -463,7 +463,7 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
   kind: row.kind,
   at: row.created_at,
   ...row.detail === null ? {} : { detail: row.detail }
-}), rolesFromRow = (row) => Schema9.decodeUnknownSync(Schema9.Array(ConnectionRole))(JSON.parse(row.roles_json)), authSessionFromRow = (row) => {
+}), rolesFromRow = (row) => Schema10.decodeUnknownSync(Schema10.Array(ConnectionRole))(JSON.parse(row.roles_json)), authSessionFromRow = (row) => {
   const roles = rolesFromRow(row);
   const role = roles[0];
   return role === undefined ? Effect9.fail(new PersistenceError({
@@ -904,7 +904,7 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
         if (pairing === null) {
           throw new Error("Pairing credential is invalid, expired, or already used");
         }
-        const roles = Schema9.decodeUnknownSync(Schema9.Array(ConnectionRole))(JSON.parse(pairing.roles_json));
+        const roles = Schema10.decodeUnknownSync(Schema10.Array(ConnectionRole))(JSON.parse(pairing.roles_json));
         const deviceId = roles.includes("device") ? makeDeviceId() : undefined;
         const consumed = db.query("UPDATE auth_pairings SET used_at = ? WHERE token_hash = ? AND used_at IS NULL").run(timestamp, pairing.token_hash);
         if (consumed.changes !== 1) {
@@ -1075,7 +1075,7 @@ var init_store = __esm(() => {
   init_src();
   init_database();
   init_store();
-  PersistenceError = class PersistenceError extends Schema9.TaggedErrorClass()("RelayStore.PersistenceError", { operation: Schema9.String, message: Schema9.String }) {
+  PersistenceError = class PersistenceError extends Schema10.TaggedErrorClass()("RelayStore.PersistenceError", { operation: Schema10.String, message: Schema10.String }) {
   };
   Service2 = class Service2 extends Context2.Service()("@cohall/RelayStore") {
   };
@@ -1086,9 +1086,9 @@ var exports_main = {};
 __export(exports_main, {
   runRelay: () => runRelay
 });
-import { Effect as Effect10, ManagedRuntime, Schema as Schema10 } from "effect";
+import { Effect as Effect10, ManagedRuntime, Schema as Schema11 } from "effect";
 import { createHash as createHash2, timingSafeEqual } from "node:crypto";
-import { access as access4, chmod as chmod3 } from "node:fs/promises";
+import { access as access4, chmod as chmod5 } from "node:fs/promises";
 import { createServer } from "node:http";
 import { platform as platform5 } from "node:os";
 import { WebSocketServer } from "ws";
@@ -1173,7 +1173,7 @@ Content-Length: 0\r
 }, body = (request, decode2) => Effect10.tryPromise({
   try: () => request.json(),
   catch: () => new RequestError({ status: 400, message: "Expected a JSON request body" })
-}).pipe(Effect10.flatMap(decode2), Effect10.mapError((cause) => cause instanceof RequestError ? cause : new RequestError({ status: 400, message: String(cause).slice(0, 2048) }))), pathId = (schema, value) => Schema10.decodeUnknownEffect(schema)(value).pipe(Effect10.mapError(() => new RequestError({ status: 400, message: `Invalid identifier: ${value}` }))), scoreDevice = (device, input, sourceDeviceId) => {
+}).pipe(Effect10.flatMap(decode2), Effect10.mapError((cause) => cause instanceof RequestError ? cause : new RequestError({ status: 400, message: String(cause).slice(0, 2048) }))), pathId = (schema, value) => Schema11.decodeUnknownEffect(schema)(value).pipe(Effect10.mapError(() => new RequestError({ status: 400, message: `Invalid identifier: ${value}` }))), scoreDevice = (device, input, sourceDeviceId) => {
   const prompt = `${input.prompt} ${input.context ?? ""}`.toLowerCase();
   const needsXcode = /\b(xcode|ios|macos|swiftui|app store)\b/.test(prompt);
   const needsBrowser = /\b(browser|chrome|youtube|twitter|logged[- ]?in|signed[- ]?in|x\.com)\b/.test(prompt);
@@ -1216,7 +1216,7 @@ Content-Length: 0\r
     yield* store.recover();
   }));
   if (platform5() !== "win32" && await access4(configuration.databasePath).then(() => true).catch(() => false)) {
-    await chmod3(configuration.databasePath, 384);
+    await chmod5(configuration.databasePath, 384);
   }
   const hub = new Hub;
   let connections = 0;
@@ -1570,9 +1570,9 @@ var init_main = __esm(async () => {
   init_config();
   init_hub();
   init_store();
-  RequestError = class RequestError extends Schema10.TaggedErrorClass()("Relay.RequestError", {
-    status: Schema10.Int,
-    message: Schema10.String
+  RequestError = class RequestError extends Schema11.TaggedErrorClass()("Relay.RequestError", {
+    status: Schema11.Int,
+    message: Schema11.String
   }) {
   };
   if (false) {}
@@ -1738,10 +1738,10 @@ init_src();
 init_src();
 import { Effect as Effect2, Schema as Schema3 } from "effect";
 import { accessSync, constants } from "node:fs";
-import { homedir, platform } from "node:os";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { homedir, platform, tmpdir } from "node:os";
 import { delimiter, extname, isAbsolute, join } from "node:path";
 import { spawn } from "node:child_process";
-import { createInterface } from "node:readline";
 
 class ProviderUnavailableError extends Schema3.TaggedErrorClass()("CohallProvider.Unavailable", { provider: Provider, message: Schema3.String }) {
 }
@@ -1758,7 +1758,7 @@ var executables = {
   opencode: "opencode"
 };
 var providerEnvironment = () => ({
-  ...Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.startsWith("COHALL_"))),
+  ...Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.startsWith("COHALL_") || name === "COHALL_CONFIG")),
   PATH: executableDirectories().join(delimiter)
 });
 var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : undefined;
@@ -1879,42 +1879,90 @@ var claudeCommand = (options) => [
   ...options.model === undefined ? [] : ["--model", options.model],
   ...options.sessionId === undefined ? [] : ["--resume", options.sessionId]
 ];
-var opencodeCommand = (options) => [
+var opencodeCommand = (options, promptPath) => [
   "opencode",
   "run",
   "--format",
   "json",
   ...options.model === undefined ? [] : ["--model", options.model],
   ...options.sessionId === undefined ? [] : ["--session", options.sessionId],
-  options.prompt
+  "--file",
+  promptPath,
+  "Complete the task described in the attached Cohall prompt file."
 ];
-var command = (options) => {
+var prepareCommand = async (options) => {
   switch (options.provider) {
     case "codex":
-      return codexCommand(options);
+      return {
+        command: codexCommand(options),
+        input: options.prompt,
+        cleanup: () => Promise.resolve()
+      };
     case "claude-code":
-      return claudeCommand(options);
-    case "opencode":
-      return opencodeCommand(options);
+      return {
+        command: claudeCommand(options),
+        input: options.prompt,
+        cleanup: () => Promise.resolve()
+      };
+    case "opencode": {
+      const directory = await mkdtemp(join(tmpdir(), "cohall-opencode-"));
+      const promptPath = join(directory, "prompt.md");
+      try {
+        if (platform() !== "win32") {
+          await chmod(directory, 448);
+        }
+        await writeFile(promptPath, options.prompt, { mode: 384 });
+        return {
+          command: opencodeCommand(options, promptPath),
+          cleanup: () => rm(directory, { recursive: true, force: true })
+        };
+      } catch (cause) {
+        await rm(directory, { recursive: true, force: true }).catch(() => {
+          return;
+        });
+        throw cause;
+      }
+    }
   }
 };
 var forEachJsonEvent = async (stdout, onEvent) => {
-  const lines = createInterface({ input: stdout, crlfDelay: Infinity });
-  try {
-    for await (const line of lines) {
-      if (line.trim().length === 0) {
-        continue;
-      }
-      if (Buffer.byteLength(line) > 1024 * 1024) {
-        throw new Error("Provider event exceeded 1024 KiB");
-      }
-      const event = record(JSON.parse(line));
-      if (event !== undefined) {
-        onEvent(event);
-      }
+  const limit = 1024 * 1024;
+  let chunks = [];
+  let size = 0;
+  const append = (chunk) => {
+    if (size + chunk.byteLength > limit) {
+      throw new Error("Provider event exceeded 1024 KiB");
     }
-  } finally {
-    lines.close();
+    if (chunk.byteLength > 0) {
+      chunks.push(chunk);
+      size += chunk.byteLength;
+    }
+  };
+  const emit = () => {
+    const line = Buffer.concat(chunks, size).toString("utf8");
+    chunks = [];
+    size = 0;
+    if (line.trim().length === 0) {
+      return;
+    }
+    const event = record(JSON.parse(line));
+    if (event !== undefined) {
+      onEvent(event);
+    }
+  };
+  for await (const chunk of stdout) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+    let start = 0;
+    for (let newline = bytes.indexOf(10, start);newline !== -1; ) {
+      append(bytes.subarray(start, newline));
+      emit();
+      start = newline + 1;
+      newline = bytes.indexOf(10, start);
+    }
+    append(bytes.subarray(start));
+  }
+  if (size > 0) {
+    emit();
   }
 };
 var parseCodex = async (stdout, existingSession) => {
@@ -2002,14 +2050,15 @@ var parse = async (options, stdout, onFailure) => {
 var byteLength = (value) => new TextEncoder().encode(value).byteLength;
 var run = (options) => Effect2.tryPromise({
   try: async (signal) => {
-    const [commandName, ...arguments_] = command(options);
-    const executable = commandName === undefined ? undefined : findExecutable(commandName);
+    const executable = findExecutable(executables[options.provider]);
     if (executable === undefined) {
       throw new ProviderUnavailableError({
         provider: options.provider,
         message: `${executables[options.provider]} is not available on this device`
       });
     }
+    const prepared = await prepareCommand(options);
+    const [, ...arguments_] = prepared.command;
     const child = spawn(executable, arguments_, {
       cwd: options.cwd,
       env: {
@@ -2037,36 +2086,46 @@ var run = (options) => Effect2.tryPromise({
       killTimer.unref();
     };
     signal.addEventListener("abort", terminate, { once: true });
-    child.stdin.end(options.provider === "opencode" ? undefined : options.prompt);
-    const [result, stderr, exitCode] = await Promise.all([
-      parse(options, child.stdout, terminate),
-      captureText(child.stderr, 64 * 1024),
-      exited
-    ]);
-    signal.removeEventListener("abort", terminate);
-    if (killTimer !== undefined && child.exitCode !== null) {
-      clearTimeout(killTimer);
-    }
-    if (exitCode !== 0) {
-      throw new ProviderRunError({
-        provider: options.provider,
-        message: failureMessage(executables[options.provider], stderr, exitCode),
-        exitCode
-      });
-    }
-    if (byteLength(result.result) > 131072) {
-      throw new ProviderRunError({
-        provider: options.provider,
-        message: "Provider result exceeded 128 KiB"
-      });
-    }
-    if (result.sessionId !== undefined && byteLength(result.sessionId) > 4096) {
-      throw new ProviderRunError({
-        provider: options.provider,
-        message: "Provider session ID exceeded 4 KiB"
-      });
+    child.stdin.end(prepared.input);
+    try {
+      const [result, stderr, exitCode] = await Promise.all([
+        parse(options, child.stdout, terminate),
+        captureText(child.stderr, 64 * 1024),
+        exited
+      ]);
+      if (exitCode !== 0) {
+        throw new ProviderRunError({
+          provider: options.provider,
+          message: failureMessage(executables[options.provider], stderr, exitCode),
+          exitCode
+        });
+      }
+      if (byteLength(result.result) > 131072) {
+        throw new ProviderRunError({
+          provider: options.provider,
+          message: "Provider result exceeded 128 KiB"
+        });
+      }
+      if (result.sessionId !== undefined && byteLength(result.sessionId) > 4096) {
+        throw new ProviderRunError({
+          provider: options.provider,
+          message: "Provider session ID exceeded 4 KiB"
+        });
+      }
+      return result;
+    } finally {
+      signal.removeEventListener("abort", terminate);
+      if (child.exitCode === null) {
+        terminate();
+        await exited.catch(() => {
+          return;
+        });
+      }
+      if (killTimer !== undefined) {
+        clearTimeout(killTimer);
+      }
+      await prepared.cleanup();
     }
-    return result;
   },
   catch: (cause) => {
     if (cause instanceof ProviderUnavailableError || cause instanceof ProviderRunError) {
@@ -2080,10 +2139,10 @@ var run = (options) => Effect2.tryPromise({
 });
 
 // apps/device/src/cli.ts
-import { Effect as Effect5, Schema as Schema6 } from "effect";
-import { access as access2, mkdir as mkdir2, readFile as readFile2, stat, writeFile as writeFile2 } from "node:fs/promises";
+import { Effect as Effect5, Schema as Schema7 } from "effect";
+import { access as access2, mkdir as mkdir3, readFile as readFile3, stat, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { dirname as dirname3, join as join4 } from "node:path";
 
 // skills/cohall/SKILL.md
 var SKILL_default = `---
@@ -2222,7 +2281,7 @@ Return the diagnostic failure to the user rather than claiming remote work ran.
 // apps/device/src/config.ts
 init_src();
 import { Effect as Effect3, Schema as Schema4 } from "effect";
-import { access, chmod, mkdir, readFile, realpath, rename, writeFile } from "node:fs/promises";
+import { access, chmod as chmod2, mkdir, readFile, realpath, rename, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2, hostname, platform as platform2 } from "node:os";
 import { dirname, join as join2, resolve } from "node:path";
 var WorkspaceList = Schema4.Array(Schema4.NonEmptyString).check(Schema4.isMaxLength(64));
@@ -2296,7 +2355,7 @@ var readStoredConfiguration = async () => {
     return;
   }
   if (platform2() !== "win32") {
-    await chmod(path, 384);
+    await chmod2(path, 384);
   }
   try {
     return Schema4.decodeUnknownSync(StoredConfiguration)(JSON.parse(await readFile(path, "utf8")));
@@ -2310,24 +2369,35 @@ var writeStoredConfiguration = async (configuration) => {
   const temporary = `${path}.${process.pid}.tmp`;
   await mkdir(directory, { recursive: true, mode: 448 });
   if (platform2() !== "win32") {
-    await chmod(directory, 448);
+    await chmod2(directory, 448);
   }
-  await writeFile(temporary, `${JSON.stringify(configuration, null, 2)}
+  await writeFile2(temporary, `${JSON.stringify(configuration, null, 2)}
 `, { mode: 384 });
   await rename(temporary, path);
   if (platform2() !== "win32") {
-    await chmod(path, 384);
+    await chmod2(path, 384);
+  }
+};
+var credentialsForRelay = (configuration, relayUrl) => {
+  if (configuration?.relayUrl !== normalizeRelayUrl(relayUrl)) {
+    return {};
   }
+  return {
+    ...configuration.clientToken === undefined ? {} : { clientToken: configuration.clientToken },
+    ...configuration.deviceToken === undefined ? {} : { deviceToken: configuration.deviceToken }
+  };
 };
 var makeStoredConfiguration = async (input) => {
   const existing = await readStoredConfiguration();
+  const relayUrl = normalizeRelayUrl(input.relayUrl);
+  const retainedCredentials = credentialsForRelay(existing, relayUrl);
   const canonicalWorkspaces = input.workspaces === undefined ? existing?.workspaces ?? [] : await Effect3.runPromise(parseWorkspaces("", JSON.stringify(input.workspaces)));
-  const clientToken = input.clientToken ?? existing?.clientToken;
-  const deviceToken = input.deviceToken ?? existing?.deviceToken;
+  const clientToken = input.clientToken ?? retainedCredentials.clientToken;
+  const deviceToken = input.deviceToken ?? retainedCredentials.deviceToken;
   const providers = input.providers === "auto" ? undefined : input.providers ?? existing?.providers;
   return StoredConfiguration.make({
     version: 1,
-    relayUrl: normalizeRelayUrl(input.relayUrl),
+    relayUrl,
     deviceId: existing?.deviceId ?? makeDeviceId(),
     deviceName: input.deviceName ?? existing?.deviceName ?? hostname(),
     workspaces: canonicalWorkspaces,
@@ -2368,12 +2438,13 @@ var storedOrDefaults = async () => {
 var loadClientConfiguration = Effect3.tryPromise({
   try: async () => {
     const stored = await storedOrDefaults();
-    const token = process.env.COHALL_CLIENT_TOKEN ?? stored.clientToken;
+    const relayUrl = normalizeRelayUrl(process.env.COHALL_RELAY_URL ?? stored.relayUrl);
+    const token = process.env.COHALL_CLIENT_TOKEN ?? credentialsForRelay(stored, relayUrl).clientToken;
     if (token === undefined) {
       throw new Error(`No client credential. Run cohall join with a pairing token on stdin or set COHALL_CLIENT_TOKEN.`);
     }
     return ClientConfiguration.make({
-      relayUrl: normalizeRelayUrl(process.env.COHALL_RELAY_URL ?? stored.relayUrl),
+      relayUrl,
       token,
       ...process.env.COHALL_THREAD_ID === undefined ? {} : { mcpThreadId: process.env.COHALL_THREAD_ID }
     });
@@ -2397,7 +2468,8 @@ var loadOwnerConfiguration = Effect3.tryPromise({
 var loadDeviceConfiguration = Effect3.tryPromise({
   try: async () => {
     const stored = await storedOrDefaults();
-    const token = process.env.COHALL_DEVICE_TOKEN ?? stored.deviceToken;
+    const relayUrl = normalizeRelayUrl(process.env.COHALL_RELAY_URL ?? stored.relayUrl);
+    const token = process.env.COHALL_DEVICE_TOKEN ?? credentialsForRelay(stored, relayUrl).deviceToken;
     if (token === undefined) {
       throw new Error(`No device credential. Run cohall join with a pairing token on stdin or set COHALL_DEVICE_TOKEN.`);
     }
@@ -2409,7 +2481,7 @@ var loadDeviceConfiguration = Effect3.tryPromise({
     const sandbox = environmentSandbox() ?? stored.sandbox;
     const providers = environmentProviders(stored);
     return DeviceConfiguration.make({
-      relayUrl: normalizeRelayUrl(process.env.COHALL_RELAY_URL ?? stored.relayUrl),
+      relayUrl,
       token,
       id: process.env.COHALL_DEVICE_ID === undefined ? stored.deviceId : DeviceId.make(process.env.COHALL_DEVICE_ID),
       name: process.env.COHALL_DEVICE_NAME ?? stored.deviceName,
@@ -2517,6 +2589,322 @@ var threadContext = Effect4.fn("Cohall.threadContext")(function* (client, thread
   return yield* client.threadContext(threadId);
 });
 
+// apps/device/src/upgrade.ts
+import { Schema as Schema6 } from "effect";
+import { execFile } from "node:child_process";
+import { chmod as chmod3, mkdir as mkdir2, readFile as readFile2, realpath as realpath2, rename as rename2, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname2, join as join3 } from "node:path";
+import { platform as operatingSystem } from "node:os";
+var packageName = "@akshar5/cohall";
+var semanticVersion = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+var PackageManager = Schema6.Literals(["npm", "bun", "pnpm"]);
+var RestartReceipt = Schema6.Struct({
+  version: Schema6.String,
+  fromVersion: Schema6.String,
+  packageManager: PackageManager,
+  pendingServices: Schema6.Array(Schema6.String),
+  restartedServices: Schema6.Array(Schema6.String)
+});
+var normalizePath = (path) => path.replaceAll("\\", "/");
+var normalizeUpgradeTarget = (target) => {
+  if (target === undefined || target === "latest") {
+    return "latest";
+  }
+  const normalized = target.startsWith("v") ? target.slice(1) : target;
+  if (!semanticVersion.test(normalized)) {
+    throw new Error("--to must be latest or an exact semantic version");
+  }
+  return normalized;
+};
+var packageInstallation = (canonicalEntrypoint, entrypoint = canonicalEntrypoint) => {
+  const path = normalizePath(canonicalEntrypoint);
+  const marker = `/node_modules/${packageName}/`;
+  const packageIndex = path.lastIndexOf(marker);
+  if (packageIndex === -1) {
+    throw new Error("cohall upgrade requires a global npm, Bun, or pnpm installation; package-runner and source-checkout executions cannot upgrade themselves");
+  }
+  if (path.includes("/.npm/_npx/") || path.includes("/.bunx/") || path.includes("/pnpm/dlx/") || path.includes("/dlx/")) {
+    throw new Error("This Cohall process is running from a temporary package-runner cache; install it globally before using cohall upgrade");
+  }
+  if (path.includes("/.bun/install/global/node_modules/")) {
+    return { manager: "bun", entrypoint };
+  }
+  if (path.includes("/pnpm/global/") || path.includes("/.pnpm/")) {
+    return { manager: "pnpm", entrypoint };
+  }
+  const nodeModulesParent = path.slice(0, packageIndex);
+  const prefix = nodeModulesParent.endsWith("/lib") ? nodeModulesParent.slice(0, -"/lib".length) : nodeModulesParent;
+  return { manager: "npm", prefix, entrypoint };
+};
+var packageInstallCommand = (installation, target) => {
+  const specification = `${packageName}@${target}`;
+  switch (installation.manager) {
+    case "bun":
+      return { command: "bun", arguments: ["add", "--global", specification] };
+    case "pnpm":
+      return { command: "pnpm", arguments: ["add", "--global", specification] };
+    case "npm":
+      return {
+        command: "npm",
+        arguments: [
+          "install",
+          "--global",
+          ...installation.prefix === undefined ? [] : ["--prefix", installation.prefix],
+          specification
+        ]
+      };
+  }
+};
+var serviceCandidates = (runtimePlatform, uid) => {
+  if (runtimePlatform === "linux") {
+    const systemd = (manager, unit, device) => {
+      const user = manager === "systemd-user" ? ["--user"] : [];
+      return {
+        id: `${manager}:${unit}`,
+        label: unit,
+        manager,
+        device,
+        check: { command: "systemctl", arguments: [...user, "is-active", "--quiet", unit] },
+        restart: [{ command: "systemctl", arguments: [...user, "restart", unit] }]
+      };
+    };
+    return [
+      systemd("systemd-user", "cohall-relay.service", false),
+      systemd("systemd-system", "cohall-relay.service", false),
+      systemd("systemd-user", "cohall-device.service", true)
+    ];
+  }
+  if (runtimePlatform === "darwin") {
+    const domain = `gui/${uid ?? 0}`;
+    const launchd = (label, device) => ({
+      id: `launchd:${label}`,
+      label,
+      manager: "launchd",
+      device,
+      check: { command: "launchctl", arguments: ["print", `${domain}/${label}`] },
+      activeOutput: /\bstate\s*=\s*running\b/,
+      restart: [{ command: "launchctl", arguments: ["kickstart", "-k", `${domain}/${label}`] }]
+    });
+    return [launchd("com.cohall.relay", false), launchd("com.cohall.device", true)];
+  }
+  if (runtimePlatform === "win32") {
+    return [
+      {
+        id: "scheduled-task:Cohall Device",
+        label: "Cohall Device",
+        manager: "scheduled-task",
+        device: true,
+        check: {
+          command: "powershell.exe",
+          arguments: [
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            "if ((Get-ScheduledTask -TaskName 'Cohall Device' -ErrorAction SilentlyContinue).State -eq 'Running') { exit 0 } else { exit 1 }"
+          ]
+        },
+        restart: [
+          {
+            command: "schtasks",
+            arguments: ["/End", "/TN", "Cohall Device"],
+            allowFailure: true
+          },
+          { command: "schtasks", arguments: ["/Run", "/TN", "Cohall Device"] }
+        ]
+      }
+    ];
+  }
+  return [];
+};
+var defaultRunner = {
+  run: (command, arguments_, timeoutMs = 300000) => new Promise((resolve2) => {
+    execFile(command, [...arguments_], { encoding: "utf8", maxBuffer: 1024 * 1024, timeout: timeoutMs, windowsHide: true }, (error, stdout, stderr) => {
+      resolve2({
+        exitCode: typeof error?.code === "number" ? error.code : error === null ? 0 : 1,
+        stdout,
+        stderr,
+        ...error === null ? {} : { error: error.message }
+      });
+    });
+  })
+};
+var checked = async (runner, invocation, timeoutMs) => {
+  const result = await runner.run(invocation.command, invocation.arguments, timeoutMs);
+  if (result.exitCode === 0 || invocation.allowFailure === true) {
+    return result;
+  }
+  const detail = (result.stderr.trim() || result.stdout.trim() || result.error || "unknown error").slice(0, 16384);
+  throw new Error(`${invocation.command} ${invocation.arguments.join(" ")} failed with status ${result.exitCode}: ${detail}`);
+};
+var activeServices = async (runner, candidates) => {
+  const active = [];
+  for (const service of candidates) {
+    const result = await runner.run(service.check.command, service.check.arguments, 1e4);
+    if (result.exitCode === 0 && (service.activeOutput === undefined || service.activeOutput.test(`${result.stdout}
+${result.stderr}`))) {
+      active.push(service);
+    }
+  }
+  return active;
+};
+var readReceipt = async (path) => readFile2(path, "utf8").then((content) => Schema6.decodeUnknownOption(RestartReceipt)(JSON.parse(content))).then((decoded) => decoded._tag === "Some" ? decoded.value : undefined).catch(() => {
+  return;
+});
+var writeReceipt = async (path, value) => {
+  const directory = dirname2(path);
+  const temporary = `${path}.${process.pid}.tmp`;
+  await mkdir2(directory, { recursive: true, mode: 448 });
+  if (operatingSystem() !== "win32") {
+    await chmod3(directory, 448);
+  }
+  await writeFile3(temporary, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+  await rename2(temporary, path);
+};
+var installedVersion = async (entrypoint) => {
+  const canonicalEntrypoint = await realpath2(entrypoint);
+  const metadata = JSON.parse(await readFile2(join3(dirname2(dirname2(canonicalEntrypoint)), "package.json"), "utf8"));
+  if (typeof metadata !== "object" || metadata === null || !("name" in metadata) || metadata.name !== packageName || !("version" in metadata) || typeof metadata.version !== "string") {
+    throw new Error(`Could not verify the installed ${packageName} version`);
+  }
+  return metadata.version;
+};
+var restartReceiptPath = () => join3(dirname2(configurationPath()), "upgrade-restart.json");
+var restartServices = async (runner, services, statePath, state) => {
+  let current = state;
+  for (const service of services) {
+    for (const invocation of service.restart) {
+      await checked(runner, invocation, 60000);
+    }
+    current = {
+      ...current,
+      pendingServices: current.pendingServices.filter((id) => id !== service.id),
+      restartedServices: [...current.restartedServices, service.id]
+    };
+    await writeReceipt(statePath, current);
+  }
+  return current;
+};
+var upgrade = async (options) => {
+  const runner = options.runner ?? defaultRunner;
+  const runtimePlatform = options.platform ?? process.platform;
+  const uid = options.uid ?? process.getuid?.();
+  const candidates = serviceCandidates(runtimePlatform, uid);
+  const statePath = options.statePath ?? restartReceiptPath();
+  const previous = await readReceipt(statePath);
+  if (previous?.version === options.currentVersion) {
+    const byId = new Map(candidates.map((service) => [service.id, service]));
+    const pending = previous.pendingServices.flatMap((id) => {
+      const service = byId.get(id);
+      return service === undefined ? [] : [service];
+    });
+    const active = await activeServices(runner, pending);
+    if (options.dryRun || !options.restart) {
+      return {
+        upgraded: previous.fromVersion !== previous.version,
+        from_version: previous.fromVersion,
+        installed_version: previous.version,
+        requested_version: previous.version,
+        package_manager: previous.packageManager,
+        services_restarted: previous.restartedServices,
+        services_pending_restart: active.map((service) => service.id),
+        resumed_after_restart: false,
+        dry_run: options.dryRun
+      };
+    }
+    const activeIds = new Set(active.map((service) => service.id));
+    const completedByRestart = options.delegated === true ? pending.filter((service) => service.device && activeIds.has(service.id)) : [];
+    const completedIds = new Set(completedByRestart.map((service) => service.id));
+    const remaining = active.filter((service) => !completedIds.has(service.id));
+    let resumed = {
+      ...previous,
+      pendingServices: previous.pendingServices.filter((id) => !completedIds.has(id)),
+      restartedServices: [
+        ...previous.restartedServices,
+        ...completedByRestart.map((service) => service.id)
+      ]
+    };
+    if (remaining.length > 0) {
+      await writeReceipt(statePath, resumed);
+      resumed = await restartServices(runner, remaining, statePath, resumed);
+    }
+    await rm2(statePath, { force: true });
+    return {
+      upgraded: previous.fromVersion !== previous.version,
+      from_version: previous.fromVersion,
+      installed_version: previous.version,
+      requested_version: previous.version,
+      package_manager: previous.packageManager,
+      services_restarted: resumed.restartedServices,
+      services_pending_restart: [],
+      resumed_after_restart: true,
+      dry_run: false
+    };
+  }
+  await rm2(statePath, { force: true });
+  const target = normalizeUpgradeTarget(options.target);
+  const entrypoint = options.entrypoint ?? process.argv[1];
+  if (entrypoint === undefined) {
+    throw new Error("Could not resolve the Cohall executable path");
+  }
+  const installation = packageInstallation(await realpath2(entrypoint), entrypoint);
+  const install = packageInstallCommand(installation, target);
+  const services = await activeServices(runner, candidates);
+  if (options.dryRun) {
+    return {
+      upgraded: false,
+      from_version: options.currentVersion,
+      installed_version: options.currentVersion,
+      requested_version: target,
+      package_manager: installation.manager,
+      services_restarted: [],
+      services_pending_restart: options.restart ? services.map((service) => service.id) : [],
+      resumed_after_restart: false,
+      dry_run: true
+    };
+  }
+  await checked(runner, install);
+  const nextVersion = await installedVersion(entrypoint);
+  if (target !== "latest" && nextVersion !== target) {
+    throw new Error(`Installed Cohall ${nextVersion}, expected ${target}`);
+  }
+  const upgraded = nextVersion !== options.currentVersion;
+  if (!options.restart || services.length === 0) {
+    return {
+      upgraded,
+      from_version: options.currentVersion,
+      installed_version: nextVersion,
+      requested_version: target,
+      package_manager: installation.manager,
+      services_restarted: [],
+      services_pending_restart: options.restart ? [] : services.map((service) => service.id),
+      resumed_after_restart: false,
+      dry_run: false
+    };
+  }
+  const initial = {
+    version: nextVersion,
+    fromVersion: options.currentVersion,
+    packageManager: installation.manager,
+    pendingServices: services.map((service) => service.id),
+    restartedServices: []
+  };
+  await writeReceipt(statePath, initial);
+  const completed = await restartServices(runner, services, statePath, initial);
+  await rm2(statePath, { force: true });
+  return {
+    upgraded,
+    from_version: options.currentVersion,
+    installed_version: nextVersion,
+    requested_version: target,
+    package_manager: installation.manager,
+    services_restarted: completed.restartedServices,
+    services_pending_restart: [],
+    resumed_after_restart: false,
+    dry_run: false
+  };
+};
+
 // apps/device/src/cli.ts
 var valueOptions = new Set([
   "context",
@@ -2534,9 +2922,10 @@ var valueOptions = new Set([
   "thread",
   "timeout",
   "token-file",
+  "to",
   "workspace"
 ]);
-var flagOptions = new Set(["client-only", "follow", "no-wait"]);
+var flagOptions = new Set(["client-only", "dry-run", "follow", "no-restart", "no-wait"]);
 var aliases = new Map([
   ["-c", "context"],
   ["-p", "prompt"],
@@ -2564,6 +2953,7 @@ Usage:
   cohall sessions
   cohall revoke <session-id>
   cohall doctor
+  cohall upgrade [--to version|latest] [--no-restart] [--dry-run]
   cohall device
   cohall relay
   cohall mcp
@@ -2636,9 +3026,9 @@ var allowOptions = (arguments_, names) => {
     }
   }
 };
-var noPositionals = (arguments_, command2) => {
+var noPositionals = (arguments_, command) => {
   if (arguments_.positionals.length > 0) {
-    throw new Error(`${command2} does not accept positional arguments`);
+    throw new Error(`${command} does not accept positional arguments`);
   }
 };
 var identifier = (arguments_, label) => {
@@ -2666,7 +3056,7 @@ var readInput = async (arguments_, name) => {
     if ((await stat(path)).size > 131072) {
       throw new Error(`${name} file exceeds 128 KiB`);
     }
-    return readFile2(path, "utf8");
+    return readFile3(path, "utf8");
   }
   const result = direct === "-" ? await readStdin(131072, name) : direct;
   if (result !== undefined && result.length > 131072) {
@@ -2702,7 +3092,7 @@ var pairingToken = async (arguments_) => {
   if (path !== undefined && (await stat(path)).size > 512) {
     throw new Error("Pairing token file exceeds 512 bytes");
   }
-  const token = (path === undefined ? await readStdin(512, "Pairing token") : await readFile2(path, "utf8")).trim();
+  const token = (path === undefined ? await readStdin(512, "Pairing token") : await readFile3(path, "utf8")).trim();
   if (token.length === 0 || new TextEncoder().encode(token).byteLength > 256) {
     throw new Error("Provide a pairing token on stdin or with --token-file");
   }
@@ -2724,25 +3114,38 @@ var ownerClient = async () => {
 };
 var installSkill = async (target) => {
   const roots = {
-    agents: join3(homedir3(), ".agents", "skills", "cohall", "SKILL.md"),
-    claude: join3(homedir3(), ".claude", "skills", "cohall", "SKILL.md"),
-    opencode: join3(homedir3(), ".config", "opencode", "skills", "cohall", "SKILL.md")
+    agents: join4(homedir3(), ".agents", "skills", "cohall", "SKILL.md"),
+    claude: join4(homedir3(), ".claude", "skills", "cohall", "SKILL.md"),
+    opencode: join4(homedir3(), ".config", "opencode", "skills", "cohall", "SKILL.md")
   };
   const selected = target === "all" ? Object.values(roots) : (target in roots) ? [roots[target]] : undefined;
   if (selected === undefined) {
     throw new Error("Skill target must be agents, claude, opencode, or all");
   }
   for (const path of selected) {
-    await mkdir2(dirname2(path), { recursive: true });
-    await writeFile2(path, SKILL_default);
+    await mkdir3(dirname3(path), { recursive: true });
+    await writeFile4(path, SKILL_default);
   }
   return selected;
 };
 var printHelp = () => console.log(help);
 var printSkill = () => console.log(SKILL_default.trimEnd());
-var runCli = async (command2, raw) => {
+var runCli = async (command, raw) => {
   const arguments_ = parseArguments(raw);
-  if (command2 === "join") {
+  if (command === "upgrade") {
+    allowOptions(arguments_, ["dry-run", "no-restart", "to"]);
+    noPositionals(arguments_, command);
+    const target = option(arguments_, "to");
+    print(await upgrade({
+      currentVersion: version,
+      ...target === undefined ? {} : { target },
+      restart: !arguments_.options.has("no-restart"),
+      dryRun: arguments_.options.has("dry-run"),
+      delegated: process.env.COHALL_PROVIDER !== undefined
+    }));
+    return;
+  }
+  if (command === "join") {
     allowOptions(arguments_, [
       "client-only",
       "name",
@@ -2751,7 +3154,7 @@ var runCli = async (command2, raw) => {
       "token-file",
       "workspace"
     ]);
-    noPositionals(arguments_, command2);
+    noPositionals(arguments_, command);
     const token = await pairingToken(arguments_);
     const relayUrl = normalizeRelayUrl(option(arguments_, "relay") ?? "http://127.0.0.1:8787");
     const existing = await readStoredConfiguration();
@@ -2793,9 +3196,9 @@ var runCli = async (command2, raw) => {
     });
     return;
   }
-  if (command2 === "config") {
+  if (command === "config") {
     allowOptions(arguments_, []);
-    noPositionals(arguments_, command2);
+    noPositionals(arguments_, command);
     const configuration2 = await readStoredConfiguration();
     print({
       config_path: configurationPath(),
@@ -2814,9 +3217,9 @@ var runCli = async (command2, raw) => {
     });
     return;
   }
-  if (command2 === "configure") {
+  if (command === "configure") {
     allowOptions(arguments_, ["model", "name", "providers", "relay", "sandbox", "workspace"]);
-    noPositionals(arguments_, command2);
+    noPositionals(arguments_, command);
     const existing = await readStoredConfiguration();
     const relayUrl = normalizeRelayUrl(option(arguments_, "relay") ?? existing?.relayUrl ?? "http://127.0.0.1:8787");
     const supplied = values(arguments_, "workspace");
@@ -2831,19 +3234,18 @@ var runCli = async (command2, raw) => {
       deviceId: existing?.deviceId ?? makeDeviceId(),
       deviceName: option(arguments_, "name") ?? existing?.deviceName ?? "cohall-device",
       workspaces,
-      ...existing?.clientToken === undefined ? {} : { clientToken: existing.clientToken },
-      ...existing?.deviceToken === undefined ? {} : { deviceToken: existing.deviceToken },
+      ...credentialsForRelay(existing, relayUrl),
       ...providers === undefined ? {} : { providers },
       ...model === undefined ? {} : { model },
       ...(sandbox ?? existing?.sandbox) === undefined ? {} : {
-        sandbox: Schema6.decodeUnknownSync(Schema6.Literals(["read-only", "workspace-write", "danger-full-access"]))(sandbox ?? existing?.sandbox)
+        sandbox: Schema7.decodeUnknownSync(Schema7.Literals(["read-only", "workspace-write", "danger-full-access"]))(sandbox ?? existing?.sandbox)
       }
     });
     await writeStoredConfiguration(configuration2);
     print({ configured: true, config_path: configurationPath() });
     return;
   }
-  if (command2 === "skill") {
+  if (command === "skill") {
     allowOptions(arguments_, []);
     if (arguments_.positionals.length === 0) {
       printSkill();
@@ -2855,9 +3257,9 @@ var runCli = async (command2, raw) => {
     print({ installed: await installSkill(arguments_.positionals[1] ?? "all") });
     return;
   }
-  if (command2 === "integrations") {
+  if (command === "integrations") {
     allowOptions(arguments_, []);
-    noPositionals(arguments_, command2);
+    noPositionals(arguments_, command);
     print({
       cli_skill: "npx -y @akshar5/cohall skill install all",
       codex_mcp: "codex mcp add cohall -- npx -y @akshar5/cohall mcp",
@@ -2874,11 +3276,12 @@ var runCli = async (command2, raw) => {
     });
     return;
   }
-  if (command2 === "doctor") {
+  if (command === "doctor") {
     allowOptions(arguments_, []);
-    noPositionals(arguments_, command2);
+    noPositionals(arguments_, command);
     const configuration2 = await readStoredConfiguration();
     const relayUrl = normalizeRelayUrl(process.env.COHALL_RELAY_URL ?? configuration2?.relayUrl ?? "http://127.0.0.1:8787");
+    const storedCredentials = credentialsForRelay(configuration2, relayUrl);
     const response = await fetch(`${relayUrl}/api/health`, {
       signal: AbortSignal.timeout(1e4)
     }).catch(() => {
@@ -2890,8 +3293,8 @@ var runCli = async (command2, raw) => {
       provider,
       findExecutable(provider === "claude-code" ? "claude" : provider) ?? "not found"
     ]));
-    const clientToken = process.env.COHALL_CLIENT_TOKEN ?? configuration2?.clientToken;
-    const hasDeviceCredential = process.env.COHALL_DEVICE_TOKEN !== undefined || configuration2?.deviceToken !== undefined;
+    const clientToken = process.env.COHALL_CLIENT_TOKEN ?? storedCredentials.clientToken;
+    const hasDeviceCredential = process.env.COHALL_DEVICE_TOKEN !== undefined || storedCredentials.deviceToken !== undefined;
     const deviceId = process.env.COHALL_DEVICE_ID ?? configuration2?.deviceId;
     const currentDevice = response?.ok !== true || clientToken === undefined || deviceId === undefined ? undefined : await Effect5.runPromise(exports_src.make({ baseUrl: relayUrl, token: clientToken }).devices()).then((devices) => devices.find((device) => device.id === deviceId)).catch(() => {
       return;
@@ -2908,7 +3311,7 @@ var runCli = async (command2, raw) => {
       relay: response?.ok === true ? "reachable" : "unreachable",
       relay_url: relayUrl,
       config_path: configurationPath(),
-      client_credential: process.env.COHALL_CLIENT_TOKEN !== undefined || configuration2?.clientToken !== undefined,
+      client_credential: process.env.COHALL_CLIENT_TOKEN !== undefined || storedCredentials.clientToken !== undefined,
       device_credential: hasDeviceCredential,
       workspaces: configuration2?.workspaces ?? [],
       providers: providerExecutables,
@@ -2920,11 +3323,11 @@ var runCli = async (command2, raw) => {
     });
     return;
   }
-  if (command2 === "pair" || command2 === "sessions" || command2 === "revoke") {
+  if (command === "pair" || command === "sessions" || command === "revoke") {
     const { configuration: configuration2, relay: relay2 } = await ownerClient();
-    if (command2 === "pair") {
+    if (command === "pair") {
       allowOptions(arguments_, ["client-only", "label"]);
-      noPositionals(arguments_, command2);
+      noPositionals(arguments_, command);
       const roles = arguments_.options.has("client-only") ? ["client"] : ["client", "device"];
       const credential = await Effect5.runPromise(relay2.createPairing({ label: option(arguments_, "label") ?? "Cohall device", roles }));
       print({
@@ -2935,24 +3338,24 @@ var runCli = async (command2, raw) => {
       });
       return;
     }
-    if (command2 === "sessions") {
+    if (command === "sessions") {
       allowOptions(arguments_, []);
-      noPositionals(arguments_, command2);
+      noPositionals(arguments_, command);
       print(await Effect5.runPromise(relay2.authSessions()));
       return;
     }
     allowOptions(arguments_, []);
-    print(await Effect5.runPromise(relay2.revokeAuthSession(Schema6.decodeUnknownSync(AuthSessionId)(identifier(arguments_, "session id")))));
+    print(await Effect5.runPromise(relay2.revokeAuthSession(Schema7.decodeUnknownSync(AuthSessionId)(identifier(arguments_, "session id")))));
     return;
   }
   const { configuration, relay } = await client();
-  if (command2 === "devices") {
+  if (command === "devices") {
     allowOptions(arguments_, []);
-    noPositionals(arguments_, command2);
+    noPositionals(arguments_, command);
     print(await Effect5.runPromise(relay.devices()));
     return;
   }
-  if (command2 === "delegate") {
+  if (command === "delegate") {
     allowOptions(arguments_, [
       "context",
       "context-file",
@@ -2985,22 +3388,22 @@ var runCli = async (command2, raw) => {
       prompt,
       ...target === undefined ? {} : { target },
       ...context === undefined ? {} : { context },
-      ...thread === undefined ? {} : { threadId: Schema6.decodeUnknownSync(ThreadId)(thread) },
+      ...thread === undefined ? {} : { threadId: Schema7.decodeUnknownSync(ThreadId)(thread) },
       ...workspace === undefined ? {} : { workspace },
-      ...provider === undefined ? {} : { provider: Schema6.decodeUnknownSync(Provider)(provider) }
+      ...provider === undefined ? {} : { provider: Schema7.decodeUnknownSync(Provider)(provider) }
     }));
     print(taskResult(arguments_.options.has("no-wait") ? task : await Effect5.runPromise(waitForTask(relay, task, timeout(arguments_)))));
     return;
   }
-  if (command2 === "status") {
+  if (command === "status") {
     allowOptions(arguments_, []);
-    const id = Schema6.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
+    const id = Schema7.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
     print(taskResult(await Effect5.runPromise(relay.getTask(id))));
     return;
   }
-  if (command2 === "trace") {
+  if (command === "trace") {
     allowOptions(arguments_, ["follow"]);
-    const id = Schema6.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
+    const id = Schema7.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
     if (arguments_.options.has("follow")) {
       await Effect5.runPromise(followTaskTrace(relay, id, printLine));
       return;
@@ -3008,37 +3411,39 @@ var runCli = async (command2, raw) => {
     print(await Effect5.runPromise(relay.traceTask(id)));
     return;
   }
-  if (command2 === "wait") {
+  if (command === "wait") {
     allowOptions(arguments_, ["timeout"]);
-    const id = Schema6.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
+    const id = Schema7.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
     const task = await Effect5.runPromise(relay.getTask(id));
     print(taskResult(await Effect5.runPromise(waitForTask(relay, task, timeout(arguments_)))));
     return;
   }
-  if (command2 === "cancel") {
+  if (command === "cancel") {
     allowOptions(arguments_, []);
-    const id = Schema6.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
+    const id = Schema7.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
     print(taskResult(await Effect5.runPromise(relay.cancelTask(id))));
     return;
   }
-  if (command2 === "thread") {
+  if (command === "thread") {
     allowOptions(arguments_, []);
-    const id = Schema6.decodeUnknownSync(ThreadId)(identifier(arguments_, "thread id"));
+    const id = Schema7.decodeUnknownSync(ThreadId)(identifier(arguments_, "thread id"));
     print(await Effect5.runPromise(threadContext(relay, id)));
     return;
   }
-  throw new Error(`Unknown Cohall command: ${command2}`);
+  throw new Error(`Unknown Cohall command: ${command}`);
 };
 
 // apps/device/src/daemon.ts
 init_src();
-import { Effect as Effect6, Schedule as Schedule2, Schema as Schema7 } from "effect";
-import { realpath as realpath2 } from "node:fs/promises";
+import { Effect as Effect6, Schedule as Schedule2, Schema as Schema8 } from "effect";
+import { realpath as realpath3 } from "node:fs/promises";
 import { arch, hostname as hostname2, platform as platform3 } from "node:os";
 import { basename, isAbsolute as isAbsolute2, relative } from "node:path";
 import { WebSocket } from "ws";
+var maxRelayPayloadBytes = 256 * 1024;
+var maxQueuedRelayMessages = 8;
 
-class DeviceConnectionError extends Schema7.TaggedErrorClass()("Device.ConnectionError", { message: Schema7.String }) {
+class DeviceConnectionError extends Schema8.TaggedErrorClass()("Device.ConnectionError", { message: Schema8.String }) {
 }
 var socketUrl = (configuration) => {
   const url = new URL(configuration.relayUrl);
@@ -3075,8 +3480,8 @@ var capabilities = (providers) => {
 };
 var selectProviders = (installed, configured) => configured === undefined ? installed : configured.filter((provider) => installed.includes(provider));
 var describeDevice = (configuration, status = "online") => {
-  const operatingSystem = platform3();
-  const platformName = operatingSystem === "darwin" || operatingSystem === "linux" ? operatingSystem : operatingSystem === "win32" ? "windows" : "unknown";
+  const operatingSystem2 = platform3();
+  const platformName = operatingSystem2 === "darwin" || operatingSystem2 === "linux" ? operatingSystem2 : operatingSystem2 === "win32" ? "windows" : "unknown";
   const installed = availableProviders();
   const providers = selectProviders(installed, configuration.providers);
   return Device.make({
@@ -3101,7 +3506,7 @@ var allowedWorkspace = async (configuration, requested) => {
   if (selected === undefined) {
     throw new Error("No workspace is configured on this device");
   }
-  const candidate = await realpath2(selected);
+  const candidate = await realpath3(selected);
   const allowed = configuration.workspaces.some((root) => {
     const child = relative(root, candidate);
     return child === "" || !child.startsWith("..") && !isAbsolute2(child);
@@ -3235,7 +3640,10 @@ var cancel = (state, taskId) => {
 };
 var connect = (configuration, state) => Effect6.tryPromise({
   try: (signal) => new Promise((complete) => {
-    const socket = new WebSocket(socketUrl(configuration));
+    const socket = new WebSocket(socketUrl(configuration), {
+      maxPayload: maxRelayPayloadBytes,
+      perMessageDeflate: false
+    });
     const heartbeat = setInterval(() => {
       send(state, SocketEvent.make({
         _tag: "DeviceHeartbeat",
@@ -3244,6 +3652,7 @@ var connect = (configuration, state) => Effect6.tryPromise({
       }));
     }, 15000);
     let closed = false;
+    let queuedMessages = 0;
     const close = () => {
       if (closed) {
         return;
@@ -3263,8 +3672,16 @@ var connect = (configuration, state) => Effect6.tryPromise({
       socket.send(JSON.stringify(SocketEvent.make({ _tag: "Authenticate", token: configuration.token })));
     });
     socket.on("message", (message) => {
-      const text2 = Buffer.isBuffer(message) ? message.toString("utf8") : message instanceof ArrayBuffer ? Buffer.from(message).toString("utf8") : Array.isArray(message) ? Buffer.concat(message).toString("utf8") : Buffer.from(message).toString("utf8");
+      if (queuedMessages >= maxQueuedRelayMessages) {
+        socket.close(4008, "Message queue limit reached");
+        return;
+      }
+      queuedMessages += 1;
       state.processing = state.processing.then(async () => {
+        if (closed) {
+          return;
+        }
+        const text2 = Buffer.isBuffer(message) ? message.toString("utf8") : message instanceof ArrayBuffer ? Buffer.from(message).toString("utf8") : Array.isArray(message) ? Buffer.concat(message).toString("utf8") : Buffer.from(message).toString("utf8");
         const event = await Effect6.runPromise(Effect6.try({
           try: () => JSON.parse(text2),
           catch: () => new DeviceConnectionError({ message: "Relay sent invalid JSON" })
@@ -3297,6 +3714,8 @@ var connect = (configuration, state) => Effect6.tryPromise({
         }
       }).catch((cause) => {
         console.error(`Invalid relay event: ${cause instanceof Error ? cause.message : String(cause)}`);
+      }).finally(() => {
+        queuedMessages = Math.max(0, queuedMessages - 1);
       });
     });
     socket.once("close", close);
@@ -3404,43 +3823,43 @@ var runMcp = async (configuration) => {
 
 // apps/device/src/main.ts
 var main = async () => {
-  const command2 = process.argv[2];
-  if (command2 === undefined || command2 === "help" || command2 === "--help" || command2 === "-h") {
+  const command = process.argv[2];
+  if (command === undefined || command === "help" || command === "--help" || command === "-h") {
     printHelp();
     return;
   }
-  if (command2 === "--version" || command2 === "version") {
+  if (command === "--version" || command === "version") {
     console.log(version);
     return;
   }
-  if (["device", "relay", "mcp"].includes(command2) && process.argv.length > 3) {
+  if (["device", "relay", "mcp"].includes(command) && process.argv.length > 3) {
     const arguments_ = process.argv.slice(3);
     if (arguments_.length === 1 && ["--help", "-h", "help"].includes(arguments_[0] ?? "")) {
       printHelp();
       return;
     }
-    throw new Error(`${command2} does not accept arguments`);
+    throw new Error(`${command} does not accept arguments`);
   }
-  if (command2 === "relay") {
+  if (command === "relay") {
     const { runRelay: runRelay2 } = await init_main().then(() => exports_main);
     await runRelay2();
     return;
   }
-  if (command2 === "device") {
+  if (command === "device") {
     const configuration = await Effect11.runPromise(loadDeviceConfiguration);
     await Effect11.runPromise(runDaemon(configuration));
     return;
   }
-  if (command2 === "mcp") {
+  if (command === "mcp") {
     const configuration = await Effect11.runPromise(loadClientConfiguration);
     await runMcp(configuration);
     return;
   }
-  await runCli(command2, process.argv.slice(3));
+  await runCli(command, process.argv.slice(3));
 };
 await main().catch((cause) => {
   console.error(JSON.stringify({ error: cause instanceof Error ? cause.message : String(cause) }, null, 2));
   process.exitCode = 1;
 });
 
-//# debugId=492323E24FE9814364756E2164756E21
+//# debugId=ADB2C1D9ECE4F8B464756E2164756E21