@akshar5/cohall 0.4.9 → 0.5.0

package/bin/cohall.js

@@ -17,16 +17,18 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // packages/protocol/src/index.ts
 import { Schema } from "effect";
-var version = "0.4.9", maxSocketPayloadBytes, bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
+var version = "0.5.0", maxSocketPayloadBytes, bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), count, uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
   expected: "an ISO-8601 UTC timestamp"
-})).pipe(Schema.brand(name)), DeviceId, ThreadId, MessageId, TaskId, AuthSessionId, Timestamp, Platform, Provider, DeviceStatus, TaskStatus, TaskTraceEventKind, MessageRole, ConnectionRole, AuthSession, CreatePairingInput, PairingCredential, ExchangePairingInput, SessionCredential, PairingResult, Capability, Workspace, Device, Thread, Message, Task, TaskTraceEvent, TaskTrace, ThreadContext, CreateTaskInput, SocketEvent, ErrorResponse, terminalTaskStatuses, isTerminalTask = (task) => terminalTaskStatuses.has(task.status), now = () => Timestamp.make(new Date().toISOString()), makeDeviceId = () => DeviceId.make(crypto.randomUUID()), makeThreadId = () => ThreadId.make(crypto.randomUUID()), makeMessageId = () => MessageId.make(crypto.randomUUID()), makeTaskId = () => TaskId.make(crypto.randomUUID()), makeAuthSessionId = () => AuthSessionId.make(crypto.randomUUID()), decodeCreatePairingInput, decodeExchangePairingInput, decodeCreateTaskInput, decodeDevice, decodeSocketEvent;
+})).pipe(Schema.brand(name)), DeviceId, ThreadId, MessageId, TaskId, AuthSessionId, OperationId, Timestamp, Platform, Provider, DeviceStatus, TaskStatus, OperationStatus, TaskTraceEventKind, MessageRole, ConnectionRole, AuthSession, CreatePairingInput, PairingCredential, ExchangePairingInput, SessionCredential, PairingResult, Capability, Workspace, Device, Thread, Message, Task, upgradeVersion, CreateUpgradeOperationsInput, DeviceOperation, TaskStatusCounts, ProviderUsage, DeviceUsage, UsageSummary, TaskTraceEvent, TaskTrace, ThreadContext, CreateTaskInput, SocketEvent, ErrorResponse, terminalTaskStatuses, isTerminalTask = (task) => terminalTaskStatuses.has(task.status), now = () => Timestamp.make(new Date().toISOString()), makeDeviceId = () => DeviceId.make(crypto.randomUUID()), makeThreadId = () => ThreadId.make(crypto.randomUUID()), makeMessageId = () => MessageId.make(crypto.randomUUID()), makeTaskId = () => TaskId.make(crypto.randomUUID()), makeAuthSessionId = () => AuthSessionId.make(crypto.randomUUID()), makeOperationId = () => OperationId.make(crypto.randomUUID()), decodeCreatePairingInput, decodeExchangePairingInput, decodeCreateTaskInput, decodeCreateUpgradeOperationsInput, decodeDevice, decodeSocketEvent;
 var init_src = __esm(() => {
   maxSocketPayloadBytes = 1024 * 1024;
+  count = Schema.Int.check(Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }));
   DeviceId = uuid("DeviceId");
   ThreadId = uuid("ThreadId");
   MessageId = uuid("MessageId");
   TaskId = uuid("TaskId");
   AuthSessionId = uuid("AuthSessionId");
+  OperationId = uuid("OperationId");
   Timestamp = isoTimestamp("Timestamp");
   Platform = Schema.Literals(["darwin", "linux", "windows", "unknown"]);
   Provider = Schema.Literals(["codex", "claude-code", "opencode"]);
@@ -40,6 +42,13 @@ var init_src = __esm(() => {
     "failed",
     "cancelled"
   ]);
+  OperationStatus = Schema.Literals([
+    "queued",
+    "assigned",
+    "running",
+    "completed",
+    "failed"
+  ]);
   TaskTraceEventKind = Schema.Literals([...TaskStatus.literals, "requeued"]);
   MessageRole = Schema.Literals(["human", "agent", "system"]);
   ConnectionRole = Schema.Literals(["client", "device"]);
@@ -130,6 +139,52 @@ var init_src = __esm(() => {
     startedAt: Schema.optionalKey(Timestamp),
     completedAt: Schema.optionalKey(Timestamp)
   });
+  upgradeVersion = Schema.String.check(Schema.isPattern(/^(?:latest|v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/, {
+    expected: "latest or an exact semantic version"
+  }));
+  CreateUpgradeOperationsInput = Schema.Struct({
+    target: upgradeVersion,
+    restart: Schema.Boolean
+  });
+  DeviceOperation = Schema.Struct({
+    id: OperationId,
+    kind: Schema.Literal("upgrade"),
+    status: OperationStatus,
+    targetDeviceId: DeviceId,
+    requestedVersion: upgradeVersion,
+    restart: Schema.Boolean,
+    result: Schema.optionalKey(optionalText(16384)),
+    error: Schema.optionalKey(optionalText(16384)),
+    createdAt: Timestamp,
+    updatedAt: Timestamp,
+    completedAt: Schema.optionalKey(Timestamp)
+  });
+  TaskStatusCounts = Schema.Struct({
+    queued: count,
+    assigned: count,
+    running: count,
+    cancelling: count,
+    completed: count,
+    failed: count,
+    cancelled: count
+  });
+  ProviderUsage = Schema.Struct({
+    provider: Provider,
+    tasks: count
+  });
+  DeviceUsage = Schema.Struct({
+    deviceId: DeviceId,
+    deviceName: bounded(128),
+    tasks: count,
+    byStatus: TaskStatusCounts,
+    byProvider: boundedArray(ProviderUsage, 3)
+  });
+  UsageSummary = Schema.Struct({
+    retainedTasks: count,
+    byStatus: TaskStatusCounts,
+    byProvider: boundedArray(ProviderUsage, 3),
+    devices: boundedArray(DeviceUsage, 256)
+  });
   TaskTraceEvent = Schema.Struct({
     kind: TaskTraceEventKind,
     at: Timestamp,
@@ -184,6 +239,11 @@ var init_src = __esm(() => {
     TaskCancelled: { taskId: TaskId },
     TaskSettled: { taskId: TaskId },
     CancelTask: { taskId: TaskId },
+    OperationAssigned: { operation: DeviceOperation },
+    OperationAccepted: { operationId: OperationId },
+    OperationFinished: { operationId: OperationId, result: optionalText(16384) },
+    OperationFailed: { operationId: OperationId, error: bounded(16384) },
+    OperationSettled: { operationId: OperationId },
     Error: { code: bounded(64), message: bounded(2048) }
   });
   ErrorResponse = Schema.Struct({
@@ -197,32 +257,33 @@ var init_src = __esm(() => {
   decodeCreatePairingInput = Schema.decodeUnknownEffect(CreatePairingInput);
   decodeExchangePairingInput = Schema.decodeUnknownEffect(ExchangePairingInput);
   decodeCreateTaskInput = Schema.decodeUnknownEffect(CreateTaskInput);
+  decodeCreateUpgradeOperationsInput = Schema.decodeUnknownEffect(CreateUpgradeOperationsInput);
   decodeDevice = Schema.decodeUnknownEffect(Device);
   decodeSocketEvent = Schema.decodeUnknownEffect(SocketEvent);
 });
 
 // apps/relay/src/config.ts
-import { Effect as Effect8, Schema as Schema9 } from "effect";
-import { access as access4, chmod as chmod4, mkdir as mkdir4, readFile as readFile4, writeFile as writeFile5 } from "node:fs/promises";
-import { homedir as homedir4, platform as platform4 } from "node:os";
-import { join as join5, resolve as resolve2 } from "node:path";
+import { Effect as Effect10, Schema as Schema10 } from "effect";
+import { access as access5, chmod as chmod6, mkdir as mkdir6, readFile as readFile5, writeFile as writeFile7 } from "node:fs/promises";
+import { homedir as homedir5, platform as platform4 } from "node:os";
+import { join as join7, resolve as resolve3 } from "node:path";
 var RelayConfiguration, defaultDataDirectory = () => {
   if (platform4() === "win32") {
-    return join5(process.env.LOCALAPPDATA ?? join5(homedir4(), "AppData", "Local"), "Cohall");
+    return join7(process.env.LOCALAPPDATA ?? join7(homedir5(), "AppData", "Local"), "Cohall");
   }
   if (platform4() === "darwin") {
-    return join5(homedir4(), "Library", "Application Support", "Cohall", "relay");
+    return join7(homedir5(), "Library", "Application Support", "Cohall", "relay");
   }
-  return join5(process.env.XDG_DATA_HOME ?? join5(homedir4(), ".local", "share"), "cohall");
+  return join7(process.env.XDG_DATA_HOME ?? join7(homedir5(), ".local", "share"), "cohall");
 }, generatedToken = () => Array.from(crypto.getRandomValues(new Uint8Array(32)), (value) => value.toString(16).padStart(2, "0")).join(""), tokenFrom = async (path) => {
-  if (await access4(path).then(() => true).catch(() => false)) {
-    return (await readFile4(path, "utf8")).trim();
+  if (await access5(path).then(() => true).catch(() => false)) {
+    return (await readFile5(path, "utf8")).trim();
   }
   const token = generatedToken();
-  await writeFile5(path, `${token}
+  await writeFile7(path, `${token}
 `, { mode: 384 });
   if (platform4() !== "win32") {
-    await chmod4(path, 384);
+    await chmod6(path, 384);
   }
   return token;
 }, booleanEnvironment = (name) => {
@@ -234,41 +295,41 @@ var RelayConfiguration, defaultDataDirectory = () => {
     return true;
   }
   throw new Error(`${name} must be true or false`);
-}, isLoopback = (host) => host === "127.0.0.1" || host === "localhost" || host === "::1", loadEnvironmentConfiguration;
+}, isLoopback2 = (host) => host === "127.0.0.1" || host === "localhost" || host === "::1", loadEnvironmentConfiguration;
 var init_config = __esm(() => {
-  RelayConfiguration = Schema9.Struct({
-    host: Schema9.NonEmptyString,
-    port: Schema9.Int.check(Schema9.isBetween({ minimum: 1, maximum: 65535 })),
-    token: Schema9.String.check(Schema9.isMinLength(32)),
-    dataDirectory: Schema9.NonEmptyString,
-    databasePath: Schema9.NonEmptyString,
-    allowRemote: Schema9.Boolean,
-    historyTaskLimit: Schema9.Int.check(Schema9.isBetween({ minimum: 100, maximum: 1e5 }))
+  RelayConfiguration = Schema10.Struct({
+    host: Schema10.NonEmptyString,
+    port: Schema10.Int.check(Schema10.isBetween({ minimum: 1, maximum: 65535 })),
+    token: Schema10.String.check(Schema10.isMinLength(32)),
+    dataDirectory: Schema10.NonEmptyString,
+    databasePath: Schema10.NonEmptyString,
+    allowRemote: Schema10.Boolean,
+    historyTaskLimit: Schema10.Int.check(Schema10.isBetween({ minimum: 100, maximum: 1e5 }))
   });
-  loadEnvironmentConfiguration = Effect8.tryPromise({
+  loadEnvironmentConfiguration = Effect10.tryPromise({
     try: async () => {
       const host = process.env.COHALL_RELAY_HOST ?? "127.0.0.1";
       const port = Number(process.env.COHALL_RELAY_PORT ?? "8787");
       const allowRemote = booleanEnvironment("COHALL_RELAY_ALLOW_REMOTE");
-      if (!isLoopback(host) && !allowRemote) {
+      if (!isLoopback2(host) && !allowRemote) {
         throw new Error("Remote relay binding is disabled. Use a private network or TLS reverse proxy, then set COHALL_RELAY_ALLOW_REMOTE=true.");
       }
-      const dataDirectory = resolve2(process.env.COHALL_DATA_DIR ?? defaultDataDirectory());
-      await mkdir4(dataDirectory, { recursive: true, mode: 448 });
+      const dataDirectory = resolve3(process.env.COHALL_DATA_DIR ?? defaultDataDirectory());
+      await mkdir6(dataDirectory, { recursive: true, mode: 448 });
       if (platform4() !== "win32") {
-        await chmod4(dataDirectory, 448);
+        await chmod6(dataDirectory, 448);
       }
-      const token = process.env.COHALL_TOKEN ?? await tokenFrom(join5(dataDirectory, "owner-token"));
+      const token = process.env.COHALL_TOKEN ?? await tokenFrom(join7(dataDirectory, "owner-token"));
       if (token.length < 32) {
         throw new Error("The Cohall relay owner token must be at least 32 characters");
       }
       const historyTaskLimit = Number(process.env.COHALL_HISTORY_TASK_LIMIT ?? "1000");
-      return Schema9.decodeUnknownSync(RelayConfiguration)({
+      return Schema10.decodeUnknownSync(RelayConfiguration)({
         host,
         port,
         token,
         dataDirectory,
-        databasePath: join5(dataDirectory, "cohall.db"),
+        databasePath: join7(dataDirectory, "cohall.db"),
         allowRemote,
         historyTaskLimit
       });
@@ -278,7 +339,7 @@ var init_config = __esm(() => {
 });
 
 // apps/relay/src/hub.ts
-import { WebSocket as WebSocket2 } from "ws";
+import { WebSocket as WebSocket3 } from "ws";
 
 class Hub {
   #principals = new Map;
@@ -294,7 +355,7 @@ class Hub {
       this.#ownerSockets.add(socket);
     } else {
       const existing = this.#sessions.get(principal.sessionId);
-      if (existing !== undefined && existing.readyState === WebSocket2.OPEN) {
+      if (existing !== undefined && existing.readyState === WebSocket3.OPEN) {
         return false;
       }
       this.#sessions.set(principal.sessionId, socket);
@@ -325,7 +386,7 @@ class Hub {
       return false;
     }
     const previous = this.#devices.get(deviceId);
-    if (previous !== undefined && previous !== socket && previous.readyState === WebSocket2.OPEN) {
+    if (previous !== undefined && previous !== socket && previous.readyState === WebSocket3.OPEN) {
       return false;
     }
     this.#devices.set(deviceId, socket);
@@ -371,11 +432,11 @@ class Hub {
     this.#devices.get(deviceId)?.close(4003, "Device forgotten");
   }
   hasDevice(deviceId) {
-    return this.#devices.get(deviceId)?.readyState === WebSocket2.OPEN;
+    return this.#devices.get(deviceId)?.readyState === WebSocket3.OPEN;
   }
   sendToDevice(deviceId, event) {
     const socket = this.#devices.get(deviceId);
-    if (socket?.readyState !== WebSocket2.OPEN || !this.isAuthorized(socket)) {
+    if (socket?.readyState !== WebSocket3.OPEN || !this.isAuthorized(socket)) {
       return false;
     }
     try {
@@ -389,7 +450,7 @@ class Hub {
 var init_hub = () => {};
 
 // apps/relay/src/database.ts
-import { DatabaseSync } from "node:sqlite";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 
 class Statement {
   #statement;
@@ -412,7 +473,7 @@ class Statement {
 class Database {
   #database;
   constructor(path) {
-    this.#database = new DatabaseSync(path);
+    this.#database = new DatabaseSync2(path);
   }
   query(sql) {
     return new Statement(this.#database.prepare(sql));
@@ -448,12 +509,12 @@ __export(exports_store, {
   RelayStore: () => exports_store,
   PersistenceError: () => PersistenceError
 });
-import { Context as Context2, Effect as Effect9, Layer as Layer2, Schema as Schema10 } from "effect";
-import { createHash, randomBytes } from "node:crypto";
+import { Context as Context2, Effect as Effect11, Layer as Layer2, Schema as Schema11 } from "effect";
+import { createHash as createHash2, randomBytes } from "node:crypto";
 var PersistenceError, Service2, operationError = (operation) => (cause) => new PersistenceError({
   operation,
   message: cause instanceof Error ? cause.message : String(cause)
-}), decode = (operation, schema, value) => Schema10.decodeUnknownEffect(schema)(value).pipe(Effect9.mapError(operationError(operation))), threadFromRow = (row) => decode("RelayStore.decodeThread", Thread, {
+}), decode = (operation, schema, value) => Schema11.decodeUnknownEffect(schema)(value).pipe(Effect11.mapError(operationError(operation))), threadFromRow = (row) => decode("RelayStore.decodeThread", Thread, {
   id: row.id,
   title: row.title,
   createdAt: row.created_at,
@@ -499,14 +560,34 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
   ...row.error === null ? {} : { error: row.error },
   ...row.started_at === null ? {} : { startedAt: row.started_at },
   ...row.completed_at === null ? {} : { completedAt: row.completed_at }
+}), operationFromRow = (row) => decode("RelayStore.decodeOperation", DeviceOperation, {
+  id: row.id,
+  kind: row.kind,
+  status: row.status,
+  targetDeviceId: row.target_device_id,
+  requestedVersion: row.requested_version,
+  restart: row.restart === 1,
+  createdAt: row.created_at,
+  updatedAt: row.updated_at,
+  ...row.result === null ? {} : { result: row.result },
+  ...row.error === null ? {} : { error: row.error },
+  ...row.completed_at === null ? {} : { completedAt: row.completed_at }
+}), emptyStatusCounts = () => ({
+  queued: 0,
+  assigned: 0,
+  running: 0,
+  cancelling: 0,
+  completed: 0,
+  failed: 0,
+  cancelled: 0
 }), taskTraceEventFromRow = (row) => decode("RelayStore.decodeTaskTraceEvent", TaskTraceEvent, {
   kind: row.kind,
   at: row.created_at,
   ...row.detail === null ? {} : { detail: row.detail }
-}), rolesFromRow = (row) => Schema10.decodeUnknownSync(Schema10.Array(ConnectionRole))(JSON.parse(row.roles_json)), authSessionFromRow = (row) => {
+}), rolesFromRow = (row) => Schema11.decodeUnknownSync(Schema11.Array(ConnectionRole))(JSON.parse(row.roles_json)), authSessionFromRow = (row) => {
   const roles = rolesFromRow(row);
   const role = roles[0];
-  return role === undefined ? Effect9.fail(new PersistenceError({
+  return role === undefined ? Effect11.fail(new PersistenceError({
     operation: "RelayStore.decodeAuthSession",
     message: `Session ${row.id} has no role`
   })) : decode("RelayStore.decodeAuthSession", AuthSession, {
@@ -521,7 +602,7 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
   });
 }, secret = (prefix) => {
   return `cohall_${prefix}_${randomBytes(32).toString("hex")}`;
-}, tokenHash = (token) => createHash("sha256").update(token).digest("hex"), providerName = (provider) => {
+}, tokenHash = (token) => createHash2("sha256").update(token).digest("hex"), providerName = (provider) => {
   switch (provider) {
     case "codex":
       return "Codex";
@@ -587,23 +668,36 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
        WHERE NOT EXISTS (SELECT 1 FROM tasks WHERE tasks.thread_id = threads.id)
          AND NOT EXISTS (SELECT 1 FROM messages WHERE messages.thread_id = threads.id)`).run();
   };
+  const pruneTerminalOperations = (preserveOperationId) => {
+    const exclusion = preserveOperationId === undefined ? "" : "AND id <> ?";
+    const offset = preserveOperationId === undefined ? retainedTerminalTasks : retainedTerminalTasks - 1;
+    const parameters = preserveOperationId === undefined ? [offset] : [preserveOperationId, offset];
+    db.query(`DELETE FROM device_operations
+       WHERE id IN (
+         SELECT id FROM device_operations
+         WHERE status IN ('completed', 'failed') ${exclusion}
+         ORDER BY completed_at DESC, updated_at DESC, id DESC
+         LIMIT -1 OFFSET ?
+       )`).run(...parameters);
+  };
   const queryTask = (taskId) => db.query("SELECT * FROM tasks WHERE id = ?").get(taskId);
-  const getTask = Effect9.fn("RelayStore.getTask")(function* (taskId) {
-    const row = yield* Effect9.try({
+  const queryOperation = (operationId) => db.query("SELECT * FROM device_operations WHERE id = ?").get(operationId);
+  const getTask = Effect11.fn("RelayStore.getTask")(function* (taskId) {
+    const row = yield* Effect11.try({
       try: () => queryTask(taskId),
       catch: operationError("RelayStore.getTask")
     });
     if (row === null) {
-      return yield* Effect9.fail(new PersistenceError({
+      return yield* Effect11.fail(new PersistenceError({
         operation: "RelayStore.getTask",
         message: `Unknown task ${taskId}`
       }));
     }
     return yield* taskFromRow(row);
   });
-  const traceTask = Effect9.fn("RelayStore.traceTask")(function* (taskId) {
+  const traceTask = Effect11.fn("RelayStore.traceTask")(function* (taskId) {
     const task = yield* getTask(taskId);
-    const [deviceRow, eventRows] = yield* Effect9.try({
+    const [deviceRow, eventRows] = yield* Effect11.try({
       try: () => [
         db.query("SELECT * FROM devices WHERE id = ?").get(task.targetDeviceId),
         db.query(`SELECT * FROM (
@@ -614,14 +708,14 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
       catch: operationError("RelayStore.traceTask")
     });
     if (deviceRow === null) {
-      return yield* Effect9.fail(new PersistenceError({
+      return yield* Effect11.fail(new PersistenceError({
         operation: "RelayStore.traceTask.device",
         message: `Unknown target device ${task.targetDeviceId}`
       }));
     }
     const targetDevice = yield* deviceFromRow(deviceRow);
     const selectedRows = eventRows.slice(-100);
-    const recordedEvents = yield* Effect9.forEach(selectedRows, taskTraceEventFromRow);
+    const recordedEvents = yield* Effect11.forEach(selectedRows, taskTraceEventFromRow);
     const events = recordedEvents.length === 0 ? derivedTraceEvents(task) : recordedEvents;
     return TaskTrace.make({
       taskId: task.id,
@@ -641,15 +735,195 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
       ...task.error === undefined ? {} : { error: task.error }
     });
   });
-  const listDevices = Effect9.fn("RelayStore.listDevices")(function* () {
-    const rows = yield* Effect9.try({
+  const listDevices = Effect11.fn("RelayStore.listDevices")(function* () {
+    const rows = yield* Effect11.try({
       try: () => db.query("SELECT * FROM devices WHERE forgotten_at IS NULL ORDER BY name COLLATE NOCASE, id").all(),
       catch: operationError("RelayStore.listDevices")
     });
-    return yield* Effect9.forEach(rows, deviceFromRow);
+    return yield* Effect11.forEach(rows, deviceFromRow);
+  });
+  const usage = Effect11.fn("RelayStore.usage")(function* () {
+    const rows = yield* Effect11.try({
+      try: () => db.query(`SELECT tasks.target_device_id AS device_id, devices.name AS device_name,
+                    tasks.status, tasks.provider, COUNT(*) AS tasks
+             FROM tasks
+             JOIN devices ON devices.id = tasks.target_device_id
+             GROUP BY tasks.target_device_id, devices.name, tasks.status, tasks.provider
+             ORDER BY devices.name COLLATE NOCASE, tasks.target_device_id, tasks.provider`).all(),
+      catch: operationError("RelayStore.usage")
+    });
+    const totalStatus = emptyStatusCounts();
+    const totalProviders = new Map;
+    const devices = new Map;
+    let retainedTasks = 0;
+    for (const row of rows) {
+      const status = Schema11.decodeUnknownSync(TaskStatus)(row.status);
+      const provider = Schema11.decodeUnknownSync(Provider)(row.provider);
+      const deviceId = Schema11.decodeUnknownSync(DeviceId)(row.device_id);
+      retainedTasks += row.tasks;
+      totalStatus[status] += row.tasks;
+      totalProviders.set(provider, (totalProviders.get(provider) ?? 0) + row.tasks);
+      const current = devices.get(deviceId) ?? {
+        name: row.device_name,
+        status: emptyStatusCounts(),
+        providers: new Map
+      };
+      current.status[status] += row.tasks;
+      current.providers.set(provider, (current.providers.get(provider) ?? 0) + row.tasks);
+      devices.set(deviceId, current);
+    }
+    const providerUsage = (providers) => Provider.literals.flatMap((provider) => {
+      const tasks = providers.get(provider);
+      return tasks === undefined ? [] : [{ provider, tasks }];
+    });
+    return UsageSummary.make({
+      retainedTasks,
+      byStatus: TaskStatusCounts.make(totalStatus),
+      byProvider: providerUsage(totalProviders),
+      devices: [...devices.entries()].map(([deviceId, device]) => DeviceUsage.make({
+        deviceId,
+        deviceName: device.name,
+        tasks: Object.values(device.status).reduce((sum, tasks) => sum + tasks, 0),
+        byStatus: TaskStatusCounts.make(device.status),
+        byProvider: providerUsage(device.providers)
+      }))
+    });
+  });
+  const getOperation = Effect11.fn("RelayStore.getOperation")(function* (operationId) {
+    const row = yield* Effect11.try({
+      try: () => queryOperation(operationId),
+      catch: operationError("RelayStore.getOperation")
+    });
+    if (row === null) {
+      return yield* Effect11.fail(new PersistenceError({
+        operation: "RelayStore.getOperation",
+        message: `Unknown device operation ${operationId}`
+      }));
+    }
+    return yield* operationFromRow(row);
+  });
+  const listOperations = Effect11.fn("RelayStore.listOperations")(function* () {
+    const rows = yield* Effect11.try({
+      try: () => db.query("SELECT * FROM device_operations ORDER BY created_at DESC, id DESC LIMIT 50").all(),
+      catch: operationError("RelayStore.listOperations")
+    });
+    return yield* Effect11.forEach(rows, operationFromRow);
+  });
+  const createUpgradeOperations = Effect11.fn("RelayStore.createUpgradeOperations")(function* (input) {
+    const timestamp = now();
+    const operations = yield* Effect11.try({
+      try: () => db.transaction(() => {
+        const devices = db.query("SELECT * FROM devices WHERE forgotten_at IS NULL ORDER BY name COLLATE NOCASE, id").all();
+        if (devices.length === 0) {
+          throw new Error("No Cohall devices are registered");
+        }
+        if (devices.length > 256) {
+          throw new Error("All-device operations support at most 256 registered devices");
+        }
+        for (const device of devices) {
+          const outstanding = db.query(`SELECT COUNT(*) AS count FROM device_operations
+                 WHERE target_device_id = ? AND status IN ('queued', 'assigned', 'running')`).get(device.id);
+          if ((outstanding?.count ?? 0) > 0) {
+            throw new Error(`${device.name} already has an upgrade operation in progress`);
+          }
+        }
+        pruneTerminalOperations();
+        return devices.map((device) => {
+          const operation = DeviceOperation.make({
+            id: makeOperationId(),
+            kind: "upgrade",
+            status: "queued",
+            targetDeviceId: DeviceId.make(device.id),
+            requestedVersion: input.target,
+            restart: input.restart,
+            createdAt: timestamp,
+            updatedAt: timestamp
+          });
+          db.query(`INSERT INTO device_operations (
+                 id, kind, status, target_device_id, requested_version, restart,
+                 created_at, updated_at
+               ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(operation.id, operation.kind, operation.status, operation.targetDeviceId, operation.requestedVersion, operation.restart ? 1 : 0, operation.createdAt, operation.updatedAt);
+          return operation;
+        });
+      })(),
+      catch: operationError("RelayStore.createUpgradeOperations")
+    });
+    return operations;
   });
-  const forgetDevice = Effect9.fn("RelayStore.forgetDevice")(function* (deviceId) {
-    const row = yield* Effect9.try({
+  const pendingOperationsFor = Effect11.fn("RelayStore.pendingOperationsFor")(function* (deviceId) {
+    const rows = yield* Effect11.try({
+      try: () => db.query(`SELECT * FROM device_operations WHERE target_device_id = ? AND status = 'queued'
+             ORDER BY created_at, id LIMIT 10`).all(deviceId),
+      catch: operationError("RelayStore.pendingOperationsFor")
+    });
+    return yield* Effect11.forEach(rows, operationFromRow);
+  });
+  const transitionOperation = Effect11.fn("RelayStore.transitionOperation")(function* (operationId, expected, status, result, error) {
+    const current = yield* getOperation(operationId);
+    if (!expected.includes(current.status)) {
+      return current;
+    }
+    const timestamp = now();
+    const completed = status === "completed" || status === "failed" ? timestamp : undefined;
+    const placeholders = expected.map(() => "?").join(", ");
+    yield* Effect11.try({
+      try: () => db.transaction(() => {
+        const updated = db.query(`UPDATE device_operations
+               SET status = ?, result = ?, error = ?, updated_at = ?, completed_at = ?
+               WHERE id = ? AND status IN (${placeholders})`).run(status, result ?? current.result ?? null, error ?? current.error ?? null, timestamp, completed ?? current.completedAt ?? null, operationId, ...expected);
+        if (updated.changes === 1 && completed !== undefined) {
+          pruneTerminalOperations(operationId);
+        }
+      })(),
+      catch: operationError("RelayStore.transitionOperation")
+    });
+    return yield* getOperation(operationId);
+  });
+  const requireOperationTarget = Effect11.fn("RelayStore.requireOperationTarget")(function* (operationId, deviceId) {
+    const operation = yield* getOperation(operationId);
+    if (operation.targetDeviceId !== deviceId) {
+      return yield* Effect11.fail(new PersistenceError({
+        operation: "RelayStore.requireOperationTarget",
+        message: `Device ${deviceId} cannot update operation ${operationId}`
+      }));
+    }
+    return operation;
+  });
+  const assignOperation = Effect11.fn("RelayStore.assignOperation")(function* (operationId) {
+    const current = yield* getOperation(operationId);
+    if (current.status !== "queued") {
+      return current;
+    }
+    const timestamp = now();
+    yield* Effect11.try({
+      try: () => db.query(`UPDATE device_operations SET status = 'assigned', updated_at = ?
+             WHERE id = ? AND status = 'queued'
+               AND NOT EXISTS (
+                 SELECT 1 FROM tasks WHERE target_device_id = ?
+                   AND status IN ('assigned', 'running', 'cancelling')
+               )
+               AND NOT EXISTS (
+                 SELECT 1 FROM device_operations active
+                 WHERE active.target_device_id = ? AND active.id <> ?
+                   AND active.status IN ('assigned', 'running')
+               )`).run(timestamp, operationId, current.targetDeviceId, current.targetDeviceId, operationId),
+      catch: operationError("RelayStore.assignOperation")
+    });
+    return yield* getOperation(operationId);
+  });
+  const acceptOperation = (operationId, deviceId) => requireOperationTarget(operationId, deviceId).pipe(Effect11.flatMap(() => transitionOperation(operationId, ["assigned"], "running")));
+  const finishOperation = (operationId, deviceId, result) => requireOperationTarget(operationId, deviceId).pipe(Effect11.flatMap(() => transitionOperation(operationId, ["queued", "assigned", "running"], "completed", result)));
+  const failOperation = (operationId, deviceId, error) => requireOperationTarget(operationId, deviceId).pipe(Effect11.flatMap(() => transitionOperation(operationId, ["queued", "assigned", "running"], "failed", undefined, error)));
+  const abandonOperation = (operationId) => transitionOperation(operationId, ["queued", "assigned", "running"], "failed", undefined, "Abandoned by the relay owner");
+  const requeueOperationsFor = Effect11.fn("RelayStore.requeueOperationsFor")(function* (deviceId) {
+    yield* Effect11.try({
+      try: () => db.query(`UPDATE device_operations SET status = 'queued', updated_at = ?
+             WHERE target_device_id = ? AND status IN ('assigned', 'running')`).run(now(), deviceId),
+      catch: operationError("RelayStore.requeueOperationsFor")
+    });
+  });
+  const forgetDevice = Effect11.fn("RelayStore.forgetDevice")(function* (deviceId) {
+    const row = yield* Effect11.try({
       try: () => db.transaction(() => {
         const device = db.query("SELECT * FROM devices WHERE id = ? AND forgotten_at IS NULL").get(deviceId);
         if (device === null) {
@@ -664,6 +938,10 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
           throw new Error(`Device ${deviceId} still has outstanding tasks`);
         }
         const timestamp = now();
+        db.query(`UPDATE device_operations
+             SET status = 'failed', error = ?, updated_at = ?, completed_at = ?
+             WHERE target_device_id = ? AND status IN ('queued', 'assigned', 'running')`).run("Target device was forgotten by the relay owner", timestamp, timestamp, deviceId);
+        pruneTerminalOperations();
         db.query("UPDATE devices SET forgotten_at = ? WHERE id = ?").run(timestamp, deviceId);
         db.query("UPDATE auth_sessions SET revoked_at = ? WHERE bound_device_id = ? AND revoked_at IS NULL").run(timestamp, deviceId);
         return device;
@@ -672,25 +950,27 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     });
     return yield* deviceFromRow(row);
   });
-  const recover = Effect9.fn("RelayStore.recover")(function* () {
-    yield* Effect9.try({
+  const recover = Effect11.fn("RelayStore.recover")(function* () {
+    yield* Effect11.try({
       try: () => db.transaction(() => {
         const timestamp = now();
         const interrupted = db.query("SELECT id FROM tasks WHERE status IN ('assigned', 'running')").all();
         db.query("UPDATE devices SET status = 'offline'").run();
         db.query("UPDATE tasks SET status = 'queued', updated_at = ? WHERE status IN ('assigned', 'running')").run(timestamp);
+        db.query("UPDATE device_operations SET status = 'queued', updated_at = ? WHERE status IN ('assigned', 'running')").run(timestamp);
         for (const task of interrupted) {
           recordTaskTraceEvent(TaskId.make(task.id), "requeued", "Relay restarted before the task completed", timestamp);
         }
         db.query("DELETE FROM auth_pairings WHERE expires_at <= ? OR used_at IS NOT NULL").run(timestamp);
         db.query("UPDATE auth_sessions SET revoked_at = ? WHERE revoked_at IS NULL AND roles_json LIKE '%,%'").run(timestamp);
         pruneTerminalHistory();
+        pruneTerminalOperations();
       })(),
       catch: operationError("RelayStore.recover")
     });
   });
-  const upsertDevice = Effect9.fn("RelayStore.upsertDevice")(function* (device) {
-    yield* Effect9.try({
+  const upsertDevice = Effect11.fn("RelayStore.upsertDevice")(function* (device) {
+    yield* Effect11.try({
       try: () => db.query(`INSERT INTO devices (
             id, name, hostname, platform, architecture, status, providers_json,
             capabilities_json, workspaces_json, version, last_seen_at, connected_at
@@ -706,28 +986,28 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     });
     return device;
   });
-  const updateDeviceStatus = Effect9.fn("RelayStore.updateDeviceStatus")(function* (deviceId, status) {
+  const updateDeviceStatus = Effect11.fn("RelayStore.updateDeviceStatus")(function* (deviceId, status) {
     const timestamp = now();
-    const result = yield* Effect9.try({
+    const result = yield* Effect11.try({
       try: () => db.query("UPDATE devices SET status = ?, last_seen_at = ? WHERE id = ?").run(status, timestamp, deviceId),
       catch: operationError("RelayStore.updateDeviceStatus")
     });
     if (result.changes !== 1) {
-      return yield* Effect9.fail(new PersistenceError({
+      return yield* Effect11.fail(new PersistenceError({
         operation: "RelayStore.updateDeviceStatus",
         message: `Unknown device ${deviceId}`
       }));
     }
     const row = db.query("SELECT * FROM devices WHERE id = ?").get(deviceId);
     if (row === null) {
-      return yield* Effect9.fail(new PersistenceError({
+      return yield* Effect11.fail(new PersistenceError({
         operation: "RelayStore.updateDeviceStatus.read",
         message: `Device ${deviceId} disappeared after update`
       }));
     }
     return yield* deviceFromRow(row);
   });
-  const createDelegation2 = Effect9.fn("RelayStore.createDelegation")(function* (input, targetDeviceId, sourceDeviceId, providerSessionId) {
+  const createDelegation2 = Effect11.fn("RelayStore.createDelegation")(function* (input, targetDeviceId, sourceDeviceId, providerSessionId) {
     const timestamp = now();
     const threadId = input.threadId ?? makeThreadId();
     const task = Task.make({
@@ -761,7 +1041,7 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
       taskId: task.id,
       ...sourceDeviceId === undefined ? {} : { deviceId: sourceDeviceId }
     });
-    yield* Effect9.try({
+    yield* Effect11.try({
       try: () => db.transaction(() => {
         const outstanding = db.query(`SELECT COUNT(*) AS count FROM tasks WHERE target_device_id = ?
                AND status IN ('queued', 'assigned', 'running', 'cancelling')`).get(targetDeviceId);
@@ -789,18 +1069,18 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     });
     return task;
   });
-  const threadContext2 = Effect9.fn("RelayStore.threadContext")(function* (threadId) {
-    const threadRow = yield* Effect9.try({
+  const threadContext2 = Effect11.fn("RelayStore.threadContext")(function* (threadId) {
+    const threadRow = yield* Effect11.try({
       try: () => db.query("SELECT * FROM threads WHERE id = ?").get(threadId),
       catch: operationError("RelayStore.threadContext.thread")
     });
     if (threadRow === null) {
-      return yield* Effect9.fail(new PersistenceError({
+      return yield* Effect11.fail(new PersistenceError({
         operation: "RelayStore.threadContext",
         message: `Unknown thread ${threadId}`
       }));
     }
-    const [messageRows, taskRows] = yield* Effect9.try({
+    const [messageRows, taskRows] = yield* Effect11.try({
       try: () => [
         db.query(`SELECT * FROM (
                  SELECT * FROM messages WHERE thread_id = ?
@@ -813,10 +1093,10 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
       ],
       catch: operationError("RelayStore.threadContext.items")
     });
-    const [thread, messages, tasks] = yield* Effect9.all([
+    const [thread, messages, tasks] = yield* Effect11.all([
       threadFromRow(threadRow),
-      Effect9.forEach(messageRows.slice(-20), messageFromRow),
-      Effect9.forEach(taskRows.slice(-20), taskFromRow)
+      Effect11.forEach(messageRows.slice(-20), messageFromRow),
+      Effect11.forEach(taskRows.slice(-20), taskFromRow)
     ]);
     const recentMessages = recentWithin(messages, 256 * 1024);
     const recentTasks = recentWithin(tasks, 768 * 1024);
@@ -827,22 +1107,22 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
       truncated: messageRows.length > 20 || taskRows.length > 20 || recentMessages.truncated || recentTasks.truncated
     });
   });
-  const pendingTasksFor = Effect9.fn("RelayStore.pendingTasksFor")(function* (deviceId) {
-    const rows = yield* Effect9.try({
+  const pendingTasksFor = Effect11.fn("RelayStore.pendingTasksFor")(function* (deviceId) {
+    const rows = yield* Effect11.try({
       try: () => db.query(`SELECT * FROM tasks WHERE target_device_id = ?
            AND status IN ('queued', 'cancelling') ORDER BY created_at, id LIMIT 100`).all(deviceId),
       catch: operationError("RelayStore.pendingTasksFor")
     });
-    return yield* Effect9.forEach(rows, taskFromRow);
+    return yield* Effect11.forEach(rows, taskFromRow);
   });
-  const transition = Effect9.fn("RelayStore.transition")(function* (taskId, expected, update, event) {
+  const transition = Effect11.fn("RelayStore.transition")(function* (taskId, expected, update, event) {
     const current = yield* getTask(taskId);
     if (!expected.includes(current.status)) {
       return current;
     }
     const placeholders = expected.map(() => "?").join(", ");
     const timestamp = now();
-    yield* Effect9.try({
+    yield* Effect11.try({
       try: () => db.transaction(() => {
         const result = db.query(`UPDATE tasks SET status = ?, provider_session_id = ?, result = ?, error = ?,
              started_at = ?, completed_at = ?, updated_at = ?
@@ -858,20 +1138,24 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     });
     return yield* getTask(taskId);
   });
-  const assignTask = Effect9.fn("RelayStore.assignTask")(function* (taskId) {
+  const assignTask = Effect11.fn("RelayStore.assignTask")(function* (taskId) {
     const current = yield* getTask(taskId);
     if (current.status !== "queued") {
       return current;
     }
     const timestamp = now();
-    yield* Effect9.try({
+    yield* Effect11.try({
       try: () => db.transaction(() => {
         const result = db.query(`UPDATE tasks SET status = 'assigned', updated_at = ?
                WHERE id = ? AND status = 'queued' AND NOT EXISTS (
                  SELECT 1 FROM tasks active
                  WHERE active.target_device_id = ? AND active.id <> ?
                    AND active.status IN ('assigned', 'running', 'cancelling')
-               )`).run(timestamp, taskId, current.targetDeviceId, taskId);
+               ) AND NOT EXISTS (
+                 SELECT 1 FROM device_operations active
+                 WHERE active.target_device_id = ?
+                   AND active.status IN ('assigned', 'running')
+               )`).run(timestamp, taskId, current.targetDeviceId, taskId, current.targetDeviceId);
         if (result.changes === 1) {
           recordTaskTraceEvent(taskId, "assigned", "Relay dispatched the task over the device WebSocket", timestamp);
         }
@@ -880,23 +1164,23 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     });
     return yield* getTask(taskId);
   });
-  const requireTarget = Effect9.fn("RelayStore.requireTarget")(function* (taskId, deviceId) {
+  const requireTarget = Effect11.fn("RelayStore.requireTarget")(function* (taskId, deviceId) {
     const task = yield* getTask(taskId);
     if (task.targetDeviceId !== deviceId) {
-      return yield* Effect9.fail(new PersistenceError({
+      return yield* Effect11.fail(new PersistenceError({
         operation: "RelayStore.requireTarget",
         message: `Task ${taskId} belongs to another device`
       }));
     }
     return task;
   });
-  const terminal = Effect9.fn("RelayStore.terminal")(function* (taskId, deviceId, status, result, error, providerSessionId) {
+  const terminal = Effect11.fn("RelayStore.terminal")(function* (taskId, deviceId, status, result, error, providerSessionId) {
     const current = yield* requireTarget(taskId, deviceId);
     if (["completed", "failed", "cancelled"].includes(current.status)) {
       return current;
     }
     const timestamp = now();
-    yield* Effect9.try({
+    yield* Effect11.try({
       try: () => db.transaction(() => {
         const updated = db.query(`UPDATE tasks SET status = ?, result = ?, error = ?, provider_session_id = ?,
              completed_at = ?, updated_at = ? WHERE id = ?
@@ -926,7 +1210,7 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     });
     return yield* getTask(taskId);
   });
-  const requestCancellation = Effect9.fn("RelayStore.requestCancellation")(function* (taskId) {
+  const requestCancellation = Effect11.fn("RelayStore.requestCancellation")(function* (taskId) {
     const current = yield* getTask(taskId);
     if (["completed", "failed", "cancelled"].includes(current.status)) {
       return current;
@@ -939,9 +1223,9 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
       status: "cancelling"
     }, { kind: "cancelling", detail: "Client requested task cancellation" });
   });
-  const requeueTasksFor = Effect9.fn("RelayStore.requeueTasksFor")(function* (deviceId) {
+  const requeueTasksFor = Effect11.fn("RelayStore.requeueTasksFor")(function* (deviceId) {
     const timestamp = now();
-    yield* Effect9.try({
+    yield* Effect11.try({
       try: () => db.transaction(() => {
         const interrupted = db.query(`SELECT id FROM tasks WHERE target_device_id = ?
                AND status IN ('assigned', 'running')`).all(deviceId);
@@ -954,42 +1238,42 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
       catch: operationError("RelayStore.requeueTasksFor")
     });
   });
-  const sessionFor = Effect9.fn("RelayStore.sessionFor")(function* (threadId, deviceId, provider) {
-    const row = yield* Effect9.try({
+  const sessionFor = Effect11.fn("RelayStore.sessionFor")(function* (threadId, deviceId, provider) {
+    const row = yield* Effect11.try({
       try: () => db.query(`SELECT session_id FROM provider_sessions
            WHERE thread_id = ? AND device_id = ? AND provider = ?`).get(threadId, deviceId, provider),
       catch: operationError("RelayStore.sessionFor")
     });
     return row?.session_id;
   });
-  const createPairing = Effect9.fn("RelayStore.createPairing")(function* (input) {
+  const createPairing = Effect11.fn("RelayStore.createPairing")(function* (input) {
     const roles = [...new Set(input.roles)];
     if (roles.length === 0) {
-      return yield* Effect9.fail(new PersistenceError({
+      return yield* Effect11.fail(new PersistenceError({
         operation: "RelayStore.createPairing",
         message: "A pairing must allow at least one role"
       }));
     }
     const token = secret("pair");
     const expiresAt = new Date(Date.now() + 10 * 60 * 1000).toISOString();
-    yield* Effect9.try({
+    yield* Effect11.try({
       try: () => db.query(`INSERT INTO auth_pairings (token_hash, label, roles_json, expires_at, created_at)
            VALUES (?, ?, ?, ?, ?)`).run(tokenHash(token), input.label, JSON.stringify(roles), expiresAt, now()),
       catch: operationError("RelayStore.createPairing")
     });
     return PairingCredential.make({ token, expiresAt: Timestamp.make(expiresAt) });
   });
-  const exchangePairing2 = Effect9.fn("RelayStore.exchangePairing")(function* (token) {
+  const exchangePairing2 = Effect11.fn("RelayStore.exchangePairing")(function* (token) {
     const timestamp = now();
     const expiresAt = new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString();
-    const created = yield* Effect9.try({
+    const created = yield* Effect11.try({
       try: () => db.transaction(() => {
         const pairing = db.query(`SELECT * FROM auth_pairings
              WHERE token_hash = ? AND used_at IS NULL AND expires_at > ?`).get(tokenHash(token), timestamp);
         if (pairing === null) {
           throw new Error("Pairing credential is invalid, expired, or already used");
         }
-        const roles = Schema10.decodeUnknownSync(Schema10.Array(ConnectionRole))(JSON.parse(pairing.roles_json));
+        const roles = Schema11.decodeUnknownSync(Schema11.Array(ConnectionRole))(JSON.parse(pairing.roles_json));
         const deviceId = roles.includes("device") ? makeDeviceId() : undefined;
         const consumed = db.query("UPDATE auth_pairings SET used_at = ? WHERE token_hash = ? AND used_at IS NULL").run(timestamp, pairing.token_hash);
         if (consumed.changes !== 1) {
@@ -1017,11 +1301,11 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
       })(),
       catch: operationError("RelayStore.exchangePairing")
     });
-    const credentials = yield* Effect9.forEach(created, ({ token: sessionToken, row }) => authSessionFromRow(row).pipe(Effect9.map((session) => ({ token: sessionToken, session }))));
+    const credentials = yield* Effect11.forEach(created, ({ token: sessionToken, row }) => authSessionFromRow(row).pipe(Effect11.map((session) => ({ token: sessionToken, session }))));
     return PairingResult.make({ credentials });
   });
-  const authenticateSession = Effect9.fn("RelayStore.authenticateSession")(function* (token, role) {
-    const row = yield* Effect9.try({
+  const authenticateSession = Effect11.fn("RelayStore.authenticateSession")(function* (token, role) {
+    const row = yield* Effect11.try({
       try: () => db.query(`SELECT * FROM auth_sessions
            WHERE token_hash = ? AND revoked_at IS NULL AND expires_at > ?`).get(tokenHash(token), now()),
       catch: operationError("RelayStore.authenticateSession")
@@ -1030,35 +1314,35 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
       return;
     }
     const lastSeenAt = now();
-    yield* Effect9.try({
+    yield* Effect11.try({
       try: () => db.query("UPDATE auth_sessions SET last_seen_at = ? WHERE id = ?").run(lastSeenAt, row.id),
       catch: operationError("RelayStore.authenticateSession.touch")
     });
     const session = yield* authSessionFromRow(row);
     return AuthSession.make({ ...session, lastSeenAt });
   });
-  const listAuthSessions = Effect9.fn("RelayStore.listAuthSessions")(function* () {
-    const rows = yield* Effect9.try({
+  const listAuthSessions = Effect11.fn("RelayStore.listAuthSessions")(function* () {
+    const rows = yield* Effect11.try({
       try: () => db.query("SELECT * FROM auth_sessions ORDER BY created_at DESC, id LIMIT 1000").all(),
       catch: operationError("RelayStore.listAuthSessions")
     });
-    return yield* Effect9.forEach(rows, authSessionFromRow);
+    return yield* Effect11.forEach(rows, authSessionFromRow);
   });
-  const revokeAuthSession = Effect9.fn("RelayStore.revokeAuthSession")(function* (sessionId) {
+  const revokeAuthSession = Effect11.fn("RelayStore.revokeAuthSession")(function* (sessionId) {
     const revokedAt = now();
-    const result = yield* Effect9.try({
+    const result = yield* Effect11.try({
       try: () => db.query("UPDATE auth_sessions SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL").run(revokedAt, sessionId),
       catch: operationError("RelayStore.revokeAuthSession")
     });
     if (result.changes !== 1) {
-      return yield* Effect9.fail(new PersistenceError({
+      return yield* Effect11.fail(new PersistenceError({
         operation: "RelayStore.revokeAuthSession",
         message: `Unknown or already revoked session ${sessionId}`
       }));
     }
     const row = db.query("SELECT * FROM auth_sessions WHERE id = ?").get(sessionId);
     if (row === null) {
-      return yield* Effect9.fail(new PersistenceError({
+      return yield* Effect11.fail(new PersistenceError({
         operation: "RelayStore.revokeAuthSession.read",
         message: `Session ${sessionId} disappeared after revocation`
       }));
@@ -1068,6 +1352,7 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
   return Service2.of({
     recover,
     listDevices,
+    usage,
     forgetDevice,
     upsertDevice,
     heartbeat: (deviceId, status) => updateDeviceStatus(deviceId, status),
@@ -1079,12 +1364,22 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     pendingTasksFor,
     assignTask,
     rollbackAssignment: (taskId) => transition(taskId, ["assigned"], { status: "queued" }, { kind: "requeued", detail: "Target device was unavailable during dispatch" }),
-    acceptTask: (taskId, deviceId) => requireTarget(taskId, deviceId).pipe(Effect9.flatMap(() => transition(taskId, ["assigned"], { status: "running", startedAt: now() }, { kind: "running", detail: "Target device accepted the task and started the provider" }))),
+    acceptTask: (taskId, deviceId) => requireTarget(taskId, deviceId).pipe(Effect11.flatMap(() => transition(taskId, ["assigned"], { status: "running", startedAt: now() }, { kind: "running", detail: "Target device accepted the task and started the provider" }))),
     finishTask: (taskId, deviceId, result, providerSessionId) => terminal(taskId, deviceId, "completed", result, undefined, providerSessionId),
     failTask: (taskId, deviceId, error) => terminal(taskId, deviceId, "failed", undefined, error),
     acknowledgeCancellation: (taskId, deviceId) => terminal(taskId, deviceId, "cancelled"),
     requestCancellation,
     requeueTasksFor,
+    createUpgradeOperations,
+    listOperations,
+    abandonOperation,
+    pendingOperationsFor,
+    assignOperation,
+    rollbackOperation: (operationId) => transitionOperation(operationId, ["assigned"], "queued"),
+    acceptOperation,
+    finishOperation,
+    failOperation,
+    requeueOperationsFor,
     sessionFor,
     createPairing,
     exchangePairing: exchangePairing2,
@@ -1092,7 +1387,7 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     listAuthSessions,
     revokeAuthSession
   });
-}, migrate = (db) => Effect9.try({
+}, migrate = (db) => Effect11.try({
   try: () => {
     db.exec("PRAGMA journal_mode = WAL");
     db.exec("PRAGMA foreign_keys = ON");
@@ -1140,6 +1435,15 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
           provider TEXT NOT NULL, session_id TEXT NOT NULL, updated_at TEXT NOT NULL,
           PRIMARY KEY(thread_id, device_id, provider)
         );
+        CREATE TABLE IF NOT EXISTS device_operations (
+          id TEXT PRIMARY KEY, kind TEXT NOT NULL, status TEXT NOT NULL,
+          target_device_id TEXT NOT NULL REFERENCES devices(id),
+          requested_version TEXT NOT NULL, restart INTEGER NOT NULL,
+          result TEXT, error TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+          completed_at TEXT
+        );
+        CREATE INDEX IF NOT EXISTS device_operations_target_status
+          ON device_operations(target_device_id, status);
         CREATE TABLE IF NOT EXISTS auth_pairings (
           token_hash TEXT PRIMARY KEY, label TEXT NOT NULL, roles_json TEXT NOT NULL,
           expires_at TEXT NOT NULL, created_at TEXT NOT NULL, used_at TEXT
@@ -1157,15 +1461,15 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     }
   },
   catch: operationError("RelayStore.migrate")
-}), layer2 = (path, retainedTerminalTasks = 1000) => Layer2.effect(Service2, Effect9.acquireRelease(Effect9.try({
+}), layer2 = (path, retainedTerminalTasks = 1000) => Layer2.effect(Service2, Effect11.acquireRelease(Effect11.try({
   try: () => new Database(path),
   catch: operationError("RelayStore.open")
-}).pipe(Effect9.tap(migrate)), (db) => Effect9.sync(() => db.close())).pipe(Effect9.map((db) => makeService(db, retainedTerminalTasks)))), layerFromDatabase = (db) => Layer2.effect(Service2, migrate(db).pipe(Effect9.map(() => makeService(db))));
+}).pipe(Effect11.tap(migrate)), (db) => Effect11.sync(() => db.close())).pipe(Effect11.map((db) => makeService(db, retainedTerminalTasks)))), layerFromDatabase = (db) => Layer2.effect(Service2, migrate(db).pipe(Effect11.map(() => makeService(db))));
 var init_store = __esm(() => {
   init_src();
   init_database();
   init_store();
-  PersistenceError = class PersistenceError extends Schema10.TaggedErrorClass()("RelayStore.PersistenceError", { operation: Schema10.String, message: Schema10.String }) {
+  PersistenceError = class PersistenceError extends Schema11.TaggedErrorClass()("RelayStore.PersistenceError", { operation: Schema11.String, message: Schema11.String }) {
   };
   Service2 = class Service2 extends Context2.Service()("@cohall/RelayStore") {
   };
@@ -1177,9 +1481,9 @@ __export(exports_main, {
   runRelay: () => runRelay,
   relayListenOptions: () => relayListenOptions
 });
-import { Effect as Effect10, ManagedRuntime, Schema as Schema11 } from "effect";
-import { createHash as createHash2, timingSafeEqual } from "node:crypto";
-import { access as access5, chmod as chmod5 } from "node:fs/promises";
+import { Effect as Effect12, ManagedRuntime, Schema as Schema12 } from "effect";
+import { createHash as createHash3, timingSafeEqual } from "node:crypto";
+import { access as access6, chmod as chmod7 } from "node:fs/promises";
 import { createServer } from "node:http";
 import { platform as platform5 } from "node:os";
 import { WebSocketServer } from "ws";
@@ -1208,7 +1512,7 @@ var RequestError, relayListenOptions = (configuration, environment = process.env
   if (request.method === "GET" || request.method === "HEAD") {
     return Promise.resolve(undefined);
   }
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const chunks = [];
     let size = 0;
     const cleanup = () => {
@@ -1227,7 +1531,7 @@ var RequestError, relayListenOptions = (configuration, environment = process.env
     };
     const onEnd = () => {
       cleanup();
-      resolve3(Buffer.concat(chunks, size));
+      resolve4(Buffer.concat(chunks, size));
     };
     const onError = (cause) => {
       cleanup();
@@ -1276,17 +1580,17 @@ Content-Length: 0\r
   if ("destroy" in socket && typeof socket.destroy === "function") {
     socket.destroy();
   }
-}, body = (request, decode2) => Effect10.tryPromise({
+}, body = (request, decode2) => Effect12.tryPromise({
   try: () => request.json(),
   catch: () => new RequestError({ status: 400, message: "Expected a JSON request body" })
-}).pipe(Effect10.flatMap(decode2), Effect10.mapError((cause) => cause instanceof RequestError ? cause : new RequestError({ status: 400, message: String(cause).slice(0, 2048) }))), pathId = (schema, value) => Schema11.decodeUnknownEffect(schema)(value).pipe(Effect10.mapError(() => new RequestError({ status: 400, message: `Invalid identifier: ${value}` }))), scoreDevice = (device, input, sourceDeviceId) => {
+}).pipe(Effect12.flatMap(decode2), Effect12.mapError((cause) => cause instanceof RequestError ? cause : new RequestError({ status: 400, message: String(cause).slice(0, 2048) }))), pathId = (schema, value) => Schema12.decodeUnknownEffect(schema)(value).pipe(Effect12.mapError(() => new RequestError({ status: 400, message: `Invalid identifier: ${value}` }))), scoreDevice = (device, input, sourceDeviceId) => {
   const prompt = `${input.prompt} ${input.context ?? ""}`.toLowerCase();
   const needsXcode = /\b(xcode|ios|macos|swiftui|app store)\b/.test(prompt);
   const needsBrowser = /\b(browser|chrome|youtube|twitter|logged[- ]?in|signed[- ]?in|x\.com)\b/.test(prompt);
   return (device.status === "offline" ? 0 : 100) + (input.workspace !== undefined && device.workspaces.some((workspace) => input.workspace === workspace.path || input.workspace?.startsWith(`${workspace.path}/`)) ? 80 : 0) + (needsXcode && device.capabilities.some((capability) => capability.id === "xcode") ? 60 : 0) + (needsBrowser && device.capabilities.some((capability) => capability.id === "browser-session") ? 40 : 0) + (sourceDeviceId === device.id ? -5 : 0);
-}, chooseDevice = (input, sourceDeviceId) => Effect10.gen(function* () {
+}, chooseDevice = (input, sourceDeviceId) => Effect12.gen(function* () {
   const store = yield* exports_store.Service;
-  const devices = yield* store.listDevices().pipe(Effect10.mapError((cause) => new RequestError({ status: 500, message: cause.message })));
+  const devices = yield* store.listDevices().pipe(Effect12.mapError((cause) => new RequestError({ status: 500, message: cause.message })));
   const provider = input.provider ?? "codex";
   if (input.targetDeviceId !== undefined) {
     const target = devices.find((device) => device.id === input.targetDeviceId);
@@ -1313,26 +1617,26 @@ Content-Length: 0\r
   }
   return selected.id;
 }), runRelay = async () => {
-  const configuration = await Effect10.runPromise(loadEnvironmentConfiguration);
+  const configuration = await Effect12.runPromise(loadEnvironmentConfiguration);
   process.umask(63);
   const runtime = ManagedRuntime.make(exports_store.layer(configuration.databasePath, configuration.historyTaskLimit));
   const run2 = (effect) => runtime.runPromise(effect);
-  await run2(Effect10.gen(function* () {
+  await run2(Effect12.gen(function* () {
     const store = yield* exports_store.Service;
     yield* store.recover();
   }));
-  if (platform5() !== "win32" && await access5(configuration.databasePath).then(() => true).catch(() => false)) {
-    await chmod5(configuration.databasePath, 384);
+  if (platform5() !== "win32" && await access6(configuration.databasePath).then(() => true).catch(() => false)) {
+    await chmod7(configuration.databasePath, 384);
   }
   const hub = new Hub;
   let connections = 0;
-  const tokenDigest = (token) => createHash2("sha256").update(token).digest();
-  const ownerToken = (token) => timingSafeEqual(tokenDigest(token), tokenDigest(configuration.token));
+  const tokenDigest = (token) => createHash3("sha256").update(token).digest();
+  const ownerToken2 = (token) => timingSafeEqual(tokenDigest(token), tokenDigest(configuration.token));
   const authenticate = async (token, role) => {
-    if (ownerToken(token)) {
+    if (ownerToken2(token)) {
       return "owner";
     }
-    return run2(Effect10.gen(function* () {
+    return run2(Effect12.gen(function* () {
       const store = yield* exports_store.Service;
       return yield* store.authenticateSession(token, role);
     })).catch(() => {
@@ -1347,7 +1651,7 @@ Content-Length: 0\r
     return authenticate(authorization.slice("Bearer ".length), "client");
   };
   const dispatch = async (task) => {
-    const assigned = await run2(Effect10.gen(function* () {
+    const assigned = await run2(Effect12.gen(function* () {
       const store = yield* exports_store.Service;
       return yield* store.assignTask(task.id);
     }));
@@ -1357,13 +1661,29 @@ Content-Length: 0\r
     if (hub.sendToDevice(assigned.targetDeviceId, SocketEvent.make({ _tag: "TaskAssigned", task: assigned }))) {
       return assigned;
     }
-    return run2(Effect10.gen(function* () {
+    return run2(Effect12.gen(function* () {
       const store = yield* exports_store.Service;
       return yield* store.rollbackAssignment(task.id);
     }));
   };
+  const dispatchOperation = async (operation) => {
+    const assigned = await run2(Effect12.gen(function* () {
+      const store = yield* exports_store.Service;
+      return yield* store.assignOperation(operation.id);
+    }));
+    if (assigned.status !== "assigned") {
+      return assigned;
+    }
+    if (hub.sendToDevice(assigned.targetDeviceId, SocketEvent.make({ _tag: "OperationAssigned", operation: assigned }))) {
+      return assigned;
+    }
+    return run2(Effect12.gen(function* () {
+      const store = yield* exports_store.Service;
+      return yield* store.rollbackOperation(operation.id);
+    }));
+  };
   const dispatchPending = async (deviceId) => {
-    const tasks = await run2(Effect10.gen(function* () {
+    const tasks = await run2(Effect12.gen(function* () {
       const store = yield* exports_store.Service;
       return yield* store.pendingTasksFor(deviceId);
     }));
@@ -1374,6 +1694,13 @@ Content-Length: 0\r
         await dispatch(task);
       }
     }
+    const operations = await run2(Effect12.gen(function* () {
+      const store = yield* exports_store.Service;
+      return yield* store.pendingOperationsFor(deviceId);
+    }));
+    for (const operation of operations) {
+      await dispatchOperation(operation);
+    }
   };
   const sendError = (socket, code, message) => {
     socket.send(JSON.stringify(SocketEvent.make({
@@ -1383,10 +1710,10 @@ Content-Length: 0\r
     })));
   };
   const handleSocketEvent = async (socket, input) => {
-    const event = await Effect10.runPromise(Effect10.try({
+    const event = await Effect12.runPromise(Effect12.try({
       try: () => JSON.parse(socketText(input)),
       catch: () => new RequestError({ status: 400, message: "Invalid socket JSON" })
-    }).pipe(Effect10.flatMap(decodeSocketEvent))).catch((cause) => {
+    }).pipe(Effect12.flatMap(decodeSocketEvent))).catch((cause) => {
       sendError(socket, "invalid_event", cause instanceof Error ? cause.message : String(cause));
       return;
     });
@@ -1443,7 +1770,7 @@ Content-Length: 0\r
         socket.close(4009, "Device is already connected");
         return;
       }
-      await run2(Effect10.gen(function* () {
+      await run2(Effect12.gen(function* () {
         const store = yield* exports_store.Service;
         yield* store.upsertDevice(device);
       }));
@@ -1458,7 +1785,10 @@ Content-Length: 0\r
     const settle = (taskId) => {
       socket.send(JSON.stringify(SocketEvent.make({ _tag: "TaskSettled", taskId })));
     };
-    const processed = await run2(Effect10.gen(function* () {
+    const settleOperation = (operationId) => {
+      socket.send(JSON.stringify(SocketEvent.make({ _tag: "OperationSettled", operationId })));
+    };
+    const processed = await run2(Effect12.gen(function* () {
       const store = yield* exports_store.Service;
       switch (event._tag) {
         case "DeviceHeartbeat":
@@ -1478,10 +1808,21 @@ Content-Length: 0\r
         case "TaskCancelled":
           yield* store.acknowledgeCancellation(event.taskId, deviceId);
           return;
+        case "OperationAccepted":
+          yield* store.acceptOperation(event.operationId, deviceId);
+          return;
+        case "OperationFinished":
+          yield* store.finishOperation(event.operationId, deviceId, event.result);
+          return;
+        case "OperationFailed":
+          yield* store.failOperation(event.operationId, deviceId, event.error);
+          return;
         case "Connected":
         case "TaskAssigned":
         case "TaskSettled":
         case "CancelTask":
+        case "OperationAssigned":
+        case "OperationSettled":
         case "Error":
           return;
       }
@@ -1493,13 +1834,17 @@ Content-Length: 0\r
       settle(event.taskId);
       await dispatchPending(deviceId);
     }
+    if (processed && (event._tag === "OperationFinished" || event._tag === "OperationFailed")) {
+      settleOperation(event.operationId);
+      await dispatchPending(deviceId);
+    }
   };
   const api = async (request, url) => {
     if (url.pathname === "/api/health" && request.method === "GET") {
       return json({ ok: true, version });
     }
     if (url.pathname === "/api/auth/pair" && request.method === "POST") {
-      return run2(Effect10.gen(function* () {
+      return run2(Effect12.gen(function* () {
         const store = yield* exports_store.Service;
         const input = yield* body(request, decodeExchangePairingInput);
         return yield* store.exchangePairing(input.token);
@@ -1509,12 +1854,12 @@ Content-Length: 0\r
     if (principal === undefined) {
       return json({ error: "Unauthorized" }, 401);
     }
-    const ownerOnly = url.pathname.startsWith("/api/auth/");
+    const ownerOnly = url.pathname.startsWith("/api/auth/") || url.pathname.startsWith("/api/operations");
     if (ownerOnly && principal !== "owner") {
       return json({ error: "Owner token required" }, 403);
     }
     const sourceDeviceId = principal === "owner" ? undefined : principal.deviceId;
-    const effect = Effect10.gen(function* () {
+    const effect = Effect12.gen(function* () {
       const store = yield* exports_store.Service;
       if (url.pathname === "/api/auth/pairings" && request.method === "POST") {
         const input = yield* body(request, decodeCreatePairingInput);
@@ -1533,6 +1878,23 @@ Content-Length: 0\r
       if (url.pathname === "/api/devices" && request.method === "GET") {
         return json(yield* store.listDevices());
       }
+      if (url.pathname === "/api/usage" && request.method === "GET") {
+        return json(yield* store.usage());
+      }
+      if (url.pathname === "/api/operations" && request.method === "GET") {
+        return json(yield* store.listOperations());
+      }
+      if (url.pathname === "/api/operations/upgrades" && request.method === "POST") {
+        const input = yield* body(request, decodeCreateUpgradeOperationsInput);
+        const operations = yield* store.createUpgradeOperations(input);
+        return json(yield* Effect12.tryPromise(() => Promise.all(operations.map(dispatchOperation))), 201);
+      }
+      const abandonOperation = url.pathname.match(/^\/api\/operations\/([^/]+)\/abandon$/);
+      if (request.method === "POST" && abandonOperation?.[1] !== undefined) {
+        const operation = yield* store.abandonOperation(yield* pathId(OperationId, abandonOperation[1]));
+        hub.sendToDevice(operation.targetDeviceId, SocketEvent.make({ _tag: "OperationSettled", operationId: operation.id }));
+        return json(operation);
+      }
       const forgetDevice = url.pathname.match(/^\/api\/devices\/([^/]+)\/forget$/);
       if (request.method === "POST" && forgetDevice?.[1] !== undefined) {
         if (principal !== "owner") {
@@ -1554,7 +1916,7 @@ Content-Length: 0\r
         const target = yield* chooseDevice(input, sourceDeviceId);
         const providerSessionId = input.threadId === undefined ? undefined : yield* store.sessionFor(input.threadId, target, input.provider ?? "codex");
         const task2 = yield* store.createDelegation(input, target, sourceDeviceId, providerSessionId);
-        return json(yield* Effect10.tryPromise(() => dispatch(task2)), 201);
+        return json(yield* Effect12.tryPromise(() => dispatch(task2)), 201);
       }
       const task = url.pathname.match(/^\/api\/tasks\/([^/]+)$/);
       if (request.method === "GET" && task?.[1] !== undefined) {
@@ -1578,8 +1940,8 @@ Content-Length: 0\r
         return json(yield* store.threadContext(yield* pathId(ThreadId, thread[1])));
       }
       return yield* new RequestError({ status: 404, message: "Route not found" });
-    }).pipe(Effect10.mapError((cause) => cause instanceof RequestError ? cause : new RequestError({
-      status: cause._tag !== "RelayStore.PersistenceError" ? 500 : cause.message.startsWith("Unknown") ? 404 : cause.message.includes("outstanding task limit") ? 429 : cause.message.includes("must be offline") || cause.message.includes("still has outstanding tasks") ? 409 : 500,
+    }).pipe(Effect12.mapError((cause) => cause instanceof RequestError ? cause : new RequestError({
+      status: cause._tag !== "RelayStore.PersistenceError" ? 500 : cause.message.startsWith("Unknown") ? 404 : cause.message.includes("outstanding task limit") ? 429 : cause.message.includes("must be offline") || cause.message.includes("still has outstanding tasks") || cause.message.includes("upgrade operation in progress") || cause.message === "No Cohall devices are registered" || cause.message.startsWith("All-device operations support") ? 409 : 500,
       message: cause.message
     })));
     return run2(effect).catch((cause) => cause instanceof RequestError ? json({ error: cause.status === 500 ? "Relay request failed" : cause.message }, cause.status) : json({ error: "Relay request failed" }, 500));
@@ -1652,9 +2014,10 @@ Content-Length: 0\r
       if (deviceId === undefined) {
         return;
       }
-      run2(Effect10.gen(function* () {
+      run2(Effect12.gen(function* () {
         const store = yield* exports_store.Service;
         yield* store.requeueTasksFor(deviceId);
+        yield* store.requeueOperationsFor(deviceId);
         yield* store.markDeviceOffline(deviceId);
       })).catch((cause) => console.error(cause));
     });
@@ -1679,11 +2042,11 @@ Content-Length: 0\r
       websocketServer.emit("connection", websocket, request);
     });
   });
-  await new Promise((resolve3, reject) => {
+  await new Promise((resolve4, reject) => {
     server.once("error", reject);
     server.listen(relayListenOptions(configuration), () => {
       server.off("error", reject);
-      resolve3();
+      resolve4();
     });
   });
   const address = server.address();
@@ -1698,7 +2061,7 @@ Content-Length: 0\r
     for (const socket of websocketServer.clients) {
       socket.close(1001, "Relay shutting down");
     }
-    await new Promise((resolve3) => server.close(() => resolve3()));
+    await new Promise((resolve4) => server.close(() => resolve4()));
     websocketServer.close();
     await runtime.dispose();
   };
@@ -1710,9 +2073,9 @@ var init_main = __esm(async () => {
   init_config();
   init_hub();
   init_store();
-  RequestError = class RequestError extends Schema11.TaggedErrorClass()("Relay.RequestError", {
-    status: Schema11.Int,
-    message: Schema11.String
+  RequestError = class RequestError extends Schema12.TaggedErrorClass()("Relay.RequestError", {
+    status: Schema12.Int,
+    message: Schema12.String
   }) {
   };
   if (false) {}
@@ -1720,7 +2083,7 @@ var init_main = __esm(async () => {
 
 // apps/device/src/main.ts
 init_src();
-import { Effect as Effect11 } from "effect";
+import { Effect as Effect13 } from "effect";
 
 // packages/client/src/index.ts
 init_src();
@@ -1840,7 +2203,11 @@ var make = (options) => {
       body: JSON.stringify(input)
     }),
     authSessions: () => request("RelayClient.authSessions", "/api/auth/sessions", Schema2.Array(AuthSession)),
-    revokeAuthSession: (sessionId) => request("RelayClient.revokeAuthSession", `/api/auth/sessions/${encodeURIComponent(sessionId)}/revoke`, AuthSession, { method: "POST" })
+    revokeAuthSession: (sessionId) => request("RelayClient.revokeAuthSession", `/api/auth/sessions/${encodeURIComponent(sessionId)}/revoke`, AuthSession, { method: "POST" }),
+    usage: () => request("RelayClient.usage", "/api/usage", UsageSummary),
+    createUpgradeOperations: (input) => request("RelayClient.createUpgradeOperations", "/api/operations/upgrades", Schema2.Array(DeviceOperation), { method: "POST", body: JSON.stringify(input) }),
+    operations: () => request("RelayClient.operations", "/api/operations", Schema2.Array(DeviceOperation)),
+    abandonOperation: (operationId) => request("RelayClient.abandonOperation", `/api/operations/${encodeURIComponent(operationId)}/abandon`, DeviceOperation, { method: "POST" })
   });
 };
 var exchangePairing = (baseUrl, input) => Effect.gen(function* () {
@@ -2326,10 +2693,10 @@ var run = (options) => Effect2.tryPromise({
 });
 
 // apps/device/src/cli.ts
-import { Effect as Effect5, Schema as Schema7 } from "effect";
-import { access as access3, mkdir as mkdir3, readFile as readFile3, stat as stat2, writeFile as writeFile4 } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname3, join as join4 } from "node:path";
+import { Effect as Effect7, Schema as Schema8 } from "effect";
+import { access as access4, mkdir as mkdir5, readFile as readFile4, stat as stat3, writeFile as writeFile6 } from "node:fs/promises";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname5, join as join6 } from "node:path";
 
 // skills/cohall/SKILL.md
 var SKILL_default = `---
@@ -2553,6 +2920,7 @@ var defaultRelayDataDirectory = () => {
   }
   return join2(process.env.XDG_DATA_HOME ?? join2(homedir2(), ".local", "share"), "cohall");
 };
+var relayDataDirectory = () => resolve(process.env.COHALL_DATA_DIR ?? defaultRelayDataDirectory());
 var configurationPath = () => resolve(process.env.COHALL_CONFIG ?? join2(defaultConfigDirectory(), "config.json"));
 var normalizeRelayUrl = (input) => {
   const url = new URL(input);
@@ -2684,7 +3052,7 @@ var loadClientConfiguration = Effect3.tryPromise({
 var loadOwnerConfiguration = Effect3.tryPromise({
   try: async () => {
     const stored = await storedOrDefaults();
-    const ownerTokenPath = join2(resolve(process.env.COHALL_DATA_DIR ?? defaultRelayDataDirectory()), "owner-token");
+    const ownerTokenPath = join2(relayDataDirectory(), "owner-token");
     const token = process.env.COHALL_TOKEN ?? await readFile(ownerTokenPath, "utf8").then((value) => value.trim()).catch(() => {
       return;
     });
@@ -2825,6 +3193,176 @@ var threadContext = Effect4.fn("Cohall.threadContext")(function* (client, thread
   return yield* client.threadContext(threadId);
 });
 
+// apps/device/src/device-overview.ts
+var deviceVersions = (devices, localVersion) => ({
+  local_version: localVersion,
+  current: devices.filter((device) => device.version === localVersion).length,
+  different: devices.filter((device) => device.version !== localVersion).length,
+  devices: devices.map((device) => ({
+    id: device.id,
+    name: device.name,
+    status: device.status,
+    version: device.version,
+    current: device.version === localVersion
+  }))
+});
+var allDeviceHealth = (devices, localVersion) => {
+  const summaries = devices.map((device) => {
+    const warnings = [
+      ...device.status === "offline" ? ["Device is offline"] : [],
+      ...device.providers.length === 0 ? ["No provider executable is available"] : [],
+      ...device.version === localVersion ? [] : [`Running Cohall ${device.version}; local CLI is ${localVersion}`]
+    ];
+    return {
+      id: device.id,
+      name: device.name,
+      hostname: device.hostname,
+      platform: device.platform,
+      architecture: device.architecture,
+      status: device.status,
+      version: device.version,
+      providers: device.providers,
+      workspaces: device.workspaces.map((workspace) => workspace.path),
+      last_seen_at: device.lastSeenAt,
+      warnings
+    };
+  });
+  return {
+    healthy: summaries.length > 0 && summaries.every((device) => device.warnings.length === 0),
+    total: devices.length,
+    online: devices.filter((device) => device.status === "online").length,
+    busy: devices.filter((device) => device.status === "busy").length,
+    offline: devices.filter((device) => device.status === "offline").length,
+    warnings: summaries.length === 0 ? ["No Cohall devices are registered"] : [],
+    devices: summaries
+  };
+};
+
+// apps/device/src/setup.ts
+import { Effect as Effect5 } from "effect";
+import { hostname as hostname2 } from "node:os";
+import { Writable } from "node:stream";
+import { createInterface } from "node:readline/promises";
+var joinRelay = async (options) => {
+  const draft = await makeStoredConfiguration({
+    relayUrl: options.relayUrl,
+    ...options.deviceName === undefined ? {} : { deviceName: options.deviceName },
+    ...options.workspaces === undefined ? {} : { workspaces: options.workspaces },
+    ...options.providers === undefined ? {} : { providers: options.providers }
+  });
+  if (!options.clientOnly && draft.workspaces.length === 0) {
+    throw new Error("At least one workspace is required when joining a device");
+  }
+  const paired = await Effect5.runPromise(exchangePairing(draft.relayUrl, { token: options.token }));
+  const clientToken = paired.credentials.find((credential) => credential.session.role === "client")?.token;
+  const deviceCredential = paired.credentials.find((credential) => credential.session.role === "device");
+  if (options.clientOnly && clientToken === undefined) {
+    throw new Error("The pairing credential did not include client access");
+  }
+  if (!options.clientOnly && deviceCredential === undefined) {
+    throw new Error("The pairing credential did not include device access");
+  }
+  const {
+    clientToken: _retainedClientToken,
+    deviceToken: _retainedDeviceToken,
+    ...configurationDraft
+  } = draft;
+  const configuration = StoredConfiguration.make({
+    ...configurationDraft,
+    deviceId: options.clientOnly ? configurationDraft.deviceId : deviceCredential?.session.deviceId ?? configurationDraft.deviceId,
+    ...clientToken === undefined ? {} : { clientToken },
+    ...options.clientOnly || deviceCredential === undefined ? {} : { deviceToken: deviceCredential.token }
+  });
+  await writeStoredConfiguration(configuration);
+  return {
+    configuration,
+    roles: options.clientOnly ? paired.credentials.map((credential) => credential.session.role).filter((role) => role === "client") : paired.credentials.map((credential) => credential.session.role)
+  };
+};
+var terminalPrompter = () => {
+  let muted = false;
+  const output = new Writable({
+    write(chunk, _encoding, callback) {
+      if (!muted) {
+        process.stderr.write(chunk);
+      }
+      callback();
+    }
+  });
+  const terminal = createInterface({ input: process.stdin, output, terminal: true });
+  return {
+    answer: async (label, fallback) => {
+      const value = (await terminal.question(`${label} [${fallback}]: `)).trim();
+      return value || fallback;
+    },
+    secret: async (label) => {
+      const pending = terminal.question(`${label}: `);
+      muted = true;
+      try {
+        return (await pending).trim();
+      } finally {
+        muted = false;
+        process.stderr.write(`
+`);
+      }
+    },
+    close: () => terminal.close()
+  };
+};
+var guidedSetupInput = async (options, prompter) => {
+  const existing = await readStoredConfiguration();
+  const relayUrl = normalizeRelayUrl(options.relayUrl ?? await prompter.answer("Relay URL", existing?.relayUrl ?? "http://127.0.0.1:8787"));
+  const credentials = credentialsForRelay(existing, relayUrl);
+  const hasRequiredCredentials = credentials.clientToken !== undefined && (options.clientOnly || credentials.deviceToken !== undefined);
+  const workspaces = options.clientOnly ? existing?.workspaces ?? [] : options.workspaces.length > 0 ? options.workspaces : [await prompter.answer("Workspace root", existing?.workspaces[0] ?? options.cwd)];
+  const deviceName = options.clientOnly ? undefined : options.deviceName ?? await prompter.answer("Device name", existing?.deviceName ?? hostname2());
+  const providers = options.providers ?? (options.clientOnly ? "auto" : await prompter.answer("Providers", existing?.providers?.join(",") ?? "auto"));
+  const token = options.token ?? (hasRequiredCredentials ? undefined : await prompter.secret("Pairing token"));
+  if (!hasRequiredCredentials && (token === undefined || token.length === 0)) {
+    throw new Error("A pairing token is required");
+  }
+  if (token !== undefined && new TextEncoder().encode(token).byteLength > 256) {
+    throw new Error("Pairing token exceeds 256 bytes");
+  }
+  return {
+    relayUrl,
+    ...token === undefined ? {} : { token },
+    ...deviceName === undefined ? {} : { deviceName },
+    workspaces,
+    providers,
+    reusedConfiguration: hasRequiredCredentials && token === undefined
+  };
+};
+
+// apps/device/src/relay-migration.ts
+init_src();
+import { Effect as Effect6, Schema as Schema7 } from "effect";
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import {
+  access as access3,
+  chmod as chmod5,
+  copyFile,
+  lstat,
+  mkdir as mkdir4,
+  mkdtemp as mkdtemp2,
+  readFile as readFile3,
+  realpath as realpath4,
+  rename as rename3,
+  rm as rm3,
+  stat as stat2,
+  writeFile as writeFile5
+} from "node:fs/promises";
+import { basename, dirname as dirname4, join as join5, resolve as resolve2 } from "node:path";
+import { backup as sqliteBackup, DatabaseSync } from "node:sqlite";
+import { WebSocket } from "ws";
+
+// apps/device/src/service.ts
+import { execFile as execFile3 } from "node:child_process";
+import { chmod as chmod4, mkdir as mkdir3, realpath as realpath3, writeFile as writeFile4 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname3, join as join4 } from "node:path";
+
 // apps/device/src/upgrade.ts
 import { Schema as Schema6 } from "effect";
 import { execFile as execFile2 } from "node:child_process";
@@ -3288,6 +3826,466 @@ var upgrade = async (options) => {
   };
 };
 
+// apps/device/src/service.ts
+var xml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+var systemdArgument = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"")}"`;
+var deviceServicePlan = (options) => {
+  if (options.platform === "linux") {
+    const path = join4(options.home, ".config", "systemd", "user", "cohall-device.service");
+    return {
+      file: {
+        path,
+        mode: 384,
+        content: `[Unit]
+Description=Cohall device agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+Environment=PATH=%h/.local/bin:%h/.npm-global/bin:%h/.bun/bin:%h/.local/share/pnpm:/usr/local/bin:/usr/bin:/bin
+ExecStart=${systemdArgument(options.entrypoint)} device
+Restart=always
+RestartSec=3
+UMask=0077
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=default.target
+`
+      },
+      commands: [
+        { command: "systemctl", arguments: ["--user", "daemon-reload"] },
+        { command: "systemctl", arguments: ["--user", "enable", "--now", "cohall-device.service"] }
+      ],
+      note: "The device starts after login. Run loginctl enable-linger $USER if it must run before login."
+    };
+  }
+  if (options.platform === "darwin") {
+    const label = "com.cohall.device";
+    const path = join4(options.home, "Library", "LaunchAgents", `${label}.plist`);
+    const domain = `gui/${options.uid ?? 0}`;
+    return {
+      file: {
+        path,
+        mode: 384,
+        content: `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${label}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${xml(options.entrypoint)}</string>
+    <string>device</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>NetworkState</key>
+    <true/>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>ThrottleInterval</key>
+  <integer>3</integer>
+  <key>ProcessType</key>
+  <string>Background</string>
+</dict>
+</plist>
+`
+      },
+      commands: [
+        { command: "launchctl", arguments: ["bootout", domain, path] },
+        { command: "launchctl", arguments: ["bootstrap", domain, path] },
+        { command: "launchctl", arguments: ["kickstart", "-k", `${domain}/${label}`] }
+      ]
+    };
+  }
+  throw new Error("Automatic device service installation supports Linux and macOS");
+};
+var defaultRunner2 = {
+  run: async (command, arguments_, timeoutMs = 60000) => {
+    const executable = await trustedExecutable(command);
+    return new Promise((resolve2) => {
+      execFile3(executable, [...arguments_], { encoding: "utf8", maxBuffer: 1024 * 1024, timeout: timeoutMs, windowsHide: true }, (error, stdout, stderr) => resolve2({
+        exitCode: typeof error?.code === "number" ? error.code : error === null ? 0 : 1,
+        stdout,
+        stderr,
+        ...error === null ? {} : { error: error.message }
+      }));
+    });
+  }
+};
+var checked2 = async (runner, command, arguments_, allowFailure = false) => {
+  const result = await runner.run(command, arguments_, 60000);
+  if (result.exitCode === 0 || allowFailure) {
+    return result;
+  }
+  throw new Error(`${command} failed: ${result.stderr.trim() || result.stdout.trim() || result.error || `status ${result.exitCode}`}`);
+};
+var installDeviceService = async (options = {}) => {
+  const entrypoint = await realpath3(options.entrypoint ?? process.argv[1] ?? "");
+  packageInstallation(entrypoint);
+  const platform3 = options.platform ?? process.platform;
+  const runner = options.runner ?? defaultRunner2;
+  if (platform3 === "win32") {
+    const script = join4(dirname3(dirname3(entrypoint)), "deploy", "windows", "install-device.ps1");
+    await checked2(runner, "powershell.exe", [
+      "-NoProfile",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-File",
+      script
+    ]);
+    return { installed: "scheduled-task:Cohall Device" };
+  }
+  const uid = options.uid ?? process.getuid?.();
+  const plan = deviceServicePlan({
+    platform: platform3,
+    entrypoint,
+    home: options.home ?? homedir3(),
+    ...uid === undefined ? {} : { uid }
+  });
+  await mkdir3(dirname3(plan.file.path), { recursive: true, mode: 448 });
+  await writeFile4(plan.file.path, plan.file.content, { mode: plan.file.mode });
+  await chmod4(plan.file.path, plan.file.mode);
+  for (const [index, command] of plan.commands.entries()) {
+    await checked2(runner, command.command, command.arguments, platform3 === "darwin" && index === 0);
+  }
+  return {
+    installed: plan.file.path,
+    ...plan.note === undefined ? {} : { note: plan.note }
+  };
+};
+var restartDeviceService = async (options = {}) => {
+  const platform3 = options.platform ?? process.platform;
+  const runner = options.runner ?? defaultRunner2;
+  if (platform3 === "linux") {
+    const service = "cohall-device.service";
+    const check = await runner.run("systemctl", ["--user", "is-active", "--quiet", service], 1e4);
+    if (check.exitCode !== 0) {
+      return { running: false, restarted: false };
+    }
+    await checked2(runner, "systemctl", ["--user", "restart", service]);
+    return { running: true, restarted: true, service };
+  }
+  if (platform3 === "darwin") {
+    const service = "com.cohall.device";
+    const target = `gui/${options.uid ?? process.getuid?.() ?? 0}/${service}`;
+    const check = await runner.run("launchctl", ["print", target], 1e4);
+    if (check.exitCode !== 0) {
+      return { running: false, restarted: false };
+    }
+    await checked2(runner, "launchctl", ["kickstart", "-k", target]);
+    return { running: true, restarted: true, service };
+  }
+  if (platform3 === "win32") {
+    const service = "Cohall Device";
+    const check = await runner.run("schtasks.exe", ["/Query", "/TN", service], 1e4);
+    if (check.exitCode !== 0) {
+      return { running: false, restarted: false };
+    }
+    await checked2(runner, "schtasks.exe", ["/End", "/TN", service], true);
+    await checked2(runner, "schtasks.exe", ["/Run", "/TN", service]);
+    return { running: true, restarted: true, service };
+  }
+  return { running: false, restarted: false };
+};
+
+// apps/device/src/relay-migration.ts
+var sha256 = Schema7.String.check(Schema7.isPattern(/^[a-f0-9]{64}$/, { expected: "a lowercase SHA-256 digest" }));
+var RelayBackupManifest = Schema7.Struct({
+  formatVersion: Schema7.Literal(1),
+  cohallVersion: Schema7.NonEmptyString,
+  createdAt: Timestamp,
+  databaseSha256: sha256,
+  ownerTokenSha256: sha256
+});
+var exists = (path) => access3(path).then(() => true).catch(() => false);
+var digest = async (path) => {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) {
+    hash.update(chunk);
+  }
+  return hash.digest("hex");
+};
+var verifyBackupMember = async (path, maximumBytes) => {
+  const metadata = await lstat(path);
+  if (!metadata.isFile()) {
+    throw new Error(`Relay backup member must be a regular file: ${path}`);
+  }
+  if (maximumBytes !== undefined && metadata.size > maximumBytes) {
+    throw new Error(`Relay backup member exceeds ${maximumBytes} bytes: ${path}`);
+  }
+};
+var readManifest = async (path) => {
+  await verifyBackupMember(path, 16384);
+  return Schema7.decodeUnknownSync(RelayBackupManifest)(JSON.parse(await readFile3(path, "utf8")));
+};
+var verifyBackupDestinationParent = async (path) => {
+  if (process.platform === "win32") {
+    return;
+  }
+  for (let current = await realpath4(path);; current = dirname4(current)) {
+    const metadata = await stat2(current);
+    const writableByOthers = (metadata.mode & 18) !== 0;
+    const sticky = (metadata.mode & 512) !== 0;
+    if (writableByOthers && !sticky) {
+      throw new Error(`Backup destination ancestors must not be group- or world-writable unless they use the sticky bit: ${current}`);
+    }
+    const parent = dirname4(current);
+    if (parent === current) {
+      return;
+    }
+  }
+};
+var ownerToken = async (dataDirectory) => {
+  const path = join5(dataDirectory, "owner-token");
+  const configured = process.env.COHALL_TOKEN;
+  if (configured !== undefined) {
+    return configured;
+  }
+  if (!await exists(path)) {
+    throw new Error(`Relay owner token was not found at ${path}`);
+  }
+  if ((await stat2(path)).size > 512) {
+    throw new Error("Relay owner token file exceeds 512 bytes");
+  }
+  return (await readFile3(path, "utf8")).trim();
+};
+var verifyDatabase = (path) => {
+  const database = new DatabaseSync(path, { readOnly: true });
+  try {
+    const result = database.prepare("PRAGMA quick_check").get();
+    if (result === undefined || Object.values(result)[0] !== "ok") {
+      throw new Error(`SQLite integrity check failed for ${path}`);
+    }
+  } finally {
+    database.close();
+  }
+};
+var backupRelay = async (destinationInput) => {
+  const sourceDirectory = relayDataDirectory();
+  const sourceDatabase = join5(sourceDirectory, "cohall.db");
+  if (!await exists(sourceDatabase)) {
+    throw new Error(`Relay database was not found at ${sourceDatabase}`);
+  }
+  const destination = resolve2(destinationInput);
+  if (await exists(destination)) {
+    throw new Error(`Backup destination already exists: ${destination}`);
+  }
+  await verifyBackupDestinationParent(dirname4(destination));
+  await mkdir4(destination, { mode: 448 });
+  try {
+    const databasePath = join5(destination, "cohall.db");
+    const ownerTokenPath = join5(destination, "owner-token");
+    const database = new DatabaseSync(sourceDatabase, { readOnly: true });
+    try {
+      await sqliteBackup(database, databasePath);
+    } finally {
+      database.close();
+    }
+    verifyDatabase(databasePath);
+    const token = await ownerToken(sourceDirectory);
+    if (token.length < 32 || new TextEncoder().encode(token).byteLength > 512) {
+      throw new Error("The relay owner token must contain between 32 and 512 bytes");
+    }
+    await writeFile5(ownerTokenPath, `${token}
+`, { mode: 384 });
+    await Promise.all([chmod5(databasePath, 384), chmod5(ownerTokenPath, 384)]);
+    const createdAt = Timestamp.make(new Date().toISOString());
+    const manifest = RelayBackupManifest.make({
+      formatVersion: 1,
+      cohallVersion: version,
+      createdAt,
+      databaseSha256: await digest(databasePath),
+      ownerTokenSha256: await digest(ownerTokenPath)
+    });
+    await writeFile5(join5(destination, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+`, {
+      mode: 384
+    });
+    return {
+      backup_directory: destination,
+      database: databasePath,
+      created_at: createdAt,
+      warning: "This backup contains relay credentials and task history. Transfer and store it privately."
+    };
+  } catch (cause) {
+    await rm3(destination, { recursive: true, force: true });
+    throw cause;
+  }
+};
+var restoreRelay = async (sourceInput) => {
+  const source = resolve2(sourceInput);
+  const sourceDatabase = join5(source, "cohall.db");
+  const sourceOwnerToken = join5(source, "owner-token");
+  const sourceManifest = join5(source, "manifest.json");
+  for (const path of [sourceDatabase, sourceOwnerToken, sourceManifest]) {
+    if (!await exists(path)) {
+      throw new Error(`Relay backup is missing ${basename(path)}`);
+    }
+  }
+  await Promise.all([
+    verifyBackupMember(sourceDatabase),
+    verifyBackupMember(sourceOwnerToken, 1024),
+    verifyBackupMember(sourceManifest, 16384)
+  ]);
+  const target = relayDataDirectory();
+  if (await exists(target)) {
+    throw new Error(`Relay data directory already exists: ${target}. Restore into a new COHALL_DATA_DIR.`);
+  }
+  const parent = dirname4(target);
+  await mkdir4(parent, { recursive: true, mode: 448 });
+  const staging = await mkdtemp2(join5(parent, `.${basename(target)}.restore-`));
+  let backupVersion = "";
+  try {
+    await chmod5(staging, 448);
+    const databasePath = join5(staging, "cohall.db");
+    const ownerTokenPath = join5(staging, "owner-token");
+    const manifestPath = join5(staging, "migration-manifest.json");
+    await Promise.all([
+      copyFile(sourceDatabase, databasePath),
+      copyFile(sourceOwnerToken, ownerTokenPath),
+      copyFile(sourceManifest, manifestPath)
+    ]);
+    await Promise.all([
+      chmod5(databasePath, 384),
+      chmod5(ownerTokenPath, 384),
+      chmod5(manifestPath, 384)
+    ]);
+    const manifest = await readManifest(manifestPath);
+    if (await digest(databasePath) !== manifest.databaseSha256 || await digest(ownerTokenPath) !== manifest.ownerTokenSha256) {
+      throw new Error("Relay backup checksum verification failed");
+    }
+    verifyDatabase(databasePath);
+    const token = (await readFile3(ownerTokenPath, "utf8")).trim();
+    if (token.length < 32 || new TextEncoder().encode(token).byteLength > 512) {
+      throw new Error("Relay backup contains an invalid owner token");
+    }
+    backupVersion = manifest.cohallVersion;
+    await rename3(staging, target);
+  } catch (cause) {
+    await rm3(staging, { recursive: true, force: true });
+    throw cause;
+  }
+  return {
+    restored: true,
+    data_directory: target,
+    backup_version: backupVersion,
+    next: "Start the relay at its new address, then run `cohall relay use <new-url>` on each client and device."
+  };
+};
+var websocketUrl = (relayUrl) => {
+  const url = new URL(relayUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  url.pathname = "/ws/device";
+  return url.toString();
+};
+var isLoopback = (url) => url.hostname === "localhost" || url.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(url.hostname);
+var verifyClientCredential = async (relayUrl, token) => {
+  await Effect6.runPromise(exports_src.make({ baseUrl: relayUrl, token }).devices());
+};
+var verifyDeviceCredential = (relayUrl, token) => new Promise((resolvePromise, reject) => {
+  const socket = new WebSocket(websocketUrl(relayUrl), {
+    handshakeTimeout: 1e4,
+    maxPayload: 1024 * 1024,
+    perMessageDeflate: false
+  });
+  let settled = false;
+  const finish = (error) => {
+    if (settled) {
+      return;
+    }
+    settled = true;
+    clearTimeout(timeout);
+    socket.terminate();
+    if (error === undefined) {
+      resolvePromise();
+      return;
+    }
+    reject(error);
+  };
+  const timeout = setTimeout(() => finish(new Error("Timed out while verifying the device credential")), 1e4);
+  socket.once("open", () => {
+    socket.send(JSON.stringify(SocketEvent.make({ _tag: "Authenticate", token })));
+  });
+  socket.on("message", (data) => {
+    try {
+      const event = Schema7.decodeUnknownSync(SocketEvent)(JSON.parse(data.toString()));
+      if (event._tag === "Connected") {
+        finish();
+      } else if (event._tag === "Error") {
+        finish(new Error(event.message));
+      }
+    } catch (cause) {
+      finish(new Error(`New relay returned an invalid device response: ${String(cause)}`));
+    }
+  });
+  socket.once("error", (cause) => finish(cause));
+  socket.once("close", () => finish(new Error("New relay rejected the stored device credential")));
+});
+var switchRelay = async (options) => {
+  if (process.env.COHALL_RELAY_URL !== undefined) {
+    throw new Error("Unset COHALL_RELAY_URL before changing the stored relay URL");
+  }
+  const configuration = await readStoredConfiguration();
+  if (configuration === undefined) {
+    throw new Error("This user has no stored Cohall configuration");
+  }
+  const relayUrl = normalizeRelayUrl(options.relayUrl);
+  const parsedRelayUrl = new URL(relayUrl);
+  if (parsedRelayUrl.protocol === "http:" && !isLoopback(parsedRelayUrl) && options.allowHttp !== true) {
+    throw new Error("Refusing to send stored credentials over remote HTTP. Use HTTPS, or --allow-http only on an independently encrypted private network.");
+  }
+  const clientTokens = [configuration.clientToken, process.env.COHALL_CLIENT_TOKEN].filter((token) => token !== undefined);
+  const deviceTokens = [configuration.deviceToken, process.env.COHALL_DEVICE_TOKEN].filter((token) => token !== undefined);
+  if (clientTokens.length === 0 && deviceTokens.length === 0) {
+    throw new Error("This configuration has no client or device credentials to verify");
+  }
+  const roles = [];
+  if (clientTokens.length > 0) {
+    for (const token of new Set(clientTokens)) {
+      await (options.verifyClient ?? verifyClientCredential)(relayUrl, token);
+    }
+    roles.push("client");
+  }
+  if (deviceTokens.length > 0) {
+    for (const token of new Set(deviceTokens)) {
+      await (options.verifyDevice ?? verifyDeviceCredential)(relayUrl, token);
+    }
+    roles.push("device");
+  }
+  const updated = configuration.relayUrl !== relayUrl;
+  if (updated) {
+    await writeStoredConfiguration(StoredConfiguration.make({ ...configuration, relayUrl }));
+  }
+  let service = { running: false, restarted: false };
+  let warning;
+  if (updated && options.restart && deviceTokens.length > 0) {
+    service = await (options.restartService ?? restartDeviceService)().catch((cause) => {
+      warning = `Relay URL changed, but the device service could not restart: ${cause instanceof Error ? cause.message : String(cause)}`;
+      return { running: true, restarted: false };
+    });
+  }
+  return {
+    updated,
+    relay_url: relayUrl,
+    verified_roles: roles,
+    service,
+    ...warning === undefined ? {} : { warning }
+  };
+};
+
 // apps/device/src/cli.ts
 var valueOptions = new Set([
   "context",
@@ -3308,7 +4306,16 @@ var valueOptions = new Set([
   "to",
   "workspace"
 ]);
-var flagOptions = new Set(["client-only", "dry-run", "follow", "no-restart", "no-wait"]);
+var flagOptions = new Set([
+  "all",
+  "allow-http",
+  "client-only",
+  "dry-run",
+  "follow",
+  "no-restart",
+  "no-wait",
+  "service"
+]);
 var aliases = new Map([
   ["-c", "context"],
   ["-p", "prompt"],
@@ -3319,6 +4326,7 @@ var aliases = new Map([
 var help = `Cohall connects agents running on your own devices.
 
 Usage:
+  cohall init [--relay url] [--workspace path] [--providers list] [--service]
   cohall join --relay <url> --workspace <path> [--providers list] [--token-file <path>]
   cohall configure [--relay url] [--name name] [--workspace path]
                    [--providers codex,opencode|auto] [--model id]
@@ -3336,10 +4344,18 @@ Usage:
   cohall sessions
   cohall revoke <session-id>
   cohall forget <device-id>
-  cohall doctor
+  cohall doctor [--all]
+  cohall versions
+  cohall usage
   cohall upgrade [--to version|latest] [--no-restart] [--dry-run]
+  cohall upgrade --all [--to version|latest] [--no-restart] [--dry-run]
+  cohall upgrades [abandon <operation-id>]
+  cohall service install
   cohall device
   cohall relay
+  cohall relay backup <directory>
+  cohall relay restore <directory>
+  cohall relay use <url> [--no-restart] [--allow-http]
   cohall mcp
   cohall skill [install [agents|claude|opencode|all]]
   cohall integrations
@@ -3434,13 +4450,13 @@ var readInput = async (arguments_, name) => {
     throw new Error(`Use either --${name} or --${name}-file, not both`);
   }
   if (path !== undefined) {
-    if (!await access3(path).then(() => true).catch(() => false)) {
+    if (!await access4(path).then(() => true).catch(() => false)) {
       throw new Error(`File does not exist: ${path}`);
     }
-    if ((await stat2(path)).size > 131072) {
+    if ((await stat3(path)).size > 131072) {
       throw new Error(`${name} file exceeds 128 KiB`);
     }
-    return readFile3(path, "utf8");
+    return readFile4(path, "utf8");
   }
   const result = direct === "-" ? await readStdin(131072, name) : direct;
   if (result !== undefined && result.length > 131072) {
@@ -3470,27 +4486,27 @@ var timeout = (arguments_) => {
 };
 var pairingToken = async (arguments_) => {
   const path = option(arguments_, "token-file");
-  if (path !== undefined && !await access3(path).then(() => true).catch(() => false)) {
+  if (path !== undefined && !await access4(path).then(() => true).catch(() => false)) {
     throw new Error(`Pairing token file does not exist: ${path}`);
   }
-  if (path !== undefined && (await stat2(path)).size > 512) {
+  if (path !== undefined && (await stat3(path)).size > 512) {
     throw new Error("Pairing token file exceeds 512 bytes");
   }
-  const token = (path === undefined ? await readStdin(512, "Pairing token") : await readFile3(path, "utf8")).trim();
+  const token = (path === undefined ? await readStdin(512, "Pairing token") : await readFile4(path, "utf8")).trim();
   if (token.length === 0 || new TextEncoder().encode(token).byteLength > 256) {
     throw new Error("Provide a pairing token on stdin or with --token-file");
   }
   return token;
 };
 var client = async () => {
-  const configuration = await Effect5.runPromise(loadClientConfiguration);
+  const configuration = await Effect7.runPromise(loadClientConfiguration);
   return {
     configuration,
     relay: exports_src.make({ baseUrl: configuration.relayUrl, token: configuration.token })
   };
 };
 var ownerClient = async () => {
-  const configuration = await Effect5.runPromise(loadOwnerConfiguration);
+  const configuration = await Effect7.runPromise(loadOwnerConfiguration);
   return {
     configuration,
     relay: exports_src.make({ baseUrl: configuration.relayUrl, token: configuration.token })
@@ -3498,17 +4514,17 @@ var ownerClient = async () => {
 };
 var installSkill = async (target) => {
   const roots = {
-    agents: join4(homedir3(), ".agents", "skills", "cohall", "SKILL.md"),
-    claude: join4(homedir3(), ".claude", "skills", "cohall", "SKILL.md"),
-    opencode: join4(homedir3(), ".config", "opencode", "skills", "cohall", "SKILL.md")
+    agents: join6(homedir4(), ".agents", "skills", "cohall", "SKILL.md"),
+    claude: join6(homedir4(), ".claude", "skills", "cohall", "SKILL.md"),
+    opencode: join6(homedir4(), ".config", "opencode", "skills", "cohall", "SKILL.md")
   };
   const selected = target === "all" ? Object.values(roots) : (target in roots) ? [roots[target]] : undefined;
   if (selected === undefined) {
     throw new Error("Skill target must be agents, claude, opencode, or all");
   }
   for (const path of selected) {
-    await mkdir3(dirname3(path), { recursive: true });
-    await writeFile4(path, SKILL_default);
+    await mkdir5(dirname5(path), { recursive: true });
+    await writeFile6(path, SKILL_default);
   }
   return selected;
 };
@@ -3516,10 +4532,150 @@ var printHelp = () => console.log(help);
 var printSkill = () => console.log(SKILL_default.trimEnd());
 var runCli = async (command, raw) => {
   const arguments_ = parseArguments(raw);
+  if (command === "init") {
+    allowOptions(arguments_, [
+      "client-only",
+      "name",
+      "providers",
+      "relay",
+      "service",
+      "token-file",
+      "workspace"
+    ]);
+    noPositionals(arguments_, command);
+    const token = option(arguments_, "token-file") === undefined ? undefined : await pairingToken(arguments_);
+    const interactive = process.stdin.isTTY === true && process.stderr.isTTY === true;
+    const relayUrl = option(arguments_, "relay");
+    const deviceName = option(arguments_, "name");
+    const providerInput = option(arguments_, "providers");
+    const prompter = interactive ? terminalPrompter() : {
+      answer: (_label, fallback) => Promise.resolve(fallback),
+      secret: () => pairingToken(arguments_),
+      close: () => {
+        return;
+      }
+    };
+    try {
+      const input = await guidedSetupInput({
+        clientOnly: arguments_.options.has("client-only"),
+        workspaces: values(arguments_, "workspace"),
+        cwd: process.cwd(),
+        ...relayUrl === undefined ? {} : { relayUrl },
+        ...token === undefined ? {} : { token },
+        ...deviceName === undefined ? {} : { deviceName },
+        ...providerInput === undefined ? {} : { providers: providerInput }
+      }, prompter);
+      const providers = input.providers === "auto" ? "auto" : parseProviders(input.providers);
+      const existing = await readStoredConfiguration();
+      const result = input.reusedConfiguration ? {
+        configuration: await makeStoredConfiguration({
+          relayUrl: input.relayUrl,
+          ...input.deviceName === undefined ? {} : { deviceName: input.deviceName },
+          workspaces: input.workspaces,
+          providers
+        }),
+        roles: [
+          ...existing?.clientToken === undefined ? [] : ["client"],
+          ...arguments_.options.has("client-only") || existing?.deviceToken === undefined ? [] : ["device"]
+        ]
+      } : await joinRelay({
+        relayUrl: input.relayUrl,
+        token: input.token ?? "",
+        clientOnly: arguments_.options.has("client-only"),
+        ...input.deviceName === undefined ? {} : { deviceName: input.deviceName },
+        workspaces: input.workspaces,
+        providers
+      });
+      if (input.reusedConfiguration) {
+        await writeStoredConfiguration(result.configuration);
+      }
+      const installedSkills = await installSkill("all");
+      const service = arguments_.options.has("service") ? await installDeviceService() : undefined;
+      print({
+        initialized: true,
+        reused_configuration: input.reusedConfiguration,
+        config_path: configurationPath(),
+        relay_url: result.configuration.relayUrl,
+        device_id: result.configuration.deviceId,
+        roles: result.roles,
+        workspaces: result.configuration.workspaces,
+        skills: installedSkills,
+        ...service === undefined ? {} : { service },
+        next: service === undefined && !arguments_.options.has("client-only") ? "Run `cohall service install` for background availability, or `cohall device` now." : "Run `cohall doctor` to verify this device."
+      });
+    } finally {
+      prompter.close();
+    }
+    return;
+  }
+  if (command === "service") {
+    allowOptions(arguments_, []);
+    if (arguments_.positionals.length !== 1 || arguments_.positionals[0] !== "install") {
+      throw new Error("Usage: cohall service install");
+    }
+    print(await installDeviceService());
+    return;
+  }
+  if (command === "relay") {
+    const action = arguments_.positionals[0];
+    if (action === "backup") {
+      allowOptions(arguments_, []);
+      if (arguments_.positionals.length !== 2) {
+        throw new Error("Usage: cohall relay backup <directory>");
+      }
+      print(await backupRelay(arguments_.positionals[1] ?? ""));
+      return;
+    }
+    if (action === "restore") {
+      allowOptions(arguments_, []);
+      if (arguments_.positionals.length !== 2) {
+        throw new Error("Usage: cohall relay restore <directory>");
+      }
+      print(await restoreRelay(arguments_.positionals[1] ?? ""));
+      return;
+    }
+    if (action === "use") {
+      allowOptions(arguments_, ["allow-http", "no-restart"]);
+      if (arguments_.positionals.length !== 2) {
+        throw new Error("Usage: cohall relay use <url> [--no-restart] [--allow-http]");
+      }
+      print(await switchRelay({
+        relayUrl: arguments_.positionals[1] ?? "",
+        restart: !arguments_.options.has("no-restart"),
+        allowHttp: arguments_.options.has("allow-http")
+      }));
+      return;
+    }
+    throw new Error("Usage: cohall relay [backup <directory>|restore <directory>|use <url> [--no-restart] [--allow-http]]");
+  }
   if (command === "upgrade") {
-    allowOptions(arguments_, ["dry-run", "no-restart", "to"]);
+    allowOptions(arguments_, ["all", "dry-run", "no-restart", "to"]);
     noPositionals(arguments_, command);
     const target = option(arguments_, "to");
+    if (arguments_.options.has("all")) {
+      const normalizedTarget = normalizeUpgradeTarget(target);
+      const { relay: relay2 } = await ownerClient();
+      const restart = !arguments_.options.has("no-restart");
+      if (arguments_.options.has("dry-run")) {
+        const devices = await Effect7.runPromise(relay2.devices());
+        print({
+          dry_run: true,
+          requested_version: normalizedTarget,
+          restart,
+          devices: devices.map((device) => ({ id: device.id, name: device.name }))
+        });
+        return;
+      }
+      const operations = await Effect7.runPromise(relay2.createUpgradeOperations({ target: normalizedTarget, restart }));
+      print({
+        queued: operations.length,
+        requested_version: normalizedTarget,
+        restart,
+        operations,
+        next: "Run `cohall upgrades` to inspect progress."
+      });
+      return;
+    }
     print(await upgrade({
       currentVersion: version,
       ...target === undefined ? {} : { target },
@@ -3529,6 +4685,19 @@ var runCli = async (command, raw) => {
     }));
     return;
   }
+  if (command === "upgrades") {
+    allowOptions(arguments_, []);
+    const { relay: relay2 } = await ownerClient();
+    if (arguments_.positionals.length > 0) {
+      if (arguments_.positionals.length !== 2 || arguments_.positionals[0] !== "abandon") {
+        throw new Error("Usage: cohall upgrades [abandon <operation-id>]");
+      }
+      print(await Effect7.runPromise(relay2.abandonOperation(Schema8.decodeUnknownSync(OperationId)(arguments_.positionals[1]))));
+      return;
+    }
+    print(await Effect7.runPromise(relay2.operations()));
+    return;
+  }
   if (command === "join") {
     allowOptions(arguments_, [
       "client-only",
@@ -3550,41 +4719,21 @@ var runCli = async (command, raw) => {
     if (!arguments_.options.has("client-only") && (workspaces?.length ?? 0) === 0) {
       throw new Error("At least one --workspace is required when joining a device");
     }
-    const draft = await makeStoredConfiguration({
+    const clientOnly = arguments_.options.has("client-only");
+    const { configuration: configuration2, roles } = await joinRelay({
       relayUrl,
+      token,
+      clientOnly,
       ...deviceName === undefined ? {} : { deviceName },
       ...workspaces === undefined ? {} : { workspaces },
       ...providers === undefined ? {} : { providers }
     });
-    const paired = await Effect5.runPromise(exchangePairing(relayUrl, { token }));
-    const clientToken = paired.credentials.find((credential) => credential.session.role === "client")?.token;
-    const deviceToken = paired.credentials.find((credential) => credential.session.role === "device")?.token;
-    const deviceId = paired.credentials.find((credential) => credential.session.role === "device")?.session.deviceId;
-    const clientOnly = arguments_.options.has("client-only");
-    if (clientOnly && clientToken === undefined) {
-      throw new Error("The pairing credential did not include client access");
-    }
-    if (!clientOnly && deviceToken === undefined) {
-      throw new Error("The pairing credential did not include device access");
-    }
-    const {
-      clientToken: _retainedClientToken,
-      deviceToken: _retainedDeviceToken,
-      ...configurationDraft
-    } = draft;
-    const configuration2 = StoredConfiguration.make({
-      ...configurationDraft,
-      deviceId: clientOnly ? configurationDraft.deviceId : deviceId ?? configurationDraft.deviceId,
-      ...clientToken === undefined ? {} : { clientToken },
-      ...clientOnly || deviceToken === undefined ? {} : { deviceToken }
-    });
-    await writeStoredConfiguration(configuration2);
     print({
       configured: true,
       config_path: configurationPath(),
       relay_url: configuration2.relayUrl,
       device_id: configuration2.deviceId,
-      roles: clientOnly ? paired.credentials.map((credential) => credential.session.role).filter((role) => role === "client") : paired.credentials.map((credential) => credential.session.role),
+      roles,
       workspaces: configuration2.workspaces
     });
     return;
@@ -3616,7 +4765,7 @@ var runCli = async (command, raw) => {
     const existing = await readStoredConfiguration();
     const relayUrl = normalizeRelayUrl(option(arguments_, "relay") ?? existing?.relayUrl ?? "http://127.0.0.1:8787");
     const supplied = values(arguments_, "workspace");
-    const workspaces = supplied.length === 0 ? existing?.workspaces ?? [] : await Effect5.runPromise(parseWorkspaces("", JSON.stringify(supplied)));
+    const workspaces = supplied.length === 0 ? existing?.workspaces ?? [] : await Effect7.runPromise(parseWorkspaces("", JSON.stringify(supplied)));
     const sandbox = option(arguments_, "sandbox");
     const model = option(arguments_, "model") ?? existing?.model;
     const providerInput = option(arguments_, "providers");
@@ -3631,7 +4780,7 @@ var runCli = async (command, raw) => {
       ...providers === undefined ? {} : { providers },
       ...model === undefined ? {} : { model },
       ...(sandbox ?? existing?.sandbox) === undefined ? {} : {
-        sandbox: Schema7.decodeUnknownSync(Schema7.Literals(["read-only", "workspace-write", "danger-full-access"]))(sandbox ?? existing?.sandbox)
+        sandbox: Schema8.decodeUnknownSync(Schema8.Literals(["read-only", "workspace-write", "danger-full-access"]))(sandbox ?? existing?.sandbox)
       }
     });
     await writeStoredConfiguration(configuration2);
@@ -3670,8 +4819,13 @@ var runCli = async (command, raw) => {
     return;
   }
   if (command === "doctor") {
-    allowOptions(arguments_, []);
+    allowOptions(arguments_, ["all"]);
     noPositionals(arguments_, command);
+    if (arguments_.options.has("all")) {
+      const { relay: relay2 } = await client();
+      print(allDeviceHealth(await Effect7.runPromise(relay2.devices()), version));
+      return;
+    }
     const configuration2 = await readStoredConfiguration();
     const relayUrl = normalizeRelayUrl(process.env.COHALL_RELAY_URL ?? configuration2?.relayUrl ?? "http://127.0.0.1:8787");
     const storedCredentials = credentialsForRelay(configuration2, relayUrl);
@@ -3689,7 +4843,7 @@ var runCli = async (command, raw) => {
     const clientToken = process.env.COHALL_CLIENT_TOKEN ?? storedCredentials.clientToken;
     const hasDeviceCredential = process.env.COHALL_DEVICE_TOKEN !== undefined || storedCredentials.deviceToken !== undefined;
     const deviceId = process.env.COHALL_DEVICE_ID ?? configuration2?.deviceId;
-    const currentDevice = response?.ok !== true || clientToken === undefined || deviceId === undefined ? undefined : await Effect5.runPromise(exports_src.make({ baseUrl: relayUrl, token: clientToken }).devices()).then((devices) => devices.find((device) => device.id === deviceId)).catch(() => {
+    const currentDevice = response?.ok !== true || clientToken === undefined || deviceId === undefined ? undefined : await Effect7.runPromise(exports_src.make({ baseUrl: relayUrl, token: clientToken }).devices()).then((devices) => devices.find((device) => device.id === deviceId)).catch(() => {
       return;
     });
     const versionWarning = deviceVersionWarning(version, currentDevice?.version);
@@ -3718,13 +4872,30 @@ var runCli = async (command, raw) => {
     });
     return;
   }
+  if (command === "versions") {
+    allowOptions(arguments_, []);
+    noPositionals(arguments_, command);
+    const { relay: relay2 } = await client();
+    print(deviceVersions(await Effect7.runPromise(relay2.devices()), version));
+    return;
+  }
+  if (command === "usage") {
+    allowOptions(arguments_, []);
+    noPositionals(arguments_, command);
+    const { relay: relay2 } = await client();
+    print({
+      ...await Effect7.runPromise(relay2.usage()),
+      scope: "Retained Cohall task activity; provider token and billing usage are not available."
+    });
+    return;
+  }
   if (command === "pair" || command === "sessions" || command === "revoke" || command === "forget") {
     const { configuration: configuration2, relay: relay2 } = await ownerClient();
     if (command === "pair") {
       allowOptions(arguments_, ["client-only", "label"]);
       noPositionals(arguments_, command);
       const roles = arguments_.options.has("client-only") ? ["client"] : ["client", "device"];
-      const credential = await Effect5.runPromise(relay2.createPairing({ label: option(arguments_, "label") ?? "Cohall device", roles }));
+      const credential = await Effect7.runPromise(relay2.createPairing({ label: option(arguments_, "label") ?? "Cohall device", roles }));
       print({
         relay_url: configuration2.relayUrl,
         pairing_token: credential.token,
@@ -3736,23 +4907,23 @@ var runCli = async (command, raw) => {
     if (command === "sessions") {
       allowOptions(arguments_, []);
       noPositionals(arguments_, command);
-      print(await Effect5.runPromise(relay2.authSessions()));
+      print(await Effect7.runPromise(relay2.authSessions()));
       return;
     }
     if (command === "forget") {
       allowOptions(arguments_, []);
-      print(await Effect5.runPromise(relay2.forgetDevice(Schema7.decodeUnknownSync(DeviceId)(identifier(arguments_, "device id")))));
+      print(await Effect7.runPromise(relay2.forgetDevice(Schema8.decodeUnknownSync(DeviceId)(identifier(arguments_, "device id")))));
       return;
     }
     allowOptions(arguments_, []);
-    print(await Effect5.runPromise(relay2.revokeAuthSession(Schema7.decodeUnknownSync(AuthSessionId)(identifier(arguments_, "session id")))));
+    print(await Effect7.runPromise(relay2.revokeAuthSession(Schema8.decodeUnknownSync(AuthSessionId)(identifier(arguments_, "session id")))));
     return;
   }
   const { configuration, relay } = await client();
   if (command === "devices") {
     allowOptions(arguments_, []);
     noPositionals(arguments_, command);
-    print(await Effect5.runPromise(relay.devices()));
+    print(await Effect7.runPromise(relay.devices()));
     return;
   }
   if (command === "delegate") {
@@ -3784,50 +4955,50 @@ var runCli = async (command, raw) => {
     const thread = option(arguments_, "thread");
     const workspace = option(arguments_, "workspace");
     const provider = option(arguments_, "provider");
-    const task = await Effect5.runPromise(createDelegation(relay, configuration, {
+    const task = await Effect7.runPromise(createDelegation(relay, configuration, {
       prompt,
       ...target === undefined ? {} : { target },
       ...context === undefined ? {} : { context },
-      ...thread === undefined ? {} : { threadId: Schema7.decodeUnknownSync(ThreadId)(thread) },
+      ...thread === undefined ? {} : { threadId: Schema8.decodeUnknownSync(ThreadId)(thread) },
       ...workspace === undefined ? {} : { workspace },
-      ...provider === undefined ? {} : { provider: Schema7.decodeUnknownSync(Provider)(provider) }
+      ...provider === undefined ? {} : { provider: Schema8.decodeUnknownSync(Provider)(provider) }
     }));
-    print(taskResult(arguments_.options.has("no-wait") ? task : await Effect5.runPromise(waitForTask(relay, task, timeout(arguments_)))));
+    print(taskResult(arguments_.options.has("no-wait") ? task : await Effect7.runPromise(waitForTask(relay, task, timeout(arguments_)))));
     return;
   }
   if (command === "status") {
     allowOptions(arguments_, []);
-    const id = Schema7.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
-    print(taskResult(await Effect5.runPromise(relay.getTask(id))));
+    const id = Schema8.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
+    print(taskResult(await Effect7.runPromise(relay.getTask(id))));
     return;
   }
   if (command === "trace") {
     allowOptions(arguments_, ["follow"]);
-    const id = Schema7.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
+    const id = Schema8.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
     if (arguments_.options.has("follow")) {
-      await Effect5.runPromise(followTaskTrace(relay, id, printLine));
+      await Effect7.runPromise(followTaskTrace(relay, id, printLine));
       return;
     }
-    print(await Effect5.runPromise(relay.traceTask(id)));
+    print(await Effect7.runPromise(relay.traceTask(id)));
     return;
   }
   if (command === "wait") {
     allowOptions(arguments_, ["timeout"]);
-    const id = Schema7.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
-    const task = await Effect5.runPromise(relay.getTask(id));
-    print(taskResult(await Effect5.runPromise(waitForTask(relay, task, timeout(arguments_)))));
+    const id = Schema8.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
+    const task = await Effect7.runPromise(relay.getTask(id));
+    print(taskResult(await Effect7.runPromise(waitForTask(relay, task, timeout(arguments_)))));
     return;
   }
   if (command === "cancel") {
     allowOptions(arguments_, []);
-    const id = Schema7.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
-    print(taskResult(await Effect5.runPromise(relay.cancelTask(id))));
+    const id = Schema8.decodeUnknownSync(TaskId)(identifier(arguments_, "task id"));
+    print(taskResult(await Effect7.runPromise(relay.cancelTask(id))));
     return;
   }
   if (command === "thread") {
     allowOptions(arguments_, []);
-    const id = Schema7.decodeUnknownSync(ThreadId)(identifier(arguments_, "thread id"));
-    print(await Effect5.runPromise(threadContext(relay, id)));
+    const id = Schema8.decodeUnknownSync(ThreadId)(identifier(arguments_, "thread id"));
+    print(await Effect7.runPromise(threadContext(relay, id)));
     return;
   }
   throw new Error(`Unknown Cohall command: ${command}`);
@@ -3835,15 +5006,15 @@ var runCli = async (command, raw) => {
 
 // apps/device/src/daemon.ts
 init_src();
-import { Effect as Effect6, Schedule as Schedule2, Schema as Schema8 } from "effect";
+import { Effect as Effect8, Schedule as Schedule2, Schema as Schema9 } from "effect";
 import { constants as constants3 } from "node:fs";
-import { open, realpath as realpath3, stat as stat3 } from "node:fs/promises";
-import { arch, hostname as hostname2, platform as platform3 } from "node:os";
-import { basename, isAbsolute as isAbsolute3, relative } from "node:path";
-import { WebSocket } from "ws";
+import { open, realpath as realpath5, stat as stat4 } from "node:fs/promises";
+import { arch, hostname as hostname3, platform as platform3 } from "node:os";
+import { basename as basename2, isAbsolute as isAbsolute3, relative } from "node:path";
+import { WebSocket as WebSocket2 } from "ws";
 var maxQueuedRelayMessages = 8;
 
-class DeviceConnectionError extends Schema8.TaggedErrorClass()("Device.ConnectionError", { message: Schema8.String }) {
+class DeviceConnectionError extends Schema9.TaggedErrorClass()("Device.ConnectionError", { message: Schema9.String }) {
 }
 var socketUrl = (configuration) => {
   const url = new URL(configuration.relayUrl);
@@ -3887,7 +5058,7 @@ var describeDevice = (configuration, status = "online") => {
   return Device.make({
     id: configuration.id,
     name: configuration.name,
-    hostname: hostname2(),
+    hostname: hostname3(),
     platform: platformName,
     architecture: arch(),
     status,
@@ -3895,7 +5066,7 @@ var describeDevice = (configuration, status = "online") => {
     capabilities: capabilities(providers),
     workspaces: configuration.workspaces.map((path) => ({
       path,
-      label: basename(path) || path
+      label: basename2(path) || path
     })),
     version,
     lastSeenAt: now()
@@ -3906,7 +5077,7 @@ var allowedWorkspace = async (configuration, requested) => {
   if (selected === undefined) {
     throw new Error("No workspace is configured on this device");
   }
-  const candidate = await realpath3(selected);
+  const candidate = await realpath5(selected);
   const allowed = configuration.workspaces.some((root) => {
     const child = relative(root, candidate);
     return child === "" || !child.startsWith("..") && !isAbsolute3(child);
@@ -3926,7 +5097,7 @@ var openAllowedWorkspace = async (configuration, requested) => {
     await handle.close();
     throw new Error(`Workspace ${path} is not a directory`);
   }
-  const cwd = operatingSystem2 === "linux" ? `/proc/self/fd/${handle.fd}` : operatingSystem2 === "darwin" ? `/dev/fd/${handle.fd}` : path;
+  const cwd = operatingSystem2 === "linux" ? `/proc/self/fd/${handle.fd}` : path;
   return {
     cwd,
     validate: async () => {
@@ -3934,9 +5105,9 @@ var openAllowedWorkspace = async (configuration, requested) => {
       if (!current.isDirectory() || current.dev !== identity.dev || current.ino !== identity.ino) {
         throw new Error(`Workspace ${path} changed before provider startup`);
       }
-      if (operatingSystem2 === "win32") {
-        const currentPath = await realpath3(path);
-        const currentPathIdentity = await stat3(currentPath);
+      if (operatingSystem2 !== "linux") {
+        const currentPath = await realpath5(path);
+        const currentPathIdentity = await stat4(currentPath);
         if (currentPathIdentity.dev !== identity.dev || currentPathIdentity.ino !== identity.ino) {
           throw new Error(`Workspace ${path} changed before provider startup`);
         }
@@ -3962,14 +5133,21 @@ ${task.prompt}${context}`
 `);
 };
 var send = (state, event) => {
-  if (state.socket?.readyState === WebSocket.OPEN) {
+  if (state.socket?.readyState === WebSocket2.OPEN) {
     state.socket.send(JSON.stringify(event));
   }
 };
 var sendTerminal = (state, taskId, event) => {
   const payload = JSON.stringify(event);
   state.terminal.set(taskId, payload);
-  if (state.socket?.readyState === WebSocket.OPEN) {
+  if (state.socket?.readyState === WebSocket2.OPEN) {
+    state.socket.send(payload);
+  }
+};
+var sendOperationTerminal = (state, operationId, event) => {
+  const payload = JSON.stringify(event);
+  state.operationTerminal.set(operationId, payload);
+  if (state.socket?.readyState === WebSocket2.OPEN) {
     state.socket.send(payload);
   }
 };
@@ -3984,6 +5162,17 @@ var remember = (state, taskId) => {
     state.terminal.delete(oldest.value);
   }
 };
+var rememberOperation = (state, operationId) => {
+  state.completedOperations.add(operationId);
+  if (state.completedOperations.size <= 100) {
+    return;
+  }
+  const oldest = state.completedOperations.values().next();
+  if (!oldest.done) {
+    state.completedOperations.delete(oldest.value);
+    state.operationTerminal.delete(oldest.value);
+  }
+};
 var sessionKey = (task) => `${task.threadId}:${task.provider}`;
 var execute = (configuration, state, task) => {
   if (state.tasks.has(task.id) || state.completed.has(task.id)) {
@@ -3992,8 +5181,8 @@ var execute = (configuration, state, task) => {
   const controller = new AbortController;
   state.tasks.set(task.id, controller);
   send(state, SocketEvent.make({ _tag: "TaskAccepted", taskId: task.id }));
-  const workflow = Effect6.gen(function* () {
-    const workspace = yield* Effect6.tryPromise({
+  const workflow = Effect8.gen(function* () {
+    const workspace = yield* Effect8.tryPromise({
       try: () => openAllowedWorkspace(configuration, task.workspace),
       catch: (cause) => new ProviderRunError({
         provider: task.provider,
@@ -4010,11 +5199,11 @@ var execute = (configuration, state, task) => {
       ...sessionId === undefined ? {} : { sessionId },
       ...configuration.model === undefined ? {} : { model: configuration.model },
       ...configuration.sandbox === undefined ? {} : { sandbox: configuration.sandbox }
-    }).pipe(Effect6.ensuring(Effect6.promise(() => workspace.close().catch(() => {
+    }).pipe(Effect8.ensuring(Effect8.promise(() => workspace.close().catch(() => {
       return;
     }))));
   });
-  Effect6.runPromise(workflow, { signal: controller.signal }).then((result) => {
+  Effect8.runPromise(workflow, { signal: controller.signal }).then((result) => {
     if (result.sessionId !== undefined) {
       state.sessions.set(sessionKey(task), result.sessionId);
     }
@@ -4034,12 +5223,71 @@ var execute = (configuration, state, task) => {
     }));
   }).finally(() => {
     state.tasks.delete(task.id);
+    const operation = state.operationQueue.shift();
+    if (operation !== undefined) {
+      executeOperation(configuration, state, operation);
+      return;
+    }
+    const next = state.queue.shift();
+    if (next !== undefined && state.operation === undefined) {
+      execute(configuration, state, next);
+    }
+  });
+};
+var executeOperation = (configuration, state, operation) => {
+  if (state.operation !== undefined || state.completedOperations.has(operation.id)) {
+    return;
+  }
+  state.operation = operation;
+  send(state, SocketEvent.make({ _tag: "OperationAccepted", operationId: operation.id }));
+  performDeviceOperation(operation, version).then((result) => {
+    rememberOperation(state, operation.id);
+    sendOperationTerminal(state, operation.id, SocketEvent.make({
+      _tag: "OperationFinished",
+      operationId: operation.id,
+      result
+    }));
+  }).catch((cause) => {
+    rememberOperation(state, operation.id);
+    sendOperationTerminal(state, operation.id, SocketEvent.make({
+      _tag: "OperationFailed",
+      operationId: operation.id,
+      error: (cause instanceof Error ? cause.message : String(cause)).slice(0, 16384)
+    }));
+  }).finally(() => {
+    state.operation = undefined;
+    const pending = state.operationQueue.shift();
+    if (pending !== undefined) {
+      executeOperation(configuration, state, pending);
+      return;
+    }
     const next = state.queue.shift();
-    if (next !== undefined) {
+    if (next !== undefined && state.tasks.size === 0) {
       execute(configuration, state, next);
     }
   });
 };
+var scheduleOperation = (configuration, state, operation) => {
+  if (state.completedOperations.has(operation.id) || state.operation?.id === operation.id || state.operationQueue.some((pending) => pending.id === operation.id)) {
+    return;
+  }
+  if (state.tasks.size > 0 || state.operation !== undefined) {
+    if (state.operationQueue.length >= 10) {
+      state.socket?.close(4008, "Operation queue limit reached");
+      return;
+    }
+    state.operationQueue.push(operation);
+    return;
+  }
+  executeOperation(configuration, state, operation);
+};
+var performDeviceOperation = (operation, currentVersion, runUpgrade = upgrade) => runUpgrade({
+  currentVersion,
+  target: operation.requestedVersion,
+  restart: operation.restart,
+  dryRun: false,
+  delegated: true
+}).then((result) => JSON.stringify(result));
 var schedule = (configuration, state, task) => {
   if (state.tasks.has(task.id) || state.completed.has(task.id) || state.queue.some((queued) => queued.id === task.id)) {
     return;
@@ -4047,7 +5295,7 @@ var schedule = (configuration, state, task) => {
   if (task.providerSessionId !== undefined) {
     state.sessions.set(sessionKey(task), task.providerSessionId);
   }
-  if (state.tasks.size > 0) {
+  if (state.tasks.size > 0 || state.operation !== undefined) {
     if (state.queue.length >= 100) {
       state.socket?.close(4008, "Task queue limit reached");
       return;
@@ -4070,9 +5318,9 @@ var cancel = (state, taskId) => {
   remember(state, taskId);
   sendTerminal(state, taskId, SocketEvent.make({ _tag: "TaskCancelled", taskId }));
 };
-var connect = (configuration, state) => Effect6.tryPromise({
+var connect = (configuration, state) => Effect8.tryPromise({
   try: (signal) => new Promise((complete) => {
-    const socket = new WebSocket(socketUrl(configuration), {
+    const socket = new WebSocket2(socketUrl(configuration), {
       maxPayload: maxSocketPayloadBytes,
       perMessageDeflate: false
     });
@@ -4080,7 +5328,7 @@ var connect = (configuration, state) => Effect6.tryPromise({
       send(state, SocketEvent.make({
         _tag: "DeviceHeartbeat",
         deviceId: configuration.id,
-        status: state.tasks.size > 0 ? "busy" : "online"
+        status: state.tasks.size > 0 || state.operation !== undefined ? "busy" : "online"
       }));
     }, 15000);
     let closed = false;
@@ -4114,19 +5362,22 @@ var connect = (configuration, state) => Effect6.tryPromise({
           return;
         }
         const text2 = Buffer.isBuffer(message) ? message.toString("utf8") : message instanceof ArrayBuffer ? Buffer.from(message).toString("utf8") : Array.isArray(message) ? Buffer.concat(message).toString("utf8") : Buffer.from(message).toString("utf8");
-        const event = await Effect6.runPromise(Effect6.try({
+        const event = await Effect8.runPromise(Effect8.try({
           try: () => JSON.parse(text2),
           catch: () => new DeviceConnectionError({ message: "Relay sent invalid JSON" })
-        }).pipe(Effect6.flatMap(decodeSocketEvent)));
+        }).pipe(Effect8.flatMap(decodeSocketEvent)));
         if (event._tag === "Connected") {
           state.socket = socket;
           socket.send(JSON.stringify(SocketEvent.make({
             _tag: "DeviceHello",
-            device: describeDevice(configuration, state.tasks.size > 0 ? "busy" : "online")
+            device: describeDevice(configuration, state.tasks.size > 0 || state.operation !== undefined ? "busy" : "online")
           })));
           for (const payload of state.terminal.values()) {
             socket.send(payload);
           }
+          for (const payload of state.operationTerminal.values()) {
+            socket.send(payload);
+          }
           return;
         }
         if (event._tag === "TaskAssigned") {
@@ -4141,6 +5392,14 @@ var connect = (configuration, state) => Effect6.tryPromise({
           state.terminal.delete(event.taskId);
           return;
         }
+        if (event._tag === "OperationAssigned") {
+          scheduleOperation(configuration, state, event.operation);
+          return;
+        }
+        if (event._tag === "OperationSettled") {
+          state.operationTerminal.delete(event.operationId);
+          return;
+        }
         if (event._tag === "Error") {
           console.error(`Relay error: ${event.message}`);
         }
@@ -4165,9 +5424,13 @@ var runDaemon = (configuration) => {
     queue: [],
     sessions: new Map,
     tasks: new Map,
-    completed: new Set
+    completed: new Set,
+    operation: undefined,
+    operationQueue: [],
+    operationTerminal: new Map,
+    completedOperations: new Set
   };
-  return connect(configuration, state).pipe(Effect6.repeat({ schedule: Schedule2.spaced("2 seconds") }), Effect6.ensuring(Effect6.sync(() => {
+  return connect(configuration, state).pipe(Effect8.repeat({ schedule: Schedule2.spaced("2 seconds") }), Effect8.ensuring(Effect8.sync(() => {
     state.socket?.close();
     for (const controller of state.tasks.values()) {
       controller.abort();
@@ -4179,7 +5442,7 @@ var runDaemon = (configuration) => {
 init_src();
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { Effect as Effect7 } from "effect";
+import { Effect as Effect9 } from "effect";
 import * as z from "zod/v4";
 var output = (value) => ({
   content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
@@ -4194,7 +5457,7 @@ var runMcp = async (configuration) => {
     title: "List Cohall devices",
     description: "List devices, their availability, local providers, capabilities, and allowed workspaces.",
     inputSchema: {}
-  }, async () => output(await Effect7.runPromise(client2.devices())));
+  }, async () => output(await Effect9.runPromise(client2.devices())));
   server.registerTool("delegate", {
     title: "Delegate work to another device",
     description: "Send focused work to another Cohall device. When the request depends on the current conversation, distill its motivation, relevant facts, prior findings, constraints, and desired decision into context; Cohall cannot read the host transcript. Never forward unrelated transcript content. Reuse thread_id for related follow-ups.",
@@ -4209,7 +5472,7 @@ var runMcp = async (configuration) => {
       timeout_seconds: z.number().int().min(5).max(86400).default(900)
     }
   }, async ({ prompt, target, provider, context, thread_id, workspace, wait, timeout_seconds }) => {
-    const task = await Effect7.runPromise(createDelegation(client2, configuration, {
+    const task = await Effect9.runPromise(createDelegation(client2, configuration, {
       prompt,
       provider,
       ...target === undefined ? {} : { target },
@@ -4217,18 +5480,18 @@ var runMcp = async (configuration) => {
       ...thread_id === undefined ? {} : { threadId: ThreadId.make(thread_id) },
       ...workspace === undefined ? {} : { workspace }
     }));
-    return output(taskResult(wait ? await Effect7.runPromise(waitForTask(client2, task, timeout_seconds)) : task));
+    return output(taskResult(wait ? await Effect9.runPromise(waitForTask(client2, task, timeout_seconds)) : task));
   });
   server.registerTool("task_status", {
     title: "Get delegated task status",
     description: "Read the current state and result of a Cohall task.",
     inputSchema: { task_id: z.string().uuid() }
-  }, async ({ task_id }) => output(taskResult(await Effect7.runPromise(client2.getTask(TaskId.make(task_id))))));
+  }, async ({ task_id }) => output(taskResult(await Effect9.runPromise(client2.getTask(TaskId.make(task_id))))));
   server.registerTool("task_trace", {
     title: "Trace a delegated task",
     description: "Read the redacted relay and device lifecycle for troubleshooting a Cohall task.",
     inputSchema: { task_id: z.string().uuid() }
-  }, async ({ task_id }) => output(await Effect7.runPromise(client2.traceTask(TaskId.make(task_id)))));
+  }, async ({ task_id }) => output(await Effect9.runPromise(client2.traceTask(TaskId.make(task_id)))));
   server.registerTool("wait_task", {
     title: "Wait for delegated work",
     description: "Wait for a Cohall task to finish and return its final result.",
@@ -4237,19 +5500,19 @@ var runMcp = async (configuration) => {
       timeout_seconds: z.number().int().min(5).max(86400).default(900)
     }
   }, async ({ task_id, timeout_seconds }) => {
-    const task = await Effect7.runPromise(client2.getTask(TaskId.make(task_id)));
-    return output(taskResult(await Effect7.runPromise(waitForTask(client2, task, timeout_seconds))));
+    const task = await Effect9.runPromise(client2.getTask(TaskId.make(task_id)));
+    return output(taskResult(await Effect9.runPromise(waitForTask(client2, task, timeout_seconds))));
   });
   server.registerTool("cancel_task", {
     title: "Cancel delegated work",
     description: "Request cancellation and return its acknowledged or pending state.",
     inputSchema: { task_id: z.string().uuid() }
-  }, async ({ task_id }) => output(taskResult(await Effect7.runPromise(client2.cancelTask(TaskId.make(task_id))))));
+  }, async ({ task_id }) => output(taskResult(await Effect9.runPromise(client2.cancelTask(TaskId.make(task_id))))));
   server.registerTool("thread_context", {
     title: "Read a Cohall thread",
     description: "Read shared task prompts and final results for a cross-device thread.",
     inputSchema: { thread_id: z.string().uuid() }
-  }, async ({ thread_id }) => output(await Effect7.runPromise(threadContext(client2, ThreadId.make(thread_id)))));
+  }, async ({ thread_id }) => output(await Effect9.runPromise(threadContext(client2, ThreadId.make(thread_id)))));
   await server.connect(new StdioServerTransport);
 };
 
@@ -4269,21 +5532,21 @@ var main = async () => {
     printHelp();
     return;
   }
-  if (["device", "relay", "mcp"].includes(command) && process.argv.length > 3) {
+  if (["device", "mcp"].includes(command) && process.argv.length > 3) {
     throw new Error(`${command} does not accept arguments`);
   }
-  if (command === "relay") {
+  if (command === "relay" && commandArguments.length === 0) {
     const { runRelay: runRelay2 } = await init_main().then(() => exports_main);
     await runRelay2();
     return;
   }
   if (command === "device") {
-    const configuration = await Effect11.runPromise(loadDeviceConfiguration);
-    await Effect11.runPromise(runDaemon(configuration));
+    const configuration = await Effect13.runPromise(loadDeviceConfiguration);
+    await Effect13.runPromise(runDaemon(configuration));
     return;
   }
   if (command === "mcp") {
-    const configuration = await Effect11.runPromise(loadClientConfiguration);
+    const configuration = await Effect13.runPromise(loadClientConfiguration);
     await runMcp(configuration);
     return;
   }
@@ -4294,4 +5557,4 @@ await main().catch((cause) => {
   process.exitCode = 1;
 });
 
-//# debugId=1A046C86E8783E4364756E2164756E21
+//# debugId=42161A8EF448D66964756E2164756E21