@akshar5/cohall 0.6.1 → 0.6.2

package/bin/cohall.js

@@ -17,7 +17,7 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // packages/protocol/src/index.ts
 import { Effect, Schema } from "effect";
-var version = "0.6.1", maxSocketPayloadBytes, bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), count, uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
+var version = "0.6.2", maxSocketPayloadBytes, bounded = (maxLength) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(maxLength)), optionalText = (maxLength) => Schema.String.check(Schema.isMaxLength(maxLength)), boundedArray = (schema, maxLength) => Schema.Array(schema).check(Schema.isMaxLength(maxLength)), count, uuid = (name) => Schema.String.check(Schema.isUUID(4)).pipe(Schema.brand(name)), isoTimestamp = (name) => Schema.String.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/, {
   expected: "an ISO-8601 UTC timestamp"
 })).pipe(Schema.brand(name)), BotId, Bot, DeviceId, ThreadId, MessageId, TaskId, AuthSessionId, OperationId, Timestamp, Platform, Provider, DeviceStatus, TaskStatus, OperationStatus, TaskTraceEventKind, MessageRole, ConnectionRole, AuthSession, CreatePairingInput, PairingCredential, ExchangePairingInput, SessionCredential, PairingResult, Capability, Workspace, Device, minimumDeviceOperationVersion = "0.5.0", parsedVersion = (value) => {
   const match = /^v?(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
@@ -487,13 +487,15 @@ class Hub {
   hasDevice(deviceId) {
     return this.#devices.get(deviceId)?.readyState === WebSocket3.OPEN;
   }
-  sendToDevice(deviceId, event) {
+  sendToDevice(deviceId, event, beforeSend) {
     const socket = this.#devices.get(deviceId);
     if (socket?.readyState !== WebSocket3.OPEN || !this.isAuthorized(socket)) {
       return false;
     }
+    const payload = JSON.stringify(event);
+    beforeSend?.();
     try {
-      socket.send(JSON.stringify(event));
+      socket.send(payload);
       return true;
     } catch {
       return false;
@@ -1067,7 +1069,11 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     }
     return yield* deviceFromRow(row);
   });
-  const createDelegation2 = Effect13.fn("RelayStore.createDelegation")(function* (input, targetDeviceId, sourceDeviceId, providerSessionId) {
+  const createDelegation2 = Effect13.fn("RelayStore.createDelegation")(function* (input, targetDeviceId, boundDeviceId, providerSessionId) {
+    const sourceDeviceId = yield* Effect13.try({
+      try: () => boundDeviceId === undefined || db.query("SELECT id FROM devices WHERE id = ? AND forgotten_at IS NULL").get(boundDeviceId) === null ? undefined : boundDeviceId,
+      catch: operationError("RelayStore.createDelegation.source")
+    });
     const timestamp = now();
     const threadId = input.threadId ?? makeThreadId();
     const task = Task.make({
@@ -1207,7 +1213,15 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     const timestamp = now();
     yield* Effect13.try({
       try: () => db.transaction(() => {
-        const result = db.query(`UPDATE tasks SET status = 'assigned', updated_at = ?
+        const result = db.query(`UPDATE tasks SET status = 'assigned', updated_at = ?,
+                 provider_session_id = CASE
+                   WHEN provider = 'grok-bot' THEN NULL
+                   WHEN started_at IS NULL THEN COALESCE((
+                     SELECT session_id FROM provider_sessions
+                     WHERE thread_id = tasks.thread_id AND device_id = tasks.target_device_id
+                       AND provider = tasks.provider
+                   ), provider_session_id)
+                   ELSE provider_session_id END
                WHERE id = ? AND status = 'queued' AND NOT EXISTS (
                  SELECT 1 FROM tasks active
                  WHERE active.target_device_id = ? AND active.id <> ?
@@ -1278,7 +1292,11 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     if (["completed", "failed", "cancelled"].includes(current.status)) {
       return current;
     }
-    if (current.provider === "grok-bot" && current.status !== "queued") {
+    const dispatched = current.provider === "grok-bot" && (yield* Effect13.try({
+      try: () => db.query("SELECT 1 FROM tasks WHERE id = ? AND dispatched_at IS NOT NULL").get(taskId) !== null,
+      catch: operationError("RelayStore.requestCancellation")
+    }));
+    if (current.provider === "grok-bot" && (current.status !== "queued" || current.startedAt !== undefined || dispatched)) {
       return yield* new PersistenceError({
         operation: "RelayStore.requestCancellation",
         message: "Stop this bot in Grok Bot; its gateway cannot cancel an individual Cohall request"
@@ -1358,7 +1376,7 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
             created_at: timestamp,
             expires_at: expiresAt,
             last_seen_at: timestamp,
-            bound_device_id: role === "device" ? deviceId ?? null : null,
+            bound_device_id: deviceId ?? null,
             revoked_at: null
           };
           db.query(`INSERT INTO auth_sessions (
@@ -1432,6 +1450,12 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     threadContext: threadContext2,
     pendingTasksFor,
     assignTask,
+    markTaskDispatched: (taskId) => Effect13.try({
+      try: () => {
+        db.query("UPDATE tasks SET dispatched_at = COALESCE(dispatched_at, ?) WHERE id = ? AND status = 'assigned'").run(now(), taskId);
+      },
+      catch: operationError("RelayStore.markTaskDispatched")
+    }),
     rollbackAssignment: (taskId) => transition(taskId, ["assigned"], { status: "queued" }, { kind: "requeued", detail: "Target device was unavailable during dispatch" }),
     acceptTask: (taskId, deviceId) => requireTarget(taskId, deviceId).pipe(Effect13.flatMap(() => transition(taskId, ["assigned"], { status: "running", startedAt: now() }, { kind: "running", detail: "Target device accepted the task and started the provider" }))),
     finishTask: (taskId, deviceId, result, providerSessionId) => terminal(taskId, deviceId, "completed", result, undefined, providerSessionId),
@@ -1487,7 +1511,8 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
           source_device_id TEXT REFERENCES devices(id),
           target_device_id TEXT NOT NULL REFERENCES devices(id), parent_task_id TEXT,
           workspace TEXT, provider_session_id TEXT, result TEXT, error TEXT,
-          created_at TEXT NOT NULL, updated_at TEXT NOT NULL, started_at TEXT, completed_at TEXT
+          created_at TEXT NOT NULL, updated_at TEXT NOT NULL, started_at TEXT, completed_at TEXT,
+          dispatched_at TEXT
         );
         CREATE INDEX IF NOT EXISTS tasks_thread_created ON tasks(thread_id, created_at);
         CREATE INDEX IF NOT EXISTS tasks_target_status ON tasks(target_device_id, status);
@@ -1535,6 +1560,13 @@ var PersistenceError, Service2, operationError = (operation) => (cause) => new P
     if (!taskColumns.some((column) => column.name === "bot_id")) {
       db.exec("ALTER TABLE tasks ADD COLUMN bot_id TEXT");
     }
+    if (!taskColumns.some((column) => column.name === "dispatched_at")) {
+      db.transaction(() => {
+        db.exec("ALTER TABLE tasks ADD COLUMN dispatched_at TEXT");
+        db.exec(`UPDATE tasks SET dispatched_at = COALESCE(started_at, updated_at)
+            WHERE provider = 'grok-bot' AND status NOT IN ('completed', 'failed', 'cancelled')`);
+      })();
+    }
   },
   catch: operationError("RelayStore.migrate")
 }), layer2 = (path, retainedTerminalTasks = 1000) => Layer2.effect(Service2, Effect13.acquireRelease(Effect13.try({
@@ -1555,8 +1587,8 @@ var init_store = __esm(() => {
 var exports_main = {};
 __export(exports_main, {
   runRelay: () => runRelay,
-  relayListenOptions: () => relayListenOptions,
-  chooseDevice: () => chooseDevice
+  resolveDelegation: () => resolveDelegation,
+  relayListenOptions: () => relayListenOptions
 });
 import { Effect as Effect14, ManagedRuntime, Schema as Schema14 } from "effect";
 import { createHash as createHash3, timingSafeEqual } from "node:crypto";
@@ -1665,10 +1697,40 @@ Content-Length: 0\r
   const needsXcode = /\b(xcode|ios|macos|swiftui|app store)\b/.test(prompt);
   const needsBrowser = /\b(browser|chrome|youtube|twitter|logged[- ]?in|signed[- ]?in|x\.com)\b/.test(prompt);
   return (device.status === "offline" ? 0 : 100) + (input.workspace !== undefined && device.workspaces.some((workspace) => input.workspace === workspace.path || input.workspace?.startsWith(`${workspace.path}/`)) ? 80 : 0) + (needsXcode && device.capabilities.some((capability) => capability.id === "xcode") ? 60 : 0) + (needsBrowser && device.capabilities.some((capability) => capability.id === "browser-session") ? 40 : 0) + (sourceDeviceId === device.id ? -5 : 0);
-}, chooseDevice = (input, sourceDeviceId) => Effect14.gen(function* () {
+}, resolveDelegation = (input, sourceDeviceId) => Effect14.gen(function* () {
   const store = yield* exports_store.Service;
+  const ancestors = [];
+  const seen = new Set;
+  let nextParentId = input.parentTaskId;
+  while (nextParentId !== undefined && !seen.has(nextParentId)) {
+    const parentId = nextParentId;
+    seen.add(parentId);
+    const parent2 = yield* store.getTask(parentId).pipe(Effect14.catch((cause) => {
+      const missing = cause.message === `Unknown task ${parentId}`;
+      if (missing && ancestors.length > 0)
+        return Effect14.succeed(undefined);
+      return Effect14.fail(new RequestError({ status: missing ? 404 : 500, message: cause.message }));
+    }));
+    if (parent2 === undefined)
+      break;
+    ancestors.push(parent2);
+    nextParentId = parent2.parentTaskId;
+  }
+  const parent = ancestors[0];
+  if (parent !== undefined && input.threadId !== undefined && input.threadId !== parent.threadId) {
+    return yield* new RequestError({
+      status: 400,
+      message: "A child task must use its parent's thread"
+    });
+  }
+  const resolvedInput = parent === undefined ? input : { ...input, threadId: parent.threadId };
   const devices = yield* store.listDevices().pipe(Effect14.mapError((cause) => new RequestError({ status: 500, message: cause.message })));
   const provider = input.provider ?? (input.botId === undefined ? "codex" : "grok-bot");
+  const slot = taskSlot({
+    provider,
+    ...input.botId === undefined ? {} : { botId: input.botId }
+  });
+  const blocked = new Set(ancestors.filter((task) => !isTerminalTask(task) && taskSlot(task) === slot).map((task) => task.targetDeviceId));
   if (input.targetDeviceId !== undefined) {
     const target = devices.find((device) => device.id === input.targetDeviceId);
     if (target === undefined) {
@@ -1689,7 +1751,13 @@ Content-Length: 0\r
         message: `${target.name} does not advertise bot ${input.botId}; refresh the bot list`
       });
     }
-    return target.id;
+    if (blocked.has(target.id)) {
+      return yield* new RequestError({
+        status: 409,
+        message: `${target.name} cannot run this task while an unfinished parent occupies the same worker slot; select another device or bot`
+      });
+    }
+    return { input: resolvedInput, targetDeviceId: target.id };
   }
   const candidates = devices.filter((device) => device.providers.includes(provider) && (input.botId === undefined || device.bots?.some((bot) => bot.id === input.botId)));
   if (input.botId !== undefined && candidates.length > 1) {
@@ -1698,14 +1766,14 @@ Content-Length: 0\r
       message: `Bot ${input.botId} is advertised by more than one device; select a device`
     });
   }
-  const selected = candidates.sort((left, right) => scoreDevice(right, input, sourceDeviceId) - scoreDevice(left, input, sourceDeviceId))[0];
+  const selected = candidates.filter((device) => !blocked.has(device.id)).sort((left, right) => scoreDevice(right, input, sourceDeviceId) - scoreDevice(left, input, sourceDeviceId))[0];
   if (selected === undefined) {
     return yield* new RequestError({
       status: 409,
-      message: input.botId === undefined ? `No Cohall device advertises the ${provider} provider` : `No Cohall device advertises bot ${input.botId}; refresh the bot list`
+      message: candidates.length > 0 ? "No available delegation target avoids an unfinished parent's worker slot; select another device or bot" : input.botId === undefined ? `No Cohall device advertises the ${provider} provider` : `No Cohall device advertises bot ${input.botId}; refresh the bot list`
     });
   }
-  return selected.id;
+  return { input: resolvedInput, targetDeviceId: selected.id };
 }), runRelay = async () => {
   const configuration = await Effect14.runPromise(loadEnvironmentConfiguration);
   process.umask(63);
@@ -1741,20 +1809,15 @@ Content-Length: 0\r
     return authenticate(authorization.slice("Bearer ".length), "client");
   };
   const dispatch = async (task) => {
-    const assigned = await run2(Effect14.gen(function* () {
-      const store = yield* exports_store.Service;
-      return yield* store.assignTask(task.id);
-    }));
+    const store = await run2(exports_store.Service);
+    const assigned = await Effect14.runPromise(store.assignTask(task.id));
     if (assigned.status !== "assigned") {
       return assigned;
     }
-    if (hub.sendToDevice(assigned.targetDeviceId, SocketEvent.make({ _tag: "TaskAssigned", task: assigned }))) {
+    if (hub.sendToDevice(assigned.targetDeviceId, SocketEvent.make({ _tag: "TaskAssigned", task: assigned }), assigned.provider === "grok-bot" ? () => Effect14.runSync(store.markTaskDispatched(assigned.id)) : undefined)) {
       return assigned;
     }
-    return run2(Effect14.gen(function* () {
-      const store = yield* exports_store.Service;
-      return yield* store.rollbackAssignment(task.id);
-    }));
+    return Effect14.runPromise(store.rollbackAssignment(task.id));
   };
   const dispatchOperation = async (operation) => {
     const assigned = await run2(Effect14.gen(function* () {
@@ -2009,8 +2072,7 @@ Content-Length: 0\r
         return json(forgotten);
       }
       if (url.pathname === "/api/tasks" && request.method === "POST") {
-        const input = yield* body(request, decodeCreateTaskInput);
-        const target = yield* chooseDevice(input, sourceDeviceId);
+        const { input, targetDeviceId: target } = yield* resolveDelegation(yield* body(request, decodeCreateTaskInput), sourceDeviceId);
         const providerSessionId = input.threadId === undefined || input.provider === "grok-bot" ? undefined : yield* store.sessionFor(input.threadId, target, input.provider ?? "codex");
         const task2 = yield* store.createDelegation(input, target, sourceDeviceId, providerSessionId);
         return json(yield* Effect14.tryPromise(() => dispatch(task2)), 201);
@@ -2051,6 +2113,7 @@ Content-Length: 0\r
   });
   websocketServer.on("connection", (rawSocket) => {
     const socket = rawSocket;
+    socket.on("error", () => socket.terminate());
     socket.data = {
       processing: Promise.resolve(),
       stageDeadline: undefined,
@@ -2127,7 +2190,11 @@ Content-Length: 0\r
     }).then((response) => sendResponse(outgoing, response)).catch((cause) => sendResponse(outgoing, json({ error: cause instanceof Error ? cause.message : "Invalid request" }, cause instanceof Error && cause.message.includes("256 KiB") ? 413 : 400)));
   });
   server.on("upgrade", (request, socket, head) => {
-    const url = new URL(request.url ?? "/", "http://cohall.local");
+    const url = URL.parse(request.url ?? "/", "http://cohall.local");
+    if (url === null) {
+      rejectUpgrade(socket, 400, "Bad Request");
+      return;
+    }
     if (url.pathname !== "/ws/device") {
       rejectUpgrade(socket, 404, "Not Found");
       return;
@@ -2343,11 +2410,12 @@ init_src();
 // packages/providers/src/index.ts
 init_src();
 import { Effect as Effect3, Schema as Schema3 } from "effect";
+import { execa } from "execa";
 import { accessSync, constants } from "node:fs";
 import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { homedir, platform, tmpdir } from "node:os";
 import { delimiter, extname, isAbsolute, join } from "node:path";
-import { execFile, spawn } from "node:child_process";
+import { execFile } from "node:child_process";
 
 class ProviderUnavailableError extends Schema3.TaggedErrorClass()("CohallProvider.Unavailable", { provider: Provider, message: Schema3.String }) {
 }
@@ -2364,7 +2432,10 @@ var executables = {
   opencode: "opencode"
 };
 var providerEnvironment = () => ({
-  ...Object.fromEntries(Object.entries(process.env).filter(([name]) => !name.startsWith("COHALL_") || name === "COHALL_CONFIG")),
+  ...Object.fromEntries(Object.entries(process.env).filter(([name]) => {
+    const key = platform() === "win32" ? name.toUpperCase() : name;
+    return !key.startsWith("COHALL_") || key === "COHALL_CONFIG";
+  })),
   PATH: executableDirectories().join(delimiter)
 });
 var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : undefined;
@@ -2708,8 +2779,8 @@ var terminateProcessTree = async (pid) => {
   process.kill(-pid, "SIGKILL");
   await waitForProcessGroup(pid, 1000);
 };
-var run = (options) => Effect3.tryPromise({
-  try: async (signal) => {
+var run = (options) => Effect3.callback((resume, signal) => {
+  const running = (async () => {
     const executable = findExecutable(executables[options.provider]);
     if (executable === undefined) {
       throw new ProviderUnavailableError({
@@ -2720,8 +2791,9 @@ var run = (options) => Effect3.tryPromise({
     const prepared = await prepareCommand(options);
     try {
       await options.beforeSpawn?.();
+      signal.throwIfAborted();
       const [, ...arguments_] = prepared.command;
-      const child = spawn(executable, arguments_, {
+      const child = execa(executable, arguments_, {
         cwd: options.cwd,
         env: {
           ...providerEnvironment(),
@@ -2729,12 +2801,22 @@ var run = (options) => Effect3.tryPromise({
           COHALL_THREAD_ID: options.threadId,
           ...options.taskId === undefined ? {} : { COHALL_TASK_ID: options.taskId }
         },
+        extendEnv: false,
         detached: platform() !== "win32",
-        stdio: ["pipe", "pipe", "pipe"]
+        stdin: "pipe",
+        stdout: "pipe",
+        stderr: "pipe",
+        buffer: false,
+        reject: false,
+        cleanup: false
       });
-      const exited = new Promise((resolve, reject) => {
-        child.once("error", reject);
-        child.once("exit", (code) => resolve(code ?? 1));
+      let finished = false;
+      const exited = child.then(({ exitCode, failed, originalMessage, shortMessage }) => {
+        finished = true;
+        if (failed && exitCode === undefined) {
+          throw new Error(originalMessage ?? shortMessage ?? "Provider failed to start");
+        }
+        return exitCode ?? 1;
       });
       let termination;
       const terminate = () => {
@@ -2749,12 +2831,16 @@ var run = (options) => Effect3.tryPromise({
       if (signal.aborted) {
         terminate();
       }
-      child.stdin.end(prepared.input);
       try {
+        const written = new Promise((resolve, reject) => {
+          child.stdin.once("error", reject);
+          child.stdin.end(prepared.input, (cause) => cause === undefined || cause === null ? resolve() : reject(cause));
+        });
         const [result, stderr, exitCode] = await Promise.all([
           parse(options, child.stdout, terminate),
           captureText(child.stderr, 64 * 1024),
-          exited
+          exited,
+          written
         ]);
         if (exitCode !== 0) {
           throw new ProviderRunError({
@@ -2778,7 +2864,7 @@ var run = (options) => Effect3.tryPromise({
         return result;
       } finally {
         signal.removeEventListener("abort", terminate);
-        if (child.exitCode === null) {
+        if (!finished) {
           terminate();
           await exited.catch(() => {
             return;
@@ -2789,21 +2875,21 @@ var run = (options) => Effect3.tryPromise({
     } finally {
       await prepared.cleanup();
     }
-  },
-  catch: (cause) => {
-    if (cause instanceof ProviderUnavailableError || cause instanceof ProviderRunError) {
-      return cause;
-    }
-    return new ProviderRunError({
-      provider: options.provider,
-      message: (cause instanceof Error ? cause.message : String(cause)).slice(0, 16384)
-    });
-  }
+  })();
+  running.then((result) => resume(Effect3.succeed(result)), (cause) => resume(Effect3.fail(cause instanceof ProviderUnavailableError || cause instanceof ProviderRunError ? cause : new ProviderRunError({
+    provider: options.provider,
+    message: (cause instanceof Error ? cause.message : String(cause)).slice(0, 16384)
+  }))));
+  return Effect3.promise(() => running.then(() => {
+    return;
+  }, () => {
+    return;
+  }));
 });
 
 // apps/device/src/cli.ts
 import { Effect as Effect9, Schema as Schema10 } from "effect";
-import { access as access4, mkdir as mkdir6, readFile as readFile4, stat as stat3, writeFile as writeFile6 } from "node:fs/promises";
+import { access as access4, mkdir as mkdir6, readFile as readFile4, stat as stat4, writeFile as writeFile6 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import { dirname as dirname6, join as join7, resolve as resolve3 } from "node:path";
 
@@ -3013,7 +3099,7 @@ Return the diagnostic failure to the user rather than claiming remote work ran.
 // apps/device/src/config.ts
 init_src();
 import { Effect as Effect4, Schema as Schema4 } from "effect";
-import { access, chmod as chmod2, mkdir, readFile, realpath, rename, writeFile as writeFile2 } from "node:fs/promises";
+import { access, chmod as chmod2, mkdir, readFile, realpath, rename, stat, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2, hostname, platform as platform2 } from "node:os";
 import { dirname, join as join2, resolve } from "node:path";
 var WorkspaceList = Schema4.Array(Schema4.NonEmptyString).check(Schema4.isMaxLength(64));
@@ -3086,10 +3172,16 @@ var normalizeRelayUrl = (input) => {
 var parseWorkspaces = (workspaceList, workspaceJson) => Effect4.tryPromise({
   try: async () => {
     const values = workspaceJson === undefined ? workspaceList.split(",").map((workspace) => workspace.trim()).filter((workspace) => workspace.length > 0) : Schema4.decodeUnknownSync(WorkspaceList)(JSON.parse(workspaceJson));
-    const canonical = await Promise.all(values.map((workspace) => realpath(resolve(workspace))));
+    const canonical = await Promise.all(values.map(async (workspace) => {
+      const path = await realpath(resolve(workspace));
+      if (!(await stat(path)).isDirectory()) {
+        throw new Error(`Not a directory: ${workspace}`);
+      }
+      return path;
+    }));
     return [...new Set(canonical)];
   },
-  catch: (cause) => new Error(`Workspace roots must be existing paths; JSON input must be an array of paths: ${cause instanceof Error ? cause.message : String(cause)}`)
+  catch: (cause) => new Error(`Workspace roots must be existing directories; JSON input must be an array of paths: ${cause instanceof Error ? cause.message : String(cause)}`)
 });
 var parseProviders = (input) => Schema4.decodeUnknownSync(ProviderList)([
   ...new Set(input.split(",").map((provider) => provider.trim()).filter(Boolean))
@@ -4013,7 +4105,7 @@ import {
   realpath as realpath4,
   rename as rename3,
   rm as rm3,
-  stat as stat2,
+  stat as stat3,
   writeFile as writeFile5
 } from "node:fs/promises";
 import { basename, dirname as dirname5, join as join6, resolve as resolve2 } from "node:path";
@@ -4021,14 +4113,14 @@ import { backup as sqliteBackup, DatabaseSync } from "node:sqlite";
 import { WebSocket } from "ws";
 
 // apps/device/src/service.ts
-import { execFile as execFile3 } from "node:child_process";
+import { execFile as execFile2 } from "node:child_process";
 import { chmod as chmod5, mkdir as mkdir4, realpath as realpath3, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import { dirname as dirname4, join as join5 } from "node:path";
 
 // apps/device/src/upgrade.ts
 import { Schema as Schema8 } from "effect";
-import { execFile as execFile2 } from "node:child_process";
+import { execa as execa2 } from "execa";
 import { constants as constants2 } from "node:fs";
 import {
   access as access2,
@@ -4038,7 +4130,7 @@ import {
   realpath as realpath2,
   rename as rename2,
   rm as rm2,
-  stat,
+  stat as stat2,
   writeFile as writeFile3
 } from "node:fs/promises";
 import { delimiter as delimiter2, dirname as dirname3, extname as extname2, isAbsolute as isAbsolute2, join as join4, relative } from "node:path";
@@ -4139,7 +4231,7 @@ var validateExecutable = async (candidate, installationRoot) => {
   const uid = process.getuid?.();
   const writableRoot = installationRoot === undefined ? undefined : await realpath2(installationRoot);
   for (let path = canonical;; path = dirname3(path)) {
-    const metadata = await stat(path);
+    const metadata = await stat2(path);
     const trustedGroupWritablePath = isTrustedGroupWritablePath({
       platform: operatingSystem(),
       canonical,
@@ -4285,16 +4377,23 @@ var serviceCandidates = (runtimePlatform, uid) => {
   return [];
 };
 var defaultRunner = {
-  run: (command, arguments_, timeoutMs = 300000) => new Promise((resolve2) => {
-    execFile2(command, [...arguments_], { encoding: "utf8", maxBuffer: 1024 * 1024, timeout: timeoutMs, windowsHide: true }, (error, stdout, stderr) => {
-      resolve2({
-        exitCode: typeof error?.code === "number" ? error.code : error === null ? 0 : 1,
-        stdout,
-        stderr,
-        ...error === null ? {} : { error: error.message }
-      });
+  run: async (command, arguments_, timeoutMs = 300000) => {
+    const result = await execa2(command, arguments_, {
+      encoding: "utf8",
+      maxBuffer: 1024 * 1024,
+      timeout: timeoutMs,
+      windowsHide: true,
+      stdin: "ignore",
+      reject: false,
+      stripFinalNewline: false
     });
-  })
+    return {
+      exitCode: result.failed ? result.exitCode || 1 : 0,
+      stdout: result.stdout,
+      stderr: result.stderr,
+      ...result.shortMessage === undefined ? {} : { error: result.shortMessage.slice(0, 16384) }
+    };
+  }
 };
 var checked = async (runner, invocation, timeoutMs) => {
   const result = await runner.run(invocation.command, invocation.arguments, timeoutMs);
@@ -4530,8 +4629,20 @@ var upgrade = async (options) => {
 
 // apps/device/src/service.ts
 var xml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-var systemdArgument = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"")}"`;
+var systemdArgument = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"").replaceAll("%", "%%").replaceAll(`
+`, "\\n").replaceAll("\r", "\\r")}"`;
 var deviceServicePlan = (options) => {
+  const servicePath = [
+    dirname4(options.nodeExecutable),
+    join5(options.home, ".local", "bin"),
+    join5(options.home, ".npm-global", "bin"),
+    join5(options.home, ".bun", "bin"),
+    options.platform === "darwin" ? join5(options.home, "Library", "pnpm") : join5(options.home, ".local", "share", "pnpm"),
+    ...options.platform === "darwin" ? ["/opt/homebrew/bin"] : [],
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin"
+  ].join(":");
   if (options.platform === "linux") {
     const path = join5(options.home, ".config", "systemd", "user", "cohall-device.service");
     return {
@@ -4545,7 +4656,8 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-Environment=PATH=%h/.local/bin:%h/.npm-global/bin:%h/.bun/bin:%h/.local/share/pnpm:/usr/local/bin:/usr/bin:/bin
+Environment=${systemdArgument(`PATH=${servicePath}`)}
+Environment=${systemdArgument(`COHALL_CONFIG=${options.configPath}`)}
 ExecStart=${systemdArgument(options.entrypoint)} device
 Restart=always
 RestartSec=3
@@ -4559,7 +4671,8 @@ WantedBy=default.target
       },
       commands: [
         { command: "systemctl", arguments: ["--user", "daemon-reload"] },
-        { command: "systemctl", arguments: ["--user", "enable", "--now", "cohall-device.service"] }
+        { command: "systemctl", arguments: ["--user", "enable", "cohall-device.service"] },
+        { command: "systemctl", arguments: ["--user", "restart", "cohall-device.service"] }
       ],
       note: "The device starts after login. Run loginctl enable-linger $USER if it must run before login."
     };
@@ -4586,7 +4699,9 @@ WantedBy=default.target
   <key>EnvironmentVariables</key>
   <dict>
     <key>PATH</key>
-    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+    <string>${xml(servicePath)}</string>
+    <key>COHALL_CONFIG</key>
+    <string>${xml(options.configPath)}</string>
   </dict>
   <key>RunAtLoad</key>
   <true/>
@@ -4618,7 +4733,7 @@ var defaultRunner2 = {
   run: async (command, arguments_, timeoutMs = 60000) => {
     const executable = await trustedExecutable(command);
     return new Promise((resolve2) => {
-      execFile3(executable, [...arguments_], { encoding: "utf8", maxBuffer: 1024 * 1024, timeout: timeoutMs, windowsHide: true }, (error, stdout, stderr) => resolve2({
+      execFile2(executable, [...arguments_], { encoding: "utf8", maxBuffer: 1024 * 1024, timeout: timeoutMs, windowsHide: true }, (error, stdout, stderr) => resolve2({
         exitCode: typeof error?.code === "number" ? error.code : error === null ? 0 : 1,
         stdout,
         stderr,
@@ -4646,7 +4761,13 @@ var installDeviceService = async (options = {}) => {
       "-ExecutionPolicy",
       "Bypass",
       "-File",
-      script
+      script,
+      "-NodeExecutable",
+      process.execPath,
+      "-Entrypoint",
+      entrypoint,
+      "-ConfigurationPath",
+      configurationPath()
     ]);
     return { installed: "scheduled-task:Cohall Device" };
   }
@@ -4655,6 +4776,8 @@ var installDeviceService = async (options = {}) => {
     platform: platform4,
     entrypoint,
     home: options.home ?? homedir3(),
+    nodeExecutable: process.execPath,
+    configPath: configurationPath(),
     ...uid === undefined ? {} : { uid }
   });
   await mkdir4(dirname4(plan.file.path), { recursive: true, mode: 448 });
@@ -4738,7 +4861,7 @@ var verifyBackupDestinationParent = async (path) => {
     return;
   }
   for (let current = await realpath4(path);; current = dirname5(current)) {
-    const metadata = await stat2(current);
+    const metadata = await stat3(current);
     const writableByOthers = (metadata.mode & 18) !== 0;
     const sticky = (metadata.mode & 512) !== 0;
     if (writableByOthers && !sticky) {
@@ -4759,7 +4882,7 @@ var ownerToken = async (dataDirectory) => {
   if (!await exists(path)) {
     throw new Error(`Relay owner token was not found at ${path}`);
   }
-  if ((await stat2(path)).size > 512) {
+  if ((await stat3(path)).size > 512) {
     throw new Error("Relay owner token file exceeds 512 bytes");
   }
   return (await readFile3(path, "utf8")).trim();
@@ -5165,7 +5288,7 @@ var readInput = async (arguments_, name) => {
     if (!await access4(path).then(() => true).catch(() => false)) {
       throw new Error(`File does not exist: ${path}`);
     }
-    if ((await stat3(path)).size > byteLimit) {
+    if ((await stat4(path)).size > byteLimit) {
       throw new Error(`${name} file exceeds ${byteLimit / 1024} KiB`);
     }
   }
@@ -5200,7 +5323,7 @@ var pairingToken = async (arguments_) => {
   if (path !== undefined && !await access4(path).then(() => true).catch(() => false)) {
     throw new Error(`Pairing token file does not exist: ${path}`);
   }
-  if (path !== undefined && (await stat3(path)).size > 512) {
+  if (path !== undefined && (await stat4(path)).size > 512) {
     throw new Error("Pairing token file exceeds 512 bytes");
   }
   const token = (path === undefined ? await readStdin(512, "Pairing token") : await readFile4(path, "utf8")).trim();
@@ -5698,6 +5821,7 @@ var runCli = async (command, raw) => {
       "timeout",
       "workspace"
     ]);
+    const waitSeconds = timeout(arguments_);
     const positionalTarget = command === "send" && arguments_.positionals[0]?.startsWith("@") ? arguments_.positionals[0] : undefined;
     const positionals = positionalTarget === undefined ? arguments_.positionals : arguments_.positionals.slice(1);
     if (positionalTarget !== undefined && option(arguments_, "target") !== undefined) {
@@ -5729,7 +5853,7 @@ var runCli = async (command, raw) => {
       ...workspace === undefined ? {} : { workspace },
       ...provider === undefined ? {} : { provider: Schema10.decodeUnknownSync(Provider)(provider) }
     }));
-    print(taskResult(arguments_.options.has("no-wait") ? task : await Effect9.runPromise(waitForTask(relay, task, timeout(arguments_)))));
+    print(taskResult(arguments_.options.has("no-wait") ? task : await Effect9.runPromise(waitForTask(relay, task, waitSeconds))));
     return;
   }
   if (command === "status") {
@@ -5774,7 +5898,7 @@ var runCli = async (command, raw) => {
 init_src();
 import { Effect as Effect10, Schedule as Schedule3, Schema as Schema11 } from "effect";
 import { constants as constants3 } from "node:fs";
-import { open as open3, realpath as realpath5, stat as stat4 } from "node:fs/promises";
+import { open as open3, realpath as realpath5, stat as stat5 } from "node:fs/promises";
 import { arch, hostname as hostname3, platform as platform4 } from "node:os";
 import { basename as basename2, isAbsolute as isAbsolute3, relative as relative2 } from "node:path";
 import { WebSocket as WebSocket2 } from "ws";
@@ -5879,7 +6003,7 @@ var openAllowedWorkspace = async (configuration, requested) => {
       }
       if (operatingSystem2 !== "linux") {
         const currentPath = await realpath5(path);
-        const currentPathIdentity = await stat4(currentPath);
+        const currentPathIdentity = await stat5(currentPath);
         if (currentPathIdentity.dev !== identity.dev || currentPathIdentity.ino !== identity.ino) {
           throw new Error(`Workspace ${path} changed before provider startup`);
         }
@@ -6390,4 +6514,4 @@ await main().catch((cause) => {
   process.exitCode = 1;
 });
 
-//# debugId=78963F23872A4D6564756E2164756E21
+//# debugId=B9C02E5590F539C264756E2164756E21