@p4code/cli 0.0.48 → 0.0.50

package/dist/bin.mjs

@@ -55,6 +55,7 @@ import * as Exit from "effect/Exit";
 import * as SchemaGetter from "effect/SchemaGetter";
 import * as Config from "effect/Config";
 import * as NodeReadline from "node:readline";
+import * as Clock from "effect/Clock";
 import * as Cache from "effect/Cache";
 import * as Deferred from "effect/Deferred";
 import * as Equal from "effect/Equal";
@@ -62,7 +63,6 @@ import * as Semaphore from "effect/Semaphore";
 import * as Scope from "effect/Scope";
 import { parse } from "yaml";
 import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
-import * as Clock from "effect/Clock";
 import * as Metric from "effect/Metric";
 import * as Queue from "effect/Queue";
 import { cast, dual } from "effect/Function";
@@ -121,7 +121,7 @@ const closeServer = (server) => {
 * NetService - Service tag for startup networking helpers.
 */
 var NetService = class extends Context.Service()("@p4code/shared/Net/NetService") {};
-const make$71 = () => {
+const make$72 = () => {
 	/**
 	* Returns true when a TCP server can bind to {host, port}.
 	* `EADDRNOTAVAIL` is treated as available so IPv6-absent hosts don't fail
@@ -230,10 +230,10 @@ const make$71 = () => {
 		})
 	};
 };
-const layer$67 = Layer.sync(NetService, make$71);
+const layer$68 = Layer.sync(NetService, make$72);
 //#endregion
 //#region package.json
-var version = "0.0.48";
+var version = "0.0.50";
 //#endregion
 //#region src/config.ts
 /**
@@ -254,8 +254,8 @@ var ServerConfig$1 = class extends Context.Service()("@p4code/cli/config/ServerC
 	/** @deprecated Import and use `layerTest` from this module. */
 	static layerTest = (cwd, baseDirOrPrefix) => layerTest$2(cwd, baseDirOrPrefix);
 };
-const make$70 = (config) => ServerConfig$1.of(config);
-const layer$66 = (config) => Layer.succeed(ServerConfig$1, make$70(config));
+const make$71 = (config) => ServerConfig$1.of(config);
+const layer$67 = (config) => Layer.succeed(ServerConfig$1, make$71(config));
 const deriveServerPaths = Effect.fn(function* (baseDir, devUrl, options = {}) {
 	const { join } = yield* Path.Path;
 	const stateDir = join(baseDir, devUrl !== void 0 && !options.baseDirIsExplicit ? "dev" : "userdata");
@@ -869,7 +869,7 @@ function compareSemverVersions(left, right) {
 * timeout, every failure swallowed, and never anything that changes an exit
 * code. A version check that can break a command is worse than no check.
 */
-const PACKAGE_NAME = "@p4code/cli";
+const PACKAGE_NAME$1 = "@p4code/cli";
 const CHECK_INTERVAL = Duration.hours(24);
 const REQUEST_TIMEOUT = Duration.seconds(3);
 /**
@@ -889,7 +889,7 @@ const encodeCacheEntry = Schema$1.encodeEffect(CacheEntryJson);
 const NpmLatest = Schema$1.Struct({ version: Schema$1.optional(Schema$1.String) });
 const fetchLatestVersion = Effect.fn("cli.updateCheck.fetch")(function* () {
 	const client = yield* HttpClient.HttpClient;
-	const request = HttpClientRequest.get(`https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME)}/latest`).pipe(HttpClientRequest.setHeader("accept", "application/json"));
+	const request = HttpClientRequest.get(`https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME$1)}/latest`).pipe(HttpClientRequest.setHeader("accept", "application/json"));
 	const response = yield* client.execute(request).pipe(Effect.timeout(REQUEST_TIMEOUT));
 	if (response.status < 200 || response.status >= 300) return null;
 	const version = (yield* response.json.pipe(Effect.flatMap(Schema$1.decodeUnknownEffect(NpmLatest)))).version?.trim();
@@ -923,7 +923,7 @@ const resolveLatestVersion = Effect.fn("cli.updateCheck.resolve")(function* (sta
 * `service update` restarts it onto the new one.
 */
 function formatUpdateReminder(input) {
-	return [`Update available: ${PACKAGE_NAME}@${input.latestVersion} (running ${input.currentVersion}).`, `  npm i -g ${PACKAGE_NAME}@latest && p4c service update`].join("\n");
+	return [`Update available: ${PACKAGE_NAME$1}@${input.latestVersion} (running ${input.currentVersion}).`, `  npm i -g ${PACKAGE_NAME$1}@latest && p4c service update`].join("\n");
 }
 /**
 * The reminder line, or null when there is nothing to say. Callers print it;
@@ -8736,7 +8736,7 @@ function deriveAuthClientMetadata(input) {
 //#endregion
 //#region src/auth/EnvironmentAuthPolicy.ts
 var EnvironmentAuthPolicy = class extends Context.Service()("@p4code/cli/auth/EnvironmentAuthPolicy") {};
-const make$69 = Effect.gen(function* () {
+const make$70 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const isRemoteReachable = isRemoteReachableHost(config.host);
 	const policy = config.mode === "desktop" ? isRemoteReachable ? "remote-reachable" : "desktop-managed-local" : isRemoteReachable ? "remote-reachable" : "loopback-browser";
@@ -8754,7 +8754,7 @@ const make$69 = Effect.gen(function* () {
 	};
 	return EnvironmentAuthPolicy.of({ getDescriptor: () => Effect.succeed(descriptor).pipe(Effect.withSpan("EnvironmentAuthPolicy.getDescriptor")) });
 });
-const layer$65 = Layer.effect(EnvironmentAuthPolicy, make$69);
+const layer$66 = Layer.effect(EnvironmentAuthPolicy, make$70);
 //#endregion
 //#region src/persistence/Errors.ts
 function summarizeSchemaIssue(issue) {
@@ -8935,7 +8935,7 @@ function toPersistenceSqlOrDecodeError$6(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$68 = Effect.gen(function* () {
+const make$69 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createSessionRow = SqlSchema.void({
 		Request: CreateAuthSessionInput,
@@ -9069,7 +9069,7 @@ const make$68 = Effect.gen(function* () {
 		setLastConnectedAt
 	};
 });
-const layer$64 = Layer.effect(AuthSessionRepository, make$68);
+const layer$65 = Layer.effect(AuthSessionRepository, make$69);
 //#endregion
 //#region src/auth/ServerSecretStore.ts
 const secretStoreErrorContext = {
@@ -9136,7 +9136,7 @@ const isSecretStoreError = Schema$1.is(SecretStoreError);
 const isPlatformError = (value) => Predicate.isTagged(value, "PlatformError");
 const isSecretAlreadyExistsError = (error) => "cause" in error && isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists";
 var ServerSecretStore = class extends Context.Service()("@p4code/cli/auth/ServerSecretStore") {};
-const make$67 = Effect.gen(function* () {
+const make$68 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -9206,7 +9206,7 @@ const make$67 = Effect.gen(function* () {
 		remove
 	});
 });
-const layer$63 = Layer.effect(ServerSecretStore, make$67);
+const layer$64 = Layer.effect(ServerSecretStore, make$68);
 //#endregion
 //#region src/auth/SessionStore.ts
 var MalformedSessionTokenError = class extends Schema$1.TaggedErrorClass()("MalformedSessionTokenError", {}) {
@@ -9444,7 +9444,7 @@ function toAuthClientSession(input) {
 		current: false
 	};
 }
-const make$66 = Effect.gen(function* () {
+const make$67 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const serverConfig = yield* ServerConfig$1;
 	const secretStore = yield* ServerSecretStore;
@@ -9758,7 +9758,7 @@ const make$66 = Effect.gen(function* () {
 		markDisconnected
 	});
 });
-const layer$62 = Layer.effect(SessionStore, make$66).pipe(Layer.provideMerge(layer$64));
+const layer$63 = Layer.effect(SessionStore, make$67).pipe(Layer.provideMerge(layer$65));
 //#endregion
 //#region src/persistence/AuthPairingLinks.ts
 const AuthPairingLinkRecord = Schema$1.Struct({
@@ -9819,7 +9819,7 @@ function toPersistenceSqlOrDecodeError$5(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$65 = Effect.gen(function* () {
+const make$66 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createPairingLinkRow = SqlSchema.void({
 		Request: CreateAuthPairingLinkInput,
@@ -9954,7 +9954,7 @@ const make$65 = Effect.gen(function* () {
 		getByCredential
 	};
 });
-const layer$61 = Layer.effect(AuthPairingLinkRepository, make$65);
+const layer$62 = Layer.effect(AuthPairingLinkRepository, make$66);
 //#endregion
 //#region src/auth/PairingGrantStore.ts
 var UnknownBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnknownBootstrapCredentialError", {}) {
@@ -10049,7 +10049,7 @@ const DEV_STARTUP_TTL_HOURS = Duration.hours(24);
 const PAIRING_TOKEN_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 const PAIRING_TOKEN_LENGTH = 12;
 const PAIRING_TOKEN_REJECTION_LIMIT = Math.floor(256 / 32) * 32;
-const make$64 = Effect.gen(function* () {
+const make$65 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const config = yield* ServerConfig$1;
 	const pairingLinks = yield* AuthPairingLinkRepository;
@@ -10247,7 +10247,7 @@ const make$64 = Effect.gen(function* () {
 		consume
 	});
 });
-const layer$60 = Layer.effect(PairingGrantStore, make$64).pipe(Layer.provideMerge(layer$61));
+const layer$61 = Layer.effect(PairingGrantStore, make$65).pipe(Layer.provideMerge(layer$62));
 //#endregion
 //#region src/persistence/Migrations/001_OrchestrationEvents.ts
 var _001_OrchestrationEvents_default = Effect.gen(function* () {
@@ -12020,7 +12020,7 @@ function parseBearerToken(request) {
 	const token = header.slice(7).trim();
 	return token.length > 0 ? token : null;
 }
-const make$63 = Effect.gen(function* () {
+const make$64 = Effect.gen(function* () {
 	const policy = yield* EnvironmentAuthPolicy;
 	const bootstrapCredentials = yield* PairingGrantStore;
 	const sessions = yield* SessionStore;
@@ -12215,9 +12215,9 @@ const make$63 = Effect.gen(function* () {
 		issueStartupPairingUrl
 	});
 });
-const layer$59 = Layer.effect(EnvironmentAuth, make$63).pipe(Layer.provideMerge(layer$60), Layer.provideMerge(layer$62), Layer.provideMerge(layer$65));
-const storageLayer = Layer.mergeAll(layer$63, layerConfig);
-const runtimeLayer = layer$59.pipe(Layer.provideMerge(storageLayer));
+const layer$60 = Layer.effect(EnvironmentAuth, make$64).pipe(Layer.provideMerge(layer$61), Layer.provideMerge(layer$63), Layer.provideMerge(layer$66));
+const storageLayer = Layer.mergeAll(layer$64, layerConfig);
+const runtimeLayer = layer$60.pipe(Layer.provideMerge(storageLayer));
 //#endregion
 //#region src/cliAuthFormat.ts
 const newline = "\n";
@@ -12763,8 +12763,8 @@ const noBrowserFlag = Flag.boolean("no-browser").pipe(Flag.withDescription("Disa
 const bootstrapFdFlag = Flag.integer("bootstrap-fd").pipe(Flag.withSchema(Schema$1.Int), Flag.withDescription("Read one-time bootstrap secrets from the given file descriptor."), Flag.optional);
 const autoBootstrapProjectFromCwdFlag = Flag.boolean("auto-bootstrap-project-from-cwd").pipe(Flag.withDescription("Create a project for the current working directory on startup when missing."), Flag.optional);
 const logWebSocketEventsFlag = Flag.boolean("log-websocket-events").pipe(Flag.withDescription("Emit server-side logs for outbound WebSocket push traffic (equivalent to P4CODE_LOG_WS_EVENTS)."), Flag.withAlias("log-ws-events"), Flag.optional);
-const tailscaleServeFlag = Flag.boolean("tailscale-serve").pipe(Flag.withDescription("Configure Tailscale Serve to expose this backend over HTTPS on the Tailnet."), Flag.optional);
-const tailscaleServePortFlag = Flag.integer("tailscale-serve-port").pipe(Flag.withSchema(PortSchema), Flag.withDescription("HTTPS port for Tailscale Serve when --tailscale-serve is enabled."), Flag.optional);
+const tailscaleServeFlag$1 = Flag.boolean("tailscale-serve").pipe(Flag.withDescription("Configure Tailscale Serve to expose this backend over HTTPS on the Tailnet."), Flag.optional);
+const tailscaleServePortFlag$1 = Flag.integer("tailscale-serve-port").pipe(Flag.withSchema(PortSchema), Flag.withDescription("HTTPS port for Tailscale Serve when --tailscale-serve is enabled."), Flag.optional);
 const EnvServerConfig = Config.all({
 	logLevel: Config.logLevel("P4CODE_LOG_LEVEL").pipe(Config.withDefault("Info")),
 	traceMinLevel: Config.logLevel("P4CODE_TRACE_MIN_LEVEL").pipe(Config.withDefault("Info")),
@@ -12806,8 +12806,8 @@ const sharedServerCommandFlags = {
 	bootstrapFd: bootstrapFdFlag,
 	autoBootstrapProjectFromCwd: autoBootstrapProjectFromCwdFlag,
 	logWebSocketEvents: logWebSocketEventsFlag,
-	tailscaleServeEnabled: tailscaleServeFlag,
-	tailscaleServePort: tailscaleServePortFlag
+	tailscaleServeEnabled: tailscaleServeFlag$1,
+	tailscaleServePort: tailscaleServePortFlag$1
 };
 const authLocationFlags = sharedServerLocationFlags;
 const resolveOptionPrecedence = (...values) => Option.firstSomeOf(values);
@@ -12972,7 +12972,7 @@ const runWithEnvironmentAuth = (flags, run, options) => Effect.gen(function* ()
 	}
 	return yield* Effect.gen(function* () {
 		return yield* run(yield* EnvironmentAuth);
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const ttlFlag = Flag.string("ttl").pipe(Flag.withSchema(DurationFromString), Flag.withDescription("TTL, for example `5m`, `1h`, `30d`, or `15 minutes`."), Flag.optional);
 const jsonFlag = Flag.boolean("json").pipe(Flag.withDescription("Emit JSON instead of human-readable output."), Flag.withDefault(false));
@@ -13069,6 +13069,64 @@ const authCommand = Command.make("auth").pipe(Command.withDescription("Manage th
 * @module HubConfig
 */
 var HubConfig = class extends Context.Service()("@p4code/cli/hub/HubConfig") {};
+const FAILURE_WINDOW_MS = 6e4;
+const BLOCK_DURATION_MS = 6e4;
+const initialThrottleState = {
+	windowStartMillis: 0,
+	failures: 0,
+	blockedUntilMillis: 0
+};
+/** Whether a *failing* request should be refused outright rather than checked. */
+const isBlocked = (state, nowMillis) => nowMillis < state.blockedUntilMillis;
+/** Seconds a caller should wait, for `retry-after`. Always at least one. */
+const retryAfterSeconds = (state, nowMillis) => Math.max(1, Math.ceil((state.blockedUntilMillis - nowMillis) / 1e3));
+/**
+* Count a failure, and start blocking once the window fills.
+*
+* The window is fixed rather than sliding: a sliding window needs the timestamp
+* of every attempt, which is unbounded memory for an unbounded attacker. A
+* fixed window lets a burst straddle a boundary and land up to twice the limit,
+* which for this purpose is a rounding error against the size of the search
+* space.
+*/
+const recordFailure = (state, nowMillis, limits = {
+	maxFailures: 10,
+	windowMillis: FAILURE_WINDOW_MS,
+	blockMillis: BLOCK_DURATION_MS
+}) => {
+	if (nowMillis - state.windowStartMillis >= limits.windowMillis) return {
+		windowStartMillis: nowMillis,
+		failures: 1,
+		blockedUntilMillis: 0
+	};
+	const failures = state.failures + 1;
+	return {
+		windowStartMillis: state.windowStartMillis,
+		failures,
+		blockedUntilMillis: failures >= limits.maxFailures ? nowMillis + limits.blockMillis : state.blockedUntilMillis
+	};
+};
+var HubAuthThrottle = class extends Context.Service()("@p4code/cli/hub/HubAuthThrottle") {};
+const DEFAULT_LIMITS = {
+	maxFailures: 10,
+	windowMillis: FAILURE_WINDOW_MS,
+	blockMillis: BLOCK_DURATION_MS
+};
+const make$63 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
+	const state = yield* Ref.make(initialThrottleState);
+	return HubAuthThrottle.of({
+		shouldRefuse: Effect.gen(function* () {
+			const now = yield* Clock.currentTimeMillis;
+			return isBlocked(yield* Ref.get(state), now);
+		}),
+		recordFailure: Effect.gen(function* () {
+			const now = yield* Clock.currentTimeMillis;
+			const next = yield* Ref.updateAndGet(state, (current) => recordFailure(current, now, limits));
+			return retryAfterSeconds(next, now);
+		})
+	});
+});
+const layer$59 = Layer.effect(HubAuthThrottle, make$63());
 //#endregion
 //#region src/hub/HubAuth.ts
 /**
@@ -13127,6 +13185,31 @@ var HubUnauthorizedError = class {
 	_tag = "HubUnauthorizedError";
 };
 /**
+* Too many failed attempts recently; this one was not even checked.
+*
+* Distinct from `HubUnauthorizedError` so the response can differ. A 429 is the
+* honest answer — the credential was not evaluated, so calling it invalid would
+* be a claim the hub did not make — and it tells a legitimate server retrying a
+* stale token to back off rather than hammer.
+*/
+var HubThrottledError = class {
+	_tag = "HubThrottledError";
+	retryAfterSeconds;
+	constructor(retryAfterSeconds) {
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+const hubThrottledResponse = (retryAfterSeconds) => HttpServerResponse.jsonUnsafe({
+	error: "too_many_hub_credential_failures",
+	message: "Too many failed credential attempts. Try again shortly."
+}, {
+	status: 429,
+	headers: {
+		"cache-control": "no-store",
+		"retry-after": String(retryAfterSeconds)
+	}
+});
+/**
 * Fails with {@link HubUnauthorizedError} unless the request carries a
 * configured bearer token. Route handlers run this first and let
 * `respondToHubAuthFailure` turn the failure into a 401.
@@ -13134,11 +13217,17 @@ var HubUnauthorizedError = class {
 const authenticateHubRequest = Effect.fn("HubAuth.authenticateHubRequest")(function* () {
 	const request = yield* HttpServerRequest.HttpServerRequest;
 	const { tokenHashes } = yield* HubConfig;
+	const throttle = yield* HubAuthThrottle;
 	const token = readBearerToken(request.headers.authorization);
-	if (!isAuthorizedHubToken(token, tokenHashes)) {
-		yield* Effect.logWarning("rejected hub request with an unusable credential", { reason: token.length === 0 ? "missing_bearer_token" : "unknown_token" });
-		return yield* Effect.fail(new HubUnauthorizedError());
+	if (isAuthorizedHubToken(token, tokenHashes)) return;
+	if (yield* throttle.shouldRefuse) {
+		const retryAfter = yield* throttle.recordFailure;
+		yield* Effect.logWarning("refused hub request without checking; too many recent failures", { reason: token.length === 0 ? "missing_bearer_token" : "unknown_token" });
+		return yield* Effect.fail(new HubThrottledError(retryAfter));
 	}
+	yield* throttle.recordFailure;
+	yield* Effect.logWarning("rejected hub request with an unusable credential", { reason: token.length === 0 ? "missing_bearer_token" : "unknown_token" });
+	return yield* Effect.fail(new HubUnauthorizedError());
 });
 const SHA256_HEX = /^[0-9a-f]{64}$/;
 /**
@@ -13547,6 +13636,7 @@ const storeUnavailable = HttpServerResponse.jsonUnsafe({
 */
 const respondToHubFailures = (handler) => handler.pipe(Effect.catch((cause) => {
 	if (cause._tag === "HubUnauthorizedError") return Effect.succeed(hubUnauthorizedResponse);
+	if (cause._tag === "HubThrottledError") return Effect.succeed(hubThrottledResponse(cause.retryAfterSeconds));
 	if (cause._tag === "InvalidHubRequest") return Effect.succeed(badRequest(cause.detail));
 	return Effect.logWarning("hub request failed", { cause }).pipe(Effect.as(storeUnavailable));
 }));
@@ -13942,7 +14032,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 	});
 	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
-const makeHubLayer = HttpRouter.serve(layer$58).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
+const makeHubLayer = HttpRouter.serve(layer$58).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$59), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
 //#endregion
 //#region src/atomicWrite.ts
@@ -16126,7 +16216,7 @@ const make$58 = Effect.gen(function* () {
 const layer$53 = Layer.effect(AssetSync, make$58);
 //#endregion
 //#region src/cli/assets.ts
-const SyncServicesLive = layer$53.pipe(Layer.provideMerge(layer$54), Layer.provideMerge(layer$55), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$63))), Layer.provideMerge(layer$63), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$53.pipe(Layer.provideMerge(layer$54), Layer.provideMerge(layer$55), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$64))), Layer.provideMerge(layer$64), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -16134,7 +16224,7 @@ const runWithSync = (flags, run) => Effect.gen(function* () {
 			sync: yield* AssetSync,
 			link: yield* HubLink
 		});
-	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
+	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
 });
 const STATE_LABEL = {
 	synced: "synced",
@@ -24098,6 +24188,92 @@ const removePinnedRuntimeInstallation = Effect.fn("cloud.pinned_runtime.remove")
 		cause
 	}))));
 });
+//#endregion
+//#region src/service/serviceOptions.ts
+/**
+* The options a supervised server keeps between installs.
+*
+* The unit file is generated, not edited: `p4c service update` rewrites it on
+* every upgrade. So anything configured by hand in it — a bind host, Tailscale
+* Serve — disappears at the next update, silently, weeks after the person who
+* added it has forgotten it was there. That is a worse failure than not
+* supporting the option at all, because the machine works until it does not.
+*
+* These options are therefore stored beside the server's other state and read
+* back when the unit is rendered. `install`, `update` and `status` all go
+* through the same path, so an option set once survives every later upgrade,
+* and `status` notices when the file and the unit disagree — which is what
+* makes `update` rewrite the unit after an option changes.
+*
+* @module service/serviceOptions
+*/
+/**
+* Tailscale Serve puts the server on HTTPS at the machine's MagicDNS name.
+*
+* Worth being an option rather than a default: it publishes the server to
+* everything on the tailnet, which is a decision about exposure and not a
+* detail of how the service is launched.
+*/
+const TailscaleServeOptions = Schema$1.Struct({
+	enabled: Schema$1.Boolean,
+	port: Schema$1.Int.check(Schema$1.isGreaterThan(0), Schema$1.isLessThanOrEqualTo(65535))
+});
+const ServiceOptions = Schema$1.Struct({ tailscaleServe: Schema$1.optional(TailscaleServeOptions) });
+const EMPTY_SERVICE_OPTIONS = {};
+const OptionsFromJson = Schema$1.fromJsonString(ServiceOptions);
+const decodeOptions = Schema$1.decodeUnknownExit(OptionsFromJson);
+const encodeOptions = Schema$1.encodeSync(OptionsFromJson);
+const serviceOptionsPath = (input) => input.path.join(input.baseDir, "userdata", "service-options.json");
+/**
+* Read the stored options, or none.
+*
+* A missing file is the ordinary case — most machines never set an option — and
+* an unreadable or malformed one is treated the same way rather than failing
+* the install. The cost of ignoring it is a service that starts without an
+* option; the cost of failing is a machine with no service at all, and the
+* second is worse for a file nobody edits by hand.
+*/
+const readServiceOptions = Effect.fn("service.readServiceOptions")(function* (input) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const contents = yield* fileSystem.readFileString(serviceOptionsPath({
+		baseDir: input.baseDir,
+		path
+	})).pipe(Effect.orElseSucceed(() => void 0));
+	if (contents === void 0) return EMPTY_SERVICE_OPTIONS;
+	const decoded = decodeOptions(contents);
+	return decoded._tag === "Success" ? decoded.value : EMPTY_SERVICE_OPTIONS;
+});
+const writeServiceOptions = Effect.fn("service.writeServiceOptions")(function* (input) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const filePath = serviceOptionsPath({
+		baseDir: input.baseDir,
+		path
+	});
+	yield* fileSystem.makeDirectory(path.dirname(filePath), { recursive: true }).pipe(Effect.ignore);
+	yield* writeFileStringAtomically({
+		filePath,
+		contents: `${encodeOptions(input.options)}\n`
+	});
+});
+/**
+* The environment the unit sets, derived from the options.
+*
+* Pairs rather than a record so the rendered unit is byte-stable: a record's
+* iteration order is stable in practice but nothing says so, and `status`
+* compares the rendered unit against the installed one to decide whether an
+* update is needed. A reordering would read as a change forever.
+*/
+const serviceEnvironmentFor = (options) => {
+	const pairs = [];
+	const tailscale = options.tailscaleServe;
+	if (tailscale?.enabled === true) {
+		pairs.push(["P4CODE_TAILSCALE_SERVE", "1"]);
+		if (tailscale.port !== 443) pairs.push(["P4CODE_TAILSCALE_SERVE_PORT", String(tailscale.port)]);
+	}
+	return pairs;
+};
 const BOOT_SERVICE_UNIT_FILE = `p4code.service`;
 const BOOT_SERVICE_UNIT_ENV = "P4_BOOT_SERVICE_UNIT";
 /**
@@ -24158,6 +24334,7 @@ function renderBootServiceUnit(plan) {
 		"WorkingDirectory=%h",
 		`Environment=P4CODE_HOME=${quoteSystemdValue(plan.baseDir)}`,
 		`Environment=${BOOT_SERVICE_UNIT_ENV}=${BOOT_SERVICE_UNIT_FILE}`,
+		...plan.serviceEnvironment.map(([name, value]) => `Environment=${name}=${quoteSystemdValue(value)}`),
 		`ExecStart=${quoteSystemdValue(plan.nodePath)} ${quoteSystemdValue(plan.p4EntryPath)} serve`,
 		"Restart=always",
 		"RestartSec=5",
@@ -24204,6 +24381,7 @@ function renderLaunchAgentPlist(plan) {
 		`    <string>${escapeXmlText(plan.baseDir)}</string>`,
 		`    <key>${escapeXmlText(BOOT_SERVICE_UNIT_ENV)}</key>`,
 		`    <string>${escapeXmlText(LAUNCH_AGENT_PLIST_FILE)}</string>`,
+		...plan.serviceEnvironment.flatMap(([name, value]) => [`    <key>${escapeXmlText(name)}</key>`, `    <string>${escapeXmlText(value)}</string>`]),
 		"  </dict>",
 		"  <key>RunAtLoad</key>",
 		"  <true/>",
@@ -24332,13 +24510,15 @@ const make$51 = Effect.fn("cloud.boot_service.make")(function* (input) {
 		}) : new BootServiceInstallError({ cause: error })), Effect.tapError((error) => DateTime.now.pipe(Effect.flatMap((now) => fs.writeFileString(logPath, `${DateTime.formatIso(now)} ${error.message}\n`, { flag: "a" })), Effect.ignore)));
 	});
 	const plannedEntryPath = isEphemeralCacheEntry(host.cliEntryPath) ? runtimePaths.entryPath : host.cliEntryPath;
+	const serviceOptions = yield* readServiceOptions({ baseDir: input.baseDir });
 	const plan = {
 		nodePath: host.execPath,
 		p4EntryPath: plannedEntryPath,
 		baseDir: input.baseDir,
 		logPath,
 		unitPath,
-		workingDirectory: homeDir
+		workingDirectory: homeDir,
+		serviceEnvironment: serviceEnvironmentFor(serviceOptions)
 	};
 	const install = Effect.gen(function* () {
 		yield* requireSupportedPlatform;
@@ -24492,7 +24672,7 @@ const RESTART_DELAY = Duration.seconds(2);
 /** Exact npm versions only — never dist-tags — so the acknowledgement names
 the version that was actually installed. Also keeps the value safe to
 pass to npm and embed in filesystem paths. */
-const EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const EXACT_VERSION_PATTERN$1 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 function normalizeEntryPath(entryPath) {
 	return entryPath.replaceAll("\\", "/");
 }
@@ -24608,7 +24788,7 @@ const make$50 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 		if (capability === null) return yield* failWith("This server cannot update itself; relaunch it manually with the new version.");
 		const activeMethod = capability;
 		const targetVersion = input.targetVersion.trim();
-		if (!EXACT_VERSION_PATTERN.test(targetVersion)) return yield* failWith(`'${targetVersion}' is not an exact p4 version.`);
+		if (!EXACT_VERSION_PATTERN$1.test(targetVersion)) return yield* failWith(`'${targetVersion}' is not an exact p4 version.`);
 		if (yield* Ref.getAndSet(inFlight, true)) return yield* failWith("A server update is already in progress.");
 		return yield* Effect.gen(function* () {
 			const runtimePaths = yield* ensurePinnedRuntimeInstalled({
@@ -24637,13 +24817,15 @@ const make$50 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 				const homeDir = env.HOME ?? "";
 				const unitPath = path.join(homeDir, ".config", "systemd", "user", BOOT_SERVICE_UNIT_FILE);
 				const previousUnit = yield* fs.readFileString(unitPath).pipe(Effect.mapError((cause) => failWith("Could not read the current systemd unit.", cause)));
+				const serviceOptions = yield* readServiceOptions({ baseDir: serverConfig.baseDir }).pipe(Effect.provideService(FileSystem.FileSystem, fs), Effect.provideService(Path.Path, path));
 				const unit = renderBootServiceUnit({
 					nodePath: host.execPath,
 					p4EntryPath: runtimePaths.entryPath,
 					baseDir: serverConfig.baseDir,
 					logPath: path.join(serverConfig.logsDir, "boot-service.log"),
 					unitPath,
-					workingDirectory: homeDir
+					workingDirectory: homeDir,
+					serviceEnvironment: serviceEnvironmentFor(serviceOptions)
 				});
 				yield* writeUnitAtomically(unitPath, unit).pipe(Effect.mapError((cause) => failWith("Could not update the systemd unit.", cause)));
 				const reloadSystemd = Effect.fn("cloud.server_self_update.reload_systemd")(function* () {
@@ -26512,7 +26694,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}));
-		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
+		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
 		return yield* Effect.gen(function* () {
 			const snapshot = yield* getOfflineSnapshot();
 			const orchestrationEngine = yield* OrchestrationEngineService;
@@ -26523,7 +26705,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}).pipe(Effect.provide(offlineRuntimeLayer));
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$42).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$42).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const projectAddCommand = Command.make("add", {
 	...projectLocationFlags,
@@ -43519,7 +43701,7 @@ const makeOpenCodeRuntime = Effect.gen(function* () {
 	};
 });
 var OpenCodeRuntime = class extends Context.Service()("@p4code/cli/provider/opencodeRuntime") {};
-const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$67));
+const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$68));
 //#endregion
 //#region src/textGeneration/TextGenerationUtils.ts
 const isTextGenerationError$2 = Schema$1.is(TextGenerationError);
@@ -82612,9 +82794,9 @@ const WorkspaceEntriesLayerLive = layer$26.pipe(Layer.provide(layer$42));
 const WorkspaceFileSystemLayerLive = layer$25.pipe(Layer.provide(layer$42), Layer.provide(WorkspaceEntriesLayerLive));
 const WorkspaceLayerLive = Layer.mergeAll(layer$42, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
 const ProjectFaviconResolverLayerLive = layer$40.pipe(Layer.provide(layer$42), Layer.provide(layer$41));
-const AuthLayerLive = layer$59.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$63));
+const AuthLayerLive = layer$60.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$64));
 const ProviderRuntimeLayerLive = ProviderSessionReaperLive.pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$50), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$63))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(layer$44), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$56), Layer.provideMerge(layer$63)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$47), Layer.provideMerge(layer$49), Layer.provideMerge(layer$48), Layer.provide(layer$67));
+const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$50), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$64))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(layer$44), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$56), Layer.provideMerge(layer$64)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$47), Layer.provideMerge(layer$49), Layer.provideMerge(layer$48), Layer.provide(layer$68));
 /**
 * Hub asset sync.
 *
@@ -82682,6 +82864,151 @@ const serveCommand = Command.make("serve", { ...sharedServerCommandFlags }).pipe
 	forceAutoBootstrapProjectFromCwd: false
 })));
 //#endregion
+//#region src/service/cliSelfUpdate.ts
+/**
+* Upgrading the globally installed CLI, then the service that runs it.
+*
+* Two steps that have to happen in that order and from different binaries, and
+* getting the order wrong is silent: `service update` renders the unit from the
+* *running* CLI, and pins that version into the runtime directory. Run the
+* reconcile from the old process and you install a new CLI and then carefully
+* point the service back at the old one.
+*
+* So the second step re-executes the newly installed binary. That is also why
+* this is not `ServerSelfUpdate`: that path respawns the server in place, which
+* it explicitly refuses to do under launchd — KeepAlive would restart the
+* process being replaced and leave two servers on one port. Under a supervisor
+* the honest sequence is install, then let the supervisor restart, which is
+* exactly what `service update` does.
+*
+* @module service/cliSelfUpdate
+*/
+/** npm can take minutes when a native dependency compiles from source. */
+const CLI_INSTALL_TIMEOUT_MS = 600 * 1e3;
+const PACKAGE_NAME = "@p4code/cli";
+/**
+* Exact versions or the two dist-tags, and nothing else.
+*
+* The value is handed to npm and printed back as "installed X". An arbitrary
+* string could be a git URL or a local path, which npm would happily install
+* and which would make the acknowledgement a lie.
+*/
+const EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/u;
+const isInstallableVersion = (value) => value === "latest" || value === "next" || EXACT_VERSION_PATTERN.test(value);
+var CliSelfUpdateError = class extends Schema$1.TaggedErrorClass()("CliSelfUpdateError", {
+	step: Schema$1.String,
+	detail: Schema$1.optional(Schema$1.String)
+}) {
+	get message() {
+		return this.detail === void 0 ? `Self-update failed while ${this.step}.` : `Self-update failed while ${this.step}: ${this.detail}`;
+	}
+};
+/**
+* Where `npm install --global` put the executable.
+*
+* Asked of npm rather than assumed, because the answer differs between a
+* Homebrew node, an nvm one and a system one — and the whole point of this step
+* is to run the binary that was just written, not the one on this process's
+* PATH, which a shell may have cached.
+*/
+const resolveGlobalBinary = Effect.fn("cli.selfUpdate.resolveGlobalBinary")(function* (binaryName) {
+	const result = yield* (yield* ProcessRunner).run({
+		command: "npm",
+		args: ["prefix", "--global"]
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step: "locating the npm global prefix",
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step: "locating the npm global prefix",
+		detail: `npm exited with code ${String(result.code)}`
+	});
+	const prefix = result.stdout.trim();
+	if (prefix.length === 0) return yield* new CliSelfUpdateError({
+		step: "locating the npm global prefix",
+		detail: "npm printed no prefix"
+	});
+	return `${prefix}/bin/${binaryName}`;
+});
+const installGlobalCli = Effect.fn("cli.selfUpdate.installGlobalCli")(function* (input) {
+	const runner = yield* ProcessRunner;
+	const step = `installing ${PACKAGE_NAME}@${input.version}`;
+	const result = yield* runner.run({
+		command: "npm",
+		args: [
+			"install",
+			"--global",
+			"--no-fund",
+			"--no-audit",
+			`${PACKAGE_NAME}@${input.version}`
+		],
+		timeout: CLI_INSTALL_TIMEOUT_MS
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step,
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: result.stderr.trim().length > 0 ? result.stderr.trim() : `exit code ${String(result.code)}`
+	});
+});
+/**
+* Ask the freshly installed binary what version it is.
+*
+* A completed npm install can still be unusable — a native dependency that
+* failed to build, a Node too old — and it is better to find that out here,
+* while the service is still running the version that works, than after
+* pointing the unit at it.
+*/
+const readInstalledVersion = Effect.fn("cli.selfUpdate.readInstalledVersion")(function* (binaryPath) {
+	const runner = yield* ProcessRunner;
+	const step = "verifying the installed CLI";
+	const result = yield* runner.run({
+		command: binaryPath,
+		args: ["--version"]
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step,
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: `the installed CLI exited with code ${String(result.code)}`
+	});
+	const match = /(\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?)/u.exec(result.stdout);
+	if (match?.[1] === void 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: "the installed CLI did not report a version"
+	});
+	return match[1];
+});
+/**
+* Hand the rest of the work to the new binary.
+*
+* `service update` from *this* process would pin this process's version. The
+* new binary reconciles to itself, which is the only way the unit ends up
+* pointing at what was just installed.
+*/
+const reconcileWithNewBinary = Effect.fn("cli.selfUpdate.reconcileWithNewBinary")(function* (input) {
+	const runner = yield* ProcessRunner;
+	const step = "updating the service to the new version";
+	const result = yield* runner.run({
+		command: input.binaryPath,
+		args: [
+			"service",
+			"update",
+			...input.baseDir === void 0 ? [] : ["--base-dir", input.baseDir]
+		],
+		timeout: CLI_INSTALL_TIMEOUT_MS
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step,
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: result.stderr.trim().length > 0 ? result.stderr.trim() : `exit code ${String(result.code)}`
+	});
+});
+//#endregion
 //#region src/cli/service.ts
 const isBootServiceCommandError = Schema$1.is(BootServiceCommandError);
 const bootServiceLayer = (config) => layer$46({
@@ -82730,13 +83057,51 @@ function formatServiceStatus(status, cliVersion) {
 		...status.current ? [] : ["  Next: Run `p4c service update`."]
 	].join("\n");
 }
-const runServiceCommand = Effect.fn("cli.service.run")(function* (flags, run) {
+const runServiceCommand = Effect.fn("cli.service.run")(function* (flags, run, prepare) {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	const baseDirNotice = yield* describeNonDefaultBaseDir(config.baseDir);
 	if (baseDirNotice !== null) yield* Console.error(baseDirNotice);
+	if (prepare !== void 0) yield* prepare(config);
 	return yield* run.pipe(Effect.tapError((error) => isBootServiceCommandError(error) ? BootService.pipe(Effect.flatMap((service) => Console.error(`Details: ${service.logPath}`))) : Effect.void), Effect.provide(Layer.mergeAll(bootServiceLayer(config), layer$52)));
 });
-const serviceInstallCommand = Command.make("install", projectLocationFlags).pipe(Command.withDescription("Install P4Code as a background service for this user."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
+/**
+* Options the installed unit carries, rather than ones this command consumes.
+*
+* Optional on purpose. Absent means "leave whatever is stored alone", so
+* re-running install to pick up a new CLI build does not quietly switch
+* Tailscale Serve off — which a plain boolean flag, false when unspecified,
+* would do every time.
+*/
+const tailscaleServeFlag = Flag.boolean("tailscale-serve").pipe(Flag.withDescription("Expose this server over HTTPS on your tailnet at its MagicDNS name. Use --no-tailscale-serve to turn it off."), Flag.optional);
+const tailscaleServePortFlag = Flag.integer("tailscale-serve-port").pipe(Flag.withDescription(`HTTPS port for Tailscale Serve (default 443).`), Flag.optional);
+/**
+* Fold the flags into what is already stored, and persist.
+*
+* Written before the unit is rendered, because the renderer reads this file —
+* so `install` and `update` both produce a unit that matches, and `status`
+* compares against the same thing.
+*/
+const applyServiceOptionFlags = Effect.fn("cli.service.applyOptionFlags")(function* (input) {
+	if (Option.isNone(input.tailscaleServe) && Option.isNone(input.tailscaleServePort)) return;
+	const stored = yield* readServiceOptions({ baseDir: input.baseDir });
+	const enabled = Option.getOrElse(input.tailscaleServe, () => stored.tailscaleServe?.enabled ?? false);
+	const port = Option.getOrElse(input.tailscaleServePort, () => stored.tailscaleServe?.port ?? 443);
+	yield* writeServiceOptions({
+		baseDir: input.baseDir,
+		options: {
+			...stored,
+			tailscaleServe: {
+				enabled,
+				port
+			}
+		}
+	});
+});
+const serviceInstallCommand = Command.make("install", {
+	...projectLocationFlags,
+	tailscaleServe: tailscaleServeFlag,
+	tailscaleServePort: tailscaleServePortFlag
+}).pipe(Command.withDescription("Install P4Code as a background service for this user."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
 	const result = yield* reconcileService();
 	if (!result.changed) {
 		yield* Console.log(`P4Code service is already installed with @p4code/cli@${version}.`);
@@ -82748,6 +83113,10 @@ const serviceInstallCommand = Command.make("install", projectLocationFlags).pipe
 		cliVersion: version,
 		platform: yield* HostProcessPlatform
 	}));
+}), (config) => applyServiceOptionFlags({
+	baseDir: config.baseDir,
+	tailscaleServe: flags.tailscaleServe,
+	tailscaleServePort: flags.tailscaleServePort
 }))));
 const serviceUpdateCommand = Command.make("update", projectLocationFlags).pipe(Command.withDescription("Update or repair the background service so it runs this CLI build, then restart it."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
 	const result = yield* reconcileService();
@@ -82767,6 +83136,57 @@ const serviceUninstallCommand = Command.make("uninstall", projectLocationFlags).
 	const removed = yield* (yield* BootService).uninstall;
 	yield* Console.log(removed ? "Removed the P4Code service." : "P4Code service is not installed.");
 }))));
+/**
+* Restart without rewriting the unit.
+*
+* `update` restarts too, but only after deciding the unit is out of date — and
+* a global `npm i -g` upgrades in place, so the rendered unit is byte-identical
+* and `update` correctly reports there is nothing to do while the running
+* process still holds the old code. The service already knew how to do this;
+* only the terminal had no way to ask.
+*/
+const serviceRestartCommand = Command.make("restart", projectLocationFlags).pipe(Command.withDescription("Restart the background service without changing its configuration."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
+	const service = yield* BootService;
+	if (!(yield* service.status).installed) {
+		yield* Console.error("P4Code service is not installed. Install it with: p4c service install");
+		return;
+	}
+	yield* service.restart;
+	yield* Console.log("Restarted the P4Code service.");
+}))));
+/**
+* Install a newer CLI, then point the service at it.
+*
+* Deliberately not `ServerSelfUpdate`, which the server uses to replace itself
+* in place: that path refuses to run under launchd, because KeepAlive would
+* restart the process being replaced and leave two servers on one port. Under a
+* supervisor the honest sequence is install, then reconcile and let the
+* supervisor restart — which is what this does, from the new binary.
+*/
+const serviceSelfUpdateCommand = Command.make("self-update", {
+	...projectLocationFlags,
+	version: Flag.string("version").pipe(Flag.withDescription("Version or dist-tag to install (default latest)."), Flag.optional)
+}).pipe(Command.withDescription("Install the newest @p4code/cli and update the service to run it."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
+	const requested = Option.getOrElse(flags.version, () => "latest");
+	if (!isInstallableVersion(requested)) {
+		yield* Console.error(`'${requested}' is not a version or dist-tag. Use an exact version, or latest.`);
+		return;
+	}
+	yield* Console.log(`Installing ${PACKAGE_NAME}@${requested}…`);
+	yield* installGlobalCli({ version: requested });
+	const binaryPath = yield* resolveGlobalBinary("p4c");
+	const installed = yield* readInstalledVersion(binaryPath);
+	if (installed === version) {
+		yield* Console.log(`Already running @p4code/cli@${installed}; nothing to update.`);
+		return;
+	}
+	yield* Console.log(`Installed @p4code/cli@${installed}; updating the service…`);
+	yield* reconcileWithNewBinary({
+		binaryPath,
+		baseDir: void 0
+	});
+	yield* Console.log(`Service now runs @p4code/cli@${installed}.`);
+}))));
 const serviceStatusCommand = Command.make("status", projectLocationFlags).pipe(Command.withDescription("Show whether the P4Code background service is installed."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
 	const service = yield* BootService;
 	yield* Console.log(formatServiceStatus(yield* service.status, version));
@@ -82790,11 +83210,13 @@ const serviceCommand = Command.make("service").pipe(Command.withDescription("Man
 	serviceInstallCommand,
 	serviceUninstallCommand,
 	serviceUpdateCommand,
+	serviceRestartCommand,
+	serviceSelfUpdateCommand,
 	serviceStatusCommand
 ]));
 //#endregion
 //#region src/bin.ts
-const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$67, FetchHttpClient.layer);
+const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$68, FetchHttpClient.layer);
 /**
 * Prints an update reminder before dispatching, at most once a day.
 *