@p4code/cli 0.0.49 → 0.0.50

package/dist/bin.mjs

@@ -55,6 +55,7 @@ import * as Exit from "effect/Exit";
 import * as SchemaGetter from "effect/SchemaGetter";
 import * as Config from "effect/Config";
 import * as NodeReadline from "node:readline";
+import * as Clock from "effect/Clock";
 import * as Cache from "effect/Cache";
 import * as Deferred from "effect/Deferred";
 import * as Equal from "effect/Equal";
@@ -62,7 +63,6 @@ import * as Semaphore from "effect/Semaphore";
 import * as Scope from "effect/Scope";
 import { parse } from "yaml";
 import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
-import * as Clock from "effect/Clock";
 import * as Metric from "effect/Metric";
 import * as Queue from "effect/Queue";
 import { cast, dual } from "effect/Function";
@@ -121,7 +121,7 @@ const closeServer = (server) => {
 * NetService - Service tag for startup networking helpers.
 */
 var NetService = class extends Context.Service()("@p4code/shared/Net/NetService") {};
-const make$71 = () => {
+const make$72 = () => {
 	/**
 	* Returns true when a TCP server can bind to {host, port}.
 	* `EADDRNOTAVAIL` is treated as available so IPv6-absent hosts don't fail
@@ -230,10 +230,10 @@ const make$71 = () => {
 		})
 	};
 };
-const layer$67 = Layer.sync(NetService, make$71);
+const layer$68 = Layer.sync(NetService, make$72);
 //#endregion
 //#region package.json
-var version = "0.0.49";
+var version = "0.0.50";
 //#endregion
 //#region src/config.ts
 /**
@@ -254,8 +254,8 @@ var ServerConfig$1 = class extends Context.Service()("@p4code/cli/config/ServerC
 	/** @deprecated Import and use `layerTest` from this module. */
 	static layerTest = (cwd, baseDirOrPrefix) => layerTest$2(cwd, baseDirOrPrefix);
 };
-const make$70 = (config) => ServerConfig$1.of(config);
-const layer$66 = (config) => Layer.succeed(ServerConfig$1, make$70(config));
+const make$71 = (config) => ServerConfig$1.of(config);
+const layer$67 = (config) => Layer.succeed(ServerConfig$1, make$71(config));
 const deriveServerPaths = Effect.fn(function* (baseDir, devUrl, options = {}) {
 	const { join } = yield* Path.Path;
 	const stateDir = join(baseDir, devUrl !== void 0 && !options.baseDirIsExplicit ? "dev" : "userdata");
@@ -869,7 +869,7 @@ function compareSemverVersions(left, right) {
 * timeout, every failure swallowed, and never anything that changes an exit
 * code. A version check that can break a command is worse than no check.
 */
-const PACKAGE_NAME = "@p4code/cli";
+const PACKAGE_NAME$1 = "@p4code/cli";
 const CHECK_INTERVAL = Duration.hours(24);
 const REQUEST_TIMEOUT = Duration.seconds(3);
 /**
@@ -889,7 +889,7 @@ const encodeCacheEntry = Schema$1.encodeEffect(CacheEntryJson);
 const NpmLatest = Schema$1.Struct({ version: Schema$1.optional(Schema$1.String) });
 const fetchLatestVersion = Effect.fn("cli.updateCheck.fetch")(function* () {
 	const client = yield* HttpClient.HttpClient;
-	const request = HttpClientRequest.get(`https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME)}/latest`).pipe(HttpClientRequest.setHeader("accept", "application/json"));
+	const request = HttpClientRequest.get(`https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME$1)}/latest`).pipe(HttpClientRequest.setHeader("accept", "application/json"));
 	const response = yield* client.execute(request).pipe(Effect.timeout(REQUEST_TIMEOUT));
 	if (response.status < 200 || response.status >= 300) return null;
 	const version = (yield* response.json.pipe(Effect.flatMap(Schema$1.decodeUnknownEffect(NpmLatest)))).version?.trim();
@@ -923,7 +923,7 @@ const resolveLatestVersion = Effect.fn("cli.updateCheck.resolve")(function* (sta
 * `service update` restarts it onto the new one.
 */
 function formatUpdateReminder(input) {
-	return [`Update available: ${PACKAGE_NAME}@${input.latestVersion} (running ${input.currentVersion}).`, `  npm i -g ${PACKAGE_NAME}@latest && p4c service update`].join("\n");
+	return [`Update available: ${PACKAGE_NAME$1}@${input.latestVersion} (running ${input.currentVersion}).`, `  npm i -g ${PACKAGE_NAME$1}@latest && p4c service update`].join("\n");
 }
 /**
 * The reminder line, or null when there is nothing to say. Callers print it;
@@ -8736,7 +8736,7 @@ function deriveAuthClientMetadata(input) {
 //#endregion
 //#region src/auth/EnvironmentAuthPolicy.ts
 var EnvironmentAuthPolicy = class extends Context.Service()("@p4code/cli/auth/EnvironmentAuthPolicy") {};
-const make$69 = Effect.gen(function* () {
+const make$70 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const isRemoteReachable = isRemoteReachableHost(config.host);
 	const policy = config.mode === "desktop" ? isRemoteReachable ? "remote-reachable" : "desktop-managed-local" : isRemoteReachable ? "remote-reachable" : "loopback-browser";
@@ -8754,7 +8754,7 @@ const make$69 = Effect.gen(function* () {
 	};
 	return EnvironmentAuthPolicy.of({ getDescriptor: () => Effect.succeed(descriptor).pipe(Effect.withSpan("EnvironmentAuthPolicy.getDescriptor")) });
 });
-const layer$65 = Layer.effect(EnvironmentAuthPolicy, make$69);
+const layer$66 = Layer.effect(EnvironmentAuthPolicy, make$70);
 //#endregion
 //#region src/persistence/Errors.ts
 function summarizeSchemaIssue(issue) {
@@ -8935,7 +8935,7 @@ function toPersistenceSqlOrDecodeError$6(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$68 = Effect.gen(function* () {
+const make$69 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createSessionRow = SqlSchema.void({
 		Request: CreateAuthSessionInput,
@@ -9069,7 +9069,7 @@ const make$68 = Effect.gen(function* () {
 		setLastConnectedAt
 	};
 });
-const layer$64 = Layer.effect(AuthSessionRepository, make$68);
+const layer$65 = Layer.effect(AuthSessionRepository, make$69);
 //#endregion
 //#region src/auth/ServerSecretStore.ts
 const secretStoreErrorContext = {
@@ -9136,7 +9136,7 @@ const isSecretStoreError = Schema$1.is(SecretStoreError);
 const isPlatformError = (value) => Predicate.isTagged(value, "PlatformError");
 const isSecretAlreadyExistsError = (error) => "cause" in error && isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists";
 var ServerSecretStore = class extends Context.Service()("@p4code/cli/auth/ServerSecretStore") {};
-const make$67 = Effect.gen(function* () {
+const make$68 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -9206,7 +9206,7 @@ const make$67 = Effect.gen(function* () {
 		remove
 	});
 });
-const layer$63 = Layer.effect(ServerSecretStore, make$67);
+const layer$64 = Layer.effect(ServerSecretStore, make$68);
 //#endregion
 //#region src/auth/SessionStore.ts
 var MalformedSessionTokenError = class extends Schema$1.TaggedErrorClass()("MalformedSessionTokenError", {}) {
@@ -9444,7 +9444,7 @@ function toAuthClientSession(input) {
 		current: false
 	};
 }
-const make$66 = Effect.gen(function* () {
+const make$67 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const serverConfig = yield* ServerConfig$1;
 	const secretStore = yield* ServerSecretStore;
@@ -9758,7 +9758,7 @@ const make$66 = Effect.gen(function* () {
 		markDisconnected
 	});
 });
-const layer$62 = Layer.effect(SessionStore, make$66).pipe(Layer.provideMerge(layer$64));
+const layer$63 = Layer.effect(SessionStore, make$67).pipe(Layer.provideMerge(layer$65));
 //#endregion
 //#region src/persistence/AuthPairingLinks.ts
 const AuthPairingLinkRecord = Schema$1.Struct({
@@ -9819,7 +9819,7 @@ function toPersistenceSqlOrDecodeError$5(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$65 = Effect.gen(function* () {
+const make$66 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createPairingLinkRow = SqlSchema.void({
 		Request: CreateAuthPairingLinkInput,
@@ -9954,7 +9954,7 @@ const make$65 = Effect.gen(function* () {
 		getByCredential
 	};
 });
-const layer$61 = Layer.effect(AuthPairingLinkRepository, make$65);
+const layer$62 = Layer.effect(AuthPairingLinkRepository, make$66);
 //#endregion
 //#region src/auth/PairingGrantStore.ts
 var UnknownBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnknownBootstrapCredentialError", {}) {
@@ -10049,7 +10049,7 @@ const DEV_STARTUP_TTL_HOURS = Duration.hours(24);
 const PAIRING_TOKEN_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 const PAIRING_TOKEN_LENGTH = 12;
 const PAIRING_TOKEN_REJECTION_LIMIT = Math.floor(256 / 32) * 32;
-const make$64 = Effect.gen(function* () {
+const make$65 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const config = yield* ServerConfig$1;
 	const pairingLinks = yield* AuthPairingLinkRepository;
@@ -10247,7 +10247,7 @@ const make$64 = Effect.gen(function* () {
 		consume
 	});
 });
-const layer$60 = Layer.effect(PairingGrantStore, make$64).pipe(Layer.provideMerge(layer$61));
+const layer$61 = Layer.effect(PairingGrantStore, make$65).pipe(Layer.provideMerge(layer$62));
 //#endregion
 //#region src/persistence/Migrations/001_OrchestrationEvents.ts
 var _001_OrchestrationEvents_default = Effect.gen(function* () {
@@ -12020,7 +12020,7 @@ function parseBearerToken(request) {
 	const token = header.slice(7).trim();
 	return token.length > 0 ? token : null;
 }
-const make$63 = Effect.gen(function* () {
+const make$64 = Effect.gen(function* () {
 	const policy = yield* EnvironmentAuthPolicy;
 	const bootstrapCredentials = yield* PairingGrantStore;
 	const sessions = yield* SessionStore;
@@ -12215,9 +12215,9 @@ const make$63 = Effect.gen(function* () {
 		issueStartupPairingUrl
 	});
 });
-const layer$59 = Layer.effect(EnvironmentAuth, make$63).pipe(Layer.provideMerge(layer$60), Layer.provideMerge(layer$62), Layer.provideMerge(layer$65));
-const storageLayer = Layer.mergeAll(layer$63, layerConfig);
-const runtimeLayer = layer$59.pipe(Layer.provideMerge(storageLayer));
+const layer$60 = Layer.effect(EnvironmentAuth, make$64).pipe(Layer.provideMerge(layer$61), Layer.provideMerge(layer$63), Layer.provideMerge(layer$66));
+const storageLayer = Layer.mergeAll(layer$64, layerConfig);
+const runtimeLayer = layer$60.pipe(Layer.provideMerge(storageLayer));
 //#endregion
 //#region src/cliAuthFormat.ts
 const newline = "\n";
@@ -12972,7 +12972,7 @@ const runWithEnvironmentAuth = (flags, run, options) => Effect.gen(function* ()
 	}
 	return yield* Effect.gen(function* () {
 		return yield* run(yield* EnvironmentAuth);
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const ttlFlag = Flag.string("ttl").pipe(Flag.withSchema(DurationFromString), Flag.withDescription("TTL, for example `5m`, `1h`, `30d`, or `15 minutes`."), Flag.optional);
 const jsonFlag = Flag.boolean("json").pipe(Flag.withDescription("Emit JSON instead of human-readable output."), Flag.withDefault(false));
@@ -13069,6 +13069,64 @@ const authCommand = Command.make("auth").pipe(Command.withDescription("Manage th
 * @module HubConfig
 */
 var HubConfig = class extends Context.Service()("@p4code/cli/hub/HubConfig") {};
+const FAILURE_WINDOW_MS = 6e4;
+const BLOCK_DURATION_MS = 6e4;
+const initialThrottleState = {
+	windowStartMillis: 0,
+	failures: 0,
+	blockedUntilMillis: 0
+};
+/** Whether a *failing* request should be refused outright rather than checked. */
+const isBlocked = (state, nowMillis) => nowMillis < state.blockedUntilMillis;
+/** Seconds a caller should wait, for `retry-after`. Always at least one. */
+const retryAfterSeconds = (state, nowMillis) => Math.max(1, Math.ceil((state.blockedUntilMillis - nowMillis) / 1e3));
+/**
+* Count a failure, and start blocking once the window fills.
+*
+* The window is fixed rather than sliding: a sliding window needs the timestamp
+* of every attempt, which is unbounded memory for an unbounded attacker. A
+* fixed window lets a burst straddle a boundary and land up to twice the limit,
+* which for this purpose is a rounding error against the size of the search
+* space.
+*/
+const recordFailure = (state, nowMillis, limits = {
+	maxFailures: 10,
+	windowMillis: FAILURE_WINDOW_MS,
+	blockMillis: BLOCK_DURATION_MS
+}) => {
+	if (nowMillis - state.windowStartMillis >= limits.windowMillis) return {
+		windowStartMillis: nowMillis,
+		failures: 1,
+		blockedUntilMillis: 0
+	};
+	const failures = state.failures + 1;
+	return {
+		windowStartMillis: state.windowStartMillis,
+		failures,
+		blockedUntilMillis: failures >= limits.maxFailures ? nowMillis + limits.blockMillis : state.blockedUntilMillis
+	};
+};
+var HubAuthThrottle = class extends Context.Service()("@p4code/cli/hub/HubAuthThrottle") {};
+const DEFAULT_LIMITS = {
+	maxFailures: 10,
+	windowMillis: FAILURE_WINDOW_MS,
+	blockMillis: BLOCK_DURATION_MS
+};
+const make$63 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
+	const state = yield* Ref.make(initialThrottleState);
+	return HubAuthThrottle.of({
+		shouldRefuse: Effect.gen(function* () {
+			const now = yield* Clock.currentTimeMillis;
+			return isBlocked(yield* Ref.get(state), now);
+		}),
+		recordFailure: Effect.gen(function* () {
+			const now = yield* Clock.currentTimeMillis;
+			const next = yield* Ref.updateAndGet(state, (current) => recordFailure(current, now, limits));
+			return retryAfterSeconds(next, now);
+		})
+	});
+});
+const layer$59 = Layer.effect(HubAuthThrottle, make$63());
 //#endregion
 //#region src/hub/HubAuth.ts
 /**
@@ -13127,6 +13185,31 @@ var HubUnauthorizedError = class {
 	_tag = "HubUnauthorizedError";
 };
 /**
+* Too many failed attempts recently; this one was not even checked.
+*
+* Distinct from `HubUnauthorizedError` so the response can differ. A 429 is the
+* honest answer — the credential was not evaluated, so calling it invalid would
+* be a claim the hub did not make — and it tells a legitimate server retrying a
+* stale token to back off rather than hammer.
+*/
+var HubThrottledError = class {
+	_tag = "HubThrottledError";
+	retryAfterSeconds;
+	constructor(retryAfterSeconds) {
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+const hubThrottledResponse = (retryAfterSeconds) => HttpServerResponse.jsonUnsafe({
+	error: "too_many_hub_credential_failures",
+	message: "Too many failed credential attempts. Try again shortly."
+}, {
+	status: 429,
+	headers: {
+		"cache-control": "no-store",
+		"retry-after": String(retryAfterSeconds)
+	}
+});
+/**
 * Fails with {@link HubUnauthorizedError} unless the request carries a
 * configured bearer token. Route handlers run this first and let
 * `respondToHubAuthFailure` turn the failure into a 401.
@@ -13134,11 +13217,17 @@ var HubUnauthorizedError = class {
 const authenticateHubRequest = Effect.fn("HubAuth.authenticateHubRequest")(function* () {
 	const request = yield* HttpServerRequest.HttpServerRequest;
 	const { tokenHashes } = yield* HubConfig;
+	const throttle = yield* HubAuthThrottle;
 	const token = readBearerToken(request.headers.authorization);
-	if (!isAuthorizedHubToken(token, tokenHashes)) {
-		yield* Effect.logWarning("rejected hub request with an unusable credential", { reason: token.length === 0 ? "missing_bearer_token" : "unknown_token" });
-		return yield* Effect.fail(new HubUnauthorizedError());
+	if (isAuthorizedHubToken(token, tokenHashes)) return;
+	if (yield* throttle.shouldRefuse) {
+		const retryAfter = yield* throttle.recordFailure;
+		yield* Effect.logWarning("refused hub request without checking; too many recent failures", { reason: token.length === 0 ? "missing_bearer_token" : "unknown_token" });
+		return yield* Effect.fail(new HubThrottledError(retryAfter));
 	}
+	yield* throttle.recordFailure;
+	yield* Effect.logWarning("rejected hub request with an unusable credential", { reason: token.length === 0 ? "missing_bearer_token" : "unknown_token" });
+	return yield* Effect.fail(new HubUnauthorizedError());
 });
 const SHA256_HEX = /^[0-9a-f]{64}$/;
 /**
@@ -13547,6 +13636,7 @@ const storeUnavailable = HttpServerResponse.jsonUnsafe({
 */
 const respondToHubFailures = (handler) => handler.pipe(Effect.catch((cause) => {
 	if (cause._tag === "HubUnauthorizedError") return Effect.succeed(hubUnauthorizedResponse);
+	if (cause._tag === "HubThrottledError") return Effect.succeed(hubThrottledResponse(cause.retryAfterSeconds));
 	if (cause._tag === "InvalidHubRequest") return Effect.succeed(badRequest(cause.detail));
 	return Effect.logWarning("hub request failed", { cause }).pipe(Effect.as(storeUnavailable));
 }));
@@ -13942,7 +14032,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 	});
 	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
-const makeHubLayer = HttpRouter.serve(layer$58).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
+const makeHubLayer = HttpRouter.serve(layer$58).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$59), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
 //#endregion
 //#region src/atomicWrite.ts
@@ -16126,7 +16216,7 @@ const make$58 = Effect.gen(function* () {
 const layer$53 = Layer.effect(AssetSync, make$58);
 //#endregion
 //#region src/cli/assets.ts
-const SyncServicesLive = layer$53.pipe(Layer.provideMerge(layer$54), Layer.provideMerge(layer$55), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$63))), Layer.provideMerge(layer$63), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$53.pipe(Layer.provideMerge(layer$54), Layer.provideMerge(layer$55), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$64))), Layer.provideMerge(layer$64), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -16134,7 +16224,7 @@ const runWithSync = (flags, run) => Effect.gen(function* () {
 			sync: yield* AssetSync,
 			link: yield* HubLink
 		});
-	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
+	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
 });
 const STATE_LABEL = {
 	synced: "synced",
@@ -24582,7 +24672,7 @@ const RESTART_DELAY = Duration.seconds(2);
 /** Exact npm versions only — never dist-tags — so the acknowledgement names
 the version that was actually installed. Also keeps the value safe to
 pass to npm and embed in filesystem paths. */
-const EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const EXACT_VERSION_PATTERN$1 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 function normalizeEntryPath(entryPath) {
 	return entryPath.replaceAll("\\", "/");
 }
@@ -24698,7 +24788,7 @@ const make$50 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 		if (capability === null) return yield* failWith("This server cannot update itself; relaunch it manually with the new version.");
 		const activeMethod = capability;
 		const targetVersion = input.targetVersion.trim();
-		if (!EXACT_VERSION_PATTERN.test(targetVersion)) return yield* failWith(`'${targetVersion}' is not an exact p4 version.`);
+		if (!EXACT_VERSION_PATTERN$1.test(targetVersion)) return yield* failWith(`'${targetVersion}' is not an exact p4 version.`);
 		if (yield* Ref.getAndSet(inFlight, true)) return yield* failWith("A server update is already in progress.");
 		return yield* Effect.gen(function* () {
 			const runtimePaths = yield* ensurePinnedRuntimeInstalled({
@@ -24727,6 +24817,7 @@ const make$50 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 				const homeDir = env.HOME ?? "";
 				const unitPath = path.join(homeDir, ".config", "systemd", "user", BOOT_SERVICE_UNIT_FILE);
 				const previousUnit = yield* fs.readFileString(unitPath).pipe(Effect.mapError((cause) => failWith("Could not read the current systemd unit.", cause)));
+				const serviceOptions = yield* readServiceOptions({ baseDir: serverConfig.baseDir }).pipe(Effect.provideService(FileSystem.FileSystem, fs), Effect.provideService(Path.Path, path));
 				const unit = renderBootServiceUnit({
 					nodePath: host.execPath,
 					p4EntryPath: runtimePaths.entryPath,
@@ -24734,7 +24825,7 @@ const make$50 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 					logPath: path.join(serverConfig.logsDir, "boot-service.log"),
 					unitPath,
 					workingDirectory: homeDir,
-					serviceEnvironment: []
+					serviceEnvironment: serviceEnvironmentFor(serviceOptions)
 				});
 				yield* writeUnitAtomically(unitPath, unit).pipe(Effect.mapError((cause) => failWith("Could not update the systemd unit.", cause)));
 				const reloadSystemd = Effect.fn("cloud.server_self_update.reload_systemd")(function* () {
@@ -26603,7 +26694,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}));
-		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
+		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
 		return yield* Effect.gen(function* () {
 			const snapshot = yield* getOfflineSnapshot();
 			const orchestrationEngine = yield* OrchestrationEngineService;
@@ -26614,7 +26705,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}).pipe(Effect.provide(offlineRuntimeLayer));
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$42).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$42).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const projectAddCommand = Command.make("add", {
 	...projectLocationFlags,
@@ -43610,7 +43701,7 @@ const makeOpenCodeRuntime = Effect.gen(function* () {
 	};
 });
 var OpenCodeRuntime = class extends Context.Service()("@p4code/cli/provider/opencodeRuntime") {};
-const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$67));
+const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$68));
 //#endregion
 //#region src/textGeneration/TextGenerationUtils.ts
 const isTextGenerationError$2 = Schema$1.is(TextGenerationError);
@@ -82703,9 +82794,9 @@ const WorkspaceEntriesLayerLive = layer$26.pipe(Layer.provide(layer$42));
 const WorkspaceFileSystemLayerLive = layer$25.pipe(Layer.provide(layer$42), Layer.provide(WorkspaceEntriesLayerLive));
 const WorkspaceLayerLive = Layer.mergeAll(layer$42, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
 const ProjectFaviconResolverLayerLive = layer$40.pipe(Layer.provide(layer$42), Layer.provide(layer$41));
-const AuthLayerLive = layer$59.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$63));
+const AuthLayerLive = layer$60.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$64));
 const ProviderRuntimeLayerLive = ProviderSessionReaperLive.pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$50), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$63))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(layer$44), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$56), Layer.provideMerge(layer$63)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$47), Layer.provideMerge(layer$49), Layer.provideMerge(layer$48), Layer.provide(layer$67));
+const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$50), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$64))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(layer$44), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$56), Layer.provideMerge(layer$64)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$47), Layer.provideMerge(layer$49), Layer.provideMerge(layer$48), Layer.provide(layer$68));
 /**
 * Hub asset sync.
 *
@@ -82773,6 +82864,151 @@ const serveCommand = Command.make("serve", { ...sharedServerCommandFlags }).pipe
 	forceAutoBootstrapProjectFromCwd: false
 })));
 //#endregion
+//#region src/service/cliSelfUpdate.ts
+/**
+* Upgrading the globally installed CLI, then the service that runs it.
+*
+* Two steps that have to happen in that order and from different binaries, and
+* getting the order wrong is silent: `service update` renders the unit from the
+* *running* CLI, and pins that version into the runtime directory. Run the
+* reconcile from the old process and you install a new CLI and then carefully
+* point the service back at the old one.
+*
+* So the second step re-executes the newly installed binary. That is also why
+* this is not `ServerSelfUpdate`: that path respawns the server in place, which
+* it explicitly refuses to do under launchd — KeepAlive would restart the
+* process being replaced and leave two servers on one port. Under a supervisor
+* the honest sequence is install, then let the supervisor restart, which is
+* exactly what `service update` does.
+*
+* @module service/cliSelfUpdate
+*/
+/** npm can take minutes when a native dependency compiles from source. */
+const CLI_INSTALL_TIMEOUT_MS = 600 * 1e3;
+const PACKAGE_NAME = "@p4code/cli";
+/**
+* Exact versions or the two dist-tags, and nothing else.
+*
+* The value is handed to npm and printed back as "installed X". An arbitrary
+* string could be a git URL or a local path, which npm would happily install
+* and which would make the acknowledgement a lie.
+*/
+const EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/u;
+const isInstallableVersion = (value) => value === "latest" || value === "next" || EXACT_VERSION_PATTERN.test(value);
+var CliSelfUpdateError = class extends Schema$1.TaggedErrorClass()("CliSelfUpdateError", {
+	step: Schema$1.String,
+	detail: Schema$1.optional(Schema$1.String)
+}) {
+	get message() {
+		return this.detail === void 0 ? `Self-update failed while ${this.step}.` : `Self-update failed while ${this.step}: ${this.detail}`;
+	}
+};
+/**
+* Where `npm install --global` put the executable.
+*
+* Asked of npm rather than assumed, because the answer differs between a
+* Homebrew node, an nvm one and a system one — and the whole point of this step
+* is to run the binary that was just written, not the one on this process's
+* PATH, which a shell may have cached.
+*/
+const resolveGlobalBinary = Effect.fn("cli.selfUpdate.resolveGlobalBinary")(function* (binaryName) {
+	const result = yield* (yield* ProcessRunner).run({
+		command: "npm",
+		args: ["prefix", "--global"]
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step: "locating the npm global prefix",
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step: "locating the npm global prefix",
+		detail: `npm exited with code ${String(result.code)}`
+	});
+	const prefix = result.stdout.trim();
+	if (prefix.length === 0) return yield* new CliSelfUpdateError({
+		step: "locating the npm global prefix",
+		detail: "npm printed no prefix"
+	});
+	return `${prefix}/bin/${binaryName}`;
+});
+const installGlobalCli = Effect.fn("cli.selfUpdate.installGlobalCli")(function* (input) {
+	const runner = yield* ProcessRunner;
+	const step = `installing ${PACKAGE_NAME}@${input.version}`;
+	const result = yield* runner.run({
+		command: "npm",
+		args: [
+			"install",
+			"--global",
+			"--no-fund",
+			"--no-audit",
+			`${PACKAGE_NAME}@${input.version}`
+		],
+		timeout: CLI_INSTALL_TIMEOUT_MS
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step,
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: result.stderr.trim().length > 0 ? result.stderr.trim() : `exit code ${String(result.code)}`
+	});
+});
+/**
+* Ask the freshly installed binary what version it is.
+*
+* A completed npm install can still be unusable — a native dependency that
+* failed to build, a Node too old — and it is better to find that out here,
+* while the service is still running the version that works, than after
+* pointing the unit at it.
+*/
+const readInstalledVersion = Effect.fn("cli.selfUpdate.readInstalledVersion")(function* (binaryPath) {
+	const runner = yield* ProcessRunner;
+	const step = "verifying the installed CLI";
+	const result = yield* runner.run({
+		command: binaryPath,
+		args: ["--version"]
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step,
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: `the installed CLI exited with code ${String(result.code)}`
+	});
+	const match = /(\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?)/u.exec(result.stdout);
+	if (match?.[1] === void 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: "the installed CLI did not report a version"
+	});
+	return match[1];
+});
+/**
+* Hand the rest of the work to the new binary.
+*
+* `service update` from *this* process would pin this process's version. The
+* new binary reconciles to itself, which is the only way the unit ends up
+* pointing at what was just installed.
+*/
+const reconcileWithNewBinary = Effect.fn("cli.selfUpdate.reconcileWithNewBinary")(function* (input) {
+	const runner = yield* ProcessRunner;
+	const step = "updating the service to the new version";
+	const result = yield* runner.run({
+		command: input.binaryPath,
+		args: [
+			"service",
+			"update",
+			...input.baseDir === void 0 ? [] : ["--base-dir", input.baseDir]
+		],
+		timeout: CLI_INSTALL_TIMEOUT_MS
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step,
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: result.stderr.trim().length > 0 ? result.stderr.trim() : `exit code ${String(result.code)}`
+	});
+});
+//#endregion
 //#region src/cli/service.ts
 const isBootServiceCommandError = Schema$1.is(BootServiceCommandError);
 const bootServiceLayer = (config) => layer$46({
@@ -82918,6 +83154,39 @@ const serviceRestartCommand = Command.make("restart", projectLocationFlags).pipe
 	yield* service.restart;
 	yield* Console.log("Restarted the P4Code service.");
 }))));
+/**
+* Install a newer CLI, then point the service at it.
+*
+* Deliberately not `ServerSelfUpdate`, which the server uses to replace itself
+* in place: that path refuses to run under launchd, because KeepAlive would
+* restart the process being replaced and leave two servers on one port. Under a
+* supervisor the honest sequence is install, then reconcile and let the
+* supervisor restart — which is what this does, from the new binary.
+*/
+const serviceSelfUpdateCommand = Command.make("self-update", {
+	...projectLocationFlags,
+	version: Flag.string("version").pipe(Flag.withDescription("Version or dist-tag to install (default latest)."), Flag.optional)
+}).pipe(Command.withDescription("Install the newest @p4code/cli and update the service to run it."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
+	const requested = Option.getOrElse(flags.version, () => "latest");
+	if (!isInstallableVersion(requested)) {
+		yield* Console.error(`'${requested}' is not a version or dist-tag. Use an exact version, or latest.`);
+		return;
+	}
+	yield* Console.log(`Installing ${PACKAGE_NAME}@${requested}…`);
+	yield* installGlobalCli({ version: requested });
+	const binaryPath = yield* resolveGlobalBinary("p4c");
+	const installed = yield* readInstalledVersion(binaryPath);
+	if (installed === version) {
+		yield* Console.log(`Already running @p4code/cli@${installed}; nothing to update.`);
+		return;
+	}
+	yield* Console.log(`Installed @p4code/cli@${installed}; updating the service…`);
+	yield* reconcileWithNewBinary({
+		binaryPath,
+		baseDir: void 0
+	});
+	yield* Console.log(`Service now runs @p4code/cli@${installed}.`);
+}))));
 const serviceStatusCommand = Command.make("status", projectLocationFlags).pipe(Command.withDescription("Show whether the P4Code background service is installed."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
 	const service = yield* BootService;
 	yield* Console.log(formatServiceStatus(yield* service.status, version));
@@ -82942,11 +83211,12 @@ const serviceCommand = Command.make("service").pipe(Command.withDescription("Man
 	serviceUninstallCommand,
 	serviceUpdateCommand,
 	serviceRestartCommand,
+	serviceSelfUpdateCommand,
 	serviceStatusCommand
 ]));
 //#endregion
 //#region src/bin.ts
-const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$67, FetchHttpClient.layer);
+const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$68, FetchHttpClient.layer);
 /**
 * Prints an update reminder before dispatching, at most once a day.
 *