@p4code/cli 0.0.49 → 0.0.51

package/dist/bin.mjs

@@ -55,6 +55,7 @@ import * as Exit from "effect/Exit";
 import * as SchemaGetter from "effect/SchemaGetter";
 import * as Config from "effect/Config";
 import * as NodeReadline from "node:readline";
+import * as Clock from "effect/Clock";
 import * as Cache from "effect/Cache";
 import * as Deferred from "effect/Deferred";
 import * as Equal from "effect/Equal";
@@ -62,7 +63,6 @@ import * as Semaphore from "effect/Semaphore";
 import * as Scope from "effect/Scope";
 import { parse } from "yaml";
 import * as HttpApiClient from "effect/unstable/httpapi/HttpApiClient";
-import * as Clock from "effect/Clock";
 import * as Metric from "effect/Metric";
 import * as Queue from "effect/Queue";
 import { cast, dual } from "effect/Function";
@@ -121,7 +121,7 @@ const closeServer = (server) => {
 * NetService - Service tag for startup networking helpers.
 */
 var NetService = class extends Context.Service()("@p4code/shared/Net/NetService") {};
-const make$71 = () => {
+const make$72 = () => {
 	/**
 	* Returns true when a TCP server can bind to {host, port}.
 	* `EADDRNOTAVAIL` is treated as available so IPv6-absent hosts don't fail
@@ -230,10 +230,10 @@ const make$71 = () => {
 		})
 	};
 };
-const layer$67 = Layer.sync(NetService, make$71);
+const layer$68 = Layer.sync(NetService, make$72);
 //#endregion
 //#region package.json
-var version = "0.0.49";
+var version = "0.0.51";
 //#endregion
 //#region src/config.ts
 /**
@@ -254,8 +254,8 @@ var ServerConfig$1 = class extends Context.Service()("@p4code/cli/config/ServerC
 	/** @deprecated Import and use `layerTest` from this module. */
 	static layerTest = (cwd, baseDirOrPrefix) => layerTest$2(cwd, baseDirOrPrefix);
 };
-const make$70 = (config) => ServerConfig$1.of(config);
-const layer$66 = (config) => Layer.succeed(ServerConfig$1, make$70(config));
+const make$71 = (config) => ServerConfig$1.of(config);
+const layer$67 = (config) => Layer.succeed(ServerConfig$1, make$71(config));
 const deriveServerPaths = Effect.fn(function* (baseDir, devUrl, options = {}) {
 	const { join } = yield* Path.Path;
 	const stateDir = join(baseDir, devUrl !== void 0 && !options.baseDirIsExplicit ? "dev" : "userdata");
@@ -869,7 +869,7 @@ function compareSemverVersions(left, right) {
 * timeout, every failure swallowed, and never anything that changes an exit
 * code. A version check that can break a command is worse than no check.
 */
-const PACKAGE_NAME = "@p4code/cli";
+const PACKAGE_NAME$1 = "@p4code/cli";
 const CHECK_INTERVAL = Duration.hours(24);
 const REQUEST_TIMEOUT = Duration.seconds(3);
 /**
@@ -889,7 +889,7 @@ const encodeCacheEntry = Schema$1.encodeEffect(CacheEntryJson);
 const NpmLatest = Schema$1.Struct({ version: Schema$1.optional(Schema$1.String) });
 const fetchLatestVersion = Effect.fn("cli.updateCheck.fetch")(function* () {
 	const client = yield* HttpClient.HttpClient;
-	const request = HttpClientRequest.get(`https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME)}/latest`).pipe(HttpClientRequest.setHeader("accept", "application/json"));
+	const request = HttpClientRequest.get(`https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME$1)}/latest`).pipe(HttpClientRequest.setHeader("accept", "application/json"));
 	const response = yield* client.execute(request).pipe(Effect.timeout(REQUEST_TIMEOUT));
 	if (response.status < 200 || response.status >= 300) return null;
 	const version = (yield* response.json.pipe(Effect.flatMap(Schema$1.decodeUnknownEffect(NpmLatest)))).version?.trim();
@@ -923,7 +923,7 @@ const resolveLatestVersion = Effect.fn("cli.updateCheck.resolve")(function* (sta
 * `service update` restarts it onto the new one.
 */
 function formatUpdateReminder(input) {
-	return [`Update available: ${PACKAGE_NAME}@${input.latestVersion} (running ${input.currentVersion}).`, `  npm i -g ${PACKAGE_NAME}@latest && p4c service update`].join("\n");
+	return [`Update available: ${PACKAGE_NAME$1}@${input.latestVersion} (running ${input.currentVersion}).`, `  npm i -g ${PACKAGE_NAME$1}@latest && p4c service update`].join("\n");
 }
 /**
 * The reminder line, or null when there is nothing to say. Callers print it;
@@ -4819,6 +4819,87 @@ const ThreadMetadataUpdatedPayload = Schema$1.Struct({
 	name: Schema$1.optional(TrimmedNonEmptyStringSchema$1),
 	metadata: Schema$1.optional(UnknownRecordSchema)
 });
+/**
+* Per-source attribution for what is occupying the context window, as reported
+* by a provider that can answer the question. Only the Claude adapter fills this
+* in today; every field is optional so a provider can report the parts it knows.
+*
+* `isDeferred` / `isLoaded` are the interesting half. Providers defer most tool
+* definitions behind tool search, so a deferred entry's tokens are what it
+* *would* cost rather than what it costs right now, and presenting the two as
+* one number overstates usage.
+*/
+const ContextWindowNamedCost = Schema$1.Struct({
+	name: TrimmedNonEmptyStringSchema$1,
+	tokens: NonNegativeInt
+});
+const ContextWindowDeferrableTool = Schema$1.Struct({
+	name: TrimmedNonEmptyStringSchema$1,
+	tokens: NonNegativeInt,
+	isLoaded: Schema$1.optional(Schema$1.Boolean)
+});
+const ContextWindowBreakdown = Schema$1.Struct({
+	/** The model the breakdown was measured against, which is not always the thread's current selection. */
+	model: Schema$1.optional(TrimmedNonEmptyStringSchema$1),
+	/** Top-level buckets the provider itself divides the window into. */
+	categories: Schema$1.optional(Schema$1.Array(Schema$1.Struct({
+		name: TrimmedNonEmptyStringSchema$1,
+		tokens: NonNegativeInt,
+		isDeferred: Schema$1.optional(Schema$1.Boolean)
+	}))),
+	mcpTools: Schema$1.optional(Schema$1.Array(Schema$1.Struct({
+		name: TrimmedNonEmptyStringSchema$1,
+		serverName: TrimmedNonEmptyStringSchema$1,
+		tokens: NonNegativeInt,
+		isLoaded: Schema$1.optional(Schema$1.Boolean)
+	}))),
+	skills: Schema$1.optional(Schema$1.Struct({
+		totalSkills: NonNegativeInt,
+		includedSkills: NonNegativeInt,
+		tokens: NonNegativeInt,
+		entries: Schema$1.optional(Schema$1.Array(Schema$1.Struct({
+			name: TrimmedNonEmptyStringSchema$1,
+			source: Schema$1.optional(TrimmedNonEmptyStringSchema$1),
+			tokens: NonNegativeInt
+		})))
+	})),
+	memoryFiles: Schema$1.optional(Schema$1.Array(Schema$1.Struct({
+		path: TrimmedNonEmptyStringSchema$1,
+		type: Schema$1.optional(TrimmedNonEmptyStringSchema$1),
+		tokens: NonNegativeInt
+	}))),
+	agents: Schema$1.optional(Schema$1.Array(Schema$1.Struct({
+		agentType: TrimmedNonEmptyStringSchema$1,
+		source: Schema$1.optional(TrimmedNonEmptyStringSchema$1),
+		tokens: NonNegativeInt
+	}))),
+	systemTools: Schema$1.optional(Schema$1.Array(ContextWindowNamedCost)),
+	deferredBuiltinTools: Schema$1.optional(Schema$1.Array(ContextWindowDeferrableTool)),
+	systemPromptSections: Schema$1.optional(Schema$1.Array(ContextWindowNamedCost)),
+	slashCommands: Schema$1.optional(Schema$1.Struct({
+		totalCommands: NonNegativeInt,
+		includedCommands: NonNegativeInt,
+		tokens: NonNegativeInt
+	})),
+	/** How the conversation itself divides up, as opposed to the prompt scaffolding above. */
+	messages: Schema$1.optional(Schema$1.Struct({
+		toolCallTokens: NonNegativeInt,
+		toolResultTokens: NonNegativeInt,
+		attachmentTokens: NonNegativeInt,
+		assistantMessageTokens: NonNegativeInt,
+		userMessageTokens: NonNegativeInt,
+		redirectedContextTokens: NonNegativeInt,
+		unattributedTokens: NonNegativeInt,
+		toolCallsByType: Schema$1.optional(Schema$1.Array(Schema$1.Struct({
+			name: TrimmedNonEmptyStringSchema$1,
+			callTokens: NonNegativeInt,
+			resultTokens: NonNegativeInt
+		}))),
+		attachmentsByType: Schema$1.optional(Schema$1.Array(ContextWindowNamedCost))
+	})),
+	/** Token count at which the provider compacts on its own, when it does. */
+	autoCompactThreshold: Schema$1.optional(NonNegativeInt)
+});
 const ThreadTokenUsageSnapshot = Schema$1.Struct({
 	usedTokens: NonNegativeInt,
 	totalProcessedTokens: Schema$1.optional(NonNegativeInt),
@@ -4834,7 +4915,8 @@ const ThreadTokenUsageSnapshot = Schema$1.Struct({
 	lastReasoningOutputTokens: Schema$1.optional(NonNegativeInt),
 	toolUses: Schema$1.optional(NonNegativeInt),
 	durationMs: Schema$1.optional(NonNegativeInt),
-	compactsAutomatically: Schema$1.optional(Schema$1.Boolean)
+	compactsAutomatically: Schema$1.optional(Schema$1.Boolean),
+	breakdown: Schema$1.optional(ContextWindowBreakdown)
 });
 const ThreadTokenUsageUpdatedPayload = Schema$1.Struct({ usage: ThreadTokenUsageSnapshot });
 const ThreadRealtimeStartedPayload = Schema$1.Struct({ realtimeSessionId: Schema$1.optional(TrimmedNonEmptyStringSchema$1) });
@@ -7235,6 +7317,59 @@ const TaskStreamEvent = Schema$1.Union([
 		taskId: TaskId
 	})
 ]);
+/**
+* Start an agent on a task.
+*
+* The input is only the task, deliberately. Everything else the thread needs —
+* which project, which model, what prompt — is resolved server-side from the
+* task's own project, because the caller that matters next is not a person
+* clicking a button but Phase 12's orchestrator, and a client that supplies the
+* model is a client that can start a task on a provider the user does not use.
+*
+* Worktrees are absent for a harder reason: `prepareWorktree` needs a base
+* branch, a task carries none, and nothing resolves one server-side. A thread
+* started from a task therefore runs in the project's own checkout.
+*/
+const TaskStartThreadInput = Schema$1.Struct({ taskId: TaskIdField });
+/**
+* The started thread and the task as it now stands.
+*
+* Both are returned because both changed: the caller navigates to the thread,
+* and the board would otherwise show the old status until the change event
+* arrived.
+*/
+const TaskStartThreadResult = Schema$1.Struct({
+	task: Task,
+	threadId: ThreadId
+});
+/**
+* A task cannot be started, and the reason is a property of the task or the
+* server rather than a failure.
+*
+* Each reason is a different thing for the user to fix, which is why this is a
+* union and not one message. `no-model` is the one worth explaining: a task
+* carries no model selection, so the thread runs on the project's default. The
+* server-side fallback that exists for first-run bootstrap is deliberately not
+* used here — it hardcodes a provider, so reaching for it would silently start
+* someone who works in Claude on Codex. Failing is the honest answer.
+*/
+const TaskNotStartableReason = Schema$1.Literals([
+	"no-project",
+	"project-missing",
+	"no-model"
+]);
+var TaskNotStartableError = class extends Schema$1.TaggedErrorClass()("TaskNotStartableError", {
+	taskId: TaskId,
+	reason: TaskNotStartableReason
+}) {
+	get message() {
+		switch (this.reason) {
+			case "no-project": return "This task has no project, so there is nowhere to run it. Set a project on the task first.";
+			case "project-missing": return "This task's project is not registered on this server. Point it at a project that is.";
+			case "no-model": return "This task's project has no default model. Choose one in the project's settings, then start the task again.";
+		}
+	}
+};
 /** Result shape for the board's list RPC. */
 const TaskListResult$1 = Schema$1.Struct({ tasks: Schema$1.Array(Task) });
 /** Result shape for every RPC that resolves to a single task. */
@@ -8004,6 +8139,7 @@ const WS_METHODS = {
 	tasksCreate: "tasks.create",
 	tasksUpdate: "tasks.update",
 	tasksDelete: "tasks.delete",
+	tasksStartThread: "tasks.startThread",
 	hubGetSyncStatus: "hub.getSyncStatus",
 	hubConnect: "hub.connect",
 	hubDisconnect: "hub.disconnect",
@@ -8078,6 +8214,30 @@ const WsTasksDeleteRpc = Rpc.make(WS_METHODS.tasksDelete, {
 	error: TaskRpcError
 });
 /**
+* Start an agent on a task.
+*
+* This is the one task RPC that is not CRUD: it creates a thread, seeds it from
+* the task, and links the two. It lives in the `tasks.*` namespace because the
+* task is what it reads and writes — the thread is the side effect, not the
+* subject — and because the caller always names a task and never a thread.
+*
+* The error union is wider than the other task methods for the same reason. A
+* start can fail because the task is not startable, which is a property of the
+* row, or because the turn could not be dispatched, which is the orchestration
+* engine's own failure and already has a type.
+*/
+const WsTasksStartThreadRpc = Rpc.make(WS_METHODS.tasksStartThread, {
+	payload: TaskStartThreadInput,
+	success: TaskStartThreadResult,
+	error: Schema$1.Union([
+		TaskNotFoundError,
+		TaskNotStartableError,
+		TaskStoreError,
+		OrchestrationDispatchCommandError,
+		EnvironmentAuthorizationError
+	])
+});
+/**
 * Hub link and skill sync.
 *
 * Every one of these answers with the whole status rather than an
@@ -8590,7 +8750,7 @@ const WsSubscribeAuthAccessRpc = Rpc.make(WS_METHODS.subscribeAuthAccess, {
 	error: Schema$1.Union([AuthAccessStreamError, EnvironmentAuthorizationError]),
 	stream: true
 });
-const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
+const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsTasksStartThreadRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
 //#endregion
 //#region ../../packages/shared/src/oauthScope.ts
 const OAUTH_SCOPE_TOKEN = /^[\u0021\u0023-\u005b\u005d-\u007e]+$/u;
@@ -8736,7 +8896,7 @@ function deriveAuthClientMetadata(input) {
 //#endregion
 //#region src/auth/EnvironmentAuthPolicy.ts
 var EnvironmentAuthPolicy = class extends Context.Service()("@p4code/cli/auth/EnvironmentAuthPolicy") {};
-const make$69 = Effect.gen(function* () {
+const make$70 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const isRemoteReachable = isRemoteReachableHost(config.host);
 	const policy = config.mode === "desktop" ? isRemoteReachable ? "remote-reachable" : "desktop-managed-local" : isRemoteReachable ? "remote-reachable" : "loopback-browser";
@@ -8754,7 +8914,7 @@ const make$69 = Effect.gen(function* () {
 	};
 	return EnvironmentAuthPolicy.of({ getDescriptor: () => Effect.succeed(descriptor).pipe(Effect.withSpan("EnvironmentAuthPolicy.getDescriptor")) });
 });
-const layer$65 = Layer.effect(EnvironmentAuthPolicy, make$69);
+const layer$66 = Layer.effect(EnvironmentAuthPolicy, make$70);
 //#endregion
 //#region src/persistence/Errors.ts
 function summarizeSchemaIssue(issue) {
@@ -8935,7 +9095,7 @@ function toPersistenceSqlOrDecodeError$6(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$68 = Effect.gen(function* () {
+const make$69 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createSessionRow = SqlSchema.void({
 		Request: CreateAuthSessionInput,
@@ -9069,7 +9229,7 @@ const make$68 = Effect.gen(function* () {
 		setLastConnectedAt
 	};
 });
-const layer$64 = Layer.effect(AuthSessionRepository, make$68);
+const layer$65 = Layer.effect(AuthSessionRepository, make$69);
 //#endregion
 //#region src/auth/ServerSecretStore.ts
 const secretStoreErrorContext = {
@@ -9136,7 +9296,7 @@ const isSecretStoreError = Schema$1.is(SecretStoreError);
 const isPlatformError = (value) => Predicate.isTagged(value, "PlatformError");
 const isSecretAlreadyExistsError = (error) => "cause" in error && isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists";
 var ServerSecretStore = class extends Context.Service()("@p4code/cli/auth/ServerSecretStore") {};
-const make$67 = Effect.gen(function* () {
+const make$68 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -9206,7 +9366,7 @@ const make$67 = Effect.gen(function* () {
 		remove
 	});
 });
-const layer$63 = Layer.effect(ServerSecretStore, make$67);
+const layer$64 = Layer.effect(ServerSecretStore, make$68);
 //#endregion
 //#region src/auth/SessionStore.ts
 var MalformedSessionTokenError = class extends Schema$1.TaggedErrorClass()("MalformedSessionTokenError", {}) {
@@ -9444,7 +9604,7 @@ function toAuthClientSession(input) {
 		current: false
 	};
 }
-const make$66 = Effect.gen(function* () {
+const make$67 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const serverConfig = yield* ServerConfig$1;
 	const secretStore = yield* ServerSecretStore;
@@ -9758,7 +9918,7 @@ const make$66 = Effect.gen(function* () {
 		markDisconnected
 	});
 });
-const layer$62 = Layer.effect(SessionStore, make$66).pipe(Layer.provideMerge(layer$64));
+const layer$63 = Layer.effect(SessionStore, make$67).pipe(Layer.provideMerge(layer$65));
 //#endregion
 //#region src/persistence/AuthPairingLinks.ts
 const AuthPairingLinkRecord = Schema$1.Struct({
@@ -9819,7 +9979,7 @@ function toPersistenceSqlOrDecodeError$5(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$65 = Effect.gen(function* () {
+const make$66 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createPairingLinkRow = SqlSchema.void({
 		Request: CreateAuthPairingLinkInput,
@@ -9954,7 +10114,7 @@ const make$65 = Effect.gen(function* () {
 		getByCredential
 	};
 });
-const layer$61 = Layer.effect(AuthPairingLinkRepository, make$65);
+const layer$62 = Layer.effect(AuthPairingLinkRepository, make$66);
 //#endregion
 //#region src/auth/PairingGrantStore.ts
 var UnknownBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnknownBootstrapCredentialError", {}) {
@@ -10049,7 +10209,7 @@ const DEV_STARTUP_TTL_HOURS = Duration.hours(24);
 const PAIRING_TOKEN_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 const PAIRING_TOKEN_LENGTH = 12;
 const PAIRING_TOKEN_REJECTION_LIMIT = Math.floor(256 / 32) * 32;
-const make$64 = Effect.gen(function* () {
+const make$65 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const config = yield* ServerConfig$1;
 	const pairingLinks = yield* AuthPairingLinkRepository;
@@ -10247,7 +10407,7 @@ const make$64 = Effect.gen(function* () {
 		consume
 	});
 });
-const layer$60 = Layer.effect(PairingGrantStore, make$64).pipe(Layer.provideMerge(layer$61));
+const layer$61 = Layer.effect(PairingGrantStore, make$65).pipe(Layer.provideMerge(layer$62));
 //#endregion
 //#region src/persistence/Migrations/001_OrchestrationEvents.ts
 var _001_OrchestrationEvents_default = Effect.gen(function* () {
@@ -12020,7 +12180,7 @@ function parseBearerToken(request) {
 	const token = header.slice(7).trim();
 	return token.length > 0 ? token : null;
 }
-const make$63 = Effect.gen(function* () {
+const make$64 = Effect.gen(function* () {
 	const policy = yield* EnvironmentAuthPolicy;
 	const bootstrapCredentials = yield* PairingGrantStore;
 	const sessions = yield* SessionStore;
@@ -12215,9 +12375,9 @@ const make$63 = Effect.gen(function* () {
 		issueStartupPairingUrl
 	});
 });
-const layer$59 = Layer.effect(EnvironmentAuth, make$63).pipe(Layer.provideMerge(layer$60), Layer.provideMerge(layer$62), Layer.provideMerge(layer$65));
-const storageLayer = Layer.mergeAll(layer$63, layerConfig);
-const runtimeLayer = layer$59.pipe(Layer.provideMerge(storageLayer));
+const layer$60 = Layer.effect(EnvironmentAuth, make$64).pipe(Layer.provideMerge(layer$61), Layer.provideMerge(layer$63), Layer.provideMerge(layer$66));
+const storageLayer = Layer.mergeAll(layer$64, layerConfig);
+const runtimeLayer = layer$60.pipe(Layer.provideMerge(storageLayer));
 //#endregion
 //#region src/cliAuthFormat.ts
 const newline = "\n";
@@ -12972,7 +13132,7 @@ const runWithEnvironmentAuth = (flags, run, options) => Effect.gen(function* ()
 	}
 	return yield* Effect.gen(function* () {
 		return yield* run(yield* EnvironmentAuth);
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const ttlFlag = Flag.string("ttl").pipe(Flag.withSchema(DurationFromString), Flag.withDescription("TTL, for example `5m`, `1h`, `30d`, or `15 minutes`."), Flag.optional);
 const jsonFlag = Flag.boolean("json").pipe(Flag.withDescription("Emit JSON instead of human-readable output."), Flag.withDefault(false));
@@ -13069,6 +13229,64 @@ const authCommand = Command.make("auth").pipe(Command.withDescription("Manage th
 * @module HubConfig
 */
 var HubConfig = class extends Context.Service()("@p4code/cli/hub/HubConfig") {};
+const FAILURE_WINDOW_MS = 6e4;
+const BLOCK_DURATION_MS = 6e4;
+const initialThrottleState = {
+	windowStartMillis: 0,
+	failures: 0,
+	blockedUntilMillis: 0
+};
+/** Whether a *failing* request should be refused outright rather than checked. */
+const isBlocked = (state, nowMillis) => nowMillis < state.blockedUntilMillis;
+/** Seconds a caller should wait, for `retry-after`. Always at least one. */
+const retryAfterSeconds = (state, nowMillis) => Math.max(1, Math.ceil((state.blockedUntilMillis - nowMillis) / 1e3));
+/**
+* Count a failure, and start blocking once the window fills.
+*
+* The window is fixed rather than sliding: a sliding window needs the timestamp
+* of every attempt, which is unbounded memory for an unbounded attacker. A
+* fixed window lets a burst straddle a boundary and land up to twice the limit,
+* which for this purpose is a rounding error against the size of the search
+* space.
+*/
+const recordFailure = (state, nowMillis, limits = {
+	maxFailures: 10,
+	windowMillis: FAILURE_WINDOW_MS,
+	blockMillis: BLOCK_DURATION_MS
+}) => {
+	if (nowMillis - state.windowStartMillis >= limits.windowMillis) return {
+		windowStartMillis: nowMillis,
+		failures: 1,
+		blockedUntilMillis: 0
+	};
+	const failures = state.failures + 1;
+	return {
+		windowStartMillis: state.windowStartMillis,
+		failures,
+		blockedUntilMillis: failures >= limits.maxFailures ? nowMillis + limits.blockMillis : state.blockedUntilMillis
+	};
+};
+var HubAuthThrottle = class extends Context.Service()("@p4code/cli/hub/HubAuthThrottle") {};
+const DEFAULT_LIMITS = {
+	maxFailures: 10,
+	windowMillis: FAILURE_WINDOW_MS,
+	blockMillis: BLOCK_DURATION_MS
+};
+const make$63 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
+	const state = yield* Ref.make(initialThrottleState);
+	return HubAuthThrottle.of({
+		shouldRefuse: Effect.gen(function* () {
+			const now = yield* Clock.currentTimeMillis;
+			return isBlocked(yield* Ref.get(state), now);
+		}),
+		recordFailure: Effect.gen(function* () {
+			const now = yield* Clock.currentTimeMillis;
+			const next = yield* Ref.updateAndGet(state, (current) => recordFailure(current, now, limits));
+			return retryAfterSeconds(next, now);
+		})
+	});
+});
+const layer$59 = Layer.effect(HubAuthThrottle, make$63());
 //#endregion
 //#region src/hub/HubAuth.ts
 /**
@@ -13127,6 +13345,31 @@ var HubUnauthorizedError = class {
 	_tag = "HubUnauthorizedError";
 };
 /**
+* Too many failed attempts recently; this one was not even checked.
+*
+* Distinct from `HubUnauthorizedError` so the response can differ. A 429 is the
+* honest answer — the credential was not evaluated, so calling it invalid would
+* be a claim the hub did not make — and it tells a legitimate server retrying a
+* stale token to back off rather than hammer.
+*/
+var HubThrottledError = class {
+	_tag = "HubThrottledError";
+	retryAfterSeconds;
+	constructor(retryAfterSeconds) {
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+const hubThrottledResponse = (retryAfterSeconds) => HttpServerResponse.jsonUnsafe({
+	error: "too_many_hub_credential_failures",
+	message: "Too many failed credential attempts. Try again shortly."
+}, {
+	status: 429,
+	headers: {
+		"cache-control": "no-store",
+		"retry-after": String(retryAfterSeconds)
+	}
+});
+/**
 * Fails with {@link HubUnauthorizedError} unless the request carries a
 * configured bearer token. Route handlers run this first and let
 * `respondToHubAuthFailure` turn the failure into a 401.
@@ -13134,11 +13377,17 @@ var HubUnauthorizedError = class {
 const authenticateHubRequest = Effect.fn("HubAuth.authenticateHubRequest")(function* () {
 	const request = yield* HttpServerRequest.HttpServerRequest;
 	const { tokenHashes } = yield* HubConfig;
+	const throttle = yield* HubAuthThrottle;
 	const token = readBearerToken(request.headers.authorization);
-	if (!isAuthorizedHubToken(token, tokenHashes)) {
-		yield* Effect.logWarning("rejected hub request with an unusable credential", { reason: token.length === 0 ? "missing_bearer_token" : "unknown_token" });
-		return yield* Effect.fail(new HubUnauthorizedError());
+	if (isAuthorizedHubToken(token, tokenHashes)) return;
+	if (yield* throttle.shouldRefuse) {
+		const retryAfter = yield* throttle.recordFailure;
+		yield* Effect.logWarning("refused hub request without checking; too many recent failures", { reason: token.length === 0 ? "missing_bearer_token" : "unknown_token" });
+		return yield* Effect.fail(new HubThrottledError(retryAfter));
 	}
+	yield* throttle.recordFailure;
+	yield* Effect.logWarning("rejected hub request with an unusable credential", { reason: token.length === 0 ? "missing_bearer_token" : "unknown_token" });
+	return yield* Effect.fail(new HubUnauthorizedError());
 });
 const SHA256_HEX = /^[0-9a-f]{64}$/;
 /**
@@ -13547,6 +13796,7 @@ const storeUnavailable = HttpServerResponse.jsonUnsafe({
 */
 const respondToHubFailures = (handler) => handler.pipe(Effect.catch((cause) => {
 	if (cause._tag === "HubUnauthorizedError") return Effect.succeed(hubUnauthorizedResponse);
+	if (cause._tag === "HubThrottledError") return Effect.succeed(hubThrottledResponse(cause.retryAfterSeconds));
 	if (cause._tag === "InvalidHubRequest") return Effect.succeed(badRequest(cause.detail));
 	return Effect.logWarning("hub request failed", { cause }).pipe(Effect.as(storeUnavailable));
 }));
@@ -13942,7 +14192,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 	});
 	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
-const makeHubLayer = HttpRouter.serve(layer$58).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
+const makeHubLayer = HttpRouter.serve(layer$58).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$59), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
 //#endregion
 //#region src/atomicWrite.ts
@@ -16126,7 +16376,7 @@ const make$58 = Effect.gen(function* () {
 const layer$53 = Layer.effect(AssetSync, make$58);
 //#endregion
 //#region src/cli/assets.ts
-const SyncServicesLive = layer$53.pipe(Layer.provideMerge(layer$54), Layer.provideMerge(layer$55), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$63))), Layer.provideMerge(layer$63), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$53.pipe(Layer.provideMerge(layer$54), Layer.provideMerge(layer$55), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$64))), Layer.provideMerge(layer$64), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -16134,7 +16384,7 @@ const runWithSync = (flags, run) => Effect.gen(function* () {
 			sync: yield* AssetSync,
 			link: yield* HubLink
 		});
-	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
+	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
 });
 const STATE_LABEL = {
 	synced: "synced",
@@ -24582,7 +24832,7 @@ const RESTART_DELAY = Duration.seconds(2);
 /** Exact npm versions only — never dist-tags — so the acknowledgement names
 the version that was actually installed. Also keeps the value safe to
 pass to npm and embed in filesystem paths. */
-const EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const EXACT_VERSION_PATTERN$1 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 function normalizeEntryPath(entryPath) {
 	return entryPath.replaceAll("\\", "/");
 }
@@ -24698,7 +24948,7 @@ const make$50 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 		if (capability === null) return yield* failWith("This server cannot update itself; relaunch it manually with the new version.");
 		const activeMethod = capability;
 		const targetVersion = input.targetVersion.trim();
-		if (!EXACT_VERSION_PATTERN.test(targetVersion)) return yield* failWith(`'${targetVersion}' is not an exact p4 version.`);
+		if (!EXACT_VERSION_PATTERN$1.test(targetVersion)) return yield* failWith(`'${targetVersion}' is not an exact p4 version.`);
 		if (yield* Ref.getAndSet(inFlight, true)) return yield* failWith("A server update is already in progress.");
 		return yield* Effect.gen(function* () {
 			const runtimePaths = yield* ensurePinnedRuntimeInstalled({
@@ -24727,6 +24977,7 @@ const make$50 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 				const homeDir = env.HOME ?? "";
 				const unitPath = path.join(homeDir, ".config", "systemd", "user", BOOT_SERVICE_UNIT_FILE);
 				const previousUnit = yield* fs.readFileString(unitPath).pipe(Effect.mapError((cause) => failWith("Could not read the current systemd unit.", cause)));
+				const serviceOptions = yield* readServiceOptions({ baseDir: serverConfig.baseDir }).pipe(Effect.provideService(FileSystem.FileSystem, fs), Effect.provideService(Path.Path, path));
 				const unit = renderBootServiceUnit({
 					nodePath: host.execPath,
 					p4EntryPath: runtimePaths.entryPath,
@@ -24734,7 +24985,7 @@ const make$50 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 					logPath: path.join(serverConfig.logsDir, "boot-service.log"),
 					unitPath,
 					workingDirectory: homeDir,
-					serviceEnvironment: []
+					serviceEnvironment: serviceEnvironmentFor(serviceOptions)
 				});
 				yield* writeUnitAtomically(unitPath, unit).pipe(Effect.mapError((cause) => failWith("Could not update the systemd unit.", cause)));
 				const reloadSystemd = Effect.fn("cloud.server_self_update.reload_systemd")(function* () {
@@ -26603,7 +26854,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}));
-		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
+		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
 		return yield* Effect.gen(function* () {
 			const snapshot = yield* getOfflineSnapshot();
 			const orchestrationEngine = yield* OrchestrationEngineService;
@@ -26614,7 +26865,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}).pipe(Effect.provide(offlineRuntimeLayer));
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$42).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$66(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$42).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const projectAddCommand = Command.make("add", {
 	...projectLocationFlags,
@@ -30873,11 +31124,25 @@ function isResolvableContextWindowActivity(activity) {
 * newer updates still stream through and supersede the retained rows on the
 * client.
 */
+function withoutContextWindowBreakdown$1(activity) {
+	const payload = asRecord$1(activity.payload);
+	if (!payload || payload.breakdown === void 0) return activity;
+	const { breakdown: _breakdown, ...rest } = payload;
+	return {
+		...activity,
+		payload: rest
+	};
+}
 function dropStaleContextWindowActivities(activities) {
 	const latestIndexByTurn = /* @__PURE__ */ new Map();
 	for (let index = 0; index < activities.length; index += 1) if (isResolvableContextWindowActivity(activities[index])) latestIndexByTurn.set(activities[index].turnId, index);
 	if (latestIndexByTurn.size === 0) return activities;
-	return activities.filter((activity, index) => !isResolvableContextWindowActivity(activity) || latestIndexByTurn.get(activity.turnId) === index);
+	const newestIndex = Math.max(...latestIndexByTurn.values());
+	return activities.flatMap((activity, index) => {
+		if (!isResolvableContextWindowActivity(activity)) return [activity];
+		if (latestIndexByTurn.get(activity.turnId) !== index) return [];
+		return [index === newestIndex ? activity : withoutContextWindowBreakdown$1(activity)];
+	});
 }
 function projectThreadDetailSnapshot(snapshot) {
 	return {
@@ -31025,6 +31290,39 @@ const resolveTaskRepositoryKey = Effect.fn("taskBoard.resolveRepositoryKey")(fun
 	return (yield* (yield* RepositoryIdentityResolver).resolve(project.value.workspaceRoot))?.canonicalKey ?? null;
 });
 /**
+* Everything that decides whether a task can be started, as one pure function.
+*
+* Kept out of the RPC handler because the three refusals are the whole of the
+* interesting behaviour and each is a different thing for the user to fix,
+* while the handler around them is two store calls and a dispatch. Phase 12's
+* orchestrator has to make the same three decisions before it may claim a task,
+* and it should reach the same verdicts by calling this rather than by reading
+* the handler and reimplementing it.
+*
+* The project is passed in as the repository returns it — including soft-deleted
+* rows, which is why `deletedAt` is checked here rather than assumed away.
+*/
+const resolveTaskStart = (task, project) => {
+	if (task.projectId === null) return {
+		startable: false,
+		reason: "no-project"
+	};
+	if (Option.isNone(project) || project.value.deletedAt !== null) return {
+		startable: false,
+		reason: "project-missing"
+	};
+	const model = project.value.defaultModelSelection;
+	if (model === null) return {
+		startable: false,
+		reason: "no-model"
+	};
+	return {
+		startable: true,
+		projectId: task.projectId,
+		model
+	};
+};
+/**
 * Map a persistence failure to the caller-facing error.
 *
 * The underlying error carries SQL detail, which is noise to a client and, for
@@ -31036,6 +31334,54 @@ const toTaskStoreError = (operation) => (cause) => Effect.logWarning("task store
 	cause
 }).pipe(Effect.andThen(Effect.fail(new TaskStoreError({ operation }))));
 //#endregion
+//#region ../../packages/shared/src/taskExecution.ts
+/**
+* The `auto` rendering: here is the task, do it.
+*
+* Two instructions carry their weight. The agent is told its thread is already
+* linked to the task, because otherwise its first useful move is to guess which
+* board row it is on. And it is told to leave `status` alone: the server moved
+* the task to `in_progress` when it started the thread, and where the work goes
+* after that is the user's call — the same rule the scoping prompt follows, and
+* the reason the board's columns still mean something.
+*/
+const buildAutoPrompt = (task) => {
+	const body = task.body.trim();
+	return `You are picking up a task from the board. Do the work.
+
+## ${task.title}
+
+${body.length === 0 ? "_The task has no description. Read enough of the repository to work out what it means, and ask if it is genuinely ambiguous._" : body}
+
+This thread is linked to task \`${task.taskId}\`, which is now In progress. \`task_current\` re-reads it if you need the fields again.
+
+Record what you find with \`task_update\` as you go — a decision you made, a constraint you hit, something the task turned out to be wrong about. That is what makes the row worth reading afterwards. Leave \`status\` alone: moving work across the board is the user's call.
+
+Start by reading the code the task concerns. If it turns out to be specified too poorly to act on, say so and stop rather than guessing at what was meant.`;
+};
+/**
+* Render a task into the prompt that seeds its thread.
+*
+* Exhaustive over the mode on purpose: adding a member to [TaskExecutionMode]
+* without a rendering should fail to compile rather than fall through to `auto`.
+*/
+const buildTaskExecutionPrompt = (input) => {
+	switch (input.mode) {
+		case "auto": return buildAutoPrompt(input.task);
+	}
+};
+const TASK_THREAD_TITLE_MAX_LENGTH = 60;
+/**
+* The thread's title, which is the task's own — a thread started from a task is
+* that task, and a derived-from-the-prompt title would read as a sentence of
+* instructions in the sidebar.
+*/
+const buildTaskThreadTitle = (title) => {
+	const compact = title.trim().replace(/\s+/gu, " ");
+	if (compact.length === 0) return "Task";
+	return compact.length > TASK_THREAD_TITLE_MAX_LENGTH ? `${compact.slice(0, TASK_THREAD_TITLE_MAX_LENGTH - 1).trimEnd()}…` : compact;
+};
+//#endregion
 //#region src/observability/RpcInstrumentation.ts
 const RPC_SPAN_PREFIX = "ws.rpc";
 const DEFAULT_RPC_SPAN_ATTRIBUTES = {
@@ -40762,6 +41108,7 @@ const RPC_REQUIRED_SCOPE = /* @__PURE__ */ new Map([
 	[WS_METHODS.tasksCreate, AuthOrchestrationOperateScope],
 	[WS_METHODS.tasksUpdate, AuthOrchestrationOperateScope],
 	[WS_METHODS.tasksDelete, AuthOrchestrationOperateScope],
+	[WS_METHODS.tasksStartThread, AuthOrchestrationOperateScope],
 	[WS_METHODS.subscribeTasks, AuthOrchestrationReadScope],
 	[WS_METHODS.hubGetSyncStatus, AuthOrchestrationReadScope],
 	[WS_METHODS.hubConnect, AuthOrchestrationOperateScope],
@@ -40874,7 +41221,7 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 	const checkpointDiffQuery = yield* CheckpointDiffQuery;
 	const keybindings = yield* Keybindings;
 	const taskRepository = yield* TaskRepository;
-	yield* ProjectionProjectRepository;
+	const projectionProjects = yield* ProjectionProjectRepository;
 	const externalLauncher = yield* ExternalLauncher;
 	const gitWorkflow = yield* GitWorkflowService;
 	const review = yield* ReviewService;
@@ -41352,6 +41699,64 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 			return { task: patched.value };
 		}), { "rpc.aggregate": "tasks" }),
 		[WS_METHODS.tasksDelete]: ({ taskId }) => observeRpcEffect$1(WS_METHODS.tasksDelete, taskRepository.deleteById({ taskId }).pipe(Effect.catch(toTaskStoreError("tasks.delete")), Effect.as({})), { "rpc.aggregate": "tasks" }),
+		[WS_METHODS.tasksStartThread]: ({ taskId }) => observeRpcEffect$1(WS_METHODS.tasksStartThread, Effect.gen(function* () {
+			const found = yield* taskRepository.getById({ taskId }).pipe(Effect.catch(toTaskStoreError("tasks.startThread")));
+			if (Option.isNone(found)) return yield* new TaskNotFoundError({ taskId });
+			const task = found.value;
+			const plan = resolveTaskStart(task, task.projectId === null ? Option.none() : yield* projectionProjects.getById({ projectId: task.projectId }).pipe(Effect.catch(toTaskStoreError("tasks.startThread.project"))));
+			if (!plan.startable) return yield* new TaskNotStartableError({
+				taskId,
+				reason: plan.reason
+			});
+			const modelSelection = plan.model;
+			const threadId = ThreadId.make(yield* crypto.randomUUIDv4.pipe(Effect.orDie));
+			const createdAt = yield* nowIso$5;
+			const threadTitle = buildTaskThreadTitle(task.title);
+			const normalizedCommand = yield* normalizeDispatchCommand({
+				type: "thread.turn.start",
+				commandId: yield* serverCommandId("task-start-thread"),
+				threadId,
+				message: {
+					messageId: MessageId.make(yield* crypto.randomUUIDv4.pipe(Effect.orDie)),
+					role: "user",
+					text: buildTaskExecutionPrompt({
+						mode: "auto",
+						task: {
+							taskId,
+							title: task.title,
+							body: task.body
+						}
+					}),
+					attachments: []
+				},
+				modelSelection,
+				titleSeed: threadTitle,
+				runtimeMode: DEFAULT_RUNTIME_MODE$2,
+				interactionMode: DEFAULT_PROVIDER_INTERACTION_MODE,
+				bootstrap: { createThread: {
+					projectId: plan.projectId,
+					title: threadTitle,
+					modelSelection,
+					runtimeMode: DEFAULT_RUNTIME_MODE$2,
+					interactionMode: DEFAULT_PROVIDER_INTERACTION_MODE,
+					branch: null,
+					worktreePath: null,
+					createdAt
+				} },
+				createdAt
+			});
+			yield* dispatchNormalizedCommand(normalizedCommand);
+			const patched = yield* taskRepository.patch({
+				taskId,
+				threadId,
+				status: "in_progress"
+			}, yield* nowIso$5).pipe(Effect.catch(toTaskStoreError("tasks.startThread.link")));
+			if (Option.isNone(patched)) return yield* new TaskNotFoundError({ taskId });
+			return {
+				task: patched.value,
+				threadId
+			};
+		}), { "rpc.aggregate": "tasks" }),
 		[WS_METHODS.subscribeTasks]: (_input) => observeRpcStreamEffect$1(WS_METHODS.subscribeTasks, Effect.succeed(taskRepository.streamWithSnapshot.pipe(Stream.catch((cause) => Stream.fromEffect(toTaskStoreError("tasks.subscribe")(cause))))), { "rpc.aggregate": "tasks" }),
 		[WS_METHODS.hubGetSyncStatus]: (_input) => observeRpcEffect$1(WS_METHODS.hubGetSyncStatus, assetSync.status, { "rpc.aggregate": "hub" }),
 		[WS_METHODS.hubConnect]: (input) => observeRpcEffect$1(WS_METHODS.hubConnect, hubLink.connect(input).pipe(Effect.mapError((cause) => new HubLinkError({ detail: cause.message })), Effect.andThen(assetSync.status)), { "rpc.aggregate": "hub" }),
@@ -43610,7 +44015,7 @@ const makeOpenCodeRuntime = Effect.gen(function* () {
 	};
 });
 var OpenCodeRuntime = class extends Context.Service()("@p4code/cli/provider/opencodeRuntime") {};
-const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$67));
+const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$68));
 //#endregion
 //#region src/textGeneration/TextGenerationUtils.ts
 const isTextGenerationError$2 = Schema$1.is(TextGenerationError);
@@ -45149,13 +45554,178 @@ function normalizeClaudeActiveTokenUsage(value, contextWindow, totalProcessedTok
 		...totalProcessedTokens !== void 0 ? { totalProcessedTokens } : {}
 	});
 }
+/**
+* The contract's string fields are non-empty, and this payload is decoded on the
+* way out, so an entry the SDK reports with a blank name would fail the whole
+* event rather than lose one row. Drop those instead.
+*/
+function trimmedName(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function mapNamedCosts(entries) {
+	if (!entries || entries.length === 0) return;
+	const mapped = entries.flatMap((entry) => {
+		const name = trimmedName(entry.name);
+		const tokens = finiteNonNegativeInteger(entry.tokens);
+		return name !== void 0 && tokens !== void 0 ? [{
+			name,
+			tokens
+		}] : [];
+	});
+	return mapped.length > 0 ? mapped : void 0;
+}
+/**
+* Keeps the per-source attribution the SDK already computes on every turn. The
+* `gridRows` and `color` fields are dropped: they describe how the vendor CLI
+* paints its own meter, and this UI has its own.
+*/
+function claudeContextWindowBreakdown(value) {
+	const model = trimmedName(value.model);
+	const categories = value.categories.flatMap((category) => {
+		const name = trimmedName(category.name);
+		const tokens = finiteNonNegativeInteger(category.tokens);
+		if (name === void 0 || tokens === void 0) return [];
+		return [{
+			name,
+			tokens,
+			...category.isDeferred !== void 0 ? { isDeferred: category.isDeferred } : {}
+		}];
+	});
+	const mcpTools = value.mcpTools.flatMap((tool) => {
+		const name = trimmedName(tool.name);
+		const serverName = trimmedName(tool.serverName);
+		const tokens = finiteNonNegativeInteger(tool.tokens);
+		if (name === void 0 || serverName === void 0 || tokens === void 0) return [];
+		return [{
+			name,
+			serverName,
+			tokens,
+			...tool.isLoaded !== void 0 ? { isLoaded: tool.isLoaded } : {}
+		}];
+	});
+	const memoryFiles = value.memoryFiles.flatMap((file) => {
+		const path = trimmedName(file.path);
+		const tokens = finiteNonNegativeInteger(file.tokens);
+		if (path === void 0 || tokens === void 0) return [];
+		const type = trimmedName(file.type);
+		return [{
+			path,
+			tokens,
+			...type !== void 0 ? { type } : {}
+		}];
+	});
+	const agents = value.agents.flatMap((agent) => {
+		const agentType = trimmedName(agent.agentType);
+		const tokens = finiteNonNegativeInteger(agent.tokens);
+		if (agentType === void 0 || tokens === void 0) return [];
+		const source = trimmedName(agent.source);
+		return [{
+			agentType,
+			tokens,
+			...source !== void 0 ? { source } : {}
+		}];
+	});
+	const deferredBuiltinTools = value.deferredBuiltinTools?.flatMap((tool) => {
+		const name = trimmedName(tool.name);
+		const tokens = finiteNonNegativeInteger(tool.tokens);
+		return name !== void 0 && tokens !== void 0 ? [{
+			name,
+			tokens,
+			isLoaded: tool.isLoaded
+		}] : [];
+	});
+	const skillsSource = value.skills;
+	const skillEntries = skillsSource?.skillFrontmatter.flatMap((skill) => {
+		const name = trimmedName(skill.name);
+		const tokens = finiteNonNegativeInteger(skill.tokens);
+		if (name === void 0 || tokens === void 0) return [];
+		const source = trimmedName(skill.source);
+		return [{
+			name,
+			tokens,
+			...source !== void 0 ? { source } : {}
+		}];
+	});
+	const skills = skillsSource === void 0 ? void 0 : {
+		totalSkills: finiteNonNegativeInteger(skillsSource.totalSkills) ?? 0,
+		includedSkills: finiteNonNegativeInteger(skillsSource.includedSkills) ?? 0,
+		tokens: finiteNonNegativeInteger(skillsSource.tokens) ?? 0,
+		...skillEntries && skillEntries.length > 0 ? { entries: skillEntries } : {}
+	};
+	const slashCommandsSource = value.slashCommands;
+	const slashCommands = slashCommandsSource === void 0 ? void 0 : {
+		totalCommands: finiteNonNegativeInteger(slashCommandsSource.totalCommands) ?? 0,
+		includedCommands: finiteNonNegativeInteger(slashCommandsSource.includedCommands) ?? 0,
+		tokens: finiteNonNegativeInteger(slashCommandsSource.tokens) ?? 0
+	};
+	const messagesSource = value.messageBreakdown;
+	const toolCallsByType = messagesSource?.toolCallsByType.flatMap((entry) => {
+		const name = trimmedName(entry.name);
+		const callTokens = finiteNonNegativeInteger(entry.callTokens);
+		const resultTokens = finiteNonNegativeInteger(entry.resultTokens);
+		return name !== void 0 && callTokens !== void 0 && resultTokens !== void 0 ? [{
+			name,
+			callTokens,
+			resultTokens
+		}] : [];
+	});
+	const attachmentsByType = mapNamedCosts(messagesSource?.attachmentsByType);
+	const messages = messagesSource === void 0 ? void 0 : {
+		toolCallTokens: finiteNonNegativeInteger(messagesSource.toolCallTokens) ?? 0,
+		toolResultTokens: finiteNonNegativeInteger(messagesSource.toolResultTokens) ?? 0,
+		attachmentTokens: finiteNonNegativeInteger(messagesSource.attachmentTokens) ?? 0,
+		assistantMessageTokens: finiteNonNegativeInteger(messagesSource.assistantMessageTokens) ?? 0,
+		userMessageTokens: finiteNonNegativeInteger(messagesSource.userMessageTokens) ?? 0,
+		redirectedContextTokens: finiteNonNegativeInteger(messagesSource.redirectedContextTokens) ?? 0,
+		unattributedTokens: finiteNonNegativeInteger(messagesSource.unattributedTokens) ?? 0,
+		...toolCallsByType && toolCallsByType.length > 0 ? { toolCallsByType } : {},
+		...attachmentsByType !== void 0 ? { attachmentsByType } : {}
+	};
+	const systemTools = mapNamedCosts(value.systemTools);
+	const systemPromptSections = mapNamedCosts(value.systemPromptSections);
+	const autoCompactThreshold = finiteNonNegativeInteger(value.autoCompactThreshold);
+	const breakdown = {
+		...model !== void 0 ? { model } : {},
+		...categories.length > 0 ? { categories } : {},
+		...mcpTools.length > 0 ? { mcpTools } : {},
+		...skills !== void 0 ? { skills } : {},
+		...memoryFiles.length > 0 ? { memoryFiles } : {},
+		...agents.length > 0 ? { agents } : {},
+		...systemTools !== void 0 ? { systemTools } : {},
+		...deferredBuiltinTools && deferredBuiltinTools.length > 0 ? { deferredBuiltinTools } : {},
+		...systemPromptSections !== void 0 ? { systemPromptSections } : {},
+		...slashCommands !== void 0 ? { slashCommands } : {},
+		...messages !== void 0 ? { messages } : {},
+		...autoCompactThreshold !== void 0 ? { autoCompactThreshold } : {}
+	};
+	return Object.keys(breakdown).length > 0 ? breakdown : void 0;
+}
+/**
+* Drops the attribution from a snapshot that is being carried forward. The token
+* counts still describe the thread, but the breakdown was measured against a
+* turn that has since moved on. A stale breakdown presented as the current one
+* is worse than none, because nothing about it looks stale.
+*/
+function withoutContextWindowBreakdown(usage) {
+	if (!usage || usage.breakdown === void 0) return usage;
+	const { breakdown: _breakdown, ...rest } = usage;
+	return rest;
+}
 function normalizeClaudeContextUsageApiSnapshot(value, totalProcessedTokens) {
-	return makeClaudeTokenUsageSnapshot({
+	const snapshot = makeClaudeTokenUsageSnapshot({
 		activeTokens: value.totalTokens,
 		contextWindow: value.maxTokens,
 		...totalProcessedTokens !== void 0 ? { totalProcessedTokens } : {},
 		compactsAutomatically: value.isAutoCompactEnabled
 	});
+	if (!snapshot) return;
+	const breakdown = claudeContextWindowBreakdown(value);
+	return breakdown !== void 0 ? {
+		...snapshot,
+		breakdown
+	} : snapshot;
 }
 function compactBoundaryTokenUsageSnapshot(message, contextWindow, totalProcessedTokens) {
 	const metadata = message.compact_metadata;
@@ -45948,7 +46518,7 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 		const resultHasActiveUsage = resultUsageRecord !== void 0 && (hasResultUsageIteration || claudeUsageInputTokens(resultUsageRecord) + claudeUsageOutputTokens(resultUsageRecord) > 0);
 		const resultTotalOnly = resultUsageRecord !== void 0 && !resultHasActiveUsage && claudeTotalProcessedTokens(resultUsageRecord) !== void 0;
 		const resultIterationSnapshot = resultUsageRecord ? normalizeClaudeActiveTokenUsage(resultUsageRecord, maxTokens, accumulatedTotalProcessedTokens ?? context.lastKnownTotalProcessedTokens) : void 0;
-		const lastGoodUsage = context.lastKnownTokenUsage;
+		const lastGoodUsage = withoutContextWindowBreakdown(context.lastKnownTokenUsage);
 		const usageSnapshot = contextUsageSnapshot ?? (resultTotalOnly && lastGoodUsage ? {
 			...lastGoodUsage,
 			...typeof maxTokens === "number" && Number.isFinite(maxTokens) && maxTokens > 0 ? { maxTokens } : {},
@@ -82703,9 +83273,9 @@ const WorkspaceEntriesLayerLive = layer$26.pipe(Layer.provide(layer$42));
 const WorkspaceFileSystemLayerLive = layer$25.pipe(Layer.provide(layer$42), Layer.provide(WorkspaceEntriesLayerLive));
 const WorkspaceLayerLive = Layer.mergeAll(layer$42, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
 const ProjectFaviconResolverLayerLive = layer$40.pipe(Layer.provide(layer$42), Layer.provide(layer$41));
-const AuthLayerLive = layer$59.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$63));
+const AuthLayerLive = layer$60.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$64));
 const ProviderRuntimeLayerLive = ProviderSessionReaperLive.pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$50), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$63))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(layer$44), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$56), Layer.provideMerge(layer$63)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$47), Layer.provideMerge(layer$49), Layer.provideMerge(layer$48), Layer.provide(layer$67));
+const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$50), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$64))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(layer$44), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$56), Layer.provideMerge(layer$64)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$47), Layer.provideMerge(layer$49), Layer.provideMerge(layer$48), Layer.provide(layer$68));
 /**
 * Hub asset sync.
 *
@@ -82773,6 +83343,151 @@ const serveCommand = Command.make("serve", { ...sharedServerCommandFlags }).pipe
 	forceAutoBootstrapProjectFromCwd: false
 })));
 //#endregion
+//#region src/service/cliSelfUpdate.ts
+/**
+* Upgrading the globally installed CLI, then the service that runs it.
+*
+* Two steps that have to happen in that order and from different binaries, and
+* getting the order wrong is silent: `service update` renders the unit from the
+* *running* CLI, and pins that version into the runtime directory. Run the
+* reconcile from the old process and you install a new CLI and then carefully
+* point the service back at the old one.
+*
+* So the second step re-executes the newly installed binary. That is also why
+* this is not `ServerSelfUpdate`: that path respawns the server in place, which
+* it explicitly refuses to do under launchd — KeepAlive would restart the
+* process being replaced and leave two servers on one port. Under a supervisor
+* the honest sequence is install, then let the supervisor restart, which is
+* exactly what `service update` does.
+*
+* @module service/cliSelfUpdate
+*/
+/** npm can take minutes when a native dependency compiles from source. */
+const CLI_INSTALL_TIMEOUT_MS = 600 * 1e3;
+const PACKAGE_NAME = "@p4code/cli";
+/**
+* Exact versions or the two dist-tags, and nothing else.
+*
+* The value is handed to npm and printed back as "installed X". An arbitrary
+* string could be a git URL or a local path, which npm would happily install
+* and which would make the acknowledgement a lie.
+*/
+const EXACT_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?$/u;
+const isInstallableVersion = (value) => value === "latest" || value === "next" || EXACT_VERSION_PATTERN.test(value);
+var CliSelfUpdateError = class extends Schema$1.TaggedErrorClass()("CliSelfUpdateError", {
+	step: Schema$1.String,
+	detail: Schema$1.optional(Schema$1.String)
+}) {
+	get message() {
+		return this.detail === void 0 ? `Self-update failed while ${this.step}.` : `Self-update failed while ${this.step}: ${this.detail}`;
+	}
+};
+/**
+* Where `npm install --global` put the executable.
+*
+* Asked of npm rather than assumed, because the answer differs between a
+* Homebrew node, an nvm one and a system one — and the whole point of this step
+* is to run the binary that was just written, not the one on this process's
+* PATH, which a shell may have cached.
+*/
+const resolveGlobalBinary = Effect.fn("cli.selfUpdate.resolveGlobalBinary")(function* (binaryName) {
+	const result = yield* (yield* ProcessRunner).run({
+		command: "npm",
+		args: ["prefix", "--global"]
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step: "locating the npm global prefix",
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step: "locating the npm global prefix",
+		detail: `npm exited with code ${String(result.code)}`
+	});
+	const prefix = result.stdout.trim();
+	if (prefix.length === 0) return yield* new CliSelfUpdateError({
+		step: "locating the npm global prefix",
+		detail: "npm printed no prefix"
+	});
+	return `${prefix}/bin/${binaryName}`;
+});
+const installGlobalCli = Effect.fn("cli.selfUpdate.installGlobalCli")(function* (input) {
+	const runner = yield* ProcessRunner;
+	const step = `installing ${PACKAGE_NAME}@${input.version}`;
+	const result = yield* runner.run({
+		command: "npm",
+		args: [
+			"install",
+			"--global",
+			"--no-fund",
+			"--no-audit",
+			`${PACKAGE_NAME}@${input.version}`
+		],
+		timeout: CLI_INSTALL_TIMEOUT_MS
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step,
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: result.stderr.trim().length > 0 ? result.stderr.trim() : `exit code ${String(result.code)}`
+	});
+});
+/**
+* Ask the freshly installed binary what version it is.
+*
+* A completed npm install can still be unusable — a native dependency that
+* failed to build, a Node too old — and it is better to find that out here,
+* while the service is still running the version that works, than after
+* pointing the unit at it.
+*/
+const readInstalledVersion = Effect.fn("cli.selfUpdate.readInstalledVersion")(function* (binaryPath) {
+	const runner = yield* ProcessRunner;
+	const step = "verifying the installed CLI";
+	const result = yield* runner.run({
+		command: binaryPath,
+		args: ["--version"]
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step,
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: `the installed CLI exited with code ${String(result.code)}`
+	});
+	const match = /(\d+\.\d+\.\d+(?:-[0-9A-Za-z-.]+)?)/u.exec(result.stdout);
+	if (match?.[1] === void 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: "the installed CLI did not report a version"
+	});
+	return match[1];
+});
+/**
+* Hand the rest of the work to the new binary.
+*
+* `service update` from *this* process would pin this process's version. The
+* new binary reconciles to itself, which is the only way the unit ends up
+* pointing at what was just installed.
+*/
+const reconcileWithNewBinary = Effect.fn("cli.selfUpdate.reconcileWithNewBinary")(function* (input) {
+	const runner = yield* ProcessRunner;
+	const step = "updating the service to the new version";
+	const result = yield* runner.run({
+		command: input.binaryPath,
+		args: [
+			"service",
+			"update",
+			...input.baseDir === void 0 ? [] : ["--base-dir", input.baseDir]
+		],
+		timeout: CLI_INSTALL_TIMEOUT_MS
+	}).pipe(Effect.mapError((cause) => new CliSelfUpdateError({
+		step,
+		detail: String(cause)
+	})));
+	if (result.code !== 0) return yield* new CliSelfUpdateError({
+		step,
+		detail: result.stderr.trim().length > 0 ? result.stderr.trim() : `exit code ${String(result.code)}`
+	});
+});
+//#endregion
 //#region src/cli/service.ts
 const isBootServiceCommandError = Schema$1.is(BootServiceCommandError);
 const bootServiceLayer = (config) => layer$46({
@@ -82918,6 +83633,39 @@ const serviceRestartCommand = Command.make("restart", projectLocationFlags).pipe
 	yield* service.restart;
 	yield* Console.log("Restarted the P4Code service.");
 }))));
+/**
+* Install a newer CLI, then point the service at it.
+*
+* Deliberately not `ServerSelfUpdate`, which the server uses to replace itself
+* in place: that path refuses to run under launchd, because KeepAlive would
+* restart the process being replaced and leave two servers on one port. Under a
+* supervisor the honest sequence is install, then reconcile and let the
+* supervisor restart — which is what this does, from the new binary.
+*/
+const serviceSelfUpdateCommand = Command.make("self-update", {
+	...projectLocationFlags,
+	version: Flag.string("version").pipe(Flag.withDescription("Version or dist-tag to install (default latest)."), Flag.optional)
+}).pipe(Command.withDescription("Install the newest @p4code/cli and update the service to run it."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
+	const requested = Option.getOrElse(flags.version, () => "latest");
+	if (!isInstallableVersion(requested)) {
+		yield* Console.error(`'${requested}' is not a version or dist-tag. Use an exact version, or latest.`);
+		return;
+	}
+	yield* Console.log(`Installing ${PACKAGE_NAME}@${requested}…`);
+	yield* installGlobalCli({ version: requested });
+	const binaryPath = yield* resolveGlobalBinary("p4c");
+	const installed = yield* readInstalledVersion(binaryPath);
+	if (installed === version) {
+		yield* Console.log(`Already running @p4code/cli@${installed}; nothing to update.`);
+		return;
+	}
+	yield* Console.log(`Installed @p4code/cli@${installed}; updating the service…`);
+	yield* reconcileWithNewBinary({
+		binaryPath,
+		baseDir: void 0
+	});
+	yield* Console.log(`Service now runs @p4code/cli@${installed}.`);
+}))));
 const serviceStatusCommand = Command.make("status", projectLocationFlags).pipe(Command.withDescription("Show whether the P4Code background service is installed."), Command.withHandler((flags) => runServiceCommand(flags, Effect.gen(function* () {
 	const service = yield* BootService;
 	yield* Console.log(formatServiceStatus(yield* service.status, version));
@@ -82942,11 +83690,12 @@ const serviceCommand = Command.make("service").pipe(Command.withDescription("Man
 	serviceUninstallCommand,
 	serviceUpdateCommand,
 	serviceRestartCommand,
+	serviceSelfUpdateCommand,
 	serviceStatusCommand
 ]));
 //#endregion
 //#region src/bin.ts
-const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$67, FetchHttpClient.layer);
+const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$68, FetchHttpClient.layer);
 /**
 * Prints an update reminder before dispatching, at most once a day.
 *