@p4code/cli 0.1.18 → 0.1.19

package/dist/bin.mjs

@@ -121,7 +121,7 @@ const closeServer = (server) => {
 * NetService - Service tag for startup networking helpers.
 */
 var NetService = class extends Context.Service()("@p4code/shared/Net/NetService") {};
-const make$75 = () => {
+const make$76 = () => {
 	/**
 	* Returns true when a TCP server can bind to {host, port}.
 	* `EADDRNOTAVAIL` is treated as available so IPv6-absent hosts don't fail
@@ -230,10 +230,10 @@ const make$75 = () => {
 		})
 	};
 };
-const layer$71 = Layer.sync(NetService, make$75);
+const layer$72 = Layer.sync(NetService, make$76);
 //#endregion
 //#region package.json
-var version = "0.1.18";
+var version = "0.1.19";
 //#endregion
 //#region src/config.ts
 /**
@@ -254,8 +254,8 @@ var ServerConfig$1 = class extends Context.Service()("@p4code/cli/config/ServerC
 	/** @deprecated Import and use `layerTest` from this module. */
 	static layerTest = (cwd, baseDirOrPrefix) => layerTest$2(cwd, baseDirOrPrefix);
 };
-const make$74 = (config) => ServerConfig$1.of(config);
-const layer$70 = (config) => Layer.succeed(ServerConfig$1, make$74(config));
+const make$75 = (config) => ServerConfig$1.of(config);
+const layer$71 = (config) => Layer.succeed(ServerConfig$1, make$75(config));
 const deriveServerPaths = Effect.fn(function* (baseDir, devUrl, options = {}) {
 	const { join } = yield* Path.Path;
 	const stateDir = join(baseDir, devUrl !== void 0 && !options.baseDirIsExplicit ? "dev" : "userdata");
@@ -3430,6 +3430,36 @@ const PreviewAutomationNetworkEntry = Schema.Struct({
 	errorText: Schema.optional(Schema.String),
 	timestamp: Schema.String
 });
+/** Value of an accessibility state such as `expanded`, `checked` or `level`. */
+const PreviewAccessibilityState = Schema.Union([
+	Schema.String,
+	Schema.Number,
+	Schema.Boolean
+]);
+/**
+* A node of the compacted accessibility tree. `parentId` points at the nearest
+* emitted ancestor, so the hierarchy is reconstructible without child lists.
+*/
+const PreviewAccessibilityNode = Schema.Struct({
+	id: Schema.String,
+	parentId: Schema.optional(Schema.String),
+	role: Schema.String,
+	name: Schema.optional(Schema.String),
+	description: Schema.optional(Schema.String),
+	value: Schema.optional(Schema.String),
+	states: Schema.optional(Schema.Record(Schema.String, PreviewAccessibilityState))
+});
+/**
+* Semantic nodes only: ignored nodes, raw text nodes and unnamed layout
+* wrappers are dropped, and the node list is capped. `totalNodes` counts the
+* nodes that survived filtering, so `truncated` distinguishes a clipped tree
+* from a small page.
+*/
+const PreviewAccessibilitySnapshot = Schema.Struct({
+	nodes: Schema.Array(PreviewAccessibilityNode),
+	totalNodes: Schema.Int,
+	truncated: Schema.Boolean
+});
 const PreviewAutomationActionEvent = Schema.Struct({
 	id: Schema.String,
 	action: Schema.String,
@@ -3449,7 +3479,7 @@ const PreviewAutomationSnapshot = Schema.Struct({
 	loading: Schema.Boolean,
 	visibleText: Schema.String,
 	interactiveElements: Schema.Array(PreviewAutomationElement),
-	accessibilityTree: Schema.Unknown,
+	accessibilityTree: PreviewAccessibilitySnapshot,
 	consoleEntries: Schema.Array(PreviewAutomationConsoleEntry),
 	networkEntries: Schema.Array(PreviewAutomationNetworkEntry),
 	actionTimeline: Schema.Array(PreviewAutomationActionEvent),
@@ -7218,6 +7248,21 @@ const RepositoryKeyField = TrimmedNonEmptyString.pipe(Schema$1.annotateEncoded({
 * placed by hand and falls back to the priority/recency order.
 */
 const OrderKeyField = TrimmedNonEmptyString.pipe(Schema$1.annotateEncoded({ description: "Manual board position key. Lexicographic: smaller sorts higher in the column. Null means no manual position." }));
+/**
+* Where a task came from when it did not originate on this board.
+*
+* The identifier is the tracker's own, not ours: `MOBILE-12262` reads the same
+* in p4code as it does in Linear, in a commit message, and in conversation,
+* which is the whole point of carrying it. `url` is what the tracker itself
+* reported, never a guess assembled from the identifier - a Linear URL embeds
+* the workspace slug, so a constructed one would 404.
+*/
+const TaskExternalRef = Schema$1.Struct({
+	source: Schema$1.Literals(["linear"]),
+	identifier: TrimmedNonEmptyString,
+	url: TrimmedNonEmptyString
+});
+const ExternalRefField = TaskExternalRef.pipe(Schema$1.annotateEncoded({ description: "The tracker issue this task mirrors, e.g. a Linear ticket. Null for a task that originated on this board." }));
 const LabelsField = Schema$1.Array(TaskLabel).check(Schema$1.isMaxLength(TASK_LABELS_MAX_COUNT)).pipe(Schema$1.annotateEncoded({ description: "Free-form tags used to group and filter tasks." }));
 const TaskIdField = TaskId.pipe(Schema$1.annotateEncoded({ description: "Id of the task to act on - the UUID or the readable id (e.g. P4-12)." }));
 const Task = Schema$1.Struct({
@@ -7259,6 +7304,13 @@ const Task = Schema$1.Struct({
 	* to a history.
 	*/
 	threadId: Schema$1.NullOr(ThreadId),
+	/**
+	* The tracker issue this task mirrors, or `null` for a task that was filed
+	* here. Nullable-with-default for the same version-skew reason as
+	* `readableId` above: a row from a store without the migration decodes to
+	* `null` rather than failing the whole board.
+	*/
+	externalRef: Schema$1.NullOr(TaskExternalRef).pipe(Schema$1.withDecodingDefault(Effect.succeed(null))),
 	title: TrimmedNonEmptyString.check(Schema$1.isMaxLength(TASK_TITLE_MAX_LENGTH)),
 	body: Schema$1.String,
 	status: StoredStatusField,
@@ -7272,6 +7324,7 @@ const TaskCreateInput = Schema$1.Struct({
 	projectId: Schema$1.optional(ProjectIdField),
 	repositoryKey: Schema$1.optional(RepositoryKeyField),
 	threadId: Schema$1.optional(ThreadIdField),
+	externalRef: Schema$1.optional(ExternalRefField),
 	title: TitleField,
 	body: Schema$1.optional(BodyField),
 	status: Schema$1.optional(StatusField),
@@ -7310,6 +7363,7 @@ const TaskUpdateInput = Schema$1.Struct({
 	projectId: Schema$1.optional(Schema$1.NullOr(ProjectIdField)),
 	repositoryKey: Schema$1.optional(Schema$1.NullOr(RepositoryKeyField)),
 	threadId: Schema$1.optional(Schema$1.NullOr(ThreadIdField)),
+	externalRef: Schema$1.optional(Schema$1.NullOr(ExternalRefField)),
 	title: Schema$1.optional(TitleField),
 	body: Schema$1.optional(BodyField),
 	status: Schema$1.optional(StatusField),
@@ -7675,6 +7729,58 @@ var ProjectWriteFileError = class extends Schema$1.TaggedErrorClass()("ProjectWr
 	}
 };
 //#endregion
+//#region ../../packages/contracts/src/ticket.ts
+/**
+* Reading an issue out of an external tracker.
+*
+* One call, deliberately: p4code does not sync trackers, it recognizes a ticket
+* somebody pasted and asks the tracker what it is called. Everything durable
+* that comes back is stored on a task as its {@link TaskExternalRef}.
+*
+* The tracker is reached through the MCP server the user already registered for
+* it, so there is no second place to configure credentials and no p4code-owned
+* API key. That also bounds what this can ever answer: a tracker with no MCP
+* server registered, or one never signed in to on this machine, is reported as
+* unconfigured rather than silently returning nothing.
+*
+* @module contracts/ticket
+*/
+/**
+* A tracker reference as it was typed, before anything has confirmed it exists.
+*
+* Deliberately not the parsed `{ source, identifier }` pair: what a user pastes
+* is a URL as often as an id, and which tracker a bare `MOBILE-12262` belongs
+* to is a question only the resolver can answer.
+*/
+const TicketResolveInput = Schema$1.Struct({ reference: TrimmedNonEmptyString });
+const TicketResolveResult = Schema$1.Struct({
+	externalRef: TaskExternalRef,
+	/** The issue title as the tracker reports it, for the task that mirrors it. */
+	title: TrimmedNonEmptyString
+});
+/**
+* Why a reference could not be turned into a ticket.
+*
+* The reason is separate from the detail because the client acts on it: an
+* unconfigured tracker is a thing the user can fix in Settings and is worth
+* saying so about, while `unavailable` is a retry and `not_found` usually means
+* a typo. `detail` is the sentence to show; the reason decides the shape.
+*/
+const TicketResolveFailureReason = Schema$1.Literals([
+	"not_configured",
+	"not_authorized",
+	"not_found",
+	"unavailable"
+]);
+var TicketResolveError = class extends Schema$1.TaggedErrorClass()("TicketResolveError", {
+	reason: TicketResolveFailureReason,
+	detail: Schema$1.String
+}) {
+	get message() {
+		return this.detail;
+	}
+};
+//#endregion
 //#region ../../packages/contracts/src/threadControl.ts
 /**
 * Thread control over MCP - the self-scoped toolkit an agent uses to act on
@@ -8726,6 +8832,7 @@ const WS_METHODS = {
 	tasksUpdate: "tasks.update",
 	tasksDelete: "tasks.delete",
 	tasksStartThread: "tasks.startThread",
+	ticketsResolve: "tickets.resolve",
 	hubGetSyncStatus: "hub.getSyncStatus",
 	hubConnect: "hub.connect",
 	hubDisconnect: "hub.disconnect",
@@ -9033,6 +9140,17 @@ const WsMcpOAuthDisconnectRpc = Rpc.make(WS_METHODS.mcpOAuthDisconnect, {
 	error: Schema$1.Union([McpRegistryError, EnvironmentAuthorizationError])
 });
 /**
+* Asks the tracker what a pasted reference is, without writing anything.
+*
+* Read-only on purpose: the caller decides whether the answer becomes a task.
+* A resolve that filed a row would make an accidental paste a board entry.
+*/
+const WsTicketsResolveRpc = Rpc.make(WS_METHODS.ticketsResolve, {
+	payload: TicketResolveInput,
+	success: TicketResolveResult,
+	error: Schema$1.Union([TicketResolveError, EnvironmentAuthorizationError])
+});
+/**
 * The board, then every change to it, for as long as the client stays
 * subscribed. The leading snapshot is what makes this sufficient on its own —
 * a client does not list first, so there is no window between the two in which
@@ -9410,7 +9528,7 @@ const WsSubscribeAuthAccessRpc = Rpc.make(WS_METHODS.subscribeAuthAccess, {
 	error: Schema$1.Union([AuthAccessStreamError, EnvironmentAuthorizationError]),
 	stream: true
 });
-const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetProviderUsageRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsTasksStartThreadRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsAssetsCreateLocalRpc, WsAssetsRemoveLocalRpc, WsSkillRegistrySearchRpc, WsSkillRegistryFetchRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsMcpOAuthBeginRpc, WsMcpOAuthDisconnectRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
+const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetProviderUsageRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsTasksStartThreadRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsAssetsCreateLocalRpc, WsAssetsRemoveLocalRpc, WsSkillRegistrySearchRpc, WsSkillRegistryFetchRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsMcpOAuthBeginRpc, WsMcpOAuthDisconnectRpc, WsTicketsResolveRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
 //#endregion
 //#region ../../packages/shared/src/oauthScope.ts
 const OAUTH_SCOPE_TOKEN = /^[\u0021\u0023-\u005b\u005d-\u007e]+$/u;
@@ -9556,7 +9674,7 @@ function deriveAuthClientMetadata(input) {
 //#endregion
 //#region src/auth/EnvironmentAuthPolicy.ts
 var EnvironmentAuthPolicy = class extends Context.Service()("@p4code/cli/auth/EnvironmentAuthPolicy") {};
-const make$73 = Effect.gen(function* () {
+const make$74 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const isRemoteReachable = isRemoteReachableHost(config.host);
 	const policy = config.mode === "desktop" ? isRemoteReachable ? "remote-reachable" : "desktop-managed-local" : isRemoteReachable ? "remote-reachable" : "loopback-browser";
@@ -9574,7 +9692,7 @@ const make$73 = Effect.gen(function* () {
 	};
 	return EnvironmentAuthPolicy.of({ getDescriptor: () => Effect.succeed(descriptor).pipe(Effect.withSpan("EnvironmentAuthPolicy.getDescriptor")) });
 });
-const layer$69 = Layer.effect(EnvironmentAuthPolicy, make$73);
+const layer$70 = Layer.effect(EnvironmentAuthPolicy, make$74);
 //#endregion
 //#region src/persistence/Errors.ts
 function summarizeSchemaIssue(issue) {
@@ -9755,7 +9873,7 @@ function toPersistenceSqlOrDecodeError$6(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$72 = Effect.gen(function* () {
+const make$73 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createSessionRow = SqlSchema.void({
 		Request: CreateAuthSessionInput,
@@ -9889,7 +10007,7 @@ const make$72 = Effect.gen(function* () {
 		setLastConnectedAt
 	};
 });
-const layer$68 = Layer.effect(AuthSessionRepository, make$72);
+const layer$69 = Layer.effect(AuthSessionRepository, make$73);
 //#endregion
 //#region src/auth/ServerSecretStore.ts
 const secretStoreErrorContext = {
@@ -9956,7 +10074,7 @@ const isSecretStoreError = Schema$1.is(SecretStoreError);
 const isPlatformError = (value) => Predicate.isTagged(value, "PlatformError");
 const isSecretAlreadyExistsError = (error) => "cause" in error && isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists";
 var ServerSecretStore = class extends Context.Service()("@p4code/cli/auth/ServerSecretStore") {};
-const make$71 = Effect.gen(function* () {
+const make$72 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -10026,7 +10144,7 @@ const make$71 = Effect.gen(function* () {
 		remove
 	});
 });
-const layer$67 = Layer.effect(ServerSecretStore, make$71);
+const layer$68 = Layer.effect(ServerSecretStore, make$72);
 //#endregion
 //#region src/auth/SessionStore.ts
 var MalformedSessionTokenError = class extends Schema$1.TaggedErrorClass()("MalformedSessionTokenError", {}) {
@@ -10264,7 +10382,7 @@ function toAuthClientSession(input) {
 		current: false
 	};
 }
-const make$70 = Effect.gen(function* () {
+const make$71 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const serverConfig = yield* ServerConfig$1;
 	const secretStore = yield* ServerSecretStore;
@@ -10578,7 +10696,7 @@ const make$70 = Effect.gen(function* () {
 		markDisconnected
 	});
 });
-const layer$66 = Layer.effect(SessionStore, make$70).pipe(Layer.provideMerge(layer$68));
+const layer$67 = Layer.effect(SessionStore, make$71).pipe(Layer.provideMerge(layer$69));
 //#endregion
 //#region src/persistence/AuthPairingLinks.ts
 const AuthPairingLinkRecord = Schema$1.Struct({
@@ -10639,7 +10757,7 @@ function toPersistenceSqlOrDecodeError$5(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$69 = Effect.gen(function* () {
+const make$70 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createPairingLinkRow = SqlSchema.void({
 		Request: CreateAuthPairingLinkInput,
@@ -10774,7 +10892,7 @@ const make$69 = Effect.gen(function* () {
 		getByCredential
 	};
 });
-const layer$65 = Layer.effect(AuthPairingLinkRepository, make$69);
+const layer$66 = Layer.effect(AuthPairingLinkRepository, make$70);
 //#endregion
 //#region src/auth/PairingGrantStore.ts
 var UnknownBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnknownBootstrapCredentialError", {}) {
@@ -10869,7 +10987,7 @@ const DEV_STARTUP_TTL_HOURS = Duration.hours(24);
 const PAIRING_TOKEN_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 const PAIRING_TOKEN_LENGTH = 12;
 const PAIRING_TOKEN_REJECTION_LIMIT = Math.floor(256 / 32) * 32;
-const make$68 = Effect.gen(function* () {
+const make$69 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const config = yield* ServerConfig$1;
 	const pairingLinks = yield* AuthPairingLinkRepository;
@@ -11067,7 +11185,7 @@ const make$68 = Effect.gen(function* () {
 		consume
 	});
 });
-const layer$64 = Layer.effect(PairingGrantStore, make$68).pipe(Layer.provideMerge(layer$65));
+const layer$65 = Layer.effect(PairingGrantStore, make$69).pipe(Layer.provideMerge(layer$66));
 //#endregion
 //#region src/persistence/Migrations/001_OrchestrationEvents.ts
 var _001_OrchestrationEvents_default = Effect.gen(function* () {
@@ -12520,6 +12638,28 @@ var _039_ProjectionThreadsCompressMode_default = Effect.gen(function* () {
   `;
 });
 //#endregion
+//#region src/persistence/Migrations/040_TaskExternalRef.ts
+/**
+* The tracker issue a task mirrors, for tasks that did not start on this board.
+*
+* Stored as one JSON blob rather than three columns because nothing queries
+* inside it except the uniqueness check below, and a tracker's shape is not
+* ours to normalize - a second source will bring fields Linear does not have.
+*
+* The unique index is over the identifier alone, extracted from the JSON: it is
+* what stops a second paste of the same ticket from filing a duplicate task.
+* Partial, so the many rows with no external ref do not collide on NULL.
+*/
+var _040_TaskExternalRef_default = Effect.gen(function* () {
+	const sql = yield* SqlClient.SqlClient;
+	yield* sql`ALTER TABLE tasks ADD COLUMN external_ref_json TEXT`;
+	yield* sql`
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_external_ref_identifier
+    ON tasks(json_extract(external_ref_json, '$.identifier'))
+    WHERE external_ref_json IS NOT NULL
+  `;
+});
+//#endregion
 //#region src/persistence/Migrations.ts
 /**
 * MigrationsLive - Migration runner with inline loader
@@ -12735,6 +12875,11 @@ const migrationEntries = [
 		39,
 		"ProjectionThreadsCompressMode",
 		_039_ProjectionThreadsCompressMode_default
+	],
+	[
+		40,
+		"TaskExternalRef",
+		_040_TaskExternalRef_default
 	]
 ];
 const makeMigrationLoader = (throughId) => Migrator.fromRecord(Object.fromEntries(migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -12922,7 +13067,7 @@ function parseBearerToken(request) {
 	const token = header.slice(7).trim();
 	return token.length > 0 ? token : null;
 }
-const make$67 = Effect.gen(function* () {
+const make$68 = Effect.gen(function* () {
 	const policy = yield* EnvironmentAuthPolicy;
 	const bootstrapCredentials = yield* PairingGrantStore;
 	const sessions = yield* SessionStore;
@@ -13117,9 +13262,9 @@ const make$67 = Effect.gen(function* () {
 		issueStartupPairingUrl
 	});
 });
-const layer$63 = Layer.effect(EnvironmentAuth, make$67).pipe(Layer.provideMerge(layer$64), Layer.provideMerge(layer$66), Layer.provideMerge(layer$69));
-const storageLayer = Layer.mergeAll(layer$67, layerConfig);
-const runtimeLayer = layer$63.pipe(Layer.provideMerge(storageLayer));
+const layer$64 = Layer.effect(EnvironmentAuth, make$68).pipe(Layer.provideMerge(layer$65), Layer.provideMerge(layer$67), Layer.provideMerge(layer$70));
+const storageLayer = Layer.mergeAll(layer$68, layerConfig);
+const runtimeLayer = layer$64.pipe(Layer.provideMerge(storageLayer));
 //#endregion
 //#region src/cliAuthFormat.ts
 const newline = "\n";
@@ -13874,7 +14019,7 @@ const runWithEnvironmentAuth = (flags, run, options) => Effect.gen(function* ()
 	}
 	return yield* Effect.gen(function* () {
 		return yield* run(yield* EnvironmentAuth);
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$70(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$71(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const ttlFlag = Flag.string("ttl").pipe(Flag.withSchema(DurationFromString), Flag.withDescription("TTL, for example `5m`, `1h`, `30d`, or `15 minutes`."), Flag.optional);
 const jsonFlag = Flag.boolean("json").pipe(Flag.withDescription("Emit JSON instead of human-readable output."), Flag.withDefault(false));
@@ -14014,7 +14159,7 @@ const DEFAULT_LIMITS = {
 	windowMillis: FAILURE_WINDOW_MS,
 	blockMillis: BLOCK_DURATION_MS
 };
-const make$66 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
+const make$67 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
 	const state = yield* Ref.make(initialThrottleState);
 	return HubAuthThrottle.of({
 		shouldRefuse: Effect.gen(function* () {
@@ -14028,7 +14173,7 @@ const make$66 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LI
 		})
 	});
 });
-const layer$62 = Layer.effect(HubAuthThrottle, make$66());
+const layer$63 = Layer.effect(HubAuthThrottle, make$67());
 //#endregion
 //#region src/hub/HubAuth.ts
 /**
@@ -14342,7 +14487,10 @@ const DeleteTaskInput = Schema$1.Struct({ taskId: TaskId });
 var TaskRepository = class extends Context.Service()("@p4code/cli/persistence/Services/Tasks/TaskRepository") {};
 //#endregion
 //#region src/persistence/Layers/Tasks.ts
-const TaskDbRow = Task.mapFields(Struct.assign({ labels: Schema$1.fromJsonString(Schema$1.Array(TaskLabel)) }));
+const TaskDbRow = Task.mapFields(Struct.assign({
+	labels: Schema$1.fromJsonString(Schema$1.Array(TaskLabel)),
+	externalRef: Schema$1.NullOr(Schema$1.fromJsonString(TaskExternalRef))
+}));
 /**
 * The `list` filter with every field normalized to a bound `null` rather than
 * an absent key. Each predicate is then `(:param IS NULL OR column = :param)`,
@@ -14362,6 +14510,7 @@ const TASK_COLUMNS = `
   project_id AS "projectId",
   repository_key AS "repositoryKey",
   thread_id AS "threadId",
+  external_ref_json AS "externalRef",
   title,
   body,
   status,
@@ -14385,6 +14534,7 @@ const makeTaskRepository = Effect.gen(function* () {
           project_id,
           repository_key,
           thread_id,
+          external_ref_json,
           title,
           body,
           status,
@@ -14401,6 +14551,7 @@ const makeTaskRepository = Effect.gen(function* () {
           ${row.projectId},
           ${row.repositoryKey},
           ${row.threadId},
+          ${row.externalRef === null ? null : JSON.stringify(row.externalRef)},
           ${row.title},
           ${row.body},
           ${row.status},
@@ -14417,6 +14568,7 @@ const makeTaskRepository = Effect.gen(function* () {
           project_id = excluded.project_id,
           repository_key = excluded.repository_key,
           thread_id = excluded.thread_id,
+          external_ref_json = excluded.external_ref_json,
           title = excluded.title,
           body = excluded.body,
           status = excluded.status,
@@ -14515,6 +14667,7 @@ const makeTaskRepository = Effect.gen(function* () {
 			...input.projectId !== void 0 ? { projectId: input.projectId } : {},
 			...input.repositoryKey !== void 0 ? { repositoryKey: input.repositoryKey } : {},
 			...input.threadId !== void 0 ? { threadId: input.threadId } : {},
+			...input.externalRef !== void 0 ? { externalRef: input.externalRef } : {},
 			...input.title !== void 0 ? { title: input.title } : {},
 			...input.body !== void 0 ? { body: input.body } : {},
 			...input.status !== void 0 ? { status: input.status } : {},
@@ -14686,6 +14839,7 @@ const createTaskRoute = HttpRouter.add("POST", "/tasks", respondToHubFailures(Ef
 		projectId: input.projectId ?? null,
 		repositoryKey: input.repositoryKey ?? null,
 		threadId: input.threadId ?? null,
+		externalRef: input.externalRef ?? null,
 		title: input.title,
 		body: input.body ?? "",
 		status: input.status ?? "backlog",
@@ -14827,7 +14981,7 @@ const deleteAssetRoute = HttpRouter.add("DELETE", "/assets/:kind/:name", respond
 	const outcome = yield* (yield* AgentAssetRepository).deleteByName(requested);
 	return outcome._tag === "conflict" ? assetConflict(Option.getOrNull(outcome.current)) : HttpServerResponse.empty({ status: 204 });
 })));
-const layer$61 = Layer.mergeAll(healthRoute, listTasksRoute, getTaskRoute, createTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute);
+const layer$62 = Layer.mergeAll(healthRoute, listTasksRoute, getTaskRoute, createTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute);
 //#endregion
 //#region src/hub/Migrations/001_Tasks.ts
 /**
@@ -14989,6 +15143,22 @@ var _005_TaskOrderKeys_default = Effect.gen(function* () {
 	yield* (yield* SqlClient.SqlClient)`ALTER TABLE tasks ADD COLUMN order_key TEXT`;
 });
 //#endregion
+//#region src/hub/Migrations/006_TaskExternalRef.ts
+/**
+* The tracker issue a task mirrors, mirroring the environment server's
+* migration 040. The hub carries the column so a task filed against a Linear
+* ticket on one machine still reads as that ticket on another.
+*/
+var _006_TaskExternalRef_default = Effect.gen(function* () {
+	const sql = yield* SqlClient.SqlClient;
+	yield* sql`ALTER TABLE tasks ADD COLUMN external_ref_json TEXT`;
+	yield* sql`
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_external_ref_identifier
+    ON tasks(json_extract(external_ref_json, '$.identifier'))
+    WHERE external_ref_json IS NOT NULL
+  `;
+});
+//#endregion
 //#region src/hub/Migrations.ts
 /**
 * Hub migrations.
@@ -15024,6 +15194,11 @@ const hubMigrationEntries = [
 		5,
 		"TaskOrderKeys",
 		_005_TaskOrderKeys_default
+	],
+	[
+		6,
+		"TaskExternalRef",
+		_006_TaskExternalRef_default
 	]
 ];
 const hubMigrationLoader = Migrator.fromRecord(Object.fromEntries(hubMigrationEntries.map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -15106,7 +15281,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 	});
 	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
-const makeHubLayer = HttpRouter.serve(layer$61).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$62), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
+const makeHubLayer = HttpRouter.serve(layer$62).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$63), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
 //#endregion
 //#region src/atomicWrite.ts
@@ -15230,7 +15405,7 @@ function stripDefaultServerSettings(current, defaults) {
 	}
 	return Object.is(current, defaults) ? void 0 : current;
 }
-const make$65 = Effect.gen(function* () {
+const make$66 = Effect.gen(function* () {
 	const { settingsPath } = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const pathService = yield* Path.Path;
@@ -15451,7 +15626,7 @@ const make$65 = Effect.gen(function* () {
 		}
 	};
 });
-const layer$60 = Layer.effect(ServerSettingsService, make$65);
+const layer$61 = Layer.effect(ServerSettingsService, make$66);
 //#endregion
 //#region src/pathExpansion.ts
 /**
@@ -15793,7 +15968,7 @@ function claudeEntryFromRegistration(registration) {
 	};
 }
 var ClaudeMcpFiles = class extends Context.Service()("@p4code/cli/mcp/ClaudeMcpFiles") {};
-const make$64 = Effect.gen(function* () {
+const make$65 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const services = yield* Effect.context();
@@ -15858,7 +16033,7 @@ const make$64 = Effect.gen(function* () {
 		removeProject: (projectDir, name) => removeAt(Effect.succeed(projectFile(projectDir)))(name)
 	};
 });
-const layer$59 = Layer.effect(ClaudeMcpFiles, make$64);
+const layer$60 = Layer.effect(ClaudeMcpFiles, make$65);
 Layer.succeed(ClaudeMcpFiles, {
 	readUser: Effect.succeed([]),
 	upsertUser: () => Effect.fail(new McpRegistryError({ detail: "No Claude config in tests." })),
@@ -15994,7 +16169,7 @@ const decodeClientRegistration = Schema$1.decodeUnknownExit(ClientRegistrationRe
 const decodeTokenResponse = Schema$1.decodeUnknownExit(TokenResponse);
 var McpOAuth = class extends Context.Service()("@p4code/cli/mcp/McpOAuth") {};
 const registryError = (detail) => new McpRegistryError({ detail });
-const make$63 = Effect.gen(function* () {
+const make$64 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
 	const http = yield* HttpClient.HttpClient;
@@ -16314,7 +16489,7 @@ const make$63 = Effect.gen(function* () {
 		accessTokenFor
 	};
 });
-const layer$58 = Layer.effect(McpOAuth, make$63);
+const layer$59 = Layer.effect(McpOAuth, make$64);
 Layer.succeed(McpOAuth, {
 	statusFor: () => Effect.succeed(Option.none()),
 	begin: () => Effect.fail(new McpRegistryError({ detail: "OAuth sign-in is not available." })),
@@ -16332,7 +16507,7 @@ const decodeRegistration$1 = Schema$1.decodeUnknownExit(RegistrationFromJson$1);
 const encodeRegistration = Schema$1.encodeSync(RegistrationFromJson$1);
 var McpRegistry = class extends Context.Service()("@p4code/cli/mcp/McpRegistry") {};
 const slotsOf = (registration) => registration.secrets ?? [];
-const make$62 = Effect.gen(function* () {
+const make$63 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
 	const oauth = yield* McpOAuth;
@@ -16483,7 +16658,7 @@ const make$62 = Effect.gen(function* () {
 		}).pipe(Effect.provide(services), Effect.catchCause((cause) => Effect.logWarning("mcp registry resolve failed", { cause }).pipe(Effect.as({}))))
 	};
 });
-const layer$57 = Layer.effect(McpRegistry, make$62);
+const layer$58 = Layer.effect(McpRegistry, make$63);
 //#endregion
 //#region src/sync/skillDirectory.ts
 /**
@@ -16862,7 +17037,7 @@ const formatHubLink = (input) => encodeStoredHubLink({
 	shareMode: input.shareMode
 });
 const fromEnvironment = (environment) => validateHubLink(environment.P4CODE_HUB_URL ?? "", environment.P4CODE_HUB_TOKEN ?? "");
-const make$61 = Effect.fn("HubLink.make")(function* (environment) {
+const make$62 = Effect.fn("HubLink.make")(function* (environment) {
 	const secrets = yield* ServerSecretStore;
 	const env = environment ?? process.env;
 	const fromEnv = fromEnvironment(env);
@@ -16928,7 +17103,7 @@ const make$61 = Effect.fn("HubLink.make")(function* (environment) {
 		})
 	};
 });
-const layer$56 = Layer.effect(HubLink, make$61());
+const layer$57 = Layer.effect(HubLink, make$62());
 //#endregion
 //#region src/sync/HubAssetClient.ts
 /**
@@ -16961,7 +17136,7 @@ const decodeAssetListPage = Schema$1.decodeUnknownEffect(AssetListPage);
 const decodeConflictBody$1 = Schema$1.decodeUnknownEffect(ConflictBody$1);
 const decodeAsset = Schema$1.decodeUnknownEffect(AgentAsset);
 var HubAssetClient = class extends Context.Service()("@p4code/cli/sync/HubAssetClient") {};
-const make$60 = Effect.gen(function* () {
+const make$61 = Effect.gen(function* () {
 	const http = yield* HttpClient.HttpClient;
 	const link = yield* HubLink;
 	const requireSettings = Effect.gen(function* () {
@@ -17043,7 +17218,7 @@ const make$60 = Effect.gen(function* () {
 		remove
 	};
 });
-const layer$55 = Layer.effect(HubAssetClient, make$60);
+const layer$56 = Layer.effect(HubAssetClient, make$61);
 //#endregion
 //#region src/sync/mcpRegistrationFiles.ts
 /**
@@ -17618,7 +17793,7 @@ const EMPTY_REPORT = {
 	unavailable: null
 };
 var AssetSync = class extends Context.Service()("@p4code/cli/sync/AssetSync") {};
-const make$59 = Effect.gen(function* () {
+const make$60 = Effect.gen(function* () {
 	const client = yield* HubAssetClient;
 	const link = yield* HubLink;
 	const settingsStore = yield* ServerSettingsService;
@@ -18331,7 +18506,7 @@ const make$59 = Effect.gen(function* () {
 		removeLocal
 	};
 });
-const layer$54 = Layer.effect(AssetSync, make$59);
+const layer$55 = Layer.effect(AssetSync, make$60);
 //#endregion
 //#region src/provider/CompressPrompts.ts
 /**
@@ -18590,7 +18765,7 @@ const findAgentPreset = (requested) => {
 };
 //#endregion
 //#region src/cli/assets.ts
-const SyncServicesLive = layer$54.pipe(Layer.provideMerge(layer$55), Layer.provideMerge(layer$56), Layer.provideMerge(layer$60.pipe(Layer.provide(layer$67))), Layer.provideMerge(layer$67), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$55.pipe(Layer.provideMerge(layer$56), Layer.provideMerge(layer$57), Layer.provideMerge(layer$61.pipe(Layer.provide(layer$68))), Layer.provideMerge(layer$68), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -18598,7 +18773,7 @@ const runWithSync = (flags, run) => Effect.gen(function* () {
 			sync: yield* AssetSync,
 			link: yield* HubLink
 		});
-	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$70(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
+	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$71(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
 });
 const STATE_LABEL = {
 	synced: "synced",
@@ -23950,12 +24125,12 @@ const runProcessCore = Effect.fn("processRunner.runProcessCore")(function* (spaw
 		stderrTruncated: stderr.truncated
 	};
 });
-const make$58 = Effect.fn("ProcessRunner.make")(function* () {
+const make$59 = Effect.fn("ProcessRunner.make")(function* () {
 	const spawner = yield* ChildProcessSpawner$1.ChildProcessSpawner;
 	const run = (input) => finalizeRunProcess(runProcessCore(spawner, input), input);
 	return ProcessRunner.of({ run });
 });
-const layer$53 = Layer.effect(ProcessRunner, make$58());
+const layer$54 = Layer.effect(ProcessRunner, make$59());
 //#endregion
 //#region src/project/RepositoryIdentityResolver.ts
 const DEFAULT_REPOSITORY_IDENTITY_CACHE_CAPACITY = 512;
@@ -24046,7 +24221,7 @@ const resolveRepositoryIdentityFromCacheKey = Effect.fn("RepositoryIdentityResol
 		rootPath: cacheKey
 	}) : null;
 });
-const make$57 = Effect.fn("RepositoryIdentityResolver.make")(function* (options = {}) {
+const make$58 = Effect.fn("RepositoryIdentityResolver.make")(function* (options = {}) {
 	const processRunner = yield* ProcessRunner;
 	const repositoryIdentityCache = yield* Cache.makeWith((cacheKey) => resolveRepositoryIdentityFromCacheKey(cacheKey).pipe(Effect.provideService(ProcessRunner, processRunner)), {
 		capacity: options.cacheCapacity ?? DEFAULT_REPOSITORY_IDENTITY_CACHE_CAPACITY,
@@ -24061,7 +24236,7 @@ const make$57 = Effect.fn("RepositoryIdentityResolver.make")(function* (options
 	});
 	return RepositoryIdentityResolver.of({ resolve });
 });
-const layer$52 = Layer.effect(RepositoryIdentityResolver, make$57()).pipe(Layer.provide(layer$53));
+const layer$53 = Layer.effect(RepositoryIdentityResolver, make$58()).pipe(Layer.provide(layer$54));
 //#endregion
 //#region src/orchestration/Layers/ProjectionSnapshotQuery.ts
 const decodeReadModel = Schema$1.decodeUnknownEffect(OrchestrationReadModel);
@@ -25881,7 +26056,7 @@ function mergeWithDefaultKeybindings(custom) {
 * Keybindings - Service tag for keybinding configuration operations.
 */
 var Keybindings = class extends Context.Service()("@p4code/cli/keybindings") {};
-const make$56 = Effect.gen(function* () {
+const make$57 = Effect.gen(function* () {
 	const { keybindingsConfigPath } = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -26142,7 +26317,7 @@ const make$56 = Effect.gen(function* () {
 		}))
 	};
 });
-const layer$51 = Layer.effect(Keybindings, make$56);
+const layer$52 = Layer.effect(Keybindings, make$57);
 //#endregion
 //#region src/process/externalLauncher.ts
 /**
@@ -26369,7 +26544,7 @@ const launchEditorProcess = Effect.fn("externalLauncher.launchEditorProcess")(fu
 		cause
 	}));
 });
-const make$55 = Effect.gen(function* () {
+const make$56 = Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner$1.ChildProcessSpawner;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -26380,7 +26555,7 @@ const make$55 = Effect.gen(function* () {
 		launchEditor: (input) => provideCommandResolutionServices(Effect.flatMap(resolveEditorLaunch(input), (launch) => launchEditorProcess(launch).pipe(Effect.provideService(ChildProcessSpawner$1.ChildProcessSpawner, spawner))))
 	});
 });
-const layer$50 = Layer.effect(ExternalLauncher, make$55);
+const layer$51 = Layer.effect(ExternalLauncher, make$56);
 //#endregion
 //#region src/orchestration/Services/OrchestrationReactor.ts
 /**
@@ -26398,7 +26573,7 @@ var OrchestrationReactor = class extends Context.Service()("@p4code/cli/orchestr
 //#endregion
 //#region src/serverLifecycleEvents.ts
 var ServerLifecycleEvents = class extends Context.Service()("@p4code/cli/serverLifecycleEvents") {};
-const make$54 = Effect.gen(function* () {
+const make$55 = Effect.gen(function* () {
 	const pubsub = yield* PubSub.unbounded();
 	const state = yield* Ref.make({
 		sequence: 0,
@@ -26422,7 +26597,7 @@ const make$54 = Effect.gen(function* () {
 		}
 	};
 });
-const layer$49 = Layer.effect(ServerLifecycleEvents, make$54);
+const layer$50 = Layer.effect(ServerLifecycleEvents, make$55);
 //#endregion
 //#region src/telemetry/Identify.ts
 const CodexAuthJsonSchema = Schema$1.Struct({ tokens: Schema$1.Struct({ account_id: Schema$1.String }) });
@@ -26595,7 +26770,7 @@ var AnalyticsService = class AnalyticsService extends Context.Service()("@p4code
 	/** No-op layer for callers that intentionally disable telemetry. */
 	static layerTest = Layer.succeed(AnalyticsService, inert);
 };
-const make$53 = Effect.gen(function* () {
+const make$54 = Effect.gen(function* () {
 	const telemetryConfig = yield* TelemetryEnvConfig;
 	const posthogKey = telemetryConfig.posthogKey.trim();
 	if (!telemetryConfig.enabled || posthogKey === "") return inert;
@@ -26665,7 +26840,7 @@ const make$53 = Effect.gen(function* () {
 		flush
 	});
 });
-const layer$48 = Layer.effect(AnalyticsService, make$53);
+const layer$49 = Layer.effect(AnalyticsService, make$54);
 AnalyticsService.layerTest;
 //#endregion
 //#region src/service/pinnedRuntime.ts
@@ -27012,7 +27187,7 @@ var BootServiceInstallError = class extends Schema$1.TaggedErrorClass()("BootSer
 	}
 };
 var BootService = class extends Context.Service()("@p4code/cli/service/bootService") {};
-const make$52 = Effect.fn("cloud.boot_service.make")(function* (input) {
+const make$53 = Effect.fn("cloud.boot_service.make")(function* (input) {
 	const hostExecPath = yield* HostProcessExecutablePath;
 	const hostArguments = yield* HostProcessArguments;
 	const host = input.host ?? {
@@ -27231,7 +27406,7 @@ const make$52 = Effect.fn("cloud.boot_service.make")(function* (input) {
 		logPath
 	});
 });
-const layer$47 = (input) => Layer.effect(BootService, make$52(input));
+const layer$48 = (input) => Layer.effect(BootService, make$53(input));
 //#endregion
 //#region src/service/selfUpdate.ts
 /**
@@ -27306,7 +27481,7 @@ const resolveServerSelfUpdateCapability = Effect.fn("cloud.server_self_update.re
 	return null;
 });
 var ServerSelfUpdate = class extends Context.Service()("@p4code/cli/service/selfUpdate/ServerSelfUpdate") {};
-const make$51 = Effect.fn("cloud.server_self_update.make")(function* (options) {
+const make$52 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 	const serverConfig = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -27456,7 +27631,7 @@ const make$51 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 	});
 	return ServerSelfUpdate.of({ update });
 });
-const layer$46 = Layer.effect(ServerSelfUpdate, make$51()).pipe(Layer.provide(layer$53));
+const layer$47 = Layer.effect(ServerSelfUpdate, make$52()).pipe(Layer.provide(layer$54));
 //#endregion
 //#region src/environment/ServerEnvironmentLabel.ts
 const ServerEnvironmentLabelCommandProbe = Schema$1.Literals(["macos-computer-name", "linux-pretty-hostname"]);
@@ -27588,7 +27763,7 @@ function platformArch(architecture) {
 		default: return "other";
 	}
 }
-const make$50 = Effect.gen(function* () {
+const make$51 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const serverConfig = yield* ServerConfig$1;
@@ -27651,7 +27826,7 @@ const make$50 = Effect.gen(function* () {
 * state. It intentionally has no fallback Layer.succeed value: callers must
 * provide the external platform services and a ServerConfig.
 */
-const layer$45 = Layer.effect(ServerEnvironment, make$50).pipe(Layer.provide(layer$53));
+const layer$46 = Layer.effect(ServerEnvironment, make$51).pipe(Layer.provide(layer$54));
 //#endregion
 //#region src/provider/Services/ProviderSessionReaper.ts
 var ProviderSessionReaper = class extends Context.Service()("@p4code/cli/provider/Services/ProviderSessionReaper") {};
@@ -28728,7 +28903,7 @@ const maybeOpenBrowser = (target) => Effect.gen(function* () {
 	yield* (yield* ExternalLauncher).launchBrowser(target).pipe(Effect.catch(() => Effect.logInfo("browser auto-open unavailable", { hint: `Open ${target} in your browser.` })));
 });
 const runStartupPhase = (phase, effect) => effect.pipe(Effect.annotateSpans({ "startup.phase": phase }), Effect.withSpan(`server.startup.${phase}`));
-const make$49 = Effect.gen(function* () {
+const make$50 = Effect.gen(function* () {
 	const serverConfig = yield* ServerConfig$1;
 	const keybindings = yield* Keybindings;
 	const orchestrationReactor = yield* OrchestrationReactor;
@@ -28869,7 +29044,7 @@ const make$49 = Effect.gen(function* () {
 		enqueueCommand: commandGate.enqueueCommand
 	};
 });
-const layer$44 = Layer.effect(ServerRuntimeStartup, make$49);
+const layer$45 = Layer.effect(ServerRuntimeStartup, make$50);
 //#endregion
 //#region src/serverRuntimeState.ts
 const PersistedServerRuntimeState = Schema$1.Struct({
@@ -29017,7 +29192,7 @@ function expandHomePath$2(input, path) {
 	if (input.startsWith("~/") || input.startsWith("~\\")) return path.join(NodeOS.homedir(), input.slice(2));
 	return input;
 }
-const make$48 = Effect.gen(function* () {
+const make$49 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const statWorkspaceRoot = Effect.fn("WorkspacePaths.statWorkspaceRoot")(function* (workspaceRoot, normalizedWorkspaceRoot, phase) {
@@ -29074,7 +29249,7 @@ const make$48 = Effect.gen(function* () {
 		resolveRelativePathWithinRoot
 	});
 });
-const layer$43 = Layer.effect(WorkspacePaths, make$48);
+const layer$44 = Layer.effect(WorkspacePaths, make$49);
 //#endregion
 //#region src/cli/project.ts
 const isEnvironmentHttpCommonError = Schema$1.is(EnvironmentHttpCommonError);
@@ -29180,7 +29355,7 @@ const projectCommandUuid = Crypto.Crypto.pipe(Effect.flatMap((crypto) => crypto.
 	operation: "generateProjectCommandId",
 	cause
 })));
-const ProjectCliRuntimeLive = Layer.mergeAll(layer$43, OrchestrationLayerLive.pipe(Layer.provideMerge(layer$52), Layer.provideMerge(layerConfig)));
+const ProjectCliRuntimeLive = Layer.mergeAll(layer$44, OrchestrationLayerLive.pipe(Layer.provideMerge(layer$53), Layer.provideMerge(layerConfig)));
 const PROJECT_CLI_LIVE_SERVER_TIMEOUT = Duration.seconds(1);
 const withProjectCliSessionToken = (environmentAuth, run) => Effect.acquireUseRelease(environmentAuth.issueSession({
 	scopes: AuthAdministrativeScopes,
@@ -29271,7 +29446,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}));
-		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$70(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
+		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$71(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
 		return yield* Effect.gen(function* () {
 			const snapshot = yield* getOfflineSnapshot();
 			const orchestrationEngine = yield* OrchestrationEngineService;
@@ -29282,7 +29457,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}).pipe(Effect.provide(offlineRuntimeLayer));
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$43).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$70(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$44).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$71(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const projectAddCommand = Command.make("add", {
 	...projectLocationFlags,
@@ -29889,7 +30064,7 @@ const logP4ProjectFileLoadError = (error) => Effect.logWarning(error).pipe(Effec
 	filePath: error.filePath,
 	errorTag: error._tag
 }));
-const make$47 = Effect.gen(function* () {
+const make$48 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const load = Effect.fn("P4ProjectFileLoader.load")(function* (workspaceRoot) {
@@ -29910,7 +30085,7 @@ const make$47 = Effect.gen(function* () {
 	});
 	return P4ProjectFileLoader.of({ load });
 });
-const layer$42 = Layer.effect(P4ProjectFileLoader, make$47);
+const layer$43 = Layer.effect(P4ProjectFileLoader, make$48);
 //#endregion
 //#region src/project/ProjectFaviconResolver.ts
 /**
@@ -29981,7 +30156,7 @@ function extractIconHref(source) {
 	return null;
 }
 const optionOnNotFound$1 = (effect) => effect.pipe(Effect.map(Option.some), Effect.catchTags({ PlatformError: (error) => error.reason._tag === "NotFound" ? Effect.succeed(Option.none()) : Effect.fail(error) }));
-const make$46 = Effect.gen(function* () {
+const make$47 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const workspacePaths = yield* WorkspacePaths;
@@ -30050,7 +30225,7 @@ const make$46 = Effect.gen(function* () {
 	});
 	return ProjectFaviconResolver.of({ resolvePath });
 });
-const layer$41 = Layer.effect(ProjectFaviconResolver, make$46);
+const layer$42 = Layer.effect(ProjectFaviconResolver, make$47);
 //#endregion
 //#region src/assets/AssetAccess.ts
 const ASSET_ROUTE_PREFIX = "/api/assets";
@@ -30303,10 +30478,10 @@ const resolveAsset = Effect.fn("AssetAccess.resolveAsset")(function* (token, rel
 //#endregion
 //#region src/observability/BrowserTraceCollector.ts
 var BrowserTraceCollector = class extends Context.Service()("@p4code/cli/observability/BrowserTraceCollector") {};
-const make$45 = (sink) => BrowserTraceCollector.of({ record: (records) => Effect.sync(() => {
+const make$46 = (sink) => BrowserTraceCollector.of({ record: (records) => Effect.sync(() => {
 	for (const record of records) sink.push(record);
 }) });
-const layer$40 = (sink) => Layer.succeed(BrowserTraceCollector, make$45(sink));
+const layer$41 = (sink) => Layer.succeed(BrowserTraceCollector, make$46(sink));
 //#endregion
 //#region src/auth/http.ts
 const CREDENTIAL_RESPONSE_HEADERS = {
@@ -31269,7 +31444,7 @@ const NESTED_PAYLOAD_KEYS = [
 	"operations"
 ];
 const MAX_COLLECT_DEPTH = 4;
-function asRecord$3(value) {
+function asRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 function pushChangedFilePath(target, value) {
@@ -31284,7 +31459,7 @@ function collectChangedFilePaths(value, target, depth) {
 		for (const entry of value) collectChangedFilePaths(entry, target, depth + 1);
 		return;
 	}
-	const record = asRecord$3(value);
+	const record = asRecord$4(value);
 	if (!record) return;
 	for (const field of CHANGED_FILE_FIELDS) pushChangedFilePath(target, record[field]);
 	for (const nestedKey of NESTED_PAYLOAD_KEYS) if (nestedKey in record) collectChangedFilePaths(record[nestedKey], target, depth + 1);
@@ -31295,7 +31470,7 @@ function collectChangedFilePaths(value, target, depth) {
 */
 function collectActivityChangedFilePaths(payload) {
 	const target = /* @__PURE__ */ new Set();
-	collectChangedFilePaths(asRecord$3(asRecord$3(payload)?.data), target, 0);
+	collectChangedFilePaths(asRecord$4(asRecord$4(payload)?.data), target, 0);
 	return target;
 }
 /**
@@ -33200,7 +33375,7 @@ const classifyNonZeroExit = (command, stderr) => {
 	if (command === "gh" && (normalized.includes("could not resolve to a pullrequest") || normalized.includes("repository.pullrequest") || normalized.includes("no pull requests found for branch") || normalized.includes("pull request not found")) || command === "glab" && (normalized.includes("merge request not found") || normalized.includes("not found") || normalized.includes("404")) || command === "az" && normalized.includes("pull request") && (normalized.includes("not found") || normalized.includes("does not exist"))) return "not-found";
 	return "command-failed";
 };
-const make$44 = Effect.gen(function* () {
+const make$45 = Effect.gen(function* () {
 	const processRunner = yield* ProcessRunner;
 	const run = Effect.fn("VcsProcess.run")(function* (input) {
 		const baseError = {
@@ -33257,7 +33432,7 @@ const make$44 = Effect.gen(function* () {
 	});
 	return VcsProcess.of({ run });
 });
-const layer$39 = Layer.effect(VcsProcess, make$44).pipe(Layer.provide(layer$53));
+const layer$40 = Layer.effect(VcsProcess, make$45).pipe(Layer.provide(layer$54));
 //#endregion
 //#region src/vcs/VcsDriver.ts
 var VcsDriver = class extends Context.Service()("@p4code/cli/vcs/VcsDriver") {};
@@ -33708,12 +33883,12 @@ const makeVcsDriver = Effect.gen(function* () {
 	const driver = yield* makeVcsDriverShape();
 	return VcsDriver.of(driver);
 });
-const make$43 = Effect.gen(function* () {
+const make$44 = Effect.gen(function* () {
 	const git = yield* makeGitVcsDriverCore();
 	return GitVcsDriver.of(git);
 });
 Layer.effect(VcsDriver, makeVcsDriver);
-const layer$38 = Layer.effect(GitVcsDriver, make$43);
+const layer$39 = Layer.effect(GitVcsDriver, make$44);
 //#endregion
 //#region src/vcs/VcsProjectConfig.ts
 const ProjectVcsConfigJson = fromLenientJson(Schema$1.Struct({
@@ -33745,7 +33920,7 @@ const logVcsProjectConfigError = (error) => Effect.logWarning(error).pipe(Effect
 	configPath: error.configPath,
 	errorTag: error._tag
 }));
-const make$42 = Effect.gen(function* () {
+const make$43 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const findConfigPath = Effect.fn("VcsProjectConfig.findConfigPath")(function* (cwd) {
@@ -33786,7 +33961,7 @@ const make$42 = Effect.gen(function* () {
 	});
 	return VcsProjectConfig.of({ resolveKind });
 });
-const layer$37 = Layer.effect(VcsProjectConfig, make$42);
+const layer$38 = Layer.effect(VcsProjectConfig, make$43);
 //#endregion
 //#region src/vcs/VcsDriverRegistry.ts
 const DETECTION_CACHE_CAPACITY = 2048;
@@ -33806,7 +33981,7 @@ function parseDetectionCacheKey(key) {
 		cwd: key.slice(separatorIndex + 1)
 	};
 }
-const make$41 = Effect.gen(function* () {
+const make$42 = Effect.gen(function* () {
 	const projectConfig = yield* VcsProjectConfig;
 	const git = yield* makeVcsDriver;
 	const drivers = { git };
@@ -33863,7 +34038,7 @@ const make$41 = Effect.gen(function* () {
 		resolve
 	});
 });
-const layer$36 = Layer.effect(VcsDriverRegistry, make$41).pipe(Layer.provide(layer$37));
+const layer$37 = Layer.effect(VcsDriverRegistry, make$42).pipe(Layer.provide(layer$38));
 //#endregion
 //#region src/checkpointing/CheckpointStore.ts
 /**
@@ -33883,7 +34058,7 @@ const layer$36 = Layer.effect(VcsDriverRegistry, make$41).pipe(Layer.provide(lay
 */
 /** Service tag for checkpoint persistence and restore operations. */
 var CheckpointStore = class extends Context.Service()("@p4code/cli/checkpointing/CheckpointStore") {};
-const make$40 = Effect.gen(function* () {
+const make$41 = Effect.gen(function* () {
 	const vcsRegistry = yield* VcsDriverRegistry;
 	const resolveCheckpoints = Effect.fn("CheckpointStore.resolveCheckpoints")(function* (operation, cwd) {
 		const handle = yield* vcsRegistry.resolve({ cwd });
@@ -33922,7 +34097,7 @@ const make$40 = Effect.gen(function* () {
 		deleteCheckpointRefs
 	});
 });
-const layer$35 = Layer.effect(CheckpointStore, make$40);
+const layer$36 = Layer.effect(CheckpointStore, make$41);
 //#endregion
 //#region src/checkpointing/CheckpointDiffQuery.ts
 /**
@@ -33944,7 +34119,7 @@ function buildTurnDiffResult(input, diff) {
 		diff
 	};
 }
-const make$39 = Effect.gen(function* () {
+const make$40 = Effect.gen(function* () {
 	const projectionSnapshotQuery = yield* ProjectionSnapshotQuery;
 	const checkpointStore = yield* CheckpointStore;
 	const threadActivities = yield* ProjectionThreadActivityRepository;
@@ -34110,7 +34285,7 @@ const make$39 = Effect.gen(function* () {
 		getFullThreadDiff
 	});
 });
-const layer$34 = Layer.effect(CheckpointDiffQuery, make$39);
+const layer$35 = Layer.effect(CheckpointDiffQuery, make$40);
 //#endregion
 //#region ../../packages/shared/src/toolCategory.ts
 const TOOL_CATEGORY_TITLES = {
@@ -34379,22 +34554,22 @@ function classifyToolCategory(input) {
 	if (normalized.includes("image")) return "image_view";
 	return "tool";
 }
-function asRecord$2(value) {
+function asRecord$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /** Classify from a runtime item payload's `data` (`{ toolName, input }`). */
 function classifyToolCategoryFromToolData(data) {
-	const record = asRecord$2(data);
+	const record = asRecord$3(data);
 	const toolName = record?.toolName;
 	if (typeof toolName !== "string" || toolName.trim().length === 0) return;
 	return classifyToolCategory({
 		toolName,
-		toolInput: asRecord$2(record?.input)
+		toolInput: asRecord$3(record?.input)
 	});
 }
 //#endregion
 //#region src/orchestration/ActivityPayloadProjection.ts
-function asRecord$1(value) {
+function asRecord$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asTrimmedString$1(value) {
@@ -34417,7 +34592,7 @@ function collectChangedFiles(value, target, seen, depth) {
 		}
 		return;
 	}
-	const record = asRecord$1(value);
+	const record = asRecord$2(value);
 	if (!record) return;
 	pushChangedFile(target, seen, record.path);
 	pushChangedFile(target, seen, record.filePath);
@@ -34443,13 +34618,13 @@ function collectChangedFiles(value, target, seen, depth) {
 	}
 }
 function projectCommandData(data) {
-	const item = asRecord$1(data.item);
+	const item = asRecord$2(data.item);
 	if (!item) return;
 	const projectedItem = {};
 	if ("command" in item) projectedItem.command = item.command;
-	const input = asRecord$1(item.input);
+	const input = asRecord$2(item.input);
 	if (input && "command" in input) projectedItem.input = { command: input.command };
-	const result = asRecord$1(item.result);
+	const result = asRecord$2(item.result);
 	if (result && "command" in result) projectedItem.result = { command: result.command };
 	return Object.keys(projectedItem).length > 0 ? projectedItem : void 0;
 }
@@ -34465,7 +34640,7 @@ function summarizeToolTextOutput(value) {
 	return null;
 }
 function projectRawOutput(value) {
-	const rawOutput = asRecord$1(value);
+	const rawOutput = asRecord$2(value);
 	if (!rawOutput) return;
 	if (typeof rawOutput.totalFiles === "number" && Number.isFinite(rawOutput.totalFiles)) return {
 		totalFiles: rawOutput.totalFiles,
@@ -34487,14 +34662,14 @@ function projectRawOutput(value) {
 * the full payload in persistence and the event store.
 */
 function projectActivityPayload(activity) {
-	const payload = asRecord$1(activity.payload);
-	const data = asRecord$1(payload?.data);
+	const payload = asRecord$2(activity.payload);
+	const data = asRecord$2(payload?.data);
 	if (!payload || !data || payload.itemType === "mcp_tool_call") return activity;
 	const projectedData = {};
 	const item = projectCommandData(data);
 	if (item) projectedData.item = item;
 	if ("command" in data) projectedData.command = data.command;
-	const input = asRecord$1(data.input);
+	const input = asRecord$2(data.input);
 	if (input && "command" in input) projectedData.input = { command: input.command };
 	const changedFiles = [];
 	collectChangedFiles(data, changedFiles, /* @__PURE__ */ new Set(), 0);
@@ -34521,7 +34696,7 @@ function projectActivityPayload(activity) {
 */
 function isResolvableContextWindowActivity(activity) {
 	if (activity.kind !== "context-window.updated") return false;
-	const usedTokens = asRecord$1(activity.payload)?.usedTokens;
+	const usedTokens = asRecord$2(activity.payload)?.usedTokens;
 	return typeof usedTokens === "number" && Number.isFinite(usedTokens) && usedTokens >= 0;
 }
 /**
@@ -34537,7 +34712,7 @@ function isResolvableContextWindowActivity(activity) {
 * client.
 */
 function withoutContextWindowBreakdown$1(activity) {
-	const payload = asRecord$1(activity.payload);
+	const payload = asRecord$2(activity.payload);
 	if (!payload || payload.breakdown === void 0) return activity;
 	const { breakdown: _breakdown, ...rest } = payload;
 	return {
@@ -34552,7 +34727,7 @@ function dropStaleContextWindowActivities(activities) {
 	const retainedIndexes = new Set(latestIndexByTurn.values());
 	let breakdownIndex = null;
 	for (const index of retainedIndexes) {
-		if (asRecord$1(activities[index].payload)?.breakdown === void 0) continue;
+		if (asRecord$2(activities[index].payload)?.breakdown === void 0) continue;
 		if (breakdownIndex === null || index > breakdownIndex) breakdownIndex = index;
 	}
 	return activities.flatMap((activity, index) => {
@@ -34680,6 +34855,7 @@ const buildTaskRow = (input, taskId, timestamp, repositoryKey = null) => ({
 	projectId: input.projectId ?? null,
 	repositoryKey: repositoryKey ?? input.repositoryKey ?? null,
 	threadId: input.threadId ?? null,
+	externalRef: input.externalRef ?? null,
 	title: input.title,
 	body: input.body ?? "",
 	status: input.status ?? "backlog",
@@ -35272,7 +35448,7 @@ function makeUpdateState(input) {
 		output: input.output ?? null
 	};
 }
-const make$38 = Effect.fn("ProviderMaintenanceRunner.make")(function* () {
+const make$39 = Effect.fn("ProviderMaintenanceRunner.make")(function* () {
 	const providerRegistry = yield* ProviderRegistry;
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	const httpClient = yield* HttpClient.HttpClient;
@@ -35387,7 +35563,7 @@ const make$38 = Effect.fn("ProviderMaintenanceRunner.make")(function* () {
 	});
 	return ProviderMaintenanceRunner.of({ updateProvider });
 });
-const layer$33 = Layer.effect(ProviderMaintenanceRunner, make$38());
+const layer$34 = Layer.effect(ProviderMaintenanceRunner, make$39());
 //#endregion
 //#region src/provider/Services/ProviderInstanceRegistry.ts
 var ProviderInstanceRegistry = class extends Context.Service()("@p4code/cli/provider/Services/ProviderInstanceRegistry") {};
@@ -35411,11 +35587,11 @@ const makeTextGenerationFromRegistry = (registry) => TextGeneration.of({
 		detail: "This provider does not report account usage."
 	}))))
 });
-const make$37 = Effect.gen(function* () {
+const make$38 = Effect.gen(function* () {
 	const registry = yield* ProviderInstanceRegistry;
 	return makeTextGenerationFromRegistry(registry);
 });
-const layer$32 = Layer.effect(TextGeneration, make$37);
+const layer$33 = Layer.effect(TextGeneration, make$38);
 const SKILL_MANIFEST_FILENAME = "SKILL.md";
 /**
 * Split a catalogue id (`owner/repo/skill-name`) into its parts.
@@ -35524,7 +35700,7 @@ function toAssetFilePath(repositoryPath, root) {
 const REGISTRY_SEARCH_URL = "https://www.skills.sh/api/search";
 const GITHUB_API_URL = "https://api.github.com";
 const GITHUB_RAW_URL = "https://raw.githubusercontent.com";
-const REQUEST_TIMEOUT_MS = 15e3;
+const REQUEST_TIMEOUT_MS$1 = 15e3;
 /** More than a person reads, few enough that the panel is a list and not a feed. */
 const MAX_SEARCH_RESULTS = 25;
 /**
@@ -35561,10 +35737,10 @@ const emptyFetch = (id, unavailable) => ({
 	skipped: [],
 	unavailable
 });
-const make$36 = Effect.gen(function* () {
+const make$37 = Effect.gen(function* () {
 	const http = yield* HttpClient.HttpClient;
 	const request = Effect.fn("SkillRegistry.request")(function* (url) {
-		return yield* http.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeader("accept", "application/json"), HttpClientRequest.setHeader("user-agent", "p4code"))).pipe(Effect.timeout(REQUEST_TIMEOUT_MS));
+		return yield* http.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeader("accept", "application/json"), HttpClientRequest.setHeader("user-agent", "p4code"))).pipe(Effect.timeout(REQUEST_TIMEOUT_MS$1));
 	});
 	const search = (query) => Effect.gen(function* () {
 		const response = yield* request(`${REGISTRY_SEARCH_URL}?q=${encodeURIComponent(query)}`).pipe(Effect.orElseSucceed(() => null));
@@ -35632,7 +35808,309 @@ const make$36 = Effect.gen(function* () {
 		fetch
 	};
 });
-const layer$31 = Layer.effect(SkillRegistry, make$36);
+const layer$32 = Layer.effect(SkillRegistry, make$37);
+//#endregion
+//#region ../../packages/shared/src/ticketReference.ts
+/**
+* Recognizing a tracker reference in text somebody pasted.
+*
+* Shared because both ends need the same answer: the composer decides whether a
+* paste is worth a round trip, and the server decides what to ask the tracker.
+* Two copies of this rule would differ, and the difference would read as "it
+* works on my machine but the paste does nothing".
+*
+* @module ticketReference
+*/
+/**
+* A Linear issue URL, e.g.
+* `https://linear.app/omnicasa/issue/MOBILE-12262/haptic-feedback`.
+*
+* The workspace slug is what makes the URL unguessable from the identifier
+* alone, which is why a resolved ticket keeps the tracker's own URL rather than
+* rebuilding one.
+*/
+const LINEAR_ISSUE_URL_PATTERN = /https?:\/\/(?:www\.)?linear\.app\/[^/\s]+\/issue\/([A-Za-z][A-Za-z0-9]*-\d+)/;
+/**
+* A bare identifier, e.g. `MOBILE-12262`.
+*
+* Anchored: only a paste that is *nothing but* an identifier counts. Scanning
+* prose for this shape would claim things that are not tickets - a date range,
+* a version, a p4code readable id like `P4-40` - and each false positive costs
+* a request and, worse, a wrong link.
+*/
+const BARE_IDENTIFIER_PATTERN = /^([A-Za-z][A-Za-z0-9]*-\d+)$/;
+/**
+* The issue identifier a paste refers to, or `null` when it refers to none.
+*
+* Case is normalized up, the way every tracker prints it, so the same ticket
+* pasted two ways compares equal.
+*/
+function parseTicketReference(text) {
+	const trimmed = text.trim();
+	if (trimmed.length === 0) return null;
+	const url = LINEAR_ISSUE_URL_PATTERN.exec(trimmed);
+	if (url?.[1] !== void 0) return url[1].toUpperCase();
+	const bare = BARE_IDENTIFIER_PATTERN.exec(trimmed);
+	if (bare?.[1] !== void 0) return bare[1].toUpperCase();
+	return null;
+}
+//#endregion
+//#region src/mcp/McpToolClient.ts
+/**
+* Calling a tool on somebody else's MCP server.
+*
+* The rest of `apps/server/src/mcp` points the other way: it *exposes* p4code's
+* toolkit to an agent. This is the only place p4code is the client, and it
+* exists because one feature - recognizing a pasted ticket - needs an answer
+* before any agent turn runs, from a server the user has already registered.
+*
+* Deliberately not a general MCP client. There is no session reuse, no tool
+* listing, no notifications, no SSE stream held open: one request/response pair
+* per call, which is all streamable HTTP requires for a plain `tools/call`. A
+* real client belongs here only once something needs one.
+*
+* @module mcp/McpToolClient
+*/
+/**
+* The version p4code speaks. Sent on `initialize` and echoed back as a header
+* on the follow-up calls, which is what the spec asks of a client that has
+* already negotiated.
+*/
+const MCP_PROTOCOL_VERSION = "2025-06-18";
+const REQUEST_TIMEOUT_MS = 15e3;
+var McpToolCallError = class extends Schema$1.TaggedErrorClass()("McpToolCallError", {
+	detail: Schema$1.String,
+	status: Schema$1.NullOr(Schema$1.Number)
+}) {
+	get message() {
+		return this.detail;
+	}
+};
+const unauthorized$1 = (status) => status === 401 || status === 403;
+/**
+* Read a JSON-RPC envelope out of a response that may be either JSON or SSE.
+*
+* A streamable-http server picks the encoding, and both are legal answers to a
+* single call. The SSE branch keeps the last `data:` payload that parses: a
+* server is free to emit progress notifications ahead of the result, and the
+* result is what a caller of this asked for.
+*/
+const readEnvelope = (body) => {
+	const direct = parseJsonObject(body);
+	if (direct !== void 0) return direct;
+	let latest;
+	for (const line of body.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed.startsWith("data:")) continue;
+		const parsed = parseJsonObject(trimmed.slice(5).trim());
+		if (parsed !== void 0) latest = parsed;
+	}
+	return latest;
+};
+const parseJsonObject = (text) => {
+	if (text.length === 0) return void 0;
+	try {
+		const parsed = JSON.parse(text);
+		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+	} catch {
+		return;
+	}
+};
+const textOf = (content) => {
+	if (!Array.isArray(content)) return "";
+	const parts = [];
+	for (const block of content) {
+		if (typeof block !== "object" || block === null) continue;
+		const record = block;
+		if (record["type"] === "text" && typeof record["text"] === "string") parts.push(record["text"]);
+	}
+	return parts.join("\n");
+};
+/**
+* One `tools/call`, preceded by the `initialize` handshake the transport
+* requires.
+*
+* The handshake is not optional and not cacheable here: a server may hand out a
+* session id, and this holds no session state between calls. Two round trips
+* for one answer is the price of not keeping a connection open for a feature
+* that fires when somebody pastes something.
+*/
+const callMcpTool = Effect.fn("McpToolClient.callMcpTool")(function* (input) {
+	const http = yield* HttpClient$1.HttpClient;
+	const post = (body, extraHeaders) => http.execute(HttpClientRequest$1.bodyJsonUnsafe(HttpClientRequest$1.setHeaders(HttpClientRequest$1.post(input.url), {
+		...input.headers,
+		...extraHeaders,
+		accept: "application/json, text/event-stream"
+	}), body)).pipe(Effect.timeout(REQUEST_TIMEOUT_MS), Effect.catchCause((cause) => Effect.fail(new McpToolCallError({
+		detail: `Could not reach ${input.url}: ${String(cause)}`,
+		status: null
+	}))));
+	const initialize = yield* post({
+		jsonrpc: "2.0",
+		id: 1,
+		method: "initialize",
+		params: {
+			protocolVersion: MCP_PROTOCOL_VERSION,
+			capabilities: {},
+			clientInfo: {
+				name: "p4code",
+				version: "0.0.0"
+			}
+		}
+	}, {});
+	if (initialize.status >= 400) return yield* new McpToolCallError({
+		detail: unauthorized$1(initialize.status) ? "The server rejected p4code's credentials." : `The server answered ${initialize.status} to initialize.`,
+		status: initialize.status
+	});
+	const sessionId = initialize.headers["mcp-session-id"];
+	const sessionHeaders = {
+		"mcp-protocol-version": MCP_PROTOCOL_VERSION,
+		...sessionId === void 0 ? {} : { "mcp-session-id": sessionId }
+	};
+	yield* post({
+		jsonrpc: "2.0",
+		method: "notifications/initialized"
+	}, sessionHeaders).pipe(Effect.ignore);
+	const response = yield* post({
+		jsonrpc: "2.0",
+		id: 2,
+		method: "tools/call",
+		params: {
+			name: input.toolName,
+			arguments: input.arguments
+		}
+	}, sessionHeaders);
+	const body = yield* response.text.pipe(Effect.catchCause(() => Effect.succeed("")));
+	if (response.status >= 400) return yield* new McpToolCallError({
+		detail: unauthorized$1(response.status) ? "The server rejected p4code's credentials." : `The server answered ${response.status} to ${input.toolName}.`,
+		status: response.status
+	});
+	const envelope = readEnvelope(body);
+	if (envelope === void 0) return yield* new McpToolCallError({
+		detail: `The server's answer to ${input.toolName} was not JSON-RPC.`,
+		status: response.status
+	});
+	const error = envelope["error"];
+	if (typeof error === "object" && error !== null) {
+		const detail = error["message"];
+		return yield* new McpToolCallError({
+			detail: typeof detail === "string" ? detail : `${input.toolName} failed.`,
+			status: response.status
+		});
+	}
+	const result = envelope["result"];
+	if (typeof result !== "object" || result === null) return yield* new McpToolCallError({
+		detail: `${input.toolName} returned no result.`,
+		status: response.status
+	});
+	const resultRecord = result;
+	const text = textOf(resultRecord["content"]);
+	if (resultRecord["isError"] === true) return yield* new McpToolCallError({
+		detail: text.length > 0 ? text : `${input.toolName} reported an error.`,
+		status: response.status
+	});
+	return {
+		structuredContent: resultRecord["structuredContent"],
+		text
+	};
+});
+//#endregion
+//#region src/mcp/TicketResolver.ts
+/**
+* The registered server name a Linear ticket is resolved through.
+*
+* Matched by name rather than by URL: the name is what the user typed in
+* Settings and what every other surface calls it, and a workspace may reach
+* Linear through a proxy URL that no pattern here would recognize.
+*/
+const LINEAR_SERVER_NAME = "linear";
+/** Linear's own tool for reading one issue. */
+const LINEAR_GET_ISSUE_TOOL = "get_issue";
+var TicketResolver = class extends Context.Service()("@p4code/cli/mcp/TicketResolver") {};
+const stringField$1 = (record, key) => {
+	const value = record[key];
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+};
+const asRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+/**
+* Find the issue inside whatever the tool returned.
+*
+* MCP leaves the shape of a tool result to the tool, so this accepts the three
+* arrangements in the wild - the structured payload itself, that payload with
+* the issue nested one level down, or a text block that happens to be JSON -
+* rather than assuming the one Linear happens to send today.
+*/
+const readIssue = (result) => {
+	const structured = asRecord$1(result.structuredContent);
+	if (structured !== void 0) {
+		const nested = asRecord$1(structured["issue"]);
+		if (nested !== void 0) return nested;
+		if (stringField$1(structured, "url") !== void 0) return structured;
+	}
+	try {
+		const parsed = JSON.parse(result.text);
+		const record = asRecord$1(parsed);
+		if (record === void 0) return structured;
+		return asRecord$1(record["issue"]) ?? record;
+	} catch {
+		return structured;
+	}
+};
+const make$36 = Effect.gen(function* () {
+	const registry = yield* McpRegistry;
+	const oauth = yield* McpOAuth;
+	const http = yield* HttpClient$1.HttpClient;
+	return { resolve: Effect.fn("TicketResolver.resolve")(function* (reference) {
+		const identifier = parseTicketReference(reference);
+		if (identifier === null) return yield* new TicketResolveError({
+			reason: "not_found",
+			detail: `"${reference}" does not look like a ticket reference.`
+		});
+		const server = (yield* registry.list).find((candidate) => candidate.registration.name.toLowerCase() === LINEAR_SERVER_NAME && candidate.registration.enabled);
+		if (server === void 0 || server.registration.transport === "stdio") return yield* new TicketResolveError({
+			reason: "not_configured",
+			detail: "No Linear MCP server is registered on this machine. Add it in Settings to link tickets."
+		});
+		const registration = server.registration;
+		const token = yield* oauth.accessTokenFor(registration);
+		const headers = {
+			...registration.headers,
+			...Option.isSome(token) ? { authorization: `Bearer ${token.value}` } : {}
+		};
+		if (Option.isNone(token) && Object.keys(registration.headers ?? {}).length === 0) return yield* new TicketResolveError({
+			reason: "not_authorized",
+			detail: "Linear is registered but not signed in on this machine. Sign in from Settings."
+		});
+		const result = yield* callMcpTool({
+			url: registration.url,
+			headers,
+			toolName: LINEAR_GET_ISSUE_TOOL,
+			arguments: { id: identifier }
+		}).pipe(Effect.provideService(HttpClient$1.HttpClient, http), Effect.mapError((error) => error.status === 401 || error.status === 403 ? new TicketResolveError({
+			reason: "not_authorized",
+			detail: "Linear rejected p4code's sign-in. Sign in again from Settings."
+		}) : new TicketResolveError({
+			reason: "unavailable",
+			detail: error.detail
+		})));
+		const issue = readIssue(result);
+		const url = issue === void 0 ? void 0 : stringField$1(issue, "url");
+		const title = issue === void 0 ? void 0 : stringField$1(issue, "title");
+		if (issue === void 0 || url === void 0 || title === void 0) return yield* new TicketResolveError({
+			reason: "not_found",
+			detail: `Linear returned nothing usable for ${identifier}.`
+		});
+		return {
+			externalRef: {
+				source: "linear",
+				identifier: stringField$1(issue, "identifier") ?? identifier,
+				url
+			},
+			title
+		};
+	}) };
+});
+const layer$31 = Layer.effect(TicketResolver, make$36);
 //#endregion
 //#region ../../packages/shared/src/KeyedCoalescingWorker.ts
 const makeKeyedCoalescingWorker = (options) => Effect.gen(function* () {
@@ -37722,7 +38200,7 @@ const makeWithOptions$1 = Effect.fn("TerminalManager.makeWithOptions")(function*
 		subscribeMetadata
 	});
 });
-const layer$29 = Layer.effect(TerminalManager, make$34()).pipe(Layer.provide(layer$53));
+const layer$29 = Layer.effect(TerminalManager, make$34()).pipe(Layer.provide(layer$54));
 //#endregion
 //#region src/mcp/McpInvocationContext.ts
 var McpInvocationContext = class extends Context.Service()("@p4code/cli/mcp/McpInvocationContext") {};
@@ -44802,6 +45280,7 @@ const RPC_REQUIRED_SCOPE = /* @__PURE__ */ new Map([
 	[WS_METHODS.tasksUpdate, AuthOrchestrationOperateScope],
 	[WS_METHODS.tasksDelete, AuthOrchestrationOperateScope],
 	[WS_METHODS.tasksStartThread, AuthOrchestrationOperateScope],
+	[WS_METHODS.ticketsResolve, AuthOrchestrationReadScope],
 	[WS_METHODS.subscribeTasks, AuthOrchestrationReadScope],
 	[WS_METHODS.hubGetSyncStatus, AuthOrchestrationReadScope],
 	[WS_METHODS.hubConnect, AuthOrchestrationOperateScope],
@@ -44956,6 +45435,7 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 	const mcpOAuth = yield* McpOAuth;
 	const claudeMcpFiles = yield* ClaudeMcpFiles;
 	const skillRegistry = yield* SkillRegistry;
+	const ticketResolver = yield* TicketResolver;
 	const listMcpServersEverywhere = Effect.gen(function* () {
 		const servers = [...yield* mcpRegistry.list];
 		const projectRows = yield* projectionProjects.listAll().pipe(Effect.map((rows) => rows.filter((row) => row.deletedAt === null)), Effect.orElseSucceed(() => []));
@@ -45502,6 +45982,13 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 				threadId
 			};
 		}), { "rpc.aggregate": "tasks" }),
+		/**
+		* What a pasted reference is, straight from the tracker.
+		*
+		* Nothing is written here: the client decides whether the answer
+		* becomes a task, so an accidental paste costs one request and no row.
+		*/
+		[WS_METHODS.ticketsResolve]: ({ reference }) => observeRpcEffect$1(WS_METHODS.ticketsResolve, ticketResolver.resolve(reference), { "rpc.aggregate": "tickets" }),
 		[WS_METHODS.subscribeTasks]: (_input) => observeRpcStreamEffect$1(WS_METHODS.subscribeTasks, Effect.succeed(taskRepository.streamWithSnapshot.pipe(Stream.catch((cause) => Stream.fromEffect(toTaskStoreError("tasks.subscribe")(cause))))), { "rpc.aggregate": "tasks" }),
 		[WS_METHODS.hubGetSyncStatus]: (_input) => observeRpcEffect$1(WS_METHODS.hubGetSyncStatus, assetSync.status, { "rpc.aggregate": "hub" }),
 		[WS_METHODS.hubConnect]: (input) => observeRpcEffect$1(WS_METHODS.hubConnect, hubLink.connect(input).pipe(Effect.mapError((cause) => new HubLinkError({ detail: cause.message })), Effect.andThen(assetSync.status)), { "rpc.aggregate": "hub" }),
@@ -45769,7 +46256,7 @@ const websocketRpcRouteLayer = Layer.unwrap(Effect.gen(function* () {
 		const serverAuth = yield* EnvironmentAuth;
 		const sessions = yield* SessionStore;
 		const session = yield* serverAuth.authenticateWebSocketUpgrade(request).pipe(Effect.catchIf(isServerAuthCredentialError, (error) => failEnvironmentAuthInvalid(serverAuthCredentialReason(error))), Effect.catchIf(isServerAuthInternalError, (error) => failEnvironmentInternal("internal_error", error)));
-		const rpcWebSocketHttpEffect = yield* RpcServer.toHttpEffectWebsocket(WsRpcGroup, { disableTracing: true }).pipe(Effect.provide(makeWsRpcLayer(session, previewAutomationBroker).pipe(Layer.provideMerge(RpcSerialization.layerJson), Layer.provide(layer$33), Layer.provide(Layer.succeed(ServerSelfUpdate, serverSelfUpdate)), Layer.provide(Layer.succeed(TaskRepository, taskRepository)), Layer.provide(Layer.succeed(ProjectionProjectRepository, projectionProjects)), Layer.provide(Layer.succeed(P4ProjectFileLoader, p4ProjectFileLoader)), Layer.provide(layer$5.pipe(Layer.provide(layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$38), Layer.provide(layer$36.pipe(Layer.provide(layer$37))))), Layer.provide(layer$39))))));
+		const rpcWebSocketHttpEffect = yield* RpcServer.toHttpEffectWebsocket(WsRpcGroup, { disableTracing: true }).pipe(Effect.provide(makeWsRpcLayer(session, previewAutomationBroker).pipe(Layer.provideMerge(RpcSerialization.layerJson), Layer.provide(layer$34), Layer.provide(Layer.succeed(ServerSelfUpdate, serverSelfUpdate)), Layer.provide(Layer.succeed(TaskRepository, taskRepository)), Layer.provide(Layer.succeed(ProjectionProjectRepository, projectionProjects)), Layer.provide(Layer.succeed(P4ProjectFileLoader, p4ProjectFileLoader)), Layer.provide(layer$5.pipe(Layer.provide(layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$39), Layer.provide(layer$37.pipe(Layer.provide(layer$38))))), Layer.provide(layer$40))))));
 		return yield* Effect.acquireUseRelease(sessions.markConnected(session.sessionId), () => rpcWebSocketHttpEffect, () => sessions.markDisconnected(session.sessionId));
 	}).pipe(Effect.catchTags({
 		EnvironmentAuthInvalidError: HttpServerRespondable.toResponse,
@@ -48093,7 +48580,7 @@ const makeOpenCodeRuntime = Effect.gen(function* () {
 	};
 });
 var OpenCodeRuntime = class extends Context.Service()("@p4code/cli/provider/opencodeRuntime") {};
-const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$71));
+const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$72));
 //#endregion
 //#region src/textGeneration/TextGenerationUtils.ts
 const isTextGenerationError$3 = Schema$1.is(TextGenerationError);
@@ -88537,7 +89024,7 @@ const ObservabilityLive = Layer.unwrap(Effect.gen(function* () {
 			sink,
 			...delegate ? { delegate } : {}
 		});
-		return Layer.mergeAll(Layer.succeed(Tracer.Tracer, tracer), layer$40(sink));
+		return Layer.mergeAll(Layer.succeed(Tracer.Tracer, tracer), layer$41(sink));
 	})).pipe(Layer.provide(OtlpExporter.layerFlusher), Layer.provideMerge(otlpSerializationLayer));
 	const metricsLayer = config.otlpMetricsUrl === void 0 ? Layer.empty : OtlpMetrics.layer({
 		url: config.otlpMetricsUrl,
@@ -88816,25 +89303,25 @@ const ReactorLayerLive = Layer.empty.pipe(Layer.provideMerge(OrchestrationReacto
 const ProviderSessionDirectoryLayerLive = ProviderSessionDirectoryLive.pipe(Layer.provide(layer$3));
 const ProviderLayerLive = ProviderServiceLive.pipe(Layer.provide(ProviderAdapterRegistryLive), Layer.provideMerge(ProviderSessionDirectoryLayerLive));
 const PersistenceLayerLive = Layer.empty.pipe(Layer.provideMerge(layerConfig));
-const VcsDriverRegistryLayerLive = layer$36.pipe(Layer.provide(layer$37));
-const SourceControlProviderRegistryLayerLive = layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$38), Layer.provideMerge(VcsDriverRegistryLayerLive));
-const GitManagerLayerLive = layer$13.pipe(Layer.provideMerge(layer$23), Layer.provideMerge(layer$38), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(layer$32));
-const GitLayerLive = Layer.empty.pipe(Layer.provideMerge(GitManagerLayerLive), Layer.provideMerge(layer$38));
+const VcsDriverRegistryLayerLive = layer$37.pipe(Layer.provide(layer$38));
+const SourceControlProviderRegistryLayerLive = layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$39), Layer.provideMerge(VcsDriverRegistryLayerLive));
+const GitManagerLayerLive = layer$13.pipe(Layer.provideMerge(layer$23), Layer.provideMerge(layer$39), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(layer$33));
+const GitLayerLive = Layer.empty.pipe(Layer.provideMerge(GitManagerLayerLive), Layer.provideMerge(layer$39));
 const GitWorkflowLayerLive = layer$12.pipe(Layer.provideMerge(VcsDriverRegistryLayerLive), Layer.provideMerge(GitLayerLive));
-const SourceControlRepositoryServiceLayerLive = layer$4.pipe(Layer.provideMerge(layer$38), Layer.provideMerge(SourceControlProviderRegistryLayerLive));
-const ReviewLayerLive = layer$9.pipe(Layer.provideMerge(layer$38), Layer.provideMerge(VcsDriverRegistryLayerLive));
-const VcsLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$37), Layer.provideMerge(VcsDriverRegistryLayerLive), Layer.provideMerge(layer$10.pipe(Layer.provide(VcsDriverRegistryLayerLive))), Layer.provideMerge(GitWorkflowLayerLive), Layer.provideMerge(ReviewLayerLive), Layer.provideMerge(SourceControlRepositoryServiceLayerLive), Layer.provideMerge(layer$11.pipe(Layer.provide(GitWorkflowLayerLive))));
-const CheckpointingLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$34), Layer.provideMerge(layer$35.pipe(Layer.provide(VcsDriverRegistryLayerLive))));
-const PortScannerLayerLive = layer$30.pipe(Layer.provide(layer$53));
+const SourceControlRepositoryServiceLayerLive = layer$4.pipe(Layer.provideMerge(layer$39), Layer.provideMerge(SourceControlProviderRegistryLayerLive));
+const ReviewLayerLive = layer$9.pipe(Layer.provideMerge(layer$39), Layer.provideMerge(VcsDriverRegistryLayerLive));
+const VcsLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$38), Layer.provideMerge(VcsDriverRegistryLayerLive), Layer.provideMerge(layer$10.pipe(Layer.provide(VcsDriverRegistryLayerLive))), Layer.provideMerge(GitWorkflowLayerLive), Layer.provideMerge(ReviewLayerLive), Layer.provideMerge(SourceControlRepositoryServiceLayerLive), Layer.provideMerge(layer$11.pipe(Layer.provide(GitWorkflowLayerLive))));
+const CheckpointingLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$35), Layer.provideMerge(layer$36.pipe(Layer.provide(VcsDriverRegistryLayerLive))));
+const PortScannerLayerLive = layer$30.pipe(Layer.provide(layer$54));
 const TerminalLayerLive = layer$29.pipe(Layer.provide(PtyAdapterLive), Layer.provide(PortScannerLayerLive));
 const PreviewLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$27), Layer.provideMerge(PortScannerLayerLive));
-const WorkspaceEntriesLayerLive = layer$25.pipe(Layer.provide(layer$43));
-const WorkspaceFileSystemLayerLive = layer$24.pipe(Layer.provide(layer$43), Layer.provide(WorkspaceEntriesLayerLive));
-const WorkspaceLayerLive = Layer.mergeAll(layer$43, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
-const ProjectFaviconResolverLayerLive = layer$41.pipe(Layer.provide(layer$43), Layer.provide(layer$42));
-const AuthLayerLive = layer$63.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$67));
+const WorkspaceEntriesLayerLive = layer$25.pipe(Layer.provide(layer$44));
+const WorkspaceFileSystemLayerLive = layer$24.pipe(Layer.provide(layer$44), Layer.provide(WorkspaceEntriesLayerLive));
+const WorkspaceLayerLive = Layer.mergeAll(layer$44, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
+const ProjectFaviconResolverLayerLive = layer$42.pipe(Layer.provide(layer$44), Layer.provide(layer$43));
+const AuthLayerLive = layer$64.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$68));
 const ProviderRuntimeLayerLive = ProviderSessionReaperLive.pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$60.pipe(Layer.provide(layer$67))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$52), Layer.provideMerge(layer$45), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(Layer.mergeAll(layer$57, layer$31).pipe(Layer.provideMerge(layer$58), Layer.provideMerge(layer$59))), Layer.provideMerge(layer$67)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$48), Layer.provideMerge(layer$50), Layer.provideMerge(layer$49), Layer.provide(layer$71));
+const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$52), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$61.pipe(Layer.provide(layer$68))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$53), Layer.provideMerge(layer$46), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$31.pipe(Layer.provideMerge(Layer.mergeAll(layer$58, layer$32).pipe(Layer.provideMerge(layer$59), Layer.provideMerge(layer$60))))), Layer.provideMerge(layer$68)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$49), Layer.provideMerge(layer$51), Layer.provideMerge(layer$50), Layer.provide(layer$72));
 /**
 * Hub asset sync.
 *
@@ -88842,9 +89329,9 @@ const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(Checkpo
 * not-configured shape, and every call reports that rather than failing — so
 * this costs a server with no hub nothing but a layer.
 */
-const AssetSyncLive = layer$54.pipe(Layer.provideMerge(layer$55), Layer.provideMerge(layer$56));
-const RuntimeServicesLive = layer$44.pipe(Layer.provideMerge(AssetSyncLive), Layer.provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = Layer.mergeAll(Layer.mergeAll(HttpApiBuilder.layer(EnvironmentHttpApi).pipe(Layer.provide(authHttpApiLayer), Layer.provide(orchestrationHttpApiLayer), Layer.provide(serverEnvironmentHttpApiLayer), Layer.provide(environmentAuthenticatedAuthLayer)), otlpTracesProxyRouteLayer, assetRouteLayer, mcpOAuthCallbackRouteLayer, staticAndDevRouteLayer, websocketRpcRouteLayer), layer.pipe(Layer.provide(layer$2))).pipe(Layer.provide(RoutedTaskRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(ProjectionProjectRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(layer$42), Layer.provide(layer$28), Layer.provide(layer$46), Layer.provide(browserApiCorsLayer), Layer.provide(httpCompressionLayer));
+const AssetSyncLive = layer$55.pipe(Layer.provideMerge(layer$56), Layer.provideMerge(layer$57));
+const RuntimeServicesLive = layer$45.pipe(Layer.provideMerge(AssetSyncLive), Layer.provideMerge(RuntimeDependenciesLive));
+const makeRoutesLayer = Layer.mergeAll(Layer.mergeAll(HttpApiBuilder.layer(EnvironmentHttpApi).pipe(Layer.provide(authHttpApiLayer), Layer.provide(orchestrationHttpApiLayer), Layer.provide(serverEnvironmentHttpApiLayer), Layer.provide(environmentAuthenticatedAuthLayer)), otlpTracesProxyRouteLayer, assetRouteLayer, mcpOAuthCallbackRouteLayer, staticAndDevRouteLayer, websocketRpcRouteLayer), layer.pipe(Layer.provide(layer$2))).pipe(Layer.provide(RoutedTaskRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(ProjectionProjectRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(layer$43), Layer.provide(layer$28), Layer.provide(layer$47), Layer.provide(browserApiCorsLayer), Layer.provide(httpCompressionLayer));
 const makeServerLayer = Layer.unwrap(Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	yield* fixPath();
@@ -88887,7 +89374,7 @@ const makeServerLayer = Layer.unwrap(Effect.gen(function* () {
 		cause,
 		servePort: configured.servePort
 	}))) : Effect.void)) : Layer.empty;
-	return Layer.mergeAll(HttpRouter.serve(makeRoutesLayer, { disableLogger: !config.logWebSocketEvents }), httpListeningLayer, runtimeStateLayer, tailscaleServeLayer).pipe(Layer.provideMerge(RuntimeServicesLive), Layer.provideMerge(HttpResponseCompressionLive), Layer.provideMerge(HttpServerLive), Layer.provide(ObservabilityLive), Layer.provideMerge(FetchHttpClient.layer), Layer.provideMerge(layer$39), Layer.provideMerge(PlatformServicesLive));
+	return Layer.mergeAll(HttpRouter.serve(makeRoutesLayer, { disableLogger: !config.logWebSocketEvents }), httpListeningLayer, runtimeStateLayer, tailscaleServeLayer).pipe(Layer.provideMerge(RuntimeServicesLive), Layer.provideMerge(HttpResponseCompressionLive), Layer.provideMerge(HttpServerLive), Layer.provide(ObservabilityLive), Layer.provideMerge(FetchHttpClient.layer), Layer.provideMerge(layer$40), Layer.provideMerge(PlatformServicesLive));
 }));
 const runServer = Layer.launch(makeServerLayer);
 //#endregion
@@ -89049,11 +89536,11 @@ const reconcileWithNewBinary = Effect.fn("cli.selfUpdate.reconcileWithNewBinary"
 //#endregion
 //#region src/cli/service.ts
 const isBootServiceCommandError = Schema$1.is(BootServiceCommandError);
-const bootServiceLayer = (config) => layer$47({
+const bootServiceLayer = (config) => layer$48({
 	baseDir: config.baseDir,
 	logsDir: config.logsDir,
 	cliVersion: version
-}).pipe(Layer.provide(layer$53));
+}).pipe(Layer.provide(layer$54));
 /** Install, update, or repair the service using the CLI version running this command. */
 const reconcileService = Effect.fn("cli.service.reconcile")(function* () {
 	const service = yield* BootService;
@@ -89100,7 +89587,7 @@ const runServiceCommand = Effect.fn("cli.service.run")(function* (flags, run, pr
 	const baseDirNotice = yield* describeNonDefaultBaseDir(config.baseDir);
 	if (baseDirNotice !== null) yield* Console.error(baseDirNotice);
 	if (prepare !== void 0) yield* prepare(config);
-	return yield* run.pipe(Effect.tapError((error) => isBootServiceCommandError(error) ? BootService.pipe(Effect.flatMap((service) => Console.error(`Details: ${service.logPath}`))) : Effect.void), Effect.provide(Layer.mergeAll(bootServiceLayer(config), layer$53)));
+	return yield* run.pipe(Effect.tapError((error) => isBootServiceCommandError(error) ? BootService.pipe(Effect.flatMap((service) => Console.error(`Details: ${service.logPath}`))) : Effect.void), Effect.provide(Layer.mergeAll(bootServiceLayer(config), layer$54)));
 });
 /**
 * Options the installed unit carries, rather than ones this command consumes.
@@ -89254,7 +89741,7 @@ const serviceCommand = Command.make("service").pipe(Command.withDescription("Man
 ]));
 //#endregion
 //#region src/bin.ts
-const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$71, FetchHttpClient.layer);
+const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$72, FetchHttpClient.layer);
 /**
 * Prints an update reminder before dispatching, at most once a day.
 *