@p4code/cli 0.1.3 → 0.1.5

package/dist/bin.mjs

@@ -121,7 +121,7 @@ const closeServer = (server) => {
 * NetService - Service tag for startup networking helpers.
 */
 var NetService = class extends Context.Service()("@p4code/shared/Net/NetService") {};
-const make$72 = () => {
+const make$73 = () => {
 	/**
 	* Returns true when a TCP server can bind to {host, port}.
 	* `EADDRNOTAVAIL` is treated as available so IPv6-absent hosts don't fail
@@ -230,10 +230,10 @@ const make$72 = () => {
 		})
 	};
 };
-const layer$68 = Layer.sync(NetService, make$72);
+const layer$69 = Layer.sync(NetService, make$73);
 //#endregion
 //#region package.json
-var version = "0.1.3";
+var version = "0.1.5";
 //#endregion
 //#region src/config.ts
 /**
@@ -254,8 +254,8 @@ var ServerConfig$1 = class extends Context.Service()("@p4code/cli/config/ServerC
 	/** @deprecated Import and use `layerTest` from this module. */
 	static layerTest = (cwd, baseDirOrPrefix) => layerTest$2(cwd, baseDirOrPrefix);
 };
-const make$71 = (config) => ServerConfig$1.of(config);
-const layer$67 = (config) => Layer.succeed(ServerConfig$1, make$71(config));
+const make$72 = (config) => ServerConfig$1.of(config);
+const layer$68 = (config) => Layer.succeed(ServerConfig$1, make$72(config));
 const deriveServerPaths = Effect.fn(function* (baseDir, devUrl, options = {}) {
 	const { join } = yield* Path.Path;
 	const stateDir = join(baseDir, devUrl !== void 0 && !options.baseDirIsExplicit ? "dev" : "userdata");
@@ -5720,6 +5720,7 @@ const SourceControlWritingStyleSettings = Schema$1.Struct({
 	followChangeRequestTemplates: Schema$1.Boolean.pipe(Schema$1.withDecodingDefault(Effect.succeed(true)))
 });
 const DEFAULT_AUTOMATIC_GIT_FETCH_INTERVAL = Duration.seconds(30);
+const TaskBoardSource = Schema$1.Literals(["local", "hub"]);
 const ServerSettings = Schema$1.Struct({
 	enableAssistantStreaming: Schema$1.Boolean.pipe(Schema$1.withDecodingDefault(Effect.succeed(false))),
 	enableProviderUpdateChecks: Schema$1.Boolean.pipe(Schema$1.withDecodingDefault(Effect.succeed(true))),
@@ -5733,6 +5734,42 @@ const ServerSettings = Schema$1.Struct({
 	}))),
 	sourceControlWritingStyle: SourceControlWritingStyleSettings.pipe(Schema$1.withDecodingDefault(Effect.succeed({}))),
 	sourceControlWriterModelSelection: Schema$1.NullOr(ModelSelection).pipe(Schema$1.withDecodingDefault(Effect.succeed(null))),
+	/**
+	* Where this server's task board lives.
+	*
+	* `local` is this machine's own SQLite database, which is where every board
+	* has been until now. `hub` puts the board on the linked hub, so two servers
+	* read and write one board instead of two that silently diverge.
+	*
+	* A setting rather than "hub if one is linked", because a hub can be linked
+	* for skills alone, and flipping a board's home is not something to have
+	* happen as a side effect of connecting. It is also the way back: the local
+	* rows are still there, untouched, when it is set to `local` again.
+	*
+	* **On `hub`, an unreachable hub means no board.** There is no local
+	* fallback by decision: answering from a stale local copy would recreate the
+	* per-machine divergence the hub exists to remove, and it would do it
+	* invisibly.
+	*/
+	taskBoardSource: TaskBoardSource.pipe(Schema$1.withDecodingDefault(Effect.succeed("local"))),
+	/**
+	* Skills the agents on this server must not see, by name.
+	*
+	* Server-scoped rather than per provider instance, because a skill is a
+	* property of the machine's filesystem and every instance on it reads the
+	* same directories.
+	*
+	* Deliberately **not** synced through the hub. A shared skill that is muted
+	* on one machine is the useful combination — the laptop does not want the
+	* skill that shells out to the Studio's build tooling — and syncing the mute
+	* would make that inexpressible.
+	*
+	* What "disabled" means is bounded by what the provider can enforce: the
+	* skill is hidden from the model's listing and from `/name`, and its files
+	* stay on disk and remain readable by Read and Bash. It is a context filter,
+	* not a sandbox, and nothing here should be described to a user as one.
+	*/
+	disabledSkills: Schema$1.Array(TrimmedNonEmptyString).pipe(Schema$1.withDecodingDefault(Effect.succeed([]))),
 	providers: Schema$1.Struct({
 		codex: CodexSettings.pipe(Schema$1.withDecodingDefault(Effect.succeed({}))),
 		claudeAgent: ClaudeSettings.pipe(Schema$1.withDecodingDefault(Effect.succeed({}))),
@@ -5824,6 +5861,8 @@ const ServerSettingsPatch = Schema$1.Struct({
 		followChangeRequestTemplates: Schema$1.optionalKey(Schema$1.Boolean)
 	})),
 	sourceControlWriterModelSelection: Schema$1.optionalKey(Schema$1.NullOr(ModelSelection)),
+	disabledSkills: Schema$1.optionalKey(Schema$1.Array(TrimmedNonEmptyString)),
+	taskBoardSource: Schema$1.optionalKey(TaskBoardSource),
 	observability: Schema$1.optionalKey(Schema$1.Struct({
 		otlpTracesUrl: Schema$1.optionalKey(TrimmedString),
 		otlpMetricsUrl: Schema$1.optionalKey(TrimmedString)
@@ -7317,6 +7356,22 @@ const TaskStreamEvent = Schema$1.Union([
 		taskId: TaskId
 	})
 ]);
+Schema$1.Struct({
+	patch: TaskUpdateInput,
+	/** The status the caller believes the task is in. */
+	expectedStatus: TaskStatus
+});
+Schema$1.Union([
+	Schema$1.Struct({
+		outcome: Schema$1.Literal("updated"),
+		task: Task
+	}),
+	Schema$1.Struct({ outcome: Schema$1.Literal("missing") }),
+	Schema$1.Struct({
+		outcome: Schema$1.Literal("conflict"),
+		current: Task
+	})
+]);
 /**
 * Start an agent on a task.
 *
@@ -7935,6 +7990,81 @@ var McpRegistryError = class extends Schema$1.TaggedErrorClass()("McpRegistryErr
 	}
 };
 //#endregion
+//#region ../../packages/contracts/src/skillRegistry.ts
+/**
+* Finding skills that are not on this machine yet.
+*
+* Managing the skills you already have is CRUD, and that is `agentAsset.ts`.
+* This is the other half: a catalogue to search and a repository to read a
+* skill out of, with the install itself going through the ordinary local-create
+* path so there is exactly one way a skill lands on disk.
+*
+* **Nothing here installs anything.** Search returns names; fetch returns the
+* files it *would* write, with the source they came from. The confirmation step
+* is a person looking at that list, which is the only reason it is two calls
+* rather than one — a `SKILL.md` is instructions handed to an agent that
+* already has a shell, so what it contains is worth seeing before it arrives.
+*
+* @module skillRegistry
+*/
+/**
+* One catalogue hit.
+*
+* `source` is the repository, and it is not decoration: it is what a person
+* judges the install on, so it travels with every result rather than being
+* fetched later.
+*/
+const RegistrySkill = Schema$1.Struct({
+	/** `owner/repo/skill-name`, the catalogue's own identifier. */
+	id: TrimmedNonEmptyString,
+	name: TrimmedNonEmptyString,
+	/** `owner/repo`. */
+	source: TrimmedNonEmptyString,
+	/** How many installs the catalogue has counted. Popularity, not endorsement. */
+	installs: Schema$1.Int
+});
+const RegistrySkillSearchInput = Schema$1.Struct({ query: TrimmedNonEmptyString });
+/**
+* `unavailable` rather than a failure, matching the hub calls: a catalogue on
+* someone else's infrastructure being down is an ordinary condition, and a
+* panel has to say which of "nothing matched" and "could not ask" happened.
+*/
+const RegistrySkillSearchResult = Schema$1.Struct({
+	results: Schema$1.Array(RegistrySkill),
+	unavailable: Schema$1.NullOr(Schema$1.String)
+});
+const RegistrySkillFetchInput = Schema$1.Struct({ 
+/** `owner/repo/skill-name`, from a search result or typed by hand. */
+id: TrimmedNonEmptyString });
+/** Why a file in the skill's directory is not in the fetched set. */
+const RegistrySkillSkippedFile = Schema$1.Struct({
+	path: Schema$1.String,
+	reason: Schema$1.Literals([
+		"too-large",
+		"too-many-files",
+		"over-total-size"
+	])
+});
+/**
+* What installing this skill would write, and where it came from.
+*
+* `skipped` is part of the answer rather than a log line. A bound that silently
+* drops a script leaves a skill that is present, looks installed, and fails at
+* the moment it is used.
+*/
+const RegistrySkillFetchResult = Schema$1.Struct({
+	found: Schema$1.Boolean,
+	id: TrimmedNonEmptyString,
+	/** The directory name the skill would take on disk. */
+	name: Schema$1.String,
+	source: Schema$1.String,
+	/** Where these files can be read in full, before trusting them. */
+	sourceUrl: Schema$1.String,
+	files: Schema$1.Array(AgentAssetFile),
+	skipped: Schema$1.Array(RegistrySkillSkippedFile),
+	unavailable: Schema$1.NullOr(Schema$1.String)
+});
+//#endregion
 //#region ../../packages/contracts/src/filesystem.ts
 const FILESYSTEM_PATH_MAX_LENGTH = 512;
 const FilesystemBrowseInput = Schema$1.Struct({
@@ -8197,6 +8327,8 @@ const WS_METHODS = {
 	assetsDelete: "assets.delete",
 	assetsCreateLocal: "assets.createLocal",
 	assetsRemoveLocal: "assets.removeLocal",
+	skillRegistrySearch: "skillRegistry.search",
+	skillRegistryFetch: "skillRegistry.fetch",
 	mcpList: "mcp.list",
 	mcpSave: "mcp.save",
 	mcpRemove: "mcp.remove",
@@ -8420,6 +8552,24 @@ const WsAssetsRemoveLocalRpc = Rpc.make(WS_METHODS.assetsRemoveLocal, {
 	error: Schema$1.Union([EnvironmentAuthorizationError])
 });
 /**
+* Finding and reading skills that are not on this machine yet.
+*
+* Read-only, both of them. Installing is `assets.createLocal` with the files
+* `skillRegistry.fetch` returned, so a skill arriving from a catalogue goes
+* through exactly the same refusals as one typed into the New skill dialog, and
+* the step in between is a person looking at what would be written.
+*/
+const WsSkillRegistrySearchRpc = Rpc.make(WS_METHODS.skillRegistrySearch, {
+	payload: RegistrySkillSearchInput,
+	success: RegistrySkillSearchResult,
+	error: Schema$1.Union([EnvironmentAuthorizationError])
+});
+const WsSkillRegistryFetchRpc = Rpc.make(WS_METHODS.skillRegistryFetch, {
+	payload: RegistrySkillFetchInput,
+	success: RegistrySkillFetchResult,
+	error: Schema$1.Union([EnvironmentAuthorizationError])
+});
+/**
 * Registering the user's own MCP servers.
 *
 * Every one of these answers with the whole list, for the same reason the sync
@@ -8829,7 +8979,7 @@ const WsSubscribeAuthAccessRpc = Rpc.make(WS_METHODS.subscribeAuthAccess, {
 	error: Schema$1.Union([AuthAccessStreamError, EnvironmentAuthorizationError]),
 	stream: true
 });
-const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetProviderUsageRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsTasksStartThreadRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsAssetsCreateLocalRpc, WsAssetsRemoveLocalRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
+const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetProviderUsageRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsTasksStartThreadRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsAssetsReadRpc, WsAssetsSaveRpc, WsAssetsDeleteRpc, WsAssetsCreateLocalRpc, WsAssetsRemoveLocalRpc, WsSkillRegistrySearchRpc, WsSkillRegistryFetchRpc, WsMcpListRpc, WsMcpSaveRpc, WsMcpRemoveRpc, WsMcpSetSecretRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
 //#endregion
 //#region ../../packages/shared/src/oauthScope.ts
 const OAUTH_SCOPE_TOKEN = /^[\u0021\u0023-\u005b\u005d-\u007e]+$/u;
@@ -8975,7 +9125,7 @@ function deriveAuthClientMetadata(input) {
 //#endregion
 //#region src/auth/EnvironmentAuthPolicy.ts
 var EnvironmentAuthPolicy = class extends Context.Service()("@p4code/cli/auth/EnvironmentAuthPolicy") {};
-const make$70 = Effect.gen(function* () {
+const make$71 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const isRemoteReachable = isRemoteReachableHost(config.host);
 	const policy = config.mode === "desktop" ? isRemoteReachable ? "remote-reachable" : "desktop-managed-local" : isRemoteReachable ? "remote-reachable" : "loopback-browser";
@@ -8993,7 +9143,7 @@ const make$70 = Effect.gen(function* () {
 	};
 	return EnvironmentAuthPolicy.of({ getDescriptor: () => Effect.succeed(descriptor).pipe(Effect.withSpan("EnvironmentAuthPolicy.getDescriptor")) });
 });
-const layer$66 = Layer.effect(EnvironmentAuthPolicy, make$70);
+const layer$67 = Layer.effect(EnvironmentAuthPolicy, make$71);
 //#endregion
 //#region src/persistence/Errors.ts
 function summarizeSchemaIssue(issue) {
@@ -9174,7 +9324,7 @@ function toPersistenceSqlOrDecodeError$6(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$69 = Effect.gen(function* () {
+const make$70 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createSessionRow = SqlSchema.void({
 		Request: CreateAuthSessionInput,
@@ -9308,7 +9458,7 @@ const make$69 = Effect.gen(function* () {
 		setLastConnectedAt
 	};
 });
-const layer$65 = Layer.effect(AuthSessionRepository, make$69);
+const layer$66 = Layer.effect(AuthSessionRepository, make$70);
 //#endregion
 //#region src/auth/ServerSecretStore.ts
 const secretStoreErrorContext = {
@@ -9375,7 +9525,7 @@ const isSecretStoreError = Schema$1.is(SecretStoreError);
 const isPlatformError = (value) => Predicate.isTagged(value, "PlatformError");
 const isSecretAlreadyExistsError = (error) => "cause" in error && isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists";
 var ServerSecretStore = class extends Context.Service()("@p4code/cli/auth/ServerSecretStore") {};
-const make$68 = Effect.gen(function* () {
+const make$69 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -9445,7 +9595,7 @@ const make$68 = Effect.gen(function* () {
 		remove
 	});
 });
-const layer$64 = Layer.effect(ServerSecretStore, make$68);
+const layer$65 = Layer.effect(ServerSecretStore, make$69);
 //#endregion
 //#region src/auth/SessionStore.ts
 var MalformedSessionTokenError = class extends Schema$1.TaggedErrorClass()("MalformedSessionTokenError", {}) {
@@ -9683,7 +9833,7 @@ function toAuthClientSession(input) {
 		current: false
 	};
 }
-const make$67 = Effect.gen(function* () {
+const make$68 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const serverConfig = yield* ServerConfig$1;
 	const secretStore = yield* ServerSecretStore;
@@ -9997,7 +10147,7 @@ const make$67 = Effect.gen(function* () {
 		markDisconnected
 	});
 });
-const layer$63 = Layer.effect(SessionStore, make$67).pipe(Layer.provideMerge(layer$65));
+const layer$64 = Layer.effect(SessionStore, make$68).pipe(Layer.provideMerge(layer$66));
 //#endregion
 //#region src/persistence/AuthPairingLinks.ts
 const AuthPairingLinkRecord = Schema$1.Struct({
@@ -10058,7 +10208,7 @@ function toPersistenceSqlOrDecodeError$5(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$66 = Effect.gen(function* () {
+const make$67 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createPairingLinkRow = SqlSchema.void({
 		Request: CreateAuthPairingLinkInput,
@@ -10193,7 +10343,7 @@ const make$66 = Effect.gen(function* () {
 		getByCredential
 	};
 });
-const layer$62 = Layer.effect(AuthPairingLinkRepository, make$66);
+const layer$63 = Layer.effect(AuthPairingLinkRepository, make$67);
 //#endregion
 //#region src/auth/PairingGrantStore.ts
 var UnknownBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnknownBootstrapCredentialError", {}) {
@@ -10288,7 +10438,7 @@ const DEV_STARTUP_TTL_HOURS = Duration.hours(24);
 const PAIRING_TOKEN_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 const PAIRING_TOKEN_LENGTH = 12;
 const PAIRING_TOKEN_REJECTION_LIMIT = Math.floor(256 / 32) * 32;
-const make$65 = Effect.gen(function* () {
+const make$66 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const config = yield* ServerConfig$1;
 	const pairingLinks = yield* AuthPairingLinkRepository;
@@ -10486,7 +10636,7 @@ const make$65 = Effect.gen(function* () {
 		consume
 	});
 });
-const layer$61 = Layer.effect(PairingGrantStore, make$65).pipe(Layer.provideMerge(layer$62));
+const layer$62 = Layer.effect(PairingGrantStore, make$66).pipe(Layer.provideMerge(layer$63));
 //#endregion
 //#region src/persistence/Migrations/001_OrchestrationEvents.ts
 var _001_OrchestrationEvents_default = Effect.gen(function* () {
@@ -12259,7 +12409,7 @@ function parseBearerToken(request) {
 	const token = header.slice(7).trim();
 	return token.length > 0 ? token : null;
 }
-const make$64 = Effect.gen(function* () {
+const make$65 = Effect.gen(function* () {
 	const policy = yield* EnvironmentAuthPolicy;
 	const bootstrapCredentials = yield* PairingGrantStore;
 	const sessions = yield* SessionStore;
@@ -12454,9 +12604,9 @@ const make$64 = Effect.gen(function* () {
 		issueStartupPairingUrl
 	});
 });
-const layer$60 = Layer.effect(EnvironmentAuth, make$64).pipe(Layer.provideMerge(layer$61), Layer.provideMerge(layer$63), Layer.provideMerge(layer$66));
-const storageLayer = Layer.mergeAll(layer$64, layerConfig);
-const runtimeLayer = layer$60.pipe(Layer.provideMerge(storageLayer));
+const layer$61 = Layer.effect(EnvironmentAuth, make$65).pipe(Layer.provideMerge(layer$62), Layer.provideMerge(layer$64), Layer.provideMerge(layer$67));
+const storageLayer = Layer.mergeAll(layer$65, layerConfig);
+const runtimeLayer = layer$61.pipe(Layer.provideMerge(storageLayer));
 //#endregion
 //#region src/cliAuthFormat.ts
 const newline = "\n";
@@ -13211,7 +13361,7 @@ const runWithEnvironmentAuth = (flags, run, options) => Effect.gen(function* ()
 	}
 	return yield* Effect.gen(function* () {
 		return yield* run(yield* EnvironmentAuth);
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$68(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const ttlFlag = Flag.string("ttl").pipe(Flag.withSchema(DurationFromString), Flag.withDescription("TTL, for example `5m`, `1h`, `30d`, or `15 minutes`."), Flag.optional);
 const jsonFlag = Flag.boolean("json").pipe(Flag.withDescription("Emit JSON instead of human-readable output."), Flag.withDefault(false));
@@ -13351,7 +13501,7 @@ const DEFAULT_LIMITS = {
 	windowMillis: FAILURE_WINDOW_MS,
 	blockMillis: BLOCK_DURATION_MS
 };
-const make$63 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
+const make$64 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
 	const state = yield* Ref.make(initialThrottleState);
 	return HubAuthThrottle.of({
 		shouldRefuse: Effect.gen(function* () {
@@ -13365,7 +13515,7 @@ const make$63 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LI
 		})
 	});
 });
-const layer$59 = Layer.effect(HubAuthThrottle, make$63());
+const layer$60 = Layer.effect(HubAuthThrottle, make$64());
 //#endregion
 //#region src/hub/HubAuth.ts
 /**
@@ -13817,6 +13967,43 @@ const makeTaskRepository = Effect.gen(function* () {
 			task
 		})
 	})));
+	/**
+	* The claim, and the reason it is a separate method rather than an option on
+	* `patch`: only this one has an outcome a caller must branch on.
+	*
+	* The comparison happens *inside* the transaction alongside the write, which
+	* is the only arrangement that makes it a compare-and-set. Reading first and
+	* writing after would leave exactly the window it exists to close.
+	*/
+	const patchIfStatus = (input, updatedAt) => sql.withTransaction(Effect.gen(function* () {
+		const existing = yield* getTaskRow({ taskId: input.patch.taskId });
+		if (Option.isNone(existing)) return { outcome: "missing" };
+		if (existing.value.status !== input.expectedStatus) return {
+			outcome: "conflict",
+			current: existing.value
+		};
+		const updated = {
+			...existing.value,
+			...input.patch.projectId !== void 0 ? { projectId: input.patch.projectId } : {},
+			...input.patch.repositoryKey !== void 0 ? { repositoryKey: input.patch.repositoryKey } : {},
+			...input.patch.threadId !== void 0 ? { threadId: input.patch.threadId } : {},
+			...input.patch.title !== void 0 ? { title: input.patch.title } : {},
+			...input.patch.body !== void 0 ? { body: input.patch.body } : {},
+			...input.patch.status !== void 0 ? { status: input.patch.status } : {},
+			...input.patch.priority !== void 0 ? { priority: input.patch.priority } : {},
+			...input.patch.assignee !== void 0 ? { assignee: input.patch.assignee } : {},
+			...input.patch.labels !== void 0 ? { labels: input.patch.labels } : {},
+			updatedAt
+		};
+		yield* upsertTaskRow(updated);
+		return {
+			outcome: "updated",
+			task: updated
+		};
+	})).pipe(Effect.mapError(toPersistenceSqlError("TaskRepository.patchIfStatus:query")), Effect.tap((result) => result.outcome === "updated" ? publish({
+		type: "upserted",
+		task: result.task
+	}) : Effect.void));
 	const deleteById = (input) => deleteTaskRow(input).pipe(Effect.mapError(toPersistenceSqlError("TaskRepository.deleteById:query")), Effect.tap(() => publish({
 		type: "deleted",
 		taskId: input.taskId
@@ -13824,6 +14011,7 @@ const makeTaskRepository = Effect.gen(function* () {
 	return {
 		upsert,
 		patch,
+		patchIfStatus,
 		getById,
 		list,
 		deleteById,
@@ -13944,13 +14132,25 @@ const updateTaskRoute = HttpRouter.add("PATCH", "/tasks/:taskId", respondToHubFa
 	yield* authenticateHubRequest();
 	const params = yield* HttpRouter.params;
 	const taskId = TaskId.make(params.taskId ?? "");
-	const body = yield* readJsonBody();
+	const { expectedStatus, ...patchBody } = (yield* readJsonBody()) ?? {};
 	const input = yield* decodeOrInvalid(TaskUpdateInput, "Request body does not match TaskUpdateInput.")({
-		...body,
+		...patchBody,
 		taskId
 	});
 	const tasks = yield* TaskRepository;
 	const timestamp = DateTime.formatIso(yield* DateTime.now);
+	if (expectedStatus !== void 0) {
+		const condition = yield* decodeOrInvalid(TaskStatus, "expectedStatus is not a task status.")(expectedStatus);
+		const result = yield* tasks.patchIfStatus({
+			patch: input,
+			expectedStatus: condition
+		}, timestamp);
+		if (result.outcome === "missing") return notFound(taskId);
+		return result.outcome === "conflict" ? HttpServerResponse.jsonUnsafe({
+			error: "conflict",
+			current: result.current
+		}, { status: 409 }) : HttpServerResponse.jsonUnsafe(result.task);
+	}
 	const patched = yield* tasks.patch(input, timestamp);
 	return Option.isNone(patched) ? notFound(taskId) : HttpServerResponse.jsonUnsafe(patched.value);
 })));
@@ -14056,7 +14256,7 @@ const deleteAssetRoute = HttpRouter.add("DELETE", "/assets/:kind/:name", respond
 	const outcome = yield* (yield* AgentAssetRepository).deleteByName(requested);
 	return outcome._tag === "conflict" ? assetConflict(Option.getOrNull(outcome.current)) : HttpServerResponse.empty({ status: 204 });
 })));
-const layer$58 = Layer.mergeAll(healthRoute, listTasksRoute, getTaskRoute, createTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute);
+const layer$59 = Layer.mergeAll(healthRoute, listTasksRoute, getTaskRoute, createTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute);
 //#endregion
 //#region src/hub/Migrations/001_Tasks.ts
 /**
@@ -14271,7 +14471,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 	});
 	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
-const makeHubLayer = HttpRouter.serve(layer$58).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$59), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
+const makeHubLayer = HttpRouter.serve(layer$59).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$60), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
 //#endregion
 //#region src/atomicWrite.ts
@@ -14395,7 +14595,7 @@ function stripDefaultServerSettings(current, defaults) {
 	}
 	return Object.is(current, defaults) ? void 0 : current;
 }
-const make$62 = Effect.gen(function* () {
+const make$63 = Effect.gen(function* () {
 	const { settingsPath } = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const pathService = yield* Path.Path;
@@ -14616,7 +14816,7 @@ const make$62 = Effect.gen(function* () {
 		}
 	};
 });
-const layer$57 = Layer.effect(ServerSettingsService, make$62);
+const layer$58 = Layer.effect(ServerSettingsService, make$63);
 //#endregion
 //#region src/pathExpansion.ts
 /**
@@ -14638,6 +14838,86 @@ function expandHomePath$3(value) {
 	return value;
 }
 //#endregion
+//#region src/provider/skillOverrides.ts
+/**
+* Turning "this skill is disabled" into something a provider enforces.
+*
+* **A skill has two names and either can reach it.** Discovery reports the
+* `SKILL.md` frontmatter `name` when there is one and the directory name
+* otherwise, while the sync panel lists directories — so the disabled set can
+* hold either form depending on which surface the toggle was pressed on, and
+* the CLI keys its own listing on the name it resolved. Matching on one form
+* only produces a toggle that works for most skills and silently does nothing
+* for the ones whose frontmatter disagrees with their directory, which is the
+* worst of the available failures: it looks like the feature works.
+*
+* So both forms are matched on the way in and both are emitted on the way out.
+*
+* **The lever is `Settings.skillOverrides`, not the SDK's `skills` option.**
+* `skills: string[]` is an allowlist: passing it enables *only* the listed
+* skills, so a single disabled skill would silently take every plugin-provided
+* skill with it, since those are not in our discovery at all. `skillOverrides`
+* is per skill and additive — an absent key means "on" — so nothing is affected
+* except what was named.
+*
+* @module provider/skillOverrides
+*/
+/**
+* Hidden from the model's listing *and* from `/name`.
+*
+* The other values the setting accepts are partial hides (`name-only`,
+* `user-invocable-only`); a p4code toggle labelled "disabled" has to be the
+* complete one, or the label is a lie.
+*/
+const SKILL_OVERRIDE_OFF = "off";
+/**
+* The directory a skill lives in, from its `SKILL.md` path.
+*
+* Path handling by hand rather than through `Path.Path`, because this stays a
+* pure function: it is called from discovery, from the adapter and from tests,
+* and the segment separator is the only platform fact it needs.
+*/
+function skillDirectoryName(skillPath) {
+	const segments = skillPath.split(/[/\\]/).filter((segment) => segment.length > 0);
+	return segments.length >= 2 ? segments[segments.length - 2] ?? "" : "";
+}
+/** Every name a skill answers to, ignoring empties. */
+function namesOf(skill) {
+	const directoryName = skillDirectoryName(skill.path);
+	return [skill.name, directoryName].filter((name) => name.length > 0);
+}
+/**
+* Whether a discovered skill is in the disabled set, under either of its names.
+*/
+function isSkillDisabled(skill, disabled) {
+	const disabledSet = new Set(disabled);
+	return namesOf(skill).some((name) => disabledSet.has(name));
+}
+/**
+* The `skillOverrides` map to hand a session, or `undefined` when nothing is
+* disabled.
+*
+* `undefined` rather than `{}` on purpose: an empty map is a setting the
+* session did not have before, and the point of this feature is that a server
+* with nothing disabled starts sessions byte-identical to the ones it started
+* yesterday.
+*
+* Names that match no discovered skill are still emitted. A skill can be
+* disabled and then removed from disk, or disabled in a project the current
+* session is not in, and dropping the entry would quietly re-enable it the
+* moment discovery misses it.
+*/
+function buildSkillOverrides(disabled, discovered) {
+	if (disabled.length === 0) return;
+	const overrides = {};
+	for (const name of disabled) if (name.length > 0) overrides[name] = SKILL_OVERRIDE_OFF;
+	for (const skill of discovered) {
+		if (!isSkillDisabled(skill, disabled)) continue;
+		for (const name of namesOf(skill)) overrides[name] = SKILL_OVERRIDE_OFF;
+	}
+	return Object.keys(overrides).length === 0 ? void 0 : overrides;
+}
+//#endregion
 //#region src/provider/Drivers/ClaudeSkills.ts
 /**
 * ClaudeSkills — filesystem discovery of Claude Code skills for the `$` picker.
@@ -14709,7 +14989,7 @@ const resolveClaudeUserSkillsDir = Effect.fn("resolveClaudeUserSkillsDir")(funct
 * collisions the project-scoped skill wins, matching Claude Code's
 * most-specific-wins resolution.
 */
-const discoverClaudeSkills = Effect.fn("discoverClaudeSkills")(function* (config, cwd, environment) {
+const discoverClaudeSkills = Effect.fn("discoverClaudeSkills")(function* (config, cwd, environment, disabledSkills) {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const configDirPath = yield* resolveClaudeConfigDirPath(config, environment ?? process.env, cwd);
@@ -14734,7 +15014,10 @@ const discoverClaudeSkills = Effect.fn("discoverClaudeSkills")(function* (config
 			skillsByName.set(name, {
 				name,
 				path: skillPath,
-				enabled: true,
+				enabled: !isSkillDisabled({
+					name,
+					path: skillPath
+				}, disabledSkills ?? []),
 				scope: root.scope,
 				...frontmatter.kind === "parsed" && frontmatter.description ? { description: frontmatter.description } : {}
 			});
@@ -14749,7 +15032,7 @@ const decodeRegistration$1 = Schema$1.decodeUnknownExit(RegistrationFromJson$1);
 const encodeRegistration = Schema$1.encodeSync(RegistrationFromJson$1);
 var McpRegistry = class extends Context.Service()("@p4code/cli/mcp/McpRegistry") {};
 const slotsOf = (registration) => registration.secrets ?? [];
-const make$61 = Effect.gen(function* () {
+const make$62 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
 	const fileSystem = yield* FileSystem.FileSystem;
@@ -14861,7 +15144,7 @@ const make$61 = Effect.gen(function* () {
 		}).pipe(Effect.provide(services), Effect.catchCause((cause) => Effect.logWarning("mcp registry resolve failed", { cause }).pipe(Effect.as({}))))
 	};
 });
-const layer$56 = Layer.effect(McpRegistry, make$61);
+const layer$57 = Layer.effect(McpRegistry, make$62);
 //#endregion
 //#region src/sync/HubLink.ts
 /**
@@ -14958,7 +15241,7 @@ const formatHubLink = (input) => encodeStoredHubLink({
 	shareMode: input.shareMode
 });
 const fromEnvironment = (environment) => validateHubLink(environment.P4CODE_HUB_URL ?? "", environment.P4CODE_HUB_TOKEN ?? "");
-const make$60 = Effect.fn("HubLink.make")(function* (environment) {
+const make$61 = Effect.fn("HubLink.make")(function* (environment) {
 	const secrets = yield* ServerSecretStore;
 	const env = environment ?? process.env;
 	const fromEnv = fromEnvironment(env);
@@ -15024,7 +15307,7 @@ const make$60 = Effect.fn("HubLink.make")(function* (environment) {
 		})
 	};
 });
-const layer$55 = Layer.effect(HubLink, make$60());
+const layer$56 = Layer.effect(HubLink, make$61());
 //#endregion
 //#region src/sync/HubAssetClient.ts
 /**
@@ -15039,7 +15322,7 @@ const layer$55 = Layer.effect(HubLink, make$60());
 *
 * @module sync/HubAssetClient
 */
-const HUB_REQUEST_TIMEOUT_MS = 15e3;
+const HUB_REQUEST_TIMEOUT_MS$1 = 15e3;
 /**
 * The hub could not be reached, or answered something unusable.
 *
@@ -15052,12 +15335,12 @@ var HubAssetConflict = class extends Data.TaggedError("HubAssetConflict") {};
 /** No hub is configured on this server, so there is nothing to talk to. */
 var HubNotConfigured = class extends Data.TaggedError("HubNotConfigured") {};
 const AssetListPage = Schema$1.Struct({ assets: Schema$1.Array(AgentAsset) });
-const ConflictBody = Schema$1.Struct({ current: Schema$1.NullOr(AgentAsset) });
+const ConflictBody$1 = Schema$1.Struct({ current: Schema$1.NullOr(AgentAsset) });
 const decodeAssetListPage = Schema$1.decodeUnknownEffect(AssetListPage);
-const decodeConflictBody = Schema$1.decodeUnknownEffect(ConflictBody);
+const decodeConflictBody$1 = Schema$1.decodeUnknownEffect(ConflictBody$1);
 const decodeAsset = Schema$1.decodeUnknownEffect(AgentAsset);
 var HubAssetClient = class extends Context.Service()("@p4code/cli/sync/HubAssetClient") {};
-const make$59 = Effect.gen(function* () {
+const make$60 = Effect.gen(function* () {
 	const http = yield* HttpClient.HttpClient;
 	const link = yield* HubLink;
 	const requireSettings = Effect.gen(function* () {
@@ -15066,7 +15349,7 @@ const make$59 = Effect.gen(function* () {
 		return state.settings.value;
 	});
 	const send = Effect.fn("HubAssetClient.send")(function* (operation, settings, request) {
-		return yield* http.execute(request.pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`), HttpClientRequest.setHeader("accept", "application/json"))).pipe(Effect.timeout(HUB_REQUEST_TIMEOUT_MS), Effect.mapError((cause) => new HubUnavailable({
+		return yield* http.execute(request.pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`), HttpClientRequest.setHeader("accept", "application/json"))).pipe(Effect.timeout(HUB_REQUEST_TIMEOUT_MS$1), Effect.mapError((cause) => new HubUnavailable({
 			operation,
 			detail: `${cause._tag ?? "error"}`
 		})));
@@ -15086,7 +15369,7 @@ const make$59 = Effect.gen(function* () {
 	* which is what lets a caller show both sides instead of only saying no.
 	*/
 	const conflictFrom = Effect.fn("HubAssetClient.conflictFrom")(function* (name, response) {
-		const body = yield* decodeBody("conflict", decodeConflictBody, response).pipe(Effect.orElseSucceed(() => ({ current: null })));
+		const body = yield* decodeBody("conflict", decodeConflictBody$1, response).pipe(Effect.orElseSucceed(() => ({ current: null })));
 		return new HubAssetConflict({
 			name,
 			current: body.current === null ? Option.none() : Option.some(body.current)
@@ -15139,7 +15422,7 @@ const make$59 = Effect.gen(function* () {
 		remove
 	};
 });
-const layer$54 = Layer.effect(HubAssetClient, make$59);
+const layer$55 = Layer.effect(HubAssetClient, make$60);
 //#endregion
 //#region src/sync/mcpRegistrationFiles.ts
 /**
@@ -15878,7 +16161,7 @@ const EMPTY_REPORT = {
 	unavailable: null
 };
 var AssetSync = class extends Context.Service()("@p4code/cli/sync/AssetSync") {};
-const make$58 = Effect.gen(function* () {
+const make$59 = Effect.gen(function* () {
 	const client = yield* HubAssetClient;
 	const link = yield* HubLink;
 	const settingsStore = yield* ServerSettingsService;
@@ -16575,10 +16858,10 @@ const make$58 = Effect.gen(function* () {
 		removeLocal
 	};
 });
-const layer$53 = Layer.effect(AssetSync, make$58);
+const layer$54 = Layer.effect(AssetSync, make$59);
 //#endregion
 //#region src/cli/assets.ts
-const SyncServicesLive = layer$53.pipe(Layer.provideMerge(layer$54), Layer.provideMerge(layer$55), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$64))), Layer.provideMerge(layer$64), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$54.pipe(Layer.provideMerge(layer$55), Layer.provideMerge(layer$56), Layer.provideMerge(layer$58.pipe(Layer.provide(layer$65))), Layer.provideMerge(layer$65), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -16586,7 +16869,7 @@ const runWithSync = (flags, run) => Effect.gen(function* () {
 			sync: yield* AssetSync,
 			link: yield* HubLink
 		});
-	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
+	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$68(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
 });
 const STATE_LABEL = {
 	synced: "synced",
@@ -21801,12 +22084,12 @@ const runProcessCore = Effect.fn("processRunner.runProcessCore")(function* (spaw
 		stderrTruncated: stderr.truncated
 	};
 });
-const make$57 = Effect.fn("ProcessRunner.make")(function* () {
+const make$58 = Effect.fn("ProcessRunner.make")(function* () {
 	const spawner = yield* ChildProcessSpawner$1.ChildProcessSpawner;
 	const run = (input) => finalizeRunProcess(runProcessCore(spawner, input), input);
 	return ProcessRunner.of({ run });
 });
-const layer$52 = Layer.effect(ProcessRunner, make$57());
+const layer$53 = Layer.effect(ProcessRunner, make$58());
 //#endregion
 //#region src/project/RepositoryIdentityResolver.ts
 const DEFAULT_REPOSITORY_IDENTITY_CACHE_CAPACITY = 512;
@@ -21897,7 +22180,7 @@ const resolveRepositoryIdentityFromCacheKey = Effect.fn("RepositoryIdentityResol
 		rootPath: cacheKey
 	}) : null;
 });
-const make$56 = Effect.fn("RepositoryIdentityResolver.make")(function* (options = {}) {
+const make$57 = Effect.fn("RepositoryIdentityResolver.make")(function* (options = {}) {
 	const processRunner = yield* ProcessRunner;
 	const repositoryIdentityCache = yield* Cache.makeWith((cacheKey) => resolveRepositoryIdentityFromCacheKey(cacheKey).pipe(Effect.provideService(ProcessRunner, processRunner)), {
 		capacity: options.cacheCapacity ?? DEFAULT_REPOSITORY_IDENTITY_CACHE_CAPACITY,
@@ -21912,7 +22195,7 @@ const make$56 = Effect.fn("RepositoryIdentityResolver.make")(function* (options
 	});
 	return RepositoryIdentityResolver.of({ resolve });
 });
-const layer$51 = Layer.effect(RepositoryIdentityResolver, make$56()).pipe(Layer.provide(layer$52));
+const layer$52 = Layer.effect(RepositoryIdentityResolver, make$57()).pipe(Layer.provide(layer$53));
 //#endregion
 //#region src/orchestration/Layers/ProjectionSnapshotQuery.ts
 const decodeReadModel = Schema$1.decodeUnknownEffect(OrchestrationReadModel);
@@ -23667,7 +23950,7 @@ function mergeWithDefaultKeybindings(custom) {
 * Keybindings - Service tag for keybinding configuration operations.
 */
 var Keybindings = class extends Context.Service()("@p4code/cli/keybindings") {};
-const make$55 = Effect.gen(function* () {
+const make$56 = Effect.gen(function* () {
 	const { keybindingsConfigPath } = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -23928,7 +24211,7 @@ const make$55 = Effect.gen(function* () {
 		}))
 	};
 });
-const layer$50 = Layer.effect(Keybindings, make$55);
+const layer$51 = Layer.effect(Keybindings, make$56);
 //#endregion
 //#region src/process/externalLauncher.ts
 /**
@@ -24155,7 +24438,7 @@ const launchEditorProcess = Effect.fn("externalLauncher.launchEditorProcess")(fu
 		cause
 	}));
 });
-const make$54 = Effect.gen(function* () {
+const make$55 = Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner$1.ChildProcessSpawner;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -24166,7 +24449,7 @@ const make$54 = Effect.gen(function* () {
 		launchEditor: (input) => provideCommandResolutionServices(Effect.flatMap(resolveEditorLaunch(input), (launch) => launchEditorProcess(launch).pipe(Effect.provideService(ChildProcessSpawner$1.ChildProcessSpawner, spawner))))
 	});
 });
-const layer$49 = Layer.effect(ExternalLauncher, make$54);
+const layer$50 = Layer.effect(ExternalLauncher, make$55);
 //#endregion
 //#region src/orchestration/Services/OrchestrationReactor.ts
 /**
@@ -24184,7 +24467,7 @@ var OrchestrationReactor = class extends Context.Service()("@p4code/cli/orchestr
 //#endregion
 //#region src/serverLifecycleEvents.ts
 var ServerLifecycleEvents = class extends Context.Service()("@p4code/cli/serverLifecycleEvents") {};
-const make$53 = Effect.gen(function* () {
+const make$54 = Effect.gen(function* () {
 	const pubsub = yield* PubSub.unbounded();
 	const state = yield* Ref.make({
 		sequence: 0,
@@ -24208,7 +24491,7 @@ const make$53 = Effect.gen(function* () {
 		}
 	};
 });
-const layer$48 = Layer.effect(ServerLifecycleEvents, make$53);
+const layer$49 = Layer.effect(ServerLifecycleEvents, make$54);
 //#endregion
 //#region src/telemetry/Identify.ts
 const CodexAuthJsonSchema = Schema$1.Struct({ tokens: Schema$1.Struct({ account_id: Schema$1.String }) });
@@ -24381,7 +24664,7 @@ var AnalyticsService = class AnalyticsService extends Context.Service()("@p4code
 	/** No-op layer for callers that intentionally disable telemetry. */
 	static layerTest = Layer.succeed(AnalyticsService, inert);
 };
-const make$52 = Effect.gen(function* () {
+const make$53 = Effect.gen(function* () {
 	const telemetryConfig = yield* TelemetryEnvConfig;
 	const posthogKey = telemetryConfig.posthogKey.trim();
 	if (!telemetryConfig.enabled || posthogKey === "") return inert;
@@ -24451,7 +24734,7 @@ const make$52 = Effect.gen(function* () {
 		flush
 	});
 });
-const layer$47 = Layer.effect(AnalyticsService, make$52);
+const layer$48 = Layer.effect(AnalyticsService, make$53);
 AnalyticsService.layerTest;
 //#endregion
 //#region src/service/pinnedRuntime.ts
@@ -24798,7 +25081,7 @@ var BootServiceInstallError = class extends Schema$1.TaggedErrorClass()("BootSer
 	}
 };
 var BootService = class extends Context.Service()("@p4code/cli/service/bootService") {};
-const make$51 = Effect.fn("cloud.boot_service.make")(function* (input) {
+const make$52 = Effect.fn("cloud.boot_service.make")(function* (input) {
 	const hostExecPath = yield* HostProcessExecutablePath;
 	const hostArguments = yield* HostProcessArguments;
 	const host = input.host ?? {
@@ -25017,7 +25300,7 @@ const make$51 = Effect.fn("cloud.boot_service.make")(function* (input) {
 		logPath
 	});
 });
-const layer$46 = (input) => Layer.effect(BootService, make$51(input));
+const layer$47 = (input) => Layer.effect(BootService, make$52(input));
 //#endregion
 //#region src/service/selfUpdate.ts
 /**
@@ -25092,7 +25375,7 @@ const resolveServerSelfUpdateCapability = Effect.fn("cloud.server_self_update.re
 	return null;
 });
 var ServerSelfUpdate = class extends Context.Service()("@p4code/cli/service/selfUpdate/ServerSelfUpdate") {};
-const make$50 = Effect.fn("cloud.server_self_update.make")(function* (options) {
+const make$51 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 	const serverConfig = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -25242,7 +25525,7 @@ const make$50 = Effect.fn("cloud.server_self_update.make")(function* (options) {
 	});
 	return ServerSelfUpdate.of({ update });
 });
-const layer$45 = Layer.effect(ServerSelfUpdate, make$50()).pipe(Layer.provide(layer$52));
+const layer$46 = Layer.effect(ServerSelfUpdate, make$51()).pipe(Layer.provide(layer$53));
 //#endregion
 //#region src/environment/ServerEnvironmentLabel.ts
 const ServerEnvironmentLabelCommandProbe = Schema$1.Literals(["macos-computer-name", "linux-pretty-hostname"]);
@@ -25374,7 +25657,7 @@ function platformArch(architecture) {
 		default: return "other";
 	}
 }
-const make$49 = Effect.gen(function* () {
+const make$50 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const serverConfig = yield* ServerConfig$1;
@@ -25437,7 +25720,7 @@ const make$49 = Effect.gen(function* () {
 * state. It intentionally has no fallback Layer.succeed value: callers must
 * provide the external platform services and a ServerConfig.
 */
-const layer$44 = Layer.effect(ServerEnvironment, make$49).pipe(Layer.provide(layer$52));
+const layer$45 = Layer.effect(ServerEnvironment, make$50).pipe(Layer.provide(layer$53));
 //#endregion
 //#region src/provider/Services/ProviderSessionReaper.ts
 var ProviderSessionReaper = class extends Context.Service()("@p4code/cli/provider/Services/ProviderSessionReaper") {};
@@ -26513,7 +26796,7 @@ const maybeOpenBrowser = (target) => Effect.gen(function* () {
 	yield* (yield* ExternalLauncher).launchBrowser(target).pipe(Effect.catch(() => Effect.logInfo("browser auto-open unavailable", { hint: `Open ${target} in your browser.` })));
 });
 const runStartupPhase = (phase, effect) => effect.pipe(Effect.annotateSpans({ "startup.phase": phase }), Effect.withSpan(`server.startup.${phase}`));
-const make$48 = Effect.gen(function* () {
+const make$49 = Effect.gen(function* () {
 	const serverConfig = yield* ServerConfig$1;
 	const keybindings = yield* Keybindings;
 	const orchestrationReactor = yield* OrchestrationReactor;
@@ -26654,7 +26937,7 @@ const make$48 = Effect.gen(function* () {
 		enqueueCommand: commandGate.enqueueCommand
 	};
 });
-const layer$43 = Layer.effect(ServerRuntimeStartup, make$48);
+const layer$44 = Layer.effect(ServerRuntimeStartup, make$49);
 //#endregion
 //#region src/serverRuntimeState.ts
 const PersistedServerRuntimeState = Schema$1.Struct({
@@ -26802,7 +27085,7 @@ function expandHomePath$2(input, path) {
 	if (input.startsWith("~/") || input.startsWith("~\\")) return path.join(NodeOS.homedir(), input.slice(2));
 	return input;
 }
-const make$47 = Effect.gen(function* () {
+const make$48 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const statWorkspaceRoot = Effect.fn("WorkspacePaths.statWorkspaceRoot")(function* (workspaceRoot, normalizedWorkspaceRoot, phase) {
@@ -26859,7 +27142,7 @@ const make$47 = Effect.gen(function* () {
 		resolveRelativePathWithinRoot
 	});
 });
-const layer$42 = Layer.effect(WorkspacePaths, make$47);
+const layer$43 = Layer.effect(WorkspacePaths, make$48);
 //#endregion
 //#region src/cli/project.ts
 const isEnvironmentHttpCommonError = Schema$1.is(EnvironmentHttpCommonError);
@@ -26965,7 +27248,7 @@ const projectCommandUuid = Crypto.Crypto.pipe(Effect.flatMap((crypto) => crypto.
 	operation: "generateProjectCommandId",
 	cause
 })));
-const ProjectCliRuntimeLive = Layer.mergeAll(layer$42, OrchestrationLayerLive.pipe(Layer.provideMerge(layer$51), Layer.provideMerge(layerConfig)));
+const ProjectCliRuntimeLive = Layer.mergeAll(layer$43, OrchestrationLayerLive.pipe(Layer.provideMerge(layer$52), Layer.provideMerge(layerConfig)));
 const PROJECT_CLI_LIVE_SERVER_TIMEOUT = Duration.seconds(1);
 const withProjectCliSessionToken = (environmentAuth, run) => Effect.acquireUseRelease(environmentAuth.issueSession({
 	scopes: AuthAdministrativeScopes,
@@ -27056,7 +27339,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}));
-		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
+		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$68(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
 		return yield* Effect.gen(function* () {
 			const snapshot = yield* getOfflineSnapshot();
 			const orchestrationEngine = yield* OrchestrationEngineService;
@@ -27067,7 +27350,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}).pipe(Effect.provide(offlineRuntimeLayer));
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$42).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$67(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$43).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$68(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const projectAddCommand = Command.make("add", {
 	...projectLocationFlags,
@@ -27674,7 +27957,7 @@ const logP4ProjectFileLoadError = (error) => Effect.logWarning(error).pipe(Effec
 	filePath: error.filePath,
 	errorTag: error._tag
 }));
-const make$46 = Effect.gen(function* () {
+const make$47 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const load = Effect.fn("P4ProjectFileLoader.load")(function* (workspaceRoot) {
@@ -27695,7 +27978,7 @@ const make$46 = Effect.gen(function* () {
 	});
 	return P4ProjectFileLoader.of({ load });
 });
-const layer$41 = Layer.effect(P4ProjectFileLoader, make$46);
+const layer$42 = Layer.effect(P4ProjectFileLoader, make$47);
 //#endregion
 //#region src/project/ProjectFaviconResolver.ts
 /**
@@ -27766,7 +28049,7 @@ function extractIconHref(source) {
 	return null;
 }
 const optionOnNotFound$1 = (effect) => effect.pipe(Effect.map(Option.some), Effect.catchTags({ PlatformError: (error) => error.reason._tag === "NotFound" ? Effect.succeed(Option.none()) : Effect.fail(error) }));
-const make$45 = Effect.gen(function* () {
+const make$46 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const workspacePaths = yield* WorkspacePaths;
@@ -27835,7 +28118,7 @@ const make$45 = Effect.gen(function* () {
 	});
 	return ProjectFaviconResolver.of({ resolvePath });
 });
-const layer$40 = Layer.effect(ProjectFaviconResolver, make$45);
+const layer$41 = Layer.effect(ProjectFaviconResolver, make$46);
 //#endregion
 //#region src/assets/AssetAccess.ts
 const ASSET_ROUTE_PREFIX = "/api/assets";
@@ -28088,10 +28371,10 @@ const resolveAsset = Effect.fn("AssetAccess.resolveAsset")(function* (token, rel
 //#endregion
 //#region src/observability/BrowserTraceCollector.ts
 var BrowserTraceCollector = class extends Context.Service()("@p4code/cli/observability/BrowserTraceCollector") {};
-const make$44 = (sink) => BrowserTraceCollector.of({ record: (records) => Effect.sync(() => {
+const make$45 = (sink) => BrowserTraceCollector.of({ record: (records) => Effect.sync(() => {
 	for (const record of records) sink.push(record);
 }) });
-const layer$39 = (sink) => Layer.succeed(BrowserTraceCollector, make$44(sink));
+const layer$40 = (sink) => Layer.succeed(BrowserTraceCollector, make$45(sink));
 //#endregion
 //#region src/auth/http.ts
 const CREDENTIAL_RESPONSE_HEADERS = {
@@ -30305,7 +30588,7 @@ const classifyNonZeroExit = (command, stderr) => {
 	if (command === "gh" && (normalized.includes("could not resolve to a pullrequest") || normalized.includes("repository.pullrequest") || normalized.includes("no pull requests found for branch") || normalized.includes("pull request not found")) || command === "glab" && (normalized.includes("merge request not found") || normalized.includes("not found") || normalized.includes("404")) || command === "az" && normalized.includes("pull request") && (normalized.includes("not found") || normalized.includes("does not exist"))) return "not-found";
 	return "command-failed";
 };
-const make$43 = Effect.gen(function* () {
+const make$44 = Effect.gen(function* () {
 	const processRunner = yield* ProcessRunner;
 	const run = Effect.fn("VcsProcess.run")(function* (input) {
 		const baseError = {
@@ -30362,7 +30645,7 @@ const make$43 = Effect.gen(function* () {
 	});
 	return VcsProcess.of({ run });
 });
-const layer$38 = Layer.effect(VcsProcess, make$43).pipe(Layer.provide(layer$52));
+const layer$39 = Layer.effect(VcsProcess, make$44).pipe(Layer.provide(layer$53));
 //#endregion
 //#region src/vcs/VcsDriver.ts
 var VcsDriver = class extends Context.Service()("@p4code/cli/vcs/VcsDriver") {};
@@ -30813,12 +31096,12 @@ const makeVcsDriver = Effect.gen(function* () {
 	const driver = yield* makeVcsDriverShape();
 	return VcsDriver.of(driver);
 });
-const make$42 = Effect.gen(function* () {
+const make$43 = Effect.gen(function* () {
 	const git = yield* makeGitVcsDriverCore();
 	return GitVcsDriver.of(git);
 });
 Layer.effect(VcsDriver, makeVcsDriver);
-const layer$37 = Layer.effect(GitVcsDriver, make$42);
+const layer$38 = Layer.effect(GitVcsDriver, make$43);
 //#endregion
 //#region src/vcs/VcsProjectConfig.ts
 const ProjectVcsConfigJson = fromLenientJson(Schema$1.Struct({
@@ -30850,7 +31133,7 @@ const logVcsProjectConfigError = (error) => Effect.logWarning(error).pipe(Effect
 	configPath: error.configPath,
 	errorTag: error._tag
 }));
-const make$41 = Effect.gen(function* () {
+const make$42 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const findConfigPath = Effect.fn("VcsProjectConfig.findConfigPath")(function* (cwd) {
@@ -30891,7 +31174,7 @@ const make$41 = Effect.gen(function* () {
 	});
 	return VcsProjectConfig.of({ resolveKind });
 });
-const layer$36 = Layer.effect(VcsProjectConfig, make$41);
+const layer$37 = Layer.effect(VcsProjectConfig, make$42);
 //#endregion
 //#region src/vcs/VcsDriverRegistry.ts
 const DETECTION_CACHE_CAPACITY = 2048;
@@ -30911,7 +31194,7 @@ function parseDetectionCacheKey(key) {
 		cwd: key.slice(separatorIndex + 1)
 	};
 }
-const make$40 = Effect.gen(function* () {
+const make$41 = Effect.gen(function* () {
 	const projectConfig = yield* VcsProjectConfig;
 	const git = yield* makeVcsDriver;
 	const drivers = { git };
@@ -30968,7 +31251,7 @@ const make$40 = Effect.gen(function* () {
 		resolve
 	});
 });
-const layer$35 = Layer.effect(VcsDriverRegistry, make$40).pipe(Layer.provide(layer$36));
+const layer$36 = Layer.effect(VcsDriverRegistry, make$41).pipe(Layer.provide(layer$37));
 //#endregion
 //#region src/checkpointing/CheckpointStore.ts
 /**
@@ -30988,7 +31271,7 @@ const layer$35 = Layer.effect(VcsDriverRegistry, make$40).pipe(Layer.provide(lay
 */
 /** Service tag for checkpoint persistence and restore operations. */
 var CheckpointStore = class extends Context.Service()("@p4code/cli/checkpointing/CheckpointStore") {};
-const make$39 = Effect.gen(function* () {
+const make$40 = Effect.gen(function* () {
 	const vcsRegistry = yield* VcsDriverRegistry;
 	const resolveCheckpoints = Effect.fn("CheckpointStore.resolveCheckpoints")(function* (operation, cwd) {
 		const handle = yield* vcsRegistry.resolve({ cwd });
@@ -31027,7 +31310,7 @@ const make$39 = Effect.gen(function* () {
 		deleteCheckpointRefs
 	});
 });
-const layer$34 = Layer.effect(CheckpointStore, make$39);
+const layer$35 = Layer.effect(CheckpointStore, make$40);
 //#endregion
 //#region src/checkpointing/CheckpointDiffQuery.ts
 /**
@@ -31049,7 +31332,7 @@ function buildTurnDiffResult(input, diff) {
 		diff
 	};
 }
-const make$38 = Effect.gen(function* () {
+const make$39 = Effect.gen(function* () {
 	const projectionSnapshotQuery = yield* ProjectionSnapshotQuery;
 	const checkpointStore = yield* CheckpointStore;
 	const getTurnDiff = Effect.fn("getTurnDiff")(function* (input) {
@@ -31185,7 +31468,7 @@ const make$38 = Effect.gen(function* () {
 		getFullThreadDiff
 	});
 });
-const layer$33 = Layer.effect(CheckpointDiffQuery, make$38);
+const layer$34 = Layer.effect(CheckpointDiffQuery, make$39);
 //#endregion
 //#region src/orchestration/ActivityPayloadProjection.ts
 function asRecord$1(value) {
@@ -32038,7 +32321,7 @@ function makeUpdateState(input) {
 		output: input.output ?? null
 	};
 }
-const make$37 = Effect.fn("ProviderMaintenanceRunner.make")(function* () {
+const make$38 = Effect.fn("ProviderMaintenanceRunner.make")(function* () {
 	const providerRegistry = yield* ProviderRegistry;
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	const httpClient = yield* HttpClient.HttpClient;
@@ -32153,7 +32436,7 @@ const make$37 = Effect.fn("ProviderMaintenanceRunner.make")(function* () {
 	});
 	return ProviderMaintenanceRunner.of({ updateProvider });
 });
-const layer$32 = Layer.effect(ProviderMaintenanceRunner, make$37());
+const layer$33 = Layer.effect(ProviderMaintenanceRunner, make$38());
 //#endregion
 //#region src/provider/Services/ProviderInstanceRegistry.ts
 var ProviderInstanceRegistry = class extends Context.Service()("@p4code/cli/provider/Services/ProviderInstanceRegistry") {};
@@ -32177,11 +32460,228 @@ const makeTextGenerationFromRegistry = (registry) => TextGeneration.of({
 		detail: "This provider does not report account usage."
 	}))))
 });
-const make$36 = Effect.gen(function* () {
+const make$37 = Effect.gen(function* () {
 	const registry = yield* ProviderInstanceRegistry;
 	return makeTextGenerationFromRegistry(registry);
 });
-const layer$31 = Layer.effect(TextGeneration, make$36);
+const layer$32 = Layer.effect(TextGeneration, make$37);
+const SKILL_MANIFEST_FILENAME = "SKILL.md";
+/**
+* Split a catalogue id (`owner/repo/skill-name`) into its parts.
+*
+* The skill segment is everything after the repository, because a nested skill
+* id contains slashes and rejoining the tail is the only reading that survives
+* one.
+*/
+function parseRegistrySkillId(id) {
+	const segments = id.split("/").map((segment) => segment.trim()).filter((segment) => segment.length > 0);
+	if (segments.length < 3) return null;
+	const [owner, repo, ...rest] = segments;
+	if (!owner || !repo || rest.length === 0) return null;
+	return {
+		owner,
+		repo,
+		skillId: rest.join("/")
+	};
+}
+/**
+* Where the skill lives in the repository, from the repository's file list.
+*
+* Matched on `<...>/<skillId>/SKILL.md` rather than on any fixed layout,
+* because repositories disagree: some keep skills at the root, some under
+* `skills/`, some several levels down inside a plugin. The shallowest match
+* wins, which is what picks the skill itself over a copy vendored inside an
+* example or a test fixture.
+*/
+function chooseSkillRoot(entries, skillId) {
+	const leaf = skillId.split("/").pop() ?? skillId;
+	const candidates = [];
+	for (const entry of entries) {
+		if (entry.type !== "blob" || !entry.path.endsWith(`/SKILL.md`)) {
+			if (entry.type === "blob" && entry.path === "SKILL.md") candidates.push("");
+			continue;
+		}
+		const root = entry.path.slice(0, -9);
+		if ((root.split("/").pop() ?? root) === leaf || root === skillId || root.endsWith(`/${skillId}`)) candidates.push(root);
+	}
+	if (candidates.length === 0) return null;
+	candidates.sort((left, right) => {
+		const depth = left.split("/").length - right.split("/").length;
+		return depth === 0 ? left.localeCompare(right) : depth;
+	});
+	return candidates[0] ?? null;
+}
+/**
+* The files under a skill root, bounded and with the manifest first.
+*
+* `SKILL.md` leads because it is the one file that must arrive: everything
+* downstream — the local create refusal, the panel preview, discovery — keys on
+* it, so if a bound is going to drop something it must not be that.
+*/
+function selectSkillFiles(entries, root) {
+	const prefix = root === "" ? "" : `${root}/`;
+	const manifestPath = `${prefix}${SKILL_MANIFEST_FILENAME}`;
+	const inRoot = entries.filter((entry) => entry.type === "blob" && entry.path.startsWith(prefix) && entry.path !== `${prefix}`);
+	const ordered = [...inRoot.filter((entry) => entry.path === manifestPath), ...inRoot.filter((entry) => entry.path !== manifestPath).sort((left, right) => left.path.localeCompare(right.path))];
+	const paths = [];
+	const skipped = [];
+	let totalBytes = 0;
+	for (const entry of ordered) {
+		if (entry.size !== void 0 && entry.size > 262144) {
+			skipped.push({
+				path: entry.path,
+				reason: "too-large"
+			});
+			continue;
+		}
+		if (paths.length >= 40) {
+			skipped.push({
+				path: entry.path,
+				reason: "too-many-files"
+			});
+			continue;
+		}
+		const size = entry.size ?? 0;
+		if (totalBytes + size > 1048576) {
+			skipped.push({
+				path: entry.path,
+				reason: "over-total-size"
+			});
+			continue;
+		}
+		totalBytes += size;
+		paths.push(entry.path);
+	}
+	return {
+		paths,
+		skipped
+	};
+}
+/**
+* The asset-relative path of a repository file, for writing on disk.
+*
+* A skill asset's files are named relative to its own directory, so the
+* repository prefix comes off here rather than at the call site — the sync's
+* file shape and the registry's are the same shape, and only this line knows
+* why they differ.
+*/
+function toAssetFilePath(repositoryPath, root) {
+	return root === "" ? repositoryPath : repositoryPath.slice(root.length + 1);
+}
+//#endregion
+//#region src/skills/SkillRegistry.ts
+const REGISTRY_SEARCH_URL = "https://www.skills.sh/api/search";
+const GITHUB_API_URL = "https://api.github.com";
+const GITHUB_RAW_URL = "https://raw.githubusercontent.com";
+const REQUEST_TIMEOUT_MS = 15e3;
+/** More than a person reads, few enough that the panel is a list and not a feed. */
+const MAX_SEARCH_RESULTS = 25;
+/**
+* The catalogue's search response, decoded loosely on purpose.
+*
+* Only the four fields we display are required. This is an undocumented public
+* endpoint on someone else's service; a field appearing or disappearing beside
+* these should not turn search into an error.
+*/
+const SearchResponse = Schema$1.Struct({ skills: Schema$1.Array(Schema$1.Struct({
+	id: Schema$1.String,
+	name: Schema$1.String,
+	source: Schema$1.String,
+	installs: Schema$1.optional(Schema$1.Number)
+})) });
+const decodeSearchResponse = Schema$1.decodeUnknownEffect(SearchResponse);
+const TreeResponse = Schema$1.Struct({
+	tree: Schema$1.Array(Schema$1.Struct({
+		path: Schema$1.String,
+		type: Schema$1.String,
+		size: Schema$1.optional(Schema$1.Number)
+	})),
+	truncated: Schema$1.optional(Schema$1.Boolean)
+});
+const decodeTreeResponse = Schema$1.decodeUnknownEffect(TreeResponse);
+var SkillRegistry = class extends Context.Service()("@p4code/cli/skills/SkillRegistry") {};
+const emptyFetch = (id, unavailable) => ({
+	found: false,
+	id,
+	name: "",
+	source: "",
+	sourceUrl: "",
+	files: [],
+	skipped: [],
+	unavailable
+});
+const make$36 = Effect.gen(function* () {
+	const http = yield* HttpClient.HttpClient;
+	const request = Effect.fn("SkillRegistry.request")(function* (url) {
+		return yield* http.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeader("accept", "application/json"), HttpClientRequest.setHeader("user-agent", "p4code"))).pipe(Effect.timeout(REQUEST_TIMEOUT_MS));
+	});
+	const search = (query) => Effect.gen(function* () {
+		const response = yield* request(`${REGISTRY_SEARCH_URL}?q=${encodeURIComponent(query)}`).pipe(Effect.orElseSucceed(() => null));
+		if (response === null) return {
+			results: [],
+			unavailable: "The skill catalogue could not be reached."
+		};
+		if (response.status !== 200) return {
+			results: [],
+			unavailable: `The skill catalogue answered ${response.status}.`
+		};
+		const body = yield* response.json.pipe(Effect.flatMap(decodeSearchResponse), Effect.orElseSucceed(() => null));
+		if (body === null) return {
+			results: [],
+			unavailable: "The skill catalogue answered something unreadable."
+		};
+		return {
+			results: body.skills.slice(0, MAX_SEARCH_RESULTS).map((skill) => ({
+				id: skill.id,
+				name: skill.name,
+				source: skill.source,
+				installs: Math.trunc(skill.installs ?? 0)
+			})),
+			unavailable: null
+		};
+	});
+	const fetch = (id) => Effect.gen(function* () {
+		const ref = parseRegistrySkillId(id);
+		if (ref === null) return emptyFetch(id, "Expected owner/repo/skill-name.");
+		const repository = `${ref.owner}/${ref.repo}`;
+		const treeResponse = yield* request(`${GITHUB_API_URL}/repos/${repository}/git/trees/HEAD?recursive=1`).pipe(Effect.orElseSucceed(() => null));
+		if (treeResponse === null) return emptyFetch(id, `${repository} could not be reached.`);
+		if (treeResponse.status === 403 || treeResponse.status === 429) return emptyFetch(id, "GitHub is rate limiting this machine. Try again later.");
+		if (treeResponse.status !== 200) return emptyFetch(id, `GitHub answered ${treeResponse.status} for ${repository}.`);
+		const tree = yield* treeResponse.json.pipe(Effect.flatMap(decodeTreeResponse), Effect.orElseSucceed(() => null));
+		if (tree === null) return emptyFetch(id, `GitHub answered something unreadable for ${repository}.`);
+		const entries = tree.tree;
+		const root = chooseSkillRoot(entries, ref.skillId);
+		if (root === null) return emptyFetch(id, tree.truncated === true ? `${repository} is too large for GitHub to list in one response, and ${ref.skillId} was not in the part it returned.` : `${repository} has no ${ref.skillId}/SKILL.md.`);
+		const selection = selectSkillFiles(entries, root);
+		const files = [];
+		for (const path of selection.paths) {
+			const fileResponse = yield* request(`${GITHUB_RAW_URL}/${repository}/HEAD/${path.split("/").map(encodeURIComponent).join("/")}`).pipe(Effect.orElseSucceed(() => null));
+			if (fileResponse === null || fileResponse.status !== 200) return emptyFetch(id, `${path} could not be downloaded.`);
+			const content = yield* fileResponse.text.pipe(Effect.orElseSucceed(() => null));
+			if (content === null) return emptyFetch(id, `${path} is not text, so this skill cannot be installed here.`);
+			files.push({
+				path: toAssetFilePath(path, root),
+				content
+			});
+		}
+		return {
+			found: true,
+			id,
+			name: root === "" ? ref.repo : root.split("/").pop() ?? ref.skillId,
+			source: repository,
+			sourceUrl: root === "" ? `https://github.com/${repository}` : `https://github.com/${repository}/tree/HEAD/${root}`,
+			files,
+			skipped: selection.skipped,
+			unavailable: null
+		};
+	});
+	return {
+		search,
+		fetch
+	};
+});
+const layer$31 = Layer.effect(SkillRegistry, make$36);
 //#endregion
 //#region ../../packages/shared/src/KeyedCoalescingWorker.ts
 const makeKeyedCoalescingWorker = (options) => Effect.gen(function* () {
@@ -32396,7 +32896,7 @@ const COMMON_DEV_PORTS = Object.freeze([
 	8888,
 	9e3
 ]);
-const POLL_INTERVAL = Duration.seconds(3);
+const POLL_INTERVAL$1 = Duration.seconds(3);
 const LSOF_TIMEOUT_MS = 5e3;
 const WINDOWS_LISTENER_TIMEOUT_MS = 5e3;
 const terminalOwnerKey = (owner) => `${owner.threadId}\u0000${owner.terminalId}`;
@@ -32571,7 +33071,7 @@ const make$35 = Effect.gen(function* PortDiscoveryMake() {
 			lastSnapshot: next
 		}])) yield* broadcast(next);
 	}, Effect.catchCause((cause) => Effect.logWarning("preview port scan failed", Cause.pretty(cause))));
-	yield* Effect.forkScoped(pollTick().pipe(Effect.repeat(Schedule.spaced(POLL_INTERVAL))));
+	yield* Effect.forkScoped(pollTick().pipe(Effect.repeat(Schedule.spaced(POLL_INTERVAL$1))));
 	const acquireRetention = Effect.fn("PortDiscovery.retain")(function* () {
 		if (yield* Ref.modify(stateRef, (state) => [state.retainCount === 0, {
 			...state,
@@ -34271,7 +34771,7 @@ const makeWithOptions$1 = Effect.fn("TerminalManager.makeWithOptions")(function*
 		subscribeMetadata
 	});
 });
-const layer$29 = Layer.effect(TerminalManager, make$34()).pipe(Layer.provide(layer$52));
+const layer$29 = Layer.effect(TerminalManager, make$34()).pipe(Layer.provide(layer$53));
 //#endregion
 //#region src/mcp/McpInvocationContext.ts
 var McpInvocationContext = class extends Context.Service()("@p4code/cli/mcp/McpInvocationContext") {};
@@ -41454,6 +41954,7 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 	const hubLink = yield* HubLink;
 	const assetSync = yield* AssetSync;
 	const mcpRegistry = yield* McpRegistry;
+	const skillRegistry = yield* SkillRegistry;
 	const startup = yield* ServerRuntimeStartup;
 	const workspaceEntries = yield* WorkspaceEntries;
 	const workspaceFileSystem = yield* WorkspaceFileSystem;
@@ -42038,6 +42539,8 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 				status: yield* assetSync.status
 			};
 		}), { "rpc.aggregate": "skills" }),
+		[WS_METHODS.skillRegistrySearch]: ({ query }) => observeRpcEffect$1(WS_METHODS.skillRegistrySearch, skillRegistry.search(query), { "rpc.aggregate": "skills" }),
+		[WS_METHODS.skillRegistryFetch]: ({ id }) => observeRpcEffect$1(WS_METHODS.skillRegistryFetch, skillRegistry.fetch(id), { "rpc.aggregate": "skills" }),
 		[WS_METHODS.mcpList]: (_input) => observeRpcEffect$1(WS_METHODS.mcpList, mcpRegistry.list.pipe(Effect.map((servers) => ({ servers }))), { "rpc.aggregate": "mcp" }),
 		[WS_METHODS.mcpSave]: ({ registration }) => observeRpcEffect$1(WS_METHODS.mcpSave, mcpRegistry.save(registration).pipe(Effect.andThen(mcpRegistry.list.pipe(Effect.map((servers) => ({ servers }))))), { "rpc.aggregate": "mcp" }),
 		[WS_METHODS.mcpRemove]: ({ name }) => observeRpcEffect$1(WS_METHODS.mcpRemove, mcpRegistry.remove(name).pipe(Effect.andThen(mcpRegistry.list.pipe(Effect.map((servers) => ({ servers }))))), { "rpc.aggregate": "mcp" }),
@@ -42219,7 +42722,7 @@ const websocketRpcRouteLayer = Layer.unwrap(Effect.gen(function* () {
 		const serverAuth = yield* EnvironmentAuth;
 		const sessions = yield* SessionStore;
 		const session = yield* serverAuth.authenticateWebSocketUpgrade(request).pipe(Effect.catchIf(isServerAuthCredentialError, (error) => failEnvironmentAuthInvalid(serverAuthCredentialReason(error))), Effect.catchIf(isServerAuthInternalError, (error) => failEnvironmentInternal("internal_error", error)));
-		const rpcWebSocketHttpEffect = yield* RpcServer.toHttpEffectWebsocket(WsRpcGroup, { disableTracing: true }).pipe(Effect.provide(makeWsRpcLayer(session, previewAutomationBroker).pipe(Layer.provideMerge(RpcSerialization.layerJson), Layer.provide(layer$32), Layer.provide(Layer.succeed(ServerSelfUpdate, serverSelfUpdate)), Layer.provide(Layer.succeed(TaskRepository, taskRepository)), Layer.provide(Layer.succeed(ProjectionProjectRepository, projectionProjects)), Layer.provide(layer$5.pipe(Layer.provide(layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$37), Layer.provide(layer$35.pipe(Layer.provide(layer$36))))), Layer.provide(layer$38))))));
+		const rpcWebSocketHttpEffect = yield* RpcServer.toHttpEffectWebsocket(WsRpcGroup, { disableTracing: true }).pipe(Effect.provide(makeWsRpcLayer(session, previewAutomationBroker).pipe(Layer.provideMerge(RpcSerialization.layerJson), Layer.provide(layer$33), Layer.provide(Layer.succeed(ServerSelfUpdate, serverSelfUpdate)), Layer.provide(Layer.succeed(TaskRepository, taskRepository)), Layer.provide(Layer.succeed(ProjectionProjectRepository, projectionProjects)), Layer.provide(layer$5.pipe(Layer.provide(layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$38), Layer.provide(layer$36.pipe(Layer.provide(layer$37))))), Layer.provide(layer$39))))));
 		return yield* Effect.acquireUseRelease(sessions.markConnected(session.sessionId), () => rpcWebSocketHttpEffect, () => sessions.markDisconnected(session.sessionId));
 	}).pipe(Effect.catchTags({
 		EnvironmentAuthInvalidError: HttpServerRespondable.toResponse,
@@ -42227,6 +42730,281 @@ const websocketRpcRouteLayer = Layer.unwrap(Effect.gen(function* () {
 	})));
 }));
 //#endregion
+//#region src/persistence/Layers/RemoteTasks.ts
+/**
+* The board, kept on the hub instead of in this machine's database.
+*
+* A drop-in `TaskRepository`: same interface, same events, so the MCP toolkit,
+* the websocket RPCs and the board itself are unchanged and do not know which
+* one they are talking to. That was the point of making it an interface.
+*
+* **An unreachable hub fails loudly, by decision.** There is no local fallback
+* and no write queue. A server that answered from a local copy while the hub
+* was down would recreate exactly the divergence the hub exists to remove —
+* two Macs with two boards, silently — and the failure would be invisible until
+* someone noticed a task missing on the other machine. So a hub that cannot be
+* reached means the board says so and nothing is written. The cost is real and
+* is the point: no board while the hub is down.
+*
+* **Changes are polled, because the hub has no push.** The interface promises
+* a change stream, and the honest implementation of that against a plain HTTP
+* API is a poll with a diff. A write made through *this* server publishes
+* immediately, so the local board is live; the poll is what carries the other
+* machine's writes, at up to `POLL_INTERVAL` of lag.
+*
+* @module persistence/Layers/RemoteTasks
+*/
+const HUB_REQUEST_TIMEOUT_MS = 15e3;
+/**
+* How stale another machine's write may look here.
+*
+* Short enough that a board left open follows along, long enough that two
+* servers idling all day are not a steady stream of requests at a hosted
+* service. Only changes made elsewhere wait for it.
+*/
+const POLL_INTERVAL = Duration.seconds(10);
+const TaskListPage = Schema$1.Struct({ tasks: Schema$1.Array(Task) });
+const ConflictBody = Schema$1.Struct({ current: Task });
+const decodeTaskListPage = Schema$1.decodeUnknownEffect(TaskListPage);
+const decodeTask = Schema$1.decodeUnknownEffect(Task);
+const decodeConflictBody = Schema$1.decodeUnknownEffect(ConflictBody);
+/**
+* Every failure here is reported as the interface's own error type.
+*
+* `PersistenceSqlError` names a store that would not answer, which is exactly
+* what this is from a caller's point of view — the detail says the store is the
+* hub. Inventing a second error type would mean touching every call site to
+* handle a case they already handle.
+*/
+const hubUnavailable = (operation, detail) => new PersistenceSqlError({
+	operation: `RemoteTaskRepository.${operation}`,
+	detail: `The hub board is unavailable: ${detail}`,
+	cause: null
+});
+/**
+* @param isActive Whether this server is currently reading its board from the
+* hub. The poll asks before every pass rather than being started once: a
+* machine with the board set to `local` must not be sending a request to a
+* hosted service every ten seconds for a board nobody is reading, and the
+* setting can change while the server runs.
+*/
+const makeRemoteTaskRepository = Effect.fn("makeRemoteTaskRepository")(function* (isActive) {
+	const http = yield* HttpClient.HttpClient;
+	const link = yield* HubLink;
+	const changes = yield* PubSub.unbounded();
+	const publish = (event) => PubSub.publish(changes, event).pipe(Effect.asVoid);
+	/** The board as of the last poll, for diffing the next one against. */
+	const lastSeen = yield* Ref.make(null);
+	const requireSettings = (operation) => Effect.gen(function* () {
+		const state = yield* link.current;
+		if (Option.isNone(state.settings)) return yield* hubUnavailable(operation, "no hub is configured on this server");
+		return state.settings.value;
+	});
+	const send = (operation, settings, request) => http.execute(request.pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`), HttpClientRequest.setHeader("accept", "application/json"))).pipe(Effect.timeout(HUB_REQUEST_TIMEOUT_MS), Effect.mapError((cause) => hubUnavailable(operation, `${cause._tag ?? "request failed"}`)));
+	const list = (filter) => Effect.gen(function* () {
+		const settings = yield* requireSettings("list");
+		const query = new URLSearchParams();
+		for (const key of [
+			"projectId",
+			"repositoryKey",
+			"threadId",
+			"status",
+			"assignee"
+		]) {
+			const value = filter[key];
+			if (value !== void 0) query.set(key, value);
+		}
+		const suffix = query.size === 0 ? "" : `?${query.toString()}`;
+		const response = yield* send("list", settings, HttpClientRequest.get(`${settings.baseUrl}/tasks${suffix}`));
+		if (response.status !== 200) return yield* hubUnavailable("list", `status ${response.status}`);
+		return (yield* response.json.pipe(Effect.flatMap(decodeTaskListPage), Effect.mapError(() => hubUnavailable("list", "the response did not match the contract")))).tasks;
+	});
+	const getById = ({ taskId }) => Effect.gen(function* () {
+		const settings = yield* requireSettings("getById");
+		const response = yield* send("getById", settings, HttpClientRequest.get(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`));
+		if (response.status === 404) return Option.none();
+		if (response.status !== 200) return yield* hubUnavailable("getById", `status ${response.status}`);
+		return Option.some(yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("getById", "the response did not match the contract"))));
+	});
+	/**
+	* Upsert is a create here, and that is a real difference from the local
+	* store.
+	*
+	* The hub mints its own ids and timestamps, so a row written through this
+	* comes back with the hub's version of both. The caller's `taskId` is not
+	* carried: honouring it would need a hub route that takes one, and inventing
+	* that quietly would let two servers mint colliding ids.
+	*/
+	const upsert = (row) => Effect.gen(function* () {
+		const settings = yield* requireSettings("upsert");
+		const response = yield* send("upsert", settings, HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.post(`${settings.baseUrl}/tasks`), {
+			...row.projectId === null ? {} : { projectId: row.projectId },
+			...row.repositoryKey === null ? {} : { repositoryKey: row.repositoryKey },
+			...row.threadId === null ? {} : { threadId: row.threadId },
+			title: row.title,
+			body: row.body,
+			status: row.status,
+			priority: row.priority,
+			...row.assignee === null ? {} : { assignee: row.assignee },
+			labels: row.labels
+		}));
+		if (response.status !== 201 && response.status !== 200) return yield* hubUnavailable("upsert", `status ${response.status}`);
+		const created = yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("upsert", "the response did not match the contract")));
+		yield* publish({
+			type: "upserted",
+			task: created
+		});
+	});
+	const patch = (input) => Effect.gen(function* () {
+		const settings = yield* requireSettings("patch");
+		const { taskId, ...fields } = input;
+		const response = yield* send("patch", settings, HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.patch(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`), fields));
+		if (response.status === 404) return Option.none();
+		if (response.status !== 200) return yield* hubUnavailable("patch", `status ${response.status}`);
+		const updated = yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("patch", "the response did not match the contract")));
+		yield* publish({
+			type: "upserted",
+			task: updated
+		});
+		return Option.some(updated);
+	});
+	const patchIfStatus = (input) => Effect.gen(function* () {
+		const settings = yield* requireSettings("patchIfStatus");
+		const { taskId, ...fields } = input.patch;
+		const response = yield* send("patchIfStatus", settings, HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.patch(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`), {
+			...fields,
+			expectedStatus: input.expectedStatus
+		}));
+		if (response.status === 404) return { outcome: "missing" };
+		if (response.status === 409) return {
+			outcome: "conflict",
+			current: (yield* response.json.pipe(Effect.flatMap(decodeConflictBody), Effect.mapError(() => hubUnavailable("patchIfStatus", "the conflict response did not match the contract")))).current
+		};
+		if (response.status !== 200) return yield* hubUnavailable("patchIfStatus", `status ${response.status}`);
+		const updated = yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("patchIfStatus", "the response did not match the contract")));
+		yield* publish({
+			type: "upserted",
+			task: updated
+		});
+		return {
+			outcome: "updated",
+			task: updated
+		};
+	});
+	const deleteById = ({ taskId }) => Effect.gen(function* () {
+		const settings = yield* requireSettings("deleteById");
+		const response = yield* send("deleteById", settings, HttpClientRequest.delete(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`));
+		if (response.status !== 200 && response.status !== 204 && response.status !== 404) return yield* hubUnavailable("deleteById", `status ${response.status}`);
+		yield* publish({
+			type: "deleted",
+			taskId
+		});
+	});
+	/**
+	* One poll: read the board, publish what differs from last time.
+	*
+	* Compared on `updatedAt` rather than deep equality, because that is the
+	* field every hub write moves and it makes the diff O(n) with no schema
+	* knowledge. A failed poll publishes nothing and leaves the last snapshot in
+	* place — a hub blip should not empty every open board.
+	*/
+	const pollOnce = Effect.gen(function* () {
+		if (!(yield* isActive)) return;
+		const current = yield* list({});
+		const previous = yield* Ref.getAndSet(lastSeen, current);
+		if (previous === null) return;
+		const previousById = new Map(previous.map((task) => [task.taskId, task]));
+		for (const task of current) {
+			const before = previousById.get(task.taskId);
+			if (before === void 0 || before.updatedAt !== task.updatedAt) yield* publish({
+				type: "upserted",
+				task
+			});
+			previousById.delete(task.taskId);
+		}
+		for (const taskId of previousById.keys()) yield* publish({
+			type: "deleted",
+			taskId
+		});
+	}).pipe(Effect.ignoreCause({ log: true }));
+	yield* Effect.forever(pollOnce.pipe(Effect.andThen(Effect.sleep(POLL_INTERVAL)))).pipe(Effect.forkScoped);
+	return {
+		upsert,
+		patch,
+		patchIfStatus,
+		getById,
+		list,
+		deleteById,
+		streamChanges: Stream.fromPubSub(changes),
+		streamWithSnapshot: Stream.unwrap(Effect.gen(function* () {
+			const subscription = yield* PubSub.subscribe(changes);
+			const snapshot = yield* list({});
+			yield* Ref.set(lastSeen, snapshot);
+			return Stream.concat(Stream.succeed({
+				type: "snapshot",
+				tasks: snapshot
+			}), Stream.fromSubscription(subscription));
+		}))
+	};
+});
+Layer.effect(TaskRepository, makeRemoteTaskRepository(Effect.succeed(true)));
+//#endregion
+//#region src/persistence/Layers/TaskBoardSource.ts
+/**
+* Which board a call goes to: this machine's database, or the hub's.
+*
+* Both repositories are built, and every call reads the setting and delegates.
+* That is deliberate rather than picking one at startup: `taskBoardSource` is
+* an ordinary setting a person changes in a panel, and a setting that only
+* takes effect after a restart is the same hazard the hub link already
+* documents — you change it, nothing happens, and there is nothing on screen
+* saying why.
+*
+* **Subscriptions pick their source when they subscribe.** A stream cannot
+* change its mind mid-flight without inventing a "your board moved" event that
+* nothing knows how to render, so an open board keeps reading the source it
+* opened against and picks up the change when it reconnects. Switching is rare;
+* a wrong row on screen is not worth a new event type.
+*
+* @module persistence/Layers/TaskBoardSource
+*/
+const makeRoutedTaskRepository = Effect.gen(function* () {
+	const local = yield* makeTaskRepository;
+	const usingHub = (yield* ServerSettingsService).getSettings.pipe(Effect.map((current) => current.taskBoardSource === "hub"), Effect.orElseSucceed(() => false));
+	const remote = yield* makeRemoteTaskRepository(usingHub);
+	/**
+	* `local` on a settings read failure, and that direction is chosen.
+	*
+	* The alternative is refusing every board call because a settings file could
+	* not be read, which turns one broken file into a dead board. Falling back to
+	* the machine's own database is the answer that still works and cannot lose a
+	* hub write, because a write that never reached the hub was never accepted.
+	*/
+	const pick = usingHub.pipe(Effect.map((hub) => hub ? remote : local));
+	return {
+		upsert: (row) => pick.pipe(Effect.flatMap((repository) => repository.upsert(row))),
+		patch: (input, updatedAt) => pick.pipe(Effect.flatMap((repository) => repository.patch(input, updatedAt))),
+		patchIfStatus: (input, updatedAt) => pick.pipe(Effect.flatMap((repository) => repository.patchIfStatus(input, updatedAt))),
+		getById: (input) => pick.pipe(Effect.flatMap((repository) => repository.getById(input))),
+		list: (filter) => pick.pipe(Effect.flatMap((repository) => repository.list(filter))),
+		deleteById: (input) => pick.pipe(Effect.flatMap((repository) => repository.deleteById(input))),
+		get streamChanges() {
+			return Stream.unwrap(pick.pipe(Effect.map((repository) => repository.streamChanges)));
+		},
+		get streamWithSnapshot() {
+			return Stream.unwrap(pick.pipe(Effect.map((repository) => repository.streamWithSnapshot)));
+		}
+	};
+});
+/**
+* The board, wherever it lives.
+*
+* Replaces `TaskRepositoryLive` at the one place the route tree provides it, so
+* the MCP toolkit and the websocket handlers keep sharing a single instance —
+* which is what makes a task an agent files appear on an open board.
+*/
+const RoutedTaskRepositoryLive = Layer.effect(TaskRepository, makeRoutedTaskRepository);
+//#endregion
 //#region src/persistence/ProviderSessionRuntime.ts
 /**
 * ProviderSessionRuntimeRepository - Repository interface for provider runtime sessions.
@@ -44246,7 +45024,7 @@ const makeOpenCodeRuntime = Effect.gen(function* () {
 	};
 });
 var OpenCodeRuntime = class extends Context.Service()("@p4code/cli/provider/opencodeRuntime") {};
-const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$68));
+const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$69));
 //#endregion
 //#region src/textGeneration/TextGenerationUtils.ts
 const isTextGenerationError$2 = Schema$1.is(TextGenerationError);
@@ -45218,7 +45996,7 @@ const runClaudeCommand = Effect.fn("runClaudeCommand")(function* (claudeSettings
 	});
 	return yield* spawnAndCollect(claudeSettings.binaryPath, command);
 });
-const checkClaudeProviderStatus = Effect.fn("checkClaudeProviderStatus")(function* (claudeSettings, resolveCapabilities, environment, cwd) {
+const checkClaudeProviderStatus = Effect.fn("checkClaudeProviderStatus")(function* (claudeSettings, resolveCapabilities, environment, cwd, disabledSkills) {
 	const resolvedEnvironment = environment ?? process.env;
 	const checkedAt = DateTime.formatIso(yield* DateTime.now);
 	const allModels = providerModelsFromSettings(BUILT_IN_MODELS, claudeSettings.customModels, DEFAULT_CLAUDE_MODEL_CAPABILITIES);
@@ -45292,7 +46070,7 @@ const checkClaudeProviderStatus = Effect.fn("checkClaudeProviderStatus")(functio
 	const models = providerModelsFromSettings(getBuiltInClaudeModelsForVersion(parsedVersion), claudeSettings.customModels, DEFAULT_CLAUDE_MODEL_CAPABILITIES);
 	const versionUpgradeMessage = supportsClaudeOpus5(parsedVersion) ? void 0 : supportsClaudeFable5(parsedVersion) ? formatClaudeOpus5UpgradeMessage(parsedVersion) : supportsClaudeOpus48(parsedVersion) ? formatClaudeFable5UpgradeMessage(parsedVersion) : supportsClaudeOpus47(parsedVersion) ? formatClaudeOpus48UpgradeMessage(parsedVersion) : formatClaudeOpus47UpgradeMessage(parsedVersion);
 	const capabilities = resolveCapabilities ? yield* resolveCapabilities(claudeSettings).pipe(Effect.orElseSucceed(() => void 0)) : void 0;
-	const skills = yield* discoverClaudeSkills(claudeSettings, cwd, resolvedEnvironment);
+	const skills = yield* discoverClaudeSkills(claudeSettings, cwd, resolvedEnvironment, disabledSkills);
 	const dedupedSlashCommands = dedupeSlashCommands(capabilities?.slashCommands ?? []);
 	if (!capabilities) return buildServerProvider({
 		presentation: CLAUDE_PRESENTATION,
@@ -45693,6 +46471,43 @@ function parseCliArgs(args, options) {
 	};
 }
 //#endregion
+//#region src/provider/askUserQuestionAnswers.ts
+/**
+* What separates the options of one multi-select answer.
+*
+* Comma-and-space rather than a bare comma: the SDK renders this string into a
+* tool result a model reads, and option labels are prose ("Fail loudly, no
+* fallback"), so the space is what keeps two joined labels from reading as one.
+*/
+const MULTI_SELECT_SEPARATOR = ", ";
+function formatAnswerValue(value) {
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		return trimmed.length > 0 ? trimmed : null;
+	}
+	if (Array.isArray(value)) {
+		const parts = value.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+		return parts.length > 0 ? parts.join(MULTI_SELECT_SEPARATOR) : null;
+	}
+	return null;
+}
+/**
+* The answers map to hand back to the SDK.
+*
+* Questions whose answer is empty, or is neither a string nor a list of them,
+* are dropped rather than stringified. `String(value)` on an object would put
+* `[object Object]` in front of the model as though it were the user's choice,
+* and an absent key is at least a fact the SDK can see.
+*/
+function formatAskUserQuestionAnswers(answers) {
+	const formatted = {};
+	for (const [question, value] of Object.entries(answers)) {
+		const answer = formatAnswerValue(value);
+		if (answer !== null) formatted[question] = answer;
+	}
+	return formatted;
+}
+//#endregion
 //#region src/provider/Layers/ClaudeAdapter.ts
 /**
 * ClaudeAdapterLive - Scoped live implementation for the Claude Agent provider adapter.
@@ -46183,20 +46998,50 @@ function planStepsFromClaudeTasks(tasks) {
 		};
 	});
 }
+const TOOL_SUMMARY_MAX_LENGTH = 400;
+const TOOL_PROMPT_SUMMARY_MAX_LENGTH = 200;
+const TOOL_PATH_INPUT_KEYS = [
+	"file_path",
+	"filePath",
+	"notebook_path",
+	"path"
+];
+function readTrimmedStringInput(input, keys) {
+	for (const key of keys) {
+		const value = input[key];
+		if (typeof value === "string" && value.trim().length > 0) return value.trim();
+	}
+}
+/**
+* Read/Grep/Glob carry no `command`, so without this they fall through to the
+* raw-JSON fallback and the work log shows `Read: {"file_path":...,"offset":80}`.
+*/
+function summarizeFileToolRequest(toolName, input) {
+	const pattern = readTrimmedStringInput(input, ["pattern", "query"]);
+	const path = readTrimmedStringInput(input, TOOL_PATH_INPUT_KEYS);
+	if (pattern) return path ? `${toolName}: ${pattern} in ${path}` : `${toolName}: ${pattern}`;
+	if (!path) return;
+	const offset = input.offset;
+	const limit = input.limit;
+	if (typeof offset === "number" && Number.isFinite(offset)) return `${toolName}: ${path}:${offset}${typeof limit === "number" && Number.isFinite(limit) && limit > 0 ? `-${offset + limit - 1}` : ""}`;
+	return `${toolName}: ${path}`;
+}
 function summarizeToolRequest(toolName, input) {
 	const commandValue = input.command ?? input.cmd;
 	const command = typeof commandValue === "string" ? commandValue : void 0;
-	if (command && command.trim().length > 0) return `${toolName}: ${command.trim().slice(0, 400)}`;
+	if (command && command.trim().length > 0) return `${toolName}: ${command.trim().slice(0, TOOL_SUMMARY_MAX_LENGTH)}`;
 	if (classifyToolItemType(toolName) === "collab_agent_tool_call") {
 		const description = typeof input.description === "string" ? input.description.trim() : void 0;
 		const prompt = typeof input.prompt === "string" ? input.prompt.trim() : void 0;
 		const subagentType = typeof input.subagent_type === "string" ? input.subagent_type.trim() : void 0;
-		const label = description || (prompt ? prompt.slice(0, 200) : void 0);
+		const label = description || (prompt ? prompt.slice(0, TOOL_PROMPT_SUMMARY_MAX_LENGTH) : void 0);
 		if (label) return subagentType ? `${subagentType}: ${label}` : label;
 	}
+	const fileSummary = summarizeFileToolRequest(toolName, input);
+	if (fileSummary) return fileSummary.slice(0, TOOL_SUMMARY_MAX_LENGTH);
 	const serialized = encodeJsonStringForDiagnostics$2(input) ?? "[unserializable input]";
-	if (serialized.length <= 400) return `${toolName}: ${serialized}`;
-	return `${toolName}: ${serialized.slice(0, 397)}...`;
+	if (serialized.length <= TOOL_SUMMARY_MAX_LENGTH) return `${toolName}: ${serialized}`;
+	return `${toolName}: ${serialized.slice(0, TOOL_SUMMARY_MAX_LENGTH - 3)}...`;
 }
 function titleForTool(itemType) {
 	switch (itemType) {
@@ -46237,6 +47082,23 @@ function buildUserMessage(input) {
 		}
 	};
 }
+function userMessageContentBlocks(message) {
+	const content = message.message.content;
+	if (typeof content === "string") return content.length > 0 ? [{
+		type: "text",
+		text: content
+	}] : [];
+	return Array.isArray(content) ? content : [];
+}
+/**
+* Messages typed while a turn runs are delivered as one prompt, not one turn
+* each: a user who sends three corrections and then hits Stop means them to be
+* read together, and replaying them as separate turns made the agent act on the
+* first before seeing the rest.
+*/
+function mergeUserMessages(previous, next) {
+	return buildUserMessage({ sdkContent: [...userMessageContentBlocks(previous), ...userMessageContentBlocks(next)] });
+}
 function buildClaudeImageContentBlock(input) {
 	return {
 		type: "image",
@@ -46876,6 +47738,7 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 					title: tool.title,
 					...tool.detail ? { detail: tool.detail } : {},
 					data: {
+						toolCallId: tool.itemId,
 						toolName: tool.toolName,
 						input: tool.input
 					}
@@ -46988,18 +47851,19 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 		});
 	});
 	/**
-	* Start the next queued sendTurn, if the session has gone idle.
+	* Start the queued sendTurn, if the session has gone idle.
 	*
-	* Runs after every turn completion. A message sent during a running turn
-	* waits here for the agent loop to end; pressing Stop ends the loop early,
-	* and the same drain is what makes Stop mean "and run my message now".
-	* One request per drain, so each queued message gets its own turn boundary -
-	* the next one starts when this turn's result arrives.
+	* Runs after every turn completion. Messages sent during a running turn wait
+	* here for the agent loop to end; pressing Stop ends the loop early, and the
+	* same drain is what makes Stop mean "and run my messages now". Everything
+	* queued during that turn is already merged into one request by `sendTurn`,
+	* so it starts as a single turn.
 	*/
 	const drainPendingTurns = Effect.fn("drainPendingTurns")(function* (context) {
 		if (context.stopped || context.turnState !== void 0) return;
-		const pending = context.pendingTurnRequests.shift();
+		const pending = context.pendingTurnRequest;
 		if (pending === void 0) return;
+		context.pendingTurnRequest = void 0;
 		yield* applyTurnSessionOptions(context, pending.modelSelection, pending.interactionMode).pipe(Effect.catchCause((cause) => Effect.logWarning("claude pending turn session options failed", { cause })));
 		yield* beginTurn(context, pending.turnId, pending.modelSelection?.model);
 		yield* Queue.offer(context.promptQueue, {
@@ -47086,6 +47950,7 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 						title: nextTool.title,
 						...nextTool.detail ? { detail: nextTool.detail } : {},
 						data: {
+							toolCallId: nextTool.itemId,
 							toolName: nextTool.toolName,
 							input: nextTool.input
 						}
@@ -47155,6 +48020,7 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 					title: tool.title,
 					...tool.detail ? { detail: tool.detail } : {},
 					data: {
+						toolCallId: tool.itemId,
 						toolName: tool.toolName,
 						input: toolInput
 					}
@@ -47192,6 +48058,7 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 			const itemStatus = toolResult.isError ? "failed" : "completed";
 			const toolUseResult = readClaudeToolUseResult(message);
 			const toolData = {
+				toolCallId: tool.itemId,
 				toolName: tool.toolName,
 				input: tool.input,
 				result: toolResult.block
@@ -47852,7 +48719,7 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 				behavior: "allow",
 				updatedInput: {
 					questions: toolInput.questions,
-					answers
+					answers: formatAskUserQuestionAnswers(answers)
 				}
 			};
 		});
@@ -47981,10 +48848,13 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 			auto: "auto",
 			"full-access": "bypassPermissions"
 		}[input.runtimeMode];
+		const disabledSkills = options?.resolveDisabledSkills === void 0 ? [] : yield* options.resolveDisabledSkills;
+		const skillOverrides = disabledSkills.length === 0 ? void 0 : buildSkillOverrides(disabledSkills, yield* discoverClaudeSkills(claudeSettings, input.cwd, claudeEnvironment).pipe(Effect.provideService(FileSystem.FileSystem, fileSystem), Effect.provideService(Path.Path, path)));
 		const settings = {
 			...typeof thinking === "boolean" ? { alwaysThinkingEnabled: thinking } : {},
 			...fastMode ? { fastMode: true } : {},
-			...ultracode ? { ultracode: true } : {}
+			...ultracode ? { ultracode: true } : {},
+			...skillOverrides ? { skillOverrides } : {}
 		};
 		const mcpSession = readMcpProviderSession(input.threadId);
 		const externalMcpServers = options?.resolveMcpServers === void 0 ? {} : yield* options.resolveMcpServers;
@@ -48085,7 +48955,7 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 			inFlightTools,
 			claudeTasks,
 			turnState: void 0,
-			pendingTurnRequests: [],
+			pendingTurnRequest: void 0,
 			lastKnownContextWindow: initialContextWindow,
 			lastKnownTokenUsage: void 0,
 			lastKnownTotalProcessedTokens: void 0,
@@ -48154,13 +49024,14 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 			boundInstanceId
 		});
 		if (context.turnState) {
-			const turnId = TurnId.make(yield* randomUUIDv4);
-			context.pendingTurnRequests.push({
+			const pending = context.pendingTurnRequest;
+			const turnId = pending?.turnId ?? TurnId.make(yield* randomUUIDv4);
+			context.pendingTurnRequest = {
 				turnId,
-				message,
+				message: pending ? mergeUserMessages(pending.message, message) : message,
 				modelSelection,
 				interactionMode: input.interactionMode
-			});
+			};
 			return {
 				threadId: context.session.threadId,
 				turnId,
@@ -48346,7 +49217,8 @@ function mergeProviderInstanceEnvironment(environment, baseEnv = process.env) {
 function makeProviderSnapshotSettings(provider, settings) {
 	return {
 		provider,
-		enableProviderUpdateChecks: settings.enableProviderUpdateChecks
+		enableProviderUpdateChecks: settings.enableProviderUpdateChecks,
+		disabledSkills: settings.disabledSkills
 	};
 }
 function haveProviderSnapshotSettingsChanged(previous, next) {
@@ -48438,10 +49310,13 @@ const ClaudeDriver = {
 			accentColor,
 			continuationGroupKey
 		});
+		const mcpRegistry = yield* McpRegistry;
+		const resolveDisabledSkills = serverSettings.getSettings.pipe(Effect.map((settings) => settings.disabledSkills), Effect.orElseSucceed(() => []));
 		const adapter = yield* makeClaudeAdapter(effectiveConfig, {
 			instanceId,
 			environment: processEnv,
-			resolveMcpServers: (yield* McpRegistry).resolveForSession,
+			resolveMcpServers: mcpRegistry.resolveForSession,
+			resolveDisabledSkills,
 			...eventLoggers.native ? { nativeEventLogger: eventLoggers.native } : {}
 		});
 		const textGeneration = yield* makeClaudeTextGeneration(effectiveConfig, processEnv);
@@ -48451,7 +49326,7 @@ const ClaudeDriver = {
 			lookup: () => probeClaudeCapabilities(effectiveConfig, processEnv, cwd).pipe(Effect.provideService(Path.Path, path))
 		});
 		const capabilitiesCacheKey = yield* makeClaudeCapabilitiesCacheKey(effectiveConfig, cwd);
-		const checkProvider = checkClaudeProviderStatus(effectiveConfig, () => Cache.get(capabilitiesProbeCache, capabilitiesCacheKey), processEnv, cwd).pipe(Effect.map(stampIdentity), Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner), Effect.provideService(FileSystem.FileSystem, fileSystem), Effect.provideService(Path.Path, path));
+		const checkProvider = resolveDisabledSkills.pipe(Effect.flatMap((disabledSkills) => checkClaudeProviderStatus(effectiveConfig, () => Cache.get(capabilitiesProbeCache, capabilitiesCacheKey), processEnv, cwd, disabledSkills)), Effect.map(stampIdentity), Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner), Effect.provideService(FileSystem.FileSystem, fileSystem), Effect.provideService(Path.Path, path));
 		const snapshotSettings = makeProviderSnapshotSettingsSource(effectiveConfig, serverSettings);
 		const snapshot = yield* makeManagedServerProvider({
 			maintenanceCapabilities,
@@ -83338,7 +84213,7 @@ const ObservabilityLive = Layer.unwrap(Effect.gen(function* () {
 			sink,
 			...delegate ? { delegate } : {}
 		});
-		return Layer.mergeAll(Layer.succeed(Tracer.Tracer, tracer), layer$39(sink));
+		return Layer.mergeAll(Layer.succeed(Tracer.Tracer, tracer), layer$40(sink));
 	})).pipe(Layer.provide(OtlpExporter.layerFlusher), Layer.provideMerge(otlpSerializationLayer));
 	const metricsLayer = config.otlpMetricsUrl === void 0 ? Layer.empty : OtlpMetrics.layer({
 		url: config.otlpMetricsUrl,
@@ -83617,25 +84492,25 @@ const ReactorLayerLive = Layer.empty.pipe(Layer.provideMerge(OrchestrationReacto
 const ProviderSessionDirectoryLayerLive = ProviderSessionDirectoryLive.pipe(Layer.provide(layer$3));
 const ProviderLayerLive = ProviderServiceLive.pipe(Layer.provide(ProviderAdapterRegistryLive), Layer.provideMerge(ProviderSessionDirectoryLayerLive));
 const PersistenceLayerLive = Layer.empty.pipe(Layer.provideMerge(layerConfig));
-const VcsDriverRegistryLayerLive = layer$35.pipe(Layer.provide(layer$36));
-const SourceControlProviderRegistryLayerLive = layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$37), Layer.provideMerge(VcsDriverRegistryLayerLive));
-const GitManagerLayerLive = layer$13.pipe(Layer.provideMerge(layer$23), Layer.provideMerge(layer$37), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(layer$31));
-const GitLayerLive = Layer.empty.pipe(Layer.provideMerge(GitManagerLayerLive), Layer.provideMerge(layer$37));
+const VcsDriverRegistryLayerLive = layer$36.pipe(Layer.provide(layer$37));
+const SourceControlProviderRegistryLayerLive = layer$14.pipe(Layer.provide(Layer.mergeAll(layer$22, layer$20, layer$18, layer$16)), Layer.provideMerge(layer$38), Layer.provideMerge(VcsDriverRegistryLayerLive));
+const GitManagerLayerLive = layer$13.pipe(Layer.provideMerge(layer$23), Layer.provideMerge(layer$38), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(layer$32));
+const GitLayerLive = Layer.empty.pipe(Layer.provideMerge(GitManagerLayerLive), Layer.provideMerge(layer$38));
 const GitWorkflowLayerLive = layer$12.pipe(Layer.provideMerge(VcsDriverRegistryLayerLive), Layer.provideMerge(GitLayerLive));
-const SourceControlRepositoryServiceLayerLive = layer$4.pipe(Layer.provideMerge(layer$37), Layer.provideMerge(SourceControlProviderRegistryLayerLive));
-const ReviewLayerLive = layer$9.pipe(Layer.provideMerge(layer$37), Layer.provideMerge(VcsDriverRegistryLayerLive));
-const VcsLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$36), Layer.provideMerge(VcsDriverRegistryLayerLive), Layer.provideMerge(layer$10.pipe(Layer.provide(VcsDriverRegistryLayerLive))), Layer.provideMerge(GitWorkflowLayerLive), Layer.provideMerge(ReviewLayerLive), Layer.provideMerge(SourceControlRepositoryServiceLayerLive), Layer.provideMerge(layer$11.pipe(Layer.provide(GitWorkflowLayerLive))));
-const CheckpointingLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$33), Layer.provideMerge(layer$34.pipe(Layer.provide(VcsDriverRegistryLayerLive))));
-const PortScannerLayerLive = layer$30.pipe(Layer.provide(layer$52));
+const SourceControlRepositoryServiceLayerLive = layer$4.pipe(Layer.provideMerge(layer$38), Layer.provideMerge(SourceControlProviderRegistryLayerLive));
+const ReviewLayerLive = layer$9.pipe(Layer.provideMerge(layer$38), Layer.provideMerge(VcsDriverRegistryLayerLive));
+const VcsLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$37), Layer.provideMerge(VcsDriverRegistryLayerLive), Layer.provideMerge(layer$10.pipe(Layer.provide(VcsDriverRegistryLayerLive))), Layer.provideMerge(GitWorkflowLayerLive), Layer.provideMerge(ReviewLayerLive), Layer.provideMerge(SourceControlRepositoryServiceLayerLive), Layer.provideMerge(layer$11.pipe(Layer.provide(GitWorkflowLayerLive))));
+const CheckpointingLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$34), Layer.provideMerge(layer$35.pipe(Layer.provide(VcsDriverRegistryLayerLive))));
+const PortScannerLayerLive = layer$30.pipe(Layer.provide(layer$53));
 const TerminalLayerLive = layer$29.pipe(Layer.provide(PtyAdapterLive), Layer.provide(PortScannerLayerLive));
 const PreviewLayerLive = Layer.empty.pipe(Layer.provideMerge(layer$27), Layer.provideMerge(PortScannerLayerLive));
-const WorkspaceEntriesLayerLive = layer$25.pipe(Layer.provide(layer$42));
-const WorkspaceFileSystemLayerLive = layer$24.pipe(Layer.provide(layer$42), Layer.provide(WorkspaceEntriesLayerLive));
-const WorkspaceLayerLive = Layer.mergeAll(layer$42, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
-const ProjectFaviconResolverLayerLive = layer$40.pipe(Layer.provide(layer$42), Layer.provide(layer$41));
-const AuthLayerLive = layer$60.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$64));
+const WorkspaceEntriesLayerLive = layer$25.pipe(Layer.provide(layer$43));
+const WorkspaceFileSystemLayerLive = layer$24.pipe(Layer.provide(layer$43), Layer.provide(WorkspaceEntriesLayerLive));
+const WorkspaceLayerLive = Layer.mergeAll(layer$43, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
+const ProjectFaviconResolverLayerLive = layer$41.pipe(Layer.provide(layer$43), Layer.provide(layer$42));
+const AuthLayerLive = layer$61.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$65));
 const ProviderRuntimeLayerLive = ProviderSessionReaperLive.pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$50), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$57.pipe(Layer.provide(layer$64))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(layer$44), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$56), Layer.provideMerge(layer$64)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$47), Layer.provideMerge(layer$49), Layer.provideMerge(layer$48), Layer.provide(layer$68));
+const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$58.pipe(Layer.provide(layer$65))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$52), Layer.provideMerge(layer$45), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(Layer.mergeAll(layer$57, layer$31)), Layer.provideMerge(layer$65)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$48), Layer.provideMerge(layer$50), Layer.provideMerge(layer$49), Layer.provide(layer$69));
 /**
 * Hub asset sync.
 *
@@ -83643,9 +84518,9 @@ const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(Checkpo
 * not-configured shape, and every call reports that rather than failing — so
 * this costs a server with no hub nothing but a layer.
 */
-const AssetSyncLive = layer$53.pipe(Layer.provideMerge(layer$54), Layer.provideMerge(layer$55));
-const RuntimeServicesLive = layer$43.pipe(Layer.provideMerge(AssetSyncLive), Layer.provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = Layer.mergeAll(Layer.mergeAll(HttpApiBuilder.layer(EnvironmentHttpApi).pipe(Layer.provide(authHttpApiLayer), Layer.provide(orchestrationHttpApiLayer), Layer.provide(serverEnvironmentHttpApiLayer), Layer.provide(environmentAuthenticatedAuthLayer)), otlpTracesProxyRouteLayer, assetRouteLayer, staticAndDevRouteLayer, websocketRpcRouteLayer), layer.pipe(Layer.provide(layer$2))).pipe(Layer.provide(TaskRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(ProjectionProjectRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(layer$28), Layer.provide(layer$45), Layer.provide(browserApiCorsLayer), Layer.provide(httpCompressionLayer));
+const AssetSyncLive = layer$54.pipe(Layer.provideMerge(layer$55), Layer.provideMerge(layer$56));
+const RuntimeServicesLive = layer$44.pipe(Layer.provideMerge(AssetSyncLive), Layer.provideMerge(RuntimeDependenciesLive));
+const makeRoutesLayer = Layer.mergeAll(Layer.mergeAll(HttpApiBuilder.layer(EnvironmentHttpApi).pipe(Layer.provide(authHttpApiLayer), Layer.provide(orchestrationHttpApiLayer), Layer.provide(serverEnvironmentHttpApiLayer), Layer.provide(environmentAuthenticatedAuthLayer)), otlpTracesProxyRouteLayer, assetRouteLayer, staticAndDevRouteLayer, websocketRpcRouteLayer), layer.pipe(Layer.provide(layer$2))).pipe(Layer.provide(RoutedTaskRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(ProjectionProjectRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(layer$28), Layer.provide(layer$46), Layer.provide(browserApiCorsLayer), Layer.provide(httpCompressionLayer));
 const makeServerLayer = Layer.unwrap(Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	yield* fixPath();
@@ -83688,7 +84563,7 @@ const makeServerLayer = Layer.unwrap(Effect.gen(function* () {
 		cause,
 		servePort: configured.servePort
 	}))) : Effect.void)) : Layer.empty;
-	return Layer.mergeAll(HttpRouter.serve(makeRoutesLayer, { disableLogger: !config.logWebSocketEvents }), httpListeningLayer, runtimeStateLayer, tailscaleServeLayer).pipe(Layer.provideMerge(RuntimeServicesLive), Layer.provideMerge(HttpResponseCompressionLive), Layer.provideMerge(HttpServerLive), Layer.provide(ObservabilityLive), Layer.provideMerge(FetchHttpClient.layer), Layer.provideMerge(layer$38), Layer.provideMerge(PlatformServicesLive));
+	return Layer.mergeAll(HttpRouter.serve(makeRoutesLayer, { disableLogger: !config.logWebSocketEvents }), httpListeningLayer, runtimeStateLayer, tailscaleServeLayer).pipe(Layer.provideMerge(RuntimeServicesLive), Layer.provideMerge(HttpResponseCompressionLive), Layer.provideMerge(HttpServerLive), Layer.provide(ObservabilityLive), Layer.provideMerge(FetchHttpClient.layer), Layer.provideMerge(layer$39), Layer.provideMerge(PlatformServicesLive));
 }));
 const runServer = Layer.launch(makeServerLayer);
 //#endregion
@@ -83850,11 +84725,11 @@ const reconcileWithNewBinary = Effect.fn("cli.selfUpdate.reconcileWithNewBinary"
 //#endregion
 //#region src/cli/service.ts
 const isBootServiceCommandError = Schema$1.is(BootServiceCommandError);
-const bootServiceLayer = (config) => layer$46({
+const bootServiceLayer = (config) => layer$47({
 	baseDir: config.baseDir,
 	logsDir: config.logsDir,
 	cliVersion: version
-}).pipe(Layer.provide(layer$52));
+}).pipe(Layer.provide(layer$53));
 /** Install, update, or repair the service using the CLI version running this command. */
 const reconcileService = Effect.fn("cli.service.reconcile")(function* () {
 	const service = yield* BootService;
@@ -83901,7 +84776,7 @@ const runServiceCommand = Effect.fn("cli.service.run")(function* (flags, run, pr
 	const baseDirNotice = yield* describeNonDefaultBaseDir(config.baseDir);
 	if (baseDirNotice !== null) yield* Console.error(baseDirNotice);
 	if (prepare !== void 0) yield* prepare(config);
-	return yield* run.pipe(Effect.tapError((error) => isBootServiceCommandError(error) ? BootService.pipe(Effect.flatMap((service) => Console.error(`Details: ${service.logPath}`))) : Effect.void), Effect.provide(Layer.mergeAll(bootServiceLayer(config), layer$52)));
+	return yield* run.pipe(Effect.tapError((error) => isBootServiceCommandError(error) ? BootService.pipe(Effect.flatMap((service) => Console.error(`Details: ${service.logPath}`))) : Effect.void), Effect.provide(Layer.mergeAll(bootServiceLayer(config), layer$53)));
 });
 /**
 * Options the installed unit carries, rather than ones this command consumes.
@@ -84055,7 +84930,7 @@ const serviceCommand = Command.make("service").pipe(Command.withDescription("Man
 ]));
 //#endregion
 //#region src/bin.ts
-const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$68, FetchHttpClient.layer);
+const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$69, FetchHttpClient.layer);
 /**
 * Prints an update reminder before dispatching, at most once a day.
 *