@p4code/cli 0.2.22 → 0.2.24

package/dist/bin.mjs

@@ -126,7 +126,7 @@ const closeServer = (server) => {
 * NetService - Service tag for startup networking helpers.
 */
 var NetService = class extends Context.Service()("@p4code/shared/Net/NetService") {};
-const make$89 = () => {
+const make$90 = () => {
 	/**
 	* Returns true when a TCP server can bind to {host, port}.
 	* `EADDRNOTAVAIL` is treated as available so IPv6-absent hosts don't fail
@@ -235,10 +235,10 @@ const make$89 = () => {
 		})
 	};
 };
-const layer$80 = Layer.sync(NetService, make$89);
+const layer$81 = Layer.sync(NetService, make$90);
 //#endregion
 //#region package.json
-var version = "0.2.22";
+var version = "0.2.24";
 //#endregion
 //#region src/config.ts
 /**
@@ -259,8 +259,8 @@ var ServerConfig$1 = class extends Context.Service()("@p4code/cli/config/ServerC
 	/** @deprecated Import and use `layerTest` from this module. */
 	static layerTest = (cwd, baseDirOrPrefix) => layerTest$3(cwd, baseDirOrPrefix);
 };
-const make$88 = (config) => ServerConfig$1.of(config);
-const layer$79 = (config) => Layer.succeed(ServerConfig$1, make$88(config));
+const make$89 = (config) => ServerConfig$1.of(config);
+const layer$80 = (config) => Layer.succeed(ServerConfig$1, make$89(config));
 const deriveServerPaths = Effect.fn(function* (baseDir, devUrl, options = {}) {
 	const { join } = yield* Path.Path;
 	const stateDir = join(baseDir, devUrl !== void 0 && !options.baseDirIsExplicit ? "dev" : "userdata");
@@ -1329,6 +1329,9 @@ const ExecutionEnvironmentCapabilities = Schema$1.Struct({
 	/** Server understands thread.snooze / thread.unsnooze commands. Same
 	version-skew contract as threadSettlement. */
 	threadSnooze: Schema$1.optionalKey(Schema$1.Boolean),
+	/** Server understands thread.pin / thread.unpin / thread.pin.reorder
+	commands. Same version-skew contract as threadSettlement. */
+	threadPinning: Schema$1.optionalKey(Schema$1.Boolean),
 	/** Server exposes the pull-request list, detail, activity, diff, and mutation APIs. Absent on
 	servers from before the pull-request workspace shipped, so clients must not probe them. */
 	pullRequests: Schema$1.optionalKey(Schema$1.Boolean),
@@ -1961,6 +1964,8 @@ const OrchestrationThread = Schema$1.Struct({
 	settledAt: Schema$1.NullOr(IsoDateTime).pipe(Schema$1.withDecodingDefault(Effect.succeed(null))),
 	snoozedUntil: Schema$1.optional(Schema$1.NullOr(IsoDateTime)),
 	snoozedAt: Schema$1.optional(Schema$1.NullOr(IsoDateTime)),
+	pinnedAt: Schema$1.optional(Schema$1.NullOr(IsoDateTime)),
+	pinOrderKey: Schema$1.optional(Schema$1.NullOr(Schema$1.String)),
 	deletedAt: Schema$1.NullOr(IsoDateTime),
 	messages: Schema$1.Array(OrchestrationMessage),
 	proposedPlans: Schema$1.Array(OrchestrationProposedPlan).pipe(Schema$1.withDecodingDefault(Effect.succeed([]))),
@@ -2058,11 +2063,19 @@ const OrchestrationThreadShell = Schema$1.Struct({
 	settledAt: Schema$1.NullOr(IsoDateTime).pipe(Schema$1.withDecodingDefault(Effect.succeed(null))),
 	snoozedUntil: Schema$1.optional(Schema$1.NullOr(IsoDateTime)),
 	snoozedAt: Schema$1.optional(Schema$1.NullOr(IsoDateTime)),
+	pinnedAt: Schema$1.optional(Schema$1.NullOr(IsoDateTime)),
+	pinOrderKey: Schema$1.optional(Schema$1.NullOr(Schema$1.String)),
 	session: Schema$1.NullOr(OrchestrationSession),
 	latestUserMessageAt: Schema$1.NullOr(IsoDateTime),
 	hasPendingApprovals: Schema$1.Boolean,
 	hasPendingUserInput: Schema$1.Boolean,
 	hasActionableProposedPlan: Schema$1.Boolean,
+	/**
+	* Native background work alive after the turn settles: "working" while
+	* subagents/workflows run, "monitoring" when watch loops are the only
+	* live work. Optional so old servers/clients interop; absent = none.
+	*/
+	backgroundLiveness: Schema$1.optional(Schema$1.NullOr(Schema$1.Literals(["working", "monitoring"]))),
 	hasBackgroundTasks: Schema$1.optional(Schema$1.Boolean),
 	scheduledWakeAt: Schema$1.optional(Schema$1.NullOr(IsoDateTime))
 });
@@ -2227,6 +2240,23 @@ const ThreadUnsnoozeCommand = Schema$1.Struct({
 	threadId: ThreadId,
 	reason: Schema$1.Literal("user")
 });
+const ThreadPinCommand = Schema$1.Struct({
+	type: Schema$1.Literal("thread.pin"),
+	commandId: CommandId,
+	threadId: ThreadId
+});
+const ThreadUnpinCommand = Schema$1.Struct({
+	type: Schema$1.Literal("thread.unpin"),
+	commandId: CommandId,
+	threadId: ThreadId
+});
+/** Writes one key to one thread, so neighbours on other servers stay untouched. */
+const ThreadPinReorderCommand = Schema$1.Struct({
+	type: Schema$1.Literal("thread.pin.reorder"),
+	commandId: CommandId,
+	threadId: ThreadId,
+	pinOrderKey: Schema$1.NullOr(Schema$1.String)
+});
 const ThreadMetaUpdateCommand = Schema$1.Struct({
 	type: Schema$1.Literal("thread.meta.update"),
 	commandId: CommandId,
@@ -2411,6 +2441,9 @@ const DispatchableClientOrchestrationCommand = Schema$1.Union([
 	ThreadUnsettleCommand,
 	ThreadSnoozeCommand,
 	ThreadUnsnoozeCommand,
+	ThreadPinCommand,
+	ThreadUnpinCommand,
+	ThreadPinReorderCommand,
 	ThreadMetaUpdateCommand,
 	ThreadRuntimeModeSetCommand,
 	ThreadInteractionModeSetCommand,
@@ -2438,6 +2471,9 @@ const ClientOrchestrationCommand = Schema$1.Union([
 	ThreadUnsettleCommand,
 	ThreadSnoozeCommand,
 	ThreadUnsnoozeCommand,
+	ThreadPinCommand,
+	ThreadUnpinCommand,
+	ThreadPinReorderCommand,
 	ThreadMetaUpdateCommand,
 	ThreadRuntimeModeSetCommand,
 	ThreadInteractionModeSetCommand,
@@ -2582,6 +2618,9 @@ const OrchestrationEventType = Schema$1.Literals([
 	"thread.unsettled",
 	"thread.snoozed",
 	"thread.unsnoozed",
+	"thread.pinned",
+	"thread.unpinned",
+	"thread.pin-reordered",
 	"thread.meta-updated",
 	"thread.runtime-mode-set",
 	"thread.interaction-mode-set",
@@ -2688,6 +2727,21 @@ const ThreadUnsnoozedPayload$1 = Schema$1.Struct({
 	reason: Schema$1.Literals(["user", "activity"]),
 	updatedAt: IsoDateTime
 });
+const ThreadPinnedPayload$1 = Schema$1.Struct({
+	threadId: ThreadId,
+	pinnedAt: IsoDateTime,
+	pinOrderKey: Schema$1.optional(Schema$1.NullOr(Schema$1.String)),
+	updatedAt: IsoDateTime
+});
+const ThreadUnpinnedPayload$1 = Schema$1.Struct({
+	threadId: ThreadId,
+	updatedAt: IsoDateTime
+});
+const ThreadPinReorderedPayload$1 = Schema$1.Struct({
+	threadId: ThreadId,
+	pinOrderKey: Schema$1.NullOr(Schema$1.String),
+	updatedAt: IsoDateTime
+});
 const ThreadMetaUpdatedPayload$1 = Schema$1.Struct({
 	threadId: ThreadId,
 	title: Schema$1.optional(TrimmedNonEmptyString),
@@ -2933,6 +2987,21 @@ const OrchestrationEvent = Schema$1.Union([
 		type: Schema$1.Literal("thread.unsnoozed"),
 		payload: ThreadUnsnoozedPayload$1
 	}),
+	Schema$1.Struct({
+		...EventBaseFields,
+		type: Schema$1.Literal("thread.pinned"),
+		payload: ThreadPinnedPayload$1
+	}),
+	Schema$1.Struct({
+		...EventBaseFields,
+		type: Schema$1.Literal("thread.unpinned"),
+		payload: ThreadUnpinnedPayload$1
+	}),
+	Schema$1.Struct({
+		...EventBaseFields,
+		type: Schema$1.Literal("thread.pin-reordered"),
+		payload: ThreadPinReorderedPayload$1
+	}),
 	Schema$1.Struct({
 		...EventBaseFields,
 		type: Schema$1.Literal("thread.meta-updated"),
@@ -6787,6 +6856,19 @@ const UserInputQuestion = Schema$1.Struct({
 });
 const UserInputRequestedPayload = Schema$1.Struct({ questions: Schema$1.Array(UserInputQuestion) });
 const UserInputResolvedPayload = Schema$1.Struct({ answers: UnknownRecordSchema });
+/**
+* Watch-loop task types: Monitor-tool tasks plus background shells (a shell
+* that outlives its turn is in practice a watch loop). Canonical single copy,
+* so the server liveness registry and any client fold classify identically.
+*/
+const MONITOR_TASK_TYPES = /* @__PURE__ */ new Set([
+	"monitor",
+	"monitor_mcp",
+	"local_bash",
+	"shell"
+]);
+/** Task types that are neither agents nor watch loops (plan-mode bookkeeping). */
+const INERT_TASK_TYPES = /* @__PURE__ */ new Set(["plan", "dream"]);
 const TaskStartedPayload = Schema$1.Struct({
 	taskId: RuntimeTaskId,
 	description: Schema$1.optional(TrimmedNonEmptyStringSchema$1),
@@ -7852,6 +7934,8 @@ const SidebarProjectSortOrder = Schema$1.Literals([
 const DEFAULT_SIDEBAR_PROJECT_SORT_ORDER = "updated_at";
 const SidebarThreadSortOrder = Schema$1.Literals(["updated_at", "created_at"]);
 const DEFAULT_SIDEBAR_THREAD_SORT_ORDER = "updated_at";
+const SidebarDisplayStyle = Schema$1.Literals(["project", "thread"]);
+const DEFAULT_SIDEBAR_DISPLAY_STYLE = "project";
 const SidebarProjectGroupingMode = Schema$1.Literals([
 	"repository",
 	"repository_path",
@@ -7894,6 +7978,7 @@ const ClientSettingsSchema = Schema$1.Struct({
 	})).pipe(Schema$1.withDecodingDefault(Effect.succeed({}))),
 	showBuildModeToggle: Schema$1.Boolean.pipe(Schema$1.withDecodingDefault(Effect.succeed(false))),
 	sidebarAutoSettleAfterDays: Schema$1.NullOr(SidebarAutoSettleAfterDays).pipe(Schema$1.withDecodingDefault(Effect.succeed(3))),
+	sidebarDisplayStyle: SidebarDisplayStyle.pipe(Schema$1.withDecodingDefault(Effect.succeed(DEFAULT_SIDEBAR_DISPLAY_STYLE))),
 	sidebarProjectGroupingMode: SidebarProjectGroupingMode.pipe(Schema$1.withDecodingDefault(Effect.succeed(DEFAULT_SIDEBAR_PROJECT_GROUPING_MODE))),
 	sidebarProjectGroupingOverrides: Schema$1.Record(TrimmedNonEmptyString, SidebarProjectGroupingMode).pipe(Schema$1.withDecodingDefault(Effect.succeed({}))),
 	sidebarProjectSortOrder: SidebarProjectSortOrder.pipe(Schema$1.withDecodingDefault(Effect.succeed(DEFAULT_SIDEBAR_PROJECT_SORT_ORDER))),
@@ -8151,6 +8236,12 @@ const ServerSettings = Schema$1.Struct({
 		instanceId: ProviderInstanceId.make("codex"),
 		model: DEFAULT_TEXT_GENERATION_MODEL
 	}))),
+	/**
+	* The supervisor model a Fusion pair starts with. Null until the user picks
+	* one; kept in settings rather than per-draft state so the choice survives
+	* the next thread instead of resetting to none each time.
+	*/
+	fusionWatcherModelSelection: Schema$1.NullOr(ModelSelection).pipe(Schema$1.withDecodingDefault(Effect.succeed(null))),
 	sourceControlWritingStyle: SourceControlWritingStyleSettings.pipe(Schema$1.withDecodingDefault(Effect.succeed({}))),
 	sourceControlWriterModelSelection: Schema$1.NullOr(ModelSelection).pipe(Schema$1.withDecodingDefault(Effect.succeed(null))),
 	/** Prefix used for tasks without a project or project-specific override. */
@@ -8288,6 +8379,7 @@ const ServerSettingsPatch = Schema$1.Struct({
 	newWorktreesStartFromOrigin: Schema$1.optionalKey(Schema$1.Boolean),
 	addProjectBaseDirectory: Schema$1.optionalKey(TrimmedString),
 	textGenerationModelSelection: Schema$1.optionalKey(ModelSelectionPatch),
+	fusionWatcherModelSelection: Schema$1.optionalKey(Schema$1.NullOr(ModelSelection)),
 	sourceControlWritingStyle: Schema$1.optionalKey(Schema$1.Struct({
 		mode: Schema$1.optionalKey(SourceControlWritingStyleMode),
 		customInstructions: Schema$1.optionalKey(TrimmedString),
@@ -8331,6 +8423,7 @@ Schema$1.Struct({
 	}))),
 	showBuildModeToggle: Schema$1.optionalKey(Schema$1.Boolean),
 	sidebarAutoSettleAfterDays: Schema$1.optionalKey(Schema$1.NullOr(SidebarAutoSettleAfterDays)),
+	sidebarDisplayStyle: Schema$1.optionalKey(SidebarDisplayStyle),
 	sidebarProjectGroupingMode: Schema$1.optionalKey(SidebarProjectGroupingMode),
 	sidebarProjectGroupingOverrides: Schema$1.optionalKey(Schema$1.Record(TrimmedNonEmptyString, SidebarProjectGroupingMode)),
 	sidebarProjectSortOrder: Schema$1.optionalKey(SidebarProjectSortOrder),
@@ -9404,7 +9497,17 @@ const TrackerStatus = Schema$1.Struct({
 	* Null in `mcp` and `none` modes, where p4code holds no credential to ask
 	* with.
 	*/
-	workspace: Schema$1.NullOr(Schema$1.String)
+	workspace: Schema$1.NullOr(Schema$1.String),
+	/**
+	* The stored key with its middle replaced by bullets, for the settings row
+	* to display. Null in `mcp` and `none` modes.
+	*
+	* The full key is never sent back out. This exists so the panel can show
+	* that a key is present, and which one, without the reader being able to
+	* reconstruct it: the mask is a fixed width, so it does not disclose the
+	* key's length either.
+	*/
+	maskedKey: Schema$1.NullOr(Schema$1.String)
 });
 const TrackerProviderInput = Schema$1.Struct({ provider: TrackerProviderName });
 const TrackerApiKeyInput = Schema$1.Struct({
@@ -12098,7 +12201,7 @@ function deriveAuthClientMetadata(input) {
 //#endregion
 //#region src/auth/EnvironmentAuthPolicy.ts
 var EnvironmentAuthPolicy = class extends Context.Service()("@p4code/cli/auth/EnvironmentAuthPolicy") {};
-const make$87 = Effect.gen(function* () {
+const make$88 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const isRemoteReachable = isRemoteReachableHost(config.host);
 	const policy = config.mode === "desktop" ? isRemoteReachable ? "remote-reachable" : "desktop-managed-local" : isRemoteReachable ? "remote-reachable" : "loopback-browser";
@@ -12116,7 +12219,7 @@ const make$87 = Effect.gen(function* () {
 	};
 	return EnvironmentAuthPolicy.of({ getDescriptor: () => Effect.succeed(descriptor).pipe(Effect.withSpan("EnvironmentAuthPolicy.getDescriptor")) });
 });
-const layer$78 = Layer.effect(EnvironmentAuthPolicy, make$87);
+const layer$79 = Layer.effect(EnvironmentAuthPolicy, make$88);
 //#endregion
 //#region src/persistence/Errors.ts
 function summarizeSchemaIssue(issue) {
@@ -12297,7 +12400,7 @@ function toPersistenceSqlOrDecodeError$6(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$86 = Effect.gen(function* () {
+const make$87 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createSessionRow = SqlSchema.void({
 		Request: CreateAuthSessionInput,
@@ -12431,7 +12534,7 @@ const make$86 = Effect.gen(function* () {
 		setLastConnectedAt
 	};
 });
-const layer$77 = Layer.effect(AuthSessionRepository, make$86);
+const layer$78 = Layer.effect(AuthSessionRepository, make$87);
 //#endregion
 //#region src/auth/ServerSecretStore.ts
 const secretStoreErrorContext = {
@@ -12498,7 +12601,7 @@ const isSecretStoreError = Schema$1.is(SecretStoreError);
 const isPlatformError = (value) => Predicate.isTagged(value, "PlatformError");
 const isSecretAlreadyExistsError = (error) => "cause" in error && isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists";
 var ServerSecretStore = class extends Context.Service()("@p4code/cli/auth/ServerSecretStore") {};
-const make$85 = Effect.gen(function* () {
+const make$86 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -12568,7 +12671,7 @@ const make$85 = Effect.gen(function* () {
 		remove
 	});
 });
-const layer$76 = Layer.effect(ServerSecretStore, make$85);
+const layer$77 = Layer.effect(ServerSecretStore, make$86);
 //#endregion
 //#region src/auth/SessionStore.ts
 var MalformedSessionTokenError = class extends Schema$1.TaggedErrorClass()("MalformedSessionTokenError", {}) {
@@ -12806,7 +12909,7 @@ function toAuthClientSession(input) {
 		current: false
 	};
 }
-const make$84 = Effect.gen(function* () {
+const make$85 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const serverConfig = yield* ServerConfig$1;
 	const secretStore = yield* ServerSecretStore;
@@ -13120,7 +13223,7 @@ const make$84 = Effect.gen(function* () {
 		markDisconnected
 	});
 });
-const layer$75 = Layer.effect(SessionStore, make$84).pipe(Layer.provideMerge(layer$77));
+const layer$76 = Layer.effect(SessionStore, make$85).pipe(Layer.provideMerge(layer$78));
 //#endregion
 //#region src/persistence/AuthPairingLinks.ts
 const AuthPairingLinkRecord = Schema$1.Struct({
@@ -13181,7 +13284,7 @@ function toPersistenceSqlOrDecodeError$5(sqlOperation, decodeOperation, correlat
 		cause
 	});
 }
-const make$83 = Effect.gen(function* () {
+const make$84 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const createPairingLinkRow = SqlSchema.void({
 		Request: CreateAuthPairingLinkInput,
@@ -13316,7 +13419,7 @@ const make$83 = Effect.gen(function* () {
 		getByCredential
 	};
 });
-const layer$74 = Layer.effect(AuthPairingLinkRepository, make$83);
+const layer$75 = Layer.effect(AuthPairingLinkRepository, make$84);
 //#endregion
 //#region src/auth/PairingGrantStore.ts
 var UnknownBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnknownBootstrapCredentialError", {}) {
@@ -13411,7 +13514,7 @@ const DEV_STARTUP_TTL_HOURS = Duration.hours(24);
 const PAIRING_TOKEN_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 const PAIRING_TOKEN_LENGTH = 12;
 const PAIRING_TOKEN_REJECTION_LIMIT = Math.floor(256 / 32) * 32;
-const make$82 = Effect.gen(function* () {
+const make$83 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
 	const config = yield* ServerConfig$1;
 	const pairingLinks = yield* AuthPairingLinkRepository;
@@ -13609,7 +13712,7 @@ const make$82 = Effect.gen(function* () {
 		consume
 	});
 });
-const layer$73 = Layer.effect(PairingGrantStore, make$82).pipe(Layer.provideMerge(layer$74));
+const layer$74 = Layer.effect(PairingGrantStore, make$83).pipe(Layer.provideMerge(layer$75));
 //#endregion
 //#region src/persistence/DatabaseSnapshot.ts
 /**
@@ -15450,6 +15553,27 @@ var _047_ThreadPairGates_default = Effect.gen(function* () {
   `;
 });
 //#endregion
+//#region src/persistence/Migrations/048_ProjectionThreadsPinned.ts
+/**
+* Server-side thread pinning. `pinned_at` holds the pin itself; `pin_order_key`
+* is the fractional index that orders the pinned block, written one key at a
+* time so a reorder never touches threads living on other servers.
+*
+* Both are nullable with no default: an unpinned thread is the absence of a
+* pin, and every existing thread starts unpinned.
+*/
+var _048_ProjectionThreadsPinned_default = Effect.gen(function* () {
+	const sql = yield* SqlClient.SqlClient;
+	yield* sql`
+    ALTER TABLE projection_threads
+    ADD COLUMN pinned_at TEXT
+  `;
+	yield* sql`
+    ALTER TABLE projection_threads
+    ADD COLUMN pin_order_key TEXT
+  `;
+});
+//#endregion
 //#region src/persistence/Migrations.ts
 /**
 * MigrationsLive - Migration runner with inline loader
@@ -15705,6 +15829,11 @@ const migrationEntries = [
 		47,
 		"ThreadPairGates",
 		_047_ThreadPairGates_default
+	],
+	[
+		48,
+		"ProjectionThreadsPinned",
+		_048_ProjectionThreadsPinned_default
 	]
 ];
 const makeMigrationLoader = (throughId) => Migrator.fromRecord(Object.fromEntries(migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -15955,7 +16084,7 @@ function parseBearerToken(request) {
 	const token = header.slice(7).trim();
 	return token.length > 0 ? token : null;
 }
-const make$81 = Effect.gen(function* () {
+const make$82 = Effect.gen(function* () {
 	const policy = yield* EnvironmentAuthPolicy;
 	const bootstrapCredentials = yield* PairingGrantStore;
 	const sessions = yield* SessionStore;
@@ -16150,9 +16279,9 @@ const make$81 = Effect.gen(function* () {
 		issueStartupPairingUrl
 	});
 });
-const layer$72 = Layer.effect(EnvironmentAuth, make$81).pipe(Layer.provideMerge(layer$73), Layer.provideMerge(layer$75), Layer.provideMerge(layer$78));
-const storageLayer = Layer.mergeAll(layer$76, layerConfig);
-const runtimeLayer = layer$72.pipe(Layer.provideMerge(storageLayer));
+const layer$73 = Layer.effect(EnvironmentAuth, make$82).pipe(Layer.provideMerge(layer$74), Layer.provideMerge(layer$76), Layer.provideMerge(layer$79));
+const storageLayer = Layer.mergeAll(layer$77, layerConfig);
+const runtimeLayer = layer$73.pipe(Layer.provideMerge(storageLayer));
 //#endregion
 //#region src/cliAuthFormat.ts
 const newline = "\n";
@@ -16907,7 +17036,7 @@ const runWithEnvironmentAuth = (flags, run, options) => Effect.gen(function* ()
 	}
 	return yield* Effect.gen(function* () {
 		return yield* run(yield* EnvironmentAuth);
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$79(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer).pipe(Layer.provide(layer$80(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const ttlFlag = Flag.string("ttl").pipe(Flag.withSchema(DurationFromString), Flag.withDescription("TTL, for example `5m`, `1h`, `30d`, or `15 minutes`."), Flag.optional);
 const jsonFlag = Flag.boolean("json").pipe(Flag.withDescription("Emit JSON instead of human-readable output."), Flag.withDefault(false));
@@ -17047,7 +17176,7 @@ const DEFAULT_LIMITS = {
 	windowMillis: FAILURE_WINDOW_MS,
 	blockMillis: BLOCK_DURATION_MS
 };
-const make$80 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
+const make$81 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LIMITS) {
 	const state = yield* Ref.make(initialThrottleState);
 	return HubAuthThrottle.of({
 		shouldRefuse: Effect.gen(function* () {
@@ -17061,7 +17190,7 @@ const make$80 = Effect.fn("HubAuthThrottle.make")(function* (limits = DEFAULT_LI
 		})
 	});
 });
-const layer$71 = Layer.effect(HubAuthThrottle, make$80());
+const layer$72 = Layer.effect(HubAuthThrottle, make$81());
 //#endregion
 //#region src/hub/HubAuth.ts
 /**
@@ -18120,7 +18249,7 @@ const releaseFeedLeaseRoute = HttpRouter.add("DELETE", "/feed/lease", respondToH
 	yield* (yield* SqlClient.SqlClient)`DELETE FROM feed_refresh_lease WHERE lease_key='refresh' AND owner=${body.owner}`;
 	return HttpServerResponse.empty({ status: 204 });
 })));
-const layer$70 = Layer.mergeAll(healthRoute, listTasksRoute, getTaskRoute, createTaskRoute, putTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute, listFeedSourcesRoute, upsertFeedSourceRoute, deleteFeedSourceRoute, listFeedRoute, putFeedArticleRoute, putFeedEngagementRoute, markFeedReadRoute, cleanupFeedRoute, setFeedRefreshedAtRoute, acquireFeedLeaseRoute, renewFeedLeaseRoute, releaseFeedLeaseRoute);
+const layer$71 = Layer.mergeAll(healthRoute, listTasksRoute, getTaskRoute, createTaskRoute, putTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute, listFeedSourcesRoute, upsertFeedSourceRoute, deleteFeedSourceRoute, listFeedRoute, putFeedArticleRoute, putFeedEngagementRoute, markFeedReadRoute, cleanupFeedRoute, setFeedRefreshedAtRoute, acquireFeedLeaseRoute, renewFeedLeaseRoute, releaseFeedLeaseRoute);
 //#endregion
 //#region src/hub/Migrations/001_Tasks.ts
 /**
@@ -18635,7 +18764,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 	});
 	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
-const makeHubLayer = HttpRouter.serve(layer$70).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$71), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
+const makeHubLayer = HttpRouter.serve(layer$71).pipe(Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$72), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
 //#endregion
 //#region src/atomicWrite.ts
@@ -18759,7 +18888,7 @@ function stripDefaultServerSettings(current, defaults) {
 	}
 	return Object.is(current, defaults) ? void 0 : current;
 }
-const make$79 = Effect.gen(function* () {
+const make$80 = Effect.gen(function* () {
 	const { settingsPath } = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const pathService = yield* Path.Path;
@@ -18980,7 +19109,7 @@ const make$79 = Effect.gen(function* () {
 		}
 	};
 });
-const layer$69 = Layer.effect(ServerSettingsService, make$79);
+const layer$70 = Layer.effect(ServerSettingsService, make$80);
 //#endregion
 //#region src/pathExpansion.ts
 /**
@@ -19354,7 +19483,7 @@ function claudeEntryFromRegistration(registration) {
 	};
 }
 var ClaudeMcpFiles = class extends Context.Service()("@p4code/cli/mcp/ClaudeMcpFiles") {};
-const make$78 = Effect.gen(function* () {
+const make$79 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const services = yield* Effect.context();
@@ -19419,7 +19548,7 @@ const make$78 = Effect.gen(function* () {
 		removeProject: (projectDir, name) => removeAt(Effect.succeed(projectFile(projectDir)))(name)
 	};
 });
-const layer$68 = Layer.effect(ClaudeMcpFiles, make$78);
+const layer$69 = Layer.effect(ClaudeMcpFiles, make$79);
 Layer.succeed(ClaudeMcpFiles, {
 	readUser: Effect.succeed([]),
 	upsertUser: () => Effect.fail(new McpRegistryError({ detail: "No Claude config in tests." })),
@@ -19555,7 +19684,7 @@ const decodeClientRegistration = Schema$1.decodeUnknownExit(ClientRegistrationRe
 const decodeTokenResponse = Schema$1.decodeUnknownExit(TokenResponse);
 var McpOAuth = class extends Context.Service()("@p4code/cli/mcp/McpOAuth") {};
 const registryError = (detail) => new McpRegistryError({ detail });
-const make$77 = Effect.gen(function* () {
+const make$78 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
 	const http = yield* HttpClient.HttpClient;
@@ -19875,7 +20004,7 @@ const make$77 = Effect.gen(function* () {
 		accessTokenFor
 	};
 });
-const layer$67 = Layer.effect(McpOAuth, make$77);
+const layer$68 = Layer.effect(McpOAuth, make$78);
 Layer.succeed(McpOAuth, {
 	statusFor: () => Effect.succeed(Option.none()),
 	begin: () => Effect.fail(new McpRegistryError({ detail: "OAuth sign-in is not available." })),
@@ -19893,7 +20022,7 @@ const decodeRegistration$1 = Schema$1.decodeUnknownExit(RegistrationFromJson$1);
 const encodeRegistration = Schema$1.encodeSync(RegistrationFromJson$1);
 var McpRegistry = class extends Context.Service()("@p4code/cli/mcp/McpRegistry") {};
 const slotsOf = (registration) => registration.secrets ?? [];
-const make$76 = Effect.gen(function* () {
+const make$77 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
 	const oauth = yield* McpOAuth;
@@ -20044,7 +20173,7 @@ const make$76 = Effect.gen(function* () {
 		}).pipe(Effect.provide(services), Effect.catchCause((cause) => Effect.logWarning("mcp registry resolve failed", { cause }).pipe(Effect.as({}))))
 	};
 });
-const layer$66 = Layer.effect(McpRegistry, make$76);
+const layer$67 = Layer.effect(McpRegistry, make$77);
 //#endregion
 //#region src/sync/skillDirectory.ts
 /**
@@ -20423,7 +20552,7 @@ const formatHubLink = (input) => encodeStoredHubLink({
 	shareMode: input.shareMode
 });
 const fromEnvironment = (environment) => validateHubLink(environment.P4CODE_HUB_URL ?? "", environment.P4CODE_HUB_TOKEN ?? "");
-const make$75 = Effect.fn("HubLink.make")(function* (environment) {
+const make$76 = Effect.fn("HubLink.make")(function* (environment) {
 	const secrets = yield* ServerSecretStore;
 	const env = environment ?? process.env;
 	const fromEnv = fromEnvironment(env);
@@ -20489,7 +20618,7 @@ const make$75 = Effect.fn("HubLink.make")(function* (environment) {
 		})
 	};
 });
-const layer$65 = Layer.effect(HubLink, make$75());
+const layer$66 = Layer.effect(HubLink, make$76());
 //#endregion
 //#region src/sync/HubAssetClient.ts
 /**
@@ -20522,7 +20651,7 @@ const decodeAssetListPage = Schema$1.decodeUnknownEffect(AssetListPage);
 const decodeConflictBody$1 = Schema$1.decodeUnknownEffect(ConflictBody$1);
 const decodeAsset = Schema$1.decodeUnknownEffect(AgentAsset);
 var HubAssetClient = class extends Context.Service()("@p4code/cli/sync/HubAssetClient") {};
-const make$74 = Effect.gen(function* () {
+const make$75 = Effect.gen(function* () {
 	const http = yield* HttpClient.HttpClient;
 	const link = yield* HubLink;
 	const requireSettings = Effect.gen(function* () {
@@ -20604,7 +20733,7 @@ const make$74 = Effect.gen(function* () {
 		remove
 	};
 });
-const layer$64 = Layer.effect(HubAssetClient, make$74);
+const layer$65 = Layer.effect(HubAssetClient, make$75);
 //#endregion
 //#region src/sync/mcpRegistrationFiles.ts
 /**
@@ -21179,7 +21308,7 @@ const EMPTY_REPORT = {
 	unavailable: null
 };
 var AssetSync = class extends Context.Service()("@p4code/cli/sync/AssetSync") {};
-const make$73 = Effect.gen(function* () {
+const make$74 = Effect.gen(function* () {
 	const client = yield* HubAssetClient;
 	const link = yield* HubLink;
 	const settingsStore = yield* ServerSettingsService;
@@ -21892,7 +22021,7 @@ const make$73 = Effect.gen(function* () {
 		removeLocal
 	};
 });
-const layer$63 = Layer.effect(AssetSync, make$73);
+const layer$64 = Layer.effect(AssetSync, make$74);
 //#endregion
 //#region src/provider/CompressPrompts.ts
 /**
@@ -22266,7 +22395,7 @@ const findAgentPreset = (requested) => {
 };
 //#endregion
 //#region src/cli/assets.ts
-const SyncServicesLive = layer$63.pipe(Layer.provideMerge(layer$64), Layer.provideMerge(layer$65), Layer.provideMerge(layer$69.pipe(Layer.provide(layer$76))), Layer.provideMerge(layer$76), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$64.pipe(Layer.provideMerge(layer$65), Layer.provideMerge(layer$66), Layer.provideMerge(layer$70.pipe(Layer.provide(layer$77))), Layer.provideMerge(layer$77), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -22274,7 +22403,7 @@ const runWithSync = (flags, run) => Effect.gen(function* () {
 			sync: yield* AssetSync,
 			link: yield* HubLink
 		});
-	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$79(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
+	}).pipe(Effect.provide(SyncServicesLive.pipe(Layer.provide(layer$80(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, "Error")))));
 });
 const STATE_LABEL = {
 	synced: "synced",
@@ -23305,6 +23434,9 @@ const ThreadUnpromptedSubagentsSetPayload = ThreadUnpromptedSubagentsSetPayload$
 const ThreadDeletedPayload = ThreadDeletedPayload$1;
 const ThreadUnarchivedPayload = ThreadUnarchivedPayload$1;
 const ThreadUnsettledPayload = ThreadUnsettledPayload$1;
+const ThreadPinnedPayload = ThreadPinnedPayload$1;
+const ThreadPinReorderedPayload = ThreadPinReorderedPayload$1;
+const ThreadUnpinnedPayload = ThreadUnpinnedPayload$1;
 const ThreadSnoozedPayload = ThreadSnoozedPayload$1;
 const ThreadUnsnoozedPayload = ThreadUnsnoozedPayload$1;
 const MessageSentPayloadSchema = ThreadMessageSentPayload;
@@ -23574,6 +23706,29 @@ function projectEvent(model, event) {
 				updatedAt: payload.updatedAt
 			})
 		})));
+		case "thread.pinned": return decodeForEvent(ThreadPinnedPayload, event.payload, event.type, "payload").pipe(Effect.map((payload) => ({
+			...nextBase,
+			threads: updateThread(nextBase.threads, payload.threadId, {
+				pinnedAt: payload.pinnedAt,
+				...payload.pinOrderKey === void 0 ? {} : { pinOrderKey: payload.pinOrderKey },
+				updatedAt: payload.updatedAt
+			})
+		})));
+		case "thread.unpinned": return decodeForEvent(ThreadUnpinnedPayload, event.payload, event.type, "payload").pipe(Effect.map((payload) => ({
+			...nextBase,
+			threads: updateThread(nextBase.threads, payload.threadId, {
+				pinnedAt: null,
+				pinOrderKey: null,
+				updatedAt: payload.updatedAt
+			})
+		})));
+		case "thread.pin-reordered": return decodeForEvent(ThreadPinReorderedPayload, event.payload, event.type, "payload").pipe(Effect.map((payload) => ({
+			...nextBase,
+			threads: updateThread(nextBase.threads, payload.threadId, {
+				pinOrderKey: payload.pinOrderKey,
+				updatedAt: payload.updatedAt
+			})
+		})));
 		case "thread.meta-updated": return decodeForEvent(ThreadMetaUpdatedPayload, event.payload, event.type, "payload").pipe(Effect.map((payload) => ({
 			...nextBase,
 			threads: updateThread(nextBase.threads, payload.threadId, {
@@ -24305,7 +24460,7 @@ const decideOrchestrationCommand = Effect.fn("decideOrchestrationCommand")(funct
 				detail: `thread ${command.threadId} has a queued turn start and cannot be settled`
 			}));
 			const alreadySettled = thread.settledOverride === "settled" && thread.settledAt !== null;
-			return {
+			const settledEvent = {
 				...yield* withEventBase({
 					aggregateKind: "thread",
 					aggregateId: command.threadId,
@@ -24319,6 +24474,20 @@ const decideOrchestrationCommand = Effect.fn("decideOrchestrationCommand")(funct
 					updatedAt: alreadySettled ? thread.updatedAt : occurredAt
 				}
 			};
+			if (thread.pinnedAt == null) return settledEvent;
+			return [settledEvent, {
+				...yield* withEventBase({
+					aggregateKind: "thread",
+					aggregateId: command.threadId,
+					occurredAt,
+					commandId: command.commandId
+				}),
+				type: "thread.unpinned",
+				payload: {
+					threadId: command.threadId,
+					updatedAt: occurredAt
+				}
+			}];
 		}
 		case "thread.unsettle": {
 			const thread = yield* requireThreadNotArchived({
@@ -24402,6 +24571,105 @@ const decideOrchestrationCommand = Effect.fn("decideOrchestrationCommand")(funct
 				}
 			};
 		}
+		case "thread.pin": {
+			const thread = yield* requireThreadNotArchived({
+				readModel,
+				command,
+				threadId: command.threadId
+			});
+			const occurredAt = yield* nowIso$8;
+			const existingPinnedAt = thread.pinnedAt ?? null;
+			const pinnedEvent = {
+				...yield* withEventBase({
+					aggregateKind: "thread",
+					aggregateId: command.threadId,
+					occurredAt,
+					commandId: command.commandId
+				}),
+				type: "thread.pinned",
+				payload: {
+					threadId: command.threadId,
+					pinnedAt: existingPinnedAt ?? occurredAt,
+					updatedAt: existingPinnedAt !== null ? thread.updatedAt : occurredAt
+				}
+			};
+			const promotionEvents = [];
+			if (thread.settledOverride === "settled") promotionEvents.push({
+				...yield* withEventBase({
+					aggregateKind: "thread",
+					aggregateId: command.threadId,
+					occurredAt,
+					commandId: command.commandId
+				}),
+				type: "thread.unsettled",
+				payload: {
+					threadId: command.threadId,
+					reason: "user",
+					updatedAt: occurredAt
+				}
+			});
+			if (thread.snoozedUntil != null) promotionEvents.push({
+				...yield* withEventBase({
+					aggregateKind: "thread",
+					aggregateId: command.threadId,
+					occurredAt,
+					commandId: command.commandId
+				}),
+				type: "thread.unsnoozed",
+				payload: {
+					threadId: command.threadId,
+					reason: "user",
+					updatedAt: occurredAt
+				}
+			});
+			return promotionEvents.length > 0 ? [pinnedEvent, ...promotionEvents] : pinnedEvent;
+		}
+		case "thread.unpin": {
+			const thread = yield* requireThreadNotArchived({
+				readModel,
+				command,
+				threadId: command.threadId
+			});
+			const alreadyUnpinned = thread.pinnedAt == null;
+			const occurredAt = yield* nowIso$8;
+			return {
+				...yield* withEventBase({
+					aggregateKind: "thread",
+					aggregateId: command.threadId,
+					occurredAt,
+					commandId: command.commandId
+				}),
+				type: "thread.unpinned",
+				payload: {
+					threadId: command.threadId,
+					updatedAt: alreadyUnpinned ? thread.updatedAt : occurredAt
+				}
+			};
+		}
+		case "thread.pin.reorder": {
+			const thread = yield* requireThreadNotArchived({
+				readModel,
+				command,
+				threadId: command.threadId
+			});
+			const occurredAt = yield* nowIso$8;
+			const nextKey = thread.pinnedAt == null ? null : command.pinOrderKey;
+			const unchanged = (thread.pinOrderKey ?? null) === nextKey;
+			return {
+				...yield* withEventBase({
+					aggregateKind: "thread",
+					aggregateId: command.threadId,
+					occurredAt,
+					commandId: command.commandId
+				}),
+				type: "thread.pin-reordered",
+				payload: {
+					threadId: command.threadId,
+					pinOrderKey: nextKey,
+					updatedAt: unchanged ? thread.updatedAt : occurredAt
+				}
+			};
+		}
 		case "thread.meta.update": {
 			const thread = yield* requireThread({
 				readModel,
@@ -25362,6 +25630,8 @@ const ProjectionThread = Schema$1.Struct({
 	settledAt: Schema$1.NullOr(IsoDateTime),
 	snoozedUntil: Schema$1.NullOr(IsoDateTime),
 	snoozedAt: Schema$1.NullOr(IsoDateTime),
+	pinnedAt: Schema$1.NullOr(IsoDateTime),
+	pinOrderKey: Schema$1.NullOr(Schema$1.String),
 	latestUserMessageAt: Schema$1.NullOr(IsoDateTime),
 	pendingApprovalCount: NonNegativeInt,
 	pendingUserInputCount: NonNegativeInt,
@@ -26255,6 +26525,8 @@ const makeProjectionThreadRepository = Effect.gen(function* () {
           settled_at,
           snoozed_until,
           snoozed_at,
+          pinned_at,
+          pin_order_key,
           latest_user_message_at,
           pending_approval_count,
           pending_user_input_count,
@@ -26282,6 +26554,8 @@ const makeProjectionThreadRepository = Effect.gen(function* () {
           ${row.settledAt},
           ${row.snoozedUntil},
           ${row.snoozedAt},
+          ${row.pinnedAt},
+          ${row.pinOrderKey},
           ${row.latestUserMessageAt},
           ${row.pendingApprovalCount},
           ${row.pendingUserInputCount},
@@ -26309,6 +26583,8 @@ const makeProjectionThreadRepository = Effect.gen(function* () {
           settled_at = excluded.settled_at,
           snoozed_until = excluded.snoozed_until,
           snoozed_at = excluded.snoozed_at,
+          pinned_at = excluded.pinned_at,
+          pin_order_key = excluded.pin_order_key,
           latest_user_message_at = excluded.latest_user_message_at,
           pending_approval_count = excluded.pending_approval_count,
           pending_user_input_count = excluded.pending_user_input_count,
@@ -26341,6 +26617,8 @@ const makeProjectionThreadRepository = Effect.gen(function* () {
           settled_at AS "settledAt",
           snoozed_until AS "snoozedUntil",
           snoozed_at AS "snoozedAt",
+          pinned_at AS "pinnedAt",
+          pin_order_key AS "pinOrderKey",
           latest_user_message_at AS "latestUserMessageAt",
           pending_approval_count AS "pendingApprovalCount",
           pending_user_input_count AS "pendingUserInputCount",
@@ -26375,6 +26653,8 @@ const makeProjectionThreadRepository = Effect.gen(function* () {
           settled_at AS "settledAt",
           snoozed_until AS "snoozedUntil",
           snoozed_at AS "snoozedAt",
+          pinned_at AS "pinnedAt",
+          pin_order_key AS "pinOrderKey",
           latest_user_message_at AS "latestUserMessageAt",
           pending_approval_count AS "pendingApprovalCount",
           pending_user_input_count AS "pendingUserInputCount",
@@ -26969,6 +27249,8 @@ const makeOrchestrationProjectionPipeline = Effect.fn("makeOrchestrationProjecti
 					settledAt: null,
 					snoozedUntil: null,
 					snoozedAt: null,
+					pinnedAt: null,
+					pinOrderKey: null,
 					latestUserMessageAt: null,
 					pendingApprovalCount: 0,
 					pendingUserInputCount: 0,
@@ -27042,6 +27324,38 @@ const makeOrchestrationProjectionPipeline = Effect.fn("makeOrchestrationProjecti
 				});
 				return;
 			}
+			case "thread.pinned": {
+				const existingRow = yield* projectionThreadRepository.getById({ threadId: event.payload.threadId });
+				if (Option.isNone(existingRow)) return;
+				yield* projectionThreadRepository.upsert({
+					...existingRow.value,
+					pinnedAt: event.payload.pinnedAt,
+					...event.payload.pinOrderKey === void 0 ? {} : { pinOrderKey: event.payload.pinOrderKey },
+					updatedAt: event.payload.updatedAt
+				});
+				return;
+			}
+			case "thread.unpinned": {
+				const existingRow = yield* projectionThreadRepository.getById({ threadId: event.payload.threadId });
+				if (Option.isNone(existingRow)) return;
+				yield* projectionThreadRepository.upsert({
+					...existingRow.value,
+					pinnedAt: null,
+					pinOrderKey: null,
+					updatedAt: event.payload.updatedAt
+				});
+				return;
+			}
+			case "thread.pin-reordered": {
+				const existingRow = yield* projectionThreadRepository.getById({ threadId: event.payload.threadId });
+				if (Option.isNone(existingRow)) return;
+				yield* projectionThreadRepository.upsert({
+					...existingRow.value,
+					pinOrderKey: event.payload.pinOrderKey,
+					updatedAt: event.payload.updatedAt
+				});
+				return;
+			}
 			case "thread.meta-updated": {
 				const existingRow = yield* projectionThreadRepository.getById({ threadId: event.payload.threadId });
 				if (Option.isNone(existingRow)) return;
@@ -27616,6 +27930,84 @@ const makeOrchestrationProjectionPipeline = Effect.fn("makeOrchestrationProjecti
 });
 const OrchestrationProjectionPipelineLive = Layer.effect(OrchestrationProjectionPipeline, makeOrchestrationProjectionPipeline()).pipe(Layer.provideMerge(ProjectionProjectRepositoryLive), Layer.provideMerge(ProjectionThreadRepositoryLive), Layer.provideMerge(ProjectionThreadMessageRepositoryLive), Layer.provideMerge(ProjectionThreadProposedPlanRepositoryLive), Layer.provideMerge(ProjectionThreadActivityRepositoryLive), Layer.provideMerge(ProjectionThreadSessionRepositoryLive), Layer.provideMerge(ProjectionTurnRepositoryLive), Layer.provideMerge(ProjectionPendingApprovalRepositoryLive), Layer.provideMerge(ProjectionStateRepositoryLive));
 //#endregion
+//#region src/orchestration/ThreadBackgroundLiveness.ts
+/**
+* ThreadBackgroundLivenessService - in-memory per-thread background liveness
+* for the sidebar status pill.
+*
+* The turn can settle while native background work runs on (subagent fleets,
+* workflow runs, Monitor watch loops); the shell previously showed nothing.
+* Ingestion records task lifecycle transitions and the shell query reads the
+* derived state at mapping time — no persistence, no migration. After a
+* server restart the registry is empty until new task events arrive, which
+* matches reality: orphaned background work is not live.
+*
+* "monitoring" is reserved for watch loops (monitor tasks and background
+* shells) when they are the ONLY live work; any agent work presents as
+* "working".
+*
+* @module ThreadBackgroundLivenessService
+*/
+const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
+	"completed",
+	"failed",
+	"stopped",
+	"cancelled",
+	"interrupted"
+]);
+var ThreadBackgroundLivenessService = class extends Context.Service()("p4code/orchestration/ThreadBackgroundLiveness/ThreadBackgroundLivenessService") {};
+function make$73() {
+	const stateByThreadId = /* @__PURE__ */ new Map();
+	const stateFor = (threadId) => {
+		const existing = stateByThreadId.get(threadId);
+		if (existing) return existing;
+		const created = {
+			agents: /* @__PURE__ */ new Set(),
+			monitors: /* @__PURE__ */ new Set()
+		};
+		stateByThreadId.set(threadId, created);
+		return created;
+	};
+	const drop = (threadId, taskId) => {
+		const state = stateByThreadId.get(threadId);
+		if (!state) return;
+		state.agents.delete(taskId);
+		state.monitors.delete(taskId);
+		if (state.agents.size === 0 && state.monitors.size === 0) stateByThreadId.delete(threadId);
+	};
+	return {
+		recordTaskLiveness: (input) => {
+			const taskType = input.taskType;
+			if (taskType !== void 0 && INERT_TASK_TYPES.has(taskType)) {
+				drop(input.threadId, input.taskId);
+				return;
+			}
+			if (input.agentId !== void 0 && (taskType === void 0 || MONITOR_TASK_TYPES.has(taskType))) {
+				drop(input.threadId, input.taskId);
+				return;
+			}
+			if (input.kind === "completed" || input.status === "idle" || input.status !== void 0 && TERMINAL_STATUSES.has(input.status)) {
+				drop(input.threadId, input.taskId);
+				return;
+			}
+			drop(input.threadId, input.taskId);
+			const state = stateFor(input.threadId);
+			(taskType !== void 0 && MONITOR_TASK_TYPES.has(taskType) ? state.monitors : state.agents).add(input.taskId);
+		},
+		clearThreadLiveness: (threadId) => {
+			stateByThreadId.delete(threadId);
+		},
+		getThreadBackgroundLiveness: (threadId) => {
+			const state = stateByThreadId.get(threadId);
+			if (!state) return null;
+			if (state.agents.size > 0) return "working";
+			if (state.monitors.size > 0) return "monitoring";
+			return null;
+		}
+	};
+}
+const layer$63 = Layer.effect(ThreadBackgroundLivenessService, Effect.sync(make$73));
+//#endregion
 //#region src/persistence/Services/ProjectionCheckpoints.ts
 /**
 * ProjectionCheckpointRepository - Projection repository interface for checkpoints.
@@ -28463,6 +28855,7 @@ function toPersistenceSqlOrDecodeError$1(sqlOperation, decodeOperation) {
 const makeProjectionSnapshotQuery = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
 	const repositoryIdentityResolver = yield* RepositoryIdentityResolver;
+	const threadBackgroundLiveness = yield* ThreadBackgroundLivenessService;
 	const repositoryIdentityResolutionConcurrency = 4;
 	const resolveRepositoryIdentitiesForProjects = Effect.fn("ProjectionSnapshotQuery.resolveRepositoryIdentitiesForProjects")(function* (projectRows, options) {
 		const filteredProjectRows = options?.includeDeleted === true ? projectRows : projectRows.filter((row) => row.deletedAt === null);
@@ -28546,6 +28939,8 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
           settled_at AS "settledAt",
           snoozed_until AS "snoozedUntil",
           snoozed_at AS "snoozedAt",
+          pinned_at AS "pinnedAt",
+          pin_order_key AS "pinOrderKey",
           latest_user_message_at AS "latestUserMessageAt",
           pending_approval_count AS "pendingApprovalCount",
           pending_user_input_count AS "pendingUserInputCount",
@@ -28580,6 +28975,8 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
           settled_at AS "settledAt",
           snoozed_until AS "snoozedUntil",
           snoozed_at AS "snoozedAt",
+          pinned_at AS "pinnedAt",
+          pin_order_key AS "pinOrderKey",
           latest_user_message_at AS "latestUserMessageAt",
           pending_approval_count AS "pendingApprovalCount",
           pending_user_input_count AS "pendingUserInputCount",
@@ -28616,6 +29013,8 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
           settled_at AS "settledAt",
           snoozed_until AS "snoozedUntil",
           snoozed_at AS "snoozedAt",
+          pinned_at AS "pinnedAt",
+          pin_order_key AS "pinOrderKey",
           latest_user_message_at AS "latestUserMessageAt",
           pending_approval_count AS "pendingApprovalCount",
           pending_user_input_count AS "pendingUserInputCount",
@@ -29036,6 +29435,8 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
           settled_at AS "settledAt",
           snoozed_until AS "snoozedUntil",
           snoozed_at AS "snoozedAt",
+          pinned_at AS "pinnedAt",
+          pin_order_key AS "pinOrderKey",
           latest_user_message_at AS "latestUserMessageAt",
           pending_approval_count AS "pendingApprovalCount",
           pending_user_input_count AS "pendingUserInputCount",
@@ -29356,6 +29757,8 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
 			settledAt: row.settledAt,
 			snoozedUntil: row.snoozedUntil,
 			snoozedAt: row.snoozedAt,
+			pinnedAt: row.pinnedAt,
+			pinOrderKey: row.pinOrderKey ?? null,
 			deletedAt: row.deletedAt,
 			messages: messagesByThread.get(row.threadId) ?? [],
 			proposedPlans: proposedPlansByThread.get(row.threadId) ?? [],
@@ -29472,6 +29875,8 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
 				settledAt: row.settledAt,
 				snoozedUntil: row.snoozedUntil,
 				snoozedAt: row.snoozedAt,
+				pinnedAt: row.pinnedAt,
+				pinOrderKey: row.pinOrderKey ?? null,
 				deletedAt: row.deletedAt,
 				messages: [],
 				proposedPlans: proposedPlansByThread.get(row.threadId) ?? [],
@@ -29534,11 +29939,14 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
 				settledAt: row.settledAt,
 				snoozedUntil: row.snoozedUntil,
 				snoozedAt: row.snoozedAt,
+				pinnedAt: row.pinnedAt,
+				pinOrderKey: row.pinOrderKey ?? null,
 				session: sessionByThread.get(row.threadId) ?? null,
 				latestUserMessageAt: row.latestUserMessageAt,
 				hasPendingApprovals: row.pendingApprovalCount > 0,
 				hasPendingUserInput: row.pendingUserInputCount > 0,
 				hasActionableProposedPlan: row.hasActionableProposedPlan > 0,
+				backgroundLiveness: threadBackgroundLiveness.getThreadBackgroundLiveness(row.threadId),
 				hasBackgroundTasks: row.backgroundTaskCount > 0,
 				scheduledWakeAt: row.scheduledWakeAt
 			}) : Result.failVoid),
@@ -29593,11 +30001,14 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
 				settledAt: row.settledAt,
 				snoozedUntil: row.snoozedUntil,
 				snoozedAt: row.snoozedAt,
+				pinnedAt: row.pinnedAt,
+				pinOrderKey: row.pinOrderKey ?? null,
 				session: sessionByThread.get(row.threadId) ?? null,
 				latestUserMessageAt: row.latestUserMessageAt,
 				hasPendingApprovals: row.pendingApprovalCount > 0,
 				hasPendingUserInput: row.pendingUserInputCount > 0,
 				hasActionableProposedPlan: row.hasActionableProposedPlan > 0,
+				backgroundLiveness: threadBackgroundLiveness.getThreadBackgroundLiveness(row.threadId),
 				hasBackgroundTasks: row.backgroundTaskCount > 0,
 				scheduledWakeAt: row.scheduledWakeAt
 			})),
@@ -29702,11 +30113,14 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
 			settledAt: threadRow.value.settledAt,
 			snoozedUntil: threadRow.value.snoozedUntil,
 			snoozedAt: threadRow.value.snoozedAt,
+			pinnedAt: threadRow.value.pinnedAt,
+			pinOrderKey: threadRow.value.pinOrderKey ?? null,
 			session: Option.isSome(sessionRow) ? mapSessionRow(sessionRow.value) : null,
 			latestUserMessageAt: threadRow.value.latestUserMessageAt,
 			hasPendingApprovals: threadRow.value.pendingApprovalCount > 0,
 			hasPendingUserInput: threadRow.value.pendingUserInputCount > 0,
 			hasActionableProposedPlan: threadRow.value.hasActionableProposedPlan > 0,
+			backgroundLiveness: threadBackgroundLiveness.getThreadBackgroundLiveness(threadRow.value.threadId),
 			hasBackgroundTasks: threadRow.value.backgroundTaskCount > 0,
 			scheduledWakeAt: threadRow.value.scheduledWakeAt
 		});
@@ -29743,6 +30157,8 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
 			settledAt: threadRow.value.settledAt,
 			snoozedUntil: threadRow.value.snoozedUntil,
 			snoozedAt: threadRow.value.snoozedAt,
+			pinnedAt: threadRow.value.pinnedAt,
+			pinOrderKey: threadRow.value.pinOrderKey ?? null,
 			deletedAt: null,
 			messages: messageRows.map((row) => {
 				const message = {
@@ -29812,7 +30228,7 @@ const makeProjectionSnapshotQuery = Effect.gen(function* () {
 		getThreadDetailSnapshot
 	};
 });
-const OrchestrationProjectionSnapshotQueryLive = Layer.effect(ProjectionSnapshotQuery, makeProjectionSnapshotQuery);
+const OrchestrationProjectionSnapshotQueryLive = Layer.effect(ProjectionSnapshotQuery, makeProjectionSnapshotQuery).pipe(Layer.provide(layer$63));
 //#endregion
 //#region src/orchestration/Services/ThreadEventStream.ts
 var ThreadEventStreamService = class extends Context.Service()("@p4code/cli/orchestration/Services/ThreadEventStream/ThreadEventStreamService") {};
@@ -29871,7 +30287,14 @@ const ThreadEventStreamLive = Layer.effect(ThreadEventStreamService, makeThreadE
 //#region src/orchestration/runtimeLayer.ts
 const OrchestrationEventInfrastructureLayerLive = Layer.mergeAll(OrchestrationEventStoreLive, OrchestrationCommandReceiptRepositoryLive);
 const OrchestrationProjectionPipelineLayerLive = OrchestrationProjectionPipelineLive.pipe(Layer.provide(OrchestrationEventStoreLive));
-const OrchestrationInfrastructureLayerLive = Layer.mergeAll(OrchestrationProjectionSnapshotQueryLive, OrchestrationEventInfrastructureLayerLive, OrchestrationProjectionPipelineLayerLive);
+/**
+* In-memory registry of background work that outlives a turn. Exported as one
+* reference on purpose: the snapshot query reads liveness while provider
+* ingestion writes it, and layers memoize by reference, so both must receive
+* THIS layer or they would each get their own empty registry.
+*/
+const ThreadBackgroundLivenessLayerLive = layer$63;
+const OrchestrationInfrastructureLayerLive = Layer.mergeAll(OrchestrationProjectionSnapshotQueryLive, OrchestrationEventInfrastructureLayerLive, OrchestrationProjectionPipelineLayerLive, ThreadBackgroundLivenessLayerLive);
 const OrchestrationEngineLayerLive = OrchestrationEngineLive.pipe(Layer.provide(OrchestrationInfrastructureLayerLive));
 const OrchestrationLayerLive = Layer.mergeAll(OrchestrationInfrastructureLayerLive, OrchestrationEngineLayerLive, ThreadEventStreamLive.pipe(Layer.provide(OrchestrationEngineLayerLive)));
 //#endregion
@@ -32091,6 +32514,7 @@ const make$64 = Effect.gen(function* () {
 			pullRequests: true,
 			threadSettlement: true,
 			threadSnooze: true,
+			threadPinning: true,
 			...serverSelfUpdate === null ? {} : { serverSelfUpdate },
 			...serverServiceSupervised ? { serverServiceSupervised } : {}
 		}
@@ -33735,7 +34159,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}));
-		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$79(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
+		const offlineRuntimeLayer = ProjectCliRuntimeLive.pipe(Layer.provide(layer$80(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)));
 		return yield* Effect.gen(function* () {
 			const snapshot = yield* getOfflineSnapshot();
 			const orchestrationEngine = yield* OrchestrationEngineService;
@@ -33746,7 +34170,7 @@ const runProjectMutation = Effect.fn("runProjectMutation")(function* (flags, run
 			});
 			yield* Console.log(output);
 		}).pipe(Effect.provide(offlineRuntimeLayer));
-	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$52).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$79(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
+	}).pipe(Effect.provide(Layer.mergeAll(runtimeLayer, layer$52).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provide(layer$80(config)), Layer.provide(Layer.succeed(References.MinimumLogLevel, minimumLogLevel)))));
 });
 const projectAddCommand = Command.make("add", {
 	...projectLocationFlags,
@@ -40506,6 +40930,24 @@ const makeLinearApiTransport = Effect.gen(function* () {
 * @module tracker/LinearClient
 */
 var LinearClient = class extends Context.Service()("@p4code/cli/tracker/LinearClient") {};
+/**
+* How much of a stored key the settings row may show.
+*
+* The prefix identifies the provider (`lin_api_`) and the suffix is enough to
+* tell two keys apart when one is being replaced. The bullet run is a fixed
+* width rather than the number of characters hidden, so the mask says nothing
+* about how long the key is.
+*/
+const MASK_PREFIX_CHARS = 8;
+const MASK_BULLETS = "•".repeat(8);
+/**
+* A stored key rendered for display, never for use.
+*
+* A key too short to reveal both ends without meeting in the middle is shown
+* as bullets alone: a mask that gives away most of a short key is worse than
+* one that gives away nothing.
+*/
+const maskApiKey = (apiKey) => apiKey.length > 12 ? `${apiKey.slice(0, MASK_PREFIX_CHARS)}${MASK_BULLETS}${apiKey.slice(-4)}` : MASK_BULLETS;
 const makeLinearClient = Effect.gen(function* () {
 	const secrets = yield* TrackerSecrets;
 	const api = yield* makeLinearApiTransport;
@@ -40524,12 +40966,14 @@ const makeLinearClient = Effect.gen(function* () {
 		if (Option.isSome(credential)) return {
 			provider: "linear",
 			mode: "api",
-			workspace: credential.value.workspace
+			workspace: credential.value.workspace,
+			maskedKey: maskApiKey(credential.value.apiKey)
 		};
 		return {
 			provider: "linear",
 			mode: (yield* mcp.isConfigured) ? "mcp" : "none",
-			workspace: null
+			workspace: null,
+			maskedKey: null
 		};
 	});
 	const setApiKey = (apiKey) => Effect.gen(function* () {
@@ -42436,8 +42880,32 @@ const resolveClaudeHomePath = Effect.fn("resolveClaudeHomePath")(function* (conf
 	const homePath = config.homePath.trim();
 	return path.resolve(homePath.length > 0 ? expandHomePath$3(homePath) : NodeOS.homedir());
 });
+/**
+* The macOS login keychain stores the CLI's OAuth credentials under the account
+* name in `USER`. A server started outside a login shell — a desktop app
+* launched from Finder, a launchd job — can hand the child an environment
+* without it, and the CLI then reports no subscription at all rather than
+* failing: `/usage` quietly answers with the session cost report instead of the
+* account's limits. Filling the name back in keeps the lookup working.
+*/
+function withProcessUserName(env) {
+	if (env.USER?.trim() && env.LOGNAME?.trim()) return env;
+	const username = (() => {
+		try {
+			return NodeOS.userInfo().username;
+		} catch {
+			return "";
+		}
+	})();
+	if (username.length === 0) return env;
+	return {
+		...env,
+		...env.USER?.trim() ? {} : { USER: username },
+		...env.LOGNAME?.trim() ? {} : { LOGNAME: username }
+	};
+}
 const makeClaudeEnvironment = Effect.fn("makeClaudeEnvironment")(function* (config, baseEnv) {
-	const resolvedBaseEnv = baseEnv ?? process.env;
+	const resolvedBaseEnv = withProcessUserName(baseEnv ?? process.env);
 	if (config.homePath.trim().length === 0) return resolvedBaseEnv;
 	const resolvedHomePath = yield* resolveClaudeHomePath(config);
 	return {
@@ -64555,7 +65023,7 @@ const makeOpenCodeRuntime = Effect.gen(function* () {
 	};
 });
 var OpenCodeRuntime = class extends Context.Service()("@p4code/cli/provider/opencodeRuntime") {};
-const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$80));
+const OpenCodeRuntimeLive = Layer.effect(OpenCodeRuntime, makeOpenCodeRuntime).pipe(Layer.provide(layer$81));
 //#endregion
 //#region src/textGeneration/TextGenerationUtils.ts
 const isTextGenerationError$3 = Schema$1.is(TextGenerationError);
@@ -65663,7 +66131,7 @@ const makePendingClaudeProvider = (claudeSettings) => Effect.gen(function* () {
 */
 const CLAUDE_TIMEOUT_MS = 18e4;
 /** The usage report is a local lookup, so it should return in seconds, not minutes. */
-const USAGE_REPORT_TIMEOUT_MS = 6e4;
+const USAGE_REPORT_TIMEOUT_MS$1 = 6e4;
 /**
 * Schema for the wrapper JSON returned by `claude -p --output-format json`.
 * We only care about `structured_output`.
@@ -65674,6 +66142,16 @@ const ClaudeOutputEnvelope = Schema$1.Struct({ structured_output: Schema$1.Unkno
 * CLI-local command, so this costs no turn and no tokens.
 */
 const ClaudeResultEnvelope = Schema$1.Struct({ result: Schema$1.String });
+const USAGE_LIMIT_LINE = /^.+:\s+\d+(?:\.\d+)?%\s+used/mu;
+/**
+* When the CLI cannot resolve the account behind its config directory it does
+* not fail: it prints the session's own cost summary — all zeroes for a
+* one-shot run — in place of the account's limits. Only a report that carries a
+* limit line is the report that was asked for.
+*/
+function isClaudeUsageReport(report) {
+	return USAGE_LIMIT_LINE.test(report);
+}
 const encodeJsonString$2 = Schema$1.encodeEffect(Schema$1.UnknownFromJsonString);
 const decodeClaudeOutputEnvelope = Schema$1.decodeEffect(Schema$1.fromJsonString(ClaudeOutputEnvelope));
 const decodeClaudeResultEnvelope = Schema$1.decodeEffect(Schema$1.fromJsonString(ClaudeResultEnvelope));
@@ -65861,18 +66339,23 @@ const makeClaudeTextGeneration = Effect.fn("makeClaudeTextGeneration")(function*
 					});
 				}
 				return stdout;
-			})().pipe(Effect.scoped, Effect.timeoutOption(USAGE_REPORT_TIMEOUT_MS), Effect.flatMap(Option.match({
+			})().pipe(Effect.scoped, Effect.timeoutOption(USAGE_REPORT_TIMEOUT_MS$1), Effect.flatMap(Option.match({
 				onNone: () => Effect.fail(new TextGenerationError({
 					operation,
 					detail: "Claude CLI request timed out."
 				})),
 				onSome: (value) => Effect.succeed(value)
 			})));
-			return { report: (yield* decodeClaudeResultEnvelope(rawStdout).pipe(Effect.catchTags({ SchemaError: (cause) => Effect.fail(new TextGenerationError({
+			const report = (yield* decodeClaudeResultEnvelope(rawStdout).pipe(Effect.catchTags({ SchemaError: (cause) => Effect.fail(new TextGenerationError({
 				operation,
 				detail: "Claude CLI returned unexpected output format.",
 				cause
-			})) }))).result.trim() };
+			})) }))).result.trim();
+			if (!isClaudeUsageReport(report)) return yield* new TextGenerationError({
+				operation,
+				detail: "Claude CLI answered with its session cost summary instead of the account report. That means it could not read the subscription behind its config directory - run `claude /login` for this instance's CLAUDE_CONFIG_DIR and try again."
+			});
+			return { report };
 		})
 	};
 });
@@ -69144,529 +69627,6 @@ const ClaudeDriver = {
 		};
 	})
 };
-const resolveCodexLaunchArgs = (launchArgs, environment = process.env) => environment["P4CODE_CODEX_LAUNCH_ARGS"]?.trim() || launchArgs?.trim() || "";
-const codexLaunchArgv = (launchArgs) => tokenizeCliArgs(launchArgs);
-const codexAppServerArgs = (launchArgs) => ["app-server", ...codexLaunchArgv(launchArgs)];
-const codexExecLaunchArgs = (launchArgs) => {
-	const args = codexLaunchArgv(launchArgs);
-	const execArgs = [];
-	for (let index = 0; index < args.length; index++) {
-		const arg = args[index];
-		if (arg === void 0) continue;
-		if (arg === "--strict-config" || arg.startsWith("--config=") || arg.startsWith("-c=")) execArgs.push(arg);
-		else if (arg === "--config" || arg === "-c" || arg === "--enable" || arg === "--disable") {
-			const value = args[index + 1];
-			if (value !== void 0 && !value.startsWith("-")) {
-				execArgs.push(arg, value);
-				index++;
-			}
-		} else if (arg.startsWith("--enable=") || arg.startsWith("--disable=")) execArgs.push(arg);
-	}
-	return execArgs;
-};
-const codexSessionAppServerArgs = (appServerArgs, launchArgs) => {
-	const launchAppServerArgs = codexAppServerArgs(launchArgs);
-	return appServerArgs ? [...launchAppServerArgs, ...appServerArgs] : launchAppServerArgs;
-};
-//#endregion
-//#region src/codexModelOptions.ts
-function getCodexServiceTierOptionValue(modelSelection) {
-	return getModelSelectionStringOptionValue(modelSelection, "serviceTier") ?? (getModelSelectionBooleanOptionValue(modelSelection, "fastMode") === true ? "fast" : void 0);
-}
-//#endregion
-//#region src/textGeneration/CodexTextGeneration.ts
-const CODEX_GIT_TEXT_GENERATION_REASONING_EFFORT = "low";
-const CODEX_TIMEOUT_MS = 18e4;
-const encodeJsonString$1 = Schema$1.encodeEffect(Schema$1.UnknownFromJsonString);
-/**
-* Build a Codex text-generation closure bound to a specific `CodexSettings`
-* payload. See `makeCodexAdapter` for the overall per-instance rationale.
-*/
-const makeCodexTextGeneration = Effect.fn("makeCodexTextGeneration")(function* (codexConfig, environment) {
-	const fileSystem = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	const commandSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const serverConfig = yield* Effect.service(ServerConfig$1);
-	const resolvedEnvironment = environment ?? process.env;
-	const readStreamAsString = (operation, stream) => stream.pipe(Stream.decodeText(), Stream.runFold(() => "", (acc, chunk) => acc + chunk), Effect.mapError((cause) => normalizeCliError("codex", operation, cause, "Failed to collect process output")));
-	const writeTempFile = (operation, prefix, content) => fileSystem.makeTempFileScoped({ prefix: `p4code-${prefix}-${process.pid}-` }).pipe(Effect.tap((filePath) => fileSystem.writeFileString(filePath, content)), Effect.mapError((cause) => new TextGenerationError({
-		operation,
-		detail: `Failed to write temp file`,
-		cause
-	})));
-	const safeUnlink = (filePath) => fileSystem.remove(filePath).pipe(Effect.catch(() => Effect.void));
-	const encodeJsonForOperation = (operation, value) => encodeJsonString$1(value).pipe(Effect.mapError((cause) => new TextGenerationError({
-		operation,
-		detail: "Failed to encode structured output schema.",
-		cause
-	})));
-	const materializeImageAttachments = Effect.fn("materializeImageAttachments")(function* (_operation, attachments) {
-		if (!attachments || attachments.length === 0) return { imagePaths: [] };
-		const imagePaths = [];
-		for (const attachment of attachments) {
-			if (attachment.type !== "image") continue;
-			const resolvedPath = resolveAttachmentPath({
-				attachmentsDir: serverConfig.attachmentsDir,
-				attachment
-			});
-			if (!resolvedPath || !path.isAbsolute(resolvedPath)) continue;
-			const fileInfo = yield* fileSystem.stat(resolvedPath).pipe(Effect.orElseSucceed(() => null));
-			if (!fileInfo || fileInfo.type !== "File") continue;
-			imagePaths.push(resolvedPath);
-		}
-		return { imagePaths };
-	});
-	const runCodexJson = Effect.fn("runCodexJson")(function* ({ operation, cwd, prompt, outputSchemaJson, imagePaths = [], cleanupPaths = [], modelSelection }) {
-		const schemaJson = yield* encodeJsonForOperation(operation, toJsonSchemaObject(outputSchemaJson));
-		const schemaPath = yield* writeTempFile(operation, "codex-schema", schemaJson);
-		const outputPath = yield* writeTempFile(operation, "codex-output", "");
-		const runCodexCommand = Effect.fn("runCodexJson.runCodexCommand")(function* () {
-			const launchArgs = resolveCodexLaunchArgs(codexConfig.launchArgs, resolvedEnvironment);
-			const reasoningEffort = getModelSelectionStringOptionValue(modelSelection, "reasoningEffort") ?? CODEX_GIT_TEXT_GENERATION_REASONING_EFFORT;
-			const serviceTier = getCodexServiceTierOptionValue(modelSelection);
-			const spawnCommand = yield* resolveSpawnCommand(codexConfig.binaryPath || "codex", [
-				"exec",
-				...codexExecLaunchArgs(launchArgs),
-				"--ephemeral",
-				"--skip-git-repo-check",
-				"-s",
-				"read-only",
-				"--model",
-				modelSelection.model,
-				"--config",
-				`model_reasoning_effort="${reasoningEffort}"`,
-				...serviceTier ? ["--config", `service_tier="${serviceTier}"`] : [],
-				"--output-schema",
-				schemaPath,
-				"--output-last-message",
-				outputPath,
-				...imagePaths.flatMap((imagePath) => ["--image", imagePath]),
-				"-"
-			], { env: resolvedEnvironment });
-			const command = ChildProcess.make(spawnCommand.command, spawnCommand.args, {
-				env: {
-					...resolvedEnvironment,
-					...codexConfig.homePath ? { CODEX_HOME: expandHomePath$3(codexConfig.homePath) } : {}
-				},
-				cwd,
-				shell: spawnCommand.shell,
-				stdin: { stream: Stream.encodeText(Stream.make(prompt)) }
-			});
-			const child = yield* commandSpawner.spawn(command).pipe(Effect.mapError((cause) => normalizeCliError("codex", operation, cause, "Failed to spawn Codex CLI process")));
-			const [stdout, stderr, exitCode] = yield* Effect.all([
-				readStreamAsString(operation, child.stdout),
-				readStreamAsString(operation, child.stderr),
-				child.exitCode.pipe(Effect.mapError((cause) => normalizeCliError("codex", operation, cause, "Failed to read Codex CLI exit code")))
-			], { concurrency: "unbounded" });
-			if (exitCode !== 0) {
-				const stderrDetail = stderr.trim();
-				const stdoutDetail = stdout.trim();
-				const detail = stderrDetail.length > 0 ? stderrDetail : stdoutDetail;
-				return yield* new TextGenerationError({
-					operation,
-					detail: detail.length > 0 ? `Codex CLI command failed: ${detail}` : `Codex CLI command failed with code ${exitCode}.`
-				});
-			}
-		});
-		const cleanup = Effect.all([
-			schemaPath,
-			outputPath,
-			...cleanupPaths
-		].map((filePath) => safeUnlink(filePath)), { concurrency: "unbounded" }).pipe(Effect.asVoid);
-		return yield* Effect.gen(function* () {
-			yield* runCodexCommand().pipe(Effect.scoped, Effect.timeoutOption(CODEX_TIMEOUT_MS), Effect.flatMap(Option.match({
-				onNone: () => Effect.fail(new TextGenerationError({
-					operation,
-					detail: "Codex CLI request timed out."
-				})),
-				onSome: () => Effect.void
-			})));
-			const decodeOutput = Schema$1.decodeEffect(Schema$1.fromJsonString(outputSchemaJson));
-			return yield* fileSystem.readFileString(outputPath).pipe(Effect.mapError((cause) => new TextGenerationError({
-				operation,
-				detail: "Failed to read Codex output file.",
-				cause
-			})), Effect.flatMap(decodeOutput), Effect.catchTags({ SchemaError: (cause) => Effect.fail(new TextGenerationError({
-				operation,
-				detail: "Codex returned invalid structured output.",
-				cause
-			})) }));
-		}).pipe(Effect.ensuring(cleanup));
-	});
-	return {
-		generateCommitMessage: Effect.fn("CodexTextGeneration.generateCommitMessage")(function* (input) {
-			const { prompt, outputSchema } = buildCommitMessagePrompt({
-				branch: input.branch,
-				stagedSummary: input.stagedSummary,
-				stagedPatch: input.stagedPatch,
-				includeBranch: input.includeBranch === true,
-				policy: input.policy
-			});
-			const generated = yield* runCodexJson({
-				operation: "generateCommitMessage",
-				cwd: input.cwd,
-				prompt,
-				outputSchemaJson: outputSchema,
-				modelSelection: input.modelSelection
-			});
-			return {
-				subject: sanitizeCommitSubject(generated.subject),
-				body: generated.body.trim(),
-				..."branch" in generated && typeof generated.branch === "string" ? { branch: sanitizeFeatureBranchName(generated.branch) } : {}
-			};
-		}),
-		generatePrContent: Effect.fn("CodexTextGeneration.generatePrContent")(function* (input) {
-			const { prompt, outputSchema } = buildPrContentPrompt({
-				baseBranch: input.baseBranch,
-				headBranch: input.headBranch,
-				commitSummary: input.commitSummary,
-				diffSummary: input.diffSummary,
-				diffPatch: input.diffPatch,
-				policy: input.policy,
-				changeRequestTemplate: input.changeRequestTemplate
-			});
-			const generated = yield* runCodexJson({
-				operation: "generatePrContent",
-				cwd: input.cwd,
-				prompt,
-				outputSchemaJson: outputSchema,
-				modelSelection: input.modelSelection
-			});
-			return {
-				title: sanitizePrTitle(generated.title),
-				body: generated.body.trim()
-			};
-		}),
-		generateBranchName: Effect.fn("CodexTextGeneration.generateBranchName")(function* (input) {
-			const { imagePaths } = yield* materializeImageAttachments("generateBranchName", input.attachments);
-			const { prompt, outputSchema } = buildBranchNamePrompt({
-				message: input.message,
-				attachments: input.attachments
-			});
-			return { branch: sanitizeBranchFragment((yield* runCodexJson({
-				operation: "generateBranchName",
-				cwd: input.cwd,
-				prompt,
-				outputSchemaJson: outputSchema,
-				imagePaths,
-				modelSelection: input.modelSelection
-			})).branch) };
-		}),
-		generateThreadTitle: Effect.fn("CodexTextGeneration.generateThreadTitle")(function* (input) {
-			const { imagePaths } = yield* materializeImageAttachments("generateThreadTitle", input.attachments);
-			const { prompt, outputSchema } = buildThreadTitlePrompt({
-				message: input.message,
-				attachments: input.attachments
-			});
-			return { title: sanitizeThreadTitle((yield* runCodexJson({
-				operation: "generateThreadTitle",
-				cwd: input.cwd,
-				prompt,
-				outputSchemaJson: outputSchema,
-				imagePaths,
-				modelSelection: input.modelSelection
-			})).title) };
-		})
-	};
-});
-//#endregion
-//#region ../../packages/effect-codex-app-server/src/errors.ts
-const CodexAppServerRequestOperation = Schema$1.Literals([
-	"decode-payload",
-	"encode-payload",
-	"handle-request",
-	"receive-response"
-]);
-const CodexAppServerSchemaIssueKind = Schema$1.Literals([
-	"Filter",
-	"Encoding",
-	"Pointer",
-	"Composite",
-	"AnyOf",
-	"InvalidType",
-	"InvalidValue",
-	"MissingKey",
-	"UnexpectedKey",
-	"Forbidden",
-	"OneOf"
-]);
-const schemaIssueDiagnostics$1 = (root) => {
-	let issueCount = 0;
-	let maximumPathDepth = 0;
-	const issueKinds = /* @__PURE__ */ new Set();
-	const visit = (issue, pathDepth) => {
-		issueCount += 1;
-		issueKinds.add(issue._tag);
-		maximumPathDepth = Math.max(maximumPathDepth, pathDepth);
-		switch (issue._tag) {
-			case "Filter":
-			case "Encoding":
-				visit(issue.issue, pathDepth);
-				break;
-			case "Pointer":
-				visit(issue.issue, pathDepth + issue.path.length);
-				break;
-			case "Composite":
-			case "AnyOf":
-				for (const child of issue.issues) visit(child, pathDepth);
-				break;
-		}
-	};
-	visit(root, 0);
-	return {
-		issueCount,
-		issueKinds: [...issueKinds],
-		maximumPathDepth
-	};
-};
-const CodexAppServerPayloadKind = Schema$1.Literals([
-	"null",
-	"array",
-	"string",
-	"number",
-	"boolean",
-	"bigint",
-	"object",
-	"symbol",
-	"function",
-	"undefined"
-]);
-const payloadKind = (payload) => {
-	if (payload === null) return "null";
-	if (Array.isArray(payload)) return "array";
-	return typeof payload;
-};
-const protocolMessageFields = [
-	"id",
-	"method",
-	"params",
-	"result",
-	"error"
-];
-const CodexAppServerProtocolMessageField = Schema$1.Literals(protocolMessageFields);
-const CodexAppServerProtocolParseOperation = Schema$1.Literals([
-	"encode-wire-message",
-	"decode-wire-message",
-	"route-wire-message",
-	"decode-notification-payload",
-	"decode-request-payload",
-	"decode-response-payload"
-]);
-const CodexAppServerTransportOperation = Schema$1.Literals(["read-input-stream", "read-process-exit-status"]);
-const CodexAppServerIdentifierPurpose = Schema$1.Literals([
-	"provider-event",
-	"command-approval-request",
-	"file-change-approval-request",
-	"user-input-request"
-]);
-var CodexAppServerSpawnError = class extends Schema$1.TaggedErrorClass()("CodexAppServerSpawnError", {
-	command: Schema$1.optional(Schema$1.String),
-	cause: Schema$1.Defect()
-}) {
-	get message() {
-		return this.command ? `Failed to spawn Codex App Server process for command: ${this.command}` : "Failed to spawn Codex App Server process";
-	}
-};
-var CodexAppServerProcessExitedError = class extends Schema$1.TaggedErrorClass()("CodexAppServerProcessExitedError", {
-	code: Schema$1.optional(Schema$1.Number),
-	pid: Schema$1.optionalKey(Schema$1.Int),
-	cause: Schema$1.optional(Schema$1.Defect())
-}) {
-	get message() {
-		return this.code === void 0 ? "Codex App Server process exited" : `Codex App Server process exited with code ${this.code}`;
-	}
-};
-var CodexAppServerProtocolParseError = class CodexAppServerProtocolParseError extends Schema$1.TaggedErrorClass()("CodexAppServerProtocolParseError", {
-	operation: CodexAppServerProtocolParseOperation,
-	method: Schema$1.optionalKey(Schema$1.String),
-	requestId: Schema$1.optionalKey(Schema$1.String),
-	payloadKind: Schema$1.optionalKey(CodexAppServerPayloadKind),
-	presentFields: Schema$1.optionalKey(Schema$1.Array(CodexAppServerProtocolMessageField)),
-	issueCount: Schema$1.optionalKey(Schema$1.Number),
-	issueKinds: Schema$1.optionalKey(Schema$1.Array(CodexAppServerSchemaIssueKind)),
-	maximumPathDepth: Schema$1.optionalKey(Schema$1.Number),
-	cause: Schema$1.optional(Schema$1.Defect())
-}) {
-	get message() {
-		const method = this.method === void 0 ? "" : ` for method '${this.method}'`;
-		return `Codex App Server protocol operation '${this.operation}' failed${method}.`;
-	}
-	static fromSchemaError(operation, cause, context = {}) {
-		return new CodexAppServerProtocolParseError({
-			operation,
-			...context,
-			...schemaIssueDiagnostics$1(cause.issue),
-			cause
-		});
-	}
-	static fromRequestError(operation, method, cause) {
-		return new CodexAppServerProtocolParseError({
-			operation,
-			method,
-			...cause.issueCount === void 0 ? {} : { issueCount: cause.issueCount },
-			...cause.issueKinds === void 0 ? {} : { issueKinds: cause.issueKinds },
-			...cause.maximumPathDepth === void 0 ? {} : { maximumPathDepth: cause.maximumPathDepth },
-			cause
-		});
-	}
-	static fromUnroutableMessage(message) {
-		const diagnostics = { payloadKind: payloadKind(message) };
-		if (typeof message !== "object" || message === null || Array.isArray(message)) return new CodexAppServerProtocolParseError({
-			operation: "route-wire-message",
-			...diagnostics
-		});
-		const presentFields = protocolMessageFields.filter((field) => field in message);
-		const method = "method" in message && typeof message.method === "string" ? message.method : void 0;
-		const requestId = "id" in message && (typeof message.id === "string" || typeof message.id === "number") ? String(message.id) : void 0;
-		return new CodexAppServerProtocolParseError({
-			operation: "route-wire-message",
-			...diagnostics,
-			presentFields,
-			...method === void 0 ? {} : { method },
-			...requestId === void 0 ? {} : { requestId }
-		});
-	}
-};
-var CodexAppServerTransportError = class extends Schema$1.TaggedErrorClass()("CodexAppServerTransportError", {
-	operation: CodexAppServerTransportOperation,
-	pid: Schema$1.optionalKey(Schema$1.Int),
-	cause: Schema$1.Defect()
-}) {
-	get message() {
-		return `Codex App Server transport operation '${this.operation}' failed.`;
-	}
-};
-var CodexAppServerIdentifierGenerationError = class extends Schema$1.TaggedErrorClass()("CodexAppServerIdentifierGenerationError", {
-	purpose: CodexAppServerIdentifierPurpose,
-	cause: Schema$1.Defect()
-}) {
-	get message() {
-		return `Failed to generate Codex App Server identifier for ${this.purpose}.`;
-	}
-};
-var CodexAppServerInputStreamEndedError = class extends Schema$1.TaggedErrorClass()("CodexAppServerInputStreamEndedError", {}) {
-	get message() {
-		return "Codex App Server input stream ended.";
-	}
-};
-var CodexAppServerRequestError = class CodexAppServerRequestError extends Schema$1.TaggedErrorClass()("CodexAppServerRequestError", {
-	code: Schema$1.Number,
-	errorMessage: Schema$1.String,
-	data: Schema$1.optional(Schema$1.Unknown),
-	method: Schema$1.optionalKey(Schema$1.String),
-	requestId: Schema$1.optionalKey(Schema$1.String),
-	operation: Schema$1.optionalKey(CodexAppServerRequestOperation),
-	issueCount: Schema$1.optionalKey(Schema$1.Number),
-	issueKinds: Schema$1.optionalKey(Schema$1.Array(CodexAppServerSchemaIssueKind)),
-	maximumPathDepth: Schema$1.optionalKey(Schema$1.Number),
-	payloadKind: Schema$1.optionalKey(CodexAppServerPayloadKind),
-	cause: Schema$1.optionalKey(Schema$1.Defect())
-}) {
-	get message() {
-		return this.errorMessage;
-	}
-	static fromProtocolError(error, method, requestId) {
-		return new CodexAppServerRequestError({
-			code: error.code,
-			errorMessage: error.message,
-			...error.data !== void 0 ? { data: error.data } : {},
-			method,
-			requestId,
-			operation: "receive-response",
-			cause: error
-		});
-	}
-	static fromAppServerError(error, method) {
-		if (error._tag === "CodexAppServerRequestError") return error;
-		return CodexAppServerRequestError.internalError(`Codex App Server request handler failed for method '${method}'`, void 0, {
-			method,
-			operation: "handle-request",
-			cause: error
-		});
-	}
-	static parseError(message = "Parse error", data) {
-		return new CodexAppServerRequestError({
-			code: -32700,
-			errorMessage: message,
-			...data !== void 0 ? { data } : {}
-		});
-	}
-	static invalidRequest(message = "Invalid request", data) {
-		return new CodexAppServerRequestError({
-			code: -32600,
-			errorMessage: message,
-			...data !== void 0 ? { data } : {}
-		});
-	}
-	static methodNotFound(method) {
-		return new CodexAppServerRequestError({
-			code: -32601,
-			errorMessage: `Method not found: ${method}`
-		});
-	}
-	static invalidParams(message = "Invalid params", data, diagnostics = {}) {
-		return new CodexAppServerRequestError({
-			code: -32602,
-			errorMessage: message,
-			...data !== void 0 ? { data } : {},
-			...diagnostics
-		});
-	}
-	static invalidPayload(method, operation, cause) {
-		const diagnostics = schemaIssueDiagnostics$1(cause.issue);
-		return new CodexAppServerRequestError({
-			code: -32602,
-			errorMessage: `Invalid payload for method '${method}' during '${operation}'`,
-			data: diagnostics,
-			method,
-			operation,
-			...diagnostics,
-			cause
-		});
-	}
-	static unexpectedPayload(method, operation, payload) {
-		const diagnostics = { payloadKind: payloadKind(payload) };
-		return new CodexAppServerRequestError({
-			code: -32602,
-			errorMessage: `Method '${method}' does not accept a payload during '${operation}'`,
-			data: diagnostics,
-			method,
-			operation,
-			...diagnostics
-		});
-	}
-	static internalError(message = "Internal error", data, diagnostics = {}) {
-		return new CodexAppServerRequestError({
-			code: -32603,
-			errorMessage: message,
-			...data !== void 0 ? { data } : {},
-			...diagnostics
-		});
-	}
-	static overloaded(message = "Server overloaded; retry later.", data) {
-		return new CodexAppServerRequestError({
-			code: -32001,
-			errorMessage: message,
-			...data !== void 0 ? { data } : {}
-		});
-	}
-	toProtocolError() {
-		return {
-			code: this.code,
-			message: this.errorMessage,
-			...this.data !== void 0 ? { data: this.data } : {}
-		};
-	}
-};
-const CodexAppServerError = Schema$1.Union([
-	CodexAppServerRequestError,
-	CodexAppServerSpawnError,
-	CodexAppServerProcessExitedError,
-	CodexAppServerProtocolParseError,
-	CodexAppServerTransportError,
-	CodexAppServerIdentifierGenerationError,
-	CodexAppServerInputStreamEndedError
-]);
 //#endregion
 //#region ../../packages/effect-codex-app-server/src/_generated/schema.gen.ts
 const ApplyPatchApprovalParams__FileChange = Schema$1.Union([
@@ -87129,80 +87089,303 @@ const SERVER_NOTIFICATION_PARAMS = {
 	"account/login/completed": V2AccountLoginCompletedNotification
 };
 //#endregion
-//#region src/provider/Layers/codexMcpArgs.ts
-/** Codex's own name for the token variable of p4code's built-in server. */
-const CODEX_P4CODE_BEARER_TOKEN_ENV_VAR = "P4_MCP_BEARER_TOKEN";
-/** Prefix for the per-server variables the registered servers get. */
-const BEARER_TOKEN_ENV_VAR_PREFIX = "P4_MCP_BEARER_TOKEN_";
-/** TOML bare keys; anything else has to be quoted inside the dotted path. */
-const BARE_KEY = /^[A-Za-z0-9_-]+$/;
-const AUTHORIZATION_HEADER = "authorization";
-const BEARER_PREFIX = /^Bearer\s+/;
-const configKey = (name, field) => `mcp_servers.${BARE_KEY.test(name) ? name : JSON.stringify(name)}.${field}`;
-/**
-* A variable name derived from the server's, uniquely.
-*
-* Uppercased with every character a shell would not accept replaced, which can
-* collide (`a.b` and `a-b`), so the sanitized name is the prefix and the index
-* keeps it unique. The index is stable within one call, which is all that is
-* needed: the variable and the reference to it are emitted together.
-*/
-const bearerTokenEnvVar = (name, index) => `${BEARER_TOKEN_ENV_VAR_PREFIX}${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_${index}`;
-/**
-* @param resolved - Servers keyed by name, as the registry resolved them.
-* @param exclude - Names p4code declares itself. A registration cannot displace
-*   the built-in `p4-code` server, whose per-thread credential is the only
-*   thing that makes `task_current` and the thread tools work.
-*/
-const toCodexMcpConfig = (resolved, exclude = /* @__PURE__ */ new Set()) => {
-	const args = [];
-	const env = {};
-	const skipped = [];
-	const push = (name, field, value) => {
-		args.push("-c", `${configKey(name, field)}=${value}`);
-	};
-	let index = 0;
-	for (const [name, server] of Object.entries(resolved)) {
-		if (exclude.has(name)) continue;
-		if (server.type === "stdio") {
-			push(name, "command", JSON.stringify(server.command));
-			push(name, "args", JSON.stringify(server.args));
-			if (Object.keys(server.env).length > 0) push(name, "env", `{ ${Object.entries(server.env).map(([key, value]) => `${JSON.stringify(key)} = ${JSON.stringify(value)}`).join(", ")} }`);
-			index += 1;
-			continue;
-		}
-		if (server.type === "sse") {
-			skipped.push({
-				name,
-				reason: "Codex speaks streamable HTTP, not SSE."
-			});
-			continue;
-		}
-		const headerNames = Object.keys(server.headers);
-		const authorization = headerNames.find((key) => key.toLowerCase() === AUTHORIZATION_HEADER);
-		const otherHeaders = headerNames.filter((key) => key !== authorization);
-		if (otherHeaders.length > 0) {
-			skipped.push({
-				name,
-				reason: `Codex sends no custom headers, and this server needs ${otherHeaders.join(", ")}.`
-			});
-			continue;
-		}
-		push(name, "url", JSON.stringify(server.url));
-		if (authorization !== void 0) {
-			const token = server.headers[authorization]?.replace(BEARER_PREFIX, "") ?? "";
-			const variable = bearerTokenEnvVar(name, index);
-			env[variable] = token;
-			push(name, "bearer_token_env_var", JSON.stringify(variable));
+//#region ../../packages/effect-codex-app-server/src/errors.ts
+const CodexAppServerRequestOperation = Schema$1.Literals([
+	"decode-payload",
+	"encode-payload",
+	"handle-request",
+	"receive-response"
+]);
+const CodexAppServerSchemaIssueKind = Schema$1.Literals([
+	"Filter",
+	"Encoding",
+	"Pointer",
+	"Composite",
+	"AnyOf",
+	"InvalidType",
+	"InvalidValue",
+	"MissingKey",
+	"UnexpectedKey",
+	"Forbidden",
+	"OneOf"
+]);
+const schemaIssueDiagnostics$1 = (root) => {
+	let issueCount = 0;
+	let maximumPathDepth = 0;
+	const issueKinds = /* @__PURE__ */ new Set();
+	const visit = (issue, pathDepth) => {
+		issueCount += 1;
+		issueKinds.add(issue._tag);
+		maximumPathDepth = Math.max(maximumPathDepth, pathDepth);
+		switch (issue._tag) {
+			case "Filter":
+			case "Encoding":
+				visit(issue.issue, pathDepth);
+				break;
+			case "Pointer":
+				visit(issue.issue, pathDepth + issue.path.length);
+				break;
+			case "Composite":
+			case "AnyOf":
+				for (const child of issue.issues) visit(child, pathDepth);
+				break;
 		}
-		index += 1;
-	}
+	};
+	visit(root, 0);
 	return {
-		args,
-		env,
-		skipped
+		issueCount,
+		issueKinds: [...issueKinds],
+		maximumPathDepth
 	};
 };
+const CodexAppServerPayloadKind = Schema$1.Literals([
+	"null",
+	"array",
+	"string",
+	"number",
+	"boolean",
+	"bigint",
+	"object",
+	"symbol",
+	"function",
+	"undefined"
+]);
+const payloadKind = (payload) => {
+	if (payload === null) return "null";
+	if (Array.isArray(payload)) return "array";
+	return typeof payload;
+};
+const protocolMessageFields = [
+	"id",
+	"method",
+	"params",
+	"result",
+	"error"
+];
+const CodexAppServerProtocolMessageField = Schema$1.Literals(protocolMessageFields);
+const CodexAppServerProtocolParseOperation = Schema$1.Literals([
+	"encode-wire-message",
+	"decode-wire-message",
+	"route-wire-message",
+	"decode-notification-payload",
+	"decode-request-payload",
+	"decode-response-payload"
+]);
+const CodexAppServerTransportOperation = Schema$1.Literals(["read-input-stream", "read-process-exit-status"]);
+const CodexAppServerIdentifierPurpose = Schema$1.Literals([
+	"provider-event",
+	"command-approval-request",
+	"file-change-approval-request",
+	"user-input-request"
+]);
+var CodexAppServerSpawnError = class extends Schema$1.TaggedErrorClass()("CodexAppServerSpawnError", {
+	command: Schema$1.optional(Schema$1.String),
+	cause: Schema$1.Defect()
+}) {
+	get message() {
+		return this.command ? `Failed to spawn Codex App Server process for command: ${this.command}` : "Failed to spawn Codex App Server process";
+	}
+};
+var CodexAppServerProcessExitedError = class extends Schema$1.TaggedErrorClass()("CodexAppServerProcessExitedError", {
+	code: Schema$1.optional(Schema$1.Number),
+	pid: Schema$1.optionalKey(Schema$1.Int),
+	cause: Schema$1.optional(Schema$1.Defect())
+}) {
+	get message() {
+		return this.code === void 0 ? "Codex App Server process exited" : `Codex App Server process exited with code ${this.code}`;
+	}
+};
+var CodexAppServerProtocolParseError = class CodexAppServerProtocolParseError extends Schema$1.TaggedErrorClass()("CodexAppServerProtocolParseError", {
+	operation: CodexAppServerProtocolParseOperation,
+	method: Schema$1.optionalKey(Schema$1.String),
+	requestId: Schema$1.optionalKey(Schema$1.String),
+	payloadKind: Schema$1.optionalKey(CodexAppServerPayloadKind),
+	presentFields: Schema$1.optionalKey(Schema$1.Array(CodexAppServerProtocolMessageField)),
+	issueCount: Schema$1.optionalKey(Schema$1.Number),
+	issueKinds: Schema$1.optionalKey(Schema$1.Array(CodexAppServerSchemaIssueKind)),
+	maximumPathDepth: Schema$1.optionalKey(Schema$1.Number),
+	cause: Schema$1.optional(Schema$1.Defect())
+}) {
+	get message() {
+		const method = this.method === void 0 ? "" : ` for method '${this.method}'`;
+		return `Codex App Server protocol operation '${this.operation}' failed${method}.`;
+	}
+	static fromSchemaError(operation, cause, context = {}) {
+		return new CodexAppServerProtocolParseError({
+			operation,
+			...context,
+			...schemaIssueDiagnostics$1(cause.issue),
+			cause
+		});
+	}
+	static fromRequestError(operation, method, cause) {
+		return new CodexAppServerProtocolParseError({
+			operation,
+			method,
+			...cause.issueCount === void 0 ? {} : { issueCount: cause.issueCount },
+			...cause.issueKinds === void 0 ? {} : { issueKinds: cause.issueKinds },
+			...cause.maximumPathDepth === void 0 ? {} : { maximumPathDepth: cause.maximumPathDepth },
+			cause
+		});
+	}
+	static fromUnroutableMessage(message) {
+		const diagnostics = { payloadKind: payloadKind(message) };
+		if (typeof message !== "object" || message === null || Array.isArray(message)) return new CodexAppServerProtocolParseError({
+			operation: "route-wire-message",
+			...diagnostics
+		});
+		const presentFields = protocolMessageFields.filter((field) => field in message);
+		const method = "method" in message && typeof message.method === "string" ? message.method : void 0;
+		const requestId = "id" in message && (typeof message.id === "string" || typeof message.id === "number") ? String(message.id) : void 0;
+		return new CodexAppServerProtocolParseError({
+			operation: "route-wire-message",
+			...diagnostics,
+			presentFields,
+			...method === void 0 ? {} : { method },
+			...requestId === void 0 ? {} : { requestId }
+		});
+	}
+};
+var CodexAppServerTransportError = class extends Schema$1.TaggedErrorClass()("CodexAppServerTransportError", {
+	operation: CodexAppServerTransportOperation,
+	pid: Schema$1.optionalKey(Schema$1.Int),
+	cause: Schema$1.Defect()
+}) {
+	get message() {
+		return `Codex App Server transport operation '${this.operation}' failed.`;
+	}
+};
+var CodexAppServerIdentifierGenerationError = class extends Schema$1.TaggedErrorClass()("CodexAppServerIdentifierGenerationError", {
+	purpose: CodexAppServerIdentifierPurpose,
+	cause: Schema$1.Defect()
+}) {
+	get message() {
+		return `Failed to generate Codex App Server identifier for ${this.purpose}.`;
+	}
+};
+var CodexAppServerInputStreamEndedError = class extends Schema$1.TaggedErrorClass()("CodexAppServerInputStreamEndedError", {}) {
+	get message() {
+		return "Codex App Server input stream ended.";
+	}
+};
+var CodexAppServerRequestError = class CodexAppServerRequestError extends Schema$1.TaggedErrorClass()("CodexAppServerRequestError", {
+	code: Schema$1.Number,
+	errorMessage: Schema$1.String,
+	data: Schema$1.optional(Schema$1.Unknown),
+	method: Schema$1.optionalKey(Schema$1.String),
+	requestId: Schema$1.optionalKey(Schema$1.String),
+	operation: Schema$1.optionalKey(CodexAppServerRequestOperation),
+	issueCount: Schema$1.optionalKey(Schema$1.Number),
+	issueKinds: Schema$1.optionalKey(Schema$1.Array(CodexAppServerSchemaIssueKind)),
+	maximumPathDepth: Schema$1.optionalKey(Schema$1.Number),
+	payloadKind: Schema$1.optionalKey(CodexAppServerPayloadKind),
+	cause: Schema$1.optionalKey(Schema$1.Defect())
+}) {
+	get message() {
+		return this.errorMessage;
+	}
+	static fromProtocolError(error, method, requestId) {
+		return new CodexAppServerRequestError({
+			code: error.code,
+			errorMessage: error.message,
+			...error.data !== void 0 ? { data: error.data } : {},
+			method,
+			requestId,
+			operation: "receive-response",
+			cause: error
+		});
+	}
+	static fromAppServerError(error, method) {
+		if (error._tag === "CodexAppServerRequestError") return error;
+		return CodexAppServerRequestError.internalError(`Codex App Server request handler failed for method '${method}'`, void 0, {
+			method,
+			operation: "handle-request",
+			cause: error
+		});
+	}
+	static parseError(message = "Parse error", data) {
+		return new CodexAppServerRequestError({
+			code: -32700,
+			errorMessage: message,
+			...data !== void 0 ? { data } : {}
+		});
+	}
+	static invalidRequest(message = "Invalid request", data) {
+		return new CodexAppServerRequestError({
+			code: -32600,
+			errorMessage: message,
+			...data !== void 0 ? { data } : {}
+		});
+	}
+	static methodNotFound(method) {
+		return new CodexAppServerRequestError({
+			code: -32601,
+			errorMessage: `Method not found: ${method}`
+		});
+	}
+	static invalidParams(message = "Invalid params", data, diagnostics = {}) {
+		return new CodexAppServerRequestError({
+			code: -32602,
+			errorMessage: message,
+			...data !== void 0 ? { data } : {},
+			...diagnostics
+		});
+	}
+	static invalidPayload(method, operation, cause) {
+		const diagnostics = schemaIssueDiagnostics$1(cause.issue);
+		return new CodexAppServerRequestError({
+			code: -32602,
+			errorMessage: `Invalid payload for method '${method}' during '${operation}'`,
+			data: diagnostics,
+			method,
+			operation,
+			...diagnostics,
+			cause
+		});
+	}
+	static unexpectedPayload(method, operation, payload) {
+		const diagnostics = { payloadKind: payloadKind(payload) };
+		return new CodexAppServerRequestError({
+			code: -32602,
+			errorMessage: `Method '${method}' does not accept a payload during '${operation}'`,
+			data: diagnostics,
+			method,
+			operation,
+			...diagnostics
+		});
+	}
+	static internalError(message = "Internal error", data, diagnostics = {}) {
+		return new CodexAppServerRequestError({
+			code: -32603,
+			errorMessage: message,
+			...data !== void 0 ? { data } : {},
+			...diagnostics
+		});
+	}
+	static overloaded(message = "Server overloaded; retry later.", data) {
+		return new CodexAppServerRequestError({
+			code: -32001,
+			errorMessage: message,
+			...data !== void 0 ? { data } : {}
+		});
+	}
+	toProtocolError() {
+		return {
+			code: this.code,
+			message: this.errorMessage,
+			...this.data !== void 0 ? { data: this.data } : {}
+		};
+	}
+};
+const CodexAppServerError = Schema$1.Union([
+	CodexAppServerRequestError,
+	CodexAppServerSpawnError,
+	CodexAppServerProcessExitedError,
+	CodexAppServerProtocolParseError,
+	CodexAppServerTransportError,
+	CodexAppServerIdentifierGenerationError,
+	CodexAppServerInputStreamEndedError
+]);
 //#endregion
 //#region ../../packages/effect-codex-app-server/src/_internal/shared.ts
 const JsonRpcId$1 = Schema$1.Union([Schema$1.Number, Schema$1.String]);
@@ -87253,9 +87436,9 @@ function isIncomingNotification(value) {
 function isIncomingResponse(value) {
 	return isJsonRpcResponseEnvelope(value);
 }
-const encodeJsonString = Schema$1.encodeUnknownEffect(Schema$1.UnknownFromJsonString);
+const encodeJsonString$1 = Schema$1.encodeUnknownEffect(Schema$1.UnknownFromJsonString);
 const decodeJsonString = Schema$1.decodeUnknownEffect(Schema$1.UnknownFromJsonString);
-const encodeWireMessage = (message) => encodeJsonString(message).pipe(Effect.map((encoded) => `${encoded}\n`), Effect.mapError((cause) => {
+const encodeWireMessage = (message) => encodeJsonString$1(message).pipe(Effect.map((encoded) => `${encoded}\n`), Effect.mapError((cause) => {
 	const method = typeof message.method === "string" ? message.method : void 0;
 	const requestId = typeof message.id === "string" || typeof message.id === "number" ? String(message.id) : void 0;
 	return CodexAppServerProtocolParseError.fromSchemaError("encode-wire-message", cause, {
@@ -87511,6 +87694,30 @@ const makeChildProcessClient = Effect.fn("effect-codex-app-server/CodexAppServer
 	yield* Stream.runDrain(handle.stderr).pipe(Effect.ignore, Effect.forkScoped);
 	return yield* make$8(makeChildStdio$1(handle), options, makeTerminationError$1(handle));
 });
+const resolveCodexLaunchArgs = (launchArgs, environment = process.env) => environment["P4CODE_CODEX_LAUNCH_ARGS"]?.trim() || launchArgs?.trim() || "";
+const codexLaunchArgv = (launchArgs) => tokenizeCliArgs(launchArgs);
+const codexAppServerArgs = (launchArgs) => ["app-server", ...codexLaunchArgv(launchArgs)];
+const codexExecLaunchArgs = (launchArgs) => {
+	const args = codexLaunchArgv(launchArgs);
+	const execArgs = [];
+	for (let index = 0; index < args.length; index++) {
+		const arg = args[index];
+		if (arg === void 0) continue;
+		if (arg === "--strict-config" || arg.startsWith("--config=") || arg.startsWith("-c=")) execArgs.push(arg);
+		else if (arg === "--config" || arg === "-c" || arg === "--enable" || arg === "--disable") {
+			const value = args[index + 1];
+			if (value !== void 0 && !value.startsWith("-")) {
+				execArgs.push(arg, value);
+				index++;
+			}
+		} else if (arg.startsWith("--enable=") || arg.startsWith("--disable=")) execArgs.push(arg);
+	}
+	return execArgs;
+};
+const codexSessionAppServerArgs = (appServerArgs, launchArgs) => {
+	const launchAppServerArgs = codexAppServerArgs(launchArgs);
+	return appServerArgs ? [...launchAppServerArgs, ...appServerArgs] : launchAppServerArgs;
+};
 //#endregion
 //#region src/provider/Layers/CodexProvider.ts
 const isCodexAppServerSpawnError = Schema$1.is(CodexAppServerSpawnError);
@@ -87878,6 +88085,507 @@ const checkCodexProviderStatus = Effect.fn("checkCodexProviderStatus")(function*
 	});
 });
 //#endregion
+//#region src/provider/Layers/CodexAccountUsage.ts
+/**
+* Codex has no `/usage` command: the limits live behind the app-server's
+* `account/*` requests. A short-lived app-server is spawned for the question and
+* torn down with the scope, the same way the capability probe does it, so asking
+* about the account never touches a running session.
+*
+* @module CodexAccountUsage
+*/
+const CODEX_ACCOUNT_USAGE_FORCE_KILL_AFTER = "2 seconds";
+const readCodexAccountUsage = Effect.fn("readCodexAccountUsage")(function* (input) {
+	const resolvedHomePath = input.homePath ? expandHomePath$3(input.homePath) : void 0;
+	const spawner = yield* ChildProcessSpawner$1.ChildProcessSpawner;
+	const environment = {
+		...input.environment,
+		...resolvedHomePath ? { CODEX_HOME: resolvedHomePath } : {}
+	};
+	const spawnCommand = yield* resolveSpawnCommand(input.binaryPath, codexAppServerArgs(input.launchArgs), {
+		env: environment,
+		extendEnv: true
+	});
+	const child = yield* spawner.spawn(ChildProcess$1.make(spawnCommand.command, spawnCommand.args, {
+		cwd: input.cwd,
+		env: environment,
+		extendEnv: true,
+		forceKillAfter: CODEX_ACCOUNT_USAGE_FORCE_KILL_AFTER,
+		shell: spawnCommand.shell
+	})).pipe(Effect.mapError((cause) => new CodexAppServerSpawnError({
+		command: `${input.binaryPath} app-server`,
+		cause
+	})));
+	const clientContext = yield* Layer.build(layerChildProcess$1(child));
+	const client = yield* Effect.service(CodexAppServerClient).pipe(Effect.provide(clientContext));
+	yield* client.request("initialize", buildCodexInitializeParams());
+	yield* client.notify("initialized", void 0);
+	return {
+		rateLimits: yield* client.request("account/rateLimits/read", void 0),
+		usage: yield* client.request("account/usage/read", void 0).pipe(Effect.orElseSucceed(() => null))
+	};
+});
+//#endregion
+//#region src/codexModelOptions.ts
+function getCodexServiceTierOptionValue(modelSelection) {
+	return getModelSelectionStringOptionValue(modelSelection, "serviceTier") ?? (getModelSelectionBooleanOptionValue(modelSelection, "fastMode") === true ? "fast" : void 0);
+}
+//#endregion
+//#region src/textGeneration/codexUsageReport.ts
+const MINUTES_PER_HOUR = 60;
+const MINUTES_PER_DAY = 1440;
+const TOP_DAY_COUNT = 3;
+const PLAN_LABELS = {
+	free: "Free",
+	go: "Go",
+	plus: "Plus",
+	pro: "Pro",
+	prolite: "Pro Lite",
+	team: "Team",
+	business: "Business",
+	enterprise: "Enterprise",
+	edu: "Edu"
+};
+function formatNumber(value) {
+	return Math.round(value).toLocaleString("en-US");
+}
+/** `10080` reads as `7d`, `300` as `5h`: the window label the limit lines carry. */
+function formatWindowDuration(minutes) {
+	if (minutes === void 0 || minutes === null || minutes <= 0) return null;
+	if (minutes % MINUTES_PER_DAY === 0) return `${minutes / MINUTES_PER_DAY}d`;
+	if (minutes % MINUTES_PER_HOUR === 0) return `${minutes / MINUTES_PER_HOUR}h`;
+	return `${minutes}m`;
+}
+const MILLISECONDS_PER_SECOND = 1e3;
+function formatResetTime(resetsAt, timeZone) {
+	if (resetsAt === void 0 || resetsAt === null || !Number.isFinite(resetsAt)) return null;
+	const epochMs = resetsAt * MILLISECONDS_PER_SECOND;
+	return `resets ${new Intl.DateTimeFormat("en-US", {
+		month: "short",
+		day: "numeric",
+		timeZone
+	}).format(epochMs)} at ${new Intl.DateTimeFormat("en-US", {
+		hour: "numeric",
+		minute: "2-digit",
+		hour12: true,
+		timeZone
+	}).format(epochMs).replace(/\s/g, "").toLowerCase()} (${timeZone})`;
+}
+function limitLabel(snapshot, fallbackId) {
+	const name = snapshot.limitName?.trim();
+	if (name) return name;
+	const id = snapshot.limitId?.trim() || fallbackId;
+	return id === "codex" ? "Codex" : id;
+}
+function limitLine(label, window, timeZone) {
+	if (!window) return null;
+	const duration = formatWindowDuration(window.windowDurationMins);
+	const resets = formatResetTime(window.resetsAt, timeZone);
+	return `${duration ? `${label} (${duration})` : label}: ${window.usedPercent}% used${resets ? ` · ${resets}` : ""}`;
+}
+/**
+* Every limit Codex knows about, not just the account-wide one: model-specific
+* limits arrive under `rateLimitsByLimitId` and are the ones that actually stop
+* a turn.
+*/
+function collectRateLimitSnapshots(response) {
+	const activeId = response.rateLimits.limitId ?? "codex";
+	const byId = response.rateLimitsByLimitId;
+	if (byId && Object.keys(byId).length > 0) return Object.entries(byId).map(([id, snapshot]) => ({
+		id,
+		snapshot
+	})).sort((left, right) => Number(right.id === activeId) - Number(left.id === activeId));
+	return [{
+		id: activeId,
+		snapshot: response.rateLimits
+	}];
+}
+function planSentence(response) {
+	const planType = response.rateLimits.planType;
+	if (!planType || planType === "unknown") return null;
+	return `You are currently using your Codex ${PLAN_LABELS[planType] ?? planType} plan.`;
+}
+function creditsSentence(response) {
+	const credits = response.rateLimits.credits;
+	if (!credits) return null;
+	if (credits.unlimited) return "Credits: unlimited.";
+	if (!credits.hasCredits) return null;
+	return credits.balance ? `Credits: ${credits.balance} available.` : "Credits available.";
+}
+function resetCreditSentence(response) {
+	const available = response.rateLimitResetCredits?.availableCount ?? 0;
+	if (available <= 0) return null;
+	return available === 1 ? "1 rate limit reset is available on this account." : `${available} rate limit resets are available on this account.`;
+}
+const MONTH_NAMES = [
+	"Jan",
+	"Feb",
+	"Mar",
+	"Apr",
+	"May",
+	"Jun",
+	"Jul",
+	"Aug",
+	"Sep",
+	"Oct",
+	"Nov",
+	"Dec"
+];
+/** A stat line only earns its place when the account actually reports the number. */
+function countStat(value, label) {
+	if (value === void 0 || value === null || value <= 0) return null;
+	return `${formatNumber(value)} ${label}`;
+}
+/** Buckets are calendar days (`2026-08-17`), read as written rather than as an instant. */
+function formatBucketDay(startDate) {
+	const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(startDate);
+	const month = MONTH_NAMES[Number(match?.[2]) - 1];
+	if (!match || !month) return startDate;
+	return `${month} ${Number(match[3])}`;
+}
+function usageWindowLines(usage) {
+	const lines = [];
+	const buckets = (usage.dailyUsageBuckets ?? []).filter((bucket) => bucket.tokens > 0);
+	const bucketTotal = buckets.reduce((total, bucket) => total + bucket.tokens, 0);
+	if (buckets.length > 0 && bucketTotal > 0) {
+		const perDay = Math.round(bucketTotal / buckets.length);
+		lines.push(`Last ${buckets.length}d · ${formatNumber(bucketTotal)} tokens · ${formatNumber(perDay)} tokens per day`);
+		const topDays = [...buckets].sort((left, right) => right.tokens - left.tokens).slice(0, TOP_DAY_COUNT).map((bucket) => `${formatBucketDay(bucket.startDate)} ${Math.round(bucket.tokens / bucketTotal * 100)}%`);
+		if (topDays.length > 0) lines.push(`  Top days: ${topDays.join(", ")}`);
+	}
+	const summary = usage.summary;
+	const allTimeStats = [
+		countStat(summary.lifetimeTokens, "tokens"),
+		countStat(summary.peakDailyTokens, "peak daily tokens"),
+		countStat(summary.currentStreakDays, "day streak")
+	].filter((stat) => stat !== null);
+	if (allTimeStats.length > 0) lines.push(`All time · ${allTimeStats.join(" · ")}`);
+	return lines;
+}
+/**
+* Render the Codex account report. `timeZone` is the server's, matching how the
+* Claude CLI stamps its own reset times.
+*/
+function formatCodexUsageReport(input) {
+	const { rateLimits, usage, timeZone } = input;
+	const sections = [];
+	const intro = [
+		planSentence(rateLimits),
+		creditsSentence(rateLimits),
+		resetCreditSentence(rateLimits)
+	].filter((sentence) => sentence !== null).join("\n");
+	if (intro.length > 0) sections.push(intro);
+	const limits = collectRateLimitSnapshots(rateLimits).flatMap(({ id, snapshot }) => {
+		const label = limitLabel(snapshot, id);
+		return [limitLine(label, snapshot.primary, timeZone), limitLine(label, snapshot.secondary, timeZone)].filter((line) => line !== null);
+	});
+	if (limits.length > 0) sections.push(limits.join("\n"));
+	const windows = usage ? usageWindowLines(usage) : [];
+	if (windows.length > 0) {
+		sections.push(["What's contributing to your limits usage?", "Token totals Codex reports for this account. Day shares are of the tokens in that window."].join("\n"));
+		sections.push(windows.join("\n"));
+	}
+	return sections.join("\n\n");
+}
+//#endregion
+//#region src/textGeneration/CodexTextGeneration.ts
+const CODEX_GIT_TEXT_GENERATION_REASONING_EFFORT = "low";
+const CODEX_TIMEOUT_MS = 18e4;
+/** The account report is a local lookup, so it should return in seconds, not minutes. */
+const USAGE_REPORT_TIMEOUT_MS = 3e4;
+const encodeJsonString = Schema$1.encodeEffect(Schema$1.UnknownFromJsonString);
+/**
+* Build a Codex text-generation closure bound to a specific `CodexSettings`
+* payload. See `makeCodexAdapter` for the overall per-instance rationale.
+*/
+const makeCodexTextGeneration = Effect.fn("makeCodexTextGeneration")(function* (codexConfig, environment) {
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const commandSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const serverConfig = yield* Effect.service(ServerConfig$1);
+	const resolvedEnvironment = environment ?? process.env;
+	const readStreamAsString = (operation, stream) => stream.pipe(Stream.decodeText(), Stream.runFold(() => "", (acc, chunk) => acc + chunk), Effect.mapError((cause) => normalizeCliError("codex", operation, cause, "Failed to collect process output")));
+	const writeTempFile = (operation, prefix, content) => fileSystem.makeTempFileScoped({ prefix: `p4code-${prefix}-${process.pid}-` }).pipe(Effect.tap((filePath) => fileSystem.writeFileString(filePath, content)), Effect.mapError((cause) => new TextGenerationError({
+		operation,
+		detail: `Failed to write temp file`,
+		cause
+	})));
+	const safeUnlink = (filePath) => fileSystem.remove(filePath).pipe(Effect.catch(() => Effect.void));
+	const encodeJsonForOperation = (operation, value) => encodeJsonString(value).pipe(Effect.mapError((cause) => new TextGenerationError({
+		operation,
+		detail: "Failed to encode structured output schema.",
+		cause
+	})));
+	const materializeImageAttachments = Effect.fn("materializeImageAttachments")(function* (_operation, attachments) {
+		if (!attachments || attachments.length === 0) return { imagePaths: [] };
+		const imagePaths = [];
+		for (const attachment of attachments) {
+			if (attachment.type !== "image") continue;
+			const resolvedPath = resolveAttachmentPath({
+				attachmentsDir: serverConfig.attachmentsDir,
+				attachment
+			});
+			if (!resolvedPath || !path.isAbsolute(resolvedPath)) continue;
+			const fileInfo = yield* fileSystem.stat(resolvedPath).pipe(Effect.orElseSucceed(() => null));
+			if (!fileInfo || fileInfo.type !== "File") continue;
+			imagePaths.push(resolvedPath);
+		}
+		return { imagePaths };
+	});
+	const runCodexJson = Effect.fn("runCodexJson")(function* ({ operation, cwd, prompt, outputSchemaJson, imagePaths = [], cleanupPaths = [], modelSelection }) {
+		const schemaJson = yield* encodeJsonForOperation(operation, toJsonSchemaObject(outputSchemaJson));
+		const schemaPath = yield* writeTempFile(operation, "codex-schema", schemaJson);
+		const outputPath = yield* writeTempFile(operation, "codex-output", "");
+		const runCodexCommand = Effect.fn("runCodexJson.runCodexCommand")(function* () {
+			const launchArgs = resolveCodexLaunchArgs(codexConfig.launchArgs, resolvedEnvironment);
+			const reasoningEffort = getModelSelectionStringOptionValue(modelSelection, "reasoningEffort") ?? CODEX_GIT_TEXT_GENERATION_REASONING_EFFORT;
+			const serviceTier = getCodexServiceTierOptionValue(modelSelection);
+			const spawnCommand = yield* resolveSpawnCommand(codexConfig.binaryPath || "codex", [
+				"exec",
+				...codexExecLaunchArgs(launchArgs),
+				"--ephemeral",
+				"--skip-git-repo-check",
+				"-s",
+				"read-only",
+				"--model",
+				modelSelection.model,
+				"--config",
+				`model_reasoning_effort="${reasoningEffort}"`,
+				...serviceTier ? ["--config", `service_tier="${serviceTier}"`] : [],
+				"--output-schema",
+				schemaPath,
+				"--output-last-message",
+				outputPath,
+				...imagePaths.flatMap((imagePath) => ["--image", imagePath]),
+				"-"
+			], { env: resolvedEnvironment });
+			const command = ChildProcess.make(spawnCommand.command, spawnCommand.args, {
+				env: {
+					...resolvedEnvironment,
+					...codexConfig.homePath ? { CODEX_HOME: expandHomePath$3(codexConfig.homePath) } : {}
+				},
+				cwd,
+				shell: spawnCommand.shell,
+				stdin: { stream: Stream.encodeText(Stream.make(prompt)) }
+			});
+			const child = yield* commandSpawner.spawn(command).pipe(Effect.mapError((cause) => normalizeCliError("codex", operation, cause, "Failed to spawn Codex CLI process")));
+			const [stdout, stderr, exitCode] = yield* Effect.all([
+				readStreamAsString(operation, child.stdout),
+				readStreamAsString(operation, child.stderr),
+				child.exitCode.pipe(Effect.mapError((cause) => normalizeCliError("codex", operation, cause, "Failed to read Codex CLI exit code")))
+			], { concurrency: "unbounded" });
+			if (exitCode !== 0) {
+				const stderrDetail = stderr.trim();
+				const stdoutDetail = stdout.trim();
+				const detail = stderrDetail.length > 0 ? stderrDetail : stdoutDetail;
+				return yield* new TextGenerationError({
+					operation,
+					detail: detail.length > 0 ? `Codex CLI command failed: ${detail}` : `Codex CLI command failed with code ${exitCode}.`
+				});
+			}
+		});
+		const cleanup = Effect.all([
+			schemaPath,
+			outputPath,
+			...cleanupPaths
+		].map((filePath) => safeUnlink(filePath)), { concurrency: "unbounded" }).pipe(Effect.asVoid);
+		return yield* Effect.gen(function* () {
+			yield* runCodexCommand().pipe(Effect.scoped, Effect.timeoutOption(CODEX_TIMEOUT_MS), Effect.flatMap(Option.match({
+				onNone: () => Effect.fail(new TextGenerationError({
+					operation,
+					detail: "Codex CLI request timed out."
+				})),
+				onSome: () => Effect.void
+			})));
+			const decodeOutput = Schema$1.decodeEffect(Schema$1.fromJsonString(outputSchemaJson));
+			return yield* fileSystem.readFileString(outputPath).pipe(Effect.mapError((cause) => new TextGenerationError({
+				operation,
+				detail: "Failed to read Codex output file.",
+				cause
+			})), Effect.flatMap(decodeOutput), Effect.catchTags({ SchemaError: (cause) => Effect.fail(new TextGenerationError({
+				operation,
+				detail: "Codex returned invalid structured output.",
+				cause
+			})) }));
+		}).pipe(Effect.ensuring(cleanup));
+	});
+	return {
+		generateCommitMessage: Effect.fn("CodexTextGeneration.generateCommitMessage")(function* (input) {
+			const { prompt, outputSchema } = buildCommitMessagePrompt({
+				branch: input.branch,
+				stagedSummary: input.stagedSummary,
+				stagedPatch: input.stagedPatch,
+				includeBranch: input.includeBranch === true,
+				policy: input.policy
+			});
+			const generated = yield* runCodexJson({
+				operation: "generateCommitMessage",
+				cwd: input.cwd,
+				prompt,
+				outputSchemaJson: outputSchema,
+				modelSelection: input.modelSelection
+			});
+			return {
+				subject: sanitizeCommitSubject(generated.subject),
+				body: generated.body.trim(),
+				..."branch" in generated && typeof generated.branch === "string" ? { branch: sanitizeFeatureBranchName(generated.branch) } : {}
+			};
+		}),
+		generatePrContent: Effect.fn("CodexTextGeneration.generatePrContent")(function* (input) {
+			const { prompt, outputSchema } = buildPrContentPrompt({
+				baseBranch: input.baseBranch,
+				headBranch: input.headBranch,
+				commitSummary: input.commitSummary,
+				diffSummary: input.diffSummary,
+				diffPatch: input.diffPatch,
+				policy: input.policy,
+				changeRequestTemplate: input.changeRequestTemplate
+			});
+			const generated = yield* runCodexJson({
+				operation: "generatePrContent",
+				cwd: input.cwd,
+				prompt,
+				outputSchemaJson: outputSchema,
+				modelSelection: input.modelSelection
+			});
+			return {
+				title: sanitizePrTitle(generated.title),
+				body: generated.body.trim()
+			};
+		}),
+		generateBranchName: Effect.fn("CodexTextGeneration.generateBranchName")(function* (input) {
+			const { imagePaths } = yield* materializeImageAttachments("generateBranchName", input.attachments);
+			const { prompt, outputSchema } = buildBranchNamePrompt({
+				message: input.message,
+				attachments: input.attachments
+			});
+			return { branch: sanitizeBranchFragment((yield* runCodexJson({
+				operation: "generateBranchName",
+				cwd: input.cwd,
+				prompt,
+				outputSchemaJson: outputSchema,
+				imagePaths,
+				modelSelection: input.modelSelection
+			})).branch) };
+		}),
+		generateThreadTitle: Effect.fn("CodexTextGeneration.generateThreadTitle")(function* (input) {
+			const { imagePaths } = yield* materializeImageAttachments("generateThreadTitle", input.attachments);
+			const { prompt, outputSchema } = buildThreadTitlePrompt({
+				message: input.message,
+				attachments: input.attachments
+			});
+			return { title: sanitizeThreadTitle((yield* runCodexJson({
+				operation: "generateThreadTitle",
+				cwd: input.cwd,
+				prompt,
+				outputSchemaJson: outputSchema,
+				imagePaths,
+				modelSelection: input.modelSelection
+			})).title) };
+		}),
+		getUsageReport: Effect.fn("CodexTextGeneration.getUsageReport")(function* () {
+			const operation = "getUsageReport";
+			const snapshot = yield* readCodexAccountUsage({
+				binaryPath: codexConfig.binaryPath || "codex",
+				...codexConfig.homePath ? { homePath: codexConfig.homePath } : {},
+				launchArgs: resolveCodexLaunchArgs(codexConfig.launchArgs, resolvedEnvironment),
+				cwd: serverConfig.cwd,
+				environment: resolvedEnvironment
+			}).pipe(Effect.mapError((cause) => new TextGenerationError({
+				operation,
+				detail: "Codex CLI could not read this account's usage.",
+				cause
+			})), Effect.scoped, Effect.timeoutOption(USAGE_REPORT_TIMEOUT_MS), Effect.flatMap(Option.match({
+				onNone: () => Effect.fail(new TextGenerationError({
+					operation,
+					detail: "Codex CLI request timed out."
+				})),
+				onSome: (value) => Effect.succeed(value)
+			})), Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, commandSpawner));
+			return { report: formatCodexUsageReport({
+				rateLimits: snapshot.rateLimits,
+				usage: snapshot.usage,
+				timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone
+			}) };
+		})
+	};
+});
+//#endregion
+//#region src/provider/Layers/codexMcpArgs.ts
+/** Codex's own name for the token variable of p4code's built-in server. */
+const CODEX_P4CODE_BEARER_TOKEN_ENV_VAR = "P4_MCP_BEARER_TOKEN";
+/** Prefix for the per-server variables the registered servers get. */
+const BEARER_TOKEN_ENV_VAR_PREFIX = "P4_MCP_BEARER_TOKEN_";
+/** TOML bare keys; anything else has to be quoted inside the dotted path. */
+const BARE_KEY = /^[A-Za-z0-9_-]+$/;
+const AUTHORIZATION_HEADER = "authorization";
+const BEARER_PREFIX = /^Bearer\s+/;
+const configKey = (name, field) => `mcp_servers.${BARE_KEY.test(name) ? name : JSON.stringify(name)}.${field}`;
+/**
+* A variable name derived from the server's, uniquely.
+*
+* Uppercased with every character a shell would not accept replaced, which can
+* collide (`a.b` and `a-b`), so the sanitized name is the prefix and the index
+* keeps it unique. The index is stable within one call, which is all that is
+* needed: the variable and the reference to it are emitted together.
+*/
+const bearerTokenEnvVar = (name, index) => `${BEARER_TOKEN_ENV_VAR_PREFIX}${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_${index}`;
+/**
+* @param resolved - Servers keyed by name, as the registry resolved them.
+* @param exclude - Names p4code declares itself. A registration cannot displace
+*   the built-in `p4-code` server, whose per-thread credential is the only
+*   thing that makes `task_current` and the thread tools work.
+*/
+const toCodexMcpConfig = (resolved, exclude = /* @__PURE__ */ new Set()) => {
+	const args = [];
+	const env = {};
+	const skipped = [];
+	const push = (name, field, value) => {
+		args.push("-c", `${configKey(name, field)}=${value}`);
+	};
+	let index = 0;
+	for (const [name, server] of Object.entries(resolved)) {
+		if (exclude.has(name)) continue;
+		if (server.type === "stdio") {
+			push(name, "command", JSON.stringify(server.command));
+			push(name, "args", JSON.stringify(server.args));
+			if (Object.keys(server.env).length > 0) push(name, "env", `{ ${Object.entries(server.env).map(([key, value]) => `${JSON.stringify(key)} = ${JSON.stringify(value)}`).join(", ")} }`);
+			index += 1;
+			continue;
+		}
+		if (server.type === "sse") {
+			skipped.push({
+				name,
+				reason: "Codex speaks streamable HTTP, not SSE."
+			});
+			continue;
+		}
+		const headerNames = Object.keys(server.headers);
+		const authorization = headerNames.find((key) => key.toLowerCase() === AUTHORIZATION_HEADER);
+		const otherHeaders = headerNames.filter((key) => key !== authorization);
+		if (otherHeaders.length > 0) {
+			skipped.push({
+				name,
+				reason: `Codex sends no custom headers, and this server needs ${otherHeaders.join(", ")}.`
+			});
+			continue;
+		}
+		push(name, "url", JSON.stringify(server.url));
+		if (authorization !== void 0) {
+			const token = server.headers[authorization]?.replace(BEARER_PREFIX, "") ?? "";
+			const variable = bearerTokenEnvVar(name, index);
+			env[variable] = token;
+			push(name, "bearer_token_env_var", JSON.stringify(variable));
+		}
+		index += 1;
+	}
+	return {
+		args,
+		env,
+		skipped
+	};
+};
+//#endregion
 //#region src/provider/CodexDeveloperInstructions.ts
 const P4_CODE_BROWSER_TOOL_INSTRUCTIONS = `
 
@@ -103874,6 +104582,7 @@ const make$4 = Effect.gen(function* () {
 	const projectionSnapshotQuery = yield* ProjectionSnapshotQuery;
 	const providerService = yield* ProviderService;
 	const projectionTurnRepository = yield* ProjectionTurnRepository;
+	const threadBackgroundLiveness = yield* ThreadBackgroundLivenessService;
 	const serverSettingsService = yield* ServerSettingsService;
 	const taskRepositories = yield* TaskRepositoryRegistry;
 	const providerCommandId = (event, tag) => crypto.randomUUIDv4.pipe(Effect.map((uuid) => CommandId.make(`provider:${event.eventId}:${tag}:${uuid}`)));
@@ -104160,6 +104869,26 @@ const make$4 = Effect.gen(function* () {
 	const processRuntimeEvent = (event) => Effect.gen(function* () {
 		const thread = yield* resolveThreadShell(event.threadId);
 		if (!thread) return;
+		switch (event.type) {
+			case "task.started":
+			case "task.progress":
+			case "task.completed": {
+				const payload = event.payload;
+				threadBackgroundLiveness.recordTaskLiveness({
+					threadId: thread.id,
+					taskId: payload.taskId,
+					taskType: payload.taskType,
+					status: payload.status,
+					agentId: payload.agentId,
+					kind: event.type === "task.started" ? "started" : event.type === "task.progress" ? "progress" : "completed"
+				});
+				break;
+			}
+			case "session.exited":
+				threadBackgroundLiveness.clearThreadLiveness(thread.id);
+				break;
+			default: break;
+		}
 		let loadedThreadDetail;
 		const getLoadedThreadDetail = () => Effect.gen(function* () {
 			if (loadedThreadDetail !== void 0) return loadedThreadDetail;
@@ -104477,7 +105206,7 @@ const make$4 = Effect.gen(function* () {
 		drain: worker.drain
 	};
 });
-const ProviderRuntimeIngestionLive = Layer.effect(ProviderRuntimeIngestionService, make$4).pipe(Layer.provide(ProjectionTurnRepositoryLive));
+const ProviderRuntimeIngestionLive = Layer.effect(ProviderRuntimeIngestionService, make$4).pipe(Layer.provide(ProjectionTurnRepositoryLive), Layer.provide(layer$63));
 //#endregion
 //#region src/provider/userInvokedSkills.ts
 /**
@@ -107229,11 +107958,11 @@ const WorkspaceEntriesLayerLive = layer$32.pipe(Layer.provide(layer$52));
 const WorkspaceFileSystemLayerLive = layer$31.pipe(Layer.provide(layer$52), Layer.provide(WorkspaceEntriesLayerLive));
 const WorkspaceLayerLive = Layer.mergeAll(layer$52, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
 const ProjectFaviconResolverLayerLive = layer$50.pipe(Layer.provide(layer$52), Layer.provide(layer$51));
-const AuthLayerLive = layer$72.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$76));
+const AuthLayerLive = layer$73.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$77));
 const ProviderRuntimeLayerLive = ProviderSessionReaperLive.pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeCoreDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive, RoutedTaskRepositoryLive)), Layer.provideMerge(Layer.mergeAll(PersistenceLayerLive, layer$65)), Layer.provideMerge(layer$60), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$69.pipe(Layer.provide(layer$76))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$61), Layer.provideMerge(layer$54), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$1.pipe(Layer.provideMerge(LinearClientLive), Layer.provideMerge(Layer.mergeAll(LinearMcpClientLive, TrackerSecretsLive)), Layer.provideMerge(Layer.mergeAll(layer$66, layer$38).pipe(Layer.provideMerge(layer$67), Layer.provideMerge(layer$68))))), Layer.provideMerge(layer$76));
-const UsageLayerLive = layer$40.pipe(Layer.provide(layer$69.pipe(Layer.provide(layer$76))));
-const RuntimeDependenciesLive = layer$39.pipe(Layer.provideMerge(RuntimeCoreDependenciesLive)).pipe(Layer.provideMerge(UsageLayerLive), Layer.provideMerge(layer$15), Layer.provideMerge(layer$14), Layer.provideMerge(layer$13), Layer.provideMerge(layer$57), Layer.provideMerge(layer$59), Layer.provideMerge(layer$58), Layer.provide(layer$80));
+const RuntimeCoreDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive, RoutedTaskRepositoryLive)), Layer.provideMerge(Layer.mergeAll(PersistenceLayerLive, layer$66)), Layer.provideMerge(layer$60), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$70.pipe(Layer.provide(layer$77))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$61), Layer.provideMerge(layer$54), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$1.pipe(Layer.provideMerge(LinearClientLive), Layer.provideMerge(Layer.mergeAll(LinearMcpClientLive, TrackerSecretsLive)), Layer.provideMerge(Layer.mergeAll(layer$67, layer$38).pipe(Layer.provideMerge(layer$68), Layer.provideMerge(layer$69))))), Layer.provideMerge(layer$77));
+const UsageLayerLive = layer$40.pipe(Layer.provide(layer$70.pipe(Layer.provide(layer$77))));
+const RuntimeDependenciesLive = layer$39.pipe(Layer.provideMerge(RuntimeCoreDependenciesLive)).pipe(Layer.provideMerge(UsageLayerLive), Layer.provideMerge(layer$15), Layer.provideMerge(layer$14), Layer.provideMerge(layer$13), Layer.provideMerge(layer$57), Layer.provideMerge(layer$59), Layer.provideMerge(layer$58), Layer.provide(layer$81));
 /**
 * Hub asset sync.
 *
@@ -107241,7 +107970,7 @@ const RuntimeDependenciesLive = layer$39.pipe(Layer.provideMerge(RuntimeCoreDepe
 * not-configured shape, and every call reports that rather than failing — so
 * this costs a server with no hub nothing but a layer.
 */
-const AssetSyncLive = layer$63.pipe(Layer.provideMerge(layer$64), Layer.provideMerge(layer$65));
+const AssetSyncLive = layer$64.pipe(Layer.provideMerge(layer$65), Layer.provideMerge(layer$66));
 const RuntimeServicesLive = layer$53.pipe(Layer.provideMerge(AssetSyncLive), Layer.provideMerge(RuntimeDependenciesLive));
 const PullRequestServiceLive = layer$7.pipe(Layer.provide(layer$8), Layer.provide(SourceControlProviderRegistryLayerLive), Layer.provide(layer$48));
 const makeRoutesLayer = Layer.mergeAll(Layer.mergeAll(HttpApiBuilder.layer(EnvironmentHttpApi).pipe(Layer.provide(authHttpApiLayer), Layer.provide(orchestrationHttpApiLayer), Layer.provide(pullRequestHttpApiLayer), Layer.provide(serverEnvironmentHttpApiLayer), Layer.provide(environmentAuthenticatedAuthLayer)), otlpTracesProxyRouteLayer, assetRouteLayer, mcpOAuthCallbackRouteLayer, staticAndDevRouteLayer, websocketRpcRouteLayer), layer.pipe(Layer.provide(layer$3))).pipe(Layer.provide(ProjectionProjectRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(layer$51), Layer.provide(PullRequestServiceLive), Layer.provide(layer$35), Layer.provide(layer$55), Layer.provide(browserApiCorsLayer), Layer.provide(httpCompressionLayer));
@@ -107882,7 +108611,7 @@ const serviceCommand = Command.make("service").pipe(Command.withDescription("Man
 ]));
 //#endregion
 //#region src/bin.ts
-const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$80, FetchHttpClient.layer);
+const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, layer$81, FetchHttpClient.layer);
 /**
 * Prints an update reminder before dispatching, at most once a day.
 *