@p4code/cli 0.6.13 → 0.6.15

package/dist/bin.mjs

@@ -8,7 +8,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { Argument, Command, Flag, GlobalFlag, Prompt } from "effect/unstable/cli";
 import * as CliError from "effect/unstable/cli/CliError";
-import { FetchHttpClient, Headers as Headers$1, HttpBody, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse, HttpEffect, HttpRouter, HttpServer, HttpServerRequest, HttpServerRespondable, HttpServerResponse } from "effect/unstable/http";
+import { FetchHttpClient, HttpBody, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse, HttpEffect, HttpRouter, HttpServer, HttpServerRequest, HttpServerRespondable, HttpServerResponse } from "effect/unstable/http";
 import * as Context from "effect/Context";
 import * as NodeOS from "node:os";
 import * as NodeNet from "node:net";
@@ -63,6 +63,8 @@ import * as NodeReadline from "node:readline";
 import * as NodeFSP from "node:fs/promises";
 import { access } from "node:fs/promises";
 import * as Clock from "effect/Clock";
+import * as Headers$1 from "effect/unstable/http/Headers";
+import * as HttpRouter$1 from "effect/unstable/http/HttpRouter";
 import * as NodeStream from "@effect/platform-node/NodeStream";
 import * as NodeHttp from "node:http";
 import * as Deferred from "effect/Deferred";
@@ -266,7 +268,7 @@ const make$124 = () => {
 const layer$124 = Layer.sync(NetService, make$124);
 //#endregion
 //#region package.json
-var version$1 = "0.6.13";
+var version$1 = "0.6.15";
 //#endregion
 //#region src/config.ts
 /**
@@ -10163,7 +10165,8 @@ var DeviceOperationError = class extends Schema$1.TaggedErrorClass()("DeviceOper
 		"request_failed",
 		"invalid_payload",
 		"settings_failed",
-		"hub_rejected"
+		"hub_rejected",
+		"agent_access_disabled"
 	]),
 	exitCode: Schema$1.optional(Schema$1.Number),
 	cause: Schema$1.Defect()
@@ -10174,7 +10177,8 @@ var DeviceOperationError = class extends Schema$1.TaggedErrorClass()("DeviceOper
 			request_failed: "Could not communicate with device support. Try refreshing devices.",
 			invalid_payload: "The device request could not be encoded.",
 			settings_failed: "Could not read or save device settings.",
-			hub_rejected: "The device hub could not complete the request."
+			hub_rejected: "The device hub could not complete the request.",
+			agent_access_disabled: "Agent device access is off. Turn on Settings > Devices > Allow agents to control devices."
 		}[this.reason];
 		return `Device ${this.operation} failed: ${explanation}`;
 	}
@@ -24244,6 +24248,49 @@ function isLoopbackHost(host) {
 	return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]" || normalized.startsWith("127.");
 }
 //#endregion
+//#region src/httpCompression/HttpResponseCompression.ts
+const GZIP_MIN_BYTES = 1024;
+var HttpResponseCompression = class extends Context.Service()("@p4code/cli/httpCompression/HttpResponseCompression") {};
+const layerNode = Layer.effect(HttpResponseCompression, Effect.gen(function* () {
+	const NodeZlib = yield* Effect.promise(() => import("node:zlib"));
+	return { gzip: (body, options) => {
+		const stream = NodeZlib.createGzip();
+		stream.end(body);
+		return HttpServerResponse$1.raw(stream, options);
+	} };
+}));
+const layerBun = Layer.succeed(HttpResponseCompression, { gzip: (body, options) => HttpServerResponse$1.raw(new Response(body).body.pipeThrough(new CompressionStream("gzip")), options) });
+function acceptsGzip(value) {
+	if (!value) return false;
+	const accepted = new Map(value.split(",").map((entry) => {
+		const [coding = "", ...parameters] = entry.trim().toLowerCase().split(";");
+		const quality = parameters.map((parameter) => parameter.trim().match(/^q=(.+)$/)?.[1]).find((parameter) => parameter !== void 0);
+		return [coding, quality === void 0 ? 1 : Number(quality)];
+	}));
+	return (accepted.get("gzip") ?? accepted.get("*") ?? 0) > 0;
+}
+function varyByAcceptEncoding(value) {
+	if (!value) return "Accept-Encoding";
+	const values = new Set(value.split(",").map((entry) => entry.trim().toLowerCase()));
+	return values.has("*") || values.has("accept-encoding") ? value : `${value}, Accept-Encoding`;
+}
+const compressHttpResponse = Effect.fnUntraced(function* (response, acceptEncoding) {
+	const body = response.body;
+	if (body._tag !== "Uint8Array" || body.contentLength < GZIP_MIN_BYTES || !body.contentType.startsWith("application/json") || response.headers["content-encoding"]) return response;
+	const variedResponse = HttpServerResponse$1.setHeader(response, "vary", varyByAcceptEncoding(response.headers.vary));
+	if (!acceptsGzip(acceptEncoding)) return variedResponse;
+	const compression = yield* HttpResponseCompression;
+	const headers = Headers$1.set(Headers$1.remove(variedResponse.headers, "content-length"), "content-encoding", "gzip");
+	return compression.gzip(body.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers,
+		cookies: response.cookies,
+		contentType: body.contentType
+	});
+});
+const httpCompressionLayer = HttpRouter$1.middleware((httpEffect) => Effect.flatMap(Effect.all([httpEffect, HttpServerRequest$1.HttpServerRequest]), ([response, request]) => compressHttpResponse(response, request.headers["accept-encoding"])), { global: true });
+//#endregion
 //#region src/persistence/Services/AgentAssets.ts
 var AgentAssetRepository = class extends Context.Service()("@p4code/cli/persistence/Services/AgentAssets/AgentAssetRepository") {};
 //#endregion
@@ -28795,6 +28842,321 @@ const hubTunnelClientSocketRoute = Effect.gen(function* () {
 })));
 const layer$96 = HttpRouter.add("GET", `${HUB_TUNNEL_CLIENT_SOCKET_PATH}/*`, hubTunnelClientSocketRoute);
 //#endregion
+//#region src/sync/HubLink.ts
+/**
+* Where this server's hub is, what it authenticates with, and whether it syncs
+* on its own.
+*
+* Absent by default. A server with no hub configured runs exactly as it does
+* today — the sync is skipped rather than failing, because "no hub" is a
+* complete and normal configuration, not a broken one.
+*
+* The record lives in `ServerSecretStore`, which already writes with
+* restrictive permissions, rather than in the settings file or the database.
+* The sync mode rides along in that record even though it is not a secret:
+* connect, disconnect and pause are then one write and one read, and the
+* settings panel reads one thing instead of joining two. Environment variables
+* override the link so a container or a service unit can be configured without
+* a first-run interactive step — the same trade the hub process itself makes
+* with `P4CODE_HUB_TOKEN_HASHES` — while the mode always comes from the stored
+* record, so a server configured by environment can still be paused.
+*
+* Mutable, deliberately. Resolving this once at layer construction would mean
+* connecting to a hub did nothing until the server restarted, which is a
+* miserable thing to discover after typing a token into a form.
+*
+* @module sync/HubLink
+*/
+/** Secret name holding the hub record as JSON. */
+const HUB_LINK_SECRET_NAME = "hub-link";
+var HubLink = class extends Context.Service()("@p4code/cli/sync/HubLink") {};
+/** The submitted URL or token could not make a usable link. */
+var InvalidHubLink = class extends Schema$1.TaggedErrorClass()("InvalidHubLink", { detail: Schema$1.String }) {
+	get message() {
+		return this.detail;
+	}
+};
+const trimTrailingSlash = (value) => value.replace(/\/+$/u, "");
+/**
+* Both halves must be present and the URL parseable. A half-configured link is
+* treated as no link at all, because a server that thinks it has a hub and
+* cannot form a request would report every sync as a failure rather than as the
+* "not configured" it actually is.
+*/
+const validateHubLink = (rawBaseUrl, rawToken) => {
+	const trimmed = trimTrailingSlash(rawBaseUrl.trim());
+	const token = rawToken.trim();
+	if (trimmed.length === 0 || token.length === 0) return Option.none();
+	const baseUrl = /^[a-z][a-z0-9+.-]*:\/\//iu.test(trimmed) ? trimmed : `https://${trimmed}`;
+	if (!URL.canParse(baseUrl)) return Option.none();
+	const parsed = new URL(baseUrl);
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return Option.none();
+	return Option.some({
+		baseUrl,
+		token
+	});
+};
+const StoredHubLink = Schema$1.fromJsonString(Schema$1.Struct({
+	baseUrl: Schema$1.String,
+	token: Schema$1.String,
+	syncMode: Schema$1.optional(Schema$1.Literals(["auto", "paused"])),
+	shareMode: Schema$1.optional(Schema$1.Literals(["all", "selected"]))
+}));
+const decodeStoredHubLink = Schema$1.decodeUnknownExit(StoredHubLink);
+const encodeStoredHubLink = Schema$1.encodeSync(StoredHubLink);
+/**
+* Parse a stored record, tolerating anything that is not the shape we wrote.
+*
+* A corrupt secret disables the sync rather than failing the server's start.
+* Losing sync is recoverable by reconnecting; refusing to boot over it is not
+* proportionate to what has gone wrong.
+*/
+const parseHubLink = (raw) => {
+	const decoded = decodeStoredHubLink(raw);
+	if (decoded._tag !== "Success") return {
+		settings: Option.none(),
+		syncMode: "auto",
+		shareMode: "all"
+	};
+	return {
+		settings: validateHubLink(decoded.value.baseUrl, decoded.value.token),
+		syncMode: decoded.value.syncMode ?? "auto",
+		shareMode: decoded.value.shareMode ?? "all"
+	};
+};
+const formatHubLink = (input) => encodeStoredHubLink({
+	baseUrl: Option.match(input.settings, {
+		onNone: () => "",
+		onSome: (settings) => trimTrailingSlash(settings.baseUrl)
+	}),
+	token: Option.match(input.settings, {
+		onNone: () => "",
+		onSome: (s) => s.token
+	}),
+	syncMode: input.syncMode,
+	shareMode: input.shareMode
+});
+const fromEnvironment = (environment) => validateHubLink(environment.P4CODE_HUB_URL ?? "", environment.P4CODE_HUB_TOKEN ?? "");
+const make$113 = Effect.fn("HubLink.make")(function* (environment) {
+	const secrets = yield* ServerSecretStore;
+	const env = environment ?? process.env;
+	const fromEnv = fromEnvironment(env);
+	const readStored = Effect.fn("HubLink.readStored")(function* () {
+		const stored = yield* secrets.get(HUB_LINK_SECRET_NAME).pipe(Effect.orElseSucceed(() => Option.none()));
+		return Option.match(stored, {
+			onNone: () => ({
+				settings: Option.none(),
+				syncMode: "auto",
+				shareMode: "all"
+			}),
+			onSome: (bytes) => parseHubLink(new TextDecoder().decode(bytes))
+		});
+	});
+	const toState = (record) => Option.isSome(fromEnv) ? {
+		settings: fromEnv,
+		syncMode: record.syncMode,
+		shareMode: record.shareMode,
+		source: "environment"
+	} : {
+		settings: record.settings,
+		syncMode: record.syncMode,
+		shareMode: record.shareMode,
+		source: Option.isSome(record.settings) ? "stored" : "none"
+	};
+	const cache = yield* Ref.make(yield* readStored());
+	const updates = yield* PubSub.sliding({
+		capacity: 1,
+		replay: 1
+	});
+	yield* PubSub.publish(updates, toState(yield* Ref.get(cache)));
+	const persist = Effect.fn("HubLink.persist")(function* (record) {
+		yield* secrets.set(HUB_LINK_SECRET_NAME, new TextEncoder().encode(formatHubLink(record)));
+		yield* Ref.set(cache, record);
+		yield* PubSub.publish(updates, toState(record));
+		return toState(record);
+	});
+	return {
+		current: Ref.get(cache).pipe(Effect.map(toState)),
+		changes: Stream.fromPubSub(updates),
+		connect: (settings) => Effect.gen(function* () {
+			const validated = validateHubLink(settings.baseUrl, settings.token);
+			if (Option.isNone(validated)) return yield* new InvalidHubLink({ detail: "A hub needs an http or https URL and a non-empty token." });
+			const record = yield* Ref.get(cache);
+			return yield* persist({
+				...record,
+				settings: validated
+			});
+		}),
+		disconnect: Effect.gen(function* () {
+			const record = yield* Ref.get(cache);
+			return yield* persist({
+				...record,
+				settings: Option.none()
+			});
+		}),
+		setSyncMode: (mode) => Effect.gen(function* () {
+			const record = yield* Ref.get(cache);
+			return yield* persist({
+				...record,
+				syncMode: mode
+			});
+		}),
+		setShareMode: (mode) => Effect.gen(function* () {
+			const record = yield* Ref.get(cache);
+			return yield* persist({
+				...record,
+				shareMode: mode
+			});
+		})
+	};
+});
+const layer$95 = Layer.effect(HubLink, make$113());
+//#endregion
+//#region src/persistence/Layers/RemoteTasks.ts
+/**
+* The hub's task API, as a client.
+*
+* This used to be a `TaskRepository` in its own right, and the board was
+* either this or the local database. It is now the transport underneath
+* `SyncedTaskRepository`: local SQLite is a replica of the hub, so nothing
+* reads from here directly and the board no longer goes dark when the hub is
+* unreachable. What changed with it is the failure story — an unreachable hub
+* used to mean no board, and now means a board that is behind.
+*
+* The four calls here are what a mirror needs and no more: pull what changed
+* on the hub, push a whole row, arbitrate a claim, and delete. There is no partial
+* patch, because a mirror always holds the full row it wants the hub to have
+* and sending a diff of it would only add a way for the two to disagree.
+*
+* @module persistence/Layers/RemoteTasks
+*/
+const HUB_REQUEST_TIMEOUT_MS$1 = 15e3;
+/**
+* How often the hub writes to an idle `/v1/task-changes` stream. The client
+* treats two missed beats as a dead connection. Under ten seconds because Bun
+* closes a connection idle for ten, and proxies in front of a hosted hub are
+* rarely more patient.
+*/
+const HUB_TASK_CHANGES_HEARTBEAT_MS = 8e3;
+/**
+* `cursor`, `deletedTaskIds` and `full` are absent from a hub that predates
+* cursors, which answers every pull with the whole board.
+*/
+const TaskListPage = Schema$1.Struct({
+	tasks: Schema$1.Array(Task),
+	deletedTaskIds: Schema$1.optional(Schema$1.Array(TaskId)),
+	cursor: Schema$1.optional(Schema$1.String),
+	full: Schema$1.optional(Schema$1.Boolean)
+});
+const ConflictBody$1 = Schema$1.Struct({ current: Task });
+const decodeTaskListPage = Schema$1.decodeUnknownEffect(TaskListPage);
+const decodeTask = Schema$1.decodeUnknownEffect(Task);
+const decodeConflictBody$1 = Schema$1.decodeUnknownEffect(ConflictBody$1);
+/**
+* Every failure here is reported as the persistence error type.
+*
+* The mirror catches these and carries on — a failed push leaves the row
+* `pending` and the next pass retries it — so what matters is that the detail
+* says the hub was the store that would not answer, which is what shows up in
+* the log when someone asks why their two machines disagree.
+*/
+const hubUnavailable = (operation, detail) => new PersistenceSqlError({
+	operation: `HubTaskClient.${operation}`,
+	detail: `The hub board is unavailable: ${detail}`,
+	cause: null
+});
+var HubTaskClient = class extends Context.Service()("@p4code/cli/persistence/Layers/RemoteTasks/HubTaskClient") {};
+const makeHubTaskClient = Effect.gen(function* () {
+	const http = yield* HttpClient.HttpClient;
+	const link = yield* HubLink;
+	const isLinked = link.current.pipe(Effect.map((state) => Option.isSome(state.settings)));
+	const requireSettings = (operation) => Effect.gen(function* () {
+		const state = yield* link.current;
+		if (Option.isNone(state.settings)) return yield* hubUnavailable(operation, "no hub is configured on this server");
+		return state.settings.value;
+	});
+	const send = (operation, settings, request) => http.execute(request.pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`), HttpClientRequest.setHeader("accept", "application/json"))).pipe(Effect.timeout(HUB_REQUEST_TIMEOUT_MS$1), Effect.mapError((cause) => hubUnavailable(operation, `${cause._tag ?? "request failed"}`)));
+	const pull = (from) => Effect.gen(function* () {
+		const settings = yield* requireSettings("pull");
+		const resume = from?.baseUrl === settings.baseUrl ? from : void 0;
+		const request = HttpClientRequest.get(`${settings.baseUrl}/tasks${resume === void 0 ? "" : `?since=${encodeURIComponent(resume.cursor)}`}`);
+		const response = yield* send("pull", settings, resume?.etag === void 0 ? request : HttpClientRequest.setHeader(request, "if-none-match", resume.etag));
+		if (response.status === 304) return Option.none();
+		if (response.status !== 200) return yield* hubUnavailable("pull", `status ${response.status}`);
+		const body = yield* response.json.pipe(Effect.flatMap(decodeTaskListPage), Effect.mapError(() => hubUnavailable("pull", "the response did not match the contract")));
+		return Option.some({
+			full: body.full ?? true,
+			tasks: body.tasks,
+			deletedTaskIds: body.deletedTaskIds ?? [],
+			next: body.cursor === void 0 ? void 0 : {
+				baseUrl: settings.baseUrl,
+				cursor: body.cursor,
+				etag: response.headers.etag
+			}
+		});
+	});
+	const watch = Stream.unwrap(Effect.gen(function* () {
+		const settings = yield* requireSettings("watch");
+		const response = yield* http.execute(HttpClientRequest.get(`${settings.baseUrl}/v1/task-changes`).pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`))).pipe(Effect.mapError((cause) => hubUnavailable("watch", `${cause._tag ?? "request failed"}`)));
+		if (response.status !== 200) return yield* hubUnavailable("watch", `status ${response.status}`);
+		const relinked = link.changes.pipe(Stream.filter((state) => Option.isNone(state.settings) || state.settings.value.baseUrl !== settings.baseUrl || state.settings.value.token !== settings.token), Stream.runHead);
+		return response.stream.pipe(Stream.mapError(() => hubUnavailable("watch", "the change stream failed")), Stream.decodeText, Stream.splitLines, Stream.timeout(HUB_TASK_CHANGES_HEARTBEAT_MS * 2), Stream.filter((line) => line.includes("\"ready\"") || line.includes("\"changed\"")), Stream.map(() => void 0), Stream.interruptWhen(relinked));
+	}));
+	const put = (row, readableIdPrefix) => Effect.gen(function* () {
+		const settings = yield* requireSettings("put");
+		const response = yield* send("put", settings, HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.put(`${settings.baseUrl}/tasks/${encodeURIComponent(row.taskId)}`), {
+			projectId: row.projectId,
+			repositoryKey: row.repositoryKey,
+			threadId: row.threadId,
+			parentTaskId: row.parentTaskId,
+			title: row.title,
+			body: row.body,
+			status: row.status,
+			priority: row.priority,
+			assignee: row.assignee,
+			labels: row.labels,
+			orderKey: row.orderKey,
+			createdAt: row.createdAt,
+			statusChangedAt: row.statusChangedAt ?? row.updatedAt,
+			readableIdPrefix
+		}));
+		if (response.status !== 200 && response.status !== 201) return yield* hubUnavailable("put", `status ${response.status}`);
+		return yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("put", "the response did not match the contract")));
+	});
+	const patchIfStatus = (input) => Effect.gen(function* () {
+		const settings = yield* requireSettings("patchIfStatus");
+		const { taskId, ...fields } = input.patch;
+		const response = yield* send("patchIfStatus", settings, HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.patch(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`), {
+			...fields,
+			expectedStatus: input.expectedStatus
+		}));
+		if (response.status === 404) return { outcome: "missing" };
+		if (response.status === 409) return {
+			outcome: "conflict",
+			current: (yield* response.json.pipe(Effect.flatMap(decodeConflictBody$1), Effect.mapError(() => hubUnavailable("patchIfStatus", "the conflict response did not match the contract")))).current
+		};
+		if (response.status !== 200) return yield* hubUnavailable("patchIfStatus", `status ${response.status}`);
+		return {
+			outcome: "updated",
+			task: yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("patchIfStatus", "the response did not match the contract")))
+		};
+	});
+	const remove = (taskId) => Effect.gen(function* () {
+		const settings = yield* requireSettings("remove");
+		const response = yield* send("remove", settings, HttpClientRequest.delete(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`));
+		if (response.status !== 200 && response.status !== 204 && response.status !== 404) return yield* hubUnavailable("remove", `status ${response.status}`);
+	});
+	return {
+		isLinked,
+		pull,
+		watch,
+		put,
+		patchIfStatus,
+		remove
+	};
+});
+Layer.effect(HubTaskClient, makeHubTaskClient);
+//#endregion
 //#region src/hub/HubHttpServer.ts
 /**
 * The hub's HTTP surface.
@@ -28857,10 +29219,66 @@ const identityRoute = HttpRouter.add("GET", "/v1/identity", respondToHubFailures
 		environmentId: principal.environmentId
 	}, { headers: { "cache-control": "no-store" } });
 })));
+/**
+* Minted per process, not per database: a database restored from a backup
+* carries its old sequence numbers, and a cursor past the restore point would
+* otherwise skip every write it lost. The cost is one full pull per server
+* after each hub restart.
+*/
+const TASK_CURSOR_EPOCH = NodeCrypto.randomBytes(8).toString("hex");
+/**
+* The board, or what changed on it since a cursor.
+*
+* `?since=<cursor>` returns rows changed after that cursor plus the ids
+* deleted since, so a server polling an idle board downloads almost nothing.
+* An unfiltered list also carries the cursor to start from. A cursor this
+* process never issued gets the whole board back with `full: true`. Cursors
+* are `<epoch>-<seq>`; callers treat them as opaque.
+*/
+const readTaskPage = Effect.fn("HubHttpServer.readTaskPage")(function* (filter, since) {
+	const tasks = yield* TaskRepository;
+	if (since === void 0 && Object.keys(filter).length > 0) return { tasks: yield* tasks.list(filter) };
+	const sql = yield* SqlClient.SqlClient;
+	const [head] = yield* sql`SELECT COALESCE(MAX(seq), 0) AS seq FROM task_change_log`;
+	const seq = head?.seq ?? 0;
+	const epoch = TASK_CURSOR_EPOCH;
+	const cursor = `${epoch}-${seq}`;
+	const [sinceEpoch, sinceSeqText] = since?.split("-") ?? [];
+	const sinceSeq = Number(sinceSeqText);
+	if (since === void 0 || sinceEpoch !== epoch || sinceSeq > seq) return {
+		tasks: yield* tasks.list({}),
+		deletedTaskIds: [],
+		cursor,
+		full: true
+	};
+	const changes = yield* sql`
+    SELECT task_id AS "taskId", deleted FROM task_change_log
+    WHERE seq > ${sinceSeq} AND seq <= ${seq}
+    ORDER BY seq
+  `;
+	const changed = [];
+	const deletedTaskIds = [];
+	for (const change of changes) {
+		if (change.deleted === 1) {
+			deletedTaskIds.push(change.taskId);
+			continue;
+		}
+		const task = yield* tasks.getById({ taskId: change.taskId });
+		if (Option.isSome(task)) changed.push(task.value);
+	}
+	return {
+		tasks: changed,
+		deletedTaskIds,
+		cursor,
+		full: false
+	};
+});
+/** Weak, because gzip may re-encode the same representation on the way out. */
+const taskPageEtag = (body) => `W/"${NodeCrypto.createHash("sha256").update(body).digest("base64url")}"`;
+const matchesEtag = (ifNoneMatch, etag) => ifNoneMatch !== void 0 && ifNoneMatch.split(",").map((candidate) => candidate.trim().replace(/^W\//, "")).some((candidate) => candidate === "*" || candidate === etag.replace(/^W\//, ""));
 const listTasksRoute = HttpRouter.add("GET", "/tasks", respondToHubFailures(Effect.gen(function* () {
 	yield* authenticateHubRequest();
 	const request = yield* HttpServerRequest.HttpServerRequest;
-	const tasks = yield* TaskRepository;
 	const url = new URL(request.url, "http://hub.invalid");
 	const filter = yield* decodeOrInvalid(TaskListFilter, "Query string does not match TaskListFilter.")(Object.fromEntries([
 		"projectId",
@@ -28869,8 +29287,39 @@ const listTasksRoute = HttpRouter.add("GET", "/tasks", respondToHubFailures(Effe
 		"assignee",
 		"query"
 	].map((key) => [key, url.searchParams.get(key)]).filter(([, value]) => value !== null)));
-	const listed = yield* tasks.list(filter);
-	return HttpServerResponse.jsonUnsafe({ tasks: listed });
+	const sinceParam = url.searchParams.get("since");
+	if (sinceParam !== null && (!/^[0-9a-f]{1,32}-\d{1,15}$/.test(sinceParam) || Object.keys(filter).length > 0)) return yield* new InvalidHubRequest({ detail: "`since` must be a cursor from an earlier page and cannot be combined with filters." });
+	const page = yield* readTaskPage(filter, sinceParam ?? void 0);
+	const body = JSON.stringify(page);
+	const etag = taskPageEtag(body);
+	if (matchesEtag(request.headers["if-none-match"], etag)) return HttpServerResponse.empty({
+		status: 304,
+		headers: { etag }
+	});
+	return HttpServerResponse.text(body, {
+		contentType: "application/json",
+		headers: { etag }
+	});
+})));
+const taskChangeLine = (type) => new TextEncoder().encode(`{"type":"${type}"}\n`);
+/**
+* A nudge per board write, so linked servers pull when something changed
+* instead of on a timer.
+*
+* Carries no rows: the server answers a nudge with the same cursor pull it
+* always makes, so a nudge that is lost or duplicated costs nothing but
+* latency. `ready` doubles as a nudge, covering whatever changed while the
+* server was not listening.
+*/
+const taskChangesRoute = HttpRouter.add("GET", "/v1/task-changes", respondToHubFailures(Effect.gen(function* () {
+	yield* authenticateHubRequest();
+	const tasks = yield* TaskRepository;
+	const events = Stream.merge(tasks.streamWithSnapshot.pipe(Stream.map((event) => taskChangeLine(event.type === "snapshot" ? "ready" : "changed"))), Stream.tick(HUB_TASK_CHANGES_HEARTBEAT_MS).pipe(Stream.drop(1), Stream.map(() => taskChangeLine("heartbeat"))));
+	return HttpServerResponse.stream(events, { headers: {
+		"content-type": "application/x-ndjson",
+		"cache-control": "no-store",
+		"x-accel-buffering": "no"
+	} });
 })));
 const getTaskRoute = HttpRouter.add("GET", "/tasks/:taskId", respondToHubFailures(Effect.gen(function* () {
 	yield* authenticateHubRequest();
@@ -29292,7 +29741,7 @@ const releaseFeedLeaseRoute = HttpRouter.add("DELETE", "/feed/lease", respondToH
 })));
 /** Provide around HttpRouter.serve so request fibers share these process-owned services. */
 const routingServices = Layer.mergeAll(layer$113, layer$111, layer$102, layer$101).pipe(Layer.provideMerge(layer$112));
-const layer$95 = Layer.mergeAll(layer$100, layer$99, layer$103, layer$97, layer$96, layer$110, layer$98, healthRoute, identityRoute, listTasksRoute, getTaskRoute, createTaskRoute, putTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute, listFeedSourcesRoute, upsertFeedSourceRoute, deleteFeedSourceRoute, listFeedRoute, putFeedArticleRoute, putFeedEngagementRoute, markFeedReadRoute, cleanupFeedRoute, setFeedRefreshedAtRoute, acquireFeedLeaseRoute, renewFeedLeaseRoute, releaseFeedLeaseRoute).pipe(Layer.provideMerge(layer$113), Layer.provideMerge(layer$111), Layer.provideMerge(layer$102));
+const layer$94 = Layer.mergeAll(layer$100, layer$99, layer$103, layer$97, layer$96, layer$110, layer$98, healthRoute, identityRoute, listTasksRoute, taskChangesRoute, getTaskRoute, createTaskRoute, putTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute, listFeedSourcesRoute, upsertFeedSourceRoute, deleteFeedSourceRoute, listFeedRoute, putFeedArticleRoute, putFeedEngagementRoute, markFeedReadRoute, cleanupFeedRoute, setFeedRefreshedAtRoute, acquireFeedLeaseRoute, renewFeedLeaseRoute, releaseFeedLeaseRoute).pipe(Layer.provideMerge(layer$113), Layer.provideMerge(layer$111), Layer.provideMerge(layer$102));
 //#endregion
 //#region src/hub/Migrations/001_Tasks.ts
 /**
@@ -29789,6 +30238,57 @@ var _022_AnalyticsFacts_default = Effect.gen(function* () {
     ON hub_analytics_facts(account_id, kind, occurred_at DESC, event_id DESC)`;
 });
 //#endregion
+//#region src/hub/Migrations/023_TaskChangeLog.ts
+/**
+* One row per task that has ever existed, stamped with the order of its last
+* change, so a server can ask for "everything since cursor N" instead of the
+* whole board every poll.
+*
+* The sequence is the hub's, not `updated_at`: that timestamp is written by
+* whichever machine made the edit, and a machine with a slow clock would land
+* behind a cursor that already moved past it. `AUTOINCREMENT` never reuses a
+* value, and SQLite serializes writers, so a reader never sees N+1 before N.
+*
+* Triggers rather than repository code, because the hub shares
+* `TaskRepository` with every environment server and only the hub needs this.
+* A delete keeps its row with `deleted = 1`, which is how another machine
+* learns the task is gone. The triggers delete then insert rather than
+* `INSERT OR REPLACE`, because the repository writes with an upsert and its
+* conflict policy overrides the trigger's, failing the whole write.
+*/
+var _023_TaskChangeLog_default = Effect.gen(function* () {
+	const sql = yield* SqlClient.SqlClient;
+	yield* sql`
+    CREATE TABLE task_change_log (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT,
+      task_id TEXT NOT NULL UNIQUE,
+      deleted INTEGER NOT NULL DEFAULT 0
+    )
+  `;
+	yield* sql`
+    INSERT INTO task_change_log (task_id)
+    SELECT task_id FROM tasks ORDER BY updated_at, task_id
+  `;
+	yield* sql`
+    CREATE TRIGGER task_change_log_insert AFTER INSERT ON tasks BEGIN
+      DELETE FROM task_change_log WHERE task_id = NEW.task_id;
+      INSERT INTO task_change_log (task_id, deleted) VALUES (NEW.task_id, 0);
+    END
+  `;
+	yield* sql`
+    CREATE TRIGGER task_change_log_update AFTER UPDATE ON tasks BEGIN
+      DELETE FROM task_change_log WHERE task_id = NEW.task_id;
+      INSERT INTO task_change_log (task_id, deleted) VALUES (NEW.task_id, 0);
+    END
+  `;
+	yield* sql`
+    CREATE TRIGGER task_change_log_delete AFTER DELETE ON tasks BEGIN
+      DELETE FROM task_change_log WHERE task_id = OLD.task_id;
+      INSERT INTO task_change_log (task_id, deleted) VALUES (OLD.task_id, 1);
+    END
+  `;
+});
+//#endregion
 //#region src/hub/Migrations.ts
 /**
 * Hub migrations.
@@ -29909,6 +30409,11 @@ const hubMigrationEntries = [
 		22,
 		"AnalyticsFacts",
 		_022_AnalyticsFacts_default
+	],
+	[
+		23,
+		"TaskChangeLog",
+		_023_TaskChangeLog_default
 	]
 ];
 const hubMigrationLoader = Migrator.fromRecord(Object.fromEntries(hubMigrationEntries.map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -30000,7 +30505,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 	});
 	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
-const makeHubLayer = HttpRouter.serve(Layer.mergeAll(layer$95, layer$107, layer$109)).pipe(Layer.provideMerge(routingServices), Layer.provideMerge(layer$105), Layer.provideMerge(layer$106), Layer.provideMerge(layer$104), Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$115), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
+const makeHubLayer = HttpRouter.serve(Layer.mergeAll(layer$94, layer$107, layer$109).pipe(Layer.provide(httpCompressionLayer))).pipe(Layer.provideMerge(typeof Bun !== "undefined" ? layerBun : layerNode), Layer.provideMerge(routingServices), Layer.provideMerge(layer$105), Layer.provideMerge(layer$106), Layer.provideMerge(layer$104), Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$115), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
 //#endregion
 //#region src/atomicWrite.ts
@@ -30157,7 +30662,7 @@ function stripDefaultServerSettings(current, defaults) {
 	}
 	return Object.is(current, defaults) ? void 0 : current;
 }
-const make$113 = Effect.gen(function* () {
+const make$112 = Effect.gen(function* () {
 	const { settingsPath } = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const pathService = yield* Path$1.Path;
@@ -30380,7 +30885,7 @@ const make$113 = Effect.gen(function* () {
 		}
 	};
 });
-const layer$94 = Layer.effect(ServerSettingsService, make$113);
+const layer$93 = Layer.effect(ServerSettingsService, make$112);
 //#endregion
 //#region src/provider/skillWorkspace.ts
 /** Ancestors inside the nearest Git checkout, ordered from root to cwd. */
@@ -31124,7 +31629,7 @@ function entriesOf(config) {
 	return found;
 }
 var ClaudeMcpFiles = class extends Context.Service()("@p4code/cli/mcp/ClaudeMcpFiles") {};
-const make$112 = Effect.gen(function* () {
+const make$111 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path$1.Path;
 	const services = yield* Effect.context();
@@ -31195,7 +31700,7 @@ const make$112 = Effect.gen(function* () {
 		removeProject: (projectDir, name) => removeAt(Effect.succeed(projectFile(projectDir)))(name)
 	};
 });
-const layer$93 = Layer.effect(ClaudeMcpFiles, make$112);
+const layer$92 = Layer.effect(ClaudeMcpFiles, make$111);
 Layer.succeed(ClaudeMcpFiles, {
 	readUser: Effect.succeed([]),
 	readUserStrict: Effect.succeed([]),
@@ -31369,7 +31874,7 @@ const decodeClientRegistration = Schema$1.decodeUnknownExit(ClientRegistrationRe
 const decodeTokenResponse = Schema$1.decodeUnknownExit(TokenResponse);
 var McpOAuth = class extends Context.Service()("@p4code/cli/mcp/McpOAuth") {};
 const registryError = (detail) => new McpRegistryError({ detail });
-const make$111 = Effect.gen(function* () {
+const make$110 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
 	const http = yield* HttpClient.HttpClient;
@@ -31774,7 +32279,7 @@ const make$111 = Effect.gen(function* () {
 		grantIdentityFor
 	};
 });
-const layer$92 = Layer.effect(McpOAuth, make$111);
+const layer$91 = Layer.effect(McpOAuth, make$110);
 Layer.succeed(McpOAuth, {
 	statusFor: () => Effect.succeed(Option.none()),
 	begin: () => Effect.fail(new McpRegistryError({ detail: "OAuth sign-in is not available." })),
@@ -31829,7 +32334,7 @@ const slotsOf = (registration) => registration.secrets ?? [];
 */
 const OMITTED_FOR_SIGN_IN = "mcp server omitted: sign-in required";
 const SIGN_IN_ACTION = "Connect it in Settings > MCP servers.";
-const make$110 = Effect.gen(function* () {
+const make$109 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
 	const oauth = yield* McpOAuth;
@@ -32109,7 +32614,7 @@ const make$110 = Effect.gen(function* () {
 		resolveForSessionAtClaudeUserConfigPath
 	};
 });
-const layer$91 = Layer.effect(McpRegistry, make$110);
+const layer$90 = Layer.effect(McpRegistry, make$109);
 //#endregion
 //#region src/sync/skillDirectory.ts
 /**
@@ -32393,176 +32898,6 @@ const removeAgentDefinition = Effect.fn("agentDefinitionFiles.remove")(function*
 	yield* fileSystem.remove(path.join(input.agentsRoot, input.name), { force: true });
 });
 //#endregion
-//#region src/sync/HubLink.ts
-/**
-* Where this server's hub is, what it authenticates with, and whether it syncs
-* on its own.
-*
-* Absent by default. A server with no hub configured runs exactly as it does
-* today — the sync is skipped rather than failing, because "no hub" is a
-* complete and normal configuration, not a broken one.
-*
-* The record lives in `ServerSecretStore`, which already writes with
-* restrictive permissions, rather than in the settings file or the database.
-* The sync mode rides along in that record even though it is not a secret:
-* connect, disconnect and pause are then one write and one read, and the
-* settings panel reads one thing instead of joining two. Environment variables
-* override the link so a container or a service unit can be configured without
-* a first-run interactive step — the same trade the hub process itself makes
-* with `P4CODE_HUB_TOKEN_HASHES` — while the mode always comes from the stored
-* record, so a server configured by environment can still be paused.
-*
-* Mutable, deliberately. Resolving this once at layer construction would mean
-* connecting to a hub did nothing until the server restarted, which is a
-* miserable thing to discover after typing a token into a form.
-*
-* @module sync/HubLink
-*/
-/** Secret name holding the hub record as JSON. */
-const HUB_LINK_SECRET_NAME = "hub-link";
-var HubLink = class extends Context.Service()("@p4code/cli/sync/HubLink") {};
-/** The submitted URL or token could not make a usable link. */
-var InvalidHubLink = class extends Schema$1.TaggedErrorClass()("InvalidHubLink", { detail: Schema$1.String }) {
-	get message() {
-		return this.detail;
-	}
-};
-const trimTrailingSlash = (value) => value.replace(/\/+$/u, "");
-/**
-* Both halves must be present and the URL parseable. A half-configured link is
-* treated as no link at all, because a server that thinks it has a hub and
-* cannot form a request would report every sync as a failure rather than as the
-* "not configured" it actually is.
-*/
-const validateHubLink = (rawBaseUrl, rawToken) => {
-	const trimmed = trimTrailingSlash(rawBaseUrl.trim());
-	const token = rawToken.trim();
-	if (trimmed.length === 0 || token.length === 0) return Option.none();
-	const baseUrl = /^[a-z][a-z0-9+.-]*:\/\//iu.test(trimmed) ? trimmed : `https://${trimmed}`;
-	if (!URL.canParse(baseUrl)) return Option.none();
-	const parsed = new URL(baseUrl);
-	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return Option.none();
-	return Option.some({
-		baseUrl,
-		token
-	});
-};
-const StoredHubLink = Schema$1.fromJsonString(Schema$1.Struct({
-	baseUrl: Schema$1.String,
-	token: Schema$1.String,
-	syncMode: Schema$1.optional(Schema$1.Literals(["auto", "paused"])),
-	shareMode: Schema$1.optional(Schema$1.Literals(["all", "selected"]))
-}));
-const decodeStoredHubLink = Schema$1.decodeUnknownExit(StoredHubLink);
-const encodeStoredHubLink = Schema$1.encodeSync(StoredHubLink);
-/**
-* Parse a stored record, tolerating anything that is not the shape we wrote.
-*
-* A corrupt secret disables the sync rather than failing the server's start.
-* Losing sync is recoverable by reconnecting; refusing to boot over it is not
-* proportionate to what has gone wrong.
-*/
-const parseHubLink = (raw) => {
-	const decoded = decodeStoredHubLink(raw);
-	if (decoded._tag !== "Success") return {
-		settings: Option.none(),
-		syncMode: "auto",
-		shareMode: "all"
-	};
-	return {
-		settings: validateHubLink(decoded.value.baseUrl, decoded.value.token),
-		syncMode: decoded.value.syncMode ?? "auto",
-		shareMode: decoded.value.shareMode ?? "all"
-	};
-};
-const formatHubLink = (input) => encodeStoredHubLink({
-	baseUrl: Option.match(input.settings, {
-		onNone: () => "",
-		onSome: (settings) => trimTrailingSlash(settings.baseUrl)
-	}),
-	token: Option.match(input.settings, {
-		onNone: () => "",
-		onSome: (s) => s.token
-	}),
-	syncMode: input.syncMode,
-	shareMode: input.shareMode
-});
-const fromEnvironment = (environment) => validateHubLink(environment.P4CODE_HUB_URL ?? "", environment.P4CODE_HUB_TOKEN ?? "");
-const make$109 = Effect.fn("HubLink.make")(function* (environment) {
-	const secrets = yield* ServerSecretStore;
-	const env = environment ?? process.env;
-	const fromEnv = fromEnvironment(env);
-	const readStored = Effect.fn("HubLink.readStored")(function* () {
-		const stored = yield* secrets.get(HUB_LINK_SECRET_NAME).pipe(Effect.orElseSucceed(() => Option.none()));
-		return Option.match(stored, {
-			onNone: () => ({
-				settings: Option.none(),
-				syncMode: "auto",
-				shareMode: "all"
-			}),
-			onSome: (bytes) => parseHubLink(new TextDecoder().decode(bytes))
-		});
-	});
-	const toState = (record) => Option.isSome(fromEnv) ? {
-		settings: fromEnv,
-		syncMode: record.syncMode,
-		shareMode: record.shareMode,
-		source: "environment"
-	} : {
-		settings: record.settings,
-		syncMode: record.syncMode,
-		shareMode: record.shareMode,
-		source: Option.isSome(record.settings) ? "stored" : "none"
-	};
-	const cache = yield* Ref.make(yield* readStored());
-	const updates = yield* PubSub.sliding({
-		capacity: 1,
-		replay: 1
-	});
-	yield* PubSub.publish(updates, toState(yield* Ref.get(cache)));
-	const persist = Effect.fn("HubLink.persist")(function* (record) {
-		yield* secrets.set(HUB_LINK_SECRET_NAME, new TextEncoder().encode(formatHubLink(record)));
-		yield* Ref.set(cache, record);
-		yield* PubSub.publish(updates, toState(record));
-		return toState(record);
-	});
-	return {
-		current: Ref.get(cache).pipe(Effect.map(toState)),
-		changes: Stream.fromPubSub(updates),
-		connect: (settings) => Effect.gen(function* () {
-			const validated = validateHubLink(settings.baseUrl, settings.token);
-			if (Option.isNone(validated)) return yield* new InvalidHubLink({ detail: "A hub needs an http or https URL and a non-empty token." });
-			const record = yield* Ref.get(cache);
-			return yield* persist({
-				...record,
-				settings: validated
-			});
-		}),
-		disconnect: Effect.gen(function* () {
-			const record = yield* Ref.get(cache);
-			return yield* persist({
-				...record,
-				settings: Option.none()
-			});
-		}),
-		setSyncMode: (mode) => Effect.gen(function* () {
-			const record = yield* Ref.get(cache);
-			return yield* persist({
-				...record,
-				syncMode: mode
-			});
-		}),
-		setShareMode: (mode) => Effect.gen(function* () {
-			const record = yield* Ref.get(cache);
-			return yield* persist({
-				...record,
-				shareMode: mode
-			});
-		})
-	};
-});
-const layer$90 = Layer.effect(HubLink, make$109());
-//#endregion
 //#region src/sync/HubAssetClient.ts
 /**
 * The server's half of the hub's asset API.
@@ -32576,7 +32911,7 @@ const layer$90 = Layer.effect(HubLink, make$109());
 *
 * @module sync/HubAssetClient
 */
-const HUB_REQUEST_TIMEOUT_MS$1 = 15e3;
+const HUB_REQUEST_TIMEOUT_MS = 15e3;
 /**
 * The hub could not be reached, or answered something unusable.
 *
@@ -32589,9 +32924,9 @@ var HubAssetConflict = class extends Data.TaggedError("HubAssetConflict") {};
 /** No hub is configured on this server, so there is nothing to talk to. */
 var HubNotConfigured = class extends Data.TaggedError("HubNotConfigured") {};
 const AssetListPage = Schema$1.Struct({ assets: Schema$1.Array(AgentAsset) });
-const ConflictBody$1 = Schema$1.Struct({ current: Schema$1.NullOr(AgentAsset) });
+const ConflictBody = Schema$1.Struct({ current: Schema$1.NullOr(AgentAsset) });
 const decodeAssetListPage = Schema$1.decodeUnknownEffect(AssetListPage);
-const decodeConflictBody$1 = Schema$1.decodeUnknownEffect(ConflictBody$1);
+const decodeConflictBody = Schema$1.decodeUnknownEffect(ConflictBody);
 const decodeAsset = Schema$1.decodeUnknownEffect(AgentAsset);
 var HubAssetClient = class extends Context.Service()("@p4code/cli/sync/HubAssetClient") {};
 const make$108 = Effect.gen(function* () {
@@ -32603,7 +32938,7 @@ const make$108 = Effect.gen(function* () {
 		return state.settings.value;
 	});
 	const send = Effect.fn("HubAssetClient.send")(function* (operation, settings, request) {
-		return yield* http.execute(request.pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`), HttpClientRequest.setHeader("accept", "application/json"))).pipe(Effect.timeout(HUB_REQUEST_TIMEOUT_MS$1), Effect.mapError((cause) => new HubUnavailable({
+		return yield* http.execute(request.pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`), HttpClientRequest.setHeader("accept", "application/json"))).pipe(Effect.timeout(HUB_REQUEST_TIMEOUT_MS), Effect.mapError((cause) => new HubUnavailable({
 			operation,
 			detail: `${cause._tag ?? "error"}`
 		})));
@@ -32623,7 +32958,7 @@ const make$108 = Effect.gen(function* () {
 	* which is what lets a caller show both sides instead of only saying no.
 	*/
 	const conflictFrom = Effect.fn("HubAssetClient.conflictFrom")(function* (name, response) {
-		const body = yield* decodeBody("conflict", decodeConflictBody$1, response).pipe(Effect.orElseSucceed(() => ({ current: null })));
+		const body = yield* decodeBody("conflict", decodeConflictBody, response).pipe(Effect.orElseSucceed(() => ({ current: null })));
 		return new HubAssetConflict({
 			name,
 			current: body.current === null ? Option.none() : Option.some(body.current)
@@ -34849,7 +35184,7 @@ const findAgentPreset = (requested) => {
 };
 //#endregion
 //#region src/cli/assets.ts
-const SyncServicesLive = layer$88.pipe(Layer.provideMerge(layer$89), Layer.provideMerge(layer$90), Layer.provideMerge(layer$94.pipe(Layer.provide(layer$120))), Layer.provideMerge(layer$120), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$88.pipe(Layer.provideMerge(layer$89), Layer.provideMerge(layer$95), Layer.provideMerge(layer$93.pipe(Layer.provide(layer$120))), Layer.provideMerge(layer$120), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -51250,7 +51585,7 @@ const makeWithHosts = Effect.fn("DeviceService.makeWithHosts")(function* (input)
 		yield* (yield* initialize).refresh;
 		if (access === "agent" && !state.agentAccessEnabled) return yield* new DeviceOperationError({
 			operation: "list",
-			reason: "settings_failed",
+			reason: "agent_access_disabled",
 			cause: "Agent device access is disabled."
 		});
 		const ids = enabled ? state.hosts.map((host) => host.id) : [];
@@ -57639,6 +57974,7 @@ const requireThreadSpawn = Effect.fn("mcp.requireThreadSpawn")(function* (fusion
 //#region src/mcp/DeviceInvocation.ts
 const isDeviceToolUnavailableError = Schema$1.is(DeviceToolUnavailableError);
 const isDeviceActionUnavailableError = Schema$1.is(DeviceActionUnavailableError);
+const isDeviceOperationError = Schema$1.is(DeviceOperationError);
 /** Internal bridge; tool payloads never choose thread identity or daemon credentials. */
 const withDeviceInvocation = (execute, capability = "devices") => Effect.gen(function* () {
 	const invocation = yield* McpInvocationContext;
@@ -57646,7 +57982,7 @@ const withDeviceInvocation = (execute, capability = "devices") => Effect.gen(fun
 	const lifetime = invocation.authorizationLifetime;
 	const denied = () => new DeviceToolUnavailableError({ reason: "Device command unavailable or authorization changed." });
 	if (!invocation.capabilities.has(capability) || !lifetime?.revocation || lifetime.revoked) return yield* denied();
-	const work = execute(service, invocation.threadId).pipe(Effect.tap(() => lifetime.revoked ? Effect.fail(denied()) : Effect.void), Effect.mapError((error) => isDeviceToolUnavailableError(error) || isDeviceActionUnavailableError(error) ? error : denied()));
+	const work = execute(service, invocation.threadId).pipe(Effect.tap(() => lifetime.revoked ? Effect.fail(denied()) : Effect.void), Effect.mapError((error) => isDeviceToolUnavailableError(error) || isDeviceActionUnavailableError(error) ? error : isDeviceOperationError(error) && error.reason === "agent_access_disabled" ? new DeviceToolUnavailableError({ reason: error.message }) : denied()));
 	return yield* Effect.raceFirst(work, Deferred.await(lifetime.revocation).pipe(Effect.andThen(Effect.fail(denied()))));
 });
 const withDeviceSession = (target, execute) => withDeviceInvocation((service, threadId) => service.withAgentCommand({
@@ -58879,18 +59215,6 @@ const acceptBunDeviceSocket = Effect.fn("DeviceHubBunSocket.accept")(function* (
 	}))), MAX_DEVICE_INPUT_BYTES, MAX_DEVICE_OUTPUT_BYTES);
 });
 //#endregion
-//#region src/httpCompression/HttpResponseCompression.ts
-var HttpResponseCompression = class extends Context.Service()("@p4code/cli/httpCompression/HttpResponseCompression") {};
-const layerNode = Layer.effect(HttpResponseCompression, Effect.gen(function* () {
-	const NodeZlib = yield* Effect.promise(() => import("node:zlib"));
-	return { gzip: (body, options) => {
-		const stream = NodeZlib.createGzip();
-		stream.end(body);
-		return HttpServerResponse$1.raw(stream, options);
-	} };
-}));
-const layerBun = Layer.succeed(HttpResponseCompression, { gzip: (body, options) => HttpServerResponse$1.raw(new Response(body).body.pipeThrough(new CompressionStream("gzip")), options) });
-//#endregion
 //#region ../../packages/shared/src/devProxy.ts
 /**
 * Backend paths the web dev server proxies in single-origin browser dev.
@@ -60562,7 +60886,6 @@ const LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set([
 	"localhost"
 ]);
 const DESKTOP_RENDERER_ORIGINS = ["p4code://app", "p4code-dev://app"];
-const GZIP_MIN_BYTES = 1024;
 const SVG_CONTENT_SECURITY_POLICY = "default-src 'none'; style-src 'unsafe-inline'; sandbox";
 function assetResponseHeaders(filePath) {
 	return {
@@ -60571,36 +60894,6 @@ function assetResponseHeaders(filePath) {
 		...filePath.toLowerCase().endsWith(".svg") ? { "Content-Security-Policy": SVG_CONTENT_SECURITY_POLICY } : {}
 	};
 }
-function acceptsGzip(value) {
-	if (!value) return false;
-	const accepted = new Map(value.split(",").map((entry) => {
-		const [coding = "", ...parameters] = entry.trim().toLowerCase().split(";");
-		const quality = parameters.map((parameter) => parameter.trim().match(/^q=(.+)$/)?.[1]).find((parameter) => parameter !== void 0);
-		return [coding, quality === void 0 ? 1 : Number(quality)];
-	}));
-	return (accepted.get("gzip") ?? accepted.get("*") ?? 0) > 0;
-}
-function varyByAcceptEncoding(value) {
-	if (!value) return "Accept-Encoding";
-	const values = new Set(value.split(",").map((entry) => entry.trim().toLowerCase()));
-	return values.has("*") || values.has("accept-encoding") ? value : `${value}, Accept-Encoding`;
-}
-const compressHttpResponse = Effect.fnUntraced(function* (response, acceptEncoding) {
-	const body = response.body;
-	if (body._tag !== "Uint8Array" || body.contentLength < GZIP_MIN_BYTES || !body.contentType.startsWith("application/json") || response.headers["content-encoding"]) return response;
-	const variedResponse = HttpServerResponse.setHeader(response, "vary", varyByAcceptEncoding(response.headers.vary));
-	if (!acceptsGzip(acceptEncoding)) return variedResponse;
-	const compression = yield* HttpResponseCompression;
-	const headers = Headers$1.set(Headers$1.remove(variedResponse.headers, "content-length"), "content-encoding", "gzip");
-	return compression.gzip(body.body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers,
-		cookies: response.cookies,
-		contentType: body.contentType
-	});
-});
-const httpCompressionLayer = HttpRouter.middleware((httpEffect) => Effect.flatMap(Effect.all([httpEffect, HttpServerRequest.HttpServerRequest]), ([response, request]) => compressHttpResponse(response, request.headers["accept-encoding"])), { global: true });
 const browserApiCorsLayer = Layer.unwrap(Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const devOrigin = config.devUrl?.origin;
@@ -69433,6 +69726,13 @@ const NARRATE_BEFORE_TOOLS_PROMPT = "Before each turn's first tool call, state n
 */
 const SUBAGENTS_ALLOWED_PROMPT = "You may spawn Task subagents without asking; this overrides earlier request-only rules. Use for bounded search/review whose result is far smaller than required reading. Single-file answer/edit stays inline.";
 const SUBAGENTS_ON_REQUEST_PROMPT = "Never spawn Task subagents unless user asks; this overrides earlier proactive permission. Work inline; say when delegation would have been better.";
+/**
+* Appended to ordinary (non-Fusion) sessions. Fusion role prompts already tell
+* both roles to follow applicable instructions and load memories and skills;
+* without the same line an ordinary thread treats the user's memory store as
+* optional background it may skip.
+*/
+const INSTRUCTIONS_AND_MEMORY_PROMPT = "Follow applicable global and project instructions, and load relevant memories and skills on demand. When ~/.agent-memory exists, read its INDEX.md and the entries it points you to before acting.";
 //#endregion
 //#region src/provider/Layers/ClaudeAdapter.ts
 /**
@@ -70108,6 +70408,22 @@ const CLAUDE_SETTING_SOURCES = [
 	"project",
 	"local"
 ];
+/**
+* Claude user-scope MCP servers this session already receives under their
+* `p4-user-` alias, as `deniedMcpServers` entries.
+*
+* The `user` setting source still loads the originals from `~/.claude.json`,
+* where Claude has no credential for a server p4code authorized. An OAuth
+* server then appears twice, once working and once as "needs authentication",
+* and the agent believes the service is unavailable. Denying each original by
+* name leaves the working alias as the only copy. The deny matches by name in
+* every Claude scope, so a same-named project server is dropped too.
+*/
+function claudeShadowedUserScopeMcpServers(sessionServerNames) {
+	const prefix = mcpUserScopeSessionName("");
+	const names = new Set(sessionServerNames);
+	return sessionServerNames.filter((name) => name.startsWith(prefix)).map((name) => name.slice(prefix.length)).filter((original) => original.length > 0 && !names.has(original)).map((serverName) => ({ serverName }));
+}
 function buildPromptText(input, boundInstanceId, customModels = [], manifest) {
 	const rawEffort = input.modelSelection?.instanceId === boundInstanceId ? getModelSelectionStringOptionValue(input.modelSelection, "effort") : null;
 	const caps = getClaudeModelCapabilities(input.modelSelection?.instanceId === boundInstanceId ? input.modelSelection.model : void 0, customModels, manifest);
@@ -72143,14 +72459,16 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 		}[input.runtimeMode];
 		const disabledSkills = options?.resolveDisabledSkills === void 0 ? [] : yield* options.resolveDisabledSkills;
 		const skillOverrides = disabledSkills.length === 0 ? void 0 : buildSkillOverrides(disabledSkills, yield* discoverClaudeSkills(claudeSettings, input.cwd, claudeEnvironment).pipe(Effect.provideService(FileSystem.FileSystem, fileSystem), Effect.provideService(Path$1.Path, path)));
+		const mcpSession = readMcpProviderSession(input.threadId);
+		const registeredMcpServers = Object.fromEntries(Object.entries(options?.resolveMcpServers === void 0 ? {} : yield* options.resolveMcpServers(input.cwd)).filter(([name]) => !providerMcpReservedNames().has(name)));
+		const deniedMcpServers = claudeShadowedUserScopeMcpServers([...Object.keys(registeredMcpServers), ...providerMcpReservedNames()]);
 		const settings = {
 			...typeof thinking === "boolean" ? { alwaysThinkingEnabled: thinking } : {},
 			...fastMode ? { fastMode: true } : {},
 			...ultracode ? { ultracode: true } : {},
-			...skillOverrides ? { skillOverrides } : {}
+			...skillOverrides ? { skillOverrides } : {},
+			...deniedMcpServers.length > 0 ? { deniedMcpServers } : {}
 		};
-		const mcpSession = readMcpProviderSession(input.threadId);
-		const registeredMcpServers = Object.fromEntries(Object.entries(options?.resolveMcpServers === void 0 ? {} : yield* options.resolveMcpServers(input.cwd)).filter(([name]) => !providerMcpReservedNames().has(name)));
 		const narrateBeforeTools = options?.resolveToolCallNarration === void 0 ? DEFAULT_SERVER_SETTINGS.enableToolCallNarration : yield* options.resolveToolCallNarration;
 		const guardrailSettings = options?.resolveGuardrailPrompts === void 0 ? {
 			enableVerificationBeforeCompletion: DEFAULT_SERVER_SETTINGS.enableVerificationBeforeCompletion,
@@ -72171,7 +72489,7 @@ const makeClaudeAdapter = Effect.fn("makeClaudeAdapter")(function* (claudeSettin
 			...narrateBeforeTools ? [NARRATE_BEFORE_TOOLS_PROMPT] : [],
 			...guardrailPromptsFor(guardrailSettings),
 			unpromptedSubagents ? SUBAGENTS_ALLOWED_PROMPT : SUBAGENTS_ON_REQUEST_PROMPT,
-			...input.fusionRole !== void 0 ? [fusionRoleInstructionsWith(input.fusionRole, "claudeAgent", fusionPromptSettings)] : [],
+			...input.fusionRole !== void 0 ? [fusionRoleInstructionsWith(input.fusionRole, "claudeAgent", fusionPromptSettings)] : [INSTRUCTIONS_AND_MEMORY_PROMPT],
 			...fusionLeanContextApplies(fusionContextPolicy) ? [FUSION_SAFETY_KERNEL] : [],
 			...compressRuleset !== void 0 ? [compressRuleset] : []
 		].join("\n\n");
@@ -109238,7 +109556,7 @@ const COMMON_DEV_PORTS = Object.freeze([
 	8888,
 	9e3
 ]);
-const POLL_INTERVAL$2 = Duration.seconds(3);
+const POLL_INTERVAL$3 = Duration.seconds(3);
 const LSOF_TIMEOUT_MS = 5e3;
 const WINDOWS_LISTENER_TIMEOUT_MS = 5e3;
 const terminalOwnerKey = (owner) => `${owner.threadId}\u0000${owner.terminalId}`;
@@ -109413,7 +109731,7 @@ const make$61 = Effect.gen(function* PortDiscoveryMake() {
 			lastSnapshot: next
 		}])) yield* broadcast(next);
 	}, Effect.catchCause((cause) => Effect.logWarning("preview port scan failed", Cause.pretty(cause))));
-	yield* Effect.forkScoped(pollTick().pipe(Effect.repeat(Schedule.spaced(POLL_INTERVAL$2))));
+	yield* Effect.forkScoped(pollTick().pipe(Effect.repeat(Schedule.spaced(POLL_INTERVAL$3))));
 	const acquireRetention = Effect.fn("PortDiscovery.retain")(function* () {
 		if (yield* Ref.modify(stateRef, (state) => [state.retainCount === 0, {
 			...state,
@@ -124922,7 +125240,7 @@ const LINEAR_ISSUE_FIELDS = [
 * a Linear workspace is edited by people at human speed rather than by agents
 * at machine speed.
 */
-const POLL_INTERVAL$1 = Duration.seconds(30);
+const POLL_INTERVAL$2 = Duration.seconds(30);
 /** Linear's cap on one page. Asking for more is an error, not a bigger page. */
 const LINEAR_PAGE_LIMIT = 250;
 const LINEAR_LIST_TOOL = "list_issues";
@@ -125175,7 +125493,7 @@ const makeLinearTaskRepository = Effect.gen(function* () {
 			taskId
 		});
 	}).pipe(Effect.ignoreCause({ log: true }));
-	yield* Effect.forever(pollOnce.pipe(Effect.andThen(Effect.sleep(POLL_INTERVAL$1)))).pipe(Effect.forkScoped);
+	yield* Effect.forever(pollOnce.pipe(Effect.andThen(Effect.sleep(POLL_INTERVAL$2)))).pipe(Effect.forkScoped);
 	return {
 		create,
 		upsert,
@@ -125199,127 +125517,6 @@ const makeLinearTaskRepository = Effect.gen(function* () {
 	};
 });
 //#endregion
-//#region src/persistence/Layers/RemoteTasks.ts
-/**
-* The hub's task API, as a client.
-*
-* This used to be a `TaskRepository` in its own right, and the board was
-* either this or the local database. It is now the transport underneath
-* `SyncedTaskRepository`: local SQLite is a replica of the hub, so nothing
-* reads from here directly and the board no longer goes dark when the hub is
-* unreachable. What changed with it is the failure story — an unreachable hub
-* used to mean no board, and now means a board that is behind.
-*
-* The four calls here are what a mirror needs and no more: read the hub's
-* rows, push a whole row, arbitrate a claim, and delete. There is no partial
-* patch, because a mirror always holds the full row it wants the hub to have
-* and sending a diff of it would only add a way for the two to disagree.
-*
-* @module persistence/Layers/RemoteTasks
-*/
-const HUB_REQUEST_TIMEOUT_MS = 15e3;
-const TaskListPage = Schema$1.Struct({ tasks: Schema$1.Array(Task) });
-const ConflictBody = Schema$1.Struct({ current: Task });
-const decodeTaskListPage = Schema$1.decodeUnknownEffect(TaskListPage);
-const decodeTask = Schema$1.decodeUnknownEffect(Task);
-const decodeConflictBody = Schema$1.decodeUnknownEffect(ConflictBody);
-/**
-* Every failure here is reported as the persistence error type.
-*
-* The mirror catches these and carries on — a failed push leaves the row
-* `pending` and the next pass retries it — so what matters is that the detail
-* says the hub was the store that would not answer, which is what shows up in
-* the log when someone asks why their two machines disagree.
-*/
-const hubUnavailable = (operation, detail) => new PersistenceSqlError({
-	operation: `HubTaskClient.${operation}`,
-	detail: `The hub board is unavailable: ${detail}`,
-	cause: null
-});
-var HubTaskClient = class extends Context.Service()("@p4code/cli/persistence/Layers/RemoteTasks/HubTaskClient") {};
-const makeHubTaskClient = Effect.gen(function* () {
-	const http = yield* HttpClient.HttpClient;
-	const link = yield* HubLink;
-	const isLinked = link.current.pipe(Effect.map((state) => Option.isSome(state.settings)));
-	const requireSettings = (operation) => Effect.gen(function* () {
-		const state = yield* link.current;
-		if (Option.isNone(state.settings)) return yield* hubUnavailable(operation, "no hub is configured on this server");
-		return state.settings.value;
-	});
-	const send = (operation, settings, request) => http.execute(request.pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`), HttpClientRequest.setHeader("accept", "application/json"))).pipe(Effect.timeout(HUB_REQUEST_TIMEOUT_MS), Effect.mapError((cause) => hubUnavailable(operation, `${cause._tag ?? "request failed"}`)));
-	const list = (filter) => Effect.gen(function* () {
-		const settings = yield* requireSettings("list");
-		const query = new URLSearchParams();
-		for (const key of [
-			"projectId",
-			"repositoryKey",
-			"threadId",
-			"status",
-			"assignee",
-			"query"
-		]) {
-			const value = filter[key];
-			if (value !== void 0) query.set(key, value);
-		}
-		const suffix = query.size === 0 ? "" : `?${query.toString()}`;
-		const response = yield* send("list", settings, HttpClientRequest.get(`${settings.baseUrl}/tasks${suffix}`));
-		if (response.status !== 200) return yield* hubUnavailable("list", `status ${response.status}`);
-		return (yield* response.json.pipe(Effect.flatMap(decodeTaskListPage), Effect.mapError(() => hubUnavailable("list", "the response did not match the contract")))).tasks;
-	});
-	const put = (row, readableIdPrefix) => Effect.gen(function* () {
-		const settings = yield* requireSettings("put");
-		const response = yield* send("put", settings, HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.put(`${settings.baseUrl}/tasks/${encodeURIComponent(row.taskId)}`), {
-			projectId: row.projectId,
-			repositoryKey: row.repositoryKey,
-			threadId: row.threadId,
-			parentTaskId: row.parentTaskId,
-			title: row.title,
-			body: row.body,
-			status: row.status,
-			priority: row.priority,
-			assignee: row.assignee,
-			labels: row.labels,
-			orderKey: row.orderKey,
-			createdAt: row.createdAt,
-			statusChangedAt: row.statusChangedAt ?? row.updatedAt,
-			readableIdPrefix
-		}));
-		if (response.status !== 200 && response.status !== 201) return yield* hubUnavailable("put", `status ${response.status}`);
-		return yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("put", "the response did not match the contract")));
-	});
-	const patchIfStatus = (input) => Effect.gen(function* () {
-		const settings = yield* requireSettings("patchIfStatus");
-		const { taskId, ...fields } = input.patch;
-		const response = yield* send("patchIfStatus", settings, HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.patch(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`), {
-			...fields,
-			expectedStatus: input.expectedStatus
-		}));
-		if (response.status === 404) return { outcome: "missing" };
-		if (response.status === 409) return {
-			outcome: "conflict",
-			current: (yield* response.json.pipe(Effect.flatMap(decodeConflictBody), Effect.mapError(() => hubUnavailable("patchIfStatus", "the conflict response did not match the contract")))).current
-		};
-		if (response.status !== 200) return yield* hubUnavailable("patchIfStatus", `status ${response.status}`);
-		return {
-			outcome: "updated",
-			task: yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("patchIfStatus", "the response did not match the contract")))
-		};
-	});
-	const remove = (taskId) => Effect.gen(function* () {
-		const settings = yield* requireSettings("remove");
-		const response = yield* send("remove", settings, HttpClientRequest.delete(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`));
-		if (response.status !== 200 && response.status !== 204 && response.status !== 404) return yield* hubUnavailable("remove", `status ${response.status}`);
-	});
-	return {
-		isLinked,
-		list,
-		put,
-		patchIfStatus,
-		remove
-	};
-});
-Layer.effect(HubTaskClient, makeHubTaskClient);
-//#endregion
 //#region src/persistence/Layers/TaskSyncStore.ts
 /**
 * The bookkeeping a mirror needs and a board does not.
@@ -125516,14 +125713,17 @@ const makeTaskSyncStore = Effect.gen(function* () {
 * @module persistence/Layers/SyncedTasks
 */
 /**
-* How stale another machine's write may look here.
+* How stale another machine's write may look here when the hub cannot push.
 *
-* Short enough that a board left open follows along, long enough that two
-* servers idling all day are not a steady stream of requests at a hosted
-* service. Only changes made elsewhere wait for it; a write made here is
-* already on screen.
+* With the hub's change stream connected, a write elsewhere triggers a pull
+* right away and the timer is only a safety net, so it can be slow. Without
+* it (an older hub, or the stream is reconnecting) the timer is the only
+* signal, and a board left open should still follow along.
 */
-const SYNC_INTERVAL = Duration.seconds(10);
+const POLL_INTERVAL$1 = Duration.seconds(10);
+const PUSHED_POLL_INTERVAL = Duration.minutes(5);
+/** Between change-stream attempts, so an older hub's 404 is not hammered. */
+const WATCH_RETRY_DELAY = Duration.seconds(30);
 const makeSyncedTaskRepository = Effect.gen(function* () {
 	const local = yield* makeTaskRepository;
 	const sync = yield* makeTaskSyncStore;
@@ -125610,6 +125810,11 @@ const makeSyncedTaskRepository = Effect.gen(function* () {
 	* that was just removed; a pull run before either would see this machine's
 	* own stale absence as the hub's opinion and undo local work.
 	*/
+	/**
+	* Where the last applied pull left off. Held in memory only: a restart pulls
+	* the whole board once, then follows changes again.
+	*/
+	let position;
 	const syncOnce = Effect.gen(function* () {
 		if (!(yield* hub.isLinked)) return;
 		for (const taskId of yield* sync.listTombstones) yield* hub.remove(taskId).pipe(Effect.andThen(sync.clearTombstone(taskId)), Effect.ignoreCause({ log: true }));
@@ -125617,21 +125822,36 @@ const makeSyncedTaskRepository = Effect.gen(function* () {
 			const { readableIdPrefix, ...task } = row;
 			yield* pushInBackground(task, readableIdPrefix ?? "T");
 		}
-		const remote = yield* hub.list({});
+		const pulled = yield* hub.pull(position);
+		if (Option.isNone(pulled)) return;
+		const page = pulled.value;
 		const stillPending = new Set((yield* sync.listPending).map((row) => row.taskId));
 		const tombstoned = new Set(yield* sync.listTombstones);
 		const syncedIds = yield* sync.listSyncedIds;
 		const held = new Map((yield* local.list({})).map((task) => [task.taskId, task]));
 		const seen = /* @__PURE__ */ new Set();
-		for (const task of remote) {
+		for (const task of page.tasks) {
 			seen.add(task.taskId);
 			if (stillPending.has(task.taskId) || tombstoned.has(task.taskId)) continue;
 			const current = held.get(task.taskId);
 			if (current === void 0 || current.updatedAt !== task.updatedAt) yield* adopt(task);
 		}
-		for (const taskId of syncedIds) if (!seen.has(taskId)) yield* local.deleteById({ taskId });
+		const gone = page.full ? syncedIds.filter((taskId) => !seen.has(taskId)) : page.deletedTaskIds.filter((taskId) => syncedIds.includes(taskId));
+		for (const taskId of gone) yield* local.deleteById({ taskId });
+		position = page.next;
 	}).pipe(Effect.ignoreCause({ log: true }));
-	yield* Effect.forever(syncOnce.pipe(Effect.andThen(Effect.sleep(SYNC_INTERVAL)))).pipe(Effect.forkScoped);
+	const nudges = yield* Queue.sliding(1);
+	let watching = false;
+	yield* hub.watch.pipe(Stream.runForEach(() => Effect.sync(() => {
+		watching = true;
+	}).pipe(Effect.andThen(Queue.offer(nudges, void 0)))), Effect.ignoreCause({ log: "Debug" }), Effect.andThen(Effect.sync(() => {
+		watching = false;
+	}).pipe(Effect.andThen(Queue.offer(nudges, void 0)))), Effect.andThen(Effect.sleep(WATCH_RETRY_DELAY)), Effect.forever, Effect.forkScoped);
+	const nextPass = Effect.gen(function* () {
+		const owed = (yield* sync.listPending).length > 0 || (yield* sync.listTombstones).length > 0;
+		return yield* Queue.take(nudges).pipe(Effect.timeoutOption(watching && !owed ? PUSHED_POLL_INTERVAL : POLL_INTERVAL$1));
+	}).pipe(Effect.catch(() => Effect.sleep(POLL_INTERVAL$1)));
+	yield* Effect.forever(syncOnce.pipe(Effect.andThen(nextPass))).pipe(Effect.forkScoped);
 	return {
 		create,
 		upsert,
@@ -133683,7 +133903,7 @@ const ProviderAdapterRegistryLive = Layer.effect(ProviderAdapterRegistry, makePr
 //#endregion
 //#region src/provider/ComputerUsePrompts.ts
 /** Routing guidance is injected only when the session has P4's Computer Use endpoint. */
-const COMPUTER_USE_ROUTING_PROMPT = "P4 Computer Use is available for this session through the cua_repl MCP server. When you use it for a native desktop app, do not substitute AppleScript or shell automation unless the user explicitly requests that path. For a named app, start directly with const app = await cua.getApp(exactNameOrBundleId); read the automatically returned state/image and stop if it answers the request. Reuse the handle and batch safe actions; do not repeat selection or unchanged state. For Device Hub, simulator, emulator, or connected-device requests, use cua.listDevices() once, then cua.getDevice({hostId,deviceId,platform}) with exact discovered IDs, unless the user explicitly requested a different route such as simctl. Selection already emits initial device state. Reuse its handle; do not print the handle or repeat that state before acting. Never substitute macOS getApp('Simulator'). Device hosts are scoped to this provider environment and can differ from the desktop host. If device discovery, opening, inspection, or interaction reports missing permission or unavailable control, stop P4 device interaction and report the exact limitation. Do not silently retry through screenshots, shell simctl, Xcode tools, or another MCP server; an explicit user request for one of those routes is separate authorization to use it. Do not call getState/getApp, control the P4 desktop app, or open device settings to work around a device API failure. Missing consent, unavailable devices, or unsupported operations are P4 limitations to report, never permission to switch P4 hosts or bypass the tool.";
+const COMPUTER_USE_ROUTING_PROMPT = "P4 Computer Use is available for this session through the cua_repl MCP server. When you use it for a native desktop app, do not substitute AppleScript or shell automation unless the user explicitly requests that path. For a named app, start directly with const app = await cua.getApp(exactNameOrBundleId); read the automatically returned state/image and stop if it answers the request. Reuse the handle and batch safe actions; do not repeat selection or unchanged state. For Device Hub, simulator, emulator, or connected-device requests, use cua.listDevices() once, then cua.getDevice({hostId,deviceId,platform}) with exact discovered IDs, unless the user explicitly requested a different route such as simctl. Selection already emits initial device state. Reuse its handle; do not print the handle or repeat that state before acting. Never substitute macOS getApp('Simulator'). Device hosts are scoped to this provider environment and can differ from the desktop host. If device discovery, opening, inspection, or interaction reports missing permission or unavailable control, stop P4 device interaction and report the exact limitation. Do not silently retry through screenshots, shell simctl, Xcode tools, or another MCP server; an explicit user request for one of those routes, including a standing fallback authorization in the user's global or project instructions, is separate authorization to use it; report the P4 error and the fallback you used. Do not call getState/getApp, control the P4 desktop app, or open device settings to work around a device API failure. Missing consent, unavailable devices, or unsupported operations are P4 limitations to report, never on their own permission to switch P4 hosts or bypass the tool.";
 /** The routing note, naming the server the way this session's provider sees it. */
 function withComputerUseRouting(input, enabled, serverName = "cua_repl") {
 	const prompt = serverName === "cua_repl" ? COMPUTER_USE_ROUTING_PROMPT : COMPUTER_USE_ROUTING_PROMPT.replace("the cua_repl MCP server", `the ${serverName} MCP server`);
@@ -148286,8 +148506,8 @@ const WorkspaceLayerLive = Layer.mergeAll(layer$71, WorkspaceEntriesLayerLive, W
 const ProjectFaviconResolverLayerLive = layer$66.pipe(Layer.provide(layer$71), Layer.provide(layer$67));
 const AuthLayerLive = layer$116.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$120));
 const ProviderRuntimeLayerLive = Layer.mergeAll(ProviderSessionReaperLive, ProviderHealthRefresherLive).pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeCoreDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(layer$28), Layer.provideMerge(Layer.mergeAll(PullRequestServiceLive, CheckpointingLayerLive, SourceControlProviderRegistryLayerLive)), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderAuthServiceLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive, RoutedTaskRepositoryLive)), Layer.provideMerge(Layer.mergeAll(PersistenceLayerLive, layer$90)), Layer.provideMerge(layer$84), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(layer$61), Layer.provideMerge(Layer.mergeAll(layer$60, layer$73.pipe(Layer.provide(layer$86)), layer$75, layer$70)), Layer.provideMerge(layer$55), Layer.provideMerge(layer$56), Layer.provideMerge(layer$57), Layer.provideMerge(layer$58), Layer.provideMerge(layer$59)).pipe(Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(AntigravityInstallation.layer), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$63), Layer.provideMerge(JevWorkspaceAdvisorLive.pipe(Layer.provide(TypeSafeClientLive))), Layer.provideMerge(layer$94.pipe(Layer.provide(layer$120))), Layer.provideMerge(SupervisorSecretsLive.pipe(Layer.provide(layer$120))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$85), Layer.provideMerge(layer$69), Layer.provideMerge(remoteComputerUseBindingsLayer.pipe(Layer.provide(layer$90))), Layer.provideMerge(layer$78), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$5.pipe(Layer.provideMerge(LinearClientLive), Layer.provideMerge(Layer.mergeAll(LinearMcpClientLive, TrackerSecretsLive)), Layer.provideMerge(Layer.mergeAll(layer$91, layer$21).pipe(Layer.provideMerge(layer$92), Layer.provideMerge(layer$93))))), Layer.provideMerge(layer$120));
-const UsageLayerLive = layer$25.pipe(Layer.provide(layer$94.pipe(Layer.provide(layer$120))));
+const RuntimeCoreDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(layer$28), Layer.provideMerge(Layer.mergeAll(PullRequestServiceLive, CheckpointingLayerLive, SourceControlProviderRegistryLayerLive)), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderAuthServiceLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive, RoutedTaskRepositoryLive)), Layer.provideMerge(Layer.mergeAll(PersistenceLayerLive, layer$95)), Layer.provideMerge(layer$84), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(layer$61), Layer.provideMerge(Layer.mergeAll(layer$60, layer$73.pipe(Layer.provide(layer$86)), layer$75, layer$70)), Layer.provideMerge(layer$55), Layer.provideMerge(layer$56), Layer.provideMerge(layer$57), Layer.provideMerge(layer$58), Layer.provideMerge(layer$59)).pipe(Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(AntigravityInstallation.layer), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$63), Layer.provideMerge(JevWorkspaceAdvisorLive.pipe(Layer.provide(TypeSafeClientLive))), Layer.provideMerge(layer$93.pipe(Layer.provide(layer$120))), Layer.provideMerge(SupervisorSecretsLive.pipe(Layer.provide(layer$120))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$85), Layer.provideMerge(layer$69), Layer.provideMerge(remoteComputerUseBindingsLayer.pipe(Layer.provide(layer$95))), Layer.provideMerge(layer$78), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$5.pipe(Layer.provideMerge(LinearClientLive), Layer.provideMerge(Layer.mergeAll(LinearMcpClientLive, TrackerSecretsLive)), Layer.provideMerge(Layer.mergeAll(layer$90, layer$21).pipe(Layer.provideMerge(layer$91), Layer.provideMerge(layer$92))))), Layer.provideMerge(layer$120));
+const UsageLayerLive = layer$25.pipe(Layer.provide(layer$93.pipe(Layer.provide(layer$120))));
 const RuntimeDependenciesLive = layer$24.pipe(Layer.provideMerge(RuntimeCoreDependenciesLive)).pipe(Layer.provideMerge(UsageLayerLive), Layer.provideMerge(layer$12), Layer.provideMerge(layer$11), Layer.provideMerge(layer$10), Layer.provideMerge(layer$81), Layer.provideMerge(layer$83), Layer.provideMerge(layer$82), Layer.provide(layer$124));
 /**
 * Hub asset sync.
@@ -148296,7 +148516,7 @@ const RuntimeDependenciesLive = layer$24.pipe(Layer.provideMerge(RuntimeCoreDepe
 * not-configured shape, and every call reports that rather than failing — so
 * this costs a server with no hub nothing but a layer.
 */
-const AssetSyncLive = layer$88.pipe(Layer.provideMerge(layer$77), Layer.provideMerge(layer$89), Layer.provideMerge(layer$90));
+const AssetSyncLive = layer$88.pipe(Layer.provideMerge(layer$77), Layer.provideMerge(layer$89), Layer.provideMerge(layer$95));
 const RuntimeServicesLive = layer$72.pipe(Layer.provideMerge(layer$1), Layer.provideMerge(AssetSyncLive), Layer.provideMerge(layer$23), Layer.provideMerge(layer$22.pipe(Layer.provide(layer$53), Layer.provide(ProviderSessionDirectoryLayerLive), Layer.provide(ProjectionProjectRepositoryLive))), Layer.provideMerge(RuntimeDependenciesLive));
 const makeRoutesLayer = Layer.mergeAll(Layer.mergeAll(HttpApiBuilder.layer(EnvironmentHttpApi).pipe(Layer.provide(authHttpApiLayer), Layer.provide(orchestrationHttpApiLayer), Layer.provide(pullRequestHttpApiLayer), Layer.provide(serverEnvironmentHttpApiLayer), Layer.provide(environmentAuthenticatedAuthLayer)), otlpTracesProxyRouteLayer, assetRouteLayer, mcpOAuthCallbackRouteLayer, staticAndDevRouteLayer, websocketRpcRouteLayer), layer$4.pipe(Layer.provide(layer$6)), layer$68, layer).pipe(Layer.provide(ProjectionProjectRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(ProjectionThreadRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(layer$67), Layer.provide(layer$28), Layer.provide(PullRequestServiceLive), Layer.provide(layer$20), Layer.provide(layer$79), Layer.provide(layer$26), Layer.provide(browserApiCorsLayer), Layer.provide(httpCompressionLayer));
 const makeServerLayer = Layer.unwrap(Effect.gen(function* () {