@webinson/peer-core 0.1.894 → 0.1.944

package/dist/{binCli-BRnHIlUQ.mjs → binCli-BXUdYHGg.mjs}

@@ -2,10 +2,10 @@
 
 import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-1CwlsFOK.mjs";
 import { $r as isEmpty, A as NullOr, Ar as fromInput$1, B as String$6, C as Literals$2, Cn as inetAddressFromIpString, Cr as Forbidden$1, Ct as decodeUnknownSync, Di as toEpochMillis, E as Never, Ei as toDate, En as unixPathAddress, Et as encodeSync, Fi as Class, Gt as isNonEmpty, H as Struct, Hr as merge, I as Record, Ir as CurrentRedactedNames, J as TrueLiterals, Jr as value, Jt as isSchemaError, Li as TaggedClass, Nr as toRecord, Nt as is, On as assign, Ot as encodeUnknownEffect, Ri as TaggedError$1, Rr as fromInput, S as Literal, Tt as encodeEffect, W as TaggedError, Xr as empty, Y as Tuple, Yn as isNull, Z as URLFromString, Zr as expireCookie, _ as Finite, _i as makeUnsafe, a as BooleanLiterals, ai as decodeString, bt as decodeUnknownExit, c as DateTimeUtc, d as Duration, di as formatIso, dn as toCodecStringTree, dr as transformEffect, fi as isGreaterThan, ft as declare, g as FalseLiterals, gi as make$65, gn as toType, ht as decodeExit, ii as decode, ir as toEncoded, j as Number$2, jr as redactUrl, jt as fromJsonString, k as Null, ki as toUtc, l as DateTimeUtcFromString, li as add, ln as toCodecArrayFromSingle, mi as isLessThan, mt as decodeEffect, n as ArraySchema, ni as set, nn as optional$3, nt as Union, o as Cause, oi as encode, pi as isGreaterThanOrEqualTo, pn as toEquivalence, qr as make$64, qt as isSchema, r as Boolean$4, ri as toSetCookieHeaders, rn as optionalKey, rt as Unknown, si as Equivalence, ti as parseHeader, u as Defect, un as toCodecJson, v as FiniteFromString, vt as decodeTo, wr as InvalidValue$1, xt as decodeUnknownOption, y as Int$5, yi as now, yt as decodeUnknownEffect, z as SchemaError, zi as taggedEnum, zr as fromRecordUnsafe } from "./Schema-Eq619wkO.mjs";
-import { $ as forEach, $i as hasInterrupts, $t as runPromise, Ai as isSuccess, Ar as empty$3, As as findFirst, At as matchEffect, B as filter$1, Bc as Number$3, Bn as withTracerEnabled, Bo as fromInput$2, Br as tap$1, Bt as promise, C as catchTag, Cc as getOrElse, Cn as tryPromise, Cu as dual, D as context, Dc as isNone, Dl as assignProperty, Dr as effect, Ds as ensure, Dt as match$2, Ec as getOrUndefined, Es as empty$1, Et as mapErrorEager, Eu as memoize, F as exit, Fc as orElse, Fl as equals, Fn as withErrorReporting, Fr as provideMerge, G as findFirst$1, Gi as fail$3, Gr as close, Gs as match, Hi as combine$1, Hn as zip, Ho as hours, Hr as Scope, Ht as provideContext, I as fail$1, Ic as some, In as withFiber$1, Ir as succeed$3, It as option, Ji as findErrorOption, Jl as compose, Jr as forkUnsafe, Kt as raceFirst, L as failCause, Lc as toArray, Lt as orDie, M as die, Mc as map$5, Mn as void_, Mo as encode$1, Mr as merge$1, Ms as findLast, Mt as onError, Nc as match$1, Ni as void_$1, Nr as mergeAll, Ns as flatMapNullishOr, Nt as onExit, On as uninterruptible, Oo as Tracer, Or as effectContext, Os as filter$2, Ot as matchCauseEffect, Ou as pipe, P as ensuring, Pc as none$1, Pr as provide$1, Qa as fnUntraced, Qo as minutes$1, Qr as CurrentLogAnnotations, Qt as runForkWith, Rn as withParentSpan, Ro as days, Rt as orElseSucceed, S as catchReason, Sc as fromUndefinedOr, Sn as timeoutOrElse, Ss as Prototype, St as map$3, T as catch_, Tc as getOrThrow$1, To as MinimumTraceLevel, Tt as mapError, Tu as identity, Ui as die$1, Un as zipWith, Uo as infinity, Ur as addFinalizer, Ut as provideService, Vn as yieldNow, Vo as fromInputUnsafe, Vr as unwrap, Vt as provide, W as filterOrFail, Wr as addFinalizerExit, Ws as map$4, X as fn, Xi as fromReasons, Xo as millis, Xt as retry, Yl as hasProperty, Yr as make$69, Ys as sort, Yt as result, Z as fnUntraced$1, Zo as min, Zr as provide$2, Zt as runFork, _ as catchCauseIf, _c as firstSomeOf, _i as make$68, _o as sync, _s as getUnsafe, a as all, ac as getOrUndefined$1, ai as UnhandledLogLevel, an as scoped, as as toMinutes, b as catchFilter, ba as ConsoleRef, bi as succeed$4, bn as timeout, bs as merge$2, bt as logWithLevel, c as annotateLogs, cc as isSuccess$1, ci as done, cl as isEffect, cn as serviceOption, cr as jittered, cs as Reference, ct as ignore, d as asSome, di as failCause$1, dl as withFiber, dn as succeedNone, ds as empty$2, dt as interruptible, du as isTagged, ea as hasInterruptsOnly, ei as CurrentLogSpans, en as runPromiseWith, et as forever, f as asVoid, fc as succeed$2, fn as succeedSome, fr as spaced, ft as isEffect$1, g as catchCause, ga as prettyErrors, gc as filter, gn as tapCause, gt as logError, gu as cast, h as callback, ha as pretty, hc as exists, hi as isDone, hl as Class$1, hn as tap, hr as upTo, ht as logDebug, i as addFinalizer$1, ic as getOrThrow, ii as TracerTimingEnabled, in as scope, is as toMillis, it as forkScoped, j as delay, ji as match$3, jr as launch, js as findFirstIndex, jt as never, ju as pipeArguments, k as currentParentSpan, ka as consolePretty$1, kc as isSome, ki as isFailure, kr as effectDiscard, ks as filterMap, l as annotateLogsScoped, ln as sleep$1, lr as modifyDelay, ls as Service, lt as ignoreCause, mc as contains, mn as sync$1, mt as log$1, n as acquireRelease, nc as failVoid, ni as MinimumLogLevel, nn as runSyncExit, ns as sum, nt as forkDetach, o as andThen, oc as isFailure$1, oi as _await, ot as fromResult, ou as isObject, p as cached, pn as suspend, q as flatMap$1, qc as make$67, qs as reduce, qt as repeat, r as acquireUseRelease, ri as TracerEnabled, rn as runSyncWith, ro as loggerMake, rr as exponential, rt as forkIn, ru as isNotUndefined, s as annotateCurrentSpan, si as die$2, ss as zero, st as gen$1, tc as fail$2, tn as runSync, ts as seconds, tu as isNotNull, u as as, ui as fail$4, un as succeed$1, us as add$1, ut as interrupt, v as catchDefect, va as squash, vc as flatMap$2, vi as makeUnsafe$1, vl as format, vn as tapError, vo as tracerLogger$1, vs as make$66, vt as logInfo, w as catchTags, wc as getOrNull, wn as try_, wr as build, wu as flow, x as catchIf, xa as CurrentLoggers$1, xc as fromNullishOr, xn as timeoutOption, xs as omit, xu as constVoid, yc as flatten, ys as makeUnsafe$2, yt as logWarning, zn as withSpan, zo as format$1, zr as sync$2, zs as isReadonlyArrayNonEmpty, zt as partition } from "./Effect-DXlc4A9S.mjs";
-import { $ as Scheduler, $a as GitVcsDriver, $c as mergeWithDefaultKeybindings, $d as Terminal, $f as EnvironmentHttpForbiddenError, $g as CheckpointId, $h as FileSystem, $i as isGitImport, $l as layerOtlpSerialization, $m as makeWebSocket$1, $n as isLoopbackHost$1, $o as randomBytes, $p as PROVIDER_SEND_TURN_MAX_FILE_BYTES, $r as layer$193, $s as isSecretStoreError, $t as layer$124, $u as AssetWorkspaceAssetInspectionError, A as layer$184, Aa as EffectOutboxV2, Ac as decodeThreadHistoryCursor, Ad as CodexSettings, Af as makeWith, Ag as ServerAuthSessionMethod, Ah as inspect$1, Ai as layer$120, Al as compareExactServiceVersions, Am as fromHeaders, An as NativeTelemetryClient, Ao as APPARMOR_PROFILE, Ap as latestProviderTurnForAttempt, Ar as make$81, As as toUint8Array, At as RELAY_MINT_REQUEST_TYP, Au as RequestInit, B as coreLayer, Ba as PeerState, Bc as normalizeProjectPathForComparison, Bd as resolveProviderInstanceEnabled, Bf as DesktopBrowserCommand, Bg as isStreamUint8Array, Bh as post, Bi as selectHistory, Bl as pinnedRuntimeVersionsDir, Bm as isPersistedFile, Bn as layer$155, Bo as sandboxDisabled, Bp as ProjectWriteFileError, Br as withWorkspaceLease, Bs as RELAY_URL_SECRET, Bt as withCreationProvenance, Bu as Service$1, C as stateStream, C_ as decodeString$1, Ca as deriveThreadFromProviderThread, Cc as ProjectionStoreThreadNotFoundError, Cd as ExternalLauncherUnknownEditorError, Cf as option$1, Cg as AuthRelayWriteScope, Ch as stream$2, Ci as mergeRestartCancelledBackgroundWork, Cl as void_$2, Cm as set$2, Cn as layer$168, Co as requestHandover, Cp as OrchestrationV2GetShellSnapshotError, Cr as makeUnavailableUsageLimits, Cs as ServerSettingsService, Ct as getOrCreateEnvironmentKeyPairFromSecretStore, Cu as make$72, D as PreviewAutomationBroker, D_ as withAttributes, Da as layer$112, Dc as THREAD_HISTORY_PAGE_POLICY, Dd as ProviderUploadFeedbackError, Df as get$1, Dg as AuthTerminalOperateScope, Dh as filterStatusOk, Di as restartContinuationNote, Dl as SERVICE_RESTART_PENDING_FILE, Dm as toHandled, Dn as layer$132, Do as layer$104, Dp as OrchestrationV2ThreadLaunchError, Dr as NoOpProviderEventLoggers, Ds as fromReadable, Dt as RELAY_HOOK_DELIVERY_TYP, Du as cliReleaseChannelOf, E as layer$197, E_ as update$1, Ea as layerFromStores, Ec as InvalidThreadHistoryCursorError, Ed as ProviderSetupError, Ef as SourceError, Eg as AuthStandardClientScopes, Eh as urlParams, Ei as restartCancelledBackgroundWorkNote, El as SERVICE_LAUNCHER_CONTEXT_ENV, Em as appendPreResponseHandler, En as ProjectSetupScriptRunner, Eo as RelayClientTracer, Ep as OrchestrationV2SearchThreadError, Er as PluginMcpServers, Es as decode$2, Et as RELAY_HOOK_DELIVERY_HEADER, Eu as CLI_RELEASE_CHANNELS, F as issueAttachmentUploadUrl, Fa as ServerActivation, Fc as parseAttachmentFileExtension, Fd as ServerSettings, Fg as getStatusErrorSchema, Fh as bodyStream, Fi as handoffTokenCapConfig, Fl as serviceStateHasPendingUpdate, Fm as schemaHeaders, Fn as deriveProviderInstanceConfigMap, Fo as PreviewBrowserSandboxError, Fp as ProjectMutation, Fr as toAcpRegistryOperationError, Fs as CLOUD_MINT_PUBLIC_KEY, Ft as makeDrainableWorker, Fu as WS_METHODS, G as PeerWorkspaces, Ga as workspaceNameForRef, Gc as toolOutputImages, Gd as PreviewStreamHostSetup, Gf as EnvironmentAuthInvalidError, Gg as AcpRegistryOperationError, Gh as ignore$1, Gi as layer$119, Gl as resolveLatestProviderVersion, Gm as make$74, Gn as layer$160, Go as sha512, Gp as PullRequestOperationError, Gr as BUILT_IN_SOURCE_CONTROL_DRIVERS, Gs as isAgentActivityPublishingEnabledValue, Gt as layerFromProjectStore, Gu as AssetAttachmentNotFoundError, H as rpcLayer, Ha as resolveJjRepoPaths, Hc as projectThreadProjectionForWire, Hd as PREVIEW_STREAM_HOST_SETUP_CLOSE_CODE, Hf as DESKTOP_UPDATE_RESTART_MARKER_FILE, Hg as isWithHeadersValue, Hh as setHeaders$1, Hi as layer$129, Hl as layer$98, Hm as makeConfig, Hn as layer$191, Ho as layer$101, Hr as layer$137, Hs as decodeRuntimeConfig, Ht as layer$128, Hu as PREVIEW_AUTOMATION_SERVER_OPERATIONS, I as storeAttachmentUpload, Ia as forkParked, Ic as resolveAttachmentPathById, Id as ServerSettingsError, If as findBrowserProfile, Ig as getStatusSuccessSchema, Ih as bodyUrlParams, Ii as historicalMessage, Il as PinnedRuntimeInstallError, Im as schemaSearchParams, In as layer$186, Io as SETUP_SUBCOMMAND, Ip as ProjectMutationError, Ir as AcpRegistryRuntimeCoordinator, Is as HOLD_WEBHOOKS_WHILE_OFFLINE_SECRET, It as ThreadManagementService, Iu as WsRpcGroup, J as ScheduledTaskService, Ja as colocatedGitCommand, Jc as injectMcpAppThemeBootstrap, Jd as KeybindingsConfig, Jf as EnvironmentCloudEndpointUnavailableError, Jg as ProviderDriverKind, Jh as layer$102, Ji as VcsDriverRegistry, Jl as DEFAULT_SIGNAL_EXPORT, Jm as SocketError, Jn as withUsageLimitsCommands, Jo as aexists, Jp as VcsUnsupportedOperationError, Jr as layer$167, Js as resolveCliCommand, Jt as layer$123, Ju as AssetPreviewTypeValidationError, K as PeerPluginRegistry, Ka as make$79, Kc as MCP_APP_MAX_HTML_BYTES, Kd as PreviewViewportSetting, Kf as EnvironmentAuthenticatedAuth, Kg as DEFAULT_MODEL, Kh as isIgnored, Ki as CheckpointStore, Kl as ProviderLatestVersions, Km as Path, Kn as layer$161, Ko as Hash, Kp as pullRequestHostOf, Kr as layer$149, Ks as readHoldWebhooksWhileOffline, Kt as layer$121, Ku as AssetCreateUrlInput, L as validateAttachmentUploadToken, La as forkParkedFiber, Lc as parseBase64DataUrl, Ld as ServerSettingsPatch, Lf as resolveBrowserProfiles, Lg as getWithHeadersAnnotation, Lh as del, Li as historyCost, Ll as ensurePinnedRuntimeInstalled, Lm as toURL, Ln as layer$162, Lo as diagnoseLaunchFailure, Lp as ProjectReadFileError, Lr as PtyAdapter, Ls as PUBLISH_AGENT_ACTIVITY_SECRET, Lt as ThreadTranscriptTooLargeError, Lu as WsT3RpcGroup, M as launchThread, Ma as REPLAY_SAFE_EFFECT_TYPES_AFTER_PROCESS_LOSS, Mc as attachmentRelativePath, Md as DEFAULT_AUTOMATIC_GIT_FETCH_INTERVAL, Mf as nextIntBetween, Mg as authScopeResponse, Mh as bearerToken, Mi as attachmentTokenAllowance, Ml as isExactServiceVersion, Mm as ParsedSearchParams, Mn as layer$153, Mo as DEBIAN_PACKAGES, Mp as UsageLimitSourceError, Mr as layerJson, Ms as CLOUD_ENDPOINT_RUNTIME_CONFIG, Mt as normalizeRelayIssuer, Mu as CLIENT_GUARDED_RPC_SCOPES, N as ATTACHMENT_UPLOAD_ROUTE_PREFIX, Na as layer$111, Nc as chatAttachmentStableKey, Nd as DEFAULT_PROVIDER_HEALTH_REFRESH_INTERVAL, Nf as BUILT_IN_BROWSER_PROFILES, Ng as getResponseEncoding, Nh as bodyJson, Ni as contextUsageForHandoff, Nl as parseServiceState, Nm as TypeId$6, Nn as PortDiscovery, No as NO_SANDBOX_SIGNATURE, Np as OrchestrationProjectShell, Nr as AcpRegistryCatalog, Ns as CLOUD_LINKED_USER_ID, Nt as signRelayJwt, Nu as clientRpcRequiredScopes, O as layer$198, O_ as bytes, Oa as ProjectStoreV2, Oc as THREAD_HISTORY_SNAPSHOT_ROW_LIMIT, Od as AntigravitySettings, Of as invalidate, Og as AuthTerminalReadScope, Oh as MaxBodySize, Oi as reportLabel, Ol as SERVICE_STATE_FILE, Om as TracerDisabledWhen, On as TerminalManager, Oo as withLocalTracing, Op as OrchestrationV2ThreadShell, Or as ProviderEventLoggers, Os as pipeThroughDuplex, Ot as RELAY_LINK_PROOF_TYP, Ou as cliReleaseIndexPageUrl, P as deletePendingAttachment, Pa as layerPruneWorker, Pc as createDeterministicAttachmentId, Pd as DEFAULT_SERVER_SETTINGS, Pg as getResponseEncodingSchema, Ph as bodyJsonUnsafe, Pi as handoffBudget, Pl as serviceStateActiveVersion, Pm as schemaCookies, Pn as layer$176, Po as PreviewBrowserLibrariesError, Pp as ProjectListEntriesError, Pr as layerFromHost, Ps as CLOUD_LINK_REVOKED, Pt as verifyRelayJwt, Pu as RpcScopeAuthorization, Q as relayHookBaseUrl, Qa as managedWorktreesDirectories, Qc as compileResolvedKeybindingsConfig, Qd as QuitError, Qf as EnvironmentHttpConflictError, Qg as AuthSessionId, Qh as uint8Array, Qi as layer$145, Ql as decodeOtlpTraceRecords, Qm as fromWebSocket, Qn as providerAuthReturnUrl, Qo as concatBytes$1, Qp as ChatAttachmentId, Qr as AnalyticsService, Qs as isSecretAlreadyExistsError, Qt as canRouteRelatedSubagent, Qu as AssetSigningKeyLoadError, R as PreviewManager, Ra as layerFromApplicationReceipts, Rc as runRanAfter, Rd as requiredScopesForProjectMutation, Rf as DesktopAppActivationErrorCode, Rg as isNoContent, Rh as get$2, Ri as latestNativeContextUsage, Rl as pinnedRuntimeCommand, Rm as MultipartError, Rn as BackgroundPolicy, Ro as missingLibraries, Rp as ProjectSearchContentsError, Rr as PtySpawnError, Rs as RELAY_ENVIRONMENT_CREDENTIAL_SECRET, Rt as isTerminalRunStatus, Ru as PEER_RPC_SCOPES, S as layer$179, S_ as decode$1, Sa as IdAllocatorV2, Sc as layer$180, Sd as ExternalLauncherEditorSpawnError, Sf as mapEffect$1, Sg as AuthRelayReadScope, Sh as setHeaders, Si as isRestartNoteSource, Sl as findOneOption, Sm as modify, Sn as GitManager, So as readOwner, Sp as OrchestrationV2DispatchCommandError, Sr as isWorkspacePreviewEntryPath, Ss as subscribeBeforeSnapshot, St as layer$183, Su as withPathDirectoryListings, T as PreviewBrowser, T_ as snapshotUnsafe, Ta as EventSinkV2, Tc as layer$96, Td as ExternalLauncherUnsupportedTargetError, Tf as withDefault$2, Tg as AuthSourceControlWriteScope, Th as uint8Array$1, Ti as pendingRestartCancelledBackgroundWork, Tl as readOnly, Tm as updateAndGet, Tn as layer$185, To as make$76, Tp as OrchestrationV2ProviderSessionJson, Tr as endRunlessRootTurns, Ts as redactServerSettingsForClient, Tt as RELAY_HEALTH_RESPONSE_TYP, Tu as CLI_RELEASE_BASE_URL_ENV, U as PeerAdapters, Ua as invalidateJjAvailability, Uc as MAX_TOOL_OUTPUT_IMAGE_BASE64_LENGTH, Ud as PREVIEW_VIEWPORT_PRESET_IDS, Uf as DesktopBackendBootstrap, Ug as hasBody, Uh as isHttpClientError, Ui as CheckpointServiceV2, Ul as enrichProviderSnapshotWithVersionAdvisory, Um as toPersisted, Un as layer$192, Uo as sha256, Up as RuntimeMode, Ur as SourceControlProviderRegistry, Us as encodeConfirmedOriginJson, Ut as layer$131, Uu as SERVER_BROWSER_AUTOMATION_CLIENT_ID, V as layer$105, Va as layer$106, Vc as projectDomainEventForWire, Vd as FILL_PREVIEW_VIEWPORT, Vf as DesktopBrowserEvent, Vg as isWithHeaders, Vh as setHeader$1, Vi as isNativeMaintenanceCommand, Vl as ProcessRunner, Vm as limitsServices, Vn as BUILT_IN_USAGE_DRIVERS, Vo as layer$103, Vp as DEFAULT_PROVIDER_INTERACTION_MODE, Vr as TextGeneration, Vs as decodeConfirmedOrigin, Vt as OrchestratorV2, Vu as UsageReadError, W as PeerCoordination, Wa as resolveWorkspaceRefName, Wc as mcpAppFromToolItem, Wd as PreviewClearProfileError, Wf as RelayClientInstallFailedError, Wg as encoder, Wh as TypeId$7, Wi as checkpointRefForScopeOrdinal, Wl as makeTargetedProviderUpdateAction, Wm as decodeField, Wn as layer$159, Wo as sha384, Wp as PullRequestLinkedThreadsResult, Wr as layer$148, Ws as encodeEndpointRuntimeConfigJson, Wt as RuntimePolicyV2, Wu as McpAppRequestError, X as WEBHOOK_ROUTE_PREFIX, Xa as isFilesystemRoot, Xc as DEFAULT_KEYBINDINGS, Xd as ResolvedKeybindingRule, Xf as EnvironmentHttpBadRequestError, Xg as ProviderInstanceMutation, Xh as raw, Xi as layer$151, Xl as OtlpProtocol, Xm as WebSocket$1, Xn as codexAuthorizationRequest, Xo as anumber, Xp as OrchestrationGetTurnDiffError, Xr as firstNonEmptyLine, Xs as resolveRootCliCommand, Xt as layer$122, Xu as AssetProjectFaviconNotFoundError, Y as ScheduledTaskWebhookOrigin, Ya as jjCommand, Yc as mcpAppToolCallableByApp, Yd as KeybindingsConfigError, Yf as EnvironmentHttpApi, Yg as ProviderInstanceId, Yh as layerWeak, Yi as layer$150, Yl as OtlpHeadersFromString, Ym as SocketOpenError, Yn as makeCodexChatGptAuth, Yo as ahash, Yp as OrchestrationGetFullThreadDiffError, Yr as detailFromCause, Ys as resolveHostCliCommand, Yt as CommandOutputHub, Yu as AssetProjectFaviconInspectionError, Z as layer$136, Za as makeIsManagedWorktreePath, Zc as compileResolvedKeybindingRule, Zd as getCurrentVersion, Zf as EnvironmentHttpCommonError, Zg as defaultInstanceIdForDriver, Zh as stream$1, Zi as JjVcsDriver, Zl as causeErrorTag, Zm as WebSocketConstructor, Zn as codexCallbackUrl, Zo as clean, Zp as OrchestrationGetTurnDiffResult, Zr as PullRequestProviderError, Zs as ServerSecretStore, Zt as RunExecutionServiceV2, Zu as AssetProjectFaviconResolutionError, _ as layer$195, __ as RpcClientId, _a as layer$142, _c as layerResourceAttributes, _d as ServerProviderUpdateError, _f as Redacted, _g as AuthMcpTokenError, _h as raw$1, _i as cancelledRosterTaskWork, _l as PersistenceDecodeError, _m as mapRequest, _n as layer$116, _o as mergeProviderInstanceEnvironment, _p as fromApi, _r as WORKSPACE_BROWSER_PREVIEW_EXTENSIONS, _s as runServicePreflight, _t as ensureShim, _u as readPathFromLaunchctl, a_ as CommandId, aa as ProjectOperationError, ac as deriveServerPaths, ad as AssetWorkspaceRootNormalizationError, af as Stdio, ag as AuthAccessTokenType, ah as causeResponse, ai as layer$201, al as threadPullRequestKeyOf, am as normalize, an as WorkspaceEntries, ao as orchestrationEffectClaimsTotal, ap as EnvironmentResourceNotFoundError, ar as EMPTY_TOTALS, as as resolveLegacySessionCookieName, at as ThreadLaunchService, au as entriesToAttributes, b as DEVICE_HUB_ROUTE_PREFIX, b_ as ThreadId, ba as LegacyV1ThreadImporter, bc as resolveSignalEndpoint, bd as ExternalLauncherBrowserSpawnError, bf as all$1, bg as AuthPreviewOperateScope, bh as setBody, bi as isRestartContinuationSource, bl as makeLiveStreamBudget, bm as getAndSet, bn as layer$171, bo as coordSocketPath, bp as OrchestrationGetWorkflowScriptError, br as hostPreviewMimeTypeFromExtension, bs as layer$154, bt as mcpClient, bu as resolveWindowsEnvironment, c_ as IsoDateTime, ca as ProjectEnrichmentService, cc as make$77, cd as AgentSessionImportSource, cf as SpanPropagationEnabled, cg as AuthDiagnosticsReadScope, ch as HttpPlatform, ci as ProviderContinuationRequests, cl as parseChangeRequestUrl, cm as cors, cn as isProjectFaviconPath, co as rpcRequestsTotal, cp as RelayCloudEnvironmentHealthProofPayload, cr as readContainedWorkflowFile, cs as timingSafeEqualBase64Url, ct as ManagedProjectFolders, cu as unknownToAttributeValue, d_ as PortSchema, da as layer$140, dc as version, dd as FilesystemBrowseError, df as Boolean$5, dg as AuthFilesystemReadScope, dh as empty$4, di as ProviderAdapterTurnStartError, dl as sourceControlRepositorySelector, dm as serve, dn as layerAutoPullPolicy, do as resolveProjectSettings, dp as RelayEnvironmentLinkResponse, dr as layer$187, ds as layer$182, dt as layer$173, du as modelSelectionsEqual, e_ as ClientConnectionMethod, ea as parseTurnDiffFilesFromNumstat, ec as layer$97, ed as AssetWorkspaceAssetNotFoundError, ef as isQuitError, eg as ExecutionEnvironmentDescriptor, eh as ClientAbort, ei as AgentScope, el as parseKeybindingShortcut, em as PersistChatAttachmentsError, en as selectInheritedBackgroundTurnItems, eo as layer$118, ep as EnvironmentHttpInternalServerError, er as normalizePreviewUrl, es as toBytes, et as layer$138, eu as makeLocalFileTracer, f_ as PositiveInt, fa as make$84, fc as parsePersistedServerObservabilitySettings, fd as OrchestrationSearchThreadsError, ff as ConfigError, fg as AuthFilesystemWriteScope, fh as file, fi as ProviderInstanceRegistry, fl as EventStoreV2, fm as use, fn as PullRequestService, fo as resolveWorktreeCleanup, fp as RelayHookDeliveryProofPayload, fr as layerModelCatalog, fs as layerIdentity, ft as SourceControlRepositoryService, fu as collectUint8StreamText, g as PullRequestReviewGuideService, g_ as ProviderTurnId, ga as WorkspacePaths, gc as fromLenientJson, gd as EnvironmentThemeId, gf as Port, gg as AuthMcpRegistrationError, gh as mergeCookies, gi as cancelledBeforeStart, gl as layer$108, gm as filterStatusOk$1, gn as layer$165, go as resolveCodexHomeLayout, gp as RelayProtectedError, gr as formatThreadTitleContext, gs as layer$200, gt as McpClients, gu as readEnvironmentFromLoginShell, h_ as ProviderThreadId, ha as layer$143, hc as fromJsonStringPretty, hd as EnvironmentThemeFile, hf as NonEmptyString, hg as AuthMcpClientAccess, hh as jsonUnsafe, hi as awaitingProviderThreadId, hl as OrchestrationEventStore, hm as HttpClient, hn as layer$166, ho as parseOriginUrlFromGitConfig, hp as RelayOkResponse, hr as AntigravityInstallation, hs as ServiceLauncherClient, ht as layer$169, hu as mergePathEntries, i as layer$194, i_ as ClientWebDeployment, ia as ProjectConflictError, ic as ServerConfig, id as AssetWorkspaceResolutionError, if as set$1, ig as AuthAccessStreamError, ih as ServeError, ii as layer$125, il as normalizeThreadPullRequestKey, im as getSuccessSchemas, in as layer$126, io as metricAttributes, ip as EnvironmentRequestInvalidError, ir as layer$188, is as isRemoteReachableHost, it as threadHasQueuedTurnStart, iu as OtlpSerialization, j as dispatchCommand, ja as PROCESS_BOUND_EFFECT_TYPES, jc as PENDING_ATTACHMENT_THREAD_SEGMENT, jd as DATABASE_COMPACTION_RECOMMENDED_BYTES, jf as set$3, jg as authScopeRequiredResponse, jh as schemaBodyJson, ji as DEFAULT_HANDOFF_TOKEN_CAP, jl as decodeServiceLauncherChildMessage, jm as HttpServerRequest, jn as layer$152, jo as APPARMOR_PROFILE_PATH, jp as ToolActivityNativeAppReference, jr as makeProtocolWithHttpEffectWebsocket, js as CLOUD_ENDPOINT_CONFIRMED_ORIGIN, jt as RELAY_MINT_RESPONSE_TYP, ju as layer$99, k as ThreadSearch, ka as layer$110, kc as buildBoundedThreadProjection, kd as ClaudeSettings, kf as make$80, kg as EnvironmentAuthorizationError, kh as TypeId$4, ki as ContextHandoffServiceV2, kl as SERVICE_STOP_MARKER_FILE, km as compression$1, kn as layer$177, ko as withRelayClientTracing, kp as isOrchestrationV2WorkActive, kr as Protocol, ks as toArrayBuffer, kt as RELAY_MANAGED_TUNNEL_RECOVERY_TYP, ku as newestCliReleaseVersion, l_ as MessageId, la as layer$139, lc as otlpResource, ld as AgentSessionScanError, lf as isSqlError, lg as AuthEnvironmentMaintainScope, lh as make$73, li as layer$130, ll as siblingPullRequestUrl, lm as middleware, ln as VcsStatusBroadcaster, lo as webhookDeliveriesTotal, lp as RelayCloudMintCredentialProofPayload, lr as BUNDLED_MODEL_MANIFEST, ls as ServerEnvironment, lt as layer$133, lu as layerFlusher, m_ as ProviderSessionId, ma as layer$141, mc as decodeJsonResult, md as GitCommandError, mf as LogLevel$1, mg as AuthMcpApprovalError, mh as isHttpServerResponse, mi as isUndeliveredMailboxSteer, ml as layerFromOrchestrationEventStore, mm as make$75, mn as layer$164, mo as parseGitHubRepositoryNameWithOwnerFromRemoteUrl, mp as RelayManagedEndpointRecoveryResponse, mr as layer$158, ms as layer$199, mt as WorktreeSetupTracker, mu as listLoginShellCandidates, n as McpClientAuthenticator, n_ as ClientOs, na as isCheckpointRestoreIsolated, nc as DEFAULT_PORT, nd as AssetWorkspaceContextResolutionError, nf as get$3, ng as ORCHESTRATION_PROTOCOL_QUERY_PARAM, nh as RequestParseError, nl as UNPUBLISHABLE_THEME_IDS, nm as getSlotParseOptions, nn as layer$127, no as layer$146, np as EnvironmentInternalError, nr as codexPlanLabel, ns as base64UrlEncode, nt as layer$135, nu as RotatingFileSink, o_ as DpopFailureReason, oa as ProjectService, oc as ensureServerDirectories, od as AgentSessionImportProjectChangedError, of as map$7, og as AuthAccessWriteScope, oh as symbol, oi as ContextHandoffBudgetError, ol as threadPullRequestKeysEqual, om as RouteContext, on as layer$181, oo as orchestrationEffectQueueWait, op as EnvironmentScopeRequiredError, or as claudeUsageResponseToLimits, os as resolveSessionCookieName, ot as layer$134, ou as fromConfig, p_ as ProjectId, pa as ProjectFaviconResolver, pc as resolveServerBackgroundActivitySettings, pd as OrchestrationDispatchCommandError, pf as Int$6, pg as AuthGrantScope, ph as html, pi as isBufferedProviderNotification, pl as layer$95, pm as HttpServer, pn as layer$163, po as normalizeGitRemoteUrl, pp as RelayManagedEndpointRecoveryRegistrationResponse, pr as resolveProviderCompatibility, ps as ServerSelfUpdate, pt as layer$172, pu as isCommandAvailable, q as peerPlugins, qa as exactStringPattern, qc as injectMcpAppCookieBootstrap, qd as KeybindingRule, qf as EnvironmentAuthenticatedPrincipal, qg as DEFAULT_MODEL_BY_PROVIDER, qh as layer$147, qi as layer$175, ql as layer$189, qm as CloseEvent, qn as sameUsageLimitCommandCoverage, qo as abytes$1, qp as VcsRepositoryDetectionError, qr as GitHubCredentials, qs as readRelayConnection, qt as ProviderSessionManagerV2, qu as AssetGitHubMediaUrlValidationError, r_ as ClientSurface, ra as pluginMcpServers, rc as RuntimeMode$1, rd as AssetWorkspacePathValidationError, rf as make$78, rg as AuthAccessReadScope, rh as ResponseError, ri as McpAppModelContext, rl as legacyThreadPullRequestKey, rm as getErrorSchemas, rn as layerObserver, ro as increment, rp as EnvironmentOperationForbiddenError, rr as codexRateLimitsToLimits, rs as deriveAuthClientMetadata, rt as make$85, ru as make$83, s_ as EventId, sa as layer$114, sc as layer$100, sd as AgentSessionImportProjectNotFoundError, sf as SqlClient, sg as AuthClientMetadataDeviceType, sh as toResponse, si as makeProviderFailure, sl as visibleThreadPullRequests, sm as add$2, sn as PROJECT_FAVICON_FALLBACK_MARKER, so as rpcRequestDuration, sp as RelayApi, sr as makeEventNdjsonLogStore, ss as signPayload, st as userFacingDispatchErrorMessage, su as serviceNameUnsafe, t_ as ClientDeviceType, ta as SHARED_WORKSPACE_RESTORE_MESSAGE, tc as writeFileStringAtomically, td as AssetWorkspaceContextNotFoundError, tf as changes, tg as ORCHESTRATION_PROTOCOL_HEADER, th as HttpServerError, ti as agentScopeCommand, tl as BUILT_IN_THEME_IDS, tm as isSecurity, tn as RunFinalizationService, to as VcsProcess, tp as EnvironmentHttpUnauthorizedError, tr as CodexInstallation, ts as base64UrlDecodeUtf8, tt as SecretRequests, tu as makeTraceSink, u_ as NonNegativeInt, ua as RepositoryIdentityResolver, uc as resolveStaticDir, ud as AgentSessionSource, uf as Crypto, ug as AuthEnvironmentScopes, uh as getType, ui as layerFromProviderInstanceRegistry, ul as canonicalRepositoryKey, um as route, un as layer$174, uo as withMetrics, up as RelayEnvironmentLinkChallengeResponse, ur as ModelManifest, us as ServerEnvironmentIdentity, ut as ProjectCloneTracker, uu as make$70, v as pullRequestSyncKey, v_ as RunId, va as ThreadCommandExecutor, vc as load, vd as environmentThemeFileHasColors, vf as String$7, vg as AuthOrchestrationOperateScope, vh as redirect, vi as cancelledTurnItemWork, vl as PersistenceSqlError, vm as withScope, vn as layerAnalytics, vo as expandHomePath$1, vp as toRouterPath, vr as WORKSPACE_IMAGE_PREVIEW_EXTENSIONS, vs as layer$156, vt as layer$107, vu as resolveCommandPath, w as remoteSshDeviceHosts, w_ as encode$2, wa as layer$115, wc as ProjectionStoreV2, wd as ExternalLauncherUnsupportedEditorError, wf as schema, wg as AuthSettingsWriteScope, wh as text$1, wi as neverStarted, wl as layer$94, wm as update, wn as ProviderRegistry, wo as waitForSocketGone, wp as OrchestrationV2GetThreadProjectionError, wr as endOrphanedNativeSubagent, ws as layer$144, wt as RELAY_HEALTH_REQUEST_TYP, wu as ChildProcessSpawner, x as DeviceService, x_ as TurnItemId, xa as layer$113, xc as NetService, xd as ExternalLauncherCommandNotFoundError, xf as map$6, xg as AuthProvidersManageScope, xh as setHeader, xi as isRestartNoteContinuation, xl as findAll, xm as make$71, xn as layer$170, xo as coreLaunchCommand, xp as OrchestrationV2AppThreadJson, xr as isWorkspaceImagePreviewPath, xs as writeAllToFileDescriptor, xt as AgentAwarenessRelay, xu as setWindowsPath, y as layer$196, y_ as RuntimeRequestId, ya as layer$117, yc as none$2, yd as EDITORS, yf as URL$1, yg as AuthOrchestrationReadScope, yh as removeHeader, yi as isAwaitedWork, yl as bufferLiveStream, ym as get, yn as GitWorkflowService, yo as PeerBrokerKind, yp as ORCHESTRATION_V2_WS_METHODS, yr as audioMimeTypeFromExtension, ys as DesktopTelemetryReceiver, yt as MCP_CLIENTS, yu as resolveSpawnCommand, z as layer$178, za as layer$109, zc as projectComposerContextForProvider, zd as requiredScopesForServerSettingsPatch, zf as DesktopAppActivationResponse, zg as isStreamSchema, zh as make$82, zi as renderHistory, zl as pinnedRuntimePaths, zm as TypeId$5, zn as layer$157, zo as sandboxBlocked, zp as ProjectSearchEntriesError, zr as layer$190, zs as RELAY_ISSUER_SECRET, zt as layerWithLegacyImporter, zu as PEER_LOCAL_WORKSPACE } from "./McpHttpServer-BMHEDUFV.mjs";
+import { $ as forEach, $i as hasInterrupts, $t as runPromise, Ai as isSuccess, Ar as empty$3, As as findFirst, At as matchEffect, B as filter$1, Bc as Number$3, Bn as withTracerEnabled, Bo as fromInput$2, Br as tap$1, Bt as promise, C as catchTag, Cc as getOrElse, Cn as tryPromise, Cu as dual, D as context, Dc as isNone, Dl as assignProperty, Dr as effect, Ds as ensure, Dt as match$2, Ec as getOrUndefined, Es as empty$1, Et as mapErrorEager, Eu as memoize, F as exit, Fc as orElse, Fl as equals, Fn as withErrorReporting, Fr as provideMerge, G as findFirst$1, Gi as fail$4, Gr as close, Gs as match, Hi as combine$1, Hn as zip, Ho as hours, Hr as Scope, Ht as provideContext, I as fail$2, Ic as some, In as withFiber$1, Ir as succeed$3, It as option, Ji as findErrorOption, Jl as compose, Jr as forkUnsafe, Kt as raceFirst, L as failCause, Lc as toArray, Lt as orDie, M as die, Mc as map$5, Mn as void_, Mo as encode$1, Mr as merge$1, Ms as findLast, Mt as onError, Nc as match$1, Ni as void_$1, Nr as mergeAll, Ns as flatMapNullishOr, Nt as onExit, On as uninterruptible, Oo as Tracer, Or as effectContext, Os as filter$2, Ot as matchCauseEffect, Ou as pipe, P as ensuring, Pc as none$1, Pr as provide$1, Qa as fnUntraced, Qo as minutes$1, Qr as CurrentLogAnnotations, Qt as runForkWith, Rn as withParentSpan, Ro as days, Rt as orElseSucceed, S as catchReason, Sc as fromUndefinedOr, Sn as timeoutOrElse, Ss as Prototype, St as map$3, T as catch_, Tc as getOrThrow$1, To as MinimumTraceLevel, Tt as mapError, Tu as identity, Ui as die$1, Un as zipWith, Uo as infinity, Ur as addFinalizer, Ut as provideService, Vn as yieldNow, Vo as fromInputUnsafe, Vr as unwrap, Vt as provide, W as filterOrFail, Wr as addFinalizerExit, Ws as map$4, X as fn, Xi as fromReasons, Xo as millis, Xt as retry, Yl as hasProperty, Yr as make$69, Ys as sort, Yt as result, Z as fnUntraced$1, Zo as min, Zr as provide$2, Zt as runFork, _ as catchCauseIf, _c as firstSomeOf, _i as make$68, _o as sync, _s as getUnsafe, a as all, ac as getOrUndefined$1, ai as UnhandledLogLevel, an as scoped, as as toMinutes, b as catchFilter, ba as ConsoleRef, bi as succeed$4, bn as timeout, bs as merge$2, bt as logWithLevel, c as annotateLogs, cc as isSuccess$1, ci as done, cl as isEffect, cn as serviceOption, cr as jittered, cs as Reference, ct as ignore, d as asSome, di as failCause$1, dl as withFiber, dn as succeedNone, ds as empty$2, dt as interruptible, du as isTagged, ea as hasInterruptsOnly, ei as CurrentLogSpans, en as runPromiseWith, et as forever, f as asVoid, fc as succeed$2, fn as succeedSome, fr as spaced, ft as isEffect$1, g as catchCause, ga as prettyErrors, gc as filter, gn as tapCause, gt as logError, gu as cast, h as callback, ha as pretty, hc as exists$1, hi as isDone, hl as Class$1, hn as tap, hr as upTo, ht as logDebug, i as addFinalizer$1, ic as getOrThrow, ii as TracerTimingEnabled, in as scope, is as toMillis, it as forkScoped, j as delay, ji as match$3, jr as launch, js as findFirstIndex, jt as never, ju as pipeArguments, k as currentParentSpan, ka as consolePretty$1, kc as isSome, ki as isFailure, kr as effectDiscard, ks as filterMap, l as annotateLogsScoped, ln as sleep$1, lr as modifyDelay, ls as Service, lt as ignoreCause, mc as contains, mn as sync$1, mt as log$1, n as acquireRelease, nc as failVoid, ni as MinimumLogLevel, nn as runSyncExit, ns as sum, nt as forkDetach, o as andThen, oc as isFailure$1, oi as _await, ot as fromResult, ou as isObject, p as cached, pn as suspend, q as flatMap$1, qc as make$67, qs as reduce, qt as repeat, r as acquireUseRelease, ri as TracerEnabled, rn as runSyncWith, ro as loggerMake, rr as exponential, rt as forkIn, ru as isNotUndefined, s as annotateCurrentSpan, si as die$2, ss as zero, st as gen$1, tc as fail$3, tn as runSync, ts as seconds, tu as isNotNull, u as as, ui as fail$5, un as succeed$1, us as add$1, ut as interrupt, v as catchDefect, va as squash, vc as flatMap$2, vi as makeUnsafe$1, vl as format, vn as tapError, vo as tracerLogger$1, vs as make$66, vt as logInfo, w as catchTags, wc as getOrNull, wn as try_, wr as build, wu as flow, x as catchIf, xa as CurrentLoggers$1, xc as fromNullishOr, xn as timeoutOption, xs as omit, xu as constVoid, yc as flatten, ys as makeUnsafe$2, yt as logWarning, zn as withSpan, zo as format$1, zr as sync$2, zs as isReadonlyArrayNonEmpty, zt as partition } from "./Effect-DXlc4A9S.mjs";
+import { $ as Scheduler, $a as exactStringPattern, $c as MAX_TOOL_OUTPUT_IMAGE_BASE64_LENGTH, $d as PREVIEW_VIEWPORT_PRESET_IDS, $f as DesktopBackendBootstrap, $g as hasBody, $h as isHttpClientError, $i as JjVcsDriver, $l as enrichProviderSnapshotWithVersionAdvisory, $m as toPersisted, $n as codexCallbackUrl, $o as sha256, $p as RuntimeMode, $r as PullRequestProviderError, $s as encodeConfirmedOriginJson, $t as RunExecutionServiceV2, $u as SERVER_BROWSER_AUTOMATION_CLIENT_ID, A as layer$184, A_ as ThreadId, Aa as layer$112, Ac as resolveSignalEndpoint, Ad as ExternalLauncherBrowserSpawnError, Af as all$1, Ag as AuthPreviewOperateScope, Ah as setBody, Ai as reportLabel, Al as makeLiveStreamBudget, Am as getAndSet, An as TerminalManager, Ao as coreLaunchCommand, Ap as OrchestrationGetWorkflowScriptError, Ar as ProviderEventLoggers, As as layer$154, At as RELAY_LINK_PROOF_TYP, Au as resolveWindowsEnvironment, B as coreLayer, Ba as forkParkedFiber, Bc as decodeThreadHistoryCursor, Bd as CodexSettings, Bf as makeWith, Bg as ServerAuthSessionMethod, Bh as inspect$1, Bi as latestNativeContextUsage, Bl as compareExactServiceVersions, Bm as fromHeaders, Bn as BackgroundPolicy, Bo as APPARMOR_PROFILE, Bp as latestProviderTurnForAttempt, Br as PtySpawnError, Bs as toUint8Array, Bt as isTerminalRunStatus, Bu as RequestInit, C as stateStream, C_ as ProjectId, Ca as LegacyV1ThreadImporter, Cc as resolveServerBackgroundActivitySettings, Cd as OrchestrationDispatchCommandError, Cf as Int$6, Cg as AuthGrantScope, Ch as html, Ci as isRestartNoteContinuation, Cl as layer$95, Cm as HttpServer, Cn as layer$170, Co as matchRepositories, Cp as RelayManagedEndpointRecoveryRegistrationResponse, Cr as isWorkspaceImagePreviewPath, Cs as ServerSelfUpdate, Ct as AgentAwarenessRelay, Cu as isCommandAvailable, D as PreviewAutomationBroker, D_ as RpcClientId, Da as layer$115, Dc as layerResourceAttributes, Dd as ServerProviderUpdateError, Df as Redacted, Dg as AuthMcpTokenError, Dh as raw$1, Di as pendingRestartCancelledBackgroundWork, Dl as PersistenceDecodeError, Dm as mapRequest, Dn as layer$185, Do as expandHomePath$1, Dp as fromApi, Dr as endRunlessRootTurns, Ds as runServicePreflight, Dt as RELAY_HEALTH_RESPONSE_TYP, Du as readPathFromLaunchctl, E as layer$197, E_ as ProviderTurnId, Ea as deriveThreadFromProviderThread, Ec as fromLenientJson, Ed as EnvironmentThemeId, Ef as Port, Eg as AuthMcpRegistrationError, Eh as mergeCookies, Ei as neverStarted, El as layer$108, Em as filterStatusOk$1, En as ProviderRegistry, Eo as mergeProviderInstanceEnvironment, Ep as RelayProtectedError, Er as endOrphanedNativeSubagent, Es as layer$200, Et as RELAY_HEALTH_REQUEST_TYP, Eu as readEnvironmentFromLoginShell, F as issueAttachmentUploadUrl, F_ as snapshotUnsafe, Fa as REPLAY_SAFE_EFFECT_TYPES_AFTER_PROCESS_LOSS, Fc as layer$96, Fd as ExternalLauncherUnsupportedTargetError, Ff as withDefault$2, Fg as AuthSourceControlWriteScope, Fh as uint8Array$1, Fi as contextUsageForHandoff, Fl as readOnly, Fm as updateAndGet, Fn as PortDiscovery, Fo as make$76, Fp as OrchestrationV2ProviderSessionJson, Fr as AcpRegistryCatalog, Fs as redactServerSettingsForClient, Ft as signRelayJwt, Fu as CLI_RELEASE_BASE_URL_ENV, G as PeerWorkspaces, Ga as realpathOrSelf$2, Gc as parseAttachmentFileExtension, Gd as ServerSettings, Gg as getStatusErrorSchema, Gh as bodyStream, Gi as CheckpointServiceV2, Gl as serviceStateHasPendingUpdate, Gm as schemaHeaders, Gn as layer$192, Go as PreviewBrowserSandboxError, Gp as ProjectMutation, Gr as SourceControlProviderRegistry, Gs as CLOUD_MINT_PUBLIC_KEY, Gt as layer$131, Gu as WS_METHODS, H as rpcLayer, Ha as layer$109, Hc as attachmentRelativePath, Hd as DEFAULT_AUTOMATIC_GIT_FETCH_INTERVAL, Hf as nextIntBetween, Hg as authScopeResponse, Hh as bearerToken, Hi as selectHistory, Hl as isExactServiceVersion, Hm as ParsedSearchParams, Hn as layer$155, Ho as DEBIAN_PACKAGES, Hp as UsageLimitSourceError, Hr as withWorkspaceLease, Hs as CLOUD_ENDPOINT_RUNTIME_CONFIG, Ht as withCreationProvenance, Hu as CLIENT_GUARDED_RPC_SCOPES, I as storeAttachmentUpload, I_ as update$1, Ia as layer$111, Ic as InvalidThreadHistoryCursorError, Id as ProviderSetupError, If as SourceError, Ig as AuthStandardClientScopes, Ih as urlParams, Ii as handoffBudget, Il as SERVICE_LAUNCHER_CONTEXT_ENV, Im as appendPreResponseHandler, In as layer$176, Io as RelayClientTracer, Ip as OrchestrationV2SearchThreadError, Ir as layerFromHost, Is as decode$2, It as verifyRelayJwt, Iu as CLI_RELEASE_CHANNELS, J as ScheduledTaskService, Ja as resolveJjRepoPaths, Jc as runRanAfter, Jd as requiredScopesForProjectMutation, Jf as DesktopAppActivationErrorCode, Jg as isNoContent, Jh as get$2, Ji as CheckpointStore, Jl as pinnedRuntimeCommand, Jm as MultipartError, Jn as layer$161, Jo as missingLibraries, Jp as ProjectSearchContentsError, Jr as layer$149, Js as RELAY_ENVIRONMENT_CREDENTIAL_SECRET, Jt as layer$121, Ju as PEER_RPC_SCOPES, K as PeerPluginRegistry, Ka as remoteOf, Kc as resolveAttachmentPathById, Kd as ServerSettingsError, Kf as findBrowserProfile, Kg as getStatusSuccessSchema, Kh as bodyUrlParams, Ki as checkpointRefForScopeOrdinal, Kl as PinnedRuntimeInstallError, Km as schemaSearchParams, Kn as layer$159, Ko as SETUP_SUBCOMMAND, Kp as ProjectMutationError, Kr as layer$148, Ks as HOLD_WEBHOOKS_WHILE_OFFLINE_SECRET, Kt as RuntimePolicyV2, Ku as WsRpcGroup, L as validateAttachmentUploadToken, L_ as withAttributes, La as layerPruneWorker, Lc as THREAD_HISTORY_PAGE_POLICY, Ld as ProviderUploadFeedbackError, Lf as get$1, Lg as AuthTerminalOperateScope, Lh as filterStatusOk, Li as handoffTokenCapConfig, Ll as SERVICE_RESTART_PENDING_FILE, Lm as toHandled, Ln as deriveProviderInstanceConfigMap, Lo as layer$104, Lp as OrchestrationV2ThreadLaunchError, Lr as toAcpRegistryOperationError, Ls as fromReadable, Lt as makeDrainableWorker, Lu as cliReleaseChannelOf, M as launchThread, M_ as decode$1, Ma as layer$110, Mc as layer$180, Md as ExternalLauncherEditorSpawnError, Mf as mapEffect$1, Mg as AuthRelayReadScope, Mh as setHeaders, Mi as layer$120, Ml as findOneOption, Mm as modify, Mn as NativeTelemetryClient, Mo as requestHandover, Mp as OrchestrationV2DispatchCommandError, Mr as make$81, Ms as subscribeBeforeSnapshot, Mt as RELAY_MINT_REQUEST_TYP, Mu as withPathDirectoryListings, N as ATTACHMENT_UPLOAD_ROUTE_PREFIX, N_ as decodeString$1, Na as EffectOutboxV2, Nc as ProjectionStoreThreadNotFoundError, Nd as ExternalLauncherUnknownEditorError, Nf as option$1, Ng as AuthRelayWriteScope, Nh as stream$2, Ni as DEFAULT_HANDOFF_TOKEN_CAP, Nl as void_$2, Nm as set$2, Nn as layer$152, No as waitForSocketGone, Np as OrchestrationV2GetShellSnapshotError, Nr as makeProtocolWithHttpEffectWebsocket, Ns as ServerSettingsService, Nt as RELAY_MINT_RESPONSE_TYP, Nu as make$72, O as layer$198, O_ as RunId, Oa as EventSinkV2, Oc as load, Od as environmentThemeFileHasColors, Of as String$7, Og as AuthOrchestrationOperateScope, Oh as redirect, Oi as restartCancelledBackgroundWorkNote, Ol as PersistenceSqlError, Om as withScope, On as ProjectSetupScriptRunner, Oo as PeerBrokerKind, Op as toRouterPath, Or as PluginMcpServers, Os as layer$156, Ot as RELAY_HOOK_DELIVERY_HEADER, Ou as resolveCommandPath, P as deletePendingAttachment, P_ as encode$2, Pa as PROCESS_BOUND_EFFECT_TYPES, Pc as ProjectionStoreV2, Pd as ExternalLauncherUnsupportedEditorError, Pf as schema, Pg as AuthSettingsWriteScope, Ph as text$1, Pi as attachmentTokenAllowance, Pl as layer$94, Pm as update, Pn as layer$153, Po as EXIT_STATUS, Pp as OrchestrationV2GetThreadProjectionError, Pr as layerJson, Ps as layer$144, Pt as normalizeRelayIssuer, Pu as ChildProcessSpawner, Q as relayHookBaseUrl, Qa as make$79, Qc as projectThreadProjectionForWire, Qd as PREVIEW_STREAM_HOST_SETUP_CLOSE_CODE, Qf as DESKTOP_UPDATE_RESTART_MARKER_FILE, Qg as isWithHeadersValue, Qh as setHeaders$1, Qi as layer$151, Ql as layer$98, Qm as makeConfig, Qn as codexAuthorizationRequest, Qo as layer$101, Qr as firstNonEmptyLine, Qs as decodeRuntimeConfig, Qt as layer$122, Qu as PREVIEW_AUTOMATION_SERVER_OPERATIONS, R as PreviewManager, R_ as bytes, Ra as ServerActivation, Rc as THREAD_HISTORY_SNAPSHOT_ROW_LIMIT, Rd as AntigravitySettings, Rf as invalidate, Rg as AuthTerminalReadScope, Rh as MaxBodySize, Ri as historicalMessage, Rl as SERVICE_STATE_FILE, Rm as TracerDisabledWhen, Rn as layer$186, Ro as withLocalTracing, Rp as OrchestrationV2ThreadShell, Rr as AcpRegistryRuntimeCoordinator, Rs as pipeThroughDuplex, Rt as ThreadManagementService, Ru as cliReleaseIndexPageUrl, S as layer$179, S_ as PositiveInt, Sa as layer$117, Sc as parsePersistedServerObservabilitySettings, Sd as OrchestrationSearchThreadsError, Sf as ConfigError, Sg as AuthFilesystemWriteScope, Sh as file, Si as isRestartContinuationSource, Sl as EventStoreV2, Sm as use, Sn as layer$171, So as run$4, Sp as RelayHookDeliveryProofPayload, Sr as hostPreviewMimeTypeFromExtension, Ss as layerIdentity, St as mcpClient, Su as collectUint8StreamText, T as PreviewBrowser, T_ as ProviderThreadId, Ta as IdAllocatorV2, Tc as fromJsonStringPretty, Td as EnvironmentThemeFile, Tf as NonEmptyString, Tg as AuthMcpClientAccess, Th as jsonUnsafe, Ti as mergeRestartCancelledBackgroundWork, Tl as OrchestrationEventStore, Tm as HttpClient, Tn as layer$168, To as resolveCodexHomeLayout, Tp as RelayOkResponse, Tr as makeUnavailableUsageLimits, Ts as ServiceLauncherClient, Tt as getOrCreateEnvironmentKeyPairFromSecretStore, Tu as mergePathEntries, U as PeerAdapters, Ua as PeerState, Uc as chatAttachmentStableKey, Ud as DEFAULT_PROVIDER_HEALTH_REFRESH_INTERVAL, Uf as BUILT_IN_BROWSER_PROFILES, Ug as getResponseEncoding, Uh as bodyJson, Ui as isNativeMaintenanceCommand, Ul as parseServiceState, Um as TypeId$6, Un as BUILT_IN_USAGE_DRIVERS, Uo as NO_SANDBOX_SIGNATURE, Up as OrchestrationProjectShell, Ur as TextGeneration, Us as CLOUD_LINKED_USER_ID, Ut as OrchestratorV2, Uu as clientRpcRequiredScopes, V as layer$105, Va as layerFromApplicationReceipts, Vc as PENDING_ATTACHMENT_THREAD_SEGMENT, Vd as DATABASE_COMPACTION_RECOMMENDED_BYTES, Vf as set$3, Vg as authScopeRequiredResponse, Vh as schemaBodyJson, Vi as renderHistory, Vl as decodeServiceLauncherChildMessage, Vm as HttpServerRequest, Vn as layer$157, Vo as APPARMOR_PROFILE_PATH, Vp as ToolActivityNativeAppReference, Vr as layer$190, Vs as CLOUD_ENDPOINT_CONFIRMED_ORIGIN, Vt as layerWithLegacyImporter, Vu as layer$99, W as PeerCoordination, Wa as layer$106, Wc as createDeterministicAttachmentId, Wd as DEFAULT_SERVER_SETTINGS, Wg as getResponseEncodingSchema, Wh as bodyJsonUnsafe, Wi as layer$129, Wl as serviceStateActiveVersion, Wm as schemaCookies, Wn as layer$191, Wo as PreviewBrowserLibrariesError, Wp as ProjectListEntriesError, Wr as layer$137, Ws as CLOUD_LINK_REVOKED, Wt as layer$128, Wu as RpcScopeAuthorization, X as WEBHOOK_ROUTE_PREFIX, Xa as resolveWorkspaceRefName, Xc as normalizeProjectPathForComparison, Xd as resolveProviderInstanceEnabled, Xf as DesktopBrowserCommand, Xg as isStreamUint8Array, Xh as post, Xi as VcsDriverRegistry, Xl as pinnedRuntimeVersionsDir, Xm as isPersistedFile, Xn as withUsageLimitsCommands, Xo as sandboxDisabled, Xp as ProjectWriteFileError, Xr as layer$167, Xs as RELAY_URL_SECRET, Xt as layer$123, Xu as Service$1, Y as ScheduledTaskWebhookOrigin, Ya as invalidateJjAvailability, Yc as projectComposerContextForProvider, Yd as requiredScopesForServerSettingsPatch, Yf as DesktopAppActivationResponse, Yg as isStreamSchema, Yh as make$82, Yi as layer$175, Yl as pinnedRuntimePaths, Ym as TypeId$5, Yn as sameUsageLimitCommandCoverage, Yo as sandboxBlocked, Yp as ProjectSearchEntriesError, Yr as GitHubCredentials, Ys as RELAY_ISSUER_SECRET, Yt as ProviderSessionManagerV2, Yu as PEER_LOCAL_WORKSPACE, Z as layer$136, Za as workspaceNameForRef, Zc as projectDomainEventForWire, Zd as FILL_PREVIEW_VIEWPORT, Zf as DesktopBrowserEvent, Zg as isWithHeaders, Zh as setHeader$1, Zi as layer$150, Zl as ProcessRunner, Zm as limitsServices, Zn as makeCodexChatGptAuth, Zo as layer$103, Zp as DEFAULT_PROVIDER_INTERACTION_MODE, Zr as detailFromCause, Zs as decodeConfirmedOrigin, Zt as CommandOutputHub, Zu as UsageReadError, _ as layer$195, __ as EventId, _a as layer$141, _c as layer$100, _d as AgentSessionImportProjectNotFoundError, _f as SqlClient, _g as AuthClientMetadataDeviceType, _h as toResponse, _i as awaitingProviderThreadId, _l as visibleThreadPullRequests, _m as add$2, _n as layer$166, _o as resolveProjectSettings, _p as RelayApi, _r as AntigravityInstallation, _s as signPayload, _t as ensureShim, _u as serviceNameUnsafe, a_ as ProviderInstanceId, aa as PeerHubClient, ac as resolveHostCliCommand, ad as AssetProjectFaviconInspectionError, af as KeybindingsConfigError, ag as layerWeak, ah as SocketOpenError, ai as McpAppModelContext, al as mcpAppToolCallableByApp, am as OrchestrationGetFullThreadDiffError, an as layerObserver, ao as GitVcsDriver, ap as EnvironmentHttpApi, ar as codexRateLimitsToLimits, as as ahash, at as ThreadLaunchService, au as OtlpHeadersFromString, b as DEVICE_HUB_ROUTE_PREFIX, b_ as NonNegativeInt, ba as layer$142, bc as resolveStaticDir, bd as AgentSessionSource, bf as Crypto, bg as AuthEnvironmentScopes, bh as getType, bi as cancelledTurnItemWork, bl as canonicalRepositoryKey, bm as route, bn as layerAnalytics, bo as parseGitHubRepositoryNameWithOwnerFromRemoteUrl, bp as RelayEnvironmentLinkChallengeResponse, br as WORKSPACE_IMAGE_PREVIEW_EXTENSIONS, bs as ServerEnvironmentIdentity, bt as userBases, bu as make$70, c_ as AuthSessionId, ca as ProjectOperationError, cc as isSecretAlreadyExistsError, cd as AssetSigningKeyLoadError, cf as QuitError, cg as uint8Array, ch as fromWebSocket, ci as ContextHandoffBudgetError, cl as compileResolvedKeybindingsConfig, cm as ChatAttachmentId, cn as layer$181, co as layer$146, cp as EnvironmentHttpConflictError, cr as claudeUsageResponseToLimits, cs as concatBytes$1, ct as ManagedProjectFolders, cu as decodeOtlpTraceRecords, d_ as ClientDeviceType, da as ProjectEnrichmentService, dc as writeFileStringAtomically, dd as AssetWorkspaceContextNotFoundError, df as changes, dg as ORCHESTRATION_PROTOCOL_HEADER, dh as HttpServerError, di as layer$130, dl as BUILT_IN_THEME_IDS, dm as isSecurity, dn as VcsStatusBroadcaster, do as orchestrationEffectClaimsTotal, dp as EnvironmentHttpUnauthorizedError, dr as BUNDLED_MODEL_MANIFEST, ds as base64UrlDecodeUtf8, dt as layer$173, du as makeTraceSink, e_ as encoder, ea as layer$145, ec as encodeEndpointRuntimeConfigJson, ed as McpAppRequestError, ef as PreviewClearProfileError, eg as TypeId$7, eh as decodeField, ei as AnalyticsService, el as mcpAppFromToolItem, em as PullRequestLinkedThreadsResult, en as canRouteRelatedSubagent, eo as colocatedGitCommand, ep as RelayClientInstallFailedError, er as providerAuthReturnUrl, es as sha384, et as layer$138, eu as makeTargetedProviderUpdateAction, f_ as ClientOs, fa as layer$139, fc as DEFAULT_PORT, fd as AssetWorkspaceContextResolutionError, ff as get$3, fg as ORCHESTRATION_PROTOCOL_QUERY_PARAM, fh as RequestParseError, fi as layerFromProviderInstanceRegistry, fl as UNPUBLISHABLE_THEME_IDS, fm as getSlotParseOptions, fn as layer$174, fo as orchestrationEffectQueueWait, fp as EnvironmentInternalError, fr as ModelManifest, fs as base64UrlEncode, ft as SourceControlRepositoryService, fu as RotatingFileSink, g as PullRequestReviewGuideService, g_ as DpopFailureReason, ga as ProjectFaviconResolver, gc as ensureServerDirectories, gd as AgentSessionImportProjectChangedError, gf as map$7, gg as AuthAccessWriteScope, gh as symbol, gi as isUndeliveredMailboxSteer, gl as threadPullRequestKeysEqual, gm as RouteContext, gn as layer$164, go as withMetrics, gp as EnvironmentScopeRequiredError, gr as layer$158, gs as resolveSessionCookieName, gt as McpClients, gu as fromConfig, h_ as CommandId, ha as make$84, hc as deriveServerPaths, hd as AssetWorkspaceRootNormalizationError, hf as Stdio, hg as AuthAccessTokenType, hh as causeResponse, hi as isBufferedProviderNotification, hl as threadPullRequestKeyOf, hm as normalize, hn as layer$163, ho as webhookDeliveriesTotal, hp as EnvironmentResourceNotFoundError, hr as resolveProviderCompatibility, hs as resolveLegacySessionCookieName, ht as layer$169, hu as entriesToAttributes, i as layer$194, i_ as ProviderDriverKind, ia as isCheckpointRestoreIsolated, ic as resolveCliCommand, id as AssetPreviewTypeValidationError, if as KeybindingsConfig, ig as layer$102, ih as SocketError, il as injectMcpAppThemeBootstrap, im as VcsUnsupportedOperationError, in as layer$127, io as managedWorktreesDirectories, ip as EnvironmentCloudEndpointUnavailableError, ir as codexPlanLabel, is as aexists, it as threadHasQueuedTurnStart, iu as DEFAULT_SIGNAL_EXPORT, j as dispatchCommand, j_ as TurnItemId, ja as ProjectStoreV2, jc as NetService, jd as ExternalLauncherCommandNotFoundError, jf as map$6, jg as AuthProvidersManageScope, jh as setHeader, ji as ContextHandoffServiceV2, jl as findAll, jm as make$71, jn as layer$177, jo as readOwner, jp as OrchestrationV2AppThreadJson, jr as Protocol, js as writeAllToFileDescriptor, jt as RELAY_MANAGED_TUNNEL_RECOVERY_TYP, ju as setWindowsPath, k as ThreadSearch, k_ as RuntimeRequestId, ka as layerFromStores, kc as none$2, kd as EDITORS$1, kf as URL$1, kg as AuthOrchestrationReadScope, kh as removeHeader, ki as restartContinuationNote, kl as bufferLiveStream, km as get, kn as layer$132, ko as coordSocketPath, kp as ORCHESTRATION_V2_WS_METHODS, kr as NoOpProviderEventLoggers, ks as DesktopTelemetryReceiver, kt as RELAY_HOOK_DELIVERY_TYP, ku as resolveSpawnCommand, l_ as CheckpointId, la as ProjectService, lc as isSecretStoreError, ld as AssetWorkspaceAssetInspectionError, lf as Terminal, lg as FileSystem, lh as makeWebSocket$1, li as makeProviderFailure, ll as mergeWithDefaultKeybindings, lm as PROVIDER_SEND_TURN_MAX_FILE_BYTES, ln as PROJECT_FAVICON_FALLBACK_MARKER, lo as increment, lp as EnvironmentHttpForbiddenError, lr as makeEventNdjsonLogStore, ls as randomBytes, lt as layer$133, lu as layerOtlpSerialization, m_ as ClientWebDeployment, ma as layer$140, mc as ServerConfig, md as AssetWorkspaceResolutionError, mf as set$1, mg as AuthAccessStreamError, mh as ServeError, mi as ProviderInstanceRegistry, ml as normalizeThreadPullRequestKey, mm as getSuccessSchemas, mn as PullRequestService, mo as rpcRequestsTotal, mp as EnvironmentRequestInvalidError, mr as layerModelCatalog, ms as isRemoteReachableHost, mt as WorktreeSetupTracker, mu as OtlpSerialization, n as McpClientAuthenticator, n_ as DEFAULT_MODEL, na as parseTurnDiffFilesFromNumstat, nc as readHoldWebhooksWhileOffline, nd as AssetCreateUrlInput, nf as PreviewViewportSetting, ng as isIgnored, nh as Path, ni as AgentScope, nl as MCP_APP_MAX_HTML_BYTES, nm as pullRequestHostOf, nn as selectInheritedBackgroundTurnItems, no as isFilesystemRoot, np as EnvironmentAuthenticatedAuth, nr as normalizePreviewUrl, ns as Hash, nt as layer$135, nu as ProviderLatestVersions, o_ as ProviderInstanceMutation, oa as pluginMcpServers, oc as resolveRootCliCommand, od as AssetProjectFaviconNotFoundError, of as ResolvedKeybindingRule, og as raw, oh as WebSocket$1, oi as layer$125, ol as DEFAULT_KEYBINDINGS, om as OrchestrationGetTurnDiffError, on as layer$126, oo as layer$118, op as EnvironmentHttpBadRequestError, or as layer$188, os as anumber, ot as layer$134, ou as OtlpProtocol, p_ as ClientSurface, pa as RepositoryIdentityResolver, pc as RuntimeMode$1, pd as AssetWorkspacePathValidationError, pf as make$78, pg as AuthAccessReadScope, ph as ResponseError, pi as ProviderAdapterTurnStartError, pl as legacyThreadPullRequestKey, pm as getErrorSchemas, pn as layerAutoPullPolicy, po as rpcRequestDuration, pp as EnvironmentOperationForbiddenError, pr as layer$187, ps as deriveAuthClientMetadata, pt as layer$172, pu as make$83, q as peerPlugins, qa as checkoutKind, qc as parseBase64DataUrl, qd as ServerSettingsPatch, qf as resolveBrowserProfiles, qg as getWithHeadersAnnotation, qh as del, qi as layer$119, ql as ensurePinnedRuntimeInstalled, qm as toURL, qn as layer$160, qo as diagnoseLaunchFailure, qp as ProjectReadFileError, qr as BUILT_IN_SOURCE_CONTROL_DRIVERS, qs as PUBLISH_AGENT_ACTIVITY_SECRET, qt as layerFromProjectStore, qu as WsT3RpcGroup, r_ as DEFAULT_MODEL_BY_PROVIDER, ra as SHARED_WORKSPACE_RESTORE_MESSAGE, rc as readRelayConnection, rd as AssetGitHubMediaUrlValidationError, rf as KeybindingRule, rg as layer$147, rh as CloseEvent, ri as agentScopeCommand, rl as injectMcpAppCookieBootstrap, rm as VcsRepositoryDetectionError, rn as RunFinalizationService, ro as makeIsManagedWorktreePath, rp as EnvironmentAuthenticatedPrincipal, rr as CodexInstallation, rs as abytes$1, rt as make$85, ru as layer$189, s_ as defaultInstanceIdForDriver, sa as ProjectConflictError, sc as ServerSecretStore, sd as AssetProjectFaviconResolutionError, sf as getCurrentVersion, sg as stream$1, sh as WebSocketConstructor, si as layer$201, sl as compileResolvedKeybindingRule, sm as OrchestrationGetTurnDiffResult, sn as WorkspaceEntries, so as VcsProcess, sp as EnvironmentHttpCommonError, sr as EMPTY_TOTALS, ss as clean, st as userFacingDispatchErrorMessage, su as causeErrorTag, t_ as AcpRegistryOperationError, ta as isGitImport, tc as isAgentActivityPublishingEnabledValue, td as AssetAttachmentNotFoundError, tf as PreviewStreamHostSetup, tg as ignore$1, th as make$74, ti as layer$193, tl as toolOutputImages, tm as PullRequestOperationError, tn as layer$124, to as jjCommand, tp as EnvironmentAuthInvalidError, tr as isLoopbackHost$1, ts as sha512, tt as SecretRequests, tu as resolveLatestProviderVersion, u_ as ClientConnectionMethod, ua as layer$114, uc as layer$97, ud as AssetWorkspaceAssetNotFoundError, uf as isQuitError, ug as ExecutionEnvironmentDescriptor, uh as ClientAbort, ui as ProviderContinuationRequests, ul as parseKeybindingShortcut, um as PersistChatAttachmentsError, un as isProjectFaviconPath, uo as metricAttributes, up as EnvironmentHttpInternalServerError, ur as readContainedWorkflowFile, us as toBytes, ut as ProjectCloneTracker, uu as makeLocalFileTracer, v as pullRequestSyncKey, v_ as IsoDateTime, va as layer$143, vc as make$77, vd as AgentSessionImportSource, vf as SpanPropagationEnabled, vg as AuthDiagnosticsReadScope, vh as HttpPlatform, vi as cancelledBeforeStart, vl as parseChangeRequestUrl, vm as cors, vn as layer$165, vo as resolveWorktreeCleanup, vp as RelayCloudEnvironmentHealthProofPayload, vr as formatThreadTitleContext, vs as timingSafeEqualBase64Url, vt as layer$107, vu as unknownToAttributeValue, w as remoteSshDeviceHosts, w_ as ProviderSessionId, wa as layer$113, wc as decodeJsonResult, wd as GitCommandError, wf as LogLevel$1, wg as AuthMcpApprovalError, wh as isHttpServerResponse, wi as isRestartNoteSource, wl as layerFromOrchestrationEventStore, wm as make$75, wn as GitManager, wo as withoutCredentials, wp as RelayManagedEndpointRecoveryResponse, wr as isWorkspacePreviewEntryPath, ws as layer$199, wt as layer$183, wu as listLoginShellCandidates, x as DeviceService, x_ as PortSchema, xa as ThreadCommandExecutor, xc as version, xd as FilesystemBrowseError, xf as Boolean$5, xg as AuthFilesystemReadScope, xh as empty$4, xi as isAwaitedWork, xl as sourceControlRepositorySelector, xm as serve, xn as GitWorkflowService, xo as parseOriginUrlFromGitConfig, xp as RelayEnvironmentLinkResponse, xr as audioMimeTypeFromExtension, xs as layer$182, xt as MCP_CLIENTS, xu as modelSelectionsEqual, y as layer$196, y_ as MessageId, ya as WorkspacePaths, yc as otlpResource, yd as AgentSessionScanError, yf as isSqlError, yg as AuthEnvironmentMaintainScope, yh as make$73, yi as cancelledRosterTaskWork, yl as siblingPullRequestUrl, ym as middleware, yn as layer$116, yo as normalizeGitRemoteUrl, yp as RelayCloudMintCredentialProofPayload, yr as WORKSPACE_BROWSER_PREVIEW_EXTENSIONS, ys as ServerEnvironment, yt as listClients, yu as layerFlusher, z as layer$178, za as forkParked, zc as buildBoundedThreadProjection, zd as ClaudeSettings, zf as make$80, zg as EnvironmentAuthorizationError, zh as TypeId$4, zi as historyCost, zl as SERVICE_STOP_MARKER_FILE, zm as compression$1, zn as layer$162, zo as withRelayClientTracing, zp as isOrchestrationV2WorkActive, zr as PtyAdapter, zs as toArrayBuffer, zt as ThreadTranscriptTooLargeError, zu as newestCliReleaseVersion } from "./McpHttpServer-DAx8Xm-g.mjs";
 import { a as monotonicTimeNanos, i as currentTimeNanos, r as currentTimeMillis, t as Clock } from "./Clock-B88OfuDl.mjs";
-import { A as fromEffect, Bt as zipLatestWith, Dn as unbounded$1, Dt as tap$2, F as fromPull, Fn as unbounded, G as mapAccum, H as isStream, Hn as interrupt$1, I as fromQueue, J as mapError$1, Jn as runIn, K as mapArrayEffect, Kn as join, M as fromIterable, Mn as sliding, Mt as toPull, N as fromIteratorSucceed, Nn as subscribe, On as publish, P as fromPubSub, R as fromSubscription, Rn as makeUnsafe$3, Rt as unfold, S as filterMap$1, Sn as shutdown, St as switchMap, T as flattenIterable, Tn as take, U as make$87, Vn as getCurrent, W as map$8, Y as merge$3, Yn as Order, Z as mkString, Zn as round, _n as offer, b as filter$3, bt as succeed$5, c as changesWith, d as decodeText, dt as runFold, et as orDie$1, fn as fail$6, g as encodeText, gn as make$88, gt as runHead, h as empty$5, i as catchCause$1, in as make$86, it as provideContext$1, jn as shutdown$1, l as concat, lt as runCollect, m as drop, mt as runForEachArray, nt as pipeThroughChannel, pn as failCause$2, pt as runForEach, q as mapEffect$2, r as callback$1, s as changes$1, sn as clear, u as debounce, un as end, v as fail$5, vn as offerAll, w as flatMap$3, wn as sliding$1, wt as takeUntil, x as filterEffect, xt as suspend$1, yn as offerUnsafe, yt as splitLines, z as groupedWithin, zn as awaitAll, zt as unwrap$1 } from "./mcpResponsePayloads-Be_jYC4_.mjs";
+import { A as fromEffect, Bt as zipLatestWith, Dn as unbounded$1, Dt as tap$2, F as fromPull, Fn as unbounded, G as mapAccum, H as isStream, Hn as interrupt$1, I as fromQueue, J as mapError$1, Jn as runIn, K as mapArrayEffect, Kn as join$1, M as fromIterable, Mn as sliding, Mt as toPull, N as fromIteratorSucceed, Nn as subscribe, On as publish, P as fromPubSub, R as fromSubscription, Rn as makeUnsafe$3, Rt as unfold, S as filterMap$1, Sn as shutdown, St as switchMap, T as flattenIterable, Tn as take, U as make$87, Vn as getCurrent, W as map$8, Y as merge$3, Yn as Order, Z as mkString, Zn as round, _n as offer, b as filter$3, bt as succeed$5, c as changesWith, d as decodeText, dt as runFold, et as orDie$1, fn as fail$7, g as encodeText, gn as make$88, gt as runHead, h as empty$5, i as catchCause$1, in as make$86, it as provideContext$1, jn as shutdown$1, l as concat, lt as runCollect, m as drop, mt as runForEachArray, nt as pipeThroughChannel, pn as failCause$2, pt as runForEach, q as mapEffect$2, r as callback$1, s as changes$1, sn as clear, u as debounce, un as end, v as fail$6, vn as offerAll, w as flatMap$3, wn as sliding$1, wt as takeUntil, x as filterEffect, xt as suspend$1, yn as offerUnsafe, yt as splitLines, z as groupedWithin, zn as awaitAll, zt as unwrap$1 } from "./mcpResponsePayloads-Be_jYC4_.mjs";
 import { t as runClaudeHistoryWorker } from "./claudeHistoryWorker-qaiupgMM.mjs";
 import { a as HomeDirectory, c as IsExecutable, d as WorkingDirectory, f as isWindows, i as ExecutablePath, l as Platform, o as Hostname, r as Environment, s as InvokedAs, t as Architecture, u as UserId } from "./HostProcess-SbwG-qzE.mjs";
 import { r as runAcpMcpCliFastPath } from "./AcpMcpStdioBridge-ZWAIz2dT.mjs";
@@ -1482,7 +1482,7 @@ const Choice = (choices) => {
 	const validChoices = choices.map(([key]) => format(key)).join(" | ");
 	const primitive = makePrimitive("Choice", (value) => {
 		if (choiceMap.has(value)) return succeed$1(choiceMap.get(value));
-		return fail$1(validChoices);
+		return fail$2(validChoices);
 	});
 	return Object.assign(primitive, { choiceKeys: choices.map(([key]) => key) });
 };
@@ -1920,8 +1920,8 @@ const Number$1 = (options) => {
 		decrementBy: 1,
 		precision: 2,
 		validate: (n) => {
-			if (n < opts.min) return fail$1(`${n} must be greater than or equal to ${opts.min}`);
-			if (n > opts.max) return fail$1(`${n} must be less than or equal to ${opts.max}`);
+			if (n < opts.min) return fail$2(`${n} must be greater than or equal to ${opts.min}`);
+			if (n > opts.max) return fail$2(`${n} must be less than or equal to ${opts.max}`);
 			return succeed$1(n);
 		},
 		...options
@@ -1958,8 +1958,8 @@ const Int$3 = (options) => {
 		incrementBy: 1,
 		decrementBy: 1,
 		validate: (n) => {
-			if (n < opts.min) return fail$1(`${n} must be greater than or equal to ${opts.min}`);
-			if (n > opts.max) return fail$1(`${n} must be less than or equal to ${opts.max}`);
+			if (n < opts.min) return fail$2(`${n} must be greater than or equal to ${opts.min}`);
+			if (n > opts.max) return fail$2(`${n} must be less than or equal to ${opts.max}`);
 			return succeed$1(n);
 		},
 		...options
@@ -4704,7 +4704,7 @@ const makeCommand = (options) => {
 	const annotations = options.annotations ?? empty$2();
 	const globalFlags = options.globalFlags ?? [];
 	const subcommands = options.subcommands ?? [];
-	const handle = (input, commandPath) => isNotUndefined(options.handle) ? options.handle(input, commandPath) : fail$1(new ShowHelp({
+	const handle = (input, commandPath) => isNotUndefined(options.handle) ? options.handle(input, commandPath) : fail$2(new ShowHelp({
 		commandPath,
 		errors: []
 	}));
@@ -4720,7 +4720,7 @@ const makeCommand = (options) => {
 				name: single.name,
 				type: single.typeName ?? getTypeName(single.primitiveType),
 				description: single.description,
-				required: !metadata.isOptional && (!metadata.isVariadic || exists(metadata.variadicMin, (min) => min > 0)),
+				required: !metadata.isOptional && (!metadata.isVariadic || exists$1(metadata.variadicMin, (min) => min > 0)),
 				variadic: metadata.isVariadic
 			});
 		}
@@ -7982,7 +7982,7 @@ const runWith = (command, config) => {
 			onSome: (level) => make$66(MinimumLogLevel, level)
 		});
 		yield* provideContext(program, services);
-	}, catchFilter((error) => isCliError(error) && error._tag === "ShowHelp" ? succeed$2(error) : fail$2(error), (error) => andThen(showHelp(command, error, config.renderErrors !== false), fail$1(error))), catchFilter((error) => config.renderErrors !== false && isCliError(error) && error._tag === "UserError" ? succeed$2(error) : fail$2(error), (error) => andThen(showUserError(error), fail$1(error))), catchFilter((e) => isQuitError(e) ? succeed$2(e) : fail$2(e), (_) => interrupt));
+	}, catchFilter((error) => isCliError(error) && error._tag === "ShowHelp" ? succeed$2(error) : fail$3(error), (error) => andThen(showHelp(command, error, config.renderErrors !== false), fail$2(error))), catchFilter((error) => config.renderErrors !== false && isCliError(error) && error._tag === "UserError" ? succeed$2(error) : fail$3(error), (error) => andThen(showUserError(error), fail$2(error))), catchFilter((e) => isQuitError(e) ? succeed$2(e) : fail$3(e), (_) => interrupt));
 };
 //#endregion
 //#region ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/observability/OtlpLogger.js
@@ -8920,7 +8920,7 @@ const make$59 = fn("cloud.boot_service.make")(function* (input) {
 				cause
 			})), flatMap$1((result) => {
 				const reportedVersion = /\bv(\S+)\s*$/.exec(result.stdout)?.[1];
-				return result.code === 0 && reportedVersion === input.cliVersion ? void_ : fail$1(new PinnedRuntimeInstallError({
+				return result.code === 0 && reportedVersion === input.cliVersion ? void_ : fail$2(new PinnedRuntimeInstallError({
 					step: "verifying the pinned t3 runtime",
 					exitCode: Number(result.code),
 					stdoutLength: result.stdout.length,
@@ -9558,7 +9558,7 @@ const readBootstrapEnvelope = fn("readBootstrapEnvelope")(function* (schema, fd,
 				resume(succeedNone);
 				return;
 			}
-			resume(fail$1(new BootstrapEnvelopeReadError({
+			resume(fail$2(new BootstrapEnvelopeReadError({
 				fd,
 				cause: error
 			})));
@@ -9566,7 +9566,7 @@ const readBootstrapEnvelope = fn("readBootstrapEnvelope")(function* (schema, fd,
 		const handleLine = (line) => {
 			const parsed = decodeJsonResult(schema)(line);
 			if (isSuccess$1(parsed)) resume(succeedSome(parsed.success));
-			else resume(fail$1(new BootstrapEnvelopeDecodeError({
+			else resume(fail$2(new BootstrapEnvelopeDecodeError({
 				fd,
 				cause: parsed.failure
 			})));
@@ -9587,7 +9587,7 @@ const isFdReady = (fd) => try_({
 		fd,
 		cause: error
 	})
-}).pipe(as(true), catchTags({ BootstrapFdStatError: (error) => isUnavailableBootstrapFdError(error.cause) ? succeed$1(false) : fail$1(error) }));
+}).pipe(as(true), catchTags({ BootstrapFdStatError: (error) => isUnavailableBootstrapFdError(error.cause) ? succeed$1(false) : fail$2(error) }));
 const makeBootstrapInputStream = (fd) => gen$1(function* () {
 	const platform = yield* Platform;
 	const fdPath = resolveFdPath(fd, platform);
@@ -14278,7 +14278,7 @@ const make$52 = ({ dumpSchema = () => void_ }) => ({ loader, schemaDirectory, ta
   migration_id integer primary key,
   created_at timestamp with time zone not null default now(),
   name text not null
-)`).pipe(catch_((error) => flatMap$1(migrationsTableExists(sql, table), (exists) => exists ? void_ : fail$1(error))))),
+)`).pipe(catch_((error) => flatMap$1(migrationsTableExists(sql, table), (exists) => exists ? void_ : fail$2(error))))),
 		orElse: () => sql`CREATE TABLE IF NOT EXISTS ${sql(table)} (
   migration_id integer PRIMARY KEY NOT NULL,
   created_at datetime NOT NULL DEFAULT current_timestamp,
@@ -14294,10 +14294,10 @@ const make$52 = ({ dumpSchema = () => void_ }) => ({ loader, schemaDirectory, ta
 		name,
 		createdAt: created_at
 	})));
-	const loadMigration = ([id, name, load]) => catchDefect(load, (_) => fail$1(new MigrationError({
+	const loadMigration = ([id, name, load]) => catchDefect(load, (_) => fail$2(new MigrationError({
 		kind: "ImportError",
 		message: `Could not import migration "${id}_${name}"\n\n${_}`
-	}))).pipe(flatMap$1((_) => isEffect$1(_) ? succeed$1(_) : _.default ? succeed$1(_.default?.default ?? _.default) : fail$1(new MigrationError({
+	}))).pipe(flatMap$1((_) => isEffect$1(_) ? succeed$1(_) : _.default ? succeed$1(_.default?.default ?? _.default) : fail$2(new MigrationError({
 		kind: "ImportError",
 		message: `Default export not found for migration "${id}_${name}"`
 	}))), filterOrFail((_) => isEffect$1(_), () => new MigrationError({
@@ -14344,7 +14344,7 @@ const make$52 = ({ dumpSchema = () => void_ }) => ({ loader, schemaDirectory, ta
 		return required.map(([id, name]) => [id, name]);
 	});
 	yield* ensureMigrationsTable;
-	const completed = yield* pipe(sql.withTransaction(run), catchTag("MigrationError", (_) => _.kind === "Locked" ? as(logDebug(_.message), []) : fail$1(_)));
+	const completed = yield* pipe(sql.withTransaction(run), catchTag("MigrationError", (_) => _.kind === "Locked" ? as(logDebug(_.message), []) : fail$2(_)));
 	if (schemaDirectory && completed.length > 0) yield* dumpSchema(`${schemaDirectory}/_schema.sql`, table).pipe(catchCause((cause) => logInfo("Could not dump schema", cause)));
 	return completed;
 });
@@ -17555,7 +17555,7 @@ const initializeV2Database = fn("initializeV2Database")(function* (destinationPa
 				database.close();
 			}
 		});
-		yield* fs.link(snapshotPath, destinationPath).pipe(catch_((error) => error.reason._tag === "AlreadyExists" ? void_ : fail$1(error)));
+		yield* fs.link(snapshotPath, destinationPath).pipe(catch_((error) => error.reason._tag === "AlreadyExists" ? void_ : fail$2(error)));
 	}).pipe(scoped, mapError((cause) => new V2DatabaseImportError({
 		sourcePath,
 		destinationPath,
@@ -17809,7 +17809,7 @@ function toBootstrapExchangeError(cause) {
 	if (isBootstrapCredentialInternalError(cause)) return new ServerAuthBootstrapCredentialValidationError({ cause });
 	return new ServerAuthInvalidCredentialError({ cause });
 }
-const rejectMcpClientAudience = (session) => session.subject === MCP_CLIENT_SUBJECT ? fail$1(new ServerAuthInvalidCredentialError({ diagnostic: "MCP client sessions are only accepted by the MCP endpoint." })).pipe(tap(() => logWarning("Rejected an MCP client session outside /mcp."))) : succeed$1(session);
+const rejectMcpClientAudience = (session) => session.subject === MCP_CLIENT_SUBJECT ? fail$2(new ServerAuthInvalidCredentialError({ diagnostic: "MCP client sessions are only accepted by the MCP endpoint." })).pipe(tap(() => logWarning("Rejected an MCP client session outside /mcp."))) : succeed$1(session);
 const mapSessionVerificationErrors = (effect) => effect.pipe(mapError((cause) => isSessionCredentialInvalidError(cause) ? new ServerAuthInvalidCredentialError({ cause }) : new ServerAuthSessionCredentialValidationError({ cause })));
 function parseBearerToken(request) {
 	const header = request.headers["authorization"];
@@ -17907,11 +17907,11 @@ const make$51 = gen$1(function* () {
 	const authenticateRequest = (request) => {
 		const dpopToken = parseDpopToken(request);
 		const credential = resolveRequestCredential(request);
-		if (!credential?.token) return fail$1(new ServerAuthMissingCredentialError({}));
-		if (isBrowserCookieCredential(credential.source) && !isBrowserOriginAllowed(request, trustedBrowserOrigins)) return fail$1(new ServerAuthInvalidCredentialError({ diagnostic: "Browser sessions are only accepted from the app's own origin." }));
+		if (!credential?.token) return fail$2(new ServerAuthMissingCredentialError({}));
+		if (isBrowserCookieCredential(credential.source) && !isBrowserOriginAllowed(request, trustedBrowserOrigins)) return fail$2(new ServerAuthInvalidCredentialError({ diagnostic: "Browser sessions are only accepted from the app's own origin." }));
 		return authenticateToken(credential.token).pipe(flatMap$1((session) => {
 			if (session.proofKeyThumbprint) {
-				if (!dpopToken || dpopToken !== credential.token) return fail$1(new ServerAuthInvalidCredentialError({
+				if (!dpopToken || dpopToken !== credential.token) return fail$2(new ServerAuthInvalidCredentialError({
 					diagnostic: "DPoP-bound access token requires DPoP authorization.",
 					dpopFailureReason: "invalid_proof"
 				}));
@@ -17921,7 +17921,7 @@ const make$51 = gen$1(function* () {
 					expectedAccessToken: dpopToken
 				}).pipe(provideService(ServerSecretStore, secretStore), provideService(Crypto, crypto), as(session));
 			}
-			if (dpopToken) return fail$1(new ServerAuthInvalidCredentialError({
+			if (dpopToken) return fail$2(new ServerAuthInvalidCredentialError({
 				diagnostic: "DPoP authorization requires a proof-bound access token.",
 				dpopFailureReason: "invalid_proof"
 			}));
@@ -18086,7 +18086,7 @@ const make$51 = gen$1(function* () {
 			credential: devAuth.credential,
 			label: "Reusable dev token",
 			expiresAt: toUtc(session.expiresAt ?? REUSABLE_DEV_SESSION_EXPIRES_AT)
-		})), catch_((cause) => isSessionCredentialInvalidError(cause) ? fallback : fail$1(new ServerAuthPairingLinkCreationError({ cause }))), withSpan("EnvironmentAuth.issueStartupPairingCredential"));
+		})), catch_((cause) => isSessionCredentialInvalidError(cause) ? fallback : fail$2(new ServerAuthPairingLinkCreationError({ cause }))), withSpan("EnvironmentAuth.issueStartupPairingCredential"));
 	};
 	const listClientSessions = (currentSessionId) => listSessions().pipe(map$3((clientSessions) => clientSessions.map((clientSession) => ({
 		...clientSession,
@@ -18126,12 +18126,12 @@ const make$51 = gen$1(function* () {
 	});
 	const authenticateMcpClient = (request) => {
 		const token = parseBearerToken(request);
-		if (token === null) return fail$1(new ServerAuthMissingCredentialError({}));
+		if (token === null) return fail$2(new ServerAuthMissingCredentialError({}));
 		return sessions.verify(token).pipe(mapSessionVerificationErrors, flatMap$1((session) => session.subject === MCP_CLIENT_SUBJECT && session.method === "bearer-access-token" ? succeed$1({
 			sessionId: session.sessionId,
 			label: session.client.label ?? "MCP client",
 			access: session.scopes.includes("orchestration:operate") ? session.runtimeModeCeiling ?? "approval-required" : "read-only"
-		}) : fail$1(new ServerAuthInvalidCredentialError({ diagnostic: "Only MCP client sessions are accepted here." }))), withSpan("EnvironmentAuth.authenticateMcpClient"));
+		}) : fail$2(new ServerAuthInvalidCredentialError({ diagnostic: "Only MCP client sessions are accepted here." }))), withSpan("EnvironmentAuth.authenticateMcpClient"));
 	};
 	const issueMcpClientSession = (input) => sessions.issue({
 		subject: MCP_CLIENT_SUBJECT,
@@ -18150,13 +18150,13 @@ const make$51 = gen$1(function* () {
 	})), mapError((cause) => new ServerAuthSessionTokenIssueError({ cause })), withSpan("EnvironmentAuth.issueMcpClientSession"));
 	const authenticateBrowserSession = (request) => {
 		const credential = resolveRequestCredential(request);
-		if (!credential || !isBrowserCookieCredential(credential.source)) return fail$1(new ServerAuthMissingCredentialError({}));
+		if (!credential || !isBrowserCookieCredential(credential.source)) return fail$2(new ServerAuthMissingCredentialError({}));
 		return authenticateRequest(request).pipe(filterOrFail((session) => session.method === "browser-session-cookie", () => new ServerAuthInvalidCredentialError({ diagnostic: "Not a browser session." })), withSpan("EnvironmentAuth.authenticateBrowserSession"));
 	};
 	const consumeMcpApprovalCode = (code, access) => resolveBootstrapGrant(code.trim()).pipe(catchTags({
-		ServerAuthInvalidCredentialError: () => fail$1(new ServerAuthMcpApprovalCodeError({ reason: "unknown_or_used" })),
-		ServerAuthScopeNotGrantedError: () => fail$1(new ServerAuthMcpApprovalCodeError({ reason: "insufficient_scope" }))
-	}), flatMap$1((grant) => grant.method !== "one-time-token" && grant.method !== "reusable-dev-token" ? fail$1(new ServerAuthMcpApprovalCodeError({ reason: "not_a_pairing_code" })) : mcpClientScopes(access).every((scope) => grant.scopes.includes(scope)) ? void_ : fail$1(new ServerAuthMcpApprovalCodeError({ reason: "insufficient_scope" }))), withSpan("EnvironmentAuth.consumeMcpApprovalCode"));
+		ServerAuthInvalidCredentialError: () => fail$2(new ServerAuthMcpApprovalCodeError({ reason: "unknown_or_used" })),
+		ServerAuthScopeNotGrantedError: () => fail$2(new ServerAuthMcpApprovalCodeError({ reason: "insufficient_scope" }))
+	}), flatMap$1((grant) => grant.method !== "one-time-token" && grant.method !== "reusable-dev-token" ? fail$2(new ServerAuthMcpApprovalCodeError({ reason: "not_a_pairing_code" })) : mcpClientScopes(access).every((scope) => grant.scopes.includes(scope)) ? void_ : fail$2(new ServerAuthMcpApprovalCodeError({ reason: "insufficient_scope" }))), withSpan("EnvironmentAuth.consumeMcpApprovalCode"));
 	return EnvironmentAuth.of({
 		getDescriptor: () => succeed$1(descriptor).pipe(withSpan("EnvironmentAuth.getDescriptor")),
 		getSessionState,
@@ -18335,7 +18335,7 @@ const isProcessAlive = (pid) => {
 };
 const readPersistedServerRuntimeState = (path) => gen$1(function* () {
 	const raw = yield* (yield* FileSystem).readFileString(path).pipe(matchEffect({
-		onFailure: (cause) => cause.reason._tag === "NotFound" ? succeed$1(none$1()) : fail$1(new ServerRuntimeStateError({
+		onFailure: (cause) => cause.reason._tag === "NotFound" ? succeed$1(none$1()) : fail$2(new ServerRuntimeStateError({
 			operation: "read",
 			statePath: path,
 			cause
@@ -18397,7 +18397,7 @@ const EnvServerConfig = all$1({
 	tailscaleServeEnabled: Boolean$5("T3CODE_TAILSCALE_SERVE").pipe(option$1, map$6(getOrUndefined)),
 	tailscaleServePort: Port("T3CODE_TAILSCALE_SERVE_PORT").pipe(option$1, map$6(getOrUndefined))
 });
-const DevAuthTokenConfig = Redacted("T3CODE_DEV_AUTH_TOKEN").pipe(map$6((token) => make$64(value(token).trim())), mapEffect$1((token) => value(token).length === 0 || value(token).length >= 32 ? succeed$1(token) : fail$1(new ConfigError(new SchemaError(new InvalidValue$1({ message: "T3CODE_DEV_AUTH_TOKEN must contain at least 32 characters." }))))), option$1, map$6(filter((token) => value(token).length > 0)), map$6(getOrUndefined));
+const DevAuthTokenConfig = Redacted("T3CODE_DEV_AUTH_TOKEN").pipe(map$6((token) => make$64(value(token).trim())), mapEffect$1((token) => value(token).length === 0 || value(token).length >= 32 ? succeed$1(token) : fail$2(new ConfigError(new SchemaError(new InvalidValue$1({ message: "T3CODE_DEV_AUTH_TOKEN must contain at least 32 characters." }))))), option$1, map$6(filter((token) => value(token).length > 0)), map$6(getOrUndefined));
 const authLocationFlags = {
 	baseDir: baseDirFlag,
 	devUrl: devUrlFlag
@@ -18594,7 +18594,7 @@ const DurationFromString = String$6.pipe(decodeTo(Duration, transformEffect({
 	decode: (value) => {
 		const duration = parseDurationInput(value);
 		if (duration !== null) return succeed$1(duration);
-		return fail$1(new InvalidValue$1({ message: "Invalid duration. Use values like 5m, 1h, 30d, or 15 minutes." }));
+		return fail$2(new InvalidValue$1({ message: "Invalid duration. Use values like 5m, 1h, 30d, or 15 minutes." }));
 	},
 	encode: (duration) => succeed$1(format$1(duration))
 })));
@@ -19647,7 +19647,7 @@ const makeCloudflaredRelayClient = fn("cloudflared.make")(function* (options) {
 		const lockPath = `${managedPath}.lock`;
 		yield* fileSystem.makeDirectory(managedDirectory, { recursive: true }).pipe(wrapInstallFailure("write_failed", "Could not create the relay client tool directory."));
 		yield* report("waiting_for_lock");
-		yield* acquireInstallLock(lockPath).pipe(catchTags({ PlatformError: (cause) => fail$1(new RelayClientInstallError({
+		yield* acquireInstallLock(lockPath).pipe(catchTags({ PlatformError: (cause) => fail$2(new RelayClientInstallError({
 			reason: "write_failed",
 			message: "Could not acquire the relay client installation lock.",
 			cause
@@ -19687,7 +19687,7 @@ const makeCloudflaredRelayClient = fn("cloudflared.make")(function* (options) {
 				source: "managed",
 				version: CLOUDFLARED_VERSION
 			};
-		}).pipe(scoped, catchIf((cause) => !(cause instanceof RelayClientInstallError), (cause) => fail$1(new RelayClientInstallError({
+		}).pipe(scoped, catchIf((cause) => !(cause instanceof RelayClientInstallError), (cause) => fail$2(new RelayClientInstallError({
 			reason: "write_failed",
 			message: "Could not install the relay client.",
 			cause
@@ -23951,7 +23951,7 @@ const make$47 = /*#__PURE__*/ fnUntraced$1(function* (evaluate, options) {
 	yield* addFinalizer(scope$2, shutdown);
 	yield* callback((resume) => {
 		function onError(cause) {
-			resume(fail$1(new ServeError({ cause })));
+			resume(fail$2(new ServeError({ cause })));
 		}
 		server.on("error", onError);
 		server.listen(options, () => {
@@ -24040,7 +24040,7 @@ const makeUpgradeHandler = (lazyWss, httpEffect, options) => {
 				return nodeResponse_;
 			};
 			const request = new ServerRequestImpl(nodeRequest, nodeResponse, fromWebSocket(flatMap$1(lazyWss, (wss) => acquireRelease(callback((resume) => {
-				const onClose = () => resume(fail$1(new SocketError({ reason: new SocketOpenError({
+				const onClose = () => resume(fail$2(new SocketError({ reason: new SocketOpenError({
 					kind: "Unknown",
 					cause: /* @__PURE__ */ new Error("The socket closed before the upgrade")
 				}) })));
@@ -24111,7 +24111,7 @@ var ServerRequestImpl = class ServerRequestImpl extends NodeHttpIncomingMessage
 		return stream(this.source, this.source.headers);
 	}
 	get upgrade() {
-		return this.upgradeEffect ?? fail$1(new HttpServerError({ reason: new RequestParseError({
+		return this.upgradeEffect ?? fail$2(new HttpServerError({ reason: new RequestParseError({
 			request: this,
 			description: "not an upgradeable ServerRequest"
 		}) }));
@@ -24221,7 +24221,7 @@ const handleResponse = (request, response) => {
 			});
 			return callback((resume, signal) => {
 				Readable.fromWeb(r.body, { signal }).pipe(nodeResponse).on("error", (cause) => {
-					resume(fail$1(new HttpServerError({ reason: new ResponseError({
+					resume(fail$2(new HttpServerError({ reason: new ResponseError({
 						request,
 						response,
 						description: "Error writing FormData response",
@@ -24609,7 +24609,7 @@ function buildBrowserLaunch(target, platform, env = {}) {
 }
 const buildAvailableEditors = fn("externalLauncher.buildAvailableEditors")(function* (platform, env) {
 	const available = [];
-	for (const editor of EDITORS) {
+	for (const editor of EDITORS$1) {
 		if (editor.commands === null) {
 			if ((yield* resolveUsableFileManagerCommand(platform, env)) !== void 0) available.push(editor.id);
 			continue;
@@ -24651,7 +24651,7 @@ const resolveEditorLaunch = fn("resolveEditorLaunch")(function* (input) {
 		"externalLauncher.cwd": input.cwd,
 		"externalLauncher.platform": platform
 	});
-	const editorDef = EDITORS.find((editor) => editor.id === input.editor);
+	const editorDef = EDITORS$1.find((editor) => editor.id === input.editor);
 	if (!editorDef) return yield* new ExternalLauncherUnknownEditorError({ editor: input.editor });
 	if (editorDef.commands) {
 		const { command, baseArgs } = getOrElse(yield* resolveEditorCommand(editorDef, env), () => ({
@@ -24906,7 +24906,7 @@ const CLOUD_CLI_OAUTH_LOOPBACK_PORT = 34338;
 const CLOUD_CLI_OAUTH_SCOPES = CONNECT_OAUTH_SCOPES;
 function validateRelayUrl(value) {
 	const relayUrl = normalizeSecureRelayUrl(value);
-	return relayUrl === null ? fail$1(new ConfigError(new SchemaError(new InvalidValue$1({ message: "Relay URL must be a secure absolute HTTPS origin." })))) : succeed$1(relayUrl);
+	return relayUrl === null ? fail$2(new ConfigError(new SchemaError(new InvalidValue$1({ message: "Relay URL must be a secure absolute HTTPS origin." })))) : succeed$1(relayUrl);
 }
 function readBuildTimeValue(value) {
 	return typeof value === "undefined" ? "" : value.trim();
@@ -24951,7 +24951,7 @@ function validateHostedAppUrl(value) {
 		if (url.protocol !== "https:" && !isLoopbackHttp || url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error("invalid hosted app origin");
 		return succeed$1(url.origin);
 	} catch {
-		return fail$1(new ConfigError(new SchemaError(new InvalidValue$1({ message: "Hosted app URL must be an absolute HTTPS origin (or HTTP loopback origin)." }))));
+		return fail$2(new ConfigError(new SchemaError(new InvalidValue$1({ message: "Hosted app URL must be an absolute HTTPS origin (or HTTP loopback origin)." }))));
 	}
 }
 function makePublicValueConfig(name, fallback) {
@@ -25333,7 +25333,7 @@ const deviceAuthorizationLogin = fn("cloud.cli_token.device_authorization_login"
 		userCode: authorization.user_code,
 		expiresIn
 	});
-	return yield* pollDeviceToken(metadata, authorization.device_code, interval).pipe(timeout(expiresIn), catchTags({ TimeoutError: (cause) => fail$1(new CloudCliAuthorizationTimeoutError({ cause })) }));
+	return yield* pollDeviceToken(metadata, authorization.device_code, interval).pipe(timeout(expiresIn), catchTags({ TimeoutError: (cause) => fail$2(new CloudCliAuthorizationTimeoutError({ cause })) }));
 });
 /** @public Service construction is part of the canonical Effect module API. */
 const make$45 = gen$1(function* () {
@@ -25397,7 +25397,7 @@ const make$45 = gen$1(function* () {
 		yield* log(formatLoopbackAuthorizationPrompt(authorizationUrl));
 		const authorization = yield* waitForLoopbackAuthorization({
 			authorizationUrl,
-			callback: _await(callback).pipe(timeout(CLOUD_CLI_OAUTH_CALLBACK_TIMEOUT), catchTags({ TimeoutError: (cause) => fail$1(new CloudCliAuthorizationTimeoutError({ cause })) })),
+			callback: _await(callback).pipe(timeout(CLOUD_CLI_OAUTH_CALLBACK_TIMEOUT), catchTags({ TimeoutError: (cause) => fail$2(new CloudCliAuthorizationTimeoutError({ cause })) })),
 			terminal,
 			launchBrowser: externalLauncher.launchBrowser
 		});
@@ -25971,7 +25971,7 @@ const readTailscaleOutput = (subcommand, args) => gen$1(function* () {
 		const child = yield* spawner.spawn(make$72(executable, [...args])).pipe(mapError((cause) => new TailscaleCommandSpawnError({
 			...commandContext,
 			cause
-		})), catchDefect((cause) => fail$1(new TailscaleCommandSpawnError({
+		})), catchDefect((cause) => fail$2(new TailscaleCommandSpawnError({
 			...commandContext,
 			cause
 		}))));
@@ -25991,7 +25991,7 @@ const readTailscaleOutput = (subcommand, args) => gen$1(function* () {
 			...stderrDiagnosticOf(stderr) !== void 0 ? { stderrDiagnostic: stderrDiagnosticOf(stderr) } : {}
 		});
 		return stdout;
-	}).pipe(scoped, timeout(TAILSCALE_STATUS_TIMEOUT), catchTags({ TimeoutError: (cause) => fail$1(new TailscaleCommandTimeoutError({
+	}).pipe(scoped, timeout(TAILSCALE_STATUS_TIMEOUT), catchTags({ TimeoutError: (cause) => fail$2(new TailscaleCommandTimeoutError({
 		...commandContext,
 		timeoutMs: toMillis(TAILSCALE_STATUS_TIMEOUT),
 		cause
@@ -26030,7 +26030,7 @@ const runTailscaleCommand = (args, timeoutInput) => gen$1(function* () {
 		const child = yield* spawner.spawn(make$72(executable, args)).pipe(mapError((cause) => new TailscaleCommandSpawnError({
 			...commandContext,
 			cause
-		})), catchDefect((cause) => fail$1(new TailscaleCommandSpawnError({
+		})), catchDefect((cause) => fail$2(new TailscaleCommandSpawnError({
 			...commandContext,
 			cause
 		}))));
@@ -26044,7 +26044,7 @@ const runTailscaleCommand = (args, timeoutInput) => gen$1(function* () {
 			stderrLength: stderr.length,
 			...stderrDiagnosticOf(stderr) !== void 0 ? { stderrDiagnostic: stderrDiagnosticOf(stderr) } : {}
 		});
-	}).pipe(scoped, timeout(timeout$1), catchTags({ TimeoutError: (cause) => fail$1(new TailscaleCommandTimeoutError({
+	}).pipe(scoped, timeout(timeout$1), catchTags({ TimeoutError: (cause) => fail$2(new TailscaleCommandTimeoutError({
 		...commandContext,
 		timeoutMs: toMillis(timeout$1),
 		cause
@@ -26605,7 +26605,7 @@ function decodePayload$1(payloadBy, httpRequest, query) {
 			try {
 				return decode(JSON.parse(text));
 			} catch {
-				return fail$1(new SchemaError(new InvalidValue$1({ message: "Expected a valid JSON body" })));
+				return fail$2(new SchemaError(new InvalidValue$1({ message: "Expected a valid JSON body" })));
 			}
 		});
 		case "Text": return flatMap$1(orDie(httpRequest.text), decode);
@@ -26700,7 +26700,7 @@ const makeSecurityMiddleware = (key, service) => {
 				group: options.group
 			})));
 			if (isFailure$1(result$2)) {
-				if (isHandlerError(result$2.failure)) return yield* fail$1(result$2.failure.error);
+				if (isHandlerError(result$2.failure)) return yield* fail$2(result$2.failure.error);
 				lastResult = result$2;
 				continue;
 			}
@@ -26855,7 +26855,7 @@ function getResponseTransformation(getStatus, schema) {
 	const bodySchema = isWithHeaders(schema) ? schema.schema : schema;
 	const encode = getResponseEncode(getStatus(schema), getResponseEncodingSchema(schema), isNoContent(bodySchema.ast));
 	return transformEffect({
-		decode: (input, options) => fail$1(new Forbidden$1({ message: "Encode only schema" }, input, options)),
+		decode: (input, options) => fail$2(new Forbidden$1({ message: "Encode only schema" }, input, options)),
 		encode
 	});
 }
@@ -26865,7 +26865,7 @@ function toWithHeadersResponseSchema(options) {
 	const encodeResponse = getResponseEncode(options.status, options.encoding, isNoContent(options.body.ast));
 	const toIssue = (error) => error.issue;
 	const transformation = transformEffect({
-		decode: (input, options) => fail$1(new Forbidden$1({ message: "Encode only schema" }, input, options)),
+		decode: (input, options) => fail$2(new Forbidden$1({ message: "Encode only schema" }, input, options)),
 		encode: (value, parseOptions) => {
 			const pair = options.toPair(value);
 			return encodeBody(pair.body, parseOptions).pipe(mapError(toIssue), flatMap$1((body) => encodeResponse(body, parseOptions)), flatMap$1((response) => map$3(mapError(encodeHeaders(pair.headers), toIssue), (headers) => setHeaders(response, headers))));
@@ -26884,7 +26884,7 @@ function getResponseEncode(status, encoding, isNoContent) {
 					contentType: encoding.contentType
 				}));
 			} catch {
-				return fail$1(new InvalidValue$1({ expected: "a JSON-serializable response body" }, e, options));
+				return fail$2(new InvalidValue$1({ expected: "a JSON-serializable response body" }, e, options));
 			}
 		};
 		case "Text": return (e) => succeed$1(text$1(e, {
@@ -27024,8 +27024,8 @@ const layer$76 = effect(ProjectService, gen$1(function* () {
 			project: toProject(project),
 			created
 		}))),
-		update: () => fail$1(unsupported("dispatch-project-command")),
-		delete: () => fail$1(unsupported("dispatch-project-command")),
+		update: () => fail$2(unsupported("dispatch-project-command")),
+		delete: () => fail$2(unsupported("dispatch-project-command")),
 		getById,
 		getByWorkspaceRoot,
 		snapshot: all.pipe(map$3((projects) => ({
@@ -27038,7 +27038,7 @@ const layer$76 = effect(ProjectService, gen$1(function* () {
 }));
 //#endregion
 //#region src/peerHub/headless/HeadlessProjections.ts
-const missing = (threadId) => fail$1(new ProjectionStoreThreadNotFoundError({ threadId }));
+const missing = (threadId) => fail$2(new ProjectionStoreThreadNotFoundError({ threadId }));
 const emptyShell = {
 	schemaVersion: 2,
 	snapshotSequence: 0,
@@ -27047,7 +27047,7 @@ const emptyShell = {
 };
 /** `ProjectionStoreV2` with no threads in it. */
 const layer$75 = succeed$3(ProjectionStoreV2, ProjectionStoreV2.of({
-	searchThreadStream: (input) => fail$5(new ProjectionStoreThreadNotFoundError({ threadId: input.threadId })),
+	searchThreadStream: (input) => fail$6(new ProjectionStoreThreadNotFoundError({ threadId: input.threadId })),
 	searchThread: (input) => missing(input.threadId),
 	getThreadAttachmentIds: () => succeed$1([]),
 	getThreadHistoryPage: (threadId) => missing(threadId),
@@ -27135,7 +27135,7 @@ const settingsFrom = (text) => {
 const layer$73 = effect(ServerSettingsService, gen$1(function* () {
 	const { settingsPath } = yield* ServerConfig;
 	const getSettings = promise(() => NodeFSP.readFile(settingsPath, "utf8").then((text) => settingsFrom(text), () => settingsFrom(null)));
-	const refuse = fail$1(new ServerSettingsError({
+	const refuse = fail$2(new ServerSettingsError({
 		settingsPath,
 		operation: "write-file",
 		cause: /* @__PURE__ */ new Error("Peer Core does not change settings; change them in the Peer app.")
@@ -27198,9 +27198,548 @@ const servicesLayer = (config) => {
 const layer$72 = (config) => layer$105.pipe(provideMerge(servicesLayer(config)));
 /** Core for one command that exits: nothing starts in the background. */
 const oneShotLayer = (config) => coreLayer.pipe(provideMerge(servicesLayer(config)));
-/** Peer's persisted state alone, read once (never written): what `status` reads. */
+/** Peer's persisted state alone, read once: what `status` and `bind` use; writes only a binding (`placeOf`, `bind`) while no broker runs. */
 const stateLayer = (config) => layer$106.pipe(provideMerge(servicesLayer(config)));
 //#endregion
+//#region src/cli/peerCoreIo.ts
+const fail$1 = (text) => new UserError({
+	cause: text,
+	userMessage: text
+});
+const sentence$1 = (reason) => /[.!?]$/.test(reason) ? reason : `${reason}.`;
+/**
+* A one-shot command's end as the peer-cli-contract words it (`peer core: refused: … / Next: …`),
+* exiting with the contract's status: 2 usage, 3 refused, 4 uncertain.
+*/
+const outcome = (kind, reason, next) => {
+	const text = `peer core: ${kind}: ${sentence$1(reason)}\nNext: ${next}`;
+	return Object.assign(new UserError({
+		cause: text,
+		userMessage: text
+	}), { [errorExitCode]: EXIT_STATUS[kind] });
+};
+const SIGN_IN = "sign in with peer core login <email>, or join with your invitation link, then repeat the command.";
+/**
+* A Hub failure of `command`: refused when the Hub said so (or for a read, which changed nothing),
+* else uncertain, since a write may have reached the Hub.
+*/
+const hubOutcome = (error, command, next, read) => {
+	if (error.kind === "signedOut" || error.detail === "Sign in first.") return outcome("refused", error.detail, SIGN_IN);
+	if (read || error.refused === true) return outcome("refused", error.detail, next);
+	return outcome("uncertain", `the Hub gave no usable answer (${error.detail.replace(/\.$/, "")}), so peer core ${command} may or may not have taken effect`, next);
+};
+//#endregion
+//#region src/cli/peerCoreBind.ts
+/**
+* `peer core bind [folder] --project <workspace/project> [--repository <id>]`: a clone on this
+* computer becomes the checkout of a project's repository, as binding by remote does on its own
+* when only one project's repository is the clone's `origin`.
+*
+* @module cli/peerCoreBind
+*/
+/** The working tree around `folder`: Git's top level, or the Jujutsu workspace's root. */
+const repositoryRoot = (folder) => promise(async () => {
+	const toplevel = await run$4("git", [
+		"-C",
+		folder,
+		"rev-parse",
+		"--show-toplevel"
+	]).catch(() => null);
+	if (toplevel !== null && toplevel !== "") return {
+		root: realpathOrSelf$2(toplevel),
+		remoteRoot: toplevel
+	};
+	const found = await checkoutKind(folder);
+	return found?.kind === "jj" ? {
+		root: realpathOrSelf$2(found.root),
+		remoteRoot: found.mainRoot
+	} : null;
+});
+const bind = (input, io) => gen$1(function* () {
+	const state = yield* PeerState;
+	const [workspace, projectId, ...rest] = input.project.trim().split("/");
+	if (workspace === void 0 || projectId === void 0 || rest.length > 0 || projectId === "") return yield* fail$1(`peer core: --project takes <workspace>/<project>, as peer core status names it; not ${input.project}.`);
+	const { project } = yield* state.project(workspace, projectId).pipe(mapError((error) => fail$1(`peer core: ${error.detail}`)));
+	const checkout = yield* repositoryRoot(input.folder);
+	if (checkout === null) return yield* fail$1(`peer core: ${input.folder} is not a Git or Jujutsu repository.`);
+	let repositoryId = input.repository?.trim();
+	if (repositoryId !== void 0) {
+		if (!project.repositories.some((repository) => repository.id === repositoryId)) return yield* fail$1(`peer core: ${workspace}/${projectId} has no repository ${repositoryId}: ${project.repositories.map((r) => r.id).join(", ")}.`);
+	} else {
+		const remote = yield* promise(() => remoteOf(checkout.remoteRoot));
+		const matches = remote === null ? [] : matchRepositories(remote, [{
+			workspace: { slug: workspace },
+			projects: [project]
+		}]);
+		if (matches.length !== 1) return yield* fail$1(`peer core: ${remote === null ? `${checkout.root} has no origin` : `${checkout.root}'s origin ${withoutCredentials(remote)} is ${matches.length === 0 ? "none" : "several"} of ${workspace}/${projectId}'s repositories`} (${project.repositories.map((r) => `${r.id} ${withoutCredentials(r.url)}`).join(", ")}); name one with --repository <id>.`);
+		repositoryId = matches[0].repository;
+	}
+	yield* state.recordCheckout({
+		workspace,
+		projectId,
+		repositoryId
+	}, checkout.root).pipe(mapError((error) => fail$1(`peer core: ${error.detail}`)));
+	yield* io.say(`Bound ${checkout.root} to ${workspace}/${projectId}${project.repositories.length > 1 ? ` (repository ${repositoryId})` : ""}.`);
+});
+/**
+* `peer core status`'s folders: each folder `peer core share` recorded (shared, or not), then each
+* checkout `peer-hub.json` holds that is not one of them (bound by `bind` or by its remote). It
+* binds nothing: a broker may keep `peer-hub.json` in memory.
+*/
+const sayCheckouts = (sharedFolders, io) => gen$1(function* () {
+	const state = yield* PeerState;
+	const { persisted } = yield* state.read;
+	const listed = /* @__PURE__ */ new Set();
+	for (const folder of sharedFolders) {
+		const place = yield* state.placeOf(folder, { bindByRemote: false });
+		listed.add(realpathOrSelf$2(folder));
+		yield* io.say(place === null || place.workspace === "@local" ? `Folder: ${folder} (not shared)` : `Folder: ${folder} (shared: ${place.workspace}/${place.project})`);
+	}
+	for (const [key, root] of Object.entries(persisted.localCheckouts ?? {})) {
+		if (listed.has(realpathOrSelf$2(root))) continue;
+		const [workspace, project, repository] = key.split("/");
+		const repositories = persisted.workspaces.find((w) => w.slug === workspace)?.manifest?.projects.find((p) => p.id === project)?.repositories.length ?? 1;
+		yield* io.say(`Folder: ${root} (bound: ${workspace}/${project}${repositories > 1 ? `, repository ${repository}` : ""})`);
+	}
+});
+//#endregion
+//#region src/cli/peerCoreEditor.ts
+/**
+* Connecting an editor from Peer Core without the app: Peer's hooks for Claude Code and Codex
+* (`peer core hooks install`), the MCP entry for the others (`peer core connect <client>`). `join
+* --editor` runs the same code as those commands, in-process.
+*
+* @module cli/peerCoreEditor
+*/
+/** What `--editor` takes: the two with hooks, then every MCP client. */
+const EDITORS = [
+	"claude",
+	"codex",
+	...MCP_CLIENTS.map((client) => client.id)
+];
+const editorTitle = (id) => id === "claude" ? "Claude Code" : id === "codex" ? "Codex" : mcpClient(id)?.title ?? id;
+const claudeSettingsPath = () => NodePath.join(process.env.CLAUDE_CONFIG_DIR?.trim() || NodePath.join(NodeOS.homedir(), ".claude"), "settings.json");
+const exists = (path) => NodeFSP.stat(path).then(() => true, () => false);
+/** The editors whose folders are in this person's home, in `EDITORS` order. */
+const detectedEditors = gen$1(function* () {
+	const home = yield* HomeDirectory;
+	const platform = yield* Platform;
+	const env = yield* Environment;
+	return yield* promise(async () => {
+		const hooks = [{
+			id: "claude",
+			path: env.CLAUDE_CONFIG_DIR?.trim() || NodePath.join(home, ".claude")
+		}, {
+			id: "codex",
+			path: env.CODEX_HOME?.trim() || NodePath.join(home, ".codex")
+		}];
+		const found = await Promise.all(hooks.map((editor) => exists(editor.path)));
+		const clients = await listClients(userBases(home, platform, env)).catch(() => []);
+		return [...hooks.filter((_, index) => found[index]).map((editor) => editor.id), ...clients.filter((client) => client.installed).map((client) => client.id)];
+	});
+});
+/**
+* What `hooks install` and `hooks remove` say of the status they left: Claude Code's hooks, and
+* with `codex` each Codex home's, with the commands awaiting the person's approval.
+*/
+const sayHooks = (status, options, io) => gen$1(function* () {
+	const coordination = status.coordination;
+	if (options.claude) yield* io.say(`Claude Code: ${coordination.claudeHooks ? "hooks installed" : coordination.claudeHooksPresent ? "hooks partly present" : "no Peer hooks"} in ${claudeSettingsPath()} (and every Claude home your provider settings name).`);
+	if (!options.codex) return;
+	for (const codex of coordination.codexHookHomes ?? []) {
+		yield* io.say(`Codex: ${codex.installed ? codex.trusted ? "hooks installed and trusted" : "hooks installed, awaiting your approval" : codex.present ? "hooks partly present" : "no Peer hooks"} in ${codex.hooksPath}${codex.error === void 0 ? "" : ` (${codex.error})`}.`);
+		if (!options.install || !codex.installed || codex.trusted) continue;
+		yield* io.say(`Codex runs these commands for Peer in ${codex.home}:`);
+		for (const hook of codex.hooks) yield* io.say(`  ${hook.event}${hook.matcher === void 0 ? "" : ` (${hook.matcher})`}: ${hook.command}`);
+		yield* io.say(`Approve them: peer core hooks install --codex-approve ${codex.home} ${codex.reviewId}`);
+	}
+});
+/** Writes Peer's MCP entry into `client`'s settings at `scope` and says what happened. */
+const connectClient = (input, io) => gen$1(function* () {
+	const client = mcpClient(input.client);
+	if (client === void 0) return yield* fail$1(`peer core: ${input.client} is not a known client: ${MCP_CLIENTS.map((c) => c.id).join(", ")}.`);
+	yield* tryPromise({
+		try: () => ensureShim(input.stateDir),
+		catch: (cause) => fail$1(`peer core: could not write the peer command: ${cause instanceof Error ? cause.message : String(cause)}`)
+	});
+	const answer = yield* (yield* McpClients).connect({
+		client: client.id,
+		scope: input.scope,
+		...input.scope === "project" ? { project: { root: input.folder } } : {}
+	});
+	if (answer.outcome === "manual") yield* io.say(`${answer.path} is not plain JSON, so Peer left it alone. Add this entry by hand:\n${answer.entry}`);
+	else if (answer.outcome === "unchanged") yield* io.say(`${client.title} already has Peer's MCP entry in ${answer.path}.`);
+	else yield* io.say(`Connected ${client.title} in ${answer.path}. Reload ${client.title}; Peer Core starts when it first needs Peer.`);
+});
+/** `join --editor <id>`: hooks for Claude Code or Codex, the user-scope MCP entry for the rest. */
+const connectEditor = (id, stateDir, io) => gen$1(function* () {
+	if (id === "claude" || id === "codex") {
+		const status = yield* (yield* PeerAdapters).setCoordination(id === "claude" ? { claudeHooks: true } : { codexHooks: true });
+		return yield* sayHooks(status, {
+			claude: id === "claude",
+			codex: id === "codex",
+			install: true
+		}, io);
+	}
+	return yield* connectClient({
+		client: id,
+		scope: "user",
+		folder: NodeOS.homedir(),
+		stateDir
+	}, io);
+});
+//#endregion
+//#region src/cli/joinLink.ts
+/**
+* An invitation link as the Hub mails it, `{public_url}/join/{slug}?email=…`, read into the Hub it
+* came from, the workspace and the invited address. `peer core join` takes it as well as a slug.
+*
+* @module cli/joinLink
+*/
+/** Whether `peer core join`'s argument is a link rather than a slug. */
+const isJoinLink = (text) => /^https?:\/\//i.test(text.trim());
+const SLUG = /^[a-z0-9][a-z0-9-]{0,62}$/;
+/** A development Hub on this computer, the only one a link may name over plain `http:`. */
+const LOOPBACK = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+const isLoopback = (url) => LOOPBACK.has(url.hostname.toLowerCase());
+const originAndPath = (url) => `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+/**
+* The link's Hub, workspace and address, or why it is not an invitation link. With `hubUrl` (the
+* Hub this computer signs in to, or `--hub`), a link of another Hub is refused.
+*/
+function parseJoinLink(text, hubUrl) {
+	let url;
+	try {
+		url = new URL(text.trim());
+	} catch {
+		return fail$3(`${text} is not a link.`);
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") return fail$3(`${text} is not an invitation link (https://…/join/<workspace>?email=…).`);
+	if (url.protocol === "http:" && !isLoopback(url)) return fail$3(`${text} is not https; Peer signs in to a Hub over https only.`);
+	const match = /^(.*)\/join\/([^/]+)\/?$/.exec(url.pathname);
+	if (match === null) return fail$3(`${text} is not an invitation link (https://…/join/<workspace>?email=…).`);
+	const slug = decodeURIComponent(match[2] ?? "").toLowerCase();
+	if (!SLUG.test(slug)) return fail$3(`${text} names no workspace Peer can use.`);
+	const email = url.searchParams.get("email")?.trim().toLowerCase() ?? "";
+	if (!/^[^@\s]+@[^@\s]+$/.test(email)) return fail$3(`${text} names no address; open the link from the invitation email.`);
+	const hub = `${url.origin}${(match[1] ?? "").replace(/\/+$/, "")}`;
+	if (hubUrl !== void 0 && hubUrl.trim() !== "") {
+		let expected;
+		try {
+			expected = originAndPath(new URL(hubUrl.trim()));
+		} catch {
+			return fail$3(`${hubUrl} is not a Hub address.`);
+		}
+		if (expected.toLowerCase() !== hub.toLowerCase()) return fail$3(`The link is for the Hub at ${hub}, not ${expected}.`);
+	}
+	return succeed$2({
+		hub,
+		slug,
+		email
+	});
+}
+//#endregion
+//#region src/cli/peerCoreJoin.ts
+/** Signs `email` in: mails a code (or finishes a sign-in waiting for `code`) and checks it. */
+const signIn = (input, io) => gen$1(function* () {
+	const workspaces = yield* PeerWorkspaces;
+	const state = yield* PeerState;
+	const email = input.email.trim();
+	const { persisted } = yield* state.read;
+	let code = input.code?.trim();
+	const pending = persisted.pendingSignIn;
+	const otherHub = input.hub !== void 0 && pending?.hubUrl !== void 0 && !sameHub(pending.hubUrl, input.hub);
+	if (code === void 0 || pending?.email !== email || otherHub) {
+		const echoed = (yield* workspaces.startSignIn({
+			email,
+			...input.hub === void 0 ? {} : { hubUrl: input.hub }
+		})).pendingSignIn?.echoedCode;
+		if (echoed !== void 0) code = echoed;
+		else yield* io.say(`A sign-in code was mailed to ${email}.`);
+	}
+	if (code === void 0 || code === "") code = yield* io.askCode;
+	if (code === "") return yield* fail$1("peer core: no code given.");
+	return yield* workspaces.finishSignIn({ code });
+});
+/** `peer core login`: refuses a second sign-in, naming the way out of it. */
+const login = (input, io) => gen$1(function* () {
+	const state = yield* PeerState;
+	const email = input.email.trim();
+	const { persisted } = yield* state.read;
+	if (persisted.email !== null) return yield* fail$1(persisted.email === email ? `peer core: already signed in as ${email}.` : `peer core: signed in as ${persisted.email}. Run peer core logout first, then sign in as ${email}.`);
+	const status = yield* signIn(input, io);
+	yield* io.say(`Signed in: ${status.email ?? email} at ${status.hubUrl}`);
+	yield* sayWorkspaces(status, io);
+});
+const sayWorkspaces = (status, io) => gen$1(function* () {
+	for (const workspace of status.workspaces) yield* io.say(`Workspace: ${workspace.slug} (${workspace.name})`);
+	for (const offer of status.joinable) yield* io.say(offer.reason === "invite" ? `Invited: ${offer.slug} (${offer.name}). Accept it with peer core join ${offer.slug}.` : `Joinable: ${offer.slug} (${offer.name}). Confirm it with peer core join ${offer.slug}.`);
+	if (status.workspaces.length === 0 && status.joinable.length === 0) yield* io.say("Workspace: none yet (ask for an invitation, or create one in the Peer app).");
+});
+/**
+* `peer core join <slug|link>`. A link signs its address in when nobody is signed in, at the Hub
+* this computer uses or the one `--hub` names, and refuses, signing nobody out, when another
+* address (or the same one at another Hub) is. Returns the
+* workspace joined and the clone commands of the invited projects, for the editor step.
+*/
+const join = (input, io) => gen$1(function* () {
+	const workspaces = yield* PeerWorkspaces;
+	const state = yield* PeerState;
+	const client = yield* PeerHubClient;
+	const target = input.target.trim();
+	let slug = target;
+	if (isJoinLink(target)) {
+		const parsed = parseJoinLink(target, input.hub);
+		if (isFailure$1(parsed)) return yield* fail$1(`peer core: ${parsed.failure}`);
+		const link = parsed.success;
+		slug = link.slug;
+		const { persisted } = yield* state.read;
+		if (persisted.email !== null && persisted.email.toLowerCase() !== link.email) return yield* fail$1(`peer core: signed in as ${persisted.email}; the invitation is for ${link.email}. Run peer core logout first, then join with the link again.`);
+		if (persisted.email !== null && !sameHub(client.hubUrl(persisted), link.hub)) return yield* fail$1(`peer core: signed in to ${client.hubUrl(persisted)}; the invitation is from ${link.hub}. Run peer core logout first, then join with the link again.`);
+		if (persisted.email === null && input.hub === void 0) {
+			const configured = client.hubUrl(persisted);
+			if (!sameHub(configured, link.hub)) return yield* fail$1(`peer core: the invitation is from the Hub at ${new URL(link.hub).host}, and this computer signs in to ${configured}. If you trust ${new URL(link.hub).host}, join with --hub ${link.hub}.`);
+		}
+		if (persisted.email === null) {
+			const status = yield* signIn({
+				email: link.email,
+				hub: link.hub,
+				...input.code === void 0 ? {} : { code: input.code }
+			}, io);
+			yield* io.say(`Signed in: ${status.email ?? link.email} at ${status.hubUrl}`);
+		}
+	}
+	const offer = (yield* client.me).joinable.find((w) => w.slug === slug);
+	const invitation = {
+		...offer?.projects === void 0 ? {} : { projects: offer.projects },
+		...offer?.task === void 0 ? {} : { task: offer.task }
+	};
+	const joined = (yield* workspaces.joinWorkspace({
+		workspace: slug,
+		confirmDomainMatch: true
+	})).workspaces.find((workspace) => workspace.slug === slug);
+	if (joined === void 0) return yield* fail$1(`peer core: ${slug} did not list you after joining.`);
+	yield* io.say(`Joined: ${joined.slug} (${joined.name}) as ${joined.role}.`);
+	return yield* sayInvitation(slug, invitation, io);
+});
+const sameHub = (a, b) => a.replace(/\/+$/, "").toLowerCase() === b.replace(/\/+$/, "").toLowerCase();
+/**
+* The invited projects with their repositories, the task that waits (kept in `invitedTasks`), and
+* the clone commands for the next step.
+*/
+const sayInvitation = (slug, invitation, io) => gen$1(function* () {
+	const state = yield* PeerState;
+	const client = yield* PeerHubClient;
+	const projects = ((yield* state.workspaces).find((w) => w.slug === slug)?.manifest?.projects ?? []).filter((project) => invitation.projects === void 0 || invitation.projects.length === 0 || invitation.projects.includes(project.id));
+	const clones = [];
+	for (const project of projects) for (const repository of project.repositories) {
+		yield* io.say(`${project.id} · ${repository.url} (${repository.branch})`);
+		clones.push(`git clone --branch ${repository.branch} ${repository.url}`);
+	}
+	if (invitation.task !== void 0) {
+		const wanted = invitation.task;
+		const work = yield* flatMap$1(client.session, ({ hubUrl, session }) => client.api.work(hubUrl, session, slug)).pipe(option);
+		const found = projects.flatMap((project) => {
+			const task = (work._tag === "Some" ? work.value.projects[project.id]?.tasks ?? [] : []).find((t) => t.id === wanted || t.key === wanted);
+			return task === void 0 ? [] : [{
+				project: project.id,
+				task
+			}];
+		})[0];
+		const project = found?.project ?? (projects.length === 1 ? projects[0]?.id ?? void 0 : void 0);
+		yield* io.say(found === void 0 ? `Waiting for you: ${wanted}` : `Waiting for you: ${found.task.key ?? found.task.id} · ${found.task.title}`);
+		const id = found?.task.id ?? wanted;
+		yield* state.updatePersisted((p) => ({
+			...p,
+			invitedTasks: [...(p.invitedTasks ?? []).filter((t) => !(t.workspace === slug && t.task === id)), {
+				workspace: slug,
+				...project === void 0 ? {} : { project },
+				task: id
+			}]
+		}));
+	}
+	return {
+		workspace: slug,
+		clones
+	};
+});
+/** After joining: how to get the invited repositories here, and the editor step unless done. */
+const sayNextStep = (joined, io, editorConnected = false) => gen$1(function* () {
+	for (const clone of joined.clones) yield* io.say(`Next: ${clone}`);
+	if (joined.clones.length > 0) yield* io.say("Peer binds the clone to its project by its remote the first time it is used.");
+	if (!editorConnected) yield* io.say("Next: connect your editor: peer core hooks install (Claude Code; --codex for Codex), or peer core connect <client>.");
+});
+/** `--editor` names an editor Peer can connect, or says which it can. */
+const checkEditor = (editor) => editor === void 0 || EDITORS.includes(editor) ? void 0 : fail$1(`peer core: --editor ${editor} is not one of: ${EDITORS.join(", ")}.`);
+/**
+* `peer core join … [--editor <id>]`: joins, then connects the editor named, or the one a person
+* picks on a terminal; without a terminal it connects nothing and says how to.
+*/
+const joinAndConnect = (input, choice, io) => gen$1(function* () {
+	const refused = checkEditor(choice.editor);
+	if (refused !== void 0) return yield* refused;
+	const joined = yield* join(input, io);
+	let editor = choice.editor ?? null;
+	if (editor === null && choice.interactive) editor = yield* choice.choose(yield* choice.detected);
+	yield* sayNextStep(joined, io, editor !== null);
+	if (editor !== null) yield* connectEditor(editor, choice.stateDir, io);
+	return {
+		...joined,
+		editor
+	};
+});
+/**
+* The terminal's choices for `choose`: the editors found in this person's home, then the others
+* Peer can connect, then none.
+*/
+const editorChoices = (detected) => [
+	...detected.map((id) => ({
+		title: editorTitle(id),
+		value: id
+	})),
+	...EDITORS.filter((id) => !detected.includes(id)).map((id) => ({
+		title: `${editorTitle(id)} (not found here)`,
+		value: id
+	})),
+	{
+		title: "None (connect one later)",
+		value: null
+	}
+];
+//#endregion
+//#region src/cli/peerCoreTasks.ts
+/**
+* `peer core tasks` and `peer core take`: a person's tasks and taking one nobody owns, from a
+* terminal, as the person with the Hub session (no broker). The task an invitation named is listed
+* first until it is done. Outcomes follow the peer-cli-contract.
+*
+* @module cli/peerCoreTasks
+*/
+const TASKS_NEXT = "check the project with peer core status, then repeat the command.";
+/** `--project`, else the bound folder's project; undefined: every project of the person's. */
+const projectOf = (input, io) => gen$1(function* () {
+	const state = yield* PeerState;
+	if (input.project !== void 0) {
+		const [workspace, project, ...rest] = input.project.trim().split("/");
+		if (workspace === void 0 || project === void 0 || project === "" || rest.length > 0) return yield* outcome("usage", `--project takes <workspace>/<project>, not ${input.project}`, "name the project as peer core status lists it.");
+		yield* state.project(workspace, project).pipe(mapError((error) => outcome("refused", error.detail, TASKS_NEXT)));
+		return {
+			workspace,
+			project
+		};
+	}
+	const place = yield* state.placeOf(input.cwd, { bindByRemote: input.canWrite });
+	const notice = yield* state.pendingBindingNotice(input.cwd);
+	if (notice !== null) yield* io.say(notice);
+	return place === null || place.workspace === "@local" ? void 0 : {
+		workspace: place.workspace,
+		project: place.project
+	};
+});
+/** Each workspace's tasks and their owners, as its Hub says now. */
+const readWork = (slugs, command) => gen$1(function* () {
+	const client = yield* PeerHubClient;
+	const { hubUrl, session } = yield* client.session.pipe(mapError((error) => hubOutcome(error, command, TASKS_NEXT, true)));
+	const read = /* @__PURE__ */ new Map();
+	for (const slug of slugs) {
+		const work = yield* client.api.work(hubUrl, session, slug).pipe(mapError((error) => hubOutcome(error, command, TASKS_NEXT, true)));
+		const view = yield* client.api.taskOwners(hubUrl, session, slug).pipe(option);
+		read.set(slug, {
+			projects: Object.fromEntries(Object.entries(work.projects).map(([id, project]) => [id, project.tasks])),
+			owners: isNone(view) ? void 0 : Object.fromEntries(Object.entries(view.value.projects).map(([id, project]) => [id, Object.fromEntries(Object.entries(project.tasks).map(([task, owner]) => [task, owner.owner]))]))
+		});
+	}
+	return read;
+});
+const label = (task) => task.key ?? task.id;
+/** `peer core tasks [--project <ws/id>] [--open|--mine]`. */
+const listTasks = (input, io) => gen$1(function* () {
+	const state = yield* PeerState;
+	const { persisted } = yield* state.read;
+	const email = persisted.email?.toLowerCase() ?? null;
+	const chosen = yield* projectOf(input, io);
+	const refs = chosen !== void 0 ? [chosen] : persisted.workspaces.filter((workspace) => workspace.slug !== PEER_LOCAL_WORKSPACE).flatMap((workspace) => (workspace.manifest?.projects ?? []).map((project) => ({
+		workspace: workspace.slug,
+		project: project.id
+	})));
+	if (refs.length === 0) return yield* outcome("refused", "you are on no project yet", "join a workspace with peer core join <invitation link>, then repeat the command.");
+	const work = yield* readWork([...new Set(refs.map((ref) => ref.workspace))], "tasks");
+	const invited = persisted.invitedTasks ?? [];
+	const finished = [];
+	let listed = 0;
+	for (const ref of refs) {
+		const read = work.get(ref.workspace);
+		const tasks = read?.projects[ref.project] ?? [];
+		const owners = read?.owners?.[ref.project];
+		for (const entry of invited) if (entry.workspace === ref.workspace && (entry.project ?? ref.project) === ref.project) {
+			if (tasks.find((t) => t.id === entry.task)?.status === "done") finished.push(entry);
+		}
+		const isInvited = (task) => invited.some((entry) => entry.workspace === ref.workspace && (entry.project ?? ref.project) === ref.project && entry.task === task.id);
+		const ownerOf = (task) => owners?.[task.id];
+		const shown = tasks.filter((task) => task.status !== "done").filter((task) => input.filter === "open" ? owners !== void 0 && ownerOf(task) === void 0 : input.filter === "mine" ? email !== null && ownerOf(task) === email : true).toSorted((a, b) => Number(isInvited(b)) - Number(isInvited(a)));
+		if (refs.length > 1 && shown.length > 0) yield* io.say(`Project: ${ref.workspace}/${ref.project}`);
+		for (const task of shown) {
+			const owner = owners === void 0 ? "owner unknown" : ownerOf(task) ?? "nobody";
+			yield* io.say(`${label(task)} · ${task.title} · ${task.status} · ${task.area ?? "no area"} · ${owner}`);
+		}
+		listed += shown.length;
+	}
+	if (listed === 0) yield* io.say(`Tasks: none${input.filter === "open" ? " nobody owns" : input.filter === "mine" ? " of yours" : ""} in ${refs.map((r) => `${r.workspace}/${r.project}`).join(", ")}.`);
+	if (input.canWrite && finished.length > 0) yield* state.updatePersisted((p) => ({
+		...p,
+		invitedTasks: (p.invitedTasks ?? []).filter((entry) => !finished.some((done) => done.workspace === entry.workspace && done.task === entry.task))
+	})).pipe(ignore);
+});
+/** `peer core take <task> [--project <ws/id>]`: the person becomes the owner of a task nobody owns. */
+const takeTask = (input, io) => gen$1(function* () {
+	const state = yield* PeerState;
+	const client = yield* PeerHubClient;
+	const { persisted } = yield* state.read;
+	const wanted = input.task.trim();
+	if (wanted === "") return yield* outcome("usage", "take needs a task", "name it as peer core tasks lists it.");
+	const email = persisted.email?.toLowerCase() ?? null;
+	if (email === null) return yield* outcome("refused", "nobody is signed in here", "sign in with peer core login <email>, then repeat the command.");
+	const chosen = yield* projectOf(input, io);
+	const invitedProject = persisted.invitedTasks?.find((entry) => entry.task === wanted && entry.project !== void 0);
+	const candidates = chosen !== void 0 ? [chosen] : invitedProject?.project !== void 0 ? [{
+		workspace: invitedProject.workspace,
+		project: invitedProject.project
+	}] : persisted.workspaces.filter((workspace) => workspace.slug !== PEER_LOCAL_WORKSPACE).flatMap((workspace) => (workspace.manifest?.projects ?? []).map((project) => ({
+		workspace: workspace.slug,
+		project: project.id
+	})));
+	const work = yield* readWork([...new Set(candidates.map((ref) => ref.workspace))], "take");
+	const found = candidates.flatMap((ref) => {
+		const task = (work.get(ref.workspace)?.projects[ref.project] ?? []).find((t) => t.id === wanted || t.key === wanted);
+		return task === void 0 ? [] : [{
+			...ref,
+			task
+		}];
+	});
+	if (found.length === 0) return yield* outcome("refused", `no task ${wanted} in ${candidates.map((r) => `${r.workspace}/${r.project}`).join(", ") || "your projects"}`, "find it with peer core tasks, then repeat the command.");
+	if (found.length > 1) return yield* outcome("usage", `${wanted} is a task of ${found.map((f) => `${f.workspace}/${f.project}`).join(" and ")}`, "choose one with --project <workspace>/<project>.");
+	const { workspace, project, task } = found[0];
+	const where = `${workspace}/${project}`;
+	if (task.status === "done") return yield* outcome("refused", `${label(task)} is done`, "take a task that is not done; peer core tasks lists them.");
+	const owner = work.get(workspace)?.owners?.[project]?.[task.id];
+	const named = (address) => `${state.nameOf(workspace, address)} (${address})`;
+	const handOver = `ask them to hand it over, or a lead of ${where} to name you.`;
+	if (owner === email) {
+		yield* io.say(`You own ${label(task)} · ${task.title} already (${where}).`);
+		return;
+	}
+	if (owner !== void 0) return yield* outcome("refused", `${label(task)} is owned by ${named(owner)}`, handOver);
+	const { hubUrl, session } = yield* client.session.pipe(mapError((error) => hubOutcome(error, "take", TASKS_NEXT, true)));
+	const answer = yield* client.api.takeTask(hubUrl, session, workspace, project, task.id, { owner: email }).pipe(mapError((error) => hubOutcome(error, "take", error.refused === true ? `ask a lead of ${where} to name you the owner.` : "run peer core tasks to see who owns it, and repeat the command only if it is still nobody.", false)));
+	if ("ownedBy" in answer) return yield* outcome("refused", `${label(task)} is owned by ${named(answer.ownedBy)}`, handOver);
+	if (answer.owner !== null && answer.owner.owner !== email) return yield* outcome("refused", `${label(task)} is owned by ${named(answer.owner.owner)}`, handOver);
+	yield* io.say(`You own ${label(task)} · ${task.title} now (${where}).`);
+});
+//#endregion
 //#region src/cli/peerCore.ts
 /**
 * `peer core …` (also `t3 peer …`): Peer's coordination without the desktop app. `serve` runs Peer Core (the broker
@@ -27373,17 +27912,13 @@ const stopCommand = make$62("stop", { ...authLocationFlags }).pipe(withDescripti
 })));
 /** What this computer's Peer state says, read once without writing anything. */
 const localStatus = (config, owner) => gen$1(function* () {
-	const state = yield* PeerState;
-	const { persisted } = yield* state.read;
+	const { persisted } = yield* (yield* PeerState).read;
 	yield* log(owner === null ? "Peer runs: no (start it with peer core serve, or open the Peer app)." : `Peer runs: ${describeOwner(owner)}.`);
 	yield* log(`Hub: ${persisted.hubUrl ?? process.env.PEER_HUB_URL ?? "the default Hub"}`);
 	yield* log(persisted.email === null ? "Signed in: no" : `Signed in: ${persisted.email}`);
 	for (const workspace of persisted.workspaces) yield* log(`Workspace: ${workspace.slug} (${workspace.name})`);
 	const folders = yield* promise(() => readProjects(config.stateDir));
-	for (const folder of folders) {
-		const place = yield* state.placeOf(folder.workspaceRoot);
-		yield* log(place === null || place.workspace === "@local" ? `Folder: ${folder.workspaceRoot} (not shared)` : `Folder: ${folder.workspaceRoot} (shared: ${place.workspace}/${place.project})`);
-	}
+	yield* sayCheckouts(folders.map((folder) => folder.workspaceRoot), terminalIo);
 }).pipe(provide(stateLayer(config)));
 const statusCommand = make$62("status", { ...authLocationFlags }).pipe(withDescription("Who runs Peer here, who is signed in, and which folders are shared."), withHandler((flags) => gen$1(function* () {
 	const config = yield* resolveConfig(flags);
@@ -27393,69 +27928,112 @@ const refuseWhileRunning = (stateDir) => gen$1(function* () {
 	const owner = yield* ownerOf(stateDir);
 	if (owner !== null) return yield* fail(`Peer is running (${describeOwner(owner)}): sign in in the app${owner.kind === "peer-core" ? ", or stop Peer Core with peer core stop first" : ""}.`);
 });
-const readCode = tryPromise({
-	try: async () => {
-		const terminal = NodeReadlinePromises.createInterface({
-			input: process.stdin,
-			output: process.stderr
-		});
-		try {
-			return (await terminal.question("Code: ")).trim();
-		} finally {
-			terminal.close();
-		}
-	},
-	catch: () => fail("peer core: could not read the code.")
-});
+const terminalIo = {
+	say: (line) => log(line),
+	askCode: tryPromise({
+		try: async () => {
+			const terminal = NodeReadlinePromises.createInterface({
+				input: process.stdin,
+				output: process.stderr
+			});
+			try {
+				return (await terminal.question("Code: ")).trim();
+			} finally {
+				terminal.close();
+			}
+		},
+		catch: () => fail("peer core: could not read the code.")
+	})
+};
+const hubFlag = String$1("hub").pipe(withDescription$1("Another Peer Hub than the current one."), optional);
+const codeFlag = String$1("code").pipe(withDescription$1("The code the Hub mailed (else it is asked for)."), optional);
 const loginCommand = make$62("login", {
 	...authLocationFlags,
 	email: String$2("email").pipe(withDescription$2("Your work email address.")),
-	code: String$1("code").pipe(withDescription$1("The code the Hub mailed (else it is asked for)."), optional),
-	hub: String$1("hub").pipe(withDescription$1("Another Peer Hub than the current one."), optional)
+	code: codeFlag,
+	hub: hubFlag
 }).pipe(withDescription("Sign this computer's Peer in to its Peer Hub."), withHandler((flags) => gen$1(function* () {
 	const config = yield* resolveConfig(flags);
 	yield* refuseWhileRunning(config.stateDir);
-	yield* gen$1(function* () {
-		const workspaces = yield* PeerWorkspaces;
-		const state = yield* PeerState;
-		const email = flags.email.trim();
-		const { persisted } = yield* state.read;
-		if (persisted.email !== null) return yield* fail(persisted.email === email ? `peer core: already signed in as ${email}.` : `peer core: signed in as ${persisted.email}. Run peer core logout first, then sign in as ${email}.`);
-		const pending = persisted.pendingSignIn;
-		let code = getOrUndefined(flags.code)?.trim();
-		if (code === void 0 || pending?.email !== email) {
-			const echoed = (yield* workspaces.startSignIn({
-				email,
-				...isSome(flags.hub) ? { hubUrl: flags.hub.value } : {}
-			})).pendingSignIn?.echoedCode;
-			if (echoed !== void 0) code = echoed;
-			else yield* log(`A sign-in code was mailed to ${email}.`);
-		}
-		if (code === void 0 || code === "") code = yield* readCode;
-		if (code === "") return yield* fail("peer core: no code given.");
-		const status = yield* workspaces.finishSignIn({ code });
-		yield* log(`Signed in: ${status.email ?? email} at ${status.hubUrl}`);
-		for (const workspace of status.workspaces) yield* log(`Workspace: ${workspace.slug} (${workspace.name})`);
-		for (const offer of status.joinable) yield* log(offer.reason === "invite" ? `Invited: ${offer.slug} (${offer.name}). Accept it with peer core join ${offer.slug}.` : `Joinable: ${offer.slug} (${offer.name}). Confirm it with peer core join ${offer.slug}.`);
-		if (status.workspaces.length === 0 && status.joinable.length === 0) yield* log("Workspace: none yet (ask for an invitation, or create one in the Peer app).");
-	}).pipe(catchTags({ PeerHubError: (error) => fail$1(fail(`peer core: ${error.detail}`)) }), provide(oneShotLayer(config)));
+	yield* login({
+		email: flags.email,
+		...isSome(flags.code) ? { code: flags.code.value } : {},
+		...isSome(flags.hub) ? { hub: flags.hub.value } : {}
+	}, terminalIo).pipe(catchTags({ PeerHubError: (error) => fail$2(fail(`peer core: ${error.detail}`)) }), provide(oneShotLayer(config)));
 })));
 const joinCommand = make$62("join", {
 	...authLocationFlags,
-	workspace: String$2("workspace").pipe(withDescription$2("The organization's slug, as login listed it."))
-}).pipe(withDescription("Accept an invitation to an organization, or confirm a domain match."), withHandler((flags) => gen$1(function* () {
+	workspace: String$2("link-or-workspace").pipe(withDescription$2("The invitation link (https://…/join/<workspace>?email=…), or the organization's slug as login listed it.")),
+	code: codeFlag,
+	hub: hubFlag,
+	editor: String$1("editor").pipe(withDescription$1(`Connect this editor after joining: ${EDITORS.join(", ")} (else asked on a terminal).`), optional)
+}).pipe(withDescription("Accept an invitation (signing its address in when nobody is), or confirm a domain match."), withHandler((flags) => gen$1(function* () {
 	const config = yield* resolveConfig(flags);
+	const editor = getOrUndefined(flags.editor);
+	const refused = checkEditor(editor);
+	if (refused !== void 0) return yield* refused;
 	yield* refuseWhileRunning(config.stateDir);
-	yield* gen$1(function* () {
-		const workspaces = yield* PeerWorkspaces;
-		const slug = flags.workspace.trim();
-		const joined = (yield* workspaces.joinWorkspace({
-			workspace: slug,
-			confirmDomainMatch: true
-		})).workspaces.find((workspace) => workspace.slug === slug);
-		if (joined === void 0) return yield* fail(`peer core: ${slug} did not list you after joining.`);
-		yield* log(`Joined: ${joined.slug} (${joined.name}) as ${joined.role}.`);
-	}).pipe(catchTags({ PeerHubError: (error) => fail$1(fail(`peer core: ${error.detail}`)) }), provide(oneShotLayer(config)));
+	const choose = (detected) => run$3(Select({
+		message: "Connect an editor to Peer?",
+		choices: editorChoices(detected)
+	})).pipe(orElseSucceed(() => null));
+	yield* joinAndConnect({
+		target: flags.workspace,
+		...isSome(flags.code) ? { code: flags.code.value } : {},
+		...isSome(flags.hub) ? { hub: flags.hub.value } : {}
+	}, {
+		...editor === void 0 ? {} : { editor },
+		interactive: process.stdin.isTTY === true && process.stdout.isTTY === true,
+		choose,
+		detected: detectedEditors,
+		stateDir: config.stateDir
+	}, terminalIo).pipe(catchTags({ PeerHubError: (error) => fail$2(fail(`peer core: ${error.detail}`)) }), provide(layer$107.pipe(provideMerge(oneShotLayer(config)))));
+})));
+const bindCommand = make$62("bind", {
+	...authLocationFlags,
+	folder: String$2("folder").pipe(withDescription$2("The clone (default: this folder)."), optional$1),
+	project: String$1("project").pipe(withDescription$1("The project, as <workspace>/<project>.")),
+	repository: String$1("repository").pipe(withDescription$1("The project's repository, when the clone's origin does not say which."), optional)
+}).pipe(withDescription("Make a clone on this computer the checkout of a project's repository."), withHandler((flags) => gen$1(function* () {
+	const config = yield* resolveConfig(flags);
+	const owner = yield* ownerOf(config.stateDir);
+	if (owner !== null) return yield* fail(`peer core: Peer is running (${describeOwner(owner)}), and it keeps the checkouts in memory: ${owner.kind === "peer-core" ? "stop Peer Core with peer core stop first" : "choose the folder in the app's project settings"}.`);
+	yield* bind({
+		folder: realpathOrSelf(getOrElse(flags.folder, () => process.cwd())),
+		project: flags.project,
+		...isSome(flags.repository) ? { repository: flags.repository.value } : {}
+	}, terminalIo).pipe(provide(stateLayer(config)));
+})));
+const taskProjectFlag = String$1("project").pipe(withDescription$1("The project, as <workspace>/<project> (default: this folder's)."), optional);
+const tasksCommand = make$62("tasks", {
+	...authLocationFlags,
+	project: taskProjectFlag,
+	open: Boolean$1("open").pipe(withDescription$1("Only the tasks nobody owns (what you can take)."), withDefault(false)),
+	mine: Boolean$1("mine").pipe(withDescription$1("Only the tasks you own."), withDefault(false))
+}).pipe(withDescription("Your tasks that are not done, with status, area and owner; an invitation's task first."), withHandler((flags) => gen$1(function* () {
+	const config = yield* resolveConfig(flags);
+	if (flags.open && flags.mine) return yield* outcome("usage", "--open and --mine exclude each other", "use one of them.");
+	const owner = yield* ownerOf(config.stateDir);
+	yield* listTasks({
+		...isSome(flags.project) ? { project: flags.project.value } : {},
+		filter: flags.open ? "open" : flags.mine ? "mine" : "all",
+		cwd: realpathOrSelf(process.cwd()),
+		canWrite: owner === null
+	}, terminalIo).pipe(provide(oneShotLayer(config)));
+})));
+const takeCommand = make$62("take", {
+	...authLocationFlags,
+	task: String$2("task").pipe(withDescription$2("The task, as peer core tasks lists it.")),
+	project: taskProjectFlag
+}).pipe(withDescription("Become the owner of a task nobody owns."), withHandler((flags) => gen$1(function* () {
+	const config = yield* resolveConfig(flags);
+	const owner = yield* ownerOf(config.stateDir);
+	yield* takeTask({
+		task: flags.task,
+		...isSome(flags.project) ? { project: flags.project.value } : {},
+		cwd: realpathOrSelf(process.cwd()),
+		canWrite: owner === null
+	}, terminalIo).pipe(provide(oneShotLayer(config)));
 })));
 const logoutCommand = make$62("logout", { ...authLocationFlags }).pipe(withDescription("Sign this computer's Peer out of its Peer Hub."), withHandler((flags) => gen$1(function* () {
 	const config = yield* resolveConfig(flags);
@@ -27463,7 +28041,7 @@ const logoutCommand = make$62("logout", { ...authLocationFlags }).pipe(withDescr
 	yield* gen$1(function* () {
 		yield* (yield* PeerWorkspaces).signOut;
 		yield* log("Signed out.");
-	}).pipe(catchTags({ PeerHubError: (error) => fail$1(fail(`peer core: ${error.detail}`)) }), provide(oneShotLayer(config)));
+	}).pipe(catchTags({ PeerHubError: (error) => fail$2(fail(`peer core: ${error.detail}`)) }), provide(oneShotLayer(config)));
 })));
 const shareCommand = make$62("share", {
 	...authLocationFlags,
@@ -27478,6 +28056,10 @@ const shareCommand = make$62("share", {
 		const state = yield* PeerState;
 		const workspaces = yield* PeerWorkspaces;
 		const place = yield* state.placeOf(folder);
+		const notice = yield* state.pendingBindingNotice(folder);
+		const inProject = place !== null && place.workspace !== "@local";
+		if (notice !== null && !inProject) return yield* fail(`peer core: ${notice}`);
+		if (notice !== null) yield* log(notice);
 		if (place !== null && place.workspace !== "@local") {
 			yield* log(`Shared already: ${folder} is project ${place.project} of ${place.workspace}.`);
 			return;
@@ -27500,7 +28082,7 @@ const shareCommand = make$62("share", {
 		});
 		const shared = yield* state.placeOf(folder);
 		yield* log(shared === null ? `Shared ${folder} with ${workspace}.` : `Shared ${folder} with ${workspace} as project ${shared.project}.`);
-	}).pipe(catchTags({ PeerHubError: (error) => fail$1(fail(`peer core: ${error.detail}`)) }), provide(oneShotLayer(config)));
+	}).pipe(catchTags({ PeerHubError: (error) => fail$2(fail(`peer core: ${error.detail}`)) }), provide(oneShotLayer(config)));
 })));
 const CLIENT_IDS = MCP_CLIENTS.map((client) => client.id).join(", ");
 const editorCommand = (kind) => make$62(kind, {
@@ -27519,23 +28101,29 @@ const editorCommand = (kind) => make$62(kind, {
 		"--scope",
 		scope
 	], folder);
-	if (kind === "connect") yield* tryPromise({
-		try: () => ensureShim(config.stateDir),
-		catch: (cause) => fail(`peer core: could not write the peer command: ${messageOf(cause)}`)
-	});
 	yield* gen$1(function* () {
-		const answer = yield* (yield* McpClients)[kind]({
+		if (kind === "disconnect") return yield* disconnect(client.id, scope, folder);
+		return yield* connectClient({
 			client: client.id,
 			scope,
-			...scope === "project" ? { project: { root: folder } } : {}
-		});
-		if (answer.outcome === "manual") yield* log(`${answer.path} is not plain JSON, so Peer left it alone. ${kind === "connect" ? "Add" : "Remove"} this entry by hand:\n${answer.entry}`);
-		else if (answer.outcome === "unchanged") yield* log(`${client.title} ${kind === "connect" ? "already has" : "has no"} Peer's MCP entry in ${answer.path}.`);
-		else yield* log(kind === "connect" ? `Connected ${client.title} in ${answer.path}. Reload ${client.title}; Peer Core starts when it first needs Peer.` : `Removed Peer's MCP entry from ${answer.path}.`);
-	}).pipe(catchTags({ PeerHubError: (error) => fail$1(fail(`peer core: ${error.detail}`)) }), provide(layer$107.pipe(provideMerge(oneShotLayer(config)))));
+			folder,
+			stateDir: config.stateDir
+		}, terminalIo);
+	}).pipe(catchTags({ PeerHubError: (error) => fail$2(fail(`peer core: ${error.detail}`)) }), provide(layer$107.pipe(provideMerge(oneShotLayer(config)))));
 })));
+/** Takes Peer's MCP entry out of `client`'s settings at `scope`. */
+const disconnect = (client, scope, folder) => gen$1(function* () {
+	const answer = yield* (yield* McpClients).disconnect({
+		client,
+		scope,
+		...scope === "project" ? { project: { root: folder } } : {}
+	});
+	const title = editorTitle(client);
+	if (answer.outcome === "manual") yield* log(`${answer.path} is not plain JSON, so Peer left it alone. Remove this entry by hand:\n${answer.entry}`);
+	else if (answer.outcome === "unchanged") yield* log(`${title} has no Peer's MCP entry in ${answer.path}.`);
+	else yield* log(`Removed Peer's MCP entry from ${answer.path}.`);
+});
 const codexFlag = Boolean$1("codex").pipe(withDescription$1("Codex's hooks too, in every configured Codex home."), withDefault(false));
-const claudeSettingsPath = () => NodePath.join(process.env.CLAUDE_CONFIG_DIR?.trim() || NodePath.join(NodeOS.homedir(), ".claude"), "settings.json");
 /** A running broker keeps peer-hub.json in memory, so hooks change only while none runs. */
 const refuseHooksWhileRunning = (stateDir) => gen$1(function* () {
 	const owner = yield* ownerOf(stateDir);
@@ -27557,23 +28145,19 @@ const hooksCommand = (kind) => make$62(kind, {
 	const reviewId = "reviewId" in flags ? getOrUndefined(flags.reviewId) : void 0;
 	if (home !== void 0 && reviewId === void 0) return yield* fail("peer core: --codex-approve takes a home and a review id.");
 	yield* gen$1(function* () {
-		const coordination = (yield* (yield* PeerAdapters).setCoordination(home !== void 0 && reviewId !== void 0 ? { codexHookApproval: {
+		const status = yield* (yield* PeerAdapters).setCoordination(home !== void 0 && reviewId !== void 0 ? { codexHookApproval: {
 			home,
 			reviewId
 		} } : {
 			claudeHooks: install,
 			...flags.codex ? { codexHooks: install } : {}
-		})).coordination;
-		if (home === void 0) yield* log(`Claude Code: ${coordination.claudeHooks ? "hooks installed" : coordination.claudeHooksPresent ? "hooks partly present" : "no Peer hooks"} in ${claudeSettingsPath()} (and every Claude home your provider settings name).`);
-		if (!flags.codex && home === void 0) return;
-		for (const codex of coordination.codexHookHomes ?? []) {
-			yield* log(`Codex: ${codex.installed ? codex.trusted ? "hooks installed and trusted" : "hooks installed, awaiting your approval" : codex.present ? "hooks partly present" : "no Peer hooks"} in ${codex.hooksPath}${codex.error === void 0 ? "" : ` (${codex.error})`}.`);
-			if (!install || !codex.installed || codex.trusted) continue;
-			yield* log(`Codex runs these commands for Peer in ${codex.home}:`);
-			for (const hook of codex.hooks) yield* log(`  ${hook.event}${hook.matcher === void 0 ? "" : ` (${hook.matcher})`}: ${hook.command}`);
-			yield* log(`Approve them: peer core hooks install --codex-approve ${codex.home} ${codex.reviewId}`);
-		}
-	}).pipe(catchTags({ PeerHubError: (error) => fail$1(fail(`peer core: ${error.detail}`)) }), provide(oneShotLayer(config)));
+		});
+		yield* sayHooks(status, {
+			claude: home === void 0,
+			codex: flags.codex || home !== void 0,
+			install
+		}, terminalIo);
+	}).pipe(catchTags({ PeerHubError: (error) => fail$2(fail(`peer core: ${error.detail}`)) }), provide(oneShotLayer(config)));
 })));
 const hooksGroup = make$62("hooks").pipe(withDescription("Peer's hooks in Claude Code and Codex, without the app."), withSubcommands([hooksCommand("install"), hooksCommand("remove")]));
 /**
@@ -27598,6 +28182,9 @@ const makePeerCommand = (name) => make$62(name).pipe(withDescription(name === "p
 	joinCommand,
 	logoutCommand,
 	shareCommand,
+	bindCommand,
+	tasksCommand,
+	takeCommand,
 	editorCommand("connect"),
 	editorCommand("disconnect"),
 	hooksGroup,
@@ -30630,7 +31217,7 @@ const make$41 = gen$1(function* () {
 			operation: "read-projects",
 			cause
 		})), flatMap$1(match$1({
-			onNone: () => fail$1(new AgentSessionImportProjectNotFoundError({ projectId: input.projectId })),
+			onNone: () => fail$2(new AgentSessionImportProjectNotFoundError({ projectId: input.projectId })),
 			onSome: succeed$1
 		})));
 		if (input.expectedWorkspaceRoot !== void 0 && normalizeProjectPathForComparison(project.workspaceRoot) !== normalizeProjectPathForComparison(input.expectedWorkspaceRoot)) return yield* new AgentSessionImportProjectChangedError({ projectId: input.projectId });
@@ -31733,7 +32320,7 @@ const layer$62 = effect(ProviderTurnStartServiceV2, gen$1(function* () {
 				existingProviderThread: providerThread
 			}));
 			const uncertainDelivery = projection.contextHandoffs.some((handoff) => handoff.toProviderThreadId === providerThread.id && handoff.delivery?.nativeThreadId === providerThread.nativeThreadRef?.nativeId && handoff.delivery?.status === "pending");
-			const resumed = yield* result(uncertainDelivery ? fail$1(new ProviderAdapterTurnStartError({
+			const resumed = yield* result(uncertainDelivery ? fail$2(new ProviderAdapterTurnStartError({
 				driver: session.driver,
 				threadId: projection.thread.id,
 				providerThreadId: providerThread.id,
@@ -32444,7 +33031,7 @@ const layerExecutor = effect(OrchestrationEffectExecutorV2, gen$1(function* () {
 				}).pipe(tapError((cause) => request.subagent === void 0 ? void_ : logWarning("orchestration-v2.subagent-stop-failed", {
 					effectId: effect.id,
 					cause
-				})), catch_((cause) => request.subagent === void 0 && isNonRetryableProviderTurnControlFailure(request.type, pretty(fail$3(cause))) ? void_ : fail$1(cause)), andThen((outcome) => request.subagent !== void 0 && outcome === void 0 ? void_ : threads.dispatch({
+				})), catch_((cause) => request.subagent === void 0 && isNonRetryableProviderTurnControlFailure(request.type, pretty(fail$4(cause))) ? void_ : fail$2(cause)), andThen((outcome) => request.subagent !== void 0 && outcome === void 0 ? void_ : threads.dispatch({
 					type: "thread.background-work.settle",
 					commandId: CommandId.make(`${effect.id}:background-work-settled`),
 					...request.subagent === void 0 || outcome === void 0 ? {} : { subagent: {
@@ -34322,7 +34909,7 @@ const make$36 = gen$1(function* () {
 				args,
 				env: { LC_ALL: "C" },
 				allowNonZeroExit: true
-			}).pipe(catch_((error) => flatMap$1(fs.exists(cwd), (exists) => exists ? fail$1(error) : succeed$1(null))));
+			}).pipe(catch_((error) => flatMap$1(fs.exists(cwd), (exists) => exists ? fail$2(error) : succeed$1(null))));
 			if (result === null) return null;
 			if (result.exitCode === 0 || result.exitCode === allowedExitCode) return result;
 			if (result.stderr.toLowerCase().includes("not a git repository")) return null;
@@ -34392,7 +34979,7 @@ const make$36 = gen$1(function* () {
 			allowNonZeroExit: true,
 			timeoutMs: 3e5
 		});
-		if (result.exitCode !== 0) return yield* fail$1(new GitCommandError({
+		if (result.exitCode !== 0) return yield* fail$2(new GitCommandError({
 			operation: "StorageCleanup.cleanupGit",
 			command,
 			cwd,
@@ -35758,7 +36345,7 @@ function appFromCacheKey(key) {
 	return JSON.parse(key);
 }
 const existingFile = fn("NativeAppIconResolver.existingFile")(function* (filePath) {
-	const info = yield* (yield* FileSystem).stat(filePath).pipe(asSome, catchTags({ PlatformError: (error) => error.reason._tag === "NotFound" ? succeedNone : fail$1(error) }));
+	const info = yield* (yield* FileSystem).stat(filePath).pipe(asSome, catchTags({ PlatformError: (error) => error.reason._tag === "NotFound" ? succeedNone : fail$2(error) }));
 	return isSome(info) && info.value.type === "File" ? filePath : null;
 });
 const commandOutput$1 = fn("NativeAppIconResolver.commandOutput")(function* (command, args) {
@@ -35858,7 +36445,7 @@ const make$32 = gen$1(function* () {
 			onFailure: () => zero
 		})
 	});
-	const cachedFileExists = (filePath) => fileSystem.stat(filePath).pipe(map$3((info) => info.type === "File"), catchTags({ PlatformError: (error) => error.reason._tag === "NotFound" ? succeed$1(false) : fail$1(error) }));
+	const cachedFileExists = (filePath) => fileSystem.stat(filePath).pipe(map$3((info) => info.type === "File"), catchTags({ PlatformError: (error) => error.reason._tag === "NotFound" ? succeed$1(false) : fail$2(error) }));
 	const resolveAttempt = fn("NativeAppIconResolver.resolve")(function* (app) {
 		if (hostPlatform !== "darwin" || app._tag === "display-name" && containsControlCharacter(app.displayName)) return null;
 		const key = appCacheKey(app);
@@ -36105,7 +36692,7 @@ function decodeRelativePath(value) {
 		return null;
 	}
 }
-const optionOnNotFound = (effect) => effect.pipe(asSome, catchTags({ PlatformError: (error) => error.reason._tag === "NotFound" ? succeed$1(none$1()) : fail$1(error) }));
+const optionOnNotFound = (effect) => effect.pipe(asSome, catchTags({ PlatformError: (error) => error.reason._tag === "NotFound" ? succeed$1(none$1()) : fail$2(error) }));
 const readMcpAppHtml = fn("AssetAccess.readMcpAppHtml")(function* (filePath) {
 	const fileSystem = yield* FileSystem;
 	const limit = MCP_APP_MAX_HTML_BYTES + 131072;
@@ -36760,7 +37347,7 @@ function annotateEnvironmentRequest(endpoint) {
 	});
 }
 function failEnvironmentAuthInvalid(reason, dpopFailureReason) {
-	return currentEnvironmentTraceId.pipe(flatMap$1((traceId) => fail$1(new EnvironmentAuthInvalidError({
+	return currentEnvironmentTraceId.pipe(flatMap$1((traceId) => fail$2(new EnvironmentAuthInvalidError({
 		code: "auth_invalid",
 		reason,
 		...dpopFailureReason === void 0 ? {} : { dpopFailureReason },
@@ -36768,28 +37355,28 @@ function failEnvironmentAuthInvalid(reason, dpopFailureReason) {
 	}))));
 }
 function failEnvironmentInvalidRequest(reason) {
-	return currentEnvironmentTraceId.pipe(flatMap$1((traceId) => fail$1(new EnvironmentRequestInvalidError({
+	return currentEnvironmentTraceId.pipe(flatMap$1((traceId) => fail$2(new EnvironmentRequestInvalidError({
 		code: "invalid_request",
 		reason,
 		traceId
 	}))));
 }
 function failEnvironmentScopeRequired(requiredScope) {
-	return currentEnvironmentTraceId.pipe(flatMap$1((traceId) => fail$1(new EnvironmentScopeRequiredError({
+	return currentEnvironmentTraceId.pipe(flatMap$1((traceId) => fail$2(new EnvironmentScopeRequiredError({
 		code: "insufficient_scope",
 		...authScopeRequiredResponse(requiredScope),
 		traceId
 	}))));
 }
 function failEnvironmentOperationForbidden(reason) {
-	return currentEnvironmentTraceId.pipe(flatMap$1((traceId) => fail$1(new EnvironmentOperationForbiddenError({
+	return currentEnvironmentTraceId.pipe(flatMap$1((traceId) => fail$2(new EnvironmentOperationForbiddenError({
 		code: "operation_forbidden",
 		reason,
 		traceId
 	}))));
 }
 function failEnvironmentNotFound(reason) {
-	return currentEnvironmentTraceId.pipe(flatMap$1((traceId) => fail$1(new EnvironmentResourceNotFoundError({
+	return currentEnvironmentTraceId.pipe(flatMap$1((traceId) => fail$2(new EnvironmentResourceNotFoundError({
 		code: "not_found",
 		reason,
 		traceId
@@ -37417,8 +38004,8 @@ function subscribeCodexAuthCallback(input) {
 				return true;
 			}, () => destination, signal),
 			catch: failure
-		}).pipe(tapError((error) => fail$4(ready, error)), forkScoped);
-		return fromEffect(_await(ready)).pipe(map$8(() => ({ phase: "ready" })), concat(fromEffect(join(callback)).pipe(map$8((callbackUrl) => ({
+		}).pipe(tapError((error) => fail$5(ready, error)), forkScoped);
+		return fromEffect(_await(ready)).pipe(map$8(() => ({ phase: "ready" })), concat(fromEffect(join$1(callback)).pipe(map$8((callbackUrl) => ({
 			phase: "finished",
 			callbackUrl
 		})))));
@@ -37785,7 +38372,7 @@ const ResolvedKeybindingFromConfig = KeybindingRule.pipe(decodeTo(toType(Resolve
 	decode: (rule) => succeed$1(compileResolvedKeybindingRule(rule)).pipe(filterOrFail(isNotNull, () => new InvalidValue$1({ message: "Invalid keybinding rule" })), map$3((resolved) => resolved)),
 	encode: (resolved) => gen$1(function* () {
 		const key = encodeShortcut(resolved.shortcut);
-		if (!key) return yield* fail$1(new InvalidValue$1({ message: "Resolved shortcut cannot be encoded to key string" }));
+		if (!key) return yield* fail$2(new InvalidValue$1({ message: "Resolved shortcut cannot be encoded to key string" }));
 		const when = resolved.whenAst ? encodeWhenAst(resolved.whenAst) : void 0;
 		return {
 			key,
@@ -38465,7 +39052,7 @@ const makeThreadLiveEventCoalescer = (options) => gen$1(function* () {
 		yield* succeed$4(cleanupComplete, void 0);
 	}));
 	yield* addFinalizer$1(() => close());
-	yield* budget.failed.pipe(catchTags({ LiveStreamBufferError: (error) => close(fail$3(error)) }), forkScoped);
+	yield* budget.failed.pipe(catchTags({ LiveStreamBufferError: (error) => close(fail$4(error)) }), forkScoped);
 	return {
 		offer: (input) => offerAll$1([input]),
 		close,
@@ -38578,7 +39165,7 @@ const makeProviderMaintenanceCommandCoordinator = fn("makeProviderMaintenanceCom
 		return next;
 	});
 	const withCommandLock = ({ targetKey, lockKey, onQueued, run }) => gen$1(function* () {
-		if (!(yield* acquireTarget(targetKey))) return yield* fail$1(input.makeAlreadyRunningError(targetKey));
+		if (!(yield* acquireTarget(targetKey))) return yield* fail$2(input.makeAlreadyRunningError(targetKey));
 		return yield* (onQueued ?? void_).pipe(andThen(locks.withLock(lockKey, run)), ensuring(releaseTarget(targetKey)));
 	});
 	return { withCommandLock };
@@ -38988,7 +39575,7 @@ const makeCommandGate = gen$1(function* () {
 		}),
 		failCommandReady: (error) => gen$1(function* () {
 			yield* set$2(commandReadinessState, error);
-			yield* fail$4(commandReady, error).pipe(orDie);
+			yield* fail$5(commandReady, error).pipe(orDie);
 		}),
 		enqueueCommand: (effect) => gen$1(function* () {
 			const readinessState = yield* get(commandReadinessState);
@@ -39538,7 +40125,7 @@ const makeWebSocket = /*#__PURE__*/ fnUntraced$1(function* (options) {
 	});
 	yield* callback((resume) => {
 		server.once("error", (error) => {
-			resume(fail$1(new SocketServerError({ reason: new SocketServerOpenError({ cause: error }) })));
+			resume(fail$2(new SocketServerError({ reason: new SocketServerOpenError({ cause: error }) })));
 		});
 		server.once("listening", () => {
 			resume(void_);
@@ -42814,7 +43401,7 @@ const readWorkflowScript = fn("orchestration.readWorkflowScript")(function* (inp
 var VcsProvisioningService = class extends Service()("t3/vcs/VcsProvisioningService") {};
 function resolveRequestedKind(kind) {
 	if (kind === void 0) return succeed$1("git");
-	if (kind === "unknown") return fail$1(new VcsUnsupportedOperationError({
+	if (kind === "unknown") return fail$2(new VcsUnsupportedOperationError({
 		operation: "VcsProvisioningService.resolveRequestedKind",
 		kind,
 		detail: "A concrete VCS driver kind is required for repository provisioning."
@@ -42905,7 +43492,7 @@ const make$19 = gen$1(function* () {
 	const knownWorkspaces = yield* KnownWorkspaces;
 	const canonicalizePath = (value) => {
 		const resolvedPath = path.resolve(value);
-		return fileSystem.realPath(resolvedPath).pipe(catchTags({ PlatformError: (cause) => cause.reason._tag === "NotFound" ? succeed$1(resolvedPath) : fail$1(new VcsRepositoryDetectionError({
+		return fileSystem.realPath(resolvedPath).pipe(catchTags({ PlatformError: (cause) => cause.reason._tag === "NotFound" ? succeed$1(resolvedPath) : fail$2(new VcsRepositoryDetectionError({
 			operation: "ReviewService.assertWorkspaceBoundCwd.canonicalizePath",
 			cwd: resolvedPath,
 			detail: "Failed to resolve a path while validating the review workspace.",
@@ -43362,7 +43949,7 @@ const requiredScopesForRpcCall = (method, payload) => {
 };
 const layer$32 = (scopes) => succeed$3(RpcScopeAuthorization)((effect, { rpc, payload }) => {
 	const requiredScope = requiredScopesForRpcCall(rpc._tag, payload).find((scope) => !scopes.includes(scope));
-	return requiredScope === void 0 ? effect : fail$1(rpcAuthorizationError(requiredScope));
+	return requiredScope === void 0 ? effect : fail$2(rpcAuthorizationError(requiredScope));
 });
 /** Retrying can install or restart tools even though ordinary listing is readable. */
 const requiredScopeForDeviceList = (input) => input.retryHostId || input.updateTool ? AuthOrchestrationOperateScope : AuthOrchestrationReadScope;
@@ -46229,7 +46816,7 @@ function makeTraceDiagnosticsAggregator(slowSpanThresholdMs = DEFAULT_SLOW_SPAN_
 * Succeeds with false when the file does not exist.
 */
 function streamTraceFileLines(fileSystem, path, onLine) {
-	return fileSystem.stream(path).pipe(decodeText, splitLines, runForEachArray((lines) => sync$1(() => lines.forEach(onLine))), as(true), catchTags({ PlatformError: (cause) => isNotFoundError(cause) ? succeed$1(false) : fail$1(new TraceFileReadError({
+	return fileSystem.stream(path).pipe(decodeText, splitLines, runForEachArray((lines) => sync$1(() => lines.forEach(onLine))), as(true), catchTags({ PlatformError: (cause) => isNotFoundError(cause) ? succeed$1(false) : fail$2(new TraceFileReadError({
 		traceFilePath: path,
 		causeTag: cause.reason._tag,
 		cause
@@ -47401,7 +47988,7 @@ const layerWsRpc = (currentSession, clientOrigin, clientAnalyticsProps, previewA
 	const resourceTelemetry = yield* ResourceTelemetry;
 	const relayClient = yield* RelayClient;
 	const withVisibleWebhookUrls = (result) => currentSession.scopes.includes("orchestration:operate") ? result : { tasks: result.tasks.map(({ webhook: _webhook, ...task }) => task) };
-	const authorizeEffect = (requiredScope, effect) => currentSession.scopes.includes(requiredScope) ? effect : fail$1(rpcAuthorizationError(requiredScope));
+	const authorizeEffect = (requiredScope, effect) => currentSession.scopes.includes(requiredScope) ? effect : fail$2(rpcAuthorizationError(requiredScope));
 	const acpRegistryProject = fn("ws.acpRegistry.project")(function* (projectId) {
 		const project = yield* projectService.getById(projectId).pipe(mapError((cause) => new AcpRegistryOperationError({
 			reason: "project_not_found",
@@ -47409,7 +47996,7 @@ const layerWsRpc = (currentSession, clientOrigin, clientAnalyticsProps, previewA
 			cause
 		})));
 		return yield* match$1(project, {
-			onNone: () => fail$1(new AcpRegistryOperationError({
+			onNone: () => fail$2(new AcpRegistryOperationError({
 				reason: "project_not_found",
 				message: `Project ${projectId} was not found.`
 			})),
@@ -47914,16 +48501,16 @@ const layerWsRpc = (currentSession, clientOrigin, clientAnalyticsProps, previewA
 			const projection = yield* threadManagement.getThreadRecords(input.threadId, ["providerThreads"]);
 			const providerThread = projection.providerThreads.find((candidate) => candidate.id === projection.thread.activeProviderThreadId) ?? projection.providerThreads.at(-1);
 			const providerSessionId = providerThread?.providerSessionId ?? null;
-			if (providerThread === void 0 || providerSessionId === null) return yield* fail$1(new ProviderUploadFeedbackError({
+			if (providerThread === void 0 || providerSessionId === null) return yield* fail$2(new ProviderUploadFeedbackError({
 				threadId: input.threadId,
 				cause: "No provider session has run in this thread yet."
 			}));
 			const runtime = getOrNull(yield* providerSessionsV2.get(providerSessionId));
-			if (runtime === null) return yield* fail$1(new ProviderUploadFeedbackError({
+			if (runtime === null) return yield* fail$2(new ProviderUploadFeedbackError({
 				threadId: input.threadId,
 				cause: "The provider session is no longer running. Send a message first."
 			}));
-			if (runtime.uploadFeedback === void 0) return yield* fail$1(new ProviderUploadFeedbackError({
+			if (runtime.uploadFeedback === void 0) return yield* fail$2(new ProviderUploadFeedbackError({
 				threadId: input.threadId,
 				cause: `Provider '${runtime.driver}' does not support feedback uploads.`
 			}));
@@ -47977,7 +48564,7 @@ const layerWsRpc = (currentSession, clientOrigin, clientAnalyticsProps, previewA
 		}).pipe(asVoid)).pipe(flatMap$1((result) => offer(queue, {
 			type: "complete",
 			result
-		})), catchTags({ ServerSelfUpdateError: (error) => fail$6(queue, error) }), andThen(end(queue)), forkScoped)),
+		})), catchTags({ ServerSelfUpdateError: (error) => fail$7(queue, error) }), andThen(end(queue)), forkScoped)),
 		[WS_METHODS.serverCommitDesktopUpdate]: (input) => serverSelfUpdate.commitDesktopUpdate(input.requestId),
 		[WS_METHODS.serverUpsertKeybinding]: (rule) => gen$1(function* () {
 			return {
@@ -48029,7 +48616,7 @@ const layerWsRpc = (currentSession, clientOrigin, clientAnalyticsProps, previewA
 		[WS_METHODS.cloudInstallRelayClient]: (_input) => callback$1((queue) => relayClient.installWithProgress((event) => offer(queue, event).pipe(asVoid)).pipe(flatMap$1((status) => offer(queue, {
 			type: "complete",
 			status
-		})), catchTags({ RelayClientInstallError: (error) => fail$6(queue, new RelayClientInstallFailedError({
+		})), catchTags({ RelayClientInstallError: (error) => fail$7(queue, new RelayClientInstallFailedError({
 			reason: error.reason,
 			message: error.message
 		})) }), andThen(end(queue)), forkScoped)),
@@ -48671,7 +49258,7 @@ const ensureNodePtySpawnHelperExecutable = fn(function* () {
 */
 const waitForWindowsPid = (process, trackedProcess, shell) => callback((resume) => {
 	const hasPid = () => Number.isInteger(process.pid) && process.pid > 0;
-	const failure = (cause) => fail$1(new PtySpawnError({
+	const failure = (cause) => fail$2(new PtySpawnError({
 		adapter: "node-pty",
 		shell,
 		cause
@@ -49006,7 +49593,7 @@ const makeHandler = (browser) => gen$1(function* () {
 			ServerBrowserTabNotFoundError: () => succeed$1({ _tag: "gone" }),
 			ServerBrowserLaunchError: (error) => {
 				const setup = hostSetup(error.cause);
-				return setup === void 0 ? fail$1(error) : succeed$1({
+				return setup === void 0 ? fail$2(error) : succeed$1({
 					_tag: "hostSetup",
 					reason: encodeHostSetup(setup)
 				});
@@ -49866,7 +50453,7 @@ var CloudLinkInternalError = class extends TaggedError()("CloudLinkInternalError
 		return INTERNAL_OPERATION_MESSAGES[this.operation];
 	}
 };
-const internalError = (operation) => (cause) => fail$1(new CloudLinkInternalError({
+const internalError = (operation) => (cause) => fail$2(new CloudLinkInternalError({
 	operation,
 	cause
 }));
@@ -49893,14 +50480,14 @@ function stringToBytes(value) {
 	return new TextEncoder().encode(value);
 }
 function consumeCloudReplayGuards(input) {
-	return forEach(input.names, (name) => input.secrets.create(name, input.value).pipe(as(true), catchIf(isSecretStoreError, (error) => isSecretAlreadyExistsError(error) ? succeed$1(false) : fail$1(error))), { concurrency: input.names.length }).pipe(map$3((created) => created.every(Boolean)));
+	return forEach(input.names, (name) => input.secrets.create(name, input.value).pipe(as(true), catchIf(isSecretStoreError, (error) => isSecretAlreadyExistsError(error) ? succeed$1(false) : fail$2(error))), { concurrency: input.names.length }).pipe(map$3((created) => created.every(Boolean)));
 }
 function validateCloudMintPublicKey(publicKey) {
 	const invalid = new CloudLinkRelayConfigInvalidError({ field: "cloudMintPublicKey" });
 	return try_({
 		try: () => NodeCrypto.createPublicKey(publicKey.replace(/\\n/g, "\n")),
 		catch: () => invalid
-	}).pipe(flatMap$1((key) => key.asymmetricKeyType === "ed25519" ? void_ : fail$1(invalid)));
+	}).pipe(flatMap$1((key) => key.asymmetricKeyType === "ed25519" ? void_ : fail$2(invalid)));
 }
 function invalidRelayConfigField(payload) {
 	if (!isSecureRelayUrl(payload.relayUrl)) return "relayUrl";
@@ -49911,7 +50498,7 @@ function invalidRelayConfigField(payload) {
 }
 function validateRelayConfigPayload(payload) {
 	const field = invalidRelayConfigField(payload);
-	return field === null ? void_ : fail$1(new CloudLinkRelayConfigInvalidError({ field }));
+	return field === null ? void_ : fail$2(new CloudLinkRelayConfigInvalidError({ field }));
 }
 function normalizePemForSignedPayload(value) {
 	return value.trim();
@@ -49936,9 +50523,9 @@ const make$3 = gen$1(function* () {
 	const withRuntimeFiles = (effect) => effect.pipe(provideService(ServerConfig, config), provideService(FileSystem, fileSystem), provideService(Path, path));
 	const validateLinkedCloudUser = (cloudUserId) => secrets.get(CLOUD_LINKED_USER_ID).pipe(mapError((cause) => new ServerAuthLinkedCloudAccountVerificationError({ cause })), flatMap$1((existing) => {
 		if (isNone(existing)) return void_;
-		return bytesToString(existing.value) === cloudUserId ? void_ : fail$1(new CloudLinkAccountMismatchError({}));
+		return bytesToString(existing.value) === cloudUserId ? void_ : fail$2(new CloudLinkAccountMismatchError({}));
 	}));
-	const readInstalledCloudUserId = secrets.get(CLOUD_LINKED_USER_ID).pipe(mapError((cause) => new ServerAuthLinkedCloudAccountReadError({ cause })), flatMap$1((bytes) => isSome(bytes) ? succeed$1(bytesToString(bytes.value)) : fail$1(new ServerAuthLinkedCloudAccountMissingError({}))));
+	const readInstalledCloudUserId = secrets.get(CLOUD_LINKED_USER_ID).pipe(mapError((cause) => new ServerAuthLinkedCloudAccountReadError({ cause })), flatMap$1((bytes) => isSome(bytes) ? succeed$1(bytesToString(bytes.value)) : fail$2(new ServerAuthLinkedCloudAccountMissingError({}))));
 	const makeCloudLinkProof = fn("environment.cloud.makeLinkProof")(function* (request, requestUrl) {
 		const keyPair = yield* getOrCreateEnvironmentKeyPairFromSecretStore(secrets);
 		if (!isSupportedLinkProviderKind(request) || !isAllowedEndpointOrigin({
@@ -50075,7 +50662,7 @@ const make$3 = gen$1(function* () {
 			catch: () => new CloudLinkOriginInvalidError({ origin: "local" })
 		});
 		const token = yield* cliTokenManager.getExisting.pipe(flatMap$1(match$1({
-			onNone: () => fail$1(new CloudLinkAuthorizationMissingError({})),
+			onNone: () => fail$2(new CloudLinkAuthorizationMissingError({})),
 			onSome: succeed$1
 		})));
 		const mode = yield* readCliDesiredLinkMode.pipe(withSecrets);
@@ -50224,7 +50811,7 @@ const make$3 = gen$1(function* () {
 				proof
 			},
 			schema: RelayManagedEndpointRecoveryRegistrationResponse
-		}).pipe(catchTags({ RelayRequestError: (error) => error.rejection === "unauthorized" ? markLinkRevoked(credential, error).pipe(map$3((marked) => marked ? "revoked" : "superseded")) : fail$1(error) }));
+		}).pipe(catchTags({ RelayRequestError: (error) => error.rejection === "unauthorized" ? markLinkRevoked(credential, error).pipe(map$3((marked) => marked ? "revoked" : "superseded")) : fail$2(error) }));
 		if (registered === "revoked" || registered === "superseded") return { status: registered };
 		yield* secrets.remove(CLOUD_LINK_REVOKED);
 		if (registered.status === "recovery_required") return {
@@ -50426,8 +51013,8 @@ const make$3 = gen$1(function* () {
 		return yield* readCloudLinkState();
 	}, catchIf(isSecretStoreError, internalError("read-preferences")));
 	const answerHealthRequest = fn("environment.cloud.health")(function* (request) {
-		const cloudMintPublicKey = yield* secrets.get(CLOUD_MINT_PUBLIC_KEY).pipe(flatMap$1((bytes) => isSome(bytes) ? succeed$1(bytesToString(bytes.value)) : fail$1(new ServerAuthCloudMintPublicKeyMissingError({}))));
-		const relayIssuer = yield* secrets.get(RELAY_ISSUER_SECRET).pipe(flatMap$1((bytes) => isSome(bytes) ? succeed$1(bytesToString(bytes.value)) : secrets.get(RELAY_URL_SECRET).pipe(flatMap$1((fallbackBytes) => isSome(fallbackBytes) ? succeed$1(bytesToString(fallbackBytes.value)) : fail$1(new ServerAuthCloudRelayIssuerMissingError({}))))));
+		const cloudMintPublicKey = yield* secrets.get(CLOUD_MINT_PUBLIC_KEY).pipe(flatMap$1((bytes) => isSome(bytes) ? succeed$1(bytesToString(bytes.value)) : fail$2(new ServerAuthCloudMintPublicKeyMissingError({}))));
+		const relayIssuer = yield* secrets.get(RELAY_ISSUER_SECRET).pipe(flatMap$1((bytes) => isSome(bytes) ? succeed$1(bytesToString(bytes.value)) : secrets.get(RELAY_URL_SECRET).pipe(flatMap$1((fallbackBytes) => isSome(fallbackBytes) ? succeed$1(bytesToString(fallbackBytes.value)) : fail$2(new ServerAuthCloudRelayIssuerMissingError({}))))));
 		const environmentId = yield* environment.getEnvironmentId;
 		const linkedCloudUserId = yield* readInstalledCloudUserId;
 		const now$4 = yield* now;
@@ -50485,8 +51072,8 @@ const make$3 = gen$1(function* () {
 		};
 	}, catchIf(isSecretStoreError, internalError("answer-health")), catchTags({ PlatformError: internalError("answer-health") }));
 	const mintCredential = fn("environment.cloud.mintCredential")(function* (request) {
-		const cloudMintPublicKey = yield* secrets.get(CLOUD_MINT_PUBLIC_KEY).pipe(flatMap$1((bytes) => isSome(bytes) ? succeed$1(bytesToString(bytes.value)) : fail$1(new ServerAuthCloudMintPublicKeyMissingError({}))));
-		const relayIssuer = yield* secrets.get(RELAY_ISSUER_SECRET).pipe(flatMap$1((bytes) => isSome(bytes) ? succeed$1(bytesToString(bytes.value)) : secrets.get(RELAY_URL_SECRET).pipe(flatMap$1((fallbackBytes) => isSome(fallbackBytes) ? succeed$1(bytesToString(fallbackBytes.value)) : fail$1(new ServerAuthCloudRelayIssuerMissingError({}))))));
+		const cloudMintPublicKey = yield* secrets.get(CLOUD_MINT_PUBLIC_KEY).pipe(flatMap$1((bytes) => isSome(bytes) ? succeed$1(bytesToString(bytes.value)) : fail$2(new ServerAuthCloudMintPublicKeyMissingError({}))));
+		const relayIssuer = yield* secrets.get(RELAY_ISSUER_SECRET).pipe(flatMap$1((bytes) => isSome(bytes) ? succeed$1(bytesToString(bytes.value)) : secrets.get(RELAY_URL_SECRET).pipe(flatMap$1((fallbackBytes) => isSome(fallbackBytes) ? succeed$1(bytesToString(fallbackBytes.value)) : fail$2(new ServerAuthCloudRelayIssuerMissingError({}))))));
 		const environmentId = yield* environment.getEnvironmentId;
 		const linkedCloudUserId = yield* readInstalledCloudUserId;
 		const now$2 = yield* now;
@@ -50584,7 +51171,7 @@ const pruneExpiredReplayMarkers = fn("replayMarkers.pruneExpired")(function* ()
 	const markers = (yield* fileSystem.readDirectory(secretsDir)).filter((name) => name.endsWith(".bin") && REPLAY_MARKER_PREFIXES.some((prefix) => name.startsWith(prefix)));
 	const [removed, failures] = yield* partition(markers, (name) => {
 		const markerPath = path.join(secretsDir, name);
-		return fileSystem.stat(markerPath).pipe(flatMap$1((info) => exists(info.mtime, (mtime) => mtime.getTime() < cutoff) ? fileSystem.remove(markerPath).pipe(as(true)) : succeed$1(false)), catchReason("PlatformError", "NotFound", () => succeed$1(false)));
+		return fileSystem.stat(markerPath).pipe(flatMap$1((info) => exists$1(info.mtime, (mtime) => mtime.getTime() < cutoff) ? fileSystem.remove(markerPath).pipe(as(true)) : succeed$1(false)), catchReason("PlatformError", "NotFound", () => succeed$1(false)));
 	});
 	yield* annotateCurrentSpan({
 		"replay_markers.matched": markers.length,
@@ -50940,7 +51527,7 @@ const make$1 = gen$1(function* () {
 	});
 	const approve = (input) => gen$1(function* () {
 		const { decision } = input;
-		if (decision._tag === "pairing-code") yield* environmentAuth.consumeMcpApprovalCode(decision.code, decision.access).pipe(catchIf(isServerAuthInternalError, (cause) => logError("MCP approval code check failed.", { cause }).pipe(andThen(fail$1(new McpOAuthPageError({ description: "The code could not be checked. Try again." }))))));
+		if (decision._tag === "pairing-code") yield* environmentAuth.consumeMcpApprovalCode(decision.code, decision.access).pipe(catchIf(isServerAuthInternalError, (cause) => logError("MCP approval code check failed.", { cause }).pipe(andThen(fail$2(new McpOAuthPageError({ description: "The code could not be checked. Try again." }))))));
 		else {
 			const session = yield* approvingBrowserSession(input.request, input.authorization);
 			if (session === void 0 || !timingSafeEqualBase64Url(decision.csrfToken, session.csrfToken) || !mcpClientScopes(decision.access).every((scope) => session.scopes.includes(scope))) return yield* new McpOAuthPageError({ description: "Your session cannot approve this request. Enter a pairing code instead." });
@@ -50985,7 +51572,7 @@ const make$1 = gen$1(function* () {
 			label: pending.clientName,
 			access: pending.access,
 			client: deriveAuthClientMetadata({ request })
-		}).pipe(catch_((cause) => logError("Could not issue an MCP client session.", { cause }).pipe(andThen(fail$1(fail("invalid_grant", "The session could not be issued."))))));
+		}).pipe(catch_((cause) => logError("Could not issue an MCP client session.", { cause }).pipe(andThen(fail$2(fail("invalid_grant", "The session could not be issued."))))));
 		return {
 			access_token: issued.token,
 			token_type: "Bearer",
@@ -51087,7 +51674,7 @@ const forwardedAuthorization = (oauth, request) => gen$1(function* () {
 		urls,
 		request
 	}).pipe(catchTags({
-		McpOAuthPageError: (error) => fail$1(new AuthMcpApprovalError({ message: error.description })),
+		McpOAuthPageError: (error) => fail$2(new AuthMcpApprovalError({ message: error.description })),
 		McpOAuthRedirectError: (error) => succeed$1({ redirectTo: redirectForError(error, urls.issuer) })
 	}));
 });
@@ -51161,19 +51748,19 @@ const CLOUD_CREDENTIAL_RESPONSE_HEADERS = {
 	pragma: "no-cache"
 };
 const appendCloudCredentialResponseHeaders = appendPreResponseHandler((_request, response) => succeed$1(setHeaders(response, CLOUD_CREDENTIAL_RESPONSE_HEADERS)));
-const internalServerError = (error, cause) => logError(error.message, { cause }).pipe(andThen(fail$1(new EnvironmentHttpInternalServerError({ message: error.message }))));
+const internalServerError = (error, cause) => logError(error.message, { cause }).pipe(andThen(fail$2(new EnvironmentHttpInternalServerError({ message: error.message }))));
 const relayFailure = (error) => {
 	const message = error.message;
 	switch (error.rejection) {
-		case "unauthorized": return fail$1(new EnvironmentHttpUnauthorizedError({ message }));
-		case "forbidden": return fail$1(new EnvironmentHttpForbiddenError({ message }));
-		case "rejected": return fail$1(new EnvironmentHttpBadRequestError({ message }));
-		case "unavailable": return fail$1(new EnvironmentHttpInternalServerError({ message }));
+		case "unauthorized": return fail$2(new EnvironmentHttpUnauthorizedError({ message }));
+		case "forbidden": return fail$2(new EnvironmentHttpForbiddenError({ message }));
+		case "rejected": return fail$2(new EnvironmentHttpBadRequestError({ message }));
+		case "unavailable": return fail$2(new EnvironmentHttpInternalServerError({ message }));
 	}
 };
-const badRequest = (error) => fail$1(new EnvironmentHttpBadRequestError({ message: error.message }));
-const unauthorized = (error) => fail$1(new EnvironmentHttpUnauthorizedError({ message: error.message }));
-const conflict = (error) => fail$1(new EnvironmentHttpConflictError({ message: error.message }));
+const badRequest = (error) => fail$2(new EnvironmentHttpBadRequestError({ message: error.message }));
+const unauthorized = (error) => fail$2(new EnvironmentHttpUnauthorizedError({ message: error.message }));
+const conflict = (error) => fail$2(new EnvironmentHttpConflictError({ message: error.message }));
 const connectErrorCases = {
 	CloudLinkRelayConfigInvalidError: badRequest,
 	CloudLinkOriginInvalidError: badRequest,
@@ -51189,7 +51776,7 @@ const connectErrorCases = {
 const toHttpError = (effect) => effect.pipe(catchTags(connectErrorCases), catchIf(isServerAuthInternalError, (error) => internalServerError(error, error)));
 const toHttpErrorOrUnavailable = (effect) => effect.pipe(catchTags({
 	...connectErrorCases,
-	CloudLinkEndpointUnavailableError: (error) => fail$1(new EnvironmentCloudEndpointUnavailableError({
+	CloudLinkEndpointUnavailableError: (error) => fail$2(new EnvironmentCloudEndpointUnavailableError({
 		message: error.message,
 		endpointRuntimeStatus: error.endpointRuntimeStatus
 	}))
@@ -51901,7 +52488,7 @@ const resolveNewestVersion = fn("cli.update.resolve_newest")(function* (channel)
 	for (let page = 1; page <= RELEASE_INDEX_MAX_PAGES; page += 1) {
 		const body = yield* httpClient.execute(get$2(cliReleaseIndexPageUrl(page)).pipe(setHeader$1("Accept", "application/vnd.github+json"))).pipe(flatMap$1(filterStatusOk), flatMap$1((response) => response.text), mapError(() => new CliUpdateError({ reason: "Could not list t3 releases." })), timeoutOrElse({
 			duration: RELEASE_INDEX_TIMEOUT,
-			orElse: () => fail$1(new CliUpdateError({ reason: "Timed out listing t3 releases." }))
+			orElse: () => fail$2(new CliUpdateError({ reason: "Timed out listing t3 releases." }))
 		}));
 		const releases = yield* decodeReleaseIndex(body).pipe(mapError(() => new CliUpdateError({ reason: "The t3 release index had an unexpected shape." })));
 		const version = newestCliReleaseVersion(releases, channel);
@@ -52122,11 +52709,11 @@ const runUpdate = fn("cli.update.run")(function* (input) {
 		}).pipe(mapError((cause) => new PinnedRuntimeInstallError({
 			step: "verifying the downloaded t3",
 			cause
-		})), flatMap$1((result) => result.code === 0 && /\bv(\S+)\s*$/.exec(result.stdout)?.[1] === targetVersion ? void_ : fail$1(new PinnedRuntimeInstallError({
+		})), flatMap$1((result) => result.code === 0 && /\bv(\S+)\s*$/.exec(result.stdout)?.[1] === targetVersion ? void_ : fail$2(new PinnedRuntimeInstallError({
 			step: "verifying the downloaded t3",
 			exitCode: Number(result.code)
 		}))))
-	}).pipe(ensuring(sync$1(progress.finish)), catchIf((error) => error._tag === "PinnedRuntimeInstallError" && error.step.startsWith("downloading the t3 release checksums") && String(error.cause).includes("404"), () => fail$1(new CliUpdateError({ reason: `No release archive was published for t3@${targetVersion}.` }))));
+	}).pipe(ensuring(sync$1(progress.finish)), catchIf((error) => error._tag === "PinnedRuntimeInstallError" && error.step.startsWith("downloading the t3 release checksums") && String(error.cause).includes("404"), () => fail$2(new CliUpdateError({ reason: `No release archive was published for t3@${targetVersion}.` }))));
 	const launchedAs = (yield* IsExecutable) ? yield* resolveLauncherPath : void 0;
 	const repointed = yield* repointLauncher({
 		launchedAs,
@@ -53803,7 +54390,7 @@ const runInteractiveSession = (input) => callback((resume) => {
 		],
 		shell: input.shell
 	});
-	child.once("error", (cause) => resume(fail$1(new TriageAgentSpawnError({
+	child.once("error", (cause) => resume(fail$2(new TriageAgentSpawnError({
 		command: input.command,
 		cause
 	}))));
@@ -53890,12 +54477,12 @@ var ConnectPublicConfigMissingError = class extends UserError {
 		return connectPublicConfigMissingMessage;
 	}
 };
-const connectUnavailableCommand = make$62("connect", { command: String$2("command").pipe(variadic) }).pipe(withDescription("T3 Connect is unavailable in builds without public configuration."), unlisted, withHandler(() => fail$1(new ShowHelp({
+const connectUnavailableCommand = make$62("connect", { command: String$2("command").pipe(variadic) }).pipe(withDescription("T3 Connect is unavailable in builds without public configuration."), unlisted, withHandler(() => fail$2(new ShowHelp({
 	commandPath: ["t3", "connect"],
 	errors: [new ConnectPublicConfigMissingError({ cause: connectPublicConfigMissingMessage })]
 }))));
 const makeCli = ({ cloudEnabled = hasCloudPublicConfig } = {}) => make$62("t3", { ...sharedServerCommandFlags }).pipe(withDescription("Run the T3 Code server."), withHandler(runDefaultServerCommand), withSubcommands([
-	make$62("help").pipe(withDescription("Show command help."), withHandler(() => fail$1(new ShowHelp({
+	make$62("help").pipe(withDescription("Show command help."), withHandler(() => fail$2(new ShowHelp({
 		commandPath: ["t3"],
 		errors: []
 	})))),
@@ -53930,4 +54517,4 @@ function runCli() {
 //#endregion
 export { runCli };
 
-//# sourceMappingURL=binCli-BRnHIlUQ.mjs.map
+//# sourceMappingURL=binCli-BXUdYHGg.mjs.map