ryco-cli 0.1.6 → 0.1.7

package/dist/bin.cjs

@@ -2,9 +2,9 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-jM1PLTSZ.cjs");
-const require_collectUint8StreamText = require("./collectUint8StreamText-TCG6xW_P.cjs");
-const require_SourceControlProviderDiscoveryCatalog = require("./SourceControlProviderDiscoveryCatalog-_rg0mc1o.cjs");
+const require_collectUint8StreamText = require("./collectUint8StreamText-uNXVRHOf.cjs");
 const require_Metrics = require("./Metrics-CIW1QH7M.cjs");
+const require_SourceControlProviderDiscoveryCatalog = require("./SourceControlProviderDiscoveryCatalog-DeFR5xH3.cjs");
 const require_sourceControl = require("./sourceControl-x2t62T8h.cjs");
 let _effect_platform_node_NodeRuntime = require("@effect/platform-node/NodeRuntime");
 _effect_platform_node_NodeRuntime = require_chunk.__toESM(_effect_platform_node_NodeRuntime, 1);
@@ -44,13 +44,13 @@ let effect_unstable_rpc = require("effect/unstable/rpc");
 let effect_unstable_process = require("effect/unstable/process");
 let effect_Semaphore = require("effect/Semaphore");
 effect_Semaphore = require_chunk.__toESM(effect_Semaphore, 1);
+let effect_Random = require("effect/Random");
+effect_Random = require_chunk.__toESM(effect_Random, 1);
 require("effect/PlatformError");
 let effect_unstable_sql_SqlClient = require("effect/unstable/sql/SqlClient");
 effect_unstable_sql_SqlClient = require_chunk.__toESM(effect_unstable_sql_SqlClient, 1);
 let effect_unstable_sql_Migrator = require("effect/unstable/sql/Migrator");
 effect_unstable_sql_Migrator = require_chunk.__toESM(effect_unstable_sql_Migrator, 1);
-let effect_Random = require("effect/Random");
-effect_Random = require_chunk.__toESM(effect_Random, 1);
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises, 1);
 let effect_Context = require("effect/Context");
@@ -72,9 +72,9 @@ let effect_SchemaIssue = require("effect/SchemaIssue");
 effect_SchemaIssue = require_chunk.__toESM(effect_SchemaIssue, 1);
 let effect_Sink = require("effect/Sink");
 effect_Sink = require_chunk.__toESM(effect_Sink, 1);
-let effect_Number = require("effect/Number");
 let effect_unstable_sql_SqlSchema = require("effect/unstable/sql/SqlSchema");
 effect_unstable_sql_SqlSchema = require_chunk.__toESM(effect_unstable_sql_SqlSchema, 1);
+let effect_Number = require("effect/Number");
 let node_url = require("node:url");
 let _pierre_diffs = require("@pierre/diffs");
 let node_perf_hooks = require("node:perf_hooks");
@@ -336,7 +336,7 @@ function applyClaudePromptEffortPrefix(text, effort) {
 }
 //#endregion
 //#region ../../packages/shared/src/serverSettings.ts
-const ServerSettingsJson$1 = require_SourceControlProviderDiscoveryCatalog.fromLenientJson(require_collectUint8StreamText.ServerSettings);
+const ServerSettingsJson$1 = require_collectUint8StreamText.fromLenientJson(require_collectUint8StreamText.ServerSettings);
 function normalizePersistedServerSettingString(value) {
 	const trimmed = value?.trim();
 	return trimmed && trimmed.length > 0 ? trimmed : void 0;
@@ -424,7 +424,7 @@ const readBootstrapEnvelope = effect.Effect.fn("readBootstrapEnvelope")(function
 			})));
 		};
 		const handleLine = (line) => {
-			const parsed = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(schema)(line);
+			const parsed = require_collectUint8StreamText.decodeJsonResult(schema)(line);
 			if (effect.Result.isSuccess(parsed)) resume(effect.Effect.succeedSome(parsed.success));
 			else resume(effect.Effect.fail(new BootstrapError({
 				message: "Failed to decode bootstrap envelope.",
@@ -1657,6 +1657,388 @@ const makeProviderMaintenanceCommandCoordinator = effect.Effect.fn("makeProvider
 	return { withCommandLock };
 });
 //#endregion
+//#region src/atomicWrite.ts
+const writeFileStringAtomically = (input) => effect.Effect.scoped(effect.Effect.gen(function* () {
+	const fs = yield* effect.FileSystem.FileSystem;
+	const path = yield* effect.Path.Path;
+	const tempFileId = yield* effect_Random.nextUUIDv4;
+	const targetDirectory = path.dirname(input.filePath);
+	yield* fs.makeDirectory(targetDirectory, { recursive: true });
+	const tempDirectory = yield* fs.makeTempDirectoryScoped({
+		directory: targetDirectory,
+		prefix: `${path.basename(input.filePath)}.`
+	});
+	const tempPath = path.join(tempDirectory, `${tempFileId}.tmp`);
+	yield* fs.writeFileString(tempPath, input.contents);
+	yield* fs.rename(tempPath, input.filePath);
+}));
+//#endregion
+//#region src/auth/Services/ServerSecretStore.ts
+var SecretStoreError = class extends effect.Data.TaggedError("SecretStoreError") {};
+var ServerSecretStore = class extends effect.Context.Service()("ryco/auth/Services/ServerSecretStore") {};
+//#endregion
+//#region src/auth/Layers/ServerSecretStore.ts
+const makeServerSecretStore = effect.Effect.gen(function* () {
+	const fileSystem = yield* effect.FileSystem.FileSystem;
+	const path = yield* effect.Path.Path;
+	const serverConfig = yield* require_Metrics.ServerConfig;
+	yield* fileSystem.makeDirectory(serverConfig.secretsDir, { recursive: true });
+	yield* fileSystem.chmod(serverConfig.secretsDir, 448).pipe(effect.Effect.mapError((cause) => new SecretStoreError({
+		message: `Failed to secure secrets directory ${serverConfig.secretsDir}.`,
+		cause
+	})));
+	const resolveSecretPath = (name) => path.join(serverConfig.secretsDir, `${name}.bin`);
+	const ensureSecretDirectory = (secretPath) => {
+		const directory = path.dirname(secretPath);
+		return fileSystem.makeDirectory(directory, { recursive: true }).pipe(effect.Effect.flatMap(() => fileSystem.chmod(directory, 448)));
+	};
+	const isPlatformError = (u) => effect.Predicate.isTagged(u, "PlatformError");
+	const get = (name) => fileSystem.readFile(resolveSecretPath(name)).pipe(effect.Effect.map((bytes) => Uint8Array.from(bytes)), effect.Effect.catch((cause) => cause.reason._tag === "NotFound" ? effect.Effect.succeed(null) : effect.Effect.fail(new SecretStoreError({
+		message: `Failed to read secret ${name}.`,
+		cause
+	}))));
+	const set = (name, value) => {
+		const secretPath = resolveSecretPath(name);
+		const tempPath = `${secretPath}.${node_crypto.randomUUID()}.tmp`;
+		return effect.Effect.gen(function* () {
+			yield* ensureSecretDirectory(secretPath);
+			yield* fileSystem.writeFile(tempPath, value);
+			yield* fileSystem.chmod(tempPath, 384);
+			yield* fileSystem.rename(tempPath, secretPath);
+			yield* fileSystem.chmod(secretPath, 384);
+		}).pipe(effect.Effect.catch((cause) => fileSystem.remove(tempPath).pipe(effect.Effect.ignore, effect.Effect.flatMap(() => effect.Effect.fail(new SecretStoreError({
+			message: `Failed to persist secret ${name}.`,
+			cause
+		}))))));
+	};
+	const create = (name, value) => {
+		const secretPath = resolveSecretPath(name);
+		return effect.Effect.scoped(effect.Effect.gen(function* () {
+			yield* ensureSecretDirectory(secretPath);
+			const file = yield* fileSystem.open(secretPath, {
+				flag: "wx",
+				mode: 384
+			});
+			yield* file.writeAll(value);
+			yield* file.sync;
+			yield* fileSystem.chmod(secretPath, 384);
+		})).pipe(effect.Effect.mapError((cause) => new SecretStoreError({
+			message: `Failed to persist secret ${name}.`,
+			cause
+		})));
+	};
+	const getOrCreateRandom = (name, bytes) => get(name).pipe(effect.Effect.flatMap((existing) => {
+		if (existing) return effect.Effect.succeed(existing);
+		const generated = node_crypto.randomBytes(bytes);
+		return create(name, generated).pipe(effect.Effect.as(Uint8Array.from(generated)), effect.Effect.catchTag("SecretStoreError", (error) => isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists" ? get(name).pipe(effect.Effect.flatMap((created) => created !== null ? effect.Effect.succeed(created) : effect.Effect.fail(new SecretStoreError({ message: `Failed to read secret ${name} after concurrent creation.` })))) : effect.Effect.fail(error)));
+	}));
+	const remove = (name) => fileSystem.remove(resolveSecretPath(name)).pipe(effect.Effect.catch((cause) => cause.reason._tag === "NotFound" ? effect.Effect.void : effect.Effect.fail(new SecretStoreError({
+		message: `Failed to remove secret ${name}.`,
+		cause
+	}))));
+	return {
+		get,
+		set,
+		getOrCreateRandom,
+		remove
+	};
+});
+const ServerSecretStoreLive = effect.Layer.effect(ServerSecretStore, makeServerSecretStore);
+//#endregion
+//#region src/serverSettings.ts
+/**
+* ServerSettings - Server-authoritative settings service.
+*
+* Owns persistence, validation, and change notification of settings that affect
+* server-side behavior (binary paths, streaming mode, env mode, custom models,
+* text generation model selection).
+*
+* Follows the same pattern as `keybindings.ts`: JSON file + Cache + PubSub +
+* Semaphore + FileSystem.watch for concurrency and external edit detection.
+*
+* @module ServerSettings
+*/
+const textEncoder$2 = new TextEncoder();
+const textDecoder$2 = new TextDecoder();
+function providerEnvironmentSecretName(input) {
+	return `provider-env-${Buffer.from(input.instanceId, "utf8").toString("base64url")}-${Buffer.from(input.name, "utf8").toString("base64url")}`;
+}
+function redactProviderEnvironmentVariable(variable) {
+	if (!variable.sensitive) {
+		const { valueRedacted: _omit, ...rest } = variable;
+		return rest;
+	}
+	return {
+		...variable,
+		value: "",
+		...variable.value.length > 0 || variable.valueRedacted ? { valueRedacted: true } : {}
+	};
+}
+function redactServerSettingsForClient(settings) {
+	const providerInstances = Object.fromEntries(Object.entries(settings.providerInstances).map(([instanceId, instance]) => [instanceId, instance.environment ? {
+		...instance,
+		environment: instance.environment.map(redactProviderEnvironmentVariable)
+	} : instance]));
+	return {
+		...settings,
+		providerInstances
+	};
+}
+var ServerSettingsService = class ServerSettingsService extends effect.Context.Service()("ryco/serverSettings/ServerSettingsService") {
+	static layerTest = (overrides = {}) => effect.Layer.effect(ServerSettingsService, effect.Effect.gen(function* () {
+		const currentSettingsRef = yield* effect.Ref.make(deepMerge(require_collectUint8StreamText.DEFAULT_SERVER_SETTINGS, overrides));
+		return {
+			start: effect.Effect.void,
+			ready: effect.Effect.void,
+			getSettings: effect.Ref.get(currentSettingsRef),
+			updateSettings: (patch) => effect.Ref.get(currentSettingsRef).pipe(effect.Effect.flatMap((currentSettings) => effect.Schema.decodeEffect(require_collectUint8StreamText.ServerSettings)(applyServerSettingsPatch(currentSettings, patch)).pipe(effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
+				settingsPath: "<memory>",
+				detail: `failed to normalize server settings: ${effect.SchemaIssue.makeFormatterDefault()(cause.issue)}`,
+				cause
+			})))), effect.Effect.tap((nextSettings) => effect.Ref.set(currentSettingsRef, nextSettings))),
+			streamChanges: effect.Stream.empty
+		};
+	}));
+};
+const ServerSettingsJson = require_collectUint8StreamText.fromLenientJson(require_collectUint8StreamText.ServerSettings);
+const getLegacyProviderSettings = (settings, provider) => settings.providers[provider];
+/**
+* Ensure the `textGenerationModelSelection` points to an enabled provider.
+* If the selected provider is disabled, fall back to the first enabled
+* provider with its default model.  This is applied at read-time so the
+* persisted preference is preserved for when a provider is re-enabled.
+*/
+function resolveTextGenerationProvider(settings) {
+	const selection = settings.textGenerationModelSelection;
+	const instanceConfig = settings.providerInstances[selection.instanceId];
+	if (instanceConfig !== void 0) return instanceConfig.enabled ?? true ? settings : fallbackTextGenerationProvider(settings);
+	if (require_collectUint8StreamText.isProviderDriverKind(selection.instanceId) && getLegacyProviderSettings(settings, selection.instanceId)?.enabled) return settings;
+	return fallbackTextGenerationProvider(settings);
+}
+function fallbackTextGenerationProvider(settings) {
+	const fallbackEntry = Object.entries(settings.providers).find(([, provider]) => provider.enabled);
+	const fallback = fallbackEntry ? require_collectUint8StreamText.ProviderDriverKind.make(fallbackEntry[0]) : void 0;
+	if (!fallback) return settings;
+	return {
+		...settings,
+		textGenerationModelSelection: {
+			instanceId: require_collectUint8StreamText.ProviderInstanceId.make(fallback),
+			model: require_collectUint8StreamText.DEFAULT_GIT_TEXT_GENERATION_MODEL_BY_PROVIDER[fallback] ?? "gpt-5.4-mini"
+		}
+	};
+}
+const ATOMIC_SETTINGS_KEYS = new Set(["textGenerationModelSelection"]);
+function stripDefaultServerSettings(current, defaults) {
+	if (Array.isArray(current) || Array.isArray(defaults)) return effect.Equal.equals(current, defaults) ? void 0 : current;
+	if (current !== null && defaults !== null && typeof current === "object" && typeof defaults === "object") {
+		const currentRecord = current;
+		const defaultsRecord = defaults;
+		const next = {};
+		for (const key of Object.keys(currentRecord)) if (ATOMIC_SETTINGS_KEYS.has(key)) {
+			if (!effect.Equal.equals(currentRecord[key], defaultsRecord[key])) next[key] = currentRecord[key];
+		} else {
+			const stripped = stripDefaultServerSettings(currentRecord[key], defaultsRecord[key]);
+			if (stripped !== void 0) next[key] = stripped;
+		}
+		return Object.keys(next).length > 0 ? next : void 0;
+	}
+	return Object.is(current, defaults) ? void 0 : current;
+}
+const makeServerSettings = effect.Effect.gen(function* () {
+	const { settingsPath } = yield* require_Metrics.ServerConfig;
+	const fs = yield* effect.FileSystem.FileSystem;
+	const pathService = yield* effect.Path.Path;
+	const secretStore = yield* ServerSecretStore;
+	const writeSemaphore = yield* effect_Semaphore.make(1);
+	const cacheKey = "settings";
+	const changesPubSub = yield* effect.PubSub.unbounded();
+	const startedRef = yield* effect.Ref.make(false);
+	const startedDeferred = yield* effect.Deferred.make();
+	const watcherScope = yield* effect.Scope.make("sequential");
+	yield* effect.Effect.addFinalizer(() => effect.Scope.close(watcherScope, effect.Exit.void));
+	const emitChange = (settings) => effect.PubSub.publish(changesPubSub, settings).pipe(effect.Effect.asVoid);
+	const readConfigExists = fs.exists(settingsPath).pipe(effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
+		settingsPath,
+		detail: "failed to check settings file existence",
+		cause
+	})));
+	const readRawConfig = fs.readFileString(settingsPath).pipe(effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
+		settingsPath,
+		detail: "failed to read settings file",
+		cause
+	})));
+	const loadSettingsFromDisk = effect.Effect.gen(function* () {
+		if (!(yield* readConfigExists)) return require_collectUint8StreamText.DEFAULT_SERVER_SETTINGS;
+		const raw = yield* readRawConfig;
+		const decoded = effect.Schema.decodeUnknownExit(ServerSettingsJson)(raw);
+		if (decoded._tag === "Failure") {
+			yield* effect.Effect.logWarning("failed to parse settings.json, using defaults", {
+				path: settingsPath,
+				issues: effect.Cause.pretty(decoded.cause)
+			});
+			return require_collectUint8StreamText.DEFAULT_SERVER_SETTINGS;
+		}
+		return decoded.value;
+	});
+	const settingsCache = yield* effect.Cache.make({
+		capacity: 1,
+		lookup: () => loadSettingsFromDisk
+	});
+	const getSettingsFromCache = effect.Cache.get(settingsCache, cacheKey);
+	const toSettingsError = (detail, cause) => new require_collectUint8StreamText.ServerSettingsError({
+		settingsPath,
+		detail,
+		cause
+	});
+	const materializeProviderEnvironmentSecrets = (settings) => effect.Effect.gen(function* () {
+		const providerInstances = { ...settings.providerInstances };
+		for (const [instanceId, instance] of Object.entries(settings.providerInstances)) {
+			if (!instance.environment) continue;
+			const environment = [];
+			for (const variable of instance.environment) {
+				if (!variable.sensitive || !variable.valueRedacted) {
+					environment.push(variable);
+					continue;
+				}
+				const secret = yield* secretStore.get(providerEnvironmentSecretName({
+					instanceId,
+					name: variable.name
+				})).pipe(effect.Effect.mapError((cause) => toSettingsError(`failed to read sensitive environment variable ${variable.name}`, cause)));
+				environment.push({
+					...variable,
+					value: secret ? textDecoder$2.decode(secret) : ""
+				});
+			}
+			providerInstances[instanceId] = {
+				...instance,
+				environment
+			};
+		}
+		return {
+			...settings,
+			providerInstances
+		};
+	});
+	const persistProviderEnvironmentSecrets = (current, next) => effect.Effect.gen(function* () {
+		const providerInstances = { ...next.providerInstances };
+		const nextSecretKeys = /* @__PURE__ */ new Set();
+		for (const [instanceId, instance] of Object.entries(next.providerInstances)) {
+			if (!instance.environment) continue;
+			const environment = [];
+			for (const variable of instance.environment) {
+				const secretName = providerEnvironmentSecretName({
+					instanceId,
+					name: variable.name
+				});
+				if (!variable.sensitive) {
+					yield* secretStore.remove(secretName).pipe(effect.Effect.mapError((cause) => toSettingsError(`failed to remove environment secret ${variable.name}`, cause)));
+					environment.push(redactProviderEnvironmentVariable(variable));
+					continue;
+				}
+				nextSecretKeys.add(secretName);
+				if (!variable.valueRedacted) {
+					if (variable.value.length > 0) {
+						yield* secretStore.set(secretName, textEncoder$2.encode(variable.value)).pipe(effect.Effect.mapError((cause) => toSettingsError(`failed to persist environment secret ${variable.name}`, cause)));
+						environment.push({
+							...variable,
+							value: "",
+							valueRedacted: true
+						});
+					} else {
+						yield* secretStore.remove(secretName).pipe(effect.Effect.mapError((cause) => toSettingsError(`failed to remove environment secret ${variable.name}`, cause)));
+						const { valueRedacted: _omit, ...rest } = variable;
+						environment.push(rest);
+					}
+					continue;
+				}
+				environment.push(redactProviderEnvironmentVariable(variable));
+			}
+			providerInstances[instanceId] = {
+				...instance,
+				environment
+			};
+		}
+		for (const [instanceId, instance] of Object.entries(current.providerInstances)) for (const variable of instance.environment ?? []) {
+			if (!variable.sensitive) continue;
+			const secretName = providerEnvironmentSecretName({
+				instanceId,
+				name: variable.name
+			});
+			if (nextSecretKeys.has(secretName)) continue;
+			yield* secretStore.remove(secretName).pipe(effect.Effect.mapError((cause) => toSettingsError(`failed to remove stale environment secret ${variable.name}`, cause)));
+		}
+		return {
+			...next,
+			providerInstances
+		};
+	});
+	const writeSettingsAtomically = (settings) => {
+		const sparseSettings = stripDefaultServerSettings(settings, require_collectUint8StreamText.DEFAULT_SERVER_SETTINGS) ?? {};
+		return writeFileStringAtomically({
+			filePath: settingsPath,
+			contents: `${JSON.stringify(sparseSettings, null, 2)}\n`
+		}).pipe(effect.Effect.provideService(effect.FileSystem.FileSystem, fs), effect.Effect.provideService(effect.Path.Path, pathService), effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
+			settingsPath,
+			detail: "failed to write settings file",
+			cause
+		})));
+	};
+	const revalidateAndEmit = writeSemaphore.withPermits(1)(effect.Effect.gen(function* () {
+		yield* effect.Cache.invalidate(settingsCache, cacheKey);
+		yield* emitChange(yield* getSettingsFromCache);
+	}));
+	const startWatcher = effect.Effect.gen(function* () {
+		const settingsDir = pathService.dirname(settingsPath);
+		const settingsFile = pathService.basename(settingsPath);
+		const settingsPathResolved = pathService.resolve(settingsPath);
+		yield* fs.makeDirectory(settingsDir, { recursive: true }).pipe(effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
+			settingsPath,
+			detail: "failed to prepare settings directory",
+			cause
+		})));
+		const revalidateAndEmitSafely = revalidateAndEmit.pipe(effect.Effect.ignoreCause({ log: true }));
+		const debouncedSettingsEvents = fs.watch(settingsDir).pipe(effect.Stream.filter((event) => {
+			return event.path === settingsFile || event.path === settingsPath || pathService.resolve(settingsDir, event.path) === settingsPathResolved;
+		}), effect.Stream.debounce(effect.Duration.millis(100)));
+		yield* effect.Stream.runForEach(debouncedSettingsEvents, () => revalidateAndEmitSafely).pipe(effect.Effect.ignoreCause({ log: true }), effect.Effect.forkIn(watcherScope), effect.Effect.asVoid);
+	});
+	return {
+		start: effect.Effect.gen(function* () {
+			if (!(yield* effect.Ref.modify(startedRef, (started) => [!started, true]))) return yield* effect.Deferred.await(startedDeferred);
+			const startup = effect.Effect.gen(function* () {
+				yield* startWatcher;
+				yield* effect.Cache.invalidate(settingsCache, cacheKey);
+				yield* getSettingsFromCache;
+			});
+			const startupExit = yield* effect.Effect.exit(startup);
+			if (startupExit._tag === "Failure") {
+				yield* effect.Deferred.failCause(startedDeferred, startupExit.cause).pipe(effect.Effect.orDie);
+				return yield* effect.Effect.failCause(startupExit.cause);
+			}
+			yield* effect.Deferred.succeed(startedDeferred, void 0).pipe(effect.Effect.orDie);
+		}),
+		ready: effect.Deferred.await(startedDeferred),
+		getSettings: getSettingsFromCache.pipe(effect.Effect.flatMap(materializeProviderEnvironmentSecrets), effect.Effect.map(resolveTextGenerationProvider)),
+		updateSettings: (patch) => writeSemaphore.withPermits(1)(effect.Effect.gen(function* () {
+			const current = yield* getSettingsFromCache;
+			const nextPersisted = yield* persistProviderEnvironmentSecrets(current, applyServerSettingsPatch(current, patch));
+			const next = yield* effect.Schema.decodeEffect(require_collectUint8StreamText.ServerSettings)(nextPersisted).pipe(effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
+				settingsPath: "<memory>",
+				detail: `failed to normalize server settings: ${effect.SchemaIssue.makeFormatterDefault()(cause.issue)}`,
+				cause
+			})));
+			yield* writeSettingsAtomically(next);
+			yield* effect.Cache.set(settingsCache, cacheKey, next);
+			yield* emitChange(next);
+			return resolveTextGenerationProvider(yield* materializeProviderEnvironmentSecrets(next));
+		})),
+		get streamChanges() {
+			return effect.Stream.fromPubSub(changesPubSub).pipe(effect.Stream.mapEffect((settings) => materializeProviderEnvironmentSecrets(settings).pipe(effect.Effect.catch((error) => effect.Effect.logWarning("failed to materialize provider environment secrets", { detail: error.detail }).pipe(effect.Effect.as(settings))))), effect.Stream.map(resolveTextGenerationProvider));
+		}
+	};
+});
+const ServerSettingsLive = effect.Layer.effect(ServerSettingsService, makeServerSettings).pipe(effect.Layer.provide(ServerSecretStoreLive));
+//#endregion
 //#region src/provider/cliVersion.ts
 const CLI_VERSION_NUMBER_SEGMENT = /^\d+$/;
 function normalizeCliVersion(version) {
@@ -1957,7 +2339,8 @@ const resolveLatestProviderVersion = effect.Effect.fn("resolveLatestProviderVers
 });
 const enrichProviderSnapshotWithVersionAdvisory = effect.Effect.fn("enrichProviderSnapshotWithVersionAdvisory")(function* (snapshot, maintenanceCapabilities) {
 	const capabilities = maintenanceCapabilities ?? makeManualProviderMaintenanceCapabilities$1(snapshot.driver);
-	if (!snapshot.enabled || !snapshot.installed || !snapshot.version) return {
+	const { enableProviderUpdateChecks } = yield* (yield* ServerSettingsService).getSettings.pipe(effect.Effect.orElseSucceed(() => require_collectUint8StreamText.DEFAULT_SERVER_SETTINGS));
+	if (!enableProviderUpdateChecks || !snapshot.enabled || !snapshot.installed || !snapshot.version) return {
 		...snapshot,
 		versionAdvisory: createProviderVersionAdvisory({
 			driver: snapshot.driver,
@@ -2052,6 +2435,7 @@ const make$21 = effect.Effect.fn("ProviderMaintenanceRunner.make")(function* ()
 	const providerRegistry = yield* ProviderRegistry;
 	const spawner = yield* effect_unstable_process.ChildProcessSpawner.ChildProcessSpawner;
 	const httpClient = yield* effect_unstable_http.HttpClient.HttpClient;
+	const serverSettings = yield* ServerSettingsService;
 	const runMaintenanceCommand = (command, args) => runProviderMaintenanceCommandWithSpawner({
 		spawner,
 		command,
@@ -2070,7 +2454,7 @@ const make$21 = effect.Effect.fn("ProviderMaintenanceRunner.make")(function* ()
 			providers,
 			verifiedProviders: []
 		});
-		return effect.Effect.forEach(refreshedProviders, (refreshedProvider) => enrichProviderSnapshotWithVersionAdvisory(refreshedProvider, maintenanceCapabilities).pipe(effect.Effect.provideService(effect_unstable_http.HttpClient.HttpClient, httpClient)), { concurrency: "unbounded" }).pipe(effect.Effect.map((verifiedProviders) => ({
+		return effect.Effect.forEach(refreshedProviders, (refreshedProvider) => enrichProviderSnapshotWithVersionAdvisory(refreshedProvider, maintenanceCapabilities).pipe(effect.Effect.provideService(effect_unstable_http.HttpClient.HttpClient, httpClient), effect.Effect.provideService(ServerSettingsService, serverSettings)), { concurrency: "unbounded" }).pipe(effect.Effect.map((verifiedProviders) => ({
 			providers,
 			verifiedProviders
 		})), effect.Effect.catchCause((cause) => effect.Effect.logWarning("Provider post-update version verification failed", {
@@ -2160,78 +2544,6 @@ const make$21 = effect.Effect.fn("ProviderMaintenanceRunner.make")(function* ()
 });
 const layer$18 = effect.Layer.effect(ProviderMaintenanceRunner, make$21());
 //#endregion
-//#region src/auth/Services/ServerSecretStore.ts
-var SecretStoreError = class extends effect.Data.TaggedError("SecretStoreError") {};
-var ServerSecretStore = class extends effect.Context.Service()("ryco/auth/Services/ServerSecretStore") {};
-//#endregion
-//#region src/auth/Layers/ServerSecretStore.ts
-const makeServerSecretStore = effect.Effect.gen(function* () {
-	const fileSystem = yield* effect.FileSystem.FileSystem;
-	const path = yield* effect.Path.Path;
-	const serverConfig = yield* require_Metrics.ServerConfig;
-	yield* fileSystem.makeDirectory(serverConfig.secretsDir, { recursive: true });
-	yield* fileSystem.chmod(serverConfig.secretsDir, 448).pipe(effect.Effect.mapError((cause) => new SecretStoreError({
-		message: `Failed to secure secrets directory ${serverConfig.secretsDir}.`,
-		cause
-	})));
-	const resolveSecretPath = (name) => path.join(serverConfig.secretsDir, `${name}.bin`);
-	const ensureSecretDirectory = (secretPath) => {
-		const directory = path.dirname(secretPath);
-		return fileSystem.makeDirectory(directory, { recursive: true }).pipe(effect.Effect.flatMap(() => fileSystem.chmod(directory, 448)));
-	};
-	const isPlatformError = (u) => effect.Predicate.isTagged(u, "PlatformError");
-	const get = (name) => fileSystem.readFile(resolveSecretPath(name)).pipe(effect.Effect.map((bytes) => Uint8Array.from(bytes)), effect.Effect.catch((cause) => cause.reason._tag === "NotFound" ? effect.Effect.succeed(null) : effect.Effect.fail(new SecretStoreError({
-		message: `Failed to read secret ${name}.`,
-		cause
-	}))));
-	const set = (name, value) => {
-		const secretPath = resolveSecretPath(name);
-		const tempPath = `${secretPath}.${node_crypto.randomUUID()}.tmp`;
-		return effect.Effect.gen(function* () {
-			yield* ensureSecretDirectory(secretPath);
-			yield* fileSystem.writeFile(tempPath, value);
-			yield* fileSystem.chmod(tempPath, 384);
-			yield* fileSystem.rename(tempPath, secretPath);
-			yield* fileSystem.chmod(secretPath, 384);
-		}).pipe(effect.Effect.catch((cause) => fileSystem.remove(tempPath).pipe(effect.Effect.ignore, effect.Effect.flatMap(() => effect.Effect.fail(new SecretStoreError({
-			message: `Failed to persist secret ${name}.`,
-			cause
-		}))))));
-	};
-	const create = (name, value) => {
-		const secretPath = resolveSecretPath(name);
-		return effect.Effect.scoped(effect.Effect.gen(function* () {
-			yield* ensureSecretDirectory(secretPath);
-			const file = yield* fileSystem.open(secretPath, {
-				flag: "wx",
-				mode: 384
-			});
-			yield* file.writeAll(value);
-			yield* file.sync;
-			yield* fileSystem.chmod(secretPath, 384);
-		})).pipe(effect.Effect.mapError((cause) => new SecretStoreError({
-			message: `Failed to persist secret ${name}.`,
-			cause
-		})));
-	};
-	const getOrCreateRandom = (name, bytes) => get(name).pipe(effect.Effect.flatMap((existing) => {
-		if (existing) return effect.Effect.succeed(existing);
-		const generated = node_crypto.randomBytes(bytes);
-		return create(name, generated).pipe(effect.Effect.as(Uint8Array.from(generated)), effect.Effect.catchTag("SecretStoreError", (error) => isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists" ? get(name).pipe(effect.Effect.flatMap((created) => created !== null ? effect.Effect.succeed(created) : effect.Effect.fail(new SecretStoreError({ message: `Failed to read secret ${name} after concurrent creation.` })))) : effect.Effect.fail(error)));
-	}));
-	const remove = (name) => fileSystem.remove(resolveSecretPath(name)).pipe(effect.Effect.catch((cause) => cause.reason._tag === "NotFound" ? effect.Effect.void : effect.Effect.fail(new SecretStoreError({
-		message: `Failed to remove secret ${name}.`,
-		cause
-	}))));
-	return {
-		get,
-		set,
-		getOrCreateRandom,
-		remove
-	};
-});
-const ServerSecretStoreLive = effect.Layer.effect(ServerSecretStore, makeServerSecretStore);
-//#endregion
 //#region src/persistence/Errors.ts
 var PersistenceSqlError = class extends effect.Schema.TaggedErrorClass()("PersistenceSqlError", {
 	operation: effect.Schema.String,
@@ -3925,6 +4237,35 @@ var _040_ProjectionThreadsProjectUpdatedAtIndex_default = effect_Effect.gen(func
   `;
 });
 //#endregion
+//#region src/persistence/Migrations/041_ProjectionThreadsSubagentNesting.ts
+var _041_ProjectionThreadsSubagentNesting_default = effect_Effect.gen(function* () {
+	const sql = yield* effect_unstable_sql_SqlClient.SqlClient;
+	const columns = yield* sql`
+    PRAGMA table_info(projection_threads)
+  `;
+	const columnNames = new Set(columns.map((column) => column.name));
+	if (!columnNames.has("thread_kind")) yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN thread_kind TEXT NOT NULL DEFAULT 'normal'
+    `;
+	if (!columnNames.has("visibility")) yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN visibility TEXT NOT NULL DEFAULT 'normal'
+    `;
+	if (!columnNames.has("parent_thread_id")) yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN parent_thread_id TEXT
+    `;
+	if (!columnNames.has("parent_subagent_id")) yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN parent_subagent_id TEXT
+    `;
+	yield* sql`
+    CREATE INDEX IF NOT EXISTS idx_projection_threads_parent_thread
+    ON projection_threads(parent_thread_id, created_at, thread_id)
+  `;
+});
+//#endregion
 //#region src/persistence/Migrations.ts
 /**
 * MigrationsLive - Migration runner with inline loader
@@ -4145,6 +4486,11 @@ const migrationEntries = [
 		40,
 		"ProjectionThreadsProjectUpdatedAtIndex",
 		_040_ProjectionThreadsProjectUpdatedAtIndex_default
+	],
+	[
+		41,
+		"ProjectionThreadsSubagentNesting",
+		_041_ProjectionThreadsSubagentNesting_default
 	]
 ];
 const makeMigrationLoader = (throughId) => effect_unstable_sql_Migrator.fromRecord(Object.fromEntries(migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -4214,6 +4560,45 @@ const repairProjectionTokenModeColumns = effect_Effect.fn("repairProjectionToken
 		yield* effect_Effect.log("Repaired projection_thread_sessions.token_mode column");
 	}
 });
+const repairProjectionThreadSubagentNestingColumns = effect_Effect.fn("repairProjectionThreadSubagentNestingColumns")(function* () {
+	const sql = yield* effect_unstable_sql_SqlClient.SqlClient;
+	if ((yield* sql`
+    SELECT name FROM sqlite_master
+    WHERE type = 'table' AND name = 'projection_threads'
+  `).length === 0) return;
+	const columns = yield* sql`
+    PRAGMA table_info(projection_threads)
+  `;
+	const columnNames = new Set(columns.map((column) => column.name));
+	if (!columnNames.has("thread_kind")) {
+		yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN thread_kind TEXT NOT NULL DEFAULT 'normal'
+    `;
+		yield* effect_Effect.log("Repaired projection_threads.thread_kind column");
+	}
+	if (!columnNames.has("visibility")) {
+		yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN visibility TEXT NOT NULL DEFAULT 'normal'
+    `;
+		yield* effect_Effect.log("Repaired projection_threads.visibility column");
+	}
+	if (!columnNames.has("parent_thread_id")) {
+		yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN parent_thread_id TEXT
+    `;
+		yield* effect_Effect.log("Repaired projection_threads.parent_thread_id column");
+	}
+	if (!columnNames.has("parent_subagent_id")) {
+		yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN parent_subagent_id TEXT
+    `;
+		yield* effect_Effect.log("Repaired projection_threads.parent_subagent_id column");
+	}
+});
 /**
 * Run all pending migrations.
 *
@@ -4230,6 +4615,7 @@ const runMigrations = effect_Effect.fn("runMigrations")(function* ({ toMigration
 	if (toMigrationInclusive === void 0 || toMigrationInclusive >= 31) yield* repairProjectionWorktreeTitleColumn();
 	if (toMigrationInclusive === void 0 || toMigrationInclusive >= 34) yield* repairProjectionProjectAvatarColumns();
 	if (toMigrationInclusive === void 0 || toMigrationInclusive >= 35) yield* repairProjectionTokenModeColumns();
+	if (toMigrationInclusive === void 0 || toMigrationInclusive >= 41) yield* repairProjectionThreadSubagentNestingColumns();
 	yield* effect_Effect.log("Migrations ran successfully").pipe(effect_Effect.annotateLogs({ migrations: executedMigrations.map(([id, name]) => `${id}_${name}`) }));
 	return executedMigrations;
 });
@@ -4304,10 +4690,10 @@ function normalizeAzureDevOpsPullRequestRecord(raw) {
 		updatedAt: (raw.closedDate ?? effect.Option.none()).pipe(effect.Option.orElse(() => raw.creationDate ?? effect.Option.none()))
 	};
 }
-const decodeAzureDevOpsPullRequestList = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
-const decodeAzureDevOpsPullRequest = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(AzureDevOpsPullRequestSchema);
+const decodeAzureDevOpsPullRequestList = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
+const decodeAzureDevOpsPullRequest = require_collectUint8StreamText.decodeJsonResult(AzureDevOpsPullRequestSchema);
 const decodeAzureDevOpsPullRequestEntry = effect.Schema.decodeUnknownExit(AzureDevOpsPullRequestSchema);
-const formatAzureDevOpsJsonDecodeError = require_SourceControlProviderDiscoveryCatalog.formatSchemaError;
+const formatAzureDevOpsJsonDecodeError = require_collectUint8StreamText.formatSchemaError;
 function decodeAzureDevOpsPullRequestListJson(raw) {
 	const result = decodeAzureDevOpsPullRequestList(raw);
 	if (effect.Result.isSuccess(result)) {
@@ -4345,7 +4731,7 @@ function flattenThreadComments(threads) {
 		createdAt: c.publishedDate ?? ""
 	}));
 }
-const decodeAzurePullRequestDetail = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Struct({
+const decodeAzurePullRequestDetail = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Struct({
 	...AzureDevOpsPullRequestSchema.fields,
 	description: effect.Schema.optional(effect.Schema.NullOr(effect.Schema.String)),
 	threads: effect.Schema.optional(effect.Schema.Array(AzureThreadSchema))
@@ -4360,7 +4746,7 @@ function decodeAzureDevOpsPullRequestDetailJson(raw) {
 		comments: flattenThreadComments(result.success.threads ?? [])
 	});
 }
-const decodeThreadList = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Array(AzureThreadSchema));
+const decodeThreadList = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Array(AzureThreadSchema));
 function decodeAzureDevOpsPullRequestThreadsJson(raw) {
 	if (raw.length === 0) return effect.Result.succeed([]);
 	const result = decodeThreadList(raw);
@@ -4434,10 +4820,10 @@ function normalize(raw) {
 		labels: labelsFromTags(raw.fields["System.Tags"])
 	};
 }
-const decodeWorkItemList = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
+const decodeWorkItemList = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
 const decodeWorkItemEntry = effect.Schema.decodeUnknownExit(AzureWorkItemSchema);
-const decodeWorkItemDetail = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(AzureWorkItemSchema);
-const formatAzureDevOpsWorkItemDecodeError = require_SourceControlProviderDiscoveryCatalog.formatSchemaError;
+const decodeWorkItemDetail = require_collectUint8StreamText.decodeJsonResult(AzureWorkItemSchema);
+const formatAzureDevOpsWorkItemDecodeError = require_collectUint8StreamText.formatSchemaError;
 function decodeAzureDevOpsWorkItemListJson(raw) {
 	const result = decodeWorkItemList(raw);
 	if (!effect.Result.isSuccess(result)) return effect.Result.fail(result.failure);
@@ -4855,9 +5241,9 @@ function normalizeBitbucketCommentList(decoded) {
 		createdAt: c.created_on
 	}));
 }
-require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(BitbucketIssueListSchema);
-require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(BitbucketIssueSchema);
-require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(BitbucketCommentListSchema);
+require_collectUint8StreamText.decodeJsonResult(BitbucketIssueListSchema);
+require_collectUint8StreamText.decodeJsonResult(BitbucketIssueSchema);
+require_collectUint8StreamText.decodeJsonResult(BitbucketCommentListSchema);
 //#endregion
 //#region src/sourceControl/bitbucketPullRequests.ts
 const BitbucketRepositoryRefSchema = effect.Schema.Struct({
@@ -4940,7 +5326,7 @@ const BitbucketPullRequestDetailSchema = effect.Schema.Struct({
 	...BitbucketPullRequestSchema.fields,
 	summary: effect.Schema.optional(effect.Schema.NullOr(effect.Schema.Struct({ raw: effect.Schema.optional(effect.Schema.NullOr(effect.Schema.String)) })))
 });
-require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(BitbucketPullRequestDetailSchema);
+require_collectUint8StreamText.decodeJsonResult(BitbucketPullRequestDetailSchema);
 const WORK_ITEM_KEY_PATTERN = /\b([A-Z][A-Z0-9]{1,9})-(\d+)\b/giu;
 function extractWorkItemKeys(input) {
 	const keys = /* @__PURE__ */ new Set();
@@ -5023,7 +5409,7 @@ effect.Schema.Struct({
 var ProjectAtlassianLinkRepository = class extends effect.Context.Service()("ryco/persistence/Services/ProjectAtlassianLinks/ProjectAtlassianLinkRepository") {};
 //#endregion
 //#region src/atlassian/AtlassianConnectionService.ts
-const textEncoder$2 = new TextEncoder();
+const textEncoder$1 = new TextEncoder();
 var AtlassianConnectionService = class extends effect.Context.Service()("ryco/atlassian/AtlassianConnectionService") {};
 function atlassianError(operation, detail, cause) {
 	return new require_collectUint8StreamText.AtlassianConnectionError({
@@ -5151,7 +5537,7 @@ const make$19 = effect.Effect.fn("makeAtlassianConnectionService")(function* ()
 				createdAt,
 				updatedAt: createdAt
 			};
-			return secretStore.set(manualBitbucketTokenSecretName(connectionId), textEncoder$2.encode(input.token)).pipe(effect.Effect.flatMap(() => connections.upsert(record)), cleanupSecretOnFailure(manualBitbucketTokenSecretName(connectionId)), effect.Effect.as(toSummary(record)), effect.Effect.mapError(mapError$1("atlassian.saveManualBitbucketToken", "Failed to save the Bitbucket token.")));
+			return secretStore.set(manualBitbucketTokenSecretName(connectionId), textEncoder$1.encode(input.token)).pipe(effect.Effect.flatMap(() => connections.upsert(record)), cleanupSecretOnFailure(manualBitbucketTokenSecretName(connectionId)), effect.Effect.as(toSummary(record)), effect.Effect.mapError(mapError$1("atlassian.saveManualBitbucketToken", "Failed to save the Bitbucket token.")));
 		},
 		saveManualJiraToken: (input) => {
 			const createdAt = nowIso$2();
@@ -5187,7 +5573,7 @@ const make$19 = effect.Effect.fn("makeAtlassianConnectionService")(function* ()
 				avatarUrl: null,
 				updatedAt: createdAt
 			};
-			return secretStore.set(manualJiraTokenSecretName(connectionId), textEncoder$2.encode(input.token)).pipe(effect.Effect.flatMap(() => connections.upsert(record)), effect.Effect.flatMap(() => resources.upsertForConnection({
+			return secretStore.set(manualJiraTokenSecretName(connectionId), textEncoder$1.encode(input.token)).pipe(effect.Effect.flatMap(() => connections.upsert(record)), effect.Effect.flatMap(() => resources.upsertForConnection({
 				connectionId,
 				resources: [resource]
 			})), cleanupSecretOnFailure(manualJiraTokenSecretName(connectionId)), effect.Effect.as(toSummary(record)), effect.Effect.mapError(mapError$1("atlassian.saveManualJiraToken", "Failed to save the Jira API token.")));
@@ -5303,6 +5689,11 @@ const NON_REPOSITORY_STATUS_DETAILS = Object.freeze({
 	behindCount: 0,
 	aheadOfDefaultCount: 0
 });
+const emptyDiffTotals = () => ({
+	files: [],
+	insertions: 0,
+	deletions: 0
+});
 var StatusRemoteRefreshCacheKey = class extends effect.Data.Class {};
 function parseBranchAb(value) {
 	const match = value.match(/^\+(\d+)\s+-(\d+)$/);
@@ -5502,7 +5893,7 @@ const createTrace2Monitor = effect.Effect.fn("createTrace2Monitor")(function* (i
 	const handleTraceLine = effect.Effect.fn("handleTraceLine")(function* (line) {
 		const trimmedLine = line.trim();
 		if (trimmedLine.length === 0) return;
-		const traceRecord = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(Trace2Record)(trimmedLine);
+		const traceRecord = require_collectUint8StreamText.decodeJsonResult(Trace2Record)(trimmedLine);
 		if (effect.Result.isFailure(traceRecord)) {
 			yield* effect.Effect.logDebug(`GitVcsDriver.trace2: failed to parse trace line for ${quoteGitCommand(input.args)} in ${input.cwd}`, traceRecord.failure);
 			return;
@@ -5949,6 +6340,31 @@ const makeGitVcsDriverCore = effect.Effect.fn("makeGitVcsDriverCore")(function*
 		const parsed = Number.parseInt(result.stdout.trim(), 10);
 		return Number.isFinite(parsed) ? Math.max(0, parsed) : 0;
 	});
+	const readCommittedAgainstBase = effect.Effect.fn("readCommittedAgainstBase")(function* (cwd, refName) {
+		const baseRef = yield* resolveBaseBranchForNoUpstream(cwd, refName).pipe(effect.Effect.catch(() => effect.Effect.succeed(null)));
+		if (!baseRef) return emptyDiffTotals();
+		const result = yield* executeGit("GitVcsDriver.readCommittedAgainstBase.diff", cwd, [
+			"diff",
+			"--numstat",
+			`${baseRef}...HEAD`
+		], { allowNonZeroExit: true });
+		if (result.exitCode !== 0) return emptyDiffTotals();
+		let insertions = 0;
+		let deletions = 0;
+		return {
+			files: parseNumstatEntries(result.stdout).map((entry) => {
+				insertions += entry.insertions;
+				deletions += entry.deletions;
+				return {
+					path: entry.path,
+					insertions: entry.insertions,
+					deletions: entry.deletions
+				};
+			}).toSorted((a, b) => a.path.localeCompare(b.path)),
+			insertions,
+			deletions
+		};
+	});
 	const readBranchRecency = effect.Effect.fn("readBranchRecency")(function* (cwd) {
 		const branchRecency = yield* executeGit("GitVcsDriver.readBranchRecency", cwd, [
 			"for-each-ref",
@@ -6067,6 +6483,7 @@ const makeGitVcsDriverCore = effect.Effect.fn("makeGitVcsDriverCore")(function*
 			});
 		}
 		files.sort((a, b) => a.path.localeCompare(b.path));
+		const committed = refName && !isDefaultBranch ? yield* readCommittedAgainstBase(cwd, refName).pipe(effect.Effect.catch(() => effect.Effect.succeed(emptyDiffTotals()))) : void 0;
 		return {
 			isRepo: true,
 			hasOriginRemote: hasPrimaryRemote,
@@ -6079,6 +6496,7 @@ const makeGitVcsDriverCore = effect.Effect.fn("makeGitVcsDriverCore")(function*
 				insertions,
 				deletions
 			},
+			...committed ? { committed } : {},
 			hasUpstream: upstreamRef !== null,
 			aheadCount,
 			behindCount,
@@ -6099,6 +6517,7 @@ const makeGitVcsDriverCore = effect.Effect.fn("makeGitVcsDriverCore")(function*
 		refName: details.branch,
 		hasWorkingTreeChanges: details.hasWorkingTreeChanges,
 		workingTree: details.workingTree,
+		...details.committed ? { committed: details.committed } : {},
 		hasUpstream: details.hasUpstream,
 		aheadCount: details.aheadCount,
 		behindCount: details.behindCount,
@@ -6991,7 +7410,7 @@ const layer$13 = effect.Layer.effect(VcsDriverRegistry, make$16()).pipe(effect.L
 //#endregion
 //#region src/sourceControl/BitbucketApi.ts
 const DEFAULT_API_BASE_URL = "https://api.bitbucket.org/2.0";
-const textDecoder$2 = new TextDecoder();
+const textDecoder$1 = new TextDecoder();
 const BitbucketApiEnvConfig = effect.Config.all({
 	baseUrl: effect.Config.string("RYCO_BITBUCKET_API_BASE_URL").pipe(effect.Config.withDefault(DEFAULT_API_BASE_URL)),
 	accessToken: effect.Config.string("RYCO_BITBUCKET_ACCESS_TOKEN").pipe(effect.Config.option),
@@ -7336,7 +7755,7 @@ const make$15 = effect.Effect.fn("makeBitbucketApi")(function* () {
 				cause
 			})));
 			if (!tokenBytes || tokenBytes.length === 0) continue;
-			const token = textDecoder$2.decode(tokenBytes).trim();
+			const token = textDecoder$1.decode(tokenBytes).trim();
 			if (!token) continue;
 			return {
 				source: "stored",
@@ -7741,9 +8160,9 @@ function normalizeForgejoIssueDetail(input) {
 		comments: input.comments.map(normalizeForgejoComment)
 	};
 }
-require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
-require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(ForgejoIssueSchema);
-require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(ForgejoCommentListSchema);
+require_collectUint8StreamText.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
+require_collectUint8StreamText.decodeJsonResult(ForgejoIssueSchema);
+require_collectUint8StreamText.decodeJsonResult(ForgejoCommentListSchema);
 effect.Schema.decodeUnknownExit(ForgejoIssueSchema);
 //#endregion
 //#region src/sourceControl/forgejoPullRequests.ts
@@ -7882,8 +8301,8 @@ function normalizeForgejoPullRequestDetail(input) {
 		files
 	};
 }
-require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
-require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(ForgejoPullRequestSchema);
+require_collectUint8StreamText.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
+require_collectUint8StreamText.decodeJsonResult(ForgejoPullRequestSchema);
 effect.Schema.decodeUnknownExit(ForgejoPullRequestSchema);
 //#endregion
 //#region src/sourceControl/ForgejoApi.ts
@@ -7915,7 +8334,7 @@ const ForgejoCliLoginSchema = effect.Schema.Struct({
 	name: effect.Schema.optional(require_collectUint8StreamText.TrimmedNonEmptyString),
 	token: effect.Schema.optional(require_collectUint8StreamText.TrimmedNonEmptyString)
 });
-const decodeForgejoCliKeysJson = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Struct({ hosts: effect.Schema.optional(effect.Schema.Record(effect.Schema.String, ForgejoCliLoginSchema)) }));
+const decodeForgejoCliKeysJson = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Struct({ hosts: effect.Schema.optional(effect.Schema.Record(effect.Schema.String, ForgejoCliLoginSchema)) }));
 var ForgejoApi = class extends effect.Context.Service()("ryco/source-control/ForgejoApi") {};
 function nonEmpty$1(value) {
 	const trimmed = value?.trim();
@@ -8478,7 +8897,7 @@ const RawGitHubReactionGroupSchema = effect.Schema.Struct({
 	reactors: effect.Schema.optional(effect.Schema.Struct({ totalCount: effect.Schema.optional(effect.Schema.Number) })),
 	users: effect.Schema.optional(effect.Schema.Struct({ totalCount: effect.Schema.optional(effect.Schema.Number) }))
 });
-const decodeReactionGroupsBySubject = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Struct({ data: effect.Schema.Struct({ nodes: effect.Schema.Array(effect.Schema.NullOr(effect.Schema.Struct({
+const decodeReactionGroupsBySubject = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Struct({ data: effect.Schema.Struct({ nodes: effect.Schema.Array(effect.Schema.NullOr(effect.Schema.Struct({
 	id: effect.Schema.String,
 	reactionGroups: effect.Schema.Array(RawGitHubReactionGroupSchema)
 }))) }) }));
@@ -8521,7 +8940,7 @@ function normalizeReactionGroups(raw) {
 		}];
 	});
 }
-const formatGitHubReactionGroupsDecodeError = require_SourceControlProviderDiscoveryCatalog.formatSchemaError;
+const formatGitHubReactionGroupsDecodeError = require_collectUint8StreamText.formatSchemaError;
 function decodeGitHubReactionGroupsBySubjectJson(raw) {
 	const result = decodeReactionGroupsBySubject(raw);
 	if (!effect.Result.isSuccess(result)) return effect.Result.fail(result.failure);
@@ -8599,8 +9018,8 @@ function normalizeGitHubIssueRecord(raw) {
 		commentsCount
 	};
 }
-const decodeIssueList$1 = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
-const decodeIssueDetail$1 = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(GitHubIssueSchema);
+const decodeIssueList$1 = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
+const decodeIssueDetail$1 = require_collectUint8StreamText.decodeJsonResult(GitHubIssueSchema);
 const decodeIssueEntry$1 = effect.Schema.decodeUnknownExit(GitHubIssueSchema);
 const GitHubLabelSchema = effect.Schema.Struct({
 	name: effect.Schema.String,
@@ -8612,9 +9031,9 @@ const GitHubAssigneeSchema = effect.Schema.Struct({
 	name: effect.Schema.optional(effect.Schema.NullOr(effect.Schema.String)),
 	avatar_url: effect.Schema.optional(effect.Schema.NullOr(effect.Schema.String))
 });
-const decodeJsonLabelList = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Array(GitHubLabelSchema));
-const decodeJsonAssigneeList = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Array(GitHubAssigneeSchema));
-const formatGitHubIssueDecodeError = require_SourceControlProviderDiscoveryCatalog.formatSchemaError;
+const decodeJsonLabelList = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Array(GitHubLabelSchema));
+const decodeJsonAssigneeList = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Array(GitHubAssigneeSchema));
+const formatGitHubIssueDecodeError = require_collectUint8StreamText.formatSchemaError;
 function decodeGitHubIssueListJson(raw) {
 	const result = decodeIssueList$1(raw);
 	if (!effect.Result.isSuccess(result)) return effect.Result.fail(result.failure);
@@ -8763,10 +9182,10 @@ function normalizePullRequestWorkflowContext(raw) {
 		baseRepositoryNameWithOwner: optionalTrimmed(raw.base?.repo?.full_name)
 	};
 }
-const decodeWorkflowRunsResponse = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(RawGitHubWorkflowRunsResponseSchema);
-const decodeWorkflowJobsResponse = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(RawGitHubWorkflowJobsPayloadSchema);
-const decodePullRequestWorkflowContext = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(RawGitHubPullRequestWorkflowContextSchema);
-const formatGitHubWorkflowDecodeError = require_SourceControlProviderDiscoveryCatalog.formatSchemaError;
+const decodeWorkflowRunsResponse = require_collectUint8StreamText.decodeJsonResult(RawGitHubWorkflowRunsResponseSchema);
+const decodeWorkflowJobsResponse = require_collectUint8StreamText.decodeJsonResult(RawGitHubWorkflowJobsPayloadSchema);
+const decodePullRequestWorkflowContext = require_collectUint8StreamText.decodeJsonResult(RawGitHubPullRequestWorkflowContextSchema);
+const formatGitHubWorkflowDecodeError = require_collectUint8StreamText.formatSchemaError;
 function decodeGitHubWorkflowRunsJson(raw) {
 	const result = decodeWorkflowRunsResponse(raw);
 	return effect.Result.isSuccess(result) ? effect.Result.succeed(result.success.workflow_runs.map(normalizeWorkflowRun)) : effect.Result.fail(result.failure);
@@ -8974,10 +9393,10 @@ function normalizeGitHubPullRequestRecord(raw) {
 		...raw.statusCheckRollup ? { checkRollup: raw.statusCheckRollup.map((item, index) => normalizeCheckRollupItem(item, index)) } : {}
 	};
 }
-const decodeGitHubPullRequestList = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
-const decodeGitHubPullRequest = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(GitHubPullRequestSchema);
+const decodeGitHubPullRequestList = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
+const decodeGitHubPullRequest = require_collectUint8StreamText.decodeJsonResult(GitHubPullRequestSchema);
 const decodeGitHubPullRequestEntry = effect.Schema.decodeUnknownExit(GitHubPullRequestSchema);
-const formatGitHubJsonDecodeError = require_SourceControlProviderDiscoveryCatalog.formatSchemaError;
+const formatGitHubJsonDecodeError = require_collectUint8StreamText.formatSchemaError;
 function decodeGitHubPullRequestListJson(raw) {
 	const result = decodeGitHubPullRequestList(raw);
 	if (effect.Result.isSuccess(result)) {
@@ -9650,7 +10069,7 @@ const make$13 = effect.Effect.fn("makeGitHubCli")(function* () {
 			...l.description ? { description: l.description } : {}
 		}))) : effect.Effect.fail(new GitHubCliError({
 			operation: "listLabels",
-			detail: `Invalid label list output: ${require_SourceControlProviderDiscoveryCatalog.formatSchemaError(decoded.failure)}`,
+			detail: `Invalid label list output: ${require_collectUint8StreamText.formatSchemaError(decoded.failure)}`,
 			cause: decoded.failure
 		})))))),
 		listAssignees: (input) => execute({
@@ -9670,7 +10089,7 @@ const make$13 = effect.Effect.fn("makeGitHubCli")(function* () {
 			...u.avatar_url ? { avatarUrl: u.avatar_url } : {}
 		}))) : effect.Effect.fail(new GitHubCliError({
 			operation: "listAssignees",
-			detail: `Invalid assignees output: ${require_SourceControlProviderDiscoveryCatalog.formatSchemaError(decoded.failure)}`,
+			detail: `Invalid assignees output: ${require_collectUint8StreamText.formatSchemaError(decoded.failure)}`,
 			cause: decoded.failure
 		})))))),
 		listWorkflowRuns: (input) => execute({
@@ -9779,10 +10198,10 @@ function normalizeGitLabIssueRecord(raw) {
 		labels: raw.labels ?? []
 	};
 }
-const decodeIssueList = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
-const decodeIssueDetail = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(GitLabIssueSchema);
+const decodeIssueList = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
+const decodeIssueDetail = require_collectUint8StreamText.decodeJsonResult(GitLabIssueSchema);
 const decodeIssueEntry = effect.Schema.decodeUnknownExit(GitLabIssueSchema);
-const formatGitLabIssueDecodeError = require_SourceControlProviderDiscoveryCatalog.formatSchemaError;
+const formatGitLabIssueDecodeError = require_collectUint8StreamText.formatSchemaError;
 function decodeGitLabIssueListJson(raw) {
 	const result = decodeIssueList(raw);
 	if (!effect.Result.isSuccess(result)) return effect.Result.fail(result.failure);
@@ -9869,10 +10288,10 @@ function normalizeGitLabMergeRequestRecord(raw) {
 		...headRepositoryOwnerLogin ? { headRepositoryOwnerLogin } : {}
 	};
 }
-const decodeGitLabMergeRequestList = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
-const decodeGitLabMergeRequest = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(GitLabMergeRequestSchema);
+const decodeGitLabMergeRequestList = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Array(effect.Schema.Unknown));
+const decodeGitLabMergeRequest = require_collectUint8StreamText.decodeJsonResult(GitLabMergeRequestSchema);
 const decodeGitLabMergeRequestEntry = effect.Schema.decodeUnknownExit(GitLabMergeRequestSchema);
-const formatGitLabJsonDecodeError = require_SourceControlProviderDiscoveryCatalog.formatSchemaError;
+const formatGitLabJsonDecodeError = require_collectUint8StreamText.formatSchemaError;
 function decodeGitLabMergeRequestListJson(raw) {
 	const result = decodeGitLabMergeRequestList(raw);
 	if (effect.Result.isSuccess(result)) {
@@ -9891,7 +10310,7 @@ function decodeGitLabMergeRequestJson(raw) {
 	if (effect.Result.isSuccess(result)) return effect.Result.succeed(normalizeGitLabMergeRequestRecord(result.success));
 	return effect.Result.fail(result.failure);
 }
-const decodeGitLabMergeRequestDetail = require_SourceControlProviderDiscoveryCatalog.decodeJsonResult(effect.Schema.Struct({
+const decodeGitLabMergeRequestDetail = require_collectUint8StreamText.decodeJsonResult(effect.Schema.Struct({
 	...GitLabMergeRequestSchema.fields,
 	description: effect.Schema.optional(effect.Schema.NullOr(effect.Schema.String)),
 	notes: effect.Schema.optional(effect.Schema.Array(effect.Schema.Struct({
@@ -10561,26 +10980,26 @@ const make$11 = effect.Effect.fn("makeSourceControlProviderRegistry")(function*
 	const azureDevOpsCli = yield* AzureDevOpsCli;
 	const fileSystem = yield* effect.FileSystem.FileSystem;
 	const github = yield* makeLazyProvider("github", effect.Effect.tryPromise({
-		try: () => Promise.resolve().then(() => require("./GitHubSourceControlProvider-9lJFzjsu.cjs")),
+		try: () => Promise.resolve().then(() => require("./GitHubSourceControlProvider-DWmwkA_y.cjs")),
 		catch: (cause) => providerLoadError("github", cause)
 	}).pipe(effect.Effect.flatMap((module) => module.make()), effect.Effect.provideService(GitHubCli, githubCli), effect.Effect.provideService(effect.FileSystem.FileSystem, fileSystem)));
 	const gitlab = yield* makeLazyProvider("gitlab", effect.Effect.tryPromise({
-		try: () => Promise.resolve().then(() => require("./GitLabSourceControlProvider-CvKA74lg.cjs")),
+		try: () => Promise.resolve().then(() => require("./GitLabSourceControlProvider-D-YHnxRe.cjs")),
 		catch: (cause) => providerLoadError("gitlab", cause)
 	}).pipe(effect.Effect.flatMap((module) => module.make()), effect.Effect.provideService(GitLabCli, gitlabCli)));
 	const bitbucket = yield* makeLazyProvider("bitbucket", effect.Effect.tryPromise({
-		try: () => Promise.resolve().then(() => require("./BitbucketSourceControlProvider-a0IsNFyG.cjs")),
+		try: () => Promise.resolve().then(() => require("./BitbucketSourceControlProvider-1GWENqcl.cjs")),
 		catch: (cause) => providerLoadError("bitbucket", cause)
 	}).pipe(effect.Effect.flatMap((module) => module.make()), effect.Effect.provideService(BitbucketApi, bitbucketApi)), {
 		searchRepositories: true,
 		cloneAuthentication: true
 	});
 	const forgejo = yield* makeLazyProvider("forgejo", effect.Effect.tryPromise({
-		try: () => Promise.resolve().then(() => require("./ForgejoSourceControlProvider-DwAog76b.cjs")),
+		try: () => Promise.resolve().then(() => require("./ForgejoSourceControlProvider-BTXRDCGB.cjs")),
 		catch: (cause) => providerLoadError("forgejo", cause)
 	}).pipe(effect.Effect.flatMap((module) => module.make()), effect.Effect.provideService(ForgejoApi, forgejoApi)));
 	const azureDevOps = yield* makeLazyProvider("azure-devops", effect.Effect.tryPromise({
-		try: () => Promise.resolve().then(() => require("./AzureDevOpsSourceControlProvider-6holYS_D.cjs")),
+		try: () => Promise.resolve().then(() => require("./AzureDevOpsSourceControlProvider-5exivY-1.cjs")),
 		catch: (cause) => providerLoadError("azure-devops", cause)
 	}).pipe(effect.Effect.flatMap((module) => module.make()), effect.Effect.provideService(AzureDevOpsCli, azureDevOpsCli)));
 	const bitbucketDiscovery = require_SourceControlProviderDiscoveryCatalog.makeBitbucketDiscovery(bitbucketApi);
@@ -10703,22 +11122,6 @@ var CheckpointDiffQuery = class extends effect.Context.Service()("ryco/checkpoin
 //#region src/diagnostics/Services/Diagnostics.ts
 var Diagnostics = class extends effect.Context.Service()("ryco/diagnostics/Services/Diagnostics") {};
 //#endregion
-//#region src/atomicWrite.ts
-const writeFileStringAtomically = (input) => effect.Effect.scoped(effect.Effect.gen(function* () {
-	const fs = yield* effect.FileSystem.FileSystem;
-	const path = yield* effect.Path.Path;
-	const tempFileId = yield* effect_Random.nextUUIDv4;
-	const targetDirectory = path.dirname(input.filePath);
-	yield* fs.makeDirectory(targetDirectory, { recursive: true });
-	const tempDirectory = yield* fs.makeTempDirectoryScoped({
-		directory: targetDirectory,
-		prefix: `${path.basename(input.filePath)}.`
-	});
-	const tempPath = path.join(tempDirectory, `${tempFileId}.tmp`);
-	yield* fs.writeFileString(tempPath, input.contents);
-	yield* fs.rename(tempPath, input.filePath);
-}));
-//#endregion
 //#region ../../packages/shared/src/keybindings.ts
 const DEFAULT_KEYBINDINGS = [
 	{
@@ -11069,7 +11472,7 @@ function encodeWhenAst(node) {
 		case "or": return `(${encodeWhenAst(node.left)} || ${encodeWhenAst(node.right)})`;
 	}
 }
-const RawKeybindingsEntries = require_SourceControlProviderDiscoveryCatalog.fromLenientJson(effect.Schema.Array(effect.Schema.Unknown));
+const RawKeybindingsEntries = require_collectUint8StreamText.fromLenientJson(effect.Schema.Array(effect.Schema.Unknown));
 const KeybindingsConfigJson = effect.Schema.fromJsonString(require_collectUint8StreamText.KeybindingsConfig);
 const PrettyJsonString = effect.SchemaGetter.parseJson().compose(effect.SchemaGetter.stringifyJson({ space: 2 }));
 const KeybindingsConfigPrettyJson = KeybindingsConfigJson.pipe(effect.Schema.encode({
@@ -26104,300 +26507,6 @@ async function runProcess(command, args, options = {}) {
 	});
 }
 //#endregion
-//#region src/serverSettings.ts
-/**
-* ServerSettings - Server-authoritative settings service.
-*
-* Owns persistence, validation, and change notification of settings that affect
-* server-side behavior (binary paths, streaming mode, env mode, custom models,
-* text generation model selection).
-*
-* Follows the same pattern as `keybindings.ts`: JSON file + Cache + PubSub +
-* Semaphore + FileSystem.watch for concurrency and external edit detection.
-*
-* @module ServerSettings
-*/
-const textEncoder$1 = new TextEncoder();
-const textDecoder$1 = new TextDecoder();
-function providerEnvironmentSecretName(input) {
-	return `provider-env-${Buffer.from(input.instanceId, "utf8").toString("base64url")}-${Buffer.from(input.name, "utf8").toString("base64url")}`;
-}
-function redactProviderEnvironmentVariable(variable) {
-	if (!variable.sensitive) {
-		const { valueRedacted: _omit, ...rest } = variable;
-		return rest;
-	}
-	return {
-		...variable,
-		value: "",
-		...variable.value.length > 0 || variable.valueRedacted ? { valueRedacted: true } : {}
-	};
-}
-function redactServerSettingsForClient(settings) {
-	const providerInstances = Object.fromEntries(Object.entries(settings.providerInstances).map(([instanceId, instance]) => [instanceId, instance.environment ? {
-		...instance,
-		environment: instance.environment.map(redactProviderEnvironmentVariable)
-	} : instance]));
-	return {
-		...settings,
-		providerInstances
-	};
-}
-var ServerSettingsService = class ServerSettingsService extends effect.Context.Service()("ryco/serverSettings/ServerSettingsService") {
-	static layerTest = (overrides = {}) => effect.Layer.effect(ServerSettingsService, effect.Effect.gen(function* () {
-		const currentSettingsRef = yield* effect.Ref.make(deepMerge(require_collectUint8StreamText.DEFAULT_SERVER_SETTINGS, overrides));
-		return {
-			start: effect.Effect.void,
-			ready: effect.Effect.void,
-			getSettings: effect.Ref.get(currentSettingsRef),
-			updateSettings: (patch) => effect.Ref.get(currentSettingsRef).pipe(effect.Effect.flatMap((currentSettings) => effect.Schema.decodeEffect(require_collectUint8StreamText.ServerSettings)(applyServerSettingsPatch(currentSettings, patch)).pipe(effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
-				settingsPath: "<memory>",
-				detail: `failed to normalize server settings: ${effect.SchemaIssue.makeFormatterDefault()(cause.issue)}`,
-				cause
-			})))), effect.Effect.tap((nextSettings) => effect.Ref.set(currentSettingsRef, nextSettings))),
-			streamChanges: effect.Stream.empty
-		};
-	}));
-};
-const ServerSettingsJson = require_SourceControlProviderDiscoveryCatalog.fromLenientJson(require_collectUint8StreamText.ServerSettings);
-const getLegacyProviderSettings = (settings, provider) => settings.providers[provider];
-/**
-* Ensure the `textGenerationModelSelection` points to an enabled provider.
-* If the selected provider is disabled, fall back to the first enabled
-* provider with its default model.  This is applied at read-time so the
-* persisted preference is preserved for when a provider is re-enabled.
-*/
-function resolveTextGenerationProvider(settings) {
-	const selection = settings.textGenerationModelSelection;
-	const instanceConfig = settings.providerInstances[selection.instanceId];
-	if (instanceConfig !== void 0) return instanceConfig.enabled ?? true ? settings : fallbackTextGenerationProvider(settings);
-	if (require_collectUint8StreamText.isProviderDriverKind(selection.instanceId) && getLegacyProviderSettings(settings, selection.instanceId)?.enabled) return settings;
-	return fallbackTextGenerationProvider(settings);
-}
-function fallbackTextGenerationProvider(settings) {
-	const fallbackEntry = Object.entries(settings.providers).find(([, provider]) => provider.enabled);
-	const fallback = fallbackEntry ? require_collectUint8StreamText.ProviderDriverKind.make(fallbackEntry[0]) : void 0;
-	if (!fallback) return settings;
-	return {
-		...settings,
-		textGenerationModelSelection: {
-			instanceId: require_collectUint8StreamText.ProviderInstanceId.make(fallback),
-			model: require_collectUint8StreamText.DEFAULT_GIT_TEXT_GENERATION_MODEL_BY_PROVIDER[fallback] ?? "gpt-5.4-mini"
-		}
-	};
-}
-const ATOMIC_SETTINGS_KEYS = new Set(["textGenerationModelSelection"]);
-function stripDefaultServerSettings(current, defaults) {
-	if (Array.isArray(current) || Array.isArray(defaults)) return effect.Equal.equals(current, defaults) ? void 0 : current;
-	if (current !== null && defaults !== null && typeof current === "object" && typeof defaults === "object") {
-		const currentRecord = current;
-		const defaultsRecord = defaults;
-		const next = {};
-		for (const key of Object.keys(currentRecord)) if (ATOMIC_SETTINGS_KEYS.has(key)) {
-			if (!effect.Equal.equals(currentRecord[key], defaultsRecord[key])) next[key] = currentRecord[key];
-		} else {
-			const stripped = stripDefaultServerSettings(currentRecord[key], defaultsRecord[key]);
-			if (stripped !== void 0) next[key] = stripped;
-		}
-		return Object.keys(next).length > 0 ? next : void 0;
-	}
-	return Object.is(current, defaults) ? void 0 : current;
-}
-const makeServerSettings = effect.Effect.gen(function* () {
-	const { settingsPath } = yield* require_Metrics.ServerConfig;
-	const fs = yield* effect.FileSystem.FileSystem;
-	const pathService = yield* effect.Path.Path;
-	const secretStore = yield* ServerSecretStore;
-	const writeSemaphore = yield* effect_Semaphore.make(1);
-	const cacheKey = "settings";
-	const changesPubSub = yield* effect.PubSub.unbounded();
-	const startedRef = yield* effect.Ref.make(false);
-	const startedDeferred = yield* effect.Deferred.make();
-	const watcherScope = yield* effect.Scope.make("sequential");
-	yield* effect.Effect.addFinalizer(() => effect.Scope.close(watcherScope, effect.Exit.void));
-	const emitChange = (settings) => effect.PubSub.publish(changesPubSub, settings).pipe(effect.Effect.asVoid);
-	const readConfigExists = fs.exists(settingsPath).pipe(effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
-		settingsPath,
-		detail: "failed to check settings file existence",
-		cause
-	})));
-	const readRawConfig = fs.readFileString(settingsPath).pipe(effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
-		settingsPath,
-		detail: "failed to read settings file",
-		cause
-	})));
-	const loadSettingsFromDisk = effect.Effect.gen(function* () {
-		if (!(yield* readConfigExists)) return require_collectUint8StreamText.DEFAULT_SERVER_SETTINGS;
-		const raw = yield* readRawConfig;
-		const decoded = effect.Schema.decodeUnknownExit(ServerSettingsJson)(raw);
-		if (decoded._tag === "Failure") {
-			yield* effect.Effect.logWarning("failed to parse settings.json, using defaults", {
-				path: settingsPath,
-				issues: effect.Cause.pretty(decoded.cause)
-			});
-			return require_collectUint8StreamText.DEFAULT_SERVER_SETTINGS;
-		}
-		return decoded.value;
-	});
-	const settingsCache = yield* effect.Cache.make({
-		capacity: 1,
-		lookup: () => loadSettingsFromDisk
-	});
-	const getSettingsFromCache = effect.Cache.get(settingsCache, cacheKey);
-	const toSettingsError = (detail, cause) => new require_collectUint8StreamText.ServerSettingsError({
-		settingsPath,
-		detail,
-		cause
-	});
-	const materializeProviderEnvironmentSecrets = (settings) => effect.Effect.gen(function* () {
-		const providerInstances = { ...settings.providerInstances };
-		for (const [instanceId, instance] of Object.entries(settings.providerInstances)) {
-			if (!instance.environment) continue;
-			const environment = [];
-			for (const variable of instance.environment) {
-				if (!variable.sensitive || !variable.valueRedacted) {
-					environment.push(variable);
-					continue;
-				}
-				const secret = yield* secretStore.get(providerEnvironmentSecretName({
-					instanceId,
-					name: variable.name
-				})).pipe(effect.Effect.mapError((cause) => toSettingsError(`failed to read sensitive environment variable ${variable.name}`, cause)));
-				environment.push({
-					...variable,
-					value: secret ? textDecoder$1.decode(secret) : ""
-				});
-			}
-			providerInstances[instanceId] = {
-				...instance,
-				environment
-			};
-		}
-		return {
-			...settings,
-			providerInstances
-		};
-	});
-	const persistProviderEnvironmentSecrets = (current, next) => effect.Effect.gen(function* () {
-		const providerInstances = { ...next.providerInstances };
-		const nextSecretKeys = /* @__PURE__ */ new Set();
-		for (const [instanceId, instance] of Object.entries(next.providerInstances)) {
-			if (!instance.environment) continue;
-			const environment = [];
-			for (const variable of instance.environment) {
-				const secretName = providerEnvironmentSecretName({
-					instanceId,
-					name: variable.name
-				});
-				if (!variable.sensitive) {
-					yield* secretStore.remove(secretName).pipe(effect.Effect.mapError((cause) => toSettingsError(`failed to remove environment secret ${variable.name}`, cause)));
-					environment.push(redactProviderEnvironmentVariable(variable));
-					continue;
-				}
-				nextSecretKeys.add(secretName);
-				if (!variable.valueRedacted) {
-					if (variable.value.length > 0) {
-						yield* secretStore.set(secretName, textEncoder$1.encode(variable.value)).pipe(effect.Effect.mapError((cause) => toSettingsError(`failed to persist environment secret ${variable.name}`, cause)));
-						environment.push({
-							...variable,
-							value: "",
-							valueRedacted: true
-						});
-					} else {
-						yield* secretStore.remove(secretName).pipe(effect.Effect.mapError((cause) => toSettingsError(`failed to remove environment secret ${variable.name}`, cause)));
-						const { valueRedacted: _omit, ...rest } = variable;
-						environment.push(rest);
-					}
-					continue;
-				}
-				environment.push(redactProviderEnvironmentVariable(variable));
-			}
-			providerInstances[instanceId] = {
-				...instance,
-				environment
-			};
-		}
-		for (const [instanceId, instance] of Object.entries(current.providerInstances)) for (const variable of instance.environment ?? []) {
-			if (!variable.sensitive) continue;
-			const secretName = providerEnvironmentSecretName({
-				instanceId,
-				name: variable.name
-			});
-			if (nextSecretKeys.has(secretName)) continue;
-			yield* secretStore.remove(secretName).pipe(effect.Effect.mapError((cause) => toSettingsError(`failed to remove stale environment secret ${variable.name}`, cause)));
-		}
-		return {
-			...next,
-			providerInstances
-		};
-	});
-	const writeSettingsAtomically = (settings) => {
-		const sparseSettings = stripDefaultServerSettings(settings, require_collectUint8StreamText.DEFAULT_SERVER_SETTINGS) ?? {};
-		return writeFileStringAtomically({
-			filePath: settingsPath,
-			contents: `${JSON.stringify(sparseSettings, null, 2)}\n`
-		}).pipe(effect.Effect.provideService(effect.FileSystem.FileSystem, fs), effect.Effect.provideService(effect.Path.Path, pathService), effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
-			settingsPath,
-			detail: "failed to write settings file",
-			cause
-		})));
-	};
-	const revalidateAndEmit = writeSemaphore.withPermits(1)(effect.Effect.gen(function* () {
-		yield* effect.Cache.invalidate(settingsCache, cacheKey);
-		yield* emitChange(yield* getSettingsFromCache);
-	}));
-	const startWatcher = effect.Effect.gen(function* () {
-		const settingsDir = pathService.dirname(settingsPath);
-		const settingsFile = pathService.basename(settingsPath);
-		const settingsPathResolved = pathService.resolve(settingsPath);
-		yield* fs.makeDirectory(settingsDir, { recursive: true }).pipe(effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
-			settingsPath,
-			detail: "failed to prepare settings directory",
-			cause
-		})));
-		const revalidateAndEmitSafely = revalidateAndEmit.pipe(effect.Effect.ignoreCause({ log: true }));
-		const debouncedSettingsEvents = fs.watch(settingsDir).pipe(effect.Stream.filter((event) => {
-			return event.path === settingsFile || event.path === settingsPath || pathService.resolve(settingsDir, event.path) === settingsPathResolved;
-		}), effect.Stream.debounce(effect.Duration.millis(100)));
-		yield* effect.Stream.runForEach(debouncedSettingsEvents, () => revalidateAndEmitSafely).pipe(effect.Effect.ignoreCause({ log: true }), effect.Effect.forkIn(watcherScope), effect.Effect.asVoid);
-	});
-	return {
-		start: effect.Effect.gen(function* () {
-			if (!(yield* effect.Ref.modify(startedRef, (started) => [!started, true]))) return yield* effect.Deferred.await(startedDeferred);
-			const startup = effect.Effect.gen(function* () {
-				yield* startWatcher;
-				yield* effect.Cache.invalidate(settingsCache, cacheKey);
-				yield* getSettingsFromCache;
-			});
-			const startupExit = yield* effect.Effect.exit(startup);
-			if (startupExit._tag === "Failure") {
-				yield* effect.Deferred.failCause(startedDeferred, startupExit.cause).pipe(effect.Effect.orDie);
-				return yield* effect.Effect.failCause(startupExit.cause);
-			}
-			yield* effect.Deferred.succeed(startedDeferred, void 0).pipe(effect.Effect.orDie);
-		}),
-		ready: effect.Deferred.await(startedDeferred),
-		getSettings: getSettingsFromCache.pipe(effect.Effect.flatMap(materializeProviderEnvironmentSecrets), effect.Effect.map(resolveTextGenerationProvider)),
-		updateSettings: (patch) => writeSemaphore.withPermits(1)(effect.Effect.gen(function* () {
-			const current = yield* getSettingsFromCache;
-			const nextPersisted = yield* persistProviderEnvironmentSecrets(current, applyServerSettingsPatch(current, patch));
-			const next = yield* effect.Schema.decodeEffect(require_collectUint8StreamText.ServerSettings)(nextPersisted).pipe(effect.Effect.mapError((cause) => new require_collectUint8StreamText.ServerSettingsError({
-				settingsPath: "<memory>",
-				detail: `failed to normalize server settings: ${effect.SchemaIssue.makeFormatterDefault()(cause.issue)}`,
-				cause
-			})));
-			yield* writeSettingsAtomically(next);
-			yield* effect.Cache.set(settingsCache, cacheKey, next);
-			yield* emitChange(next);
-			return resolveTextGenerationProvider(yield* materializeProviderEnvironmentSecrets(next));
-		})),
-		get streamChanges() {
-			return effect.Stream.fromPubSub(changesPubSub).pipe(effect.Stream.mapEffect((settings) => materializeProviderEnvironmentSecrets(settings).pipe(effect.Effect.catch((error) => effect.Effect.logWarning("failed to materialize provider environment secrets", { detail: error.detail }).pipe(effect.Effect.as(settings))))), effect.Stream.map(resolveTextGenerationProvider));
-		}
-	};
-});
-const ServerSettingsLive = effect.Layer.effect(ServerSettingsService, makeServerSettings).pipe(effect.Layer.provide(ServerSecretStoreLive));
-//#endregion
 //#region src/pathExpansion.ts
 /**
 * Expand a leading `~` (or `~/…`, `~\…`) in a user-supplied path to the
@@ -26718,7 +26827,7 @@ const BUILT_IN_DRIVERS = [
 		configSchema: require_collectUint8StreamText.CodexSettings,
 		defaultConfig: () => effect.Schema.decodeSync(require_collectUint8StreamText.CodexSettings)({}),
 		create: (input) => effect.Effect.tryPromise({
-			try: () => Promise.resolve().then(() => require("./CodexDriver-ms_YgFD7.cjs")),
+			try: () => Promise.resolve().then(() => require("./CodexDriver-BboMT9uk.cjs")),
 			catch: (cause) => driverImportError(codexDriverKind, input, cause)
 		}).pipe(effect.Effect.flatMap(({ CodexDriver }) => CodexDriver.create(input)))
 	},
@@ -26731,7 +26840,7 @@ const BUILT_IN_DRIVERS = [
 		configSchema: require_collectUint8StreamText.ClaudeSettings,
 		defaultConfig: () => effect.Schema.decodeSync(require_collectUint8StreamText.ClaudeSettings)({}),
 		create: (input) => effect.Effect.tryPromise({
-			try: () => Promise.resolve().then(() => require("./ClaudeDriver-C6tQNEWO.cjs")),
+			try: () => Promise.resolve().then(() => require("./ClaudeDriver-BXLdjrht.cjs")),
 			catch: (cause) => driverImportError(claudeDriverKind, input, cause)
 		}).pipe(effect.Effect.flatMap(({ ClaudeDriver }) => ClaudeDriver.create(input)))
 	},
@@ -26744,7 +26853,7 @@ const BUILT_IN_DRIVERS = [
 		configSchema: require_collectUint8StreamText.CopilotSettings,
 		defaultConfig: () => effect.Schema.decodeSync(require_collectUint8StreamText.CopilotSettings)({}),
 		create: (input) => effect.Effect.tryPromise({
-			try: () => Promise.resolve().then(() => require("./CopilotDriver-B0--ZwIK.cjs")),
+			try: () => Promise.resolve().then(() => require("./CopilotDriver-DCsv-17W.cjs")),
 			catch: (cause) => driverImportError(copilotDriverKind, input, cause)
 		}).pipe(effect.Effect.flatMap(({ CopilotDriver }) => CopilotDriver.create(input)))
 	},
@@ -26757,7 +26866,7 @@ const BUILT_IN_DRIVERS = [
 		configSchema: require_collectUint8StreamText.CursorSettings,
 		defaultConfig: () => effect.Schema.decodeSync(require_collectUint8StreamText.CursorSettings)({}),
 		create: (input) => effect.Effect.tryPromise({
-			try: () => Promise.resolve().then(() => require("./CursorDriver-DTVPXZ-R.cjs")),
+			try: () => Promise.resolve().then(() => require("./CursorDriver-BTSiM3A8.cjs")),
 			catch: (cause) => driverImportError(cursorDriverKind, input, cause)
 		}).pipe(effect.Effect.flatMap(({ CursorDriver }) => CursorDriver.create(input)))
 	},
@@ -26770,7 +26879,7 @@ const BUILT_IN_DRIVERS = [
 		configSchema: require_collectUint8StreamText.OpenCodeSettings,
 		defaultConfig: () => effect.Schema.decodeSync(require_collectUint8StreamText.OpenCodeSettings)({}),
 		create: (input) => effect.Effect.tryPromise({
-			try: () => Promise.resolve().then(() => require("./OpenCodeDriver-CXUsnl5o.cjs")),
+			try: () => Promise.resolve().then(() => require("./OpenCodeDriver-CVeZ4n9-.cjs")),
 			catch: (cause) => driverImportError(openCodeDriverKind, input, cause)
 		}).pipe(effect.Effect.flatMap(({ OpenCodeDriver }) => OpenCodeDriver.create(input)))
 	}
@@ -27483,7 +27592,7 @@ const scopedSafeTeardown = (label) => (effect$15) => effect.Effect.gen(function*
 });
 //#endregion
 //#region package.json
-var version = "0.1.6";
+var version = "0.1.7";
 //#endregion
 //#region src/provider/Layers/CodexProvider.ts
 const PROVIDER_PROBE_TIMEOUT_MS = 8e3;
@@ -28520,6 +28629,387 @@ var OrchestrationEngineService = class extends effect.Context.Service()("ryco/or
 */
 var ProjectionSnapshotQuery = class extends effect.Context.Service()("ryco/orchestration/Services/ProjectionSnapshotQuery") {};
 //#endregion
+//#region src/statistics/StatisticsQuery.ts
+/**
+* StatisticsQuery - usage analytics over the orchestration projection tables.
+*
+* Aggregates the existing read models (threads, sessions, token-usage
+* activities, turns/checkpoints, worktrees) into a {@link StatisticsSnapshot}
+* on demand. No dedicated statistics tables exist; everything is derived from
+* data already persisted by the projection pipeline.
+*
+* Token figures use a per-turn delta attribution: for each `(thread, turn)` we
+* read the final `context-window.updated` activity and sum its `last*` deltas,
+* bucketed by day/project/model. When deltas are absent (older data / providers
+* that only report cumulative totals) we fall back to attributing a thread's
+* cumulative total to its primary model and last-activity day.
+*
+* @module StatisticsQuery
+*/
+/**
+* StatisticsQuery - service tag.
+*/
+var StatisticsQuery = class extends effect.Context.Service()("ryco/statistics/StatisticsQuery") {};
+function toPersistenceSqlOrDecodeError$7(sqlOperation, decodeOperation) {
+	return (cause) => effect.Schema.isSchemaError(cause) ? toPersistenceDecodeError(decodeOperation)(cause) : toPersistenceSqlError(sqlOperation)(cause);
+}
+const ThreadRow = effect.Schema.Struct({
+	threadId: effect.Schema.String,
+	projectId: require_collectUint8StreamText.ProjectId,
+	model: effect.Schema.NullOr(effect.Schema.String),
+	createdAt: effect.Schema.String,
+	providerName: effect.Schema.NullOr(effect.Schema.String)
+});
+const ProjectRow = effect.Schema.Struct({
+	projectId: require_collectUint8StreamText.ProjectId,
+	title: effect.Schema.String,
+	deletedAt: effect.Schema.NullOr(effect.Schema.String)
+});
+const TokenActivityRow = effect.Schema.Struct({
+	threadId: effect.Schema.String,
+	turnId: effect.Schema.NullOr(effect.Schema.String),
+	sequence: effect.Schema.NullOr(effect.Schema.Number),
+	createdAt: effect.Schema.String,
+	payloadJson: effect.Schema.String
+});
+const ToolUseRow = effect.Schema.Struct({
+	threadId: effect.Schema.String,
+	date: effect.Schema.String,
+	count: effect.Schema.Number
+});
+const TurnRow = effect.Schema.Struct({
+	threadId: effect.Schema.String,
+	startedAt: effect.Schema.NullOr(effect.Schema.String),
+	completedAt: effect.Schema.NullOr(effect.Schema.String),
+	checkpointTurnCount: effect.Schema.NullOr(effect.Schema.Number),
+	filesJson: effect.Schema.String
+});
+const WorktreeRow = effect.Schema.Struct({
+	createdAt: effect.Schema.String,
+	archivedAt: effect.Schema.NullOr(effect.Schema.String),
+	prNumber: effect.Schema.NullOr(effect.Schema.Number)
+});
+function num(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function dayOf(iso) {
+	return iso.length >= 10 ? iso.slice(0, 10) : null;
+}
+const makeStatisticsQuery = effect.Effect.gen(function* () {
+	const sql = yield* effect_unstable_sql_SqlClient.SqlClient;
+	const listThreadRows = effect_unstable_sql_SqlSchema.findAll({
+		Request: effect.Schema.Void,
+		Result: ThreadRow,
+		execute: () => sql`
+        SELECT
+          t.thread_id AS "threadId",
+          t.project_id AS "projectId",
+          json_extract(t.model_selection_json, '$.model') AS "model",
+          t.created_at AS "createdAt",
+          COALESCE(
+            s.provider_name,
+            json_extract(t.model_selection_json, '$.provider')
+          ) AS "providerName"
+        FROM projection_threads t
+        LEFT JOIN projection_thread_sessions s ON s.thread_id = t.thread_id
+      `
+	});
+	const listProjectRows = effect_unstable_sql_SqlSchema.findAll({
+		Request: effect.Schema.Void,
+		Result: ProjectRow,
+		execute: () => sql`
+        SELECT
+          project_id AS "projectId",
+          title,
+          deleted_at AS "deletedAt"
+        FROM projection_projects
+      `
+	});
+	const listTokenActivityRows = effect_unstable_sql_SqlSchema.findAll({
+		Request: effect.Schema.Void,
+		Result: TokenActivityRow,
+		execute: () => sql`
+        SELECT
+          thread_id AS "threadId",
+          turn_id AS "turnId",
+          sequence,
+          created_at AS "createdAt",
+          payload_json AS "payloadJson"
+        FROM projection_thread_activities
+        WHERE kind = 'context-window.updated'
+        ORDER BY thread_id ASC, turn_id ASC, sequence ASC, created_at ASC, activity_id ASC
+      `
+	});
+	const listToolUseRows = effect_unstable_sql_SqlSchema.findAll({
+		Request: effect.Schema.Void,
+		Result: ToolUseRow,
+		execute: () => sql`
+        SELECT
+          thread_id AS "threadId",
+          substr(created_at, 1, 10) AS "date",
+          COUNT(*) AS "count"
+        FROM projection_thread_activities
+        WHERE kind = 'tool.completed'
+        GROUP BY thread_id, substr(created_at, 1, 10)
+      `
+	});
+	const listTurnRows = effect_unstable_sql_SqlSchema.findAll({
+		Request: effect.Schema.Void,
+		Result: TurnRow,
+		execute: () => sql`
+        SELECT
+          thread_id AS "threadId",
+          started_at AS "startedAt",
+          completed_at AS "completedAt",
+          checkpoint_turn_count AS "checkpointTurnCount",
+          checkpoint_files_json AS "filesJson"
+        FROM projection_turns
+      `
+	});
+	const listWorktreeRows = effect_unstable_sql_SqlSchema.findAll({
+		Request: effect.Schema.Void,
+		Result: WorktreeRow,
+		execute: () => sql`
+        SELECT
+          created_at AS "createdAt",
+          archived_at AS "archivedAt",
+          pr_number AS "prNumber"
+        FROM projection_worktrees
+      `
+	});
+	const getStatistics = () => effect.Effect.gen(function* () {
+		const [threadRows, projectRows, tokenRows, toolRows, turnRows, worktreeRows] = yield* effect.Effect.all([
+			listThreadRows(void 0).pipe(effect.Effect.mapError(toPersistenceSqlOrDecodeError$7("StatisticsQuery.getStatistics:listThreads:query", "StatisticsQuery.getStatistics:listThreads:decodeRows"))),
+			listProjectRows(void 0).pipe(effect.Effect.mapError(toPersistenceSqlOrDecodeError$7("StatisticsQuery.getStatistics:listProjects:query", "StatisticsQuery.getStatistics:listProjects:decodeRows"))),
+			listTokenActivityRows(void 0).pipe(effect.Effect.mapError(toPersistenceSqlOrDecodeError$7("StatisticsQuery.getStatistics:listTokenActivities:query", "StatisticsQuery.getStatistics:listTokenActivities:decodeRows"))),
+			listToolUseRows(void 0).pipe(effect.Effect.mapError(toPersistenceSqlOrDecodeError$7("StatisticsQuery.getStatistics:listToolUses:query", "StatisticsQuery.getStatistics:listToolUses:decodeRows"))),
+			listTurnRows(void 0).pipe(effect.Effect.mapError(toPersistenceSqlOrDecodeError$7("StatisticsQuery.getStatistics:listTurns:query", "StatisticsQuery.getStatistics:listTurns:decodeRows"))),
+			listWorktreeRows(void 0).pipe(effect.Effect.mapError(toPersistenceSqlOrDecodeError$7("StatisticsQuery.getStatistics:listWorktrees:query", "StatisticsQuery.getStatistics:listWorktrees:decodeRows")))
+		], { concurrency: "unbounded" });
+		const threadMeta = /* @__PURE__ */ new Map();
+		const modelProvider = /* @__PURE__ */ new Map();
+		for (const row of threadRows) {
+			const provider = row.providerName?.trim() || void 0;
+			const model = (row.model ?? "").trim() || "unknown";
+			threadMeta.set(row.threadId, {
+				projectId: row.projectId,
+				model,
+				provider,
+				createdAt: row.createdAt
+			});
+			if (!modelProvider.has(model) || modelProvider.get(model) === void 0 && provider) modelProvider.set(model, provider);
+		}
+		const buckets = /* @__PURE__ */ new Map();
+		const getBucket = (date, projectId, model) => {
+			const key = `${date}${projectId}${model}`;
+			let bucket = buckets.get(key);
+			if (!bucket) {
+				bucket = {
+					date,
+					projectId,
+					model,
+					provider: modelProvider.get(model),
+					inputTokens: 0,
+					outputTokens: 0,
+					cachedInputTokens: 0,
+					reasoningTokens: 0,
+					turns: 0,
+					activeMs: 0,
+					toolUses: 0,
+					filesChanged: 0,
+					additions: 0,
+					deletions: 0,
+					commits: 0,
+					pushes: 0,
+					threadsCreated: 0
+				};
+				buckets.set(key, bucket);
+			}
+			return bucket;
+		};
+		let earliest;
+		const considerIso = (iso) => {
+			if (iso && (earliest === void 0 || iso < earliest)) earliest = iso;
+		};
+		const lastPerTurn = /* @__PURE__ */ new Map();
+		const lastPerThread = /* @__PURE__ */ new Map();
+		const isLater = (a, b) => {
+			if (a.createdAt !== b.createdAt) return a.createdAt > b.createdAt;
+			return (a.sequence ?? -1) >= (b.sequence ?? -1);
+		};
+		for (const row of tokenRows) {
+			considerIso(row.createdAt);
+			lastPerTurn.set(`${row.threadId}${row.turnId ?? ""}`, row);
+			const prevThread = lastPerThread.get(row.threadId);
+			if (!prevThread || isLater(row, prevThread)) lastPerThread.set(row.threadId, row);
+		}
+		let perTurnDeltaSum = 0;
+		for (const row of lastPerTurn.values()) {
+			const payload = safeParse(row.payloadJson);
+			perTurnDeltaSum += num(payload?.lastInputTokens) + num(payload?.lastOutputTokens) + num(payload?.lastCachedInputTokens) + num(payload?.lastReasoningOutputTokens);
+		}
+		let cumulativeSum = 0;
+		for (const row of lastPerThread.values()) {
+			const payload = safeParse(row.payloadJson);
+			cumulativeSum += num(payload?.inputTokens) + num(payload?.outputTokens);
+		}
+		const attribution = perTurnDeltaSum === 0 && cumulativeSum > 0 ? "thread-cumulative" : "per-turn-delta";
+		if (attribution === "per-turn-delta") for (const row of lastPerTurn.values()) {
+			const meta = threadMeta.get(row.threadId);
+			const date = dayOf(row.createdAt);
+			if (!meta || !date) continue;
+			const payload = safeParse(row.payloadJson);
+			const bucket = getBucket(date, meta.projectId, meta.model);
+			bucket.inputTokens += num(payload?.lastInputTokens);
+			bucket.outputTokens += num(payload?.lastOutputTokens);
+			bucket.cachedInputTokens += num(payload?.lastCachedInputTokens);
+			bucket.reasoningTokens += num(payload?.lastReasoningOutputTokens);
+		}
+		else for (const row of lastPerThread.values()) {
+			const meta = threadMeta.get(row.threadId);
+			const date = dayOf(row.createdAt);
+			if (!meta || !date) continue;
+			const payload = safeParse(row.payloadJson);
+			const bucket = getBucket(date, meta.projectId, meta.model);
+			bucket.inputTokens += num(payload?.inputTokens);
+			bucket.outputTokens += num(payload?.outputTokens);
+			bucket.cachedInputTokens += num(payload?.cachedInputTokens);
+			bucket.reasoningTokens += num(payload?.reasoningOutputTokens);
+		}
+		for (const row of turnRows) {
+			const meta = threadMeta.get(row.threadId);
+			if (!meta) continue;
+			considerIso(row.startedAt);
+			considerIso(row.completedAt);
+			const anchor = row.completedAt ?? row.startedAt;
+			const date = anchor ? dayOf(anchor) : null;
+			if (!date) continue;
+			const bucket = getBucket(date, meta.projectId, meta.model);
+			if (row.completedAt) {
+				bucket.turns += 1;
+				if (row.startedAt) {
+					const delta = Date.parse(row.completedAt) - Date.parse(row.startedAt);
+					if (Number.isFinite(delta) && delta > 0) bucket.activeMs += delta;
+				}
+			}
+			const files = safeParseArray(row.filesJson);
+			if (files.length > 0) {
+				bucket.filesChanged += files.length;
+				for (const file of files) {
+					bucket.additions += num(file?.additions);
+					bucket.deletions += num(file?.deletions);
+				}
+			}
+		}
+		for (const row of toolRows) {
+			const meta = threadMeta.get(row.threadId);
+			if (!meta) continue;
+			const bucket = getBucket(row.date, meta.projectId, meta.model);
+			bucket.toolUses += num(row.count);
+		}
+		for (const meta of threadMeta.values()) {
+			considerIso(meta.createdAt);
+			const date = dayOf(meta.createdAt);
+			if (!date) continue;
+			getBucket(date, meta.projectId, meta.model).threadsCreated += 1;
+		}
+		let wtCreated = 0;
+		let wtArchived = 0;
+		let wtOpenPrs = 0;
+		for (const row of worktreeRows) {
+			considerIso(row.createdAt);
+			wtCreated += 1;
+			if (row.archivedAt) wtArchived += 1;
+			else if (row.prNumber !== null) wtOpenPrs += 1;
+		}
+		const dailyBuckets = [];
+		const totals = {
+			inputTokens: 0,
+			outputTokens: 0,
+			cachedInputTokens: 0,
+			reasoningTokens: 0,
+			totalTokens: 0,
+			turns: 0,
+			activeMs: 0,
+			toolUses: 0,
+			filesChanged: 0,
+			additions: 0,
+			deletions: 0,
+			commits: 0,
+			pushes: 0,
+			threads: threadMeta.size,
+			projects: 0
+		};
+		for (const bucket of buckets.values()) {
+			const { provider, ...rest } = bucket;
+			dailyBuckets.push(provider ? {
+				...rest,
+				provider
+			} : rest);
+			totals.inputTokens += bucket.inputTokens;
+			totals.outputTokens += bucket.outputTokens;
+			totals.cachedInputTokens += bucket.cachedInputTokens;
+			totals.reasoningTokens += bucket.reasoningTokens;
+			totals.turns += bucket.turns;
+			totals.activeMs += bucket.activeMs;
+			totals.toolUses += bucket.toolUses;
+			totals.filesChanged += bucket.filesChanged;
+			totals.additions += bucket.additions;
+			totals.deletions += bucket.deletions;
+			totals.commits += bucket.commits;
+			totals.pushes += bucket.pushes;
+		}
+		totals.totalTokens = totals.inputTokens + totals.outputTokens;
+		const projectTitle = /* @__PURE__ */ new Map();
+		for (const row of projectRows) projectTitle.set(row.projectId, row.title);
+		const projectIdsInData = /* @__PURE__ */ new Set();
+		for (const meta of threadMeta.values()) projectIdsInData.add(meta.projectId);
+		for (const bucket of buckets.values()) projectIdsInData.add(bucket.projectId);
+		totals.projects = projectIdsInData.size;
+		const projects = [...projectIdsInData].map((id) => ({
+			id,
+			title: projectTitle.get(id)?.trim() || id
+		}));
+		const models = [...modelProvider].map(([model, provider]) => provider ? {
+			model,
+			provider
+		} : { model });
+		return {
+			generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			...earliest ? { earliestActivityAt: earliest } : {},
+			projects,
+			models,
+			dailyBuckets,
+			worktrees: {
+				created: wtCreated,
+				archived: wtArchived,
+				active: wtCreated - wtArchived,
+				openPrs: wtOpenPrs
+			},
+			totals,
+			tokenAttribution: attribution
+		};
+	});
+	return { getStatistics };
+});
+function safeParse(json) {
+	try {
+		const parsed = JSON.parse(json);
+		return parsed && typeof parsed === "object" ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function safeParseArray(json) {
+	try {
+		const parsed = JSON.parse(json);
+		return Array.isArray(parsed) ? parsed : [];
+	} catch {
+		return [];
+	}
+}
+const StatisticsQueryLive = effect.Layer.effect(StatisticsQuery, makeStatisticsQuery);
+//#endregion
 //#region src/serverLifecycleEvents.ts
 var ServerLifecycleEvents = class extends effect.Context.Service()("ryco/serverLifecycleEvents") {};
 const ServerLifecycleEventsLive = effect.Layer.effect(ServerLifecycleEvents, effect.Effect.gen(function* () {
@@ -30409,7 +30899,8 @@ const makeGitManager = effect.Effect.fn("makeGitManager")(function* () {
 			isDefaultRef: details.isDefaultBranch,
 			refName: details.branch,
 			hasWorkingTreeChanges: details.hasWorkingTreeChanges,
-			workingTree: details.workingTree
+			workingTree: details.workingTree,
+			...details.committed ? { committed: details.committed } : {}
 		};
 	});
 	const localStatusResultCache = yield* effect.Cache.makeWith(readLocalStatus, {
@@ -32543,6 +33034,8 @@ const layer = effect.Layer.effect(JiraWorkItemService, make$5());
 //#region src/remote/Services/AdvertisedEndpointRegistry.ts
 var AdvertisedEndpointRegistry = class extends effect.Context.Service()("ryco/remote/Services/AdvertisedEndpointRegistry") {};
 const ORCHESTRATION_REPLAY_PAGE_MAX_LIMIT = 1e3;
+const ORCHESTRATION_LEGACY_REPLAY_MAX_EVENTS = ORCHESTRATION_REPLAY_PAGE_MAX_LIMIT;
+const ORCHESTRATION_LIVE_QUEUE_MAX_EVENTS = 1e3;
 //#endregion
 //#region src/ws/context/gitErrors.ts
 function gitErrorText(error) {
@@ -32576,6 +33069,10 @@ const failGitWorkflow = (operation, detail, cause) => effect.Effect.fail(toGitMa
 const wsOrchestrationReplayDepth = effect.Metric.gauge("t3_ws_orchestration_replay_depth", { description: "Current persisted orchestration event replay depth for a replayable WebSocket subscription." });
 const wsOrchestrationLiveBufferDepth = effect.Metric.gauge("t3_ws_orchestration_live_buffer_depth", { description: "Current live orchestration event buffer depth for a replayable WebSocket subscription." });
 const wsOrchestrationLiveBufferHighWater = effect.Metric.gauge("t3_ws_orchestration_live_buffer_high_water", { description: "Highest observed live orchestration event buffer depth for a replayable WebSocket subscription." });
+const wsOrchestrationLiveBufferOverflowsTotal = effect.Metric.counter("t3_ws_orchestration_live_buffer_overflows_total", {
+	description: "Total live orchestration event buffer overflows that forced replayable WebSocket subscription resync.",
+	incremental: true
+});
 const wsOrchestrationReplayLag = effect.Metric.gauge("t3_ws_orchestration_replay_lag", { description: "Sequence lag between the latest live event observed and the latest replay/live event drained by a replayable WebSocket subscription." });
 const normalizeSequence = (sequence) => Number.isFinite(sequence) ? Math.max(0, Math.floor(sequence)) : 0;
 const updateGauge$1 = (metric, attributes, value) => effect.Metric.update(effect.Metric.withAttributes(metric, attributes), value);
@@ -32613,6 +33110,18 @@ const makeWsReplayMetrics = (input) => effect.Effect.gen(function* () {
 			yield* recordLiveBuffer(yield* effect.Ref.updateAndGet(liveBufferDepth, (current) => Math.max(0, current - 1)), yield* effect.Ref.get(liveBufferHighWater));
 			yield* markDrained(sequence);
 		}),
+		recordLiveOverflow: (sequence, capacity) => effect.Effect.gen(function* () {
+			const normalizedSequence = normalizeSequence(sequence);
+			const normalizedCapacity = Math.max(0, Math.floor(capacity));
+			yield* effect.Ref.update(latestLiveSequence, (current) => Math.max(current, normalizedSequence));
+			yield* effect.Ref.set(liveBufferDepth, normalizedCapacity);
+			const highWater = yield* effect.Ref.updateAndGet(liveBufferHighWater, (current) => Math.max(current, normalizedCapacity));
+			yield* effect.Effect.all([
+				recordLiveBuffer(normalizedCapacity, highWater),
+				updateGauge$1(wsOrchestrationLiveBufferOverflowsTotal, attributes, 1),
+				recordLag
+			], { discard: true });
+		}),
 		reset: effect.Effect.all([
 			updateGauge$1(wsOrchestrationReplayDepth, attributes, 0),
 			updateGauge$1(wsOrchestrationLiveBufferDepth, attributes, 0),
@@ -32663,6 +33172,29 @@ const buildWorkItemBranchNameMessage = (input) => {
 };
 //#endregion
 //#region src/ws/context/orchestrationStreams.ts
+const makeLiveQueueOverflowError = (input) => new require_collectUint8StreamText.OrchestrationGetSnapshotError({
+	message: `Orchestration ${input.stream} live event queue overflowed; reconnect to resynchronize`,
+	cause: /* @__PURE__ */ new Error(`orchestration ${input.stream} live queue overflow at sequence ${input.sequence} with capacity ${input.capacity}`)
+});
+const offerOrchestrationLiveEventOrFail = (input) => effect.Effect.gen(function* () {
+	const capacity = input.capacity ?? 1e3;
+	if (effect.Queue.offerUnsafe(input.liveQueue, input.event)) {
+		yield* input.replayMetrics.recordLiveEnqueued(input.event.sequence);
+		return;
+	}
+	if (!(yield* effect.Ref.modify(input.overflowedRef, (overflowed) => [!overflowed, true]))) return;
+	yield* input.replayMetrics.recordLiveOverflow(input.event.sequence, capacity);
+	yield* effect.Effect.logWarning("orchestration live stream queue overflow; forcing resync", {
+		stream: input.stream,
+		sequence: input.event.sequence,
+		capacity
+	});
+	yield* effect.Queue.fail(input.liveQueue, makeLiveQueueOverflowError({
+		stream: input.stream,
+		sequence: input.event.sequence,
+		capacity
+	}));
+});
 const makeOrchestrationStreamHelpers = (deps) => {
 	const { orchestrationEngine, projectionSnapshotQuery, repositoryIdentityResolver } = deps;
 	const enrichProjectEvent = (event) => {
@@ -32782,8 +33314,9 @@ const makeOrchestrationStreamHelpers = (deps) => {
 		const loadedSnapshot = yield* snapshot;
 		const snapshotSequence = loadedSnapshot.snapshotSequence;
 		const liveSubscription = yield* orchestrationEngine.subscribeDomainEvents;
-		const liveQueue = yield* effect.Queue.unbounded();
+		const liveQueue = yield* effect.Queue.bounded(ORCHESTRATION_LIVE_QUEUE_MAX_EVENTS);
 		const lastSequenceRef = yield* effect.Ref.make(snapshotSequence);
+		const overflowedRef = yield* effect.Ref.make(false);
 		const replayBoundary = yield* makeReplayBoundaryTracker(snapshotSequence);
 		const replayMetrics = yield* makeWsReplayMetrics({
 			stream: "shell",
@@ -32792,8 +33325,13 @@ const makeOrchestrationStreamHelpers = (deps) => {
 		});
 		yield* effect.Stream.fromSubscription(liveSubscription).pipe(effect.Stream.runForEach((event) => effect.Effect.gen(function* () {
 			yield* replayBoundary.recordLiveSequence(event.sequence);
-			yield* effect.Queue.offer(liveQueue, event);
-			yield* replayMetrics.recordLiveEnqueued(event.sequence);
+			yield* offerOrchestrationLiveEventOrFail({
+				stream: "shell",
+				event,
+				liveQueue,
+				overflowedRef,
+				replayMetrics
+			});
 		})), effect.Effect.ensuring(effect.Queue.shutdown(liveQueue)), effect.Effect.ignoreCause({ log: true }), effect.Effect.forkScoped);
 		const replayStream = makeBoundedReplayStream({
 			snapshotSequence,
@@ -32811,8 +33349,9 @@ const makeOrchestrationStreamHelpers = (deps) => {
 		const loadedSnapshot = yield* snapshot;
 		const snapshotSequence = loadedSnapshot.snapshotSequence;
 		const liveSubscription = yield* orchestrationEngine.subscribeDomainEvents;
-		const liveQueue = yield* effect.Queue.unbounded();
+		const liveQueue = yield* effect.Queue.bounded(ORCHESTRATION_LIVE_QUEUE_MAX_EVENTS);
 		const lastSequenceRef = yield* effect.Ref.make(snapshotSequence);
+		const overflowedRef = yield* effect.Ref.make(false);
 		const replayBoundary = yield* makeReplayBoundaryTracker(snapshotSequence);
 		const replayMetrics = yield* makeWsReplayMetrics({
 			stream: "thread",
@@ -32825,8 +33364,13 @@ const makeOrchestrationStreamHelpers = (deps) => {
 		})));
 		yield* effect.Stream.fromSubscription(liveSubscription).pipe(effect.Stream.runForEach((event) => effect.Effect.gen(function* () {
 			yield* replayBoundary.recordLiveSequence(event.sequence);
-			yield* effect.Queue.offer(liveQueue, event);
-			yield* replayMetrics.recordLiveEnqueued(event.sequence);
+			yield* offerOrchestrationLiveEventOrFail({
+				stream: "thread",
+				event,
+				liveQueue,
+				overflowedRef,
+				replayMetrics
+			});
 		})), effect.Effect.ensuring(effect.Queue.shutdown(liveQueue)), effect.Effect.ignoreCause({ log: true }), effect.Effect.forkScoped);
 		const replayStream = makeBoundedReplayStream({
 			snapshotSequence,
@@ -33367,6 +33911,7 @@ function toDiagnosticsProviderProcess(provider) {
 const makeWsRpcContext = (session) => effect.Effect.gen(function* () {
 	const currentSessionId = session.sessionId;
 	const projectionSnapshotQuery = yield* ProjectionSnapshotQuery;
+	const statisticsQuery = yield* StatisticsQuery;
 	const orchestrationEngine = yield* OrchestrationEngineService;
 	const checkpointDiffQuery = yield* CheckpointDiffQuery;
 	const keybindings = yield* Keybindings;
@@ -33690,6 +34235,7 @@ const makeWsRpcContext = (session) => effect.Effect.gen(function* () {
 	return {
 		currentSessionId,
 		projectionSnapshotQuery,
+		statisticsQuery,
 		orchestrationEngine,
 		checkpointDiffQuery,
 		keybindings,
@@ -33967,9 +34513,9 @@ function recordServerPerfPayload(label, value, record) {
 //#endregion
 //#region src/ws/orchestrationRpc.ts
 const makeOrchestrationHandlers = (ctx) => {
-	const { withAccess, ownerEffect, projectionSnapshotQuery, dispatchNormalizedCommand, dispatchWorktreeCommand, serverCommandId, terminalManager, checkpointDiffQuery, orchestrationEngine, enrichOrchestrationEvents, makeReplayableShellStream, makeReplayableThreadStream } = ctx;
+	const { ownerEffect, projectionSnapshotQuery, dispatchNormalizedCommand, dispatchWorktreeCommand, serverCommandId, terminalManager, checkpointDiffQuery, orchestrationEngine, enrichOrchestrationEvents, makeReplayableShellStream, makeReplayableThreadStream } = ctx;
 	return defineWsHandlers({
-		[require_collectUint8StreamText.ORCHESTRATION_WS_METHODS.dispatchCommand]: (command) => observeRpcEffect(require_collectUint8StreamText.ORCHESTRATION_WS_METHODS.dispatchCommand, withAccess("authenticated", require_collectUint8StreamText.ORCHESTRATION_WS_METHODS.dispatchCommand, effect.Effect.gen(function* () {
+		[require_collectUint8StreamText.ORCHESTRATION_WS_METHODS.dispatchCommand]: (command) => observeRpcEffect(require_collectUint8StreamText.ORCHESTRATION_WS_METHODS.dispatchCommand, ownerEffect(require_collectUint8StreamText.ORCHESTRATION_WS_METHODS.dispatchCommand, effect.Effect.gen(function* () {
 			const normalizedCommand = yield* normalizeDispatchCommand(command);
 			const shouldStopSessionAfterArchive = normalizedCommand.type === "thread.archive" ? yield* projectionSnapshotQuery.getThreadShellById(normalizedCommand.threadId).pipe(effect.Effect.map(effect.Option.match({
 				onNone: () => false,
@@ -34009,7 +34555,7 @@ const makeOrchestrationHandlers = (ctx) => {
 		[require_collectUint8StreamText.ORCHESTRATION_WS_METHODS.replayEvents]: (input) => observeRpcEffect(require_collectUint8StreamText.ORCHESTRATION_WS_METHODS.replayEvents, effect.Stream.runCollect(orchestrationEngine.readEvents((0, effect_Number.clamp)(input.fromSequenceExclusive, {
 			maximum: Number.MAX_SAFE_INTEGER,
 			minimum: 0
-		}))).pipe(effect.Effect.map((events) => Array.from(events)), effect.Effect.flatMap(enrichOrchestrationEvents), effect.Effect.mapError((cause) => new require_collectUint8StreamText.OrchestrationReplayEventsError({
+		}), ORCHESTRATION_LEGACY_REPLAY_MAX_EVENTS)).pipe(effect.Effect.map((events) => Array.from(events)), effect.Effect.flatMap(enrichOrchestrationEvents), effect.Effect.mapError((cause) => new require_collectUint8StreamText.OrchestrationReplayEventsError({
 			message: "Failed to replay orchestration events",
 			cause
 		}))), { "rpc.aggregate": "orchestration" }),
@@ -34140,10 +34686,25 @@ const makeTerminalHandlers = (ctx) => {
 		[require_collectUint8StreamText.WS_METHODS.terminalClear]: (input) => observeRpcEffect(require_collectUint8StreamText.WS_METHODS.terminalClear, ownerEffect(require_collectUint8StreamText.WS_METHODS.terminalClear, terminalManager.clear(input)), { "rpc.aggregate": "terminal" }),
 		[require_collectUint8StreamText.WS_METHODS.terminalRestart]: (input) => observeRpcEffect(require_collectUint8StreamText.WS_METHODS.terminalRestart, ownerEffect(require_collectUint8StreamText.WS_METHODS.terminalRestart, terminalManager.restart(input)), { "rpc.aggregate": "terminal" }),
 		[require_collectUint8StreamText.WS_METHODS.terminalClose]: (input) => observeRpcEffect(require_collectUint8StreamText.WS_METHODS.terminalClose, ownerEffect(require_collectUint8StreamText.WS_METHODS.terminalClose, terminalManager.close(input)), { "rpc.aggregate": "terminal" }),
-		[require_collectUint8StreamText.WS_METHODS.subscribeTerminalEvents]: (_input) => observeRpcStream(require_collectUint8StreamText.WS_METHODS.subscribeTerminalEvents, ownerStream(require_collectUint8StreamText.WS_METHODS.subscribeTerminalEvents, effect.Stream.callback((queue) => effect.Effect.acquireRelease(terminalManager.subscribe((event) => effect.Effect.gen(function* () {
-			recordServerPerfPayload("server.ws.terminal.events", event);
-			yield* effect.Queue.offer(queue, event);
-		})), (unsubscribe) => effect.Effect.sync(unsubscribe)))), { "rpc.aggregate": "terminal" })
+		[require_collectUint8StreamText.WS_METHODS.subscribeTerminalEvents]: (_input) => observeRpcStream(require_collectUint8StreamText.WS_METHODS.subscribeTerminalEvents, ownerStream(require_collectUint8StreamText.WS_METHODS.subscribeTerminalEvents, effect.Stream.callback((queue) => effect.Effect.acquireRelease(effect.Effect.gen(function* () {
+			const unsubscribe = yield* terminalManager.subscribe((event) => effect.Effect.gen(function* () {
+				recordServerPerfPayload("server.ws.terminal.events", event);
+				yield* effect.Queue.offer(queue, event);
+			}));
+			const snapshots = yield* terminalManager.listSessions;
+			yield* effect.Effect.forEach(snapshots.filter((snapshot) => snapshot.status === "running"), (snapshot) => {
+				const event = {
+					type: "started",
+					threadId: snapshot.threadId,
+					terminalId: snapshot.terminalId,
+					createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+					snapshot
+				};
+				recordServerPerfPayload("server.ws.terminal.events", event);
+				return effect.Queue.offer(queue, event);
+			}, { discard: true });
+			return unsubscribe;
+		}), (unsubscribe) => effect.Effect.sync(unsubscribe)))), { "rpc.aggregate": "terminal" })
 	});
 };
 //#endregion
@@ -34238,7 +34799,7 @@ const makeSourceControlHandlers = (ctx) => {
 			cwd,
 			reason: "sourceControl.searchIssues"
 		})))), { "rpc.aggregate": "source-control" }),
-		[require_collectUint8StreamText.WS_METHODS.sourceControlListChangeRequests]: ({ cwd, state, limit, query }) => observeRpcEffect(require_collectUint8StreamText.WS_METHODS.sourceControlListChangeRequests, sourceControlRegistry.resolve({ cwd }).pipe(effect.Effect.flatMap((provider) => {
+		[require_collectUint8StreamText.WS_METHODS.sourceControlListChangeRequests]: ({ cwd, state, limit, query }) => observeRpcEffect(require_collectUint8StreamText.WS_METHODS.sourceControlListChangeRequests, ownerEffect(require_collectUint8StreamText.WS_METHODS.sourceControlListChangeRequests, sourceControlRegistry.resolve({ cwd }).pipe(effect.Effect.flatMap((provider) => {
 			const trimmedQuery = query?.trim() ?? "";
 			if (trimmedQuery.length > 0) return provider.searchChangeRequests({
 				cwd,
@@ -34254,7 +34815,7 @@ const makeSourceControlHandlers = (ctx) => {
 		}), effect.Effect.tap(() => refreshLinkedWorktreeSourceControlStates({
 			cwd,
 			reason: "sourceControl.listChangeRequests"
-		}))), { "rpc.aggregate": "source-control" }),
+		})))), { "rpc.aggregate": "source-control" }),
 		[require_collectUint8StreamText.WS_METHODS.sourceControlSearchChangeRequests]: ({ cwd, query, limit }) => observeRpcEffect(require_collectUint8StreamText.WS_METHODS.sourceControlSearchChangeRequests, ownerEffect(require_collectUint8StreamText.WS_METHODS.sourceControlSearchChangeRequests, sourceControlRegistry.resolve({ cwd }).pipe(effect.Effect.flatMap((provider) => provider.searchChangeRequests({
 			cwd,
 			query,
@@ -35004,12 +35565,19 @@ const makeProviderHandlers = (ctx) => {
 	});
 };
 //#endregion
+//#region src/ws/statisticsRpc.ts
+const makeStatisticsHandlers = (ctx) => {
+	const { statisticsQuery, ownerEffect } = ctx;
+	return defineWsHandlers({ [require_collectUint8StreamText.WS_METHODS.serverGetStatistics]: (_input) => observeRpcEffect(require_collectUint8StreamText.WS_METHODS.serverGetStatistics, ownerEffect(require_collectUint8StreamText.WS_METHODS.serverGetStatistics, statisticsQuery.getStatistics().pipe(effect.Effect.orDie)), { "rpc.aggregate": "server" }) });
+};
+//#endregion
 //#region src/ws/index.ts
 const makeWsRpcLayer = (session) => require_collectUint8StreamText.WsRpcGroup.toLayer(effect.Effect.gen(function* () {
 	const ctx = yield* makeWsRpcContext(session);
 	return require_collectUint8StreamText.WsRpcGroup.of({
 		...makeOrchestrationHandlers(ctx),
 		...makeProviderHandlers(ctx),
+		...makeStatisticsHandlers(ctx),
 		...makeSourceControlHandlers(ctx),
 		...makeProjectHandlers(ctx),
 		...makeGitHandlers(ctx),
@@ -37427,6 +37995,8 @@ const DEFAULT_PERSIST_DEBOUNCE_MS = 40;
 const DEFAULT_SUBPROCESS_POLL_INTERVAL_MS = 1e3;
 const DEFAULT_PROCESS_KILL_GRACE_MS = 1e3;
 const DEFAULT_MAX_RETAINED_INACTIVE_SESSIONS = 128;
+const DEFAULT_MAX_PENDING_PROCESS_EVENTS = 2048;
+const DEFAULT_MAX_PENDING_PROCESS_OUTPUT_BYTES = 2 * 1024 * 1024;
 const DEFAULT_OPEN_COLS = 120;
 const DEFAULT_OPEN_ROWS = 30;
 const TERMINAL_ENV_BLOCKLIST = new Set([
@@ -37483,13 +38053,86 @@ function cleanupProcessHandles(session) {
 	session.unsubscribeExit?.();
 	session.unsubscribeExit = null;
 }
-function enqueueProcessEvent(session, expectedPid, event) {
+function clearPendingProcessEvents(session) {
+	session.pendingProcessEvents = [];
+	session.pendingProcessEventIndex = 0;
+	session.pendingProcessOutputBytes = 0;
+	session.processEventDrainRunning = false;
+}
+function enqueueProcessEvent(session, expectedPid, event, limits) {
 	if (!session.process || session.status !== "running" || session.pid !== expectedPid) return false;
+	if (event.type === "output" && session.pendingProcessEvents.some((pendingEvent) => pendingEvent.type === "exit")) return false;
+	compactPendingProcessEvents(session);
 	session.pendingProcessEvents.push(event);
+	if (event.type === "output") session.pendingProcessOutputBytes += event.byteLength;
+	enforcePendingProcessEventLimits(session, limits);
 	if (session.processEventDrainRunning) return false;
 	session.processEventDrainRunning = true;
 	return true;
 }
+function compactPendingProcessEvents(session) {
+	if (session.pendingProcessEventIndex <= 0) return;
+	session.pendingProcessEvents = session.pendingProcessEvents.slice(session.pendingProcessEventIndex);
+	session.pendingProcessEventIndex = 0;
+}
+function coalesceOldestPendingOutputPair(session) {
+	for (let index = 0; index < session.pendingProcessEvents.length - 1; index += 1) {
+		const current = session.pendingProcessEvents[index];
+		const next = session.pendingProcessEvents[index + 1];
+		if (current?.type !== "output" || next?.type !== "output") continue;
+		session.pendingProcessEvents.splice(index, 2, {
+			type: "output",
+			data: `${current.data}${next.data}`,
+			byteLength: current.byteLength + next.byteLength
+		});
+		return true;
+	}
+	return false;
+}
+function trimOutputDataToApproxBytes(data, maxBytes) {
+	if (maxBytes <= 0 || data.length === 0) return {
+		data: "",
+		byteLength: 0
+	};
+	let nextData = data;
+	let byteLength = approximateTextBytes(nextData);
+	while (byteLength > maxBytes && nextData.length > 0) {
+		const excessBytes = byteLength - maxBytes;
+		const sliceStart = Math.min(nextData.length, Math.max(1, excessBytes));
+		nextData = nextData.slice(sliceStart);
+		byteLength = approximateTextBytes(nextData);
+	}
+	return {
+		data: nextData,
+		byteLength
+	};
+}
+function trimPendingOutputBytesToLimit(session, maxPendingProcessOutputBytes) {
+	if (session.pendingProcessOutputBytes <= maxPendingProcessOutputBytes) return;
+	for (let index = 0; index < session.pendingProcessEvents.length; index += 1) {
+		if (session.pendingProcessOutputBytes <= maxPendingProcessOutputBytes) return;
+		const event = session.pendingProcessEvents[index];
+		if (event?.type !== "output") continue;
+		const targetEventBytes = Math.max(0, event.byteLength - (session.pendingProcessOutputBytes - maxPendingProcessOutputBytes));
+		if (targetEventBytes <= 0) {
+			session.pendingProcessEvents.splice(index, 1);
+			session.pendingProcessOutputBytes = Math.max(0, session.pendingProcessOutputBytes - event.byteLength);
+			index -= 1;
+			continue;
+		}
+		const trimmed = trimOutputDataToApproxBytes(event.data, targetEventBytes);
+		session.pendingProcessEvents[index] = {
+			type: "output",
+			data: trimmed.data,
+			byteLength: trimmed.byteLength
+		};
+		session.pendingProcessOutputBytes = Math.max(0, session.pendingProcessOutputBytes - (event.byteLength - trimmed.byteLength));
+	}
+}
+function enforcePendingProcessEventLimits(session, limits) {
+	while (session.pendingProcessEvents.length > limits.maxPendingProcessEvents && coalesceOldestPendingOutputPair(session));
+	trimPendingOutputBytesToLimit(session, limits.maxPendingProcessOutputBytes);
+}
 function defaultShellResolver(platform = process.platform, env = process.env) {
 	if (platform === "win32") return "pwsh.exe";
 	return env.SHELL ?? "bash";
@@ -37856,6 +38499,10 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 	const subprocessPollIntervalMs = options.subprocessPollIntervalMs ?? DEFAULT_SUBPROCESS_POLL_INTERVAL_MS;
 	const processKillGraceMs = options.processKillGraceMs ?? DEFAULT_PROCESS_KILL_GRACE_MS;
 	const maxRetainedInactiveSessions = options.maxRetainedInactiveSessions ?? DEFAULT_MAX_RETAINED_INACTIVE_SESSIONS;
+	const pendingProcessEventLimits = {
+		maxPendingProcessEvents: Math.max(1, options.maxPendingProcessEvents ?? DEFAULT_MAX_PENDING_PROCESS_EVENTS),
+		maxPendingProcessOutputBytes: Math.max(1, options.maxPendingProcessOutputBytes ?? DEFAULT_MAX_PENDING_PROCESS_OUTPUT_BYTES)
+	};
 	yield* fileSystem.makeDirectory(logsDir, { recursive: true }).pipe(effect.Effect.orDie);
 	const managerStateRef = yield* effect.SynchronizedRef.make({
 		sessions: /* @__PURE__ */ new Map(),
@@ -38092,16 +38739,12 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 		while (true) {
 			const action = yield* effect.Effect.sync(() => {
 				if (session.pid !== expectedPid || !session.process || session.status !== "running") {
-					session.pendingProcessEvents = [];
-					session.pendingProcessEventIndex = 0;
-					session.processEventDrainRunning = false;
+					clearPendingProcessEvents(session);
 					return { type: "idle" };
 				}
 				const nextEvent = session.pendingProcessEvents[session.pendingProcessEventIndex];
 				if (!nextEvent) {
-					session.pendingProcessEvents = [];
-					session.pendingProcessEventIndex = 0;
-					session.processEventDrainRunning = false;
+					clearPendingProcessEvents(session);
 					return { type: "idle" };
 				}
 				session.pendingProcessEventIndex += 1;
@@ -38110,6 +38753,7 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 					session.pendingProcessEventIndex = 0;
 				}
 				if (nextEvent.type === "output") {
+					session.pendingProcessOutputBytes = Math.max(0, session.pendingProcessOutputBytes - nextEvent.byteLength);
 					const sanitized = sanitizeTerminalHistoryChunk(session.pendingHistoryControlSequence, nextEvent.data);
 					session.pendingHistoryControlSequence = sanitized.pendingControlSequence;
 					if (sanitized.visibleText.length > 0) session.history = capHistory(`${session.history}${sanitized.visibleText}`, historyLineLimit);
@@ -38129,9 +38773,7 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 				session.hasRunningSubprocess = false;
 				session.status = "exited";
 				session.pendingHistoryControlSequence = "";
-				session.pendingProcessEvents = [];
-				session.pendingProcessEventIndex = 0;
-				session.processEventDrainRunning = false;
+				clearPendingProcessEvents(session);
 				session.exitCode = Number.isInteger(nextEvent.event.exitCode) ? nextEvent.event.exitCode : null;
 				session.exitSignal = Number.isInteger(nextEvent.event.signal) ? nextEvent.event.signal : null;
 				session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -38179,9 +38821,7 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 			session.hasRunningSubprocess = false;
 			session.status = "exited";
 			session.pendingHistoryControlSequence = "";
-			session.pendingProcessEvents = [];
-			session.pendingProcessEventIndex = 0;
-			session.processEventDrainRunning = false;
+			clearPendingProcessEvents(session);
 			session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
 			return [void 0, state];
 		});
@@ -38233,9 +38873,7 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 			session.exitCode = null;
 			session.exitSignal = null;
 			session.hasRunningSubprocess = false;
-			session.pendingProcessEvents = [];
-			session.pendingProcessEventIndex = 0;
-			session.processEventDrainRunning = false;
+			clearPendingProcessEvents(session);
 			session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
 			return [void 0, state];
 		});
@@ -38249,15 +38887,16 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 			const unsubscribeData = ptyProcess.onData((data) => {
 				if (!enqueueProcessEvent(session, processPid, {
 					type: "output",
-					data
-				})) return;
+					data,
+					byteLength: approximateTextBytes(data)
+				}, pendingProcessEventLimits)) return;
 				runFork(drainProcessEvents(session, processPid));
 			});
 			const unsubscribeExit = ptyProcess.onExit((event) => {
 				if (!enqueueProcessEvent(session, processPid, {
 					type: "exit",
 					event
-				})) return;
+				}, pendingProcessEventLimits)) return;
 				runFork(drainProcessEvents(session, processPid));
 			});
 			yield* modifyManagerState((state) => {
@@ -38289,9 +38928,7 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 				session.unsubscribeData = null;
 				session.unsubscribeExit = null;
 				session.hasRunningSubprocess = false;
-				session.pendingProcessEvents = [];
-				session.pendingProcessEventIndex = 0;
-				session.processEventDrainRunning = false;
+				clearPendingProcessEvents(session);
 				session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
 				return [void 0, state];
 			});
@@ -38401,6 +39038,7 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 				pendingHistoryControlSequence: "",
 				pendingProcessEvents: [],
 				pendingProcessEventIndex: 0,
+				pendingProcessOutputBytes: 0,
 				processEventDrainRunning: false,
 				exitCode: null,
 				exitSignal: null,
@@ -38447,18 +39085,14 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 			liveSession.runtimeEnv = nextRuntimeEnv;
 			liveSession.history = "";
 			liveSession.pendingHistoryControlSequence = "";
-			liveSession.pendingProcessEvents = [];
-			liveSession.pendingProcessEventIndex = 0;
-			liveSession.processEventDrainRunning = false;
+			clearPendingProcessEvents(liveSession);
 			yield* persistHistory(liveSession.threadId, liveSession.terminalId, liveSession.history);
 		} else if (liveSession.status === "exited" || liveSession.status === "error") {
 			liveSession.runtimeEnv = nextRuntimeEnv;
 			liveSession.worktreePath = input.worktreePath ?? null;
 			liveSession.history = "";
 			liveSession.pendingHistoryControlSequence = "";
-			liveSession.pendingProcessEvents = [];
-			liveSession.pendingProcessEventIndex = 0;
-			liveSession.processEventDrainRunning = false;
+			clearPendingProcessEvents(liveSession);
 			yield* persistHistory(liveSession.threadId, liveSession.terminalId, liveSession.history);
 		}
 		if (!liveSession.process) {
@@ -38512,9 +39146,7 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 		const session = yield* requireSession(input.threadId, terminalId);
 		session.history = "";
 		session.pendingHistoryControlSequence = "";
-		session.pendingProcessEvents = [];
-		session.pendingProcessEventIndex = 0;
-		session.processEventDrainRunning = false;
+		clearPendingProcessEvents(session);
 		session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
 		yield* persistHistory(input.threadId, terminalId, session.history);
 		yield* publishEvent({
@@ -38545,6 +39177,7 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 				pendingHistoryControlSequence: "",
 				pendingProcessEvents: [],
 				pendingProcessEventIndex: 0,
+				pendingProcessOutputBytes: 0,
 				processEventDrainRunning: false,
 				exitCode: null,
 				exitSignal: null,
@@ -38578,9 +39211,7 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 		const rows = input.rows ?? session.rows;
 		session.history = "";
 		session.pendingHistoryControlSequence = "";
-		session.pendingProcessEvents = [];
-		session.pendingProcessEventIndex = 0;
-		session.processEventDrainRunning = false;
+		clearPendingProcessEvents(session);
 		yield* persistHistory(input.threadId, terminalId, session.history);
 		yield* startSession(session, {
 			threadId: input.threadId,
@@ -38602,6 +39233,7 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 		yield* effect.Effect.forEach(threadSessions, (session) => closeSession(input.threadId, session.terminalId, false), { discard: true });
 		if (input.deleteHistory) yield* deleteAllHistoryForThread(input.threadId);
 	}));
+	const listSessions = effect.SynchronizedRef.get(managerStateRef).pipe(effect.Effect.map((state) => [...state.sessions.values()].map(snapshot).toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt))));
 	return {
 		open,
 		write,
@@ -38610,6 +39242,7 @@ const makeTerminalManagerWithOptions = effect.Effect.fn("makeTerminalManagerWith
 		restart,
 		close,
 		listDiagnostics: effect.SynchronizedRef.get(managerStateRef).pipe(effect.Effect.map((state) => [...state.sessions.values()].map(diagnosticsSnapshot).toSorted((left, right) => right.updatedAt.localeCompare(left.updatedAt)))),
+		listSessions,
 		subscribe: (listener) => effect.Effect.sync(() => {
 			terminalEventListeners.add(listener);
 			return () => {
@@ -39105,7 +39738,7 @@ function isGitRepository(cwd) {
 //#endregion
 //#region src/orchestration/Layers/ProviderRuntimeIngestion.ts
 const providerTurnKey = (threadId, turnId) => `${threadId}:${turnId}`;
-const providerCommandId = (event, tag) => require_collectUint8StreamText.CommandId.make(`provider:${event.eventId}:${tag}:${crypto.randomUUID()}`);
+const providerCommandId = (event, tag, discriminator) => require_collectUint8StreamText.CommandId.make(discriminator === void 0 ? `provider:${event.eventId}:${tag}` : `provider:${event.eventId}:${tag}:${discriminator}`);
 const liveAssistantDeltaBufferKey = (threadId, messageId) => `${threadId}:${messageId}`;
 const TURN_MESSAGE_IDS_BY_TURN_CACHE_CAPACITY = 1e4;
 const TURN_MESSAGE_IDS_BY_TURN_TTL = effect.Duration.minutes(120);
@@ -39179,6 +39812,7 @@ function rawPayloadThreadId(event) {
 	return asTrimmedString(asRecord(event.raw?.payload)?.threadId);
 }
 function collabReceiverThreadIdsFromRuntimeEvent(event) {
+	if (event.type === "subagent.started" || event.type === "subagent.updated" || event.type === "subagent.completed") return event.payload.subagent.providerThreadId ? [event.payload.subagent.providerThreadId] : [];
 	if (event.type !== "item.started" && event.type !== "item.updated" && event.type !== "item.completed") return [];
 	if (event.payload.itemType !== "collab_agent_tool_call") return [];
 	const item = asRecord(asRecord(event.payload.data)?.item);
@@ -39236,6 +39870,9 @@ function normalizeRuntimeTurnState(value) {
 		default: return "completed";
 	}
 }
+function isTerminalProjectionTurnState(state) {
+	return state === "completed" || state === "error" || state === "interrupted";
+}
 function orchestrationSessionStatusFromRuntimeState(state) {
 	switch (state) {
 		case "starting": return "starting";
@@ -39423,6 +40060,53 @@ function runtimeEventToActivities(event) {
 			turnId: toTurnId$1(event.turnId) ?? null,
 			...maybeSequence
 		}];
+		case "subagent.started": return [{
+			id: event.eventId,
+			createdAt: event.createdAt,
+			tone: "tool",
+			kind: "subagent.started",
+			summary: `${event.payload.subagent.label ?? "Subagent"} started`,
+			payload: {
+				itemType: "collab_agent_tool_call",
+				status: "running",
+				subagent: event.payload.subagent
+			},
+			turnId: toTurnId$1(event.turnId) ?? null,
+			...maybeSequence
+		}];
+		case "subagent.updated": return [{
+			id: event.eventId,
+			createdAt: event.createdAt,
+			tone: "tool",
+			kind: "subagent.updated",
+			summary: event.payload.summary ?? `${event.payload.subagent.label ?? "Subagent"} updated`,
+			payload: {
+				itemType: "collab_agent_tool_call",
+				...event.payload.status ? { status: event.payload.status } : {},
+				subagent: event.payload.subagent,
+				...event.payload.detail ? { detail: truncateDetail(event.payload.detail) } : {},
+				...event.payload.summary ? { summary: truncateDetail(event.payload.summary) } : {},
+				...event.payload.usage !== void 0 ? { usage: event.payload.usage } : {}
+			},
+			turnId: toTurnId$1(event.turnId) ?? null,
+			...maybeSequence
+		}];
+		case "subagent.completed": return [{
+			id: event.eventId,
+			createdAt: event.createdAt,
+			tone: event.payload.status === "failed" ? "error" : "tool",
+			kind: "subagent.completed",
+			summary: event.payload.status === "failed" ? `${event.payload.subagent.label ?? "Subagent"} failed` : event.payload.status === "stopped" ? `${event.payload.subagent.label ?? "Subagent"} stopped` : `${event.payload.subagent.label ?? "Subagent"} completed`,
+			payload: {
+				itemType: "collab_agent_tool_call",
+				status: event.payload.status,
+				subagent: event.payload.subagent,
+				...event.payload.summary ? { detail: truncateDetail(event.payload.summary) } : {},
+				...event.payload.usage !== void 0 ? { usage: event.payload.usage } : {}
+			},
+			turnId: toTurnId$1(event.turnId) ?? null,
+			...maybeSequence
+		}];
 		case "thread.state.changed":
 			if (event.payload.state !== "compacted") return [];
 			return [{
@@ -39615,7 +40299,7 @@ const make$3 = effect.Effect.gen(function* () {
 		}
 		yield* orchestrationEngine.dispatch({
 			type: "thread.message.assistant.delta",
-			commandId: providerCommandId(buffer.event, input.commandTag),
+			commandId: providerCommandId(buffer.event, input.commandTag, String(buffer.messageId)),
 			threadId: buffer.threadId,
 			messageId: buffer.messageId,
 			delta: buffer.text,
@@ -39694,9 +40378,10 @@ const make$3 = effect.Effect.gen(function* () {
 	};
 	const upsertSubagentMessageActivity = (input) => effect.Effect.gen(function* () {
 		const sessionSequence = input.event.sessionSequence;
+		const commandKey = `${input.providerThreadId}:${input.providerItemId}`;
 		yield* orchestrationEngine.dispatch({
 			type: "thread.activity.append",
-			commandId: providerCommandId(input.event, "subagent-message-upsert"),
+			commandId: providerCommandId(input.event, "subagent-message-upsert", commandKey),
 			threadId: input.threadId,
 			activity: {
 				id: subagentMessageActivityId({
@@ -39714,6 +40399,7 @@ const make$3 = effect.Effect.gen(function* () {
 					streaming: input.streaming,
 					providerThreadId: input.providerThreadId,
 					providerItemId: input.providerItemId,
+					...input.subagentId ? { subagentId: input.subagentId } : {},
 					...input.event.providerRefs ? { providerRefs: input.event.providerRefs } : {}
 				},
 				turnId: toTurnId$1(input.event.turnId) ?? null,
@@ -39753,6 +40439,16 @@ const make$3 = effect.Effect.gen(function* () {
 			streaming: false
 		});
 	});
+	const bufferedSubagentProviderItemIds = (input) => {
+		const prefix = subagentMessageBufferKey({
+			threadId: input.threadId,
+			providerThreadId: input.providerThreadId,
+			providerItemId: ""
+		});
+		const providerItemIds = /* @__PURE__ */ new Set();
+		for (const key of subagentMessageTextByKey.keys()) if (key.startsWith(prefix)) providerItemIds.add(key.slice(prefix.length));
+		return [...providerItemIds];
+	};
 	const clearSubagentMessageBuffersForThread = (threadId) => effect.Effect.sync(() => {
 		const prefix = `${threadId}:`;
 		for (const key of subagentMessageTextByKey.keys()) if (key.startsWith(prefix)) subagentMessageTextByKey.delete(key);
@@ -39786,7 +40482,7 @@ const make$3 = effect.Effect.gen(function* () {
 		if (!hasRenderableAssistantText(bufferedText)) return false;
 		yield* orchestrationEngine.dispatch({
 			type: "thread.message.assistant.delta",
-			commandId: providerCommandId(input.event, input.commandTag),
+			commandId: providerCommandId(input.event, input.commandTag, String(input.messageId)),
 			threadId: input.threadId,
 			messageId: input.messageId,
 			delta: bufferedText,
@@ -39814,7 +40510,7 @@ const make$3 = effect.Effect.gen(function* () {
 		const hasRenderableText = hasRenderableAssistantText(text);
 		if (hasRenderableText) yield* orchestrationEngine.dispatch({
 			type: "thread.message.assistant.delta",
-			commandId: providerCommandId(input.event, input.finalDeltaCommandTag),
+			commandId: providerCommandId(input.event, input.finalDeltaCommandTag, String(input.messageId)),
 			threadId: input.threadId,
 			messageId: input.messageId,
 			delta: text,
@@ -39823,7 +40519,7 @@ const make$3 = effect.Effect.gen(function* () {
 		});
 		if (input.hasProjectedMessage || hasRenderableText) yield* orchestrationEngine.dispatch({
 			type: "thread.message.assistant.complete",
-			commandId: providerCommandId(input.event, input.commandTag),
+			commandId: providerCommandId(input.event, input.commandTag, String(input.messageId)),
 			threadId: input.threadId,
 			messageId: input.messageId,
 			...input.turnId ? { turnId: input.turnId } : {},
@@ -39857,7 +40553,7 @@ const make$3 = effect.Effect.gen(function* () {
 		const existingPlan = findProposedPlanById(input.threadProposedPlans, input.planId);
 		yield* orchestrationEngine.dispatch({
 			type: "thread.proposed-plan.upsert",
-			commandId: providerCommandId(input.event, "proposed-plan-upsert"),
+			commandId: providerCommandId(input.event, "proposed-plan-upsert", input.planId),
 			threadId: input.threadId,
 			proposedPlan: {
 				id: input.planId,
@@ -39924,13 +40620,13 @@ const make$3 = effect.Effect.gen(function* () {
 		if (!sameId$1(yield* getExpectedProviderTurnIdForThread(threadId), eventTurnId)) return null;
 		return yield* getSourceProposedPlanReferenceForPendingTurnStart(threadId);
 	});
-	const markSourceProposedPlanImplemented = effect.Effect.fn("markSourceProposedPlanImplemented")(function* (sourceThreadId, sourcePlanId, implementationThreadId, implementedAt) {
+	const markSourceProposedPlanImplemented = effect.Effect.fn("markSourceProposedPlanImplemented")(function* (event, sourceThreadId, sourcePlanId, implementationThreadId, implementedAt) {
 		const sourceThread = yield* resolveThreadDetail(sourceThreadId);
 		const sourcePlan = sourceThread?.proposedPlans.find((entry) => entry.id === sourcePlanId);
 		if (!sourceThread || !sourcePlan || sourcePlan.implementedAt !== null) return;
 		yield* orchestrationEngine.dispatch({
 			type: "thread.proposed-plan.upsert",
-			commandId: require_collectUint8StreamText.CommandId.make(`provider:source-proposed-plan-implemented:${implementationThreadId}:${crypto.randomUUID()}`),
+			commandId: providerCommandId(event, "source-proposed-plan-implemented", `${sourceThreadId}:${sourcePlanId}:${implementationThreadId}`),
 			threadId: sourceThread.id,
 			proposedPlan: {
 				...sourcePlan,
@@ -39955,6 +40651,12 @@ const make$3 = effect.Effect.gen(function* () {
 		const activeTurnId = thread.session?.activeTurnId ?? null;
 		const conflictsWithActiveTurn = activeTurnId !== null && eventTurnId !== void 0 && !sameId$1(activeTurnId, eventTurnId);
 		const missingTurnForActiveTurn = activeTurnId !== null && eventTurnId === void 0;
+		const existingEventTurn = event.type === "turn.started" && eventTurnId !== void 0 ? yield* projectionTurnRepository.getByTurnId({
+			threadId: thread.id,
+			turnId: eventTurnId
+		}) : effect.Option.none();
+		const eventTurnAlreadyTerminal = effect.Option.isSome(existingEventTurn) && isTerminalProjectionTurnState(existingEventTurn.value.state);
+		const eventTurnAlreadyProjectedWithoutActiveSession = activeTurnId === null && effect.Option.isSome(existingEventTurn);
 		if (!isAssistantTextDeltaEvent(event)) yield* flushLiveAssistantDeltaBuffersSafely({ commandTag: "assistant-delta-flush-before-runtime-event" });
 		yield* rememberSubagentProviderThreadIds(thread.id, event);
 		const eventProviderThreadId = rawPayloadThreadId(event);
@@ -39965,8 +40667,9 @@ const make$3 = effect.Effect.gen(function* () {
 				case "session.exited": return true;
 				case "session.started":
 				case "thread.started": return true;
-				case "turn.started": return !conflictsWithActiveTurn;
+				case "turn.started": return !conflictsWithActiveTurn && !eventTurnAlreadyTerminal && !eventTurnAlreadyProjectedWithoutActiveSession;
 				case "turn.completed":
+				case "turn.aborted":
 					if (conflictsWithActiveTurn || missingTurnForActiveTurn) return false;
 					if (activeTurnId !== null && eventTurnId !== void 0) return sameId$1(activeTurnId, eventTurnId);
 					return true;
@@ -39974,21 +40677,22 @@ const make$3 = effect.Effect.gen(function* () {
 			}
 		})();
 		const acceptedTurnStartedSourcePlan = event.type === "turn.started" && shouldApplyThreadLifecycle ? yield* getSourceProposedPlanReferenceForAcceptedTurnStart(thread.id, eventTurnId) : null;
-		if (event.type === "session.started" || event.type === "session.state.changed" || event.type === "session.exited" || event.type === "thread.started" || event.type === "turn.started" || event.type === "turn.completed") {
-			const nextActiveTurnId = event.type === "turn.started" ? eventTurnId ?? null : event.type === "turn.completed" || event.type === "session.exited" ? null : activeTurnId;
+		if (event.type === "session.started" || event.type === "session.state.changed" || event.type === "session.exited" || event.type === "thread.started" || event.type === "turn.started" || event.type === "turn.completed" || event.type === "turn.aborted") {
+			const nextActiveTurnId = event.type === "turn.started" ? eventTurnId ?? null : event.type === "turn.completed" || event.type === "turn.aborted" || event.type === "session.exited" ? null : activeTurnId;
 			const status = (() => {
 				switch (event.type) {
 					case "session.state.changed": return orchestrationSessionStatusFromRuntimeState(event.payload.state);
 					case "turn.started": return "running";
 					case "session.exited": return "stopped";
 					case "turn.completed": return normalizeRuntimeTurnState(event.payload.state) === "failed" ? "error" : "ready";
+					case "turn.aborted": return "ready";
 					case "session.started":
 					case "thread.started": return activeTurnId !== null ? "running" : "ready";
 				}
 			})();
 			const lastError = event.type === "session.state.changed" && event.payload.state === "error" ? event.payload.reason ?? thread.session?.lastError ?? "Provider session error" : event.type === "turn.completed" && normalizeRuntimeTurnState(event.payload.state) === "failed" ? event.payload.errorMessage ?? thread.session?.lastError ?? "Turn failed" : status === "ready" ? null : thread.session?.lastError ?? null;
 			if (shouldApplyThreadLifecycle) {
-				if (event.type === "turn.started" && acceptedTurnStartedSourcePlan !== null) yield* markSourceProposedPlanImplemented(acceptedTurnStartedSourcePlan.sourceThreadId, acceptedTurnStartedSourcePlan.sourcePlanId, thread.id, now).pipe(effect.Effect.catchCause((cause) => effect.Effect.logWarning("provider runtime ingestion failed to mark source proposed plan", {
+				if (event.type === "turn.started" && acceptedTurnStartedSourcePlan !== null) yield* markSourceProposedPlanImplemented(event, acceptedTurnStartedSourcePlan.sourceThreadId, acceptedTurnStartedSourcePlan.sourcePlanId, thread.id, now).pipe(effect.Effect.catchCause((cause) => effect.Effect.logWarning("provider runtime ingestion failed to mark source proposed plan", {
 					eventId: event.eventId,
 					eventType: event.type,
 					cause: effect.Cause.pretty(cause)
@@ -40010,11 +40714,30 @@ const make$3 = effect.Effect.gen(function* () {
 					},
 					createdAt: now
 				});
+				if (event.type === "turn.aborted" && eventTurnId !== void 0) yield* orchestrationEngine.dispatch({
+					type: "thread.turn.interrupt",
+					commandId: providerCommandId(event, "thread-turn-interrupt", String(eventTurnId)),
+					threadId: thread.id,
+					turnId: eventTurnId,
+					createdAt: now
+				});
 			}
 		}
 		const assistantDelta = isAssistantTextDeltaEvent(event) ? event.payload.delta : void 0;
+		const subagentDelta = event.type === "subagent.message.delta" ? event.payload.delta : void 0;
 		const proposedPlanDelta = event.type === "turn.proposed.delta" ? event.payload.delta : void 0;
-		if (assistantDelta && assistantDelta.length > 0 && isSubagentProviderThread && eventProviderThreadId) yield* appendSubagentMessageDelta({
+		if (event.type === "subagent.message.delta" && subagentDelta && subagentDelta.length > 0) {
+			const subagentPayload = event.payload;
+			yield* appendSubagentMessageDelta({
+				event,
+				threadId: thread.id,
+				subagentId: String(subagentPayload.subagentId),
+				providerThreadId: subagentPayload.providerThreadId ?? String(subagentPayload.subagentId),
+				providerItemId: subagentPayload.providerMessageId ?? String(subagentPayload.subagentId),
+				delta: subagentDelta,
+				createdAt: now
+			});
+		} else if (assistantDelta && assistantDelta.length > 0 && isSubagentProviderThread && eventProviderThreadId) yield* appendSubagentMessageDelta({
 			event,
 			threadId: thread.id,
 			providerThreadId: eventProviderThreadId,
@@ -40034,7 +40757,7 @@ const make$3 = effect.Effect.gen(function* () {
 				const spillChunk = yield* appendBufferedAssistantText(assistantMessageId, assistantDelta);
 				if (spillChunk.length > 0) yield* orchestrationEngine.dispatch({
 					type: "thread.message.assistant.delta",
-					commandId: providerCommandId(event, "assistant-delta-buffer-spill"),
+					commandId: providerCommandId(event, "assistant-delta-buffer-spill", String(assistantMessageId)),
 					threadId: thread.id,
 					messageId: assistantMessageId,
 					delta: spillChunk,
@@ -40119,6 +40842,26 @@ const make$3 = effect.Effect.gen(function* () {
 			...subagentMessageCompletion.fallbackText !== void 0 ? { fallbackText: subagentMessageCompletion.fallbackText } : {},
 			createdAt: now
 		});
+		if (event.type === "subagent.completed") {
+			const subagentId = String(event.payload.subagent.subagentId);
+			const providerThreadId = event.payload.subagent.providerThreadId ?? subagentId;
+			const providerItemIds = bufferedSubagentProviderItemIds({
+				threadId: thread.id,
+				providerThreadId
+			});
+			yield* effect.Effect.forEach(providerItemIds.length > 0 ? providerItemIds : [subagentId], (providerItemId) => completeSubagentMessage({
+				event,
+				threadId: thread.id,
+				subagentId,
+				providerThreadId,
+				providerItemId,
+				...event.payload.summary !== void 0 ? { fallbackText: event.payload.summary } : {},
+				createdAt: now
+			}), {
+				concurrency: 1,
+				discard: true
+			});
+		}
 		if (proposedPlanCompletion) {
 			const detailedThread = yield* getLoadedThreadDetail();
 			yield* finalizeBufferedProposedPlan({
@@ -40131,7 +40874,7 @@ const make$3 = effect.Effect.gen(function* () {
 				updatedAt: now
 			});
 		}
-		if (event.type === "turn.completed") {
+		if (event.type === "turn.completed" || event.type === "turn.aborted") {
 			const detailedThread = yield* getLoadedThreadDetail();
 			const messages = detailedThread?.messages ?? [];
 			const proposedPlans = detailedThread?.proposedPlans ?? [];
@@ -40201,7 +40944,7 @@ const make$3 = effect.Effect.gen(function* () {
 				const assistantMessageId = require_collectUint8StreamText.MessageId.make(`assistant:${event.itemId ?? event.turnId ?? event.eventId}`);
 				yield* orchestrationEngine.dispatch({
 					type: "thread.turn.diff.complete",
-					commandId: providerCommandId(event, "thread-turn-diff-complete"),
+					commandId: providerCommandId(event, "thread-turn-diff-complete", String(turnId)),
 					threadId: thread.id,
 					turnId,
 					completedAt: now,
@@ -40217,7 +40960,7 @@ const make$3 = effect.Effect.gen(function* () {
 		const activities = runtimeEventToActivities(event);
 		yield* effect.Effect.forEach(activities, (activity) => orchestrationEngine.dispatch({
 			type: "thread.activity.append",
-			commandId: providerCommandId(event, "thread-activity-append"),
+			commandId: providerCommandId(event, "thread-activity-append", String(activity.id)),
 			threadId: thread.id,
 			activity,
 			createdAt: activity.createdAt
@@ -40281,6 +41024,7 @@ function mapProviderSessionStatusToOrchestrationStatus(status) {
 }
 const turnStartKeyForEvent = (event) => event.commandId !== null ? `command:${event.commandId}` : `event:${event.eventId}`;
 const serverCommandId$1 = (tag) => require_collectUint8StreamText.CommandId.make(`server:${tag}:${crypto.randomUUID()}`);
+const isProviderOriginatedCommandId = (commandId) => commandId !== null && String(commandId).startsWith("provider:");
 const HANDLED_TURN_START_KEY_MAX = 1e4;
 const HANDLED_TURN_START_KEY_TTL = effect.Duration.minutes(30);
 const DEFAULT_RUNTIME_MODE = "full-access";
@@ -40632,6 +41376,17 @@ const make$2 = effect.Effect.gen(function* () {
 		if (yield* hasHandledTurnStartRecently(turnStartKeyForEvent(event))) return;
 		const thread = yield* resolveThread(event.payload.threadId);
 		if (!thread) return;
+		if (thread.session?.status === "running" && thread.session.activeTurnId !== null) {
+			yield* appendProviderFailureActivity({
+				threadId: event.payload.threadId,
+				kind: "provider.turn.start.failed",
+				summary: "Provider turn start rejected",
+				detail: `Thread already has active turn '${thread.session.activeTurnId}'. Queuing overlapping turns is not supported; wait for the active turn to finish before starting another.`,
+				turnId: null,
+				createdAt: event.payload.createdAt
+			});
+			return;
+		}
 		const message = thread.messages.find((entry) => entry.id === event.payload.messageId);
 		if (!message || message.role !== "user") {
 			yield* appendProviderFailureActivity({
@@ -40702,6 +41457,7 @@ const make$2 = effect.Effect.gen(function* () {
 		yield* providerService.sendTurn(sendTurnRequest.value).pipe(effect.Effect.catchCause(recoverTurnStartFailure), effect.Effect.forkScoped);
 	});
 	const processTurnInterruptRequested = effect.Effect.fn("processTurnInterruptRequested")(function* (event) {
+		if (isProviderOriginatedCommandId(event.commandId)) return;
 		const thread = yield* resolveThread(event.payload.threadId);
 		if (!thread) return;
 		if (!(thread.session && thread.session.status !== "stopped")) return yield* appendProviderFailureActivity({
@@ -46998,6 +47754,10 @@ const decideOrchestrationCommand = effect.Effect.fn("decideOrchestrationCommand"
 				command,
 				threadId: command.threadId
 			});
+			if (targetThread.session?.status === "running" && targetThread.session.activeTurnId !== null) return yield* new OrchestrationCommandInvariantError({
+				commandType: command.type,
+				detail: `Thread '${command.threadId}' already has active turn '${targetThread.session.activeTurnId}' and cannot start another turn until it finishes.`
+			});
 			const sourceProposedPlan = command.sourceProposedPlan;
 			const sourceThread = sourceProposedPlan ? yield* requireThread({
 				readModel,
@@ -50955,7 +51715,7 @@ const OrchestrationProjectionSnapshotQueryLive = effect.Layer.effect(ProjectionS
 //#region src/orchestration/runtimeLayer.ts
 const OrchestrationEventInfrastructureLayerLive = effect.Layer.mergeAll(OrchestrationEventStoreLive, OrchestrationCommandReceiptRepositoryLive);
 const OrchestrationProjectionPipelineLayerLive = OrchestrationProjectionPipelineLive.pipe(effect.Layer.provide(OrchestrationEventStoreLive));
-const OrchestrationInfrastructureLayerLive = effect.Layer.mergeAll(OrchestrationProjectionSnapshotQueryLive, OrchestrationEventInfrastructureLayerLive, OrchestrationProjectionPipelineLayerLive);
+const OrchestrationInfrastructureLayerLive = effect.Layer.mergeAll(OrchestrationProjectionSnapshotQueryLive, StatisticsQueryLive, OrchestrationEventInfrastructureLayerLive, OrchestrationProjectionPipelineLayerLive);
 const OrchestrationLayerLive = effect.Layer.mergeAll(OrchestrationInfrastructureLayerLive, OrchestrationEngineLive.pipe(effect.Layer.provide(OrchestrationInfrastructureLayerLive)));
 //#endregion
 //#region src/serverRuntimeState.ts
@@ -51762,6 +52522,7 @@ exports.ServerRequest__DynamicToolCallParams = ServerRequest__DynamicToolCallPar
 exports.ServerRequest__ExecCommandApprovalParams = ServerRequest__ExecCommandApprovalParams;
 exports.ServerRequest__FileChangeRequestApprovalParams = ServerRequest__FileChangeRequestApprovalParams;
 exports.ServerRequest__ToolRequestUserInputParams = ServerRequest__ToolRequestUserInputParams;
+exports.ServerSettingsService = ServerSettingsService;
 exports.ToolRequestUserInputParams = ToolRequestUserInputParams;
 exports.ToolRequestUserInputResponse = ToolRequestUserInputResponse;
 exports.V2AccountRateLimitsUpdatedNotification = V2AccountRateLimitsUpdatedNotification;