Commit 78552a8c6162c9b5248231bc70be8bffdb50cbd3 | the-knife

apps/desktop/src/electron/ElectronProtocol.test.ts+51-1

...	@@ -1,9 +1,11 @@	...	@@ -1,9 +1,11 @@
1	import { assert, describe, it } from "@effect/vitest";	1	import { assert, describe, it } from "@effect/vitest";
2	import * as Cause from "effect/Cause";	2	import * as Cause from "effect/Cause";
3	import * as Effect from "effect/Effect";	3	import * as Effect from "effect/Effect";
		4	import * as Fiber from "effect/Fiber";
4	import * as NodeServices from "@effect/platform-node/NodeServices";	5	import * as NodeServices from "@effect/platform-node/NodeServices";
5	import * as FileSystem from "effect/FileSystem";	6	import * as FileSystem from "effect/FileSystem";
6	import * as Layer from "effect/Layer";	7	import * as Layer from "effect/Layer";
		8	import * as TestClock from "effect/testing/TestClock";
7	import { beforeEach, vi } from "vite-plus/test";	9	import { beforeEach, vi } from "vite-plus/test";
8		10
9	const { handleMock, netFetchMock, unhandleMock } = vi.hoisted(() => ({	11	const { handleMock, netFetchMock, unhandleMock } = vi.hoisted(() => ({
...	@@ -174,7 +176,11 @@ describe("ElectronProtocol", () => {	...	@@ -174,7 +176,11 @@ describe("ElectronProtocol", () => {
174	targetOrigin: new URL("http://127.0.0.1:5733/"),	176	targetOrigin: new URL("http://127.0.0.1:5733/"),
175	clerkFrontendApiHostname: undefined,	177	clerkFrontendApiHostname: undefined,
176	});	178	});
177	return yield* Effect.promise(() => handler!(new Request("t3code-dev://app/")));	179	const fiber = yield* Effect.forkChild(
		180	Effect.promise(() => handler!(new Request("t3code-dev://app/"))),
		181	);
		182	yield* TestClock.adjust("50 millis");
		183	return yield* Fiber.join(fiber);
178	}),	184	}),
179	);	185	);
180		186
...	@@ -183,6 +189,50 @@ describe("ElectronProtocol", () => {	...	@@ -183,6 +189,50 @@ describe("ElectronProtocol", () => {
183	}).pipe(Effect.provide(layerProtocol)),	189	}).pipe(Effect.provide(layerProtocol)),
184	);	190	);
185		191
		192	it.effect("rejects with the last renderer target failure after 50ms and 150ms retries", () =>
		193	Effect.gen(function* () {
		194	let handler: ((request: Request) => Promise<Response>) \| undefined;
		195	handleMock.mockImplementation((_scheme, nextHandler) => {
		196	handler = nextHandler;
		197	});
		198	const lastFailure = new Error("connect ECONNREFUSED 127.0.0.1:5733 (3)");
		199	netFetchMock
		200	.mockRejectedValueOnce(new Error("connect ECONNREFUSED 127.0.0.1:5733 (1)"))
		201	.mockRejectedValueOnce(new Error("connect ECONNREFUSED 127.0.0.1:5733 (2)"))
		202	.mockRejectedValueOnce(lastFailure);
		203
		204	const rejection = yield* Effect.scoped(
		205	Effect.gen(function* () {
		206	const protocol = yield* ElectronProtocol.ElectronProtocol;
		207	yield* protocol.registerDesktopProtocol({
		208	scheme: "t3code-dev",
		209	targetOrigin: new URL("http://127.0.0.1:5733/"),
		210	clerkFrontendApiHostname: undefined,
		211	});
		212	const fiber = yield* Effect.forkChild(
		213	Effect.promise(() =>
		214	handler!(new Request("t3code-dev://app/")).then(
		215	() => null,
		216	(error: unknown) => error,
		217	),
		218	),
		219	);
		220	yield* TestClock.adjust("49 millis");
		221	assert.equal(netFetchMock.mock.calls.length, 1);
		222	yield* TestClock.adjust("1 millis");
		223	assert.equal(netFetchMock.mock.calls.length, 2);
		224	yield* TestClock.adjust("149 millis");
		225	assert.equal(netFetchMock.mock.calls.length, 2);
		226	yield* TestClock.adjust("1 millis");
		227	return yield* Fiber.join(fiber);
		228	}),
		229	);
		230
		231	assert.strictEqual(rejection, lastFailure);
		232	assert.equal(netFetchMock.mock.calls.length, 3);
		233	}).pipe(Effect.provide(layerProtocol)),
		234	);
		235
186	it.effect("preserves protocol registration failures", () =>	236	it.effect("preserves protocol registration failures", () =>
187	Effect.gen(function* () {	237	Effect.gen(function* () {
188	const cause = new Error("protocol registration failed");	238	const cause = new Error("protocol registration failed");

apps/desktop/src/electron/ElectronProtocol.ts+32-27

 @@ -3,10 +3,10 @@ import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
-import * as NodeTimersPromises from "node:timers/promises";
 import * as Path from "effect/Path";
 import * as Mime from "effect/http/Mime";
 import * as Ref from "effect/Ref";
+import * as Schedule from "effect/Schedule";
 import * as Schema from "effect/Schema";
 import * as Scope from "effect/Scope";
 @@ -150,11 +150,29 @@ const registerDesktopSchemePrivileges = Effect.sync(registerDesktopSchemePrivile
 export const layerSchemePrivileges = Layer.effectDiscard(registerDesktopSchemePrivileges);
-async function proxyRequest(
+class ElectronProtocolFetchError extends Schema.TaggedError<ElectronProtocolFetchError>()(
+  "ElectronProtocolFetchError",
+  { cause: Schema.Defect() },
+) {}
+const netFetch = (url: string, init: RequestInit) =>
+  Effect.tryPromise({
+    try: () => Electron.net.fetch(url, init),
+    catch: (cause) => new ElectronProtocolFetchError({ cause }),
+  });
+// The dev renderer target can briefly refuse connections while Vite restarts:
+// retry idempotent requests after 50ms, then 150ms, and keep the last failure.
+const fetchWithTransientRetry = (url: string, init: RequestInit) =>
+  netFetch(url, init).pipe(
+    Effect.retry({ schedule: Schedule.exponential("50 millis", 3), times: 2 }),
+  );
+const proxyRequest = Effect.fn("desktop.protocol.proxyRequest")(function* (
   request: Request,
   targetOrigin: URL,
   contentSecurityPolicy: string,
-): Promise<Response> {
+) {
   const requestUrl = new URL(request.url);
   if (requestUrl.host !== DESKTOP_HOST) {
     return new Response(null, { status: 404 });
 @@ -190,12 +208,10 @@ async function proxyRequest(
   }
   const response =
     request.method === "GET" || request.method === "HEAD"
-      ? await fetchWithTransientRetry(targetUrl.toString(), init)
+      ? yield* fetchWithTransientRetry(targetUrl.toString(), init)
-      : await Electron.net.fetch(targetUrl.toString(), init);
+      : yield* netFetch(targetUrl.toString(), init);
   return withContentSecurityPolicy(response, contentSecurityPolicy);
-}
+});
-const TRANSIENT_FETCH_RETRY_DELAYS_MS = [0, 50, 150] as const;
 // Serves the packaged web client without a backend: files resolve within the
 // asset directory, and any other path falls back to index.html so the SPA
 @@ -238,24 +254,6 @@ const serveDesktopAsset = Effect.fn("desktop.protocol.serveAsset")(function* (
   });
 });
-async function fetchWithTransientRetry(url: string, init: RequestInit): Promise<Response> {
-  let lastError: unknown;
-  for (const delayMs of TRANSIENT_FETCH_RETRY_DELAYS_MS) {
-    if (delayMs > 0) {
-      await NodeTimersPromises.setTimeout(delayMs);
-    }
-    try {
-      return await Electron.net.fetch(url, init);
-    } catch (error) {
-      lastError = error;
-    }
-  }
-  throw lastError;
-}
 /** @public Service construction is part of the canonical Effect module API. */
 export const make = Effect.gen(function* () {
   const registered = yield* Ref.make(false);
 @@ -278,7 +276,14 @@ export const make = Effect.gen(function* () {
                   contentSecurityPolicy,
                 );
               }
-              return proxyRequest(request, input.targetOrigin, contentSecurityPolicy);
+              // Reject with net.fetch's own error, as an unproxied fetch would.
+              return runPromise(
+                proxyRequest(request, input.targetOrigin, contentSecurityPolicy).pipe(
+                  Effect.catchTags({
+                    ElectronProtocolFetchError: (error) => Effect.die(error.cause),
+                  }),
+                ),
+              );
             });
           },
           catch: (cause) => new ElectronProtocolRegistrationError({ scheme: input.scheme, cause }),

apps/desktop/src/ssh/DesktopSshEnvironment.ts+2

...	@@ -18,6 +18,7 @@ import {	...	@@ -18,6 +18,7 @@ import {
18	} from "@t3tools/ssh/errors";	18	} from "@t3tools/ssh/errors";
19	import * as SshTunnel from "@t3tools/ssh/tunnel";	19	import * as SshTunnel from "@t3tools/ssh/tunnel";
20	import * as Context from "effect/Context";	20	import * as Context from "effect/Context";
		21	import type * as Crypto from "effect/Crypto";
21	import * as Effect from "effect/Effect";	22	import * as Effect from "effect/Effect";
22	import * as FileSystem from "effect/FileSystem";	23	import * as FileSystem from "effect/FileSystem";
23	import * as Layer from "effect/Layer";	24	import * as Layer from "effect/Layer";
...	@@ -29,6 +30,7 @@ import * as DesktopSshPasswordPrompts from "./DesktopSshPasswordPrompts.ts";	...	@@ -29,6 +30,7 @@ import * as DesktopSshPasswordPrompts from "./DesktopSshPasswordPrompts.ts";
29		30
30	export type DesktopSshEnvironmentRuntimeServices =	31	export type DesktopSshEnvironmentRuntimeServices =
31	\| ChildProcessSpawner.ChildProcessSpawner	32	\| ChildProcessSpawner.ChildProcessSpawner
		33	\| Crypto.Crypto
32	\| FileSystem.FileSystem	34	\| FileSystem.FileSystem
33	\| Path.Path	35	\| Path.Path
34	\| HttpClient.HttpClient	36	\| HttpClient.HttpClient

apps/server/package.json+1

...	@@ -34,6 +34,7 @@	...	@@ -34,6 +34,7 @@
34	"@effect/platform-node-shared": "catalog:",	34	"@effect/platform-node-shared": "catalog:",
35	"@ff-labs/fff-node": "0.9.4",	35	"@ff-labs/fff-node": "0.9.4",
36	"@napi-rs/keyring": "^1.3.0",	36	"@napi-rs/keyring": "^1.3.0",
		37	"@noble/hashes": "catalog:",
37	"@opencode-ai/sdk": "^1.3.15",	38	"@opencode-ai/sdk": "^1.3.15",
38	"@opencode/client": "2.0.23",	39	"@opencode/client": "2.0.23",
39	"@opencode/protocol": "2.0.23",	40	"@opencode/protocol": "2.0.23",

apps/server/src/auth/ReusableDevAuth.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no timingSafeEqual.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2	import { AuthSessionId } from "@t3tools/contracts";	3	import { AuthSessionId } from "@t3tools/contracts";
3	import * as DateTime from "effect/DateTime";	4	import * as DateTime from "effect/DateTime";

apps/server/src/auth/utils.ts+1

...	@@ -4,6 +4,7 @@ import type {	...	@@ -4,6 +4,7 @@ import type {
4	AuthClientPresentationMetadata,	4	AuthClientPresentationMetadata,
5	} from "@t3tools/contracts";	5	} from "@t3tools/contracts";
6	import type * as HttpServerRequest from "effect/http/HttpServerRequest";	6	import type * as HttpServerRequest from "effect/http/HttpServerRequest";
		7	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no createHmac or timingSafeEqual.
7	import * as NodeCrypto from "node:crypto";	8	import * as NodeCrypto from "node:crypto";
8	import * as Base64Url from "effect/encoding/Base64Url";	9	import * as Base64Url from "effect/encoding/Base64Url";
9	import * as Result from "effect/Result";	10	import * as Result from "effect/Result";

apps/server/src/checkpointing/CheckpointDiffQuery.test.ts+3-1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
1	import { assert, it, vi } from "@effect/vitest";	2	import { assert, it, vi } from "@effect/vitest";
2	import { CheckpointRef, CheckpointScopeId, RunId, ThreadId } from "@t3tools/contracts";	3	import { CheckpointRef, CheckpointScopeId, RunId, ThreadId } from "@t3tools/contracts";
3	import * as Effect from "effect/Effect";	4	import * as Effect from "effect/Effect";
...	@@ -59,6 +60,7 @@ function layerFor(input: {	...	@@ -59,6 +60,7 @@ function layerFor(input: {
59	}),	60	}),
60	),	61	),
61	),	62	),
		63	Layer.provideMerge(NodeCrypto.layer),
62	);	64	);
63	}	65	}
64		66
...	@@ -80,7 +82,7 @@ it.effect("computes V2 run diffs from projected checkpoint scopes", () => {	...	@@ -80,7 +82,7 @@ it.effect("computes V2 run diffs from projected checkpoint scopes", () => {
80	});	82	});
81	assert.deepEqual(diffCheckpoints.mock.calls[0]?.[0], {	83	assert.deepEqual(diffCheckpoints.mock.calls[0]?.[0], {
82	cwd: "/repo",	84	cwd: "/repo",
83	fromCheckpointRef: checkpointRefForScopeOrdinal({	85	fromCheckpointRef: yield* checkpointRefForScopeOrdinal({
84	scopeId: firstScopeId,	86	scopeId: firstScopeId,
85	ordinalWithinScope: 0,	87	ordinalWithinScope: 0,
86	}),	88	}),

apps/server/src/checkpointing/CheckpointDiffQuery.ts+14-13

 @@ -15,6 +15,7 @@ import {
   type ThreadId,
 } from "@t3tools/contracts";
 import * as Context from "effect/Context";
+import * as Crypto from "effect/Crypto";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
 @@ -77,6 +78,7 @@ function buildTurnDiffResult(
 export const make = Effect.gen(function* () {
   const threads = yield* ThreadManagement.ThreadManagementService;
   const checkpointStore = yield* CheckpointStore.CheckpointStore;
+  const crypto = yield* Crypto.Crypto;
   const getTurnDiff: CheckpointDiffQuery["Service"]["getTurnDiff"] = Effect.fn("getTurnDiff")(
     function* (input) {
 @@ -155,21 +157,20 @@ export const make = Effect.gen(function* () {
         });
       }
+      // The root scope is shared by every run in this thread. Its runId
+      // tracks the latest owner, while ordinal zero stays the baseline.
+      const firstScope =
+        input.fromTurnCount === 0
+          ? projection.checkpointScopes.find((scope) => scope.kind === "root_run")
+          : undefined;
       const fromCheckpointRef =
         input.fromTurnCount === 0
-          ? (() => {
+          ? firstScope === undefined
-              // The root scope is shared by every run in this thread. Its
+            ? undefined
-              // runId tracks the latest owner, while ordinal zero stays the baseline.
+            : yield* checkpointRefForScopeOrdinal({
-              const firstScope = projection.checkpointScopes.find(
+                scopeId: firstScope.id,
-                (scope) => scope.kind === "root_run",
+                ordinalWithinScope: 0,
-              );
+              }).pipe(Effect.provideService(Crypto.Crypto, crypto))
-              return firstScope === undefined
-                ? undefined
-                : checkpointRefForScopeOrdinal({
-                    scopeId: firstScope.id,
-                    ordinalWithinScope: 0,
-                  });
-            })()
           : readyCheckpoints.find((checkpoint) => checkpoint.appRunOrdinal === input.fromTurnCount)
               ?.ref;
       if (fromCheckpointRef === undefined) {

apps/server/src/cloud/CloudLink.ts+1

...	@@ -4,6 +4,7 @@	...	@@ -4,6 +4,7 @@
4	* and mint requests, and keeping the managed tunnel registered, recovered and	4	* and mint requests, and keeping the managed tunnel registered, recovered and
5	* released. HTTP handlers, server startup and shutdown all go through it.	5	* released. HTTP handlers, server startup and shutdown all go through it.
6	*/	6	*/
		7	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no createPublicKey.
7	import * as NodeCrypto from "node:crypto";	8	import * as NodeCrypto from "node:crypto";
8	import {	9	import {
9	AuthStandardClientScopes,	10	AuthStandardClientScopes,

apps/server/src/cloud/environmentKeys.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2	import * as Effect from "effect/Effect";	3	import * as Effect from "effect/Effect";
3	import * as Option from "effect/Option";	4	import * as Option from "effect/Option";

apps/server/src/device/AgentDeviceTarget.test.ts+5-3

apps/server/src/device/AgentDeviceTarget.ts+12-6

 @@ -1,6 +1,7 @@
-import * as NodeCrypto from "node:crypto";
+import * as Crypto from "effect/Crypto";
-import * as Schema from "effect/Schema";
 import * as Effect from "effect/Effect";
+import * as Hex from "effect/encoding/Hex";
+import * as Schema from "effect/Schema";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 @@ -12,15 +13,20 @@ const encodeEndpoint = Schema.encodeEffect(
   ),
 );
-const key = (value: string) =>
+const key = Effect.fn("AgentDeviceTarget.key")(function* (value: string) {
-  NodeCrypto.createHash("sha256").update(value).digest("hex").slice(0, 24);
+  const crypto = yield* Crypto.Crypto;
+  const digest = yield* crypto
+    .digest("SHA-256", new TextEncoder().encode(value))
+    .pipe(Effect.orDie);
+  return Hex.encode(digest).slice(0, 24);
+});
 /** A stable file per host lets forwarded endpoints change without retargeting other commands. */
 export const agentDeviceConfigPath = (stateDir: string, hostId: string, path: Path.Path) =>
-  path.join(stateDir, "device", "hosts", `${key(hostId)}.json`);
+  key(hostId).pipe(Effect.map((hash) => path.join(stateDir, "device", "hosts", `${hash}.json`)));
 export const agentDeviceSession = (threadId: string, hostId: string, deviceId: string) =>
-  `t3-${key(JSON.stringify([threadId, hostId, deviceId]))}`;
+  key(JSON.stringify([threadId, hostId, deviceId])).pipe(Effect.map((hash) => `t3-${hash}`));
 export const writeAgentDeviceConfig = Effect.fn("AgentDeviceTarget.writeConfig")(function* (
   file: string,

apps/server/src/device/DeviceMultiHost.test.ts+2-1

apps/server/src/device/DeviceService.test.ts+4

...	@@ -7,6 +7,7 @@ import {	...	@@ -7,6 +7,7 @@ import {
7	ThreadId,	7	ThreadId,
8	type DeviceServiceState,	8	type DeviceServiceState,
9	} from "@t3tools/contracts";	9	} from "@t3tools/contracts";
		10	import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
10	import * as Effect from "effect/Effect";	11	import * as Effect from "effect/Effect";
11	import * as Exit from "effect/Exit";	12	import * as Exit from "effect/Exit";
12	import * as Deferred from "effect/Deferred";	13	import * as Deferred from "effect/Deferred";
...	@@ -135,6 +136,7 @@ const fixture = Effect.fn("fixture")(function* (	...	@@ -135,6 +136,7 @@ const fixture = Effect.fn("fixture")(function* (
135	undefined,	136	undefined,
136	installTool,	137	installTool,
137	).pipe(	138	).pipe(
		139	Effect.provide(NodeCrypto.layer),
138	Effect.provideService(DeviceHost.DeviceHost, host),	140	Effect.provideService(DeviceHost.DeviceHost, host),
139	Effect.provideService(	141	Effect.provideService(
140	ServerSettings.ServerSettingsService,	142	ServerSettings.ServerSettingsService,
...	@@ -482,6 +484,7 @@ it.effect.each(["shutdown", "close"] as const)(	...	@@ -482,6 +484,7 @@ it.effect.each(["shutdown", "close"] as const)(
482	}),	484	}),
483	);	485	);
484	const service = yield* DeviceService.makeWithHosts(new Map([[host.id, host]])).pipe(	486	const service = yield* DeviceService.makeWithHosts(new Map([[host.id, host]])).pipe(
		487	Effect.provide(NodeCrypto.layer),
485	Effect.provideService(HttpClient.HttpClient, http),	488	Effect.provideService(HttpClient.HttpClient, http),
486	);	489	);
487	const input = { threadId, deviceId, platform: "ios" as const };	490	const input = { threadId, deviceId, platform: "ios" as const };
...	@@ -574,6 +577,7 @@ it.effect.each([	...	@@ -574,6 +577,7 @@ it.effect.each([
574	}),	577	}),
575	);	578	);
576	const service = yield* DeviceService.makeWithHosts(new Map([[host.id, host]])).pipe(	579	const service = yield* DeviceService.makeWithHosts(new Map([[host.id, host]])).pipe(
		580	Effect.provide(NodeCrypto.layer),
577	Effect.provideService(HttpClient.HttpClient, http),	581	Effect.provideService(HttpClient.HttpClient, http),
578	);	582	);
579	yield* service.list;	583	yield* service.list;

apps/server/src/device/DeviceService.ts+20-14

 @@ -46,6 +46,7 @@ import {
   writeAgentDeviceConfig,
 } from "./AgentDeviceTarget.ts";
 import * as Context from "effect/Context";
+import * as Crypto from "effect/Crypto";
 import * as DateTime from "effect/DateTime";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 @@ -186,6 +187,7 @@ export const makeWithHosts = Effect.fn("DeviceService.makeWithHosts")(function*
   installTool?: (tool: "hub" | "agent") => Effect.Effect<unknown, DeviceError>,
 ) {
   const settings = yield* ServerSettings.ServerSettingsService;
+  const crypto = yield* Crypto.Crypto;
   const lifecycleLock = yield* Semaphore.make(1);
   const readDeviceSettings = settings.getSettings.pipe(
     Effect.map((value) => ({
 @@ -943,12 +945,12 @@ export const makeWithHosts = Effect.fn("DeviceService.makeWithHosts")(function*
               return yield* configureAgent(input.hostId, ready);
             }),
           );
-          return [
+          const session = yield* agentDeviceSession(
-            "--config",
+            input.threadId,
-            configPath,
+            input.hostId,
-            "--session",
+            input.deviceId,
-            agentDeviceSession(input.threadId, input.hostId, input.deviceId),
+          ).pipe(Effect.provideService(Crypto.Crypto, crypto));
-          ];
+          return ["--config", configPath, "--session", session];
         }),
       state: SynchronizedRef.get(stateRef).pipe(Effect.map(({ state }) => state)),
       subscribe: PubSub.subscribe(statePubSub),
 @@ -998,9 +1000,17 @@ export const make = Effect.gen(function* () {
   const hosts = new Map<DeviceHostId, DeviceHost.DeviceHost["Service"]>([
     [localHost.id, localHost],
   ]);
-  const configureAgent = (hostId: DeviceHostId, ready: DeviceHost.DeviceHostAgentReady) => {
+  const crypto = yield* Crypto.Crypto;
-    const file = agentDeviceConfigPath(config.stateDir, hostId, path);
+  const configPath = (hostId: DeviceHostId) =>
-    return writeAgentDeviceConfig(file, ready.agentDevice).pipe(
+    agentDeviceConfigPath(config.stateDir, hostId, path).pipe(
+      Effect.provideService(Crypto.Crypto, crypto),
+    );
+  const configureAgent = (hostId: DeviceHostId, ready: DeviceHost.DeviceHostAgentReady) =>
+    Effect.gen(function* () {
+      const file = yield* configPath(hostId);
+      yield* writeAgentDeviceConfig(file, ready.agentDevice);
+      return file;
+    }).pipe(
       Effect.provideService(FileSystem.FileSystem, fs),
       Effect.provideService(Path.Path, path),
       Effect.mapError(
 @@ -1011,9 +1021,7 @@ export const make = Effect.gen(function* () {
             cause,
           }),
       ),
-      Effect.as(file),
     );
-  };
   const probeContext =
     yield* Effect.context<Effect.Services<ReturnType<typeof SshDeviceHost.probe>>>();
   const localTargetContext =
 @@ -1089,9 +1097,7 @@ export const make = Effect.gen(function* () {
         ({ id, scope }) =>
           Effect.gen(function* () {
             yield* Scope.close(scope, Exit.void);
-            yield* fs
+            yield* fs.remove(yield* configPath(id), { force: true }).pipe(Effect.ignore);
-              .remove(agentDeviceConfigPath(config.stateDir, id, path), { force: true })
-              .pipe(Effect.ignore);
           }),
         { concurrency: 4, discard: true },
       );

apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts+54-32

 @@ -32,6 +32,7 @@ import { assert, describe, it } from "@effect/vitest";
 import * as Context from "effect/Context";
 import * as DateTime from "effect/DateTime";
 import * as Deferred from "effect/Deferred";
+import * as Crypto from "effect/Crypto";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
 import * as FileSystem from "effect/FileSystem";
 @@ -957,6 +958,7 @@ describe("ClaudeAdapterV2 Auto-accept edits", () => {
           attachmentsDir,
           fileSystem,
           path: yield* Path.Path,
+          crypto: yield* Crypto.Crypto,
           idAllocator,
           queryRunner: {
             allocateSessionId: Effect.succeed("native-thread-claude-accept-edits"),
 @@ -1199,6 +1201,7 @@ describe("ClaudeAdapterV2 resume compaction", () => {
           attachmentsDir,
           fileSystem,
           path: yield* Path.Path,
+          crypto: yield* Crypto.Crypto,
           idAllocator,
           queryRunner: {
             allocateSessionId: Effect.succeed("native-thread-claude-resume"),
 @@ -1418,6 +1421,7 @@ describe("ClaudeAdapterV2 attachments", () => {
           attachmentsDir,
           fileSystem,
           path: yield* Path.Path,
+          crypto: yield* Crypto.Crypto,
           idAllocator,
           queryRunner: {
             allocateSessionId: Effect.succeed("native-thread-claude-attachments"),
 @@ -1558,6 +1562,7 @@ describe("ClaudeAdapterV2 attachments", () => {
           attachmentsDir,
           fileSystem,
           path: yield* Path.Path,
+          crypto: yield* Crypto.Crypto,
           idAllocator,
           queryRunner: {
             allocateSessionId: Effect.succeed("native-thread-claude-unsupported-attachment"),
 @@ -1647,6 +1652,7 @@ describe("ClaudeAdapterV2 native fork", () => {
           attachmentsDir,
           fileSystem,
           path: yield* Path.Path,
+          crypto: yield* Crypto.Crypto,
           idAllocator,
           queryRunner: {
             allocateSessionId: Effect.succeed("source-native-session"),
 @@ -1819,6 +1825,7 @@ describe("ClaudeAdapterV2 native session identity", () => {
           attachmentsDir,
           fileSystem,
           path: yield* Path.Path,
+          crypto: yield* Crypto.Crypto,
           idAllocator,
           queryRunner: {
             allocateSessionId: Effect.succeed("native-session-identity"),
 @@ -2108,6 +2115,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
         attachmentsDir,
         fileSystem,
         path: yield* Path.Path,
+        crypto: yield* Crypto.Crypto,
         idAllocator,
         continuationRequests: {
           offer: (request) =>
 @@ -3892,6 +3900,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
           attachmentsDir,
           fileSystem,
           path: yield* Path.Path,
+          crypto: yield* Crypto.Crypto,
           idAllocator,
           continuationRequests: {
             offer: (request) =>
 @@ -4137,6 +4146,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
             attachmentsDir,
             fileSystem,
             path: yield* Path.Path,
+            crypto: yield* Crypto.Crypto,
             idAllocator,
             continuationRequests: {
               offer: () => Effect.void,
 @@ -4389,11 +4399,12 @@ describe("ClaudeAdapterV2 background wake turns", () => {
           const continuationAttempt = RunAttemptId.make("attempt-claude-wake-callback-3");
           const planToolUseId = "toolu_01WakePlanExitPlanMode";
           const planMarkdown = "# Wake plan\n\n1. Report the background result.";
-          const stamp = (frame: SDKMessage, attemptId: RunAttemptId) =>
+          const stamp = Effect.fnUntraced(function* (frame: SDKMessage, attemptId: RunAttemptId) {
-            claudeSdkFrame({
+            return claudeSdkFrame({
               ...frame,
-              user_message_uuid: ClaudeAdapterV2.claudePromptUuid(attemptId),
+              user_message_uuid: yield* ClaudeAdapterV2.claudePromptUuid(attemptId),
             });
+          });
           const runOf = (attemptId: RunAttemptId) => RunId.make(`run-${attemptId}`);
           const planToolUse = claudeSdkFrame({
             type: "assistant",
 @@ -4446,10 +4457,10 @@ describe("ClaudeAdapterV2 background wake turns", () => {
               runtimePolicy,
             }),
           );
-          yield* Queue.offer(harness.sdkMessages, stamp(wakeTaskStarted, firstAttempt));
+          yield* Queue.offer(harness.sdkMessages, yield* stamp(wakeTaskStarted, firstAttempt));
           yield* Queue.offer(
             harness.sdkMessages,
-            stamp(
+            yield* stamp(
               makeResultFrame({ uuid: "00000000-0000-4000-8000-000000000740", result: "STARTED" }),
               firstAttempt,
             ),
 @@ -4508,7 +4519,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
           // The prompt's own turn follows and echoes its uuid.
           yield* Queue.offer(
             harness.sdkMessages,
-            stamp(
+            yield* stamp(
               makeAssistantTextFrame({
                 uuid: "00000000-0000-4000-8000-000000000743",
                 text: "USER_REPLY",
 @@ -4518,7 +4529,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
           );
           yield* Queue.offer(
             harness.sdkMessages,
-            stamp(
+            yield* stamp(
               makeResultFrame({
                 uuid: "00000000-0000-4000-8000-000000000744",
                 result: "USER_REPLY",
 @@ -4688,11 +4699,12 @@ describe("ClaudeAdapterV2 background wake turns", () => {
         const firstAttempt = RunAttemptId.make("attempt-claude-wake-approval-1");
         const userAttempt = RunAttemptId.make("attempt-claude-wake-approval-2");
         const bashToolUseId = "toolu_01WakeApprovalBash";
-        const stamp = (frame: SDKMessage, attemptId: RunAttemptId) =>
+        const stamp = Effect.fnUntraced(function* (frame: SDKMessage, attemptId: RunAttemptId) {
-          claudeSdkFrame({
+          return claudeSdkFrame({
             ...frame,
-            user_message_uuid: ClaudeAdapterV2.claudePromptUuid(attemptId),
+            user_message_uuid: yield* ClaudeAdapterV2.claudePromptUuid(attemptId),
           });
+        });
         yield* harness.runtime.startTurn(
           makeClaudeTestTurnInput({
 @@ -4707,14 +4719,14 @@ describe("ClaudeAdapterV2 background wake turns", () => {
         );
         yield* Queue.offer(
           harness.sdkMessages,
-          stamp(
+          yield* stamp(
             makeAssistantTextFrame({ uuid: "00000000-0000-4000-8000-000000000780", text: "One." }),
             firstAttempt,
           ),
         );
         yield* Queue.offer(
           harness.sdkMessages,
-          stamp(
+          yield* stamp(
             makeResultFrame({ uuid: "00000000-0000-4000-8000-000000000781", result: "One." }),
             firstAttempt,
           ),
 @@ -4811,11 +4823,12 @@ describe("ClaudeAdapterV2 background wake turns", () => {
         const now = yield* DateTime.now;
         const firstAttempt = RunAttemptId.make("attempt-claude-echo-debris-1");
         const secondAttempt = RunAttemptId.make("attempt-claude-echo-debris-2");
-        const stamp = (frame: SDKMessage, attemptId: RunAttemptId) =>
+        const stamp = Effect.fnUntraced(function* (frame: SDKMessage, attemptId: RunAttemptId) {
-          claudeSdkFrame({
+          return claudeSdkFrame({
             ...frame,
-            user_message_uuid: ClaudeAdapterV2.claudePromptUuid(attemptId),
+            user_message_uuid: yield* ClaudeAdapterV2.claudePromptUuid(attemptId),
           });
+        });
         yield* harness.runtime.startTurn(
           makeClaudeTestTurnInput({
 @@ -4830,14 +4843,14 @@ describe("ClaudeAdapterV2 background wake turns", () => {
         // The first turn echoes on its first frame: this process echoes early.
         yield* Queue.offer(
           harness.sdkMessages,
-          stamp(
+          yield* stamp(
             makeAssistantTextFrame({ uuid: "00000000-0000-4000-8000-000000000760", text: "One." }),
             firstAttempt,
           ),
         );
         yield* Queue.offer(
           harness.sdkMessages,
-          stamp(
+          yield* stamp(
             makeResultFrame({ uuid: "00000000-0000-4000-8000-000000000761", result: "One." }),
             firstAttempt,
           ),
 @@ -4864,14 +4877,14 @@ describe("ClaudeAdapterV2 background wake turns", () => {
         yield* Queue.offer(harness.sdkMessages, staleTaskNotificationResult);
         yield* Queue.offer(
           harness.sdkMessages,
-          stamp(
+          yield* stamp(
             makeAssistantTextFrame({ uuid: "00000000-0000-4000-8000-000000000762", text: "Two." }),
             secondAttempt,
           ),
         );
         yield* Queue.offer(
           harness.sdkMessages,
-          stamp(
+          yield* stamp(
             makeResultFrame({ uuid: "00000000-0000-4000-8000-000000000763", result: "Two." }),
             secondAttempt,
           ),
 @@ -4909,11 +4922,12 @@ describe("ClaudeAdapterV2 background wake turns", () => {
         const now = yield* DateTime.now;
         const firstAttempt = RunAttemptId.make("attempt-claude-echo-1");
         const secondAttempt = RunAttemptId.make("attempt-claude-echo-2");
-        const stamp = (frame: SDKMessage, attemptId: RunAttemptId) =>
+        const stamp = Effect.fnUntraced(function* (frame: SDKMessage, attemptId: RunAttemptId) {
-          claudeSdkFrame({
+          return claudeSdkFrame({
             ...frame,
-            user_message_uuid: ClaudeAdapterV2.claudePromptUuid(attemptId),
+            user_message_uuid: yield* ClaudeAdapterV2.claudePromptUuid(attemptId),
           });
+        });
         const assistantTexts = () =>
           harness.events.flatMap((event) =>
             event.type === "message.updated" && event.message.role === "assistant"
 @@ -4935,18 +4949,18 @@ describe("ClaudeAdapterV2 background wake turns", () => {
         );
         assert.equal(
           harness.offeredMessages[0]?.uuid,
-          ClaudeAdapterV2.claudePromptUuid(firstAttempt),
+          yield* ClaudeAdapterV2.claudePromptUuid(firstAttempt),
         );
         yield* Queue.offer(
           harness.sdkMessages,
-          stamp(
+          yield* stamp(
             makeAssistantTextFrame({ uuid: "00000000-0000-4000-8000-000000000701", text: "One." }),
             firstAttempt,
           ),
         );
         yield* Queue.offer(
           harness.sdkMessages,
-          stamp(
+          yield* stamp(
             makeResultFrame({ uuid: "00000000-0000-4000-8000-000000000702", result: "One." }),
             firstAttempt,
           ),
 @@ -5995,11 +6009,12 @@ describe("ClaudeAdapterV2 background wake turns", () => {
         const userAttempt = RunAttemptId.make("attempt-claude-wake-subagent-2");
         const continuationAttempt = RunAttemptId.make("attempt-claude-wake-subagent-3");
         const runOf = (attemptId: RunAttemptId) => RunId.make(`run-${attemptId}`);
-        const stamp = (frame: SDKMessage, attemptId: RunAttemptId) =>
+        const stamp = Effect.fnUntraced(function* (frame: SDKMessage, attemptId: RunAttemptId) {
-          claudeSdkFrame({
+          return claudeSdkFrame({
             ...frame,
-            user_message_uuid: ClaudeAdapterV2.claudePromptUuid(attemptId),
+            user_message_uuid: yield* ClaudeAdapterV2.claudePromptUuid(attemptId),
           });
+        });
         yield* harness.runtime.startTurn(
           makeClaudeTestTurnInput({
 @@ -6011,10 +6026,10 @@ describe("ClaudeAdapterV2 background wake turns", () => {
             attachments: [],
           }),
         );
-        yield* Queue.offer(harness.sdkMessages, stamp(wakeTaskStarted, firstAttempt));
+        yield* Queue.offer(harness.sdkMessages, yield* stamp(wakeTaskStarted, firstAttempt));
         yield* Queue.offer(
           harness.sdkMessages,
-          stamp(
+          yield* stamp(
             makeResultFrame({ uuid: "00000000-0000-4000-8000-000000000770", result: "STARTED" }),
             firstAttempt,
           ),
 @@ -6083,14 +6098,14 @@ describe("ClaudeAdapterV2 background wake turns", () => {
             session_id: WAKE_NATIVE_SESSION,
           }),
           wakeResult,
-          stamp(
+          yield* stamp(
             makeAssistantTextFrame({
               uuid: "00000000-0000-4000-8000-000000000776",
               text: "USER_REPLY",
             }),
             userAttempt,
           ),
-          stamp(
+          yield* stamp(
             makeResultFrame({ uuid: "00000000-0000-4000-8000-000000000777", result: "USER_REPLY" }),
             userAttempt,
           ),
 @@ -7018,6 +7033,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
           attachmentsDir,
           fileSystem,
           path: yield* Path.Path,
+          crypto: yield* Crypto.Crypto,
           idAllocator,
           continuationRequests: {
             offer: (request) =>
 @@ -7201,6 +7217,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
             attachmentsDir,
             fileSystem,
             path: yield* Path.Path,
+            crypto: yield* Crypto.Crypto,
             idAllocator,
             continuationRequests: {
               offer: (request) =>
 @@ -7436,6 +7453,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
             attachmentsDir,
             fileSystem,
             path: yield* Path.Path,
+            crypto: yield* Crypto.Crypto,
             idAllocator,
             continuationRequests: {
               offer: (request) =>
 @@ -7628,6 +7646,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
           attachmentsDir,
           fileSystem,
           path: yield* Path.Path,
+          crypto: yield* Crypto.Crypto,
           idAllocator,
           continuationRequests: { offer: () => Effect.void },
           queryRunner: {
 @@ -7794,6 +7813,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
             attachmentsDir,
             fileSystem,
             path: yield* Path.Path,
+            crypto: yield* Crypto.Crypto,
             idAllocator,
             continuationRequests: {
               offer: () => Effect.void,
 @@ -7923,6 +7943,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
             attachmentsDir,
             fileSystem,
             path: yield* Path.Path,
+            crypto: yield* Crypto.Crypto,
             idAllocator,
             continuationRequests: {
               offer: (request) =>
 @@ -8117,6 +8138,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
           attachmentsDir,
           fileSystem,
           path: yield* Path.Path,
+          crypto: yield* Crypto.Crypto,
           idAllocator,
           continuationRequests: {
             offer: () => Effect.void,

apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.testkit.ts+5-1

 @@ -1580,7 +1580,11 @@ async function recordClaudeStreamingQuery(input: {
       // Like the adapter, give each prompt a uuid Claude echoes on its turn.
       const message = ClaudeAdapterV2.makeClaudeUserMessage({
         text: prompt,
-        uuid: ClaudeAdapterV2.claudePromptUuid(`${input.sessionId}:prompt:${index + 1}`),
+        uuid: await Effect.runPromise(
+          ClaudeAdapterV2.claudePromptUuid(`${input.sessionId}:prompt:${index + 1}`).pipe(
+            Effect.provide(NodeServices.layer),
+          ),
+        ),
       });
       input.entries.push({
         type: "expect_outbound",

apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts+39-24

...	@@ -1,5 +1,3 @@	...	@@ -1,5 +1,3 @@
1	import * as NodeCrypto from "node:crypto";
2
3	import { makeProviderTextDeltaCoalescer } from "./ProviderTextDeltaCoalescer.ts";	1	import { makeProviderTextDeltaCoalescer } from "./ProviderTextDeltaCoalescer.ts";
4	import {	2	import {
5	dynamicToolTitle,	3	dynamicToolTitle,
...	@@ -73,6 +71,7 @@ import {	...	@@ -73,6 +71,7 @@ import {
73	import * as Cause from "effect/Cause";	71	import * as Cause from "effect/Cause";
74	import * as Context from "effect/Context";	72	import * as Context from "effect/Context";
75	import * as Crypto from "effect/Crypto";	73	import * as Crypto from "effect/Crypto";
		74	import * as Hex from "effect/encoding/Hex";
76	import * as DateTime from "effect/DateTime";	75	import * as DateTime from "effect/DateTime";
77	import * as Deferred from "effect/Deferred";	76	import * as Deferred from "effect/Deferred";
78	import * as Effect from "effect/Effect";	77	import * as Effect from "effect/Effect";
...	@@ -1420,11 +1419,17 @@ const makeClaudeUserMessageWithAttachments = Effect.fnUntraced(function* (input:	...	@@ -1420,11 +1419,17 @@ const makeClaudeUserMessageWithAttachments = Effect.fnUntraced(function* (input:
1420		1419
1421	// Stable per run attempt, so a replayed prompt offer matches its recording.	1420	// Stable per run attempt, so a replayed prompt offer matches its recording.
1422	// Claude echoes it back as user_message_uuid on the turn that answers it.	1421	// Claude echoes it back as user_message_uuid on the turn that answers it.
1423	export function claudePromptUuid(attemptId: string): NonNullable<SDKUserMessage["uuid"]> {	1422	export const claudePromptUuid = Effect.fn("claudePromptUuid")(function* (attemptId: string) {
1424	const hex = NodeCrypto.createHash("sha256").update(`t3-claude-prompt:${attemptId}`).digest("hex");	1423	const crypto = yield* Crypto.Crypto;
		1424	const digest = yield* crypto
		1425	.digest("SHA-256", new TextEncoder().encode(`t3-claude-prompt:${attemptId}`))
		1426	.pipe(Effect.orDie);
		1427	const hex = Hex.encode(digest);
1425	const variant = ((Number.parseInt(hex[16]!, 16) & 0x3) \| 0x8).toString(16);	1428	const variant = ((Number.parseInt(hex[16]!, 16) & 0x3) \| 0x8).toString(16);
1426	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-${variant}${hex.slice(17, 20)}-${hex.slice(20, 32)}`;	1429	const uuid: NonNullable<SDKUserMessage["uuid"]> =
1427	}	1430	`${hex.slice(0, 8)}-${hex.slice(8, 12)}-4${hex.slice(13, 16)}-${variant}${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
		1431	return uuid;
		1432	});
1428		1433
1429	type ClaudeAssistantContentBlock = SDKAssistantMessage["message"]["content"][number];	1434	type ClaudeAssistantContentBlock = SDKAssistantMessage["message"]["content"][number];
1430	type ClaudeToolUseContentBlock = Extract<	1435	type ClaudeToolUseContentBlock = Extract<
...	@@ -2998,6 +3003,7 @@ export interface ClaudeAdapterV2Options {	...	@@ -2998,6 +3003,7 @@ export interface ClaudeAdapterV2Options {
2998	readonly attachmentsDir: string;	3003	readonly attachmentsDir: string;
2999	readonly fileSystem: FileSystem.FileSystem;	3004	readonly fileSystem: FileSystem.FileSystem;
3000	readonly path: Path.Path;	3005	readonly path: Path.Path;
		3006	readonly crypto: Crypto.Crypto;
3001	readonly idAllocator: IdAllocator.IdAllocatorV2Shape;	3007	readonly idAllocator: IdAllocator.IdAllocatorV2Shape;
3002	readonly queryRunner: ClaudeAgentSdkQueryRunnerShape;	3008	readonly queryRunner: ClaudeAgentSdkQueryRunnerShape;
3003	readonly scopedLimitNames?: Ref.Ref<ClaudeScopedLimitNames>;	3009	readonly scopedLimitNames?: Ref.Ref<ClaudeScopedLimitNames>;
...	@@ -3013,7 +3019,7 @@ export interface ClaudeAdapterV2Options {	...	@@ -3013,7 +3019,7 @@ export interface ClaudeAdapterV2Options {
3013	export function makeClaudeAdapterV2(	3019	export function makeClaudeAdapterV2(
3014	adapterOptions: ClaudeAdapterV2Options,	3020	adapterOptions: ClaudeAdapterV2Options,
3015	): ProviderAdapter.ProviderAdapterV2Shape {	3021	): ProviderAdapter.ProviderAdapterV2Shape {
3016	const { attachmentsDir, fileSystem, path, idAllocator, queryRunner } = adapterOptions;	3022	const { attachmentsDir, fileSystem, path, crypto, idAllocator, queryRunner } = adapterOptions;
3017	const continuationRequests = adapterOptions.continuationRequests ?? {	3023	const continuationRequests = adapterOptions.continuationRequests ?? {
3018	offer: () => Effect.void,	3024	offer: () => Effect.void,
3019	};	3025	};
...	@@ -7242,6 +7248,11 @@ export function makeClaudeAdapterV2(	...	@@ -7242,6 +7248,11 @@ export function makeClaudeAdapterV2(
7242	const startedAt = yield* DateTime.now;	7248	const startedAt = yield* DateTime.now;
7243	const nativeThreadId = yield* getNativeThreadId(turnInput.providerThread);	7249	const nativeThreadId = yield* getNativeThreadId(turnInput.providerThread);
7244	const nativeTurnId = `turn:${turnInput.attemptId}`;	7250	const nativeTurnId = `turn:${turnInput.attemptId}`;
		7251	const promptUuid = isClaudeProviderContinuationTurn(turnInput)
		7252	? null
		7253	: yield* claudePromptUuid(turnInput.attemptId).pipe(
		7254	Effect.provideService(Crypto.Crypto, crypto),
		7255	);
7245	const providerTurnId = idAllocator.derive.providerTurn({	7256	const providerTurnId = idAllocator.derive.providerTurn({
7246	driver: CLAUDE_PROVIDER,	7257	driver: CLAUDE_PROVIDER,
7247	nativeTurnId,	7258	nativeTurnId,
...	@@ -7298,9 +7309,7 @@ export function makeClaudeAdapterV2(	...	@@ -7298,9 +7309,7 @@ export function makeClaudeAdapterV2(
7298	subagentsByToolUseId: new Map(),	7309	subagentsByToolUseId: new Map(),
7299	subagentNodesByTaskId: new Map(),	7310	subagentNodesByTaskId: new Map(),
7300	pendingSubagentLaunchesByToolUseId: new Map(),	7311	pendingSubagentLaunchesByToolUseId: new Map(),
7301	promptUuid: isClaudeProviderContinuationTurn(turnInput)	7312	promptUuid,
7302	? null
7303	: claudePromptUuid(turnInput.attemptId),
7304	promptEcho: isClaudeProviderContinuationTurn(turnInput) ? "confirmed" : "pending",	7313	promptEcho: isClaudeProviderContinuationTurn(turnInput) ? "confirmed" : "pending",
7305	gatedFramesBeforeEcho: 0,	7314	gatedFramesBeforeEcho: 0,
7306	heldRootFrames: [],	7315	heldRootFrames: [],
...	@@ -7309,20 +7318,20 @@ export function makeClaudeAdapterV2(	...	@@ -7309,20 +7318,20 @@ export function makeClaudeAdapterV2(
7309	// produced instead of prompting it again: drain the buffered wake	7318	// produced instead of prompting it again: drain the buffered wake
7310	// messages into this turn and let any still-streaming messages	7319	// messages into this turn and let any still-streaming messages
7311	// follow live. The continuation prompt text never reaches the CLI.	7320	// follow live. The continuation prompt text never reaches the CLI.
7312	const isContinuationTurn = context.promptUuid === null;	7321	const userMessage =
7313	const userMessage = isContinuationTurn	7322	promptUuid === null
7314	? null	7323	? null
7315	: yield* makeClaudeUserMessageWithAttachments({	7324	: yield* makeClaudeUserMessageWithAttachments({
7316	text: applyClaudePromptEffortPrefix(	7325	text: applyClaudePromptEffortPrefix(
7317	turnInput.message.text,	7326	turnInput.message.text,
7318	compileClaudeModelSelection(turnInput.modelSelection).promptEffort,	7327	compileClaudeModelSelection(turnInput.modelSelection).promptEffort,
7319	),	7328	),
7320	attachments: turnInput.message.attachments,	7329	attachments: turnInput.message.attachments,
7321	attachmentsDir,	7330	attachmentsDir,
7322	fileSystem,	7331	fileSystem,
7323	skillNames: yield* userInvocableSkillNames(turnInput.runtimePolicy.cwd),	7332	skillNames: yield* userInvocableSkillNames(turnInput.runtimePolicy.cwd),
7324	uuid: claudePromptUuid(turnInput.attemptId),	7333	uuid: promptUuid,
7325	});	7334	});
7326	const querySession = yield* openQuery(turnInput, nativeThreadId);	7335	const querySession = yield* openQuery(turnInput, nativeThreadId);
7327	yield* Ref.set(activeTurn, context);	7336	yield* Ref.set(activeTurn, context);
7328	yield* emitProviderEvent({	7337	yield* emitProviderEvent({
...	@@ -7906,6 +7915,7 @@ export function makeClaudeAdapterV2(	...	@@ -7906,6 +7915,7 @@ export function makeClaudeAdapterV2(
7906		7915
7907	export type ClaudeAdapterV2DriverEnv =	7916	export type ClaudeAdapterV2DriverEnv =
7908	\| ClaudeAgentSdkQueryRunner	7917	\| ClaudeAgentSdkQueryRunner
		7918	\| Crypto.Crypto
7909	\| FileSystem.FileSystem	7919	\| FileSystem.FileSystem
7910	\| IdAllocator.IdAllocatorV2	7920	\| IdAllocator.IdAllocatorV2
7911	\| Path.Path	7921	\| Path.Path
...	@@ -7926,6 +7936,7 @@ export const createClaudeAdapterV2 = Effect.fn("ClaudeAdapterV2Driver.create")(	...	@@ -7926,6 +7936,7 @@ export const createClaudeAdapterV2 = Effect.fn("ClaudeAdapterV2Driver.create")(
7926	const baseEnvironment = mergeProviderInstanceEnvironment(environment, hostEnvironment);	7936	const baseEnvironment = mergeProviderInstanceEnvironment(environment, hostEnvironment);
7927	const claudeEnvironment = yield* makeClaudeEnvironment(config, baseEnvironment);	7937	const claudeEnvironment = yield* makeClaudeEnvironment(config, baseEnvironment);
7928	const path = yield* Path.Path;	7938	const path = yield* Path.Path;
		7939	const crypto = yield* Crypto.Crypto;
7929	const binaryPath = yield* resolveClaudeSdkExecutablePath(	7940	const binaryPath = yield* resolveClaudeSdkExecutablePath(
7930	expandHomePath(config.binaryPath),	7941	expandHomePath(config.binaryPath),
7931	claudeEnvironment,	7942	claudeEnvironment,
...	@@ -7937,6 +7948,7 @@ export const createClaudeAdapterV2 = Effect.fn("ClaudeAdapterV2Driver.create")(	...	@@ -7937,6 +7948,7 @@ export const createClaudeAdapterV2 = Effect.fn("ClaudeAdapterV2Driver.create")(
7937	attachmentsDir: serverConfig.attachmentsDir,	7948	attachmentsDir: serverConfig.attachmentsDir,
7938	fileSystem,	7949	fileSystem,
7939	path,	7950	path,
		7951	crypto,
7940	idAllocator,	7952	idAllocator,
7941	queryRunner,	7953	queryRunner,
7942	continuationRequests,	7954	continuationRequests,
...	@@ -7970,6 +7982,7 @@ export const ClaudeAdapterV2Driver: ProviderAdapterDriver<	...	@@ -7970,6 +7982,7 @@ export const ClaudeAdapterV2Driver: ProviderAdapterDriver<
7970	const makeDefaultClaudeAdapterV2 = Effect.fn("ClaudeAdapterV2.layer")(function* () {	7982	const makeDefaultClaudeAdapterV2 = Effect.fn("ClaudeAdapterV2.layer")(function* () {
7971	const fileSystem = yield* FileSystem.FileSystem;	7983	const fileSystem = yield* FileSystem.FileSystem;
7972	const path = yield* Path.Path;	7984	const path = yield* Path.Path;
		7985	const crypto = yield* Crypto.Crypto;
7973	const hostEnvironment = yield* HostProcessEnvironment;	7986	const hostEnvironment = yield* HostProcessEnvironment;
7974	const idAllocator = yield* IdAllocator.IdAllocatorV2;	7987	const idAllocator = yield* IdAllocator.IdAllocatorV2;
7975	const queryRunner = yield* ClaudeAgentSdkQueryRunner;	7988	const queryRunner = yield* ClaudeAgentSdkQueryRunner;
...	@@ -7983,6 +7996,7 @@ const makeDefaultClaudeAdapterV2 = Effect.fn("ClaudeAdapterV2.layer")(function*	...	@@ -7983,6 +7996,7 @@ const makeDefaultClaudeAdapterV2 = Effect.fn("ClaudeAdapterV2.layer")(function*
7983	attachmentsDir: serverConfig.attachmentsDir,	7996	attachmentsDir: serverConfig.attachmentsDir,
7984	fileSystem,	7997	fileSystem,
7985	path,	7998	path,
		7999	crypto,
7986	idAllocator,	8000	idAllocator,
7987	queryRunner,	8001	queryRunner,
7988	continuationRequests,	8002	continuationRequests,
...	@@ -7993,6 +8007,7 @@ const layer: Layer.Layer<	...	@@ -7993,6 +8007,7 @@ const layer: Layer.Layer<
7993	ProviderAdapter.ProviderAdapterV2,	8007	ProviderAdapter.ProviderAdapterV2,
7994	never,	8008	never,
7995	\| ClaudeAgentSdkQueryRunner	8009	\| ClaudeAgentSdkQueryRunner
		8010	\| Crypto.Crypto
7996	\| FileSystem.FileSystem	8011	\| FileSystem.FileSystem
7997	\| IdAllocator.IdAllocatorV2	8012	\| IdAllocator.IdAllocatorV2
7998	\| Path.Path	8013	\| Path.Path

apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts+175-160

...	@@ -35,6 +35,7 @@ import * as CodexClient from "effect-codex-app-server/client";	...	@@ -35,6 +35,7 @@ import * as CodexClient from "effect-codex-app-server/client";
35	import * as CodexReplay from "effect-codex-app-server/replay";	35	import * as CodexReplay from "effect-codex-app-server/replay";
36	import * as DateTime from "effect/DateTime";	36	import * as DateTime from "effect/DateTime";
37	import * as Deferred from "effect/Deferred";	37	import * as Deferred from "effect/Deferred";
		38	import * as Crypto from "effect/Crypto";
38	import * as Effect from "effect/Effect";	39	import * as Effect from "effect/Effect";
39	import * as Predicate from "effect/Predicate";	40	import * as Predicate from "effect/Predicate";
40	import * as FileSystem from "effect/FileSystem";	41	import * as FileSystem from "effect/FileSystem";
...	@@ -801,183 +802,195 @@ describe("CodexAdapterV2 process spawning", () => {	...	@@ -801,183 +802,195 @@ describe("CodexAdapterV2 process spawning", () => {
801	});	802	});
802		803
803	describe("CodexAdapterV2 dynamic tool projection", () => {	804	describe("CodexAdapterV2 dynamic tool projection", () => {
804	it("uses the CUA call title while leaving other MCP titles as tool arguments", () => {	805	it.effect("uses the CUA call title while leaving other MCP titles as tool arguments", () =>
805	const call = {	806	Effect.gen(function* () {
806	type: "mcpToolCall" as const,	807	const call = {
807	id: "inspect",	808	type: "mcpToolCall" as const,
808	server: "cua_repl",	809	id: "inspect",
809	tool: "js",	810	server: "cua_repl",
810	status: "completed" as const,	811	tool: "js",
811	arguments: {	812	status: "completed" as const,
812	code: "await game.getAXStateAndScreenshot();",	813	arguments: {
813	title: "Inspect Saga music screen",	814	code: "await game.getAXStateAndScreenshot();",
814	},	815	title: "Inspect Saga music screen",
815	result: { content: [] },	816	},
816	};	817	result: { content: [] },
817	assert.equal(	818	};
818	CodexAdapterV2.projectCodexDynamicToolItem(call).title,	819	assert.equal(
819	"Inspect Saga music screen",	820	(yield* CodexAdapterV2.projectCodexDynamicToolItem(call)).title,
820	);	821	"Inspect Saga music screen",
821	assert.equal(	822	);
822	CodexAdapterV2.projectCodexDynamicToolItem({ ...call, arguments: { title: " " } }).title,	823	assert.equal(
823	"js",	824	(yield* CodexAdapterV2.projectCodexDynamicToolItem({ ...call, arguments: { title: " " } }))
824	);	825	.title,
825	assert.equal(	826	"js",
826	CodexAdapterV2.projectCodexDynamicToolItem({ ...call, server: "github" }).title,	827	);
827	"js",	828	assert.equal(
828	);	829	(yield* CodexAdapterV2.projectCodexDynamicToolItem({ ...call, server: "github" })).title,
829	});	830	"js",
		831	);
		832	}).pipe(Effect.provide(NodeServices.layer)),
		833	);
830		834
831	it.each(["inProgress", "completed", "failed"] as const)(	835	it.effect.each(["inProgress", "completed", "failed"] as const)(
832	"presents ordinary MCP calls when %s",	836	"presents ordinary MCP calls when %s",
833	(status) => {	837	(status) =>
834	const projection = CodexAdapterV2.projectCodexDynamicToolItem({	838	Effect.gen(function* () {
		839	const projection = yield* CodexAdapterV2.projectCodexDynamicToolItem({
		840	type: "mcpToolCall",
		841	id: "weather-call",
		842	server: "weather",
		843	tool: "get_weather",
		844	status,
		845	arguments: { city: "Berlin" },
		846	});
		847	assert.equal(projection.title, "get weather");
		848	assert.deepEqual(projection.toolSource, {
		849	key: "mcp:weather",
		850	name: "weather",
		851	kind: "integration",
		852	});
		853	assert.deepEqual(projection.input, { city: "Berlin" });
		854	}).pipe(Effect.provide(NodeServices.layer)),
		855	);
		856
		857	it.effect("uses Codex connector names without reading a display title from arguments", () =>
		858	Effect.gen(function* () {
		859	const projection = yield* CodexAdapterV2.projectCodexDynamicToolItem({
835	type: "mcpToolCall",	860	type: "mcpToolCall",
836	id: "weather-call",	861	id: "connector-call",
837	server: "weather",	862	server: "_apps",
838	tool: "get_weather",	863	tool: "connector_get_weather",
839	status,	864	status: "completed",
840	arguments: { city: "Berlin" },	865	arguments: { title: "Argument, not display metadata" },
		866	appContext: {
		867	connectorId: "weather-app",
		868	appName: "Weather",
		869	actionName: "Check weather",
		870	},
		871	result: {
		872	content: [],
		873	_meta: { source: { logoUrl: "https://example.com/weather.png" } },
		874	},
841	});	875	});
842	assert.equal(projection.title, "get weather");	876	assert.equal(projection.title, "Check weather");
843	assert.deepEqual(projection.toolSource, {	877	assert.equal(projection.toolSource?.name, "Weather");
844	key: "mcp:weather",	878	assert.deepEqual(projection.toolIcon, {
845	name: "weather",	879	_tag: "themed-logo",
846	kind: "integration",	880	logoUrl: "https://example.com/weather.png",
847	});	881	});
848	assert.deepEqual(projection.input, { city: "Berlin" });	882	assert.deepEqual(projection.toolSource?.icon, projection.toolIcon);
849	},	883	}).pipe(Effect.provide(NodeServices.layer)),
850	);	884	);
851		885
852	it("uses Codex connector names without reading a display title from arguments", () => {	886	it.effect("preserves native browser and app icons alongside MCP tool output", () =>
853	const projection = CodexAdapterV2.projectCodexDynamicToolItem({	887	Effect.gen(function* () {
854	type: "mcpToolCall",	888	const browser = yield* CodexAdapterV2.projectCodexDynamicToolItem({
855	id: "connector-call",	889	type: "mcpToolCall",
856	server: "_apps",	890	id: "browser",
857	tool: "connector_get_weather",	891	server: "browser",
858	status: "completed",	892	tool: "open",
859	arguments: { title: "Argument, not display metadata" },	893	status: "completed",
860	appContext: {	894	arguments: {},
861	connectorId: "weather-app",	895	result: {
862	appName: "Weather",	896	content: [],
863	actionName: "Check weather",	897	_meta: {
864	},	898	"codex/toolSurface": {
865	result: {	899	kind: "browserUse",
866	content: [],	900	browserFamily: "Chrome",
867	_meta: { source: { logoUrl: "https://example.com/weather.png" } },	901	screenshot: {
868	},	902	pageUrl: "https://example.com/docs",
869	});	903	faviconUrl: "https://example.com/icon.png",
870	assert.equal(projection.title, "Check weather");	904	},
871	assert.equal(projection.toolSource?.name, "Weather");
872	assert.deepEqual(projection.toolIcon, {
873	_tag: "themed-logo",
874	logoUrl: "https://example.com/weather.png",
875	});
876	assert.deepEqual(projection.toolSource?.icon, projection.toolIcon);
877	});
878
879	it("preserves native browser and app icons alongside MCP tool output", () => {
880	const browser = CodexAdapterV2.projectCodexDynamicToolItem({
881	type: "mcpToolCall",
882	id: "browser",
883	server: "browser",
884	tool: "open",
885	status: "completed",
886	arguments: {},
887	result: {
888	content: [],
889	_meta: {
890	"codex/toolSurface": {
891	kind: "browserUse",
892	browserFamily: "Chrome",
893	screenshot: {
894	pageUrl: "https://example.com/docs",
895	faviconUrl: "https://example.com/icon.png",
896	},	905	},
897	},	906	},
898	},	907	},
899	},	908	});
900	});	909	assert.equal(browser.toolSurface, "browser");
901	assert.equal(browser.toolSurface, "browser");	910	assert.deepEqual(browser.toolIcon, {
902	assert.deepEqual(browser.toolIcon, {	911	_tag: "website",
903	_tag: "website",	912	pageUrl: "https://example.com/docs",
904	pageUrl: "https://example.com/docs",	913	faviconUrl: "https://example.com/icon.png",
905	faviconUrl: "https://example.com/icon.png",	914	});
906	});	915	assert.equal(browser.toolSource?.name, "Chrome");
907	assert.equal(browser.toolSource?.name, "Chrome");	916	const app = yield* CodexAdapterV2.projectCodexDynamicToolItem({
908	const app = CodexAdapterV2.projectCodexDynamicToolItem({	917	type: "mcpToolCall",
909	type: "mcpToolCall",	918	id: "app",
910	id: "app",	919	server: "computer",
911	server: "computer",	920	tool: "click",
912	tool: "click",	921	status: "completed",
913	status: "completed",	922	arguments: {},
914	arguments: {},	923	result: {
915	result: {	924	content: [],
916	content: [],	925	_meta: {
917	_meta: {	926	"codex/toolSurface": {
918	"codex/toolSurface": {	927	kind: "computerUse",
919	kind: "computerUse",	928	app: { kind: "appId", appId: "com.apple.finder" },
920	app: { kind: "appId", appId: "com.apple.finder" },	929	},
921	},	930	},
922	},	931	},
923	},	932	});
924	});	933	assert.deepEqual(app.toolIcon, {
925	assert.deepEqual(app.toolIcon, {	934	_tag: "native-app",
926	_tag: "native-app",	935	app: { _tag: "app-id", appId: "com.apple.finder" },
927	app: { _tag: "app-id", appId: "com.apple.finder" },	936	});
928	});	937	assert.equal(app.toolSource?.name, "Finder");
929	assert.equal(app.toolSource?.name, "Finder");	938	}).pipe(Effect.provide(NodeServices.layer)),
930	});	939	);
931		940
932	it("preserves MCP arguments and prefers structured output", () => {	941	it.effect("preserves MCP arguments and prefers structured output", () =>
933	const projection = CodexAdapterV2.projectCodexDynamicToolItem({	942	Effect.gen(function* () {
934	type: "mcpToolCall",	943	const projection = yield* CodexAdapterV2.projectCodexDynamicToolItem({
935	id: "call-create-threads",	944	type: "mcpToolCall",
936	server: "t3-code",	945	id: "call-create-threads",
937	tool: "create_threads",	946	server: "t3-code",
938	status: "completed",	947	tool: "create_threads",
939	arguments: {	948	status: "completed",
940	threads: [{ title: "Fixture child", prompt: "fixture child prompt" }],	949	arguments: {
941	},	950	threads: [{ title: "Fixture child", prompt: "fixture child prompt" }],
942	result: {
943	content: [{ type: "text", text: '{"threads":[{"threadId":"thread:mcp:fixture:0"}]}' }],
944	structuredContent: {
945	threads: [{ threadId: "thread:mcp:fixture:0" }],
946	},	951	},
947	},	952	result: {
948	});	953	content: [{ type: "text", text: '{"threads":[{"threadId":"thread:mcp:fixture:0"}]}' }],
		954	structuredContent: {
		955	threads: [{ threadId: "thread:mcp:fixture:0" }],
		956	},
		957	},
		958	});
949		959
950	assert.deepEqual(projection, {	960	assert.deepEqual(projection, {
951	toolName: "t3-code.create_threads",	961	toolName: "t3-code.create_threads",
952	input: {	962	input: {
953	threads: [{ title: "Fixture child", prompt: "fixture child prompt" }],	963	threads: [{ title: "Fixture child", prompt: "fixture child prompt" }],
954	},	964	},
955	output: {	965	output: {
956	threads: [{ threadId: "thread:mcp:fixture:0" }],	966	threads: [{ threadId: "thread:mcp:fixture:0" }],
957	},	967	},
958	status: "completed",	968	status: "completed",
959	});	969	});
960	});	970	}).pipe(Effect.provide(NodeServices.layer)),
		971	);
961		972
962	it("preserves namespaced dynamic tool output", () => {	973	it.effect("preserves namespaced dynamic tool output", () =>
963	const projection = CodexAdapterV2.projectCodexDynamicToolItem({	974	Effect.gen(function* () {
964	type: "dynamicToolCall",	975	const projection = yield* CodexAdapterV2.projectCodexDynamicToolItem({
965	id: "call-dynamic",	976	type: "dynamicToolCall",
966	namespace: "workspace",	977	id: "call-dynamic",
967	tool: "inspect",	978	namespace: "workspace",
968	status: "failed",	979	tool: "inspect",
969	arguments: { path: "package.json" },	980	status: "failed",
970	contentItems: [{ type: "inputText", text: "inspection failed" }],	981	arguments: { path: "package.json" },
971	success: false,	982	contentItems: [{ type: "inputText", text: "inspection failed" }],
972	});	983	success: false,
		984	});
973		985
974	assert.deepEqual(projection, {	986	assert.deepEqual(projection, {
975	toolName: "workspace.inspect",	987	toolName: "workspace.inspect",
976	input: { path: "package.json" },	988	input: { path: "package.json" },
977	output: [{ type: "inputText", text: "inspection failed" }],	989	output: [{ type: "inputText", text: "inspection failed" }],
978	status: "failed",	990	status: "failed",
979	});	991	});
980	});	992	}).pipe(Effect.provide(NodeServices.layer)),
		993	);
981	});	994	});
982		995
983	describe("CodexAdapterV2 native protocol logging", () => {	996	describe("CodexAdapterV2 native protocol logging", () => {
...	@@ -1703,6 +1716,7 @@ describe("CodexAdapterV2 session initialize", () => {	...	@@ -1703,6 +1716,7 @@ describe("CodexAdapterV2 session initialize", () => {
1703	),	1716	),
1704	),	1717	),
1705	},	1718	},
		1719	crypto: yield* Crypto.Crypto,
1706	fileSystem: yield* FileSystem.FileSystem,	1720	fileSystem: yield* FileSystem.FileSystem,
1707	idAllocator: yield* IdAllocator.IdAllocatorV2,	1721	idAllocator: yield* IdAllocator.IdAllocatorV2,
1708	serverConfig: yield* makeReplayServerConfig(transcript.scenario).pipe(Effect.orDie),	1722	serverConfig: yield* makeReplayServerConfig(transcript.scenario).pipe(Effect.orDie),
...	@@ -1899,6 +1913,7 @@ describe("CodexAdapterV2 post-settle continuation", () => {	...	@@ -1899,6 +1913,7 @@ describe("CodexAdapterV2 post-settle continuation", () => {
1899	settings: DEFAULT_CODEX_SETTINGS,	1913	settings: DEFAULT_CODEX_SETTINGS,
1900	environment: {},	1914	environment: {},
1901	clientFactory,	1915	clientFactory,
		1916	crypto: yield* Crypto.Crypto,
1902	fileSystem,	1917	fileSystem,
1903	idAllocator,	1918	idAllocator,
1904	serverConfig,	1919	serverConfig,

apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts+35-23

 @@ -66,6 +66,7 @@ import * as CodexClient from "effect-codex-app-server/client";
 import * as CodexErrors from "effect-codex-app-server/errors";
 import * as CodexSchema from "effect-codex-app-server/schema";
 import * as Context from "effect/Context";
+import * as Crypto from "effect/Crypto";
 import * as DateTime from "effect/DateTime";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 @@ -479,26 +480,29 @@ function codexDynamicToolOutput(
   return item.success === false ? { success: false } : undefined;
 }
-export function projectCodexDynamicToolItem(
+export const projectCodexDynamicToolItem = Effect.fn("CodexAdapterV2.projectDynamicToolItem")(
-  item: CodexDynamicToolItem,
+  function* (
-): CodexDynamicToolProjection {
+    item: CodexDynamicToolItem,
-  const output =
+  ): Effect.fn.Return<CodexDynamicToolProjection, never, Crypto.Crypto> {
-    item.type === "mcpToolCall" ? codexMcpToolOutput(item) : codexDynamicToolOutput(item);
+    const output =
-  const toolName =
+      item.type === "mcpToolCall" ? codexMcpToolOutput(item) : codexDynamicToolOutput(item);
-    item.type === "mcpToolCall"
+    const toolName =
-      ? `${item.server}.${item.tool}`
+      item.type === "mcpToolCall"
-      : [trimText(item.namespace), item.tool].filter(Boolean).join(".");
+        ? `${item.server}.${item.tool}`
-  const presentation = item.type === "mcpToolCall" ? mcpToolPresentation(item) : {};
+        : [trimText(item.namespace), item.tool].filter(Boolean).join(".");
-  const title = dynamicToolTitle(toolName, item.arguments) ?? presentation.title;
+    const presentation: McpToolPresentation =
-  const projection: CodexDynamicToolProjection = {
+      item.type === "mcpToolCall" ? yield* mcpToolPresentation(item) : {};
-    ...presentation,
+    const title = dynamicToolTitle(toolName, item.arguments) ?? presentation.title;
-    toolName,
+    const projection: CodexDynamicToolProjection = {
-    ...(title ? { title } : {}),
+      ...presentation,
-    input: item.arguments,
+      toolName,
-    status: codexItemStatus(item.status).turnItem,
+      ...(title ? { title } : {}),
-  };
+      input: item.arguments,
-  return output === undefined ? projection : { ...projection, output };
+      status: codexItemStatus(item.status).turnItem,
-}
+    };
+    return output === undefined ? projection : { ...projection, output };
+  },
+);
 function codexNativeItemRef(nativeItemId: string) {
   return {
 @@ -1513,6 +1517,7 @@ export const layerAppServerClientFactory: Layer.Layer<
 export type CodexAdapterV2DriverEnv =
   | CodexAppServerClientFactory
+  | Crypto.Crypto
   | FileSystem.FileSystem
   | IdAllocatorV2
   | Path.Path
 @@ -1525,6 +1530,7 @@ export const createCodexAdapterV2 = (
   Effect.gen(function* () {
     const clientFactory = yield* CodexAppServerClientFactory;
     const continuationRequests = yield* ProviderContinuationRequests;
+    const crypto = yield* Crypto.Crypto;
     const fileSystem = yield* FileSystem.FileSystem;
     const hostEnvironment = yield* HostProcessEnvironment;
     const idAllocator = yield* IdAllocatorV2;
 @@ -1555,6 +1561,7 @@ export const createCodexAdapterV2 = (
       settings,
       environment: mergeProviderInstanceEnvironment(environment, hostEnvironment),
       clientFactory,
+      crypto,
       fileSystem,
       idAllocator,
       serverConfig,
 @@ -1573,12 +1580,13 @@ export const CodexAdapterV2Driver: ProviderAdapterDriver<CodexSettings, CodexAda
 const layer: Layer.Layer<
   ProviderAdapterV2,
   never,
-  CodexAppServerClientFactory | FileSystem.FileSystem | IdAllocatorV2 | ServerConfig
+  CodexAppServerClientFactory | Crypto.Crypto | FileSystem.FileSystem | IdAllocatorV2 | ServerConfig
 > = Layer.effect(
   ProviderAdapterV2,
   Effect.gen(function* () {
     const clientFactory = yield* CodexAppServerClientFactory;
     const continuationRequests = yield* ProviderContinuationRequests;
+    const crypto = yield* Crypto.Crypto;
     const fileSystem = yield* FileSystem.FileSystem;
     const hostEnvironment = yield* HostProcessEnvironment;
     const idAllocator = yield* IdAllocatorV2;
 @@ -1589,6 +1597,7 @@ const layer: Layer.Layer<
       settings: DEFAULT_CODEX_SETTINGS,
       environment: hostEnvironment,
       clientFactory,
+      crypto,
       fileSystem,
       idAllocator,
       serverConfig,
 @@ -1609,6 +1618,7 @@ export interface CodexAdapterV2Options {
    * Codex with a current access token.
    */
   readonly resolveRuntime?: Effect.Effect<CodexEffectiveRuntime, ProviderSetupError, Scope.Scope>;
+  readonly crypto: Crypto.Crypto;
   readonly fileSystem: FileSystem.FileSystem;
   readonly idAllocator: IdAllocatorV2Shape;
   readonly serverConfig: ServerConfig["Service"];
 @@ -1623,7 +1633,7 @@ export interface CodexAdapterV2Options {
 }
 export function makeCodexAdapterV2(adapterOptions: CodexAdapterV2Options): ProviderAdapterV2Shape {
-  const { clientFactory, fileSystem, idAllocator, serverConfig } = adapterOptions;
+  const { clientFactory, crypto, fileSystem, idAllocator, serverConfig } = adapterOptions;
   const continuationRequests = adapterOptions.continuationRequests;
   return ProviderAdapterV2.of({
 @@ -3480,7 +3490,9 @@ export function makeCodexAdapterV2(adapterOptions: CodexAdapterV2Options): Provi
               nativeItemId: item.id,
             });
             const { ordinal, startedAt } = yield* resolveItemPosition(context, item.id);
-            const projection = projectCodexDynamicToolItem(item);
+            const projection = yield* projectCodexDynamicToolItem(item).pipe(
+              Effect.provideService(Crypto.Crypto, crypto),
+            );
             const node: OrchestrationV2ExecutionNode = {
               id: nodeId,
               threadId: context.projectionThreadId,

apps/server/src/orchestration-v2/Adapters/OpenCode2AdapterV2.test.ts+20-15

...	@@ -3,6 +3,7 @@	...	@@ -3,6 +3,7 @@
3	* driven through the real adapter and `@opencode/client` against a replayed	3	* driven through the real adapter and `@opencode/client` against a replayed
4	* HTTP server. Frames reuse the shapes recorded against 2.0.18.	4	* HTTP server. Frames reuse the shapes recorded against 2.0.18.
5	*/	5	*/
		6	import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
6	import { assert, it } from "@effect/vitest";	7	import { assert, it } from "@effect/vitest";
7	import {	8	import {
8	CheckpointId,	9	CheckpointId,
...	@@ -2766,21 +2767,25 @@ describe("OpenCode2 adapter", () => {	...	@@ -2766,21 +2767,25 @@ describe("OpenCode2 adapter", () => {
2766	}).pipe(Effect.scoped),	2767	}).pipe(Effect.scoped),
2767	);	2768	);
2768		2769
2769	it("names each thread's MCP server within OpenCode's limits, one name per thread", () => {	2770	it.effect("names each thread's MCP server within OpenCode's limits, one name per thread", () =>
2770	const project = "thread:project:ce04e4e2-6c29-4ff0-a1d7-b089dd63e258";	2771	Effect.gen(function* () {
2771	const ids = [	2772	const project = "thread:project:ce04e4e2-6c29-4ff0-a1d7-b089dd63e258";
2772	`${project}:d3b2d715-c4a1-4b63-bb65-1634c3a3a8c4`,	2773	const ids = [
2773	`${project}:d3b2d715-c4a1-4b63-bb65-1634c3a3a8c5`,	2774	`${project}:d3b2d715-c4a1-4b63-bb65-1634c3a3a8c4`,
2774	"thread:delegated-task:command%3Amcp%3A48bef2bf-6d0e-4f7a-9c3b-2e5d8a1f7c40%3Adelegate-task%3Around1",	2775	`${project}:d3b2d715-c4a1-4b63-bb65-1634c3a3a8c5`,
2775	"thread:delegated-task:command%3Amcp%3A48bef2bf-6d0e-4f7a-9c3b-2e5d8a1f7c40%3Adelegate-task%3Around2",	2776	"thread:delegated-task:command%3Amcp%3A48bef2bf-6d0e-4f7a-9c3b-2e5d8a1f7c40%3Adelegate-task%3Around1",
2776	];	2777	"thread:delegated-task:command%3Amcp%3A48bef2bf-6d0e-4f7a-9c3b-2e5d8a1f7c40%3Adelegate-task%3Around2",
2777	const names = ids.map(t3McpServerName);	2778	];
2778	for (const name of names) assert.match(name, /^t3-code-[A-Za-z0-9_-]{1,56}$/);	2779	const names = yield* Effect.forEach(ids, t3McpServerName);
2779	assert.equal(new Set(names).size, ids.length);	2780	for (const name of names) assert.match(name, /^t3-code-[A-Za-z0-9_-]{1,56}$/);
2780	assert.deepEqual(ids.map(t3McpServerName), names);	2781	assert.equal(new Set(names).size, ids.length);
2781	// A name that already fits stays readable.	2782	assert.deepEqual(yield* Effect.forEach(ids, t3McpServerName), names);
2782	assert.equal(t3McpServerName(threadId), "t3-code-thread_opencode2-adapter");	2783	// A digested name is the one the synchronous node:crypto version produced.
2783	});	2784	assert.equal(names[0], "t3-code-63abb5df2b188bdd");
		2785	// A name that already fits stays readable.
		2786	assert.equal(yield* t3McpServerName(threadId), "t3-code-thread_opencode2-adapter");
		2787	}).pipe(Effect.provide(NodeCrypto.layer)),
		2788	);
2784		2789
2785	it.effect("reads user and assistant text from the session's message list", () =>	2790	it.effect("reads user and assistant text from the session's message list", () =>
2786	Effect.gen(function* () {	2791	Effect.gen(function* () {

apps/server/src/orchestration-v2/Adapters/OpenCode2AdapterV2.testkit.ts+14-2

 @@ -284,7 +284,13 @@ function layerRegistry(
       Effect.map((adapter) => ProviderAdapterRegistry.layerFromAdapters([adapter])),
     ),
   ).pipe(
-    Layer.provide(Layer.mergeAll(layerReplayServerConfig(transcript.scenario), IdAllocator.layer)),
+    Layer.provide(
+      Layer.mergeAll(
+        layerReplayServerConfig(transcript.scenario),
+        IdAllocator.layer,
+        NodeServices.layer,
+      ),
+    ),
   );
 }
 @@ -322,7 +328,13 @@ export const openCode2ReplayRuntime = (
       },
     });
   }).pipe(
-    Effect.provide(Layer.mergeAll(layerReplayServerConfig("opencode2_adapter"), IdAllocator.layer)),
+    Effect.provide(
+      Layer.mergeAll(
+        layerReplayServerConfig("opencode2_adapter"),
+        IdAllocator.layer,
+        NodeServices.layer,
+      ),
+    ),
   );
 export const OpenCode2OrchestratorReplayHarness: OrchestratorV2ProviderReplayHarness<

apps/server/src/orchestration-v2/Adapters/OpenCode2AdapterV2.ts+19-12

 @@ -21,7 +21,6 @@
  *
  * @module orchestration-v2/Adapters/OpenCode2AdapterV2
  */
-import * as NodeCrypto from "node:crypto";
 import {
   AbsolutePath,
 @@ -59,7 +58,9 @@ import {
 import type * as Cause from "effect/Cause";
 import * as DateTime from "effect/DateTime";
 import * as Deferred from "effect/Deferred";
+import * as Crypto from "effect/Crypto";
 import * as Effect from "effect/Effect";
+import * as Hex from "effect/encoding/Hex";
 import * as Exit from "effect/Exit";
 import * as Option from "effect/Option";
 import * as Queue from "effect/Queue";
 @@ -453,12 +454,15 @@ const rule = (action: string, effect: Rule["effect"]): Rule => ({ action, resour
  * tool namespace limit), and its router rejects adding one over 100, so a
  * thread id that does not fit is replaced by a digest of it.
  */
-export const t3McpServerName = (threadId: string) => {
+export const t3McpServerName = Effect.fn("t3McpServerName")(function* (threadId: string) {
   const name = `t3-code-${threadId.replaceAll(/[^a-zA-Z0-9_-]/g, "_")}`;
   if (name.length <= 64) return name;
-  const digest = NodeCrypto.createHash("sha256").update(threadId).digest("hex");
+  const crypto = yield* Crypto.Crypto;
-  return `t3-code-${digest.slice(0, 16)}`;
+  const digest = yield* crypto
-};
+    .digest("SHA-256", new TextEncoder().encode(threadId))
+    .pipe(Effect.orDie);
+  return `t3-code-${Hex.encode(digest).slice(0, 16)}`;
+});
 /**
  * The rules that keep T3's MCP servers to their own thread, after the mode's:
 @@ -466,19 +470,19 @@ export const t3McpServerName = (threadId: string) => {
  * this thread's own is allowed again, in every mode. A subagent's session
  * inherits the thread's.
  */
-const mcpRules = (threadId: string | null): ReadonlyArray<Rule> =>
+const mcpRules = (mcpServerName: string | null): ReadonlyArray<Rule> =>
-  threadId === null
+  mcpServerName === null
     ? []
     : [
         { action: "t3-code-*", resource: "*", effect: "deny" },
-        { action: `${t3McpServerName(threadId)}_*`, resource: "*", effect: "allow" },
+        { action: `${mcpServerName}_*`, resource: "*", effect: "allow" },
       ];
 const sessionRules = (
   policy: RulesPolicy,
   paths: ReadonlyArray<Rule>,
   grants: ReadonlyArray<Rule>,
-  threadId: string | null,
+  mcpServerName: string | null,
 ): ReadonlyArray<Rule> => [
   ...(policy.runtimeMode === "full-access"
     ? [rule("*", "allow")]
 @@ -492,7 +496,7 @@ const sessionRules = (
   // are never denied: the free tier refuses sessions whose rules deny them.
   ...(policy.interactionMode === "plan" ? [rule("edit", "deny")] : []),
   ...paths,
-  ...mcpRules(threadId),
+  ...mcpRules(mcpServerName),
 ];
 const sameRules = (left: ReadonlyArray<Rule> | undefined, right: ReadonlyArray<Rule>) =>
 @@ -828,7 +832,10 @@ export const make = Effect.fn("OpenCode2Adapter.make")(function* (instanceId: Pr
   const idAllocator = yield* IdAllocator.IdAllocatorV2;
   const serverConfig = yield* ServerConfig.ServerConfig;
   const continuationRequests = yield* ProviderContinuationRequests.ProviderContinuationRequests;
+  const crypto = yield* Crypto.Crypto;
   const driver = OPENCODE_PROVIDER;
+  const mcpServerNameFor = (threadId: string) =>
+    t3McpServerName(threadId).pipe(Effect.provideService(Crypto.Crypto, crypto));
   /**
    * Lends the instance's server to a session until its scope closes. A spawned
 @@ -2977,7 +2984,7 @@ export const make = Effect.fn("OpenCode2Adapter.make")(function* (instanceId: Pr
         policy,
         paths,
         policy.runtimeMode === "full-access" ? [] : thread.grants,
-        appThreadId,
+        appThreadId === null ? null : yield* mcpServerNameFor(appThreadId),
       );
     });
 @@ -3234,7 +3241,7 @@ export const make = Effect.fn("OpenCode2Adapter.make")(function* (instanceId: Pr
     ) {
       const mcpSession = McpProviderSession.readMcpProviderSession(turnInput.threadId);
       const directory = turnInput.runtimePolicy.cwd ?? serverConfig.cwd;
-      const name = t3McpServerName(turnInput.threadId);
+      const name = yield* mcpServerNameFor(turnInput.threadId);
       // An external server may not reach T3's MCP endpoint, as with 1.x.
       const wanted =
         mcpSession === undefined || connection.external

apps/server/src/orchestration-v2/CheckpointCaptureService.test.ts+2

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
1	import { assert, it } from "@effect/vitest";	2	import { assert, it } from "@effect/vitest";
2	import {	3	import {
3	CheckpointId,	4	CheckpointId,
...	@@ -274,6 +275,7 @@ it.layer(layerProjectionStoreTest)("CheckpointCaptureServiceV2", (it) => {	...	@@ -274,6 +275,7 @@ it.layer(layerProjectionStoreTest)("CheckpointCaptureServiceV2", (it) => {
274	Layer.provide(	275	Layer.provide(
275	Layer.mergeAll(	276	Layer.mergeAll(
276	IdAllocator.layer,	277	IdAllocator.layer,
		278	NodeCrypto.layer,
277	Layer.mock(CheckpointStore.CheckpointStore)({	279	Layer.mock(CheckpointStore.CheckpointStore)({
278	isGitRepository: () => Effect.succeed(true),	280	isGitRepository: () => Effect.succeed(true),
279	captureCheckpoint: () => Effect.void,	281	captureCheckpoint: () => Effect.void,

apps/server/src/orchestration-v2/CheckpointScopeOwnership.test.ts+10-9

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
1	import { assert, it } from "@effect/vitest";	2	import { assert, it } from "@effect/vitest";
2	import * as DateTime from "effect/DateTime";	3	import * as DateTime from "effect/DateTime";
3	import * as Effect from "effect/Effect";	4	import * as Effect from "effect/Effect";
...	@@ -24,6 +25,7 @@ const layerProjection = Layer.mergeAll(	...	@@ -24,6 +25,7 @@ const layerProjection = Layer.mergeAll(
24	ProjectionStore.layer.pipe(Layer.provideMerge(SqlitePersistence.layerMemory)),	25	ProjectionStore.layer.pipe(Layer.provideMerge(SqlitePersistence.layerMemory)),
25	SqlitePersistence.layerMemory,	26	SqlitePersistence.layerMemory,
26	IdAllocator.layer,	27	IdAllocator.layer,
		28	NodeCrypto.layer,
27	);	29	);
28	it.effect("resolves the thread baseline after a second root run replaces scope ownership", () =>	30	it.effect("resolves the thread baseline after a second root run replaces scope ownership", () =>
29	Effect.gen(function* () {	31	Effect.gen(function* () {
...	@@ -38,6 +40,11 @@ it.effect("resolves the thread baseline after a second root run replaces scope o	...	@@ -38,6 +40,11 @@ it.effect("resolves the thread baseline after a second root run replaces scope o
38	const providerThreadId = ProviderThreadId.make("provider-thread:audit-root-scope");	40	const providerThreadId = ProviderThreadId.make("provider-thread:audit-root-scope");
39	const providerInstanceId = ProviderInstanceId.make("codex");	41	const providerInstanceId = ProviderInstanceId.make("codex");
40	const scopeId = yield* ids.allocate.checkpointScope({ threadId, name: "root" });	42	const scopeId = yield* ids.allocate.checkpointScope({ threadId, name: "root" });
		43	const checkpointRefs = [
		44	yield* checkpointRefForScopeOrdinal({ scopeId, ordinalWithinScope: 0 }),
		45	yield* checkpointRefForScopeOrdinal({ scopeId, ordinalWithinScope: 1 }),
		46	yield* checkpointRefForScopeOrdinal({ scopeId, ordinalWithinScope: 2 }),
		47	];
41	const baselineId = CheckpointId.make("checkpoint:audit-root-scope:0");	48	const baselineId = CheckpointId.make("checkpoint:audit-root-scope:0");
42	const firstCheckpointId = CheckpointId.make("checkpoint:audit-root-scope:1");	49	const firstCheckpointId = CheckpointId.make("checkpoint:audit-root-scope:1");
43	const secondCheckpointId = CheckpointId.make("checkpoint:audit-root-scope:2");	50	const secondCheckpointId = CheckpointId.make("checkpoint:audit-root-scope:2");
...	@@ -154,7 +161,7 @@ it.effect("resolves the thread baseline after a second root run replaces scope o	...	@@ -154,7 +161,7 @@ it.effect("resolves the thread baseline after a second root run replaces scope o
154	input.ordinal === 0 ? null : input.ordinal === 1 ? baselineId : firstCheckpointId,	161	input.ordinal === 0 ? null : input.ordinal === 1 ? baselineId : firstCheckpointId,
155	ordinalWithinScope: input.ordinal,	162	ordinalWithinScope: input.ordinal,
156	appRunOrdinal: input.appRunOrdinal,	163	appRunOrdinal: input.appRunOrdinal,
157	ref: checkpointRefForScopeOrdinal({ scopeId, ordinalWithinScope: input.ordinal }),	164	ref: checkpointRefs[input.ordinal]!,
158	status: "ready" as const,	165	status: "ready" as const,
159	files: [],	166	files: [],
160	capturedAt: now,	167	capturedAt: now,
...	@@ -214,14 +221,8 @@ it.effect("resolves the thread baseline after a second root run replaces scope o	...	@@ -214,14 +221,8 @@ it.effect("resolves the thread baseline after a second root run replaces scope o
214	Layer.mock(CheckpointStore.CheckpointStore)({	221	Layer.mock(CheckpointStore.CheckpointStore)({
215	diffCheckpoints: (input) => {	222	diffCheckpoints: (input) => {
216	assert.equal(input.cwd, "/prepared-repo");	223	assert.equal(input.cwd, "/prepared-repo");
217	assert.equal(	224	assert.equal(input.fromCheckpointRef, checkpointRefs[0]);
218	input.fromCheckpointRef,	225	assert.equal(input.toCheckpointRef, checkpointRefs[2]);
219	checkpointRefForScopeOrdinal({ scopeId, ordinalWithinScope: 0 }),
220	);
221	assert.equal(
222	input.toCheckpointRef,
223	checkpointRefForScopeOrdinal({ scopeId, ordinalWithinScope: 2 }),
224	);
225	return Effect.succeed("two-run diff");	226	return Effect.succeed("two-run diff");
226	},	227	},
227	}),	228	}),

apps/server/src/orchestration-v2/CheckpointService.test.ts+3-1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
1	import { assert, it, vi } from "@effect/vitest";	2	import { assert, it, vi } from "@effect/vitest";
2	import {	3	import {
3	CheckpointScopeId,	4	CheckpointScopeId,
...	@@ -58,6 +59,7 @@ it.effect.each([false, true, "interrupt"] as const)(	...	@@ -58,6 +59,7 @@ it.effect.each([false, true, "interrupt"] as const)(
58	}),	59	}),
59	),	60	),
60	),	61	),
		62	Layer.provideMerge(NodeCrypto.layer),
61	);	63	);
62		64
63	return Effect.gen(function* () {	65	return Effect.gen(function* () {
...	@@ -88,7 +90,7 @@ it.effect.each([false, true, "interrupt"] as const)(	...	@@ -88,7 +90,7 @@ it.effect.each([false, true, "interrupt"] as const)(
88	assert.equal(baseline.ordinalWithinScope, 2);	90	assert.equal(baseline.ordinalWithinScope, 2);
89	assert.equal(	91	assert.equal(
90	baseline.ref,	92	baseline.ref,
91	CheckpointService.checkpointRefForScopeOrdinal({	93	yield* CheckpointService.checkpointRefForScopeOrdinal({
92	scopeId: scope.id,	94	scopeId: scope.id,
93	ordinalWithinScope: 2,	95	ordinalWithinScope: 2,
94	}),	96	}),

apps/server/src/orchestration-v2/CheckpointService.ts+22-15

 @@ -9,11 +9,12 @@ import {
   RunId,
   ThreadId,
 } from "@t3tools/contracts";
-import * as NodeCrypto from "node:crypto";
 import * as Context from "effect/Context";
+import * as Crypto from "effect/Crypto";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import * as Base64Url from "effect/encoding/Base64Url";
+import * as Hex from "effect/encoding/Hex";
 import * as KeyedLock from "@t3tools/shared/KeyedLock";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
 @@ -157,15 +158,18 @@ export class CheckpointServiceV2 extends Context.Service<
   CheckpointServiceV2Shape
 >()("t3/orchestration-v2/CheckpointService/CheckpointServiceV2") {}
-export function checkpointRefForScopeOrdinal(input: {
+export const checkpointRefForScopeOrdinal = Effect.fn("checkpointRefForScopeOrdinal")(
-  readonly scopeId: CheckpointScopeId;
+  function* (input: { readonly scopeId: CheckpointScopeId; readonly ordinalWithinScope: number }) {
-  readonly ordinalWithinScope: number;
+    const crypto = yield* Crypto.Crypto;
-}): CheckpointRef {
+    const digest = yield* crypto
-  const scopeKey = NodeCrypto.createHash("sha256").update(input.scopeId).digest("hex").slice(0, 32);
+      .digest("SHA-256", new TextEncoder().encode(input.scopeId))
-  return CheckpointRef.make(
+      .pipe(Effect.orDie);
-    `${CHECKPOINT_REFS_PREFIX}/${Base64Url.encode(scopeKey)}/ordinal/${input.ordinalWithinScope}`,
+    const scopeKey = Hex.encode(digest).slice(0, 32);
-  );
+    return CheckpointRef.make(
-}
+      `${CHECKPOINT_REFS_PREFIX}/${Base64Url.encode(scopeKey)}/ordinal/${input.ordinalWithinScope}`,
+    );
+  },
+);
 function checkpointIdForScopeOrdinal(
   idAllocator: IdAllocator.IdAllocatorV2Shape,
 @@ -242,11 +246,14 @@ function makeCheckpoint(input: {
 export const layer: Layer.Layer<
   CheckpointServiceV2,
   never,
-  CheckpointStore.CheckpointStore | IdAllocator.IdAllocatorV2
+  CheckpointStore.CheckpointStore | Crypto.Crypto | IdAllocator.IdAllocatorV2
 > = Layer.effect(
   CheckpointServiceV2,
   Effect.gen(function* () {
     const checkpointStore = yield* CheckpointStore.CheckpointStore;
+    const crypto = yield* Crypto.Crypto;
+    const checkpointRefFor = (input: Parameters<typeof checkpointRefForScopeOrdinal>[0]) =>
+      checkpointRefForScopeOrdinal(input).pipe(Effect.provideService(Crypto.Crypto, crypto));
     const idAllocator = yield* IdAllocator.IdAllocatorV2;
     const workspaceLocks = yield* KeyedLock.make<string>();
     const withWorkspaceLock = <A, E, R>(cwd: string, effect: Effect.Effect<A, E, R>) =>
 @@ -265,7 +272,7 @@ export const layer: Layer.Layer<
             return;
           }
-          const checkpointRef = checkpointRefForScopeOrdinal({
+          const checkpointRef = yield* checkpointRefFor({
             scopeId: input.scope.id,
             ordinalWithinScope: input.ordinalWithinScope,
           });
 @@ -298,7 +305,7 @@ export const layer: Layer.Layer<
         withWorkspaceLock(
           input.scope.cwd,
           Effect.gen(function* () {
-            const checkpointRef = checkpointRefForScopeOrdinal({
+            const checkpointRef = yield* checkpointRefFor({
               scopeId: input.scope.id,
               ordinalWithinScope: input.ordinalWithinScope,
             });
 @@ -362,11 +369,11 @@ export const layer: Layer.Layer<
                   ordinalWithinScope: input.ordinalWithinScope - 1,
                 })
               : null;
-          const checkpointRef = checkpointRefForScopeOrdinal({
+          const checkpointRef = yield* checkpointRefFor({
             scopeId: input.scope.id,
             ordinalWithinScope: input.ordinalWithinScope,
           });
-          const previousCheckpointRef = checkpointRefForScopeOrdinal({
+          const previousCheckpointRef = yield* checkpointRefFor({
             scopeId: input.scope.id,
             ordinalWithinScope: Math.max(0, input.ordinalWithinScope - 1),
           });

apps/server/src/orchestration-v2/ClaudeAutomaticDelivery.integration.test.ts+2

...	@@ -15,6 +15,7 @@ import {	...	@@ -15,6 +15,7 @@ import {
15	type OrchestrationV2DomainEvent,	15	type OrchestrationV2DomainEvent,
16	} from "@t3tools/contracts";	16	} from "@t3tools/contracts";
17	import * as DateTime from "effect/DateTime";	17	import * as DateTime from "effect/DateTime";
		18	import * as Crypto from "effect/Crypto";
18	import * as Effect from "effect/Effect";	19	import * as Effect from "effect/Effect";
19	import * as FileSystem from "effect/FileSystem";	20	import * as FileSystem from "effect/FileSystem";
20	import * as Fiber from "effect/Fiber";	21	import * as Fiber from "effect/Fiber";
...	@@ -137,6 +138,7 @@ it.effect.each(["child completion", "scheduled message", "user steering"] as con	...	@@ -137,6 +138,7 @@ it.effect.each(["child completion", "scheduled message", "user steering"] as con
137	attachmentsDir: cwd,	138	attachmentsDir: cwd,
138	fileSystem: yield* FileSystem.FileSystem,	139	fileSystem: yield* FileSystem.FileSystem,
139	path: yield* Path.Path,	140	path: yield* Path.Path,
		141	crypto: yield* Crypto.Crypto,
140	idAllocator: yield* IdAllocator.IdAllocatorV2,	142	idAllocator: yield* IdAllocator.IdAllocatorV2,
141	queryRunner: {	143	queryRunner: {
142	allocateSessionId: Effect.succeed(sessionId),	144	allocateSessionId: Effect.succeed(sessionId),

apps/server/src/orchestration-v2/ProviderTurnControlService.ts+17-10

 @@ -7,12 +7,12 @@ import {
   RunAttemptId,
   ThreadId,
 } from "@t3tools/contracts";
+import * as Clock from "effect/Clock";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
-import * as NodeTimersPromises from "node:timers/promises";
 import * as ProjectionStore from "./ProjectionStore.ts";
 import * as ProviderSessionManager from "./ProviderSessionManager.ts";
 @@ -188,17 +188,24 @@ export const layer: Layer.Layer<
           });
           // Give native terminal ingestion time to finish before the Stop
           // follow-up repairs a run whose provider no longer reports on it.
-          const deadline = performance.now() + 2_000;
+          // The wait is real time: ingestion runs on other fibers and never
-          while (loaded.providerTurn.status === "running" && performance.now() < deadline) {
+          // advances a test clock, so a test clock would hold Stop forever.
-            const current = yield* projections.getProviderControlContext(input.threadId, input);
+          yield* Effect.gen(function* () {
-            if (
+            const deadline = (yield* Clock.currentTimeMillis) + 2_000;
-              current.providerTurn?.status !== "running" &&
+            while (
-              current.attempt?.status !== "running"
+              loaded.providerTurn.status === "running" &&
+              (yield* Clock.currentTimeMillis) < deadline
             ) {
-              break;
+              const current = yield* projections.getProviderControlContext(input.threadId, input);
+              if (
+                current.providerTurn?.status !== "running" &&
+                current.attempt?.status !== "running"
+              ) {
+                return;
+              }
+              yield* Effect.sleep("10 millis");
             }
-            yield* Effect.promise(() => NodeTimersPromises.setTimeout(10));
+          }).pipe(Effect.provideService(Clock.Clock, Clock.Clock.defaultValue()));
-          }
         }).pipe(
           Effect.mapError((cause) =>
             isProviderTurnControlError(cause)

apps/server/src/preview/PreviewBrowser.test.ts+6-2

apps/server/src/provider/AntigravityInstallation.test.ts+20-13

 @@ -6,8 +6,10 @@ import {
   HostProcessIsExecutable,
   HostProcessPlatform,
 } from "@t3tools/shared/hostProcess";
+import * as Crypto from "effect/Crypto";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
+import * as Hex from "effect/encoding/Hex";
 import * as Exit from "effect/Exit";
 import * as Fiber from "effect/Fiber";
 import * as FileSystem from "effect/FileSystem";
 @@ -21,7 +23,6 @@ import * as Sink from "effect/Sink";
 import * as Stream from "effect/Stream";
 import { HttpClient, HttpClientResponse } from "effect/http";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
-import * as NodeCrypto from "node:crypto";
 import * as AntigravityInstallation from "./AntigravityInstallation.ts";
 import { ANTIGRAVITY_AUTH_BROWSER_MARKER } from "./antigravityAuthSupport.ts";
 @@ -70,14 +71,15 @@ const executableName = hostPlatform === "win32" ? "agy_acp_server.exe" : "agy_ac
 const harnessName =
   hostPlatform === "win32" ? "localharness_external.exe" : "localharness_external";
-function releaseAsset(
+const releaseAsset = Effect.fn("test.antigravityReleaseAsset")(function* (
   archive: Uint8Array = completeArchive,
   platform: NodeJS.Platform = hostPlatform,
 ) {
+  const crypto = yield* Crypto.Crypto;
   return {
     version: "fixture-new",
     url: "https://dl.google.com/antigravity-test.zip",
-    sha256: NodeCrypto.createHash("sha256").update(archive).digest("hex"),
+    sha256: Hex.encode(yield* crypto.digest("SHA-256", archive).pipe(Effect.orDie)),
     archiveBytes: archive.byteLength,
     executable: {
       name: platform === "win32" ? "agy_acp_server.exe" : "agy_acp_server.par",
 @@ -88,7 +90,7 @@ function releaseAsset(
       bytes: Buffer.byteLength(harnessContents),
     },
   } satisfies AntigravityReleaseAsset;
-}
+});
 const writeRelease = Effect.fn("test.writeAntigravityRelease")(function* (
   managedDirectory: string,
 @@ -146,11 +148,12 @@ const makeHarness = Effect.fn("test.makeAntigravityInstallation")(function* (
     options.baseDir ?? (yield* fs.makeTempDirectoryScoped({ prefix: "t3-agy-test-" }));
   const platform = options.platform ?? hostPlatform;
   const archive = options.archive ?? completeArchive;
-  const asset = options.asset === undefined ? releaseAsset(archive, platform) : options.asset;
+  const asset =
+    options.asset === undefined ? yield* releaseAsset(archive, platform) : options.asset;
   const managedDirectory = path.join(baseDir, "tools", "antigravity-acp", `${platform}-x64`);
   if (options.previous) {
     yield* writeRelease(managedDirectory, {
-      ...releaseAsset(archive, platform),
+      ...(yield* releaseAsset(archive, platform)),
       sha256: previousReleaseId,
       version: previousVersion,
     });
 @@ -301,9 +304,9 @@ it.layer(NodeServices.layer)("Antigravity installation", (it) => {
       expect(yield* fs.readFileString(selected.executablePath)).toBe(serverContents);
       expect(yield* fs.readFileString(selected.harnessPath)).toBe(harnessContents);
       expect(yield* fs.readDirectory(path.join(installation.managedDirectory, "versions"))).toEqual(
-        expect.arrayContaining([previousReleaseId, releaseAsset().sha256]),
+        expect.arrayContaining([previousReleaseId, (yield* releaseAsset()).sha256]),
       );
-      expect(requests).toEqual([releaseAsset().url]);
+      expect(requests).toEqual([(yield* releaseAsset()).url]);
     }),
   );
 @@ -469,12 +472,12 @@ it.layer(NodeServices.layer)("Antigravity installation", (it) => {
   );
   it.effect.each([
-    { name: "checksum mismatch", asset: { ...releaseAsset(), sha256: "2".repeat(64) } },
+    { name: "checksum mismatch", completeAsset: { sha256: "2".repeat(64) } },
-    { name: "short download", archive: completeArchive.subarray(0, -1), asset: releaseAsset() },
+    { name: "short download", archive: completeArchive.subarray(0, -1), completeAsset: {} },
     {
       name: "oversized download",
       archive: Buffer.concat([completeArchive, Buffer.from("extra")]),
-      asset: releaseAsset(),
+      completeAsset: {},
     },
     { name: "wrong Content-Length", contentLength: completeArchive.byteLength + 1 },
     { name: "missing harness", archive: Buffer.from(zipFixtures.missingHarness, "base64") },
 @@ -482,10 +485,14 @@ it.layer(NodeServices.layer)("Antigravity installation", (it) => {
     { name: "path traversal", archive: Buffer.from(zipFixtures.traversal, "base64") },
     { name: "symbolic link", archive: Buffer.from(zipFixtures.symlink, "base64") },
     { name: "oversized member", archive: Buffer.from(zipFixtures.oversizedMember, "base64") },
-  ])("rejects $name before runtime validation", (options) =>
+  ])("rejects $name before runtime validation", ({ completeAsset, ...options }) =>
     Effect.gen(function* () {
+      // Pin the asset to the complete archive so the download itself is what disagrees.
+      const asset =
+        completeAsset === undefined ? undefined : { ...(yield* releaseAsset()), ...completeAsset };
       const { installation, validations, stagingReleased, fs, path } = yield* makeHarness({
         ...options,
+        ...(asset === undefined ? {} : { asset }),
         previous: true,
       });
       yield* installation.start;
 @@ -893,7 +900,7 @@ it.layer(NodeServices.layer)("Antigravity installation", (it) => {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
         const archive = Buffer.from(zipFixtures.windows, "base64");
-        const asset = releaseAsset(archive, "win32");
+        const asset = yield* releaseAsset(archive, "win32");
         let denyPointerRename = true;
         const renameTargets: string[] = [];
         const { installation, requests, validations } = yield* makeHarness({

apps/server/src/provider/CodexInstallation.test.ts+5-3

 @@ -6,15 +6,16 @@ import {
   HostProcessEnvironment,
   HostProcessPlatform,
 } from "@t3tools/shared/hostProcess";
+import * as Crypto from "effect/Crypto";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
+import * as Hex from "effect/encoding/Hex";
 import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
 import * as Exit from "effect/Exit";
 import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
 import { HttpClient, HttpClientResponse } from "effect/http";
-import * as NodeCrypto from "node:crypto";
 import * as CodexInstallation from "./CodexInstallation.ts";
 const archive = Buffer.from(
 @@ -25,7 +26,6 @@ const asset = {
   version: "0.156.1",
   target: "aarch64-apple-darwin",
   url: "https://github.com/openai/codex/releases/download/test/package.tar.gz",
-  sha256: NodeCrypto.createHash("sha256").update(archive).digest("hex"),
   archiveBytes: archive.length,
 };
 const makeHarness = Effect.fn("test.makeCodexInstallation")(function* (
 @@ -52,9 +52,11 @@ const makeHarness = Effect.fn("test.makeCodexInstallation")(function* (
     );
   }
   let downloads = 0;
+  const crypto = yield* Crypto.Crypto;
+  const sha256 = Hex.encode(yield* crypto.digest("SHA-256", archive).pipe(Effect.orDie));
   const installation = yield* CodexInstallation.makeCodexInstallation({
     baseDir,
-    releaseAsset: asset,
+    releaseAsset: { ...asset, sha256 },
     validate: () => Effect.void,
     ...input.options,
   }).pipe(

apps/server/src/provider/CodexToolPresentation.ts+114-105

...	@@ -1,9 +1,11 @@	...	@@ -1,9 +1,11 @@
1	import * as NodeCrypto from "node:crypto";
2	import type {	1	import type {
3	ToolActivityIcon,	2	ToolActivityIcon,
4	ToolActivityNativeAppReference,	3	ToolActivityNativeAppReference,
5	ToolActivitySource,	4	ToolActivitySource,
6	} from "@t3tools/contracts";	5	} from "@t3tools/contracts";
		6	import * as Crypto from "effect/Crypto";
		7	import * as Effect from "effect/Effect";
		8	import * as Hex from "effect/encoding/Hex";
7	import type * as EffectCodexSchema from "effect-codex-app-server/schema";	9	import type * as EffectCodexSchema from "effect-codex-app-server/schema";
8		10
9	import {	11	import {
...	@@ -42,12 +44,17 @@ function normalizedSourceKeyPart(value: string): string {	...	@@ -42,12 +44,17 @@ function normalizedSourceKeyPart(value: string): string {
42	return value.trim().toLowerCase();	44	return value.trim().toLowerCase();
43	}	45	}
44		46
45	function nativeAppSourceKey(appId: string): string {	47	const nativeAppSourceKey = Effect.fn("CodexToolPresentation.nativeAppSourceKey")(function* (
		48	appId: string,
		49	) {
46	const key = `native-app:${appId.toLowerCase()}`;	50	const key = `native-app:${appId.toLowerCase()}`;
47	if (key.length <= 512) return key;	51	if (key.length <= 512) return key;
48	const digest = NodeCrypto.createHash("sha256").update(key).digest("hex");	52	const crypto = yield* Crypto.Crypto;
		53	const digest = Hex.encode(
		54	yield* crypto.digest("SHA-256", new TextEncoder().encode(key)).pipe(Effect.orDie),
		55	);
49	return `${key.slice(0, 512 - digest.length - 1)}:${digest}`;	56	return `${key.slice(0, 512 - digest.length - 1)}:${digest}`;
50	}	57	});
51		58
52	function browserDisplayName(value: unknown): string \| undefined {	59	function browserDisplayName(value: unknown): string \| undefined {
53	const normalized = normalizedDisplayName(value)?.toLowerCase();	60	const normalized = normalizedDisplayName(value)?.toLowerCase();
...	@@ -123,105 +130,107 @@ export interface McpToolPresentation {	...	@@ -123,105 +130,107 @@ export interface McpToolPresentation {
123	readonly toolSource?: ToolActivitySource;	130	readonly toolSource?: ToolActivitySource;
124	}	131	}
125		132
126	export function mcpToolPresentation(	133	export const mcpToolPresentation = Effect.fn("CodexToolPresentation.mcpToolPresentation")(
127	item: Extract<CodexLifecycleItem, { readonly type: "mcpToolCall" }>,	134	function* (
128	): McpToolPresentation {	135	item: Extract<CodexLifecycleItem, { readonly type: "mcpToolCall" }>,
129	const result = asUnknownRecord(item.result);	136	): Effect.fn.Return<McpToolPresentation, never, Crypto.Crypto> {
130	const metadata = asUnknownRecord(result?._meta);	137	const result = asUnknownRecord(item.result);
131	const surface = asUnknownRecord(metadata?.["codex/toolSurface"]);	138	const metadata = asUnknownRecord(result?._meta);
132	const sourceMetadata = asUnknownRecord(metadata?.source);	139	const surface = asUnknownRecord(metadata?.["codex/toolSurface"]);
133	const appContext = asUnknownRecord(item.appContext);	140	const sourceMetadata = asUnknownRecord(metadata?.source);
134	const sourceLogo = themedLogoIcon(surface, sourceMetadata, appContext);	141	const appContext = asUnknownRecord(item.appContext);
135	if (surface?.kind === "browserUse") {	142	const sourceLogo = themedLogoIcon(surface, sourceMetadata, appContext);
136	const screenshot = asUnknownRecord(surface.screenshot);	143	if (surface?.kind === "browserUse") {
137	const browserUse = asUnknownRecord(metadata?.browser_use);	144	const screenshot = asUnknownRecord(surface.screenshot);
138	const openTabs = Array.isArray(surface.openTabs) ? surface.openTabs : [];	145	const browserUse = asUnknownRecord(metadata?.browser_use);
139	const latestOpenTab = openTabs	146	const openTabs = Array.isArray(surface.openTabs) ? surface.openTabs : [];
140	.toReversed()	147	const latestOpenTab = openTabs
141	.map(asUnknownRecord)	148	.toReversed()
142	.find((tab) => normalizedHttpUrl(tab?.url) !== undefined);	149	.map(asUnknownRecord)
143	const selectedPage = [	150	.find((tab) => normalizedHttpUrl(tab?.url) !== undefined);
144	{ record: screenshot, url: screenshot?.pageUrl },	151	const selectedPage = [
145	{ record: browserUse, url: browserUse?.url },	152	{ record: screenshot, url: screenshot?.pageUrl },
146	{ record: latestOpenTab, url: latestOpenTab?.url },	153	{ record: browserUse, url: browserUse?.url },
147	]	154	{ record: latestOpenTab, url: latestOpenTab?.url },
148	.map((candidate) => ({ ...candidate, pageUrl: normalizedHttpUrl(candidate.url) }))	155	]
149	.find((candidate) => candidate.pageUrl !== undefined);	156	.map((candidate) => ({ ...candidate, pageUrl: normalizedHttpUrl(candidate.url) }))
150	const pageUrl = selectedPage?.pageUrl;	157	.find((candidate) => candidate.pageUrl !== undefined);
151	const faviconUrl = normalizedImageUrl(	158	const pageUrl = selectedPage?.pageUrl;
152	selectedPage?.record?.faviconUrl ?? selectedPage?.record?.favIconUrl,	159	const faviconUrl = normalizedImageUrl(
153	);	160	selectedPage?.record?.faviconUrl ?? selectedPage?.record?.favIconUrl,
154	const faviconUrlDark = normalizedImageUrl(	161	);
155	selectedPage?.record?.faviconUrlDark ?? selectedPage?.record?.favIconUrlDark,	162	const faviconUrlDark = normalizedImageUrl(
156	);	163	selectedPage?.record?.faviconUrlDark ?? selectedPage?.record?.favIconUrlDark,
157	const name =	164	);
158	browserDisplayName(appContext?.appName) ??	165	const name =
159	browserDisplayName(surface.browserFamily) ??	166	browserDisplayName(appContext?.appName) ??
160	browserDisplayName(surface.backend) ??	167	browserDisplayName(surface.browserFamily) ??
161	"Browser";	168	browserDisplayName(surface.backend) ??
162	const nativeBrowserIcon = browserNativeAppReference(name);	169	"Browser";
163	const sourceIcon =	170	const nativeBrowserIcon = browserNativeAppReference(name);
164	sourceLogo ??	171	const sourceIcon =
165	(nativeBrowserIcon ? ({ _tag: "native-app", app: nativeBrowserIcon } as const) : undefined);	172	sourceLogo ??
166	const sourceKeyPart = normalizedSourceKeyPart(name) \|\| "browser";	173	(nativeBrowserIcon ? ({ _tag: "native-app", app: nativeBrowserIcon } as const) : undefined);
167	return {	174	const sourceKeyPart = normalizedSourceKeyPart(name) \|\| "browser";
168	toolSurface: "browser",	175	return {
169	...(pageUrl	176	toolSurface: "browser",
170	? {	177	...(pageUrl
171	toolIcon: {	178	? {
172	_tag: "website",	179	toolIcon: {
173	pageUrl,	180	_tag: "website",
174	...(faviconUrl ? { faviconUrl } : {}),	181	pageUrl,
175	...(faviconUrlDark ? { faviconUrlDark } : {}),	182	...(faviconUrl ? { faviconUrl } : {}),
176	} as const,	183	...(faviconUrlDark ? { faviconUrlDark } : {}),
177	}	184	} as const,
178	: {}),	185	}
179	toolSource: {	186	: {}),
180	key: `browser-use:${sourceKeyPart}`,	187	toolSource: {
181	name,	188	key: `browser-use:${sourceKeyPart}`,
182	kind: name === "Browser" ? "browser" : "integration",	189	name,
183	...(sourceIcon ? { icon: sourceIcon } : {}),	190	kind: name === "Browser" ? "browser" : "integration",
184	},	191	...(sourceIcon ? { icon: sourceIcon } : {}),
185	};	192	},
186	}	193	};
187	if (surface?.kind === "computerUse") {	194	}
188	const app = nativeAppReference(surface.app);	195	if (surface?.kind === "computerUse") {
189	const args = asUnknownRecord(item.arguments);	196	const app = nativeAppReference(surface.app);
190	const argumentAppName =	197	const args = asUnknownRecord(item.arguments);
191	normalizedDisplayName(args?.appName) ??	198	const argumentAppName =
192	normalizedDisplayName(args?.application) ??	199	normalizedDisplayName(args?.appName) ??
193	normalizedDisplayName(typeof args?.app === "string" ? args.app : undefined);	200	normalizedDisplayName(args?.application) ??
194	const name =	201	normalizedDisplayName(typeof args?.app === "string" ? args.app : undefined);
195	normalizedDisplayName(appContext?.appName) ??	202	const name =
196	argumentAppName ??	203	normalizedDisplayName(appContext?.appName) ??
197	(app?._tag === "display-name" ? app.displayName : undefined) ??	204	argumentAppName ??
198	(app?._tag === "app-id" ? appDisplayNameFromId(app.appId) : undefined) ??	205	(app?._tag === "display-name" ? app.displayName : undefined) ??
199	"Computer Use";	206	(app?._tag === "app-id" ? appDisplayNameFromId(app.appId) : undefined) ??
200	const sourceIcon = sourceLogo ?? (app ? ({ _tag: "native-app", app } as const) : undefined);	207	"Computer Use";
201	const sourceKey = app	208	const sourceIcon = sourceLogo ?? (app ? ({ _tag: "native-app", app } as const) : undefined);
202	? app._tag === "app-id"	209	const sourceKey = app
203	? nativeAppSourceKey(app.appId)	210	? app._tag === "app-id"
204	: `native-app-name:${normalizedSourceKeyPart(app.displayName)}`	211	? yield* nativeAppSourceKey(app.appId)
205	: "computer-use";	212	: `native-app-name:${normalizedSourceKeyPart(app.displayName)}`
206	return {	213	: "computer-use";
207	toolSurface: "computer",	214	return {
208	...(app ? { toolIcon: { _tag: "native-app", app } as const } : {}),	215	toolSurface: "computer",
209	toolSource: {	216	...(app ? { toolIcon: { _tag: "native-app", app } as const } : {}),
210	key: sourceKey,	217	toolSource: {
211	name,	218	key: sourceKey,
212	kind: "computer",	219	name,
213	...(sourceIcon ? { icon: sourceIcon } : {}),	220	kind: "computer",
214	},	221	...(sourceIcon ? { icon: sourceIcon } : {}),
215	};	222	},
216	}	223	};
		224	}
217		225
218	return integrationToolPresentation({	226	return integrationToolPresentation({
219	serverName: appContext?.connectorId ?? item.server,	227	serverName: appContext?.connectorId ?? item.server,
220	toolName: item.tool,	228	toolName: item.tool,
221	title: appContext?.actionName,	229	title: appContext?.actionName,
222	serverDisplayName: appContext?.appName,	230	serverDisplayName: appContext?.appName,
223	source: sourceMetadata,	231	source: sourceMetadata,
224	iconUrl: sourceLogo?._tag === "themed-logo" ? sourceLogo.logoUrl : undefined,	232	iconUrl: sourceLogo?._tag === "themed-logo" ? sourceLogo.logoUrl : undefined,
225	iconUrlDark: sourceLogo?._tag === "themed-logo" ? sourceLogo.logoUrlDark : undefined,	233	iconUrlDark: sourceLogo?._tag === "themed-logo" ? sourceLogo.logoUrlDark : undefined,
226	});	234	});
227	}	235	},
		236	);

apps/server/src/provider/OpenCodeProvider.test.ts+2-2

...	@@ -1,5 +1,4 @@	...	@@ -1,5 +1,4 @@
1	import * as NodeAssert from "node:assert/strict";	1	import * as NodeAssert from "node:assert/strict";
2	import * as NodeCrypto from "node:crypto";
3		2
4	import * as NodeServices from "@effect/platform-node/NodeServices";	3	import * as NodeServices from "@effect/platform-node/NodeServices";
5	import { it } from "@effect/vitest";	4	import { it } from "@effect/vitest";
...	@@ -81,7 +80,8 @@ it.effect("reads Go limits with the instance's XDG credentials and preserves res	...	@@ -81,7 +80,8 @@ it.effect("reads Go limits with the instance's XDG credentials and preserves res
81	NodeAssert.equal(limits.unavailable, undefined);	80	NodeAssert.equal(limits.unavailable, undefined);
82	NodeAssert.equal(	81	NodeAssert.equal(
83	limits.credentialFingerprint,	82	limits.credentialFingerprint,
84	NodeCrypto.createHash("sha256").update("opencode-go\0instance-key").digest("hex"),	83	// SHA-256 of "opencode-go\0instance-key".
		84	"aba48e85c981a8edc1c9fb4575121accc7235fa55d0f8689f66f153de5566a37",
85	);	85	);
86	NodeAssert.deepEqual(	86	NodeAssert.deepEqual(
87	limits.windows.map(({ kind, usedPercent, resetsAt: reset }) => ({	87	limits.windows.map(({ kind, usedPercent, resetsAt: reset }) => ({

apps/server/src/provider/acp/AcpRegistryAuthenticationState.ts+11-5

 @@ -1,10 +1,11 @@
-import * as NodeCrypto from "node:crypto";
 import type {
   AcpRegistrySettings,
   ProviderInstanceEnvironment,
   ProviderInstanceId,
 } from "@t3tools/contracts";
+import * as Crypto from "effect/Crypto";
 import * as Effect from "effect/Effect";
+import * as Hex from "effect/encoding/Hex";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as Ref from "effect/Ref";
 @@ -16,8 +17,13 @@ import { writeFileStringAtomically } from "../../atomicWrite.ts";
 const decodeState = Schema.decodeUnknownEffect(
   Schema.fromJsonString(Schema.Struct({ binding: Schema.String, authenticated: Schema.Boolean })),
 );
-const hash = (value: unknown) =>
+const encodeJson = Schema.encodeEffect(Schema.fromJsonString(Schema.Unknown));
-  NodeCrypto.createHash("sha256").update(JSON.stringify(value)).digest("hex");
+const hash = Effect.fn("AcpRegistryAuthenticationState.hash")(function* (value: unknown) {
+  const crypto = yield* Crypto.Crypto;
+  const json = yield* encodeJson(value).pipe(Effect.orDie);
+  const digest = yield* crypto.digest("SHA-256", new TextEncoder().encode(json)).pipe(Effect.orDie);
+  return Hex.encode(digest);
+});
 /** Remember explicit sign-in success, never discovery success or the agent's credentials. */
 export const makeAcpRegistryAuthenticationState = Effect.fn("makeAcpRegistryAuthenticationState")(
 @@ -30,10 +36,10 @@ export const makeAcpRegistryAuthenticationState = Effect.fn("makeAcpRegistryAuth
   }) {
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
-    const filePath = path.join(input.cacheDir, `acp-auth-${hash(input.instanceId)}.json`);
+    const filePath = path.join(input.cacheDir, `acp-auth-${yield* hash(input.instanceId)}.json`);
     // Cosmetic settings and model discovery can rebuild the driver without
     // changing the account. Credential overrides and profile paths cannot.
-    const binding = hash({
+    const binding = yield* hash({
       ...(input.settings.source === "local"
         ? { source: "local", commandArgs: input.settings.commandArgs }
         : {}),

apps/server/src/provider/acp/AcpRegistrySupport.test.ts+4-3

...	@@ -16,7 +16,6 @@ import * as Layer from "effect/Layer";	...	@@ -16,7 +16,6 @@ import * as Layer from "effect/Layer";
16	import * as Schema from "effect/Schema";	16	import * as Schema from "effect/Schema";
17	import { HttpClient, HttpClientResponse } from "effect/http";	17	import { HttpClient, HttpClientResponse } from "effect/http";
18	import * as TestClock from "effect/testing/TestClock";	18	import * as TestClock from "effect/testing/TestClock";
19	import * as NodeCrypto from "node:crypto";
20	import { ChildProcess, ChildProcessSpawner } from "effect/process";	19	import { ChildProcess, ChildProcessSpawner } from "effect/process";
21		20
22	import * as AcpRegistrySupport from "./AcpRegistrySupport.ts";	21	import * as AcpRegistrySupport from "./AcpRegistrySupport.ts";
...	@@ -587,7 +586,8 @@ describe("AcpRegistrySupport", () => {	...	@@ -587,7 +586,8 @@ describe("AcpRegistrySupport", () => {
587	archive: archiveUrl,	586	archive: archiveUrl,
588	cmd: "./bin/example-agent",	587	cmd: "./bin/example-agent",
589	args: ["acp"],	588	args: ["acp"],
590	sha256: NodeCrypto.createHash("sha256").update(binaryBytes).digest("hex"),	589	// SHA-256 of binaryBytes.
		590	sha256: "97b29a636d7ddf7bf3567ae4d48c0f2a9b03943fd808b6efbf74f1dd3db131b7",
591	},	591	},
592	},	592	},
593	});	593	});
...	@@ -646,7 +646,8 @@ describe("AcpRegistrySupport", () => {	...	@@ -646,7 +646,8 @@ describe("AcpRegistrySupport", () => {
646	archive: archiveUrl,	646	archive: archiveUrl,
647	cmd: "./bin/example-agent",	647	cmd: "./bin/example-agent",
648	args: ["acp"],	648	args: ["acp"],
649	sha256: NodeCrypto.createHash("sha256").update(binaryBytes).digest("hex"),	649	// SHA-256 of binaryBytes.
		650	sha256: "e1eb7c905b91c400af2ec858628aec22866bfda1383b93ceb73ae01d9769fb31",
650	},	651	},
651	},	652	},
652	});	653	});

apps/server/src/provider/acp/AcpRegistrySupport.ts+33-27

 @@ -25,7 +25,9 @@ import {
 import * as Clock from "effect/Clock";
 import * as Context from "effect/Context";
 import * as Duration from "effect/Duration";
+import * as Crypto from "effect/Crypto";
 import * as Effect from "effect/Effect";
+import * as Hex from "effect/encoding/Hex";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 @@ -35,9 +37,9 @@ import * as Ref from "effect/Ref";
 import * as Schema from "effect/Schema";
 import * as Semaphore from "effect/Semaphore";
 import * as Stream from "effect/Stream";
+import { sha256 } from "@noble/hashes/sha2";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
-import * as NodeCrypto from "node:crypto";
 import { collectUint8StreamText } from "../../stream/collectUint8StreamText.ts";
 import * as ServerSettings from "../../serverSettings.ts";
 @@ -597,11 +599,15 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
   AcpRegistryCatalog["Service"],
   never,
   | ChildProcessSpawner.ChildProcessSpawner
+  | Crypto.Crypto
   | FileSystem.FileSystem
   | HttpClient.HttpClient
   | Path.Path
   | ServerSettings.ServerSettingsService
 > {
+  const crypto = yield* Crypto.Crypto;
+  const sha256Hex = (data: Uint8Array) =>
+    crypto.digest("SHA-256", data).pipe(Effect.map(Hex.encode), Effect.orDie);
   const fileSystem = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const httpClient = yield* HttpClient.HttpClient;
 @@ -731,17 +737,20 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
     .readFileString(registryCachePath)
     .pipe(Effect.flatMap(decodeRegistryText), Effect.option);
-  const writeRegistryCache = (text: string) => {
+  const writeRegistryCache = (text: string) =>
-    const temporaryPath = `${registryCachePath}.${process.pid}-${NodeCrypto.randomUUID()}.tmp`;
+    crypto.randomUUIDv4.pipe(
-    return fileSystem
+      Effect.flatMap((id) => {
-      .makeDirectory(registryDirectory, { recursive: true })
+        const temporaryPath = `${registryCachePath}.${process.pid}-${id}.tmp`;
-      .pipe(
+        return fileSystem
-        Effect.andThen(fileSystem.writeFileString(temporaryPath, text)),
+          .makeDirectory(registryDirectory, { recursive: true })
-        Effect.andThen(fileSystem.rename(temporaryPath, registryCachePath)),
+          .pipe(
-        Effect.ensuring(fileSystem.remove(temporaryPath, { force: true }).pipe(Effect.ignore)),
+            Effect.andThen(fileSystem.writeFileString(temporaryPath, text)),
-        Effect.ignore,
+            Effect.andThen(fileSystem.rename(temporaryPath, registryCachePath)),
-      );
+            Effect.ensuring(fileSystem.remove(temporaryPath, { force: true }).pipe(Effect.ignore)),
-  };
+          );
+      }),
+      Effect.ignore,
+    );
   const fetchRegistry = Effect.fn("AcpRegistryCatalog.fetchRegistry")(function* () {
     yield* assertHttpsUrl(registryUrl, "ACP Registry index URL must use HTTPS.");
 @@ -928,17 +937,12 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
         );
   });
-  const packageReceiptPath = (
+  const packageReceiptPath = (agentId: string, distribution: "npx" | "uvx", managerPath: string) =>
-    agentId: string,
+    sha256Hex(new TextEncoder().encode(`${distribution}\0${managerPath}`)).pipe(
-    distribution: "npx" | "uvx",
+      Effect.map((digest) =>
-    managerPath: string,
+        path.join(packageReceiptsDirectory, `${agentId}-${digest.slice(0, 16)}.json`),
-  ) => {
+      ),
-    const managerId = NodeCrypto.createHash("sha256")
+    );
-      .update(`${distribution}\0${managerPath}`)
-      .digest("hex")
-      .slice(0, 16);
-    return path.join(packageReceiptsDirectory, `${agentId}-${managerId}.json`);
-  };
   const readPackageReceipt = Effect.fn("AcpRegistryCatalog.readPackageReceipt")(function* (
     agent: AcpRegistryAgent,
 @@ -947,7 +951,7 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
     managerPath: string,
   ) {
     const receipt = yield* fileSystem
-      .readFileString(packageReceiptPath(agent.id, distribution, managerPath))
+      .readFileString(yield* packageReceiptPath(agent.id, distribution, managerPath))
       .pipe(
         Effect.map(decodePackageInstallReceipt),
         Effect.orElseSucceed(() => Option.none()),
 @@ -991,7 +995,7 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
   const writePackageReceipt = Effect.fn("AcpRegistryCatalog.writePackageReceipt")(
     function* (receipt: AcpRegistryPackageInstallReceipt) {
-      const receiptPath = packageReceiptPath(
+      const receiptPath = yield* packageReceiptPath(
         receipt.agentId,
         receipt.distribution,
         receipt.managerPath,
 @@ -1409,7 +1413,9 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
             ),
         }),
       );
-      const hash = NodeCrypto.createHash("sha256");
+      // Hash while streaming: archives can be up to MAX_ARCHIVE_BYTES, and
+      // Effect's Crypto only digests a whole buffer.
+      const hash = sha256.create();
       let downloadedBytes = 0;
       yield* response.stream.pipe(
         Stream.tap((chunk) => {
 @@ -1447,7 +1453,7 @@ export const makeAcpRegistryCatalog = Effect.fn("AcpRegistryCatalog.make")(funct
         }),
       );
       if (target.sha256 !== undefined) {
-        const actual = hash.digest("hex");
+        const actual = Hex.encode(hash.digest());
         if (actual !== target.sha256.toLowerCase()) {
           return yield* new AcpRegistryError({
             reason: "checksum_mismatch",

apps/server/src/provider/opencode2/OpenCode2Client.live.test.ts+3-2

apps/server/src/scheduledTasks/ScheduledTaskService.webhook.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no createHmac.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	import * as NodePlatformCrypto from "@effect/platform-node/NodeCrypto";	4	import * as NodePlatformCrypto from "@effect/platform-node/NodeCrypto";

apps/server/src/scheduledTasks/webhookRoute.test.ts+1

...	@@ -1,4 +1,5 @@	...	@@ -1,4 +1,5 @@
1	import { describe, expect, it } from "@effect/vitest";	1	import { describe, expect, it } from "@effect/vitest";
		2	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync.
2	import * as NodeCrypto from "node:crypto";	3	import * as NodeCrypto from "node:crypto";
3	import * as Clock from "effect/Clock";	4	import * as Clock from "effect/Clock";
4	import * as Effect from "effect/Effect";	5	import * as Effect from "effect/Effect";

apps/server/src/scheduledTasks/webhookVerification.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no createHmac.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	import { assert, describe, it } from "@effect/vitest";	4	import { assert, describe, it } from "@effect/vitest";

apps/server/src/scheduledTasks/webhookVerification.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no createHmac or timingSafeEqual.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	import type { ScheduledTaskWebhookSignature } from "@t3tools/contracts";	4	import type { ScheduledTaskWebhookSignature } from "@t3tools/contracts";

apps/server/src/secrets/SecretRequests.ts+1

...	@@ -16,6 +16,7 @@ import {	...	@@ -16,6 +16,7 @@ import {
16	type SecretRequestAnswerInput,	16	type SecretRequestAnswerInput,
17	type ThreadId,	17	type ThreadId,
18	} from "@t3tools/contracts";	18	} from "@t3tools/contracts";
		19	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no createHmac.
19	import * as NodeCrypto from "node:crypto";	20	import * as NodeCrypto from "node:crypto";
20		21
21	import * as Clock from "effect/Clock";	22	import * as Clock from "effect/Clock";

apps/server/src/telemetry/Identify.test.ts+11-6

...	@@ -1,7 +1,8 @@	...	@@ -1,7 +1,8 @@
1	import * as NodeCrypto from "node:crypto";
2	import * as NodeServices from "@effect/platform-node/NodeServices";	1	import * as NodeServices from "@effect/platform-node/NodeServices";
3	import { assert, it } from "@effect/vitest";	2	import { assert, it } from "@effect/vitest";
		3	import * as Crypto from "effect/Crypto";
4	import * as Effect from "effect/Effect";	4	import * as Effect from "effect/Effect";
		5	import * as Hex from "effect/encoding/Hex";
5	import * as FileSystem from "effect/FileSystem";	6	import * as FileSystem from "effect/FileSystem";
6	import * as Layer from "effect/Layer";	7	import * as Layer from "effect/Layer";
7	import * as Logger from "effect/Logger";	8	import * as Logger from "effect/Logger";
...	@@ -17,8 +18,12 @@ interface CapturedLog {	...	@@ -17,8 +18,12 @@ interface CapturedLog {
17	readonly annotations: Readonly<Record<string, unknown>>;	18	readonly annotations: Readonly<Record<string, unknown>>;
18	}	19	}
19		20
20	const sha256 = (value: string) =>	21	const sha256 = Effect.fn("test.sha256")(function* (value: string) {
21	NodeCrypto.createHash("sha256").update(value, "utf8").digest("hex");	22	const crypto = yield* Crypto.Crypto;
		23	return Hex.encode(
		24	yield* crypto.digest("SHA-256", new TextEncoder().encode(value)).pipe(Effect.orDie),
		25	);
		26	});
22		27
23	const makeCaptureLogger = (logs: CapturedLog[]) =>	28	const makeCaptureLogger = (logs: CapturedLog[]) =>
24	Logger.make(({ fiber, message }) => {	29	Logger.make(({ fiber, message }) => {
...	@@ -48,7 +53,7 @@ it.layer(NodeServices.layer)("telemetry identity", (it) => {	...	@@ -48,7 +53,7 @@ it.layer(NodeServices.layer)("telemetry identity", (it) => {
48	path.join(config.baseDir, "home"),	53	path.join(config.baseDir, "home"),
49	);	54	);
50		55
51	assert.equal(identifier, sha256(anonymousId));	56	assert.equal(identifier, yield* sha256(anonymousId));
52	}).pipe(	57	}).pipe(
53	Effect.provide(	58	Effect.provide(
54	ServerConfig.layerTest(process.cwd(), {	59	ServerConfig.layerTest(process.cwd(), {
...	@@ -132,7 +137,7 @@ it.layer(NodeServices.layer)("telemetry identity", (it) => {	...	@@ -132,7 +137,7 @@ it.layer(NodeServices.layer)("telemetry identity", (it) => {
132		137
133	const identifier = yield* Identify.getTelemetryIdentifierForHome(homeDirectory);	138	const identifier = yield* Identify.getTelemetryIdentifierForHome(homeDirectory);
134		139
135	assert.equal(identifier, sha256(anonymousId));	140	assert.equal(identifier, yield* sha256(anonymousId));
136	assert.isUndefined(findIdentityLog(logs, "codex", "TelemetryIdentityDecodeError"));	141	assert.isUndefined(findIdentityLog(logs, "codex", "TelemetryIdentityDecodeError"));
137	assert.isUndefined(findIdentityLog(logs, "codex", "TelemetryIdentityReadError"));	142	assert.isUndefined(findIdentityLog(logs, "codex", "TelemetryIdentityReadError"));
138	const allLogs = logs	143	const allLogs = logs
...	@@ -175,7 +180,7 @@ it.layer(NodeServices.layer)("telemetry identity", (it) => {	...	@@ -175,7 +180,7 @@ it.layer(NodeServices.layer)("telemetry identity", (it) => {
175		180
176	const identifier = yield* Identify.getTelemetryIdentifierForHome(homeDirectory);	181	const identifier = yield* Identify.getTelemetryIdentifierForHome(homeDirectory);
177		182
178	assert.equal(identifier, sha256(anonymousId));	183	assert.equal(identifier, yield* sha256(anonymousId));
179	const decodeLog = findIdentityLog(logs, "codex", "TelemetryIdentityDecodeError");	184	const decodeLog = findIdentityLog(logs, "codex", "TelemetryIdentityDecodeError");
180	assert.isDefined(decodeLog);	185	assert.isDefined(decodeLog);
181	assert.equal(	186	assert.equal(

apps/server/src/usage/cliproxyApi.test.ts+8-3

 @@ -1,10 +1,11 @@
+import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
 import { describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
 import * as TestClock from "effect/testing/TestClock";
 import { HttpClient, HttpClientResponse } from "effect/http";
-import { creditRedeemRequestId, makeCliproxyApi } from "./cliproxyApi.ts";
+import { makeCliproxyApi } from "./cliproxyApi.ts";
 const config = {
   kind: "cliproxy",
 @@ -106,7 +107,10 @@ function fixture(
   );
   return {
     requests,
-    api: makeCliproxyApi.pipe(Effect.provideService(HttpClient.HttpClient, http)),
+    api: makeCliproxyApi.pipe(
+      Effect.provideService(HttpClient.HttpClient, http),
+      Effect.provide(NodeCrypto.layer),
+    ),
   };
 }
 @@ -222,7 +226,8 @@ describe("CLIProxyAPI built-in management API", () => {
       expect(redemptions[0]?.body?.data).toBe(redemptions[1]?.body?.data);
       expect(redemptions[0]?.body?.data).toBe(
         encodeJson({
-          redeem_request_id: creditRedeemRequestId("account-b", "credit-b"),
+          // UUIDv5 of "account-b:credit-b"; must stay stable so retries deduplicate.
+          redeem_request_id: "519d5243-011a-5b7b-91f3-44d85f095705",
           credit_id: "credit-b",
         }),
       );

apps/server/src/usage/cliproxyApi.ts+22-12

 @@ -1,5 +1,3 @@
-import * as NodeCrypto from "node:crypto";
 import {
   ProviderDriverKind,
   UsageLimitSourceError,
 @@ -7,8 +5,10 @@ import {
   type UsageLimitSourceAccount,
   type UsageLimitSourceConfig,
 } from "@t3tools/contracts";
+import * as Crypto from "effect/Crypto";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
+import * as Hex from "effect/encoding/Hex";
 import * as Schema from "effect/Schema";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
 @@ -99,21 +99,31 @@ const decodeConsumeResponse = Schema.decodeUnknownEffect(
 const CODEX_BASE = "https://chatgpt.com/backend-api/wham";
 const CREDIT_URL = `${CODEX_BASE}/rate-limit-reset-credits`;
+// 6f1c2a9e-2d4b-4c1e-9a7f-3b8d5e0c1a42
+const CREDIT_REDEEM_NAMESPACE = new Uint8Array([
+  0x6f, 0x1c, 0x2a, 0x9e, 0x2d, 0x4b, 0x4c, 0x1e, 0x9a, 0x7f, 0x3b, 0x8d, 0x5e, 0x0c, 0x1a, 0x42,
+]);
 // UUIDv5 per account and credit also deduplicates retries across T3 environments.
-export function creditRedeemRequestId(accountId: string, creditId: string): string {
+const creditRedeemRequestId = Effect.fn("CliproxyApi.creditRedeemRequestId")(function* (
-  const bytes = NodeCrypto.createHash("sha1")
+  accountId: string,
-    .update(Buffer.from("6f1c2a9e2d4b4c1e9a7f3b8d5e0c1a42", "hex"))
+  creditId: string,
-    .update(`${accountId}:${creditId}`)
+) {
-    .digest()
+  const crypto = yield* Crypto.Crypto;
-    .subarray(0, 16);
+  const name = new TextEncoder().encode(`${accountId}:${creditId}`);
+  const input = new Uint8Array(CREDIT_REDEEM_NAMESPACE.length + name.length);
+  input.set(CREDIT_REDEEM_NAMESPACE);
+  input.set(name, CREDIT_REDEEM_NAMESPACE.length);
+  const bytes = (yield* crypto.digest("SHA-1", input).pipe(Effect.orDie)).slice(0, 16);
   bytes[6] = (bytes[6]! & 0x0f) | 0x50;
   bytes[8] = (bytes[8]! & 0x3f) | 0x80;
-  const hex = bytes.toString("hex");
+  const hex = Hex.encode(bytes);
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
+});
 export const makeCliproxyApi = Effect.gen(function* () {
   const client = yield* HttpClient.HttpClient;
+  const crypto = yield* Crypto.Crypto;
   const management = Effect.fn("CliproxyApi.management")(function* (
     config: UsageLimitSourceConfig,
 @@ -323,10 +333,10 @@ export const makeCliproxyApi = Effect.gen(function* () {
         });
       }
       const body = yield* apiCall(config, account, `${CREDIT_URL}/consume`, {
-        redeem_request_id: creditRedeemRequestId(
+        redeem_request_id: yield* creditRedeemRequestId(
           account.id_token?.chatgpt_account_id ?? account.id,
           creditId,
-        ),
+        ).pipe(Effect.provideService(Crypto.Crypto, crypto)),
         credit_id: creditId,
       });
       const response = yield* decodeConsumeResponse(body);

apps/server/src/zipArchive.ts+1

...	@@ -1,4 +1,5 @@	...	@@ -1,4 +1,5 @@
1	import * as Effect from "effect/Effect";	1	import * as Effect from "effect/Effect";
		2	// @effect-diagnostics-next-line nodeBuiltinImport:off -- type-only, to adapt a Node Readable into Effect.
2	import type * as NodeStream from "node:stream";	3	import type * as NodeStream from "node:stream";
3	import * as Yauzl from "yauzl";	4	import * as Yauzl from "yauzl";
4		5

infra/relay/src/agentActivity/ApnsClient.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	import { EnvironmentId, ThreadId } from "@t3tools/contracts";	4	import { EnvironmentId, ThreadId } from "@t3tools/contracts";

infra/relay/src/agentActivity/ApnsDeliveries.test.ts+1

...	@@ -4,6 +4,7 @@ import type {	...	@@ -4,6 +4,7 @@ import type {
4	} from "@t3tools/contracts/relay";	4	} from "@t3tools/contracts/relay";
5	import * as NodeCryptoLayer from "@effect/platform-node/NodeCrypto";	5	import * as NodeCryptoLayer from "@effect/platform-node/NodeCrypto";
6	import { describe, expect, it } from "@effect/vitest";	6	import { describe, expect, it } from "@effect/vitest";
		7	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync.
7	import * as NodeCrypto from "node:crypto";	8	import * as NodeCrypto from "node:crypto";
8	import * as Deferred from "effect/Deferred";	9	import * as Deferred from "effect/Deferred";
9	import * as Effect from "effect/Effect";	10	import * as Effect from "effect/Effect";

infra/relay/src/agentActivity/ApnsProviderTokens.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	import { describe, expect, it } from "@effect/vitest";	4	import { describe, expect, it } from "@effect/vitest";

infra/relay/src/agentActivity/FcmClient.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync or verify.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2	import { describe, expect, it } from "@effect/vitest";	3	import { describe, expect, it } from "@effect/vitest";
3	import * as Deferred from "effect/Deferred";	4	import * as Deferred from "effect/Deferred";

infra/relay/src/agentActivity/apnsDeliveryJobs.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no createHmac or timingSafeEqual.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	import {	4	import {

infra/relay/src/agentActivity/apnsJwt.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no createPrivateKey.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	import { p256 } from "@noble/curves/nist";	4	import { p256 } from "@noble/curves/nist";

infra/relay/src/auth/DpopProofs.verifyAndConsume.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync or sign.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	import { describe, expect, it } from "@effect/vitest";	4	import { describe, expect, it } from "@effect/vitest";

infra/relay/src/auth/RelayTokens.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	import { describe, expect, it } from "@effect/vitest";	4	import { describe, expect, it } from "@effect/vitest";

infra/relay/src/environments/EnvironmentConnector.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync or sign.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2	import * as NodeCryptoLayer from "@effect/platform-node/NodeCrypto";	3	import * as NodeCryptoLayer from "@effect/platform-node/NodeCrypto";
3		4

infra/relay/src/environments/EnvironmentLinker.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync or sign.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2	import type {	3	import type {
3	RelayEnvironmentLinkProofPayload,	4	RelayEnvironmentLinkProofPayload,

infra/relay/src/environments/EnvironmentPublishSignatures.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync or sign.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2	import * as NodeServices from "@effect/platform-node/NodeServices";	3	import * as NodeServices from "@effect/platform-node/NodeServices";
3	import type {	4	import type {

infra/relay/src/environments/ManagedEndpointProvider.test.ts+16-11

 @@ -1,4 +1,3 @@
-import * as NodeCrypto from "node:crypto";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { describe, expect, it } from "@effect/vitest";
 @@ -365,20 +364,26 @@ function layerProvider(
   );
 }
+// First 16 hex chars of SHA-256(`dev_julius:${userId}:${environmentId}`), pinned so a
+// change to the endpoint naming scheme fails here instead of silently matching.
+const MANAGED_ENDPOINT_HASHES: Record<string, string> = {
+  "user_ABC:env_ABC": "d101ac68108a423e",
+  "user_ABC:env_shared": "d7e6356aaf8863aa",
+  "user_DEF:env_shared": "a2fc84ac1b8c1c35",
+};
+function expectedManagedEndpointHash(environmentId: string, userId: string): string {
+  const hash = MANAGED_ENDPOINT_HASHES[`${userId}:${environmentId}`];
+  if (hash === undefined) throw new Error(`No pinned hash for ${userId}:${environmentId}`);
+  return hash;
+}
 function expectedManagedHostname(environmentId: string, userId = "user_ABC"): string {
-  const hash = NodeCrypto.createHash("sha256")
+  return `dev-julius-${expectedManagedEndpointHash(environmentId, userId)}.t3code.test`;
-    .update(`dev_julius:${userId}:${environmentId}`)
-    .digest("hex")
-    .slice(0, 16);
-  return `dev-julius-${hash}.t3code.test`;
 }
 function expectedManagedTunnelName(environmentId: string, userId = "user_ABC"): string {
-  const hash = NodeCrypto.createHash("sha256")
+  return `t3coderelay-managedendpoint-dev-julius-${expectedManagedEndpointHash(environmentId, userId)}`;
-    .update(`dev_julius:${userId}:${environmentId}`)
-    .digest("hex")
-    .slice(0, 16);
-  return `t3coderelay-managedendpoint-dev-julius-${hash}`;
 }
 describe("ManagedEndpointProvider", () => {

infra/relay/src/hooks/HookForwarder.test.ts+1

...	@@ -1,5 +1,6 @@	...	@@ -1,5 +1,6 @@
1	import * as NodeHttpPlatform from "@effect/platform-node/NodeHttpPlatform";	1	import * as NodeHttpPlatform from "@effect/platform-node/NodeHttpPlatform";
2	import * as NodeServices from "@effect/platform-node/NodeServices";	2	import * as NodeServices from "@effect/platform-node/NodeServices";
		3	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync.
3	import * as NodeCrypto from "node:crypto";	4	import * as NodeCrypto from "node:crypto";
4	import * as EffectNodeCrypto from "@effect/platform-node/NodeCrypto";	5	import * as EffectNodeCrypto from "@effect/platform-node/NodeCrypto";
5	import { describe, expect, it } from "@effect/vitest";	6	import { describe, expect, it } from "@effect/vitest";

infra/relay/src/http/Api.test.ts+1

...	@@ -7,6 +7,7 @@ import {	...	@@ -7,6 +7,7 @@ import {
7	import * as EnvironmentLinker from "../environments/EnvironmentLinker.ts";	7	import * as EnvironmentLinker from "../environments/EnvironmentLinker.ts";
8	import * as RelayTokens from "../auth/RelayTokens.ts";	8	import * as RelayTokens from "../auth/RelayTokens.ts";
9	import * as Devices from "../agentActivity/Devices.ts";	9	import * as Devices from "../agentActivity/Devices.ts";
		10	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync.
10	import * as NodeCrypto from "node:crypto";	11	import * as NodeCrypto from "node:crypto";
11	import { createClerkClient, verifyToken } from "@clerk/backend";	12	import { createClerkClient, verifyToken } from "@clerk/backend";
12	import * as NodeHttpPlatform from "@effect/platform-node/NodeHttpPlatform";	13	import * as NodeHttpPlatform from "@effect/platform-node/NodeHttpPlatform";

packages/shared/src/desktopBootstrapToken.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no createHmac or timingSafeEqual.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	/**	4	/**

packages/shared/src/dpop.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no KeyObject, generateKeyPairSync, or sign.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	import { assert, describe, it } from "@effect/vitest";	4	import { assert, describe, it } from "@effect/vitest";

packages/shared/src/relayJwt.test.ts+1

...	@@ -1,3 +1,4 @@	...	@@ -1,3 +1,4 @@
		1	// @effect-diagnostics-next-line nodeBuiltinImport:off -- Effect's Crypto has no generateKeyPairSync.
1	import * as NodeCrypto from "node:crypto";	2	import * as NodeCrypto from "node:crypto";
2		3
3	import { describe, expect, it } from "@effect/vitest";	4	import { describe, expect, it } from "@effect/vitest";

packages/ssh/src/command.test.ts+25

...	@@ -14,6 +14,7 @@ import {	...	@@ -14,6 +14,7 @@ import {
14	baseSshArgs,	14	baseSshArgs,
15	getLastNonEmptyOutputLine,	15	getLastNonEmptyOutputLine,
16	parseSshResolveOutput,	16	parseSshResolveOutput,
		17	remoteStateKey,
17	runSshCommand,	18	runSshCommand,
18	} from "./command.ts";	19	} from "./command.ts";
19	import { SshCommandError } from "./errors.ts";	20	import { SshCommandError } from "./errors.ts";
...	@@ -98,6 +99,30 @@ describe("ssh command", () => {	...	@@ -98,6 +99,30 @@ describe("ssh command", () => {
98	}),	99	}),
99	);	100	);
100		101
		102	// Remote servers store state under this key, so it must not change across releases.
		103	it.effect("derives a stable remote state key", () =>
		104	Effect.gen(function* () {
		105	assert.equal(
		106	yield* remoteStateKey({
		107	alias: "devbox",
		108	hostname: "devbox.example.com",
		109	username: "julius",
		110	port: 2222,
		111	}),
		112	"711bc738002d72fd",
		113	);
		114	assert.equal(
		115	yield* remoteStateKey({
		116	alias: "fixture",
		117	hostname: "fixture",
		118	username: null,
		119	port: null,
		120	}),
		121	"326264c4f08c8a0c",
		122	);
		123	}).pipe(Effect.provide(NodeServices.layer)),
		124	);
		125
101	it.effect("reads the last non-empty ssh output line", () =>	126	it.effect("reads the last non-empty ssh output line", () =>
102	Effect.sync(() => {	127	Effect.sync(() => {
103	assert.equal(	128	assert.equal(

packages/ssh/src/command.ts+12-8

 @@ -1,9 +1,9 @@
-import * as NodeCrypto from "node:crypto";
 import type { DesktopSshEnvironmentTarget } from "@t3tools/contracts";
 import { HostProcessPlatform } from "@t3tools/shared/hostProcess";
+import * as Crypto from "effect/Crypto";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as Hex from "effect/encoding/Hex";
 import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 @@ -72,12 +72,16 @@ export function targetConnectionKey(target: DesktopSshEnvironmentTarget): string
   return `${target.alias}\u0000${target.hostname}\u0000${target.username ?? ""}\u0000${target.port ?? ""}`;
 }
-export function remoteStateKey(target: DesktopSshEnvironmentTarget): string {
+/** Names the remote state directory for a target: the first 16 hex chars of its SHA-256 key. */
-  return NodeCrypto.createHash("sha256")
+export const remoteStateKey = Effect.fn("ssh/command.remoteStateKey")(function* (
-    .update(targetConnectionKey(target))
+  target: DesktopSshEnvironmentTarget,
-    .digest("hex")
+): Effect.fn.Return<string, never, Crypto.Crypto> {
-    .slice(0, 16);
+  const crypto = yield* Crypto.Crypto;
-}
+  const digest = yield* crypto
+    .digest("SHA-256", encoder.encode(targetConnectionKey(target)))
+    .pipe(Effect.orDie);
+  return Hex.encode(digest).slice(0, 16);
+});
 function buildSshHostSpec(target: DesktopSshEnvironmentTarget): string {
   const destination = target.alias.trim() || target.hostname.trim();

packages/ssh/src/runnerProcess.test.ts+9-6

 @@ -11,6 +11,7 @@ import * as Stream from "effect/Stream";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import * as NodeNet from "node:net";
+import { remoteStateKey } from "./command.ts";
 import { buildRemoteStopScript, buildRemoteT3RunnerScript } from "./tunnel.ts";
 const Started = Schema.Struct({
 @@ -186,12 +187,14 @@ server.listen(0, "127.0.0.1", () => {
           for (const [name, contents] of Object.entries(savedState)) {
             yield* fs.writeFileString(path.join(fixture, name), contents);
           }
-          const script = buildRemoteStopScript({
+          const script = buildRemoteStopScript(
-            alias: "fixture",
+            yield* remoteStateKey({
-            hostname: "fixture",
+              alias: "fixture",
-            username: null,
+              hostname: "fixture",
-            port: null,
+              username: null,
-          });
+              port: null,
+            }),
+          );
           // Redirect only the state directory. Never use the developer's SSH state.
           const isolatedScript = script.replace(
             /^STATE_DIR=.*$/mu,

packages/ssh/src/tunnel.test.ts+8-13

 @@ -233,12 +233,7 @@ describe("ssh tunnel scripts", () => {
   });
   it("uses the remote t3 runner for launch and pairing scripts", () => {
-    const target = {
+    const stateKey = "711bc738002d72fd";
-      alias: "devbox",
-      hostname: "devbox.example.com",
-      username: "julius",
-      port: 2222,
-    } as const;
     const launch = SshTunnel.buildRemoteLaunchScript(ARCHIVE);
     const devLaunch = SshTunnel.buildRemoteLaunchScript({
       ...NODE_SCRIPT,
 @@ -265,28 +260,28 @@ describe("ssh tunnel scripts", () => {
     assert.include(launch, "It wrote nothing to %s");
     assert.include(launch, "T3_ARCHIVE_VERSION='1.2.3-preview.20260911.4'");
     assert.include(
-      SshTunnel.buildRemotePairingScript(target, ARCHIVE),
+      SshTunnel.buildRemotePairingScript(stateKey, ARCHIVE),
       '"$RUNNER_FILE" auth pairing create --base-dir "$PAIRING_BASE_DIR" --json',
     );
     assert.include(
-      SshTunnel.buildRemotePairingScript(target, ARCHIVE),
+      SshTunnel.buildRemotePairingScript(stateKey, ARCHIVE),
       'PAIRING_BASE_DIR="$DEFAULT_SERVER_HOME"',
     );
-    assert.notInclude(SshTunnel.buildRemotePairingScript(target, ARCHIVE), "server-home");
+    assert.notInclude(SshTunnel.buildRemotePairingScript(stateKey, ARCHIVE), "server-home");
     assert.include(
-      SshTunnel.buildRemotePairingScript(target, ARCHIVE),
+      SshTunnel.buildRemotePairingScript(stateKey, ARCHIVE),
       "T3_ARCHIVE_VERSION='1.2.3-preview.20260911.4'",
     );
     assert.include(
-      SshTunnel.buildRemoteStopScript(target),
+      SshTunnel.buildRemoteStopScript(stateKey),
       'if [ "$REMOTE_MANAGED" != "external" ] && [ -n "$REMOTE_PID" ]',
     );
     assert.include(
-      SshTunnel.buildRemoteStopScript(target),
+      SshTunnel.buildRemoteStopScript(stateKey),
       'kill "$REMOTE_PID" 2>/dev/null || true',
     );
     assert.include(
-      SshTunnel.buildRemoteStopScript(target),
+      SshTunnel.buildRemoteStopScript(stateKey),
       'rm -f "$PID_FILE" "$PORT_FILE" "$MANAGED_FILE"',
     );
     assert.include(

packages/ssh/src/tunnel.ts+29-24

 @@ -12,6 +12,7 @@ import * as NetService from "@t3tools/shared/Net";
 import { extractJsonObject, fromLenientJson } from "@t3tools/shared/schemaJson";
 import { satisfiesSemverRange } from "@t3tools/shared/semver";
 import * as Context from "effect/Context";
+import * as Crypto from "effect/Crypto";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
 import * as FileSystem from "effect/FileSystem";
 @@ -98,6 +99,7 @@ interface SshTunnelEntry {
 type SshEnvironmentEffectContext =
   | ChildProcessSpawner.ChildProcessSpawner
+  | Crypto.Crypto
   | FileSystem.FileSystem
   | Path.Path
   | HttpClient.HttpClient
 @@ -837,25 +839,22 @@ export function buildRemoteLaunchScript(input?: RemoteT3RunnerOptions): string {
   });
 }
-export function buildRemotePairingScript(
+export function buildRemotePairingScript(stateKey: string, input?: RemoteT3RunnerOptions): string {
-  target: DesktopSshEnvironmentTarget,
-  input?: RemoteT3RunnerOptions,
-): string {
   return applyScriptPlaceholders(REMOTE_PAIRING_SCRIPT, {
-    T3_STATE_KEY: remoteStateKey(target),
+    T3_STATE_KEY: stateKey,
     T3_RUNNER_SCRIPT: stripTrailingNewlines(buildRemoteT3RunnerScript(input)),
   });
 }
-export function buildRemoteStopScript(target: DesktopSshEnvironmentTarget): string {
+export function buildRemoteStopScript(stateKey: string): string {
   return applyScriptPlaceholders(REMOTE_STOP_SCRIPT, {
-    T3_STATE_KEY: remoteStateKey(target),
+    T3_STATE_KEY: stateKey,
   });
 }
-function buildRemoteLogTailScript(target: DesktopSshEnvironmentTarget): string {
+function buildRemoteLogTailScript(stateKey: string): string {
   return applyScriptPlaceholders(REMOTE_LOG_TAIL_SCRIPT, {
-    T3_STATE_KEY: remoteStateKey(target),
+    T3_STATE_KEY: stateKey,
   });
 }
 @@ -867,15 +866,16 @@ export const launchOrReuseRemoteServer = Effect.fn("ssh/tunnel.launchOrReuseRemo
   ): Effect.fn.Return<
     { readonly remotePort: number; readonly remoteServerKind: "external" | "managed" | null },
     SshCommandError | SshInvalidTargetError | SshLaunchError,
-    ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem | Path.Path
+    ChildProcessSpawner.ChildProcessSpawner | Crypto.Crypto | FileSystem.FileSystem | Path.Path
   > {
+    const stateKey = yield* remoteStateKey(target);
     yield* Effect.logInfo("ssh.remoteServer.launch.start", {
       ...sshTargetLogFields(target),
       ...sshRunnerLogFields(runner),
-      stateKey: remoteStateKey(target),
+      stateKey,
     });
     const result = yield* runSshCommand(target, {
-      remoteCommandArgs: ["sh", "-l", "-s", "--", remoteStateKey(target)],
+      remoteCommandArgs: ["sh", "-l", "-s", "--", stateKey],
       stdin: buildRemoteLaunchScript(runner),
       timeoutMs: isNodeScriptRunner(runner)
         ? REMOTE_LAUNCH_TIMEOUT_MS
 @@ -910,7 +910,7 @@ export const launchOrReuseRemoteServer = Effect.fn("ssh/tunnel.launchOrReuseRemo
       ...sshTargetLogFields(target),
       remotePort: parsed.remotePort,
       remoteServerKind: parsed.serverKind ?? null,
-      stateKey: remoteStateKey(target),
+      stateKey,
     });
     return {
       remotePort: parsed.remotePort,
 @@ -928,15 +928,16 @@ export const issueRemotePairingToken = Effect.fn("ssh/tunnel.issueRemotePairingT
     readonly credential: string;
   },
   SshCommandError | SshInvalidTargetError | SshPairingError,
-  ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem | Path.Path
+  ChildProcessSpawner.ChildProcessSpawner | Crypto.Crypto | FileSystem.FileSystem | Path.Path
 > {
+  const stateKey = yield* remoteStateKey(target);
   yield* Effect.logDebug("ssh.remoteServer.pairingToken.start", {
     ...sshTargetLogFields(target),
-    stateKey: remoteStateKey(target),
+    stateKey,
   });
   const result = yield* runSshCommand(target, {
     remoteCommandArgs: ["sh", "-s"],
-    stdin: buildRemotePairingScript(target, runner),
+    stdin: buildRemotePairingScript(stateKey, runner),
     // Pairing may be the first command on a cold remote, so it can install
     // the archive on the way.
     ...(isNodeScriptRunner(runner) ? {} : { timeoutMs: REMOTE_ARCHIVE_LAUNCH_TIMEOUT_MS }),
 @@ -968,7 +969,7 @@ export const issueRemotePairingToken = Effect.fn("ssh/tunnel.issueRemotePairingT
   }
   yield* Effect.logDebug("ssh.remoteServer.pairingToken.created", {
     ...sshTargetLogFields(target),
-    stateKey: remoteStateKey(target),
+    stateKey,
   });
   return {
     credential: parsed.credential,
 @@ -981,22 +982,23 @@ const stopRemoteServer = Effect.fn("ssh/tunnel.stopRemoteServer")(function* (
 ): Effect.fn.Return<
   void,
   SshCommandError | SshInvalidTargetError,
-  ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem | Path.Path
+  ChildProcessSpawner.ChildProcessSpawner | Crypto.Crypto | FileSystem.FileSystem | Path.Path
 > {
+  const stateKey = yield* remoteStateKey(target);
   yield* Effect.logInfo("ssh.remoteServer.stop.start", {
     ...sshTargetLogFields(target),
-    stateKey: remoteStateKey(target),
+    stateKey,
   });
   yield* runSshCommand(target, {
     remoteCommandArgs: ["sh", "-s"],
-    stdin: buildRemoteStopScript(target),
+    stdin: buildRemoteStopScript(stateKey),
     ...(input?.authSecret === undefined ? {} : { authSecret: input.authSecret }),
     ...(input?.batchMode === undefined ? {} : { batchMode: input.batchMode }),
     ...(input?.interactiveAuth === undefined ? {} : { interactiveAuth: input.interactiveAuth }),
   });
   yield* Effect.logInfo("ssh.remoteServer.stop.succeeded", {
     ...sshTargetLogFields(target),
-    stateKey: remoteStateKey(target),
+    stateKey,
   });
 });
 @@ -1006,11 +1008,11 @@ const readRemoteServerLogTail = Effect.fn("ssh/tunnel.readRemoteServerLogTail")(
 ): Effect.fn.Return<
   string,
   SshCommandError | SshInvalidTargetError,
-  ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem | Path.Path
+  ChildProcessSpawner.ChildProcessSpawner | Crypto.Crypto | FileSystem.FileSystem | Path.Path
 > {
   const result = yield* runSshCommand(target, {
     remoteCommandArgs: ["sh", "-s"],
-    stdin: buildRemoteLogTailScript(target),
+    stdin: buildRemoteLogTailScript(yield* remoteStateKey(target)),
     timeoutMs: 10_000,
     ...(input?.authSecret === undefined ? {} : { authSecret: input.authSecret }),
     ...(input?.batchMode === undefined ? {} : { batchMode: input.batchMode }),
 @@ -1109,6 +1111,7 @@ const startSshTunnel = Effect.fn("ssh/tunnel.startSshTunnel")(function* (input:
   SshTunnelEntry,
   SshCommandError | SshInvalidTargetError | SshReadinessError,
   | ChildProcessSpawner.ChildProcessSpawner
+  | Crypto.Crypto
   | FileSystem.FileSystem
   | Path.Path
   | HttpClient.HttpClient
 @@ -1538,6 +1541,7 @@ const makeSshEnvironmentManager = Effect.fn("ssh/tunnel.SshEnvironmentManager.ma
     );
     tunnels.set(input.key, tunnelEntry);
     const spawnerService = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const cryptoService = yield* Crypto.Crypto;
     const fileSystemService = yield* FileSystem.FileSystem;
     const pathService = yield* Path.Path;
     yield* Scope.addFinalizer(
 @@ -1577,6 +1581,7 @@ const makeSshEnvironmentManager = Effect.fn("ssh/tunnel.SshEnvironmentManager.ma
               },
         ).pipe(
           Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawnerService),
+          Effect.provideService(Crypto.Crypto, cryptoService),
           Effect.provideService(FileSystem.FileSystem, fileSystemService),
           Effect.provideService(Path.Path, pathService),
         );
 @@ -1757,7 +1762,7 @@ const makeSshEnvironmentManager = Effect.fn("ssh/tunnel.SshEnvironmentManager.ma
 });
 /**
- * @effect-expect-leaking ChildProcessSpawner | FileSystem | HttpClient | NetService | Path | SshPasswordPrompt
+ * @effect-expect-leaking ChildProcessSpawner | Crypto | FileSystem | HttpClient | NetService | Path | SshPasswordPrompt
  */
 export class SshEnvironmentManager extends Context.Service<
   SshEnvironmentManager,

pnpm-lock.yaml+37-34

 @@ -13,8 +13,8 @@ catalogs:
       specifier: 4.0.1
       version: 4.0.1
     '@effect/tsgo':
-      specifier: 0.41.0
+      specifier: 0.46.1
-      version: 0.41.0
+      version: 0.46.1
     '@legendapp/list':
       specifier: 3.3.5
       version: 3.3.5
 @@ -131,7 +131,7 @@ importers:
         version: 1.1.0
       '@effect/tsgo':
         specifier: 'catalog:'
-        version: 0.41.0
+        version: 0.46.1
       '@shadcn/lint':
         specifier: 0.1.5
         version: 0.1.5
 @@ -540,6 +540,9 @@ importers:
       '@napi-rs/keyring':
         specifier: ^1.3.0
         version: 1.3.0
+      '@noble/hashes':
+        specifier: 'catalog:'
+        version: 1.8.0
       '@opencode-ai/sdk':
         specifier: ^1.3.15
         version: 1.15.13
 @@ -2384,43 +2387,43 @@ packages:
     peerDependencies:
       effect: 4.0.1
-  '@effect/tsgo-darwin-arm64@0.41.0':
+  '@effect/tsgo-darwin-arm64@0.46.1':
-    resolution: {integrity: sha512-3iEPtcHF72yDjv7T5YpnX+Io1LDLywJb1oGG3Fp/Fth4xmqiT1Vacyz5wnPCfEWGQ6CyrlyCZSSjUxPyJ70+DQ==}
+    resolution: {integrity: sha512-ErehNqI9p8me4XKO8N4bzdDWgBbSNlJ3CIZGfXoAW6Fo4Oo7x4ZbZV7KNsMSn9aJSiUUOQUoXjGBdslU5OYMdw==}
     cpu: [arm64]
     os: [darwin]
-  '@effect/tsgo-darwin-x64@0.41.0':
+  '@effect/tsgo-darwin-x64@0.46.1':
-    resolution: {integrity: sha512-rrVVNacJ/Qh8DfdfgNJDuzcVmR3xPnqes3z+F1kio99umJwPIRB8iPWRAY0SrO+Y84A/y2SSb0AjMGqA5V3Aiw==}
+    resolution: {integrity: sha512-zsQI1gjGMYF/C2FWDUwbStBAf0tJDVgXeWwTAZ+VUiNY06fR1SrZHK0L+22PE49Nim3biWK2h+XXRFVzql+ojg==}
     cpu: [x64]
     os: [darwin]
-  '@effect/tsgo-linux-arm64@0.41.0':
+  '@effect/tsgo-linux-arm64@0.46.1':
-    resolution: {integrity: sha512-RVI+7pG3tP56LfH06a2aq4KLp2RQ0HohW8mmoGmrBPyNEL9DnzFEGB98ZoMJ+ERYUJoIp74Jy3nKRVbnzVhxFw==}
+    resolution: {integrity: sha512-e283BZEQC3mJpk1N7vdUhoF/aYHc4YwCE/fwz/80d11OSvG35U+c49grxS7V7+dAl2ld6QiT8D1rcL8PYu8DLQ==}
     cpu: [arm64]
     os: [linux]
-  '@effect/tsgo-linux-arm@0.41.0':
+  '@effect/tsgo-linux-arm@0.46.1':
-    resolution: {integrity: sha512-JddS91IaupLa22oc4YQiYppe7iAZAEyx/2iR9sAAAhpVanWACsIAcyUy4RJrs8sPLLoLsZQaKQa+9rbQO1FLsg==}
+    resolution: {integrity: sha512-Y12wOcJ6HgwiCgg/oDQH4tdRQKRsWnul/KjCOwMxzVT4kO+ndczu1sKUZT+qIxV7qNk4Sq+uSWKEnFBA3ETI8w==}
     cpu: [arm]
     os: [linux]
-  '@effect/tsgo-linux-x64@0.41.0':
+  '@effect/tsgo-linux-x64@0.46.1':
-    resolution: {integrity: sha512-U3+kMDVe2Opa5mxbN4B6PgOizWx5B4LXLN98CZDUl2vYtRGfwrRRhKQiB+de3ELaZ0MuDjPlCvU7S2mXQ8UiuQ==}
+    resolution: {integrity: sha512-NYGBC3Scfo9yZJfs7cg0KMcHgtukJ4+xff18nqIrON9Zzc/qD6w1AwEwYKYCsbai5hTQBb3VLIWmHM8BJ54WJg==}
     cpu: [x64]
     os: [linux]
-  '@effect/tsgo-win32-arm64@0.41.0':
+  '@effect/tsgo-win32-arm64@0.46.1':
-    resolution: {integrity: sha512-H6/xkn+B4B63OPKc0UAzQQFvLs0MXKigiD9dtvQeCU7czWGztOQILuLkyHnM1Dlc+uy4cJ5eXHiMXd+lwl+E8g==}
+    resolution: {integrity: sha512-MK93SN9qjowrCjch+2wGGncd6Y7KgDyJvLKVVFCJV8cPpHoL3xDCpxFCGqQWe120mVpLmnzbM2evKdh0M5l5PA==}
     cpu: [arm64]
     os: [win32]
-  '@effect/tsgo-win32-x64@0.41.0':
+  '@effect/tsgo-win32-x64@0.46.1':
-    resolution: {integrity: sha512-vRN/Mhi381xEGrvV68IN/VO4Lc0pnlVQzHSVmNCJXLwGLmJUvuvPoyZ7Lv4wwHRX9iZe8Rch21xUGu5jSQtUSw==}
+    resolution: {integrity: sha512-hlRbeNlp0N/dfZZFl+xVzT3XfHYqPmkXzCadR6e5yoe/vyA3O9RnO5UrOBHsXvL2RTE6hrh8bRfx2Uu6g3LL5w==}
     cpu: [x64]
     os: [win32]
-  '@effect/tsgo@0.41.0':
+  '@effect/tsgo@0.46.1':
-    resolution: {integrity: sha512-C/U7lFM0AXsfpqRilDOgwu+llBhAo8bcdIlzgbRWf1LWlU4KZKB2UsUvBPL3qPnm+wmbCvQLeTQc4BjV9oJrcg==}
+    resolution: {integrity: sha512-DMcBCg5nWLufejRlyqFEkXmbtaLUJ56NKny6L1LTtimvz0U3VNj9H6ZUXV4WeeWvJzVyL0y7G2wsCBAFUgy1jw==}
     hasBin: true
   '@effect/vitest@4.0.1':
 @@ -13055,36 +13058,36 @@ snapshots:
     dependencies:
       effect: 4.0.1(patch_hash=a33cba07c41f32374c2aaa86ea4a84d3ab9a872a78c94b65e929b19f8361856f)
-  '@effect/tsgo-darwin-arm64@0.41.0':
+  '@effect/tsgo-darwin-arm64@0.46.1':
     optional: true
-  '@effect/tsgo-darwin-x64@0.41.0':
+  '@effect/tsgo-darwin-x64@0.46.1':
     optional: true
-  '@effect/tsgo-linux-arm64@0.41.0':
+  '@effect/tsgo-linux-arm64@0.46.1':
     optional: true
-  '@effect/tsgo-linux-arm@0.41.0':
+  '@effect/tsgo-linux-arm@0.46.1':
     optional: true
-  '@effect/tsgo-linux-x64@0.41.0':
+  '@effect/tsgo-linux-x64@0.46.1':
     optional: true
-  '@effect/tsgo-win32-arm64@0.41.0':
+  '@effect/tsgo-win32-arm64@0.46.1':
     optional: true
-  '@effect/tsgo-win32-x64@0.41.0':
+  '@effect/tsgo-win32-x64@0.46.1':
     optional: true
-  '@effect/tsgo@0.41.0':
+  '@effect/tsgo@0.46.1':
     optionalDependencies:
-      '@effect/tsgo-darwin-arm64': 0.41.0
+      '@effect/tsgo-darwin-arm64': 0.46.1
-      '@effect/tsgo-darwin-x64': 0.41.0
+      '@effect/tsgo-darwin-x64': 0.46.1
-      '@effect/tsgo-linux-arm': 0.41.0
+      '@effect/tsgo-linux-arm': 0.46.1
-      '@effect/tsgo-linux-arm64': 0.41.0
+      '@effect/tsgo-linux-arm64': 0.46.1
-      '@effect/tsgo-linux-x64': 0.41.0
+      '@effect/tsgo-linux-x64': 0.46.1
-      '@effect/tsgo-win32-arm64': 0.41.0
+      '@effect/tsgo-win32-arm64': 0.46.1
-      '@effect/tsgo-win32-x64': 0.41.0
+      '@effect/tsgo-win32-x64': 0.46.1
   '@effect/vitest@4.0.1(patch_hash=359f6fb2f7b3ec145bb72208edb9034f02489791aa2491a55cdbd69bd56ee0d2)(@types/node@24.12.4)(@vitest/ui@5.0.1)(bufferutil@4.1.0)(effect@4.0.1(patch_hash=a33cba07c41f32374c2aaa86ea4a84d3ab9a872a78c94b65e929b19f8361856f))(esbuild@0.28.2)(jiti@2.7.0)(jsdom@30.1.0(@noble/hashes@1.8.0))(msw@2.12.11(@types/node@24.12.4)(typescript@7.0.2))(terser@5.48.0)(typescript@7.0.2)(unrun@0.2.39)(utf-8-validate@6.0.6)(yaml@2.9.0)':
     dependencies:

pnpm-workspace.yaml+1-1

...	@@ -36,7 +36,7 @@ catalog:	...	@@ -36,7 +36,7 @@ catalog:
36	"@effect/platform-node-shared": 4.0.1	36	"@effect/platform-node-shared": 4.0.1
37	"@effect/sql-pg": 4.0.1	37	"@effect/sql-pg": 4.0.1
38	"@effect/sql-sqlite-do": 4.0.1	38	"@effect/sql-sqlite-do": 4.0.1
39	"@effect/tsgo": 0.41.0	39	"@effect/tsgo": 0.46.1
40	"@effect/vitest": 4.0.1	40	"@effect/vitest": 4.0.1
41	"@legendapp/list": 3.3.5	41	"@legendapp/list": 3.3.5
42	"@noble/curves": 1.9.1	42	"@noble/curves": 1.9.1

tsconfig.base.json-1

...	@@ -23,7 +23,6 @@	...	@@ -23,7 +23,6 @@
23	"name": "@effect/language-service",	23	"name": "@effect/language-service",
24	"namespaceImportPackages": ["@effect/platform-node", "effect"],	24	"namespaceImportPackages": ["@effect/platform-node", "effect"],
25	"diagnosticSeverity": {	25	"diagnosticSeverity": {
26	"importFromBarrel": "error",
27	"anyUnknownInErrorContext": "error",	26	"anyUnknownInErrorContext": "error",
28	"unsafeEffectTypeAssertion": "error",	27	"unsafeEffectTypeAssertion": "error",
29	"instanceOfSchema": "error",	28	"instanceOfSchema": "error",

author	Erik Thorelli <ethorelli@gmail.com> 2026-10-06 10:52:08-07:00
committer	GitHub <noreply@github.com> 2026-10-06 10:52:08-07:00
log	78552a8c6162c9b5248231bc70be8bffdb50cbd3
tree	ee48d1dc45597e71f184354e297bb29f872bb833
parent	b38aa18365fe314e079d99670932bedfc7407e5a
signature	Signed by PGP key B5690EEEBB952194

...	@@ -41,7 +41,9 @@ console.log(readFileSync(args[args.indexOf('--config') + 1], 'utf8'));	...	@@ -41,7 +41,9 @@ console.log(readFileSync(args[args.indexOf('--config') + 1], 'utf8'));
41	if (process.env.AGENT_DEVICE_DAEMON_BASE_URL) process.exit(2);`,	41	if (process.env.AGENT_DEVICE_DAEMON_BASE_URL) process.exit(2);`,
42	);	42	);
43	const shim = yield* ensureAgentDeviceShim({ entryPath, stateDir: dir });	43	const shim = yield* ensureAgentDeviceShim({ entryPath, stateDir: dir });
44	const files = ["mini", "android"].map((host) => agentDeviceConfigPath(dir, host, path));	44	const files = yield* Effect.forEach(["mini", "android"], (host) =>
		45	agentDeviceConfigPath(dir, host, path),
		46	);
45	for (const [index, file] of files.entries())	47	for (const [index, file] of files.entries())
46	yield* writeAgentDeviceConfig(file, {	48	yield* writeAgentDeviceConfig(file, {
47	baseUrl: `http://127.0.0.1:${1000 + index}`,	49	baseUrl: `http://127.0.0.1:${1000 + index}`,
...	@@ -73,8 +75,8 @@ if (process.env.AGENT_DEVICE_DAEMON_BASE_URL) process.exit(2);`,	...	@@ -73,8 +75,8 @@ if (process.env.AGENT_DEVICE_DAEMON_BASE_URL) process.exit(2);`,
73	});	75	});
74	expect((yield* Effect.promise(() => invoke(files[0]!))).daemonAuthToken).toBe("new");	76	expect((yield* Effect.promise(() => invoke(files[0]!))).daemonAuthToken).toBe("new");
75	expect(yield* fs.readFileString(files[1]!)).toBe(second);	77	expect(yield* fs.readFileString(files[1]!)).toBe(second);
76	expect(agentDeviceSession("thread", "mini", "same-id")).not.toBe(	78	expect(yield* agentDeviceSession("thread", "mini", "same-id")).not.toBe(
77	agentDeviceSession("thread", "android", "same-id"),	79	yield* agentDeviceSession("thread", "android", "same-id"),
78	);	80	);
79	for (const args of [	81	for (const args of [
80	["snapshot"],	82	["snapshot"],

...	@@ -2,6 +2,7 @@ import { expect, it } from "@effect/vitest";	...	@@ -2,6 +2,7 @@ import { expect, it } from "@effect/vitest";
2	import { ThreadId } from "@t3tools/contracts";	2	import { ThreadId } from "@t3tools/contracts";
3	import * as Deferred from "effect/Deferred";	3	import * as Deferred from "effect/Deferred";
4	import * as Fiber from "effect/Fiber";	4	import * as Fiber from "effect/Fiber";
		5	import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
5	import * as Effect from "effect/Effect";	6	import * as Effect from "effect/Effect";
6	import { HttpClient, HttpClientResponse } from "effect/http";	7	import { HttpClient, HttpClientResponse } from "effect/http";
7	import * as ServerSettings from "../serverSettings.ts";	8	import * as ServerSettings from "../serverSettings.ts";
...	@@ -77,7 +78,7 @@ it.effect("keeps hosts independent when serials collide and another host fails",	...	@@ -77,7 +78,7 @@ it.effect("keeps hosts independent when serials collide and another host fails",
77	order.push("write finished");	78	order.push("write finished");
78	return "/host-config.json";	79	return "/host-config.json";
79	}),	80	}),
80	).pipe(Effect.provideService(HttpClient.HttpClient, http));	81	).pipe(Effect.provide(NodeCrypto.layer), Effect.provideService(HttpClient.HttpClient, http));
81	expect(yield* service.agentReadinessIfSupported("b")).not.toBeNull();	82	expect(yield* service.agentReadinessIfSupported("b")).not.toBeNull();
82	const listed = yield* service.list;	83	const listed = yield* service.list;
83	expect(listed.devices.map((device) => device.hostId).sort()).toEqual(["a", "b"]);	84	expect(listed.devices.map((device) => device.hostId).sort()).toEqual(["a", "b"]);

...	@@ -2,9 +2,11 @@ import * as NodeServices from "@effect/platform-node/NodeServices";	...	@@ -2,9 +2,11 @@ import * as NodeServices from "@effect/platform-node/NodeServices";
2	import { expect, it } from "@effect/vitest";	2	import { expect, it } from "@effect/vitest";
3	import { HostProcessArchitecture, HostProcessPlatform } from "@t3tools/shared/hostProcess";	3	import { HostProcessArchitecture, HostProcessPlatform } from "@t3tools/shared/hostProcess";
4	import * as Deferred from "effect/Deferred";	4	import * as Deferred from "effect/Deferred";
		5	import * as Crypto from "effect/Crypto";
5	import type * as Duration from "effect/Duration";	6	import type * as Duration from "effect/Duration";
6	import * as DateTime from "effect/DateTime";	7	import * as DateTime from "effect/DateTime";
7	import * as Effect from "effect/Effect";	8	import * as Effect from "effect/Effect";
		9	import * as Hex from "effect/encoding/Hex";
8	import * as Fiber from "effect/Fiber";	10	import * as Fiber from "effect/Fiber";
9	import * as FileSystem from "effect/FileSystem";	11	import * as FileSystem from "effect/FileSystem";
10	import * as Option from "effect/Option";	12	import * as Option from "effect/Option";
...	@@ -12,7 +14,6 @@ import * as Path from "effect/Path";	...	@@ -12,7 +14,6 @@ import * as Path from "effect/Path";
12	import * as Stream from "effect/Stream";	14	import * as Stream from "effect/Stream";
13	import * as TestClock from "effect/testing/TestClock";	15	import * as TestClock from "effect/testing/TestClock";
14	import { HttpClient, HttpClientResponse } from "effect/http";	16	import { HttpClient, HttpClientResponse } from "effect/http";
15	import * as NodeCrypto from "node:crypto";
16	import * as NodeZlib from "node:zlib";	17	import * as NodeZlib from "node:zlib";
17		18
18	import * as PreviewBrowser from "./PreviewBrowser.ts";	19	import * as PreviewBrowser from "./PreviewBrowser.ts";
...	@@ -87,6 +88,9 @@ const makeHarness = Effect.fn("test.makePreviewBrowser")(function* (	...	@@ -87,6 +88,9 @@ const makeHarness = Effect.fn("test.makePreviewBrowser")(function* (
87	const path = yield* Path.Path;	88	const path = yield* Path.Path;
88	const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-preview-browser-test-" });	89	const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-preview-browser-test-" });
89	const archive = options.archive ?? browserArchive;	90	const archive = options.archive ?? browserArchive;
		91	const crypto = yield* Crypto.Crypto;
		92	const sha256 =
		93	options.sha256 ?? Hex.encode(yield* crypto.digest("SHA-256", archive).pipe(Effect.orDie));
90	const requests: Array<string> = [];	94	const requests: Array<string> = [];
91	const browser = yield* PreviewBrowser.makePreviewBrowser({	95	const browser = yield* PreviewBrowser.makePreviewBrowser({
92	baseDir,	96	baseDir,
...	@@ -97,7 +101,7 @@ const makeHarness = Effect.fn("test.makePreviewBrowser")(function* (	...	@@ -97,7 +101,7 @@ const makeHarness = Effect.fn("test.makePreviewBrowser")(function* (
97	platform: "fixture",	101	platform: "fixture",
98	url: "https://storage.googleapis.com/chrome-headless-shell-fixture.zip",	102	url: "https://storage.googleapis.com/chrome-headless-shell-fixture.zip",
99	bytes: archive.byteLength,	103	bytes: archive.byteLength,
100	sha256: options.sha256 ?? NodeCrypto.createHash("sha256").update(archive).digest("hex"),	104	sha256,
101	},	105	},
102	...(options.wait === undefined ? {} : { wait: options.wait }),	106	...(options.wait === undefined ? {} : { wait: options.wait }),
103	}).pipe(	107	}).pipe(

...	@@ -10,6 +10,7 @@	...	@@ -10,6 +10,7 @@
10	import * as NodeServices from "@effect/platform-node/NodeServices";	10	import * as NodeServices from "@effect/platform-node/NodeServices";
11	import { AbsolutePath, Location, Model, Provider } from "@opencode/client/effect";	11	import { AbsolutePath, Location, Model, Provider } from "@opencode/client/effect";
12	import { assert, it } from "@effect/vitest";	12	import { assert, it } from "@effect/vitest";
		13	import * as Crypto from "effect/Crypto";
13	import * as Effect from "effect/Effect";	14	import * as Effect from "effect/Effect";
14	import * as Base64Url from "effect/encoding/Base64Url";	15	import * as Base64Url from "effect/encoding/Base64Url";
15	import * as Fiber from "effect/Fiber";	16	import * as Fiber from "effect/Fiber";
...	@@ -21,7 +22,6 @@ import * as Path from "effect/Path";	...	@@ -21,7 +22,6 @@ import * as Path from "effect/Path";
21	import * as Stream from "effect/Stream";	22	import * as Stream from "effect/Stream";
22	import { FetchHttpClient } from "effect/http";	23	import { FetchHttpClient } from "effect/http";
23	import { ChildProcess, ChildProcessSpawner } from "effect/process";	24	import { ChildProcess, ChildProcessSpawner } from "effect/process";
24	import * as NodeCrypto from "node:crypto";
25	import { describe } from "vite-plus/test";	25	import { describe } from "vite-plus/test";
26		26
27	import * as OpenCode2Client from "./OpenCode2Client.ts";	27	import * as OpenCode2Client from "./OpenCode2Client.ts";
...	@@ -36,7 +36,8 @@ const startServer = Effect.fn("OpenCode2ClientLive.startServer")(function* (bina	...	@@ -36,7 +36,8 @@ const startServer = Effect.fn("OpenCode2ClientLive.startServer")(function* (bina
36	const directory = path.join(root, "work");	36	const directory = path.join(root, "work");
37	yield* fs.makeDirectory(directory);	37	yield* fs.makeDirectory(directory);
38	// Non-ASCII on purpose: OpenCode decodes Basic credentials as UTF-8.	38	// Non-ASCII on purpose: OpenCode decodes Basic credentials as UTF-8.
39	const password = `${Base64Url.encode(NodeCrypto.randomBytes(32))}-pässwörd€`;	39	const crypto = yield* Crypto.Crypto;
		40	const password = `${Base64Url.encode(yield* crypto.randomBytes(32))}-pässwörd€`;
40	const child = yield* spawner.spawn(	41	const child = yield* spawner.spawn(
41	ChildProcess.make(binary, ["serve", "--hostname=127.0.0.1", "--port=0"], {	42	ChildProcess.make(binary, ["serve", "--hostname=127.0.0.1", "--port=0"], {
42	cwd: directory,	43	cwd: directory,

chore(deps): upgrade @effect/tsgo to 0.46.1 (#16360)