import * as ProviderEventLoggers from "@t3tools/provider-core/server/ProviderEventLoggers"; import type { RelayManagedEndpointRuntimeConfig } from "@t3tools/contracts/relay"; import * as Random from "effect/Random"; import * as EnvironmentKeys from "./cloud/environmentKeys.ts"; import * as AssetSigner from "./assets/AssetSigner.ts"; import * as DatabaseStorage from "./persistence/DatabaseStorage.ts"; import * as StorageCleanup from "./storageCleanup.ts"; import * as PullRequestSyncReactor from "./orchestration-v2/PullRequestSyncReactor.ts"; import * as PullRequestWatchReactor from "./orchestration-v2/PullRequestWatchReactor.ts"; import * as DelegatedTaskQuestionReactor from "./orchestration-v2/DelegatedTaskQuestionReactor.ts"; // Effect wraps this raw Node HTTP server after its startup and write-error guards attach. // @effect-diagnostics nodeBuiltinImport:off import * as NodeHttp from "node:http"; import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer"; import * as NodeCrypto from "@effect/platform-node/NodeCrypto"; import * as NodeServices from "@effect/platform-node/NodeServices"; import { EnvironmentHttpApi, type RepositoryIdentity } from "@t3tools/contracts"; import * as Cause from "effect/Cause"; import * as Duration from "effect/Duration"; import * as Deferred from "effect/Deferred"; import * as Effect from "effect/Effect"; import * as Option from "effect/Option"; import * as Layer from "effect/Layer"; import * as Stream from "effect/Stream"; import { FetchHttpClient, HttpRouter, HttpServer } from "effect/http"; import * as HttpApiBuilder from "effect/http-api/HttpApiBuilder"; import * as BackgroundPolicy from "./background/BackgroundPolicy.ts"; import * as HostPowerMonitor from "./background/HostPowerMonitor.ts"; import * as ServerConfig from "./config.ts"; import { withUntracedRequests } from "./http.ts"; import * as ServerHttp from "./http.ts"; import { guardHttpResponseWriteErrors, rejectRequestsUntilServing, } from "./httpResponseErrorGuard.ts"; import { fixPath } from "./os-jank.ts"; import * as Ws from "./ws.ts"; import * as AgentScopeLive from "./process/agentScope.ts"; import * as ExternalLauncher from "./process/externalLauncher.ts"; import * as NodePtyAdapter from "./terminal/NodePtyAdapter.ts"; import * as PullRequestHttp from "./pullRequest/http.ts"; import * as SpeechModelStore from "./speech/SpeechModelStore.ts"; import * as SpeechService from "./speech/SpeechService.ts"; import { speechHttpApiLayer } from "./speech/http.ts"; import { speechStreamRouteLayer } from "./speech/stream.ts"; import * as PullRequestProviderRegistry from "./pullRequest/PullRequestProviderRegistry.ts"; import * as PullRequestService from "./pullRequest/PullRequestService.ts"; import * as SqlitePersistence from "./persistence/Sqlite.ts"; import * as PullRequestFilesViewed from "./persistence/PullRequestFilesViewed.ts"; import * as PullRequestReviewGuides from "./persistence/PullRequestReviewGuides.ts"; import * as PullRequestReviewGuideService from "./pullRequest/PullRequestReviewGuideService.ts"; import * as ServerLifecycleEvents from "./serverLifecycleEvents.ts"; import * as AnalyticsService from "./telemetry/AnalyticsService.ts"; import * as DelegatedTaskAnalytics from "./telemetry/DelegatedTaskAnalytics.ts"; import * as ProviderUsageAnalytics from "./telemetry/ProviderUsageAnalytics.ts"; import * as ModelManifest from "./provider/ModelManifest.ts"; import * as ResetCreditCoordinator from "./provider/resetCreditCoordinator.ts"; import * as EventNdjsonLogger from "./provider/EventNdjsonLogger.ts"; import * as ProviderLatestVersions from "@t3tools/provider-core/server/ProviderLatestVersions"; import * as McpProviderSessions from "@t3tools/provider-core/server/McpProviderSessions"; import * as OpenCodeRuntime from "@t3tools/provider-opencode/server/OpenCodeRuntime"; import * as OpenCodeServerLedger from "@t3tools/provider-opencode/server/OpenCodeServerLedger"; import * as ProviderHostLive from "./provider/ProviderHostLive.ts"; import * as DocumentText from "./provider/DocumentText.ts"; import * as AcpRegistrySupport from "@t3tools/provider-acp-registry/server/AcpRegistrySupport"; import * as CheckpointDiffQuery from "./checkpointing/CheckpointDiffQuery.ts"; import * as NativeChildWorkQuery from "./orchestration-v2/NativeChildWorkQuery.ts"; import * as CheckpointStore from "./checkpointing/CheckpointStore.ts"; import * as SourceControlBuiltInDrivers from "./sourceControl/builtInDrivers.ts"; import * as SourceControlSignIn from "./sourceControl/SourceControlSignIn.ts"; import { BUILT_IN_SOURCE_CONTROL_DRIVER_LIST } from "./sourceControl/sourceControlDefinitions.ts"; import * as TextGeneration from "./textGeneration/TextGeneration.ts"; import * as SecretResolver from "./secrets/SecretResolver.ts"; import * as ProviderInstanceRegistryHydration from "./provider/ProviderInstanceRegistryHydration.ts"; import * as ProjectSettingsOverrideSweep from "./provider/ProjectSettingsOverrideSweep.ts"; import * as TerminalManager from "./terminal/Manager.ts"; import * as McpHttpServer from "./mcp/McpHttpServer.ts"; import * as PeerForwarding from "./peer/PeerForwarding.ts"; import * as RemoteDelegation from "./peer/RemoteDelegation.ts"; import * as PeerLinkRequests from "./peer/PeerLinkRequests.ts"; import * as PeerLinks from "./peer/PeerLinks.ts"; import * as PeerMcpClient from "./peer/PeerMcpClient.ts"; import * as McpSessionRegistry from "./mcp/McpSessionRegistry.ts"; import * as PreviewAutomationBroker from "./mcp/PreviewAutomationBroker.ts"; import * as DeviceService from "./device/DeviceService.ts"; import * as DeviceHubProxy from "./device/DeviceHubProxy.ts"; import * as PreviewManager from "./preview/Manager.ts"; import * as PortScanner from "./preview/PortScanner.ts"; import * as ServerBrowser from "./preview/ServerBrowser.ts"; import * as PreviewAgentActivity from "./preview/PreviewAgentActivity.ts"; import * as DesktopBrowserChannel from "./preview/DesktopBrowserChannel.ts"; import * as ServerBrowserStream from "./preview/ServerBrowserStream.ts"; import * as PreviewBrowser from "./preview/PreviewBrowser.ts"; import * as ProcessRunner from "./processRunner.ts"; import * as GitManager from "./git/GitManager.ts"; import * as EnvironmentTheme from "./environmentTheme.ts"; import * as Keybindings from "./keybindings.ts"; import * as ServerRuntimeStartup from "./serverRuntimeStartup.ts"; import * as ServerOwnership from "./serverOwnership.ts"; import * as AgentAwarenessRelay from "./relay/AgentAwarenessRelay.ts"; import { hasCloudPublicConfig } from "./cloud/publicConfig.ts"; import * as ServerSettings from "./serverSettings.ts"; import * as ManagedLimits from "./policy/managedLimits.ts"; import * as ManagedPolicy from "./policy/ManagedPolicy.ts"; import * as ProjectEnrichmentService from "./project/ProjectEnrichmentService.ts"; import * as NativeAppIconResolver from "./assets/NativeAppIconResolver.ts"; import * as AntigravityInstallation from "./provider/AntigravityInstallation.ts"; import * as CodexInstallation from "./provider/CodexInstallation.ts"; import * as ProviderInstanceRegistry from "./provider/ProviderInstanceRegistry.ts"; import * as ProviderAdapterRegistry from "./orchestration-v2/ProviderAdapterRegistry.ts"; import * as ProviderRegistry from "./provider/ProviderRegistry.ts"; import * as ProviderUsageLimitsIngestion from "./provider/ProviderUsageLimitsIngestion.ts"; import * as UsageLimitSources from "./usage/UsageLimitSources.ts"; import * as ProjectFaviconResolver from "./project/ProjectFaviconResolver.ts"; import * as T3ProjectFileLoader from "./project/T3ProjectFileLoader.ts"; import * as RepositoryIdentityResolver from "./project/RepositoryIdentityResolver.ts"; import * as WorkspaceEntries from "./workspace/WorkspaceEntries.ts"; import * as KnownWorkspaces from "./workspace/KnownWorkspaces.ts"; import * as WorkspaceFileSystem from "./workspace/WorkspaceFileSystem.ts"; import * as WorkspacePaths from "./workspace/WorkspacePaths.ts"; import * as GitVcsDriver from "./vcs/GitVcsDriver.ts"; import * as VcsDriverRegistry from "./vcs/VcsDriverRegistry.ts"; import * as VcsProjectConfig from "./vcs/VcsProjectConfig.ts"; import * as VcsProcess from "./vcs/VcsProcess.ts"; import * as VcsProvisioningService from "./vcs/VcsProvisioningService.ts"; import * as VcsStatusBroadcaster from "./vcs/VcsStatusBroadcaster.ts"; import * as ProjectCloneTracker from "./project/ProjectCloneTracker.ts"; import * as GitWorkflowService from "./git/GitWorkflowService.ts"; import * as ReviewService from "./review/ReviewService.ts"; import * as SourceControlProviderRegistry from "./sourceControl/SourceControlProviderRegistry.ts"; import * as PullRequestReadCache from "./pullRequest/PullRequestReadCache.ts"; import * as SourceControlRateLimit from "@t3tools/source-control-core/server/SourceControlRateLimit"; import * as SourceControlRepositoryService from "./sourceControl/SourceControlRepositoryService.ts"; import * as WorktreeSetupTracker from "./project/WorktreeSetupTracker.ts"; import * as Observability from "./observability/Observability.ts"; import * as HeapSnapshot from "./observability/HeapSnapshot.ts"; import * as EventLoopMonitor from "./observability/EventLoopMonitor.ts"; import * as ServerEnvironment from "./environment/ServerEnvironment.ts"; import * as DirectEndpoints from "./environment/DirectEndpoints.ts"; import * as RemoteOpenTargets from "./environment/RemoteOpenTargets.ts"; import * as AuthHttp from "./auth/http.ts"; import * as ReplayMarkers from "./auth/replayMarkers.ts"; import * as ServerSecretStore from "./auth/ServerSecretStore.ts"; import * as CodexManagedTokenBroker from "./provider/CodexManagedTokenBroker.ts"; import * as WebhookRoute from "./scheduledTasks/webhookRoute.ts"; import * as RelayDeliveryProof from "./scheduledTasks/RelayDeliveryProof.ts"; import * as HeldHooksWaker from "./relay/HeldHooksWaker.ts"; import * as McpOAuth from "./auth/McpOAuth.ts"; import * as McpOAuthHttp from "./auth/mcpOAuthHttp.ts"; import { relayHookBaseUrl, ScheduledTaskWebhookOrigin, } from "./scheduledTasks/ScheduledTaskService.ts"; import { CLOUD_ENDPOINT_RUNTIME_CONFIG, decodeRuntimeConfig, RELAY_URL_SECRET, } from "./cloud/config.ts"; import * as EnvironmentAuth from "./auth/EnvironmentAuth.ts"; import * as EnvironmentAuthPolicy from "./auth/EnvironmentAuthPolicy.ts"; import * as CloudHttp from "./cloud/http.ts"; import * as GuestHttp from "./guest/http.ts"; import * as CloudLink from "./cloud/CloudLink.ts"; import * as ConnectReachability from "./cloud/ConnectReachability.ts"; import { pendingServiceUpdateExists } from "./cloud/updateHandoff.ts"; import * as RelayTracing from "./cloud/relayTracing.ts"; import * as CloudManagedEndpointRuntime from "./cloud/ManagedEndpointRuntime.ts"; import { MANAGED_TUNNEL_FIRST_REGISTRATION_JITTER, makeManagedTunnelRecovery, managedTunnelStartupAction, retryDesiredLinkReconcile, retryManagedTunnelRegistration, } from "./cloud/managedTunnelStartup.ts"; import * as CloudCliTokenManager from "./cloud/CliTokenManager.ts"; import * as CloudCliState from "./cloud/CliState.ts"; import * as ServerSelfUpdate from "./cloud/selfUpdate.ts"; import * as DesktopAppUpdate from "./desktopUpdate/DesktopAppUpdate.ts"; import * as ServiceLauncherClient from "./cloud/serviceLauncherClient.ts"; import * as ProcessDiagnostics from "./diagnostics/ProcessDiagnostics.ts"; import * as HostResources from "./resourceTelemetry/HostResources.ts"; import * as ProcessResourceMonitor from "./diagnostics/ProcessResourceMonitor.ts"; import * as TraceDiagnostics from "./diagnostics/TraceDiagnostics.ts"; import * as TriageService from "./triage/TriageService.ts"; import * as DesktopTelemetryReceiver from "./resourceTelemetry/DesktopTelemetryReceiver.ts"; import * as NativeTelemetryClient from "./resourceTelemetry/NativeTelemetryClient.ts"; import * as ResourceAttribution from "./resourceTelemetry/ResourceAttribution.ts"; import * as ResourceMonitorBinary from "./resourceTelemetry/ResourceMonitorBinary.ts"; import * as ProcessGroupMetrics from "./resourceTelemetry/ProcessGroupMetrics.ts"; import * as ResourceTelemetry from "./resourceTelemetry/ResourceTelemetry.ts"; import * as AntigravityUsage from "./provider/Drivers/AntigravityUsage.ts"; import { MuseUsageHome } from "@t3tools/provider-muse/server"; import * as CursorAccountReader from "@t3tools/provider-cursor/server/CursorAccountReader"; import * as CursorKeychain from "@t3tools/provider-cursor/server/CursorKeychain"; import * as CursorUsageAccounts from "@t3tools/provider-cursor/server/CursorUsageAccounts"; import * as UsageService from "./usage/UsageService.ts"; import * as CodexUsageHistory from "./usage/CodexUsageHistory.ts"; import * as RuntimeLayer from "./orchestration-v2/runtimeLayer.ts"; import * as ProjectStore from "./orchestration-v2/ProjectStore.ts"; import * as ThreadSearch from "./orchestration-v2/ThreadSearch.ts"; import * as ThreadSettlementService from "./orchestration-v2/ThreadSettlementService.ts"; import * as IdleCompactionService from "./orchestration-v2/IdleCompactionService.ts"; import * as ThreadPullRequestService from "./orchestration-v2/ThreadPullRequestService.ts"; import * as RunFinalizationService from "./orchestration-v2/RunFinalizationService.ts"; import * as ProjectionMaintenance from "./orchestration-v2/ProjectionMaintenance.ts"; import * as ProjectionStoreV2 from "./orchestration-v2/ProjectionStore.ts"; import { makePersistedServerRuntimeState } from "./serverRuntimeState.ts"; import { acceptsPrivateNetworkConnection, loopbackUrlHostForAddress } from "./startupAccess.ts"; import * as OrchestrationHttp from "./orchestration-v2/http.ts"; import * as ProjectHttp from "./project/http.ts"; import * as NetService from "@t3tools/shared/Net"; import * as RelayClient from "@t3tools/shared/relayClient"; import { disableTailscaleServe, ensureTailscaleServe, readTailscaleServeRoutesBlocking, readTailscaleServeRoutesTo, readTailscaleStatus, } from "@t3tools/tailscale"; import * as ServerActivation from "./serverActivation.ts"; // Escaped MCP handoff provenance can exceed find-my-way's 100-character segment default. const HTTP_ROUTER_CONFIG = { maxParamLength: 512, } as const; // Skip Effect's default 20 s grace; WebSocket scope finalizers already close connections gracefully. const HTTP_PREEMPTIVE_SHUTDOWN_GRACE_MS = 0; const layerResourceAttribution = ResourceAttribution.layer; const layerApplicationObservability = EventLoopMonitor.layer.pipe( Layer.provideMerge(Observability.layer), Layer.provideMerge(layerResourceAttribution), ); // Share rotation state so driver loggers cannot race. const layerProviderEventLoggers = Layer.effect( ProviderEventLoggers.ProviderEventLoggers, Effect.gen(function* () { const { providerEventLogPath } = yield* ServerConfig.ServerConfig; const attribution = yield* ResourceAttribution.ResourceAttribution; const store = yield* EventNdjsonLogger.makeEventNdjsonLogStore(providerEventLogPath, { attribution, }).pipe( Effect.catch((error) => Effect.logWarning(error.message, { error }).pipe( Effect.annotateLogs({ scope: "provider-observability" }), Effect.as(undefined), ), ), ); if (!store) return ProviderEventLoggers.NoOpProviderEventLoggers; yield* Effect.addFinalizer(() => store.close()); return { native: store.logger("native"), canonical: store.logger("canonical") }; }), ); const layerPtyAdapter = NodePtyAdapter.layer; const layerServerSettings = ServerSettings.layer.pipe( Layer.provide(ServerSecretStore.layer), Layer.provideMerge(ManagedPolicy.layer), Layer.provideMerge(SqlitePersistence.layerConfig), ); const layerNativeTelemetry = NativeTelemetryClient.layer.pipe( Layer.provide(ResourceMonitorBinary.layer), ); const layerDesktopTelemetryReceiver = DesktopTelemetryReceiver.layer.pipe( Layer.provideMerge(layerServerSettings), ); const layerResourceTelemetry = ResourceTelemetry.layer.pipe( Layer.provideMerge(layerNativeTelemetry), Layer.provideMerge(layerDesktopTelemetryReceiver), ); const layerHostPowerMonitor = HostPowerMonitor.layer.pipe( Layer.provide(layerDesktopTelemetryReceiver), ); // A fresh receiver layer would open a second reader on the desktop telemetry fd. const layerDesktopAppUpdate = DesktopAppUpdate.layer.pipe( Layer.provide(layerDesktopTelemetryReceiver), ); const layerBackground = BackgroundPolicy.layer.pipe( Layer.provide(layerHostPowerMonitor), Layer.provideMerge(layerServerSettings), ); const layerUsage = UsageService.layer.pipe( Layer.provide( Layer.mergeAll( AntigravityUsage.layer, MuseUsageHome.layer, CodexUsageHistory.layer, CursorUsageAccounts.layer.pipe( Layer.provide(CursorAccountReader.layer.pipe(Layer.provide(CursorKeychain.layer))), ), ).pipe(Layer.provide(ProviderHostLive.layer.pipe(Layer.provide(ServerSecretStore.layer)))), ), Layer.provide(layerServerSettings), ); const layerResourceDiagnostics = Layer.mergeAll( HostResources.layer, layerResourceTelemetry, ProcessDiagnostics.layer.pipe(Layer.provide(layerResourceTelemetry)), ProcessResourceMonitor.layer.pipe(Layer.provide(layerResourceTelemetry)), ProcessGroupMetrics.layer.pipe(Layer.provide(layerResourceTelemetry)), ); const layerRelayClient = Layer.unwrap( Effect.gen(function* () { const config = yield* ServerConfig.ServerConfig; const policy = yield* ManagedPolicy.ManagedPolicy; const layerCloudflared = RelayClient.layerCloudflared({ baseDir: config.baseDir }); if (ManagedLimits.allowsConnect(policy)) return layerCloudflared; // The connector only carries T3 Connect, so a policy without Connect never installs one. const refused = Effect.fn("RelayClient.installRefusedByPolicy")(function* () { return yield* new RelayClient.RelayClientInstallError({ reason: "managed_by_policy", message: ManagedLimits.refuseConnect(policy).message, }); }); return Layer.effect( RelayClient.RelayClient, Effect.gen(function* () { const relayClient = yield* RelayClient.RelayClient; return RelayClient.RelayClient.of({ ...relayClient, install: refused(), installWithProgress: refused, }); }), ).pipe(Layer.provide(layerCloudflared)); }), ).pipe(Layer.provide(ManagedPolicy.layer)); const layerHttpServer = Layer.unwrap( Effect.gen(function* () { const config = yield* ServerConfig.ServerConfig; // Before binding: a host the policy does not allow must never listen, not even briefly. const policy = yield* ManagedPolicy.ManagedPolicy; const bindHost = yield* ManagedLimits.checkServerReachability(policy, { authPolicy: EnvironmentAuthPolicy.resolveServerAuthPolicy(config), host: config.host, tailscaleServeEnabled: config.tailscaleServeEnabled, privateNetworkOnly: config.privateNetworkOnly, }); yield* ManagedLimits.closeTailscaleServeTo(policy, { host: bindHost, port: config.port }); return NodeHttpServer.layer( () => { const server = rejectRequestsUntilServing( guardHttpResponseWriteErrors(NodeHttp.createServer()), ); if (config.privateNetworkOnly) { server.on("connection", (socket) => { if (!acceptsPrivateNetworkConnection(socket)) { socket.destroy(); } }); } return server; }, { host: bindHost, port: config.port, gracefulShutdownTimeout: HTTP_PREEMPTIVE_SHUTDOWN_GRACE_MS, // Context takeover stays enabled (ws default) so the compression // window is shared across frames — that also makes small frames cheap // to compress, so no size threshold is set (ws only honors // `threshold` when context takeover is disabled). websocket: { perMessageDeflate: true }, }, ); }), ).pipe(Layer.provide(ManagedPolicy.layer)); const layerPlatformServices = DocumentText.layer.pipe( Layer.provideMerge(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer)), ); const layerPersistence = Layer.empty.pipe(Layer.provideMerge(SqlitePersistence.layerConfig)); const layerVcsDriverRegistry = VcsDriverRegistry.layer.pipe(Layer.provide(VcsProjectConfig.layer)); const layerSourceControlProviderRegistry = SourceControlProviderRegistry.layer.pipe( Layer.provideMerge(SourceControlBuiltInDrivers.layer), Layer.provideMerge(GitVcsDriver.layer), Layer.provideMerge(layerVcsDriverRegistry), ); const layerRepositoryIdentityResolver = Layer.effect( RepositoryIdentityResolver.RepositoryIdentityResolver, Effect.gen(function* () { const registry = yield* SourceControlProviderRegistry.SourceControlProviderRegistry; return yield* RepositoryIdentityResolver.make({ refine: Effect.fn(function* (identity: RepositoryIdentity) { for (const { kind } of BUILT_IN_SOURCE_CONTROL_DRIVER_LIST) { const provider = yield* registry.get(kind); if (provider.refineRepositoryIdentity === undefined) continue; const refined = yield* provider.refineRepositoryIdentity({ identity, resolveContext: (input) => registry.resolveHandle(input).pipe(Effect.map((handle) => handle.context)), }); if (refined !== identity) return refined; } return identity; }), }); }), ).pipe(Layer.provide(layerSourceControlProviderRegistry), Layer.provide(ProcessRunner.layer)); const layerPullRequestService = PullRequestService.layer.pipe( Layer.provide(PullRequestProviderRegistry.layer), Layer.provide(PullRequestFilesViewed.layer), Layer.provide(PullRequestReadCache.layer), Layer.provide(layerSourceControlProviderRegistry), Layer.provide(SourceControlRateLimit.layer), ); const layerGitManager = GitManager.layer.pipe( Layer.provide(Layer.merge(ProjectionStoreV2.layer, ProjectStore.layer)), Layer.provideMerge(RuntimeLayer.layerProjectSetupScriptRunner), Layer.provideMerge(WorktreeSetupTracker.layer), Layer.provideMerge(GitVcsDriver.layer), Layer.provideMerge(layerSourceControlProviderRegistry), Layer.provideMerge(TextGeneration.layer.pipe(Layer.provide(layerSourceControlProviderRegistry))), ); const layerGit = Layer.empty.pipe( Layer.provideMerge(layerGitManager), Layer.provideMerge(GitVcsDriver.layer), ); const layerGitWorkflow = GitWorkflowService.layer.pipe( Layer.provideMerge(layerVcsDriverRegistry), Layer.provideMerge(layerGit), ); const layerSourceControlRepositoryService = SourceControlRepositoryService.layer.pipe( Layer.provideMerge(GitVcsDriver.layer), Layer.provideMerge(layerSourceControlProviderRegistry), ); const layerProjectCloneTracker = ProjectCloneTracker.layer.pipe( Layer.provide(layerSourceControlRepositoryService), ); const layerKnownWorkspaces = KnownWorkspaces.layer.pipe( Layer.provide(ProjectStore.layer), Layer.provide(GitVcsDriver.layer), ); const layerReview = ReviewService.layer.pipe( Layer.provideMerge(layerKnownWorkspaces), Layer.provideMerge(GitVcsDriver.layer), Layer.provideMerge(layerVcsDriverRegistry), ); const layerVcs = Layer.empty.pipe( Layer.provideMerge(VcsProjectConfig.layer), Layer.provideMerge(layerVcsDriverRegistry), Layer.provideMerge(VcsProvisioningService.layer.pipe(Layer.provide(layerVcsDriverRegistry))), Layer.provideMerge(layerGitWorkflow), Layer.provideMerge(layerReview), Layer.provideMerge(layerSourceControlRepositoryService), Layer.provideMerge( SourceControlSignIn.layer.pipe(Layer.provide(layerSourceControlProviderRegistry)), ), Layer.provideMerge(layerProjectCloneTracker), Layer.provideMerge( VcsStatusBroadcaster.layer.pipe( Layer.provide(layerGitWorkflow), Layer.provide(VcsStatusBroadcaster.layerAutomaticFetchInterval), // The orchestration runtime also consumes the broadcaster (run // finalization), so the policy cannot read the store from the runtime's // output. Layer.provide( VcsStatusBroadcaster.layerAutoPullPolicy.pipe(Layer.provide(ProjectStore.layer)), ), ), ), ); const layerCheckpointStore = CheckpointStore.layer.pipe(Layer.provide(layerVcsDriverRegistry)); const layerPortScanner = PortScanner.layer.pipe(Layer.provide(ProcessRunner.layer)); const layerTerminal = TerminalManager.layer.pipe( Layer.provide(layerPtyAdapter), Layer.provide(layerPortScanner), Layer.provide(layerNativeTelemetry), ); const layerPreview = Layer.empty.pipe( Layer.provideMerge(PreviewManager.layer), Layer.provideMerge(layerPortScanner), ); const layerDevice = DeviceService.layer.pipe( Layer.provide(layerServerSettings), Layer.provide(ProcessRunner.layer), Layer.provide(NetService.layer), ); const layerWorkspaceEntries = WorkspaceEntries.layer.pipe(Layer.provide(WorkspacePaths.layer)); const layerWorkspaceFileSystem = WorkspaceFileSystem.layer.pipe( Layer.provide(WorkspacePaths.layer), Layer.provide(layerWorkspaceEntries), Layer.provide(layerKnownWorkspaces), ); const layerWorkspace = Layer.mergeAll( WorkspacePaths.layer, layerWorkspaceEntries, layerWorkspaceFileSystem, ); const layerProjectFaviconResolver = ProjectFaviconResolver.layer.pipe( Layer.provide(WorkspacePaths.layer), Layer.provide(T3ProjectFileLoader.layer), ); const layerServerEnvironment = ServerEnvironment.layer.pipe(Layer.provide(ServerSecretStore.layer)); const layerAuth = EnvironmentAuth.layer.pipe( Layer.provideMerge(layerPersistence), Layer.provide(layerServerEnvironment), Layer.provide(ServerSecretStore.layer), ); const layerCloudManagedEndpointRuntime = Layer.mergeAll( layerRelayClient, CloudManagedEndpointRuntime.layer.pipe( Layer.provide(ServerSecretStore.layer), Layer.provide(layerRelayClient), ), ); const layerScheduledTaskWebhookOrigin = Layer.effect( ScheduledTaskWebhookOrigin, Effect.gen(function* () { const secrets = yield* ServerSecretStore.ServerSecretStore; return Effect.gen(function* () { const [relayUrl, tunnelConfig] = yield* Effect.all([ secrets.get(RELAY_URL_SECRET), secrets.get(CLOUD_ENDPOINT_RUNTIME_CONFIG), ]).pipe(Effect.orElseSucceed(() => [Option.none(), Option.none()] as const)); if (Option.isNone(relayUrl) || Option.isNone(tunnelConfig)) { return { relayHookBaseUrl: null }; } const config = decodeRuntimeConfig(new TextDecoder().decode(tunnelConfig.value)); return { relayHookBaseUrl: relayHookBaseUrl({ relayUrl: new TextDecoder().decode(relayUrl.value), tunnelName: Option.isSome(config) ? config.value.tunnelName : undefined, }), }; }); }), ); const layerOrchestrationV2Runtime = RuntimeLayer.layerProduction.pipe( Layer.provide(layerScheduledTaskWebhookOrigin), Layer.provide(ProviderUsageAnalytics.layer), Layer.provide(layerCheckpointStore), Layer.provide(layerGitWorkflow), Layer.provide( RunFinalizationService.layerObserver.pipe( Layer.provide(ProjectionStoreV2.layer), Layer.provide(layerPullRequestService), Layer.provide(RuntimeLayer.layerProjectService), ), ), ); const layerOrchestrationApplication = Layer.merge( CheckpointDiffQuery.layer, NativeChildWorkQuery.layer, ).pipe(Layer.provideMerge(layerCheckpointStore), Layer.provideMerge(layerOrchestrationV2Runtime)); const layerThreadSettlementWorker = Layer.effectDiscard( ThreadSettlementService.make.pipe(Effect.flatMap((service) => service.start())), ).pipe(Layer.provide(layerPullRequestService), Layer.provide(ProjectionStoreV2.layer)); const layerIdleCompactionWorker = Layer.effectDiscard( IdleCompactionService.make.pipe(Effect.flatMap((service) => service.start())), ).pipe(Layer.provide(ProjectionStoreV2.layer)); const layerThreadPullRequestWorker = Layer.effectDiscard( ThreadPullRequestService.make.pipe(Effect.flatMap((service) => service.start())), ).pipe(Layer.provide(layerPullRequestService)); const layerProviderInstallationRefresh = Layer.effectDiscard( Effect.gen(function* () { const antigravity = yield* AntigravityInstallation.AntigravityInstallation; const codex = yield* CodexInstallation.CodexInstallation; const instances = yield* ProviderInstanceRegistry.ProviderInstanceRegistry; const providers = yield* ProviderRegistry.ProviderRegistry; yield* Stream.merge( antigravity.changes.pipe( Stream.changesWith((a, b) => a.installedVersion === b.installedVersion), Stream.drop(1), ), codex.changes.pipe( Stream.changesWith((a, b) => a.installedVersion === b.installedVersion), Stream.drop(1), ), ).pipe( Stream.runForEach((state) => instances.listInstances.pipe( Effect.flatMap((entries) => Effect.forEach( entries.filter((instance) => instance.driverKind === state.driver), (instance) => providers.refreshInstance(instance.instanceId), { discard: true }, ), ), ), ), Effect.forkScoped, ); }), ); const layerRuntimeCoreDependenciesBase = Layer.mergeAll( AgentAwarenessRelay.layer, HeldHooksWaker.layer, layerThreadSettlementWorker, layerIdleCompactionWorker, StorageCleanup.layer.pipe(Layer.provide(ProjectionStoreV2.layer)), DatabaseStorage.layer.pipe(Layer.provide(ProjectionMaintenance.layer)), layerThreadPullRequestWorker, DelegatedTaskAnalytics.layer, Layer.effectDiscard( Effect.gen(function* () { const service = yield* PullRequestSyncReactor.PullRequestSyncReactor; yield* service.start(); }), ).pipe( Layer.provideMerge(PullRequestSyncReactor.layer), Layer.provide(layerPullRequestService), Layer.provide(ProjectionStoreV2.layer), ), Layer.effectDiscard( Effect.gen(function* () { const service = yield* PullRequestWatchReactor.PullRequestWatchReactor; yield* service.start(); }), ).pipe( Layer.provide(PullRequestWatchReactor.layer), Layer.provide(layerPullRequestService), Layer.provide(ProjectionStoreV2.layer), ), Layer.effectDiscard( Effect.gen(function* () { const service = yield* DelegatedTaskQuestionReactor.DelegatedTaskQuestionReactor; yield* service.start(); }), ).pipe(Layer.provide(DelegatedTaskQuestionReactor.layer), Layer.provide(ProjectionStoreV2.layer)), ProviderUsageLimitsIngestion.layer, layerProviderInstallationRefresh, ReplayMarkers.layer, Layer.effectDiscard(ProjectSettingsOverrideSweep.sweep), ).pipe( Layer.provideMerge(layerOrchestrationApplication), Layer.provideMerge(RuntimeLayer.layerEventInfrastructure), Layer.provideMerge(Layer.merge(ProjectStore.layer, ThreadSearch.layer)), Layer.provideMerge(SecretResolver.layer), Layer.provideMerge(layerServerSettings), Layer.provideMerge(layerSourceControlProviderRegistry), Layer.provideMerge(layerGit), Layer.provideMerge(layerVcs), Layer.provideMerge(Layer.mergeAll(layerTerminal, layerPreview, layerDevice)), Layer.provideMerge(layerPersistence), Layer.provideMerge( Layer.mergeAll(Keybindings.layer, EnvironmentTheme.layer, UsageLimitSources.layer), ), Layer.provideMerge(ProviderRegistry.layer), Layer.provideMerge(ProviderInstanceRegistryHydration.layer), // Provider hydration builds the Claude runner, which reports agents to the same scanner the // terminal and preview layers share. Layer.provideMerge(layerPortScanner), Layer.provideMerge( Layer.mergeAll( AntigravityInstallation.AntigravityInstallation.layer, CodexInstallation.CodexInstallation.layer, ), ), ); const layerRuntimeCoreDependencies = layerRuntimeCoreDependenciesBase.pipe( Layer.provideMerge(layerPtyAdapter), Layer.provideMerge(AcpRegistrySupport.layerFromHost.pipe(Layer.provide(ProviderHostLive.layer))), Layer.provideMerge( Layer.mergeAll( layerProviderEventLoggers, ModelManifest.layerModelCatalog.pipe(Layer.provideMerge(ModelManifest.layer)), ResetCreditCoordinator.layer, ProviderLatestVersions.layer, McpProviderSessions.layer, ), ), Layer.provideMerge( OpenCodeRuntime.layer.pipe( Layer.provide( Layer.unwrap( Effect.gen(function* () { const config = yield* ServerConfig.ServerConfig; return OpenCodeServerLedger.layer({ stateDir: config.stateDir }); }), ), ), ), ), Layer.provideMerge(layerWorkspace), Layer.provideMerge(ProjectEnrichmentService.layer), Layer.provideMerge(Layer.mergeAll(NativeAppIconResolver.layer, layerProjectFaviconResolver)), Layer.provideMerge(layerRepositoryIdentityResolver), Layer.provideMerge(CodexManagedTokenBroker.layer), Layer.provideMerge(layerServerEnvironment), Layer.provideMerge(layerAuth), Layer.provideMerge(Layer.mergeAll(AssetSigner.layer, EnvironmentKeys.layer)), Layer.provideMerge(ServerSecretStore.layer), Layer.provideMerge( Layer.mergeAll( CloudCliTokenManager.layer.pipe( Layer.provide(ServerSecretStore.layer), Layer.provide(ExternalLauncher.layer), ), layerCloudManagedEndpointRuntime, ), ), ); const layerRuntimeDependencies = layerRuntimeCoreDependencies.pipe( Layer.provideMerge(layerUsage), Layer.provideMerge(layerBackground), Layer.provideMerge(layerResourceDiagnostics), Layer.provideMerge(TraceDiagnostics.layer), Layer.provideMerge(TriageService.layer.pipe(Layer.provide(GitVcsDriver.layer))), // Layers memoize by reference, so this is the same policy the settings layer reads. Layer.provideMerge(AnalyticsService.layer.pipe(Layer.provide(ManagedPolicy.layer))), Layer.provideMerge(ExternalLauncher.layer), Layer.provideMerge(RemoteOpenTargets.layer), Layer.provideMerge(DirectEndpoints.layer), Layer.provideMerge(ServerLifecycleEvents.layer), Layer.provide(NetService.layer), ); const layerCommandReadiness = HttpRouter.middleware( (httpEffect) => Effect.flatMap(ServerRuntimeStartup.ServerRuntimeStartup, (startup) => startup.awaitCommandReady.pipe(Effect.orDie, Effect.andThen(httpEffect)), ), { global: true }, ); const layerMakeRoutes = Layer.mergeAll( Layer.mergeAll( HttpApiBuilder.layer(EnvironmentHttpApi).pipe( Layer.provide(AuthHttp.layer), Layer.provide(McpOAuthHttp.layer.pipe(Layer.provide(McpOAuth.layer))), Layer.provide(CloudHttp.layer), Layer.provide(OrchestrationHttp.layer), Layer.provide(PullRequestHttp.layer), Layer.provide(ProjectHttp.layer), Layer.provide(speechHttpApiLayer), Layer.provide(ServerHttp.layerServerEnvironmentHttpApi), Layer.provide(WebhookRoute.layer.pipe(Layer.provide(RelayDeliveryProof.layer))), Layer.provide(AuthHttp.layerAuthenticatedAuth), ), ServerHttp.layerOtlpTracesProxyRoute, ServerHttp.layerAssetRoute, ServerHttp.layerAttachmentUploadRoute, GuestHttp.layer, DeviceHubProxy.layer, ServerBrowserStream.routeLayer, ServerHttp.layerStaticAndDevRoute, Ws.layer, speechStreamRouteLayer, ), McpHttpServer.layer.pipe( Layer.provide(ProviderAdapterRegistry.layerFromProviderInstanceRegistry), Layer.provide(McpOAuth.layerMcpClientAuthenticator), ), // Follows delegated tasks running in linked environments, including after a restart. Layer.effectDiscard( RemoteDelegation.RemoteDelegation.pipe(Effect.flatMap((remote) => remote.start())), ), ).pipe( Layer.provide( PullRequestReviewGuideService.layer.pipe(Layer.provide(PullRequestReviewGuides.layer)), ), // delegate_task to a linked environment, from /mcp and the follower above. Layer.provide(RemoteDelegation.layer.pipe(Layer.provide(ProjectionStoreV2.layer))), // Links agents ask for: shown in a thread from /mcp, answered over WebSocket. Layer.provide(PeerLinkRequests.layer), // Share the service so HTTP/WS clients single-flight reads and invalidate each other's cached patches. Layer.provide(layerPullRequestService), // The same activity instance RunExecutionService reports to, by layer memoization. Layer.provide( ServerBrowser.layer.pipe( Layer.provide(Layer.merge(DesktopBrowserChannel.layer, PreviewAgentActivity.layer)), ), ), Layer.provide(PreviewBrowser.layer), // Links to other environments, shared by Settings (WebSocket) and agents (/mcp). Layer.provide( PeerForwarding.layer.pipe( Layer.provideMerge(PeerMcpClient.layer), Layer.provideMerge(PeerLinks.layer), ), ), Layer.provide( SpeechService.layer.pipe( Layer.provide(layerServerSettings), Layer.provide(SpeechModelStore.layer), ), ), Layer.provide(layerServerSettings), Layer.provide(PreviewAutomationBroker.layer), Layer.provide(ServerSelfUpdate.layer.pipe(Layer.provide(layerDesktopAppUpdate))), Layer.provide(layerCommandReadiness), Layer.provide(ServerHttp.layerBrowserApiCors), Layer.provide(ServerHttp.layerHttpCompression), ); const layerMakeServer = Layer.unwrap( Effect.gen(function* () { const config = yield* ServerConfig.ServerConfig; // Before anything opens the database: one server per T3 home. const ownership = yield* ServerOwnership.acquireServerOwnership(config.serverRuntimeStatePath); const activation = yield* Deferred.make(); const awaitActivation = Deferred.await(activation); const layerActivation = Layer.succeed(ServerActivation.ServerActivation, awaitActivation); const runtimeStateParked = yield* Deferred.make(); const tailscaleParked = yield* Deferred.make(); const cloudLinkParked = yield* Deferred.make(); const routesReady = yield* Deferred.make(); const layerLauncher = ServiceLauncherClient.layer; yield* fixPath({ shellEnvironmentPrepared: config.shellEnvironmentPrepared }); const layerHttpListening = Layer.effectDiscard( Effect.gen(function* () { yield* HttpServer.HttpServer; const startup = yield* ServerRuntimeStartup.ServerRuntimeStartup; yield* startup.markHttpListening; }), ); const layerRuntimeState = Layer.effectDiscard( Effect.gen(function* () { yield* Deferred.succeed(runtimeStateParked, undefined).pipe(Effect.orDie); yield* awaitActivation; const server = yield* HttpServer.HttpServer; const address = server.address; if (typeof address === "string" || !("port" in address)) { return; } const launcher = yield* ServiceLauncherClient.ServiceLauncherClient; const state = yield* makePersistedServerRuntimeState({ config, port: address.port, serviceManaged: launcher.managed, managedPolicy: yield* ManagedPolicy.loadedPolicy(yield* ManagedPolicy.ManagedPolicy), }); yield* ownership .publish(state) .pipe( Effect.catchCause((cause) => Effect.logWarning("Failed to persist server runtime state", { cause }), ), ); }), ); const layerTailscaleServe = config.tailscaleServeEnabled ? Layer.effectDiscard( Effect.acquireRelease( Effect.gen(function* () { yield* Deferred.succeed(tailscaleParked, undefined).pipe(Effect.orDie); yield* awaitActivation; const server = yield* HttpServer.HttpServer; const address = server.address; if (typeof address === "string" || !("port" in address)) { return null; } const localPort = address.port; const localHost = loopbackUrlHostForAddress(address); // Serving the port again would replace its root handler, so leave a port that // already serves something else alone, or one whose routes cannot be read. const blocking = yield* readTailscaleServeRoutesBlocking({ servePort: config.tailscaleServePort, target: { host: localHost.replace(/^\[|\]$/gu, ""), port: localPort }, }).pipe(Effect.option); if (Option.isNone(blocking) || blocking.value.length > 0) { yield* Effect.logWarning( `Tailscale Serve left off: HTTPS port ${String(config.tailscaleServePort)} ${Option.isNone(blocking) ? "could not be checked for other routes" : "already serves other routes on this machine; choose another port"}`, { servePort: config.tailscaleServePort, ...(Option.isSome(blocking) ? { routes: blocking.value } : {}), }, ); return null; } return yield* ensureTailscaleServe({ localPort, servePort: config.tailscaleServePort, localHost, }).pipe( Effect.as({ localPort, localHost: localHost.replace(/^\[|\]$/gu, ""), servePort: config.tailscaleServePort, }), Effect.tap(() => Effect.logInfo("Tailscale Serve configured", { localPort, servePort: config.tailscaleServePort, }), ), Effect.catch((cause) => Effect.logWarning("Failed to configure Tailscale Serve", { cause, localPort, servePort: config.tailscaleServePort, }).pipe(Effect.as(null)), ), ); }), (configured) => configured ? Effect.all( [ readTailscaleServeRoutesTo({ host: configured.localHost, port: configured.localPort, }), readTailscaleStatus, ], { concurrency: 2 }, ).pipe( // Another service may hold the root route by now, or it may sit under a // former name, where `off` would act on the current one; only ours goes. Effect.map(([routes, status]) => routes.some( (route) => route.servePort === configured.servePort && route.mount === "/" && route.owner === undefined && route.ambiguous === undefined && route.host?.toLowerCase() === status.magicDnsName?.toLowerCase(), ), ), Effect.orElseSucceed(() => false), Effect.flatMap((ours) => ours ? disableTailscaleServe({ servePort: configured.servePort }).pipe( Effect.tap(() => Effect.logInfo("Tailscale Serve disabled", { servePort: configured.servePort, }), ), ) : Effect.logInfo( "Tailscale Serve left on; its root route is not known to be ours", { servePort: configured.servePort, }, ), ), Effect.catch((cause) => Effect.logWarning("Failed to disable Tailscale Serve", { cause, servePort: configured.servePort, }), ), ) : Effect.void, ), ) : Layer.empty; const layerCloudDesiredLinkReconcile = Layer.effectDiscard( Effect.gen(function* () { const cloudLink = yield* CloudLink.CloudLink; // CloudLink unlinks on startup when the policy turns Connect off; nothing to restore. if (!ManagedLimits.allowsConnect(yield* ManagedPolicy.ManagedPolicy)) { yield* Deferred.succeed(cloudLinkParked, undefined).pipe(Effect.orDie); return; } const releaseManagedTunnel = cloudLink.releaseManagedTunnelOnShutdown().pipe( Effect.timeout("10 seconds"), Effect.tap((released) => released ? Effect.logInfo("Released the managed tunnel on shutdown") : Effect.void, ), Effect.catchCause((cause) => Effect.logWarning( "Failed to release the managed tunnel on shutdown; the next link reuses it", { errors: Cause.prettyErrors(cause).map((error) => error.message) }, ), ), Effect.asVoid, ); // Trials own cleanup immediately after the old server exits, retaining tunnels for commit/rollback unless explicitly stopped. // Other runtimes wait for activation so failed standbys cannot tear down active tunnels. const cleanupBeforeActivation = yield* pendingServiceUpdateExists; if (cleanupBeforeActivation) { yield* Effect.addFinalizer(() => releaseManagedTunnel); } yield* ServerActivation.forkParked( Effect.gen(function* () { if (!cleanupBeforeActivation) { yield* Effect.addFinalizer(() => releaseManagedTunnel); } const server = yield* HttpServer.HttpServer; const address = server.address; if (typeof address === "string" || !("port" in address)) return; const localOrigin = `http://${loopbackUrlHostForAddress(address)}:${address.port}`; const endpointRuntime = yield* CloudManagedEndpointRuntime.CloudManagedEndpointRuntime; const runManagedTunnelRecovery = yield* makeManagedTunnelRecovery({ recover: (config: RelayManagedEndpointRuntimeConfig) => cloudLink.recoverManagedTunnel(localOrigin, config, { retryRuntimeFailures: true, }), isRetryable: (error) => CloudLink.shouldRetryCloudLink(error) && error._tag !== "CloudLinkEndpointUnavailableError", }); const recoverManagedTunnel = (config: RelayManagedEndpointRuntimeConfig) => runManagedTunnelRecovery(config).pipe( Effect.tap((recovered) => recovered ? Effect.logInfo("T3 Connect managed tunnel recovered") : Effect.void, ), Effect.catchCause((cause) => Cause.hasInterrupts(cause) ? Effect.interrupt : Effect.logWarning("Failed to recover the T3 Connect managed tunnel", { cause, }), ), ); yield* endpointRuntime.recoveryRequests.pipe( Stream.runForEach(recoverManagedTunnel), Effect.forkScoped, ); const wantsCliLink = hasCloudPublicConfig ? yield* CloudCliState.readCliDesiredCloudLink.pipe( Effect.catch((cause) => Effect.logWarning("Failed to read the desired T3 Connect link", { cause }).pipe( Effect.as(false), ), ), ) : false; // Recover reads so this fiber still registers and consumes recovery requests. const desiredCliLinkMode = wantsCliLink ? yield* CloudCliState.readCliDesiredLinkMode.pipe( Effect.catch((cause) => Effect.logWarning("Failed to read the desired T3 Connect link mode", { cause, }).pipe(Effect.as("managed" as const)), ), ) : null; // Publish-only links must not expose the host through old managed configs. const startedConfirmed = desiredCliLinkMode === "publish_only" ? false : yield* cloudLink.startManagedTunnelIfOriginConfirmed(localOrigin).pipe( Effect.catch((cause) => Effect.logWarning("Failed to start the confirmed T3 Connect tunnel", { cause, }).pipe(Effect.as(false)), ), ); const startStoredManagedTunnel = cloudLink .startManagedTunnelIfOriginConfirmed(localOrigin, { requireConfirmedOrigin: false, }) .pipe( Effect.tap((started) => started ? Effect.logWarning( "T3 Connect started the stored tunnel without relay confirmation", ) : Effect.void, ), Effect.catch((cause) => Effect.logWarning("Failed to start the stored T3 Connect tunnel", { cause }), ), Effect.asVoid, ); const registerManagedTunnel = retryManagedTunnelRegistration( cloudLink.registerManagedTunnelRecovery(localOrigin, { retryRuntimeFailures: true, }), (error) => CloudLink.shouldRetryCloudLink(error) && error._tag !== "CloudLinkEndpointUnavailableError", startedConfirmed ? Effect.void : startStoredManagedTunnel, ).pipe( Effect.tap((result) => result.status === "ready" ? Effect.logInfo("T3 Connect managed tunnel recovery registered") : Effect.void, ), Effect.catchCause((cause) => Cause.hasInterrupts(cause) ? Effect.interrupt : Effect.logWarning("Failed to register T3 Connect managed tunnel recovery", { cause, }).pipe(Effect.as({ status: "unavailable" as const })), ), ); // Jitter registrations so update waves do not hit the relay simultaneously. if (!startedConfirmed && desiredCliLinkMode !== "publish_only") { const jitter = yield* Random.nextIntBetween( 0, Duration.toMillis(MANAGED_TUNNEL_FIRST_REGISTRATION_JITTER), ); yield* Effect.sleep(Duration.millis(jitter)); } const registration = desiredCliLinkMode === "publish_only" ? { status: "not_linked" as const } : yield* registerManagedTunnel; if (registration.status === "unavailable" && !startedConfirmed) { yield* startStoredManagedTunnel; } const startupAction = managedTunnelStartupAction({ wantsCliLink, registration }); if (startupAction.action === "request_recovery") { yield* endpointRuntime.requestRecovery(startupAction.config); } if (startupAction.action === "reconcile_link") { const reconciledMode = yield* cloudLink .reconcileDesiredLinkIfStillDesired(localOrigin) .pipe( (reconcile) => retryDesiredLinkReconcile(reconcile, CloudLink.shouldRetryCloudLink, (cause) => Effect.logWarning( "T3 Connect relay is still unavailable; retrying the desired link in the background", { cause }, ), ), Effect.tap((mode) => mode === null ? Effect.void : Effect.logInfo("T3 Connect desired link reconciled on startup"), ), Effect.catch((cause) => Effect.logWarning("Failed to reconcile T3 Connect desired link on startup", { cause, }).pipe(Effect.as(null)), ), ); if (reconciledMode === "managed") { const afterReconcile = yield* registerManagedTunnel; if (afterReconcile.status === "recovery_required") { yield* endpointRuntime.requestRecovery(afterReconcile.config); } } } }), ); yield* Deferred.succeed(cloudLinkParked, undefined).pipe(Effect.orDie); }), ); const layerRuntimeServices = ServerRuntimeStartup.layerWithOptions({ activate: Deferred.succeed(activation, undefined).pipe(Effect.asVoid), abort: (error) => Deferred.die(activation, error).pipe(Effect.asVoid), awaitAuxiliaryParked: Effect.all( [ Deferred.await(runtimeStateParked), Deferred.await(cloudLinkParked), Deferred.await(routesReady), ...(config.tailscaleServeEnabled ? [Deferred.await(tailscaleParked)] : []), ], { concurrency: "unbounded" }, ).pipe(Effect.asVoid), }).pipe(Layer.provideMerge(layerRuntimeDependencies), Layer.provide(layerLauncher)); const layerRoutes = HttpRouter.serve(layerMakeRoutes.pipe(Layer.provide(layerLauncher)), { disableLogger: !config.logWebSocketEvents, routerConfig: HTTP_ROUTER_CONFIG, }).pipe( withUntracedRequests, Layer.tap(() => Deferred.succeed(routesReady, undefined).pipe(Effect.orDie)), ); const layerServerApplication = Layer.mergeAll( layerRoutes, layerHttpListening, layerRuntimeState.pipe(Layer.provide(layerLauncher)), layerTailscaleServe, layerCloudDesiredLinkReconcile, HeapSnapshot.layer, ); return layerServerApplication.pipe( Layer.provide(CloudLink.layer.pipe(Layer.provideMerge(ConnectReachability.layer))), Layer.provideMerge(layerRuntimeServices), Layer.provideMerge( McpSessionRegistry.layer.pipe( Layer.provide(ServerEnvironment.layer.pipe(Layer.provide(ServerSecretStore.layer))), ), ), Layer.provide(layerActivation), Layer.provideMerge( RelayTracing.layerServerRelayBroker.pipe(Layer.provide(ManagedPolicy.layer)), ), Layer.provideMerge(layerHttpServer), Layer.provide(layerApplicationObservability), Layer.provideMerge(FetchHttpClient.layer), Layer.provide(VcsProcess.layer), Layer.provideMerge(AgentScopeLive.layer), Layer.provideMerge(layerPlatformServices), ); }), ).pipe(Layer.provide(ProcessRunner.layer)); export const runServer = Layer.launch(layerMakeServer);