chore(deps): upgrade Effect to 4.1.2 and alchemy to beta.85#26833

Effect 4.1 is out (release notes). This PR moves every Effect package from 4.0.5 to 4.1.2 and alchemy from beta.84 to beta.85, and fixes everything 4.1 breaks. Two of those breaks are runtime regressions that the type checker does not catch.

Runtime regressions fixed

• TLS proxies. HttpServerRequest.toURL no longer reads X-Forwarded-Proto. Behind Tailscale Serve or a tunnel, MCP OAuth metadata would advertise http://, https:// resources would be refused (invalid_target), and DPoP htu checks would fail. A new requestUrl helper (apps/server/src/requestUrl.ts) keeps the 4.0 behavior, and every server toURL call goes through it. The existing McpOAuth tests caught this.
• PR cache growth. Persistence now stores keys as <storeId>:<key>, which KeyValueStore.layerFileSystem writes to disk as pr-v2%3A<hex>. The PullRequestReadCache cleanup regex no longer matched those files, so the cache directory would have grown without bound. The regex now matches both formats, and a new regression test fails without the fix.

alchemy

alchemy beta.85 ships Effect 4.1 support (alchemy-run/alchemy#2754), so patches/alchemy@*.patch is gone. beta.85 moved alchemy/Test/Vitest into the new @alchemy.run/test package. The relay now imports it from there, and patches/@alchemy.run__test@2.0.0-beta.85.patch carries the vitest → vite-plus/test swap that the old alchemy patch made. @distilled.cloud/* moves to rc.18 to match alchemy.

API migration

• Crypto. effect/Crypto became effect/crypto/SecureRandom and effect/crypto/Digest. Neither can fail, so some dead orDie/mapError handling is gone. Crypto is no longer part of NodeServices.layer, so the server, CLI, desktop and scripts provide NodeCrypto.layer explicitly. Web and relay use the WebCrypto layers. Mobile keeps an Expo-backed layer because Hermes has no SubtleCrypto.
• MCP. Tool dependencies are now request-level McpRequest<"Requires", S> markers. toolkitRegistration discharges the handler services with a local McpServer.middleware. McpInvocationContext reaches the existing HTTP auth middleware through layerHttp({ registrations }), which removes the unsafe type assertion. Tests use layerInProcessMcpServer, which is exported from McpHttpServer.ts because the no-raw-mcp-registration lint rule keeps McpServer out of testkits.
• Smaller changes.
  • NodeSocket.NodeWS moved to @effect/platform-node/NodeWS.
  • SqlClient.make needs a driver ("node:sqlite").
  • ChildProcess args are string | Redacted.
  • Server request methods are typed string; DeviceHubProxy returns 405 for unknown ones.
  • sql.insert takes a non-empty array.
  • Terminal needs size.

An audit of the other 4.1 behavior changes found nothing else affected: ChildProcess shell-syntax rejection, stream chunkSize, FetchHttpClient stream bodies, mixed-version RPC framing and serialization, and sql.in([]). One thing worth knowing: on Windows, realPath now uses fs.realpath.native, so mapped drives resolve to UNC paths.

Verification

• Typecheck is clean in all 40 packages, including web and desktop.
• The relay passes all 303 of its tests on alchemy beta.85 with no alchemy patch, and the alchemy CLI loads.
• vp run check:changed: format, lint, knip and graphql pass, and 4,795 of 4,801 tests in 207 files pass. The 6 failures come from macOS filesystem behavior, not this change:
  • UsageService (2), ServerEnvironment (1) and GitVcsDriverCore's short-worktree-folder test (1) fail on the /var vs /private/var realpath. The first three fail the same way on clean main on this Mac.
  • The 2 DesktopLinuxUrlHandler theme-icon tests write com.t3tools.T3Code.png and com.t3tools.t3code.png side by side, which a case-insensitive APFS volume cannot hold. They cover Linux-only behavior.

Built with Claude Opus 5.5 in Claude Code (T3 Code).

🤖 Generated with Claude Code