chore(deps): upgrade Effect to stable 4.0.1

[juliusmarminge]

Moves Effect from 4.0.0-rc.115 to stable 4.0.1, without waiting for OpenCode to move off the release candidates. 4.0.1 includes several fixes we sent upstream (interrupted Effect.cached/Cache lookups, idle groupedWithin ticking, sqlite-node prepare caching, RpcClient stream buffers on interrupt). This replaces #14914, which targeted 4.0.0 and is 170 commits behind main.

Changes

• Imports. 4.0 removes the effect/unstable/* paths: every import moves to effect/<area> (httpapi becomes http-api), and effect/Encoding is split into effect/encoding/{Base64,Base64Url,Hex}. This is the bulk of the 834 files and was done with a script.

• Dependencies.

  • effect and every @effect/* package at 4.0.1.
  • Alchemy 2.0.0-beta.80 and distilled 1.0.0-rc.13, which ship the new layout.
  • OpenCode 2 (@opencode/client, protocol, schema) at 2.0.23, patched. They still import the removed paths, Encoding and Schema.isStartsWith, and their statics helper assigned over a schema's make, which 4.0 caches as a non-configurable property. Drop the patches once OpenCode targets stable Effect.

• Behavior changes picked up from rc.116 through 4.0.1:

  • HttpRouter.serve builds the app in a private memo map, so TracerDisabledWhen is provided to the served layer.
  • Scope.close requires a closeable scope: SSH tunnels and the ACP and Antigravity runtimes close a scope they own.
  • RpcSerialization.ndJsonRpc skips non-JSON lines, so effect-acp decodes each frame with the strict codec to keep failing on a malformed agent line.
  • Effect.partition returns successes first; Stream.scan takes a lazy initial state; SchemaGetter.onSome/.compose are replaced; Schema.brand needs a single concrete brand key.
  • A declared MCP tool failure is isError with JSON text, without structuredContent; the MCP tests read it there.

• Patches. effect@4.0.1.patch is down to three changes, each sent upstream so it can be dropped:

  • MCP session DELETE: Effect-TS/effect#8773 (opt-in allowSessionTermination; we'd pass it once that lands).
  • The React Native getSetCookie guard: Effect-TS/effect#8772.
  • Tolerating up to 3 missed pongs before a ping timeout: Effect-TS/effect#8774 (issue, API to agree on).

  The RpcClient RequestHooks and onPing/onPong/onPingTimeout hooks are dropped: nothing has used them since the client connection rewrite in [codex] Rewrite client connection architecture #2978. 4.0.1 has its own fix for a busy stream blocking the socket on interrupt, so ours is dropped too. The Alchemy patch applies unchanged.

• @effect/vitest patch. Besides importing vite-plus/test, it now drops the package's vitest peer. Left in, pnpm auto-installed a second vitest for it, and that one pulled in real vite@8.3.2 and another rolldown, because our vite → vite-plus-core override doesn't reach auto-installed peers. Nothing imported it.

Verification

• tsc --noEmit clean in all 12 packages: contracts, shared, effect-acp, effect-codex-app-server, client-runtime, ssh, tailscale, server, desktop, web, mobile, relay.
• vp test run:
  • contracts 510, shared 1105, effect-acp 70, effect-codex-app-server 36, client-runtime 1998, ssh 35, tailscale 14, relay 345, desktop 1208 — all pass.
  • server 6411 passed, 8 failed; web 5802 passed, 3 failed; mobile 1932 passed, 1 failed. The same tests fail on a clean checkout of main on this machine: macOS /var vs /private/var temp paths, symlink resolution, the root .env leaking a Clerk client id into connectCliAuth.test.ts, and the Swift TSan fixtures.
• OpenCode2Client.live.test.ts against a real OpenCode 2.0.23 server: passes (server info, one turn, history paging), so the patched client decodes the live API under 4.0.1. Its pinned server version moves to 2.0.23.
• knip clean.

Not in this PR: syncing .repos/effect-smol to 4.0.1 (separate refs PR).

Model/harness: Claude Opus 5.5 (1M context) via Claude Code in T3 Code.

🤖 Generated with Claude Code

---

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a broad Effect runtime upgrade spanning production desktop, mobile, web, server, relay, and shared code, with additional process-lifecycle, parser, tracing, and authentication-path changes plus patched third-party packages. The sensitive authentication-directory changes and non-mechanical runtime adaptations make the blast radius unsuitable for automatic approval.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	4.9 KiB	5.0 KiB	+122 B (+2.5%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.7 KiB	3.8 KiB	+81 B (+2.1%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.1 KiB	1.2 KiB	+41 B (+3.5%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.4 KiB	20.9 KiB	+482 B (+2.3%)	29.3 KiB	✅
Codex	Live turn messages	1	2	+1 (+100.0%)	8	✅
Claude	Total thread wire	4.9 KiB	5.0 KiB	+59 B (+1.2%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.7 KiB	3.8 KiB	+82 B (+2.2%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−23 B (−1.9%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	20.8 KiB	21.2 KiB	+400 B (+1.9%)	29.3 KiB	✅
Claude	Live turn messages	2	1	−1 (−50.0%)	8	✅

Baseline: ce90eec · PR result: da1038c · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.