@tekmidian/pai 0.36.1 → 0.37.0

package/dist/providers-sXcK5bDZ.mjs

@@ -0,0 +1,3067 @@
+import { n as CONFIG_FILE } from "./config-B64vFg14.mjs";
+import { appendFileSync, chmodSync, closeSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { basename, dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+import { connect, createServer } from "node:net";
+import { execFileSync, spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+
+//#region src/config/json-store.ts
+/**
+* json-store.ts — read/write JSON config files without destroying them
+*
+* The failure this exists to prevent:
+*
+*     try { return JSON.parse(read(path)); } catch { return {}; }
+*     ... later ...
+*     write(path, JSON.stringify(ourData));
+*
+* An unreadable file becomes an empty object, and the next write makes that
+* permanent. Silently, exit code 0. This shape appeared three times in this
+* repo against three different files, and twice in AIBroker.
+*
+* The distinction that matters is between *missing* and *unreadable*:
+*
+*   missing     — legitimate first run. Start fresh; writing is safe.
+*   unreadable  — the file exists and we could not parse it. Those bytes are
+*                 the only copy of something. Never overwrite them.
+*
+* Collapsing the second into the first is the bug.
+*
+* NOT everything deserves this guard. For a transient buffer — an undelivered
+* message queue, a cache — starting fresh IS the correct recovery, and
+* refusing to write would disable the feature permanently. Use `writeJsonAtomic`
+* alone there: it still prevents a crash from truncating a good file, without
+* blocking recovery. Reserve `readJsonStrict` for data a user cannot rebuild.
+*/
+/**
+* Read a JSON file, distinguishing "absent" from "damaged".
+*
+* @param path   file to read
+* @param label  how to name it to the user, e.g. "~/.claude.json"
+* @throws if the file exists but cannot be read or parsed
+*/
+function readJsonStrict(path, label = path) {
+	if (!existsSync(path)) return {};
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch (e) {
+		throw new Error(`Could not read ${label}: ${e instanceof Error ? e.message : String(e)}\nRefusing to continue — writing now would replace its contents with ours alone.`);
+	}
+	try {
+		return JSON.parse(raw);
+	} catch (e) {
+		throw new Error(`${label} exists but is not valid JSON: ${e instanceof Error ? e.message : String(e)}\nRefusing to continue — overwriting it would destroy whatever it holds.\nRepair the file, or move it aside and re-run this command.`);
+	}
+}
+/**
+* Write JSON without risking the existing file.
+*
+* Keeps a `.bak-pai` copy of the previous contents, then writes to a temp file
+* and renames. Rename is atomic within a filesystem, so a crash mid-write
+* leaves the original intact rather than truncated — which is how these files
+* become corrupt in the first place.
+*/
+function writeJsonAtomic(path, data, opts = {}) {
+	const { backup = true, label = path } = opts;
+	const serialized = JSON.stringify(data, null, 2) + "\n";
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	if (backup && existsSync(path)) try {
+		copyFileSync(path, `${path}.bak-pai`);
+	} catch (e) {
+		throw new Error(`Could not back up ${label}: ${e instanceof Error ? e.message : String(e)}\nRefusing to write without a backup.`);
+	}
+	const tmp = `${path}.tmp-pai-${process.pid}`;
+	try {
+		writeFileSync(tmp, serialized, "utf8");
+		renameSync(tmp, path);
+	} catch (e) {
+		try {
+			if (existsSync(tmp)) unlinkSync(tmp);
+		} catch {}
+		throw new Error(`Failed to write ${label}: ${e instanceof Error ? e.message : String(e)}\nThe original is unchanged.`);
+	}
+}
+
+//#endregion
+//#region src/workers/config.ts
+/**
+* config.ts — the `workers` section of ~/.config/pai/config.json
+*
+* Everything that knows about worker providers reads this module: the CLI
+* (`pai worker …`), the MCP tools (worker_*), and the Agent-routing hook.
+* Keep it free of commander/MCP imports so all three layers stay thin over it.
+*
+* Keys are never stored here — only paths to 0600 files. A provider without a
+* keyFile is a local server and gets the placeholder token "local".
+*
+* `protocol: "openai"` providers run through the PAI proxy (src/workers/proxy):
+* `upstreamUrl` is their Chat Completions base, and `run` points
+* ANTHROPIC_BASE_URL at the local proxy with the provider name in the path.
+* `engine: "codex"` providers run through the Codex CLI instead of Claude
+* Code.
+*/
+const DEFAULT_LOG_DIR = "~/.claude/logs/workers";
+const DEFAULT_PANE = {
+	enabled: true,
+	fontSize: 13,
+	autoExitSecs: 60
+};
+const DEFAULT_ROUTING = {
+	order: [],
+	cooldownMinutes: 30,
+	retryOnQuota: true
+};
+function defaultWorkersConfig() {
+	return {
+		enabled: false,
+		active: null,
+		providers: {},
+		roles: {},
+		mcpSets: {},
+		pane: { ...DEFAULT_PANE },
+		logDir: DEFAULT_LOG_DIR,
+		routing: {
+			...DEFAULT_ROUTING,
+			order: []
+		}
+	};
+}
+var WorkersConfigError = class extends Error {};
+function bad(path, why) {
+	throw new WorkersConfigError(`workers${path}: ${why}`);
+}
+function str(v) {
+	return typeof v === "string" ? v : "";
+}
+function parseProvider(name, raw) {
+	if (typeof raw !== "object" || raw === null) bad(`.providers.${name}`, "must be an object");
+	const p = raw;
+	const protocol = p.protocol === void 0 ? "anthropic" : str(p.protocol);
+	if (protocol !== "anthropic" && protocol !== "openai") bad(`.providers.${name}.protocol`, `"${str(p.protocol)}" is neither "anthropic" nor "openai"`);
+	const engine = p.engine === void 0 ? "claude" : str(p.engine);
+	if (engine !== "claude" && engine !== "codex") bad(`.providers.${name}.engine`, `"${str(p.engine)}" is neither "claude" nor "codex"`);
+	const baseUrl = str(p.baseUrl);
+	if (!baseUrl && protocol !== "openai") bad(`.providers.${name}.baseUrl`, "is required");
+	const keyFile = p.keyFile === void 0 || p.keyFile === null || str(p.keyFile) === "" ? null : str(p.keyFile);
+	const modelsRaw = p.models === void 0 ? {} : p.models;
+	if (typeof modelsRaw !== "object" || modelsRaw === null) bad(`.providers.${name}.models`, "must be an object");
+	const m = modelsRaw;
+	const defaultModel = str(m.default);
+	if (!defaultModel) bad(`.providers.${name}.models.default`, "is required");
+	const fast = m.fast === void 0 ? void 0 : str(m.fast);
+	const env = {};
+	if (p.env !== void 0) {
+		if (typeof p.env !== "object" || p.env === null || Array.isArray(p.env)) bad(`.providers.${name}.env`, "must be an object of string values");
+		for (const [k, v] of Object.entries(p.env)) {
+			if (typeof v !== "string") bad(`.providers.${name}.env.${k}`, "must be a string");
+			env[k] = v;
+		}
+	}
+	const quotaSkipAt = p.quotaSkipAt === void 0 ? void 0 : p.quotaSkipAt;
+	if (quotaSkipAt !== void 0) {
+		if (typeof quotaSkipAt !== "number" || quotaSkipAt < 0 || quotaSkipAt > 100) bad(`.providers.${name}.quotaSkipAt`, "must be a number between 0 and 100");
+	}
+	const contextWindow = p.contextWindow === void 0 ? void 0 : p.contextWindow;
+	if (contextWindow !== void 0) {
+		if (typeof contextWindow !== "number" || contextWindow <= 0) bad(`.providers.${name}.contextWindow`, "must be a positive number of tokens");
+	}
+	const upstreamUrl = str(p.upstreamUrl);
+	if (protocol === "openai" && !upstreamUrl) bad(`.providers.${name}.upstreamUrl`, `is required for protocol "openai" (the Chat Completions base, e.g. "https://api.openai.com/v1")`);
+	return {
+		enabled: p.enabled === void 0 ? true : p.enabled === true,
+		protocol,
+		baseUrl,
+		keyFile,
+		models: fast ? {
+			default: defaultModel,
+			fast
+		} : { default: defaultModel },
+		env,
+		...str(p.note) ? { note: str(p.note) } : {},
+		...upstreamUrl ? { upstreamUrl } : {},
+		...engine !== "claude" ? { engine } : {},
+		...str(p.quotaProbe) ? { quotaProbe: str(p.quotaProbe) } : {},
+		...quotaSkipAt !== void 0 ? { quotaSkipAt } : {},
+		...contextWindow !== void 0 ? { contextWindow } : {}
+	};
+}
+/**
+* Parse and validate a raw `workers` value. Missing section → defaults.
+* Unknown-but-typed garbage → WorkersConfigError naming the offending field.
+*/
+function parseWorkersConfig(raw) {
+	const d = defaultWorkersConfig();
+	if (raw === void 0 || raw === null) return d;
+	if (typeof raw !== "object" || Array.isArray(raw)) bad("", "section must be an object");
+	const w = raw;
+	const providers = {};
+	if (w.providers !== void 0) {
+		if (typeof w.providers !== "object" || w.providers === null || Array.isArray(w.providers)) bad(".providers", "must be an object keyed by provider name");
+		for (const [name, p] of Object.entries(w.providers)) providers[name] = parseProvider(name, p);
+	}
+	const roles = {};
+	if (w.roles !== void 0) {
+		if (typeof w.roles !== "object" || w.roles === null || Array.isArray(w.roles)) bad(".roles", "must be an object of role → provider[/alias] or {provider, mcp}");
+		for (const [role, target] of Object.entries(w.roles)) if (typeof target === "object" && target !== null && !Array.isArray(target)) {
+			const o = target;
+			const provider = str(o.provider);
+			if (!provider || provider.includes(" ")) bad(`.roles.${role}.provider`, `invalid provider "${provider}"`);
+			let mcp;
+			if (o.mcp !== void 0) {
+				if (!Array.isArray(o.mcp) || o.mcp.some((x) => typeof x !== "string")) bad(`.roles.${role}.mcp`, "must be an array of MCP server or set names");
+				mcp = o.mcp;
+			}
+			roles[role] = mcp ? {
+				provider,
+				mcp
+			} : { provider };
+		} else {
+			const t = str(target);
+			if (!t || t.includes(" ")) bad(`.roles.${role}`, `invalid target "${t}"`);
+			roles[role] = t;
+		}
+	}
+	const mcpSets = {};
+	if (w.mcpSets !== void 0) {
+		if (typeof w.mcpSets !== "object" || w.mcpSets === null || Array.isArray(w.mcpSets)) bad(".mcpSets", "must be an object of set name → [server names]");
+		for (const [setName, servers] of Object.entries(w.mcpSets)) {
+			if (!Array.isArray(servers) || servers.some((x) => typeof x !== "string")) bad(`.mcpSets.${setName}`, "must be an array of MCP server names");
+			mcpSets[setName] = servers;
+		}
+	}
+	let pane = { ...DEFAULT_PANE };
+	if (w.pane !== void 0) {
+		if (typeof w.pane !== "object" || w.pane === null) bad(".pane", "must be an object");
+		const pc = w.pane;
+		if (pc.enabled !== void 0 && typeof pc.enabled !== "boolean") bad(".pane.enabled", "must be boolean");
+		if (pc.fontSize !== void 0 && (typeof pc.fontSize !== "number" || pc.fontSize <= 0)) bad(".pane.fontSize", "must be a positive number of points");
+		if (pc.autoExitSecs !== void 0 && typeof pc.autoExitSecs !== "number") bad(".pane.autoExitSecs", "must be a number");
+		pane = {
+			enabled: pc.enabled === void 0 ? DEFAULT_PANE.enabled : pc.enabled === true,
+			fontSize: pc.fontSize === void 0 ? DEFAULT_PANE.fontSize : pc.fontSize,
+			autoExitSecs: pc.autoExitSecs === void 0 ? DEFAULT_PANE.autoExitSecs : pc.autoExitSecs
+		};
+	}
+	let routing = {
+		...DEFAULT_ROUTING,
+		order: []
+	};
+	if (w.routing !== void 0) {
+		if (typeof w.routing !== "object" || w.routing === null) bad(".routing", "must be an object");
+		const r = w.routing;
+		if (r.order !== void 0) {
+			if (!Array.isArray(r.order) || r.order.some((x) => typeof x !== "string")) bad(".routing.order", "must be an array of provider names");
+			routing.order = r.order;
+		}
+		if (r.cooldownMinutes !== void 0 && typeof r.cooldownMinutes !== "number") bad(".routing.cooldownMinutes", "must be a number");
+		if (r.retryOnQuota !== void 0 && typeof r.retryOnQuota !== "boolean") bad(".routing.retryOnQuota", "must be boolean");
+		routing = {
+			order: routing.order,
+			cooldownMinutes: r.cooldownMinutes === void 0 ? DEFAULT_ROUTING.cooldownMinutes : r.cooldownMinutes,
+			retryOnQuota: r.retryOnQuota === void 0 ? DEFAULT_ROUTING.retryOnQuota : r.retryOnQuota === true
+		};
+	}
+	const active = w.active === void 0 || w.active === null ? null : str(w.active);
+	if (active !== null && active !== "auto" && !(active in providers)) {}
+	return {
+		enabled: w.enabled === void 0 ? d.enabled : w.enabled === true,
+		active,
+		providers,
+		roles,
+		mcpSets,
+		pane,
+		logDir: str(w.logDir) || d.logDir,
+		routing
+	};
+}
+/**
+* Read the whole config file and return (raw, workers) — the raw record so
+* callers can rewrite it preserving every other section, the parsed+validated
+* workers section. Unreadable config throws (readJsonStrict), missing is fine.
+*/
+function readWorkersSection() {
+	const raw = readJsonStrict(CONFIG_FILE, "~/.config/pai/config.json");
+	return {
+		raw,
+		workers: parseWorkersConfig(raw.workers)
+	};
+}
+/** Write the workers section back into the config file, atomically. */
+function writeWorkersSection(raw, workers) {
+	raw.workers = workers;
+	writeJsonAtomic(CONFIG_FILE, raw, { label: "~/.config/pai/config.json" });
+}
+/** Expand a leading ~ (config values are written with `~` to stay portable). */
+function expandHome(p) {
+	if (p === "~" || p.startsWith("~/")) return join(homedir(), p.slice(1));
+	return p;
+}
+function assertProviderRunnable(name, p) {
+	if (p.protocol === "openai" && !p.upstreamUrl) throw new WorkersConfigError(`provider "${name}" uses protocol "openai" but has no upstreamUrl — set its Chat Completions base (e.g. "https://api.openai.com/v1") so the PAI proxy knows where to translate to.`);
+}
+/** Where a provider's key file lives, or null. Shared by run + test + add. */
+function providerKeyPath(p) {
+	return p.keyFile ? expandHome(p.keyFile) : null;
+}
+const DEFAULT_CONTEXT_WINDOW = 2e5;
+/** Context window used by the meter when the init event carries none. */
+function providerContextWindow(p) {
+	return p.contextWindow ?? DEFAULT_CONTEXT_WINDOW;
+}
+/** Directory under which inline keys (MCP `key` field) are stored, 0600. */
+function keysDir() {
+	return join(homedir(), ".config", "pai", "keys");
+}
+
+//#endregion
+//#region src/workers/paths.ts
+/**
+* paths.ts — where worker run artefacts live.
+*
+* Everything a run writes (event mirror, status file, pane registry, routing
+* state, the empty MCP config) sits under one logDir so the whole tree is
+* disposable and configurable: `workers.logDir`, default ~/.claude/logs/workers.
+*/
+/** Absolute logDir for the given config. */
+function workersLogDir(config) {
+	return expandHome(config.logDir);
+}
+function statusPath(logDir, id) {
+	return join(logDir, `${id}.status`);
+}
+function eventsPath(logDir, id) {
+	return join(logDir, `${id}.jsonl`);
+}
+function ledgerPath(logDir) {
+	return join(logDir, "ledger.log");
+}
+function routingStatePath(logDir) {
+	return join(logDir, "routing-state.json");
+}
+function panesDir(logDir) {
+	return join(logDir, "panes");
+}
+/**
+* The strict empty MCP config handed to headless workers. Written into the
+* logDir on demand (never into the user's vendor config directory — this is
+* PAI state, not vendor state).
+*/
+function noMcpConfigPath(logDir) {
+	return join(logDir, "no-mcp.json");
+}
+
+//#endregion
+//#region src/workers/args.ts
+function parseRunnerArgs(argv) {
+	let prompt = null;
+	let outputFormat = "text";
+	const rest = [];
+	let headless = false;
+	let callerModel = false;
+	let callerMcpConfig = false;
+	let callerSystemPrompt = false;
+	const mcp = [];
+	let i = 0;
+	while (i < argv.length) {
+		const a = argv[i];
+		if (a === "-p" || a === "--print") {
+			headless = true;
+			rest.push(a);
+			if (i + 1 < argv.length && !argv[i + 1].startsWith("-")) {
+				prompt = argv[i + 1];
+				rest.push(prompt);
+				i += 1;
+			}
+		} else if (a === "--output-format") {
+			const v = argv[i + 1];
+			if (v === "json" || v === "stream-json") outputFormat = v;
+			i += 1;
+		} else if (a.startsWith("--output-format=")) {
+			const v = a.slice(16);
+			if (v === "json" || v === "stream-json") outputFormat = v;
+		} else if (a === "--verbose") {} else if (a === "--mcp") {
+			const v = argv[i + 1];
+			if (v !== void 0 && !v.startsWith("-")) {
+				mcp.push(v);
+				i += 1;
+			}
+		} else if (a.startsWith("--mcp=")) mcp.push(a.slice(6));
+		else {
+			if (a === "--model") callerModel = true;
+			if (a.startsWith("--model=")) callerModel = true;
+			if (a === "--mcp-config") callerMcpConfig = true;
+			if (a.startsWith("--mcp-config=")) callerMcpConfig = true;
+			if (a === "--append-system-prompt") callerSystemPrompt = true;
+			if (a.startsWith("--append-system-prompt=")) callerSystemPrompt = true;
+			if (prompt === null && !a.startsWith("-") && rest.length > 0 && (rest[rest.length - 1] === "-p" || rest[rest.length - 1] === "--print")) prompt = a;
+			rest.push(a);
+		}
+		i += 1;
+	}
+	return {
+		prompt,
+		outputFormat,
+		rest,
+		headless,
+		callerModel,
+		callerMcpConfig,
+		callerSystemPrompt,
+		mcp
+	};
+}
+/**
+* Turn `-p "<prompt>"` into bare `-p` (same for --print): for stream-json
+* stdin runs the prompt moves to the first user message on stdin, so the
+* value must not stay on the command line. Only prompt values directly
+* following the flag are touched; everything else passes through.
+*/
+function stripPromptValues(argv) {
+	const out = [];
+	for (let i = 0; i < argv.length; i++) {
+		const a = argv[i];
+		const isPrint = a === "-p" || a === "--print";
+		out.push(a);
+		if (isPrint && i + 1 < argv.length && !argv[i + 1].startsWith("-")) i += 1;
+	}
+	return out;
+}
+/** Collapse whitespace and cut to n chars with an ellipsis (label rendering). */
+function shortText(s, n) {
+	const t = String(s ?? "").split(/\s+/).filter(Boolean).join(" ");
+	return t.length <= n ? t : t.slice(0, n - 1) + "…";
+}
+
+//#endregion
+//#region src/workers/ledger.ts
+/**
+* ledger.ts — the routing ledger, one append-only log for every worker event.
+*
+* Line shapes (whitespace-aligned so `tail` reads as a table):
+*
+*   2026-09-17 12:00:00 WORKER-START id=<id> provider=<p> mode=headless model=<m> cwd=<cwd> label=<label>
+*   2026-09-17 12:01:00 WORKER-END   id=<id> provider=<p> mode=headless model=<m> rc=0 secs=60 turns=3 tools=8 label=<label>
+*   2026-09-17 12:00:20 WORKER-REROUTE from=<a> to=<b> reason=quota
+*   2026-09-17 12:00:00 DENIED-ANTHROPIC-AGENT cwd=<cwd> desc=<desc>
+*   2026-09-17 12:00:00 ALLOWED-ANTHROPIC-AGENT cwd=<cwd> desc=<desc>
+*
+* `pai worker log` (and glm-log before it) counts these; keep the tags stable.
+*/
+function ledgerStamp(d = /* @__PURE__ */ new Date()) {
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`;
+}
+/** Parse `2026-09-17 12:00:00 TAG key=value …` into its parts. */
+function parseLedgerLine(line) {
+	const m = line.match(/^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) (\S+)(?: (.*))?$/);
+	if (!m) return null;
+	const fields = {};
+	for (const part of (m[3] ?? "").split(" ")) {
+		if (!part) continue;
+		const eq = part.indexOf("=");
+		if (eq <= 0) continue;
+		fields[part.slice(0, eq)] = part.slice(eq + 1);
+	}
+	return {
+		stamp: m[1],
+		event: m[2],
+		fields
+	};
+}
+/** Append one ledger line. `kv` order is the caller's; values are flattened. */
+function appendLedger(path, event, kv, now = /* @__PURE__ */ new Date()) {
+	const parts = [];
+	for (const [k, v] of Object.entries(kv)) {
+		if (v === void 0 || v === null) continue;
+		parts.push(`${k}=${String(v).replace(/\s+/g, " ")}`);
+	}
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tail = parts.length ? " " + parts.join(" ") : "";
+	appendFileSync(path, `${ledgerStamp(now)} ${event}${tail}\n`, "utf8");
+}
+/** The counts `pai worker log` prints, over today's lines or the whole file. */
+function ledgerSummary(path, scope, lastN = 15, now = /* @__PURE__ */ new Date()) {
+	if (!existsSync(path)) return null;
+	const text = readFileSync(path, "utf8");
+	const today = ledgerStamp(now).slice(0, 10);
+	const lines = text.split("\n").filter((l) => l.trim());
+	const parsed = (scope === "all" ? lines : lines.filter((l) => l.startsWith(today))).map(parseLedgerLine).filter((x) => x !== null);
+	const count = (ev) => parsed.filter((p) => p.event === ev).length;
+	const ends = parsed.filter((p) => p.event === "WORKER-END");
+	const ok = ends.filter((p) => p.fields.rc === "0").length;
+	return {
+		scope: scope === "all" ? "all time" : `today ${today}`,
+		started: count("WORKER-START"),
+		endedOk: ok,
+		endedFailed: ends.length - ok,
+		denied: count("DENIED-ANTHROPIC-AGENT"),
+		allowed: count("ALLOWED-ANTHROPIC-AGENT"),
+		reroutes: count("WORKER-REROUTE"),
+		lastLines: lines.slice(-lastN)
+	};
+}
+
+//#endregion
+//#region src/workers/status.ts
+/**
+* status.ts — the live per-worker status file.
+*
+* One JSON file per run, rewritten atomically on every turn, read by `ps`,
+* `follow`, the status line and the pane logic. Same field set the Python
+* runner wrote, plus `provider` (routing is multi-provider now) and `session`
+* (the AIBroker identity of the launching session, see scope.ts).
+*/
+/** Context-meter percentage 0–100, null when the numbers are missing. */
+function contextPercent(s) {
+	if (!s.contextTokens || !s.contextWindow) return null;
+	return Math.round(s.contextTokens / s.contextWindow * 100);
+}
+/** Timestamp format shared by status files and the ledger. */
+function nowStamp(d = /* @__PURE__ */ new Date()) {
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`;
+}
+function newWorkerId(d = /* @__PURE__ */ new Date(), pid = process.pid) {
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}-${pid}`;
+}
+/** Write status atomically (temp + rename) and stamp `updated`. */
+function saveStatus(logDir, status, d = /* @__PURE__ */ new Date()) {
+	status.updated = nowStamp(d);
+	const path = statusPath(logDir, status.id);
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, JSON.stringify(status), "utf8");
+	renameSync(tmp, path);
+}
+/** Load every status file in the logDir, oldest id first, skipping damage. */
+function loadStatuses(logDir) {
+	if (!existsSync(logDir)) return [];
+	const out = [];
+	for (const name of readdirSync(logDir).sort()) {
+		if (!name.endsWith(".status")) continue;
+		try {
+			out.push(JSON.parse(readFileSync(join(logDir, name), "utf8")));
+		} catch {}
+	}
+	return out;
+}
+function loadStatus(logDir, id) {
+	const path = statusPath(logDir, id);
+	if (!existsSync(path)) return null;
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+function alive(pid) {
+	if (!pid || pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** "42s" under 90s, "7m" above — the coarse age the table and bar show. */
+function ageOf(ts, now = /* @__PURE__ */ new Date()) {
+	const t = Date.parse(ts.replace(" ", "T"));
+	if (Number.isNaN(t)) return "?";
+	const s = Math.max(0, Math.floor((now.getTime() - t) / 1e3));
+	return s < 90 ? `${s}s` : `${Math.floor(s / 60)}m`;
+}
+/** One-line description of a tool call, e.g. "Bash: npm test". */
+function describeTool(name, inp) {
+	if (typeof inp !== "object" || inp === null) return name;
+	const i = inp;
+	const get = (k) => typeof i[k] === "string" ? i[k] : "";
+	if (name === "Bash") return `Bash: ${shortText(get("command"), 70)}`;
+	if (name === "Read" || name === "Edit" || name === "Write" || name === "MultiEdit") return `${name}: ${get("file_path").split("/").pop() ?? ""}`;
+	if (name === "Grep" || name === "Glob") return `${name}: ${shortText(get("pattern"), 50)}`;
+	if (name === "WebSearch") return `${name}: ${shortText(get("query"), 50)}`;
+	if (name === "WebFetch") return `${name}: ${shortText(get("url"), 60)}`;
+	return name;
+}
+
+//#endregion
+//#region src/workers/scope.ts
+/**
+* scope.ts — which workers "belong" to the terminal asking about them.
+*
+* Two identities, in priority order:
+*
+*   1. AIBroker's session registry (~/.aibroker/session-names.json): iTerm
+*      session UUID → session name. The launching session's UUID is stored in
+*      each worker's status file as `session.id`, so every pane of a named
+*      session sees its workers — regardless of tab layout.
+*   2. The iTerm tab key (`w<window>t<tab>` prefix of ITERM_SESSION_ID): the
+*      original heuristic, kept as the fallback when no registry entry
+*      matches (AIBroker absent, unnamed session, non-iTerm terminal).
+*
+* If neither is available, viewers fall back to "all workers".
+*/
+const AIBROKER_REGISTRY = join(homedir(), ".aibroker", "session-names.json");
+/**
+* `w<window>t<tab>` prefix of an iTerm session id, "" if empty or malformed.
+* Panes split from the same tab share this prefix and differ only in `p<n>`.
+*/
+function tabKey(term) {
+	if (!term) return "";
+	const head = term.split("p", 1)[0];
+	const parts = head.slice(1).split("t");
+	if (head.startsWith("w") && parts.length === 2 && parts.every((p) => /^\d+$/.test(p))) return head;
+	return "";
+}
+/** Tab key of the iTerm tab this process runs in, "" if not inside iTerm2. */
+function currentTabKey(env = process.env) {
+	return tabKey(env.ITERM_SESSION_ID ?? "");
+}
+/** The iTerm UUID part of an ITERM_SESSION_ID (after the last colon). */
+function itermUuid(term) {
+	if (!term) return "";
+	return term.split(":").pop() ?? "";
+}
+/**
+* Resolve the AIBroker session for an ITERM_SESSION_ID. Reads the persistent
+* name registry (the same store `aibroker_rename` writes); returns null when
+* AIBroker is absent or the session is not in it — callers then use the tab
+* key, which is the pre-AIBroker behaviour.
+*/
+function resolveSession(term, registryPath = AIBROKER_REGISTRY) {
+	const uuid = itermUuid(term);
+	if (!uuid) return null;
+	let names;
+	try {
+		if (!existsSync(registryPath)) return null;
+		names = JSON.parse(readFileSync(registryPath, "utf8"));
+	} catch {
+		return null;
+	}
+	const name = names[uuid];
+	if (typeof name !== "string" || !name) return null;
+	return {
+		id: uuid,
+		name
+	};
+}
+/**
+* True when `worker` was launched from `term` (the terminal asking about it).
+* Session-id match first; the tab key only when no registry entry matched —
+* a session without a name keeps the tab-scoped behaviour it always had.
+*/
+function workerInScope(worker, term) {
+	if (!term) return false;
+	const uuid = itermUuid(term);
+	if (worker.session?.id && uuid) return worker.session.id === uuid;
+	return tabKey(worker.term) === tabKey(term) && tabKey(term) !== "";
+}
+/**
+* Registry key for pane files: the session id when AIBroker knows this
+* terminal, else the tab key, else the raw iTerm UUID.
+*/
+function scopeKey(term) {
+	const session = resolveSession(term);
+	if (session) return session.id;
+	return currentTabKey() || itermUuid(term);
+}
+/** `[Name]` when the worker has an AIBroker session name, else "". */
+function sessionTag(worker) {
+	return worker.session?.name ? `[${worker.session.name}]` : "";
+}
+
+//#endregion
+//#region src/workers/routing.ts
+/**
+* routing.ts — provider selection: flag > role > active (possibly "auto").
+*
+* Auto-routing walks `workers.routing.order` and takes the first provider
+* that is enabled, out of cooldown, and (when it defines a quotaProbe) under
+* its quotaSkipAt threshold. A run that dies of a quota/rate error puts its
+* provider in cooldown for cooldownMinutes; when that happens before the
+* first tool call and retryOnQuota is set, the runner restarts the same task
+* on the next provider (ledger: WORKER-REROUTE).
+*
+* An explicit --provider or --role always bypasses all of this.
+*/
+const QUOTA_SKIP_DEFAULT = 95;
+const PROBE_TIMEOUT_MS = 1e4;
+function readRoutingState(logDir) {
+	const path = routingStatePath(logDir);
+	if (!existsSync(path)) return { cooldowns: {} };
+	try {
+		return { cooldowns: JSON.parse(readFileSync(path, "utf8")).cooldowns ?? {} };
+	} catch {
+		return { cooldowns: {} };
+	}
+}
+function writeRoutingState(logDir, state) {
+	const path = routingStatePath(logDir);
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n", "utf8");
+	renameSync(tmp, path);
+}
+function cooldownRemaining(state, provider, now = /* @__PURE__ */ new Date()) {
+	const end = state.cooldowns[provider];
+	if (!end) return 0;
+	const ms = Date.parse(end) - now.getTime();
+	return ms > 0 ? ms : 0;
+}
+function setCooldown(logDir, provider, minutes, now = /* @__PURE__ */ new Date()) {
+	const state = readRoutingState(logDir);
+	state.cooldowns[provider] = new Date(now.getTime() + minutes * 6e4).toISOString();
+	writeRoutingState(logDir, state);
+}
+function clearCooldown(logDir, provider) {
+	const state = readRoutingState(logDir);
+	if (!(provider in state.cooldowns)) return;
+	delete state.cooldowns[provider];
+	writeRoutingState(logDir, state);
+}
+/**
+* Run a provider's quotaProbe and return its percentage (0–100), or null when
+* there is no probe or it printed nothing usable. A probe must never break
+* routing: failures read as "unknown", not as "full".
+*/
+function probeQuota(provider) {
+	if (!provider.quotaProbe) return null;
+	try {
+		const m = execFileSync("/bin/sh", ["-c", provider.quotaProbe], {
+			timeout: PROBE_TIMEOUT_MS,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).match(/(\d+(?:\.\d+)?)/);
+		if (!m) return null;
+		return Math.min(100, Math.max(0, Math.round(parseFloat(m[1]))));
+	} catch {
+		return null;
+	}
+}
+function quotaSkipThreshold(provider) {
+	return provider.quotaSkipAt ?? QUOTA_SKIP_DEFAULT;
+}
+/** Does this provider exceed its quota threshold right now? */
+function quotaExceeded(provider) {
+	const used = probeQuota(provider);
+	return used !== null && used >= quotaSkipThreshold(provider);
+}
+var NoProviderError = class extends WorkersConfigError {};
+function mustExist(config, name) {
+	const p = config.providers[name];
+	if (!p) throw new NoProviderError(`no worker provider named "${name}". Configured: ${Object.keys(config.providers).join(", ") || "(none)"}.\nAdd one with: pai worker providers add <name> --base-url <url> --key-file <path> --model <model>`);
+	return p;
+}
+function mustBeRunnable(name, p) {
+	if (!p.enabled) throw new NoProviderError(`provider "${name}" is disabled. Enable it with: pai worker providers enable ${name}`);
+	return p;
+}
+/**
+* Resolve which provider (and model alias) a run uses.
+*
+* @param flagProvider --provider value, highest precedence
+* @param role         --role value, looked up in workers.roles
+*/
+function resolveTarget(config, logDir, opts = {}) {
+	if (opts.flagProvider) return {
+		providerName: opts.flagProvider,
+		provider: mustBeRunnable(opts.flagProvider, mustExist(config, opts.flagProvider)),
+		modelAlias: null,
+		roleMcp: null,
+		via: "flag"
+	};
+	if (opts.role) {
+		const target = config.roles[opts.role];
+		if (!target) throw new NoProviderError(`no role named "${opts.role}". Defined: ${Object.keys(config.roles).join(", ") || "(none)"}.\nSet one with: pai worker roles set ${opts.role}=<provider[/alias]>`);
+		const name = typeof target === "string" ? target.split("/")[0] : target.provider;
+		const alias = typeof target === "string" ? target.split("/")[1] : void 0;
+		const roleMcp = typeof target === "string" ? null : target.mcp ?? null;
+		return {
+			providerName: name,
+			provider: mustBeRunnable(name, mustExist(config, name)),
+			modelAlias: alias ?? null,
+			roleMcp,
+			via: "role"
+		};
+	}
+	if (config.active !== "auto") {
+		const name = config.active;
+		if (!name) throw new NoProviderError("no active worker provider. Add one with: pai worker providers add <name> --base-url <url> --key-file <path> --model <model>\n(or point one that exists at it: pai worker providers use <name>)");
+		return {
+			providerName: name,
+			provider: mustBeRunnable(name, mustExist(config, name)),
+			modelAlias: null,
+			roleMcp: null,
+			via: "active"
+		};
+	}
+	const state = readRoutingState(logDir);
+	const skipped = [];
+	for (const name of config.routing.order) {
+		const p = config.providers[name];
+		if (!p || !p.enabled) continue;
+		if (cooldownRemaining(state, name) > 0) {
+			skipped.push(`${name}(cooldown)`);
+			continue;
+		}
+		if (quotaExceeded(p)) {
+			skipped.push(`${name}(quota)`);
+			continue;
+		}
+		return {
+			providerName: name,
+			provider: p,
+			modelAlias: null,
+			roleMcp: null,
+			via: "auto"
+		};
+	}
+	throw new NoProviderError(`auto-routing found no usable provider (order: [${config.routing.order.join(", ")}]${skipped.length ? `; skipped: ${skipped.join(", ")}` : ""}).\nClear a cooldown with: pai worker providers enable <name>`);
+}
+/**
+* Next provider after `from` in auto order, applying the same filters.
+* Used by rerouting; null when the order is exhausted.
+*/
+function nextAutoProvider(config, logDir, from, now = /* @__PURE__ */ new Date()) {
+	const state = readRoutingState(logDir);
+	const order = config.routing.order;
+	const start = order.indexOf(from);
+	for (let i = start + 1; i < order.length; i++) {
+		const name = order[i];
+		const p = config.providers[name];
+		if (!p || !p.enabled) continue;
+		const end = state.cooldowns[name];
+		if (end && Date.parse(end) > now.getTime()) continue;
+		if (quotaExceeded(p)) continue;
+		return name;
+	}
+	return null;
+}
+/**
+* Was this failure a quota/rate failure? Detected from the result text the
+* endpoint produced (HTTP status is not visible in the stream events).
+*/
+function isQuotaFailure(resultText) {
+	return /usage limit reached|rate limit|quota/i.test(resultText);
+}
+
+//#endregion
+//#region src/workers/pane.ts
+/**
+* pane.ts — the per-worker follow pane in iTerm2.
+*
+* One small-font pane per worker, stacked in a right-hand column: the first
+* worker of a scope splits the launching session vertically (right, ~40% of
+* the columns), every further one splits the lowest live worker pane
+* horizontally, so panes stack top to bottom. Each pane runs
+* `pai worker follow <id> --auto-exit <n>` under the `pai-worker` dynamic
+* profile (Close Sessions On End), so panes disappear by themselves.
+*
+* Panes are tracked per scope (AIBroker session id, else tab key) in
+* <logDir>/panes/<key>.json, keyed by iTerm session unique id, newest first —
+* the split lands below the lowest live worker pane.
+*
+* The dynamic profile's font is the family of iTerm's DEFAULT profile (the
+* `Default Bookmark Guid` entry in New Bookmarks) at workers.pane.fontSize —
+* never the launching session's profile, which the Python version did and
+* which produced iTerm's "unknown parent name" dialog whenever the two
+* differed. `Dynamic Profile Parent Name` is only written when that name
+* actually exists in New Bookmarks; when iTerm's preferences cannot be read
+* the profile is still written, with font Menlo-Regular and no parent.
+*/
+const PROFILE_NAME = "pai-worker";
+/** Where the dynamic profile lives (env override keeps tests off the real one). */
+function dynamicProfilePath() {
+	return process.env.PAI_WORKER_PROFILE ?? join(homedir(), "Library", "Application Support", "iTerm2", "DynamicProfiles", "pai-worker.json");
+}
+const WORKER_SPLIT_SCRIPT = `on run(argv)
+    set targetID to item 1 of argv
+    set candList to item 2 of argv
+    set followCmd to item 3 of argv
+    set profileName to item 4 of argv
+    tell application id "com.googlecode.iterm2"
+        if not running then return "notrunning"
+        repeat with w in windows
+            repeat with t in tabs of w
+                repeat with s in sessions of t
+                    if id of s is targetID then
+                        set parentCols to missing value
+                        try
+                            set parentCols to columns of s
+                        end try
+                        set sessIDs to {}
+                        repeat with other in sessions of t
+                            set end of sessIDs to (id of other as text)
+                        end repeat
+                        set lived to {}
+                        set splitS to missing value
+                        repeat with cid in my splitIds(candList)
+                            set cidText to (cid as text)
+                            if sessIDs contains cidText then
+                                set end of lived to cidText
+                                if splitS is missing value then
+                                    set splitS to first session of t whose id is cidText
+                                end if
+                            end if
+                        end repeat
+                        if profileName is "" then
+                            if splitS is missing value then
+                                tell s
+                                    set newS to split vertically with default profile
+                                end tell
+                            else
+                                tell splitS
+                                    set newS to split horizontally with default profile
+                                end tell
+                            end if
+                        else
+                            if splitS is missing value then
+                                tell s
+                                    set newS to split vertically with profile profileName
+                                end tell
+                            else
+                                tell splitS
+                                    set newS to split horizontally with profile profileName
+                                end tell
+                            end if
+                        end if
+                        tell newS
+                            write text followCmd
+                        end tell
+                        if splitS is missing value and parentCols is not missing value then
+                            try
+                                tell newS
+                                    set columns to (round (parentCols * 0.4))
+                                end tell
+                            end try
+                        end if
+                        set out to ""
+                        repeat with lid in lived
+                            set out to out & lid & ","
+                        end repeat
+                        return out & "|" & (id of newS as text)
+                    end if
+                end repeat
+            end repeat
+        end repeat
+    end tell
+    return "notfound"
+end run
+
+on splitIds(s)
+    set out to {}
+    if s is "" then return out
+    set prevDels to AppleScript's text item delimiters
+    set AppleScript's text item delimiters to ","
+    repeat with part in text items of s
+        set end of out to (part as text)
+    end repeat
+    set AppleScript's text item delimiters to prevDels
+    return out
+end splitIds`;
+const TAB_TTYS_SCRIPT = `on run(argv)
+    set targetID to item 1 of argv
+    tell application id "com.googlecode.iterm2"
+        if not running then return "notrunning"
+        repeat with w in windows
+            repeat with t in tabs of w
+                repeat with s in sessions of t
+                    if id of s is targetID then
+                        set ttys to {}
+                        repeat with other in sessions of t
+                            copy (tty of other) to end of ttys
+                        end repeat
+                        return ttys
+                    end if
+                end repeat
+            end repeat
+        end repeat
+    end tell
+    return "notfound"
+end run`;
+const SPLIT_SCRIPT = `on run(argv)
+    set targetID to item 1 of argv
+    set followCmd to item 2 of argv
+    tell application id "com.googlecode.iterm2"
+        if not running then return "notrunning"
+        repeat with w in windows
+            repeat with t in tabs of w
+                repeat with s in sessions of t
+                    if id of s is targetID then
+                        tell s
+                            set newS to split vertically with default profile
+                        end tell
+                        tell newS
+                            write text followCmd
+                        end tell
+                        return "opened"
+                    end if
+                end repeat
+            end repeat
+        end repeat
+    end tell
+    return "notfound"
+end run`;
+/** Run an AppleScript with argv. Rejects when osascript itself cannot run. */
+function osascript(script, args) {
+	return new Promise((resolve, reject) => {
+		const proc = spawn("osascript", ["-", ...args], { stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		] });
+		let out = "";
+		let err = "";
+		proc.stdout.on("data", (c) => out += c.toString("utf8"));
+		proc.stderr.on("data", (c) => err += c.toString("utf8"));
+		proc.on("error", reject);
+		proc.on("close", () => resolve({
+			stdout: out,
+			stderr: err
+		}));
+		proc.stdin.write(script);
+		proc.stdin.end();
+	});
+}
+function psOutput$1(format) {
+	try {
+		return execFileSync("ps", ["-axo", format], { encoding: "utf8" });
+	} catch {
+		return "";
+	}
+}
+/** TTys of running `worker follow` processes, normalised to /dev/ttysNNN. */
+function followTtys() {
+	const ttys = /* @__PURE__ */ new Set();
+	for (const line of psOutput$1("tty=,command=").split("\n")) {
+		const parts = line.trim().split(/\s+/, 2);
+		if (parts.length < 2 || parts[0] === "ps") continue;
+		if (!/(^|\/)(worker-follow|pai worker follow|glm-ps follow)\b/.test(parts[1])) continue;
+		if (parts[0].startsWith("ttys")) ttys.add(`/dev/${parts[0]}`);
+	}
+	return ttys;
+}
+/** True while a `follow <wid>` process runs (its pane shows that worker). */
+function workerPaneOpen(wid) {
+	const pat = new RegExp(`(?:worker follow|worker-follow|glm-ps follow) ${wid.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
+	return psOutput$1("command=").split("\n").some((ln) => pat.test(ln));
+}
+/** plutil's message for an ExecFileSync failure, else the exception text. */
+function toolErr(e) {
+	const err = e;
+	return ((typeof err.stderr === "string" ? err.stderr : err.stderr?.toString("utf8")) || err.message || String(e)).trim();
+}
+/**
+* Read New Bookmarks and Default Bookmark Guid from an iTerm preferences
+* plist. Key-scoped `plutil -extract`, never a whole-file JSON conversion:
+* real iTerm preferences carry `<date>` objects (SULastCheckTime & friends)
+* which `plutil -convert json` rejects outright — "Invalid object in plist
+* for JSON format" — so the whole-file read always failed and the dynamic
+* profile was never written.
+*/
+function readItermPlist(plistPath) {
+	let bookmarks = [];
+	try {
+		const out = execFileSync("plutil", [
+			"-extract",
+			"New Bookmarks",
+			"json",
+			"-o",
+			"-",
+			plistPath
+		], {
+			encoding: "utf8",
+			timeout: 1e4
+		});
+		const parsed = JSON.parse(out);
+		if (Array.isArray(parsed)) bookmarks = parsed;
+	} catch (e) {
+		return {
+			bookmarks: [],
+			defaultGuid: null,
+			error: `extracting New Bookmarks: ${toolErr(e)}`
+		};
+	}
+	let defaultGuid = null;
+	try {
+		defaultGuid = execFileSync("plutil", [
+			"-extract",
+			"Default Bookmark Guid",
+			"raw",
+			"-o",
+			"-",
+			plistPath
+		], {
+			encoding: "utf8",
+			timeout: 1e4
+		}).trim() || null;
+	} catch {}
+	return {
+		bookmarks,
+		defaultGuid,
+		error: null
+	};
+}
+/** iTerm's exported preferences, via a temp plist (no shell pipe involved). */
+function itermPrefs() {
+	let dir = null;
+	try {
+		dir = mkdtempSync(join(tmpdir(), "pai-iterm-"));
+		const plist = join(dir, "iterm2.plist");
+		execFileSync("defaults", [
+			"export",
+			"com.googlecode.iterm2",
+			plist
+		], {
+			encoding: "utf8",
+			timeout: 1e4
+		});
+		return readItermPlist(plist);
+	} catch (e) {
+		return {
+			bookmarks: [],
+			defaultGuid: null,
+			error: `defaults export: ${toolErr(e)}`
+		};
+	} finally {
+		if (dir) try {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		} catch {}
+	}
+}
+/** The New Bookmarks entry of that profile name, null if absent. */
+function bookmarkFrom(read, named) {
+	return read.bookmarks.find((b) => b.Name === named) ?? null;
+}
+/** The bookmark iTerm marks default, null when it is missing or unreadable. */
+function defaultBookmarkFrom(read) {
+	return read.defaultGuid ? read.bookmarks.find((b) => b.Guid === read.defaultGuid) ?? null : null;
+}
+/** The default profile, read fresh from iTerm's preferences. */
+function defaultBookmark() {
+	return defaultBookmarkFrom(itermPrefs());
+}
+/**
+* The pane profile's font: the family of iTerm's default profile at
+* `fontSize` points ("MesloLGLNFM-Regular 18" + 13 → "MesloLGLNFM-Regular 13"),
+* or "Menlo-Regular <fontSize>" when the default font cannot be read.
+*/
+function paneFont(font, fontSize) {
+	const idx = (font ?? "").lastIndexOf(" ");
+	if (idx > 0) {
+		const family = font.slice(0, idx);
+		if (!Number.isNaN(parseFloat(font.slice(idx + 1)))) return `${family} ${fontSize}`;
+	}
+	return `Menlo-Regular ${fontSize}`;
+}
+/** Write the pai-worker dynamic profile; iTerm2 loads that directory itself. */
+function writeDynamicProfile(parent, fontSize, read = itermPrefs) {
+	const profile = {
+		Name: PROFILE_NAME,
+		Guid: "pai-worker-dynamic-profile",
+		"Normal Font": paneFont(parent?.["Normal Font"], fontSize),
+		"Close Sessions On End": true
+	};
+	if (parent?.Name && bookmarkFrom(read(), parent.Name)) profile["Dynamic Profile Parent Name"] = parent.Name;
+	const path = dynamicProfilePath();
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, JSON.stringify({ Profiles: [profile] }, null, 2) + "\n", "utf8");
+	renameSync(tmp, path);
+}
+let warnedPrefs = false;
+/**
+* Profile for new worker panes, creating the small-font one on demand.
+* "" means "split with the default profile" (also the fallback when the
+* dynamic profile does not show up in time).
+*
+* The profile file is written whenever it is missing — even when iTerm's
+* preferences cannot be read; then it gets font "Menlo-Regular <fontSize>"
+* and no parent, and the reason is logged to stderr once.
+*/
+async function followProfile(fontSize, read = itermPrefs) {
+	const first = read();
+	const parent = defaultBookmarkFrom(first);
+	const path = dynamicProfilePath();
+	const existed = existsSync(path);
+	if (!existed) writeDynamicProfile(parent, fontSize, () => first);
+	if (!parent) {
+		if (!warnedPrefs) {
+			warnedPrefs = true;
+			const reason = first.error ?? "no profile is marked default";
+			const what = existed ? `keeping ${path} as-is` : `wrote ${path} with Menlo-Regular ${fontSize} and no parent`;
+			process.stderr.write(`pai worker pane: cannot read iTerm's default profile (${reason}) — ${what}\n`);
+		}
+		if (first.error) return "";
+	}
+	for (let i = 0; i < 10; i++) {
+		if (bookmarkFrom(read(), PROFILE_NAME)) return PROFILE_NAME;
+		await new Promise((r) => setTimeout(r, 200));
+	}
+	process.stderr.write(`pai worker pane: profile ${PROFILE_NAME} not visible, splitting with default\n`);
+	return "";
+}
+function loadRegistry(path) {
+	try {
+		const reg = JSON.parse(readFileSync(path, "utf8"));
+		return Array.isArray(reg) ? reg : [];
+	} catch {
+		return [];
+	}
+}
+function saveRegistry(path, reg) {
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, JSON.stringify(reg, null, 1), "utf8");
+	renameSync(tmp, path);
+}
+/** Open (or only report on) the stacked follow pane of one worker. */
+async function openPaneForWorker(logDir, config, wid, term) {
+	if (workerPaneOpen(wid)) return `pane for ${wid} already open`;
+	const uid = itermUuid(term);
+	const regPath = join(panesDir(logDir), `${scopeKey(term)}.json`);
+	const reg = loadRegistry(regPath);
+	const profile = await followProfile(config.pane.fontSize);
+	const cmd = ` exec pai worker follow ${JSON.stringify(wid)} --auto-exit ${config.pane.autoExitSecs}`;
+	const p = await osascript(WORKER_SPLIT_SCRIPT, [
+		uid,
+		[...reg].reverse().map((e) => e.session).join(","),
+		cmd,
+		profile
+	]);
+	const out = p.stdout.trim();
+	if (out === "notfound" || out === "notrunning") throw new Error(out === "notfound" ? "pai worker pane: no open iTerm2 session matches ITERM_SESSION_ID" : "pai worker pane: iTerm2 is not running");
+	const bar = out.indexOf("|");
+	if (bar < 0) throw new Error(`pai worker pane: osascript failed: ${(p.stderr || out).slice(0, 200)}`);
+	const live = new Set(out.slice(0, bar).split(",").filter(Boolean));
+	const pruned = reg.filter((e) => live.has(e.session));
+	pruned.push({
+		session: out.slice(bar + 1),
+		worker: wid,
+		opened: (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19)
+	});
+	saveRegistry(regPath, pruned);
+	return `pane opened for ${wid}`;
+}
+/**
+* Report-only variant used by `pai worker pane <id> --check`: whether a pane
+* runs for the worker, plus the dynamic profile's path, its existence, and
+* the font it contains (or, when missing, would write).
+*/
+async function checkPaneForWorker(wid, fontSize) {
+	const lines = [workerPaneOpen(wid) ? `pane for ${wid} open` : `no pane for ${wid}`];
+	const path = dynamicProfilePath();
+	if (existsSync(path)) {
+		let font = "(unreadable)";
+		try {
+			font = JSON.parse(readFileSync(path, "utf8")).Profiles?.[0]?.["Normal Font"] ?? "(none)";
+		} catch {}
+		lines.push(`profile file: ${path} (exists)`);
+		lines.push(`profile font: ${font}`);
+	} else {
+		const parent = defaultBookmark();
+		lines.push(`profile file: ${path} (missing)`);
+		lines.push(`profile font (would write): ${paneFont(parent?.["Normal Font"], fontSize)}`);
+	}
+	return lines.join("\n");
+}
+/**
+* Split this iTerm tab and run `pai worker follow` in the new pane, unless
+* one already runs here (detected by TTY — iTerm overwrites session names
+* with the running command, so names cannot serve as idempotence).
+*/
+async function openFollowPane(logDir, _config, term, checkOnly) {
+	const uid = itermUuid(term);
+	const out = (await osascript(TAB_TTYS_SCRIPT, [uid])).stdout.trim();
+	if (out === "notfound") throw new Error("pai worker pane: no open iTerm2 session matches ITERM_SESSION_ID");
+	if (out === "notrunning") throw new Error("pai worker pane: iTerm2 is not running");
+	if ([...new Set(out.split(",").map((t) => t.trim()).filter(Boolean))].filter((t) => followTtys().has(t)).length > 0) return "follow pane already open";
+	if (checkOnly) return "no follow pane";
+	const s = await osascript(SPLIT_SCRIPT, [uid, " exec pai worker follow"]);
+	const sout = s.stdout.trim();
+	if (sout === "opened") return "follow pane opened";
+	if (sout === "notfound") throw new Error("pai worker pane: no open iTerm2 session matches ITERM_SESSION_ID");
+	throw new Error(`pai worker pane: osascript failed: ${(s.stderr || sout).slice(0, 200)}`);
+}
+
+//#endregion
+//#region src/workers/report.ts
+/**
+* report.ts — the worker contract: terse, structured final reports.
+*
+* Headless workers run with an appended system prompt that fixes their output
+* shape: act, verify, then finish with ONE final message that is a JSON object
+* and nothing else. The runner parses it out of the result; the viewer renders
+* it as a compact block instead of a wall of text.
+*/
+/** Appended to the caller's system prompt on every headless run (2h). */
+const WORKER_CONTRACT_PROMPT = [
+	"You are a headless implementation worker, run non-interactively by an orchestrating session.",
+	"No narration, no timestamps, no greetings, no summaries of what you read; act, verify, then stop.",
+	"Your ONE final message is a JSON object and nothing else — no prose before or after, no code fence:",
+	"{\"changed\":[{\"path\":\"…\",\"summary\":\"…\"}],\"commands\":[\"…\"],\"checks\":[{\"name\":\"…\",\"ok\":true,\"detail\":\"…\"}],\"open\":[\"…\"],\"notes\":\"one line\"}",
+	"changed: files you touched (path + one-line summary). commands: the commands that verify the work.",
+	"checks: each with ok true/false and the evidence in detail. open: what you could not finish, if anything.",
+	"notes: one line, the headline a reviewer reads first."
+].join("\n");
+/**
+* Extract the JSON report from a worker's final message. Accepts a bare
+* object, a ```json fenced block, or an object embedded in surrounding text.
+* Only objects that look like the contract count (at least one of changed /
+* checks / notes) — any other JSON falls through to null so the raw text is
+* kept as-is.
+*/
+function parseWorkerReport(text) {
+	const trimmed = (text ?? "").trim();
+	if (!trimmed) return null;
+	const candidates = [];
+	const fence = trimmed.match(/```(?:json)?\s*(\{[\s\S]*?\})\s*```/);
+	if (fence) candidates.push(fence[1]);
+	if (trimmed.startsWith("{")) candidates.push(trimmed);
+	const first = trimmed.indexOf("{");
+	const last = trimmed.lastIndexOf("}");
+	if (first >= 0 && last > first) candidates.push(trimmed.slice(first, last + 1));
+	for (const cand of candidates) try {
+		const v = JSON.parse(cand);
+		if (typeof v === "object" && v !== null && !Array.isArray(v) && looksLikeReport(v)) return v;
+	} catch {}
+	return null;
+}
+/** The contract's fingerprint — guards against unrelated JSON in a reply. */
+function looksLikeReport(v) {
+	const o = v;
+	return Array.isArray(o.changed) || Array.isArray(o.checks) || typeof o.notes === "string";
+}
+/**
+* Render a parsed report as the compact block the viewer shows: changed paths
+* with summaries, checks with ✓/✗, open items, notes. Empty report → [].
+*/
+function renderReport(c, prefix, r, cwd = "") {
+	const out = [];
+	const has = (xs) => (xs ?? []).length > 0;
+	if (has(r.changed)) {
+		out.push(`${prefix}${c("bold", "changed")}`);
+		for (const ch of r.changed) out.push(`${prefix}  ${relShort(ch.path ?? "?", cwd)} — ${shortText(ch.summary ?? "", 90)}`);
+	}
+	if (has(r.checks)) {
+		out.push(`${prefix}${c("bold", "checks")}`);
+		for (const ck of r.checks) {
+			const mark = ck.ok === false ? c("red", "✗") : c("green", "✓");
+			const detail = ck.detail ? c("dim", ` · ${shortText(ck.detail, 80)}`) : "";
+			out.push(`${prefix}  ${mark} ${ck.name ?? "?"}${detail}`);
+		}
+	}
+	if (has(r.commands)) {
+		out.push(`${prefix}${c("bold", "commands")}`);
+		for (const cmd of r.commands) out.push(`${prefix}  ${c("dim", shortText(cmd, 100))}`);
+	}
+	if (has(r.open)) {
+		out.push(`${prefix}${c("bold", "open")}`);
+		for (const o of r.open) out.push(`${prefix}  ${c("yellow", shortText(o, 100))}`);
+	}
+	if (r.notes) out.push(`${prefix}${c("bold", "notes")}  ${shortText(r.notes, 120)}`);
+	return out;
+}
+/** repo-relative display of a changed path when it lies under cwd. */
+function relShort(p, cwd) {
+	if (!cwd) return p;
+	const r = relative(cwd, p);
+	return r && !r.startsWith("..") ? r : p;
+}
+
+//#endregion
+//#region src/workers/mcp.ts
+/**
+* mcp.ts — the MCP allowlist for headless workers.
+*
+* Headless workers start with NO MCP servers: every server definition is a
+* prompt-time tool inventory the model pays to know, and a worker that only
+* reads and edits files needs none of it. A run may opt in with `--mcp
+* name[,name…]` (or a role carrying `"mcp": [...]`); names may be single
+* servers from ~/.claude.json's `mcpServers` or `workers.mcpSets` set names,
+* which expand to their member list. The filtered config lands in
+* `<logDir>/<id>.mcp.json` and is passed with `--strict-mcp-config
+* --mcp-config` so exactly those servers load. MCP servers are chosen at
+* launch only — a mid-run `say` cannot add any.
+*/
+/** ~/.claude.json — the user's MCP server definitions (top-level mcpServers). */
+const CLAUDE_JSON = join(homedir(), ".claude.json");
+function readMcpServers(claudeJson = CLAUDE_JSON) {
+	try {
+		if (!existsSync(claudeJson)) return {};
+		const servers = JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers;
+		if (typeof servers !== "object" || servers === null || Array.isArray(servers)) return {};
+		return servers;
+	} catch {
+		return {};
+	}
+}
+/**
+* Split a `--mcp a,b,c` flag value (also accepts repeated flags already split
+* by the caller) and expand set names from workers.mcpSets.
+*/
+function expandMcpNames(names, config, claudeJson = CLAUDE_JSON) {
+	const available = readMcpServers(claudeJson);
+	const out = [];
+	for (const raw of names) for (const name of raw.split(",").map((s) => s.trim()).filter(Boolean)) {
+		if (name in config.mcpSets) {
+			for (const member of config.mcpSets[name]) if (!out.includes(member)) out.push(member);
+			continue;
+		}
+		if (!(name in available)) {
+			const sets = Object.keys(config.mcpSets);
+			throw new WorkersConfigError(`unknown MCP server "${name}". Available servers: ${Object.keys(available).join(", ") || "(none in ~/.claude.json)"}${sets.length ? `; sets: ${sets.join(", ")}` : ""}`);
+		}
+		if (!out.includes(name)) out.push(name);
+	}
+	return out;
+}
+/** Path of a run's filtered MCP config. */
+function runMcpConfigPath(logDir, id) {
+	return join(logDir, `${id}.mcp.json`);
+}
+/**
+* Write a config containing only `names` (already expanded) and return its
+* path. Unknown names fail fast with the available list.
+*/
+function writeMcpConfig(logDir, id, names, claudeJson = CLAUDE_JSON) {
+	const available = readMcpServers(claudeJson);
+	const unknown = names.filter((n) => !(n in available));
+	if (unknown.length) throw new WorkersConfigError(`unknown MCP server(s): ${unknown.join(", ")}. Available: ${Object.keys(available).join(", ") || "(none in ~/.claude.json)"}`);
+	const servers = {};
+	for (const n of names) servers[n] = available[n];
+	const path = runMcpConfigPath(logDir, id);
+	if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
+	writeFileSync(path, JSON.stringify({ mcpServers: servers }, null, 2) + "\n", "utf8");
+	return path;
+}
+/** `pai worker mcp list`: the servers and sets a run could name. */
+function describeMcp(config, claudeJson = CLAUDE_JSON) {
+	const servers = Object.keys(readMcpServers(claudeJson));
+	const lines = [];
+	if (servers.length) {
+		lines.push(`servers (~/.claude.json):`);
+		for (const s of servers) lines.push(`  ${s}`);
+	} else lines.push(`no MCP servers defined in ~/.claude.json`);
+	const sets = Object.entries(config.mcpSets);
+	if (sets.length) {
+		lines.push(`sets (workers.mcpSets):`);
+		for (const [name, members] of sets) lines.push(`  ${name} = ${members.join(", ")}`);
+	}
+	lines.push(`usage: pai worker run --mcp <name>[,<name>…] -p '<task>'`);
+	return lines;
+}
+
+//#endregion
+//#region src/workers/operator.ts
+/**
+* operator.ts — talking to a running worker.
+*
+* Headless workers run with `--input-format stream-json` and their stdin held
+* open, so a run is a conversation: every line sent to the per-worker Unix
+* socket `<logDir>/<id>.sock` is forwarded to the child as a user message and
+* mirrored into the transcript as an `operator` event (rendered with a »
+* marker). Once the worker has finished its turn, stdin closes 2 s later
+* unless a new message arrives — after that, `say` refuses and `resume`
+* continues the same Claude session with the worker's context intact.
+*/
+function operatorSocketPath(logDir, id) {
+	return join(logDir, `${id}.sock`);
+}
+/**
+* The runner's side: listen on the worker socket, hand every received line to
+* `onLine`. Returns the server (close it when the run ends; the socket file is
+* unlinked on close, best effort).
+*/
+function createOperatorServer(logDir, id, onLine) {
+	const path = operatorSocketPath(logDir, id);
+	try {
+		if (existsSync(path)) unlinkSync(path);
+	} catch {}
+	const server = createServer((socket) => {
+		let buf = "";
+		socket.on("data", (chunk) => {
+			buf += chunk.toString("utf8");
+			let nl;
+			while ((nl = buf.indexOf("\n")) >= 0) {
+				const line = buf.slice(0, nl).replace(/\r$/, "");
+				buf = buf.slice(nl + 1);
+				if (line.trim()) onLine(line);
+				socket.write("ok\n");
+			}
+		});
+	});
+	server.listen(path);
+	server.on("close", () => {
+		try {
+			if (existsSync(path)) unlinkSync(path);
+		} catch {}
+	});
+	return server;
+}
+/**
+* `pai worker say <id> "<text>"`: forward one line to a running worker.
+* Resolves "ok", rejects with a clear message when the worker is not running.
+*/
+function sayToWorker(logDir, id, text, timeoutMs = 4e3) {
+	const status = loadStatus(logDir, id);
+	if (!status) return Promise.reject(/* @__PURE__ */ new Error(`no worker named "${id}"`));
+	if (status.state !== "running" || !alive(status.pid)) return Promise.reject(/* @__PURE__ */ new Error(`worker ${id} is not running (state: ${status.state}) — continue it instead with: pai worker resume ${id} "<text>"`));
+	const path = operatorSocketPath(logDir, id);
+	if (!existsSync(path)) return Promise.reject(/* @__PURE__ */ new Error(`worker ${id} has no operator socket (${path}) — it may predate this PAI version`));
+	return new Promise((resolve, reject) => {
+		const sock = connect(path);
+		const fail = (e) => {
+			sock.destroy();
+			reject(/* @__PURE__ */ new Error(`cannot talk to worker ${id}: ${e.message}`));
+		};
+		sock.setTimeout(timeoutMs, () => fail(/* @__PURE__ */ new Error("timeout")));
+		sock.once("error", (e) => fail(e));
+		sock.once("connect", () => {
+			sock.write(text.replace(/\n/g, " ") + "\n");
+		});
+		sock.once("data", () => {
+			sock.end();
+			resolve("ok");
+		});
+	});
+}
+
+//#endregion
+//#region src/workers/proxy/server.ts
+/**
+* server.ts — the PAI worker proxy: Anthropic Messages API on the front,
+* OpenAI Chat Completions on the back, loopback only.
+*
+* One proxy serves every OpenAI-protocol provider: Claude Code points
+* ANTHROPIC_BASE_URL at `http://127.0.0.1:8797/<provider>` and the provider
+* name in the path selects the upstream (`upstreamUrl` + `keyFile` from the
+* workers config, re-read per request so config edits apply without a
+* restart). `run` starts the proxy on demand (detached, pid file under the
+* logDir) and `pai worker proxy stop` stops it again.
+*
+* All translation lives in translate.ts; this file is only HTTP plumbing.
+*/
+const DEFAULT_PROXY_PORT = 8797;
+const HOST = "127.0.0.1";
+function proxyPidPath(logDir) {
+	return join(logDir, "proxy.pid");
+}
+/** True when something already accepts connections on the port. */
+function proxyListening(port = DEFAULT_PROXY_PORT, timeoutMs = 400) {
+	return new Promise((resolve) => {
+		const sock = connect({
+			port,
+			host: HOST
+		});
+		const done = (ok) => {
+			sock.removeAllListeners();
+			sock.destroy();
+			resolve(ok);
+		};
+		sock.setTimeout(timeoutMs, () => done(false));
+		sock.once("connect", () => done(true));
+		sock.once("error", () => done(false));
+	});
+}
+/**
+* Where the standalone proxy artefact lives, found from this module's own
+* location (dist/cli bundle → ../hooks/, dev checkout → <repo>/dist/hooks).
+*/
+function standaloneProxyPath() {
+	let dir = dirname(fileURLToPath(import.meta.url));
+	for (let i = 0; i < 6; i++) {
+		for (const cand of [
+			join(dir, "worker-proxy.mjs"),
+			join(dir, "hooks", "worker-proxy.mjs"),
+			join(dir, "dist", "hooks", "worker-proxy.mjs")
+		]) if (existsSync(cand)) return cand;
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return null;
+}
+/**
+* Ensure a proxy is listening on the port; start the detached standalone when
+* nothing answers. Returns the base URL (`http://127.0.0.1:<port>`).
+*/
+async function ensureProxyRunning(port, logDir) {
+	if (await proxyListening(port)) return `http://${HOST}:${port}`;
+	const script = standaloneProxyPath();
+	if (!script) throw new Error(`the PAI worker proxy is not running and its build was not found — run \`bun run build\` (or start one with: pai worker proxy --port ${port})`);
+	if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
+	const child = spawn(process.execPath, [
+		script,
+		"--port",
+		String(port)
+	], {
+		detached: true,
+		stdio: "ignore"
+	});
+	child.unref();
+	writeFileSync(proxyPidPath(logDir), `${child.pid}\n`, "utf8");
+	for (let i = 0; i < 40; i++) {
+		if (await proxyListening(port)) return `http://${HOST}:${port}`;
+		await new Promise((r) => setTimeout(r, 250));
+	}
+	throw new Error(`the PAI worker proxy did not come up on port ${port} (see ${proxyPidPath(logDir)})`);
+}
+/** `pai worker proxy stop`: SIGTERM the pid from the pid file. */
+function stopProxy(logDir) {
+	const path = proxyPidPath(logDir);
+	if (!existsSync(path)) return "no proxy pid file — nothing to stop";
+	const pid = parseInt(readFileSync(path, "utf8").trim(), 10);
+	unlinkSync(path);
+	if (!Number.isFinite(pid)) return "stale proxy pid file removed";
+	try {
+		process.kill(pid, "SIGTERM");
+	} catch {
+		return `proxy pid ${pid} was not running (pid file removed)`;
+	}
+	return `proxy pid ${pid} stopped`;
+}
+
+//#endregion
+//#region src/workers/codex.ts
+/**
+* codex.ts — the "codex" runner engine.
+*
+* A ChatGPT plan gives no API key, only Codex CLI access, so a provider may
+* set `engine: "codex"`: `run` then shells out to `codex exec --json <prompt>`
+* (non-interactive) instead of Claude Code. The JSONL event stream is parsed
+* into the same status-file fields (turns, tools, last) and ledger lines as a
+* Claude run, and is normalised into claude-code-shaped events in the
+* worker's .jsonl so follow/replay/the pane render it unchanged.
+*
+* Implemented against the documented `codex exec --json` interface
+* (thread.started / item.completed / turn.completed / turn.failed lines);
+* verify against the installed CLI when one is present.
+* `--allowedTools` has no Codex equivalent and is dropped (ledgered).
+*/
+/** Build the codex exec argument vector (without the binary itself). */
+function buildCodexArgs(prompt, model) {
+	return [
+		"exec",
+		"--json",
+		"--skip-git-repo-check",
+		...model ? ["-m", model] : [],
+		"--",
+		prompt
+	];
+}
+/** Env for a codex run: caller's env, Anthropic vars stripped, key applied. */
+function buildCodexEnv(provider) {
+	const env = { ...process.env };
+	delete env.ANTHROPIC_API_KEY;
+	delete env.ANTHROPIC_BASE_URL;
+	delete env.ANTHROPIC_AUTH_TOKEN;
+	delete env.ANTHROPIC_DEFAULT_HAIKU_MODEL;
+	delete env.ANTHROPIC_DEFAULT_SONNET_MODEL;
+	delete env.ANTHROPIC_DEFAULT_OPUS_MODEL;
+	const keyPath = providerKeyPath(provider);
+	if (keyPath && existsSync(keyPath)) env.OPENAI_API_KEY = readFileSync(keyPath, "utf8").trim();
+	if (provider.upstreamUrl) env.OPENAI_BASE_URL = provider.upstreamUrl;
+	for (const [k, v] of Object.entries(provider.env)) env[k] = v;
+	env.PAI_WORKER = "1";
+	return env;
+}
+/** Codex "not applicable" flags the runner drops with a ledger note. */
+function codexDroppedFlags(argv) {
+	const dropped = [];
+	for (let i = 0; i < argv.length; i++) {
+		const a = argv[i];
+		if (a === "--allowedTools" || a === "--disallowedTools" || a === "--mcp-config" || a === "--mcp") {
+			dropped.push(a);
+			if (i + 1 < argv.length && !argv[i + 1].startsWith("-")) i++;
+		} else if (a.startsWith("--allowedTools=") || a.startsWith("--mcp-config=")) dropped.push(a.split("=")[0]);
+	}
+	return dropped;
+}
+const emptyCodexResult = () => ({
+	events: [],
+	turns: 0,
+	tools: 0,
+	last: null,
+	isError: false,
+	contextTokens: null,
+	finalText: null,
+	threadId: null
+});
+/**
+* Fold one parsed `codex exec --json` line into the running result: appends
+* normalised transcript events and updates the counters in place.
+*/
+function foldCodexLine(line, r) {
+	if (typeof line !== "object" || line === null) return;
+	const e = line;
+	const type = typeof e.type === "string" ? e.type : "";
+	if (type === "thread.started" && typeof e.thread_id === "string") {
+		r.threadId = e.thread_id;
+		return;
+	}
+	if (type === "item.completed" && typeof e.item === "object" && e.item !== null) {
+		const item = e.item;
+		const kind = typeof item.type === "string" ? item.type : "";
+		if (kind === "agent_message" && typeof item.text === "string") {
+			r.turns += 1;
+			r.last = `says: ${item.text.slice(0, 70)}`;
+			r.finalText = item.text;
+			r.events.push({
+				type: "assistant",
+				message: { content: [{
+					type: "text",
+					text: item.text
+				}] }
+			});
+		} else if (kind === "command_execution") {
+			r.tools += 1;
+			const cmd = typeof item.command === "string" ? item.command : "?";
+			const rc = typeof item.exit_code === "number" ? item.exit_code : 0;
+			r.last = `Bash: ${cmd.slice(0, 70)}`;
+			r.events.push({
+				type: "assistant",
+				message: { content: [{
+					type: "tool_use",
+					name: "Bash",
+					input: { command: cmd }
+				}] }
+			});
+			r.events.push({
+				type: "user",
+				message: { content: [{
+					type: "tool_result",
+					tool_use_id: "",
+					is_error: rc !== 0,
+					content: item.aggregated_output ?? ""
+				}] }
+			});
+		} else if (kind === "file_change") {
+			r.tools += 1;
+			const files = (Array.isArray(item.changes) ? item.changes : []).map((c) => typeof c === "object" && c !== null && typeof c.path === "string" ? c.path : "?").join(", ");
+			r.last = `files: ${files.slice(0, 70)}`;
+			r.events.push({
+				type: "assistant",
+				message: { content: [{
+					type: "tool_use",
+					name: "Write",
+					input: { file_path: files }
+				}] }
+			});
+		} else if (kind === "mcp_tool_call") {
+			r.tools += 1;
+			r.last = `mcp: ${String(item.tool ?? "?")}`;
+		}
+		return;
+	}
+	if (type === "turn.completed") {
+		const usage = typeof e.usage === "object" && e.usage !== null ? e.usage : {};
+		const tokens = (usage.input_tokens ?? 0) + (usage.cached_input_tokens ?? 0) + (usage.output_tokens ?? 0);
+		if (tokens > 0) r.contextTokens = tokens;
+		return;
+	}
+	if (type === "turn.failed" || type === "error") {
+		r.isError = true;
+		const err = typeof e.error === "object" && e.error !== null ? e.error : {};
+		r.last = String(err.message ?? e.message ?? "codex turn failed");
+	}
+}
+/** Parse one JSONL line; null for blanks and non-JSON noise. */
+function parseCodexLine(line) {
+	const t = line.trim();
+	if (!t.startsWith("{")) return null;
+	try {
+		return JSON.parse(t);
+	} catch {
+		return null;
+	}
+}
+/** True when the Codex CLI is on PATH (test reports "not installed" else). */
+function codexInstalled() {
+	try {
+		execFileSync("codex", ["--version"], {
+			timeout: 5e3,
+			stdio: "ignore"
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+//#region src/workers/run.ts
+/**
+* run.ts — the worker runner (port of the glm / glm-run pair, provider-neutral).
+*
+* One claude-code process per call, pointed at the chosen provider:
+*
+*   - env: ANTHROPIC_BASE_URL/AUTH_TOKEN from the provider (token from its
+*     key file, never from the environment), the three DEFAULT_*_MODEL vars,
+*     the provider's extra env, nonessential traffic off, and ANTHROPIC_API_KEY
+*     stripped so nothing can fall back to Anthropic billing. OpenAI-protocol
+*     providers point at the PAI proxy instead (started on demand, the
+*     provider name in the URL path); codex-engine providers run the Codex CLI.
+*   - headless (-p): strict empty MCP config unless the caller brings one or
+*     names servers via --mcp / a role (then a filtered <id>.mcp.json),
+*     PAI_WORKER=1 so PAI's per-session hooks leave it alone, the worker
+*     contract appended to the system prompt, `--input-format stream-json`
+*     with the prompt as the first stdin user message (the operator socket
+*     can add more mid-run), stream-json mirroring (every line stamped `_ts`)
+*     into <logDir>/<id>.jsonl, a live <id>.status for ps/follow/status line
+*     (context meter included), ledger lines, result printed in the caller's
+*     --output-format (json adds the parsed `report`), and the follow pane
+*     (unless --no-pane).
+*   - interactive: no MCP restriction, no pane, ENABLE_TOOL_SEARCH=true.
+*
+* Auto-routed runs that die of a quota error before the first tool call are
+* restarted on the next provider in routing order (WORKER-REROUTE ledger line).
+*/
+/** Environment for a run through `provider`. Caller's env minus the Anthropic key. */
+function buildRunEnv(provider, headless, proxyUrl) {
+	const env = { ...process.env };
+	delete env.ANTHROPIC_API_KEY;
+	let token = "local";
+	if (proxyUrl) env.ANTHROPIC_BASE_URL = proxyUrl;
+	else {
+		const keyPath = providerKeyPath(provider);
+		if (keyPath) {
+			try {
+				token = readFileSync(keyPath, "utf8").trim();
+			} catch {
+				throw new Error(`key file not readable: ${keyPath}`);
+			}
+			if (!token) throw new Error(`key file is empty: ${keyPath}`);
+		}
+		env.ANTHROPIC_BASE_URL = provider.baseUrl;
+	}
+	env.ANTHROPIC_AUTH_TOKEN = token;
+	env.ANTHROPIC_DEFAULT_HAIKU_MODEL = provider.models.fast ?? provider.models.default;
+	env.ANTHROPIC_DEFAULT_SONNET_MODEL = provider.models.default;
+	env.ANTHROPIC_DEFAULT_OPUS_MODEL = provider.models.default;
+	for (const [k, v] of Object.entries(provider.env)) env[k] = v;
+	env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1";
+	if (headless) env.PAI_WORKER = "1";
+	else env.ENABLE_TOOL_SEARCH = "true";
+	return env;
+}
+/** The strict empty MCP config for headless workers, written on demand. */
+function ensureNoMcpConfig(logDir) {
+	const path = noMcpConfigPath(logDir);
+	if (!existsSync(path)) {
+		mkdirSync(logDir, { recursive: true });
+		writeFileSync(path, "{ \"mcpServers\": {} }\n", "utf8");
+	}
+	return path;
+}
+/** A stream-json user message for the child's stdin. */
+function stdinUserMessage(text) {
+	return JSON.stringify({
+		type: "user",
+		message: {
+			role: "user",
+			content: text
+		}
+	});
+}
+/** ISO stamp with seconds, attached to every mirrored event (2g). */
+function isoStamp(d = /* @__PURE__ */ new Date()) {
+	return d.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+/** Context tokens of an assistant/result usage block (input+cache+output). */
+function usageContextTokens(u) {
+	if (!u) return null;
+	const t = (u.input_tokens ?? 0) + (u.cache_read_input_tokens ?? 0) + (u.cache_creation_input_tokens ?? 0) + (u.output_tokens ?? 0);
+	return t > 0 ? t : null;
+}
+/** Context window announced by the init event, when the endpoint sends one. */
+function initContextWindow(e) {
+	if (typeof e.context_window === "number" && e.context_window > 0) return e.context_window;
+	if (e.model_info && typeof e.model_info.context_window === "number" && e.model_info.context_window > 0) return e.model_info.context_window;
+	return null;
+}
+/**
+* Run one worker. Returns the process exit code to pass through.
+* Throws WorkersConfigError-shaped Errors for configuration problems.
+*/
+async function runWorker(opts) {
+	const { raw: _raw, workers: config } = readWorkersSection();
+	if (!config.enabled) throw new Error("workers are off. Turn them on with: pai worker on\n(then the Agent-tool hook stops denying Anthropic subagents only when you do)");
+	const logDir = workersLogDir(config);
+	mkdirSync(logDir, { recursive: true });
+	const target = resolveTarget(config, logDir, {
+		flagProvider: opts.providerFlag,
+		role: opts.role
+	});
+	assertProviderRunnable(target.providerName, target.provider);
+	const parsed = parseRunnerArgs(opts.claudeArgs);
+	const label = opts.label ?? shortText(parsed.prompt ?? "(no prompt)", 70);
+	const model = opts.modelFlag ?? (target.modelAlias === "fast" ? target.provider.models.fast ?? target.provider.models.default : target.provider.models.default);
+	try {
+		if (target.provider.engine === "codex") return await executeCodexRun({
+			config,
+			logDir,
+			target,
+			model,
+			label,
+			parsed,
+			claudeArgs: opts.claudeArgs,
+			noPane: opts.noPane ?? false,
+			onWorkerStart: opts.onWorkerStart
+		});
+		return await executeRun({
+			config,
+			logDir,
+			target,
+			model,
+			label,
+			parsed,
+			claudeArgs: opts.claudeArgs,
+			noPane: opts.noPane ?? false,
+			mcpFlag: opts.mcpFlag,
+			onWorkerStart: opts.onWorkerStart,
+			reroutes: opts._reroutes ?? 0
+		});
+	} catch (e) {
+		if (e instanceof Error && e.message.startsWith("key file")) throw new Error(`provider "${target.providerName}": ${e.message}\nPut the token in that file (chmod 600) or point keyFile elsewhere.`);
+		throw e;
+	}
+}
+async function executeRun(a) {
+	const { config, logDir, target, model, label, parsed, noPane } = a;
+	const headless = parsed.headless;
+	let proxyUrl;
+	if (target.provider.protocol === "openai") proxyUrl = `${await ensureProxyRunning(DEFAULT_PROXY_PORT, logDir)}/${target.providerName}`;
+	const env = buildRunEnv(target.provider, headless, proxyUrl);
+	const wid = newWorkerId();
+	const cwd = process.cwd();
+	const term = process.env.ITERM_SESSION_ID ?? "";
+	const session = resolveSession(term);
+	const status = {
+		id: wid,
+		pid: process.pid,
+		label,
+		cwd,
+		term,
+		provider: target.providerName,
+		model,
+		state: "running",
+		started: nowStamp(),
+		updated: nowStamp(),
+		turns: 0,
+		tools: 0,
+		last: headless ? "starting" : "interactive",
+		rc: null,
+		secs: null,
+		...session ? { session } : {},
+		contextWindow: providerContextWindow(target.provider)
+	};
+	saveStatus(logDir, status);
+	a.onWorkerStart?.(wid);
+	const ledger = ledgerPath(logDir);
+	appendLedger(ledger, "WORKER-START", {
+		id: wid,
+		provider: target.providerName,
+		mode: headless ? "headless" : "interactive",
+		model,
+		cwd,
+		label
+	});
+	if (headless && !noPane && config.pane.enabled && term && process.env.PAI_WORKER_AUTOPANE !== "0") openPaneForWorker(logDir, config, wid, term).catch(() => {});
+	let mcpArgs = [];
+	if (headless && !parsed.callerMcpConfig) {
+		const wanted = [
+			...a.mcpFlag ? [a.mcpFlag] : [],
+			...parsed.mcp,
+			...target.roleMcp ?? []
+		];
+		if (wanted.length) mcpArgs = [
+			"--strict-mcp-config",
+			"--mcp-config",
+			writeMcpConfig(logDir, wid, expandMcpNames(wanted, config))
+		];
+		else mcpArgs = [
+			"--strict-mcp-config",
+			"--mcp-config",
+			ensureNoMcpConfig(logDir)
+		];
+	}
+	const restArgs = headless ? stripPromptValues(parsed.rest) : parsed.rest;
+	const cmd = ["claude"];
+	if (!parsed.callerModel) cmd.push("--model", model);
+	cmd.push(...mcpArgs, ...restArgs);
+	if (headless) {
+		cmd.push("--output-format", "stream-json", "--verbose", "--input-format", "stream-json");
+		if (!parsed.callerSystemPrompt) cmd.push("--append-system-prompt", WORKER_CONTRACT_PROMPT);
+	}
+	const t0 = Date.now();
+	const proc = spawn(cmd[0], cmd.slice(1), {
+		env,
+		cwd,
+		stdio: headless ? [
+			"pipe",
+			"pipe",
+			"inherit"
+		] : "inherit"
+	});
+	let operatorInFlight = 0;
+	let closeTimer = null;
+	const armStdinClose = () => {
+		if (closeTimer) clearTimeout(closeTimer);
+		closeTimer = setTimeout(() => {
+			if (operatorInFlight === 0) try {
+				proc.stdin?.end();
+			} catch {}
+		}, 2e3);
+	};
+	let eventsFd = null;
+	const writeEvent = (obj) => {
+		if (eventsFd === null) return;
+		try {
+			writeSync(eventsFd, JSON.stringify({
+				...obj,
+				_ts: isoStamp()
+			}) + "\n");
+		} catch {}
+	};
+	const operatorServer = headless ? createOperatorServer(logDir, wid, (text) => {
+		operatorInFlight += 1;
+		if (closeTimer) {
+			clearTimeout(closeTimer);
+			closeTimer = null;
+		}
+		writeEvent({
+			type: "operator",
+			text
+		});
+		try {
+			proc.stdin?.write(stdinUserMessage(text) + "\n");
+		} catch {}
+	}) : null;
+	let killed = false;
+	const cleanup = () => {
+		if (closeTimer) clearTimeout(closeTimer);
+		operatorServer?.close();
+	};
+	const onSignal = (sig) => {
+		killed = true;
+		status.state = "killed";
+		status.rc = 143;
+		status.secs = Math.floor((Date.now() - t0) / 1e3);
+		status.last = `killed by signal ${sig}`;
+		saveStatus(logDir, status);
+		appendLedger(ledger, "WORKER-END", {
+			id: wid,
+			provider: target.providerName,
+			mode: "headless",
+			model,
+			rc: 143,
+			secs: status.secs,
+			killed: 1,
+			label
+		});
+		cleanup();
+		try {
+			proc.kill();
+		} catch {}
+		process.exit(143);
+	};
+	process.once("SIGTERM", () => onSignal("SIGTERM"));
+	process.once("SIGINT", () => onSignal("SIGINT"));
+	const ctx = {
+		resultEvent: null,
+		resultReport: null
+	};
+	if (headless) {
+		if (parsed.prompt !== null) try {
+			proc.stdin.write(stdinUserMessage(parsed.prompt) + "\n");
+		} catch {}
+		eventsFd = openSync(eventsPath(logDir, wid), "a");
+		createInterface({ input: proc.stdout }).on("line", (line) => {
+			if (parsed.outputFormat === "stream-json") process.stdout.write(line + "\n");
+			if (!line.startsWith("{")) return;
+			let e;
+			try {
+				e = JSON.parse(line);
+			} catch {
+				return;
+			}
+			writeEvent(e);
+			if (e.type === "system" && e.subtype === "init") {
+				if (e.session_id) status.claudeSession = e.session_id;
+				const cw = initContextWindow(e);
+				if (cw) status.contextWindow = cw;
+				saveStatus(logDir, status);
+			} else if (e.type === "assistant") {
+				status.turns += 1;
+				const tokens = usageContextTokens(e.message?.usage);
+				if (tokens) status.contextTokens = tokens;
+				for (const block of e.message?.content ?? []) if (block.type === "tool_use") {
+					status.tools += 1;
+					status.last = describeTool(block.name ?? "?", block.input);
+				} else if (block.type === "text" && (block.text ?? "").trim()) status.last = "says: " + shortText(block.text, 70);
+				saveStatus(logDir, status);
+			} else if (e.type === "result") {
+				const tokens = usageContextTokens(e.usage);
+				if (tokens) status.contextTokens = tokens;
+				const report = parseWorkerReport(e.result ?? "");
+				if (report?.notes) status.last = shortText(report.notes, 90);
+				else if (e.result) status.last = shortText(e.result, 90);
+				saveStatus(logDir, status);
+				operatorInFlight = 0;
+				armStdinClose();
+				ctx.resultEvent = e;
+				ctx.resultReport = report;
+			}
+		});
+	}
+	const rc = await new Promise((resolve, reject) => {
+		proc.on("error", reject);
+		proc.on("close", (code) => resolve(code ?? (killed ? 143 : 1)));
+	});
+	if (eventsFd !== null) closeSync(eventsFd);
+	cleanup();
+	const secs = Math.floor((Date.now() - t0) / 1e3);
+	const resultEvent = ctx.resultEvent;
+	const ok = rc === 0 && resultEvent !== null && !resultEvent.is_error;
+	status.state = ok ? "done" : "failed";
+	status.rc = rc;
+	status.secs = secs;
+	if (resultEvent) status.last = shortText(resultEvent.result ?? "", 90);
+	if (ctx.resultReport?.notes) status.last = shortText(ctx.resultReport.notes, 90);
+	saveStatus(logDir, status);
+	appendLedger(ledger, "WORKER-END", {
+		id: wid,
+		provider: target.providerName,
+		mode: headless ? "headless" : "interactive",
+		model,
+		rc,
+		secs,
+		turns: status.turns,
+		tools: status.tools,
+		label
+	});
+	if (headless) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, ctx.resultReport);
+	const resultText = resultEvent?.result ?? "";
+	if (!ok && headless && a.target.via === "auto" && config.routing.retryOnQuota && status.turns <= 1 && status.tools === 0 && isQuotaFailure(resultText)) {
+		setCooldown(logDir, target.providerName, config.routing.cooldownMinutes);
+		const next = nextAutoProvider(config, logDir, target.providerName);
+		if (next && a.reroutes < config.routing.order.length) {
+			appendLedger(ledger, "WORKER-REROUTE", {
+				from: target.providerName,
+				to: next,
+				reason: "quota"
+			});
+			return runWorker({
+				providerFlag: next,
+				label,
+				noPane: a.noPane,
+				mcpFlag: a.mcpFlag,
+				claudeArgs: a.claudeArgs,
+				onWorkerStart: a.onWorkerStart,
+				_reroutes: a.reroutes + 1
+			});
+		}
+	}
+	return rc !== 0 ? rc : ok ? 0 : 1;
+}
+async function executeCodexRun(a) {
+	const { config, logDir, target, model, label, parsed, noPane } = a;
+	if (!parsed.headless || parsed.prompt === null) throw new Error(`provider "${target.providerName}" (engine codex) supports headless runs only: pass the task with -p '<prompt>'`);
+	const env = buildCodexEnv(target.provider);
+	const wid = newWorkerId();
+	const cwd = process.cwd();
+	const term = process.env.ITERM_SESSION_ID ?? "";
+	const session = resolveSession(term);
+	const status = {
+		id: wid,
+		pid: process.pid,
+		label,
+		cwd,
+		term,
+		provider: target.providerName,
+		model,
+		state: "running",
+		started: nowStamp(),
+		updated: nowStamp(),
+		turns: 0,
+		tools: 0,
+		last: "starting",
+		rc: null,
+		secs: null,
+		...session ? { session } : {},
+		contextWindow: providerContextWindow(target.provider)
+	};
+	saveStatus(logDir, status);
+	a.onWorkerStart?.(wid);
+	const ledger = ledgerPath(logDir);
+	appendLedger(ledger, "WORKER-START", {
+		id: wid,
+		provider: target.providerName,
+		mode: "headless",
+		engine: "codex",
+		model,
+		cwd,
+		label
+	});
+	const dropped = codexDroppedFlags(a.claudeArgs);
+	if (dropped.length) appendLedger(ledger, "WORKER-NOTE", {
+		id: wid,
+		note: `dropped for codex: ${dropped.join(", ")}`
+	});
+	if (!noPane && config.pane.enabled && term && process.env.PAI_WORKER_AUTOPANE !== "0") openPaneForWorker(logDir, config, wid, term).catch(() => {});
+	const t0 = Date.now();
+	const proc = spawn("codex", buildCodexArgs(parsed.prompt, parsed.callerModel ? void 0 : model), {
+		env,
+		cwd,
+		stdio: [
+			"ignore",
+			"pipe",
+			"inherit"
+		]
+	});
+	const fold = emptyCodexResult();
+	const eventsFd = openSync(eventsPath(logDir, wid), "a");
+	const writeEvent = (obj) => {
+		try {
+			writeSync(eventsFd, JSON.stringify({
+				...obj,
+				_ts: isoStamp()
+			}) + "\n");
+		} catch {}
+	};
+	writeEvent({
+		type: "system",
+		subtype: "init",
+		model,
+		cwd
+	});
+	let killed = false;
+	process.once("SIGTERM", onCodexSignal("SIGTERM"));
+	process.once("SIGINT", onCodexSignal("SIGINT"));
+	function onCodexSignal(sig) {
+		return () => {
+			killed = true;
+			status.state = "killed";
+			status.rc = 143;
+			status.secs = Math.floor((Date.now() - t0) / 1e3);
+			status.last = `killed by signal ${sig}`;
+			saveStatus(logDir, status);
+			try {
+				proc.kill();
+			} catch {}
+			process.exit(143);
+		};
+	}
+	createInterface({ input: proc.stdout }).on("line", (line) => {
+		if (parsed.outputFormat === "stream-json") process.stdout.write(line + "\n");
+		const parsedLine = parseCodexLine(line);
+		if (parsedLine === null) return;
+		foldCodexLine(parsedLine, fold);
+		if (fold.threadId && !status.claudeSession) status.claudeSession = fold.threadId;
+		status.turns = fold.turns;
+		status.tools = fold.tools;
+		if (fold.last) status.last = shortText(fold.last, 90);
+		if (fold.contextTokens) status.contextTokens = fold.contextTokens;
+		saveStatus(logDir, status);
+		for (const ev of fold.events.splice(0)) writeEvent(ev);
+	});
+	const rc = await new Promise((resolve, reject) => {
+		proc.on("error", reject);
+		proc.on("close", (code) => resolve(code ?? (killed ? 143 : 1)));
+	});
+	closeSync(eventsFd);
+	const secs = Math.floor((Date.now() - t0) / 1e3);
+	const finalText = fold.finalText ?? "";
+	const report = parseWorkerReport(finalText);
+	const resultEvent = {
+		type: "result",
+		result: finalText,
+		is_error: fold.isError || rc !== 0,
+		num_turns: fold.turns,
+		duration_ms: secs * 1e3
+	};
+	writeEvent(resultEvent);
+	const ok = rc === 0 && !fold.isError;
+	status.state = ok ? "done" : "failed";
+	status.rc = rc;
+	status.secs = secs;
+	status.last = shortText(report?.notes ?? finalText, 90) || (ok ? "done" : "failed");
+	saveStatus(logDir, status);
+	appendLedger(ledger, "WORKER-END", {
+		id: wid,
+		provider: target.providerName,
+		mode: "headless",
+		engine: "codex",
+		model,
+		rc,
+		secs,
+		turns: status.turns,
+		tools: status.tools,
+		label
+	});
+	printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, report);
+	return rc !== 0 ? rc : ok ? 0 : 1;
+}
+function printResult(fmt, resultEvent, rc, logDir, wid, report) {
+	if (fmt === "stream-json") return;
+	if (fmt === "json") {
+		const payload = report ? {
+			...resultEvent ?? {
+				is_error: true,
+				result: "no result event",
+				rc
+			},
+			report
+		} : resultEvent ?? {
+			is_error: true,
+			result: "no result event",
+			rc
+		};
+		console.log(JSON.stringify(payload));
+		return;
+	}
+	if (resultEvent) console.log(resultEvent.result ?? "");
+	else process.stderr.write(`pai worker: run produced no result (rc=${rc}); see ${eventsPath(logDir, wid)}\n`);
+}
+/**
+* Run a one-word pong probe through the provider (headless, no pane) and
+* report provider, model, latency and the reply. ok is false unless the reply
+* was exactly "pong" (case-insensitive, whitespace-trimmed).
+*/
+async function testProvider(providerName, provider, logDir, timeoutMs = 9e4) {
+	assertProviderRunnable(providerName, provider);
+	const model = provider.models.default;
+	if (provider.engine === "codex") {
+		const skipped = codexInstalled() ? void 0 : "codex not installed";
+		return {
+			provider: providerName,
+			model,
+			latencyMs: 0,
+			result: skipped ?? "codex engine: pong probe through codex exec not implemented",
+			ok: false,
+			...skipped ? { skipped } : {}
+		};
+	}
+	let proxyUrl;
+	if (provider.protocol === "openai") proxyUrl = `${await ensureProxyRunning(DEFAULT_PROXY_PORT, logDir)}/${providerName}`;
+	const env = buildRunEnv(provider, true, proxyUrl);
+	const t0 = Date.now();
+	const proc = spawn("claude", [
+		"--model",
+		model,
+		"--strict-mcp-config",
+		"--mcp-config",
+		ensureNoMcpConfig(logDir),
+		"-p",
+		"Reply with exactly one word: pong",
+		"--output-format",
+		"json"
+	], {
+		env,
+		stdio: [
+			"ignore",
+			"pipe",
+			"inherit"
+		]
+	});
+	const timer = setTimeout(() => {
+		try {
+			proc.kill("SIGKILL");
+		} catch {}
+	}, timeoutMs);
+	let out = "";
+	proc.stdout.on("data", (chunk) => {
+		out += chunk.toString("utf8");
+	});
+	const rc = await new Promise((resolve) => {
+		proc.on("error", () => resolve(1));
+		proc.on("close", (code) => resolve(code ?? 1));
+	});
+	clearTimeout(timer);
+	return {
+		provider: providerName,
+		model,
+		latencyMs: Date.now() - t0,
+		result: resultFromOutput(out),
+		ok: rc === 0 && resultFromOutput(out).trim().toLowerCase() === "pong"
+	};
+}
+/**
+* Pull the reply out of claude's stdout. With --verbose, `--output-format
+* json` dumps a JSON array of stream events and the reply sits in the last
+* "result" event; without it, stdout is the single result object. Accept
+* either shape, plus a bare-text fallback for error output.
+*/
+function resultFromOutput(out) {
+	const trimmed = out.trim();
+	if (!trimmed) return "";
+	const parse = (s) => {
+		try {
+			return JSON.parse(s);
+		} catch {
+			return;
+		}
+	};
+	const fromValue = (v) => {
+		if (Array.isArray(v)) {
+			for (let i = v.length - 1; i >= 0; i--) {
+				const r = fromValue(v[i]);
+				if (r !== null) return r;
+			}
+			return null;
+		}
+		if (typeof v === "object" && v !== null) {
+			const o = v;
+			if (o.type === "result" && typeof o.result === "string") return o.result;
+		}
+		return null;
+	};
+	const direct = fromValue(parse(trimmed));
+	if (direct !== null) return direct;
+	const lines = trimmed.split("\n");
+	for (let i = lines.length - 1; i >= 0; i--) {
+		const r = fromValue(parse(lines[i]));
+		if (r !== null) return r;
+	}
+	return trimmed.slice(0, 200);
+}
+
+//#endregion
+//#region src/workers/render.ts
+/**
+* render.ts — turn worker events into the lines a human reads.
+*
+* Ports the glm-ps transcript rendering: the gutter rules (dim `>` for reads
+* and searches, `$` for shell, magenta `~` + red/green diff for edits, green
+* `+` for writes), Read-result trimming (first 3 lines then a count), and the
+* result footer. Colors are applied only when the output is a TTY, so MCP
+* tool output stays plain text.
+*/
+const CODES = {
+	dim: "2",
+	bold: "1",
+	red: "31",
+	green: "32",
+	yellow: "33",
+	blue: "34",
+	mag: "35",
+	cyan: "36"
+};
+function makeColor(enabled) {
+	return (name, s) => enabled ? `\x1b[${CODES[name]}m${s}\x1b[0m` : s;
+}
+/** Path relative to cwd when it lies inside it, otherwise unchanged. */
+function relPath(path, cwd) {
+	if (!path || !cwd) return path;
+	let r;
+	try {
+		r = relative(cwd, path);
+	} catch {
+		return path;
+	}
+	return r.startsWith("..") ? path : r;
+}
+/** Minimal line diff for Edit previews: common prefix/suffix, one hunk. */
+function unifiedDiffLines(oldStr, newStr) {
+	const oldL = oldStr.split("\n");
+	const newL = newStr.split("\n");
+	let start = 0;
+	while (start < oldL.length && start < newL.length && oldL[start] === newL[start]) start++;
+	let endOld = oldL.length;
+	let endNew = newL.length;
+	while (endOld > start && endNew > start && oldL[endOld - 1] === newL[endNew - 1]) {
+		endOld--;
+		endNew--;
+	}
+	const out = [];
+	for (let i = start; i < endOld; i++) out.push("-" + oldL[i]);
+	for (let i = start; i < endNew; i++) out.push("+" + newL[i]);
+	return out;
+}
+/**
+* The transcript gutter (2g): `HH:MM:SS │ ` from the event's `_ts`, dim, with
+* the worker tag in front when several run at once. Continuation lines get
+* blanks of the same width so wrapped text stays aligned. null when the event
+* carries no stamp (logs from before 2g render with the plain prefix).
+*/
+function gutterFor(c, e, tag) {
+	if (!e._ts) return null;
+	const time = e._ts.length >= 19 ? e._ts.slice(11, 19) : e._ts;
+	const head = tag ? `${tag} ${time}` : time;
+	const width = head.length + 3;
+	return {
+		first: c("dim", `${head} │ `),
+		cont: " ".repeat(width)
+	};
+}
+/** Compact token count: 84k, 200k, 900. */
+function fmtK(n) {
+	return n >= 1e3 ? `${Math.round(n / 1e3)}k` : String(n);
+}
+/**
+* The context meter `ctx 84k/200k (42%)`, yellow from 70 %, red from 85 %.
+* null when the numbers are missing or below `minPct` (the table only shows
+* it past 60; the pane liveness line always shows it).
+*/
+function contextMeter(c, s, minPct = 0) {
+	const pct = contextPercent(s);
+	if (pct === null || pct <= minPct) return null;
+	const label = `ctx ${fmtK(s.contextTokens ?? 0)}/${fmtK(s.contextWindow ?? 0)} (${pct}%)`;
+	if (pct > 85) return c("red", label);
+	if (pct > 70) return c("yellow", label);
+	return label;
+}
+function renderToolUse(c, prefix, name, inp, cwd) {
+	const i = typeof inp === "object" && inp !== null ? inp : {};
+	const get = (k) => typeof i[k] === "string" ? i[k] : "";
+	if (name === "Read") return [`${prefix}${c("dim", ">")} Reading ${relPath(get("file_path"), cwd)}`];
+	if (name === "Grep" || name === "Glob") return [`${prefix}${c("dim", ">")} Searching ${c("cyan", get("pattern"))} in ${relPath(get("path") || ".", cwd)}`];
+	if (name === "Bash") return [`${prefix}${c("dim", "$")} ${shortText(get("command"), 160)}`];
+	if (name === "Edit") {
+		const out = [`${prefix}${c("mag", "~")} Editing ${relPath(get("file_path"), cwd)}`];
+		for (const line of unifiedDiffLines(get("old_string"), get("new_string"))) if (line.startsWith("-")) out.push(`${prefix}    ${c("red", line)}`);
+		else if (line.startsWith("+")) out.push(`${prefix}    ${c("green", line)}`);
+		else out.push(`${prefix}    ${c("dim", line)}`);
+		return out;
+	}
+	if (name === "Write") {
+		const n = get("content").split("\n").length;
+		return [`${prefix}${c("green", "+")} Writing ${relPath(get("file_path"), cwd)} (${n} lines)`];
+	}
+	if (name === "WebSearch" || name === "WebFetch") return [`${prefix}${c("dim", ">")} ${name} ${shortText(get("query") || get("url"), 100)}`];
+	return [`${prefix}${c("dim", ">")} ${name} ${shortText(JSON.stringify(i), 120)}`];
+}
+/** Render one stream-json event; `tools` maps tool_use_id → tool name. */
+function renderEvent(c, prefix, e, cwd, tools, gutter) {
+	const out = [];
+	if (e.type === "system" && e.subtype === "init") out.push(`${prefix}${c("dim", `worker started · model ${e.model ?? "?"} · cwd ${basename(e.cwd || cwd || "")}`)}`);
+	else if (e.type === "operator") for (const ln of String(e.text ?? "").split("\n")) out.push(`${prefix}${c("cyan", "» " + ln)}`);
+	else if (e.type === "assistant") {
+		for (const b of e.message?.content ?? []) if (b.type === "text" && (b.text ?? "").trim()) for (const ln of (b.text ?? "").trim().split("\n")) out.push(`${prefix}${ln}`);
+		else if (b.type === "tool_use") out.push(...renderToolUse(c, prefix, b.name ?? "?", b.input, cwd));
+	} else if (e.type === "user") for (const b of e.message?.content ?? []) {
+		if (b.type !== "tool_result") continue;
+		let content = b.content ?? "";
+		if (Array.isArray(content)) content = content.map((x) => typeof x === "object" && x !== null && "text" in x ? String(x.text ?? "") : "").join("\n");
+		const text = String(content);
+		const isError = b.is_error === true;
+		if (!isError && tools[b.tool_use_id ?? ""] === "Read") {
+			const lines = text.split("\n");
+			for (const ln of lines.slice(0, 3)) out.push(`${prefix}${c("dim", ln)}`);
+			if (lines.length > 3) out.push(`${prefix}${c("dim", `    … ${lines.length} lines`)}`);
+		} else if (isError) out.push(`${prefix}    ${c("red", "! " + shortText(text, 200))}`);
+		else if (text.trim()) out.push(`${prefix}    ${c("dim", shortText(text, 120))}`);
+	}
+	else if (e.type === "result") {
+		const mark = !e.is_error ? c("green", "✓ done") : c("red", "✗ failed");
+		out.push(`${prefix}${mark} · ${e.num_turns ?? "?"} turns · ${Math.floor((e.duration_ms ?? 0) / 1e3)}s`);
+		const report = parseWorkerReport(String(e.result ?? ""));
+		if (report) out.push(...renderReport(c, prefix, report, cwd));
+		else for (const ln of String(e.result ?? "").trim().split("\n")) out.push(`${prefix}  ${ln}`);
+	}
+	if (!gutter) return out;
+	return out.map((ln, i) => (i === 0 ? gutter.first : gutter.cont) + ln);
+}
+/** Transcript header: id, provider, label, session name, project dir. */
+function headerLine(c, s) {
+	const bits = [s.provider ? `[${s.provider}]` : "", sessionTag(s)].filter(Boolean).join(" ");
+	const sep = bits ? `  ${bits}` : "";
+	return c("bold", `━━ ${s.id}${sep}  ${s.label}  (${basename(s.cwd)})`);
+}
+/** The ps table (RUNNING + FINISHED last 8). */
+function renderTable(c, statuses, scopeLabel, now = /* @__PURE__ */ new Date()) {
+	const running = [];
+	const done = [];
+	for (const s of statuses) if (s.state === "running" && alive(s.pid)) running.push(s);
+	else {
+		if (s.state === "running") s.state = "lost";
+		done.push(s);
+	}
+	const lines = [c("bold", `Workers  ${`${String(now.getHours()).padStart(2, "0")}:${String(now.getMinutes()).padStart(2, "0")}:${String(now.getSeconds()).padStart(2, "0")}`}`), ""];
+	lines.push(c("bold", `RUNNING (${running.length})`));
+	if (!running.length) lines.push("  none");
+	for (const s of running) {
+		const meter = contextMeter(c, s, 60);
+		lines.push(`  ${c("cyan", s.id)} [${s.provider}]  ${ageOf(s.started, now).padStart(4)} old  turns ${String(s.turns).padStart(2)}  tools ${String(s.tools).padStart(2)}  ${basename(s.cwd)}${meter ? "  " + meter : ""}`);
+		lines.push(`      task: ${s.label}`);
+		lines.push(`      now:  ${c("yellow", s.last)}  (${ageOf(s.updated, now)} ago)`);
+	}
+	lines.push("");
+	lines.push(c("bold", "FINISHED (last 8)"));
+	for (const s of done.slice(-8)) {
+		const col = s.state === "done" ? "green" : "red";
+		const tag = sessionTag(s);
+		lines.push(`  ${s.id} [${s.provider}]${tag ? " " + tag : ""}  ${c(col, s.state.padEnd(6))} rc=${s.rc}  ${String(s.secs ?? "?").padStart(4)}s  turns ${String(s.turns).padStart(2)}  tools ${String(s.tools).padStart(2)}  ${basename(s.cwd)}  ${s.label}`);
+	}
+	lines.push("");
+	lines.push(c("dim", "worker follow        live transcript of running workers"));
+	lines.push(c("dim", "worker <id>          replay one worker"));
+	lines.push(c("dim", scopeLabel));
+	return lines.join("\n");
+}
+/** One-line status-bar summary (same shape glm-ps --status printed). */
+function renderStatusLine(mine, now = /* @__PURE__ */ new Date(), c = makeColor(true)) {
+	if (!mine.length) return "";
+	const running = mine.filter((s) => s.state === "running" && alive(s.pid));
+	const today = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}`;
+	const doneToday = mine.filter((s) => s.state !== "running" && s.started.startsWith(today));
+	const ok = doneToday.filter((s) => s.state === "done").length;
+	const bad = doneToday.length - ok;
+	const providers = new Set(running.map((s) => s.provider));
+	let head = `${providers.size === 1 ? [...providers][0] : "workers"} ▶${running.length}`;
+	const parts = running.slice(0, 3).map((s) => {
+		const meter = contextMeter(c, s, 60);
+		return `${s.id.slice(-4)} ${s.label.slice(0, 26)} ${ageOf(s.started, now)} · ${s.last.slice(0, 30)}` + (meter ? ` ${meter}` : "");
+	});
+	if (parts.length) head += "  " + parts.join(" | ");
+	if (doneToday.length) head += `   ✓${ok} ✗${bad} today`;
+	return head;
+}
+
+//#endregion
+//#region src/workers/viewer.ts
+/**
+* viewer.ts — ps / follow / replay / status line over the worker logDir.
+*
+* Scoping: workers launched from this terminal's AIBroker session (or, as the
+* fallback, its iTerm tab) unless --all or an explicit worker id is given.
+* Outside iTerm, everything degrades to "all workers" — the Python behaviour.
+*
+* Transcripts render with a `HH:MM:SS │ ` gutter (2g): dim, taken from the
+* `_ts` stamp on every mirrored event, the worker tag in front when several
+* run at once, a date separator when the day changes, and — on a TTY — a
+* liveness line (`⋯ 12s since last event · Bash: npm test · ctx 84k/200k (42%)`)
+* that is rewritten in place between events. Following one worker also wires
+* this pane's stdin: every typed line is said to the worker while it runs and
+* resumes it (same Claude session) once it has finished.
+*/
+function psOutput(logDir, showAll, env = process.env, color = process.stdout.isTTY === true) {
+	const c = makeColor(color);
+	const term = env.ITERM_SESSION_ID ?? "";
+	const statuses = loadStatuses(logDir);
+	return renderTable(c, showAll || !term ? statuses : statuses.filter((s) => workerInScope(s, term)), showAll || !term ? "scope: all workers" : resolveSession(term) ? `scope: session ${resolveSession(term).name}` : `scope: tab ${currentTabKey(env)} (this iTerm tab)`);
+}
+/** The rendered transcript of one worker, from the start, as one string. */
+function replayOutput(logDir, wid, color = process.stdout.isTTY === true, tailLines) {
+	const path = eventsPath(logDir, wid);
+	if (!existsSync(path)) throw new Error(`no event log for ${wid}`);
+	const c = makeColor(color);
+	const st = loadStatuses(logDir).find((s) => s.id === wid) ?? {
+		id: wid,
+		label: "",
+		cwd: "",
+		provider: ""
+	};
+	const tools = {};
+	const out = [headerLine(c, st)];
+	const lines = readFileSync(path, "utf8").split("\n");
+	let lastDay = "";
+	for (const line of tailLines !== void 0 ? lines.slice(-tailLines) : lines) {
+		if (!line.trim()) continue;
+		let e;
+		try {
+			e = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		if (typeof e._ts === "string" && e._ts.slice(0, 10) !== lastDay) {
+			lastDay = e._ts.slice(0, 10);
+			out.push(c("dim", `── ${lastDay} ──`));
+		}
+		const g = gutterFor(c, e);
+		collectTools(e, tools);
+		out.push(...renderEvent(c, g ? "" : "  ", e, st.cwd ?? "", tools, g));
+	}
+	return out.join("\n");
+}
+function collectTools(e, tools) {
+	if (e.type !== "assistant") return;
+	for (const b of e.message?.content ?? []) if (b.type === "tool_use" && b.id) tools[b.id] = b.name ?? "?";
+}
+/**
+* The follow exit decision for one worker: it is over once its result event
+* was rendered, or once its status left "running" while its pid is gone — a
+* worker killed without writing a result still ends. A status never read
+* (undefined) means "not over": follow keeps waiting for the first event.
+*/
+function workerEnded(resultRendered, state, pidAlive) {
+	return resultRendered || state !== void 0 && state !== "running" && !pidAlive;
+}
+/**
+* Tail one worker (target) or the running workers of this scope, live.
+* Auto-exit: with a target, wait `autoExit` seconds after its end; without
+* one, exit once no worker in scope has run for that many seconds in a row,
+* never within the first 30 s. With a target on a TTY, typed stdin lines are
+* said to the worker (or resume it after it finished).
+*/
+async function followWorkers(logDir, target, showAll, autoExit, env = process.env, color = process.stdout.isTTY === true) {
+	const c = makeColor(color);
+	const tty = process.stdout.isTTY === true;
+	const term = env.ITERM_SESSION_ID ?? "";
+	const scopeTab = target || showAll ? "" : currentTabKey(env);
+	const tools = {};
+	const handles = /* @__PURE__ */ new Map();
+	const seenHeader = /* @__PURE__ */ new Set();
+	const finished = /* @__PURE__ */ new Set();
+	const lastDayBy = /* @__PURE__ */ new Map();
+	const started = Date.now();
+	let idleSince = null;
+	let aborted = false;
+	let lastEventAt = Date.now();
+	let lastAction = "waiting for first event";
+	let meterStatus = null;
+	let livenessLen = 0;
+	const onInt = () => {
+		aborted = true;
+	};
+	process.once("SIGINT", onInt);
+	const plainOf = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
+	const eraseLiveness = () => {
+		if (livenessLen > 0) {
+			process.stdout.write("\r" + " ".repeat(livenessLen) + "\r");
+			livenessLen = 0;
+		}
+	};
+	const writeLiveness = () => {
+		if (!tty) return;
+		eraseLiveness();
+		const secs = Math.max(0, Math.floor((Date.now() - lastEventAt) / 1e3));
+		const meter = meterStatus ? contextMeter(c, meterStatus) : null;
+		const plain = `⋯ ${secs}s since last event · ${lastAction}${meter ? ` · ${plainOf(meter)}` : ""}`;
+		process.stdout.write(`
+		livenessLen = plain.length;
+	};
+	const runningIds = () => loadStatuses(logDir).filter((s) => s.state === "running" && alive(s.pid) && (target !== null || showAll || (scopeTab ? workerInScope(s, term) : true))).map((s) => s.id);
+	const noteLine = (s) => {
+		eraseLiveness();
+		process.stdout.write(s + "\n");
+	};
+	const resumeTarget = (text, id) => {
+		noteLine(c("dim", `» resuming ${id} …`));
+		const child = spawn("pai", [
+			"worker",
+			"resume",
+			id,
+			text,
+			"--print-id",
+			"--no-pane"
+		], { stdio: [
+			"ignore",
+			"pipe",
+			"inherit"
+		] });
+		let idOut = "";
+		child.stdout?.on("data", (chunk) => {
+			idOut += chunk.toString("utf8");
+		});
+		child.on("close", (rc) => {
+			const newId = idOut.trim().split("\n").pop() ?? "";
+			if (rc === 0 && /^[0-9]{8}-[0-9]{6}-[0-9]+$/.test(newId)) {
+				noteLine(c("dim", `» resumed as ${newId}`));
+				target = newId;
+				finished.delete(newId);
+				seenHeader.delete(newId);
+				lastEventAt = Date.now();
+				lastAction = "resumed";
+			} else noteLine(c("red", `» resume failed (rc=${rc})`));
+		});
+	};
+	const handleOperatorLine = (raw) => {
+		const text = raw.trim();
+		if (!text || target === null) return;
+		const id = target;
+		sayToWorker(logDir, id, text).then(() => noteLine(c("dim", `» sent to ${id}`)), (e) => {
+			if (loadStatuses(logDir).some((s) => s.id === id)) resumeTarget(text, id);
+			else noteLine(c("red", `» ${e.message}`));
+		});
+	};
+	let rlIn = null;
+	if (target !== null && process.stdin.isTTY) {
+		rlIn = createInterface({ input: process.stdin });
+		rlIn.on("line", handleOperatorLine);
+	}
+	try {
+		for (;;) {
+			if (aborted) return;
+			for (const wid of target ? [target] : runningIds()) {
+				if (handles.has(wid) || finished.has(wid)) continue;
+				const path = eventsPath(logDir, wid);
+				if (existsSync(path)) handles.set(wid, {
+					fd: openSync(path, "r"),
+					buf: ""
+				});
+			}
+			const statuses = new Map(loadStatuses(logDir).map((s) => [s.id, s]));
+			const multi = handles.size > 1 || target === null;
+			let progressed = false;
+			for (const [wid, h] of [...handles.entries()]) {
+				const st = statuses.get(wid) ?? {
+					id: wid,
+					label: "",
+					cwd: "",
+					provider: ""
+				};
+				const prefix = multi ? c("cyan", wid.slice(-4)) + c("dim", " ┃ ") : "  ";
+				const buffer = Buffer.alloc(65536);
+				for (;;) {
+					let n;
+					try {
+						n = readSync(h.fd, buffer, 0, buffer.length, null);
+					} catch {
+						n = 0;
+					}
+					if (n <= 0) break;
+					h.buf += buffer.toString("utf8", 0, n);
+				}
+				const lines = h.buf.split("\n");
+				h.buf = lines.pop() ?? "";
+				for (const line of lines) {
+					progressed = true;
+					if (!seenHeader.has(wid)) {
+						eraseLiveness();
+						process.stdout.write(headerLine(c, st) + "\n");
+						seenHeader.add(wid);
+					}
+					if (!line.trim()) continue;
+					let e;
+					try {
+						e = JSON.parse(line);
+					} catch {
+						continue;
+					}
+					const day = typeof e._ts === "string" ? e._ts.slice(0, 10) : "";
+					if (day && day !== lastDayBy.get(wid)) {
+						eraseLiveness();
+						process.stdout.write(`${multi ? prefix : ""}${c("dim", `── ${day} ──`)}\n`);
+						lastDayBy.set(wid, day);
+					}
+					collectTools(e, tools);
+					const g = gutterFor(c, e, multi ? c("cyan", wid.slice(-4)) : void 0);
+					eraseLiveness();
+					for (const ln of renderEvent(c, g ? "" : prefix, e, st.cwd ?? "", tools, g)) process.stdout.write(ln + "\n");
+					lastEventAt = Date.now();
+					if (e.type === "operator") lastAction = "operator message";
+					else if (e.type === "assistant") {
+						const tool = (e.message?.content ?? []).find((b) => b.type === "tool_use");
+						lastAction = tool ? `${tool.name ?? "?"} running` : "thinking";
+					} else if (e.type === "result") lastAction = "finished";
+					meterStatus = st;
+					if (e.type === "result") finished.add(wid);
+				}
+				if (workerEnded(finished.has(wid), st.state, alive(st.pid))) {
+					if (!finished.has(wid)) {
+						eraseLiveness();
+						process.stdout.write(`${prefix}${c("red", "✗ " + (st.state || "ended"))} · ${st.last ?? ""}\n`);
+						finished.add(wid);
+					}
+					closeSync(h.fd);
+					handles.delete(wid);
+				}
+			}
+			const lingerOn = target;
+			if (lingerOn !== null && finished.has(lingerOn)) {
+				if (autoExit) {
+					const until = Date.now() + autoExit * 1e3;
+					while (Date.now() < until && !aborted && target === lingerOn) {
+						writeLiveness();
+						await sleep(250);
+					}
+					if (aborted || target !== lingerOn) continue;
+					eraseLiveness();
+					process.stdout.write(c("dim", "closing") + "\n");
+					return;
+				}
+				if (rlIn === null) return;
+			}
+			if (autoExit && !target) {
+				if (runningIds().length) idleSince = null;
+				else if (idleSince === null) idleSince = Date.now();
+				else if (Date.now() - started >= 3e4 && Date.now() - idleSince >= autoExit * 1e3) {
+					eraseLiveness();
+					process.stdout.write(c("dim", "closing") + "\n");
+					return;
+				}
+			}
+			if (!progressed) {
+				writeLiveness();
+				await sleep(500);
+			}
+		}
+	} finally {
+		rlIn?.close();
+		process.removeListener("SIGINT", onInt);
+		for (const h of handles.values()) try {
+			closeSync(h.fd);
+		} catch {}
+	}
+}
+function sleep(ms) {
+	return new Promise((r) => setTimeout(r, ms));
+}
+/** Workers of this terminal for the status bar; "" when there are none. */
+function statusLineOutput(logDir, term, cwd, now = /* @__PURE__ */ new Date()) {
+	return renderStatusLine(loadStatuses(logDir).filter((s) => {
+		const sameScope = term && workerInScope(s, term);
+		const sameDir = cwd && s.cwd.startsWith(cwd);
+		return sameScope || !term && sameDir;
+	}), now);
+}
+
+//#endregion
+//#region src/workers/providers.ts
+/**
+* providers.ts — provider, role and switch management over the workers config.
+*
+* One layer under both `pai worker providers …` and the MCP worker_providers
+* tool. Every mutation re-reads the config file, changes only the workers
+* section, and writes it back atomically — the file is shared with everything
+* else PAI runs, so a torn write is not an option.
+*
+* Keys are never stored in the config and never accepted inline from the CLI:
+* only file paths. (The MCP `add` tool additionally accepts a raw `key`, which
+* it immediately parks in ~/.config/pai/keys/<name>, mode 0600, storing only
+* the path — a chat is not a place to leave a credential lying around.)
+*/
+function addProvider(input) {
+	if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(input.name)) throw new WorkersConfigError(`provider name "${input.name}" may only contain letters, digits, - and _`);
+	if (input.protocol === "openai" && !input.upstreamUrl) throw new WorkersConfigError("protocol \"openai\" needs the upstreamUrl (the Chat Completions base, e.g. \"https://api.openai.com/v1\") — the PAI proxy translates to it.");
+	if (!input.baseUrl && input.protocol !== "openai") throw new WorkersConfigError("baseUrl is required");
+	let keyFile = input.keyFile ?? null;
+	if (input.key !== void 0) {
+		const dir = keysDir();
+		if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+		const path = `${dir}/${input.name}`;
+		writeFileSync(path, input.key.trim() + "\n", {
+			encoding: "utf8",
+			mode: 384
+		});
+		try {
+			chmodSync(path, 384);
+		} catch {}
+		keyFile = path;
+	}
+	const { raw, workers } = readWorkersSection();
+	const provider = {
+		enabled: true,
+		protocol: input.protocol ?? "anthropic",
+		baseUrl: input.baseUrl,
+		keyFile,
+		models: input.fastModel ? {
+			default: input.model,
+			fast: input.fastModel
+		} : { default: input.model },
+		env: input.env ?? {},
+		...input.note ? { note: input.note } : {},
+		...input.upstreamUrl ? { upstreamUrl: input.upstreamUrl } : {},
+		...input.engine && input.engine !== "claude" ? { engine: input.engine } : {},
+		...input.quotaProbe ? { quotaProbe: input.quotaProbe } : {},
+		...input.contextWindow ? { contextWindow: input.contextWindow } : {}
+	};
+	workers.providers[input.name] = provider;
+	if (Object.keys(workers.providers).length === 1) {
+		workers.enabled = true;
+		workers.active = input.name;
+		workers.logDir = workers.logDir || DEFAULT_LOG_DIR;
+		workers.roles = {
+			implement: input.name,
+			research: input.name,
+			spotcheck: input.fastModel ? `${input.name}/fast` : input.name
+		};
+	}
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+function removeProvider(name) {
+	const { raw, workers } = readWorkersSection();
+	if (!workers.providers[name]) throw new WorkersConfigError(`no provider named "${name}"`);
+	delete workers.providers[name];
+	for (const [role, target] of Object.entries(workers.roles)) if ((typeof target === "string" ? target.split("/")[0] : target.provider) === name) delete workers.roles[role];
+	if (workers.active === name) workers.active = null;
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+function useProvider(name) {
+	const { raw, workers } = readWorkersSection();
+	if (!workers.providers[name]) throw new WorkersConfigError(`no provider named "${name}". Configured: ${Object.keys(workers.providers).join(", ") || "(none)"}`);
+	workers.active = name;
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+function setProviderEnabled(name, enabled) {
+	const { raw, workers } = readWorkersSection();
+	const p = workers.providers[name];
+	if (!p) throw new WorkersConfigError(`no provider named "${name}"`);
+	p.enabled = enabled;
+	writeWorkersSection(raw, workers);
+	if (enabled) clearCooldown(workersLogDir(parseWorkersConfig(raw.workers)), name);
+	return workers;
+}
+function setRole(role, target) {
+	const { raw, workers } = readWorkersSection();
+	const [name, alias] = target.split("/");
+	const p = workers.providers[name];
+	if (!p) throw new WorkersConfigError(`no provider named "${name}" in "${target}". Configured: ${Object.keys(workers.providers).join(", ") || "(none)"}`);
+	if (alias && alias !== "default" && alias !== "fast") throw new WorkersConfigError(`unknown model alias "${alias}" — providers expose "default" and "fast"`);
+	if (alias === "fast" && !p.models.fast) throw new WorkersConfigError(`provider "${name}" has no fast model configured`);
+	workers.roles[role] = target;
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+function unsetRole(role) {
+	const { raw, workers } = readWorkersSection();
+	if (!(role in workers.roles)) throw new WorkersConfigError(`no role named "${role}"`);
+	delete workers.roles[role];
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+function setWorkersEnabled(enabled) {
+	const { raw, workers } = readWorkersSection();
+	workers.enabled = enabled;
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+/** Human-readable provider listing (quota probe included when configured). */
+function describeProviders(workers) {
+	const lines = [];
+	const names = Object.keys(workers.providers);
+	if (!names.length) {
+		lines.push(`no providers configured. Add one with:`);
+		lines.push(`  pai worker providers add <name> --base-url <url> --key-file <path> --model <model>`);
+		return lines;
+	}
+	for (const name of names) {
+		const p = workers.providers[name];
+		const flags = [p.enabled ? "enabled" : "disabled", workers.active === name ? "active" : null].filter(Boolean);
+		const quota = p.quotaProbe ? probeQuota(p) : null;
+		const quotaNote = quota === null ? "" : `  quota ${quota}% (skip at ${quotaSkipThreshold(p)})`;
+		lines.push(`${name}  [${flags.join(", ")}]  ${p.baseUrl}`);
+		lines.push(`    model ${p.models.default}${p.models.fast ? ` (fast: ${p.models.fast})` : ""}${quotaNote}`);
+		if (p.keyFile) lines.push(`    key file ${expandHome(p.keyFile)}`);
+		else lines.push(`    no key file (token "local")`);
+		if (p.note) lines.push(`    ${p.note}`);
+		if (p.protocol === "openai") lines.push(`    via PAI proxy ← ${p.upstreamUrl ?? "(upstreamUrl missing)"}`);
+		if (p.engine === "codex") lines.push(`    engine codex (runs through the Codex CLI)`);
+	}
+	const setNames = Object.keys(workers.mcpSets);
+	if (setNames.length) lines.push(`mcp sets: ${setNames.map((s) => `${s}=[${workers.mcpSets[s].join(",")}]`).join("  ")}`);
+	if (workers.active === "auto") lines.push(`routing: auto — order [${workers.routing.order.join(", ")}], cooldown ${workers.routing.cooldownMinutes}m`);
+	return lines;
+}
+
+//#endregion
+export { readJsonStrict as A, loadStatus as C, workersLogDir as D, ledgerPath as E, WorkersConfigError as O, openPaneForWorker as S, eventsPath as T, stopProxy as _, setRole as a, checkPaneForWorker as b, useProvider as c, replayOutput as d, statusLineOutput as f, ensureProxyRunning as g, DEFAULT_PROXY_PORT as h, setProviderEnabled as i, writeJsonAtomic as j, readWorkersSection as k, followWorkers as l, testProvider as m, describeProviders as n, setWorkersEnabled as o, runWorker as p, removeProvider as r, unsetRole as s, addProvider as t, psOutput as u, sayToWorker as v, ledgerSummary as w, openFollowPane as x, describeMcp as y };
+//# sourceMappingURL=providers-sXcK5bDZ.mjs.map