@tekmidian/pai 0.36.2 → 0.38.0

package/dist/providers-DUshcB-d.mjs

@@ -0,0 +1,4031 @@
+import { n as CONFIG_FILE } from "./config-B64vFg14.mjs";
+import { appendFileSync, chmodSync, closeSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { basename, dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+import { connect, createServer } from "node:net";
+import { execFileSync, spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+
+//#region src/config/json-store.ts
+/**
+* json-store.ts — read/write JSON config files without destroying them
+*
+* The failure this exists to prevent:
+*
+*     try { return JSON.parse(read(path)); } catch { return {}; }
+*     ... later ...
+*     write(path, JSON.stringify(ourData));
+*
+* An unreadable file becomes an empty object, and the next write makes that
+* permanent. Silently, exit code 0. This shape appeared three times in this
+* repo against three different files, and twice in AIBroker.
+*
+* The distinction that matters is between *missing* and *unreadable*:
+*
+*   missing     — legitimate first run. Start fresh; writing is safe.
+*   unreadable  — the file exists and we could not parse it. Those bytes are
+*                 the only copy of something. Never overwrite them.
+*
+* Collapsing the second into the first is the bug.
+*
+* NOT everything deserves this guard. For a transient buffer — an undelivered
+* message queue, a cache — starting fresh IS the correct recovery, and
+* refusing to write would disable the feature permanently. Use `writeJsonAtomic`
+* alone there: it still prevents a crash from truncating a good file, without
+* blocking recovery. Reserve `readJsonStrict` for data a user cannot rebuild.
+*/
+/**
+* Read a JSON file, distinguishing "absent" from "damaged".
+*
+* @param path   file to read
+* @param label  how to name it to the user, e.g. "~/.claude.json"
+* @throws if the file exists but cannot be read or parsed
+*/
+function readJsonStrict(path, label = path) {
+	if (!existsSync(path)) return {};
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch (e) {
+		throw new Error(`Could not read ${label}: ${e instanceof Error ? e.message : String(e)}\nRefusing to continue — writing now would replace its contents with ours alone.`);
+	}
+	try {
+		return JSON.parse(raw);
+	} catch (e) {
+		throw new Error(`${label} exists but is not valid JSON: ${e instanceof Error ? e.message : String(e)}\nRefusing to continue — overwriting it would destroy whatever it holds.\nRepair the file, or move it aside and re-run this command.`);
+	}
+}
+/**
+* Write JSON without risking the existing file.
+*
+* Keeps a `.bak-pai` copy of the previous contents, then writes to a temp file
+* and renames. Rename is atomic within a filesystem, so a crash mid-write
+* leaves the original intact rather than truncated — which is how these files
+* become corrupt in the first place.
+*/
+function writeJsonAtomic(path, data, opts = {}) {
+	const { backup = true, label = path } = opts;
+	const serialized = JSON.stringify(data, null, 2) + "\n";
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	if (backup && existsSync(path)) try {
+		copyFileSync(path, `${path}.bak-pai`);
+	} catch (e) {
+		throw new Error(`Could not back up ${label}: ${e instanceof Error ? e.message : String(e)}\nRefusing to write without a backup.`);
+	}
+	const tmp = `${path}.tmp-pai-${process.pid}`;
+	try {
+		writeFileSync(tmp, serialized, "utf8");
+		renameSync(tmp, path);
+	} catch (e) {
+		try {
+			if (existsSync(tmp)) unlinkSync(tmp);
+		} catch {}
+		throw new Error(`Failed to write ${label}: ${e instanceof Error ? e.message : String(e)}\nThe original is unchanged.`);
+	}
+}
+
+//#endregion
+//#region src/workers/config.ts
+/**
+* config.ts — the `workers` section of ~/.config/pai/config.json
+*
+* Everything that knows about worker providers reads this module: the CLI
+* (`pai worker …`), the MCP tools (worker_*), and the Agent-routing hook.
+* Keep it free of commander/MCP imports so all three layers stay thin over it.
+*
+* Keys are never stored here — only paths to 0600 files. A provider without a
+* keyFile is a local server and gets the placeholder token "local".
+*
+* `protocol: "openai"` providers run through the PAI proxy (src/workers/proxy):
+* `upstreamUrl` is their Chat Completions base, and `run` points
+* ANTHROPIC_BASE_URL at the local proxy with the provider name in the path.
+* `engine: "codex"` providers run through the Codex CLI instead of Claude
+* Code.
+*/
+const DEFAULT_COST_TIER = 3;
+/** Tags a provider may carry; classes filter auto-routing on them. */
+const PROVIDER_TAGS = [
+	"code",
+	"vision",
+	"image-gen",
+	"long-context",
+	"fast",
+	"reasoning"
+];
+/** The standard task classes; `workers.classes` maps each to a target. */
+const WORKER_CLASSES = [
+	"draft",
+	"plan",
+	"implement",
+	"review",
+	"research",
+	"spotcheck",
+	"simple",
+	"complex",
+	"image"
+];
+const DEFAULT_LOG_DIR = "~/.claude/logs/workers";
+const DEFAULT_PANE = {
+	enabled: true,
+	fontSize: 13,
+	autoExitSecs: 60
+};
+const DEFAULT_ROUTING = {
+	order: [],
+	cooldownMinutes: 30,
+	retryOnQuota: true
+};
+function defaultWorkersConfig() {
+	return {
+		enabled: false,
+		active: null,
+		providers: {},
+		classes: {},
+		mcpSets: {},
+		pane: { ...DEFAULT_PANE },
+		logDir: DEFAULT_LOG_DIR,
+		routing: {
+			...DEFAULT_ROUTING,
+			order: []
+		}
+	};
+}
+var WorkersConfigError = class extends Error {};
+function bad(path, why) {
+	throw new WorkersConfigError(`workers${path}: ${why}`);
+}
+function str(v) {
+	return typeof v === "string" ? v : "";
+}
+function parseProvider(name, raw) {
+	if (typeof raw !== "object" || raw === null) bad(`.providers.${name}`, "must be an object");
+	const p = raw;
+	const protocol = p.protocol === void 0 ? "anthropic" : str(p.protocol);
+	if (protocol !== "anthropic" && protocol !== "openai") bad(`.providers.${name}.protocol`, `"${str(p.protocol)}" is neither "anthropic" nor "openai"`);
+	const engine = p.engine === void 0 ? "claude" : str(p.engine);
+	if (engine !== "claude" && engine !== "codex") bad(`.providers.${name}.engine`, `"${str(p.engine)}" is neither "claude" nor "codex"`);
+	const baseUrl = str(p.baseUrl);
+	if (!baseUrl && protocol !== "openai") bad(`.providers.${name}.baseUrl`, "is required");
+	const keyFile = p.keyFile === void 0 || p.keyFile === null || str(p.keyFile) === "" ? null : str(p.keyFile);
+	const modelsRaw = p.models === void 0 ? {} : p.models;
+	if (typeof modelsRaw !== "object" || modelsRaw === null) bad(`.providers.${name}.models`, "must be an object");
+	const m = modelsRaw;
+	const defaultModel = str(m.default);
+	if (!defaultModel) bad(`.providers.${name}.models.default`, "is required");
+	const fast = m.fast === void 0 ? void 0 : str(m.fast);
+	const env = {};
+	if (p.env !== void 0) {
+		if (typeof p.env !== "object" || p.env === null || Array.isArray(p.env)) bad(`.providers.${name}.env`, "must be an object of string values");
+		for (const [k, v] of Object.entries(p.env)) {
+			if (typeof v !== "string") bad(`.providers.${name}.env.${k}`, "must be a string");
+			env[k] = v;
+		}
+	}
+	const quotaSkipAt = p.quotaSkipAt === void 0 ? void 0 : p.quotaSkipAt;
+	if (quotaSkipAt !== void 0) {
+		if (typeof quotaSkipAt !== "number" || quotaSkipAt < 0 || quotaSkipAt > 100) bad(`.providers.${name}.quotaSkipAt`, "must be a number between 0 and 100");
+	}
+	const contextWindow = p.contextWindow === void 0 ? void 0 : p.contextWindow;
+	if (contextWindow !== void 0) {
+		if (typeof contextWindow !== "number" || contextWindow <= 0) bad(`.providers.${name}.contextWindow`, "must be a positive number of tokens");
+	}
+	const upstreamUrl = str(p.upstreamUrl);
+	if (protocol === "openai" && !upstreamUrl) bad(`.providers.${name}.upstreamUrl`, `is required for protocol "openai" (the Chat Completions base, e.g. "https://api.openai.com/v1")`);
+	const costTier = p.costTier === void 0 ? void 0 : p.costTier;
+	if (costTier !== void 0) {
+		if (typeof costTier !== "number" || !Number.isInteger(costTier) || costTier < 1 || costTier > 5) bad(`.providers.${name}.costTier`, "must be an integer 1 (cheapest) … 5 (most expensive)");
+	}
+	let tags;
+	if (p.tags !== void 0) {
+		if (!Array.isArray(p.tags) || p.tags.some((x) => typeof x !== "string")) bad(`.providers.${name}.tags`, `must be an array of tags from: ${PROVIDER_TAGS.join(", ")}`);
+		for (const t of p.tags) if (!PROVIDER_TAGS.includes(t)) bad(`.providers.${name}.tags`, `"${t}" is not a tag (from: ${PROVIDER_TAGS.join(", ")})`);
+		tags = p.tags;
+	}
+	return {
+		enabled: p.enabled === void 0 ? true : p.enabled === true,
+		protocol,
+		baseUrl,
+		keyFile,
+		models: fast ? {
+			default: defaultModel,
+			fast
+		} : { default: defaultModel },
+		env,
+		...str(p.note) ? { note: str(p.note) } : {},
+		...upstreamUrl ? { upstreamUrl } : {},
+		...engine !== "claude" ? { engine } : {},
+		...str(p.quotaProbe) ? { quotaProbe: str(p.quotaProbe) } : {},
+		...quotaSkipAt !== void 0 ? { quotaSkipAt } : {},
+		...contextWindow !== void 0 ? { contextWindow } : {},
+		...costTier !== void 0 ? { costTier } : {},
+		...tags ? { tags } : {}
+	};
+}
+/**
+* Parse and validate a raw `workers` value. Missing section → defaults.
+* Unknown-but-typed garbage → WorkersConfigError naming the offending field.
+*/
+function parseWorkersConfig(raw) {
+	const d = defaultWorkersConfig();
+	if (raw === void 0 || raw === null) return d;
+	if (typeof raw !== "object" || Array.isArray(raw)) bad("", "section must be an object");
+	const w = raw;
+	const providers = {};
+	if (w.providers !== void 0) {
+		if (typeof w.providers !== "object" || w.providers === null || Array.isArray(w.providers)) bad(".providers", "must be an object keyed by provider name");
+		for (const [name, p] of Object.entries(w.providers)) providers[name] = parseProvider(name, p);
+	}
+	const classes = {};
+	const classesRaw = w.classes !== void 0 ? w.classes : w.roles;
+	if (classesRaw !== void 0) {
+		if (typeof classesRaw !== "object" || classesRaw === null || Array.isArray(classesRaw)) bad(w.classes !== void 0 ? ".classes" : ".roles", "must be an object of class → provider[/alias] or {provider, mcp, maxCostTier, requireTags, order}");
+		for (const [cls, target] of Object.entries(classesRaw)) if (typeof target === "object" && target !== null && !Array.isArray(target)) {
+			const o = target;
+			const provider = str(o.provider);
+			if (o.provider !== void 0 && (!provider || provider.includes(" "))) bad(`.classes.${cls}.provider`, `invalid provider "${provider}"`);
+			let mcp;
+			if (o.mcp !== void 0) {
+				if (!Array.isArray(o.mcp) || o.mcp.some((x) => typeof x !== "string")) bad(`.classes.${cls}.mcp`, "must be an array of MCP server or set names");
+				mcp = o.mcp;
+			}
+			let maxCostTier;
+			if (o.maxCostTier !== void 0) {
+				if (typeof o.maxCostTier !== "number" || !Number.isInteger(o.maxCostTier) || o.maxCostTier < 1 || o.maxCostTier > 5) bad(`.classes.${cls}.maxCostTier`, "must be an integer 1 … 5");
+				maxCostTier = o.maxCostTier;
+			}
+			let requireTags;
+			if (o.requireTags !== void 0) {
+				if (!Array.isArray(o.requireTags) || o.requireTags.some((x) => typeof x !== "string")) bad(`.classes.${cls}.requireTags`, `must be an array of tags from: ${PROVIDER_TAGS.join(", ")}`);
+				for (const t of o.requireTags) if (!PROVIDER_TAGS.includes(t)) bad(`.classes.${cls}.requireTags`, `"${t}" is not a tag (from: ${PROVIDER_TAGS.join(", ")})`);
+				requireTags = o.requireTags;
+			}
+			let order;
+			if (o.order !== void 0) {
+				if (!Array.isArray(o.order) || o.order.some((x) => typeof x !== "string")) bad(`.classes.${cls}.order`, "must be an array of provider names");
+				order = o.order;
+			}
+			const obj = {
+				...provider ? { provider } : {},
+				...mcp ? { mcp } : {},
+				...maxCostTier !== void 0 ? { maxCostTier } : {},
+				...requireTags ? { requireTags } : {},
+				...order ? { order } : {}
+			};
+			classes[cls] = Object.keys(obj).length ? obj : {};
+		} else {
+			const t = str(target);
+			if (!t || t.includes(" ")) bad(`.classes.${cls}`, `invalid target "${t}"`);
+			classes[cls] = t;
+		}
+	}
+	const mcpSets = {};
+	if (w.mcpSets !== void 0) {
+		if (typeof w.mcpSets !== "object" || w.mcpSets === null || Array.isArray(w.mcpSets)) bad(".mcpSets", "must be an object of set name → [server names]");
+		for (const [setName, servers] of Object.entries(w.mcpSets)) {
+			if (!Array.isArray(servers) || servers.some((x) => typeof x !== "string")) bad(`.mcpSets.${setName}`, "must be an array of MCP server names");
+			mcpSets[setName] = servers;
+		}
+	}
+	let pane = { ...DEFAULT_PANE };
+	if (w.pane !== void 0) {
+		if (typeof w.pane !== "object" || w.pane === null) bad(".pane", "must be an object");
+		const pc = w.pane;
+		if (pc.enabled !== void 0 && typeof pc.enabled !== "boolean") bad(".pane.enabled", "must be boolean");
+		if (pc.fontSize !== void 0 && (typeof pc.fontSize !== "number" || pc.fontSize <= 0)) bad(".pane.fontSize", "must be a positive number of points");
+		if (pc.autoExitSecs !== void 0 && typeof pc.autoExitSecs !== "number") bad(".pane.autoExitSecs", "must be a number");
+		pane = {
+			enabled: pc.enabled === void 0 ? DEFAULT_PANE.enabled : pc.enabled === true,
+			fontSize: pc.fontSize === void 0 ? DEFAULT_PANE.fontSize : pc.fontSize,
+			autoExitSecs: pc.autoExitSecs === void 0 ? DEFAULT_PANE.autoExitSecs : pc.autoExitSecs
+		};
+	}
+	let routing = {
+		...DEFAULT_ROUTING,
+		order: []
+	};
+	if (w.routing !== void 0) {
+		if (typeof w.routing !== "object" || w.routing === null) bad(".routing", "must be an object");
+		const r = w.routing;
+		if (r.order !== void 0) {
+			if (!Array.isArray(r.order) || r.order.some((x) => typeof x !== "string")) bad(".routing.order", "must be an array of provider names");
+			routing.order = r.order;
+		}
+		if (r.cooldownMinutes !== void 0 && typeof r.cooldownMinutes !== "number") bad(".routing.cooldownMinutes", "must be a number");
+		if (r.retryOnQuota !== void 0 && typeof r.retryOnQuota !== "boolean") bad(".routing.retryOnQuota", "must be boolean");
+		routing = {
+			order: routing.order,
+			cooldownMinutes: r.cooldownMinutes === void 0 ? DEFAULT_ROUTING.cooldownMinutes : r.cooldownMinutes,
+			retryOnQuota: r.retryOnQuota === void 0 ? DEFAULT_ROUTING.retryOnQuota : r.retryOnQuota === true
+		};
+	}
+	const active = w.active === void 0 || w.active === null ? null : str(w.active);
+	if (active !== null && active !== "auto" && !(active in providers)) {}
+	return {
+		enabled: w.enabled === void 0 ? d.enabled : w.enabled === true,
+		active,
+		providers,
+		classes,
+		mcpSets,
+		pane,
+		logDir: str(w.logDir) || d.logDir,
+		routing
+	};
+}
+/**
+* Read the whole config file and return (raw, workers) — the raw record so
+* callers can rewrite it preserving every other section, the parsed+validated
+* workers section. Unreadable config throws (readJsonStrict), missing is fine.
+*/
+function readWorkersSection() {
+	const raw = readJsonStrict(CONFIG_FILE, "~/.config/pai/config.json");
+	return {
+		raw,
+		workers: parseWorkersConfig(raw.workers)
+	};
+}
+/** Write the workers section back into the config file, atomically. */
+function writeWorkersSection(raw, workers) {
+	raw.workers = workers;
+	writeJsonAtomic(CONFIG_FILE, raw, { label: "~/.config/pai/config.json" });
+}
+/** Expand a leading ~ (config values are written with `~` to stay portable). */
+function expandHome(p) {
+	if (p === "~" || p.startsWith("~/")) return join(homedir(), p.slice(1));
+	return p;
+}
+function assertProviderRunnable(name, p) {
+	if (p.protocol === "openai" && !p.upstreamUrl) throw new WorkersConfigError(`provider "${name}" uses protocol "openai" but has no upstreamUrl — set its Chat Completions base (e.g. "https://api.openai.com/v1") so the PAI proxy knows where to translate to.`);
+}
+/** Where a provider's key file lives, or null. Shared by run + test + add. */
+function providerKeyPath(p) {
+	return p.keyFile ? expandHome(p.keyFile) : null;
+}
+const DEFAULT_CONTEXT_WINDOW = 2e5;
+/** Cost tier of a provider for class filtering (unset = 3, the middle). */
+function providerCostTier(p) {
+	return p.costTier ?? DEFAULT_COST_TIER;
+}
+/** Context window used by the meter when the init event carries none. */
+function providerContextWindow(p) {
+	return p.contextWindow ?? DEFAULT_CONTEXT_WINDOW;
+}
+/** Directory under which inline keys (MCP `key` field) are stored, 0600. */
+function keysDir() {
+	return join(homedir(), ".config", "pai", "keys");
+}
+
+//#endregion
+//#region src/workers/paths.ts
+/**
+* paths.ts — where worker run artefacts live.
+*
+* Everything a run writes (event mirror, status file, pane registry, routing
+* state, the empty MCP config) sits under one logDir so the whole tree is
+* disposable and configurable: `workers.logDir`, default ~/.claude/logs/workers.
+*/
+/** Absolute logDir for the given config. */
+function workersLogDir(config) {
+	return expandHome(config.logDir);
+}
+function statusPath(logDir, id) {
+	return join(logDir, `${id}.status`);
+}
+function eventsPath(logDir, id) {
+	return join(logDir, `${id}.jsonl`);
+}
+function ledgerPath(logDir) {
+	return join(logDir, "ledger.log");
+}
+function routingStatePath(logDir) {
+	return join(logDir, "routing-state.json");
+}
+function panesDir(logDir) {
+	return join(logDir, "panes");
+}
+/**
+* The strict empty MCP config handed to headless workers. Written into the
+* logDir on demand (never into the user's vendor config directory — this is
+* PAI state, not vendor state).
+*/
+function noMcpConfigPath(logDir) {
+	return join(logDir, "no-mcp.json");
+}
+
+//#endregion
+//#region src/workers/args.ts
+function parseRunnerArgs(argv) {
+	let prompt = null;
+	let outputFormat = "text";
+	const rest = [];
+	let headless = false;
+	let callerModel = false;
+	let callerMcpConfig = false;
+	let callerSystemPrompt = false;
+	const mcp = [];
+	let i = 0;
+	while (i < argv.length) {
+		const a = argv[i];
+		if (a === "-p" || a === "--print") {
+			headless = true;
+			rest.push(a);
+			if (i + 1 < argv.length && !argv[i + 1].startsWith("-")) {
+				prompt = argv[i + 1];
+				rest.push(prompt);
+				i += 1;
+			}
+		} else if (a === "--output-format") {
+			const v = argv[i + 1];
+			if (v === "json" || v === "stream-json") outputFormat = v;
+			i += 1;
+		} else if (a.startsWith("--output-format=")) {
+			const v = a.slice(16);
+			if (v === "json" || v === "stream-json") outputFormat = v;
+		} else if (a === "--verbose") {} else if (a === "--mcp") {
+			const v = argv[i + 1];
+			if (v !== void 0 && !v.startsWith("-")) {
+				mcp.push(v);
+				i += 1;
+			}
+		} else if (a.startsWith("--mcp=")) mcp.push(a.slice(6));
+		else {
+			if (a === "--model") callerModel = true;
+			if (a.startsWith("--model=")) callerModel = true;
+			if (a === "--mcp-config") callerMcpConfig = true;
+			if (a.startsWith("--mcp-config=")) callerMcpConfig = true;
+			if (a === "--append-system-prompt") callerSystemPrompt = true;
+			if (a.startsWith("--append-system-prompt=")) callerSystemPrompt = true;
+			if (prompt === null && !a.startsWith("-") && rest.length > 0 && (rest[rest.length - 1] === "-p" || rest[rest.length - 1] === "--print")) prompt = a;
+			rest.push(a);
+		}
+		i += 1;
+	}
+	return {
+		prompt,
+		outputFormat,
+		rest,
+		headless,
+		callerModel,
+		callerMcpConfig,
+		callerSystemPrompt,
+		mcp
+	};
+}
+/**
+* Turn `-p "<prompt>"` into bare `-p` (same for --print): for stream-json
+* stdin runs the prompt moves to the first user message on stdin, so the
+* value must not stay on the command line. Only prompt values directly
+* following the flag are touched; everything else passes through.
+*/
+function stripPromptValues(argv) {
+	const out = [];
+	for (let i = 0; i < argv.length; i++) {
+		const a = argv[i];
+		const isPrint = a === "-p" || a === "--print";
+		out.push(a);
+		if (isPrint && i + 1 < argv.length && !argv[i + 1].startsWith("-")) i += 1;
+	}
+	return out;
+}
+/** Collapse whitespace and cut to n chars with an ellipsis (label rendering). */
+function shortText(s, n) {
+	const t = String(s ?? "").split(/\s+/).filter(Boolean).join(" ");
+	return t.length <= n ? t : t.slice(0, n - 1) + "…";
+}
+
+//#endregion
+//#region src/workers/ledger.ts
+/**
+* ledger.ts — the routing ledger, one append-only log for every worker event.
+*
+* Line shapes (whitespace-aligned so `tail` reads as a table):
+*
+*   2026-09-17 12:00:00 WORKER-START id=<id> provider=<p> mode=headless model=<m> cwd=<cwd> label=<label>
+*   2026-09-17 12:01:00 WORKER-END   id=<id> provider=<p> mode=headless model=<m> rc=0 secs=60 turns=3 tools=8 label=<label>
+*   2026-09-17 12:00:20 WORKER-REROUTE from=<a> to=<b> reason=quota
+*   2026-09-17 12:00:00 DENIED-ANTHROPIC-AGENT cwd=<cwd> desc=<desc>
+*   2026-09-17 12:00:00 ALLOWED-ANTHROPIC-AGENT cwd=<cwd> desc=<desc>
+*
+* `pai worker log` (and glm-log before it) counts these; keep the tags stable.
+*/
+function ledgerStamp(d = /* @__PURE__ */ new Date()) {
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`;
+}
+/** Parse `2026-09-17 12:00:00 TAG key=value …` into its parts. */
+function parseLedgerLine(line) {
+	const m = line.match(/^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) (\S+)(?: (.*))?$/);
+	if (!m) return null;
+	const fields = {};
+	for (const part of (m[3] ?? "").split(" ")) {
+		if (!part) continue;
+		const eq = part.indexOf("=");
+		if (eq <= 0) continue;
+		fields[part.slice(0, eq)] = part.slice(eq + 1);
+	}
+	return {
+		stamp: m[1],
+		event: m[2],
+		fields
+	};
+}
+/** Append one ledger line. `kv` order is the caller's; values are flattened. */
+function appendLedger(path, event, kv, now = /* @__PURE__ */ new Date()) {
+	const parts = [];
+	for (const [k, v] of Object.entries(kv)) {
+		if (v === void 0 || v === null) continue;
+		parts.push(`${k}=${String(v).replace(/\s+/g, " ")}`);
+	}
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tail = parts.length ? " " + parts.join(" ") : "";
+	appendFileSync(path, `${ledgerStamp(now)} ${event}${tail}\n`, "utf8");
+}
+/** The counts `pai worker log` prints, over today's lines or the whole file. */
+function ledgerSummary(path, scope, lastN = 15, now = /* @__PURE__ */ new Date()) {
+	if (!existsSync(path)) return null;
+	const text = readFileSync(path, "utf8");
+	const today = ledgerStamp(now).slice(0, 10);
+	const lines = text.split("\n").filter((l) => l.trim());
+	const parsed = (scope === "all" ? lines : lines.filter((l) => l.startsWith(today))).map(parseLedgerLine).filter((x) => x !== null);
+	const count = (ev) => parsed.filter((p) => p.event === ev).length;
+	const ends = parsed.filter((p) => p.event === "WORKER-END");
+	const ok = ends.filter((p) => p.fields.rc === "0").length;
+	return {
+		scope: scope === "all" ? "all time" : `today ${today}`,
+		started: count("WORKER-START"),
+		endedOk: ok,
+		endedFailed: ends.length - ok,
+		denied: count("DENIED-ANTHROPIC-AGENT"),
+		allowed: count("ALLOWED-ANTHROPIC-AGENT"),
+		reroutes: count("WORKER-REROUTE"),
+		lastLines: lines.slice(-lastN)
+	};
+}
+
+//#endregion
+//#region src/workers/status.ts
+/**
+* status.ts — the live per-worker status file.
+*
+* One JSON file per run, rewritten atomically on every turn, read by `ps`,
+* `follow`, the status line and the pane logic. Same field set the Python
+* runner wrote, plus `provider` (routing is multi-provider now) and `session`
+* (the AIBroker identity of the launching session, see scope.ts).
+*/
+/** Context-meter percentage 0–100, null when the numbers are missing. */
+function contextPercent(s) {
+	if (!s.contextTokens || !s.contextWindow) return null;
+	return Math.round(s.contextTokens / s.contextWindow * 100);
+}
+/** Timestamp format shared by status files and the ledger. */
+function nowStamp(d = /* @__PURE__ */ new Date()) {
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`;
+}
+let lastId = "";
+let idSeq = 0;
+function newWorkerId(d = /* @__PURE__ */ new Date(), pid = process.pid) {
+	const p = (n) => String(n).padStart(2, "0");
+	const base = `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}-${pid}`;
+	if (base === lastId) {
+		idSeq += 1;
+		return `${base}-${String(idSeq).padStart(2, "0")}`;
+	}
+	lastId = base;
+	idSeq = 0;
+	return base;
+}
+/** Write status atomically (temp + rename) and stamp `updated`. */
+function saveStatus(logDir, status, d = /* @__PURE__ */ new Date()) {
+	status.updated = nowStamp(d);
+	const path = statusPath(logDir, status.id);
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, JSON.stringify(status), "utf8");
+	renameSync(tmp, path);
+}
+/** Load every status file in the logDir, oldest id first, skipping damage. */
+function loadStatuses(logDir) {
+	if (!existsSync(logDir)) return [];
+	const out = [];
+	for (const name of readdirSync(logDir).sort()) {
+		if (!name.endsWith(".status")) continue;
+		try {
+			out.push(JSON.parse(readFileSync(join(logDir, name), "utf8")));
+		} catch {}
+	}
+	return out;
+}
+function loadStatus(logDir, id) {
+	const path = statusPath(logDir, id);
+	if (!existsSync(path)) return null;
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+function alive(pid) {
+	if (!pid || pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** "42s" under 90s, "7m" above — the coarse age the table and bar show. */
+function ageOf(ts, now = /* @__PURE__ */ new Date()) {
+	const t = Date.parse(ts.replace(" ", "T"));
+	if (Number.isNaN(t)) return "?";
+	const s = Math.max(0, Math.floor((now.getTime() - t) / 1e3));
+	return s < 90 ? `${s}s` : `${Math.floor(s / 60)}m`;
+}
+/** One-line description of a tool call, e.g. "Bash: npm test". */
+function describeTool(name, inp) {
+	if (typeof inp !== "object" || inp === null) return name;
+	const i = inp;
+	const get = (k) => typeof i[k] === "string" ? i[k] : "";
+	if (name === "Bash") return `Bash: ${shortText(get("command"), 70)}`;
+	if (name === "Read" || name === "Edit" || name === "Write" || name === "MultiEdit") return `${name}: ${get("file_path").split("/").pop() ?? ""}`;
+	if (name === "Grep" || name === "Glob") return `${name}: ${shortText(get("pattern"), 50)}`;
+	if (name === "WebSearch") return `${name}: ${shortText(get("query"), 50)}`;
+	if (name === "WebFetch") return `${name}: ${shortText(get("url"), 60)}`;
+	return name;
+}
+
+//#endregion
+//#region src/workers/scope.ts
+/**
+* scope.ts — which workers "belong" to the terminal asking about them.
+*
+* Two identities, in priority order:
+*
+*   1. AIBroker's session registry (~/.aibroker/session-names.json): iTerm
+*      session UUID → session name. The launching session's UUID is stored in
+*      each worker's status file as `session.id`, so every pane of a named
+*      session sees its workers — regardless of tab layout.
+*   2. The iTerm tab key (`w<window>t<tab>` prefix of ITERM_SESSION_ID): the
+*      original heuristic, kept as the fallback when no registry entry
+*      matches (AIBroker absent, unnamed session, non-iTerm terminal).
+*
+* If neither is available, viewers fall back to "all workers".
+*/
+const AIBROKER_REGISTRY = join(homedir(), ".aibroker", "session-names.json");
+/**
+* `w<window>t<tab>` prefix of an iTerm session id, "" if empty or malformed.
+* Panes split from the same tab share this prefix and differ only in `p<n>`.
+*/
+function tabKey(term) {
+	if (!term) return "";
+	const head = term.split("p", 1)[0];
+	const parts = head.slice(1).split("t");
+	if (head.startsWith("w") && parts.length === 2 && parts.every((p) => /^\d+$/.test(p))) return head;
+	return "";
+}
+/** Tab key of the iTerm tab this process runs in, "" if not inside iTerm2. */
+function currentTabKey(env = process.env) {
+	return tabKey(env.ITERM_SESSION_ID ?? "");
+}
+/** The iTerm UUID part of an ITERM_SESSION_ID (after the last colon). */
+function itermUuid(term) {
+	if (!term) return "";
+	return term.split(":").pop() ?? "";
+}
+/**
+* Resolve the AIBroker session for an ITERM_SESSION_ID. Reads the persistent
+* name registry (the same store `aibroker_rename` writes); returns null when
+* AIBroker is absent or the session is not in it — callers then use the tab
+* key, which is the pre-AIBroker behaviour.
+*/
+function resolveSession(term, registryPath = AIBROKER_REGISTRY) {
+	const uuid = itermUuid(term);
+	if (!uuid) return null;
+	let names;
+	try {
+		if (!existsSync(registryPath)) return null;
+		names = JSON.parse(readFileSync(registryPath, "utf8"));
+	} catch {
+		return null;
+	}
+	const name = names[uuid];
+	if (typeof name !== "string" || !name) return null;
+	return {
+		id: uuid,
+		name
+	};
+}
+/**
+* True when `worker` was launched from `term` (the terminal asking about it).
+* Session-id match first; the tab key only when no registry entry matched —
+* a session without a name keeps the tab-scoped behaviour it always had.
+*/
+function workerInScope(worker, term) {
+	if (!term) return false;
+	const uuid = itermUuid(term);
+	if (worker.session?.id && uuid) return worker.session.id === uuid;
+	return tabKey(worker.term) === tabKey(term) && tabKey(term) !== "";
+}
+/**
+* Registry key for pane files: the session id when AIBroker knows this
+* terminal, else the tab key, else the raw iTerm UUID.
+*/
+function scopeKey(term) {
+	const session = resolveSession(term);
+	if (session) return session.id;
+	return currentTabKey() || itermUuid(term);
+}
+/** `[Name]` when the worker has an AIBroker session name, else "". */
+function sessionTag(worker) {
+	return worker.session?.name ? `[${worker.session.name}]` : "";
+}
+
+//#endregion
+//#region src/workers/routing.ts
+/**
+* routing.ts — provider selection: flag > class > active (possibly "auto").
+*
+* Auto-routing walks `workers.routing.order` — or the class's own `order` —
+* and takes the first provider that is enabled, out of cooldown, (when it
+* defines a quotaProbe) under its quotaSkipAt threshold, and — when the class
+* constrains it — within `maxCostTier` and carrying all `requireTags`. A run
+* that dies of a quota/rate error puts its provider in cooldown for
+* cooldownMinutes; when that happens before the first tool call and
+* retryOnQuota is set, the runner restarts the same task on the next provider
+* (ledger: WORKER-REROUTE).
+*
+* An explicit --provider or a class mapping that pins a provider always
+* bypasses all of this.
+*/
+const QUOTA_SKIP_DEFAULT = 95;
+const PROBE_TIMEOUT_MS = 1e4;
+function readRoutingState(logDir) {
+	const path = routingStatePath(logDir);
+	if (!existsSync(path)) return { cooldowns: {} };
+	try {
+		return { cooldowns: JSON.parse(readFileSync(path, "utf8")).cooldowns ?? {} };
+	} catch {
+		return { cooldowns: {} };
+	}
+}
+function writeRoutingState(logDir, state) {
+	const path = routingStatePath(logDir);
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n", "utf8");
+	renameSync(tmp, path);
+}
+function cooldownRemaining(state, provider, now = /* @__PURE__ */ new Date()) {
+	const end = state.cooldowns[provider];
+	if (!end) return 0;
+	const ms = Date.parse(end) - now.getTime();
+	return ms > 0 ? ms : 0;
+}
+function setCooldown(logDir, provider, minutes, now = /* @__PURE__ */ new Date()) {
+	const state = readRoutingState(logDir);
+	state.cooldowns[provider] = new Date(now.getTime() + minutes * 6e4).toISOString();
+	writeRoutingState(logDir, state);
+}
+function clearCooldown(logDir, provider) {
+	const state = readRoutingState(logDir);
+	if (!(provider in state.cooldowns)) return;
+	delete state.cooldowns[provider];
+	writeRoutingState(logDir, state);
+}
+/**
+* Run a provider's quotaProbe and return its percentage (0–100), or null when
+* there is no probe or it printed nothing usable. A probe must never break
+* routing: failures read as "unknown", not as "full".
+*/
+function probeQuota(provider) {
+	if (!provider.quotaProbe) return null;
+	try {
+		const m = execFileSync("/bin/sh", ["-c", provider.quotaProbe], {
+			timeout: PROBE_TIMEOUT_MS,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).match(/(\d+(?:\.\d+)?)/);
+		if (!m) return null;
+		return Math.min(100, Math.max(0, Math.round(parseFloat(m[1]))));
+	} catch {
+		return null;
+	}
+}
+function quotaSkipThreshold(provider) {
+	return provider.quotaSkipAt ?? QUOTA_SKIP_DEFAULT;
+}
+/** Does this provider exceed its quota threshold right now? */
+function quotaExceeded(provider) {
+	const used = probeQuota(provider);
+	return used !== null && used >= quotaSkipThreshold(provider);
+}
+var NoProviderError = class extends WorkersConfigError {};
+function mustExist(config, name) {
+	const p = config.providers[name];
+	if (!p) throw new NoProviderError(`no worker provider named "${name}". Configured: ${Object.keys(config.providers).join(", ") || "(none)"}.\nAdd one with: pai worker providers add <name> --base-url <url> --key-file <path> --model <model>`);
+	return p;
+}
+function mustBeRunnable(name, p) {
+	if (!p.enabled) throw new NoProviderError(`provider "${name}" is disabled. Enable it with: pai worker providers enable ${name}`);
+	return p;
+}
+/** Why one provider of a routing order did not qualify (message fragment). */
+function exclusionReason(config, state, name, cls) {
+	const p = config.providers[name];
+	if (!p) return "not configured";
+	if (!p.enabled) return "disabled";
+	if (cooldownRemaining(state, name) > 0) return "cooldown";
+	if (quotaExceeded(p)) return "quota";
+	const tier = providerCostTier(p);
+	if (cls?.maxCostTier !== void 0 && tier > cls.maxCostTier) return `cost tier ${tier} > max ${cls.maxCostTier}`;
+	if (cls?.requireTags?.length) {
+		const have = p.tags ?? [];
+		const missing = cls.requireTags.filter((t) => !have.includes(t));
+		if (missing.length) return `missing tags: ${missing.join(", ")}`;
+	}
+	return null;
+}
+/**
+* Resolve which provider (and model alias) a run uses.
+*
+* @param flagProvider --provider value, highest precedence
+* @param className    --class value (the old --role), looked up in workers.classes
+*/
+function resolveTarget(config, logDir, opts = {}) {
+	if (opts.flagProvider) return {
+		providerName: opts.flagProvider,
+		provider: mustBeRunnable(opts.flagProvider, mustExist(config, opts.flagProvider)),
+		modelAlias: null,
+		classMcp: null,
+		via: "flag"
+	};
+	const clsTarget = opts.className ? config.classes[opts.className] : void 0;
+	const cls = typeof clsTarget === "object" && clsTarget !== null ? clsTarget : void 0;
+	if (opts.className && clsTarget !== void 0 && typeof clsTarget !== "object") {
+		const [name, alias] = clsTarget.split("/");
+		return {
+			providerName: name,
+			provider: mustBeRunnable(name, mustExist(config, name)),
+			modelAlias: alias ?? null,
+			classMcp: null,
+			via: "class"
+		};
+	}
+	if (opts.className && cls?.provider) {
+		const provider = mustBeRunnable(cls.provider, mustExist(config, cls.provider));
+		return {
+			providerName: cls.provider,
+			provider,
+			modelAlias: null,
+			classMcp: cls.mcp ?? null,
+			via: "class"
+		};
+	}
+	if (opts.className && clsTarget === void 0) {
+		if (!WORKER_CLASSES.includes(opts.className)) throw new NoProviderError(`no class named "${opts.className}". Standard classes: ${WORKER_CLASSES.join(", ")}.Defined: ${Object.keys(config.classes).join(", ") || "(none)"}.\nSet one with: pai worker classes set ${opts.className}=<provider[/alias]>`);
+	}
+	if (config.active !== "auto") {
+		const name = config.active;
+		if (!name) throw new NoProviderError("no active worker provider. Add one with: pai worker providers add <name> --base-url <url> --key-file <path> --model <model>\n(or point one that exists at it: pai worker providers use <name>)");
+		return {
+			providerName: name,
+			provider: mustBeRunnable(name, mustExist(config, name)),
+			modelAlias: null,
+			classMcp: null,
+			via: "active"
+		};
+	}
+	const state = readRoutingState(logDir);
+	const order = cls?.order ?? config.routing.order;
+	const excluded = [];
+	for (const name of order) {
+		const p = config.providers[name];
+		const why = exclusionReason(config, state, name, cls);
+		if (why) {
+			excluded.push(`${name}: ${why}`);
+			continue;
+		}
+		return {
+			providerName: name,
+			provider: p,
+			modelAlias: null,
+			classMcp: cls?.mcp ?? null,
+			via: "auto"
+		};
+	}
+	throw new NoProviderError(`auto-routing found no usable provider${opts.className ? ` for class "${opts.className}"` : ""} (order: [${order.join(", ")}]).${excluded.length ? `\nExcluded: ${excluded.join("; ")}.` : ""}\nClear a cooldown with: pai worker providers enable <name>; widen the class with: pai worker classes set ${opts.className ?? "<class>"}=<target>`);
+}
+/**
+* Next provider after `from` in auto order, applying the same filters.
+* Used by rerouting; null when the order is exhausted.
+*/
+function nextAutoProvider(config, logDir, from, now = /* @__PURE__ */ new Date()) {
+	const state = readRoutingState(logDir);
+	const order = config.routing.order;
+	const start = order.indexOf(from);
+	for (let i = start + 1; i < order.length; i++) {
+		const name = order[i];
+		const p = config.providers[name];
+		if (!p || !p.enabled) continue;
+		const end = state.cooldowns[name];
+		if (end && Date.parse(end) > now.getTime()) continue;
+		if (quotaExceeded(p)) continue;
+		return name;
+	}
+	return null;
+}
+/**
+* Was this failure a quota/rate failure? Detected from the result text the
+* endpoint produced (HTTP status is not visible in the stream events).
+*/
+function isQuotaFailure(resultText) {
+	return /usage limit reached|rate limit|quota/i.test(resultText);
+}
+
+//#endregion
+//#region src/workers/pane.ts
+/**
+* pane.ts — the per-worker follow pane in iTerm2.
+*
+* One small-font pane per worker, stacked in a right-hand column: the first
+* worker of a scope splits the launching session vertically, every further
+* one splits the lowest live worker pane horizontally, so panes stack top to
+* bottom. The split never sizes the new session — that would grow the whole
+* window; instead the window's bounds are read before the split and restored
+* right after, so the panes share the space the window already had. Each
+* pane runs `pai worker follow <id> --auto-exit <n>` under the `pai-worker`
+* dynamic profile (Close Sessions On End), so panes disappear by themselves.
+*
+* Panes are tracked per scope (AIBroker session id, else tab key) in
+* <logDir>/panes/<key>.json, keyed by iTerm session unique id, newest first —
+* the split lands below the lowest live worker pane.
+*
+* The dynamic profile's font is the family of iTerm's DEFAULT profile (the
+* `Default Bookmark Guid` entry in New Bookmarks) at workers.pane.fontSize —
+* never the launching session's profile, which the Python version did and
+* which produced iTerm's "unknown parent name" dialog whenever the two
+* differed. `Dynamic Profile Parent Name` is only written when that name
+* actually exists in New Bookmarks; when iTerm's preferences cannot be read
+* the profile is still written, with font Menlo-Regular and no parent.
+*/
+const PROFILE_NAME = "pai-worker";
+/** Where the dynamic profile lives (env override keeps tests off the real one). */
+function dynamicProfilePath() {
+	return process.env.PAI_WORKER_PROFILE ?? join(homedir(), "Library", "Application Support", "iTerm2", "DynamicProfiles", "pai-worker.json");
+}
+const WORKER_SPLIT_SCRIPT = `on run(argv)
+    set targetID to item 1 of argv
+    set candList to item 2 of argv
+    set followCmd to item 3 of argv
+    set profileName to item 4 of argv
+    tell application id "com.googlecode.iterm2"
+        if not running then return "notrunning"
+        repeat with w in windows
+            repeat with t in tabs of w
+                repeat with s in sessions of t
+                    if id of s is targetID then
+                        -- sizing the new session would grow the whole window:
+                        -- pin the window's bounds now and restore them after
+                        -- the split, so the panes share the existing space.
+                        -- copy, never set: set stores the property
+                        -- reference lazily, so restoring it would re-read the
+                        -- post-split bounds instead of these — observed as the
+                        -- window jumping to the main display
+                        copy bounds of w to winBounds
+                        set sessIDs to {}
+                        repeat with other in sessions of t
+                            set end of sessIDs to (id of other as text)
+                        end repeat
+                        set lived to {}
+                        set splitS to missing value
+                        repeat with cid in my splitIds(candList)
+                            set cidText to (cid as text)
+                            if sessIDs contains cidText then
+                                set end of lived to cidText
+                                if splitS is missing value then
+                                    set splitS to first session of t whose id is cidText
+                                end if
+                            end if
+                        end repeat
+                        if profileName is "" then
+                            if splitS is missing value then
+                                tell s
+                                    set newS to split vertically with default profile
+                                end tell
+                            else
+                                tell splitS
+                                    set newS to split horizontally with default profile
+                                end tell
+                            end if
+                        else
+                            if splitS is missing value then
+                                tell s
+                                    set newS to split vertically with profile profileName
+                                end tell
+                            else
+                                tell splitS
+                                    set newS to split horizontally with profile profileName
+                                end tell
+                            end if
+                        end if
+                        tell newS
+                            write text followCmd
+                        end tell
+                        try
+                            set bounds of w to winBounds
+                        end try
+                        set out to ""
+                        repeat with lid in lived
+                            set out to out & lid & ","
+                        end repeat
+                        return out & "|" & (id of newS as text)
+                    end if
+                end repeat
+            end repeat
+        end repeat
+    end tell
+    return "notfound"
+end run
+
+on splitIds(s)
+    set out to {}
+    if s is "" then return out
+    set prevDels to AppleScript's text item delimiters
+    set AppleScript's text item delimiters to ","
+    repeat with part in text items of s
+        set end of out to (part as text)
+    end repeat
+    set AppleScript's text item delimiters to prevDels
+    return out
+end splitIds`;
+const TAB_TTYS_SCRIPT = `on run(argv)
+    set targetID to item 1 of argv
+    tell application id "com.googlecode.iterm2"
+        if not running then return "notrunning"
+        repeat with w in windows
+            repeat with t in tabs of w
+                repeat with s in sessions of t
+                    if id of s is targetID then
+                        set ttys to {}
+                        repeat with other in sessions of t
+                            copy (tty of other) to end of ttys
+                        end repeat
+                        return ttys
+                    end if
+                end repeat
+            end repeat
+        end repeat
+    end tell
+    return "notfound"
+end run`;
+const WINDOW_BOUNDS_SCRIPT = `on run(argv)
+    set targetID to item 1 of argv
+    tell application id "com.googlecode.iterm2"
+        if not running then return "notrunning"
+        repeat with w in windows
+            repeat with t in tabs of w
+                repeat with s in sessions of t
+                    if id of s is targetID then
+                        copy bounds of w to winBounds
+                        set prevDels to AppleScript's text item delimiters
+                        set AppleScript's text item delimiters to ", "
+                        set out to winBounds as text
+                        set AppleScript's text item delimiters to prevDels
+                        return out
+                    end if
+                end repeat
+            end repeat
+        end repeat
+    end tell
+    return "notfound"
+end run`;
+const SPLIT_SCRIPT = `on run(argv)
+    set targetID to item 1 of argv
+    set followCmd to item 2 of argv
+    tell application id "com.googlecode.iterm2"
+        if not running then return "notrunning"
+        repeat with w in windows
+            repeat with t in tabs of w
+                repeat with s in sessions of t
+                    if id of s is targetID then
+                        tell s
+                            set newS to split vertically with default profile
+                        end tell
+                        tell newS
+                            write text followCmd
+                        end tell
+                        return "opened"
+                    end if
+                end repeat
+            end repeat
+        end repeat
+    end tell
+    return "notfound"
+end run`;
+/** Run an AppleScript with argv. Rejects when osascript itself cannot run. */
+function osascript(script, args) {
+	return new Promise((resolve, reject) => {
+		const proc = spawn("osascript", ["-", ...args], { stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		] });
+		let out = "";
+		let err = "";
+		proc.stdout.on("data", (c) => out += c.toString("utf8"));
+		proc.stderr.on("data", (c) => err += c.toString("utf8"));
+		proc.on("error", reject);
+		proc.on("close", () => resolve({
+			stdout: out,
+			stderr: err
+		}));
+		proc.stdin.write(script);
+		proc.stdin.end();
+	});
+}
+function psOutput$1(format) {
+	try {
+		return execFileSync("ps", ["-axo", format], { encoding: "utf8" });
+	} catch {
+		return "";
+	}
+}
+/** TTys of running `worker follow` processes, normalised to /dev/ttysNNN. */
+function followTtys() {
+	const ttys = /* @__PURE__ */ new Set();
+	for (const line of psOutput$1("tty=,command=").split("\n")) {
+		const parts = line.trim().split(/\s+/, 2);
+		if (parts.length < 2 || parts[0] === "ps") continue;
+		if (!/(^|\/)(worker-follow|pai worker follow|glm-ps follow)\b/.test(parts[1])) continue;
+		if (parts[0].startsWith("ttys")) ttys.add(`/dev/${parts[0]}`);
+	}
+	return ttys;
+}
+/** True while a `follow <wid>` process runs (its pane shows that worker). */
+function workerPaneOpen(wid) {
+	const pat = new RegExp(`(?:worker follow|worker-follow|glm-ps follow) ${wid.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
+	return psOutput$1("command=").split("\n").some((ln) => pat.test(ln));
+}
+/** plutil's message for an ExecFileSync failure, else the exception text. */
+function toolErr(e) {
+	const err = e;
+	return ((typeof err.stderr === "string" ? err.stderr : err.stderr?.toString("utf8")) || err.message || String(e)).trim();
+}
+/**
+* Read New Bookmarks and Default Bookmark Guid from an iTerm preferences
+* plist. Key-scoped `plutil -extract`, never a whole-file JSON conversion:
+* real iTerm preferences carry `<date>` objects (SULastCheckTime & friends)
+* which `plutil -convert json` rejects outright — "Invalid object in plist
+* for JSON format" — so the whole-file read always failed and the dynamic
+* profile was never written.
+*/
+function readItermPlist(plistPath) {
+	let bookmarks = [];
+	try {
+		const out = execFileSync("plutil", [
+			"-extract",
+			"New Bookmarks",
+			"json",
+			"-o",
+			"-",
+			plistPath
+		], {
+			encoding: "utf8",
+			timeout: 1e4
+		});
+		const parsed = JSON.parse(out);
+		if (Array.isArray(parsed)) bookmarks = parsed;
+	} catch (e) {
+		return {
+			bookmarks: [],
+			defaultGuid: null,
+			error: `extracting New Bookmarks: ${toolErr(e)}`
+		};
+	}
+	let defaultGuid = null;
+	try {
+		defaultGuid = execFileSync("plutil", [
+			"-extract",
+			"Default Bookmark Guid",
+			"raw",
+			"-o",
+			"-",
+			plistPath
+		], {
+			encoding: "utf8",
+			timeout: 1e4
+		}).trim() || null;
+	} catch {}
+	return {
+		bookmarks,
+		defaultGuid,
+		error: null
+	};
+}
+/** iTerm's exported preferences, via a temp plist (no shell pipe involved). */
+function itermPrefs() {
+	let dir = null;
+	try {
+		dir = mkdtempSync(join(tmpdir(), "pai-iterm-"));
+		const plist = join(dir, "iterm2.plist");
+		execFileSync("defaults", [
+			"export",
+			"com.googlecode.iterm2",
+			plist
+		], {
+			encoding: "utf8",
+			timeout: 1e4
+		});
+		return readItermPlist(plist);
+	} catch (e) {
+		return {
+			bookmarks: [],
+			defaultGuid: null,
+			error: `defaults export: ${toolErr(e)}`
+		};
+	} finally {
+		if (dir) try {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		} catch {}
+	}
+}
+/** The New Bookmarks entry of that profile name, null if absent. */
+function bookmarkFrom(read, named) {
+	return read.bookmarks.find((b) => b.Name === named) ?? null;
+}
+/** The bookmark iTerm marks default, null when it is missing or unreadable. */
+function defaultBookmarkFrom(read) {
+	return read.defaultGuid ? read.bookmarks.find((b) => b.Guid === read.defaultGuid) ?? null : null;
+}
+/** The default profile, read fresh from iTerm's preferences. */
+function defaultBookmark() {
+	return defaultBookmarkFrom(itermPrefs());
+}
+/**
+* The pane profile's font: the family of iTerm's default profile at
+* `fontSize` points ("MesloLGLNFM-Regular 18" + 13 → "MesloLGLNFM-Regular 13"),
+* or "Menlo-Regular <fontSize>" when the default font cannot be read.
+*/
+function paneFont(font, fontSize) {
+	const idx = (font ?? "").lastIndexOf(" ");
+	if (idx > 0) {
+		const family = font.slice(0, idx);
+		if (!Number.isNaN(parseFloat(font.slice(idx + 1)))) return `${family} ${fontSize}`;
+	}
+	return `Menlo-Regular ${fontSize}`;
+}
+/** Write the pai-worker dynamic profile; iTerm2 loads that directory itself. */
+function writeDynamicProfile(parent, fontSize, read = itermPrefs) {
+	const profile = {
+		Name: PROFILE_NAME,
+		Guid: "pai-worker-dynamic-profile",
+		"Normal Font": paneFont(parent?.["Normal Font"], fontSize),
+		"Close Sessions On End": true
+	};
+	if (parent?.Name && bookmarkFrom(read(), parent.Name)) profile["Dynamic Profile Parent Name"] = parent.Name;
+	const path = dynamicProfilePath();
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, JSON.stringify({ Profiles: [profile] }, null, 2) + "\n", "utf8");
+	renameSync(tmp, path);
+}
+let warnedPrefs = false;
+/**
+* Profile for new worker panes, creating the small-font one on demand.
+* "" means "split with the default profile" (also the fallback when the
+* dynamic profile does not show up in time).
+*
+* The profile file is written whenever it is missing — even when iTerm's
+* preferences cannot be read; then it gets font "Menlo-Regular <fontSize>"
+* and no parent, and the reason is logged to stderr once.
+*/
+async function followProfile(fontSize, read = itermPrefs) {
+	const first = read();
+	const parent = defaultBookmarkFrom(first);
+	const path = dynamicProfilePath();
+	const existed = existsSync(path);
+	if (!existed) writeDynamicProfile(parent, fontSize, () => first);
+	if (!parent) {
+		if (!warnedPrefs) {
+			warnedPrefs = true;
+			const reason = first.error ?? "no profile is marked default";
+			const what = existed ? `keeping ${path} as-is` : `wrote ${path} with Menlo-Regular ${fontSize} and no parent`;
+			process.stderr.write(`pai worker pane: cannot read iTerm's default profile (${reason}) — ${what}\n`);
+		}
+		if (first.error) return "";
+	}
+	for (let i = 0; i < 10; i++) {
+		if (bookmarkFrom(read(), PROFILE_NAME)) return PROFILE_NAME;
+		await new Promise((r) => setTimeout(r, 200));
+	}
+	process.stderr.write(`pai worker pane: profile ${PROFILE_NAME} not visible, splitting with default\n`);
+	return "";
+}
+function loadRegistry(path) {
+	try {
+		const reg = JSON.parse(readFileSync(path, "utf8"));
+		return Array.isArray(reg) ? reg : [];
+	} catch {
+		return [];
+	}
+}
+function saveRegistry(path, reg) {
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, JSON.stringify(reg, null, 1), "utf8");
+	renameSync(tmp, path);
+}
+/** Open (or only report on) the stacked follow pane of one worker. */
+async function openPaneForWorker(logDir, config, wid, term) {
+	if (workerPaneOpen(wid)) return `pane for ${wid} already open`;
+	const uid = itermUuid(term);
+	const regPath = join(panesDir(logDir), `${scopeKey(term)}.json`);
+	const reg = loadRegistry(regPath);
+	const profile = await followProfile(config.pane.fontSize);
+	const cmd = ` exec pai worker follow ${JSON.stringify(wid)} --auto-exit ${config.pane.autoExitSecs}`;
+	const p = await osascript(WORKER_SPLIT_SCRIPT, [
+		uid,
+		[...reg].reverse().map((e) => e.session).join(","),
+		cmd,
+		profile
+	]);
+	const out = p.stdout.trim();
+	if (out === "notfound" || out === "notrunning") throw new Error(out === "notfound" ? "pai worker pane: no open iTerm2 session matches ITERM_SESSION_ID" : "pai worker pane: iTerm2 is not running");
+	const bar = out.indexOf("|");
+	if (bar < 0) throw new Error(`pai worker pane: osascript failed: ${(p.stderr || out).slice(0, 200)}`);
+	const live = new Set(out.slice(0, bar).split(",").filter(Boolean));
+	const pruned = reg.filter((e) => live.has(e.session));
+	pruned.push({
+		session: out.slice(bar + 1),
+		worker: wid,
+		opened: (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19)
+	});
+	saveRegistry(regPath, pruned);
+	return `pane opened for ${wid}`;
+}
+/**
+* One `--check` line with the bounds of the window hosting `term`'s iTerm
+* session — the before/after pair that shows whether a split moved it.
+* Read-only; never touches the window.
+*/
+async function windowBoundsLine(term) {
+	const uid = itermUuid(term);
+	if (!uid) return "window bounds: (not in iTerm2)";
+	try {
+		const p = await osascript(WINDOW_BOUNDS_SCRIPT, [uid]);
+		const out = p.stdout.trim();
+		if (out && out !== "notfound" && out !== "notrunning") return `window bounds: ${out}`;
+		return `window bounds: (${out === "notfound" ? "iTerm2 session not found" : out === "notrunning" ? "iTerm2 not running" : (p.stderr.trim() || "no output").slice(0, 120)})`;
+	} catch (e) {
+		return `window bounds: (osascript: ${String(e.message ?? e).slice(0, 120)})`;
+	}
+}
+/**
+* Report-only variant used by `pai worker pane <id> --check`: whether a pane
+* runs for the worker, the bounds of the window hosting the asking session,
+* plus the dynamic profile's path, its existence, and the font it contains
+* (or, when missing, would write).
+*/
+async function checkPaneForWorker(wid, fontSize, term) {
+	const lines = [workerPaneOpen(wid) ? `pane for ${wid} open` : `no pane for ${wid}`];
+	lines.push(await windowBoundsLine(term));
+	const path = dynamicProfilePath();
+	if (existsSync(path)) {
+		let font = "(unreadable)";
+		try {
+			font = JSON.parse(readFileSync(path, "utf8")).Profiles?.[0]?.["Normal Font"] ?? "(none)";
+		} catch {}
+		lines.push(`profile file: ${path} (exists)`);
+		lines.push(`profile font: ${font}`);
+	} else {
+		const parent = defaultBookmark();
+		lines.push(`profile file: ${path} (missing)`);
+		lines.push(`profile font (would write): ${paneFont(parent?.["Normal Font"], fontSize)}`);
+	}
+	return lines.join("\n");
+}
+/**
+* Split this iTerm tab and run `pai worker follow` in the new pane, unless
+* one already runs here (detected by TTY — iTerm overwrites session names
+* with the running command, so names cannot serve as idempotence).
+*/
+async function openFollowPane(logDir, _config, term, checkOnly) {
+	const uid = itermUuid(term);
+	const out = (await osascript(TAB_TTYS_SCRIPT, [uid])).stdout.trim();
+	if (out === "notfound") throw new Error("pai worker pane: no open iTerm2 session matches ITERM_SESSION_ID");
+	if (out === "notrunning") throw new Error("pai worker pane: iTerm2 is not running");
+	if ([...new Set(out.split(",").map((t) => t.trim()).filter(Boolean))].filter((t) => followTtys().has(t)).length > 0) return "follow pane already open";
+	if (checkOnly) return "no follow pane";
+	const s = await osascript(SPLIT_SCRIPT, [uid, " exec pai worker follow"]);
+	const sout = s.stdout.trim();
+	if (sout === "opened") return "follow pane opened";
+	if (sout === "notfound") throw new Error("pai worker pane: no open iTerm2 session matches ITERM_SESSION_ID");
+	throw new Error(`pai worker pane: osascript failed: ${(s.stderr || sout).slice(0, 200)}`);
+}
+
+//#endregion
+//#region src/workers/report.ts
+/**
+* report.ts — the worker contract: terse, structured final reports.
+*
+* Headless workers run with an appended system prompt that fixes their output
+* shape: act, verify, then finish with ONE final message that is a JSON object
+* and nothing else. The runner parses it out of the result; the viewer renders
+* it as a compact block instead of a wall of text.
+*/
+/** Appended to the caller's system prompt on every headless run (2h). */
+const WORKER_CONTRACT_PROMPT = [
+	"You are a headless implementation worker, run non-interactively by an orchestrating session.",
+	"No narration, no timestamps, no greetings, no summaries of what you read; act, verify, then stop.",
+	"Your ONE final message is a JSON object and nothing else — no prose before or after, no code fence:",
+	"{\"changed\":[{\"path\":\"…\",\"summary\":\"…\"}],\"commands\":[\"…\"],\"checks\":[{\"name\":\"…\",\"ok\":true,\"detail\":\"…\"}],\"open\":[\"…\"],\"notes\":\"one line\"}",
+	"changed: files you touched (path + one-line summary). commands: the commands that verify the work.",
+	"checks: each with ok true/false and the evidence in detail. open: what you could not finish, if anything.",
+	"notes: one line, the headline a reviewer reads first."
+].join("\n");
+/**
+* Extract the JSON report from a worker's final message. Accepts a bare
+* object, a ```json fenced block, or an object embedded in surrounding text.
+* Only objects that look like the contract count (at least one of changed /
+* checks / notes) — any other JSON falls through to null so the raw text is
+* kept as-is.
+*/
+function parseWorkerReport(text) {
+	const trimmed = (text ?? "").trim();
+	if (!trimmed) return null;
+	const candidates = [];
+	const fence = trimmed.match(/```(?:json)?\s*(\{[\s\S]*?\})\s*```/);
+	if (fence) candidates.push(fence[1]);
+	if (trimmed.startsWith("{")) candidates.push(trimmed);
+	const first = trimmed.indexOf("{");
+	const last = trimmed.lastIndexOf("}");
+	if (first >= 0 && last > first) candidates.push(trimmed.slice(first, last + 1));
+	for (const cand of candidates) try {
+		const v = JSON.parse(cand);
+		if (typeof v === "object" && v !== null && !Array.isArray(v) && looksLikeReport(v)) return v;
+	} catch {}
+	return null;
+}
+/** The contract's fingerprint — guards against unrelated JSON in a reply. */
+function looksLikeReport(v) {
+	const o = v;
+	return Array.isArray(o.changed) || Array.isArray(o.checks) || typeof o.notes === "string";
+}
+/**
+* Render a parsed report as the compact block the viewer shows: changed paths
+* with summaries, checks with ✓/✗, open items, notes. Empty report → [].
+*/
+function renderReport(c, prefix, r, cwd = "") {
+	const out = [];
+	const has = (xs) => (xs ?? []).length > 0;
+	if (has(r.changed)) {
+		out.push(`${prefix}${c("bold", "changed")}`);
+		for (const ch of r.changed) out.push(`${prefix}  ${relShort(ch.path ?? "?", cwd)} — ${shortText(ch.summary ?? "", 90)}`);
+	}
+	if (has(r.checks)) {
+		out.push(`${prefix}${c("bold", "checks")}`);
+		for (const ck of r.checks) {
+			const mark = ck.ok === false ? c("red", "✗") : c("green", "✓");
+			const detail = ck.detail ? c("dim", ` · ${shortText(ck.detail, 80)}`) : "";
+			out.push(`${prefix}  ${mark} ${ck.name ?? "?"}${detail}`);
+		}
+	}
+	if (has(r.commands)) {
+		out.push(`${prefix}${c("bold", "commands")}`);
+		for (const cmd of r.commands) out.push(`${prefix}  ${c("dim", shortText(cmd, 100))}`);
+	}
+	if (has(r.open)) {
+		out.push(`${prefix}${c("bold", "open")}`);
+		for (const o of r.open) out.push(`${prefix}  ${c("yellow", shortText(o, 100))}`);
+	}
+	if (r.notes) out.push(`${prefix}${c("bold", "notes")}  ${shortText(r.notes, 120)}`);
+	return out;
+}
+/** repo-relative display of a changed path when it lies under cwd. */
+function relShort(p, cwd) {
+	if (!cwd) return p;
+	const r = relative(cwd, p);
+	return r && !r.startsWith("..") ? r : p;
+}
+
+//#endregion
+//#region src/workers/mcp.ts
+/**
+* mcp.ts — the MCP allowlist for headless workers.
+*
+* Headless workers start with NO MCP servers: every server definition is a
+* prompt-time tool inventory the model pays to know, and a worker that only
+* reads and edits files needs none of it. A run may opt in with `--mcp
+* name[,name…]` (or a role carrying `"mcp": [...]`); names may be single
+* servers from ~/.claude.json's `mcpServers` or `workers.mcpSets` set names,
+* which expand to their member list. The filtered config lands in
+* `<logDir>/<id>.mcp.json` and is passed with `--strict-mcp-config
+* --mcp-config` so exactly those servers load. MCP servers are chosen at
+* launch only — a mid-run `say` cannot add any.
+*/
+/** ~/.claude.json — the user's MCP server definitions (top-level mcpServers). */
+const CLAUDE_JSON = join(homedir(), ".claude.json");
+function readMcpServers(claudeJson = CLAUDE_JSON) {
+	try {
+		if (!existsSync(claudeJson)) return {};
+		const servers = JSON.parse(readFileSync(claudeJson, "utf8")).mcpServers;
+		if (typeof servers !== "object" || servers === null || Array.isArray(servers)) return {};
+		return servers;
+	} catch {
+		return {};
+	}
+}
+/**
+* Split a `--mcp a,b,c` flag value (also accepts repeated flags already split
+* by the caller) and expand set names from workers.mcpSets.
+*/
+function expandMcpNames(names, config, claudeJson = CLAUDE_JSON) {
+	const available = readMcpServers(claudeJson);
+	const out = [];
+	for (const raw of names) for (const name of raw.split(",").map((s) => s.trim()).filter(Boolean)) {
+		if (name in config.mcpSets) {
+			for (const member of config.mcpSets[name]) if (!out.includes(member)) out.push(member);
+			continue;
+		}
+		if (!(name in available)) {
+			const sets = Object.keys(config.mcpSets);
+			throw new WorkersConfigError(`unknown MCP server "${name}". Available servers: ${Object.keys(available).join(", ") || "(none in ~/.claude.json)"}${sets.length ? `; sets: ${sets.join(", ")}` : ""}`);
+		}
+		if (!out.includes(name)) out.push(name);
+	}
+	return out;
+}
+/** Path of a run's filtered MCP config. */
+function runMcpConfigPath(logDir, id) {
+	return join(logDir, `${id}.mcp.json`);
+}
+/**
+* Write a config containing only `names` (already expanded) and return its
+* path. Unknown names fail fast with the available list.
+*/
+function writeMcpConfig(logDir, id, names, claudeJson = CLAUDE_JSON) {
+	const available = readMcpServers(claudeJson);
+	const unknown = names.filter((n) => !(n in available));
+	if (unknown.length) throw new WorkersConfigError(`unknown MCP server(s): ${unknown.join(", ")}. Available: ${Object.keys(available).join(", ") || "(none in ~/.claude.json)"}`);
+	const servers = {};
+	for (const n of names) servers[n] = available[n];
+	const path = runMcpConfigPath(logDir, id);
+	if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
+	writeFileSync(path, JSON.stringify({ mcpServers: servers }, null, 2) + "\n", "utf8");
+	return path;
+}
+/** `pai worker mcp list`: the servers and sets a run could name. */
+function describeMcp(config, claudeJson = CLAUDE_JSON) {
+	const servers = Object.keys(readMcpServers(claudeJson));
+	const lines = [];
+	if (servers.length) {
+		lines.push(`servers (~/.claude.json):`);
+		for (const s of servers) lines.push(`  ${s}`);
+	} else lines.push(`no MCP servers defined in ~/.claude.json`);
+	const sets = Object.entries(config.mcpSets);
+	if (sets.length) {
+		lines.push(`sets (workers.mcpSets):`);
+		for (const [name, members] of sets) lines.push(`  ${name} = ${members.join(", ")}`);
+	}
+	lines.push(`usage: pai worker run --mcp <name>[,<name>…] -p '<task>'`);
+	return lines;
+}
+
+//#endregion
+//#region src/workers/operator.ts
+/**
+* operator.ts — talking to a running worker.
+*
+* Headless workers run with `--input-format stream-json` and their stdin held
+* open, so a run is a conversation: every line sent to the per-worker Unix
+* socket `<logDir>/<id>.sock` is forwarded to the child as a user message and
+* mirrored into the transcript as an `operator` event (rendered with a »
+* marker). Once the worker has finished its turn, stdin closes 2 s later
+* unless a new message arrives — after that, `say` refuses and `resume`
+* continues the same Claude session with the worker's context intact.
+*/
+function operatorSocketPath(logDir, id) {
+	return join(logDir, `${id}.sock`);
+}
+/**
+* The runner's side: listen on the worker socket, hand every received line to
+* `onLine`. Returns the server (close it when the run ends; the socket file is
+* unlinked on close, best effort).
+*/
+function createOperatorServer(logDir, id, onLine) {
+	const path = operatorSocketPath(logDir, id);
+	try {
+		if (existsSync(path)) unlinkSync(path);
+	} catch {}
+	const server = createServer((socket) => {
+		let buf = "";
+		socket.on("data", (chunk) => {
+			buf += chunk.toString("utf8");
+			let nl;
+			while ((nl = buf.indexOf("\n")) >= 0) {
+				const line = buf.slice(0, nl).replace(/\r$/, "");
+				buf = buf.slice(nl + 1);
+				if (line.trim()) onLine(line);
+				socket.write("ok\n");
+			}
+		});
+	});
+	server.listen(path);
+	server.on("close", () => {
+		try {
+			if (existsSync(path)) unlinkSync(path);
+		} catch {}
+	});
+	return server;
+}
+/**
+* `pai worker say <id> "<text>"`: forward one line to a running worker.
+* Resolves "ok", rejects with a clear message when the worker is not running.
+*/
+function sayToWorker(logDir, id, text, timeoutMs = 4e3) {
+	const status = loadStatus(logDir, id);
+	if (!status) return Promise.reject(/* @__PURE__ */ new Error(`no worker named "${id}"`));
+	if (status.state !== "running" || !alive(status.pid)) return Promise.reject(/* @__PURE__ */ new Error(`worker ${id} is not running (state: ${status.state}) — continue it instead with: pai worker resume ${id} "<text>"`));
+	const path = operatorSocketPath(logDir, id);
+	if (!existsSync(path)) return Promise.reject(/* @__PURE__ */ new Error(`worker ${id} has no operator socket (${path}) — it may predate this PAI version`));
+	return new Promise((resolve, reject) => {
+		const sock = connect(path);
+		const fail = (e) => {
+			sock.destroy();
+			reject(/* @__PURE__ */ new Error(`cannot talk to worker ${id}: ${e.message}`));
+		};
+		sock.setTimeout(timeoutMs, () => fail(/* @__PURE__ */ new Error("timeout")));
+		sock.once("error", (e) => fail(e));
+		sock.once("connect", () => {
+			sock.write(text.replace(/\n/g, " ") + "\n");
+		});
+		sock.once("data", () => {
+			sock.end();
+			resolve("ok");
+		});
+	});
+}
+
+//#endregion
+//#region src/workers/proxy/server.ts
+/**
+* server.ts — the PAI worker proxy: Anthropic Messages API on the front,
+* OpenAI Chat Completions on the back, loopback only.
+*
+* One proxy serves every OpenAI-protocol provider: Claude Code points
+* ANTHROPIC_BASE_URL at `http://127.0.0.1:8797/<provider>` and the provider
+* name in the path selects the upstream (`upstreamUrl` + `keyFile` from the
+* workers config, re-read per request so config edits apply without a
+* restart). `run` starts the proxy on demand (detached, pid file under the
+* logDir) and `pai worker proxy stop` stops it again.
+*
+* All translation lives in translate.ts; this file is only HTTP plumbing.
+*/
+const DEFAULT_PROXY_PORT = 8797;
+const HOST = "127.0.0.1";
+function proxyPidPath(logDir) {
+	return join(logDir, "proxy.pid");
+}
+/** True when something already accepts connections on the port. */
+function proxyListening(port = DEFAULT_PROXY_PORT, timeoutMs = 400) {
+	return new Promise((resolve) => {
+		const sock = connect({
+			port,
+			host: HOST
+		});
+		const done = (ok) => {
+			sock.removeAllListeners();
+			sock.destroy();
+			resolve(ok);
+		};
+		sock.setTimeout(timeoutMs, () => done(false));
+		sock.once("connect", () => done(true));
+		sock.once("error", () => done(false));
+	});
+}
+/**
+* Where the standalone proxy artefact lives, found from this module's own
+* location (dist/cli bundle → ../hooks/, dev checkout → <repo>/dist/hooks).
+*/
+function standaloneProxyPath() {
+	let dir = dirname(fileURLToPath(import.meta.url));
+	for (let i = 0; i < 6; i++) {
+		for (const cand of [
+			join(dir, "worker-proxy.mjs"),
+			join(dir, "hooks", "worker-proxy.mjs"),
+			join(dir, "dist", "hooks", "worker-proxy.mjs")
+		]) if (existsSync(cand)) return cand;
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return null;
+}
+/**
+* Ensure a proxy is listening on the port; start the detached standalone when
+* nothing answers. Returns the base URL (`http://127.0.0.1:<port>`).
+*/
+async function ensureProxyRunning(port, logDir) {
+	if (await proxyListening(port)) return `http://${HOST}:${port}`;
+	const script = standaloneProxyPath();
+	if (!script) throw new Error(`the PAI worker proxy is not running and its build was not found — run \`bun run build\` (or start one with: pai worker proxy --port ${port})`);
+	if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
+	const child = spawn(process.execPath, [
+		script,
+		"--port",
+		String(port)
+	], {
+		detached: true,
+		stdio: "ignore"
+	});
+	child.unref();
+	writeFileSync(proxyPidPath(logDir), `${child.pid}\n`, "utf8");
+	for (let i = 0; i < 40; i++) {
+		if (await proxyListening(port)) return `http://${HOST}:${port}`;
+		await new Promise((r) => setTimeout(r, 250));
+	}
+	throw new Error(`the PAI worker proxy did not come up on port ${port} (see ${proxyPidPath(logDir)})`);
+}
+/** `pai worker proxy stop`: SIGTERM the pid from the pid file. */
+function stopProxy(logDir) {
+	const path = proxyPidPath(logDir);
+	if (!existsSync(path)) return "no proxy pid file — nothing to stop";
+	const pid = parseInt(readFileSync(path, "utf8").trim(), 10);
+	unlinkSync(path);
+	if (!Number.isFinite(pid)) return "stale proxy pid file removed";
+	try {
+		process.kill(pid, "SIGTERM");
+	} catch {
+		return `proxy pid ${pid} was not running (pid file removed)`;
+	}
+	return `proxy pid ${pid} stopped`;
+}
+
+//#endregion
+//#region src/workers/codex.ts
+/**
+* codex.ts — the "codex" runner engine.
+*
+* A ChatGPT plan gives no API key, only Codex CLI access, so a provider may
+* set `engine: "codex"`: `run` then shells out to `codex exec --json <prompt>`
+* (non-interactive) instead of Claude Code. The JSONL event stream is parsed
+* into the same status-file fields (turns, tools, last) and ledger lines as a
+* Claude run, and is normalised into claude-code-shaped events in the
+* worker's .jsonl so follow/replay/the pane render it unchanged.
+*
+* Implemented against the documented `codex exec --json` interface
+* (thread.started / item.completed / turn.completed / turn.failed lines);
+* verify against the installed CLI when one is present.
+* `--allowedTools` has no Codex equivalent and is dropped (ledgered).
+*/
+/** Build the codex exec argument vector (without the binary itself). */
+function buildCodexArgs(prompt, model) {
+	return [
+		"exec",
+		"--json",
+		"--skip-git-repo-check",
+		...model ? ["-m", model] : [],
+		"--",
+		prompt
+	];
+}
+/** Env for a codex run: caller's env, Anthropic vars stripped, key applied. */
+function buildCodexEnv(provider) {
+	const env = { ...process.env };
+	delete env.ANTHROPIC_API_KEY;
+	delete env.ANTHROPIC_BASE_URL;
+	delete env.ANTHROPIC_AUTH_TOKEN;
+	delete env.ANTHROPIC_DEFAULT_HAIKU_MODEL;
+	delete env.ANTHROPIC_DEFAULT_SONNET_MODEL;
+	delete env.ANTHROPIC_DEFAULT_OPUS_MODEL;
+	const keyPath = providerKeyPath(provider);
+	if (keyPath && existsSync(keyPath)) env.OPENAI_API_KEY = readFileSync(keyPath, "utf8").trim();
+	if (provider.upstreamUrl) env.OPENAI_BASE_URL = provider.upstreamUrl;
+	for (const [k, v] of Object.entries(provider.env)) env[k] = v;
+	env.PAI_WORKER = "1";
+	return env;
+}
+/** Codex "not applicable" flags the runner drops with a ledger note. */
+function codexDroppedFlags(argv) {
+	const dropped = [];
+	for (let i = 0; i < argv.length; i++) {
+		const a = argv[i];
+		if (a === "--allowedTools" || a === "--disallowedTools" || a === "--mcp-config" || a === "--mcp") {
+			dropped.push(a);
+			if (i + 1 < argv.length && !argv[i + 1].startsWith("-")) i++;
+		} else if (a.startsWith("--allowedTools=") || a.startsWith("--mcp-config=")) dropped.push(a.split("=")[0]);
+	}
+	return dropped;
+}
+const emptyCodexResult = () => ({
+	events: [],
+	turns: 0,
+	tools: 0,
+	last: null,
+	isError: false,
+	contextTokens: null,
+	finalText: null,
+	threadId: null
+});
+/**
+* Fold one parsed `codex exec --json` line into the running result: appends
+* normalised transcript events and updates the counters in place.
+*/
+function foldCodexLine(line, r) {
+	if (typeof line !== "object" || line === null) return;
+	const e = line;
+	const type = typeof e.type === "string" ? e.type : "";
+	if (type === "thread.started" && typeof e.thread_id === "string") {
+		r.threadId = e.thread_id;
+		return;
+	}
+	if (type === "item.completed" && typeof e.item === "object" && e.item !== null) {
+		const item = e.item;
+		const kind = typeof item.type === "string" ? item.type : "";
+		if (kind === "agent_message" && typeof item.text === "string") {
+			r.turns += 1;
+			r.last = `says: ${item.text.slice(0, 70)}`;
+			r.finalText = item.text;
+			r.events.push({
+				type: "assistant",
+				message: { content: [{
+					type: "text",
+					text: item.text
+				}] }
+			});
+		} else if (kind === "command_execution") {
+			r.tools += 1;
+			const cmd = typeof item.command === "string" ? item.command : "?";
+			const rc = typeof item.exit_code === "number" ? item.exit_code : 0;
+			r.last = `Bash: ${cmd.slice(0, 70)}`;
+			r.events.push({
+				type: "assistant",
+				message: { content: [{
+					type: "tool_use",
+					name: "Bash",
+					input: { command: cmd }
+				}] }
+			});
+			r.events.push({
+				type: "user",
+				message: { content: [{
+					type: "tool_result",
+					tool_use_id: "",
+					is_error: rc !== 0,
+					content: item.aggregated_output ?? ""
+				}] }
+			});
+		} else if (kind === "file_change") {
+			r.tools += 1;
+			const files = (Array.isArray(item.changes) ? item.changes : []).map((c) => typeof c === "object" && c !== null && typeof c.path === "string" ? c.path : "?").join(", ");
+			r.last = `files: ${files.slice(0, 70)}`;
+			r.events.push({
+				type: "assistant",
+				message: { content: [{
+					type: "tool_use",
+					name: "Write",
+					input: { file_path: files }
+				}] }
+			});
+		} else if (kind === "mcp_tool_call") {
+			r.tools += 1;
+			r.last = `mcp: ${String(item.tool ?? "?")}`;
+		}
+		return;
+	}
+	if (type === "turn.completed") {
+		const usage = typeof e.usage === "object" && e.usage !== null ? e.usage : {};
+		const tokens = (usage.input_tokens ?? 0) + (usage.cached_input_tokens ?? 0) + (usage.output_tokens ?? 0);
+		if (tokens > 0) r.contextTokens = tokens;
+		return;
+	}
+	if (type === "turn.failed" || type === "error") {
+		r.isError = true;
+		const err = typeof e.error === "object" && e.error !== null ? e.error : {};
+		r.last = String(err.message ?? e.message ?? "codex turn failed");
+	}
+}
+/** Parse one JSONL line; null for blanks and non-JSON noise. */
+function parseCodexLine(line) {
+	const t = line.trim();
+	if (!t.startsWith("{")) return null;
+	try {
+		return JSON.parse(t);
+	} catch {
+		return null;
+	}
+}
+/** True when the Codex CLI is on PATH (test reports "not installed" else). */
+function codexInstalled() {
+	try {
+		execFileSync("codex", ["--version"], {
+			timeout: 5e3,
+			stdio: "ignore"
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+//#region src/workers/run.ts
+/**
+* run.ts — the worker runner (port of the glm / glm-run pair, provider-neutral).
+*
+* One claude-code process per call, pointed at the chosen provider:
+*
+*   - env: ANTHROPIC_BASE_URL/AUTH_TOKEN from the provider (token from its
+*     key file, never from the environment), the three DEFAULT_*_MODEL vars,
+*     the provider's extra env, nonessential traffic off, and ANTHROPIC_API_KEY
+*     stripped so nothing can fall back to Anthropic billing. OpenAI-protocol
+*     providers point at the PAI proxy instead (started on demand, the
+*     provider name in the URL path); codex-engine providers run the Codex CLI.
+*   - headless (-p): strict empty MCP config unless the caller brings one or
+*     names servers via --mcp / a role (then a filtered <id>.mcp.json),
+*     PAI_WORKER=1 so PAI's per-session hooks leave it alone, the worker
+*     contract appended to the system prompt, `--input-format stream-json`
+*     with the prompt as the first stdin user message (the operator socket
+*     can add more mid-run), stream-json mirroring (every line stamped `_ts`)
+*     into <logDir>/<id>.jsonl, a live <id>.status for ps/follow/status line
+*     (context meter included), ledger lines, result printed in the caller's
+*     --output-format (json adds the parsed `report`), and the follow pane
+*     (unless --no-pane).
+*   - interactive: no MCP restriction, no pane, ENABLE_TOOL_SEARCH=true.
+*
+* Auto-routed runs that die of a quota error before the first tool call are
+* restarted on the next provider in routing order (WORKER-REROUTE ledger line).
+*/
+/** Environment for a run through `provider`. Caller's env minus the Anthropic key. */
+function buildRunEnv(provider, headless, proxyUrl) {
+	const env = { ...process.env };
+	delete env.ANTHROPIC_API_KEY;
+	let token = "local";
+	if (proxyUrl) env.ANTHROPIC_BASE_URL = proxyUrl;
+	else {
+		const keyPath = providerKeyPath(provider);
+		if (keyPath) {
+			try {
+				token = readFileSync(keyPath, "utf8").trim();
+			} catch {
+				throw new Error(`key file not readable: ${keyPath}`);
+			}
+			if (!token) throw new Error(`key file is empty: ${keyPath}`);
+		}
+		env.ANTHROPIC_BASE_URL = provider.baseUrl;
+	}
+	env.ANTHROPIC_AUTH_TOKEN = token;
+	env.ANTHROPIC_DEFAULT_HAIKU_MODEL = provider.models.fast ?? provider.models.default;
+	env.ANTHROPIC_DEFAULT_SONNET_MODEL = provider.models.default;
+	env.ANTHROPIC_DEFAULT_OPUS_MODEL = provider.models.default;
+	for (const [k, v] of Object.entries(provider.env)) env[k] = v;
+	env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1";
+	if (headless) env.PAI_WORKER = "1";
+	else env.ENABLE_TOOL_SEARCH = "true";
+	return env;
+}
+/** The strict empty MCP config for headless workers, written on demand. */
+function ensureNoMcpConfig(logDir) {
+	const path = noMcpConfigPath(logDir);
+	if (!existsSync(path)) {
+		mkdirSync(logDir, { recursive: true });
+		writeFileSync(path, "{ \"mcpServers\": {} }\n", "utf8");
+	}
+	return path;
+}
+/** A stream-json user message for the child's stdin. */
+function stdinUserMessage(text) {
+	return JSON.stringify({
+		type: "user",
+		message: {
+			role: "user",
+			content: text
+		}
+	});
+}
+/**
+* ISO stamp with seconds, attached to every mirrored event (2g): local time
+* with its offset (`2026-09-17T14:19:23+02:00`), so the viewer can render the
+* wall clock the operator lives in. `offMin` is east-positive minutes —
+* injectable so tests do not depend on the machine's zone.
+*/
+function isoStamp(d = /* @__PURE__ */ new Date(), offMin = -d.getTimezoneOffset()) {
+	const t = new Date(d.getTime() + offMin * 6e4);
+	const sign = offMin < 0 ? "-" : "+";
+	const abs = Math.abs(offMin);
+	const hh = String(Math.floor(abs / 60)).padStart(2, "0");
+	const mm = String(abs % 60).padStart(2, "0");
+	return `${t.toISOString().slice(0, 19)}${sign}${hh}:${mm}`;
+}
+/** Context tokens of an assistant/result usage block (input+cache+output). */
+function usageContextTokens(u) {
+	if (!u) return null;
+	const t = (u.input_tokens ?? 0) + (u.cache_read_input_tokens ?? 0) + (u.cache_creation_input_tokens ?? 0) + (u.output_tokens ?? 0);
+	return t > 0 ? t : null;
+}
+/** Context window announced by the init event, when the endpoint sends one. */
+function initContextWindow(e) {
+	if (typeof e.context_window === "number" && e.context_window > 0) return e.context_window;
+	if (e.model_info && typeof e.model_info.context_window === "number" && e.model_info.context_window > 0) return e.model_info.context_window;
+	return null;
+}
+/**
+* Run one worker. Returns the process exit code to pass through.
+* Throws WorkersConfigError-shaped Errors for configuration problems.
+*/
+async function runWorker(opts) {
+	const { raw: _raw, workers: config } = readWorkersSection();
+	if (!config.enabled) throw new Error("workers are off. Turn them on with: pai worker on\n(then the Agent-tool hook stops denying Anthropic subagents only when you do)");
+	const logDir = workersLogDir(config);
+	mkdirSync(logDir, { recursive: true });
+	const target = resolveTarget(config, logDir, {
+		flagProvider: opts.providerFlag,
+		className: opts.className
+	});
+	assertProviderRunnable(target.providerName, target.provider);
+	const parsed = parseRunnerArgs(opts.claudeArgs);
+	const label = opts.label ?? shortText(parsed.prompt ?? "(no prompt)", 70);
+	const model = opts.modelFlag ?? (target.modelAlias === "fast" ? target.provider.models.fast ?? target.provider.models.default : target.provider.models.default);
+	try {
+		if (target.provider.engine === "codex") return await executeCodexRun({
+			config,
+			logDir,
+			target,
+			model,
+			label,
+			parsed,
+			claudeArgs: opts.claudeArgs,
+			noPane: opts.noPane ?? false,
+			cwd: opts.cwd,
+			parent: opts.parent,
+			stage: opts.stage,
+			quiet: opts.quiet,
+			onWorkerStart: opts.onWorkerStart
+		});
+		return await executeRun({
+			config,
+			logDir,
+			target,
+			model,
+			label,
+			parsed,
+			claudeArgs: opts.claudeArgs,
+			noPane: opts.noPane ?? false,
+			mcpFlag: opts.mcpFlag,
+			cwd: opts.cwd,
+			parent: opts.parent,
+			stage: opts.stage,
+			quiet: opts.quiet,
+			onWorkerStart: opts.onWorkerStart,
+			reroutes: opts._reroutes ?? 0
+		});
+	} catch (e) {
+		if (e instanceof Error && e.message.startsWith("key file")) throw new Error(`provider "${target.providerName}": ${e.message}\nPut the token in that file (chmod 600) or point keyFile elsewhere.`);
+		throw e;
+	}
+}
+async function executeRun(a) {
+	const { config, logDir, target, model, label, parsed, noPane } = a;
+	const headless = parsed.headless;
+	let proxyUrl;
+	if (target.provider.protocol === "openai") proxyUrl = `${await ensureProxyRunning(DEFAULT_PROXY_PORT, logDir)}/${target.providerName}`;
+	const env = buildRunEnv(target.provider, headless, proxyUrl);
+	const wid = newWorkerId();
+	const cwd = a.cwd ?? process.cwd();
+	const term = process.env.ITERM_SESSION_ID ?? "";
+	const session = resolveSession(term);
+	const status = {
+		id: wid,
+		pid: process.pid,
+		label,
+		cwd,
+		term,
+		provider: target.providerName,
+		model,
+		state: "running",
+		started: nowStamp(),
+		updated: nowStamp(),
+		turns: 0,
+		tools: 0,
+		last: headless ? "starting" : "interactive",
+		rc: null,
+		secs: null,
+		...session ? { session } : {},
+		contextWindow: providerContextWindow(target.provider),
+		...a.parent ? {
+			parent: a.parent,
+			stage: a.stage
+		} : {}
+	};
+	saveStatus(logDir, status);
+	a.onWorkerStart?.(wid);
+	const ledger = ledgerPath(logDir);
+	appendLedger(ledger, "WORKER-START", {
+		id: wid,
+		provider: target.providerName,
+		mode: headless ? "headless" : "interactive",
+		model,
+		cwd,
+		label
+	});
+	if (headless && !noPane && config.pane.enabled && term && process.env.PAI_WORKER_AUTOPANE !== "0") openPaneForWorker(logDir, config, wid, term).catch(() => {});
+	let mcpArgs = [];
+	if (headless && !parsed.callerMcpConfig) {
+		const wanted = [
+			...a.mcpFlag ? [a.mcpFlag] : [],
+			...parsed.mcp,
+			...target.classMcp ?? []
+		];
+		if (wanted.length) mcpArgs = [
+			"--strict-mcp-config",
+			"--mcp-config",
+			writeMcpConfig(logDir, wid, expandMcpNames(wanted, config))
+		];
+		else mcpArgs = [
+			"--strict-mcp-config",
+			"--mcp-config",
+			ensureNoMcpConfig(logDir)
+		];
+	}
+	const restArgs = headless ? stripPromptValues(parsed.rest) : parsed.rest;
+	const cmd = ["claude"];
+	if (!parsed.callerModel) cmd.push("--model", model);
+	cmd.push(...mcpArgs, ...restArgs);
+	if (headless) {
+		cmd.push("--output-format", "stream-json", "--verbose", "--input-format", "stream-json");
+		if (!parsed.callerSystemPrompt) cmd.push("--append-system-prompt", WORKER_CONTRACT_PROMPT);
+	}
+	const t0 = Date.now();
+	const proc = spawn(cmd[0], cmd.slice(1), {
+		env,
+		cwd,
+		stdio: headless ? [
+			"pipe",
+			"pipe",
+			"inherit"
+		] : "inherit"
+	});
+	let operatorInFlight = 0;
+	let closeTimer = null;
+	const armStdinClose = () => {
+		if (closeTimer) clearTimeout(closeTimer);
+		closeTimer = setTimeout(() => {
+			if (operatorInFlight === 0) try {
+				proc.stdin?.end();
+			} catch {}
+		}, 2e3);
+	};
+	let eventsFd = null;
+	const writeEvent = (obj) => {
+		if (eventsFd === null) return;
+		try {
+			writeSync(eventsFd, JSON.stringify({
+				...obj,
+				_ts: isoStamp()
+			}) + "\n");
+		} catch {}
+	};
+	const operatorServer = headless ? createOperatorServer(logDir, wid, (text) => {
+		operatorInFlight += 1;
+		if (closeTimer) {
+			clearTimeout(closeTimer);
+			closeTimer = null;
+		}
+		writeEvent({
+			type: "operator",
+			text
+		});
+		try {
+			proc.stdin?.write(stdinUserMessage(text) + "\n");
+		} catch {}
+	}) : null;
+	let killed = false;
+	const cleanup = () => {
+		if (closeTimer) clearTimeout(closeTimer);
+		operatorServer?.close();
+	};
+	const onSignal = (sig) => {
+		killed = true;
+		status.state = "killed";
+		status.rc = 143;
+		status.secs = Math.floor((Date.now() - t0) / 1e3);
+		status.last = `killed by signal ${sig}`;
+		saveStatus(logDir, status);
+		appendLedger(ledger, "WORKER-END", {
+			id: wid,
+			provider: target.providerName,
+			mode: "headless",
+			model,
+			rc: 143,
+			secs: status.secs,
+			killed: 1,
+			label
+		});
+		cleanup();
+		try {
+			proc.kill();
+		} catch {}
+		process.exit(143);
+	};
+	process.once("SIGTERM", () => onSignal("SIGTERM"));
+	process.once("SIGINT", () => onSignal("SIGINT"));
+	const ctx = {
+		resultEvent: null,
+		resultReport: null
+	};
+	if (headless) {
+		if (parsed.prompt !== null) try {
+			proc.stdin.write(stdinUserMessage(parsed.prompt) + "\n");
+		} catch {}
+		eventsFd = openSync(eventsPath(logDir, wid), "a");
+		createInterface({ input: proc.stdout }).on("line", (line) => {
+			if (parsed.outputFormat === "stream-json") process.stdout.write(line + "\n");
+			if (!line.startsWith("{")) return;
+			let e;
+			try {
+				e = JSON.parse(line);
+			} catch {
+				return;
+			}
+			writeEvent(e);
+			if (e.type === "system" && e.subtype === "init") {
+				if (e.session_id) status.claudeSession = e.session_id;
+				const cw = initContextWindow(e);
+				if (cw) status.contextWindow = cw;
+				saveStatus(logDir, status);
+			} else if (e.type === "assistant") {
+				status.turns += 1;
+				const tokens = usageContextTokens(e.message?.usage);
+				if (tokens) status.contextTokens = tokens;
+				for (const block of e.message?.content ?? []) if (block.type === "tool_use") {
+					status.tools += 1;
+					status.last = describeTool(block.name ?? "?", block.input);
+				} else if (block.type === "text" && (block.text ?? "").trim()) status.last = "says: " + shortText(block.text, 70);
+				saveStatus(logDir, status);
+			} else if (e.type === "result") {
+				const tokens = usageContextTokens(e.usage);
+				if (tokens) status.contextTokens = tokens;
+				const report = parseWorkerReport(e.result ?? "");
+				if (report?.notes) status.last = shortText(report.notes, 90);
+				else if (e.result) status.last = shortText(e.result, 90);
+				saveStatus(logDir, status);
+				operatorInFlight = 0;
+				armStdinClose();
+				ctx.resultEvent = e;
+				ctx.resultReport = report;
+			}
+		});
+	}
+	const rc = await new Promise((resolve, reject) => {
+		proc.on("error", reject);
+		proc.on("close", (code) => resolve(code ?? (killed ? 143 : 1)));
+	});
+	if (eventsFd !== null) closeSync(eventsFd);
+	cleanup();
+	const secs = Math.floor((Date.now() - t0) / 1e3);
+	const resultEvent = ctx.resultEvent;
+	const ok = rc === 0 && resultEvent !== null && !resultEvent.is_error;
+	status.state = ok ? "done" : "failed";
+	status.rc = rc;
+	status.secs = secs;
+	if (resultEvent) status.last = shortText(resultEvent.result ?? "", 90);
+	if (ctx.resultReport?.notes) status.last = shortText(ctx.resultReport.notes, 90);
+	saveStatus(logDir, status);
+	appendLedger(ledger, "WORKER-END", {
+		id: wid,
+		provider: target.providerName,
+		mode: headless ? "headless" : "interactive",
+		model,
+		rc,
+		secs,
+		turns: status.turns,
+		tools: status.tools,
+		label
+	});
+	if (headless && !a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, ctx.resultReport);
+	const resultText = resultEvent?.result ?? "";
+	if (!ok && headless && a.target.via === "auto" && config.routing.retryOnQuota && status.turns <= 1 && status.tools === 0 && isQuotaFailure(resultText)) {
+		setCooldown(logDir, target.providerName, config.routing.cooldownMinutes);
+		const next = nextAutoProvider(config, logDir, target.providerName);
+		if (next && a.reroutes < config.routing.order.length) {
+			appendLedger(ledger, "WORKER-REROUTE", {
+				from: target.providerName,
+				to: next,
+				reason: "quota"
+			});
+			return runWorker({
+				providerFlag: next,
+				label,
+				noPane: a.noPane,
+				mcpFlag: a.mcpFlag,
+				cwd: a.cwd,
+				parent: a.parent,
+				stage: a.stage,
+				claudeArgs: a.claudeArgs,
+				onWorkerStart: a.onWorkerStart,
+				_reroutes: a.reroutes + 1
+			});
+		}
+	}
+	return rc !== 0 ? rc : ok ? 0 : 1;
+}
+async function executeCodexRun(a) {
+	const { config, logDir, target, model, label, parsed, noPane } = a;
+	if (!parsed.headless || parsed.prompt === null) throw new Error(`provider "${target.providerName}" (engine codex) supports headless runs only: pass the task with -p '<prompt>'`);
+	const env = buildCodexEnv(target.provider);
+	const wid = newWorkerId();
+	const cwd = a.cwd ?? process.cwd();
+	const term = process.env.ITERM_SESSION_ID ?? "";
+	const session = resolveSession(term);
+	const status = {
+		id: wid,
+		pid: process.pid,
+		label,
+		cwd,
+		term,
+		provider: target.providerName,
+		model,
+		state: "running",
+		started: nowStamp(),
+		updated: nowStamp(),
+		turns: 0,
+		tools: 0,
+		last: "starting",
+		rc: null,
+		secs: null,
+		...session ? { session } : {},
+		contextWindow: providerContextWindow(target.provider),
+		...a.parent ? {
+			parent: a.parent,
+			stage: a.stage
+		} : {}
+	};
+	saveStatus(logDir, status);
+	a.onWorkerStart?.(wid);
+	const ledger = ledgerPath(logDir);
+	appendLedger(ledger, "WORKER-START", {
+		id: wid,
+		provider: target.providerName,
+		mode: "headless",
+		engine: "codex",
+		model,
+		cwd,
+		label
+	});
+	const dropped = codexDroppedFlags(a.claudeArgs);
+	if (dropped.length) appendLedger(ledger, "WORKER-NOTE", {
+		id: wid,
+		note: `dropped for codex: ${dropped.join(", ")}`
+	});
+	if (!noPane && config.pane.enabled && term && process.env.PAI_WORKER_AUTOPANE !== "0") openPaneForWorker(logDir, config, wid, term).catch(() => {});
+	const t0 = Date.now();
+	const proc = spawn("codex", buildCodexArgs(parsed.prompt, parsed.callerModel ? void 0 : model), {
+		env,
+		cwd,
+		stdio: [
+			"ignore",
+			"pipe",
+			"inherit"
+		]
+	});
+	const fold = emptyCodexResult();
+	const eventsFd = openSync(eventsPath(logDir, wid), "a");
+	const writeEvent = (obj) => {
+		try {
+			writeSync(eventsFd, JSON.stringify({
+				...obj,
+				_ts: isoStamp()
+			}) + "\n");
+		} catch {}
+	};
+	writeEvent({
+		type: "system",
+		subtype: "init",
+		model,
+		cwd
+	});
+	let killed = false;
+	process.once("SIGTERM", onCodexSignal("SIGTERM"));
+	process.once("SIGINT", onCodexSignal("SIGINT"));
+	function onCodexSignal(sig) {
+		return () => {
+			killed = true;
+			status.state = "killed";
+			status.rc = 143;
+			status.secs = Math.floor((Date.now() - t0) / 1e3);
+			status.last = `killed by signal ${sig}`;
+			saveStatus(logDir, status);
+			try {
+				proc.kill();
+			} catch {}
+			process.exit(143);
+		};
+	}
+	createInterface({ input: proc.stdout }).on("line", (line) => {
+		if (parsed.outputFormat === "stream-json") process.stdout.write(line + "\n");
+		const parsedLine = parseCodexLine(line);
+		if (parsedLine === null) return;
+		foldCodexLine(parsedLine, fold);
+		if (fold.threadId && !status.claudeSession) status.claudeSession = fold.threadId;
+		status.turns = fold.turns;
+		status.tools = fold.tools;
+		if (fold.last) status.last = shortText(fold.last, 90);
+		if (fold.contextTokens) status.contextTokens = fold.contextTokens;
+		saveStatus(logDir, status);
+		for (const ev of fold.events.splice(0)) writeEvent(ev);
+	});
+	const rc = await new Promise((resolve, reject) => {
+		proc.on("error", reject);
+		proc.on("close", (code) => resolve(code ?? (killed ? 143 : 1)));
+	});
+	closeSync(eventsFd);
+	const secs = Math.floor((Date.now() - t0) / 1e3);
+	const finalText = fold.finalText ?? "";
+	const report = parseWorkerReport(finalText);
+	const resultEvent = {
+		type: "result",
+		result: finalText,
+		is_error: fold.isError || rc !== 0,
+		num_turns: fold.turns,
+		duration_ms: secs * 1e3
+	};
+	writeEvent(resultEvent);
+	const ok = rc === 0 && !fold.isError;
+	status.state = ok ? "done" : "failed";
+	status.rc = rc;
+	status.secs = secs;
+	status.last = shortText(report?.notes ?? finalText, 90) || (ok ? "done" : "failed");
+	saveStatus(logDir, status);
+	appendLedger(ledger, "WORKER-END", {
+		id: wid,
+		provider: target.providerName,
+		mode: "headless",
+		engine: "codex",
+		model,
+		rc,
+		secs,
+		turns: status.turns,
+		tools: status.tools,
+		label
+	});
+	if (!a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, report);
+	return rc !== 0 ? rc : ok ? 0 : 1;
+}
+function printResult(fmt, resultEvent, rc, logDir, wid, report) {
+	if (fmt === "stream-json") return;
+	if (fmt === "json") {
+		const payload = report ? {
+			...resultEvent ?? {
+				is_error: true,
+				result: "no result event",
+				rc
+			},
+			report
+		} : resultEvent ?? {
+			is_error: true,
+			result: "no result event",
+			rc
+		};
+		console.log(JSON.stringify(payload));
+		return;
+	}
+	if (resultEvent) console.log(resultEvent.result ?? "");
+	else process.stderr.write(`pai worker: run produced no result (rc=${rc}); see ${eventsPath(logDir, wid)}\n`);
+}
+/**
+* Run a one-word pong probe through the provider (headless, no pane) and
+* report provider, model, latency and the reply. ok is false unless the reply
+* was exactly "pong" (case-insensitive, whitespace-trimmed).
+*/
+async function testProvider(providerName, provider, logDir, timeoutMs = 9e4) {
+	assertProviderRunnable(providerName, provider);
+	const model = provider.models.default;
+	if (provider.engine === "codex") {
+		const skipped = codexInstalled() ? void 0 : "codex not installed";
+		return {
+			provider: providerName,
+			model,
+			latencyMs: 0,
+			result: skipped ?? "codex engine: pong probe through codex exec not implemented",
+			ok: false,
+			...skipped ? { skipped } : {}
+		};
+	}
+	let proxyUrl;
+	if (provider.protocol === "openai") proxyUrl = `${await ensureProxyRunning(DEFAULT_PROXY_PORT, logDir)}/${providerName}`;
+	const env = buildRunEnv(provider, true, proxyUrl);
+	const t0 = Date.now();
+	const proc = spawn("claude", [
+		"--model",
+		model,
+		"--strict-mcp-config",
+		"--mcp-config",
+		ensureNoMcpConfig(logDir),
+		"-p",
+		"Reply with exactly one word: pong",
+		"--output-format",
+		"json"
+	], {
+		env,
+		stdio: [
+			"ignore",
+			"pipe",
+			"inherit"
+		]
+	});
+	const timer = setTimeout(() => {
+		try {
+			proc.kill("SIGKILL");
+		} catch {}
+	}, timeoutMs);
+	let out = "";
+	proc.stdout.on("data", (chunk) => {
+		out += chunk.toString("utf8");
+	});
+	const rc = await new Promise((resolve) => {
+		proc.on("error", () => resolve(1));
+		proc.on("close", (code) => resolve(code ?? 1));
+	});
+	clearTimeout(timer);
+	return {
+		provider: providerName,
+		model,
+		latencyMs: Date.now() - t0,
+		result: resultFromOutput(out),
+		ok: rc === 0 && resultFromOutput(out).trim().toLowerCase() === "pong"
+	};
+}
+/**
+* Pull the reply out of claude's stdout. With --verbose, `--output-format
+* json` dumps a JSON array of stream events and the reply sits in the last
+* "result" event; without it, stdout is the single result object. Accept
+* either shape, plus a bare-text fallback for error output.
+*/
+function resultFromOutput(out) {
+	const trimmed = out.trim();
+	if (!trimmed) return "";
+	const parse = (s) => {
+		try {
+			return JSON.parse(s);
+		} catch {
+			return;
+		}
+	};
+	const fromValue = (v) => {
+		if (Array.isArray(v)) {
+			for (let i = v.length - 1; i >= 0; i--) {
+				const r = fromValue(v[i]);
+				if (r !== null) return r;
+			}
+			return null;
+		}
+		if (typeof v === "object" && v !== null) {
+			const o = v;
+			if (o.type === "result" && typeof o.result === "string") return o.result;
+		}
+		return null;
+	};
+	const direct = fromValue(parse(trimmed));
+	if (direct !== null) return direct;
+	const lines = trimmed.split("\n");
+	for (let i = lines.length - 1; i >= 0; i--) {
+		const r = fromValue(parse(lines[i]));
+		if (r !== null) return r;
+	}
+	return trimmed.slice(0, 200);
+}
+
+//#endregion
+//#region src/workers/chain.ts
+/**
+* chain.ts — draft-then-implement chains: `--chain draft,implement[,review]`.
+*
+* The chain runs each stage as its own worker (own id, own pane, `parent` set
+* to the chain id), so `ps` shows the chain as a tree and every stage can be
+* followed, replayed and said to like any other worker:
+*
+*   - draft    turns the operator's brief into a full spec file under
+*              <logDir>/specs/<chain id>.md (goal, constraints, files likely
+*              touched, acceptance checks, verification commands);
+*   - any other stage (implement, plan, …) runs with that spec as its prompt
+*              and the original brief attached;
+*   - review   reads the spec and the working-tree diff and produces the
+*              structured report.
+*
+* A stage that fails (or a draft that produces no spec file) stops the chain;
+* the caller then writes the spec itself and re-runs without the draft stage.
+*/
+/** Where a chain's spec file lives: <logDir>/specs/<chain id>.md. */
+function specPathFor(logDir, chainId) {
+	return join(logDir, "specs", `${chainId}.md`);
+}
+/**
+* Replace the caller's -p value with `prompt`, dropping every existing
+* -p/--print pair first (two -p flags on one claude command line are an error,
+* so the chain must never leave the brief in place when swapping prompts).
+*/
+function swapPromptArg(claudeArgs, prompt) {
+	const out = [];
+	for (let i = 0; i < claudeArgs.length; i++) {
+		const a = claudeArgs[i];
+		if (a === "-p" || a === "--print") {
+			if (i + 1 < claudeArgs.length && !claudeArgs[i + 1].startsWith("-")) i += 1;
+			continue;
+		}
+		out.push(a);
+	}
+	out.push("-p", prompt);
+	return out;
+}
+function draftPrompt(brief, specPath) {
+	return [
+		"You are the DRAFT stage of a worker chain. Turn the operator's brief below into a full implementation spec and write it to",
+		specPath,
+		"with the Write tool.",
+		"",
+		"Use exactly these five sections as Markdown headings:",
+		"# Goal",
+		"# Constraints",
+		"# Files likely touched",
+		"# Acceptance checks",
+		"# Verification commands",
+		"",
+		"Read the repository first (Glob/Grep/Read) so the spec names real files and real commands. Do not implement anything.",
+		"",
+		"## Operator brief",
+		"",
+		brief
+	].join("\n");
+}
+function implementPrompt(brief, specPath, spec) {
+	return [
+		...spec ? [
+			"You are the IMPLEMENT stage of a worker chain. The draft stage wrote the spec below (also at " + specPath + "). Implement it exactly, then run the spec's verification commands before finishing.",
+			"",
+			"## Spec",
+			"",
+			spec
+		] : ["Implement the operator's brief below."],
+		"",
+		"## Operator brief",
+		"",
+		brief
+	].join("\n");
+}
+function reviewPrompt(brief, specPath, spec) {
+	return [
+		"You are the REVIEW stage of a worker chain. The implement stage just ran. Read the repository's diff (run `git diff` and `git status`; use `git diff --stat` for the overview) and check it against the spec's acceptance checks and verification commands — run the checks when they are cheap. Do not fix anything you find; report it.",
+		...spec ? [
+			"",
+			"## Spec (also at " + specPath + ")",
+			"",
+			spec
+		] : [],
+		"",
+		"## Operator brief",
+		"",
+		brief
+	].join("\n");
+}
+/** Run a chain of stages; returns the exit code of the first failed stage, 0 when all pass. */
+async function runChain(opts, deps = {}) {
+	const stages = opts.stages.map((s) => s.trim()).filter(Boolean);
+	if (!stages.length) throw new Error("--chain needs at least one class, e.g. --chain draft,implement");
+	const runStage = deps.runStage ?? runWorker;
+	const logDir = deps.logDir ?? workersLogDir(readWorkersSection().workers);
+	const chainId = newWorkerId();
+	const specPath = specPathFor(logDir, chainId);
+	mkdirSync(join(logDir, "specs"), { recursive: true });
+	const baseLabel = opts.label ?? shortText(opts.brief, 40);
+	appendLedger(ledgerPath(logDir), "WORKER-CHAIN", {
+		chain: chainId,
+		stages: stages.join(","),
+		label: baseLabel
+	});
+	opts.onChainStart?.(chainId);
+	let spec = null;
+	for (let i = 0; i < stages.length; i++) {
+		const stage = stages[i];
+		if (stage === "draft") spec = null;
+		else if (spec === null && existsSync(specPath)) spec = readFileSync(specPath, "utf8");
+		const prompt = stage === "draft" ? draftPrompt(opts.brief, specPath) : stage === "review" ? reviewPrompt(opts.brief, spec ? specPath : null, spec) : implementPrompt(opts.brief, spec ? specPath : null, spec);
+		process.stderr.write(`chain ${chainId}: stage ${i + 1}/${stages.length} ${stage} (spec: ${specPath})\n`);
+		const rc = await runStage({
+			className: opts.className ?? stage,
+			providerFlag: opts.providerFlag,
+			modelFlag: opts.modelFlag,
+			label: `${baseLabel} · ${stage}`,
+			noPane: opts.noPane,
+			mcpFlag: opts.mcpFlag,
+			claudeArgs: swapPromptArg(opts.claudeArgs, prompt),
+			cwd: opts.cwd,
+			parent: chainId,
+			stage,
+			quiet: opts.quiet
+		});
+		if (stage === "draft") {
+			if (!existsSync(specPath)) {
+				process.stderr.write(`chain ${chainId}: draft stage produced no spec at ${specPath} — stopping. Write the spec yourself and re-run without the draft stage.\n`);
+				appendLedger(ledgerPath(logDir), "WORKER-CHAIN-END", {
+					chain: chainId,
+					rc: rc !== 0 ? rc : 1,
+					failed: "draft"
+				});
+				return rc !== 0 ? rc : 1;
+			}
+			spec = readFileSync(specPath, "utf8");
+		}
+		if (rc !== 0) {
+			appendLedger(ledgerPath(logDir), "WORKER-CHAIN-END", {
+				chain: chainId,
+				rc,
+				failed: stage
+			});
+			return rc;
+		}
+	}
+	appendLedger(ledgerPath(logDir), "WORKER-CHAIN-END", {
+		chain: chainId,
+		rc: 0
+	});
+	return 0;
+}
+
+//#endregion
+//#region src/workers/chatui.ts
+/**
+* chatui.ts — the chat line of a `follow` pane.
+*
+* A follow pane with a target behaves like a small chat, Claude Code style:
+* the transcript lives in a terminal scroll region that ends two rows above
+* the pane's bottom; the last two rows are fixed — the prompt row (`› `,
+* readline line editing) and the ticker row. A transcript line is inserted
+* above the fixed rows with a save-cursor / scroll-region / restore-cursor
+* write that never touches them; the scroll region makes the transcript roll
+* inside itself. Everything here builds strings (or parses one line), so the
+* tests assert exact byte sequences — no terminal needed.
+*/
+/** The prompt marker of the chat row. */
+const CHAT_PROMPT = "› ";
+/** Dim hint shown once behind the cursor until the first line is typed. */
+const CHAT_HINT = "type here and press Enter · /help for commands";
+/** What `/help` prints (one command per line, dim). */
+const CHAT_HELP = [
+	"/quit            close this pane",
+	"/resume <text>   continue the finished worker with <text>",
+	"/status          one-line worker status",
+	"anything else is sent to the worker — said while it runs, resumed after"
+];
+/** Index just past the escape starting at `i` (CSI, OSC or a two-char one). */
+function endOfEscape(s, i) {
+	const n = s[i + 1];
+	if (n === "[") {
+		let j = i + 2;
+		while (j < s.length && !(s[j] >= "@" && s[j] <= "~")) j++;
+		return Math.min(s.length, j + 1);
+	}
+	if (n === "]") {
+		let j = i + 2;
+		while (j < s.length && s[j] !== "\x07") j++;
+		return Math.min(s.length, j + 1);
+	}
+	return i + 2;
+}
+/** Printable columns of `s` — ANSI escape sequences measure zero. */
+function visibleWidth(s) {
+	let w = 0;
+	let i = 0;
+	while (i < s.length) {
+		if (s[i] === "\x1B") {
+			i = endOfEscape(s, i);
+			continue;
+		}
+		w += 1;
+		i += 1;
+	}
+	return w;
+}
+/**
+* The SGR sequences in effect at `upto`: everything opened since the last
+* reset, in order. Anything that is not an SGR escape is ignored (it does
+* not change colour state).
+*/
+function sgrStateAt(text, upto) {
+	const open = [];
+	let i = 0;
+	while (i < Math.min(upto, text.length)) {
+		if (text[i] === "\x1B") {
+			const end = endOfEscape(text, i);
+			const esc = text.slice(i, end);
+			if (/^\x1b\[[0-9;]*m$/.test(esc)) {
+				const params = esc.slice(2, -1);
+				if (params === "" || params.split(";").includes("0")) open.length = 0;
+				if (!(params === "" || params === "0")) open.push(esc);
+			}
+			i = end;
+			continue;
+		}
+		i += 1;
+	}
+	return open;
+}
+/**
+* Wrap one rendered row to `width` printable columns. Breaks on whitespace
+* where possible, hard-wraps words longer than the width, never splits an
+* ANSI escape, and re-opens the colours it wraps inside of, so a diff row
+* keeps its `-`/`+` colour on every continuation row.
+*/
+function wrapText(text, width) {
+	if (width < 1 || visibleWidth(text) <= width) return [text];
+	const chars = [];
+	for (let i = 0; i < text.length; i++) {
+		if (text[i] === "\x1B") {
+			i = endOfEscape(text, i) - 1;
+			continue;
+		}
+		chars.push(i);
+	}
+	const words = [];
+	{
+		let s = -1;
+		let w = 0;
+		for (let k = 0; k <= chars.length; k++) if ((k === chars.length ? " " : text[chars[k]]) === " ") {
+			if (s >= 0) {
+				words.push({
+					s,
+					e: k - 1,
+					w
+				});
+				s = -1;
+				w = 0;
+			}
+		} else {
+			if (s < 0) s = k;
+			w++;
+		}
+	}
+	if (words.length && words[0].s > 0) words[0] = {
+		s: 0,
+		e: words[0].e,
+		w: words[0].w + words[0].s
+	};
+	const spans = [];
+	let cs = -1;
+	let ce = -1;
+	for (const word of words) {
+		if (word.w > width) {
+			const room = cs < 0 ? 0 : width - (ce - cs + 1);
+			const take = room > 0 ? ce + room - word.s + 1 : 0;
+			if (take > 0) spans.push([cs, ce + room]);
+			else if (cs >= 0) spans.push([cs, ce]);
+			let pos = word.s + Math.max(0, take);
+			let remaining = word.w - Math.max(0, take);
+			while (remaining > width) {
+				spans.push([pos, pos + width - 1]);
+				pos += width;
+				remaining -= width;
+			}
+			cs = pos;
+			ce = pos + remaining - 1;
+			continue;
+		}
+		if (cs < 0) {
+			cs = word.s;
+			ce = word.e;
+			continue;
+		}
+		if (word.e - cs + 1 <= width) {
+			ce = word.e;
+			continue;
+		}
+		spans.push([cs, ce]);
+		cs = word.s;
+		ce = word.e;
+	}
+	if (cs >= 0) spans.push([cs, ce]);
+	const out = [];
+	for (const [a, b] of spans) {
+		const from = chars[a];
+		let end = chars[b] + 1;
+		while (end < text.length && text[end] === "\x1B") end = endOfEscape(text, end);
+		let piece = text.slice(from, end);
+		const reopen = sgrStateAt(text, from);
+		if (reopen.length) piece = reopen.join("") + piece;
+		if (sgrStateAt(text, end).length) piece += "\x1B[0m";
+		out.push(piece);
+	}
+	return out.length ? out : [""];
+}
+/** Restrict scrolling to the transcript region (rows 1 … rows-2). */
+function chatScrollRegion(rows) {
+	return `\x1b[1;${Math.max(1, rows - 2)}r`;
+}
+/**
+* Enter the chat layout: clear the pane, set the scroll region, park the
+* cursor at column 1 of the prompt row (rows-1). The ticker owns row `rows`.
+*/
+function chatEnter(rows) {
+	return "\x1B[2J" + chatScrollRegion(rows) + `\x1b[${Math.max(1, rows - 1)};1H`;
+}
+/** Leave it: reset the scroll region, show the cursor, drop to the last row. */
+function chatLeave(rows) {
+	return `[?25h\x1b[${Math.max(1, rows)};1H`;
+}
+/** Redraw the ticker on its own row without moving the user's cursor. */
+function chatTickerRow(text, rows) {
+	return `7\x1b[${Math.max(1, rows)};1H\x1b[K` + text + "\x1B8";
+}
+/** Move to column 1 of the prompt row and draw prompt (and hint). */
+function chatPromptRow(rows, prompt = CHAT_PROMPT, hint) {
+	return `\x1b[${Math.max(1, rows - 1)};1H` + prompt + (hint ?? "");
+}
+/**
+* Insert one transcript row above the fixed prompt/ticker rows. While the
+* region is still filling (`fill < regionRows`) the row is placed top-down;
+* once full, the cursor moves to the region's bottom row and a newline
+* scrolls the region up by one — the two fixed rows are never touched. The
+* user's cursor is saved before and restored after, so readline keeps its
+* position on the prompt row.
+*/
+function chatInsertLine(line, fill, regionRows) {
+	return {
+		seq: "\x1B7" + (fill < regionRows ? `\x1b[${fill + 1};1H${line}\x1b[K` : `\x1b[${regionRows};1H\n${line}\x1b[K`) + "\x1B8",
+		fill: Math.min(fill + 1, regionRows)
+	};
+}
+/**
+* One submitted prompt line → what to do with it. `/help`, `/quit`,
+* `/status` and `/resume <text>` are commands (a bare `/resume` comes back
+* with empty text so the caller can print its usage); anything else,
+* including any other `/word`, is a message for the worker.
+*/
+function parseChatLine(raw) {
+	const text = raw.trim();
+	if (text === "/help") return { kind: "help" };
+	if (text === "/quit") return { kind: "quit" };
+	if (text === "/status") return { kind: "status" };
+	if (text.startsWith("/resume")) return {
+		kind: "resume",
+		text: text.slice(7).trim()
+	};
+	return {
+		kind: "message",
+		text
+	};
+}
+/**
+* The auto-exit countdown must not fire while the prompt holds unsent text:
+* true while it does. null/undefined (no prompt wired) never holds.
+*/
+function holdAutoExit(promptText) {
+	return typeof promptText === "string" && promptText.trim() !== "";
+}
+
+//#endregion
+//#region src/workers/render.ts
+/**
+* render.ts — turn worker events into the lines a human reads.
+*
+* Ports the glm-ps transcript rendering: the gutter rules (dim `>` for reads
+* and searches, `$` for shell, magenta `~` + red/green diff for edits, green
+* `+` for writes), Read-result trimming (first 3 lines then a count), and the
+* result footer. Colors are applied only when the output is a TTY, so MCP
+* tool output stays plain text.
+*/
+const CODES = {
+	dim: "2",
+	bold: "1",
+	red: "31",
+	green: "32",
+	yellow: "33",
+	blue: "34",
+	mag: "35",
+	cyan: "36"
+};
+function makeColor(enabled) {
+	return (name, s) => enabled ? `\x1b[${CODES[name]}m${s}\x1b[0m` : s;
+}
+/** Path relative to cwd when it lies inside it, otherwise unchanged. */
+function relPath(path, cwd) {
+	if (!path || !cwd) return path;
+	let r;
+	try {
+		r = relative(cwd, path);
+	} catch {
+		return path;
+	}
+	return r.startsWith("..") ? path : r;
+}
+/** Minimal line diff for Edit previews: common prefix/suffix, one hunk. */
+function unifiedDiffLines(oldStr, newStr) {
+	const oldL = oldStr.split("\n");
+	const newL = newStr.split("\n");
+	let start = 0;
+	while (start < oldL.length && start < newL.length && oldL[start] === newL[start]) start++;
+	let endOld = oldL.length;
+	let endNew = newL.length;
+	while (endOld > start && endNew > start && oldL[endOld - 1] === newL[endNew - 1]) {
+		endOld--;
+		endNew--;
+	}
+	const out = [];
+	for (let i = start; i < endOld; i++) out.push("-" + oldL[i]);
+	for (let i = start; i < endNew; i++) out.push("+" + newL[i]);
+	return out;
+}
+/**
+* `HH:MM:SS` at an offset east of UTC in minutes (Date.getTimezoneOffset()
+* negated), from any ISO stamp the runner wrote — `Z` or a local `+HH:MM`.
+* null when the stamp cannot be parsed. Offsets make this testable without
+* depending on the machine's zone; the default is this machine's.
+*/
+function clockOf(ts, offMin = -(/* @__PURE__ */ new Date()).getTimezoneOffset()) {
+	const t = Date.parse(ts);
+	if (Number.isNaN(t)) return null;
+	return new Date(t + offMin * 6e4).toISOString().slice(11, 19);
+}
+/** `YYYY-MM-DD` at the same offset — the local day a date separator shows. */
+function dayOf(ts, offMin = -(/* @__PURE__ */ new Date()).getTimezoneOffset()) {
+	const t = Date.parse(ts);
+	if (Number.isNaN(t)) return null;
+	return new Date(t + offMin * 6e4).toISOString().slice(0, 10);
+}
+/**
+* The transcript gutter (2g): `HH:MM:SS │ ` from the event's `_ts`, dim, with
+* the worker tag in front when several run at once. Continuation lines get
+* blanks of the same width so wrapped text stays aligned; when the viewer
+* wraps lines itself, continuation rows carry the `│` bar instead (barCont)
+* so the bar runs unbroken down the pane. null when the event carries no
+* stamp (logs from before 2g render with the plain prefix). The time is the
+* stamp's wall clock at `offMin` — the default renders local time, whatever
+* zone stamped the log (old logs were stamped in UTC).
+*/
+function gutterFor(c, e, tag, offMin) {
+	if (!e._ts) return null;
+	const time = clockOf(e._ts, offMin) ?? (e._ts.length >= 19 ? e._ts.slice(11, 19) : e._ts);
+	const head = tag ? `${tag} ${time}` : time;
+	const width = head.length + 3;
+	return {
+		first: c("dim", `${head} │ `),
+		cont: " ".repeat(width),
+		barCont: c("dim", `${" ".repeat(head.length)} │ `),
+		width
+	};
+}
+/**
+* The ticker's tool part: `$ <command>` for Bash (first 60 chars), the file
+* basename for the file tools, the bare name for everything else.
+*/
+function tickerTool(name, inp) {
+	const i = typeof inp === "object" && inp !== null ? inp : {};
+	const get = (k) => typeof i[k] === "string" ? i[k] : "";
+	if (name === "Bash") return `$ ${shortText(get("command").replace(/\s+/g, " ").trim(), 60)}`;
+	if (name === "Read" || name === "Edit" || name === "Write" || name === "MultiEdit") return (get("file_path").split("/").pop() ?? "") || name;
+	return name;
+}
+/**
+* The liveness line: `⋯ 12s · run tests before the fix · $ bun run test` —
+* seconds since the last *rendered* event, the worker's last stated intent
+* (its last assistant text, ≤60 chars) and the tool it is currently running.
+* Parts that are empty drop out.
+*/
+function tickerText(secs, intent, tool, meter) {
+	const head = `⋯ ${secs}s`;
+	const tail = [intent, tool].map((p) => p.trim()).filter(Boolean).join(" · ");
+	const line = tail ? `${head} · ${tail}` : head;
+	return meter ? `${line} · ${meter}` : line;
+}
+/**
+* One blank line between turns, none inside one: a blank goes before an
+* assistant message that follows a tool result or an operator message (the
+* worker starting to speak again after its tools were answered / it was told
+* something), not between the text, tool calls and results of one turn.
+*/
+function blankBetween(prev, e) {
+	if (!prev) return false;
+	if (e.type !== "assistant") return false;
+	return prev.type === "user" || prev.type === "operator";
+}
+/** The worker's last stated intent: the first line of its last text, ≤60. */
+function intentOf(text) {
+	return shortText((text.trim().split("\n").find((l) => l.trim()) ?? "").trim().replace(/\s+/g, " "), 60);
+}
+/** Compact token count: 84k, 200k, 900. */
+function fmtK(n) {
+	return n >= 1e3 ? `${Math.round(n / 1e3)}k` : String(n);
+}
+/**
+* The context meter `ctx 84k/200k (42%)`, yellow from 70 %, red from 85 %.
+* null when the numbers are missing or below `minPct` (the table only shows
+* it past 60; the pane liveness line always shows it).
+*/
+function contextMeter(c, s, minPct = 0) {
+	const pct = contextPercent(s);
+	if (pct === null || pct <= minPct) return null;
+	const label = `ctx ${fmtK(s.contextTokens ?? 0)}/${fmtK(s.contextWindow ?? 0)} (${pct}%)`;
+	if (pct > 85) return c("red", label);
+	if (pct > 70) return c("yellow", label);
+	return label;
+}
+function renderToolUse(c, prefix, name, inp, cwd) {
+	const i = typeof inp === "object" && inp !== null ? inp : {};
+	const get = (k) => typeof i[k] === "string" ? i[k] : "";
+	if (name === "Read") return [`${prefix}${c("dim", ">")} Reading ${relPath(get("file_path"), cwd)}`];
+	if (name === "Grep" || name === "Glob") return [`${prefix}${c("dim", ">")} Searching ${c("cyan", get("pattern"))} in ${relPath(get("path") || ".", cwd)}`];
+	if (name === "Bash") return [`${prefix}${c("dim", "$")} ${shortText(get("command"), 160)}`];
+	if (name === "Edit") {
+		const out = [`${prefix}${c("mag", "~")} Editing ${relPath(get("file_path"), cwd)}`];
+		for (const line of unifiedDiffLines(get("old_string"), get("new_string"))) if (line.startsWith("-")) out.push(`${prefix}    ${c("red", line)}`);
+		else if (line.startsWith("+")) out.push(`${prefix}    ${c("green", line)}`);
+		else out.push(`${prefix}    ${c("dim", line)}`);
+		return out;
+	}
+	if (name === "Write") {
+		const n = get("content").split("\n").length;
+		return [`${prefix}${c("green", "+")} Writing ${relPath(get("file_path"), cwd)} (${n} lines)`];
+	}
+	if (name === "WebSearch" || name === "WebFetch") return [`${prefix}${c("dim", ">")} ${name} ${shortText(get("query") || get("url"), 100)}`];
+	return [`${prefix}${c("dim", ">")} ${name} ${shortText(JSON.stringify(i), 120)}`];
+}
+/** Render one stream-json event; `tools` maps tool_use_id → tool name. */
+function renderEvent(c, prefix, e, cwd, tools, gutter) {
+	const out = [];
+	if (e.type === "system" && e.subtype === "init") out.push(`${prefix}${c("dim", `worker started · model ${e.model ?? "?"} · cwd ${basename(e.cwd || cwd || "")}`)}`);
+	else if (e.type === "operator") for (const ln of String(e.text ?? "").split("\n")) out.push(`${prefix}${c("cyan", "» " + ln)}`);
+	else if (e.type === "assistant") {
+		for (const b of e.message?.content ?? []) if (b.type === "text" && (b.text ?? "").trim()) for (const ln of (b.text ?? "").trim().split("\n")) out.push(`${prefix}${ln}`);
+		else if (b.type === "tool_use") out.push(...renderToolUse(c, prefix, b.name ?? "?", b.input, cwd));
+	} else if (e.type === "user") for (const b of e.message?.content ?? []) {
+		if (b.type !== "tool_result") continue;
+		let content = b.content ?? "";
+		if (Array.isArray(content)) content = content.map((x) => typeof x === "object" && x !== null && "text" in x ? String(x.text ?? "") : "").join("\n");
+		const text = String(content);
+		const isError = b.is_error === true;
+		if (!isError && tools[b.tool_use_id ?? ""] === "Read") {
+			const lines = text.split("\n");
+			for (const ln of lines.slice(0, 3)) out.push(`${prefix}${c("dim", ln)}`);
+			if (lines.length > 3) out.push(`${prefix}${c("dim", `    … ${lines.length} lines`)}`);
+		} else if (isError) out.push(`${prefix}    ${c("red", "! " + shortText(text, 200))}`);
+		else if (text.trim()) out.push(`${prefix}    ${c("dim", shortText(text, 120))}`);
+	}
+	else if (e.type === "result") {
+		const mark = !e.is_error ? c("green", "✓ done") : c("red", "✗ failed");
+		out.push(`${prefix}${mark} · ${e.num_turns ?? "?"} turns · ${Math.floor((e.duration_ms ?? 0) / 1e3)}s`);
+		const report = parseWorkerReport(String(e.result ?? ""));
+		if (report) out.push(...renderReport(c, prefix, report, cwd));
+		else for (const ln of String(e.result ?? "").trim().split("\n")) out.push(`${prefix}  ${ln}`);
+	}
+	if (!gutter) return out;
+	return out.map((ln, i) => (i === 0 ? gutter.first : gutter.cont) + ln);
+}
+/** Transcript header: id, provider, label, session name, project dir. */
+function headerLine(c, s) {
+	const bits = [s.provider ? `[${s.provider}]` : "", sessionTag(s)].filter(Boolean).join(" ");
+	const sep = bits ? `  ${bits}` : "";
+	return c("bold", `━━ ${s.id}${sep}  ${s.label}  (${basename(s.cwd)})`);
+}
+/** The chain label behind a stage label: strip the trailing " · <stage>". */
+function chainLabelOf(stages) {
+	const first = stages[0];
+	if (!first) return "";
+	const suffix = first.stage ? ` · ${first.stage}` : "";
+	return first.label.endsWith(suffix) && suffix ? first.label.slice(0, first.label.length - suffix.length) : first.label;
+}
+/**
+* The ps table (RUNNING + FINISHED last 8). Chain stages carry `parent` and
+* render as a tree under one `chain <id>` header; plain workers render as
+* before.
+*/
+function renderTable(c, statuses, scopeLabel, now = /* @__PURE__ */ new Date()) {
+	const running = [];
+	const done = [];
+	for (const s of statuses) if (s.state === "running" && alive(s.pid)) running.push(s);
+	else {
+		if (s.state === "running") s.state = "lost";
+		done.push(s);
+	}
+	const group = (list) => {
+		const out = [];
+		for (const s of list) out.push({
+			s,
+			chain: s.parent ?? null
+		});
+		return out;
+	};
+	const treeLine = (line, chain, last) => {
+		if (chain === null) return line;
+		const mark = last ? "└" : "├";
+		const bar = last ? " " : "│";
+		return line.startsWith("      ") ? `  ${bar}   ${line.slice(6)}` : `  ${mark} ${line.slice(2)}`;
+	};
+	const lines = [c("bold", `Workers  ${`${String(now.getHours()).padStart(2, "0")}:${String(now.getMinutes()).padStart(2, "0")}:${String(now.getSeconds()).padStart(2, "0")}`}`), ""];
+	lines.push(c("bold", `RUNNING (${running.length})`));
+	if (!running.length) lines.push("  none");
+	const runEntries = group(running);
+	for (let i = 0; i < runEntries.length; i++) {
+		const { s, chain } = runEntries[i];
+		if (chain) {
+			const prev = runEntries[i - 1];
+			if (!prev || prev.chain !== chain) {
+				const stages = runEntries.filter((e) => e.chain === chain).map((e) => e.s);
+				lines.push(`  ${c("bold", `chain ${chain}`)}  ${chainLabelOf(stages)}`);
+			}
+		}
+		const last = !chain || !runEntries[i + 1] || runEntries[i + 1].chain !== chain;
+		const meter = contextMeter(c, s, 60);
+		lines.push(treeLine(`  ${c("cyan", s.id)} [${s.provider}]  ${ageOf(s.started, now).padStart(4)} old  turns ${String(s.turns).padStart(2)}  tools ${String(s.tools).padStart(2)}  ${basename(s.cwd)}${meter ? "  " + meter : ""}`, chain, last));
+		lines.push(treeLine(`      task: ${s.label}`, chain, last));
+		lines.push(treeLine(`      now:  ${c("yellow", s.last)}  (${ageOf(s.updated, now)} ago)`, chain, last));
+	}
+	lines.push("");
+	lines.push(c("bold", "FINISHED (last 8)"));
+	const doneEntries = group(done.slice(-8));
+	for (let i = 0; i < doneEntries.length; i++) {
+		const { s, chain } = doneEntries[i];
+		if (chain) {
+			const prev = doneEntries[i - 1];
+			if (!prev || prev.chain !== chain) {
+				const stages = doneEntries.filter((e) => e.chain === chain).map((e) => e.s);
+				lines.push(`  ${c("bold", `chain ${chain}`)}  ${chainLabelOf(stages)}`);
+			}
+		}
+		const last = !chain || !doneEntries[i + 1] || doneEntries[i + 1].chain !== chain;
+		const col = s.state === "done" ? "green" : "red";
+		const tag = sessionTag(s);
+		lines.push(treeLine(`  ${s.id} [${s.provider}]${tag ? " " + tag : ""}  ${c(col, s.state.padEnd(6))} rc=${s.rc}  ${String(s.secs ?? "?").padStart(4)}s  turns ${String(s.turns).padStart(2)}  tools ${String(s.tools).padStart(2)}  ${basename(s.cwd)}  ${s.label}`, chain, last));
+	}
+	lines.push("");
+	lines.push(c("dim", "worker follow        live transcript of running workers"));
+	lines.push(c("dim", "worker <id>          replay one worker"));
+	lines.push(c("dim", scopeLabel));
+	return lines.join("\n");
+}
+/** One-line status-bar summary (same shape glm-ps --status printed). */
+function renderStatusLine(mine, now = /* @__PURE__ */ new Date(), c = makeColor(true)) {
+	if (!mine.length) return "";
+	const running = mine.filter((s) => s.state === "running" && alive(s.pid));
+	const today = `${now.getFullYear()}-${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(2, "0")}`;
+	const doneToday = mine.filter((s) => s.state !== "running" && s.started.startsWith(today));
+	const ok = doneToday.filter((s) => s.state === "done").length;
+	const bad = doneToday.length - ok;
+	const providers = new Set(running.map((s) => s.provider));
+	let head = `${providers.size === 1 ? [...providers][0] : "workers"} ▶${running.length}`;
+	const parts = running.slice(0, 3).map((s) => {
+		const meter = contextMeter(c, s, 60);
+		return `${s.id.slice(-4)} ${s.label.slice(0, 26)} ${ageOf(s.started, now)} · ${s.last.slice(0, 30)}` + (meter ? ` ${meter}` : "");
+	});
+	if (parts.length) head += "  " + parts.join(" | ");
+	if (doneToday.length) head += `   ✓${ok} ✗${bad} today`;
+	return head;
+}
+
+//#endregion
+//#region src/workers/viewer.ts
+/**
+* viewer.ts — ps / follow / replay / status line over the worker logDir.
+*
+* Scoping: workers launched from this terminal's AIBroker session (or, as the
+* fallback, its iTerm tab) unless --all or an explicit worker id is given.
+* Outside iTerm, everything degrades to "all workers" — the Python behaviour.
+*
+* Transcripts render with a `HH:MM:SS │ ` gutter (2g): dim, taken from the
+* `_ts` stamp on every mirrored event (local wall clock — stamps carry a local
+* offset and old UTC stamps are converted), the worker tag in front when
+* several run at once, a date separator when the day changes, and — on a TTY —
+* a liveness line (`⋯ 12s · run tests before the fix · $ bun run test`) that
+* is rewritten in place between events. Attaching to a worker that is already
+* running first replays its last events (backfill), then continues live.
+*
+* Following one worker turns the pane into a small chat (see chatui.ts): the
+* transcript scrolls in a region that ends two rows above the bottom, the
+* prompt row (`› `, readline editing) and the ticker row stay fixed, and every
+* submitted line is said to the worker while it runs and resumes it (same
+* Claude session) once it has finished. Lines the pane wraps itself keep the
+* `│` bar on continuation rows, so no content ever lands left of the bar.
+* Non-TTY output keeps the plain scrolling behaviour.
+*/
+/** How many existing events a fresh follow pane replays before going live. */
+const BACKFILL_EVENTS = 200;
+function psOutput(logDir, showAll, env = process.env, color = process.stdout.isTTY === true) {
+	const c = makeColor(color);
+	const term = env.ITERM_SESSION_ID ?? "";
+	const statuses = loadStatuses(logDir);
+	return renderTable(c, showAll || !term ? statuses : statuses.filter((s) => workerInScope(s, term)), showAll || !term ? "scope: all workers" : resolveSession(term) ? `scope: session ${resolveSession(term).name}` : `scope: tab ${currentTabKey(env)} (this iTerm tab)`);
+}
+function initialFollowState(intent = "waiting for first event") {
+	return {
+		lastDay: "",
+		tools: {},
+		intent,
+		tool: "",
+		prev: null
+	};
+}
+/**
+* Gutter the rendered body of one event, wrapping when the pane width is
+* known. Unwrapped (null `wrapWidth`, e.g. piped output): the first row gets
+* the stamped gutter, later rows of the event blanks — exactly the pre-chat
+* rendering. Wrapped: every row is folded at `wrapWidth` columns and each
+* continuation row carries the blank gutter with the `│` bar, so the bar runs
+* unbroken down the pane and no content ever lands left of it.
+*/
+function gutterBody(body, gutter, wrapWidth) {
+	if (!gutter) return body;
+	if (wrapWidth === null || wrapWidth <= gutter.width) return body.map((ln, i) => (i === 0 ? gutter.first : gutter.cont) + ln);
+	const out = [];
+	for (const ln of body) for (const piece of wrapText(ln, wrapWidth - gutter.width)) out.push((out.length === 0 ? gutter.first : gutter.barCont) + piece);
+	return out;
+}
+/**
+* Render one event and advance the follow state. Everything the viewer shows
+* between events of one worker comes from here: replay, the backfill on
+* attach and the live tail all use it, so they space identically — events
+* back to back, one blank line between turns. `activity` is false for events
+* that render nothing (stream noise, empty tool results): they leave the
+* ticker's "since last event" clock running. `wrapWidth` (the pane's column
+* count, re-read on resize) makes the viewer wrap rows itself; null keeps
+* the terminal's own wrapping.
+*/
+function applyEvent(c, s, e, cwd, tag, offMin, wrapWidth) {
+	const tools = { ...s.tools };
+	if (e.type === "assistant") {
+		for (const b of e.message?.content ?? []) if (b.type === "tool_use" && b.id) tools[b.id] = b.name ?? "?";
+	}
+	const day = typeof e._ts === "string" ? dayOf(e._ts, offMin) ?? rawDay(e._ts) : "";
+	const state = {
+		lastDay: day && day !== s.lastDay ? day : s.lastDay,
+		tools,
+		intent: s.intent,
+		tool: s.tool,
+		prev: e
+	};
+	if (e.type === "assistant") {
+		for (const b of e.message?.content ?? []) if (b.type === "text" && (b.text ?? "").trim()) state.intent = intentOf(b.text ?? "");
+		else if (b.type === "tool_use") state.tool = tickerTool(b.name ?? "?", b.input);
+	}
+	const gutter = gutterFor(c, e, tag, offMin);
+	const body = gutterBody(renderEvent(c, "", e, cwd, tools), gutter, wrapWidth ?? null);
+	const lines = blankBetween(s.prev, e) ? ["", ...body] : body;
+	return {
+		lines,
+		day: day && day !== s.lastDay ? day : null,
+		activity: lines.some((ln) => ln !== ""),
+		state
+	};
+}
+/** `YYYY-MM-DD` straight out of an unparsable stamp, "" when it has none. */
+function rawDay(ts) {
+	return /^\d{4}-\d{2}-\d{2}/.test(ts) ? ts.slice(0, 10) : "";
+}
+/**
+* The events a fresh follow replays before going live: the last `cap`
+* non-empty log lines, oldest first.
+*/
+function backfillLines(raw, cap = BACKFILL_EVENTS) {
+	return raw.split("\n").filter((l) => l.trim()).slice(-cap);
+}
+/** The rendered transcript of one worker, from the start, as one string. */
+function replayOutput(logDir, wid, color = process.stdout.isTTY === true, tailLines) {
+	const path = eventsPath(logDir, wid);
+	if (!existsSync(path)) throw new Error(`no event log for ${wid}`);
+	const c = makeColor(color);
+	const st = loadStatuses(logDir).find((s) => s.id === wid) ?? {
+		id: wid,
+		label: "",
+		cwd: "",
+		provider: ""
+	};
+	const wrapWidth = typeof process.stdout.columns === "number" ? process.stdout.columns : null;
+	const out = [headerLine(c, st)];
+	const raw = readFileSync(path, "utf8");
+	const lines = tailLines !== void 0 ? raw.split("\n").slice(-tailLines) : raw.split("\n");
+	let state = initialFollowState("");
+	for (const line of lines) {
+		if (!line.trim()) continue;
+		let e;
+		try {
+			e = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		const step = applyEvent(c, state, e, st.cwd ?? "", void 0, void 0, wrapWidth);
+		if (step.day) out.push(c("dim", `── ${step.day} ──`));
+		out.push(...step.lines);
+		state = step.state;
+	}
+	return out.join("\n");
+}
+/**
+* The follow exit decision for one worker: it is over once its result event
+* was rendered, or once its status left "running" while its pid is gone — a
+* worker killed without writing a result still ends. A status never read
+* (undefined) means "not over": follow keeps waiting for the first event.
+*/
+function workerEnded(resultRendered, state, pidAlive) {
+	return resultRendered || state !== void 0 && state !== "running" && !pidAlive;
+}
+/**
+* One typed stdin line → say (worker running) or resume (worker finished):
+* the operator channel of a `follow <id>` pane. Trimmed; empty lines and a
+* missing target are ignored.
+*/
+function makeOperatorInput(d) {
+	return (raw) => {
+		const text = raw.trim();
+		if (!text) return;
+		const id = d.target();
+		if (id === null) return;
+		d.say(id, text).then(() => d.sent ? d.sent(id) : d.note(d.paint("dim", `» sent to ${id}`)), (e) => {
+			if (d.workerKnown(id)) d.resume(text, id);
+			else d.note(d.paint("red", `» ${e.message}`));
+		});
+	};
+}
+/**
+* Tail one worker (target) or the running workers of this scope, live.
+* Workers whose event log already exists are first replayed (last
+* BACKFILL_EVENTS events), then tailed. Auto-exit: with a target, wait
+* `autoExit` seconds after its end; without one, exit once no worker in
+* scope has run for that many seconds in a row, never within the first 30 s.
+*
+* With a target on a TTY the pane becomes a chat (chatui.ts): transcript in
+* a scroll region, fixed prompt and ticker rows, submitted lines said to the
+* worker (or resuming it after it finished) and echoed as `»` rows. A draft
+* in the prompt holds the auto-exit countdown. Non-TTY output keeps the
+* plain scrolling behaviour; FORCE_TTY=1 emits the chat layout over a pipe.
+*/
+async function followWorkers(logDir, target, showAll, autoExit, env = process.env, color = process.stdout.isTTY === true, io) {
+	const c = makeColor(color);
+	const out_ = io?.stdout ?? process.stdout;
+	const in_ = io?.stdin ?? process.stdin;
+	const tty = out_.isTTY === true || env.FORCE_TTY === "1";
+	const term = env.ITERM_SESSION_ID ?? "";
+	const scopeTab = target || showAll ? "" : currentTabKey(env);
+	const handles = /* @__PURE__ */ new Map();
+	const seenHeader = /* @__PURE__ */ new Set();
+	const finished = /* @__PURE__ */ new Set();
+	const states = /* @__PURE__ */ new Map();
+	const started = Date.now();
+	let idleSince = null;
+	let aborted = false;
+	let lastEventAt = Date.now();
+	let meterStatus = null;
+	const onInt = () => {
+		aborted = true;
+	};
+	process.once("SIGINT", onInt);
+	const chat = tty && target !== null;
+	let rows = out_.rows ?? 24;
+	const columns = () => typeof out_.columns === "number" ? out_.columns : null;
+	let fill = 0;
+	const regionRows = () => Math.max(1, rows - 2);
+	/** Every line the pane shows goes through here: plain newline, or a row
+	*  inserted above the fixed prompt/ticker rows (chatui.chatInsertLine). */
+	const out = (line) => {
+		if (!chat) {
+			out_.write(line + "\n");
+			return;
+		}
+		const r = chatInsertLine(line, fill, regionRows());
+		out_.write(r.seq);
+		fill = r.fill;
+	};
+	const eraseLiveness = () => {
+		if (chat) return;
+		if (tty) out_.write("\r\x1B[K");
+	};
+	let ticker = initialFollowState();
+	const writeLiveness = () => {
+		if (!tty) return;
+		const secs = Math.max(0, Math.floor((Date.now() - lastEventAt) / 1e3));
+		const meter = meterStatus ? contextMeter(c, meterStatus) : null;
+		const text = tickerText(secs, ticker.intent, ticker.tool, meter);
+		if (chat) out_.write(chatTickerRow(text, rows));
+		else {
+			out_.write("\r\x1B[K");
+			out_.write(text);
+		}
+	};
+	const runningIds = () => loadStatuses(logDir).filter((s) => s.state === "running" && alive(s.pid) && (target !== null || showAll || (scopeTab ? workerInScope(s, term) : true))).map((s) => s.id);
+	const emitEvent = (e, wid, st, multi) => {
+		if (e.type === "operator" && chat && suppressMirror(String(e.text ?? ""))) return;
+		if (!seenHeader.has(wid)) {
+			eraseLiveness();
+			out(headerLine(c, st));
+			seenHeader.add(wid);
+		}
+		const step = applyEvent(c, states.get(wid) ?? initialFollowState(), e, st.cwd ?? "", multi ? c("cyan", wid.slice(-4)) : void 0, void 0, columns());
+		if (step.day) out(c("dim", `── ${step.day} ──`));
+		states.set(wid, step.state);
+		if (wid === target) ticker = step.state;
+		eraseLiveness();
+		for (const ln of step.lines) out(ln);
+		if (step.activity) lastEventAt = Date.now();
+		if (e.type === "result") {
+			meterStatus = st;
+			finished.add(wid);
+		} else if (wid === target || target === null) meterStatus = st;
+	};
+	const attachHandle = (wid, path, st, multi) => {
+		const handle = {
+			fd: openSync(path, "r"),
+			buf: ""
+		};
+		try {
+			const existing = readFileSync(path, "utf8");
+			if (existing.trim()) for (const line of backfillLines(existing)) {
+				let e;
+				try {
+					e = JSON.parse(line);
+				} catch {
+					continue;
+				}
+				emitEvent(e, wid, st, multi);
+			}
+			else if (!seenHeader.has(wid)) {
+				out(headerLine(c, st));
+				seenHeader.add(wid);
+			}
+			const sink = Buffer.alloc(65536);
+			for (;;) {
+				let n;
+				try {
+					n = readSync(handle.fd, sink, 0, sink.length, null);
+				} catch {
+					break;
+				}
+				if (n <= 0) break;
+			}
+		} catch {}
+		return handle;
+	};
+	const noteLine = (s) => {
+		eraseLiveness();
+		out(s);
+	};
+	const spawnResume = io?.spawnResume ?? ((id, text) => spawn("pai", [
+		"worker",
+		"resume",
+		id,
+		text,
+		"--print-id",
+		"--no-pane"
+	], { stdio: [
+		"ignore",
+		"pipe",
+		"inherit"
+	] }));
+	const resumeTarget = (text, id) => {
+		noteLine(c("dim", `» resuming ${id} …`));
+		const child = spawnResume(id, text);
+		let idOut = "";
+		child.stdout?.on("data", (chunk) => {
+			idOut += chunk.toString("utf8");
+		});
+		child.on("close", (rc) => {
+			const newId = idOut.trim().split("\n").pop() ?? "";
+			if (rc === 0 && /^\d{8}-\d{6}-\d+$/.test(newId)) {
+				noteLine(c("dim", `» resumed as ${newId}`));
+				target = newId;
+				finished.delete(newId);
+				seenHeader.delete(newId);
+				states.delete(newId);
+				ticker = initialFollowState("resumed");
+				lastEventAt = Date.now();
+			} else noteLine(c("red", `» resume failed (rc=${rc})`));
+		});
+	};
+	const handleOperatorLine = makeOperatorInput({
+		target: () => target,
+		say: (id, text) => sayToWorker(logDir, id, text),
+		workerKnown: (id) => loadStatuses(logDir).some((s) => s.id === id),
+		resume: resumeTarget,
+		note: noteLine,
+		paint: c,
+		...chat ? { sent: () => void 0 } : {}
+	});
+	const terminalIn = in_.isTTY === true;
+	let hintUp = true;
+	let rlIn = null;
+	let onResize = null;
+	const echoed = /* @__PURE__ */ new Map();
+	const suppressMirror = (text) => {
+		const g = echoed.get(text);
+		if (!g || Date.now() > g.until) return false;
+		g.n -= 1;
+		if (g.n <= 0) echoed.delete(text);
+		return true;
+	};
+	const drawPrompt = () => {
+		if (!chat || terminalIn) return;
+		out_.write(chatPromptRow(rows, CHAT_PROMPT, hintUp ? c("dim", CHAT_HINT) : void 0));
+	};
+	if (chat) {
+		const echoOperator = (text) => {
+			const id = target;
+			if (id === null) return;
+			echoed.set(text, {
+				n: 1,
+				until: Date.now() + 1e4
+			});
+			const step = applyEvent(c, states.get(id) ?? initialFollowState(), {
+				type: "operator",
+				_ts: (/* @__PURE__ */ new Date()).toISOString(),
+				text
+			}, "", void 0, void 0, columns());
+			if (step.day) out(c("dim", `── ${step.day} ──`));
+			for (const ln of step.lines) out(ln);
+			states.set(id, step.state);
+		};
+		const handleChatLine = (raw) => {
+			hintUp = false;
+			const act = parseChatLine(raw);
+			switch (act.kind) {
+				case "message":
+					if (!act.text) break;
+					echoOperator(act.text);
+					handleOperatorLine(act.text);
+					break;
+				case "resume":
+					if (!act.text) {
+						out(c("dim", "usage: /resume <text>"));
+						break;
+					}
+					echoOperator(act.text);
+					if (target !== null) resumeTarget(act.text, target);
+					break;
+				case "help":
+					for (const ln of CHAT_HELP) out(c("dim", ln));
+					break;
+				case "status": {
+					const s = target !== null ? loadStatuses(logDir).find((x) => x.id === target) : void 0;
+					out(c("dim", s ? `${s.id} · ${s.state} · ${s.last}` : `${target ?? "?"} · no status`));
+					break;
+				}
+				case "quit":
+					aborted = true;
+					break;
+			}
+			drawPrompt();
+		};
+		rlIn = createInterface({
+			input: in_,
+			output: out_,
+			terminal: terminalIn
+		});
+		rlIn.on("line", handleChatLine);
+		rlIn.on("SIGINT", () => {
+			if ((rlIn?.line ?? "").trim() === "") aborted = true;
+			else rlIn?.write(null, {
+				ctrl: true,
+				name: "u"
+			});
+		});
+		rlIn.on("close", () => {
+			aborted = true;
+		});
+		out_.write(chatEnter(rows));
+		if (terminalIn) {
+			rlIn.setPrompt(CHAT_PROMPT);
+			rlIn.prompt();
+			out_.write(c("dim", CHAT_HINT));
+		} else drawPrompt();
+		onResize = () => {
+			if (typeof out_.rows === "number") rows = out_.rows;
+			fill = 0;
+			out_.write(chatScrollRegion(rows));
+			drawPrompt();
+		};
+		out_.on?.("resize", onResize);
+	} else if (target !== null && in_.isTTY) {
+		rlIn = createInterface({ input: in_ });
+		rlIn.on("line", handleOperatorLine);
+	}
+	/** The prompt's unsent text — a draft holds the auto-exit countdown. */
+	const promptText = () => io?.promptLine ? io.promptLine() : rlIn?.line ?? "";
+	try {
+		for (;;) {
+			if (aborted) return;
+			const statuses = new Map(loadStatuses(logDir).map((s) => [s.id, s]));
+			const wanted = target ? [target] : runningIds();
+			for (const wid of wanted) {
+				if (handles.has(wid) || finished.has(wid)) continue;
+				const path = eventsPath(logDir, wid);
+				const st = statuses.get(wid) ?? {
+					id: wid,
+					label: "",
+					cwd: "",
+					provider: ""
+				};
+				if (existsSync(path)) {
+					const multi = target === null || handles.size > 0;
+					handles.set(wid, attachHandle(wid, path, st, multi));
+					states.set(wid, states.get(wid) ?? initialFollowState());
+				} else if (!seenHeader.has(wid)) {
+					out(headerLine(c, st));
+					seenHeader.add(wid);
+				}
+			}
+			const multi = handles.size > 1 || target === null;
+			let progressed = false;
+			for (const [wid, h] of [...handles.entries()]) {
+				const st = statuses.get(wid) ?? {
+					id: wid,
+					label: "",
+					cwd: "",
+					provider: ""
+				};
+				const buffer = Buffer.alloc(65536);
+				for (;;) {
+					let n;
+					try {
+						n = readSync(h.fd, buffer, 0, buffer.length, null);
+					} catch {
+						n = 0;
+					}
+					if (n <= 0) break;
+					h.buf += buffer.toString("utf8", 0, n);
+				}
+				const lines = h.buf.split("\n");
+				h.buf = lines.pop() ?? "";
+				for (const line of lines) {
+					if (!line.trim()) continue;
+					progressed = true;
+					let e;
+					try {
+						e = JSON.parse(line);
+					} catch {
+						continue;
+					}
+					emitEvent(e, wid, st, multi);
+				}
+				if (workerEnded(finished.has(wid), st.state, alive(st.pid))) {
+					if (!finished.has(wid)) {
+						eraseLiveness();
+						out(`${multi ? c("cyan", wid.slice(-4)) + c("dim", " ┃ ") : "  "}${c("red", "✗ " + (st.state || "ended"))} · ${st.last ?? ""}`);
+						finished.add(wid);
+					}
+					closeSync(h.fd);
+					handles.delete(wid);
+				}
+			}
+			const lingerOn = target;
+			if (lingerOn !== null && finished.has(lingerOn)) {
+				if (autoExit) {
+					if (holdAutoExit(promptText())) {
+						writeLiveness();
+						await sleep(250);
+						continue;
+					}
+					const until = Date.now() + autoExit * 1e3;
+					while (Date.now() < until && !aborted && target === lingerOn && !holdAutoExit(promptText())) {
+						writeLiveness();
+						await sleep(250);
+					}
+					if (aborted || target !== lingerOn || holdAutoExit(promptText())) continue;
+					eraseLiveness();
+					out(c("dim", "closing"));
+					return;
+				}
+				if (rlIn === null) return;
+			}
+			if (autoExit && !target) {
+				if (runningIds().length) idleSince = null;
+				else if (idleSince === null) idleSince = Date.now();
+				else if (Date.now() - started >= 3e4 && Date.now() - idleSince >= autoExit * 1e3) {
+					eraseLiveness();
+					out(c("dim", "closing"));
+					return;
+				}
+			}
+			if (!progressed) {
+				writeLiveness();
+				await sleep(500);
+			}
+		}
+	} finally {
+		rlIn?.close();
+		process.removeListener("SIGINT", onInt);
+		if (onResize) out_.removeListener?.("resize", onResize);
+		if (chat) out_.write(chatLeave(rows));
+		for (const h of handles.values()) try {
+			closeSync(h.fd);
+		} catch {}
+	}
+}
+function sleep(ms) {
+	return new Promise((r) => setTimeout(r, ms));
+}
+/** Workers of this terminal for the status bar; "" when there are none. */
+function statusLineOutput(logDir, term, cwd, now = /* @__PURE__ */ new Date()) {
+	return renderStatusLine(loadStatuses(logDir).filter((s) => {
+		const sameScope = term && workerInScope(s, term);
+		const sameDir = cwd && s.cwd.startsWith(cwd);
+		return sameScope || !term && sameDir;
+	}), now);
+}
+
+//#endregion
+//#region src/workers/providers.ts
+/**
+* providers.ts — provider, class and switch management over the workers config.
+*
+* One layer under both `pai worker providers …` and the MCP worker_providers
+* tool. Every mutation re-reads the config file, changes only the workers
+* section, and writes it back atomically — the file is shared with everything
+* else PAI runs, so a torn write is not an option.
+*
+* Keys are never stored in the config and never accepted inline from the CLI:
+* only file paths. (The MCP `add` tool additionally accepts a raw `key`, which
+* it immediately parks in ~/.config/pai/keys/<name>, mode 0600, storing only
+* the path — a chat is not a place to leave a credential lying around.)
+*/
+function addProvider(input) {
+	if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(input.name)) throw new WorkersConfigError(`provider name "${input.name}" may only contain letters, digits, - and _`);
+	if (input.protocol === "openai" && !input.upstreamUrl) throw new WorkersConfigError("protocol \"openai\" needs the upstreamUrl (the Chat Completions base, e.g. \"https://api.openai.com/v1\") — the PAI proxy translates to it.");
+	if (!input.baseUrl && input.protocol !== "openai") throw new WorkersConfigError("baseUrl is required");
+	let keyFile = input.keyFile ?? null;
+	if (input.key !== void 0) {
+		const dir = keysDir();
+		if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+		const path = `${dir}/${input.name}`;
+		writeFileSync(path, input.key.trim() + "\n", {
+			encoding: "utf8",
+			mode: 384
+		});
+		try {
+			chmodSync(path, 384);
+		} catch {}
+		keyFile = path;
+	}
+	const { raw, workers } = readWorkersSection();
+	const provider = {
+		enabled: true,
+		protocol: input.protocol ?? "anthropic",
+		baseUrl: input.baseUrl,
+		keyFile,
+		models: input.fastModel ? {
+			default: input.model,
+			fast: input.fastModel
+		} : { default: input.model },
+		env: input.env ?? {},
+		...input.note ? { note: input.note } : {},
+		...input.upstreamUrl ? { upstreamUrl: input.upstreamUrl } : {},
+		...input.engine && input.engine !== "claude" ? { engine: input.engine } : {},
+		...input.quotaProbe ? { quotaProbe: input.quotaProbe } : {},
+		...input.contextWindow ? { contextWindow: input.contextWindow } : {},
+		...input.costTier ? { costTier: input.costTier } : {},
+		...input.tags?.length ? { tags: input.tags } : {}
+	};
+	workers.providers[input.name] = provider;
+	if (Object.keys(workers.providers).length === 1) {
+		workers.enabled = true;
+		workers.active = input.name;
+		workers.logDir = workers.logDir || DEFAULT_LOG_DIR;
+		const fast = input.fastModel ? `${input.name}/fast` : input.name;
+		workers.classes = {
+			draft: fast,
+			plan: input.name,
+			implement: input.name,
+			review: input.name,
+			research: input.name,
+			spotcheck: fast,
+			simple: fast,
+			complex: input.name,
+			image: input.name
+		};
+	}
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+/** Change costTier / tags on an existing provider (MCP action "update"). */
+function updateProvider(name, changes) {
+	const { raw, workers } = readWorkersSection();
+	const p = workers.providers[name];
+	if (!p) throw new WorkersConfigError(`no provider named "${name}". Configured: ${Object.keys(workers.providers).join(", ") || "(none)"}`);
+	if (changes.costTier !== void 0) {
+		if (!Number.isInteger(changes.costTier) || changes.costTier < 1 || changes.costTier > 5) throw new WorkersConfigError("costTier must be an integer 1 (cheapest) … 5 (most expensive)");
+		p.costTier = changes.costTier;
+	}
+	if (changes.tags !== void 0) {
+		for (const t of changes.tags) if (!PROVIDER_TAGS.includes(t)) throw new WorkersConfigError(`"${t}" is not a tag (from: ${PROVIDER_TAGS.join(", ")})`);
+		p.tags = changes.tags;
+	}
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+function removeProvider(name) {
+	const { raw, workers } = readWorkersSection();
+	if (!workers.providers[name]) throw new WorkersConfigError(`no provider named "${name}"`);
+	delete workers.providers[name];
+	for (const [cls, target] of Object.entries(workers.classes)) if ((typeof target === "string" ? target.split("/")[0] : target.provider) === name) delete workers.classes[cls];
+	if (workers.active === name) workers.active = null;
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+function useProvider(name) {
+	const { raw, workers } = readWorkersSection();
+	if (!workers.providers[name]) throw new WorkersConfigError(`no provider named "${name}". Configured: ${Object.keys(workers.providers).join(", ") || "(none)"}`);
+	workers.active = name;
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+function setProviderEnabled(name, enabled) {
+	const { raw, workers } = readWorkersSection();
+	const p = workers.providers[name];
+	if (!p) throw new WorkersConfigError(`no provider named "${name}"`);
+	p.enabled = enabled;
+	writeWorkersSection(raw, workers);
+	if (enabled) clearCooldown(workersLogDir(parseWorkersConfig(raw.workers)), name);
+	return workers;
+}
+/**
+* Point a class at a target ("provider", "provider/fast", or an object with
+* provider + optional mcp/maxCostTier/requireTags/order). An object without
+* a provider only constrains auto-routing for that class.
+*/
+function setClass(name, target) {
+	const { raw, workers } = readWorkersSection();
+	if (typeof target === "string") {
+		const [provider, alias] = target.split("/");
+		const p = workers.providers[provider];
+		if (!p) throw new WorkersConfigError(`no provider named "${provider}" in "${target}". Configured: ${Object.keys(workers.providers).join(", ") || "(none)"}`);
+		if (alias && alias !== "default" && alias !== "fast") throw new WorkersConfigError(`unknown model alias "${alias}" — providers expose "default" and "fast"`);
+		if (alias === "fast" && !p.models.fast) throw new WorkersConfigError(`provider "${provider}" has no fast model configured`);
+	} else if (target.provider) {
+		if (!workers.providers[target.provider]) throw new WorkersConfigError(`no provider named "${target.provider}". Configured: ${Object.keys(workers.providers).join(", ") || "(none)"}`);
+	}
+	workers.classes[name] = target;
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+function unsetClass(name) {
+	const { raw, workers } = readWorkersSection();
+	if (!(name in workers.classes)) throw new WorkersConfigError(`no class named "${name}"`);
+	delete workers.classes[name];
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+function setWorkersEnabled(enabled) {
+	const { raw, workers } = readWorkersSection();
+	workers.enabled = enabled;
+	writeWorkersSection(raw, workers);
+	return workers;
+}
+/** `glm/fast` | `{provider, mcp, …}` → one printable target line. */
+function classTargetText(target) {
+	if (typeof target === "string") return target;
+	return [
+		target.provider ?? "(routing)",
+		...target.mcp?.length ? [`mcp(${target.mcp.join(",")})`] : [],
+		...target.maxCostTier !== void 0 ? [`max tier ${target.maxCostTier}`] : [],
+		...target.requireTags?.length ? [`needs ${target.requireTags.join(",")}`] : [],
+		...target.order?.length ? [`order [${target.order.join(",")}]`] : []
+	].join(" ");
+}
+/** Human-readable provider listing (quota probe included when configured). */
+function describeProviders(workers) {
+	const lines = [];
+	const names = Object.keys(workers.providers);
+	if (!names.length) {
+		lines.push(`no providers configured. Add one with:`);
+		lines.push(`  pai worker providers add <name> --base-url <url> --key-file <path> --model <model>`);
+		return lines;
+	}
+	for (const name of names) {
+		const p = workers.providers[name];
+		const flags = [p.enabled ? "enabled" : "disabled", workers.active === name ? "active" : null].filter(Boolean);
+		const quota = p.quotaProbe ? probeQuota(p) : null;
+		const quotaNote = quota === null ? "" : `  quota ${quota}% (skip at ${quotaSkipThreshold(p)})`;
+		const tierTags = [`tier ${providerCostTier(p)}`, ...p.tags ?? []].join(", ");
+		lines.push(`${name}  [${flags.join(", ")}]  ${p.baseUrl}`);
+		lines.push(`    model ${p.models.default}${p.models.fast ? ` (fast: ${p.models.fast})` : ""}${quotaNote}`);
+		lines.push(`    ${tierTags}`);
+		if (p.keyFile) lines.push(`    key file ${expandHome(p.keyFile)}`);
+		else lines.push(`    no key file (token "local")`);
+		if (p.note) lines.push(`    ${p.note}`);
+		if (p.protocol === "openai") lines.push(`    via PAI proxy ← ${p.upstreamUrl ?? "(upstreamUrl missing)"}`);
+		if (p.engine === "codex") lines.push(`    engine codex (runs through the Codex CLI)`);
+	}
+	const setNames = Object.keys(workers.mcpSets);
+	if (setNames.length) lines.push(`mcp sets: ${setNames.map((s) => `${s}=[${workers.mcpSets[s].join(",")}]`).join("  ")}`);
+	const classNames = Object.keys(workers.classes);
+	if (classNames.length) lines.push(`classes: ${classNames.map((cl) => `${cl}=${classTargetText(workers.classes[cl])}`).join("  ")}`);
+	if (workers.active === "auto") lines.push(`routing: auto — order [${workers.routing.order.join(", ")}], cooldown ${workers.routing.cooldownMinutes}m`);
+	return lines;
+}
+
+//#endregion
+export { ledgerPath as A, checkPaneForWorker as C, ledgerSummary as D, loadStatus as E, readJsonStrict as F, writeJsonAtomic as I, PROVIDER_TAGS as M, WorkersConfigError as N, parseRunnerArgs as O, readWorkersSection as P, describeMcp as S, openPaneForWorker as T, testProvider as _, setClass as a, stopProxy as b, unsetClass as c, followWorkers as d, psOutput as f, runWorker as g, runChain as h, removeProvider as i, workersLogDir as j, eventsPath as k, updateProvider as l, statusLineOutput as m, classTargetText as n, setProviderEnabled as o, replayOutput as p, describeProviders as r, setWorkersEnabled as s, addProvider as t, useProvider as u, DEFAULT_PROXY_PORT as v, openFollowPane as w, sayToWorker as x, ensureProxyRunning as y };
+//# sourceMappingURL=providers-DUshcB-d.mjs.map