@tekmidian/pai 0.39.0 → 0.40.0

package/dist/{chain-CTtHligI.mjs → chain-DhVHVnmT.mjs}

@@ -1,448 +1,12 @@
-import { n as CONFIG_FILE } from "./config-B64vFg14.mjs";
-import { appendFileSync, closeSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { a as WorkersConfigError, h as resolveModelCapability, l as isModelCapability, m as readWorkersSection, o as assertProviderRunnable, p as providerKeyPath, s as classModelCapability } from "./config-Dl8lT4Lu.mjs";
+import { _ as workersLogDir, d as setCooldown, f as eventsPath, g as statusPath, h as panesDir, i as buildRunEnv, m as noMcpConfigPath, n as ensureProxyRunning, o as isQuotaFailure, p as ledgerPath, s as nextAutoProvider, t as DEFAULT_PROXY_PORT, u as resolveTarget } from "./server-BOuAOj9b.mjs";
+import { appendFileSync, closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join, relative } from "node:path";
-import { fileURLToPath } from "node:url";
 import { connect, createServer } from "node:net";
 import { execFileSync, spawn } from "node:child_process";
 import { createInterface } from "node:readline";
 
-//#region src/config/json-store.ts
-/**
-* json-store.ts — read/write JSON config files without destroying them
-*
-* The failure this exists to prevent:
-*
-*     try { return JSON.parse(read(path)); } catch { return {}; }
-*     ... later ...
-*     write(path, JSON.stringify(ourData));
-*
-* An unreadable file becomes an empty object, and the next write makes that
-* permanent. Silently, exit code 0. This shape appeared three times in this
-* repo against three different files, and twice in AIBroker.
-*
-* The distinction that matters is between *missing* and *unreadable*:
-*
-*   missing     — legitimate first run. Start fresh; writing is safe.
-*   unreadable  — the file exists and we could not parse it. Those bytes are
-*                 the only copy of something. Never overwrite them.
-*
-* Collapsing the second into the first is the bug.
-*
-* NOT everything deserves this guard. For a transient buffer — an undelivered
-* message queue, a cache — starting fresh IS the correct recovery, and
-* refusing to write would disable the feature permanently. Use `writeJsonAtomic`
-* alone there: it still prevents a crash from truncating a good file, without
-* blocking recovery. Reserve `readJsonStrict` for data a user cannot rebuild.
-*/
-/**
-* Read a JSON file, distinguishing "absent" from "damaged".
-*
-* @param path   file to read
-* @param label  how to name it to the user, e.g. "~/.claude.json"
-* @throws if the file exists but cannot be read or parsed
-*/
-function readJsonStrict(path, label = path) {
-	if (!existsSync(path)) return {};
-	let raw;
-	try {
-		raw = readFileSync(path, "utf8");
-	} catch (e) {
-		throw new Error(`Could not read ${label}: ${e instanceof Error ? e.message : String(e)}\nRefusing to continue — writing now would replace its contents with ours alone.`);
-	}
-	try {
-		return JSON.parse(raw);
-	} catch (e) {
-		throw new Error(`${label} exists but is not valid JSON: ${e instanceof Error ? e.message : String(e)}\nRefusing to continue — overwriting it would destroy whatever it holds.\nRepair the file, or move it aside and re-run this command.`);
-	}
-}
-/**
-* Write JSON without risking the existing file.
-*
-* Keeps a `.bak-pai` copy of the previous contents, then writes to a temp file
-* and renames. Rename is atomic within a filesystem, so a crash mid-write
-* leaves the original intact rather than truncated — which is how these files
-* become corrupt in the first place.
-*/
-function writeJsonAtomic(path, data, opts = {}) {
-	const { backup = true, label = path } = opts;
-	const serialized = JSON.stringify(data, null, 2) + "\n";
-	const dir = dirname(path);
-	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-	if (backup && existsSync(path)) try {
-		copyFileSync(path, `${path}.bak-pai`);
-	} catch (e) {
-		throw new Error(`Could not back up ${label}: ${e instanceof Error ? e.message : String(e)}\nRefusing to write without a backup.`);
-	}
-	const tmp = `${path}.tmp-pai-${process.pid}`;
-	try {
-		writeFileSync(tmp, serialized, "utf8");
-		renameSync(tmp, path);
-	} catch (e) {
-		try {
-			if (existsSync(tmp)) unlinkSync(tmp);
-		} catch {}
-		throw new Error(`Failed to write ${label}: ${e instanceof Error ? e.message : String(e)}\nThe original is unchanged.`);
-	}
-}
-
-//#endregion
-//#region src/workers/config.ts
-/**
-* config.ts — the `workers` section of ~/.config/pai/config.json
-*
-* Everything that knows about worker providers reads this module: the CLI
-* (`pai worker …`), the MCP tools (worker_*), and the Agent-routing hook.
-* Keep it free of commander/MCP imports so all three layers stay thin over it.
-*
-* Keys are never stored here — only paths to 0600 files. A provider without a
-* keyFile is a local server and gets the placeholder token "local".
-*
-* `protocol: "openai"` providers run through the PAI proxy (src/workers/proxy):
-* `upstreamUrl` is their Chat Completions base, and `run` points
-* ANTHROPIC_BASE_URL at the local proxy with the provider name in the path.
-* `engine: "codex"` providers run through the Codex CLI instead of Claude
-* Code.
-*/
-const DEFAULT_COST_TIER = 3;
-/** Tags a provider may carry; classes filter auto-routing on them. */
-const PROVIDER_TAGS = [
-	"code",
-	"vision",
-	"image-gen",
-	"long-context",
-	"fast",
-	"reasoning"
-];
-/** The standard task classes; `workers.classes` maps each to a target. */
-const WORKER_CLASSES = [
-	"draft",
-	"plan",
-	"implement",
-	"review",
-	"research",
-	"spotcheck",
-	"simple",
-	"complex",
-	"image"
-];
-const DEFAULT_LOG_DIR = "~/.claude/logs/workers";
-const DEFAULT_PANE = {
-	enabled: true,
-	fontSize: 13,
-	autoExitSecs: 60
-};
-const DEFAULT_ROUTING = {
-	order: [],
-	cooldownMinutes: 30,
-	retryOnQuota: true
-};
-const DEFAULT_TREE = {
-	maxDepth: 2,
-	maxChildren: 4
-};
-/**
-* The default MCP sets every config starts from. `desktop` names the clickr
-* server so `--mcp desktop` hands a worker the machine controls (read-only
-* tools always; actuating ones after the operator hands the controls over,
-* see `pai worker controls`). A user's mcpSets section is merged over this,
-* so `desktop: []` removes the set deliberately.
-*/
-const DEFAULT_MCP_SETS = { desktop: ["clickr"] };
-function defaultWorkersConfig() {
-	return {
-		enabled: false,
-		active: null,
-		providers: {},
-		classes: {},
-		mcpSets: { ...DEFAULT_MCP_SETS },
-		pane: { ...DEFAULT_PANE },
-		logDir: DEFAULT_LOG_DIR,
-		routing: {
-			...DEFAULT_ROUTING,
-			order: []
-		},
-		tree: { ...DEFAULT_TREE }
-	};
-}
-var WorkersConfigError = class extends Error {};
-function bad(path, why) {
-	throw new WorkersConfigError(`workers${path}: ${why}`);
-}
-function str(v) {
-	return typeof v === "string" ? v : "";
-}
-function parseProvider(name, raw) {
-	if (typeof raw !== "object" || raw === null) bad(`.providers.${name}`, "must be an object");
-	const p = raw;
-	const protocol = p.protocol === void 0 ? "anthropic" : str(p.protocol);
-	if (protocol !== "anthropic" && protocol !== "openai") bad(`.providers.${name}.protocol`, `"${str(p.protocol)}" is neither "anthropic" nor "openai"`);
-	const engine = p.engine === void 0 ? "claude" : str(p.engine);
-	if (engine !== "claude" && engine !== "codex") bad(`.providers.${name}.engine`, `"${str(p.engine)}" is neither "claude" nor "codex"`);
-	const baseUrl = str(p.baseUrl);
-	if (!baseUrl && protocol !== "openai") bad(`.providers.${name}.baseUrl`, "is required");
-	const keyFile = p.keyFile === void 0 || p.keyFile === null || str(p.keyFile) === "" ? null : str(p.keyFile);
-	const modelsRaw = p.models === void 0 ? {} : p.models;
-	if (typeof modelsRaw !== "object" || modelsRaw === null) bad(`.providers.${name}.models`, "must be an object");
-	const m = modelsRaw;
-	const defaultModel = str(m.default);
-	if (!defaultModel) bad(`.providers.${name}.models.default`, "is required");
-	const fast = m.fast === void 0 ? void 0 : str(m.fast);
-	const env = {};
-	if (p.env !== void 0) {
-		if (typeof p.env !== "object" || p.env === null || Array.isArray(p.env)) bad(`.providers.${name}.env`, "must be an object of string values");
-		for (const [k, v] of Object.entries(p.env)) {
-			if (typeof v !== "string") bad(`.providers.${name}.env.${k}`, "must be a string");
-			env[k] = v;
-		}
-	}
-	const quotaSkipAt = p.quotaSkipAt === void 0 ? void 0 : p.quotaSkipAt;
-	if (quotaSkipAt !== void 0) {
-		if (typeof quotaSkipAt !== "number" || quotaSkipAt < 0 || quotaSkipAt > 100) bad(`.providers.${name}.quotaSkipAt`, "must be a number between 0 and 100");
-	}
-	const contextWindow = p.contextWindow === void 0 ? void 0 : p.contextWindow;
-	if (contextWindow !== void 0) {
-		if (typeof contextWindow !== "number" || contextWindow <= 0) bad(`.providers.${name}.contextWindow`, "must be a positive number of tokens");
-	}
-	const upstreamUrl = str(p.upstreamUrl);
-	if (protocol === "openai" && !upstreamUrl) bad(`.providers.${name}.upstreamUrl`, `is required for protocol "openai" (the Chat Completions base, e.g. "https://api.openai.com/v1")`);
-	const costTier = p.costTier === void 0 ? void 0 : p.costTier;
-	if (costTier !== void 0) {
-		if (typeof costTier !== "number" || !Number.isInteger(costTier) || costTier < 1 || costTier > 5) bad(`.providers.${name}.costTier`, "must be an integer 1 (cheapest) … 5 (most expensive)");
-	}
-	let tags;
-	if (p.tags !== void 0) {
-		if (!Array.isArray(p.tags) || p.tags.some((x) => typeof x !== "string")) bad(`.providers.${name}.tags`, `must be an array of tags from: ${PROVIDER_TAGS.join(", ")}`);
-		for (const t of p.tags) if (!PROVIDER_TAGS.includes(t)) bad(`.providers.${name}.tags`, `"${t}" is not a tag (from: ${PROVIDER_TAGS.join(", ")})`);
-		tags = p.tags;
-	}
-	return {
-		enabled: p.enabled === void 0 ? true : p.enabled === true,
-		protocol,
-		baseUrl,
-		keyFile,
-		models: fast ? {
-			default: defaultModel,
-			fast
-		} : { default: defaultModel },
-		env,
-		...str(p.note) ? { note: str(p.note) } : {},
-		...upstreamUrl ? { upstreamUrl } : {},
-		...engine !== "claude" ? { engine } : {},
-		...str(p.quotaProbe) ? { quotaProbe: str(p.quotaProbe) } : {},
-		...quotaSkipAt !== void 0 ? { quotaSkipAt } : {},
-		...contextWindow !== void 0 ? { contextWindow } : {},
-		...costTier !== void 0 ? { costTier } : {},
-		...tags ? { tags } : {}
-	};
-}
-/**
-* Parse and validate a raw `workers` value. Missing section → defaults.
-* Unknown-but-typed garbage → WorkersConfigError naming the offending field.
-*/
-function parseWorkersConfig(raw) {
-	const d = defaultWorkersConfig();
-	if (raw === void 0 || raw === null) return d;
-	if (typeof raw !== "object" || Array.isArray(raw)) bad("", "section must be an object");
-	const w = raw;
-	const providers = {};
-	if (w.providers !== void 0) {
-		if (typeof w.providers !== "object" || w.providers === null || Array.isArray(w.providers)) bad(".providers", "must be an object keyed by provider name");
-		for (const [name, p] of Object.entries(w.providers)) providers[name] = parseProvider(name, p);
-	}
-	const classes = {};
-	const classesRaw = w.classes !== void 0 ? w.classes : w.roles;
-	if (classesRaw !== void 0) {
-		if (typeof classesRaw !== "object" || classesRaw === null || Array.isArray(classesRaw)) bad(w.classes !== void 0 ? ".classes" : ".roles", "must be an object of class → provider[/alias] or {provider, mcp, maxCostTier, requireTags, order}");
-		for (const [cls, target] of Object.entries(classesRaw)) if (typeof target === "object" && target !== null && !Array.isArray(target)) {
-			const o = target;
-			const provider = str(o.provider);
-			if (o.provider !== void 0 && (!provider || provider.includes(" "))) bad(`.classes.${cls}.provider`, `invalid provider "${provider}"`);
-			let mcp;
-			if (o.mcp !== void 0) {
-				if (!Array.isArray(o.mcp) || o.mcp.some((x) => typeof x !== "string")) bad(`.classes.${cls}.mcp`, "must be an array of MCP server or set names");
-				mcp = o.mcp;
-			}
-			let maxCostTier;
-			if (o.maxCostTier !== void 0) {
-				if (typeof o.maxCostTier !== "number" || !Number.isInteger(o.maxCostTier) || o.maxCostTier < 1 || o.maxCostTier > 5) bad(`.classes.${cls}.maxCostTier`, "must be an integer 1 … 5");
-				maxCostTier = o.maxCostTier;
-			}
-			let requireTags;
-			if (o.requireTags !== void 0) {
-				if (!Array.isArray(o.requireTags) || o.requireTags.some((x) => typeof x !== "string")) bad(`.classes.${cls}.requireTags`, `must be an array of tags from: ${PROVIDER_TAGS.join(", ")}`);
-				for (const t of o.requireTags) if (!PROVIDER_TAGS.includes(t)) bad(`.classes.${cls}.requireTags`, `"${t}" is not a tag (from: ${PROVIDER_TAGS.join(", ")})`);
-				requireTags = o.requireTags;
-			}
-			let order;
-			if (o.order !== void 0) {
-				if (!Array.isArray(o.order) || o.order.some((x) => typeof x !== "string")) bad(`.classes.${cls}.order`, "must be an array of provider names");
-				order = o.order;
-			}
-			const obj = {
-				...provider ? { provider } : {},
-				...mcp ? { mcp } : {},
-				...maxCostTier !== void 0 ? { maxCostTier } : {},
-				...requireTags ? { requireTags } : {},
-				...order ? { order } : {}
-			};
-			classes[cls] = Object.keys(obj).length ? obj : {};
-		} else {
-			const t = str(target);
-			if (!t || t.includes(" ")) bad(`.classes.${cls}`, `invalid target "${t}"`);
-			classes[cls] = t;
-		}
-	}
-	const mcpSets = { ...DEFAULT_MCP_SETS };
-	if (w.mcpSets !== void 0) {
-		if (typeof w.mcpSets !== "object" || w.mcpSets === null || Array.isArray(w.mcpSets)) bad(".mcpSets", "must be an object of set name → [server names]");
-		for (const [setName, servers] of Object.entries(w.mcpSets)) {
-			if (!Array.isArray(servers) || servers.some((x) => typeof x !== "string")) bad(`.mcpSets.${setName}`, "must be an array of MCP server names");
-			mcpSets[setName] = servers;
-		}
-	}
-	let pane = { ...DEFAULT_PANE };
-	if (w.pane !== void 0) {
-		if (typeof w.pane !== "object" || w.pane === null) bad(".pane", "must be an object");
-		const pc = w.pane;
-		if (pc.enabled !== void 0 && typeof pc.enabled !== "boolean") bad(".pane.enabled", "must be boolean");
-		if (pc.fontSize !== void 0 && (typeof pc.fontSize !== "number" || pc.fontSize <= 0)) bad(".pane.fontSize", "must be a positive number of points");
-		if (pc.autoExitSecs !== void 0 && typeof pc.autoExitSecs !== "number") bad(".pane.autoExitSecs", "must be a number");
-		pane = {
-			enabled: pc.enabled === void 0 ? DEFAULT_PANE.enabled : pc.enabled === true,
-			fontSize: pc.fontSize === void 0 ? DEFAULT_PANE.fontSize : pc.fontSize,
-			autoExitSecs: pc.autoExitSecs === void 0 ? DEFAULT_PANE.autoExitSecs : pc.autoExitSecs
-		};
-	}
-	let routing = {
-		...DEFAULT_ROUTING,
-		order: []
-	};
-	if (w.routing !== void 0) {
-		if (typeof w.routing !== "object" || w.routing === null) bad(".routing", "must be an object");
-		const r = w.routing;
-		if (r.order !== void 0) {
-			if (!Array.isArray(r.order) || r.order.some((x) => typeof x !== "string")) bad(".routing.order", "must be an array of provider names");
-			routing.order = r.order;
-		}
-		if (r.cooldownMinutes !== void 0 && typeof r.cooldownMinutes !== "number") bad(".routing.cooldownMinutes", "must be a number");
-		if (r.retryOnQuota !== void 0 && typeof r.retryOnQuota !== "boolean") bad(".routing.retryOnQuota", "must be boolean");
-		routing = {
-			order: routing.order,
-			cooldownMinutes: r.cooldownMinutes === void 0 ? DEFAULT_ROUTING.cooldownMinutes : r.cooldownMinutes,
-			retryOnQuota: r.retryOnQuota === void 0 ? DEFAULT_ROUTING.retryOnQuota : r.retryOnQuota === true
-		};
-	}
-	let tree = { ...DEFAULT_TREE };
-	if (w.tree !== void 0) {
-		if (typeof w.tree !== "object" || w.tree === null || Array.isArray(w.tree)) bad(".tree", "must be an object");
-		const t = w.tree;
-		if (t.maxDepth !== void 0) {
-			if (typeof t.maxDepth !== "number" || !Number.isInteger(t.maxDepth) || t.maxDepth < 0) bad(".tree.maxDepth", "must be a non-negative integer");
-		}
-		if (t.maxChildren !== void 0) {
-			if (typeof t.maxChildren !== "number" || !Number.isInteger(t.maxChildren) || t.maxChildren < 1) bad(".tree.maxChildren", "must be a positive integer");
-		}
-		tree = {
-			maxDepth: t.maxDepth === void 0 ? DEFAULT_TREE.maxDepth : t.maxDepth,
-			maxChildren: t.maxChildren === void 0 ? DEFAULT_TREE.maxChildren : t.maxChildren
-		};
-	}
-	const active = w.active === void 0 || w.active === null ? null : str(w.active);
-	if (active !== null && active !== "auto" && !(active in providers)) {}
-	return {
-		enabled: w.enabled === void 0 ? d.enabled : w.enabled === true,
-		active,
-		providers,
-		classes,
-		mcpSets,
-		pane,
-		logDir: str(w.logDir) || d.logDir,
-		routing,
-		tree
-	};
-}
-/**
-* Read the whole config file and return (raw, workers) — the raw record so
-* callers can rewrite it preserving every other section, the parsed+validated
-* workers section. Unreadable config throws (readJsonStrict), missing is fine.
-*/
-function readWorkersSection() {
-	const raw = readJsonStrict(CONFIG_FILE, "~/.config/pai/config.json");
-	return {
-		raw,
-		workers: parseWorkersConfig(raw.workers)
-	};
-}
-/** Write the workers section back into the config file, atomically. */
-function writeWorkersSection(raw, workers) {
-	raw.workers = workers;
-	writeJsonAtomic(CONFIG_FILE, raw, { label: "~/.config/pai/config.json" });
-}
-/** Expand a leading ~ (config values are written with `~` to stay portable). */
-function expandHome(p) {
-	if (p === "~" || p.startsWith("~/")) return join(homedir(), p.slice(1));
-	return p;
-}
-function assertProviderRunnable(name, p) {
-	if (p.protocol === "openai" && !p.upstreamUrl) throw new WorkersConfigError(`provider "${name}" uses protocol "openai" but has no upstreamUrl — set its Chat Completions base (e.g. "https://api.openai.com/v1") so the PAI proxy knows where to translate to.`);
-}
-/** Where a provider's key file lives, or null. Shared by run + test + add. */
-function providerKeyPath(p) {
-	return p.keyFile ? expandHome(p.keyFile) : null;
-}
-const DEFAULT_CONTEXT_WINDOW = 2e5;
-/** Cost tier of a provider for class filtering (unset = 3, the middle). */
-function providerCostTier(p) {
-	return p.costTier ?? DEFAULT_COST_TIER;
-}
-/** Context window used by the meter when the init event carries none. */
-function providerContextWindow(p) {
-	return p.contextWindow ?? DEFAULT_CONTEXT_WINDOW;
-}
-/** Directory under which inline keys (MCP `key` field) are stored, 0600. */
-function keysDir() {
-	return join(homedir(), ".config", "pai", "keys");
-}
-
-//#endregion
-//#region src/workers/paths.ts
-/**
-* paths.ts — where worker run artefacts live.
-*
-* Everything a run writes (event mirror, status file, pane registry, routing
-* state, the empty MCP config) sits under one logDir so the whole tree is
-* disposable and configurable: `workers.logDir`, default ~/.claude/logs/workers.
-*/
-/** Absolute logDir for the given config. */
-function workersLogDir(config) {
-	return expandHome(config.logDir);
-}
-function statusPath(logDir, id) {
-	return join(logDir, `${id}.status`);
-}
-function eventsPath(logDir, id) {
-	return join(logDir, `${id}.jsonl`);
-}
-function ledgerPath(logDir) {
-	return join(logDir, "ledger.log");
-}
-function routingStatePath(logDir) {
-	return join(logDir, "routing-state.json");
-}
-function panesDir(logDir) {
-	return join(logDir, "panes");
-}
-/**
-* The strict empty MCP config handed to headless workers. Written into the
-* logDir on demand (never into the user's vendor config directory — this is
-* PAI state, not vendor state).
-*/
-function noMcpConfigPath(logDir) {
-	return join(logDir, "no-mcp.json");
-}
-
-//#endregion
 //#region src/workers/args.ts
 function parseRunnerArgs(argv) {
 	let prompt = null;
@@ -603,11 +167,27 @@ function ledgerSummary(path, scope, lastN = 15, now = /* @__PURE__ */ new Date()
 * runner wrote, plus `provider` (routing is multi-provider now) and `session`
 * (the AIBroker identity of the launching session, see scope.ts).
 */
+/** Label a worker gets when launched with neither --label nor a prompt. */
+const UNLABELED = "unlabeled";
 /** Context-meter percentage 0–100, null when the numbers are missing. */
 function contextPercent(s) {
 	if (!s.contextTokens || !s.contextWindow) return null;
 	return Math.round(s.contextTokens / s.contextWindow * 100);
 }
+/** Compact token count: 84k, 200k, 900. */
+function fmtContextK(n) {
+	return n >= 1e3 ? `${Math.round(n / 1e3)}k` : String(n);
+}
+/**
+* The one context-meter label, shared by every renderer so identical
+* numbers always render identically: `ctx 84k/200k (42%)` — used-style
+* percent. Empty when the numbers are missing (callers drop the part).
+*/
+function contextLabel(s) {
+	const pct = contextPercent(s);
+	if (pct === null) return "";
+	return `ctx ${fmtContextK(s.contextTokens ?? 0)}/${fmtContextK(s.contextWindow ?? 0)} (${pct}%)`;
+}
 /** Timestamp format shared by status files and the ledger. */
 function nowStamp(d = /* @__PURE__ */ new Date()) {
 	const p = (n) => String(n).padStart(2, "0");
@@ -700,6 +280,12 @@ function describeTool(name, inp) {
 *      matches (AIBroker absent, unnamed session, non-iTerm terminal).
 *
 * If neither is available, viewers fall back to "all workers".
+*
+* A third case: workers spawned from a Claude Code Bash tool (the
+* orchestrator pattern) have neither — Claude Code exports no terminal or
+* session identity to its Bash children. Those record `spawnerSession`, the
+* orchestrator's claude session id bridged through the status line's
+* session map (see below), so their tab still claims them.
 */
 const AIBROKER_REGISTRY = join(homedir(), ".aibroker", "session-names.json");
 /**
@@ -769,213 +355,32 @@ function scopeKey(term) {
 function sessionTag(worker) {
 	return worker.session?.name ? `[${worker.session.name}]` : "";
 }
-
-//#endregion
-//#region src/workers/routing.ts
-/**
-* routing.ts — provider selection: flag > class > active (possibly "auto").
-*
-* Auto-routing walks `workers.routing.order` — or the class's own `order` —
-* and takes the first provider that is enabled, out of cooldown, (when it
-* defines a quotaProbe) under its quotaSkipAt threshold, and — when the class
-* constrains it — within `maxCostTier` and carrying all `requireTags`. A run
-* that dies of a quota/rate error puts its provider in cooldown for
-* cooldownMinutes; when that happens before the first tool call and
-* retryOnQuota is set, the runner restarts the same task on the next provider
-* (ledger: WORKER-REROUTE).
-*
-* An explicit --provider or a class mapping that pins a provider always
-* bypasses all of this.
-*/
-const QUOTA_SKIP_DEFAULT = 95;
-const PROBE_TIMEOUT_MS = 1e4;
-function readRoutingState(logDir) {
-	const path = routingStatePath(logDir);
-	if (!existsSync(path)) return { cooldowns: {} };
-	try {
-		return { cooldowns: JSON.parse(readFileSync(path, "utf8")).cooldowns ?? {} };
-	} catch {
-		return { cooldowns: {} };
-	}
-}
-function writeRoutingState(logDir, state) {
-	const path = routingStatePath(logDir);
-	const dir = dirname(path);
-	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-	const tmp = `${path}.tmp`;
-	writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n", "utf8");
-	renameSync(tmp, path);
-}
-function cooldownRemaining(state, provider, now = /* @__PURE__ */ new Date()) {
-	const end = state.cooldowns[provider];
-	if (!end) return 0;
-	const ms = Date.parse(end) - now.getTime();
-	return ms > 0 ? ms : 0;
-}
-function setCooldown(logDir, provider, minutes, now = /* @__PURE__ */ new Date()) {
-	const state = readRoutingState(logDir);
-	state.cooldowns[provider] = new Date(now.getTime() + minutes * 6e4).toISOString();
-	writeRoutingState(logDir, state);
-}
-function clearCooldown(logDir, provider) {
-	const state = readRoutingState(logDir);
-	if (!(provider in state.cooldowns)) return;
-	delete state.cooldowns[provider];
-	writeRoutingState(logDir, state);
+/** How old a map entry may be for a spawn to adopt it (status lines refresh constantly while a session lives). */
+const SPAWNER_SESSION_TTL_MS = 10 * 6e4;
+/** Map entries not refreshed within this window are pruned on write. */
+const SESSION_MAP_PRUNE_MS = 60 * 6e4;
+function sessionMapPath(logDir) {
+	return join(logDir, "claude-session-map.json");
 }
 /**
-* Run a provider's quotaProbe and return its percentage (0–100), or null when
-* there is no probe or it printed nothing usable. A probe must never break
-* routing: failures read as "unknown", not as "full".
+* The claude session a new run was spawned by, when it can be known: a run
+* inside another worker inherits its spawner (chain stages keep the
+* orchestrator's tab that way); otherwise a fresh map entry for `cwd`.
 */
-function probeQuota(provider) {
-	if (!provider.quotaProbe) return null;
+function resolveSpawnerSession(logDir, cwd, env = process.env, now = Date.now()) {
+	const parentId = env.PAI_WORKER_ID;
+	if (parentId) {
+		const inherited = loadStatus(logDir, parentId)?.spawnerSession;
+		if (inherited) return inherited;
+	}
+	const path = sessionMapPath(logDir);
+	if (!existsSync(path) || !cwd) return null;
 	try {
-		const m = execFileSync("/bin/sh", ["-c", provider.quotaProbe], {
-			timeout: PROBE_TIMEOUT_MS,
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).match(/(\d+(?:\.\d+)?)/);
-		if (!m) return null;
-		return Math.min(100, Math.max(0, Math.round(parseFloat(m[1]))));
-	} catch {
-		return null;
-	}
-}
-function quotaSkipThreshold(provider) {
-	return provider.quotaSkipAt ?? QUOTA_SKIP_DEFAULT;
-}
-/** Does this provider exceed its quota threshold right now? */
-function quotaExceeded(provider) {
-	const used = probeQuota(provider);
-	return used !== null && used >= quotaSkipThreshold(provider);
-}
-var NoProviderError = class extends WorkersConfigError {};
-function mustExist(config, name) {
-	const p = config.providers[name];
-	if (!p) throw new NoProviderError(`no worker provider named "${name}". Configured: ${Object.keys(config.providers).join(", ") || "(none)"}.\nAdd one with: pai worker providers add <name> --base-url <url> --key-file <path> --model <model>`);
-	return p;
-}
-function mustBeRunnable(name, p) {
-	if (!p.enabled) throw new NoProviderError(`provider "${name}" is disabled. Enable it with: pai worker providers enable ${name}`);
-	return p;
-}
-/** Why one provider of a routing order did not qualify (message fragment). */
-function exclusionReason(config, state, name, cls) {
-	const p = config.providers[name];
-	if (!p) return "not configured";
-	if (!p.enabled) return "disabled";
-	if (cooldownRemaining(state, name) > 0) return "cooldown";
-	if (quotaExceeded(p)) return "quota";
-	const tier = providerCostTier(p);
-	if (cls?.maxCostTier !== void 0 && tier > cls.maxCostTier) return `cost tier ${tier} > max ${cls.maxCostTier}`;
-	if (cls?.requireTags?.length) {
-		const have = p.tags ?? [];
-		const missing = cls.requireTags.filter((t) => !have.includes(t));
-		if (missing.length) return `missing tags: ${missing.join(", ")}`;
-	}
-	return null;
-}
-/**
-* Resolve which provider (and model alias) a run uses.
-*
-* @param flagProvider --provider value, highest precedence
-* @param className    --class value (the old --role), looked up in workers.classes
-*/
-function resolveTarget(config, logDir, opts = {}) {
-	if (opts.flagProvider) return {
-		providerName: opts.flagProvider,
-		provider: mustBeRunnable(opts.flagProvider, mustExist(config, opts.flagProvider)),
-		modelAlias: null,
-		classMcp: null,
-		via: "flag"
-	};
-	const clsTarget = opts.className ? config.classes[opts.className] : void 0;
-	const cls = typeof clsTarget === "object" && clsTarget !== null ? clsTarget : void 0;
-	if (opts.className && clsTarget !== void 0 && typeof clsTarget !== "object") {
-		const [name, alias] = clsTarget.split("/");
-		return {
-			providerName: name,
-			provider: mustBeRunnable(name, mustExist(config, name)),
-			modelAlias: alias ?? null,
-			classMcp: null,
-			via: "class"
-		};
-	}
-	if (opts.className && cls?.provider) {
-		const provider = mustBeRunnable(cls.provider, mustExist(config, cls.provider));
-		return {
-			providerName: cls.provider,
-			provider,
-			modelAlias: null,
-			classMcp: cls.mcp ?? null,
-			via: "class"
-		};
-	}
-	if (opts.className && clsTarget === void 0) {
-		if (!WORKER_CLASSES.includes(opts.className)) throw new NoProviderError(`no class named "${opts.className}". Standard classes: ${WORKER_CLASSES.join(", ")}.Defined: ${Object.keys(config.classes).join(", ") || "(none)"}.\nSet one with: pai worker classes set ${opts.className}=<provider[/alias]>`);
-	}
-	if (config.active !== "auto") {
-		const name = config.active;
-		if (!name) throw new NoProviderError("no active worker provider. Add one with: pai worker providers add <name> --base-url <url> --key-file <path> --model <model>\n(or point one that exists at it: pai worker providers use <name>)");
-		return {
-			providerName: name,
-			provider: mustBeRunnable(name, mustExist(config, name)),
-			modelAlias: null,
-			classMcp: null,
-			via: "active"
-		};
-	}
-	const state = readRoutingState(logDir);
-	const order = cls?.order ?? config.routing.order;
-	const excluded = [];
-	for (const name of order) {
-		const p = config.providers[name];
-		const why = exclusionReason(config, state, name, cls);
-		if (why) {
-			excluded.push(`${name}: ${why}`);
-			continue;
-		}
-		return {
-			providerName: name,
-			provider: p,
-			modelAlias: null,
-			classMcp: cls?.mcp ?? null,
-			via: "auto"
-		};
-	}
-	throw new NoProviderError(`auto-routing found no usable provider${opts.className ? ` for class "${opts.className}"` : ""} (order: [${order.join(", ")}]).${excluded.length ? `\nExcluded: ${excluded.join("; ")}.` : ""}\nClear a cooldown with: pai worker providers enable <name>; widen the class with: pai worker classes set ${opts.className ?? "<class>"}=<target>`);
-}
-/**
-* Next provider after `from` in auto order, applying the same filters.
-* Used by rerouting; null when the order is exhausted.
-*/
-function nextAutoProvider(config, logDir, from, now = /* @__PURE__ */ new Date()) {
-	const state = readRoutingState(logDir);
-	const order = config.routing.order;
-	const start = order.indexOf(from);
-	for (let i = start + 1; i < order.length; i++) {
-		const name = order[i];
-		const p = config.providers[name];
-		if (!p || !p.enabled) continue;
-		const end = state.cooldowns[name];
-		if (end && Date.parse(end) > now.getTime()) continue;
-		if (quotaExceeded(p)) continue;
-		return name;
-	}
+		const entry = JSON.parse(readFileSync(path, "utf8"))[cwd];
+		if (entry && entry.session && now - entry.ts < SPAWNER_SESSION_TTL_MS) return entry.session;
+	} catch {}
 	return null;
 }
-/**
-* Was this failure a quota/rate failure? Detected from the result text the
-* endpoint produced (HTTP status is not visible in the stream events).
-*/
-function isQuotaFailure(resultText) {
-	return /usage limit reached|rate limit|quota/i.test(resultText);
-}
 
 //#endregion
 //#region src/workers/pane.ts
@@ -987,7 +392,10 @@ function isQuotaFailure(resultText) {
 * one splits the lowest live worker pane horizontally, so panes stack top to
 * bottom. The split never sizes the new session — that would grow the whole
 * window; instead the window's bounds are read before the split and restored
-* right after, so the panes share the space the window already had. Each
+* right after, so the panes share the space the window already had. A split
+* would also make the new session the tab's active one — the scripts re-select
+* the launching session right after, so a pane opening never steals the
+* keystrokes the operator is typing. Each
 * pane runs `pai worker follow <id> --auto-exit <n>` under the `pai-worker`
 * dynamic profile (Close Sessions On End), so panes disappear by themselves.
 *
@@ -1066,6 +474,13 @@ const WORKER_SPLIT_SCRIPT = `on run(argv)
                         tell newS
                             write text followCmd
                         end tell
+                        -- a split makes the new session the tab's active one:
+                        -- re-select the launching session so keystrokes keep
+                        -- going where the operator was typing, not into the
+                        -- pane's chat prompt
+                        try
+                            select s
+                        end try
                         try
                             set bounds of w to winBounds
                         end try
@@ -1149,6 +564,11 @@ const SPLIT_SCRIPT = `on run(argv)
                         tell newS
                             write text followCmd
                         end tell
+                        -- keep the tab's active session where it was (see
+                        -- WORKER_SPLIT_SCRIPT)
+                        try
+                            select s
+                        end try
                         return "opened"
                     end if
                 end repeat
@@ -1476,9 +896,11 @@ function parentFromEnv(env = process.env) {
 * Depth of `id` in the worker forest: 0 for a top-level worker, 1 + the
 * parent's depth for a sub-worker. Parents without a status file (chain ids,
 * unknown ids) count as roots; a cycle reads as its own depth and is cut off
-* after the statuses it walked.
+* after the statuses it walked. `chatIsRoot` stops one level short of the
+* chat-pane tracker (origin "chat"): the status line treats the pane as the
+* bar itself, so the workers it spawned are its top level.
 */
-function workerDepth(statuses, id) {
+function workerDepth(statuses, id, opts) {
 	const byId = new Map(statuses.map((s) => [s.id, s]));
 	let depth = 0;
 	let cur = byId.get(id);
@@ -1487,7 +909,7 @@ function workerDepth(statuses, id) {
 		seen.add(cur.parent);
 		const next = byId.get(cur.parent);
 		if (!next) break;
-		depth += 1;
+		if (!(opts?.chatIsRoot && next.origin === "chat")) depth += 1;
 		cur = next;
 	}
 	return depth;
@@ -1722,7 +1144,7 @@ async function handoffFromInside(logDir, env, payload, deps = {}) {
 * commits its own work on that branch — the no-commit rule applies to the
 * main branch only — and the parent (or the operator) merges the result back:
 *
-*   pai worker merge <id>     git merge --no-ff worker/<id> + remove worktree
+*   pai worker merge <id>     git merge --no-ff worker/<id> + remove worktree + delete branch
 *   pai worker discard <id>   remove worktree and branch, keep nothing
 *
 * `ps` marks a worker with an unmerged branch `⎇`. Draft and review run in
@@ -1873,26 +1295,160 @@ function removeWorktree(cwd, dir, force) {
 	} catch {}
 }
 /**
-* `pai worker merge <id>`: merge the worker's branch into the original
-* checkout with --no-ff (the merge commit names the worker), then remove the
-* worktree. The branch stays for the record; the status gains `merged: true`.
+* Tracked changes (staged or not) plus untracked files — everything a
+* `git add -A` in `wtDir` would commit. The same two calls the old patch
+* carry used; name-only, not porcelain: a worktree-only change renders as
+* " M path" and the shared git() helper trims that leading space away.
+*/
+function uncommittedPaths(wtDir) {
+	const tracked = git(wtDir, [
+		"diff",
+		"--name-only",
+		"HEAD"
+	]).split("\n").filter(Boolean);
+	const untracked = git(wtDir, [
+		"ls-files",
+		"--others",
+		"--exclude-standard"
+	]).split("\n").filter(Boolean);
+	return [...tracked, ...untracked];
+}
+/**
+* Commit a worktree's uncommitted changes to its branch so the merge carries
+* them. `git merge` only moves committed work, so a worker that stopped
+* without committing would lose its edits to `worktree remove` — exactly
+* what happened live on 2026-09-17. Returns the salvaged paths, [] when the
+* worktree is clean. A failed commit throws with the worktree untouched:
+* its edits are still on disk, so nothing is lost.
+*/
+function salvageUncommitted(wtDir, label) {
+	const paths = uncommittedPaths(wtDir);
+	if (!paths.length) return [];
+	try {
+		git(wtDir, ["add", "-A"]);
+		git(wtDir, [
+			"commit",
+			"-m",
+			`salvaged: ${label}`
+		]);
+	} catch (e) {
+		throw new Error(`cannot salvage the uncommitted changes in ${wtDir} — ${e.message}; nothing was lost: commit them there by hand, then re-run merge`);
+	}
+	return paths;
+}
+/**
+* The dirty paths of a checkout, parsed from `git status --porcelain -z`:
+* NUL-separated (a path with a newline in it cannot corrupt the parse),
+* rename entries contribute both sides, and any quoting is stripped.
+*/
+function dirtyPaths(cwd) {
+	const fields = execFileSync("git", [
+		"-C",
+		cwd,
+		"status",
+		"--porcelain",
+		"-z"
+	], {
+		encoding: "utf8",
+		timeout: 3e4,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	}).split("\0");
+	const strip = (p) => p.startsWith("\"") && p.endsWith("\"") ? p.slice(1, -1) : p;
+	const out = [];
+	for (let i = 0; i < fields.length; i++) {
+		const f = fields[i];
+		if (!f || f.length < 4 || f.charAt(2) !== " ") continue;
+		out.push(strip(f.slice(3)));
+		const xy = f.slice(0, 2);
+		if (xy.includes("R") || xy.includes("C")) {
+			const orig = fields[i + 1];
+			if (orig && orig.charAt(2) !== " ") {
+				out.push(strip(orig));
+				i += 1;
+			}
+		}
+	}
+	return out;
+}
+/**
+* Refuse the merge when the original checkout is dirty in paths the branch
+* touches: the merge would overwrite those edits or fail on them, either way
+* leaving a half-state. No merge is made, the worktree stays.
+*/
+function assertNoDirtyOverlap(cwd, incoming, id, branch) {
+	const dirty = new Set(dirtyPaths(cwd));
+	const overlap = [...new Set(incoming)].filter((p) => dirty.has(p)).sort();
+	if (!overlap.length) return;
+	throw new Error(`worker ${id}: the checkout ${cwd} has uncommitted changes in paths ${branch} touches: ${overlap.join(", ")}. Commit or stash them in the checkout, then re-run: pai worker merge ${id}. No merge was made; the worktree was kept.`);
+}
+/** Never remove a worktree that still holds uncommitted changes. */
+function assertWorktreeClean(wtDir, id) {
+	const leftover = uncommittedPaths(wtDir);
+	if (leftover.length) throw new Error(`worker ${id}: the worktree ${wtDir} still holds uncommitted changes (${leftover.join(", ")}) — it was NOT removed; commit or copy them by hand, then re-run merge`);
+}
+/**
+* `pai worker merge <id>`: salvage whatever the worker left uncommitted onto
+* its branch, refuse when the original checkout is dirty in paths the branch
+* touches, merge with --no-ff (the merge commit names the worker), then
+* remove the worktree and delete the branch; the status gains `merged: true`.
+* A branch with nothing to merge is refused loudly — after salvage that
+* genuinely means it holds nothing, and reporting success there would
+* destroy the worktree for no gain.
 */
 function mergeWorker(logDir, id) {
 	const st = mustHaveBranch(logDir, id);
 	if (st.merged) return `worker ${id}: branch ${st.branch} already merged`;
-	git(st.cwd, [
-		"merge",
-		"--no-ff",
-		st.branch,
-		"-m",
-		`merge worker ${id} (${st.label})`
+	const salvaged = existsSync(st.worktreeDir) ? salvageUncommitted(st.worktreeDir, st.label || UNLABELED) : [];
+	if ((parseInt(git(st.cwd, [
+		"rev-list",
+		"--count",
+		`HEAD..${st.branch}`
+	]), 10) || 0) <= 0) throw new Error(`worker ${id}: branch ${st.branch} has no commits to merge. The worktree ${st.worktreeDir} was NOT removed — uncommitted work there would be destroyed. Commit it yourself, or drop everything with: pai worker discard ${id}`);
+	const mergeBase = git(st.cwd, [
+		"merge-base",
+		"HEAD",
+		st.branch
 	]);
+	const incomingPaths = git(st.cwd, [
+		"diff",
+		"--name-only",
+		mergeBase,
+		st.branch
+	]).split("\n").filter(Boolean);
+	assertNoDirtyOverlap(st.cwd, incomingPaths, id, st.branch);
+	try {
+		git(st.cwd, [
+			"merge",
+			"--no-ff",
+			st.branch,
+			"-m",
+			`merge worker ${id} (${st.label})`
+		]);
+	} catch (e) {
+		throw new Error(`worker ${id}: git refused the merge of ${st.branch} — ${e.message}. The worktree ${st.worktreeDir} was kept: resolve the conflict, then re-run merge`);
+	}
+	if (existsSync(st.worktreeDir)) assertWorktreeClean(st.worktreeDir, id);
 	removeWorktree(st.cwd, st.worktreeDir, false);
+	let branchGone = true;
+	try {
+		git(st.cwd, [
+			"branch",
+			"-d",
+			st.branch
+		]);
+	} catch {
+		branchGone = false;
+	}
 	saveStatus(logDir, {
 		...st,
 		merged: true
 	});
-	return `merged ${st.branch} into ${st.cwd} (worktree removed)`;
+	const base = `merged ${st.branch} into ${st.cwd} (worktree removed${branchGone ? ", branch deleted" : "; branch kept: git refused -d"})`;
+	return salvaged.length ? `${base}; salvaged ${salvaged.length} uncommitted change(s): ${salvaged.join(", ")}` : base;
 }
 /** `pai worker discard <id>`: drop worktree and branch, keep nothing. */
 function discardWorker(logDir, id) {
@@ -1936,7 +1492,8 @@ function worktreeSystemPrompt(id, branch, dir) {
 		`  ${dir} on branch ${branch} (worker id ${id}).`,
 		"Commit your work on that branch as you go (git add / git commit) — committing here is expected;",
 		"the no-commit rule applies to the main branch only, and this is not it.",
-		"Do not merge, rebase or push; the operator merges your branch back with `pai worker merge`."
+		"Do not merge, rebase or push; the operator merges your branch back with `pai worker merge`.",
+		"Use ONLY relative paths inside the worktree, never absolute worktree paths — absolute paths break after merge and leak machine layout."
 	].join("\n");
 }
 
@@ -1961,6 +1518,8 @@ const WORKER_CONTRACT_PROMPT = [
 	"changed: files you touched (path + one-line summary). commands: the commands that verify the work.",
 	"checks: each with ok true/false and the evidence in detail. open: what you could not finish, if anything.",
 	"notes: one line, the headline a reviewer reads first.",
+	"Never write shell heredocs — write the script to a file with the Write tool, then run it",
+	"(heredocs fail silently or get swallowed).",
 	"",
 	`Operator messages: a user turn starting with ${OPERATOR_MARK} was typed by the operator while you`,
 	"run (the prompt of a resumed run is the operator's too). Answer it FIRST, in one or two plain lines —",
@@ -2123,101 +1682,6 @@ function describeMcp(config, claudeJson = CLAUDE_JSON) {
 	return lines;
 }
 
-//#endregion
-//#region src/workers/proxy/server.ts
-/**
-* server.ts — the PAI worker proxy: Anthropic Messages API on the front,
-* OpenAI Chat Completions on the back, loopback only.
-*
-* One proxy serves every OpenAI-protocol provider: Claude Code points
-* ANTHROPIC_BASE_URL at `http://127.0.0.1:8797/<provider>` and the provider
-* name in the path selects the upstream (`upstreamUrl` + `keyFile` from the
-* workers config, re-read per request so config edits apply without a
-* restart). `run` starts the proxy on demand (detached, pid file under the
-* logDir) and `pai worker proxy stop` stops it again.
-*
-* All translation lives in translate.ts; this file is only HTTP plumbing.
-*/
-const DEFAULT_PROXY_PORT = 8797;
-const HOST = "127.0.0.1";
-function proxyPidPath(logDir) {
-	return join(logDir, "proxy.pid");
-}
-/** True when something already accepts connections on the port. */
-function proxyListening(port = DEFAULT_PROXY_PORT, timeoutMs = 400) {
-	return new Promise((resolve) => {
-		const sock = connect({
-			port,
-			host: HOST
-		});
-		const done = (ok) => {
-			sock.removeAllListeners();
-			sock.destroy();
-			resolve(ok);
-		};
-		sock.setTimeout(timeoutMs, () => done(false));
-		sock.once("connect", () => done(true));
-		sock.once("error", () => done(false));
-	});
-}
-/**
-* Where the standalone proxy artefact lives, found from this module's own
-* location (dist/cli bundle → ../hooks/, dev checkout → <repo>/dist/hooks).
-*/
-function standaloneProxyPath() {
-	let dir = dirname(fileURLToPath(import.meta.url));
-	for (let i = 0; i < 6; i++) {
-		for (const cand of [
-			join(dir, "worker-proxy.mjs"),
-			join(dir, "hooks", "worker-proxy.mjs"),
-			join(dir, "dist", "hooks", "worker-proxy.mjs")
-		]) if (existsSync(cand)) return cand;
-		const parent = dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return null;
-}
-/**
-* Ensure a proxy is listening on the port; start the detached standalone when
-* nothing answers. Returns the base URL (`http://127.0.0.1:<port>`).
-*/
-async function ensureProxyRunning(port, logDir) {
-	if (await proxyListening(port)) return `http://${HOST}:${port}`;
-	const script = standaloneProxyPath();
-	if (!script) throw new Error(`the PAI worker proxy is not running and its build was not found — run \`bun run build\` (or start one with: pai worker proxy --port ${port})`);
-	if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
-	const child = spawn(process.execPath, [
-		script,
-		"--port",
-		String(port)
-	], {
-		detached: true,
-		stdio: "ignore"
-	});
-	child.unref();
-	writeFileSync(proxyPidPath(logDir), `${child.pid}\n`, "utf8");
-	for (let i = 0; i < 40; i++) {
-		if (await proxyListening(port)) return `http://${HOST}:${port}`;
-		await new Promise((r) => setTimeout(r, 250));
-	}
-	throw new Error(`the PAI worker proxy did not come up on port ${port} (see ${proxyPidPath(logDir)})`);
-}
-/** `pai worker proxy stop`: SIGTERM the pid from the pid file. */
-function stopProxy(logDir) {
-	const path = proxyPidPath(logDir);
-	if (!existsSync(path)) return "no proxy pid file — nothing to stop";
-	const pid = parseInt(readFileSync(path, "utf8").trim(), 10);
-	unlinkSync(path);
-	if (!Number.isFinite(pid)) return "stale proxy pid file removed";
-	try {
-		process.kill(pid, "SIGTERM");
-	} catch {
-		return `proxy pid ${pid} was not running (pid file removed)`;
-	}
-	return `proxy pid ${pid} stopped`;
-}
-
 //#endregion
 //#region src/workers/codex.ts
 /**
@@ -2413,34 +1877,6 @@ function codexInstalled() {
 * Auto-routed runs that die of a quota error before the first tool call are
 * restarted on the next provider in routing order (WORKER-REROUTE ledger line).
 */
-/** Environment for a run through `provider`. Caller's env minus the Anthropic key. */
-function buildRunEnv(provider, headless, proxyUrl) {
-	const env = { ...process.env };
-	delete env.ANTHROPIC_API_KEY;
-	let token = "local";
-	if (proxyUrl) env.ANTHROPIC_BASE_URL = proxyUrl;
-	else {
-		const keyPath = providerKeyPath(provider);
-		if (keyPath) {
-			try {
-				token = readFileSync(keyPath, "utf8").trim();
-			} catch {
-				throw new Error(`key file not readable: ${keyPath}`);
-			}
-			if (!token) throw new Error(`key file is empty: ${keyPath}`);
-		}
-		env.ANTHROPIC_BASE_URL = provider.baseUrl;
-	}
-	env.ANTHROPIC_AUTH_TOKEN = token;
-	env.ANTHROPIC_DEFAULT_HAIKU_MODEL = provider.models.fast ?? provider.models.default;
-	env.ANTHROPIC_DEFAULT_SONNET_MODEL = provider.models.default;
-	env.ANTHROPIC_DEFAULT_OPUS_MODEL = provider.models.default;
-	for (const [k, v] of Object.entries(provider.env)) env[k] = v;
-	env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1";
-	if (headless) env.PAI_WORKER = "1";
-	else env.ENABLE_TOOL_SEARCH = "true";
-	return env;
-}
 /** The strict empty MCP config for headless workers, written on demand. */
 function ensureNoMcpConfig(logDir) {
 	const path = noMcpConfigPath(logDir);
@@ -2484,10 +1920,35 @@ function usageContextTokens(u) {
 	const t = (u.input_tokens ?? 0) + (u.cache_read_input_tokens ?? 0) + (u.cache_creation_input_tokens ?? 0) + (u.output_tokens ?? 0);
 	return t > 0 ? t : null;
 }
+/**
+* Context never shrinks mid-segment, so the status keeps the high-water
+* mark of the usage it has seen: a smaller later reading (short reply,
+* sidechain answer) must not drag the meter down. Compaction is the one
+* legitimate drop — see `resetContextTokensOnCompact`.
+*/
+function bumpContextTokens(status, tokens) {
+	if (tokens === null || tokens <= 0) return;
+	status.contextTokens = Math.max(status.contextTokens ?? 0, tokens);
+}
+/**
+* A compact boundary (`system`/`compact_boundary`, the shape Claude Code
+* writes with `compactMetadata.preTokens`; `compact` kept as the older
+* spelling) legitimately restarts the context at a lower size: the floor
+* drops to the event's own usage — usually none — so the next usage
+* reading re-seeds the meter at the fresh, smaller context.
+*/
+function resetContextTokensOnCompact(status, e) {
+	status.contextTokens = usageContextTokens(e.usage) ?? null;
+}
+/** A compact boundary in a worker's stream, in either event spelling. */
+function isCompactBoundary(e) {
+	return e.type === "system" && (e.subtype === "compact_boundary" || e.subtype === "compact");
+}
 /** Context window announced by the init event, when the endpoint sends one. */
 function initContextWindow(e) {
 	if (typeof e.context_window === "number" && e.context_window > 0) return e.context_window;
 	if (e.model_info && typeof e.model_info.context_window === "number" && e.model_info.context_window > 0) return e.model_info.context_window;
+	if (/\[1m\]$/.test((e.model ?? "").trim())) return 1e6;
 	return null;
 }
 /**
@@ -2500,7 +1961,7 @@ async function runWorker(opts) {
 	const logDir = workersLogDir(config);
 	mkdirSync(logDir, { recursive: true });
 	if (opts.className === "plan" && !opts._planner) {
-		const { runPlanner } = await import("./planner-BDI7bE9B.mjs");
+		const { runPlanner } = await import("./planner-Cm3g6fWH.mjs");
 		return runPlanner(opts);
 	}
 	const parent = launchParent(opts.parent);
@@ -2511,8 +1972,10 @@ async function runWorker(opts) {
 	});
 	assertProviderRunnable(target.providerName, target.provider);
 	const parsed = parseRunnerArgs(opts.claudeArgs);
-	const label = opts.label ?? shortText(parsed.prompt ?? "(no prompt)", 70);
-	const model = opts.modelFlag ?? (target.modelAlias === "fast" ? target.provider.models.fast ?? target.provider.models.default : target.provider.models.default);
+	const label = opts.label ?? shortText(parsed.prompt ?? UNLABELED, 70);
+	const alias = target.modelAlias;
+	const capability = alias && isModelCapability(alias) ? alias : classModelCapability(opts.className);
+	const model = opts.modelFlag ?? resolveModelCapability(target.provider, capability);
 	try {
 		if (target.provider.engine === "codex") return await executeCodexRun({
 			config,
@@ -2567,6 +2030,7 @@ async function executeRun(a) {
 	const cwd = a.cwd ?? process.cwd();
 	const term = process.env.ITERM_SESSION_ID ?? "";
 	const session = resolveSession(term);
+	const spawnerSession = resolveSpawnerSession(logDir, cwd);
 	let worktree = null;
 	if (headless && worktreeWanted(a.worktreeFlag, {
 		cwd,
@@ -2599,8 +2063,9 @@ async function executeRun(a) {
 		last: headless ? "starting" : "interactive",
 		rc: null,
 		secs: null,
+		origin: headless ? "spawn" : "chat",
 		...session ? { session } : {},
-		contextWindow: providerContextWindow(target.provider),
+		...spawnerSession ? { spawnerSession } : {},
 		...a.parent ? {
 			parent: a.parent,
 			stage: a.stage
@@ -2749,10 +2214,12 @@ async function executeRun(a) {
 				const cw = initContextWindow(e);
 				if (cw) status.contextWindow = cw;
 				saveStatus(logDir, status);
+			} else if (isCompactBoundary(e)) {
+				resetContextTokensOnCompact(status, e);
+				saveStatus(logDir, status);
 			} else if (e.type === "assistant") {
 				status.turns += 1;
-				const tokens = usageContextTokens(e.message?.usage);
-				if (tokens) status.contextTokens = tokens;
+				bumpContextTokens(status, usageContextTokens(e.message?.usage));
 				for (const block of e.message?.content ?? []) if (block.type === "tool_use") {
 					status.tools += 1;
 					status.last = describeTool(block.name ?? "?", block.input);
@@ -2760,7 +2227,8 @@ async function executeRun(a) {
 				saveStatus(logDir, status);
 			} else if (e.type === "result") {
 				const tokens = usageContextTokens(e.usage);
-				if (tokens) status.contextTokens = tokens;
+				if (e.is_compact) status.contextTokens = tokens ?? status.contextTokens;
+				else bumpContextTokens(status, tokens);
 				const report = parseWorkerReport(e.result ?? "");
 				if (report?.notes) status.last = shortText(report.notes, 90);
 				else if (e.result) status.last = shortText(e.result, 90);
@@ -2861,6 +2329,7 @@ async function executeCodexRun(a) {
 	const cwd = a.cwd ?? process.cwd();
 	const term = process.env.ITERM_SESSION_ID ?? "";
 	const session = resolveSession(term);
+	const spawnerSession = resolveSpawnerSession(logDir, cwd);
 	let worktree = null;
 	if (worktreeWanted(a.worktreeFlag, {
 		cwd,
@@ -2894,8 +2363,10 @@ async function executeCodexRun(a) {
 		last: "starting",
 		rc: null,
 		secs: null,
+		origin: "spawn",
 		...session ? { session } : {},
-		contextWindow: providerContextWindow(target.provider),
+		...spawnerSession ? { spawnerSession } : {},
+		...target.provider.contextWindow ? { contextWindow: target.provider.contextWindow } : {},
 		...a.parent ? {
 			parent: a.parent,
 			stage: a.stage
@@ -2948,7 +2419,8 @@ async function executeCodexRun(a) {
 		type: "system",
 		subtype: "init",
 		model,
-		cwd
+		cwd,
+		...target.provider.contextWindow ? { context_window: target.provider.contextWindow } : {}
 	});
 	let killed = false;
 	process.once("SIGTERM", onCodexSignal("SIGTERM"));
@@ -2976,7 +2448,7 @@ async function executeCodexRun(a) {
 		status.turns = fold.turns;
 		status.tools = fold.tools;
 		if (fold.last) status.last = shortText(fold.last, 90);
-		if (fold.contextTokens) status.contextTokens = fold.contextTokens;
+		bumpContextTokens(status, fold.contextTokens);
 		saveStatus(logDir, status);
 		for (const ev of fold.events.splice(0)) writeEvent(ev);
 	});
@@ -3321,5 +2793,5 @@ async function runChain(opts, deps = {}) {
 }
 
 //#endregion
-export { contextPercent as A, workersLogDir as B, quotaSkipThreshold as C, workerInScope as D, sessionTag as E, ledgerSummary as F, keysDir as G, PROVIDER_TAGS as H, parseRunnerArgs as I, readWorkersSection as J, parseWorkersConfig as K, shortText as L, loadStatuses as M, newWorkerId as N, ageOf as O, appendLedger as P, eventsPath as R, probeQuota as S, resolveSession as T, WorkersConfigError as U, DEFAULT_LOG_DIR as V, expandHome as W, readJsonStrict as X, writeWorkersSection as Y, writeJsonAtomic as Z, workerDepth as _, testProvider as a, openPaneForWorker as b, stopProxy as c, renderReport as d, discardWorker as f, sayToWorker as g, readInbox as h, runWorker as i, loadStatus as j, alive as k, describeMcp as l, handoffFromInside as m, swapPromptArg as n, DEFAULT_PROXY_PORT as o, mergeWorker as p, providerCostTier as q, printResult as r, ensureProxyRunning as s, runChain as t, parseWorkerReport as u, checkPaneForWorker as v, currentTabKey as w, clearCooldown as x, openFollowPane as y, ledgerPath as z };
-//# sourceMappingURL=chain-CTtHligI.mjs.map
+export { appendLedger as A, ageOf as C, loadStatus as D, contextPercent as E, parseRunnerArgs as M, shortText as N, loadStatuses as O, UNLABELED as S, contextLabel as T, openPaneForWorker as _, testProvider as a, sessionTag as b, renderReport as c, handoffFromInside as d, readInbox as f, openFollowPane as g, checkPaneForWorker as h, runWorker as i, ledgerSummary as j, newWorkerId as k, discardWorker as l, workerDepth as m, swapPromptArg as n, describeMcp as o, sayToWorker as p, printResult as r, parseWorkerReport as s, runChain as t, mergeWorker as u, currentTabKey as v, alive as w, workerInScope as x, resolveSession as y };
+//# sourceMappingURL=chain-DhVHVnmT.mjs.map