@tekmidian/pai 0.42.4 → 0.42.6

package/statusline-command.sh

@@ -32,11 +32,68 @@ input=$(cat)
 DA_NAME="${DA:-Assistant}"  # Assistant name
 DA_COLOR="${DA_COLOR:-purple}"  # Color for the assistant name
 
-# Extract data from JSON input
-current_dir=$(echo "$input" | jq -r '.workspace.current_dir')
-model_name=$(echo "$input" | jq -r '.model.display_name')
-model_id=$(echo "$input" | jq -r '.model.id // .model.display_name // empty')
-cc_version=$(echo "$input" | jq -r '.version // "unknown"')
+# Where the status line keeps what it may cache between renders: the usage
+# snapshots per provider and the Claude Code version. One knob rather than a
+# path repeated six times, so a test (or a second user on the same machine)
+# can point the whole lot somewhere private.
+pai_cache_dir="${PAI_CACHE_DIR:-/tmp/claude}"
+
+# PAI's per-user namespace dir — see src/config/pai-home.ts (paiHomeDir) for
+# the canonical (TypeScript) version of this same resolver; this script
+# can't import that module, so the new/old fallback logic is duplicated here.
+pai_home_dir="${PAI_HOME:-$HOME/.claude/pai}"
+
+# Resolve a PAI per-user file: the new PAI_HOME path if it exists, else the
+# first existing old candidate (args 2+), else the new path. Mirrors
+# resolvePaiFile() in src/config/pai-home.ts.
+_pai_resolve_file() {
+    _new="$1"; shift
+    [ -f "$_new" ] && { printf '%s' "$_new"; return; }
+    for _old in "$@"; do
+        if [ -f "$_old" ]; then
+            printf 'pai: %s is at an old location — run `pai config migrate` to move it to %s\n' "$_old" "$_new" >&2
+            printf '%s' "$_old"
+            return
+        fi
+    done
+    printf '%s' "$_new"
+}
+
+# Extract data from JSON input.
+#
+# `.workspace.current_dir` is the documented field and a full session always
+# sends it — but `jq -r` prints the JSON null as the four characters "null"
+# when it is absent, and `basename null` is "null", so any payload without a
+# workspace block rendered a confident "📁 null". A folder name is never
+# unknowable here: the payload also carries the flat `.cwd`, and failing both
+# we are running in the directory ourselves. Fall through all three.
+current_dir=$(echo "$input" | jq -r '.workspace.current_dir // .cwd // empty' 2>/dev/null)
+[ -n "$current_dir" ] && [ "$current_dir" != "null" ] || current_dir="${PWD:-}"
+model_name=$(echo "$input" | jq -r '.model.display_name // empty' 2>/dev/null)
+[ -n "$model_name" ] || model_name="?"
+model_id=$(echo "$input" | jq -r '.model.id // .model.display_name // empty' 2>/dev/null)
+
+# Claude Code version. The payload carries `.version` as a plain string, but a
+# caller that sends a partial payload (a test harness, an older client) left it
+# rendering the literal word "unknown" next to a version that `claude --version`
+# would have answered immediately. Ask the binary, and cache the answer for a
+# day: it is a ~200MB executable and the status line runs on every keystroke.
+cc_version=$(echo "$input" | jq -r '.version // empty' 2>/dev/null)
+if [ -z "$cc_version" ]; then
+    _ccv_cache="${pai_cache_dir}/cc-version"
+    _ccv_age=$(( $(date +%s) - $(stat -f %m "$_ccv_cache" 2>/dev/null || echo 0) ))
+    if [ -s "$_ccv_cache" ] && [ "$_ccv_age" -lt 86400 ] 2>/dev/null; then
+        read -r cc_version < "$_ccv_cache"
+    elif command -v claude >/dev/null 2>&1; then
+        # "2.1.267 (Claude Code)" -> "2.1.267"
+        cc_version=$(command claude --version 2>/dev/null | awk 'NR==1{print $1}')
+        if [ -n "$cc_version" ]; then
+            mkdir -p "$pai_cache_dir" 2>/dev/null
+            printf '%s\n' "$cc_version" > "$_ccv_cache" 2>/dev/null || true
+        fi
+    fi
+fi
+[ -n "$cc_version" ] || cc_version="?"
 
 # Provider detection: which worker provider is this session running on? The
 # answer comes from the PAI config, not from model-name prefixes — a session
@@ -44,7 +101,19 @@ cc_version=$(echo "$input" | jq -r '.version // "unknown"')
 # Any [...] suffix (e.g. the [1m] context marker) is stripped on both sides,
 # so a session on "glm-5.3[1m]" matches a configured "glm-5.3" and vice versa.
 # No config, no jq, unreadable JSON or no match => anthropic, silently.
-pai_config="${PAI_CONFIG:-${XDG_CONFIG_HOME:-$HOME/.config}/pai/config.json}"
+# PAI_HOME (~/.claude/pai by default — see src/config/pai-home.ts) first;
+# else fall back through the pre-2026-09-19 locations in the same order
+# paiConfigFilePath() in src/daemon/config.ts does, since a shell script
+# can't import that resolver.
+pai_home_dir="${PAI_HOME:-$HOME/.claude/pai}"
+pai_config="${PAI_CONFIG:-$pai_home_dir/config.json}"
+if [ ! -f "$pai_config" ]; then
+    if [ -f "$HOME/.claude/pai.json" ]; then
+        pai_config="$HOME/.claude/pai.json"
+    elif [ -f "${XDG_CONFIG_HOME:-$HOME/.config}/pai/config.json" ]; then
+        pai_config="${XDG_CONFIG_HOME:-$HOME/.config}/pai/config.json"
+    fi
+fi
 model_base="${model_id%%\[*}"
 session_provider=anthropic
 if [ -n "$model_base" ] && [ -f "$pai_config" ] && command -v jq >/dev/null 2>&1; then
@@ -58,7 +127,8 @@ if [ -n "$model_base" ] && [ -f "$pai_config" ] && command -v jq >/dev/null 2>&1
 fi
 
 # Get directory name
-dir_name=$(basename "$current_dir")
+dir_name=$(basename "$current_dir" 2>/dev/null)
+[ -n "$dir_name" ] || dir_name="?"
 
 # Read Whazaa session name from iTerm2 user variable
 pai_session_name=""
@@ -372,80 +442,175 @@ fi
 printf "${LINE2_PRIMARY}${EMOJI_PLUG} MCPs${RESET}${LINE2_PRIMARY}${SEPARATOR_COLOR}: ${RESET}${mcp_line1}${RESET}\n"
 
 
-# Usage suffix: provider-aware. The built-in anthropic provider reads the
-# Claude Code OAuth usage endpoint (5-hour + 1d pace + 7-day); every other
-# provider is rendered from its own `usage` block in the PAI config (see
-# docs/provider-abstraction.md) — endpoint, auth header and per-window jq
-# expressions are config, not code. Both paths cache for usage_cache_ttl.
-usage_cache="/tmp/claude/statusline-usage-cache.json"
-usage_cache_ttl=60  # seconds
+# Usage suffix: provider-aware. Every non-anthropic provider is rendered from
+# its own `usage` block in the PAI config (see docs/provider-abstraction.md) —
+# endpoint, auth header and per-window jq expressions are config, not code.
+#
+# The anthropic numbers come from Claude Code itself. Its status line payload
+# carries a `rate_limits` object built from the same internal reading that
+# /usage renders:
+#
+#     "rate_limits": {
+#       "five_hour": { "used_percentage": 9, "resets_at": 1789810200 },
+#       "seven_day": { "used_percentage": 2, "resets_at": 1790402400 }
+#     }
+#
+# `used_percentage` is already 0-100 (used, not remaining) and `resets_at` is
+# Unix epoch SECONDS. It is live, free and needs no credential.
+#
+# The OAuth usage endpoint below stays only as a fallback for payloads that
+# carry no rate_limits (it reports `utilization` on the same 0-100 scale but
+# `resets_at` as an ISO-8601 UTC string, so the two are parsed differently).
+# That endpoint needs an OAuth token out of the Keychain, and when the token
+# goes away the fetch fails silently and leaves whatever it cached last. A
+# cache with no expiry is not a reading, it is a photograph: this one sat at
+# "7d: 97%" for a day and a half after the window had already reset to 2%, and
+# that number is not decoration — it is written to advisor-mode.json and
+# injected into every session as an instruction about how much work to do. So
+# the fallback is refused once it is older than usage_cache_max_age, and any
+# window whose resets_at has already passed is dropped. What neither source can
+# answer renders "?", which is the honest reading.
+usage_cache="${pai_cache_dir}/statusline-usage-cache.json"
+usage_cache_ttl=60       # refetch the fallback after this many seconds
+usage_cache_max_age=300  # refuse to render from the fallback past this age
 usage_suffix=""
 
-# Color based on utilization: green < 50%, yellow 50-75%, red > 75%
+# Color based on utilization: green < 50%, orange 50-75%, red > 75%.
+# An unknown percentage is neither good nor bad news — render it neutral.
 _usage_color() {
     local pct=$1
-    if [ "$pct" -gt 75 ] 2>/dev/null; then echo "$BRIGHT_RED"
-    elif [ "$pct" -gt 50 ] 2>/dev/null; then echo "$BRIGHT_YELLOW"
+    if [ -z "$pct" ]; then echo "$LINE3_ACCENT"
+    elif [ "$pct" -gt 75 ] 2>/dev/null; then echo "$BRIGHT_RED"
+    elif [ "$pct" -gt 50 ] 2>/dev/null; then echo "$BRIGHT_ORANGE"
     else echo "$BRIGHT_GREEN"; fi
 }
 
 _fetch_usage() {
     # Try to get OAuth token from macOS Keychain
     local token=""
-    token=$(security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null | jq -r '.claudeAiOauth.accessToken // empty' 2>/dev/null)
-    [ -z "$token" ] && return
+    # More than one keychain item can carry this service name: the real one is
+    # stored under the login user account, and a stub with empty tokens has
+    # been seen under acct "unknown". Without -a the first match wins, so ask
+    # for the user item first and only then fall back to an unqualified read.
+    local raw
+    raw=$(security find-generic-password -s "Claude Code-credentials" -a "$(id -un)" -w 2>/dev/null)
+    token=$(printf '%s' "$raw" | jq -r '.claudeAiOauth.accessToken // empty' 2>/dev/null)
+    if [ -z "$token" ]; then
+        raw=$(security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null)
+        token=$(printf '%s' "$raw" | jq -r '.claudeAiOauth.accessToken // empty' 2>/dev/null)
+    fi
 
-    mkdir -p /tmp/claude
-    local response
-    response=$(curl -sf --max-time 3 \
+    mkdir -p "$pai_cache_dir"
+    if [ -z "$token" ]; then
+        echo "no usable OAuth token in keychain item Claude Code-credentials" > "$usage_cache.error"
+        return
+    fi
+    # Per-process temp file: several renders may fetch at once.
+    local tmp="$usage_cache.tmp.$$" http
+    http=$(curl -s --max-time 3 -o "$tmp" -w '%{http_code}' \
         -H "Authorization: Bearer $token" \
         -H "anthropic-beta: oauth-2025-04-20" \
         "https://api.anthropic.com/api/oauth/usage" 2>/dev/null)
-    [ -n "$response" ] && echo "$response" > "$usage_cache"
+    if [ "$http" = "200" ] && [ -s "$tmp" ]; then
+        mv -f "$tmp" "$usage_cache"
+        rm -f "$usage_cache.error"
+    else
+        echo "usage fetch failed: http ${http:-timeout}" > "$usage_cache.error"
+        rm -f "$tmp"
+    fi
 }
 
-# Use cache if fresh, otherwise fetch in background (Anthropic plan only)
+# Resolve the anthropic windows — skipped on non-anthropic sessions so
+# Anthropic-plan numbers (usage line AND the advisor-mode budget file)
+# never leak into a glm or kimi statusline. A worker running on another
+# provider spends another budget; counting it here would be the same lie in
+# the other direction.
+five_hour_int=""
+seven_day_int=""
+five_reset_epoch=0
+seven_reset_epoch=0
+usage_source=""
+
+# Source 1 (authoritative): rate_limits on stdin, straight from Claude Code.
 if [ "$session_provider" = "anthropic" ]; then
+    _rl=$(echo "$input" | jq -r '
+        [ (.rate_limits.five_hour.used_percentage // ""),
+          (.rate_limits.five_hour.resets_at      // ""),
+          (.rate_limits.seven_day.used_percentage // ""),
+          (.rate_limits.seven_day.resets_at       // "") ] | @tsv' 2>/dev/null)
+    _p5=$(printf '%s' "$_rl" | cut -f1)
+    _r5=$(printf '%s' "$_rl" | cut -f2)
+    _p7=$(printf '%s' "$_rl" | cut -f3)
+    _r7=$(printf '%s' "$_rl" | cut -f4)
+    if [ -n "$_p5" ] || [ -n "$_p7" ]; then
+        usage_source="payload"
+        [ -n "$_p5" ] && five_hour_int=$(printf "%.0f" "$_p5" 2>/dev/null || echo "")
+        [ -n "$_p7" ] && seven_day_int=$(printf "%.0f" "$_p7" 2>/dev/null || echo "")
+        # resets_at is epoch seconds here, not an ISO string.
+        case "$_r5" in ''|*[!0-9.]*) ;; *) five_reset_epoch="${_r5%%.*}" ;; esac
+        case "$_r7" in ''|*[!0-9.]*) ;; *) seven_reset_epoch="${_r7%%.*}" ;; esac
+    fi
+fi
+
+# Refresh the fallback in the background, but only when the payload did not
+# already answer — a keychain lookup plus an HTTPS round trip on every render
+# buys nothing when the live numbers arrived on stdin.
+if [ "$session_provider" = "anthropic" ] && [ -z "$usage_source" ]; then
     if [ -f "$usage_cache" ]; then
         cache_age=$(( $(date +%s) - $(stat -f %m "$usage_cache" 2>/dev/null || echo 0) ))
-        if [ "$cache_age" -gt "$usage_cache_ttl" ]; then
-            _fetch_usage &
-        fi
+        [ "$cache_age" -gt "$usage_cache_ttl" ] && _fetch_usage &
     else
         _fetch_usage &
     fi
 fi
 
-# Read cached usage data — skipped on non-anthropic sessions so
-# Anthropic-plan numbers (usage line AND the advisor-mode budget file)
-# never leak into a glm or kimi statusline
-if [ "$session_provider" = "anthropic" ] && [ -f "$usage_cache" ]; then
-    five_hour=$(jq -r '.five_hour.utilization // 0' "$usage_cache" 2>/dev/null)
-    seven_day=$(jq -r '.seven_day.utilization // 0' "$usage_cache" 2>/dev/null)
-    five_reset=$(jq -r '.five_hour.resets_at // empty' "$usage_cache" 2>/dev/null)
-    seven_reset=$(jq -r '.seven_day.resets_at // empty' "$usage_cache" 2>/dev/null)
-
-    # Round to integers
-    five_hour_int=$(printf "%.0f" "$five_hour" 2>/dev/null || echo 0)
-    seven_day_int=$(printf "%.0f" "$seven_day" 2>/dev/null || echo 0)
-
-    # Format reset times as HH:MM (local time)
-    five_reset_fmt=""
-    seven_reset_fmt=""
-    seven_reset_epoch=0
-    if [ -n "$five_reset" ]; then
-        # The API states these in UTC ("...T06:00:00+00:00"). Parsing without -u
-        # reads 06:00 UTC as 06:00 local and prints a reset time that is out by
-        # the offset — two hours here, which is long enough to plan around and
-        # be wrong. Parse as UTC to get the epoch, then let date render it in
-        # local time, which is the only form worth showing a person.
-        five_reset_epoch=$(date -j -u -f "%Y-%m-%dT%H:%M:%S" "$(echo "$five_reset" | cut -c1-19)" "+%s" 2>/dev/null || date -d "$five_reset" "+%s" 2>/dev/null || echo 0)
-        five_reset_fmt=$([ "$five_reset_epoch" -gt 0 ] 2>/dev/null && date -r "$five_reset_epoch" "+%H:%M" 2>/dev/null || echo "")
+# Source 2 (fallback): the OAuth endpoint cache, and only while it is fresh.
+if [ "$session_provider" = "anthropic" ] && [ -z "$usage_source" ] && [ -f "$usage_cache" ]; then
+    _usage_cache_age=$(( $(date +%s) - $(stat -f %m "$usage_cache" 2>/dev/null || echo 0) ))
+    if [ "$_usage_cache_age" -le "$usage_cache_max_age" ] 2>/dev/null; then
+        usage_source="oauth"
+        five_hour=$(jq -r '.five_hour.utilization // empty' "$usage_cache" 2>/dev/null)
+        seven_day=$(jq -r '.seven_day.utilization // empty' "$usage_cache" 2>/dev/null)
+        five_reset=$(jq -r '.five_hour.resets_at // empty' "$usage_cache" 2>/dev/null)
+        seven_reset=$(jq -r '.seven_day.resets_at // empty' "$usage_cache" 2>/dev/null)
+        [ -n "$five_hour" ] && five_hour_int=$(printf "%.0f" "$five_hour" 2>/dev/null || echo "")
+        [ -n "$seven_day" ] && seven_day_int=$(printf "%.0f" "$seven_day" 2>/dev/null || echo "")
+        # The endpoint states these in UTC ("...T06:00:00+00:00"). Parsing
+        # without -u reads 06:00 UTC as 06:00 local and prints a reset time out
+        # by the offset — two hours here, long enough to plan around and be
+        # wrong. Parse as UTC to get the epoch; render local further down.
+        if [ -n "$five_reset" ]; then
+            five_reset_epoch=$(date -j -u -f "%Y-%m-%dT%H:%M:%S" "$(echo "$five_reset" | cut -c1-19)" "+%s" 2>/dev/null || date -d "$five_reset" "+%s" 2>/dev/null || echo 0)
+        fi
+        if [ -n "$seven_reset" ]; then
+            seven_reset_epoch=$(date -j -u -f "%Y-%m-%dT%H:%M:%S" "$(echo "$seven_reset" | cut -c1-19)" "+%s" 2>/dev/null || date -d "$seven_reset" "+%s" 2>/dev/null || echo 0)
+        fi
     fi
-    if [ -n "$seven_reset" ]; then
-        seven_reset_epoch=$(date -j -u -f "%Y-%m-%dT%H:%M:%S" "$(echo "$seven_reset" | cut -c1-19)" "+%s" 2>/dev/null || date -d "$seven_reset" "+%s" 2>/dev/null || echo 0)
-        seven_reset_fmt=$([ "$seven_reset_epoch" -gt 0 ] 2>/dev/null && date -r "$seven_reset_epoch" "+%a %H:%M" 2>/dev/null || echo "")
+fi
+
+# A window whose reset has already passed describes a window that no longer
+# exists. Its percentage belongs to a period that has been and gone, so it is
+# dropped rather than carried forward — a spent budget rendered as the current
+# one is exactly the failure this whole block exists to avoid.
+if [ "$session_provider" = "anthropic" ]; then
+    _now_epoch=$(date +%s)
+    if [ "$five_reset_epoch" -gt 0 ] 2>/dev/null && [ "$five_reset_epoch" -le "$_now_epoch" ] 2>/dev/null; then
+        five_hour_int=""; five_reset_epoch=0
+    fi
+    if [ "$seven_reset_epoch" -gt 0 ] 2>/dev/null && [ "$seven_reset_epoch" -le "$_now_epoch" ] 2>/dev/null; then
+        seven_day_int=""; seven_reset_epoch=0
     fi
+fi
+
+# Rendered even when both windows are unknown: "5h: ? │ 7d: ?" says the
+# instrument is blind, where dropping the section altogether would read as
+# "this session is not on the anthropic plan".
+if [ "$session_provider" = "anthropic" ]; then
+    # Format reset times in local time
+    five_reset_fmt=""
+    seven_reset_fmt=""
+    [ "$five_reset_epoch" -gt 0 ] 2>/dev/null && five_reset_fmt=$(date -r "$five_reset_epoch" "+%H:%M" 2>/dev/null || echo "")
+    [ "$seven_reset_epoch" -gt 0 ] 2>/dev/null && seven_reset_fmt=$(date -r "$seven_reset_epoch" "+%a %H:%M" 2>/dev/null || echo "")
 
     five_color=$(_usage_color "$five_hour_int")
     seven_color=$(_usage_color "$seven_day_int")
@@ -453,83 +618,75 @@ if [ "$session_provider" = "anthropic" ] && [ -f "$usage_cache" ]; then
     # Budget pace indicator for 7-day window
     # Compare actual usage vs linear expected usage based on elapsed time
     pace_dot=""
-    if [ "$seven_reset_epoch" -gt 0 ] 2>/dev/null; then
+    if [ "$seven_reset_epoch" -gt 0 ] 2>/dev/null && [ -n "$seven_day_int" ]; then
         now_epoch=$(date +%s)
         window_secs=$((7 * 86400))
         remaining_secs=$((seven_reset_epoch - now_epoch))
         [ "$remaining_secs" -lt 0 ] && remaining_secs=0
         elapsed_secs=$((window_secs - remaining_secs))
-        # Expected usage if spending linearly: elapsed/total * 100
-        expected_pct=$(( elapsed_secs * 100 / window_secs ))
         # Daily pace: actual spend/day vs dynamic budget
         # Budget = remaining capacity / remaining days (not static 100/7)
         elapsed_days_x10=$((elapsed_secs * 10 / 86400))
-        [ "$elapsed_days_x10" -lt 1 ] && elapsed_days_x10=1
-        spend_per_day=$((seven_day_int * 10 / elapsed_days_x10))
-        remaining_days_x10=$((remaining_secs * 10 / 86400))
-        [ "$remaining_days_x10" -lt 1 ] && remaining_days_x10=1
-        remaining_budget=$((100 - seven_day_int))
-        budget_per_day=$((remaining_budget * 10 / remaining_days_x10))
-        # Color: green = under budget, orange = near budget, red = over budget
-        overspend=$((spend_per_day - budget_per_day))
-        if [ "$overspend" -le -3 ] 2>/dev/null; then
-            pace_color="$BRIGHT_GREEN"           # well under budget
-        elif [ "$overspend" -le 2 ] 2>/dev/null; then
-            pace_color="$BRIGHT_ORANGE"          # near budget
-        else
-            pace_color="$BRIGHT_RED"             # over budget
+        # A per-day rate divided by a fraction of a day is not a rate, it is an
+        # extrapolation from noise: an hour into a fresh window the old clamp to
+        # 0.1 days turned 2% spent into "20% per day" and painted the pace red.
+        # Below half a day there is nothing to pace against yet — say nothing.
+        if [ "$elapsed_days_x10" -ge 5 ]; then
+            spend_per_day=$((seven_day_int * 10 / elapsed_days_x10))
+            remaining_days_x10=$((remaining_secs * 10 / 86400))
+            [ "$remaining_days_x10" -lt 1 ] && remaining_days_x10=1
+            remaining_budget=$((100 - seven_day_int))
+            budget_per_day=$((remaining_budget * 10 / remaining_days_x10))
+            # Color: green = under budget, orange = near budget, red = over budget
+            overspend=$((spend_per_day - budget_per_day))
+            if [ "$overspend" -le -3 ] 2>/dev/null; then
+                pace_color="$BRIGHT_GREEN"           # well under budget
+            elif [ "$overspend" -le 2 ] 2>/dev/null; then
+                pace_color="$BRIGHT_ORANGE"          # near budget
+            else
+                pace_color="$BRIGHT_RED"             # over budget
+            fi
+            pace_dot="${pace_color}${spend_per_day}%% / ${budget_per_day}%%${RESET}"
         fi
-        pace_dot="${pace_color}${spend_per_day}%% / ${budget_per_day}%%${RESET}"
     fi
 
-    # Write weekly budget to advisor-mode.json for the whisper hook
-    # Preserve existing mode if manually set — only update weeklyBudgetPercent
-    _advisor_file="${HOME}/.claude/advisor-mode.json"
-    if [ -n "$seven_day_int" ] 2>/dev/null; then
-        _existing_mode="auto"
-        _existing_force=""
-        if [ -f "$_advisor_file" ]; then
-            _existing_mode=$(jq -r '.mode // "auto"' "$_advisor_file" 2>/dev/null)
-            _existing_force=$(jq -r '.forceModel // empty' "$_advisor_file" 2>/dev/null)
-        fi
+    # Write weekly budget to advisor-mode.json for the whisper hook.
+    # Preserve existing mode if manually set — only update weeklyBudgetPercent.
+    #
+    # `asOf` is the epoch second the percentage was read. The consumer refuses a
+    # percentage without one, or one that has gone stale: this file is the input
+    # to an instruction injected on every prompt ("weekly budget at N% — do as
+    # little as possible"), so a number that stopped being refreshed must stop
+    # being obeyed rather than quietly harden into a permanent constraint.
+    # Nothing is written at all while the percentage is unknown.
+    _advisor_file=$(_pai_resolve_file "${pai_home_dir}/advisor-mode.json" "${HOME}/.claude/advisor-mode.json")
+    mkdir -p "$(dirname "$_advisor_file")" 2>/dev/null
+    _existing_mode="auto"
+    _existing_force=""
+    if [ -f "$_advisor_file" ]; then
+        _existing_mode=$(jq -r '.mode // "auto"' "$_advisor_file" 2>/dev/null)
+        _existing_force=$(jq -r '.forceModel // empty' "$_advisor_file" 2>/dev/null)
+    fi
+    case "$_existing_mode" in
+        normal|conservative|strict|critical|auto) ;;
+        *) _existing_mode="auto" ;;
+    esac
+    if [ -n "$seven_day_int" ]; then
         if [ -n "$_existing_force" ]; then
-            printf '{"weeklyBudgetPercent":%d,"mode":"%s","forceModel":"%s"}\n' "$seven_day_int" "$_existing_mode" "$_existing_force" > "$_advisor_file" 2>/dev/null
+            printf '{"weeklyBudgetPercent":%d,"asOf":%d,"mode":"%s","forceModel":"%s"}\n' "$seven_day_int" "$(date +%s)" "$_existing_mode" "$_existing_force" > "$_advisor_file" 2>/dev/null
         else
-            printf '{"weeklyBudgetPercent":%d,"mode":"%s"}\n' "$seven_day_int" "$_existing_mode" > "$_advisor_file" 2>/dev/null
-        fi
-    fi
-
-    # Compute advisor mode label (mirrors thresholds in whisper-rules.ts)
-    # If mode is manually set (not "auto"), show that instead of auto-calculated
-    advisor_label=""
-    advisor_label_color=""
-    _display_mode="$_existing_mode"
-    if [ "$_display_mode" = "auto" ]; then
-        if [ "$seven_day_int" -ge 92 ] 2>/dev/null; then
-            _display_mode="critical"
-        elif [ "$seven_day_int" -ge 80 ] 2>/dev/null; then
-            _display_mode="strict"
-        elif [ "$seven_day_int" -ge 60 ] 2>/dev/null; then
-            _display_mode="conservative"
+            printf '{"weeklyBudgetPercent":%d,"asOf":%d,"mode":"%s"}\n' "$seven_day_int" "$(date +%s)" "$_existing_mode" > "$_advisor_file" 2>/dev/null
         fi
     fi
-    case "$_display_mode" in
-        "critical") advisor_label="critical"; advisor_label_color="$BRIGHT_RED" ;;
-        "strict") advisor_label="strict"; advisor_label_color="$BRIGHT_ORANGE" ;;
-        "conservative") advisor_label="conserve"; advisor_label_color="$BRIGHT_YELLOW" ;;
-        "normal") advisor_label="normal"; advisor_label_color="$BRIGHT_GREEN" ;;
-    esac
-    # Mark forced modes with a pin symbol so user knows it's not auto
-    if [ "$_existing_mode" != "auto" ] && [ -n "$advisor_label" ]; then
-        advisor_label="📌${advisor_label}"
-    fi
 
-    # Build usage suffix: 5h: 8% → 00:59 │ 1d: ● 29% / 36% │ 7d: ⚡strict 91% → Fr. 08:00
-    five_label="5h: ${five_hour_int}%%"
+    # Build usage suffix: 5h: 8% → 00:59 │ 1d: ● 29% / 36% │ 7d: 91% → Fr. 08:00
+    # A window we could not read renders "?" — a gauge that admits it cannot
+    # tell beats one reading 0% while the tank drains. The advisor mode word is
+    # deliberately not rendered here; the whisper hook is where it acts.
+    five_label="5h: ${five_hour_int:-?}%%"
     [ -n "$five_reset_fmt" ] && five_label="${five_label} → ${five_reset_fmt}"
     seven_label="7d: "
-    [ -n "$advisor_label" ] && seven_label="${seven_label}${advisor_label_color}${advisor_label}${RESET} "
-    seven_label="${seven_label}${seven_day_int}%%"
+    seven_label="${seven_label}${seven_day_int:-?}%%"
     [ -n "$seven_reset_fmt" ] && seven_label="${seven_label} → ${seven_reset_fmt}"
 
     usage_suffix=" ${SEPARATOR_COLOR}│${RESET} ${five_color}${five_label}${RESET}"
@@ -562,7 +719,7 @@ _fetch_provider_usage() {
     else
         header="${auth}: ${key}"
     fi
-    mkdir -p /tmp/claude
+    mkdir -p "$pai_cache_dir"
     local response
     response=$(curl -sf --max-time 3 \
         -H "$header" \
@@ -593,7 +750,7 @@ if [ "$session_provider" != "anthropic" ]; then
         usage_auth=$(printf '%s' "$provider_usage" | jq -r '.authHeader // "Authorization: Bearer"')
         usage_ttl=$(printf '%s' "$provider_usage" | jq -r '.ttlSeconds // empty')
         [ "$usage_ttl" -gt 0 ] 2>/dev/null || usage_ttl="$usage_cache_ttl"
-        provider_cache="/tmp/claude/statusline-usage-${session_provider}.json"
+        provider_cache="${pai_cache_dir}/statusline-usage-${session_provider}.json"
         usage_probe=$(printf '%s' "$provider_usage" | jq -r '.windows[0].percent // empty')
 
         # Use cache if fresh, otherwise refresh in the background
@@ -704,6 +861,10 @@ fi
 # step, plus today's finished count). Empty when this session has none.
 # Prefers the standalone built script (plain node, no CLI startup); falls back
 # to the pai CLI.
+# PAI_QUIET_NOTICES=1: this call's stderr already goes to /dev/null below, but
+# set it anyway so a caller of worker-status-line.mjs outside this script
+# stays quiet too.
+export PAI_QUIET_NOTICES=1
 worker_status_cmd=""
 if [ -x "${claude_dir}/worker-status-line.mjs" ]; then
     worker_status_cmd="${claude_dir}/worker-status-line.mjs"

package/templates/agent-prefs.example.md

@@ -1,6 +1,6 @@
 # PAI Agent Preferences (Personal Configuration)
 
-Copy this file to `~/.config/pai/agent-prefs.md` and customize for your workflow. This file is **NOT** committed to any repository and contains your personal preferences.
+Copy this file to `~/.claude/pai/agent-prefs.md` and customize for your workflow. This file is **NOT** committed to any repository and contains your personal preferences.
 
 ---
 
@@ -115,7 +115,7 @@ researcher       | [researcher-voice-id]    | Research summaries, findings
 - No API key needed — runs entirely locally
 - Better for privacy-sensitive workflows
 
-**Configuration**: Store voice preferences in `~/.config/pai/voices.json` (see voices.example.json).
+**Configuration**: Store voice preferences in `~/.claude/pai/voices.json` (see voices.example.json). Currently unused — no code reads this file's contents yet.
 
 ---
 
@@ -306,14 +306,14 @@ Always Use: ~/dev, ~/Projects, ~/.claude
 
 1. **Copy to config directory**:
    ```bash
-   cp ~/dev/ai/PAI/templates/agent-prefs.example.md ~/.config/pai/agent-prefs.md
+   cp ~/dev/ai/PAI/templates/agent-prefs.example.md ~/.claude/pai/agent-prefs.md
    ```
 
-2. **Customize for your workflow**: Edit `~/.config/pai/agent-prefs.md` with your settings.
+2. **Customize for your workflow**: Edit `~/.claude/pai/agent-prefs.md` with your settings.
 
 3. **Make it executable** (optional):
    ```bash
-   chmod 600 ~/.config/pai/agent-prefs.md  # Restrict permissions if sensitive
+   chmod 600 ~/.claude/pai/agent-prefs.md  # Restrict permissions if sensitive
    ```
 
 4. **Load in your scripts**: Your PAI daemon/CLI reads this automatically on startup.
@@ -326,13 +326,13 @@ This file contains personal preferences and may reference sensitive information:
 
 ```bash
 # Recommended permissions (user read/write only)
-chmod 600 ~/.config/pai/agent-prefs.md
+chmod 600 ~/.claude/pai/agent-prefs.md
 ```
 
 Keep it **out of version control** — add to `.gitignore`:
 ```
-~/.config/pai/
-.config/pai/
+~/.claude/pai/
+.claude/pai/
 ```
 
 ---

package/templates/claude-md.template.md

@@ -1,6 +1,6 @@
 # CLAUDE.md - PAI Global Configuration
 <!-- Generated by PAI Setup — Do not edit directly. Run `pai setup` to regenerate. -->
-<!-- Personal preferences and project mappings are read from ~/.config/pai/agent-prefs.md -->
+<!-- Personal preferences and project mappings are read from ~/.claude/pai/agent-prefs.md -->
 
 ---
 

package/templates/voices.example.json

@@ -1,5 +1,5 @@
 {
-  "comment": "PAI Voice Configuration Template. Copy to ~/.config/pai/voices.json and customize.",
+  "comment": "PAI Voice Configuration Template. Copy to ~/.claude/pai/voices.json and customize. Currently unused — no code reads this file's contents yet.",
   "comment_privacy": "This file is NOT committed to any repository. Keep it out of version control.",
 
   "voiceSystem": {
@@ -231,10 +231,10 @@
   },
 
   "notes": {
-    "setup": "Copy this file to ~/.config/pai/voices.json and customize for your preferences.",
+    "setup": "Copy this file to ~/.claude/pai/voices.json and customize for your preferences.",
     "kokoro_first_run": "First use downloads ~160MB model (~30 seconds). Runs entirely offline afterward.",
     "elevenlabs_cost": "ElevenLabs has usage limits and costs. Check your account for pricing.",
-    "privacy": "This file is NOT committed to version control. Add ~/.config/pai/ to .gitignore.",
+    "privacy": "This file is NOT committed to version control. Add ~/.claude/pai/ to .gitignore.",
     "reloading": "Changes take effect immediately. No daemon restart required.",
     "fallback_behavior": "If primary system fails or voice not found, falls back to alternate system.",
     "environment_variables": "Can also set ELEVENLABS_API_KEY and KOKORO_CACHE_DIR via environment.",

package/dist/config-C_ErGddD.mjs

@@ -1,3 +0,0 @@
-import { a as expandHome, i as ensureConfigDir, n as CONFIG_FILE, o as loadConfig, r as DEFAULTS, t as CONFIG_DIR } from "./config-B64vFg14.mjs";
-
-export { ensureConfigDir, loadConfig };