@tekmidian/pai 0.42.5 → 0.43.0

package/dist/config-DxMZjpvY.mjs

@@ -0,0 +1,1289 @@
+import { a as paiHomePath, o as resolvePaiFile, r as migratePaiFile } from "./pai-home-ChAOupZc.mjs";
+import { n as CONFIG_FILE } from "./config-DCu8THKi.mjs";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { Document, Scalar, parseDocument } from "yaml";
+
+//#region src/config/json-store.ts
+/**
+* json-store.ts — read/write JSON config files without destroying them
+*
+* The failure this exists to prevent:
+*
+*     try { return JSON.parse(read(path)); } catch { return {}; }
+*     ... later ...
+*     write(path, JSON.stringify(ourData));
+*
+* An unreadable file becomes an empty object, and the next write makes that
+* permanent. Silently, exit code 0. This shape appeared three times in this
+* repo against three different files, and twice in AIBroker.
+*
+* The distinction that matters is between *missing* and *unreadable*:
+*
+*   missing     — legitimate first run. Start fresh; writing is safe.
+*   unreadable  — the file exists and we could not parse it. Those bytes are
+*                 the only copy of something. Never overwrite them.
+*
+* Collapsing the second into the first is the bug.
+*
+* NOT everything deserves this guard. For a transient buffer — an undelivered
+* message queue, a cache — starting fresh IS the correct recovery, and
+* refusing to write would disable the feature permanently. Use `writeJsonAtomic`
+* alone there: it still prevents a crash from truncating a good file, without
+* blocking recovery. Reserve `readJsonStrict` for data a user cannot rebuild.
+*/
+/**
+* Read a JSON file, distinguishing "absent" from "damaged".
+*
+* @param path   file to read
+* @param label  how to name it to the user, e.g. "~/.claude.json"
+* @throws if the file exists but cannot be read or parsed
+*/
+function readJsonStrict(path, label = path) {
+	if (!existsSync(path)) return {};
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch (e) {
+		throw new Error(`Could not read ${label}: ${e instanceof Error ? e.message : String(e)}\nRefusing to continue — writing now would replace its contents with ours alone.`);
+	}
+	try {
+		return JSON.parse(raw);
+	} catch (e) {
+		throw new Error(`${label} exists but is not valid JSON: ${e instanceof Error ? e.message : String(e)}\nRefusing to continue — overwriting it would destroy whatever it holds.\nRepair the file, or move it aside and re-run this command.`);
+	}
+}
+/**
+* Leaf values that mean "type word", not data.
+*
+* A config whose top-level keys map to bare type words is a serialized schema,
+* not a configuration — the exact shape found over the live config on
+* 2026-09-18 (399 bytes: `socketPath: string`, `indexIntervalSecs: int`, …).
+* No real config carries three of these at its top level; a dump carries
+* nothing else.
+*/
+const SCHEMA_TYPE_WORDS = new Set([
+	"string",
+	"int",
+	"integer",
+	"number",
+	"bool",
+	"boolean",
+	"float",
+	"double",
+	"object",
+	"array",
+	"any",
+	"unknown"
+]);
+function schemaDumpHits(data) {
+	let hits = 0;
+	for (const v of Object.values(data)) if (typeof v === "string" && SCHEMA_TYPE_WORDS.has(v.trim())) hits += 1;
+	return hits;
+}
+/**
+* Write JSON without risking the existing file.
+*
+* Keeps a `.bak-pai` copy of the previous contents, then writes to a temp file
+* and renames. Rename is atomic within a filesystem, so a crash mid-write
+* leaves the original intact rather than truncated — which is how these files
+* become corrupt in the first place.
+*/
+function writeJsonAtomic(path, data, opts = {}) {
+	const { backup = true, label = path } = opts;
+	if (schemaDumpHits(data) >= 3) throw new Error(`${label}: refusing to write — the object looks like a type schema, not values (several top-level keys map to bare type words). That is the corruption signature of 2026-09-18: the caller serialized the schema instead of the config. Nothing was written.`);
+	const serialized = JSON.stringify(data, null, 2) + "\n";
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	if (backup && existsSync(path)) try {
+		copyFileSync(path, `${path}.bak-pai`);
+	} catch (e) {
+		throw new Error(`Could not back up ${label}: ${e instanceof Error ? e.message : String(e)}\nRefusing to write without a backup.`);
+	}
+	const tmp = `${path}.tmp-pai-${process.pid}`;
+	try {
+		writeFileSync(tmp, serialized, "utf8");
+		renameSync(tmp, path);
+	} catch (e) {
+		try {
+			if (existsSync(tmp)) unlinkSync(tmp);
+		} catch {}
+		throw new Error(`Failed to write ${label}: ${e instanceof Error ? e.message : String(e)}\nThe original is unchanged.`);
+	}
+}
+
+//#endregion
+//#region src/utils/model-window.ts
+/**
+* model-window.ts — facts derivable from a bare model id.
+*
+* Shared by the worker stack (provider registry) and the session hooks
+* (context-fill). Zero imports on purpose: this leaf is bundled into hooks
+* (scripts/build-hooks.mjs) and must never drag config or path machinery
+* into a hook process.
+*/
+/** Last-resort window when nothing on hand reports one and the model id
+*  carries no window information. */
+const DEFAULT_CONTEXT_WINDOW = 2e5;
+/** Strip a bracketed variant suffix: "glm-5.3[1m]" → "glm-5.3". The suffix
+*  selects a variant of the same base model (a context-window tier, a
+*  quantization), so the prefix is the id's family. */
+function stripModelVariant(model) {
+	return model.replace(/\[[^\]]*\]\s*$/, "").trim() || model;
+}
+/**
+* The context window a model id itself declares, or null when the id carries
+* no window information. Only the bracketed variant suffix is read
+* ("[1m]" → 1,000,000); a bare id says nothing and stays null so callers can
+* fall back to whatever they measured themselves.
+*/
+function contextWindowFromModelId(model) {
+	if (typeof model !== "string" || model === "") return null;
+	const m = /\[(\d+)m\]$/i.exec(model.trim());
+	if (!m) return null;
+	const millions = Number(m[1]);
+	if (!Number.isFinite(millions) || millions < 1) return null;
+	return millions * 1e6;
+}
+
+//#endregion
+//#region src/workers/workers-config.ts
+/**
+* workers-config.ts — workers.yaml: providers, model roles, class routing,
+* mcp_sets.
+*
+* config.ts's readWorkersSection/writeWorkersSection are the only callers —
+* every other module keeps talking to the WorkersConfig shape from config.ts
+* and never touches this file. That is deliberate: adding a provider used to
+* mean editing JSON inside an unrelated config blob; this module makes
+* providers/classes/mcp_sets/active a single human-editable file, documented
+* in docs/workers-config.md, while everything downstream is unchanged.
+*
+* Writes go through the `yaml` package's Document API and only touch the
+* entries that actually changed, so hand-written comments elsewhere in the
+* file — including a comment directly above an untouched provider — survive
+* byte-for-byte across `add`, `use`, `disable`, and every other mutation.
+*/
+const WORKERS_YAML_FILENAME = "workers.yaml";
+/**
+* Where workers.yaml lives since 2026-09-19: under the PAI_HOME namespace
+* dir (~/.claude/pai by default) — this file is per-user state that can
+* carry API keys and must never be committed, same as the rest of PAI_HOME.
+*/
+function defaultWorkersYamlPath() {
+	return paiHomePath(WORKERS_YAML_FILENAME);
+}
+/** Briefly the canonical location between 2026-09-19's two migrations —
+*  read during the transition, never written to again. */
+function oldWorkersYamlPath() {
+	return join(homedir(), ".claude", WORKERS_YAML_FILENAME);
+}
+/** Where workers.yaml lived before 2026-09-19 — read during the transition,
+*  never written to (see `pai worker config migrate`). */
+function legacyWorkersYamlPath() {
+	return join(homedir(), ".config", "pai", WORKERS_YAML_FILENAME);
+}
+/**
+* The path any read/write of workers.yaml actually uses: PAI_WORKERS_YAML
+* (tests, power users) first, else the new PAI_HOME location if it exists,
+* else the most recent old location that is actually on disk (printing a
+* one-time notice), else the new location (the target a first write creates).
+*/
+function workersYamlPath() {
+	const override = process.env.PAI_WORKERS_YAML;
+	if (override) return override;
+	return resolvePaiFile(defaultWorkersYamlPath(), [oldWorkersYamlPath(), legacyWorkersYamlPath()], "pai worker config migrate");
+}
+/** Where a fresh write (init, migrate, relocate's destination) always
+*  targets — the new location, or PAI_WORKERS_YAML for test isolation.
+*  Never an old path: nothing is ever written there again. */
+function writeTargetWorkersYamlPath() {
+	return process.env.PAI_WORKERS_YAML ?? defaultWorkersYamlPath();
+}
+/**
+* One-line notice for `pai worker config check` and `pai worker providers`
+* when workers.yaml is still sitting at an old location. Null once it has
+* moved (or PAI_WORKERS_YAML is set — that always wins, nothing to migrate).
+*/
+function workersYamlLegacyNotice() {
+	if (process.env.PAI_WORKERS_YAML) return null;
+	if (existsSync(defaultWorkersYamlPath())) return null;
+	const found = [oldWorkersYamlPath(), legacyWorkersYamlPath()].find((p) => existsSync(p));
+	if (!found) return null;
+	return `workers.yaml is still at the old location (${found}) — run \`pai worker config migrate\` to move it to ${defaultWorkersYamlPath()}`;
+}
+/** snake_case on-disk keys → the camelCase raw shape parseProvider expects. */
+function yamlProviderToRaw(y) {
+	const raw = {};
+	if (y.enabled !== void 0) raw.enabled = y.enabled;
+	if (y.url !== void 0) raw.baseUrl = y.url;
+	if (y.key_file !== void 0) raw.keyFile = y.key_file;
+	if (y.key !== void 0) raw.key = y.key;
+	if (y.tier !== void 0) raw.costTier = y.tier;
+	if (y.models !== void 0) raw.models = y.models;
+	if (y.protocol !== void 0) raw.protocol = y.protocol;
+	if (y.engine !== void 0) raw.engine = y.engine;
+	if (y.upstream_url !== void 0) raw.upstreamUrl = y.upstream_url;
+	if (y.env !== void 0) raw.env = y.env;
+	if (y.note !== void 0) raw.note = y.note;
+	if (y.quota_probe !== void 0) raw.quotaProbe = y.quota_probe;
+	if (y.quota_skip_at !== void 0) raw.quotaSkipAt = y.quota_skip_at;
+	if (y.context_window !== void 0) raw.contextWindow = y.context_window;
+	if (y.tags !== void 0) raw.tags = y.tags;
+	if (y.usage !== void 0) raw.usage = y.usage;
+	if (y.model_tiers !== void 0) raw.modelTiers = y.model_tiers;
+	return raw;
+}
+/** Internal WorkerProvider → the friendly on-disk plain object for writing. */
+function providerToYamlPlain(p) {
+	const y = {};
+	if (!p.enabled) y.enabled = false;
+	if (p.baseUrl) y.url = p.baseUrl;
+	if (p.keyFile) y.key_file = p.keyFile;
+	if (p.key) y.key = p.key;
+	if (p.costTier !== void 0) y.tier = p.costTier;
+	y.models = { ...p.models };
+	if (p.protocol && p.protocol !== "anthropic") y.protocol = p.protocol;
+	if (p.engine && p.engine !== "claude") y.engine = p.engine;
+	if (p.upstreamUrl) y.upstream_url = p.upstreamUrl;
+	if (p.env && Object.keys(p.env).length) y.env = { ...p.env };
+	if (p.note) y.note = p.note;
+	if (p.quotaProbe) y.quota_probe = p.quotaProbe;
+	if (p.quotaSkipAt !== void 0) y.quota_skip_at = p.quotaSkipAt;
+	if (p.contextWindow !== void 0) y.context_window = p.contextWindow;
+	if (p.tags?.length) y.tags = [...p.tags];
+	if (p.usage) y.usage = p.usage;
+	if (p.modelTiers) y.model_tiers = { ...p.modelTiers };
+	return y;
+}
+/** The builtin `anthropic` block only ever carries `builtin: true` + `models`. */
+function parseBuiltinAnthropic(raw, pathPrefix) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new WorkersConfigError(`${pathPrefix}: must be an object`);
+	const p = raw;
+	if (p.builtin !== true) throw new WorkersConfigError(`${pathPrefix}: "${ANTHROPIC_NATIVE}" is reserved for the built-in Claude Code login — set "builtin: true" (optionally with a "models" override) or rename this provider`);
+	const disallowed = [
+		"url",
+		"key_file",
+		"key",
+		"engine",
+		"protocol",
+		"upstream_url"
+	].filter((k) => p[k] !== void 0);
+	if (disallowed.length) throw new WorkersConfigError(`${pathPrefix}: a builtin provider cannot set ${disallowed.join(", ")} — it runs on Claude Code's own login`);
+	if (p.models === void 0) return { ...NATIVE_ANTHROPIC_MODELS };
+	return parseModelsBlock(`${pathPrefix}.models`, p.models);
+}
+function lineOf(doc, path) {
+	try {
+		const node = doc.getIn(path, true);
+		const range = node && typeof node === "object" && "range" in node ? node.range : void 0;
+		if (!range) return null;
+		return String(doc).slice(0, range[0]).split("\n").length;
+	} catch {
+		return null;
+	}
+}
+function withLine(doc, path, yamlPath, e) {
+	const msg = e instanceof Error ? e.message : String(e);
+	const line = lineOf(doc, path);
+	throw new WorkersConfigError(line ? `${yamlPath}:${line}: ${msg}` : `${yamlPath}: ${msg}`);
+}
+/**
+* Parse and fully validate a workers.yaml Document. Throws WorkersConfigError
+* naming `<path>:<line>` for anything wrong — an unknown provider referenced
+* by a class is a load error here, not a spawn-time surprise.
+*/
+function parseWorkersYamlDocument(doc, yamlPath) {
+	const root = doc.toJS() ?? {};
+	if (typeof root !== "object" || Array.isArray(root)) throw new WorkersConfigError(`${yamlPath}: top level must be a mapping`);
+	const r = root;
+	const providers = {};
+	let nativeModels = { ...NATIVE_ANTHROPIC_MODELS };
+	const providersRaw = r.providers;
+	if (providersRaw !== void 0) {
+		if (typeof providersRaw !== "object" || providersRaw === null || Array.isArray(providersRaw)) withLine(doc, ["providers"], yamlPath, new WorkersConfigError("providers: must be a mapping of name → provider"));
+		for (const [name, raw] of Object.entries(providersRaw)) try {
+			if (name === ANTHROPIC_NATIVE) nativeModels = parseBuiltinAnthropic(raw, `providers.${name}`);
+			else providers[name] = parseProvider(name, yamlProviderToRaw(raw));
+		} catch (e) {
+			withLine(doc, ["providers", name], yamlPath, e);
+		}
+	}
+	let classes = {};
+	if (r.classes !== void 0) {
+		try {
+			classes = parseClassesValue(r.classes, "classes");
+		} catch (e) {
+			withLine(doc, ["classes"], yamlPath, e);
+		}
+		for (const [cls, target] of Object.entries(classes)) {
+			const provider = typeof target === "string" ? target.split("/")[0] : target.provider;
+			const alias = typeof target === "string" ? target.split("/")[1] : void 0;
+			if (provider !== void 0) {
+				if (provider !== ANTHROPIC_NATIVE && !providers[provider]) withLine(doc, ["classes", cls], yamlPath, new WorkersConfigError(`classes.${cls}: no provider named "${provider}" (configured: ${Object.keys(providers).join(", ") || "(none)"})`));
+				if (alias !== void 0 && !isModelCapability(alias)) withLine(doc, ["classes", cls], yamlPath, new WorkersConfigError(`classes.${cls}: unknown model role "${alias}" (from: ${MODEL_CAPABILITIES.join(", ")})`));
+			}
+		}
+	}
+	let mcpSets = {};
+	if (r.mcp_sets !== void 0) try {
+		mcpSets = parseMcpSetsValue(r.mcp_sets, "mcp_sets");
+	} catch (e) {
+		withLine(doc, ["mcp_sets"], yamlPath, e);
+	}
+	else mcpSets = parseMcpSetsValue(void 0, "mcp_sets");
+	const active = r.active === void 0 || r.active === null ? null : String(r.active);
+	if (active !== null && active !== ANTHROPIC_NATIVE && active !== "auto" && !providers[active]) withLine(doc, ["active"], yamlPath, new WorkersConfigError(`active: no provider named "${active}" (configured: ${Object.keys(providers).join(", ") || "(none)"})`));
+	return {
+		active,
+		providers,
+		classes,
+		mcpSets,
+		nativeModels
+	};
+}
+/** Read + parse workers.yaml. Returns null if the file does not exist. */
+function readWorkersYaml(yamlPath) {
+	if (!existsSync(yamlPath)) return null;
+	let text;
+	try {
+		text = readFileSync(yamlPath, "utf8");
+	} catch (e) {
+		throw new WorkersConfigError(`Could not read ${yamlPath}: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	const doc = parseDocument(text);
+	if (doc.errors.length) throw new WorkersConfigError(`${yamlPath}: ${doc.errors[0].message}`);
+	return {
+		doc,
+		data: parseWorkersYamlDocument(doc, yamlPath)
+	};
+}
+function shallowEqual(a, b) {
+	return JSON.stringify(a) === JSON.stringify(b);
+}
+/**
+* A `key:` value as an explicit double-quoted YAML scalar. A key is an
+* opaque token, not YAML-authored text — plain-scalar auto-styling could
+* read one back as a number or boolean (an all-digit token, "true", "no", …)
+* if it were ever left unquoted, so every write forces the quoted form
+* regardless of what the plain style would otherwise pick.
+*/
+function quotedKeyNode(value) {
+	const s = new Scalar(value);
+	s.type = Scalar.QUOTE_DOUBLE;
+	return s;
+}
+/**
+* Apply the changes between `before` and `after` onto `doc`, touching only
+* the providers/classes/mcp_sets/active entries that actually differ. This is
+* what makes comment preservation possible: an untouched provider's node
+* (and any comment above it) is never revisited.
+*/
+function syncWorkersYamlDocument(doc, before, after) {
+	for (const [name, p] of Object.entries(after.providers)) {
+		const beforeP = before.providers[name];
+		if (!beforeP || !shallowEqual(providerToYamlPlain(beforeP), providerToYamlPlain(p))) {
+			const y = providerToYamlPlain(p);
+			if (typeof y.key === "string") y.key = quotedKeyNode(y.key);
+			doc.setIn(["providers", name], y);
+		}
+	}
+	for (const name of Object.keys(before.providers)) if (!(name in after.providers)) doc.deleteIn(["providers", name]);
+	for (const [cls, target] of Object.entries(after.classes)) if (!shallowEqual(before.classes[cls], target)) doc.setIn(["classes", cls], target);
+	for (const cls of Object.keys(before.classes)) if (!(cls in after.classes)) doc.deleteIn(["classes", cls]);
+	for (const [set, servers] of Object.entries(after.mcpSets)) if (!shallowEqual(before.mcpSets[set], servers)) doc.setIn(["mcp_sets", set], [...servers]);
+	for (const set of Object.keys(before.mcpSets)) if (!(set in after.mcpSets)) doc.deleteIn(["mcp_sets", set]);
+	if (before.active !== after.active) if (after.active === null) doc.deleteIn(["active"]);
+	else doc.setIn(["active"], after.active);
+}
+/**
+* Write `after` into workers.yaml, preserving comments on everything that did
+* not change. Re-reads the file fresh (so the diff is against what is really
+* on disk, not a stale in-memory copy) and re-validates the result before
+* committing; on failure the previous bytes are left untouched.
+*/
+function writeWorkersYaml(yamlPath, after) {
+	const existing = readWorkersYaml(yamlPath);
+	const doc = existing ? existing.doc : new Document({});
+	syncWorkersYamlDocument(doc, existing ? existing.data : {
+		active: null,
+		providers: {},
+		classes: {},
+		mcpSets: {},
+		nativeModels: { ...NATIVE_ANTHROPIC_MODELS }
+	}, after);
+	writeWorkersYamlText(yamlPath, String(doc));
+}
+/** Atomic write with a .bak-pai backup and a re-validate-or-restore guard. */
+function writeWorkersYamlText(yamlPath, text) {
+	const probe = parseDocument(text);
+	if (probe.errors.length) throw new WorkersConfigError(`refusing to write ${yamlPath}: ${probe.errors[0].message} (previous file left unchanged)`);
+	try {
+		parseWorkersYamlDocument(probe, yamlPath);
+	} catch (e) {
+		throw new WorkersConfigError(`refusing to write ${yamlPath}: ${e instanceof Error ? e.message : String(e)} (previous file left unchanged)`);
+	}
+	const dir = dirname(yamlPath);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	if (existsSync(yamlPath)) try {
+		copyFileSync(yamlPath, `${yamlPath}.bak-pai`);
+	} catch (e) {
+		throw new WorkersConfigError(`Could not back up ${yamlPath}: ${e instanceof Error ? e.message : String(e)}\nRefusing to write without a backup.`);
+	}
+	const tmp = `${yamlPath}.tmp-pai-${process.pid}`;
+	try {
+		writeFileSync(tmp, text, {
+			encoding: "utf8",
+			mode: 384
+		});
+		renameSync(tmp, yamlPath);
+		chmodSync(yamlPath, 384);
+	} catch (e) {
+		try {
+			if (existsSync(tmp)) unlinkSync(tmp);
+		} catch {}
+		throw new WorkersConfigError(`Failed to write ${yamlPath}: ${e instanceof Error ? e.message : String(e)}`);
+	}
+}
+/** The exact commented starter shipped as examples/workers.yaml and by `init`. */
+function starterWorkersYamlText() {
+	return `# PAI worker configuration.
+# Providers PAI can run workers on, the model each role uses, and which
+# provider every --class goes to. Edit by hand; \`pai worker providers\` shows
+# the effective result. Comments are preserved when PAI writes this file.
+#
+# Per-user state, kept 0600: this file can hold API keys (\`key:\`, below).
+# Never commit it or share it. \`key_file: <path>\` keeps a secret in its own
+# 0600 file instead, if you'd rather not put it here.
+
+active: anthropic          # provider for \`pai worker run\` without --provider or --class
+
+providers:
+  anthropic:
+    builtin: true          # Claude Code's own login: no url, no key file
+    models:
+      default: ${NATIVE_ANTHROPIC_MODELS.default}
+      fast: ${NATIVE_ANTHROPIC_MODELS.fast}
+  glm:
+    url: https://api.z.ai/api/anthropic
+    key: "<your-api-key>"   # or key_file: <path to a 0600 file>
+    tier: 3
+    models:
+      default: glm-5.3[1m]
+      fast: glm-5.3-flash
+      image: example-paint
+  kimi:
+    url: https://api.kimi.ai/coding/
+    key: "<your-api-key>"   # or key_file: <path to a 0600 file>
+    tier: 3
+    models:
+      default: k3[1m]
+      fast: kimi-for-coding[1m]
+
+# A class names a provider, or provider/role to pick a non-default model.
+# Workers exist to parallelise and to save cost: the default is Sonnet,
+# Haiku for the mechanical classes, and nothing here inherits the
+# orchestrating session's model.
+classes:
+  implement: anthropic
+  draft: anthropic
+  research: anthropic
+  complex: anthropic
+  plan: anthropic
+  review: anthropic
+  spotcheck: anthropic/fast
+  simple: anthropic/fast
+  image: glm/image
+
+mcp_sets:
+  desktop: [clickr]
+`;
+}
+/**
+* Build a workers.yaml document from real (migrated) data, keeping the same
+* header/section comments as the starter. Used by `pai worker config
+* migrate` — `init` writes the literal starter instead, since it has no data
+* to carry over.
+*/
+function buildWorkersYamlText(data) {
+	const lines = [];
+	lines.push("# PAI worker configuration.");
+	lines.push("# Providers PAI can run workers on, the model each role uses, and which");
+	lines.push("# provider every --class goes to. Edit by hand; `pai worker providers` shows");
+	lines.push("# the effective result. Comments are preserved when PAI writes this file.");
+	lines.push("");
+	lines.push(`active: ${data.active ?? "null"}          # provider for \`pai worker run\` without --provider or --class`);
+	lines.push("");
+	lines.push("providers:");
+	lines.push("  anthropic:");
+	lines.push("    builtin: true          # Claude Code's own login: no url, no key file");
+	lines.push("    models:");
+	lines.push(`      default: ${data.nativeModels.default}`);
+	if (data.nativeModels.fast) lines.push(`      fast: ${data.nativeModels.fast}`);
+	if (data.nativeModels.image) lines.push(`      image: ${data.nativeModels.image}`);
+	for (const [name, p] of Object.entries(data.providers)) {
+		const y = providerToYamlPlain(p);
+		lines.push(`  ${name}:`);
+		for (const [k, v] of Object.entries(y)) {
+			if (k === "models") continue;
+			lines.push(k === "key" ? `    key: ${JSON.stringify(String(v))}` : `    ${k}: ${yamlScalar(v)}`);
+		}
+		lines.push("    models:");
+		for (const [k, v] of Object.entries(p.models)) lines.push(`      ${k}: ${yamlScalar(v)}`);
+	}
+	lines.push("");
+	lines.push("# A class names a provider, or provider/role to pick a non-default model.");
+	lines.push("# Workers exist to parallelise and to save cost: the default is Sonnet,");
+	lines.push("# Haiku for the mechanical classes, and nothing here inherits the");
+	lines.push("# orchestrating session's model.");
+	const classEntries = Object.entries(data.classes);
+	lines.push(classEntries.length ? "classes:" : "classes: {}");
+	for (const [cls, target] of classEntries) lines.push(`  ${cls}: ${typeof target === "string" ? target : yamlScalar(target)}`);
+	lines.push("");
+	const mcpEntries = Object.entries(data.mcpSets);
+	lines.push(mcpEntries.length ? "mcp_sets:" : "mcp_sets: {}");
+	for (const [set, servers] of mcpEntries) lines.push(`  ${set}: [${servers.join(", ")}]`);
+	lines.push("");
+	return lines.join("\n");
+}
+/** Minimal scalar formatter for buildWorkersYamlText's flat key: value lines. */
+function yamlScalar(v) {
+	if (typeof v === "string") return /^[\w./~\[\]-]+$/.test(v) ? v : JSON.stringify(v);
+	if (Array.isArray(v)) return `[${v.map(yamlScalar).join(", ")}]`;
+	if (v && typeof v === "object") return JSON.stringify(v);
+	return String(v);
+}
+/**
+* `pai worker config migrate`: reads the JSON `workers` section, writes
+* workers.yaml with the starter's comments, backs the JSON section up to
+* `workers.json.migrated-<date>` next to it, and strips providers/classes
+* (and the legacy `roles`)/mcpSets/active from the JSON. Idempotent: refuses
+* when workers.yaml already exists unless `force`. `dryRun` computes and
+* returns the would-be YAML text without touching either file.
+*/
+function migrateWorkersToYaml(jsonPath, opts = {}) {
+	const existing = workersYamlPath();
+	if (existsSync(existing) && !opts.force) throw new WorkersConfigError(`${existing} already exists — refusing to overwrite without --force`);
+	const yamlPath = writeTargetWorkersYamlPath();
+	const raw = readJsonStrict(jsonPath, jsonPath);
+	const workers = parseWorkersConfig(raw.workers);
+	const yamlText = buildWorkersYamlText({
+		active: workers.active,
+		providers: workers.providers,
+		classes: workers.classes,
+		mcpSets: workers.mcpSets,
+		nativeModels: workers.nativeModels
+	});
+	if (opts.dryRun) return {
+		yamlPath,
+		yamlText,
+		backupPath: null,
+		dryRun: true
+	};
+	writeWorkersYamlText(yamlPath, yamlText);
+	const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+	const backupPath = join(dirname(jsonPath), `workers.json.migrated-${stamp}`);
+	writeFileSync(backupPath, JSON.stringify(raw.workers ?? {}, null, 2) + "\n", "utf8");
+	const { providers: _p, classes: _c, roles: _r, mcpSets: _m, active: _a, ...rest } = raw.workers ?? {};
+	raw.workers = rest;
+	writeJsonAtomic(jsonPath, raw, { label: jsonPath });
+	return {
+		yamlPath,
+		yamlText,
+		backupPath,
+		dryRun: false
+	};
+}
+/**
+* `pai worker config init`: write the literal commented starter (no data to
+* carry over — that is what `migrate` is for). Refuses if workers.yaml
+* already exists.
+*/
+function initWorkersYaml() {
+	const existing = workersYamlPath();
+	if (existsSync(existing)) throw new WorkersConfigError(`${existing} already exists — edit it directly, or run \`pai worker config migrate --force\` to regenerate it from the JSON config`);
+	const yamlPath = writeTargetWorkersYamlPath();
+	writeWorkersYamlText(yamlPath, starterWorkersYamlText());
+	return yamlPath;
+}
+/** True when an old-location workers.yaml exists and nothing is at the new one yet. */
+function needsWorkersYamlRelocation() {
+	return !process.env.PAI_WORKERS_YAML && !existsSync(defaultWorkersYamlPath()) && [oldWorkersYamlPath(), legacyWorkersYamlPath()].some((p) => existsSync(p));
+}
+/**
+* `pai worker config migrate` when workers.yaml is still at an old location
+* (~/.claude/workers.yaml or, older still, ~/.config/pai/workers.yaml): a
+* byte-for-byte copy to the new path (comments, keys, everything — this only
+* changes where the file lives), verified, then the old file is renamed
+* aside as workers.yaml.migrated-<YYYYMMDD> (never deleted). No JSON
+* involved, and no secrets are read or transformed beyond copying bytes.
+*/
+function relocateWorkersYaml(opts = {}) {
+	const toPath = writeTargetWorkersYamlPath();
+	const result = migratePaiFile(toPath, [oldWorkersYamlPath(), legacyWorkersYamlPath()], opts);
+	if (!result.dryRun && result.fromPath) chmodSync(toPath, 384);
+	return result;
+}
+/**
+* `pai worker config inline-keys`: for every provider with a `key_file` and
+* no `key`, read the file, write its trimmed contents as a quoted `key:`,
+* and remove `key_file`. The key file itself is left on disk — this only
+* changes what workers.yaml reads from, never deletes a credential the
+* operator might still want. `dryRun` computes the plan (provider names and
+* key file paths only — never the key values) without writing anything.
+*/
+function inlineWorkersYamlKeys(opts = {}) {
+	const yamlPath = workersYamlPath();
+	const existing = readWorkersYaml(yamlPath);
+	if (!existing) throw new WorkersConfigError(`${yamlPath} does not exist — run \`pai worker config init\` first`);
+	const { doc, data } = existing;
+	const inlined = [];
+	for (const [name, p] of Object.entries(data.providers)) {
+		if (p.key || !p.keyFile) continue;
+		const keyPath = expandHome(p.keyFile);
+		let content;
+		try {
+			content = readFileSync(keyPath, "utf8");
+		} catch (e) {
+			throw new WorkersConfigError(`providers.${name}.key_file: could not read ${keyPath}: ${e instanceof Error ? e.message : String(e)}`);
+		}
+		const token = content.trim();
+		if (!token) throw new WorkersConfigError(`providers.${name}.key_file: ${keyPath} is empty`);
+		inlined.push({
+			provider: name,
+			keyFilePath: p.keyFile
+		});
+		if (!opts.dryRun) {
+			doc.setIn([
+				"providers",
+				name,
+				"key"
+			], quotedKeyNode(token));
+			doc.deleteIn([
+				"providers",
+				name,
+				"key_file"
+			]);
+		}
+	}
+	if (!opts.dryRun && inlined.length) writeWorkersYamlText(yamlPath, String(doc));
+	return {
+		yamlPath,
+		inlined,
+		dryRun: !!opts.dryRun
+	};
+}
+
+//#endregion
+//#region src/workers/config.ts
+/**
+* config.ts — the `workers` section of the PAI config file (CONFIG_FILE,
+* see src/daemon/config.ts's paiConfigFilePath — ~/.claude/pai/config.json
+* today, pre-2026-09-19 ~/.config/pai/config.json).
+*
+* Everything that knows about worker providers reads this module: the CLI
+* (`pai worker …`), the MCP tools (worker_*), and the Agent-routing hook.
+* Keep it free of commander/MCP imports so all three layers stay thin over it.
+*
+* Keys are never stored here — only paths to 0600 files. A provider without a
+* keyFile is a local server and gets the placeholder token "local".
+*
+* `protocol: "openai"` providers run through the PAI proxy (src/workers/proxy):
+* `upstreamUrl` is their Chat Completions base, and `run` points
+* ANTHROPIC_BASE_URL at the local proxy with the provider name in the path.
+* `engine: "codex"` providers run through the Codex CLI instead of Claude
+* Code.
+*/
+/**
+* Reserved provider name for plain Anthropic: Claude Code's own OAuth/Max-plan
+* login, no base URL override and no API key. It never needs (or accepts) a
+* `providers.anthropic` config entry — resolveTarget/mustExist synthesize it
+* on demand via `nativeAnthropicProvider()`.
+*/
+const ANTHROPIC_NATIVE = "anthropic";
+/**
+* Models the built-in provider runs on. This is the only place a model id is
+* named for it: run.ts resolves the class capability against this table like
+* it does for any configured provider and passes `--model` explicitly.
+*
+* Workers exist to parallelise and to save cost, so they must never inherit
+* the orchestrator's model. A bare headless `claude` takes the interactive
+* session default, and one probe came up on the most expensive tier because
+* the chat session had been switched to it. Sonnet is the working tier;
+* haiku serves the fast classes (spotcheck, simple).
+*/
+const NATIVE_ANTHROPIC_MODELS = {
+	default: "claude-sonnet-5",
+	fast: "claude-haiku-4-5-20251001"
+};
+/**
+* The synthetic provider object for ANTHROPIC_NATIVE. `baseUrl` is empty and
+* there is no key file, so buildRunEnv strips every provider env override;
+* the models come from NATIVE_ANTHROPIC_MODELS so a run always names its
+* model on the command line.
+*/
+function nativeAnthropicProvider(models = NATIVE_ANTHROPIC_MODELS) {
+	return {
+		enabled: true,
+		protocol: "anthropic",
+		baseUrl: "",
+		keyFile: null,
+		models: { ...models },
+		env: {},
+		native: true
+	};
+}
+/**
+* Provider by name, synthesizing ANTHROPIC_NATIVE when it is asked for. Reads
+* `config.nativeModels` (workers.yaml's documented `providers.anthropic.models`
+* override, if any) so a config that pins a different default/fast id for the
+* built-in provider is honored everywhere a provider is resolved.
+*/
+function getProviderOrNative(config, name) {
+	if (name === ANTHROPIC_NATIVE) return nativeAnthropicProvider(config.nativeModels);
+	return config.providers[name];
+}
+const MODEL_TIERS = [
+	"haiku",
+	"sonnet",
+	"opus"
+];
+const DEFAULT_COST_TIER = 3;
+/** Tags a provider may carry; classes filter auto-routing on them. */
+const PROVIDER_TAGS = [
+	"code",
+	"vision",
+	"image-gen",
+	"long-context",
+	"fast",
+	"reasoning"
+];
+/** The standard task classes; `workers.classes` maps each to a target. */
+const WORKER_CLASSES = [
+	"draft",
+	"plan",
+	"implement",
+	"review",
+	"research",
+	"spotcheck",
+	"simple",
+	"complex",
+	"image"
+];
+/**
+* The named model capabilities a provider may carry a preference for, set
+* per provider under `workers.providers.<name>.models`. "default" is the
+* required catch-all; the others name what a model is *for* — "fast" the
+* cheap tier (spotcheck, haiku-tier spawns), "image" the image class.
+* Everything resolves through resolveModelCapability, falling back to default.
+*/
+const MODEL_CAPABILITIES = [
+	"default",
+	"fast",
+	"image"
+];
+/** Is this string the name of a known model capability? */
+function isModelCapability(v) {
+	return MODEL_CAPABILITIES.includes(v);
+}
+/**
+* Which model capability a class runs on when its target names no alias: the
+* image class uses the image model, the cheap classes (spotcheck, simple) the
+* fast model, every other class the provider default. A provider without a
+* fast model falls back to its default (resolveModelCapability).
+*/
+const CLASS_MODEL_CAPABILITY = {
+	draft: "default",
+	plan: "default",
+	implement: "default",
+	review: "default",
+	research: "default",
+	spotcheck: "fast",
+	simple: "fast",
+	complex: "default",
+	image: "image"
+};
+/** Capability for a run's class (default when unset or not a standard class). */
+function classModelCapability(className) {
+	return className && CLASS_MODEL_CAPABILITY[className] || "default";
+}
+const DEFAULT_LOG_DIR = "~/.claude/logs/workers";
+const DEFAULT_PANE = {
+	enabled: true,
+	fontSize: 13,
+	autoExitSecs: 60
+};
+const DEFAULT_ROUTING = {
+	order: [],
+	cooldownMinutes: 30,
+	retryOnQuota: true
+};
+const DEFAULT_TREE = {
+	maxDepth: 2,
+	maxChildren: 4
+};
+/**
+* Cache-keepalive cadence when the config names none. Measured 2026-09-18
+* (pair probes through the real worker spawn path, numbers in
+* docs/cache-keepalive.md): the implicit provider cache only serves a fresh
+* worker warm within roughly the first minute (positive back-to-back, gone
+* at 2 min), and it covers only ~2.6k of the ~18k-token prefix. Holding it
+* needs a beat every <2 min — a continuous bill for a small saving — so the
+* default is OFF and arming it is the operator's explicit call (set e.g.
+* "cacheKeepaliveSecs": 60).
+*/
+const DEFAULT_CACHE_KEEPALIVE_SECS = 0;
+/**
+* The default MCP sets every config starts from. `desktop` names the clickr
+* server so `--mcp desktop` hands a worker the machine controls (read-only
+* tools always; actuating ones after the operator hands the controls over,
+* see `pai worker controls`). A user's mcpSets section is merged over this,
+* so `desktop: []` removes the set deliberately.
+*/
+const DEFAULT_MCP_SETS = { desktop: ["clickr"] };
+function defaultWorkersConfig() {
+	return {
+		enabled: false,
+		active: null,
+		providers: {},
+		classes: {},
+		mcpSets: { ...DEFAULT_MCP_SETS },
+		pane: { ...DEFAULT_PANE },
+		logDir: DEFAULT_LOG_DIR,
+		routing: {
+			...DEFAULT_ROUTING,
+			order: []
+		},
+		tree: { ...DEFAULT_TREE },
+		cacheKeepaliveSecs: DEFAULT_CACHE_KEEPALIVE_SECS,
+		fallback: null,
+		nativeModels: { ...NATIVE_ANTHROPIC_MODELS }
+	};
+}
+var WorkersConfigError = class extends Error {};
+function bad(path, why) {
+	throw new WorkersConfigError(`workers${path}: ${why}`);
+}
+function str(v) {
+	return typeof v === "string" ? v : "";
+}
+/**
+* Parse a `models` block (capability → model id, "default" required). Shared
+* by parseProvider and the YAML loader's builtin-anthropic override, which
+* has no other provider fields to validate.
+*/
+function parseModelsBlock(pathPrefix, modelsRaw) {
+	const raw = modelsRaw === void 0 ? {} : modelsRaw;
+	if (typeof raw !== "object" || raw === null) bad(pathPrefix, "must be an object");
+	const m = raw;
+	const defaultModel = str(m.default);
+	if (!defaultModel) bad(`${pathPrefix}.default`, "is required");
+	const models = { default: defaultModel };
+	for (const key of Object.keys(m)) {
+		if (key === "default") continue;
+		if (!isModelCapability(key)) bad(`${pathPrefix}.${key}`, `"${key}" is not a model capability (from: ${MODEL_CAPABILITIES.join(", ")})`);
+		const id = str(m[key]);
+		if (!id) bad(`${pathPrefix}.${key}`, "must be a non-empty model id");
+		models[key] = id;
+	}
+	return models;
+}
+/** Parse and validate one provider entry (shared by JSON and YAML loading). */
+function parseProvider(name, raw) {
+	if (name === ANTHROPIC_NATIVE) bad(`.providers.${name}`, `"${ANTHROPIC_NATIVE}" is reserved for plain Anthropic (Claude Code's own OAuth/Max-plan login) and cannot be configured here — remove this entry; use --provider ${ANTHROPIC_NATIVE} or "pai worker providers use ${ANTHROPIC_NATIVE}" instead`);
+	if (typeof raw !== "object" || raw === null) bad(`.providers.${name}`, "must be an object");
+	const p = raw;
+	const protocol = p.protocol === void 0 ? "anthropic" : str(p.protocol);
+	if (protocol !== "anthropic" && protocol !== "openai") bad(`.providers.${name}.protocol`, `"${str(p.protocol)}" is neither "anthropic" nor "openai"`);
+	const engine = p.engine === void 0 ? "claude" : str(p.engine);
+	if (engine !== "claude" && engine !== "codex") bad(`.providers.${name}.engine`, `"${str(p.engine)}" is neither "claude" nor "codex"`);
+	const baseUrl = str(p.baseUrl);
+	if (!baseUrl && protocol !== "openai") bad(`.providers.${name}.baseUrl`, "is required");
+	const keyFile = p.keyFile === void 0 || p.keyFile === null || str(p.keyFile) === "" ? null : str(p.keyFile);
+	const key = str(p.key) || void 0;
+	const models = parseModelsBlock(`.providers.${name}.models`, p.models);
+	let modelTiers;
+	if (p.modelTiers !== void 0) {
+		if (typeof p.modelTiers !== "object" || p.modelTiers === null || Array.isArray(p.modelTiers)) bad(`.providers.${name}.modelTiers`, "must be an object of model id → haiku | sonnet | opus");
+		modelTiers = {};
+		for (const [id, tier] of Object.entries(p.modelTiers)) {
+			if (typeof tier !== "string" || !MODEL_TIERS.includes(tier)) bad(`.providers.${name}.modelTiers.${id}`, `must be "haiku", "sonnet" or "opus" (got ${JSON.stringify(tier)})`);
+			modelTiers[id] = tier;
+		}
+	}
+	const env = {};
+	if (p.env !== void 0) {
+		if (typeof p.env !== "object" || p.env === null || Array.isArray(p.env)) bad(`.providers.${name}.env`, "must be an object of string values");
+		for (const [k, v] of Object.entries(p.env)) {
+			if (typeof v !== "string") bad(`.providers.${name}.env.${k}`, "must be a string");
+			env[k] = v;
+		}
+	}
+	const quotaSkipAt = p.quotaSkipAt === void 0 ? void 0 : p.quotaSkipAt;
+	if (quotaSkipAt !== void 0) {
+		if (typeof quotaSkipAt !== "number" || quotaSkipAt < 0 || quotaSkipAt > 100) bad(`.providers.${name}.quotaSkipAt`, "must be a number between 0 and 100");
+	}
+	const contextWindow = p.contextWindow === void 0 ? void 0 : p.contextWindow;
+	if (contextWindow !== void 0) {
+		if (typeof contextWindow !== "number" || contextWindow <= 0) bad(`.providers.${name}.contextWindow`, "must be a positive number of tokens");
+	}
+	const upstreamUrl = str(p.upstreamUrl);
+	if (protocol === "openai" && !upstreamUrl) bad(`.providers.${name}.upstreamUrl`, `is required for protocol "openai" (the Chat Completions base, e.g. "https://api.openai.com/v1")`);
+	const costTier = p.costTier === void 0 ? void 0 : p.costTier;
+	if (costTier !== void 0) {
+		if (typeof costTier !== "number" || !Number.isInteger(costTier) || costTier < 1 || costTier > 5) bad(`.providers.${name}.costTier`, "must be an integer 1 (cheapest) … 5 (most expensive)");
+	}
+	let tags;
+	if (p.tags !== void 0) {
+		if (!Array.isArray(p.tags) || p.tags.some((x) => typeof x !== "string")) bad(`.providers.${name}.tags`, `must be an array of tags from: ${PROVIDER_TAGS.join(", ")}`);
+		for (const t of p.tags) if (!PROVIDER_TAGS.includes(t)) bad(`.providers.${name}.tags`, `"${t}" is not a tag (from: ${PROVIDER_TAGS.join(", ")})`);
+		tags = p.tags;
+	}
+	let usage;
+	if (p.usage !== void 0) {
+		if (typeof p.usage !== "object" || p.usage === null || Array.isArray(p.usage)) bad(`.providers.${name}.usage`, "must be an object");
+		const u = p.usage;
+		const usageUrl = str(u.url);
+		if (!usageUrl) bad(`.providers.${name}.usage.url`, "is required");
+		if (!Array.isArray(u.windows) || u.windows.length === 0) bad(`.providers.${name}.usage.windows`, "must be a non-empty array");
+		const windows = [];
+		for (const [i, wRaw] of u.windows.entries()) {
+			const wpath = `.providers.${name}.usage.windows[${i}]`;
+			if (typeof wRaw !== "object" || wRaw === null || Array.isArray(wRaw)) bad(wpath, "must be an object");
+			const w = wRaw;
+			const wname = str(w.name);
+			if (!wname) bad(`${wpath}.name`, "is required");
+			const percent = str(w.percent);
+			if (!percent) bad(`${wpath}.percent`, "is required (a jq expression yielding 0–100)");
+			const resetUnit = w.resetUnit === void 0 ? void 0 : str(w.resetUnit);
+			if (resetUnit !== void 0 && resetUnit !== "ms" && resetUnit !== "s" && resetUnit !== "iso") bad(`${wpath}.resetUnit`, `must be "ms", "s" or "iso"`);
+			windows.push({
+				name: wname,
+				percent,
+				...str(w.resetAt) ? { resetAt: str(w.resetAt) } : {},
+				...resetUnit ? { resetUnit } : {}
+			});
+		}
+		const ttlSeconds = u.ttlSeconds === void 0 ? void 0 : u.ttlSeconds;
+		if (ttlSeconds !== void 0 && (typeof ttlSeconds !== "number" || ttlSeconds <= 0)) bad(`.providers.${name}.usage.ttlSeconds`, "must be a positive number of seconds");
+		usage = {
+			url: usageUrl,
+			...str(u.authHeader) ? { authHeader: str(u.authHeader) } : {},
+			...str(u.label) ? { label: str(u.label) } : {},
+			windows,
+			...ttlSeconds !== void 0 ? { ttlSeconds } : {}
+		};
+	}
+	return {
+		enabled: p.enabled === void 0 ? true : p.enabled === true,
+		protocol,
+		baseUrl,
+		keyFile,
+		...key ? { key } : {},
+		models,
+		...modelTiers ? { modelTiers } : {},
+		env,
+		...str(p.note) ? { note: str(p.note) } : {},
+		...upstreamUrl ? { upstreamUrl } : {},
+		...engine !== "claude" ? { engine } : {},
+		...str(p.quotaProbe) ? { quotaProbe: str(p.quotaProbe) } : {},
+		...quotaSkipAt !== void 0 ? { quotaSkipAt } : {},
+		...contextWindow !== void 0 ? { contextWindow } : {},
+		...costTier !== void 0 ? { costTier } : {},
+		...tags ? { tags } : {},
+		...usage ? { usage } : {}
+	};
+}
+/**
+* Parse a `classes` (or legacy `roles`) value shared by JSON and YAML
+* loading. `badPathPrefix` names the field in error messages, e.g. ".classes".
+*/
+function parseClassesValue(classesRaw, badPathPrefix) {
+	const classes = {};
+	if (classesRaw === void 0) return classes;
+	if (typeof classesRaw !== "object" || classesRaw === null || Array.isArray(classesRaw)) bad(badPathPrefix, "must be an object of class → provider[/alias] or {provider, mcp, maxCostTier, requireTags, order}");
+	for (const [cls, target] of Object.entries(classesRaw)) if (typeof target === "object" && target !== null && !Array.isArray(target)) {
+		const o = target;
+		const provider = str(o.provider);
+		if (o.provider !== void 0 && (!provider || provider.includes(" "))) bad(`${badPathPrefix}.${cls}.provider`, `invalid provider "${provider}"`);
+		let mcp;
+		if (o.mcp !== void 0) {
+			if (!Array.isArray(o.mcp) || o.mcp.some((x) => typeof x !== "string")) bad(`${badPathPrefix}.${cls}.mcp`, "must be an array of MCP server or set names");
+			mcp = o.mcp;
+		}
+		let maxCostTier;
+		if (o.maxCostTier !== void 0) {
+			if (typeof o.maxCostTier !== "number" || !Number.isInteger(o.maxCostTier) || o.maxCostTier < 1 || o.maxCostTier > 5) bad(`${badPathPrefix}.${cls}.maxCostTier`, "must be an integer 1 … 5");
+			maxCostTier = o.maxCostTier;
+		}
+		let requireTags;
+		if (o.requireTags !== void 0) {
+			if (!Array.isArray(o.requireTags) || o.requireTags.some((x) => typeof x !== "string")) bad(`${badPathPrefix}.${cls}.requireTags`, `must be an array of tags from: ${PROVIDER_TAGS.join(", ")}`);
+			for (const t of o.requireTags) if (!PROVIDER_TAGS.includes(t)) bad(`${badPathPrefix}.${cls}.requireTags`, `"${t}" is not a tag (from: ${PROVIDER_TAGS.join(", ")})`);
+			requireTags = o.requireTags;
+		}
+		let order;
+		if (o.order !== void 0) {
+			if (!Array.isArray(o.order) || o.order.some((x) => typeof x !== "string")) bad(`${badPathPrefix}.${cls}.order`, "must be an array of provider names");
+			order = o.order;
+		}
+		const obj = {
+			...provider ? { provider } : {},
+			...mcp ? { mcp } : {},
+			...maxCostTier !== void 0 ? { maxCostTier } : {},
+			...requireTags ? { requireTags } : {},
+			...order ? { order } : {}
+		};
+		classes[cls] = Object.keys(obj).length ? obj : {};
+	} else {
+		const t = str(target);
+		if (!t || t.includes(" ")) bad(`${badPathPrefix}.${cls}`, `invalid target "${t}"`);
+		classes[cls] = t;
+	}
+	return classes;
+}
+/**
+* Parse an `mcpSets` (or `mcp_sets`) value shared by JSON and YAML loading.
+* Always merged over DEFAULT_MCP_SETS, so an omitted `desktop` key keeps the
+* built-in clickr set (see DEFAULT_MCP_SETS).
+*/
+function parseMcpSetsValue(raw, badPathPrefix) {
+	const mcpSets = { ...DEFAULT_MCP_SETS };
+	if (raw === void 0) return mcpSets;
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) bad(badPathPrefix, "must be an object of set name → [server names]");
+	for (const [setName, servers] of Object.entries(raw)) {
+		if (!Array.isArray(servers) || servers.some((x) => typeof x !== "string")) bad(`${badPathPrefix}.${setName}`, "must be an array of MCP server names");
+		mcpSets[setName] = servers;
+	}
+	return mcpSets;
+}
+/**
+* Parse and validate a raw `workers` value. Missing section → defaults.
+* Unknown-but-typed garbage → WorkersConfigError naming the offending field.
+*/
+function parseWorkersConfig(raw) {
+	const d = defaultWorkersConfig();
+	if (raw === void 0 || raw === null) return d;
+	if (typeof raw !== "object" || Array.isArray(raw)) bad("", "section must be an object");
+	const w = raw;
+	const providers = {};
+	if (w.providers !== void 0) {
+		if (typeof w.providers !== "object" || w.providers === null || Array.isArray(w.providers)) bad(".providers", "must be an object keyed by provider name");
+		for (const [name, p] of Object.entries(w.providers)) providers[name] = parseProvider(name, p);
+	}
+	const classes = parseClassesValue(w.classes !== void 0 ? w.classes : w.roles, w.classes !== void 0 ? ".classes" : ".roles");
+	const mcpSets = parseMcpSetsValue(w.mcpSets, ".mcpSets");
+	let pane = { ...DEFAULT_PANE };
+	if (w.pane !== void 0) {
+		if (typeof w.pane !== "object" || w.pane === null) bad(".pane", "must be an object");
+		const pc = w.pane;
+		if (pc.enabled !== void 0 && typeof pc.enabled !== "boolean") bad(".pane.enabled", "must be boolean");
+		if (pc.fontSize !== void 0 && (typeof pc.fontSize !== "number" || pc.fontSize <= 0)) bad(".pane.fontSize", "must be a positive number of points");
+		if (pc.autoExitSecs !== void 0 && typeof pc.autoExitSecs !== "number") bad(".pane.autoExitSecs", "must be a number");
+		pane = {
+			enabled: pc.enabled === void 0 ? DEFAULT_PANE.enabled : pc.enabled === true,
+			fontSize: pc.fontSize === void 0 ? DEFAULT_PANE.fontSize : pc.fontSize,
+			autoExitSecs: pc.autoExitSecs === void 0 ? DEFAULT_PANE.autoExitSecs : pc.autoExitSecs
+		};
+	}
+	let routing = {
+		...DEFAULT_ROUTING,
+		order: []
+	};
+	if (w.routing !== void 0) {
+		if (typeof w.routing !== "object" || w.routing === null) bad(".routing", "must be an object");
+		const r = w.routing;
+		if (r.order !== void 0) {
+			if (!Array.isArray(r.order) || r.order.some((x) => typeof x !== "string")) bad(".routing.order", "must be an array of provider names");
+			routing.order = r.order;
+		}
+		if (r.cooldownMinutes !== void 0 && typeof r.cooldownMinutes !== "number") bad(".routing.cooldownMinutes", "must be a number");
+		if (r.retryOnQuota !== void 0 && typeof r.retryOnQuota !== "boolean") bad(".routing.retryOnQuota", "must be boolean");
+		routing = {
+			order: routing.order,
+			cooldownMinutes: r.cooldownMinutes === void 0 ? DEFAULT_ROUTING.cooldownMinutes : r.cooldownMinutes,
+			retryOnQuota: r.retryOnQuota === void 0 ? DEFAULT_ROUTING.retryOnQuota : r.retryOnQuota === true
+		};
+	}
+	let tree = { ...DEFAULT_TREE };
+	if (w.tree !== void 0) {
+		if (typeof w.tree !== "object" || w.tree === null || Array.isArray(w.tree)) bad(".tree", "must be an object");
+		const t = w.tree;
+		if (t.maxDepth !== void 0) {
+			if (typeof t.maxDepth !== "number" || !Number.isInteger(t.maxDepth) || t.maxDepth < 0) bad(".tree.maxDepth", "must be a non-negative integer");
+		}
+		if (t.maxChildren !== void 0) {
+			if (typeof t.maxChildren !== "number" || !Number.isInteger(t.maxChildren) || t.maxChildren < 1) bad(".tree.maxChildren", "must be a positive integer");
+		}
+		tree = {
+			maxDepth: t.maxDepth === void 0 ? DEFAULT_TREE.maxDepth : t.maxDepth,
+			maxChildren: t.maxChildren === void 0 ? DEFAULT_TREE.maxChildren : t.maxChildren
+		};
+	}
+	let cacheKeepaliveSecs = DEFAULT_CACHE_KEEPALIVE_SECS;
+	if (w.cacheKeepaliveSecs !== void 0) {
+		if (typeof w.cacheKeepaliveSecs !== "number" || !Number.isInteger(w.cacheKeepaliveSecs) || w.cacheKeepaliveSecs < 0) bad(".cacheKeepaliveSecs", "must be a non-negative integer (seconds, 0 = off)");
+		cacheKeepaliveSecs = w.cacheKeepaliveSecs;
+	}
+	const active = w.active === void 0 || w.active === null ? null : str(w.active);
+	if (active !== null && active !== "auto" && !(active in providers)) {}
+	let fallback = null;
+	if (w.fallback !== void 0 && w.fallback !== null) {
+		if (typeof w.fallback !== "object" || Array.isArray(w.fallback)) bad(".fallback", "must be an object (written by `pai worker fallback on`)");
+		const f = w.fallback;
+		const provider = str(f.provider);
+		if (!provider) bad(".fallback.provider", "is required");
+		const savedRaw = f.saved;
+		if (typeof savedRaw !== "object" || savedRaw === null || Array.isArray(savedRaw)) bad(".fallback.saved", "must be an object");
+		const s = savedRaw;
+		if (typeof s.env !== "object" || s.env === null || Array.isArray(s.env)) bad(".fallback.saved.env", "must be an object of env key → previous value or null");
+		const env = {};
+		for (const [k, v] of Object.entries(s.env)) env[k] = v === null || typeof v === "string" ? v : null;
+		if (s.model !== null && s.model !== void 0 && typeof s.model !== "string") bad(".fallback.saved.model", "must be a string or null");
+		fallback = {
+			provider,
+			saved: {
+				env,
+				model: typeof s.model === "string" ? s.model : null,
+				envExisted: s.envExisted === true
+			},
+			on: str(f.on) || (/* @__PURE__ */ new Date(0)).toISOString()
+		};
+	}
+	return {
+		enabled: w.enabled === void 0 ? d.enabled : w.enabled === true,
+		active,
+		providers,
+		classes,
+		mcpSets,
+		pane,
+		logDir: str(w.logDir) || d.logDir,
+		routing,
+		tree,
+		cacheKeepaliveSecs,
+		fallback,
+		nativeModels: { ...NATIVE_ANTHROPIC_MODELS }
+	};
+}
+function workersYamlDataOf(workers) {
+	return {
+		active: workers.active,
+		providers: workers.providers,
+		classes: workers.classes,
+		mcpSets: workers.mcpSets,
+		nativeModels: workers.nativeModels
+	};
+}
+/**
+* Read the whole config file and return (raw, workers) — the raw record so
+* callers can rewrite it preserving every other section, the parsed+validated
+* workers section. Unreadable config throws (readJsonStrict), missing is fine.
+* `path` overrides the config location (tests, CLAUDE_SETTINGS_PATH-style
+* dry runs); default CONFIG_FILE (see paiConfigFilePath).
+*
+* Providers, classes, mcpSets and active load from workers.yaml (next to
+* `path`) when it exists; otherwise they fall back to the JSON `workers`
+* section, and then to built-in defaults — nothing breaks before migration
+* (`pai worker config migrate`). Everything else (pane, routing, tree,
+* cacheKeepaliveSecs, fallback, enabled, logDir) always comes from JSON.
+*/
+function readWorkersSection(path = CONFIG_FILE) {
+	const raw = readJsonStrict(path, path);
+	const workers = parseWorkersConfig(raw.workers);
+	const yaml = readWorkersYaml(workersYamlPath());
+	if (yaml) {
+		workers.active = yaml.data.active;
+		workers.providers = yaml.data.providers;
+		workers.classes = yaml.data.classes;
+		workers.mcpSets = yaml.data.mcpSets;
+		workers.nativeModels = yaml.data.nativeModels;
+	}
+	return {
+		raw,
+		workers
+	};
+}
+/**
+* Write the workers section back, atomically. When workers.yaml exists, its
+* providers/classes/mcpSets/active are synced there (comment-preserving,
+* only the entries that changed are touched) and stripped from the JSON
+* `workers` section; everything else still writes to JSON as before.
+*/
+function writeWorkersSection(raw, workers, path = CONFIG_FILE) {
+	const yamlPath = workersYamlPath();
+	const usingYaml = existsSync(yamlPath);
+	if (usingYaml) writeWorkersYaml(yamlPath, workersYamlDataOf(workers));
+	raw.workers = usingYaml ? {
+		enabled: workers.enabled,
+		pane: workers.pane,
+		logDir: workers.logDir,
+		routing: workers.routing,
+		tree: workers.tree,
+		cacheKeepaliveSecs: workers.cacheKeepaliveSecs,
+		...workers.fallback ? { fallback: workers.fallback } : {}
+	} : workers.fallback ? workers : {
+		...workers,
+		fallback: void 0
+	};
+	writeJsonAtomic(path, raw, { label: path });
+}
+/** Expand a leading ~ (config values are written with `~` to stay portable). */
+function expandHome(p) {
+	if (p === "~" || p.startsWith("~/")) return join(homedir(), p.slice(1));
+	return p;
+}
+function assertProviderRunnable(name, p) {
+	if (p.protocol === "openai" && !p.upstreamUrl) throw new WorkersConfigError(`provider "${name}" uses protocol "openai" but has no upstreamUrl — set its Chat Completions base (e.g. "https://api.openai.com/v1") so the PAI proxy knows where to translate to.`);
+}
+/** Where a provider's key file lives, or null. Shared by run + test + add. */
+function providerKeyPath(p) {
+	return p.keyFile ? expandHome(p.keyFile) : null;
+}
+/**
+* The provider's auth token: inline `key` wins when set, else `key_file`
+* read and trimmed, else null (native/local providers use the "local"
+* placeholder). The one place a provider's key value is resolved — every
+* spawn path (buildRunEnv, the codex runner, the openai proxy, the
+* machine-wide fallback) reads through this instead of its own
+* readFileSync, so inline keys work everywhere a key file already did.
+*/
+function resolveProviderKey(p) {
+	if (p.key) return p.key;
+	const keyPath = providerKeyPath(p);
+	if (!keyPath) return null;
+	let content;
+	try {
+		content = readFileSync(keyPath, "utf8");
+	} catch {
+		throw new WorkersConfigError(`key file not readable: ${keyPath}`);
+	}
+	const token = content.trim();
+	if (!token) throw new WorkersConfigError(`key file is empty: ${keyPath}`);
+	return token;
+}
+/** `key: ****` + last 4 chars — never the full value. Used everywhere a
+*  provider's key would otherwise be echoed (`providers`, `config check`). */
+function maskKey(key) {
+	return `****${key.slice(-4)}`;
+}
+/** Cost tier of a provider for class filtering (unset = 3, the middle). */
+function providerCostTier(p) {
+	return p.costTier ?? DEFAULT_COST_TIER;
+}
+/**
+* The model id for a capability: the provider's preference for it, else its
+* default model — the one resolution rule every consumer (image class, fast
+* tier spawns, env pins) goes through.
+*/
+function resolveModelCapability(p, capability) {
+	return p.models[capability] ?? p.models.default;
+}
+/** Directory under which inline keys (MCP `key` field) are stored, 0600. */
+function keysDir() {
+	return paiHomePath("keys");
+}
+
+//#endregion
+export { DEFAULT_CONTEXT_WINDOW as A, inlineWorkersYamlKeys as C, relocateWorkersYaml as D, parseWorkersYamlDocument as E, stripModelVariant as M, readJsonStrict as N, workersYamlLegacyNotice as O, writeJsonAtomic as P, initWorkersYaml as S, needsWorkersYamlRelocation as T, providerKeyPath as _, WORKER_CLASSES as a, resolveProviderKey as b, classModelCapability as c, getProviderOrNative as d, isModelCapability as f, providerCostTier as g, nativeAnthropicProvider as h, PROVIDER_TAGS as i, contextWindowFromModelId as j, workersYamlPath as k, defaultWorkersConfig as l, maskKey as m, DEFAULT_LOG_DIR as n, WorkersConfigError as o, keysDir as p, MODEL_CAPABILITIES as r, assertProviderRunnable as s, ANTHROPIC_NATIVE as t, expandHome as u, readWorkersSection as v, migrateWorkersToYaml as w, writeWorkersSection as x, resolveModelCapability as y };
+//# sourceMappingURL=config-DxMZjpvY.mjs.map