@tekmidian/pai 0.42.6 → 0.43.0

package/dist/{program-LLNPpxlj.mjs → program-C5jRQ1kg.mjs}

@@ -12,16 +12,17 @@ import { B as claudeProjectsDir, C as findLatestNote, H as scanTranscriptFolders
 import { a as expandHome, c as paiConfigFilePath, i as ensureConfigDir, l as OWNER_LABEL_PREFIX, n as CONFIG_FILE$2, o as loadConfig, s as migrateConfigFile, t as CONFIG_DIR, u as UNROUTED } from "./config-DCu8THKi.mjs";
 import { a as schedulerLogPath, i as paiSocketPath, n as daemonLogPath, r as daemonPidPath } from "./runtime-paths-B0P1TvUr.mjs";
 import { A as DEFAULT_CONTEXT_WINDOW, C as inlineWorkersYamlKeys, D as relocateWorkersYaml, E as parseWorkersYamlDocument, M as stripModelVariant, N as readJsonStrict, O as workersYamlLegacyNotice, P as writeJsonAtomic, S as initWorkersYaml, T as needsWorkersYamlRelocation, d as getProviderOrNative, f as isModelCapability, h as nativeAnthropicProvider, i as PROVIDER_TAGS, j as contextWindowFromModelId, k as workersYamlPath, m as maskKey, o as WorkersConfigError, r as MODEL_CAPABILITIES, t as ANTHROPIC_NATIVE, u as expandHome$1, v as readWorkersSection, w as migrateWorkersToYaml } from "./config-DxMZjpvY.mjs";
-import { D as isChatPane, F as longInlinePromptHint, I as parseRunnerArgs, M as saveStatus, N as setWorkerLabel, O as loadStatus, P as waitForTerminalStatus, R as describeMcp, S as UNLABELED, b as appendLedger, c as handoffFromInside, f as checkPaneForWorker, i as parseWorkerReport, k as loadStatuses, m as openPaneForWorker, n as runWorker, o as discardWorker, p as openFollowPane, r as testProvider, s as mergeWorker, u as sayToWorker, z as expandMcpNames } from "./run-DDdT9teG.mjs";
+import { A as loadStatuses, B as expandMcpNames, C as UNLABELED, F as waitForTerminalStatus, I as longInlinePromptHint, L as parseRunnerArgs, N as saveStatus, O as isChatPane, P as setWorkerLabel, a as parseWorkerReport, c as mergeWorker, d as sayToWorker, h as openPaneForWorker, i as usageContextTokens, k as loadStatus, l as handoffFromInside, m as openFollowPane, n as runWorker, p as checkPaneForWorker, r as testProvider, s as discardWorker, x as appendLedger, z as describeMcp } from "./run-ByBKowN5.mjs";
 import { t as PaiClient } from "./ipc-client-C6NryMMb.mjs";
 import { r as humanDuration, t as createStorageBackend } from "./factory-DNYAqjH0.mjs";
+import { n as migrateIdentityFile } from "./wakeup-BfElduEU.mjs";
 import { a as renderDedupedSessions, c as probeResume, d as fmtAge, f as migrateSessionScanCache, h as scanSessions, i as normalizeName$2, l as restoreTopLevel, m as scanCacheFilePath, o as hasConversation, p as resolveSessionByNameOrId, r as buildDeduped, s as launchInDir, t as cmdMain, u as printExitDir } from "./main-resolver-DvYu9jbl.mjs";
 import { n as queriesDirPath, t as migrateQueriesDir } from "./query-feedback-CYyOGi3y.mjs";
 import { s as kgQuery } from "./kg-entity-BSjM5xZh.mjs";
-import { _ as workersLogDir, i as buildRunEnv, m as ledgerPath, n as ensureProxyRunning, p as eventsPath, r as stopProxy, t as DEFAULT_PROXY_PORT } from "./server-Ch99xt5K.mjs";
+import { _ as workersLogDir, f as ensureNoMcpConfig, i as buildRunEnv, m as ledgerPath, n as ensureProxyRunning, p as eventsPath, r as stopProxy, t as DEFAULT_PROXY_PORT } from "./server-Ch99xt5K.mjs";
 import { i as sendToSession, n as fetchLiveSessions, r as revealItermSession, t as callAiBroker } from "./aibroker-client-Bn9SnGMa.mjs";
-import { t as runChain } from "./chain-BbcfP77K.mjs";
-import { C as readSpecPrompt, S as statusLineOutput, _ as updateProvider, a as addProvider, b as psOutput, c as describeProviders, d as resolveProviderName, f as setClass, g as unsetClass, h as setWorkersEnabled, i as fallbackStatusText, l as modelPrefsText, m as setProviderModel, n as fallbackOn, o as classTargetText, p as setProviderEnabled, r as fallbackStatus, s as describeModels, t as fallbackOff, u as removeProvider, v as useProvider, w as resolveSpecPath, x as replayOutput, y as followWorkers } from "./fallback-Cwt4hmh5.mjs";
+import { t as runChain } from "./chain-CEC1a5mX.mjs";
+import { C as readSpecPrompt, S as statusLineOutput, _ as updateProvider, a as addProvider, b as psOutput, c as describeProviders, d as resolveProviderName, f as setClass, g as unsetClass, h as setWorkersEnabled, i as fallbackStatusText, l as modelPrefsText, m as setProviderModel, n as fallbackOn, o as classTargetText, p as setProviderEnabled, r as fallbackStatus, s as describeModels, t as fallbackOff, u as removeProvider, v as useProvider, w as resolveSpecPath, x as replayOutput, y as followWorkers } from "./fallback-BQJ8PbCK.mjs";
 import { appendFileSync, chmodSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, platform, tmpdir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
@@ -5905,7 +5906,7 @@ function cmdLogs(opts) {
 }
 function registerDaemonCommands(daemonCmd) {
 	daemonCmd.command("serve").description("Start the PAI daemon in the foreground").action(async () => {
-		const { serve } = await import("./daemon-BNjbVsQU.mjs");
+		const { serve } = await import("./daemon-QIvCXB5f.mjs");
 		const { loadConfig: lc, ensureConfigDir } = await import("./config-DeqFqa1N.mjs");
 		ensureConfigDir();
 		await serve(lc());
@@ -10159,32 +10160,124 @@ function readWorkerStatus(logDir, id) {
 		return null;
 	}
 }
-async function readOne(path) {
-	const report = await parseSessionUsage(path);
+/** Token count of the first `type:"user"` message's text, or null if none found. */
+async function firstUserPromptTokens(path) {
+	const rl = createInterface({
+		input: createReadStream(path, "utf8"),
+		crlfDelay: Infinity
+	});
+	try {
+		for await (const raw of rl) {
+			if (!raw.trim()) continue;
+			let obj;
+			try {
+				obj = JSON.parse(raw);
+			} catch {
+				continue;
+			}
+			if (obj.type !== "user") continue;
+			const content = obj.message?.content;
+			return countTokens(typeof content === "string" ? content : Array.isArray(content) ? content.map((part) => part?.text ?? "").join(" ") : "");
+		}
+	} finally {
+		rl.close();
+	}
+	return null;
+}
+/** `session_id` off the first record that carries one, or null if none do. */
+async function firstSessionId(path) {
+	const rl = createInterface({
+		input: createReadStream(path, "utf8"),
+		crlfDelay: Infinity
+	});
+	try {
+		for await (const raw of rl) {
+			if (!raw.trim()) continue;
+			let obj;
+			try {
+				obj = JSON.parse(raw);
+			} catch {
+				continue;
+			}
+			if (obj.session_id) return obj.session_id;
+		}
+	} finally {
+		rl.close();
+	}
+	return null;
+}
+/** `~/.claude/projects/**\/<sessionId>.jsonl`, searched only under the projects dir. */
+function findSessionTranscript(sessionId, projectsDir = join(homedir(), ".claude", "projects")) {
+	const target = `${sessionId}.jsonl`;
+	const stack = [projectsDir];
+	while (stack.length > 0) {
+		const dir = stack.pop();
+		let entries;
+		try {
+			entries = readdirSync(dir, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			const full = join(dir, entry.name);
+			if (entry.isDirectory()) stack.push(full);
+			else if (entry.name === target) return full;
+		}
+	}
+	return null;
+}
+/**
+* The mirror log has no `type:"user"` record (worker event mirrors carry
+* system/assistant/result records only, never the -p prompt itself), so
+* fall back to the session's own transcript under ~/.claude/projects,
+* located via whichever record in the mirror log carries a `session_id`.
+*/
+async function resolvePromptTokens(mirrorPath) {
+	const direct = await firstUserPromptTokens(mirrorPath);
+	if (direct !== null) return direct;
+	const sessionId = await firstSessionId(mirrorPath);
+	if (!sessionId) return null;
+	const transcript = findSessionTranscript(sessionId);
+	if (!transcript) return null;
+	return firstUserPromptTokens(transcript);
+}
+async function readOne(path, group) {
+	const [report, promptTokens] = await Promise.all([parseSessionUsage(path), resolvePromptTokens(path)]);
 	const model = Object.keys(report.models)[0] ?? null;
+	const overhead = report.firstTurnContext !== null && promptTokens !== null ? report.firstTurnContext - promptTokens : null;
 	return {
 		path,
 		firstTurnContext: report.firstTurnContext,
-		model
+		model,
+		promptTokens,
+		overhead,
+		group
 	};
 }
+function median(values) {
+	if (values.length === 0) return null;
+	const sorted = [...values].sort((a, b) => a - b);
+	const mid = Math.floor(sorted.length / 2);
+	return sorted.length % 2 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2;
+}
 function summarize(readings) {
 	const contexts = readings.map((r) => r.firstTurnContext).filter((v) => v !== null).sort((a, b) => a - b);
+	const overheads = readings.map((r) => r.overhead).filter((v) => v !== null);
 	const models = [...new Set(readings.map((r) => r.model).filter((m) => !!m))];
 	if (contexts.length === 0) return {
 		count: readings.length,
 		min: null,
 		median: null,
 		max: null,
+		medianOverhead: median(overheads),
 		models
 	};
-	const mid = Math.floor(contexts.length / 2);
-	const median = contexts.length % 2 ? contexts[mid] : (contexts[mid - 1] + contexts[mid]) / 2;
 	return {
 		count: readings.length,
 		min: contexts[0],
-		median,
+		median: median(contexts),
 		max: contexts[contexts.length - 1],
+		medianOverhead: median(overheads),
 		models
 	};
 }
@@ -10192,17 +10285,25 @@ async function auditSpawn(n = 10) {
 	const { workers } = readWorkersSection();
 	const logDir = workersLogDir(workers);
 	const agentLogs = newestAgentSubagentLogs(n);
-	const agentReadings = await Promise.all(agentLogs.map(readOne));
+	const agentReadings = await Promise.all(agentLogs.map((path) => readOne(path, "agentSubagents")));
 	const workerLogs = newestWorkerLogs(logDir, n);
-	const workerReadings = await Promise.all(workerLogs.map(readOne));
+	const workerReadings = await Promise.all(workerLogs.map((path) => readOne(path, "workersInteractive")));
 	const interactive = [];
 	const headless = [];
-	for (const reading of workerReadings) if (readWorkerStatus(logDir, workerIdFromLogPath(reading.path))?.outputFormat) headless.push(reading);
+	for (const reading of workerReadings) if (readWorkerStatus(logDir, workerIdFromLogPath(reading.path))?.outputFormat) headless.push({
+		...reading,
+		group: "workersHeadless"
+	});
 	else interactive.push(reading);
 	return {
 		agentSubagents: summarize(agentReadings),
 		workersInteractive: summarize(interactive),
-		workersHeadless: summarize(headless)
+		workersHeadless: summarize(headless),
+		readings: [
+			...agentReadings,
+			...interactive,
+			...headless
+		]
 	};
 }
 
@@ -10332,6 +10433,45 @@ function extract(pattern, text) {
 	const match = text.match(pattern);
 	return match ? match[1] : null;
 }
+/**
+* `--tools A,B` and `--tools=A,B` are both valid on the argv this process was
+* launched with; an explicit but empty value (`--tools ""` / `--tools=`)
+* means "no tools at all", distinct from the flag being absent entirely.
+*/
+function extractToolsArg(line) {
+	const eq = line.match(/--tools=(?:"([^"]*)"|(\S*))/);
+	if (eq) return eq[1] !== void 0 ? eq[1] : eq[2];
+	const sp = line.match(/--tools\s+(?:"([^"]*)"|(\S+))/);
+	if (sp) return sp[1] !== void 0 ? sp[1] : sp[2];
+	return null;
+}
+function extractMcpConfigArg(line) {
+	const eq = line.match(/--mcp-config=(?:"([^"]*)"|(\S*))/);
+	if (eq) return eq[1] !== void 0 ? eq[1] : eq[2];
+	const sp = line.match(/--mcp-config\s+(?:"([^"]*)"|(\S+))/);
+	if (sp) return sp[1] !== void 0 ? sp[1] : sp[2];
+	return null;
+}
+/**
+* No `--tools` flag: the CLI default tool set applies, which includes
+* ToolSearch, so deferral is on. An explicit but empty list means no tools
+* at all, so deferral doesn't apply. Otherwise deferral is on only if the
+* explicit list still names ToolSearch.
+*/
+function classifyDeferral(toolsArg) {
+	if (toolsArg === null) return "on";
+	if (toolsArg.trim() === "") return "n/a";
+	return toolsArg.split(",").map((t) => t.trim()).includes("ToolSearch") ? "on" : "OFF";
+}
+function countMcpServersInFile(path) {
+	try {
+		const resolved = path.startsWith("~") ? join(homedir(), path.slice(1)) : path;
+		const parsed = JSON.parse(readFileSync(resolved, "utf8"));
+		return Object.keys(parsed.mcpServers ?? {}).length;
+	} catch {
+		return 0;
+	}
+}
 function readProcessEnvLine(pid) {
 	try {
 		return execFileSync("ps", [
@@ -10366,6 +10506,8 @@ function auditEnv() {
 		const modelPattern = /ANTHROPIC_DEFAULT_(\w+?)_MODEL=(\S*)/g;
 		let modelMatch;
 		while (modelMatch = modelPattern.exec(line)) defaultModels[modelMatch[1]] = modelMatch[2];
+		const toolsArg = extractToolsArg(line);
+		const mcpConfigPath = extractMcpConfigArg(line);
 		processes.push({
 			pid,
 			baseUrl: extract(/ANTHROPIC_BASE_URL=(\S*)/, line),
@@ -10373,7 +10515,10 @@ function auditEnv() {
 			defaultModels,
 			enableToolSearch: extract(/ENABLE_TOOL_SEARCH=(\S*)/, line),
 			workerId: extract(/PAI_WORKER_ID=(\S*)/, line),
-			age: readProcessAge(pid)
+			age: readProcessAge(pid),
+			toolsArg,
+			mcpServers: mcpConfigPath ? countMcpServersInFile(mcpConfigPath) : "default",
+			deferral: classifyDeferral(toolsArg)
 		});
 	}
 	let mcpServerCount = 0;
@@ -10467,6 +10612,264 @@ function auditSchedule(ttlSeconds = DEFAULT_TTL_SECONDS) {
 	};
 }
 
+//#endregion
+//#region src/audit/skills.ts
+/**
+* `pai audit tokens skills` — token cost of the whole skill/command/plugin
+* catalogue: every `SKILL.md` under ~/.claude/skills and ~/.claude/plugins,
+* plus every command under ~/.claude/commands, rendered as the one-line
+* `- name: description` entry Claude Code loads into context for each.
+*
+* Two failure modes matter more than the raw total: the same real file
+* reachable through two paths (a plugin's marketplaces/ checkout and its
+* cache/ install both point at one file), and two different real files that
+* collide on name (a skill and a command both called "Sessions") — the first
+* wastes nothing but must not be double-counted, the second silently shadows
+* one of the two in whichever catalogue order Claude Code loads them.
+*/
+/** Recursively collect every file under `dir` whose basename satisfies `matches`. */
+function findFilesRecursive(dir, matches) {
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	const found = [];
+	for (const entry of entries) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) found.push(...findFilesRecursive(full, matches));
+		else if (entry.isFile() && matches(entry.name)) found.push(full);
+	}
+	return found;
+}
+/**
+* `<skillsDir>/*\/SKILL.md`, one level deep only — this is what Claude Code
+* actually loads. `readdirSync(withFileTypes)` reports a symlinked skill
+* directory as neither file nor directory, so entries are resolved with
+* `statSync` (which follows symlinks) instead of trusting `Dirent`.
+*/
+function findTopLevelSkillFiles(skillsDir) {
+	let entries;
+	try {
+		entries = readdirSync(skillsDir);
+	} catch {
+		return [];
+	}
+	const found = [];
+	for (const name of entries) {
+		const dir = join(skillsDir, name);
+		let isDir = false;
+		try {
+			isDir = statSync(dir).isDirectory();
+		} catch {
+			continue;
+		}
+		if (!isDir) continue;
+		const skillFile = join(dir, "SKILL.md");
+		if (existsSync(skillFile)) found.push(skillFile);
+	}
+	return found;
+}
+/** Every SKILL.md/*.md the three catalogue roots contribute, source-tagged. */
+function findCatalogueFiles(claudeDir) {
+	const found = [];
+	for (const path of findTopLevelSkillFiles(join(claudeDir, "skills"))) found.push({
+		path,
+		source: "skills"
+	});
+	for (const path of findFilesRecursive(join(claudeDir, "commands"), (n) => n.endsWith(".md"))) found.push({
+		path,
+		source: "commands"
+	});
+	for (const path of findFilesRecursive(join(claudeDir, "plugins"), (n) => n === "SKILL.md")) found.push({
+		path,
+		source: "plugins"
+	});
+	return found;
+}
+/** Strip a single layer of matching quotes ("..." or '...') from a trimmed value. */
+function unquote(value) {
+	if (value.length >= 2) {
+		const first = value[0];
+		const last = value[value.length - 1];
+		if (first === "\"" && last === "\"" || first === "'" && last === "'") return value.slice(1, -1);
+	}
+	return value;
+}
+/** Parse the `name:`/`description:` frontmatter fields out of a skill/command file. */
+function parseFrontmatter(text) {
+	const match = /^---\n([\s\S]*?)\n---/.exec(text);
+	const fm = match ? match[1] : "";
+	const nameMatch = /^name:\s*(.+)$/m.exec(fm);
+	const descMatch = /(?:^|\n)description:\s*(.+?)(?=\n\w[\w-]*:|$)/s.exec(fm);
+	return {
+		name: nameMatch ? unquote(nameMatch[1].trim()) : null,
+		description: descMatch ? unquote(descMatch[1].trim()) : ""
+	};
+}
+function nameFallback(path, source) {
+	if (source === "commands") return basename(path).replace(/\.md$/, "");
+	return basename(dirname(path));
+}
+/** Build one catalogue entry from a file, deriving its name/description/tokens. */
+function readEntry(path, source) {
+	let text = "";
+	try {
+		text = readFileSync(path, "utf8");
+	} catch {}
+	const fm = parseFrontmatter(text);
+	const name = fm.name ?? nameFallback(path, source);
+	const line = `- ${name}: ${fm.description}`;
+	return {
+		name,
+		description: fm.description,
+		source,
+		path,
+		tokens: countTokens(line),
+		enabled: true
+	};
+}
+/** `enabledPlugins` map from settings.json, or `{}` if the file is missing/unreadable. */
+function readEnabledPlugins(settingsPath) {
+	try {
+		return JSON.parse(readFileSync(settingsPath, "utf8")).enabledPlugins ?? {};
+	} catch {
+		return {};
+	}
+}
+/** `<relative-to-root>` split on the platform separator, or null if `path` is not under `root`. */
+function pathUnder(root, path) {
+	const rel = relative(root, path);
+	if (rel.startsWith("..")) return null;
+	return rel.split(sep);
+}
+/**
+* A cache install is `plugins/cache/<marketplace>/<plugin>/<version>/...`, so its id is exact.
+* A marketplace checkout is `plugins/marketplaces/<marketplace>/...` with no plugin segment, so
+* it can only be matched by marketplace name against whichever `enabledPlugins` key ends in
+* `@<marketplace>` — good enough for the single-plugin-per-marketplace installs this audits today.
+*/
+function resolvePluginStatus(claudeDir, path, enabledPlugins) {
+	const cacheParts = pathUnder(join(claudeDir, "plugins", "cache"), path);
+	if (cacheParts && cacheParts.length >= 4) {
+		const [marketplace, plugin, , ...suffix] = cacheParts;
+		const id = `${plugin}@${marketplace}`;
+		const known = id in enabledPlugins;
+		return {
+			id,
+			enabled: known && enabledPlugins[id] === true,
+			status: known ? void 0 : "unknown",
+			dedupeKey: `${id}::${suffix.join("/")}`
+		};
+	}
+	const marketplaceParts = pathUnder(join(claudeDir, "plugins", "marketplaces"), path);
+	if (marketplaceParts && marketplaceParts.length >= 2) {
+		const [marketplace, ...suffix] = marketplaceParts;
+		const matchKey = Object.keys(enabledPlugins).find((k) => k.endsWith(`@${marketplace}`));
+		if (matchKey) return {
+			id: matchKey,
+			enabled: enabledPlugins[matchKey] === true,
+			dedupeKey: `${matchKey}::${suffix.join("/")}`
+		};
+		return {
+			id: `unknown@${marketplace}`,
+			enabled: false,
+			status: "unknown",
+			dedupeKey: `unknown@${marketplace}::${suffix.join("/")}`
+		};
+	}
+	return {
+		id: path,
+		enabled: false,
+		status: "unknown",
+		dedupeKey: path
+	};
+}
+/** Group entries by case-insensitive name; only groups with >1 real path. */
+function findDuplicates(entries) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const key = entry.name.toLowerCase();
+		if (!byName.has(key)) byName.set(key, /* @__PURE__ */ new Set());
+		byName.get(key).add(entry.path);
+	}
+	const duplicates = [];
+	for (const [name, paths] of byName) if (paths.size > 1) duplicates.push({
+		name,
+		paths: [...paths]
+	});
+	return duplicates.sort((a, b) => a.name.localeCompare(b.name));
+}
+function auditSkills(claudeDir = join(homedir(), ".claude"), settingsPath = join(claudeDir, "settings.json")) {
+	const rawFiles = findCatalogueFiles(claudeDir);
+	const seenReal = /* @__PURE__ */ new Set();
+	const deduped = [];
+	for (const file of rawFiles) {
+		let real = file.path;
+		try {
+			real = realpathSync(file.path);
+		} catch {}
+		if (seenReal.has(real)) continue;
+		seenReal.add(real);
+		deduped.push(file);
+	}
+	const enabledPlugins = readEnabledPlugins(settingsPath);
+	const entries = deduped.map((f) => readEntry(f.path, f.source));
+	const dedupeKeys = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (entry.source !== "plugins") continue;
+		const status = resolvePluginStatus(claudeDir, entry.path, enabledPlugins);
+		entry.enabled = status.enabled;
+		entry.status = status.status;
+		dedupeKeys.set(entry.path, status.dedupeKey);
+	}
+	const totalsBySource = {
+		skills: 0,
+		commands: 0,
+		plugins: 0
+	};
+	const countsBySource = {
+		skills: 0,
+		commands: 0,
+		plugins: 0
+	};
+	const enabledTotalsBySource = {
+		skills: 0,
+		commands: 0,
+		plugins: 0
+	};
+	const seenEnabledPluginKeys = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		totalsBySource[entry.source] += entry.tokens;
+		countsBySource[entry.source] += 1;
+		if (!entry.enabled) continue;
+		if (entry.source !== "plugins") {
+			enabledTotalsBySource[entry.source] += entry.tokens;
+			continue;
+		}
+		const dedupeKey = dedupeKeys.get(entry.path);
+		if (seenEnabledPluginKeys.has(dedupeKey)) continue;
+		seenEnabledPluginKeys.add(dedupeKey);
+		enabledTotalsBySource.plugins += entry.tokens;
+	}
+	return {
+		encoding: TOKEN_ENCODING,
+		entries,
+		total: entries.reduce((sum, e) => sum + e.tokens, 0),
+		totalsBySource,
+		countsBySource,
+		enabledTotal: enabledTotalsBySource.skills + enabledTotalsBySource.commands + enabledTotalsBySource.plugins,
+		enabledTotalsBySource,
+		duplicates: findDuplicates(entries)
+	};
+}
+function topByTokens(report, n) {
+	return [...report.entries].sort((a, b) => b.tokens - a.tokens).slice(0, n);
+}
+const SKILL_CATALOGUE_AMBER = 3e3;
+const SKILL_CATALOGUE_RED = 6e3;
+
 //#endregion
 //#region src/audit/severity.ts
 const HOOK_TOKEN_LIMIT = 1e3;
@@ -10528,9 +10931,197 @@ function buildFindings(input) {
 		severity: "GREEN",
 		evidence: `${input.env.processes.length} claude process(es), none proxied`
 	});
+	const deferralOff = input.env.processes.filter((p) => {
+		const mcpCount = p.mcpServers === "default" ? input.env.mcpServerCount : p.mcpServers;
+		return p.deferral === "OFF" && mcpCount > 0;
+	});
+	findings.push({
+		finding: "tool deferral on live processes",
+		severity: deferralOff.length > 0 ? "RED" : "GREEN",
+		evidence: deferralOff.length > 0 ? deferralOff.map((p) => `pid ${p.pid}: ${p.mcpServers === "default" ? input.env.mcpServerCount : p.mcpServers} mcp servers, tools=${p.toolsArg}`).join("; ") : `${input.env.processes.length} claude process(es) checked, none with an explicit --tools list missing ToolSearch and MCP servers registered`
+	});
+	const skillTokens = input.skills.enabledTotal;
+	findings.push({
+		finding: "skill catalogue tokens",
+		severity: skillTokens > SKILL_CATALOGUE_RED ? "RED" : skillTokens > SKILL_CATALOGUE_AMBER ? "AMBER" : "GREEN",
+		evidence: `${skillTokens} tokens loaded (${input.skills.total} on disk) across ${input.skills.entries.length} entries` + (input.skills.duplicates.length ? `, ${input.skills.duplicates.length} case-insensitive duplicate name(s)` : "")
+	});
 	return sortFindings(findings);
 }
 
+//#endregion
+//#region src/audit/ladder.ts
+/**
+* `pai audit tokens ladder` — LIVE: what each layer of headless-worker
+* scaffolding actually costs in first-turn context, measured by spawning the
+* real `claude -p` binary at increasing configuration and reading the
+* `usage` block of its `--output-format json` result. No section above this
+* one makes a network call; this is the one exception, gated behind `--live`.
+*
+* Rungs (each a superset of the last, except L3 which drops every flag):
+*   L0  empty MCP config, no tool schemas at all
+*   L1  same, plus the core file/shell tool schemas (`--tools`)
+*   L2  same as L1, but the empty MCP config is swapped for a real one
+*   L3  plain: none of --strict-mcp-config / --mcp-config / --tools
+*/
+const PROBE_PROMPT = "Reply with exactly the single word OK and nothing else. Do not use any tool.";
+const LADDER_TOOLS = "Bash,Read,Edit,Write,Grep,Glob,Skill,ToolSearch";
+const LADDER_TIMEOUT_MS = 18e4;
+const DEFAULT_LADDER_MODEL = "haiku";
+/** Build the four rungs' argv. Pure — no spawning, so it's unit-testable. */
+function buildLadderRungs(model, emptyMcpPath, realMcpPath) {
+	const base = [
+		"-p",
+		PROBE_PROMPT,
+		"--model",
+		model,
+		"--output-format",
+		"json"
+	];
+	return [
+		{
+			id: "L0",
+			description: "empty MCP config, no tools",
+			args: [
+				...base,
+				"--strict-mcp-config",
+				"--mcp-config",
+				emptyMcpPath,
+				"--tools",
+				""
+			]
+		},
+		{
+			id: "L1",
+			description: `empty MCP config, --tools ${LADDER_TOOLS}`,
+			args: [
+				...base,
+				"--strict-mcp-config",
+				"--mcp-config",
+				emptyMcpPath,
+				"--tools",
+				LADDER_TOOLS
+			]
+		},
+		{
+			id: "L2",
+			description: `real MCP config, --tools ${LADDER_TOOLS}`,
+			args: [
+				...base,
+				"--strict-mcp-config",
+				"--mcp-config",
+				realMcpPath,
+				"--tools",
+				LADDER_TOOLS
+			]
+		},
+		{
+			id: "L3",
+			description: "plain (no --strict-mcp-config, no --mcp-config, no --tools)",
+			args: [...base]
+		}
+	];
+}
+/** Newest `*.mcp.json` in a worker log dir, or null if none exist. */
+function newestMcpConfig(logDir) {
+	let files;
+	try {
+		files = readdirSync(logDir);
+	} catch {
+		return null;
+	}
+	const candidates = files.filter((f) => f.endsWith(".mcp.json")).map((f) => join(logDir, f));
+	if (candidates.length === 0) return null;
+	return candidates.map((path) => ({
+		path,
+		mtime: statSync(path).mtimeMs
+	})).sort((a, b) => b.mtime - a.mtime)[0].path;
+}
+/** Spawn one rung of `claude -p ...` and read its usage-derived first-turn context. */
+function runRung(rung, cwd) {
+	return new Promise((resolvePromise) => {
+		const env = { ...process.env };
+		delete env.PAI_WORKER;
+		const proc = spawn("claude", rung.args, {
+			cwd,
+			env,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		let out = "";
+		let timedOut = false;
+		const timer = setTimeout(() => {
+			timedOut = true;
+			try {
+				proc.kill("SIGKILL");
+			} catch {}
+		}, LADDER_TIMEOUT_MS);
+		proc.stdout.on("data", (chunk) => {
+			out += chunk.toString("utf8");
+		});
+		proc.on("error", (e) => {
+			clearTimeout(timer);
+			resolvePromise({
+				firstTurnContext: null,
+				timedOut: false,
+				error: e.message
+			});
+		});
+		proc.on("close", () => {
+			clearTimeout(timer);
+			if (timedOut) {
+				resolvePromise({
+					firstTurnContext: null,
+					timedOut: true
+				});
+				return;
+			}
+			try {
+				resolvePromise({
+					firstTurnContext: usageContextTokens(JSON.parse(out.trim()).usage),
+					timedOut: false
+				});
+			} catch (e) {
+				resolvePromise({
+					firstTurnContext: null,
+					timedOut: false,
+					error: e.message
+				});
+			}
+		});
+	});
+}
+async function auditLadder(opts) {
+	const model = opts.model ?? DEFAULT_LADDER_MODEL;
+	const emptyMcpPath = ensureNoMcpConfig(opts.logDir);
+	const realMcpPath = opts.mcpConfigPath ?? newestMcpConfig(opts.logDir) ?? emptyMcpPath;
+	const cwd = opts.cwd ?? process.cwd();
+	const rungs = buildLadderRungs(model, emptyMcpPath, realMcpPath);
+	const readings = [];
+	let previous = null;
+	for (const rung of rungs) {
+		const result = await runRung(rung, cwd);
+		const delta = result.firstTurnContext !== null && previous !== null ? result.firstTurnContext - previous : null;
+		readings.push({
+			id: rung.id,
+			description: rung.description,
+			firstTurnContext: result.firstTurnContext,
+			timedOut: result.timedOut,
+			error: result.error,
+			delta
+		});
+		if (result.firstTurnContext !== null) previous = result.firstTurnContext;
+	}
+	return {
+		model,
+		mcpConfigPath: realMcpPath,
+		readings
+	};
+}
+
 //#endregion
 //#region src/cli/commands/audit.ts
 function severityColor(sev, text) {
@@ -10617,10 +11208,35 @@ function printSpawnGroup(name, stats) {
 		stats.min === null ? "n/a" : String(stats.min),
 		stats.median === null ? "n/a" : String(stats.median),
 		stats.max === null ? "n/a" : String(stats.max),
+		stats.medianOverhead === null ? "n/a" : String(stats.medianOverhead),
 		stats.models.join(", ")
 	];
 }
-function printSpawn(report) {
+const SPAWN_GROUP_LABELS = {
+	agentSubagents: "Agent-tool subagents",
+	workersInteractive: "pai workers (interactive/pane)",
+	workersHeadless: "pai workers (headless -p)"
+};
+function printSpawn(report, detail) {
+	if (detail) {
+		console.log(header("Spawn overhead — per-log detail"));
+		const rows = report.readings.map((r) => [
+			SPAWN_GROUP_LABELS[r.group] ?? r.group,
+			r.firstTurnContext === null ? "n/a" : String(r.firstTurnContext),
+			r.promptTokens === null ? "n/a" : String(r.promptTokens),
+			r.overhead === null ? "n/a" : String(r.overhead),
+			r.model ?? "",
+			shortenPath(r.path, 70)
+		]);
+		console.log(renderTable([
+			"group",
+			"first-turn ctx",
+			"prompt tok",
+			"overhead",
+			"model",
+			"path"
+		], rows));
+	}
 	console.log(header("Spawn overhead (first-turn context tokens)"));
 	const rows = [
 		printSpawnGroup("Agent-tool subagents", report.agentSubagents),
@@ -10633,13 +11249,14 @@ function printSpawn(report) {
 		"min",
 		"median",
 		"max",
+		"median overhead",
 		"models"
 	], rows));
 }
 async function cmdSpawn(opts) {
 	const report = await auditSpawn(opts.n ? parseInt(opts.n, 10) : 10);
 	if (opts.json) return printJson(report);
-	printSpawn(report);
+	printSpawn(report, opts.detail);
 }
 function printDaemon(report) {
 	console.log(header(`Daemon log: ${report.logPath}`));
@@ -10679,6 +11296,8 @@ function printEnv(report) {
 		p.authTokenPresent ? "present" : "absent",
 		JSON.stringify(p.defaultModels),
 		p.enableToolSearch ?? "",
+		String(p.mcpServers),
+		p.deferral === "OFF" ? err(p.deferral) : p.deferral === "n/a" ? dim$1(p.deferral) : p.deferral,
 		p.workerId ?? "",
 		p.age ?? ""
 	]);
@@ -10688,10 +11307,16 @@ function printEnv(report) {
 		"auth token",
 		"default models",
 		"tool search",
+		"tools",
+		"deferral",
 		"worker id",
 		"age"
 	], rows));
-	for (const p of report.processes) if (p.baseUrl) console.log(err(`  RED: claude process ${p.pid} is routed through ${p.baseUrl}`));
+	for (const p of report.processes) {
+		if (p.baseUrl) console.log(err(`  RED: claude process ${p.pid} is routed through ${p.baseUrl}`));
+		const mcpCount = p.mcpServers === "default" ? report.mcpServerCount : p.mcpServers;
+		if (p.deferral === "OFF" && mcpCount > 0) console.log(err(`  RED: claude process ${p.pid} has --tools without ToolSearch (${mcpCount} MCP servers registered)`));
+	}
 	console.log(dim$1(`MCP servers registered: ${report.mcpServerCount}`));
 	console.log(dim$1(`settings.json model: ${report.settingsModel ?? "unset"}, effortLevel: ${report.settingsEffortLevel ?? "unset"}`));
 }
@@ -10729,6 +11354,86 @@ async function cmdSchedule(opts) {
 	if (opts.json) return printJson(report);
 	printSchedule(report);
 }
+function printSkills(report, top) {
+	console.log(header(`Skill/command/plugin catalogue (encoding: ${report.encoding})`));
+	console.log(dim$1(`${report.entries.length} entries, ${report.enabledTotal} tokens loaded (${report.total} on disk)`));
+	const subtotalRows = [
+		"skills",
+		"commands",
+		"plugins"
+	].map((source) => [
+		source,
+		String(report.countsBySource[source]),
+		String(report.totalsBySource[source]),
+		String(report.enabledTotalsBySource[source])
+	]);
+	console.log(renderTable([
+		"source",
+		"entries",
+		"tokens",
+		"enabled"
+	], subtotalRows));
+	console.log(header(`Top ${top} by tokens`));
+	const topRows = topByTokens(report, top).map((e) => [
+		String(e.tokens),
+		e.source,
+		e.enabled ? "yes" : "no",
+		e.name,
+		e.path
+	]);
+	console.log(renderTable([
+		"tokens",
+		"source",
+		"on",
+		"name",
+		"path"
+	], topRows));
+	console.log(header("Case-insensitive duplicate names"));
+	if (report.duplicates.length === 0) console.log(dim$1("none"));
+	else for (const dup of report.duplicates) {
+		console.log(`${bold$1(dup.name)}:`);
+		for (const path of dup.paths) console.log(`  ${path}`);
+	}
+}
+function cmdSkills(opts) {
+	const top = opts.top ? parseInt(opts.top, 10) : 15;
+	const report = auditSkills();
+	if (opts.json) return printJson({
+		...report,
+		top: topByTokens(report, top)
+	});
+	printSkills(report, top);
+}
+function printLadder(report) {
+	console.log(header(`Context ladder (model: ${report.model}, mcp config: ${report.mcpConfigPath})`));
+	const rows = report.readings.map((r) => [
+		r.id,
+		r.description,
+		r.timedOut ? "TIMEOUT" : r.firstTurnContext === null ? `n/a${r.error ? ` (${r.error})` : ""}` : String(r.firstTurnContext),
+		r.delta === null ? "n/a" : String(r.delta)
+	]);
+	console.log(renderTable([
+		"rung",
+		"description",
+		"first-turn tokens",
+		"delta"
+	], rows));
+}
+async function cmdLadder(opts) {
+	if (!opts.live) {
+		console.log(warn$1("Refusing to run: `pai audit tokens ladder` spawns several real `claude -p` calls (billed API traffic). Pass --live to run it."));
+		return;
+	}
+	const { workers } = readWorkersSection();
+	const logDir = workersLogDir(workers);
+	const report = await auditLadder({
+		model: opts.model,
+		mcpConfigPath: opts.mcpConfig,
+		logDir
+	});
+	if (opts.json) return printJson(report);
+	printLadder(report);
+}
 async function cmdCombined(opts) {
 	const cwd = process.cwd();
 	const files = auditFiles(defaultFileSet(cwd));
@@ -10738,12 +11443,14 @@ async function cmdCombined(opts) {
 	const env = auditEnv();
 	const spawn = await auditSpawn();
 	const schedule = auditSchedule(cacheTtlSeconds(session?.cacheCreationSplit));
+	const skills = auditSkills();
 	const findings = buildFindings({
 		files,
 		hooks,
 		session,
 		daemon,
-		env
+		env,
+		skills
 	});
 	if (opts.json) return printJson({
 		encoding: TOKEN_ENCODING,
@@ -10754,7 +11461,8 @@ async function cmdCombined(opts) {
 		spawn,
 		daemon,
 		env,
-		schedule
+		schedule,
+		skills
 	});
 	console.log(header("pai audit tokens — combined report"));
 	console.log(dim$1(`token encoding: ${TOKEN_ENCODING}`));
@@ -10778,7 +11486,7 @@ async function cmdCombined(opts) {
 * `--json` on `pai audit tokens files` silently produced the table output.
 */
 function registerAuditCommands(auditCmd) {
-	const tokensCmd = auditCmd.command("tokens").description("Token-waste audit: memory files, hooks, session usage, spawn overhead, daemon, env, schedule").option("--json", "Print JSON instead of a table").action(async () => {
+	const tokensCmd = auditCmd.command("tokens").description("Token-waste audit: memory files, hooks, session usage, spawn overhead, daemon, env, schedule, skill catalogue").option("--json", "Print JSON instead of a table").action(async () => {
 		await cmdCombined(jsonOpt());
 	});
 	const jsonOpt = () => tokensCmd.opts();
@@ -10789,7 +11497,7 @@ function registerAuditCommands(auditCmd) {
 	tokensCmd.command("session").description("Cache/input/output token split for a session transcript (default: newest)").argument("[path]", "Session JSONL path (default: newest under ~/.claude/projects)").action(async (path) => {
 		await cmdSession(path, jsonOpt());
 	});
-	tokensCmd.command("spawn").description("Spawn-overhead comparison: Agent-tool subagents vs. pai workers").option("-n, --n <count>", "How many of the newest logs per group to read (default 10)").action(async (opts) => {
+	tokensCmd.command("spawn").description("Spawn-overhead comparison: Agent-tool subagents vs. pai workers").option("-n, --n <count>", "How many of the newest logs per group to read (default 10)").option("--detail", "Print one row per log (first-turn ctx, prompt tokens, overhead, model, path)").action(async (opts) => {
 		await cmdSpawn({
 			...jsonOpt(),
 			...opts
@@ -10800,6 +11508,18 @@ function registerAuditCommands(auditCmd) {
 	tokensCmd.command("schedule").description("Launchd agents / crontab entries that outpace the measured prompt-cache TTL").action(async () => {
 		await cmdSchedule(jsonOpt());
 	});
+	tokensCmd.command("skills").description("Token cost of the SKILL.md / command / plugin catalogue, top entries, duplicate names").option("--top <n>", "How many top-by-tokens entries to show (default 15)").action((opts) => {
+		cmdSkills({
+			...jsonOpt(),
+			...opts
+		});
+	});
+	tokensCmd.command("ladder").description("LIVE: first-turn context at increasing headless-worker configuration (spawns real claude -p calls)").option("--live", "Actually spawn claude -p (billed API traffic); refuses without this flag").option("--model <model>", "Model to probe with (default haiku)").option("--mcp-config <path>", "MCP config for the L2 rung (default: newest *.mcp.json in the workers log dir)").action(async (opts) => {
+		await cmdLadder({
+			...jsonOpt(),
+			...opts
+		});
+	});
 }
 
 //#endregion
@@ -16005,9 +16725,11 @@ function fail(e) {
 	process.exitCode = 1;
 }
 function registerWorkerCommands(workerCmd) {
-	workerCmd.command("run").description("Run one claude-code worker through the configured provider.\nUnknown options are passed to claude verbatim (e.g. -p, --allowedTools);\n--output-format/--verbose are handled here.\n--label \"<goal>\" is optional — it is the row shown in ps / follow /\nthe status line; when absent it is derived from the prompt's first line\n(--chain/--agent derive their own instead).\n--spec <file> (or --spec -) reads the prompt from a file/stdin instead of\nan inline -p '<prompt>', which breaks on shell quoting; mutually\nexclusive with -p.\nGrant MCP tools by naming mcp__server__tool in --allowedTools (the server loads automatically);\n--chain draft,implement[,review] runs a spec-first pipeline;\n--agent <name> runs an agent definition from ~/.claude/agents.").allowUnknownOption(true).option("--provider <name>", "Provider to run on (default: active, else routing order)").option("--class <name>", "Use the provider of this class (draft, implement, review, research, spotcheck, simple, complex, image)").option("--role <name>", "Alias of --class (roles were renamed to classes)").option("--chain <stages>", "Comma-separated stage classes, e.g. draft,implement or draft,implement,review").option("--agent <name>", "Run the agent definition ~/.claude/agents/<name>.md on a worker").option("--model <model>", "Override the model for this run. Headless (-p) workers default to the --class model; an interactive launch (no -p) with no --model uses the harness default model from settings.json.").option("--label <text>", "Short task label shown in ps / follow / status line (default: first line of the prompt)").option("--spec <path>", "Read the prompt from this file (or - for stdin) instead of -p; mutually exclusive with -p").option("--cwd <dir>", "Directory the worker runs in (default: this process's cwd)").option("--mcp <names>", "MCP servers/sets this worker may use (comma-separated; see `pai worker mcp`)").option("--no-pane", "Do not open a follow pane for this worker").option("--worktree", "Run in a git worktree on branch worker/<id> (default for implement/complex/plan in a git repo)").option("--no-worktree", "Run in place, no worktree").option("--print-cmd", "Print the assembled claude argv as JSON and exit, without spawning (audit tool)").argument("[args...]", "claude arguments, e.g. -p '<task>' --allowedTools 'Read,Edit,Bash'").action(async (args, opts) => {
+	workerCmd.command("run").description("Run one claude-code worker through the configured provider.\nUnknown options are passed to claude verbatim (e.g. -p, --allowedTools);\n--output-format/--verbose are handled here.\n--label \"<goal>\" is optional — it is the row shown in ps / follow /\nthe status line; when absent it is derived from the prompt's first line\n(--chain/--agent derive their own instead).\n--spec <file> (or --spec -) reads the prompt from a file/stdin instead of\nan inline -p '<prompt>', which breaks on shell quoting; mutually\nexclusive with -p.\nGrant MCP tools by naming mcp__server__tool in --allowedTools (the server loads automatically);\n--chain draft,implement[,review] runs a spec-first pipeline;\n--agent <name> runs an agent definition from ~/.claude/agents.").allowUnknownOption(true).option("--provider <name>", "Provider to run on (default: active, else routing order)").option("--class <name>", "Use the provider of this class (draft, implement, review, research, spotcheck, simple, complex, image)").option("--role <name>", "Alias of --class (roles were renamed to classes)").option("--chain <stages>", "Comma-separated stage classes, e.g. draft,implement or draft,implement,review").option("--agent <name>", "Run the agent definition ~/.claude/agents/<name>.md on a worker").option("--model <model>", "Override the model for this run. Headless (-p) workers default to the --class model; an interactive launch (no -p) with no --model uses the harness default model from settings.json.").option("--label <text>", "Short task label shown in ps / follow / status line (default: first line of the prompt)").option("--spec <path>", "Read the prompt from this file (or - for stdin) instead of -p; mutually exclusive with -p").option("--cwd <dir>", "Directory the worker runs in (default: this process's cwd)").option("--mcp <names>", "MCP servers/sets this worker may use (comma-separated; see `pai worker mcp`)").option("--no-pane", "Do not open a follow pane for this worker").option("--worktree", "Run in a git worktree on branch worker/<id> (default for implement/complex/plan in a git repo)").option("--no-worktree", "Run in place, no worktree").option("--print-cmd", "Print the assembled claude argv as JSON and exit, without spawning (audit tool)").option("--report <format>", "Final-report contract/parser: json or ag2 (default: ag2, or PAI_WORKER_REPORT)").option("--no-report-retry", "Skip the one bounded re-ask when the final AG2 message fails validation").argument("[args...]", "claude arguments, e.g. -p '<task>' --allowedTools 'Read,Edit,Bash'").action(async (args, opts) => {
 		try {
 			const className = opts.class ?? opts.role;
+			if (opts.report !== void 0 && opts.report !== "json" && opts.report !== "ag2") throw new Error(`--report: expected "json" or "ag2", got "${opts.report}"`);
+			const reportFormatFlag = opts.report;
 			if (opts.cwd !== void 0) {
 				if (!existsSync(opts.cwd)) throw new Error(`--cwd: directory does not exist: ${opts.cwd}`);
 				if (!statSync(opts.cwd).isDirectory()) throw new Error(`--cwd: not a directory: ${opts.cwd}`);
@@ -16072,6 +16794,8 @@ function registerWorkerCommands(workerCmd) {
 				noPane: opts.pane === false,
 				worktreeFlag: opts.worktree,
 				printCmd: opts.printCmd,
+				reportFormatFlag,
+				noReportRetry: opts.reportRetry === false,
 				claudeArgs
 			});
 			process.exitCode = rc;
@@ -18630,4 +19354,4 @@ claude() {
 
 //#endregion
 export { drainStdio as n, buildProgram as t };
-//# sourceMappingURL=program-LLNPpxlj.mjs.map
+//# sourceMappingURL=program-C5jRQ1kg.mjs.map