@tekmidian/pai 0.42.6 → 0.44.0

package/dist/{program-LLNPpxlj.mjs → program-cr5U1-DK.mjs}

@@ -12,16 +12,17 @@ import { B as claudeProjectsDir, C as findLatestNote, H as scanTranscriptFolders
 import { a as expandHome, c as paiConfigFilePath, i as ensureConfigDir, l as OWNER_LABEL_PREFIX, n as CONFIG_FILE$2, o as loadConfig, s as migrateConfigFile, t as CONFIG_DIR, u as UNROUTED } from "./config-DCu8THKi.mjs";
 import { a as schedulerLogPath, i as paiSocketPath, n as daemonLogPath, r as daemonPidPath } from "./runtime-paths-B0P1TvUr.mjs";
 import { A as DEFAULT_CONTEXT_WINDOW, C as inlineWorkersYamlKeys, D as relocateWorkersYaml, E as parseWorkersYamlDocument, M as stripModelVariant, N as readJsonStrict, O as workersYamlLegacyNotice, P as writeJsonAtomic, S as initWorkersYaml, T as needsWorkersYamlRelocation, d as getProviderOrNative, f as isModelCapability, h as nativeAnthropicProvider, i as PROVIDER_TAGS, j as contextWindowFromModelId, k as workersYamlPath, m as maskKey, o as WorkersConfigError, r as MODEL_CAPABILITIES, t as ANTHROPIC_NATIVE, u as expandHome$1, v as readWorkersSection, w as migrateWorkersToYaml } from "./config-DxMZjpvY.mjs";
-import { D as isChatPane, F as longInlinePromptHint, I as parseRunnerArgs, M as saveStatus, N as setWorkerLabel, O as loadStatus, P as waitForTerminalStatus, R as describeMcp, S as UNLABELED, b as appendLedger, c as handoffFromInside, f as checkPaneForWorker, i as parseWorkerReport, k as loadStatuses, m as openPaneForWorker, n as runWorker, o as discardWorker, p as openFollowPane, r as testProvider, s as mergeWorker, u as sayToWorker, z as expandMcpNames } from "./run-DDdT9teG.mjs";
+import { A as loadStatus, B as describeMcp, F as setWorkerLabel, I as waitForTerminalStatus, L as longInlinePromptHint, P as saveStatus, R as parseRunnerArgs, S as appendLedger, V as expandMcpNames, a as projectLaunchConfig, c as discardWorker, f as sayToWorker, g as openPaneForWorker, h as openFollowPane, i as usageContextTokens, j as loadStatuses, k as isChatPane, l as mergeWorker, m as checkPaneForWorker, n as runWorker, o as parseWorkerReport, r as testProvider, u as handoffFromInside, w as UNLABELED } from "./run-BgExF8Xg.mjs";
 import { t as PaiClient } from "./ipc-client-C6NryMMb.mjs";
 import { r as humanDuration, t as createStorageBackend } from "./factory-DNYAqjH0.mjs";
+import { n as migrateIdentityFile } from "./wakeup-BfElduEU.mjs";
 import { a as renderDedupedSessions, c as probeResume, d as fmtAge, f as migrateSessionScanCache, h as scanSessions, i as normalizeName$2, l as restoreTopLevel, m as scanCacheFilePath, o as hasConversation, p as resolveSessionByNameOrId, r as buildDeduped, s as launchInDir, t as cmdMain, u as printExitDir } from "./main-resolver-DvYu9jbl.mjs";
 import { n as queriesDirPath, t as migrateQueriesDir } from "./query-feedback-CYyOGi3y.mjs";
 import { s as kgQuery } from "./kg-entity-BSjM5xZh.mjs";
-import { _ as workersLogDir, i as buildRunEnv, m as ledgerPath, n as ensureProxyRunning, p as eventsPath, r as stopProxy, t as DEFAULT_PROXY_PORT } from "./server-Ch99xt5K.mjs";
+import { _ as workersLogDir, f as ensureNoMcpConfig, i as buildRunEnv, m as ledgerPath, n as ensureProxyRunning, p as eventsPath, r as stopProxy, t as DEFAULT_PROXY_PORT } from "./server-Ch99xt5K.mjs";
 import { i as sendToSession, n as fetchLiveSessions, r as revealItermSession, t as callAiBroker } from "./aibroker-client-Bn9SnGMa.mjs";
-import { t as runChain } from "./chain-BbcfP77K.mjs";
-import { C as readSpecPrompt, S as statusLineOutput, _ as updateProvider, a as addProvider, b as psOutput, c as describeProviders, d as resolveProviderName, f as setClass, g as unsetClass, h as setWorkersEnabled, i as fallbackStatusText, l as modelPrefsText, m as setProviderModel, n as fallbackOn, o as classTargetText, p as setProviderEnabled, r as fallbackStatus, s as describeModels, t as fallbackOff, u as removeProvider, v as useProvider, w as resolveSpecPath, x as replayOutput, y as followWorkers } from "./fallback-Cwt4hmh5.mjs";
+import { t as runChain } from "./chain-DAEC9AU7.mjs";
+import { C as readSpecPrompt, S as statusLineOutput, _ as updateProvider, a as addProvider, b as psOutput, c as describeProviders, d as resolveProviderName, f as setClass, g as unsetClass, h as setWorkersEnabled, i as fallbackStatusText, l as modelPrefsText, m as setProviderModel, n as fallbackOn, o as classTargetText, p as setProviderEnabled, r as fallbackStatus, s as describeModels, t as fallbackOff, u as removeProvider, v as useProvider, w as resolveSpecPath, x as replayOutput, y as followWorkers } from "./fallback-CxGDTXWt.mjs";
 import { appendFileSync, chmodSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, platform, tmpdir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
@@ -1281,7 +1282,7 @@ function cmdConfig(db, identifier, opts) {
 * configured server loads, today's behavior. Names are validated against
 * ~/.claude.json's mcpServers / workers.mcpSets the same way `--mcp` is.
 */
-function cmdMcp(db, names, opts = {}) {
+function cmdMcp$1(db, names, opts = {}) {
 	const project = currentProject(db, opts.cwd);
 	if (!project) {
 		console.error(err("No registered project matches the current directory."));
@@ -2076,7 +2077,7 @@ function registerProjectsCommands(projectsCmd, getDb) {
 		cmdConfig(getDb(), identifier, opts);
 	});
 	projectsCmd.command("mcp [names...]").description("View or set the MCP servers this project's interactive supervisor session\nloads (run from inside the project, like `pai projects here`).\nNo names: print the current value. Names (comma-separated or repeated\nargs): set it, validated against ~/.claude.json's mcpServers.\n--clear: unset (all servers load — today's default).").option("--clear", "Unset — all MCP servers load again").action((names, opts) => {
-		cmdMcp(getDb(), names, opts);
+		cmdMcp$1(getDb(), names, opts);
 	});
 	projectsCmd.command("tools [names...]").description("View or set the built-in tool schemas this project's interactive\nsupervisor session loads (run from inside the project, like `pai projects\nhere`). No names: print the current value. Names (comma-separated or\nrepeated args): set it. --clear: unset (all tools load — today's default).").option("--clear", "Unset — all built-in tools load again").action((names, opts) => {
 		cmdTools(getDb(), names, opts);
@@ -5905,7 +5906,7 @@ function cmdLogs(opts) {
 }
 function registerDaemonCommands(daemonCmd) {
 	daemonCmd.command("serve").description("Start the PAI daemon in the foreground").action(async () => {
-		const { serve } = await import("./daemon-BNjbVsQU.mjs");
+		const { serve } = await import("./daemon-BVbvL8IA.mjs");
 		const { loadConfig: lc, ensureConfigDir } = await import("./config-DeqFqa1N.mjs");
 		ensureConfigDir();
 		await serve(lc());
@@ -7172,10 +7173,6 @@ async function stepSettings(rl, daName) {
 			DA: daName
 		},
 		hooks: [
-			{
-				hookType: "SessionStart",
-				command: "${ADAPTER_DIR}/Hooks/session-commands.mjs"
-			},
 			{
 				hookType: "SessionStart",
 				command: "${ADAPTER_DIR}/Hooks/load-core-context.mjs"
@@ -9972,15 +9969,17 @@ function emptyTotals() {
 * Fold one already-parsed JSONL line into a report being accumulated.
 * Exported separately so both the streaming file reader below and tests
 * (which build fixtures as arrays of objects, not files) share one path.
+* Returns the turn's context value when a new turn was counted, else null
+* (non-assistant line, no usage, or a duplicate message.id already seen).
 */
-function foldAssistantLine(report, seenIds, line) {
-	if (line.type !== "assistant") return;
+function foldAssistantLine(report, seenIds, line, threshold) {
+	if (line.type !== "assistant") return null;
 	const message = line.message;
 	const usage = message?.usage;
-	if (!usage) return;
+	if (!usage) return null;
 	const id = message?.id ?? line.uuid;
 	if (id) {
-		if (seenIds.has(id)) return;
+		if (seenIds.has(id)) return null;
 		seenIds.add(id);
 	}
 	report.turns++;
@@ -9991,6 +9990,9 @@ function foldAssistantLine(report, seenIds, line) {
 	const context = (Number(usage.cache_read_input_tokens) || 0) + (Number(usage.cache_creation_input_tokens) || 0) + (Number(usage.input_tokens) || 0);
 	if (report.firstTurnContext === null) report.firstTurnContext = context;
 	report.lastTurnContext = context;
+	report.maxContext = report.maxContext === null ? context : Math.max(report.maxContext, context);
+	if (context > threshold) report.turnsAboveThreshold++;
+	if ((Number(usage.cache_creation_input_tokens) || 0) > 2e4) report.cacheRebuildTurns++;
 	const model = message?.model ?? "unknown";
 	report.models[model] = (report.models[model] ?? 0) + 1;
 	const split = usage.cache_creation;
@@ -9998,9 +10000,23 @@ function foldAssistantLine(report, seenIds, line) {
 		report.cacheCreationSplit.ephemeral5m += Number(split.ephemeral_5m_input_tokens) || 0;
 		report.cacheCreationSplit.ephemeral1h += Number(split.ephemeral_1h_input_tokens) || 0;
 	}
+	return context;
+}
+/**
+* True for a real human-authored `type:"user"` prompt line: content is a
+* plain string, or a content array with no `tool_result` block. Claude Code
+* encodes tool results as `type:"user"` messages whose content array is
+* entirely (or partly) tool_result blocks — those must not count as prompts.
+*/
+function isRealUserPrompt(line) {
+	if (line.type !== "user") return false;
+	const content = line.message?.content;
+	if (typeof content === "string") return true;
+	if (Array.isArray(content)) return !content.some((block) => block?.type === "tool_result");
+	return false;
 }
 /** Parse a session/subagent/worker-event JSONL file into a usage report. */
-async function parseSessionUsage(path) {
+async function parseSessionUsage(path, threshold = 2e5) {
 	const report = {
 		path,
 		sizeBytes: existsSync(path) ? readFileSync(path).byteLength : 0,
@@ -10012,9 +10028,15 @@ async function parseSessionUsage(path) {
 		cacheCreationSplit: {
 			ephemeral5m: 0,
 			ephemeral1h: 0
-		}
+		},
+		avgContext: null,
+		maxContext: null,
+		turnsAboveThreshold: 0,
+		cacheRebuildTurns: 0,
+		userPrompts: 0
 	};
 	const seenIds = /* @__PURE__ */ new Set();
+	let contextSum = 0;
 	const rl = createInterface({
 		input: createReadStream(path, "utf8"),
 		crlfDelay: Infinity
@@ -10027,8 +10049,14 @@ async function parseSessionUsage(path) {
 		} catch {
 			continue;
 		}
-		foldAssistantLine(report, seenIds, obj);
+		if (obj.type === "user") {
+			if (isRealUserPrompt(obj)) report.userPrompts++;
+			continue;
+		}
+		const context = foldAssistantLine(report, seenIds, obj, threshold);
+		if (context !== null) contextSum += context;
 	}
+	report.avgContext = report.turns > 0 ? Math.round(contextSum / report.turns) : null;
 	return report;
 }
 function totalUsageTokens(totals) {
@@ -10078,10 +10106,10 @@ function newestSessionLog() {
 	}
 	return best?.path ?? null;
 }
-async function auditSession(path) {
+async function auditSession(path, threshold) {
 	const target = path ?? newestSessionLog();
 	if (!target) return null;
-	const report = await parseSessionUsage(target);
+	const report = await parseSessionUsage(target, threshold);
 	const total = totalUsageTokens(report.totals) || 1;
 	const percentages = {};
 	for (const [key, value] of Object.entries(report.totals)) percentages[key] = 100 * value / total;
@@ -10159,32 +10187,124 @@ function readWorkerStatus(logDir, id) {
 		return null;
 	}
 }
-async function readOne(path) {
-	const report = await parseSessionUsage(path);
+/** Token count of the first `type:"user"` message's text, or null if none found. */
+async function firstUserPromptTokens(path) {
+	const rl = createInterface({
+		input: createReadStream(path, "utf8"),
+		crlfDelay: Infinity
+	});
+	try {
+		for await (const raw of rl) {
+			if (!raw.trim()) continue;
+			let obj;
+			try {
+				obj = JSON.parse(raw);
+			} catch {
+				continue;
+			}
+			if (obj.type !== "user") continue;
+			const content = obj.message?.content;
+			return countTokens(typeof content === "string" ? content : Array.isArray(content) ? content.map((part) => part?.text ?? "").join(" ") : "");
+		}
+	} finally {
+		rl.close();
+	}
+	return null;
+}
+/** `session_id` off the first record that carries one, or null if none do. */
+async function firstSessionId(path) {
+	const rl = createInterface({
+		input: createReadStream(path, "utf8"),
+		crlfDelay: Infinity
+	});
+	try {
+		for await (const raw of rl) {
+			if (!raw.trim()) continue;
+			let obj;
+			try {
+				obj = JSON.parse(raw);
+			} catch {
+				continue;
+			}
+			if (obj.session_id) return obj.session_id;
+		}
+	} finally {
+		rl.close();
+	}
+	return null;
+}
+/** `~/.claude/projects/**\/<sessionId>.jsonl`, searched only under the projects dir. */
+function findSessionTranscript(sessionId, projectsDir = join(homedir(), ".claude", "projects")) {
+	const target = `${sessionId}.jsonl`;
+	const stack = [projectsDir];
+	while (stack.length > 0) {
+		const dir = stack.pop();
+		let entries;
+		try {
+			entries = readdirSync(dir, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			const full = join(dir, entry.name);
+			if (entry.isDirectory()) stack.push(full);
+			else if (entry.name === target) return full;
+		}
+	}
+	return null;
+}
+/**
+* The mirror log has no `type:"user"` record (worker event mirrors carry
+* system/assistant/result records only, never the -p prompt itself), so
+* fall back to the session's own transcript under ~/.claude/projects,
+* located via whichever record in the mirror log carries a `session_id`.
+*/
+async function resolvePromptTokens(mirrorPath) {
+	const direct = await firstUserPromptTokens(mirrorPath);
+	if (direct !== null) return direct;
+	const sessionId = await firstSessionId(mirrorPath);
+	if (!sessionId) return null;
+	const transcript = findSessionTranscript(sessionId);
+	if (!transcript) return null;
+	return firstUserPromptTokens(transcript);
+}
+async function readOne(path, group) {
+	const [report, promptTokens] = await Promise.all([parseSessionUsage(path), resolvePromptTokens(path)]);
 	const model = Object.keys(report.models)[0] ?? null;
+	const overhead = report.firstTurnContext !== null && promptTokens !== null ? report.firstTurnContext - promptTokens : null;
 	return {
 		path,
 		firstTurnContext: report.firstTurnContext,
-		model
+		model,
+		promptTokens,
+		overhead,
+		group
 	};
 }
+function median(values) {
+	if (values.length === 0) return null;
+	const sorted = [...values].sort((a, b) => a - b);
+	const mid = Math.floor(sorted.length / 2);
+	return sorted.length % 2 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2;
+}
 function summarize(readings) {
 	const contexts = readings.map((r) => r.firstTurnContext).filter((v) => v !== null).sort((a, b) => a - b);
+	const overheads = readings.map((r) => r.overhead).filter((v) => v !== null);
 	const models = [...new Set(readings.map((r) => r.model).filter((m) => !!m))];
 	if (contexts.length === 0) return {
 		count: readings.length,
 		min: null,
 		median: null,
 		max: null,
+		medianOverhead: median(overheads),
 		models
 	};
-	const mid = Math.floor(contexts.length / 2);
-	const median = contexts.length % 2 ? contexts[mid] : (contexts[mid - 1] + contexts[mid]) / 2;
 	return {
 		count: readings.length,
 		min: contexts[0],
-		median,
+		median: median(contexts),
 		max: contexts[contexts.length - 1],
+		medianOverhead: median(overheads),
 		models
 	};
 }
@@ -10192,17 +10312,25 @@ async function auditSpawn(n = 10) {
 	const { workers } = readWorkersSection();
 	const logDir = workersLogDir(workers);
 	const agentLogs = newestAgentSubagentLogs(n);
-	const agentReadings = await Promise.all(agentLogs.map(readOne));
+	const agentReadings = await Promise.all(agentLogs.map((path) => readOne(path, "agentSubagents")));
 	const workerLogs = newestWorkerLogs(logDir, n);
-	const workerReadings = await Promise.all(workerLogs.map(readOne));
+	const workerReadings = await Promise.all(workerLogs.map((path) => readOne(path, "workersInteractive")));
 	const interactive = [];
 	const headless = [];
-	for (const reading of workerReadings) if (readWorkerStatus(logDir, workerIdFromLogPath(reading.path))?.outputFormat) headless.push(reading);
+	for (const reading of workerReadings) if (readWorkerStatus(logDir, workerIdFromLogPath(reading.path))?.outputFormat) headless.push({
+		...reading,
+		group: "workersHeadless"
+	});
 	else interactive.push(reading);
 	return {
 		agentSubagents: summarize(agentReadings),
 		workersInteractive: summarize(interactive),
-		workersHeadless: summarize(headless)
+		workersHeadless: summarize(headless),
+		readings: [
+			...agentReadings,
+			...interactive,
+			...headless
+		]
 	};
 }
 
@@ -10332,6 +10460,45 @@ function extract(pattern, text) {
 	const match = text.match(pattern);
 	return match ? match[1] : null;
 }
+/**
+* `--tools A,B` and `--tools=A,B` are both valid on the argv this process was
+* launched with; an explicit but empty value (`--tools ""` / `--tools=`)
+* means "no tools at all", distinct from the flag being absent entirely.
+*/
+function extractToolsArg(line) {
+	const eq = line.match(/--tools=(?:"([^"]*)"|(\S*))/);
+	if (eq) return eq[1] !== void 0 ? eq[1] : eq[2];
+	const sp = line.match(/--tools\s+(?:"([^"]*)"|(\S+))/);
+	if (sp) return sp[1] !== void 0 ? sp[1] : sp[2];
+	return null;
+}
+function extractMcpConfigArg(line) {
+	const eq = line.match(/--mcp-config=(?:"([^"]*)"|(\S*))/);
+	if (eq) return eq[1] !== void 0 ? eq[1] : eq[2];
+	const sp = line.match(/--mcp-config\s+(?:"([^"]*)"|(\S+))/);
+	if (sp) return sp[1] !== void 0 ? sp[1] : sp[2];
+	return null;
+}
+/**
+* No `--tools` flag: the CLI default tool set applies, which includes
+* ToolSearch, so deferral is on. An explicit but empty list means no tools
+* at all, so deferral doesn't apply. Otherwise deferral is on only if the
+* explicit list still names ToolSearch.
+*/
+function classifyDeferral(toolsArg) {
+	if (toolsArg === null) return "on";
+	if (toolsArg.trim() === "") return "n/a";
+	return toolsArg.split(",").map((t) => t.trim()).includes("ToolSearch") ? "on" : "OFF";
+}
+function countMcpServersInFile(path) {
+	try {
+		const resolved = path.startsWith("~") ? join(homedir(), path.slice(1)) : path;
+		const parsed = JSON.parse(readFileSync(resolved, "utf8"));
+		return Object.keys(parsed.mcpServers ?? {}).length;
+	} catch {
+		return 0;
+	}
+}
 function readProcessEnvLine(pid) {
 	try {
 		return execFileSync("ps", [
@@ -10366,6 +10533,8 @@ function auditEnv() {
 		const modelPattern = /ANTHROPIC_DEFAULT_(\w+?)_MODEL=(\S*)/g;
 		let modelMatch;
 		while (modelMatch = modelPattern.exec(line)) defaultModels[modelMatch[1]] = modelMatch[2];
+		const toolsArg = extractToolsArg(line);
+		const mcpConfigPath = extractMcpConfigArg(line);
 		processes.push({
 			pid,
 			baseUrl: extract(/ANTHROPIC_BASE_URL=(\S*)/, line),
@@ -10373,7 +10542,10 @@ function auditEnv() {
 			defaultModels,
 			enableToolSearch: extract(/ENABLE_TOOL_SEARCH=(\S*)/, line),
 			workerId: extract(/PAI_WORKER_ID=(\S*)/, line),
-			age: readProcessAge(pid)
+			age: readProcessAge(pid),
+			toolsArg,
+			mcpServers: mcpConfigPath ? countMcpServersInFile(mcpConfigPath) : "default",
+			deferral: classifyDeferral(toolsArg)
 		});
 	}
 	let mcpServerCount = 0;
@@ -10467,11 +10639,271 @@ function auditSchedule(ttlSeconds = DEFAULT_TTL_SECONDS) {
 	};
 }
 
+//#endregion
+//#region src/audit/skills.ts
+/**
+* `pai audit tokens skills` — token cost of the whole skill/command/plugin
+* catalogue: every `SKILL.md` under ~/.claude/skills and ~/.claude/plugins,
+* plus every command under ~/.claude/commands, rendered as the one-line
+* `- name: description` entry Claude Code loads into context for each.
+*
+* Two failure modes matter more than the raw total: the same real file
+* reachable through two paths (a plugin's marketplaces/ checkout and its
+* cache/ install both point at one file), and two different real files that
+* collide on name (a skill and a command both called "Sessions") — the first
+* wastes nothing but must not be double-counted, the second silently shadows
+* one of the two in whichever catalogue order Claude Code loads them.
+*/
+/** Recursively collect every file under `dir` whose basename satisfies `matches`. */
+function findFilesRecursive(dir, matches) {
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	const found = [];
+	for (const entry of entries) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) found.push(...findFilesRecursive(full, matches));
+		else if (entry.isFile() && matches(entry.name)) found.push(full);
+	}
+	return found;
+}
+/**
+* `<skillsDir>/*\/SKILL.md`, one level deep only — this is what Claude Code
+* actually loads. `readdirSync(withFileTypes)` reports a symlinked skill
+* directory as neither file nor directory, so entries are resolved with
+* `statSync` (which follows symlinks) instead of trusting `Dirent`.
+*/
+function findTopLevelSkillFiles(skillsDir) {
+	let entries;
+	try {
+		entries = readdirSync(skillsDir);
+	} catch {
+		return [];
+	}
+	const found = [];
+	for (const name of entries) {
+		const dir = join(skillsDir, name);
+		let isDir = false;
+		try {
+			isDir = statSync(dir).isDirectory();
+		} catch {
+			continue;
+		}
+		if (!isDir) continue;
+		const skillFile = join(dir, "SKILL.md");
+		if (existsSync(skillFile)) found.push(skillFile);
+	}
+	return found;
+}
+/** Every SKILL.md/*.md the three catalogue roots contribute, source-tagged. */
+function findCatalogueFiles(claudeDir) {
+	const found = [];
+	for (const path of findTopLevelSkillFiles(join(claudeDir, "skills"))) found.push({
+		path,
+		source: "skills"
+	});
+	for (const path of findFilesRecursive(join(claudeDir, "commands"), (n) => n.endsWith(".md"))) found.push({
+		path,
+		source: "commands"
+	});
+	for (const path of findFilesRecursive(join(claudeDir, "plugins"), (n) => n === "SKILL.md")) found.push({
+		path,
+		source: "plugins"
+	});
+	return found;
+}
+/** Strip a single layer of matching quotes ("..." or '...') from a trimmed value. */
+function unquote$1(value) {
+	if (value.length >= 2) {
+		const first = value[0];
+		const last = value[value.length - 1];
+		if (first === "\"" && last === "\"" || first === "'" && last === "'") return value.slice(1, -1);
+	}
+	return value;
+}
+/** Parse the `name:`/`description:` frontmatter fields out of a skill/command file. */
+function parseFrontmatter(text) {
+	const match = /^---\n([\s\S]*?)\n---/.exec(text);
+	const fm = match ? match[1] : "";
+	const nameMatch = /^name:\s*(.+)$/m.exec(fm);
+	const descMatch = /(?:^|\n)description:\s*(.+?)(?=\n\w[\w-]*:|$)/s.exec(fm);
+	return {
+		name: nameMatch ? unquote$1(nameMatch[1].trim()) : null,
+		description: descMatch ? unquote$1(descMatch[1].trim()) : ""
+	};
+}
+function nameFallback(path, source) {
+	if (source === "commands") return basename(path).replace(/\.md$/, "");
+	return basename(dirname(path));
+}
+/** Build one catalogue entry from a file, deriving its name/description/tokens. */
+function readEntry$1(path, source) {
+	let text = "";
+	try {
+		text = readFileSync(path, "utf8");
+	} catch {}
+	const fm = parseFrontmatter(text);
+	const name = fm.name ?? nameFallback(path, source);
+	const line = `- ${name}: ${fm.description}`;
+	return {
+		name,
+		description: fm.description,
+		source,
+		path,
+		tokens: countTokens(line),
+		enabled: true
+	};
+}
+/** `enabledPlugins` map from settings.json, or `{}` if the file is missing/unreadable. */
+function readEnabledPlugins(settingsPath) {
+	try {
+		return JSON.parse(readFileSync(settingsPath, "utf8")).enabledPlugins ?? {};
+	} catch {
+		return {};
+	}
+}
+/** `<relative-to-root>` split on the platform separator, or null if `path` is not under `root`. */
+function pathUnder(root, path) {
+	const rel = relative(root, path);
+	if (rel.startsWith("..")) return null;
+	return rel.split(sep);
+}
+/**
+* A cache install is `plugins/cache/<marketplace>/<plugin>/<version>/...`, so its id is exact.
+* A marketplace checkout is `plugins/marketplaces/<marketplace>/...` with no plugin segment, so
+* it can only be matched by marketplace name against whichever `enabledPlugins` key ends in
+* `@<marketplace>` — good enough for the single-plugin-per-marketplace installs this audits today.
+*/
+function resolvePluginStatus(claudeDir, path, enabledPlugins) {
+	const cacheParts = pathUnder(join(claudeDir, "plugins", "cache"), path);
+	if (cacheParts && cacheParts.length >= 4) {
+		const [marketplace, plugin, , ...suffix] = cacheParts;
+		const id = `${plugin}@${marketplace}`;
+		const known = id in enabledPlugins;
+		return {
+			id,
+			enabled: known && enabledPlugins[id] === true,
+			status: known ? void 0 : "unknown",
+			dedupeKey: `${id}::${suffix.join("/")}`
+		};
+	}
+	const marketplaceParts = pathUnder(join(claudeDir, "plugins", "marketplaces"), path);
+	if (marketplaceParts && marketplaceParts.length >= 2) {
+		const [marketplace, ...suffix] = marketplaceParts;
+		const matchKey = Object.keys(enabledPlugins).find((k) => k.endsWith(`@${marketplace}`));
+		if (matchKey) return {
+			id: matchKey,
+			enabled: enabledPlugins[matchKey] === true,
+			dedupeKey: `${matchKey}::${suffix.join("/")}`
+		};
+		return {
+			id: `unknown@${marketplace}`,
+			enabled: false,
+			status: "unknown",
+			dedupeKey: `unknown@${marketplace}::${suffix.join("/")}`
+		};
+	}
+	return {
+		id: path,
+		enabled: false,
+		status: "unknown",
+		dedupeKey: path
+	};
+}
+/** Group entries by case-insensitive name; only groups with >1 real path. */
+function findDuplicates(entries) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const key = entry.name.toLowerCase();
+		if (!byName.has(key)) byName.set(key, /* @__PURE__ */ new Set());
+		byName.get(key).add(entry.path);
+	}
+	const duplicates = [];
+	for (const [name, paths] of byName) if (paths.size > 1) duplicates.push({
+		name,
+		paths: [...paths]
+	});
+	return duplicates.sort((a, b) => a.name.localeCompare(b.name));
+}
+function auditSkills(claudeDir = join(homedir(), ".claude"), settingsPath = join(claudeDir, "settings.json")) {
+	const rawFiles = findCatalogueFiles(claudeDir);
+	const seenReal = /* @__PURE__ */ new Set();
+	const deduped = [];
+	for (const file of rawFiles) {
+		let real = file.path;
+		try {
+			real = realpathSync(file.path);
+		} catch {}
+		if (seenReal.has(real)) continue;
+		seenReal.add(real);
+		deduped.push(file);
+	}
+	const enabledPlugins = readEnabledPlugins(settingsPath);
+	const entries = deduped.map((f) => readEntry$1(f.path, f.source));
+	const dedupeKeys = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		if (entry.source !== "plugins") continue;
+		const status = resolvePluginStatus(claudeDir, entry.path, enabledPlugins);
+		entry.enabled = status.enabled;
+		entry.status = status.status;
+		dedupeKeys.set(entry.path, status.dedupeKey);
+	}
+	const totalsBySource = {
+		skills: 0,
+		commands: 0,
+		plugins: 0
+	};
+	const countsBySource = {
+		skills: 0,
+		commands: 0,
+		plugins: 0
+	};
+	const enabledTotalsBySource = {
+		skills: 0,
+		commands: 0,
+		plugins: 0
+	};
+	const seenEnabledPluginKeys = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		totalsBySource[entry.source] += entry.tokens;
+		countsBySource[entry.source] += 1;
+		if (!entry.enabled) continue;
+		if (entry.source !== "plugins") {
+			enabledTotalsBySource[entry.source] += entry.tokens;
+			continue;
+		}
+		const dedupeKey = dedupeKeys.get(entry.path);
+		if (seenEnabledPluginKeys.has(dedupeKey)) continue;
+		seenEnabledPluginKeys.add(dedupeKey);
+		enabledTotalsBySource.plugins += entry.tokens;
+	}
+	return {
+		encoding: TOKEN_ENCODING,
+		entries,
+		total: entries.reduce((sum, e) => sum + e.tokens, 0),
+		totalsBySource,
+		countsBySource,
+		enabledTotal: enabledTotalsBySource.skills + enabledTotalsBySource.commands + enabledTotalsBySource.plugins,
+		enabledTotalsBySource,
+		duplicates: findDuplicates(entries)
+	};
+}
+function topByTokens(report, n) {
+	return [...report.entries].sort((a, b) => b.tokens - a.tokens).slice(0, n);
+}
+const SKILL_CATALOGUE_AMBER = 3e3;
+const SKILL_CATALOGUE_RED = 6e3;
+
 //#endregion
 //#region src/audit/severity.ts
 const HOOK_TOKEN_LIMIT = 1e3;
 const FIRST_TURN_CONTEXT_LIMIT = 3e4;
 const DAEMON_FAILURE_RATE_LIMIT = .05;
+const CONTEXT_GROWTH_AVG_RED = 1e5;
+const CONTEXT_GROWTH_MAX_AMBER = 15e4;
 const SEVERITY_RANK = {
 	RED: 0,
 	AMBER: 1,
@@ -10528,9 +10960,534 @@ function buildFindings(input) {
 		severity: "GREEN",
 		evidence: `${input.env.processes.length} claude process(es), none proxied`
 	});
+	const deferralOff = input.env.processes.filter((p) => {
+		const mcpCount = p.mcpServers === "default" ? input.env.mcpServerCount : p.mcpServers;
+		return p.deferral === "OFF" && mcpCount > 0;
+	});
+	findings.push({
+		finding: "tool deferral on live processes",
+		severity: deferralOff.length > 0 ? "RED" : "GREEN",
+		evidence: deferralOff.length > 0 ? deferralOff.map((p) => `pid ${p.pid}: ${p.mcpServers === "default" ? input.env.mcpServerCount : p.mcpServers} mcp servers, tools=${p.toolsArg}`).join("; ") : `${input.env.processes.length} claude process(es) checked, none with an explicit --tools list missing ToolSearch and MCP servers registered`
+	});
+	const skillTokens = input.skills.enabledTotal;
+	findings.push({
+		finding: "skill catalogue tokens",
+		severity: skillTokens > SKILL_CATALOGUE_RED ? "RED" : skillTokens > SKILL_CATALOGUE_AMBER ? "AMBER" : "GREEN",
+		evidence: `${skillTokens} tokens loaded (${input.skills.total} on disk) across ${input.skills.entries.length} entries` + (input.skills.duplicates.length ? `, ${input.skills.duplicates.length} case-insensitive duplicate name(s)` : "")
+	});
+	const inheriting = input.subagents.entries.filter((e) => e.model === "inherits");
+	if (input.subagents.entries.length === 0) findings.push({
+		finding: "subagent model pinning",
+		severity: "GREEN",
+		evidence: "no agent files"
+	});
+	else findings.push({
+		finding: "subagent model pinning",
+		severity: inheriting.length > 0 ? "AMBER" : "GREEN",
+		evidence: `${inheriting.length} of ${input.subagents.entries.length} inherit`
+	});
+	const configuredCount = input.mcp.servers.filter((s) => s.configuredIn.length > 0).length;
+	const plainLaunch = input.mcp.liveProcesses.find((p) => p.mcpConfigPath === null);
+	if (!plainLaunch) findings.push({
+		finding: "MCP servers loaded vs. used",
+		severity: "GREEN",
+		evidence: `${configuredCount} configured, no plain launch found`
+	});
+	else {
+		const zeroCallServers = input.mcp.servers.filter((s) => s.configuredIn.length > 0 && s.calls30d === 0);
+		findings.push({
+			finding: "MCP servers loaded vs. used",
+			severity: zeroCallServers.length > 0 ? "AMBER" : "GREEN",
+			evidence: `${configuredCount} configured, ${zeroCallServers.length} loaded by pid ${plainLaunch.pid}`
+		});
+	}
+	if (input.session) {
+		const avg = input.session.avgContext ?? 0;
+		const max = input.session.maxContext ?? 0;
+		const severity = avg > CONTEXT_GROWTH_AVG_RED || input.session.turnsAboveThreshold > 0 ? "RED" : max > CONTEXT_GROWTH_MAX_AMBER ? "AMBER" : "GREEN";
+		findings.push({
+			finding: "context growth",
+			severity,
+			evidence: `avg ${avg}, max ${max}, ${input.session.turnsAboveThreshold} turns > ${input.ctxThreshold}, ${input.session.turns} turns`
+		});
+	}
 	return sortFindings(findings);
 }
 
+//#endregion
+//#region src/audit/ladder.ts
+/**
+* `pai audit tokens ladder` — LIVE: what each layer of headless-worker
+* scaffolding actually costs in first-turn context, measured by spawning the
+* real `claude -p` binary at increasing configuration and reading the
+* `usage` block of its `--output-format json` result. No section above this
+* one makes a network call; this is the one exception, gated behind `--live`.
+*
+* Rungs (each a superset of the last, except L3 which drops every flag):
+*   L0  empty MCP config, no tool schemas at all
+*   L1  same, plus the core file/shell tool schemas (`--tools`)
+*   L2  same as L1, but the empty MCP config is swapped for a real one
+*   L3  plain: none of --strict-mcp-config / --mcp-config / --tools
+*/
+const PROBE_PROMPT = "Reply with exactly the single word OK and nothing else. Do not use any tool.";
+const LADDER_TOOLS = "Bash,Read,Edit,Write,Grep,Glob,Skill,ToolSearch";
+const LADDER_TIMEOUT_MS = 18e4;
+const DEFAULT_LADDER_MODEL = "haiku";
+/** Build the four rungs' argv. Pure — no spawning, so it's unit-testable. */
+function buildLadderRungs(model, emptyMcpPath, realMcpPath) {
+	const base = [
+		"-p",
+		PROBE_PROMPT,
+		"--model",
+		model,
+		"--output-format",
+		"json"
+	];
+	return [
+		{
+			id: "L0",
+			description: "empty MCP config, no tools",
+			args: [
+				...base,
+				"--strict-mcp-config",
+				"--mcp-config",
+				emptyMcpPath,
+				"--tools",
+				""
+			]
+		},
+		{
+			id: "L1",
+			description: `empty MCP config, --tools ${LADDER_TOOLS}`,
+			args: [
+				...base,
+				"--strict-mcp-config",
+				"--mcp-config",
+				emptyMcpPath,
+				"--tools",
+				LADDER_TOOLS
+			]
+		},
+		{
+			id: "L2",
+			description: `real MCP config, --tools ${LADDER_TOOLS}`,
+			args: [
+				...base,
+				"--strict-mcp-config",
+				"--mcp-config",
+				realMcpPath,
+				"--tools",
+				LADDER_TOOLS
+			]
+		},
+		{
+			id: "L3",
+			description: "plain (no --strict-mcp-config, no --mcp-config, no --tools)",
+			args: [...base]
+		}
+	];
+}
+/** Newest `*.mcp.json` in a worker log dir, or null if none exist. */
+function newestMcpConfig(logDir) {
+	let files;
+	try {
+		files = readdirSync(logDir);
+	} catch {
+		return null;
+	}
+	const candidates = files.filter((f) => f.endsWith(".mcp.json")).map((f) => join(logDir, f));
+	if (candidates.length === 0) return null;
+	return candidates.map((path) => ({
+		path,
+		mtime: statSync(path).mtimeMs
+	})).sort((a, b) => b.mtime - a.mtime)[0].path;
+}
+/** Spawn one rung of `claude -p ...` and read its usage-derived first-turn context. */
+function runRung(rung, cwd) {
+	return new Promise((resolvePromise) => {
+		const env = { ...process.env };
+		delete env.PAI_WORKER;
+		const proc = spawn("claude", rung.args, {
+			cwd,
+			env,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		let out = "";
+		let timedOut = false;
+		const timer = setTimeout(() => {
+			timedOut = true;
+			try {
+				proc.kill("SIGKILL");
+			} catch {}
+		}, LADDER_TIMEOUT_MS);
+		proc.stdout.on("data", (chunk) => {
+			out += chunk.toString("utf8");
+		});
+		proc.on("error", (e) => {
+			clearTimeout(timer);
+			resolvePromise({
+				firstTurnContext: null,
+				timedOut: false,
+				error: e.message
+			});
+		});
+		proc.on("close", () => {
+			clearTimeout(timer);
+			if (timedOut) {
+				resolvePromise({
+					firstTurnContext: null,
+					timedOut: true
+				});
+				return;
+			}
+			try {
+				resolvePromise({
+					firstTurnContext: usageContextTokens(JSON.parse(out.trim()).usage),
+					timedOut: false
+				});
+			} catch (e) {
+				resolvePromise({
+					firstTurnContext: null,
+					timedOut: false,
+					error: e.message
+				});
+			}
+		});
+	});
+}
+async function auditLadder(opts) {
+	const model = opts.model ?? DEFAULT_LADDER_MODEL;
+	const emptyMcpPath = ensureNoMcpConfig(opts.logDir);
+	const realMcpPath = opts.mcpConfigPath ?? newestMcpConfig(opts.logDir) ?? emptyMcpPath;
+	const cwd = opts.cwd ?? process.cwd();
+	const rungs = buildLadderRungs(model, emptyMcpPath, realMcpPath);
+	const readings = [];
+	let previous = null;
+	for (const rung of rungs) {
+		const result = await runRung(rung, cwd);
+		const delta = result.firstTurnContext !== null && previous !== null ? result.firstTurnContext - previous : null;
+		readings.push({
+			id: rung.id,
+			description: rung.description,
+			firstTurnContext: result.firstTurnContext,
+			timedOut: result.timedOut,
+			error: result.error,
+			delta
+		});
+		if (result.firstTurnContext !== null) previous = result.firstTurnContext;
+	}
+	return {
+		model,
+		mcpConfigPath: realMcpPath,
+		readings
+	};
+}
+
+//#endregion
+//#region src/audit/subagents.ts
+/**
+* `pai audit tokens subagents` — token cost of every Claude Code subagent
+* definition: `.claude/agents/*.md` under the user's home and (separately)
+* under the current project. A subagent with no `model:` frontmatter field
+* inherits the caller's model at runtime rather than costing a fixed model
+* choice, so it is reported as `"inherits"` rather than left blank.
+*/
+/** Strip a single layer of matching quotes ("..." or '...') from a trimmed value. */
+function unquote(value) {
+	if (value.length >= 2) {
+		const first = value[0];
+		const last = value[value.length - 1];
+		if (first === "\"" && last === "\"" || first === "'" && last === "'") return value.slice(1, -1);
+	}
+	return value;
+}
+/** The top-level `model:` frontmatter field, or `"inherits"` if absent/empty. */
+function parseModel(text) {
+	const match = /^---\n([\s\S]*?)\n---/.exec(text);
+	if (!match) return "inherits";
+	const modelMatch = /^model:\s*(.+)$/m.exec(match[1]);
+	if (!modelMatch) return "inherits";
+	const value = unquote(modelMatch[1].trim());
+	return value === "" ? "inherits" : value;
+}
+/** Every top-level `.md` file directly under `agentsDir` (not recursive). */
+function findAgentFiles(agentsDir) {
+	let names;
+	try {
+		names = readdirSync(agentsDir);
+	} catch {
+		return [];
+	}
+	return names.filter((n) => n.endsWith(".md")).map((n) => join(agentsDir, n));
+}
+function readEntry(path) {
+	let text = "";
+	try {
+		text = readFileSync(path, "utf8");
+	} catch {}
+	return {
+		path,
+		tokens: countTokens(text),
+		model: parseModel(text)
+	};
+}
+function auditSubagents(homeDir, cwd) {
+	return {
+		encoding: TOKEN_ENCODING,
+		entries: [...findAgentFiles(join(homeDir, ".claude", "agents")), ...findAgentFiles(join(cwd, ".claude", "agents"))].map(readEntry)
+	};
+}
+
+//#endregion
+//#region src/audit/mcp.ts
+/**
+* `pai audit mcp` — cross-reference every MCP server name found anywhere
+* (global/project config, project `.mcp.json`, live process argv, 30-day
+* transcript usage) against where it's configured, whether it's pinned via
+* `pai project mcp`, whether a live process actually loaded it, and how much
+* it was used in the last 30 days.
+*
+* The `--connect` path is the only side-effecting one: it launches every
+* configured stdio MCP server to call `listTools()`. It never runs unless
+* the caller passes `connect: true` explicitly — there is no default-on path.
+*/
+const THIRTY_DAYS_MS = 720 * 60 * 60 * 1e3;
+const MAX_TRANSCRIPT_BYTES = 50 * 1024 * 1024;
+/** Whether a transcript file is worth streaming: fresh enough and small enough. */
+function shouldScanTranscript(stat, now) {
+	if (stat.size > MAX_TRANSCRIPT_BYTES) return false;
+	if (now - stat.mtimeMs > THIRTY_DAYS_MS) return false;
+	return true;
+}
+/**
+* Whether a live process's resolved server set includes `serverName`.
+* `servers === null` means "no --mcp-config flag", i.e. every configured
+* server loads; an array (possibly empty) means only those names load.
+*/
+function liveProcessLoadsServer(proc, serverName, allConfiguredNames) {
+	if (proc.servers === null) return allConfiguredNames.includes(serverName);
+	return proc.servers.includes(serverName);
+}
+function resolveHomePath(path, homeDir) {
+	return path.startsWith("~") ? join(homeDir, path.slice(1)) : path;
+}
+function readJsonFile(path) {
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+function gatherConfiguredSources(cwd, homeDir) {
+	const configuredIn = /* @__PURE__ */ new Map();
+	const disabled = /* @__PURE__ */ new Set();
+	const serverDefs = /* @__PURE__ */ new Map();
+	const addTag = (name, tag) => {
+		if (!configuredIn.has(name)) configuredIn.set(name, /* @__PURE__ */ new Set());
+		configuredIn.get(name).add(tag);
+	};
+	const claudeJson = readJsonFile(join(homeDir, ".claude.json"));
+	if (claudeJson) {
+		for (const [name, def] of Object.entries(claudeJson.mcpServers ?? {})) {
+			addTag(name, "global");
+			if (!serverDefs.has(name)) serverDefs.set(name, def);
+		}
+		const projectEntry = claudeJson.projects?.[resolve(cwd)];
+		if (projectEntry) {
+			for (const [name, def] of Object.entries(projectEntry.mcpServers ?? {})) {
+				addTag(name, "project");
+				if (!serverDefs.has(name)) serverDefs.set(name, def);
+			}
+			for (const name of projectEntry.disabledMcpServers ?? []) {
+				disabled.add(name);
+				if (!configuredIn.has(name)) configuredIn.set(name, /* @__PURE__ */ new Set());
+			}
+		}
+	}
+	const mcpJsonPath = join(cwd, ".mcp.json");
+	if (existsSync(mcpJsonPath)) {
+		const mcpJson = readJsonFile(mcpJsonPath);
+		if (mcpJson) for (const [name, def] of Object.entries(mcpJson.mcpServers ?? {})) {
+			addTag(name, "project .mcp.json");
+			if (!serverDefs.has(name)) serverDefs.set(name, def);
+		}
+	}
+	return {
+		configuredIn,
+		disabled,
+		serverDefs
+	};
+}
+function gatherLiveProcesses(homeDir) {
+	const procs = [];
+	for (const pid of findClaudePids()) {
+		const line = readProcessEnvLine(pid);
+		if (!line) continue;
+		const mcpConfigArg = extractMcpConfigArg(line);
+		if (!mcpConfigArg) {
+			procs.push({
+				pid,
+				mcpConfigPath: null,
+				servers: null
+			});
+			continue;
+		}
+		const resolved = resolveHomePath(mcpConfigArg, homeDir);
+		const parsed = readJsonFile(resolved);
+		const servers = parsed ? Object.keys(parsed.mcpServers ?? {}) : [];
+		procs.push({
+			pid,
+			mcpConfigPath: resolved,
+			servers
+		});
+	}
+	return procs;
+}
+/** Recursively find every file under `dir` ending in `.jsonl`. */
+function findJsonlFiles(dir) {
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	const found = [];
+	for (const entry of entries) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) found.push(...findJsonlFiles(full));
+		else if (entry.isFile() && entry.name.endsWith(".jsonl")) found.push(full);
+	}
+	return found;
+}
+function foldToolUseBlock(block, usage) {
+	if (block.type !== "tool_use") return;
+	const name = block.name;
+	if (!name || !name.startsWith("mcp__")) return;
+	const parts = name.split("__");
+	const server = parts[1];
+	const tool = parts.slice(2).join("__");
+	if (!server) return;
+	if (!usage.has(server)) usage.set(server, {
+		tools: /* @__PURE__ */ new Set(),
+		calls: 0
+	});
+	const entry = usage.get(server);
+	entry.tools.add(tool);
+	entry.calls += 1;
+}
+async function gatherUsage(transcriptsDir, now) {
+	const usage = /* @__PURE__ */ new Map();
+	for (const file of findJsonlFiles(transcriptsDir)) {
+		let stat;
+		try {
+			stat = statSync(file);
+		} catch {
+			continue;
+		}
+		if (!shouldScanTranscript(stat, now)) continue;
+		const rl = createInterface({
+			input: createReadStream(file, "utf8"),
+			crlfDelay: Infinity
+		});
+		for await (const raw of rl) {
+			if (!raw.includes("\"mcp__")) continue;
+			let parsed;
+			try {
+				parsed = JSON.parse(raw);
+			} catch {
+				continue;
+			}
+			if (parsed.type === "tool_use") foldToolUseBlock(parsed, usage);
+			if (Array.isArray(parsed.message?.content)) for (const block of parsed.message.content) foldToolUseBlock(block, usage);
+		}
+	}
+	const result = /* @__PURE__ */ new Map();
+	for (const [server, entry] of usage) result.set(server, {
+		distinctTools: entry.tools.size,
+		calls: entry.calls
+	});
+	return result;
+}
+function isStdioDef(def) {
+	return typeof def === "object" && def !== null && typeof def.command === "string";
+}
+/** Connect to every stdio MCP server row and record how many tools it exposes. Side-effecting: only called when `opts.connect === true`. */
+async function connectAndCountTools(rows, serverDefs) {
+	const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
+	const { StdioClientTransport } = await import("@modelcontextprotocol/sdk/client/stdio.js");
+	for (const row of rows) {
+		const def = serverDefs.get(row.server);
+		if (!isStdioDef(def)) continue;
+		const transport = new StdioClientTransport({
+			command: def.command,
+			args: def.args ?? [],
+			env: def.env
+		});
+		const client = new Client({
+			name: "pai-audit-mcp",
+			version: "1.0.0"
+		}, { capabilities: {} });
+		let settled = false;
+		const timeout = new Promise((res) => {
+			setTimeout(() => {
+				if (!settled) res("UNKNOWN");
+			}, 1e4);
+		});
+		try {
+			const attempt = (async () => {
+				await client.connect(transport);
+				return (await client.listTools()).tools.length;
+			})();
+			const outcome = await Promise.race([attempt, timeout]);
+			settled = true;
+			row.toolsExposed = outcome;
+		} catch {
+			settled = true;
+			row.toolsExposed = "UNKNOWN";
+		} finally {
+			try {
+				await client.close();
+			} catch {}
+		}
+	}
+}
+async function auditMcp(opts) {
+	const cwd = opts.cwd;
+	const homeDir = opts.homeDir;
+	const transcriptsDir = opts.transcriptsDir ?? join(homeDir, ".claude", "projects");
+	const { configuredIn, disabled, serverDefs } = gatherConfiguredSources(cwd, homeDir);
+	const liveProcesses = gatherLiveProcesses(homeDir);
+	const usage = await gatherUsage(transcriptsDir, Date.now());
+	const pinned = opts.projectsDbPath ? projectLaunchConfig(resolve(cwd), opts.projectsDbPath)?.mcp ?? null : projectLaunchConfig(resolve(cwd))?.mcp ?? null;
+	const allNames = new Set([...configuredIn.keys(), ...usage.keys()]);
+	const allConfiguredNames = [...configuredIn.keys()];
+	const rows = [];
+	for (const name of allNames) {
+		const liveMatches = liveProcesses.filter((p) => liveProcessLoadsServer(p, name, allConfiguredNames));
+		const serverUsage = usage.get(name);
+		rows.push({
+			server: name,
+			configuredIn: [...configuredIn.get(name) ?? /* @__PURE__ */ new Set()],
+			disabled: disabled.has(name),
+			pinned: pinned === null ? null : pinned.includes(name) ? "yes" : "-",
+			loadedLive: liveMatches.length ? liveMatches.map((p) => `pid ${p.pid}`).join(", ") : "-",
+			toolsExposed: "UNKNOWN",
+			toolsUsed30d: serverUsage?.distinctTools ?? 0,
+			calls30d: serverUsage?.calls ?? 0
+		});
+	}
+	rows.sort((a, b) => a.server.localeCompare(b.server));
+	if (opts.connect === true) await connectAndCountTools(rows, serverDefs);
+	return {
+		servers: rows,
+		liveProcesses
+	};
+}
+
 //#endregion
 //#region src/cli/commands/audit.ts
 function severityColor(sev, text) {
@@ -10599,9 +11556,10 @@ function printSession(report) {
 	console.log(`context on last turn:  ${report.lastTurnContext ?? "n/a"}`);
 	console.log(`cache_creation split: ephemeral_5m=${report.cacheCreationSplit.ephemeral5m}, ephemeral_1h=${report.cacheCreationSplit.ephemeral1h}`);
 	console.log(dim$1(`models: ${JSON.stringify(report.models)}`));
+	console.log(`avg context: ${report.avgContext ?? "n/a"}, max context: ${report.maxContext ?? "n/a"}, turns above threshold: ${report.turnsAboveThreshold}, cache-rebuild turns: ${report.cacheRebuildTurns}, user prompts: ${report.userPrompts}`);
 }
 async function cmdSession(path, opts) {
-	const report = await auditSession(path);
+	const report = await auditSession(path, opts.ctxThreshold ? parseInt(opts.ctxThreshold, 10) : void 0);
 	if (!report) {
 		console.error(err("  No session transcript found."));
 		process.exitCode = 1;
@@ -10617,10 +11575,35 @@ function printSpawnGroup(name, stats) {
 		stats.min === null ? "n/a" : String(stats.min),
 		stats.median === null ? "n/a" : String(stats.median),
 		stats.max === null ? "n/a" : String(stats.max),
+		stats.medianOverhead === null ? "n/a" : String(stats.medianOverhead),
 		stats.models.join(", ")
 	];
 }
-function printSpawn(report) {
+const SPAWN_GROUP_LABELS = {
+	agentSubagents: "Agent-tool subagents",
+	workersInteractive: "pai workers (interactive/pane)",
+	workersHeadless: "pai workers (headless -p)"
+};
+function printSpawn(report, detail) {
+	if (detail) {
+		console.log(header("Spawn overhead — per-log detail"));
+		const rows = report.readings.map((r) => [
+			SPAWN_GROUP_LABELS[r.group] ?? r.group,
+			r.firstTurnContext === null ? "n/a" : String(r.firstTurnContext),
+			r.promptTokens === null ? "n/a" : String(r.promptTokens),
+			r.overhead === null ? "n/a" : String(r.overhead),
+			r.model ?? "",
+			shortenPath(r.path, 70)
+		]);
+		console.log(renderTable([
+			"group",
+			"first-turn ctx",
+			"prompt tok",
+			"overhead",
+			"model",
+			"path"
+		], rows));
+	}
 	console.log(header("Spawn overhead (first-turn context tokens)"));
 	const rows = [
 		printSpawnGroup("Agent-tool subagents", report.agentSubagents),
@@ -10633,13 +11616,14 @@ function printSpawn(report) {
 		"min",
 		"median",
 		"max",
+		"median overhead",
 		"models"
 	], rows));
 }
 async function cmdSpawn(opts) {
 	const report = await auditSpawn(opts.n ? parseInt(opts.n, 10) : 10);
 	if (opts.json) return printJson(report);
-	printSpawn(report);
+	printSpawn(report, opts.detail);
 }
 function printDaemon(report) {
 	console.log(header(`Daemon log: ${report.logPath}`));
@@ -10679,6 +11663,8 @@ function printEnv(report) {
 		p.authTokenPresent ? "present" : "absent",
 		JSON.stringify(p.defaultModels),
 		p.enableToolSearch ?? "",
+		String(p.mcpServers),
+		p.deferral === "OFF" ? err(p.deferral) : p.deferral === "n/a" ? dim$1(p.deferral) : p.deferral,
 		p.workerId ?? "",
 		p.age ?? ""
 	]);
@@ -10688,10 +11674,16 @@ function printEnv(report) {
 		"auth token",
 		"default models",
 		"tool search",
+		"tools",
+		"deferral",
 		"worker id",
 		"age"
 	], rows));
-	for (const p of report.processes) if (p.baseUrl) console.log(err(`  RED: claude process ${p.pid} is routed through ${p.baseUrl}`));
+	for (const p of report.processes) {
+		if (p.baseUrl) console.log(err(`  RED: claude process ${p.pid} is routed through ${p.baseUrl}`));
+		const mcpCount = p.mcpServers === "default" ? report.mcpServerCount : p.mcpServers;
+		if (p.deferral === "OFF" && mcpCount > 0) console.log(err(`  RED: claude process ${p.pid} has --tools without ToolSearch (${mcpCount} MCP servers registered)`));
+	}
 	console.log(dim$1(`MCP servers registered: ${report.mcpServerCount}`));
 	console.log(dim$1(`settings.json model: ${report.settingsModel ?? "unset"}, effortLevel: ${report.settingsEffortLevel ?? "unset"}`));
 }
@@ -10729,45 +11721,309 @@ async function cmdSchedule(opts) {
 	if (opts.json) return printJson(report);
 	printSchedule(report);
 }
-async function cmdCombined(opts) {
+function printSkills(report, top) {
+	console.log(header(`Skill/command/plugin catalogue (encoding: ${report.encoding})`));
+	console.log(dim$1(`${report.entries.length} entries, ${report.enabledTotal} tokens loaded (${report.total} on disk)`));
+	const subtotalRows = [
+		"skills",
+		"commands",
+		"plugins"
+	].map((source) => [
+		source,
+		String(report.countsBySource[source]),
+		String(report.totalsBySource[source]),
+		String(report.enabledTotalsBySource[source])
+	]);
+	console.log(renderTable([
+		"source",
+		"entries",
+		"tokens",
+		"enabled"
+	], subtotalRows));
+	console.log(header(`Top ${top} by tokens`));
+	const topRows = topByTokens(report, top).map((e) => [
+		String(e.tokens),
+		e.source,
+		e.enabled ? "yes" : "no",
+		e.name,
+		e.path
+	]);
+	console.log(renderTable([
+		"tokens",
+		"source",
+		"on",
+		"name",
+		"path"
+	], topRows));
+	console.log(header("Case-insensitive duplicate names"));
+	if (report.duplicates.length === 0) console.log(dim$1("none"));
+	else for (const dup of report.duplicates) {
+		console.log(`${bold$1(dup.name)}:`);
+		for (const path of dup.paths) console.log(`  ${path}`);
+	}
+}
+function cmdSkills(opts) {
+	const top = opts.top ? parseInt(opts.top, 10) : 15;
+	const report = auditSkills();
+	if (opts.json) return printJson({
+		...report,
+		top: topByTokens(report, top)
+	});
+	printSkills(report, top);
+}
+function printLadder(report) {
+	console.log(header(`Context ladder (model: ${report.model}, mcp config: ${report.mcpConfigPath})`));
+	const rows = report.readings.map((r) => [
+		r.id,
+		r.description,
+		r.timedOut ? "TIMEOUT" : r.firstTurnContext === null ? `n/a${r.error ? ` (${r.error})` : ""}` : String(r.firstTurnContext),
+		r.delta === null ? "n/a" : String(r.delta)
+	]);
+	console.log(renderTable([
+		"rung",
+		"description",
+		"first-turn tokens",
+		"delta"
+	], rows));
+}
+async function cmdLadder(opts) {
+	if (!opts.live) {
+		console.log(warn$1("Refusing to run: `pai audit tokens ladder` spawns several real `claude -p` calls (billed API traffic). Pass --live to run it."));
+		return;
+	}
+	const { workers } = readWorkersSection();
+	const logDir = workersLogDir(workers);
+	const report = await auditLadder({
+		model: opts.model,
+		mcpConfigPath: opts.mcpConfig,
+		logDir
+	});
+	if (opts.json) return printJson(report);
+	printLadder(report);
+}
+function printSubagents(report) {
+	console.log(header(`Subagent definitions (encoding: ${report.encoding})`));
+	if (report.entries.length === 0) {
+		console.log(dim$1("no agent files"));
+		return;
+	}
+	const rows = report.entries.map((e) => [
+		String(e.tokens),
+		e.model === "inherits" ? dim$1("inherits") : e.model,
+		e.path
+	]);
+	console.log(renderTable([
+		"tokens",
+		"model",
+		"path"
+	], rows));
+	const inheriting = report.entries.filter((e) => e.model === "inherits").length;
+	console.log(dim$1(`${inheriting} of ${report.entries.length} inherit the caller's model`));
+}
+function cmdSubagents(opts) {
+	const report = auditSubagents(homedir(), process.cwd());
+	if (opts.json) return printJson(report);
+	printSubagents(report);
+}
+function printMcp(report) {
+	console.log(header("MCP servers: configured vs. loaded vs. used"));
+	const rows = report.servers.map((s) => [
+		s.server + (s.disabled ? dim$1(" (disabled)") : ""),
+		s.configuredIn.join(", ") || dim$1("-"),
+		s.pinned ?? dim$1("all"),
+		s.loadedLive,
+		String(s.toolsExposed),
+		String(s.toolsUsed30d),
+		String(s.calls30d)
+	]);
+	console.log(renderTable([
+		"server",
+		"configured-in",
+		"pinned",
+		"loaded-live",
+		"tools-exposed",
+		"tools-used-30d",
+		"calls-30d"
+	], rows));
+	console.log(dim$1(`live claude processes: ${report.liveProcesses.length}`));
+}
+async function cmdMcp(opts) {
+	const report = await auditMcp({
+		cwd: process.cwd(),
+		homeDir: homedir(),
+		connect: opts.connect
+	});
+	if (opts.json) return printJson(report);
+	printMcp(report);
+}
+const DEFAULT_CTX_THRESHOLD = 2e5;
+async function gatherCombined() {
 	const cwd = process.cwd();
 	const files = auditFiles(defaultFileSet(cwd));
 	const hooks = auditHooks(cwd);
-	const session = await auditSession(newestSessionLog() ?? void 0).catch(() => null);
+	const session = await auditSession(newestSessionLog() ?? void 0, DEFAULT_CTX_THRESHOLD).catch(() => null);
 	const daemon = auditDaemon();
 	const env = auditEnv();
 	const spawn = await auditSpawn();
 	const schedule = auditSchedule(cacheTtlSeconds(session?.cacheCreationSplit));
-	const findings = buildFindings({
-		files,
-		hooks,
-		session,
-		daemon,
-		env
+	const skills = auditSkills();
+	const subagents = auditSubagents(homedir(), cwd);
+	const mcp = await auditMcp({
+		cwd,
+		homeDir: homedir()
 	});
-	if (opts.json) return printJson({
+	return {
 		encoding: TOKEN_ENCODING,
-		findings,
+		findings: buildFindings({
+			files,
+			hooks,
+			session,
+			daemon,
+			env,
+			skills,
+			subagents,
+			mcp,
+			ctxThreshold: DEFAULT_CTX_THRESHOLD
+		}),
 		files,
 		hooks,
 		session,
 		spawn,
 		daemon,
 		env,
-		schedule
-	});
-	console.log(header("pai audit tokens — combined report"));
-	console.log(dim$1(`token encoding: ${TOKEN_ENCODING}`));
-	const rows = findings.map((f) => [
-		severityColor(f.severity, f.finding),
-		severityColor(f.severity, f.severity),
-		f.evidence
-	]);
-	console.log(renderTable([
-		"FINDING",
-		"SEVERITY",
-		"EVIDENCE"
-	], rows));
+		schedule,
+		skills,
+		subagents,
+		mcp
+	};
+}
+/** Strip ANSI escape sequences (chalk colour codes) from captured console output. */
+function stripAnsi$1(text) {
+	return text.replace(/\x1b\[[0-9;]*m/g, "");
+}
+/** Run `fn`, capturing everything it sends through `console.log` as plain text. */
+function captureOutput(fn) {
+	const original = console.log;
+	const lines = [];
+	console.log = (...args) => {
+		lines.push(stripAnsi$1(args.map((a) => String(a)).join(" ")));
+	};
+	try {
+		fn();
+	} finally {
+		console.log = original;
+	}
+	return lines.join("\n");
+}
+function combinedSectionOutputs(data) {
+	const sections = [];
+	sections.push({
+		name: "files",
+		text: captureOutput(() => printFiles(data.files))
+	});
+	sections.push({
+		name: "hooks",
+		text: captureOutput(() => printHooks(data.hooks))
+	});
+	if (data.session) sections.push({
+		name: "session",
+		text: captureOutput(() => printSession(data.session))
+	});
+	sections.push({
+		name: "spawn",
+		text: captureOutput(() => printSpawn(data.spawn))
+	});
+	sections.push({
+		name: "daemon",
+		text: captureOutput(() => printDaemon(data.daemon))
+	});
+	sections.push({
+		name: "env",
+		text: captureOutput(() => printEnv(data.env))
+	});
+	sections.push({
+		name: "schedule",
+		text: captureOutput(() => printSchedule(data.schedule))
+	});
+	sections.push({
+		name: "skills",
+		text: captureOutput(() => printSkills(data.skills, 15))
+	});
+	sections.push({
+		name: "subagents",
+		text: captureOutput(() => printSubagents(data.subagents))
+	});
+	sections.push({
+		name: "mcp",
+		text: captureOutput(() => printMcp(data.mcp))
+	});
+	return sections;
+}
+/**
+* Replace the home directory with `~` in both its plain form and the encoded
+* form Claude Code uses for transcript directories (`/Users/name/x` →
+* `-Users-name-x`), so a recorded run carries no account name.
+*/
+function redactHome(text, home = homedir()) {
+	const encoded = home.replace(/[\/\\]/g, "-");
+	return text.split(home).join("~").split(encoded).join("~");
+}
+/** `--record <dir>`: write a dated, numbered markdown+JSON snapshot of the combined report, plus one summary line in `runs.md`. */
+function recordCombinedReport(dir, data) {
+	mkdirSync(dir, { recursive: true });
+	const existingNumbers = existsSync(dir) ? readdirSync(dir).map((f) => /-run(\d+)\.md$/.exec(f)?.[1]).filter((n) => n !== void 0).map(Number) : [];
+	const runNumber = (existingNumbers.length ? Math.max(...existingNumbers) : 0) + 1;
+	const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+	const baseName = `${date}-run${runNumber}`;
+	const findingsTable = [
+		"| FINDING | SEVERITY | EVIDENCE |",
+		"|---------|----------|----------|",
+		...data.findings.map((f) => `| ${f.finding} | ${f.severity} | ${f.evidence} |`)
+	].join("\n");
+	const sectionBlocks = combinedSectionOutputs(data).map((s) => `### ${s.name}\n\n\`\`\`\n${s.text}\n\`\`\`\n`).join("\n");
+	const md = [
+		"# pai audit tokens — recorded run",
+		"",
+		`date: ${date}`,
+		`encoding: ${data.encoding}`,
+		"",
+		findingsTable,
+		"",
+		sectionBlocks
+	].join("\n");
+	const json = JSON.stringify(data, null, 2);
+	const mdRedacted = redactHome(md);
+	const jsonRedacted = redactHome(json);
+	writeFileSync(join(dir, `${baseName}.md`), mdRedacted, "utf8");
+	writeFileSync(join(dir, `${baseName}.json`), jsonRedacted, "utf8");
+	const runsPath = join(dir, "runs.md");
+	if (!existsSync(runsPath)) writeFileSync(runsPath, "# Audit token-waste runs\n\n", "utf8");
+	const counts = {
+		RED: 0,
+		AMBER: 0,
+		GREEN: 0
+	};
+	for (const f of data.findings) counts[f.severity]++;
+	appendFileSync(runsPath, `- ${date} run${runNumber}: ${counts.RED} RED, ${counts.AMBER} AMBER, ${counts.GREEN} GREEN — ${baseName}.md\n`, "utf8");
+}
+async function cmdCombined(opts) {
+	const data = await gatherCombined();
+	if (opts.json) printJson(data);
+	else {
+		console.log(header("pai audit tokens — combined report"));
+		console.log(dim$1(`token encoding: ${data.encoding}`));
+		const rows = data.findings.map((f) => [
+			severityColor(f.severity, f.finding),
+			severityColor(f.severity, f.severity),
+			f.evidence
+		]);
+		console.log(renderTable([
+			"FINDING",
+			"SEVERITY",
+			"EVIDENCE"
+		], rows));
+	}
+	if (opts.record) recordCombinedReport(opts.record, data);
 }
 /**
 * `--json` is declared once, on `tokensCmd` itself, and read back from there
@@ -10778,7 +12034,7 @@ async function cmdCombined(opts) {
 * `--json` on `pai audit tokens files` silently produced the table output.
 */
 function registerAuditCommands(auditCmd) {
-	const tokensCmd = auditCmd.command("tokens").description("Token-waste audit: memory files, hooks, session usage, spawn overhead, daemon, env, schedule").option("--json", "Print JSON instead of a table").action(async () => {
+	const tokensCmd = auditCmd.command("tokens").description("Token-waste audit: memory files, hooks, session usage, spawn overhead, daemon, env, schedule, skill catalogue, subagents, MCP").option("--json", "Print JSON instead of a table").option("--record <dir>", "Write a dated, numbered markdown+JSON snapshot of the combined report to <dir>").action(async () => {
 		await cmdCombined(jsonOpt());
 	});
 	const jsonOpt = () => tokensCmd.opts();
@@ -10786,10 +12042,13 @@ function registerAuditCommands(auditCmd) {
 		await cmdFiles(paths, jsonOpt());
 	});
 	tokensCmd.command("hooks").description("Token cost of every SessionStart / UserPromptSubmit hook").action(() => cmdHooks(jsonOpt()));
-	tokensCmd.command("session").description("Cache/input/output token split for a session transcript (default: newest)").argument("[path]", "Session JSONL path (default: newest under ~/.claude/projects)").action(async (path) => {
-		await cmdSession(path, jsonOpt());
+	tokensCmd.command("session").description("Cache/input/output token split for a session transcript (default: newest)").argument("[path]", "Session JSONL path (default: newest under ~/.claude/projects)").option("--ctx-threshold <n>", "Per-turn context size above which a turn counts as 'above threshold' (default 200000)").action(async (path, opts) => {
+		await cmdSession(path, {
+			...jsonOpt(),
+			...opts
+		});
 	});
-	tokensCmd.command("spawn").description("Spawn-overhead comparison: Agent-tool subagents vs. pai workers").option("-n, --n <count>", "How many of the newest logs per group to read (default 10)").action(async (opts) => {
+	tokensCmd.command("spawn").description("Spawn-overhead comparison: Agent-tool subagents vs. pai workers").option("-n, --n <count>", "How many of the newest logs per group to read (default 10)").option("--detail", "Print one row per log (first-turn ctx, prompt tokens, overhead, model, path)").action(async (opts) => {
 		await cmdSpawn({
 			...jsonOpt(),
 			...opts
@@ -10800,6 +12059,25 @@ function registerAuditCommands(auditCmd) {
 	tokensCmd.command("schedule").description("Launchd agents / crontab entries that outpace the measured prompt-cache TTL").action(async () => {
 		await cmdSchedule(jsonOpt());
 	});
+	tokensCmd.command("skills").description("Token cost of the SKILL.md / command / plugin catalogue, top entries, duplicate names").option("--top <n>", "How many top-by-tokens entries to show (default 15)").action((opts) => {
+		cmdSkills({
+			...jsonOpt(),
+			...opts
+		});
+	});
+	tokensCmd.command("subagents").description("Token cost of Claude Code subagent definitions (~/.claude/agents, <cwd>/.claude/agents) and their model pinning").action(() => cmdSubagents(jsonOpt()));
+	tokensCmd.command("mcp").description("MCP servers: configured vs. pinned vs. loaded-live vs. used in the last 30 days").option("--connect", "Actually connect to every stdio MCP server to count exposed tools (side-effecting; never on by default)").action(async (opts) => {
+		await cmdMcp({
+			...jsonOpt(),
+			...opts
+		});
+	});
+	tokensCmd.command("ladder").description("LIVE: first-turn context at increasing headless-worker configuration (spawns real claude -p calls)").option("--live", "Actually spawn claude -p (billed API traffic); refuses without this flag").option("--model <model>", "Model to probe with (default haiku)").option("--mcp-config <path>", "MCP config for the L2 rung (default: newest *.mcp.json in the workers log dir)").action(async (opts) => {
+		await cmdLadder({
+			...jsonOpt(),
+			...opts
+		});
+	});
 }
 
 //#endregion
@@ -16005,9 +17283,11 @@ function fail(e) {
 	process.exitCode = 1;
 }
 function registerWorkerCommands(workerCmd) {
-	workerCmd.command("run").description("Run one claude-code worker through the configured provider.\nUnknown options are passed to claude verbatim (e.g. -p, --allowedTools);\n--output-format/--verbose are handled here.\n--label \"<goal>\" is optional — it is the row shown in ps / follow /\nthe status line; when absent it is derived from the prompt's first line\n(--chain/--agent derive their own instead).\n--spec <file> (or --spec -) reads the prompt from a file/stdin instead of\nan inline -p '<prompt>', which breaks on shell quoting; mutually\nexclusive with -p.\nGrant MCP tools by naming mcp__server__tool in --allowedTools (the server loads automatically);\n--chain draft,implement[,review] runs a spec-first pipeline;\n--agent <name> runs an agent definition from ~/.claude/agents.").allowUnknownOption(true).option("--provider <name>", "Provider to run on (default: active, else routing order)").option("--class <name>", "Use the provider of this class (draft, implement, review, research, spotcheck, simple, complex, image)").option("--role <name>", "Alias of --class (roles were renamed to classes)").option("--chain <stages>", "Comma-separated stage classes, e.g. draft,implement or draft,implement,review").option("--agent <name>", "Run the agent definition ~/.claude/agents/<name>.md on a worker").option("--model <model>", "Override the model for this run. Headless (-p) workers default to the --class model; an interactive launch (no -p) with no --model uses the harness default model from settings.json.").option("--label <text>", "Short task label shown in ps / follow / status line (default: first line of the prompt)").option("--spec <path>", "Read the prompt from this file (or - for stdin) instead of -p; mutually exclusive with -p").option("--cwd <dir>", "Directory the worker runs in (default: this process's cwd)").option("--mcp <names>", "MCP servers/sets this worker may use (comma-separated; see `pai worker mcp`)").option("--no-pane", "Do not open a follow pane for this worker").option("--worktree", "Run in a git worktree on branch worker/<id> (default for implement/complex/plan in a git repo)").option("--no-worktree", "Run in place, no worktree").option("--print-cmd", "Print the assembled claude argv as JSON and exit, without spawning (audit tool)").argument("[args...]", "claude arguments, e.g. -p '<task>' --allowedTools 'Read,Edit,Bash'").action(async (args, opts) => {
+	workerCmd.command("run").description("Run one claude-code worker through the configured provider.\nUnknown options are passed to claude verbatim (e.g. -p, --allowedTools);\n--output-format/--verbose are handled here.\n--label \"<goal>\" is optional — it is the row shown in ps / follow /\nthe status line; when absent it is derived from the prompt's first line\n(--chain/--agent derive their own instead).\n--spec <file> (or --spec -) reads the prompt from a file/stdin instead of\nan inline -p '<prompt>', which breaks on shell quoting; mutually\nexclusive with -p.\nGrant MCP tools by naming mcp__server__tool in --allowedTools (the server loads automatically);\n--chain draft,implement[,review] runs a spec-first pipeline;\n--agent <name> runs an agent definition from ~/.claude/agents.").allowUnknownOption(true).option("--provider <name>", "Provider to run on (default: active, else routing order)").option("--class <name>", "Use the provider of this class (draft, implement, review, research, spotcheck, simple, complex, image)").option("--role <name>", "Alias of --class (roles were renamed to classes)").option("--chain <stages>", "Comma-separated stage classes, e.g. draft,implement or draft,implement,review").option("--agent <name>", "Run the agent definition ~/.claude/agents/<name>.md on a worker").option("--model <model>", "Override the model for this run. Headless (-p) workers default to the --class model; an interactive launch (no -p) with no --model uses the harness default model from settings.json.").option("--label <text>", "Short task label shown in ps / follow / status line (default: first line of the prompt)").option("--spec <path>", "Read the prompt from this file (or - for stdin) instead of -p; mutually exclusive with -p").option("--cwd <dir>", "Directory the worker runs in (default: this process's cwd)").option("--mcp <names>", "MCP servers/sets this worker may use (comma-separated; see `pai worker mcp`)").option("--no-pane", "Do not open a follow pane for this worker").option("--worktree", "Run in a git worktree on branch worker/<id> (default for implement/complex/plan in a git repo)").option("--no-worktree", "Run in place, no worktree").option("--print-cmd", "Print the assembled claude argv as JSON and exit, without spawning (audit tool)").option("--report <format>", "Final-report contract/parser: json or ag2 (default: ag2, or PAI_WORKER_REPORT)").option("--no-report-retry", "Skip the one bounded re-ask when the final AG2 message fails validation").argument("[args...]", "claude arguments, e.g. -p '<task>' --allowedTools 'Read,Edit,Bash'").action(async (args, opts) => {
 		try {
 			const className = opts.class ?? opts.role;
+			if (opts.report !== void 0 && opts.report !== "json" && opts.report !== "ag2") throw new Error(`--report: expected "json" or "ag2", got "${opts.report}"`);
+			const reportFormatFlag = opts.report;
 			if (opts.cwd !== void 0) {
 				if (!existsSync(opts.cwd)) throw new Error(`--cwd: directory does not exist: ${opts.cwd}`);
 				if (!statSync(opts.cwd).isDirectory()) throw new Error(`--cwd: not a directory: ${opts.cwd}`);
@@ -16072,6 +17352,8 @@ function registerWorkerCommands(workerCmd) {
 				noPane: opts.pane === false,
 				worktreeFlag: opts.worktree,
 				printCmd: opts.printCmd,
+				reportFormatFlag,
+				noReportRetry: opts.reportRetry === false,
 				claudeArgs
 			});
 			process.exitCode = rc;
@@ -18630,4 +19912,4 @@ claude() {
 
 //#endregion
 export { drainStdio as n, buildProgram as t };
-//# sourceMappingURL=program-LLNPpxlj.mjs.map
+//# sourceMappingURL=program-cr5U1-DK.mjs.map