@tekmidian/pai 0.43.0 → 0.44.0

package/dist/{program-C5jRQ1kg.mjs → program-cr5U1-DK.mjs}

@@ -12,7 +12,7 @@ import { B as claudeProjectsDir, C as findLatestNote, H as scanTranscriptFolders
 import { a as expandHome, c as paiConfigFilePath, i as ensureConfigDir, l as OWNER_LABEL_PREFIX, n as CONFIG_FILE$2, o as loadConfig, s as migrateConfigFile, t as CONFIG_DIR, u as UNROUTED } from "./config-DCu8THKi.mjs";
 import { a as schedulerLogPath, i as paiSocketPath, n as daemonLogPath, r as daemonPidPath } from "./runtime-paths-B0P1TvUr.mjs";
 import { A as DEFAULT_CONTEXT_WINDOW, C as inlineWorkersYamlKeys, D as relocateWorkersYaml, E as parseWorkersYamlDocument, M as stripModelVariant, N as readJsonStrict, O as workersYamlLegacyNotice, P as writeJsonAtomic, S as initWorkersYaml, T as needsWorkersYamlRelocation, d as getProviderOrNative, f as isModelCapability, h as nativeAnthropicProvider, i as PROVIDER_TAGS, j as contextWindowFromModelId, k as workersYamlPath, m as maskKey, o as WorkersConfigError, r as MODEL_CAPABILITIES, t as ANTHROPIC_NATIVE, u as expandHome$1, v as readWorkersSection, w as migrateWorkersToYaml } from "./config-DxMZjpvY.mjs";
-import { A as loadStatuses, B as expandMcpNames, C as UNLABELED, F as waitForTerminalStatus, I as longInlinePromptHint, L as parseRunnerArgs, N as saveStatus, O as isChatPane, P as setWorkerLabel, a as parseWorkerReport, c as mergeWorker, d as sayToWorker, h as openPaneForWorker, i as usageContextTokens, k as loadStatus, l as handoffFromInside, m as openFollowPane, n as runWorker, p as checkPaneForWorker, r as testProvider, s as discardWorker, x as appendLedger, z as describeMcp } from "./run-ByBKowN5.mjs";
+import { A as loadStatus, B as describeMcp, F as setWorkerLabel, I as waitForTerminalStatus, L as longInlinePromptHint, P as saveStatus, R as parseRunnerArgs, S as appendLedger, V as expandMcpNames, a as projectLaunchConfig, c as discardWorker, f as sayToWorker, g as openPaneForWorker, h as openFollowPane, i as usageContextTokens, j as loadStatuses, k as isChatPane, l as mergeWorker, m as checkPaneForWorker, n as runWorker, o as parseWorkerReport, r as testProvider, u as handoffFromInside, w as UNLABELED } from "./run-BgExF8Xg.mjs";
 import { t as PaiClient } from "./ipc-client-C6NryMMb.mjs";
 import { r as humanDuration, t as createStorageBackend } from "./factory-DNYAqjH0.mjs";
 import { n as migrateIdentityFile } from "./wakeup-BfElduEU.mjs";
@@ -21,8 +21,8 @@ import { n as queriesDirPath, t as migrateQueriesDir } from "./query-feedback-CY
 import { s as kgQuery } from "./kg-entity-BSjM5xZh.mjs";
 import { _ as workersLogDir, f as ensureNoMcpConfig, i as buildRunEnv, m as ledgerPath, n as ensureProxyRunning, p as eventsPath, r as stopProxy, t as DEFAULT_PROXY_PORT } from "./server-Ch99xt5K.mjs";
 import { i as sendToSession, n as fetchLiveSessions, r as revealItermSession, t as callAiBroker } from "./aibroker-client-Bn9SnGMa.mjs";
-import { t as runChain } from "./chain-CEC1a5mX.mjs";
-import { C as readSpecPrompt, S as statusLineOutput, _ as updateProvider, a as addProvider, b as psOutput, c as describeProviders, d as resolveProviderName, f as setClass, g as unsetClass, h as setWorkersEnabled, i as fallbackStatusText, l as modelPrefsText, m as setProviderModel, n as fallbackOn, o as classTargetText, p as setProviderEnabled, r as fallbackStatus, s as describeModels, t as fallbackOff, u as removeProvider, v as useProvider, w as resolveSpecPath, x as replayOutput, y as followWorkers } from "./fallback-BQJ8PbCK.mjs";
+import { t as runChain } from "./chain-DAEC9AU7.mjs";
+import { C as readSpecPrompt, S as statusLineOutput, _ as updateProvider, a as addProvider, b as psOutput, c as describeProviders, d as resolveProviderName, f as setClass, g as unsetClass, h as setWorkersEnabled, i as fallbackStatusText, l as modelPrefsText, m as setProviderModel, n as fallbackOn, o as classTargetText, p as setProviderEnabled, r as fallbackStatus, s as describeModels, t as fallbackOff, u as removeProvider, v as useProvider, w as resolveSpecPath, x as replayOutput, y as followWorkers } from "./fallback-CxGDTXWt.mjs";
 import { appendFileSync, chmodSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, platform, tmpdir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
@@ -1282,7 +1282,7 @@ function cmdConfig(db, identifier, opts) {
 * configured server loads, today's behavior. Names are validated against
 * ~/.claude.json's mcpServers / workers.mcpSets the same way `--mcp` is.
 */
-function cmdMcp(db, names, opts = {}) {
+function cmdMcp$1(db, names, opts = {}) {
 	const project = currentProject(db, opts.cwd);
 	if (!project) {
 		console.error(err("No registered project matches the current directory."));
@@ -2077,7 +2077,7 @@ function registerProjectsCommands(projectsCmd, getDb) {
 		cmdConfig(getDb(), identifier, opts);
 	});
 	projectsCmd.command("mcp [names...]").description("View or set the MCP servers this project's interactive supervisor session\nloads (run from inside the project, like `pai projects here`).\nNo names: print the current value. Names (comma-separated or repeated\nargs): set it, validated against ~/.claude.json's mcpServers.\n--clear: unset (all servers load — today's default).").option("--clear", "Unset — all MCP servers load again").action((names, opts) => {
-		cmdMcp(getDb(), names, opts);
+		cmdMcp$1(getDb(), names, opts);
 	});
 	projectsCmd.command("tools [names...]").description("View or set the built-in tool schemas this project's interactive\nsupervisor session loads (run from inside the project, like `pai projects\nhere`). No names: print the current value. Names (comma-separated or\nrepeated args): set it. --clear: unset (all tools load — today's default).").option("--clear", "Unset — all built-in tools load again").action((names, opts) => {
 		cmdTools(getDb(), names, opts);
@@ -5906,7 +5906,7 @@ function cmdLogs(opts) {
 }
 function registerDaemonCommands(daemonCmd) {
 	daemonCmd.command("serve").description("Start the PAI daemon in the foreground").action(async () => {
-		const { serve } = await import("./daemon-QIvCXB5f.mjs");
+		const { serve } = await import("./daemon-BVbvL8IA.mjs");
 		const { loadConfig: lc, ensureConfigDir } = await import("./config-DeqFqa1N.mjs");
 		ensureConfigDir();
 		await serve(lc());
@@ -7173,10 +7173,6 @@ async function stepSettings(rl, daName) {
 			DA: daName
 		},
 		hooks: [
-			{
-				hookType: "SessionStart",
-				command: "${ADAPTER_DIR}/Hooks/session-commands.mjs"
-			},
 			{
 				hookType: "SessionStart",
 				command: "${ADAPTER_DIR}/Hooks/load-core-context.mjs"
@@ -9973,15 +9969,17 @@ function emptyTotals() {
 * Fold one already-parsed JSONL line into a report being accumulated.
 * Exported separately so both the streaming file reader below and tests
 * (which build fixtures as arrays of objects, not files) share one path.
+* Returns the turn's context value when a new turn was counted, else null
+* (non-assistant line, no usage, or a duplicate message.id already seen).
 */
-function foldAssistantLine(report, seenIds, line) {
-	if (line.type !== "assistant") return;
+function foldAssistantLine(report, seenIds, line, threshold) {
+	if (line.type !== "assistant") return null;
 	const message = line.message;
 	const usage = message?.usage;
-	if (!usage) return;
+	if (!usage) return null;
 	const id = message?.id ?? line.uuid;
 	if (id) {
-		if (seenIds.has(id)) return;
+		if (seenIds.has(id)) return null;
 		seenIds.add(id);
 	}
 	report.turns++;
@@ -9992,6 +9990,9 @@ function foldAssistantLine(report, seenIds, line) {
 	const context = (Number(usage.cache_read_input_tokens) || 0) + (Number(usage.cache_creation_input_tokens) || 0) + (Number(usage.input_tokens) || 0);
 	if (report.firstTurnContext === null) report.firstTurnContext = context;
 	report.lastTurnContext = context;
+	report.maxContext = report.maxContext === null ? context : Math.max(report.maxContext, context);
+	if (context > threshold) report.turnsAboveThreshold++;
+	if ((Number(usage.cache_creation_input_tokens) || 0) > 2e4) report.cacheRebuildTurns++;
 	const model = message?.model ?? "unknown";
 	report.models[model] = (report.models[model] ?? 0) + 1;
 	const split = usage.cache_creation;
@@ -9999,9 +10000,23 @@ function foldAssistantLine(report, seenIds, line) {
 		report.cacheCreationSplit.ephemeral5m += Number(split.ephemeral_5m_input_tokens) || 0;
 		report.cacheCreationSplit.ephemeral1h += Number(split.ephemeral_1h_input_tokens) || 0;
 	}
+	return context;
+}
+/**
+* True for a real human-authored `type:"user"` prompt line: content is a
+* plain string, or a content array with no `tool_result` block. Claude Code
+* encodes tool results as `type:"user"` messages whose content array is
+* entirely (or partly) tool_result blocks — those must not count as prompts.
+*/
+function isRealUserPrompt(line) {
+	if (line.type !== "user") return false;
+	const content = line.message?.content;
+	if (typeof content === "string") return true;
+	if (Array.isArray(content)) return !content.some((block) => block?.type === "tool_result");
+	return false;
 }
 /** Parse a session/subagent/worker-event JSONL file into a usage report. */
-async function parseSessionUsage(path) {
+async function parseSessionUsage(path, threshold = 2e5) {
 	const report = {
 		path,
 		sizeBytes: existsSync(path) ? readFileSync(path).byteLength : 0,
@@ -10013,9 +10028,15 @@ async function parseSessionUsage(path) {
 		cacheCreationSplit: {
 			ephemeral5m: 0,
 			ephemeral1h: 0
-		}
+		},
+		avgContext: null,
+		maxContext: null,
+		turnsAboveThreshold: 0,
+		cacheRebuildTurns: 0,
+		userPrompts: 0
 	};
 	const seenIds = /* @__PURE__ */ new Set();
+	let contextSum = 0;
 	const rl = createInterface({
 		input: createReadStream(path, "utf8"),
 		crlfDelay: Infinity
@@ -10028,8 +10049,14 @@ async function parseSessionUsage(path) {
 		} catch {
 			continue;
 		}
-		foldAssistantLine(report, seenIds, obj);
+		if (obj.type === "user") {
+			if (isRealUserPrompt(obj)) report.userPrompts++;
+			continue;
+		}
+		const context = foldAssistantLine(report, seenIds, obj, threshold);
+		if (context !== null) contextSum += context;
 	}
+	report.avgContext = report.turns > 0 ? Math.round(contextSum / report.turns) : null;
 	return report;
 }
 function totalUsageTokens(totals) {
@@ -10079,10 +10106,10 @@ function newestSessionLog() {
 	}
 	return best?.path ?? null;
 }
-async function auditSession(path) {
+async function auditSession(path, threshold) {
 	const target = path ?? newestSessionLog();
 	if (!target) return null;
-	const report = await parseSessionUsage(target);
+	const report = await parseSessionUsage(target, threshold);
 	const total = totalUsageTokens(report.totals) || 1;
 	const percentages = {};
 	for (const [key, value] of Object.entries(report.totals)) percentages[key] = 100 * value / total;
@@ -10689,7 +10716,7 @@ function findCatalogueFiles(claudeDir) {
 	return found;
 }
 /** Strip a single layer of matching quotes ("..." or '...') from a trimmed value. */
-function unquote(value) {
+function unquote$1(value) {
 	if (value.length >= 2) {
 		const first = value[0];
 		const last = value[value.length - 1];
@@ -10704,8 +10731,8 @@ function parseFrontmatter(text) {
 	const nameMatch = /^name:\s*(.+)$/m.exec(fm);
 	const descMatch = /(?:^|\n)description:\s*(.+?)(?=\n\w[\w-]*:|$)/s.exec(fm);
 	return {
-		name: nameMatch ? unquote(nameMatch[1].trim()) : null,
-		description: descMatch ? unquote(descMatch[1].trim()) : ""
+		name: nameMatch ? unquote$1(nameMatch[1].trim()) : null,
+		description: descMatch ? unquote$1(descMatch[1].trim()) : ""
 	};
 }
 function nameFallback(path, source) {
@@ -10713,7 +10740,7 @@ function nameFallback(path, source) {
 	return basename(dirname(path));
 }
 /** Build one catalogue entry from a file, deriving its name/description/tokens. */
-function readEntry(path, source) {
+function readEntry$1(path, source) {
 	let text = "";
 	try {
 		text = readFileSync(path, "utf8");
@@ -10815,7 +10842,7 @@ function auditSkills(claudeDir = join(homedir(), ".claude"), settingsPath = join
 		deduped.push(file);
 	}
 	const enabledPlugins = readEnabledPlugins(settingsPath);
-	const entries = deduped.map((f) => readEntry(f.path, f.source));
+	const entries = deduped.map((f) => readEntry$1(f.path, f.source));
 	const dedupeKeys = /* @__PURE__ */ new Map();
 	for (const entry of entries) {
 		if (entry.source !== "plugins") continue;
@@ -10875,6 +10902,8 @@ const SKILL_CATALOGUE_RED = 6e3;
 const HOOK_TOKEN_LIMIT = 1e3;
 const FIRST_TURN_CONTEXT_LIMIT = 3e4;
 const DAEMON_FAILURE_RATE_LIMIT = .05;
+const CONTEXT_GROWTH_AVG_RED = 1e5;
+const CONTEXT_GROWTH_MAX_AMBER = 15e4;
 const SEVERITY_RANK = {
 	RED: 0,
 	AMBER: 1,
@@ -10946,6 +10975,42 @@ function buildFindings(input) {
 		severity: skillTokens > SKILL_CATALOGUE_RED ? "RED" : skillTokens > SKILL_CATALOGUE_AMBER ? "AMBER" : "GREEN",
 		evidence: `${skillTokens} tokens loaded (${input.skills.total} on disk) across ${input.skills.entries.length} entries` + (input.skills.duplicates.length ? `, ${input.skills.duplicates.length} case-insensitive duplicate name(s)` : "")
 	});
+	const inheriting = input.subagents.entries.filter((e) => e.model === "inherits");
+	if (input.subagents.entries.length === 0) findings.push({
+		finding: "subagent model pinning",
+		severity: "GREEN",
+		evidence: "no agent files"
+	});
+	else findings.push({
+		finding: "subagent model pinning",
+		severity: inheriting.length > 0 ? "AMBER" : "GREEN",
+		evidence: `${inheriting.length} of ${input.subagents.entries.length} inherit`
+	});
+	const configuredCount = input.mcp.servers.filter((s) => s.configuredIn.length > 0).length;
+	const plainLaunch = input.mcp.liveProcesses.find((p) => p.mcpConfigPath === null);
+	if (!plainLaunch) findings.push({
+		finding: "MCP servers loaded vs. used",
+		severity: "GREEN",
+		evidence: `${configuredCount} configured, no plain launch found`
+	});
+	else {
+		const zeroCallServers = input.mcp.servers.filter((s) => s.configuredIn.length > 0 && s.calls30d === 0);
+		findings.push({
+			finding: "MCP servers loaded vs. used",
+			severity: zeroCallServers.length > 0 ? "AMBER" : "GREEN",
+			evidence: `${configuredCount} configured, ${zeroCallServers.length} loaded by pid ${plainLaunch.pid}`
+		});
+	}
+	if (input.session) {
+		const avg = input.session.avgContext ?? 0;
+		const max = input.session.maxContext ?? 0;
+		const severity = avg > CONTEXT_GROWTH_AVG_RED || input.session.turnsAboveThreshold > 0 ? "RED" : max > CONTEXT_GROWTH_MAX_AMBER ? "AMBER" : "GREEN";
+		findings.push({
+			finding: "context growth",
+			severity,
+			evidence: `avg ${avg}, max ${max}, ${input.session.turnsAboveThreshold} turns > ${input.ctxThreshold}, ${input.session.turns} turns`
+		});
+	}
 	return sortFindings(findings);
 }
 
@@ -11122,6 +11187,307 @@ async function auditLadder(opts) {
 	};
 }
 
+//#endregion
+//#region src/audit/subagents.ts
+/**
+* `pai audit tokens subagents` — token cost of every Claude Code subagent
+* definition: `.claude/agents/*.md` under the user's home and (separately)
+* under the current project. A subagent with no `model:` frontmatter field
+* inherits the caller's model at runtime rather than costing a fixed model
+* choice, so it is reported as `"inherits"` rather than left blank.
+*/
+/** Strip a single layer of matching quotes ("..." or '...') from a trimmed value. */
+function unquote(value) {
+	if (value.length >= 2) {
+		const first = value[0];
+		const last = value[value.length - 1];
+		if (first === "\"" && last === "\"" || first === "'" && last === "'") return value.slice(1, -1);
+	}
+	return value;
+}
+/** The top-level `model:` frontmatter field, or `"inherits"` if absent/empty. */
+function parseModel(text) {
+	const match = /^---\n([\s\S]*?)\n---/.exec(text);
+	if (!match) return "inherits";
+	const modelMatch = /^model:\s*(.+)$/m.exec(match[1]);
+	if (!modelMatch) return "inherits";
+	const value = unquote(modelMatch[1].trim());
+	return value === "" ? "inherits" : value;
+}
+/** Every top-level `.md` file directly under `agentsDir` (not recursive). */
+function findAgentFiles(agentsDir) {
+	let names;
+	try {
+		names = readdirSync(agentsDir);
+	} catch {
+		return [];
+	}
+	return names.filter((n) => n.endsWith(".md")).map((n) => join(agentsDir, n));
+}
+function readEntry(path) {
+	let text = "";
+	try {
+		text = readFileSync(path, "utf8");
+	} catch {}
+	return {
+		path,
+		tokens: countTokens(text),
+		model: parseModel(text)
+	};
+}
+function auditSubagents(homeDir, cwd) {
+	return {
+		encoding: TOKEN_ENCODING,
+		entries: [...findAgentFiles(join(homeDir, ".claude", "agents")), ...findAgentFiles(join(cwd, ".claude", "agents"))].map(readEntry)
+	};
+}
+
+//#endregion
+//#region src/audit/mcp.ts
+/**
+* `pai audit mcp` — cross-reference every MCP server name found anywhere
+* (global/project config, project `.mcp.json`, live process argv, 30-day
+* transcript usage) against where it's configured, whether it's pinned via
+* `pai project mcp`, whether a live process actually loaded it, and how much
+* it was used in the last 30 days.
+*
+* The `--connect` path is the only side-effecting one: it launches every
+* configured stdio MCP server to call `listTools()`. It never runs unless
+* the caller passes `connect: true` explicitly — there is no default-on path.
+*/
+const THIRTY_DAYS_MS = 720 * 60 * 60 * 1e3;
+const MAX_TRANSCRIPT_BYTES = 50 * 1024 * 1024;
+/** Whether a transcript file is worth streaming: fresh enough and small enough. */
+function shouldScanTranscript(stat, now) {
+	if (stat.size > MAX_TRANSCRIPT_BYTES) return false;
+	if (now - stat.mtimeMs > THIRTY_DAYS_MS) return false;
+	return true;
+}
+/**
+* Whether a live process's resolved server set includes `serverName`.
+* `servers === null` means "no --mcp-config flag", i.e. every configured
+* server loads; an array (possibly empty) means only those names load.
+*/
+function liveProcessLoadsServer(proc, serverName, allConfiguredNames) {
+	if (proc.servers === null) return allConfiguredNames.includes(serverName);
+	return proc.servers.includes(serverName);
+}
+function resolveHomePath(path, homeDir) {
+	return path.startsWith("~") ? join(homeDir, path.slice(1)) : path;
+}
+function readJsonFile(path) {
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+function gatherConfiguredSources(cwd, homeDir) {
+	const configuredIn = /* @__PURE__ */ new Map();
+	const disabled = /* @__PURE__ */ new Set();
+	const serverDefs = /* @__PURE__ */ new Map();
+	const addTag = (name, tag) => {
+		if (!configuredIn.has(name)) configuredIn.set(name, /* @__PURE__ */ new Set());
+		configuredIn.get(name).add(tag);
+	};
+	const claudeJson = readJsonFile(join(homeDir, ".claude.json"));
+	if (claudeJson) {
+		for (const [name, def] of Object.entries(claudeJson.mcpServers ?? {})) {
+			addTag(name, "global");
+			if (!serverDefs.has(name)) serverDefs.set(name, def);
+		}
+		const projectEntry = claudeJson.projects?.[resolve(cwd)];
+		if (projectEntry) {
+			for (const [name, def] of Object.entries(projectEntry.mcpServers ?? {})) {
+				addTag(name, "project");
+				if (!serverDefs.has(name)) serverDefs.set(name, def);
+			}
+			for (const name of projectEntry.disabledMcpServers ?? []) {
+				disabled.add(name);
+				if (!configuredIn.has(name)) configuredIn.set(name, /* @__PURE__ */ new Set());
+			}
+		}
+	}
+	const mcpJsonPath = join(cwd, ".mcp.json");
+	if (existsSync(mcpJsonPath)) {
+		const mcpJson = readJsonFile(mcpJsonPath);
+		if (mcpJson) for (const [name, def] of Object.entries(mcpJson.mcpServers ?? {})) {
+			addTag(name, "project .mcp.json");
+			if (!serverDefs.has(name)) serverDefs.set(name, def);
+		}
+	}
+	return {
+		configuredIn,
+		disabled,
+		serverDefs
+	};
+}
+function gatherLiveProcesses(homeDir) {
+	const procs = [];
+	for (const pid of findClaudePids()) {
+		const line = readProcessEnvLine(pid);
+		if (!line) continue;
+		const mcpConfigArg = extractMcpConfigArg(line);
+		if (!mcpConfigArg) {
+			procs.push({
+				pid,
+				mcpConfigPath: null,
+				servers: null
+			});
+			continue;
+		}
+		const resolved = resolveHomePath(mcpConfigArg, homeDir);
+		const parsed = readJsonFile(resolved);
+		const servers = parsed ? Object.keys(parsed.mcpServers ?? {}) : [];
+		procs.push({
+			pid,
+			mcpConfigPath: resolved,
+			servers
+		});
+	}
+	return procs;
+}
+/** Recursively find every file under `dir` ending in `.jsonl`. */
+function findJsonlFiles(dir) {
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	const found = [];
+	for (const entry of entries) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) found.push(...findJsonlFiles(full));
+		else if (entry.isFile() && entry.name.endsWith(".jsonl")) found.push(full);
+	}
+	return found;
+}
+function foldToolUseBlock(block, usage) {
+	if (block.type !== "tool_use") return;
+	const name = block.name;
+	if (!name || !name.startsWith("mcp__")) return;
+	const parts = name.split("__");
+	const server = parts[1];
+	const tool = parts.slice(2).join("__");
+	if (!server) return;
+	if (!usage.has(server)) usage.set(server, {
+		tools: /* @__PURE__ */ new Set(),
+		calls: 0
+	});
+	const entry = usage.get(server);
+	entry.tools.add(tool);
+	entry.calls += 1;
+}
+async function gatherUsage(transcriptsDir, now) {
+	const usage = /* @__PURE__ */ new Map();
+	for (const file of findJsonlFiles(transcriptsDir)) {
+		let stat;
+		try {
+			stat = statSync(file);
+		} catch {
+			continue;
+		}
+		if (!shouldScanTranscript(stat, now)) continue;
+		const rl = createInterface({
+			input: createReadStream(file, "utf8"),
+			crlfDelay: Infinity
+		});
+		for await (const raw of rl) {
+			if (!raw.includes("\"mcp__")) continue;
+			let parsed;
+			try {
+				parsed = JSON.parse(raw);
+			} catch {
+				continue;
+			}
+			if (parsed.type === "tool_use") foldToolUseBlock(parsed, usage);
+			if (Array.isArray(parsed.message?.content)) for (const block of parsed.message.content) foldToolUseBlock(block, usage);
+		}
+	}
+	const result = /* @__PURE__ */ new Map();
+	for (const [server, entry] of usage) result.set(server, {
+		distinctTools: entry.tools.size,
+		calls: entry.calls
+	});
+	return result;
+}
+function isStdioDef(def) {
+	return typeof def === "object" && def !== null && typeof def.command === "string";
+}
+/** Connect to every stdio MCP server row and record how many tools it exposes. Side-effecting: only called when `opts.connect === true`. */
+async function connectAndCountTools(rows, serverDefs) {
+	const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
+	const { StdioClientTransport } = await import("@modelcontextprotocol/sdk/client/stdio.js");
+	for (const row of rows) {
+		const def = serverDefs.get(row.server);
+		if (!isStdioDef(def)) continue;
+		const transport = new StdioClientTransport({
+			command: def.command,
+			args: def.args ?? [],
+			env: def.env
+		});
+		const client = new Client({
+			name: "pai-audit-mcp",
+			version: "1.0.0"
+		}, { capabilities: {} });
+		let settled = false;
+		const timeout = new Promise((res) => {
+			setTimeout(() => {
+				if (!settled) res("UNKNOWN");
+			}, 1e4);
+		});
+		try {
+			const attempt = (async () => {
+				await client.connect(transport);
+				return (await client.listTools()).tools.length;
+			})();
+			const outcome = await Promise.race([attempt, timeout]);
+			settled = true;
+			row.toolsExposed = outcome;
+		} catch {
+			settled = true;
+			row.toolsExposed = "UNKNOWN";
+		} finally {
+			try {
+				await client.close();
+			} catch {}
+		}
+	}
+}
+async function auditMcp(opts) {
+	const cwd = opts.cwd;
+	const homeDir = opts.homeDir;
+	const transcriptsDir = opts.transcriptsDir ?? join(homeDir, ".claude", "projects");
+	const { configuredIn, disabled, serverDefs } = gatherConfiguredSources(cwd, homeDir);
+	const liveProcesses = gatherLiveProcesses(homeDir);
+	const usage = await gatherUsage(transcriptsDir, Date.now());
+	const pinned = opts.projectsDbPath ? projectLaunchConfig(resolve(cwd), opts.projectsDbPath)?.mcp ?? null : projectLaunchConfig(resolve(cwd))?.mcp ?? null;
+	const allNames = new Set([...configuredIn.keys(), ...usage.keys()]);
+	const allConfiguredNames = [...configuredIn.keys()];
+	const rows = [];
+	for (const name of allNames) {
+		const liveMatches = liveProcesses.filter((p) => liveProcessLoadsServer(p, name, allConfiguredNames));
+		const serverUsage = usage.get(name);
+		rows.push({
+			server: name,
+			configuredIn: [...configuredIn.get(name) ?? /* @__PURE__ */ new Set()],
+			disabled: disabled.has(name),
+			pinned: pinned === null ? null : pinned.includes(name) ? "yes" : "-",
+			loadedLive: liveMatches.length ? liveMatches.map((p) => `pid ${p.pid}`).join(", ") : "-",
+			toolsExposed: "UNKNOWN",
+			toolsUsed30d: serverUsage?.distinctTools ?? 0,
+			calls30d: serverUsage?.calls ?? 0
+		});
+	}
+	rows.sort((a, b) => a.server.localeCompare(b.server));
+	if (opts.connect === true) await connectAndCountTools(rows, serverDefs);
+	return {
+		servers: rows,
+		liveProcesses
+	};
+}
+
 //#endregion
 //#region src/cli/commands/audit.ts
 function severityColor(sev, text) {
@@ -11190,9 +11556,10 @@ function printSession(report) {
 	console.log(`context on last turn:  ${report.lastTurnContext ?? "n/a"}`);
 	console.log(`cache_creation split: ephemeral_5m=${report.cacheCreationSplit.ephemeral5m}, ephemeral_1h=${report.cacheCreationSplit.ephemeral1h}`);
 	console.log(dim$1(`models: ${JSON.stringify(report.models)}`));
+	console.log(`avg context: ${report.avgContext ?? "n/a"}, max context: ${report.maxContext ?? "n/a"}, turns above threshold: ${report.turnsAboveThreshold}, cache-rebuild turns: ${report.cacheRebuildTurns}, user prompts: ${report.userPrompts}`);
 }
 async function cmdSession(path, opts) {
-	const report = await auditSession(path);
+	const report = await auditSession(path, opts.ctxThreshold ? parseInt(opts.ctxThreshold, 10) : void 0);
 	if (!report) {
 		console.error(err("  No session transcript found."));
 		process.exitCode = 1;
@@ -11434,27 +11801,90 @@ async function cmdLadder(opts) {
 	if (opts.json) return printJson(report);
 	printLadder(report);
 }
-async function cmdCombined(opts) {
+function printSubagents(report) {
+	console.log(header(`Subagent definitions (encoding: ${report.encoding})`));
+	if (report.entries.length === 0) {
+		console.log(dim$1("no agent files"));
+		return;
+	}
+	const rows = report.entries.map((e) => [
+		String(e.tokens),
+		e.model === "inherits" ? dim$1("inherits") : e.model,
+		e.path
+	]);
+	console.log(renderTable([
+		"tokens",
+		"model",
+		"path"
+	], rows));
+	const inheriting = report.entries.filter((e) => e.model === "inherits").length;
+	console.log(dim$1(`${inheriting} of ${report.entries.length} inherit the caller's model`));
+}
+function cmdSubagents(opts) {
+	const report = auditSubagents(homedir(), process.cwd());
+	if (opts.json) return printJson(report);
+	printSubagents(report);
+}
+function printMcp(report) {
+	console.log(header("MCP servers: configured vs. loaded vs. used"));
+	const rows = report.servers.map((s) => [
+		s.server + (s.disabled ? dim$1(" (disabled)") : ""),
+		s.configuredIn.join(", ") || dim$1("-"),
+		s.pinned ?? dim$1("all"),
+		s.loadedLive,
+		String(s.toolsExposed),
+		String(s.toolsUsed30d),
+		String(s.calls30d)
+	]);
+	console.log(renderTable([
+		"server",
+		"configured-in",
+		"pinned",
+		"loaded-live",
+		"tools-exposed",
+		"tools-used-30d",
+		"calls-30d"
+	], rows));
+	console.log(dim$1(`live claude processes: ${report.liveProcesses.length}`));
+}
+async function cmdMcp(opts) {
+	const report = await auditMcp({
+		cwd: process.cwd(),
+		homeDir: homedir(),
+		connect: opts.connect
+	});
+	if (opts.json) return printJson(report);
+	printMcp(report);
+}
+const DEFAULT_CTX_THRESHOLD = 2e5;
+async function gatherCombined() {
 	const cwd = process.cwd();
 	const files = auditFiles(defaultFileSet(cwd));
 	const hooks = auditHooks(cwd);
-	const session = await auditSession(newestSessionLog() ?? void 0).catch(() => null);
+	const session = await auditSession(newestSessionLog() ?? void 0, DEFAULT_CTX_THRESHOLD).catch(() => null);
 	const daemon = auditDaemon();
 	const env = auditEnv();
 	const spawn = await auditSpawn();
 	const schedule = auditSchedule(cacheTtlSeconds(session?.cacheCreationSplit));
 	const skills = auditSkills();
-	const findings = buildFindings({
-		files,
-		hooks,
-		session,
-		daemon,
-		env,
-		skills
+	const subagents = auditSubagents(homedir(), cwd);
+	const mcp = await auditMcp({
+		cwd,
+		homeDir: homedir()
 	});
-	if (opts.json) return printJson({
+	return {
 		encoding: TOKEN_ENCODING,
-		findings,
+		findings: buildFindings({
+			files,
+			hooks,
+			session,
+			daemon,
+			env,
+			skills,
+			subagents,
+			mcp,
+			ctxThreshold: DEFAULT_CTX_THRESHOLD
+		}),
 		files,
 		hooks,
 		session,
@@ -11462,20 +11892,138 @@ async function cmdCombined(opts) {
 		daemon,
 		env,
 		schedule,
-		skills
-	});
-	console.log(header("pai audit tokens — combined report"));
-	console.log(dim$1(`token encoding: ${TOKEN_ENCODING}`));
-	const rows = findings.map((f) => [
-		severityColor(f.severity, f.finding),
-		severityColor(f.severity, f.severity),
-		f.evidence
-	]);
-	console.log(renderTable([
-		"FINDING",
-		"SEVERITY",
-		"EVIDENCE"
-	], rows));
+		skills,
+		subagents,
+		mcp
+	};
+}
+/** Strip ANSI escape sequences (chalk colour codes) from captured console output. */
+function stripAnsi$1(text) {
+	return text.replace(/\x1b\[[0-9;]*m/g, "");
+}
+/** Run `fn`, capturing everything it sends through `console.log` as plain text. */
+function captureOutput(fn) {
+	const original = console.log;
+	const lines = [];
+	console.log = (...args) => {
+		lines.push(stripAnsi$1(args.map((a) => String(a)).join(" ")));
+	};
+	try {
+		fn();
+	} finally {
+		console.log = original;
+	}
+	return lines.join("\n");
+}
+function combinedSectionOutputs(data) {
+	const sections = [];
+	sections.push({
+		name: "files",
+		text: captureOutput(() => printFiles(data.files))
+	});
+	sections.push({
+		name: "hooks",
+		text: captureOutput(() => printHooks(data.hooks))
+	});
+	if (data.session) sections.push({
+		name: "session",
+		text: captureOutput(() => printSession(data.session))
+	});
+	sections.push({
+		name: "spawn",
+		text: captureOutput(() => printSpawn(data.spawn))
+	});
+	sections.push({
+		name: "daemon",
+		text: captureOutput(() => printDaemon(data.daemon))
+	});
+	sections.push({
+		name: "env",
+		text: captureOutput(() => printEnv(data.env))
+	});
+	sections.push({
+		name: "schedule",
+		text: captureOutput(() => printSchedule(data.schedule))
+	});
+	sections.push({
+		name: "skills",
+		text: captureOutput(() => printSkills(data.skills, 15))
+	});
+	sections.push({
+		name: "subagents",
+		text: captureOutput(() => printSubagents(data.subagents))
+	});
+	sections.push({
+		name: "mcp",
+		text: captureOutput(() => printMcp(data.mcp))
+	});
+	return sections;
+}
+/**
+* Replace the home directory with `~` in both its plain form and the encoded
+* form Claude Code uses for transcript directories (`/Users/name/x` →
+* `-Users-name-x`), so a recorded run carries no account name.
+*/
+function redactHome(text, home = homedir()) {
+	const encoded = home.replace(/[\/\\]/g, "-");
+	return text.split(home).join("~").split(encoded).join("~");
+}
+/** `--record <dir>`: write a dated, numbered markdown+JSON snapshot of the combined report, plus one summary line in `runs.md`. */
+function recordCombinedReport(dir, data) {
+	mkdirSync(dir, { recursive: true });
+	const existingNumbers = existsSync(dir) ? readdirSync(dir).map((f) => /-run(\d+)\.md$/.exec(f)?.[1]).filter((n) => n !== void 0).map(Number) : [];
+	const runNumber = (existingNumbers.length ? Math.max(...existingNumbers) : 0) + 1;
+	const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+	const baseName = `${date}-run${runNumber}`;
+	const findingsTable = [
+		"| FINDING | SEVERITY | EVIDENCE |",
+		"|---------|----------|----------|",
+		...data.findings.map((f) => `| ${f.finding} | ${f.severity} | ${f.evidence} |`)
+	].join("\n");
+	const sectionBlocks = combinedSectionOutputs(data).map((s) => `### ${s.name}\n\n\`\`\`\n${s.text}\n\`\`\`\n`).join("\n");
+	const md = [
+		"# pai audit tokens — recorded run",
+		"",
+		`date: ${date}`,
+		`encoding: ${data.encoding}`,
+		"",
+		findingsTable,
+		"",
+		sectionBlocks
+	].join("\n");
+	const json = JSON.stringify(data, null, 2);
+	const mdRedacted = redactHome(md);
+	const jsonRedacted = redactHome(json);
+	writeFileSync(join(dir, `${baseName}.md`), mdRedacted, "utf8");
+	writeFileSync(join(dir, `${baseName}.json`), jsonRedacted, "utf8");
+	const runsPath = join(dir, "runs.md");
+	if (!existsSync(runsPath)) writeFileSync(runsPath, "# Audit token-waste runs\n\n", "utf8");
+	const counts = {
+		RED: 0,
+		AMBER: 0,
+		GREEN: 0
+	};
+	for (const f of data.findings) counts[f.severity]++;
+	appendFileSync(runsPath, `- ${date} run${runNumber}: ${counts.RED} RED, ${counts.AMBER} AMBER, ${counts.GREEN} GREEN — ${baseName}.md\n`, "utf8");
+}
+async function cmdCombined(opts) {
+	const data = await gatherCombined();
+	if (opts.json) printJson(data);
+	else {
+		console.log(header("pai audit tokens — combined report"));
+		console.log(dim$1(`token encoding: ${data.encoding}`));
+		const rows = data.findings.map((f) => [
+			severityColor(f.severity, f.finding),
+			severityColor(f.severity, f.severity),
+			f.evidence
+		]);
+		console.log(renderTable([
+			"FINDING",
+			"SEVERITY",
+			"EVIDENCE"
+		], rows));
+	}
+	if (opts.record) recordCombinedReport(opts.record, data);
 }
 /**
 * `--json` is declared once, on `tokensCmd` itself, and read back from there
@@ -11486,7 +12034,7 @@ async function cmdCombined(opts) {
 * `--json` on `pai audit tokens files` silently produced the table output.
 */
 function registerAuditCommands(auditCmd) {
-	const tokensCmd = auditCmd.command("tokens").description("Token-waste audit: memory files, hooks, session usage, spawn overhead, daemon, env, schedule, skill catalogue").option("--json", "Print JSON instead of a table").action(async () => {
+	const tokensCmd = auditCmd.command("tokens").description("Token-waste audit: memory files, hooks, session usage, spawn overhead, daemon, env, schedule, skill catalogue, subagents, MCP").option("--json", "Print JSON instead of a table").option("--record <dir>", "Write a dated, numbered markdown+JSON snapshot of the combined report to <dir>").action(async () => {
 		await cmdCombined(jsonOpt());
 	});
 	const jsonOpt = () => tokensCmd.opts();
@@ -11494,8 +12042,11 @@ function registerAuditCommands(auditCmd) {
 		await cmdFiles(paths, jsonOpt());
 	});
 	tokensCmd.command("hooks").description("Token cost of every SessionStart / UserPromptSubmit hook").action(() => cmdHooks(jsonOpt()));
-	tokensCmd.command("session").description("Cache/input/output token split for a session transcript (default: newest)").argument("[path]", "Session JSONL path (default: newest under ~/.claude/projects)").action(async (path) => {
-		await cmdSession(path, jsonOpt());
+	tokensCmd.command("session").description("Cache/input/output token split for a session transcript (default: newest)").argument("[path]", "Session JSONL path (default: newest under ~/.claude/projects)").option("--ctx-threshold <n>", "Per-turn context size above which a turn counts as 'above threshold' (default 200000)").action(async (path, opts) => {
+		await cmdSession(path, {
+			...jsonOpt(),
+			...opts
+		});
 	});
 	tokensCmd.command("spawn").description("Spawn-overhead comparison: Agent-tool subagents vs. pai workers").option("-n, --n <count>", "How many of the newest logs per group to read (default 10)").option("--detail", "Print one row per log (first-turn ctx, prompt tokens, overhead, model, path)").action(async (opts) => {
 		await cmdSpawn({
@@ -11514,6 +12065,13 @@ function registerAuditCommands(auditCmd) {
 			...opts
 		});
 	});
+	tokensCmd.command("subagents").description("Token cost of Claude Code subagent definitions (~/.claude/agents, <cwd>/.claude/agents) and their model pinning").action(() => cmdSubagents(jsonOpt()));
+	tokensCmd.command("mcp").description("MCP servers: configured vs. pinned vs. loaded-live vs. used in the last 30 days").option("--connect", "Actually connect to every stdio MCP server to count exposed tools (side-effecting; never on by default)").action(async (opts) => {
+		await cmdMcp({
+			...jsonOpt(),
+			...opts
+		});
+	});
 	tokensCmd.command("ladder").description("LIVE: first-turn context at increasing headless-worker configuration (spawns real claude -p calls)").option("--live", "Actually spawn claude -p (billed API traffic); refuses without this flag").option("--model <model>", "Model to probe with (default haiku)").option("--mcp-config <path>", "MCP config for the L2 rung (default: newest *.mcp.json in the workers log dir)").action(async (opts) => {
 		await cmdLadder({
 			...jsonOpt(),
@@ -19354,4 +19912,4 @@ claude() {
 
 //#endregion
 export { drainStdio as n, buildProgram as t };
-//# sourceMappingURL=program-C5jRQ1kg.mjs.map
+//# sourceMappingURL=program-cr5U1-DK.mjs.map