@tekmidian/pai 0.48.0 → 0.50.0

package/dist/factory-Ba8j9K7q.mjs

@@ -0,0 +1,3 @@
+import { t as createStorageBackend } from "./factory-Bt7TWQje.mjs";
+
+export { createStorageBackend };

package/dist/{factory-DNYAqjH0.mjs → factory-Bt7TWQje.mjs}

@@ -86,7 +86,7 @@ const ESCALATE_AFTER_ATTEMPTS = 5;
 async function notifyBackendDown(attempts, lastError) {
 	try {
 		const { routeNotification } = await import("./router-CremHKTI.mjs");
-		const { loadConfig } = await import("./config-DeqFqa1N.mjs");
+		const { loadConfig } = await import("./config-RjeVGJ7K.mjs");
 		await routeNotification({
 			event: "error",
 			title: "PAI: storage backend unreachable",
@@ -98,7 +98,7 @@ async function notifyBackendDown(attempts, lastError) {
 async function notifyBackendRecovered(attempts, since) {
 	try {
 		const { routeNotification } = await import("./router-CremHKTI.mjs");
-		const { loadConfig } = await import("./config-DeqFqa1N.mjs");
+		const { loadConfig } = await import("./config-RjeVGJ7K.mjs");
 		const mins = since ? Math.max(1, Math.round((Date.now() - since) / 6e4)) : null;
 		await routeNotification({
 			event: "completion",
@@ -147,4 +147,4 @@ async function createSQLiteBackend() {
 
 //#endregion
 export { getBackendOutage as n, humanDuration as r, createStorageBackend as t };
-//# sourceMappingURL=factory-DNYAqjH0.mjs.map
+//# sourceMappingURL=factory-Bt7TWQje.mjs.map

package/dist/{factory-DNYAqjH0.mjs.map → factory-Bt7TWQje.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"factory-DNYAqjH0.mjs","names":[],"sources":["../src/storage/outage.ts","../src/storage/factory.ts"],"sourcesContent":["/**\n * outage.ts — is the storage backend actually reachable right now?\n *\n * The daemon retries a dead backend forever, which is correct: a Postgres\n * container that is down will usually come back, and giving up would lose the\n * work queue. What was wrong is that it did so in complete silence.\n *\n * Observed 2026-07-26: the container was down for roughly two days. The daemon\n * logged \"Postgres unavailable\" 144 times over 36 minutes, the work queue backed\n * up, session notes for the whole period were never written — and\n * `pai daemon status` reported \"Index: idle\" throughout. The one command anyone\n * would run to check said everything was fine.\n *\n * So the outage is recorded where the status command can see it, and escalated\n * once through the notification channels that were already configured and\n * already unused for this.\n */\n\nexport interface BackendOutage {\n  backend: string;\n  /** When the current run of failures began. */\n  since: number;\n  /** Consecutive failed attempts so far. */\n  attempts: number;\n  lastError: string;\n}\n\nlet current: BackendOutage | null = null;\n\n/** Record that the backend is currently unreachable. */\nexport function setBackendOutage(outage: BackendOutage): void {\n  current = outage;\n}\n\n/**\n * Record that the backend answered.\n *\n * Called on every successful connection, including the first — so a daemon that\n * never had a problem reports none, and one that recovered stops reporting an\n * outage that has ended.\n */\nexport function clearBackendOutage(): void {\n  current = null;\n}\n\n/** The current outage, or null when the backend is answering. */\nexport function getBackendOutage(): BackendOutage | null {\n  return current;\n}\n\n/**\n * Human-readable elapsed time, for a status line rather than a log.\n *\n * Exported because the status command needs the duration on its own, to colour\n * it separately from the rest of the sentence. Without this it kept a second\n * copy of the same rounding, which is how two renderings of one outage drift.\n */\nexport function humanDuration(ms: number): string {\n  const mins = Math.max(1, Math.round(ms / 60_000));\n  return mins < 60 ? `${mins} min` : `${(mins / 60).toFixed(1)} h`;\n}\n\n/** Human-readable duration, for a status line rather than a log. */\nexport function describeOutage(o: BackendOutage, now = Date.now()): string {\n  return `${o.backend} unreachable for ${humanDuration(now - o.since)}, ${o.attempts} attempts — ${o.lastError}`;\n}\n","/**\n * Storage backend factory.\n *\n * Reads the daemon config and returns the appropriate StorageBackend.\n *\n * When Postgres is the configured backend we NEVER silently fall back to\n * SQLite — doing so would split the corpus across two databases. Instead:\n *  - Daemon (waitForPostgres: true) retries Postgres forever with capped\n *    backoff until it comes up (handles the boot race where launchd starts\n *    the daemon before Docker Desktop / Postgres is ready).\n *  - CLI / one-shot callers (default) retry a few times, then throw a clear\n *    error rather than returning a wrong/empty SQLite database.\n */\n\nimport type { PaiDaemonConfig } from \"../daemon/config.js\";\nimport type { StorageBackend } from \"./interface.js\";\nimport { setBackendOutage, clearBackendOutage } from \"./outage.js\";\n\nexport interface StorageBackendOptions {\n  /**\n   * When true, retry Postgres indefinitely instead of giving up. Used by the\n   * long-lived daemon so a not-yet-ready Postgres at boot is tolerated.\n   * Defaults to false (one-shot CLI behaviour: bounded retries, then throw).\n   */\n  waitForPostgres?: boolean;\n}\n\n/** Backoff schedule (ms) for the bounded CLI retry path. */\nconst CLI_RETRY_DELAYS_MS = [500, 1_000, 2_000];\n\n/** Backoff cap (ms) for the daemon's infinite retry path. */\nconst DAEMON_RETRY_CAP_MS = 15_000;\n\n/**\n * Create and return the configured StorageBackend.\n *\n * Auto-behaviour:\n *  - storageBackend = \"sqlite\"   → SQLiteBackend always\n *  - storageBackend = \"postgres\" → PostgresBackend (retried; never falls back)\n */\nexport async function createStorageBackend(\n  config: PaiDaemonConfig,\n  opts: StorageBackendOptions = {}\n): Promise<StorageBackend> {\n  if (config.storageBackend === \"postgres\") {\n    return await connectPostgres(config, opts.waitForPostgres ?? false);\n  }\n\n  // Default: SQLite\n  return createSQLiteBackend();\n}\n\n/**\n * Attempt a single Postgres connection (ensure DB + test). Returns the live\n * backend on success, or an error string describing why it failed.\n */\nasync function attemptPostgres(\n  config: PaiDaemonConfig\n): Promise<{ backend: StorageBackend } | { error: string }> {\n  const { PostgresBackend } = await import(\"./postgres.js\");\n  const pgConfig = config.postgres ?? {};\n\n  let backend: InstanceType<typeof PostgresBackend> | null = null;\n  try {\n    // Ensure the per-user database exists and has the schema applied.\n    await PostgresBackend.ensureDatabase(pgConfig);\n\n    backend = new PostgresBackend(pgConfig);\n    const err = await backend.testConnection();\n    if (err) {\n      await backend.close().catch(() => {});\n      return { error: err };\n    }\n    return { backend };\n  } catch (e) {\n    if (backend) await backend.close().catch(() => {});\n    return { error: e instanceof Error ? e.message : String(e) };\n  }\n}\n\n/**\n * Consecutive failures before the outage is escalated to the user.\n *\n * Not the first failure: a container restarting, or the daemon starting before\n * Docker is up, recovers within a few seconds and is not worth a notification.\n * By the fifth attempt the backoff has already spent tens of seconds, which is\n * long enough that something is actually wrong.\n */\nconst ESCALATE_AFTER_ATTEMPTS = 5;\n\n/** Tell the user the backend is down, through whatever channels are configured. */\nasync function notifyBackendDown(attempts: number, lastError: string): Promise<void> {\n  try {\n    const { routeNotification } = await import(\"../notifications/router.js\");\n    const { loadConfig } = await import(\"../daemon/config.js\");\n    await routeNotification(\n      {\n        event: \"error\",\n        title: \"PAI: storage backend unreachable\",\n        message:\n          `Postgres has not answered in ${attempts} attempts (${lastError}). ` +\n          `Indexing, session notes and the work queue are stalled until it returns. ` +\n          `Check the container, then \\`pai daemon status\\`.`,\n      },\n      loadConfig().notifications\n    );\n  } catch {\n    // A notification that cannot be sent must never take the daemon down with\n    // it — the daemon retrying is still the useful behaviour here.\n  }\n}\n\n/** And say when it comes back, so the alert is not left hanging. */\nasync function notifyBackendRecovered(\n  attempts: number,\n  since: number | null\n): Promise<void> {\n  try {\n    const { routeNotification } = await import(\"../notifications/router.js\");\n    const { loadConfig } = await import(\"../daemon/config.js\");\n    const mins = since ? Math.max(1, Math.round((Date.now() - since) / 60_000)) : null;\n    await routeNotification(\n      {\n        event: \"completion\",\n        title: \"PAI: storage backend back\",\n        message:\n          `Postgres answered after ${attempts} attempts` +\n          (mins ? `, ${mins} min down` : \"\") +\n          `. The queue will drain on its own.`,\n      },\n      loadConfig().notifications\n    );\n  } catch {\n    /* same reasoning as above */\n  }\n}\n\nasync function connectPostgres(\n  config: PaiDaemonConfig,\n  waitForever: boolean\n): Promise<StorageBackend> {\n  let attempt = 0;\n  let lastError = \"unknown error\";\n  let outageSince: number | null = null;\n  let escalated = false;\n\n  // eslint-disable-next-line no-constant-condition\n  while (true) {\n    attempt++;\n    const result = await attemptPostgres(config);\n    if (\"backend\" in result) {\n      if (attempt > 1) {\n        process.stderr.write(\n          `[pai-daemon] Connected to PostgreSQL backend (after ${attempt} attempts).\\n`\n        );\n      } else {\n        process.stderr.write(\"[pai-daemon] Connected to PostgreSQL backend.\\n\");\n      }\n      // An outage that ended must stop being reported, or the status command\n      // trades one wrong answer for another.\n      clearBackendOutage();\n      if (escalated) void notifyBackendRecovered(attempt, outageSince);\n      return result.backend;\n    }\n\n    lastError = result.error;\n\n    if (!waitForever && attempt > CLI_RETRY_DELAYS_MS.length) {\n      // Bounded CLI path exhausted — fail loudly, never silently use SQLite.\n      throw new Error(\n        `Postgres backend unreachable after ${attempt} attempts: ${lastError}. ` +\n          `Is Docker Desktop / Postgres running? Refusing to fall back to SQLite ` +\n          `(would split the corpus). Start Postgres and retry.`\n      );\n    }\n\n    const delayMs = waitForever\n      ? Math.min(DAEMON_RETRY_CAP_MS, 1_000 * 2 ** Math.min(attempt - 1, 4))\n      : CLI_RETRY_DELAYS_MS[attempt - 1];\n\n    process.stderr.write(\n      `[pai-daemon] Postgres unavailable (${lastError}). ` +\n        `Retry ${attempt}${waitForever ? \"\" : `/${CLI_RETRY_DELAYS_MS.length + 1}`} ` +\n        `in ${delayMs}ms...\\n`\n    );\n\n    // Publish the outage so `pai daemon status` can report it. Without this the\n    // daemon retries silently forever and status still reads \"idle\" — which is\n    // what happened for two days in July: 144 retries over 36 minutes, session\n    // notes never written, and the one command anyone would run to check\n    // reporting that everything was fine.\n    setBackendOutage({\n      backend: \"postgres\",\n      since: outageSince ?? (outageSince = Date.now()),\n      attempts: attempt,\n      lastError: String(lastError),\n    });\n\n    // And escalate once, out loud, rather than only into a log nobody tails.\n    // Once — not per retry — because a notification that repeats every few\n    // seconds is filtered within a minute and stops being a signal at all.\n    if (waitForever && attempt === ESCALATE_AFTER_ATTEMPTS && !escalated) {\n      escalated = true;\n      void notifyBackendDown(attempt, String(lastError));\n    }\n\n    await new Promise((r) => setTimeout(r, delayMs));\n  }\n}\n\nasync function createSQLiteBackend(): Promise<StorageBackend> {\n  const { openFederation } = await import(\"../memory/db.js\");\n  const { SQLiteBackend } = await import(\"./sqlite.js\");\n  const db = openFederation();\n  return new SQLiteBackend(db);\n}\n"],"mappings":";AA2BA,IAAI,UAAgC;;AAGpC,SAAgB,iBAAiB,QAA6B;AAC5D,WAAU;;;;;;;;;AAUZ,SAAgB,qBAA2B;AACzC,WAAU;;;AAIZ,SAAgB,mBAAyC;AACvD,QAAO;;;;;;;;;AAUT,SAAgB,cAAc,IAAoB;CAChD,MAAM,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,IAAO,CAAC;AACjD,QAAO,OAAO,KAAK,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;;;;;;AC/B/D,MAAM,sBAAsB;CAAC;CAAK;CAAO;CAAM;;AAG/C,MAAM,sBAAsB;;;;;;;;AAS5B,eAAsB,qBACpB,QACA,OAA8B,EAAE,EACP;AACzB,KAAI,OAAO,mBAAmB,WAC5B,QAAO,MAAM,gBAAgB,QAAQ,KAAK,mBAAmB,MAAM;AAIrE,QAAO,qBAAqB;;;;;;AAO9B,eAAe,gBACb,QAC0D;CAC1D,MAAM,EAAE,oBAAoB,MAAM,OAAO;CACzC,MAAM,WAAW,OAAO,YAAY,EAAE;CAEtC,IAAI,UAAuD;AAC3D,KAAI;AAEF,QAAM,gBAAgB,eAAe,SAAS;AAE9C,YAAU,IAAI,gBAAgB,SAAS;EACvC,MAAM,MAAM,MAAM,QAAQ,gBAAgB;AAC1C,MAAI,KAAK;AACP,SAAM,QAAQ,OAAO,CAAC,YAAY,GAAG;AACrC,UAAO,EAAE,OAAO,KAAK;;AAEvB,SAAO,EAAE,SAAS;UACX,GAAG;AACV,MAAI,QAAS,OAAM,QAAQ,OAAO,CAAC,YAAY,GAAG;AAClD,SAAO,EAAE,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,EAAE;;;;;;;;;;;AAYhE,MAAM,0BAA0B;;AAGhC,eAAe,kBAAkB,UAAkB,WAAkC;AACnF,KAAI;EACF,MAAM,EAAE,sBAAsB,MAAM,OAAO;EAC3C,MAAM,EAAE,eAAe,MAAM,OAAO;AACpC,QAAM,kBACJ;GACE,OAAO;GACP,OAAO;GACP,SACE,gCAAgC,SAAS,aAAa,UAAU;GAGnE,EACD,YAAY,CAAC,cACd;SACK;;;AAOV,eAAe,uBACb,UACA,OACe;AACf,KAAI;EACF,MAAM,EAAE,sBAAsB,MAAM,OAAO;EAC3C,MAAM,EAAE,eAAe,MAAM,OAAO;EACpC,MAAM,OAAO,QAAQ,KAAK,IAAI,GAAG,KAAK,OAAO,KAAK,KAAK,GAAG,SAAS,IAAO,CAAC,GAAG;AAC9E,QAAM,kBACJ;GACE,OAAO;GACP,OAAO;GACP,SACE,2BAA2B,SAAS,cACnC,OAAO,KAAK,KAAK,aAAa,MAC/B;GACH,EACD,YAAY,CAAC,cACd;SACK;;AAKV,eAAe,gBACb,QACA,aACyB;CACzB,IAAI,UAAU;CACd,IAAI,YAAY;CAChB,IAAI,cAA6B;CACjC,IAAI,YAAY;AAGhB,QAAO,MAAM;AACX;EACA,MAAM,SAAS,MAAM,gBAAgB,OAAO;AAC5C,MAAI,aAAa,QAAQ;AACvB,OAAI,UAAU,EACZ,SAAQ,OAAO,MACb,uDAAuD,QAAQ,eAChE;OAED,SAAQ,OAAO,MAAM,kDAAkD;AAIzE,uBAAoB;AACpB,OAAI,UAAW,CAAK,uBAAuB,SAAS,YAAY;AAChE,UAAO,OAAO;;AAGhB,cAAY,OAAO;AAEnB,MAAI,CAAC,eAAe,UAAU,oBAAoB,OAEhD,OAAM,IAAI,MACR,sCAAsC,QAAQ,aAAa,UAAU,6HAGtE;EAGH,MAAM,UAAU,cACZ,KAAK,IAAI,qBAAqB,MAAQ,KAAK,KAAK,IAAI,UAAU,GAAG,EAAE,CAAC,GACpE,oBAAoB,UAAU;AAElC,UAAQ,OAAO,MACb,sCAAsC,UAAU,WACrC,UAAU,cAAc,KAAK,IAAI,oBAAoB,SAAS,IAAI,MACrE,QAAQ,SACjB;AAOD,mBAAiB;GACf,SAAS;GACT,OAAO,gBAAgB,cAAc,KAAK,KAAK;GAC/C,UAAU;GACV,WAAW,OAAO,UAAU;GAC7B,CAAC;AAKF,MAAI,eAAe,YAAY,2BAA2B,CAAC,WAAW;AACpE,eAAY;AACZ,GAAK,kBAAkB,SAAS,OAAO,UAAU,CAAC;;AAGpD,QAAM,IAAI,SAAS,MAAM,WAAW,GAAG,QAAQ,CAAC;;;AAIpD,eAAe,sBAA+C;CAC5D,MAAM,EAAE,mBAAmB,MAAM,OAAO;CACxC,MAAM,EAAE,kBAAkB,MAAM,OAAO;AAEvC,QAAO,IAAI,cADA,gBAAgB,CACC"}
+{"version":3,"file":"factory-Bt7TWQje.mjs","names":[],"sources":["../src/storage/outage.ts","../src/storage/factory.ts"],"sourcesContent":["/**\n * outage.ts — is the storage backend actually reachable right now?\n *\n * The daemon retries a dead backend forever, which is correct: a Postgres\n * container that is down will usually come back, and giving up would lose the\n * work queue. What was wrong is that it did so in complete silence.\n *\n * Observed 2026-07-26: the container was down for roughly two days. The daemon\n * logged \"Postgres unavailable\" 144 times over 36 minutes, the work queue backed\n * up, session notes for the whole period were never written — and\n * `pai daemon status` reported \"Index: idle\" throughout. The one command anyone\n * would run to check said everything was fine.\n *\n * So the outage is recorded where the status command can see it, and escalated\n * once through the notification channels that were already configured and\n * already unused for this.\n */\n\nexport interface BackendOutage {\n  backend: string;\n  /** When the current run of failures began. */\n  since: number;\n  /** Consecutive failed attempts so far. */\n  attempts: number;\n  lastError: string;\n}\n\nlet current: BackendOutage | null = null;\n\n/** Record that the backend is currently unreachable. */\nexport function setBackendOutage(outage: BackendOutage): void {\n  current = outage;\n}\n\n/**\n * Record that the backend answered.\n *\n * Called on every successful connection, including the first — so a daemon that\n * never had a problem reports none, and one that recovered stops reporting an\n * outage that has ended.\n */\nexport function clearBackendOutage(): void {\n  current = null;\n}\n\n/** The current outage, or null when the backend is answering. */\nexport function getBackendOutage(): BackendOutage | null {\n  return current;\n}\n\n/**\n * Human-readable elapsed time, for a status line rather than a log.\n *\n * Exported because the status command needs the duration on its own, to colour\n * it separately from the rest of the sentence. Without this it kept a second\n * copy of the same rounding, which is how two renderings of one outage drift.\n */\nexport function humanDuration(ms: number): string {\n  const mins = Math.max(1, Math.round(ms / 60_000));\n  return mins < 60 ? `${mins} min` : `${(mins / 60).toFixed(1)} h`;\n}\n\n/** Human-readable duration, for a status line rather than a log. */\nexport function describeOutage(o: BackendOutage, now = Date.now()): string {\n  return `${o.backend} unreachable for ${humanDuration(now - o.since)}, ${o.attempts} attempts — ${o.lastError}`;\n}\n","/**\n * Storage backend factory.\n *\n * Reads the daemon config and returns the appropriate StorageBackend.\n *\n * When Postgres is the configured backend we NEVER silently fall back to\n * SQLite — doing so would split the corpus across two databases. Instead:\n *  - Daemon (waitForPostgres: true) retries Postgres forever with capped\n *    backoff until it comes up (handles the boot race where launchd starts\n *    the daemon before Docker Desktop / Postgres is ready).\n *  - CLI / one-shot callers (default) retry a few times, then throw a clear\n *    error rather than returning a wrong/empty SQLite database.\n */\n\nimport type { PaiDaemonConfig } from \"../daemon/config.js\";\nimport type { StorageBackend } from \"./interface.js\";\nimport { setBackendOutage, clearBackendOutage } from \"./outage.js\";\n\nexport interface StorageBackendOptions {\n  /**\n   * When true, retry Postgres indefinitely instead of giving up. Used by the\n   * long-lived daemon so a not-yet-ready Postgres at boot is tolerated.\n   * Defaults to false (one-shot CLI behaviour: bounded retries, then throw).\n   */\n  waitForPostgres?: boolean;\n}\n\n/** Backoff schedule (ms) for the bounded CLI retry path. */\nconst CLI_RETRY_DELAYS_MS = [500, 1_000, 2_000];\n\n/** Backoff cap (ms) for the daemon's infinite retry path. */\nconst DAEMON_RETRY_CAP_MS = 15_000;\n\n/**\n * Create and return the configured StorageBackend.\n *\n * Auto-behaviour:\n *  - storageBackend = \"sqlite\"   → SQLiteBackend always\n *  - storageBackend = \"postgres\" → PostgresBackend (retried; never falls back)\n */\nexport async function createStorageBackend(\n  config: PaiDaemonConfig,\n  opts: StorageBackendOptions = {}\n): Promise<StorageBackend> {\n  if (config.storageBackend === \"postgres\") {\n    return await connectPostgres(config, opts.waitForPostgres ?? false);\n  }\n\n  // Default: SQLite\n  return createSQLiteBackend();\n}\n\n/**\n * Attempt a single Postgres connection (ensure DB + test). Returns the live\n * backend on success, or an error string describing why it failed.\n */\nasync function attemptPostgres(\n  config: PaiDaemonConfig\n): Promise<{ backend: StorageBackend } | { error: string }> {\n  const { PostgresBackend } = await import(\"./postgres.js\");\n  const pgConfig = config.postgres ?? {};\n\n  let backend: InstanceType<typeof PostgresBackend> | null = null;\n  try {\n    // Ensure the per-user database exists and has the schema applied.\n    await PostgresBackend.ensureDatabase(pgConfig);\n\n    backend = new PostgresBackend(pgConfig);\n    const err = await backend.testConnection();\n    if (err) {\n      await backend.close().catch(() => {});\n      return { error: err };\n    }\n    return { backend };\n  } catch (e) {\n    if (backend) await backend.close().catch(() => {});\n    return { error: e instanceof Error ? e.message : String(e) };\n  }\n}\n\n/**\n * Consecutive failures before the outage is escalated to the user.\n *\n * Not the first failure: a container restarting, or the daemon starting before\n * Docker is up, recovers within a few seconds and is not worth a notification.\n * By the fifth attempt the backoff has already spent tens of seconds, which is\n * long enough that something is actually wrong.\n */\nconst ESCALATE_AFTER_ATTEMPTS = 5;\n\n/** Tell the user the backend is down, through whatever channels are configured. */\nasync function notifyBackendDown(attempts: number, lastError: string): Promise<void> {\n  try {\n    const { routeNotification } = await import(\"../notifications/router.js\");\n    const { loadConfig } = await import(\"../daemon/config.js\");\n    await routeNotification(\n      {\n        event: \"error\",\n        title: \"PAI: storage backend unreachable\",\n        message:\n          `Postgres has not answered in ${attempts} attempts (${lastError}). ` +\n          `Indexing, session notes and the work queue are stalled until it returns. ` +\n          `Check the container, then \\`pai daemon status\\`.`,\n      },\n      loadConfig().notifications\n    );\n  } catch {\n    // A notification that cannot be sent must never take the daemon down with\n    // it — the daemon retrying is still the useful behaviour here.\n  }\n}\n\n/** And say when it comes back, so the alert is not left hanging. */\nasync function notifyBackendRecovered(\n  attempts: number,\n  since: number | null\n): Promise<void> {\n  try {\n    const { routeNotification } = await import(\"../notifications/router.js\");\n    const { loadConfig } = await import(\"../daemon/config.js\");\n    const mins = since ? Math.max(1, Math.round((Date.now() - since) / 60_000)) : null;\n    await routeNotification(\n      {\n        event: \"completion\",\n        title: \"PAI: storage backend back\",\n        message:\n          `Postgres answered after ${attempts} attempts` +\n          (mins ? `, ${mins} min down` : \"\") +\n          `. The queue will drain on its own.`,\n      },\n      loadConfig().notifications\n    );\n  } catch {\n    /* same reasoning as above */\n  }\n}\n\nasync function connectPostgres(\n  config: PaiDaemonConfig,\n  waitForever: boolean\n): Promise<StorageBackend> {\n  let attempt = 0;\n  let lastError = \"unknown error\";\n  let outageSince: number | null = null;\n  let escalated = false;\n\n  // eslint-disable-next-line no-constant-condition\n  while (true) {\n    attempt++;\n    const result = await attemptPostgres(config);\n    if (\"backend\" in result) {\n      if (attempt > 1) {\n        process.stderr.write(\n          `[pai-daemon] Connected to PostgreSQL backend (after ${attempt} attempts).\\n`\n        );\n      } else {\n        process.stderr.write(\"[pai-daemon] Connected to PostgreSQL backend.\\n\");\n      }\n      // An outage that ended must stop being reported, or the status command\n      // trades one wrong answer for another.\n      clearBackendOutage();\n      if (escalated) void notifyBackendRecovered(attempt, outageSince);\n      return result.backend;\n    }\n\n    lastError = result.error;\n\n    if (!waitForever && attempt > CLI_RETRY_DELAYS_MS.length) {\n      // Bounded CLI path exhausted — fail loudly, never silently use SQLite.\n      throw new Error(\n        `Postgres backend unreachable after ${attempt} attempts: ${lastError}. ` +\n          `Is Docker Desktop / Postgres running? Refusing to fall back to SQLite ` +\n          `(would split the corpus). Start Postgres and retry.`\n      );\n    }\n\n    const delayMs = waitForever\n      ? Math.min(DAEMON_RETRY_CAP_MS, 1_000 * 2 ** Math.min(attempt - 1, 4))\n      : CLI_RETRY_DELAYS_MS[attempt - 1];\n\n    process.stderr.write(\n      `[pai-daemon] Postgres unavailable (${lastError}). ` +\n        `Retry ${attempt}${waitForever ? \"\" : `/${CLI_RETRY_DELAYS_MS.length + 1}`} ` +\n        `in ${delayMs}ms...\\n`\n    );\n\n    // Publish the outage so `pai daemon status` can report it. Without this the\n    // daemon retries silently forever and status still reads \"idle\" — which is\n    // what happened for two days in July: 144 retries over 36 minutes, session\n    // notes never written, and the one command anyone would run to check\n    // reporting that everything was fine.\n    setBackendOutage({\n      backend: \"postgres\",\n      since: outageSince ?? (outageSince = Date.now()),\n      attempts: attempt,\n      lastError: String(lastError),\n    });\n\n    // And escalate once, out loud, rather than only into a log nobody tails.\n    // Once — not per retry — because a notification that repeats every few\n    // seconds is filtered within a minute and stops being a signal at all.\n    if (waitForever && attempt === ESCALATE_AFTER_ATTEMPTS && !escalated) {\n      escalated = true;\n      void notifyBackendDown(attempt, String(lastError));\n    }\n\n    await new Promise((r) => setTimeout(r, delayMs));\n  }\n}\n\nasync function createSQLiteBackend(): Promise<StorageBackend> {\n  const { openFederation } = await import(\"../memory/db.js\");\n  const { SQLiteBackend } = await import(\"./sqlite.js\");\n  const db = openFederation();\n  return new SQLiteBackend(db);\n}\n"],"mappings":";AA2BA,IAAI,UAAgC;;AAGpC,SAAgB,iBAAiB,QAA6B;AAC5D,WAAU;;;;;;;;;AAUZ,SAAgB,qBAA2B;AACzC,WAAU;;;AAIZ,SAAgB,mBAAyC;AACvD,QAAO;;;;;;;;;AAUT,SAAgB,cAAc,IAAoB;CAChD,MAAM,OAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,IAAO,CAAC;AACjD,QAAO,OAAO,KAAK,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;;;;;;AC/B/D,MAAM,sBAAsB;CAAC;CAAK;CAAO;CAAM;;AAG/C,MAAM,sBAAsB;;;;;;;;AAS5B,eAAsB,qBACpB,QACA,OAA8B,EAAE,EACP;AACzB,KAAI,OAAO,mBAAmB,WAC5B,QAAO,MAAM,gBAAgB,QAAQ,KAAK,mBAAmB,MAAM;AAIrE,QAAO,qBAAqB;;;;;;AAO9B,eAAe,gBACb,QAC0D;CAC1D,MAAM,EAAE,oBAAoB,MAAM,OAAO;CACzC,MAAM,WAAW,OAAO,YAAY,EAAE;CAEtC,IAAI,UAAuD;AAC3D,KAAI;AAEF,QAAM,gBAAgB,eAAe,SAAS;AAE9C,YAAU,IAAI,gBAAgB,SAAS;EACvC,MAAM,MAAM,MAAM,QAAQ,gBAAgB;AAC1C,MAAI,KAAK;AACP,SAAM,QAAQ,OAAO,CAAC,YAAY,GAAG;AACrC,UAAO,EAAE,OAAO,KAAK;;AAEvB,SAAO,EAAE,SAAS;UACX,GAAG;AACV,MAAI,QAAS,OAAM,QAAQ,OAAO,CAAC,YAAY,GAAG;AAClD,SAAO,EAAE,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE,EAAE;;;;;;;;;;;AAYhE,MAAM,0BAA0B;;AAGhC,eAAe,kBAAkB,UAAkB,WAAkC;AACnF,KAAI;EACF,MAAM,EAAE,sBAAsB,MAAM,OAAO;EAC3C,MAAM,EAAE,eAAe,MAAM,OAAO;AACpC,QAAM,kBACJ;GACE,OAAO;GACP,OAAO;GACP,SACE,gCAAgC,SAAS,aAAa,UAAU;GAGnE,EACD,YAAY,CAAC,cACd;SACK;;;AAOV,eAAe,uBACb,UACA,OACe;AACf,KAAI;EACF,MAAM,EAAE,sBAAsB,MAAM,OAAO;EAC3C,MAAM,EAAE,eAAe,MAAM,OAAO;EACpC,MAAM,OAAO,QAAQ,KAAK,IAAI,GAAG,KAAK,OAAO,KAAK,KAAK,GAAG,SAAS,IAAO,CAAC,GAAG;AAC9E,QAAM,kBACJ;GACE,OAAO;GACP,OAAO;GACP,SACE,2BAA2B,SAAS,cACnC,OAAO,KAAK,KAAK,aAAa,MAC/B;GACH,EACD,YAAY,CAAC,cACd;SACK;;AAKV,eAAe,gBACb,QACA,aACyB;CACzB,IAAI,UAAU;CACd,IAAI,YAAY;CAChB,IAAI,cAA6B;CACjC,IAAI,YAAY;AAGhB,QAAO,MAAM;AACX;EACA,MAAM,SAAS,MAAM,gBAAgB,OAAO;AAC5C,MAAI,aAAa,QAAQ;AACvB,OAAI,UAAU,EACZ,SAAQ,OAAO,MACb,uDAAuD,QAAQ,eAChE;OAED,SAAQ,OAAO,MAAM,kDAAkD;AAIzE,uBAAoB;AACpB,OAAI,UAAW,CAAK,uBAAuB,SAAS,YAAY;AAChE,UAAO,OAAO;;AAGhB,cAAY,OAAO;AAEnB,MAAI,CAAC,eAAe,UAAU,oBAAoB,OAEhD,OAAM,IAAI,MACR,sCAAsC,QAAQ,aAAa,UAAU,6HAGtE;EAGH,MAAM,UAAU,cACZ,KAAK,IAAI,qBAAqB,MAAQ,KAAK,KAAK,IAAI,UAAU,GAAG,EAAE,CAAC,GACpE,oBAAoB,UAAU;AAElC,UAAQ,OAAO,MACb,sCAAsC,UAAU,WACrC,UAAU,cAAc,KAAK,IAAI,oBAAoB,SAAS,IAAI,MACrE,QAAQ,SACjB;AAOD,mBAAiB;GACf,SAAS;GACT,OAAO,gBAAgB,cAAc,KAAK,KAAK;GAC/C,UAAU;GACV,WAAW,OAAO,UAAU;GAC7B,CAAC;AAKF,MAAI,eAAe,YAAY,2BAA2B,CAAC,WAAW;AACpE,eAAY;AACZ,GAAK,kBAAkB,SAAS,OAAO,UAAU,CAAC;;AAGpD,QAAM,IAAI,SAAS,MAAM,WAAW,GAAG,QAAQ,CAAC;;;AAIpD,eAAe,sBAA+C;CAC5D,MAAM,EAAE,mBAAmB,MAAM,OAAO;CACxC,MAAM,EAAE,kBAAkB,MAAM,OAAO;AAEvC,QAAO,IAAI,cADA,gBAAgB,CACC"}

package/dist/{fallback-IeR2FrFn.mjs → fallback-CIGspCSi.mjs}

@@ -1,13 +1,218 @@
-import { n as CONFIG_FILE } from "./config-DCu8THKi.mjs";
-import { N as readJsonStrict, P as writeJsonAtomic, b as resolveProviderKey, f as isModelCapability, g as providerCostTier, h as nativeAnthropicProvider, i as PROVIDER_TAGS, k as workersYamlPath, m as maskKey, n as DEFAULT_LOG_DIR, o as WorkersConfigError, p as keysDir, r as MODEL_CAPABILITIES, t as ANTHROPIC_NATIVE, u as expandHome, v as readWorkersSection, x as writeWorkersSection, y as resolveModelCapability } from "./config-DxMZjpvY.mjs";
-import { A as isLive, D as contextLabel, E as alive, M as loadStatuses, O as contextPercent, T as ageOf, V as shortText, _ as currentTabKey, b as sessionTag, d as readInbox, f as sayToWorker, k as isChatPane, o as parseWorkerReport, p as workerDepth, s as renderReport, w as UNLABELED, x as workerInScope, y as resolveSession } from "./run-Cls0YGgV.mjs";
-import { _ as workersLogDir, a as clearCooldown, c as probeQuota, l as quotaSkipThreshold, p as eventsPath, u as resolveTarget } from "./server-Ch99xt5K.mjs";
+import { _ as writeYamlFileAtomic, d as readMainConfigRaw, f as writeMainConfigRaw, l as paiConfigFilePath, m as migrateMainConfigToYaml, n as CONFIG_FILE, r as DEFAULTS, s as loadConfig, u as paiConfigYamlFilePath, v as readJsonStrict, y as writeJsonAtomic } from "./config-Bn9jpblO.mjs";
+import { C as readWorkersSection, D as writeWorkersSection, E as resolveProviderKey, F as workersYamlPath, T as resolveModelCapability, _ as isModelCapability, a as DEFAULT_PANE, b as nativeAnthropicProvider, c as MODEL_CAPABILITIES, d as WorkersConfigError, h as expandHome, i as DEFAULT_LOG_DIR, l as PROVIDER_TAGS, o as DEFAULT_ROUTING, r as DEFAULT_CACHE_KEEPALIVE_SECS, s as DEFAULT_TREE, t as ANTHROPIC_NATIVE, v as keysDir, w as resolveCapability, x as providerCostTier, y as maskKey } from "./config-DYXARgk8.mjs";
+import { A as contextLabel, D as UNLABELED, F as loadStatuses, M as isChatPane, N as isLive, O as ageOf, W as shortText, b as sessionTag, d as workerDepth, h as currentTabKey, j as contextPercent, k as alive, l as readInbox, o as parseWorkerReport, s as renderReport, u as sayToWorker, v as resolveSession, x as workerInScope } from "./run-TChOnMO_.mjs";
+import { f as resolveTarget, h as eventsPath, l as probeQuota, o as clearCooldown, u as quotaSkipThreshold, y as workersLogDir } from "./server-R9UkCn3v.mjs";
 import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, join, relative, resolve } from "node:path";
 import { execFileSync, spawn } from "node:child_process";
+import { Document } from "yaml";
 import { createInterface } from "node:readline";
 
+//#region src/config/main-config-ops.ts
+/**
+* main-config-ops.ts — the `pai config list/get/set/unset` operations shared
+* by the CLI (src/cli/commands/config.ts) and the MCP tools
+* (src/daemon-mcp/tools/config.ts). One implementation, two thin callers, so
+* a change to masking or validation cannot drift between them.
+*/
+var MainConfigOpsError = class extends Error {};
+function splitConfigPath(dotted) {
+	const segments = dotted.split(".").filter((s) => s.length > 0);
+	if (!segments.length) throw new MainConfigOpsError("path is required");
+	return segments;
+}
+function getAtPath(root, segments) {
+	let cur = root;
+	for (const seg of segments) if (cur !== null && typeof cur === "object" && !Array.isArray(cur) && seg in cur) cur = cur[seg];
+	else return {
+		value: void 0,
+		found: false
+	};
+	return {
+		value: cur,
+		found: true
+	};
+}
+function setAtPath(root, segments, value) {
+	const clone = structuredClone(root);
+	let cur = clone;
+	for (let i = 0; i < segments.length - 1; i++) {
+		const seg = segments[i];
+		const next = cur[seg];
+		if (next === null || typeof next !== "object" || Array.isArray(next)) cur[seg] = {};
+		cur = cur[seg];
+	}
+	cur[segments[segments.length - 1]] = value;
+	return clone;
+}
+function deleteAtPath(root, segments) {
+	const clone = structuredClone(root);
+	let cur = clone;
+	for (let i = 0; i < segments.length - 1; i++) {
+		const seg = segments[i];
+		const next = cur[seg];
+		if (next === null || typeof next !== "object" || Array.isArray(next)) return clone;
+		cur = next;
+	}
+	delete cur[segments[segments.length - 1]];
+	return clone;
+}
+/** true/false, null, numbers, `[...]`/`{...}` as JSON, else the raw string. */
+function parseConfigValueString(raw) {
+	if (raw === "true") return true;
+	if (raw === "false") return false;
+	if (raw === "null") return null;
+	if (/^-?\d+(\.\d+)?$/.test(raw)) return Number(raw);
+	const trimmed = raw.trim();
+	if (trimmed.startsWith("[") || trimmed.startsWith("{")) try {
+		return JSON.parse(trimmed);
+	} catch (e) {
+		throw new MainConfigOpsError(`invalid JSON value: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	return raw;
+}
+const SECRET_SEGMENT_RE = /key|token|secret|password/i;
+/** Paths not caught by SECRET_SEGMENT_RE but whose value routinely embeds a
+*  credential (a Postgres URL's userinfo component). */
+const SPECIAL_SECRET_PATHS = new Set(["postgres.connectionString"]);
+function isSecretPath(segments) {
+	if (SPECIAL_SECRET_PATHS.has(segments.filter((s) => typeof s === "string").join("."))) return true;
+	return segments.some((s) => typeof s === "string" && SECRET_SEGMENT_RE.test(s));
+}
+/** Deep-clone `value`, replacing every string leaf on a secret path with
+*  `maskKey`'s `****<last4>` form. Used by every reader (list/get, MCP). */
+function maskSecretsDeep(value, path = []) {
+	if (Array.isArray(value)) return value.map((v, i) => maskSecretsDeep(v, [...path, i]));
+	if (value !== null && typeof value === "object") {
+		const out = {};
+		for (const [k, v] of Object.entries(value)) out[k] = maskSecretsDeep(v, [...path, k]);
+		return out;
+	}
+	if (typeof value === "string" && value && isSecretPath(path)) return maskKey(value);
+	return value;
+}
+/** The non-provider `workers` sub-object every writer persists to the main
+*  config (providers/classes/mcp_sets/active live in workers.yaml instead —
+*  see readWorkersSection). Shared by schemaRoot and effectiveConfigRoot. */
+function workersMainConfigShape() {
+	const { workers } = readWorkersSection();
+	return {
+		enabled: workers.enabled,
+		pane: workers.pane,
+		logDir: workers.logDir,
+		routing: workers.routing,
+		tree: workers.tree,
+		cacheKeepaliveSecs: workers.cacheKeepaliveSecs,
+		...workers.fallback ? { fallback: workers.fallback } : {}
+	};
+}
+function schemaRoot() {
+	return {
+		...DEFAULTS,
+		workers: {
+			enabled: false,
+			pane: DEFAULT_PANE,
+			logDir: DEFAULT_LOG_DIR,
+			routing: DEFAULT_ROUTING,
+			tree: DEFAULT_TREE,
+			cacheKeepaliveSecs: DEFAULT_CACHE_KEEPALIVE_SECS
+		}
+	};
+}
+/** loadConfig() (typed, defaults-merged) plus the workers subset — the
+*  "effective" view `pai config list --all` / `get` resolve against. */
+function effectiveConfigRoot() {
+	return {
+		...loadConfig(),
+		workers: workersMainConfigShape()
+	};
+}
+/**
+* Refuse an unset top-level key (typo protection) unless --force, and — when
+* DEFAULTS names a scalar at this exact path — refuse a value of a different
+* JS type unless --force. Nested unknown keys (e.g. under `tasks.providers`)
+* are always allowed: DEFAULTS does not enumerate every provider shape.
+*/
+function validateAgainstSchema(segments, value, opts) {
+	const schema = schemaRoot();
+	const topKey = segments[0];
+	if (!(topKey in schema) && !opts.force) throw new MainConfigOpsError(`unknown top-level config key "${topKey}" (known: ${Object.keys(schema).sort().join(", ")}) — pass --force to set it anyway`);
+	const { value: expected, found } = getAtPath(schema, segments);
+	if (found && expected !== null && expected !== void 0) {
+		const expectedType = Array.isArray(expected) ? "array" : typeof expected;
+		const actualType = Array.isArray(value) ? "array" : typeof value;
+		if (expectedType !== actualType && !opts.force) throw new MainConfigOpsError(`${segments.join(".")}: expected ${expectedType}, got ${actualType} (pass --force to override)`);
+	}
+}
+/** `pai config list` / `config_list`. `all=true` shows the defaults-merged
+*  effective config; otherwise only what the file explicitly sets. Secrets
+*  are always masked. */
+function listConfigOp(opts = {}) {
+	const masked = maskSecretsDeep(opts.all ? effectiveConfigRoot() : readMainConfigRaw());
+	return {
+		scope: opts.all ? "effective" : "file",
+		yaml: String(new Document(masked)),
+		data: masked
+	};
+}
+/** `pai config get <path>` / `config_get`: resolves against the
+*  defaults-merged effective config (a value not set in the file still
+*  answers with its default), masked if the path looks like a secret. */
+function getConfigValueOp(dottedPath) {
+	const segments = splitConfigPath(dottedPath);
+	const { value, found } = getAtPath(effectiveConfigRoot(), segments);
+	return {
+		found,
+		value: found ? maskSecretsDeep(value, segments) : void 0
+	};
+}
+/** `pai config get`'s CLI text: a scalar prints as-is, an object/array
+*  subtree prints as YAML (matching `config list`) unless `json` is passed —
+*  the MCP `config_get` tool returns the structured value directly and never
+*  goes through this. */
+function formatConfigGetOutput(value, opts = {}) {
+	if (opts.json) return JSON.stringify(value, null, 2);
+	if (value !== null && typeof value === "object") return String(new Document(value)).trimEnd();
+	return String(value);
+}
+/**
+* `pai config set <path> <value>` / `config_set`: parses `value`, validates
+* its type against DEFAULTS (refusable with `force`), converts config.json
+* to config.yaml first if neither exists yet, then writes through
+* writeMainConfigRaw (comment-preserving when config.yaml exists).
+*/
+function setConfigValueOp(dottedPath, rawValue, opts = {}) {
+	const segments = splitConfigPath(dottedPath);
+	const value = parseConfigValueString(rawValue);
+	validateAgainstSchema(segments, value, opts);
+	const jsonPath = paiConfigFilePath();
+	const yamlPath = paiConfigYamlFilePath();
+	let yamlCreated = false;
+	if (!existsSync(yamlPath)) {
+		if (existsSync(jsonPath)) migrateMainConfigToYaml(jsonPath, {});
+		else writeYamlFileAtomic(yamlPath, "{}\n", { label: yamlPath });
+		yamlCreated = true;
+	}
+	writeMainConfigRaw(setAtPath(readMainConfigRaw(), segments, value));
+	return {
+		yamlCreated,
+		yamlPath,
+		value
+	};
+}
+/** `pai config unset <path>` / `config_unset`: no-ops (existed=false) when
+*  the path was never set explicitly — defaults are never "unset". */
+function unsetConfigValueOp(dottedPath) {
+	const segments = splitConfigPath(dottedPath);
+	const raw = readMainConfigRaw();
+	const { found } = getAtPath(raw, segments);
+	if (!found) return { existed: false };
+	writeMainConfigRaw(deleteAtPath(raw, segments));
+	return { existed: true };
+}
+
+//#endregion
 //#region src/workers/specfile.ts
 /**
 * specfile.ts — `--spec <path>` reads a worker's prompt from a file (or stdin
@@ -1429,7 +1634,7 @@ function resolveProviderName(workers, name) {
 * (`pai worker model`, MCP worker_model).
 */
 function setProviderModel(name, capability, model, configPath) {
-	if (!isModelCapability(capability)) throw new WorkersConfigError(`"${capability}" is not a model capability (from: ${MODEL_CAPABILITIES.join(", ")})`);
+	if (!isModelCapability(capability)) throw new WorkersConfigError(`"${capability}" is not a valid capability name (must match ^[a-z][a-z0-9-]*$; well-known: ${MODEL_CAPABILITIES.join(", ")})`);
 	const id = model.trim();
 	if (!id) throw new WorkersConfigError(`a ${capability} model id must not be empty`);
 	const { raw, workers } = readWorkersSection(configPath);
@@ -1496,11 +1701,14 @@ function classTargetText(target) {
 	].join(" ");
 }
 /**
-* `default X  fast Y  image Z` — every model capability on one line, unset
-* ones shown as "(none)" (they resolve to the default model).
+* `default X  fast Y  image Z  …` — every well-known capability on one line
+* (unset ones shown as "(none)"), plus any open-set capability this provider
+* actually declares (e.g. `vision`), which is only listed when set.
 */
 function modelPrefsText(p) {
-	return MODEL_CAPABILITIES.map((c) => `${c} ${p.models[c] ?? "(none)"}`).join("  ");
+	const known = new Set(MODEL_CAPABILITIES);
+	const extra = Object.keys(p.models).filter((c) => !known.has(c)).sort();
+	return [...MODEL_CAPABILITIES, ...extra].map((c) => `${c} ${p.models[c] ?? "(none)"}`).join("  ");
 }
 /**
 * Compact model listing for `pai worker model` / worker_model get: the active
@@ -1551,6 +1759,7 @@ function describeProviders(workers, configPath = CONFIG_FILE) {
 		if (p.note) lines.push(`    ${p.note}`);
 		if (p.protocol === "openai") lines.push(`    via PAI proxy ← ${p.upstreamUrl ?? "(upstreamUrl missing)"}`);
 		if (p.engine === "codex") lines.push(`    engine codex (runs through the Codex CLI)`);
+		if (p.engine === "image") lines.push(`    engine image (no process spawn — POSTs {url}/images/generations directly)`);
 		const cls = classesForProvider(workers, name);
 		lines.push(`    classes: ${cls.length ? cls.join(", ") : "(none)"}`);
 	}
@@ -1560,6 +1769,47 @@ function describeProviders(workers, configPath = CONFIG_FILE) {
 	lines.push(`config: ${existsSync(workersYamlPath()) ? workersYamlPath() : configPath}`);
 	return lines;
 }
+/**
+* Set which provider(s), in order, serve a capability across the whole
+* config (`pai worker capability <name> <provider>[,<provider>…]`, MCP
+* worker_capability). resolveCapability walks this list at run time.
+*/
+function setCapabilityPreference(capability, providers, configPath) {
+	if (!isModelCapability(capability)) throw new WorkersConfigError(`"${capability}" is not a valid capability name (must match ^[a-z][a-z0-9-]*$)`);
+	if (!providers.length) throw new WorkersConfigError("at least one provider name is required");
+	const { raw, workers } = readWorkersSection(configPath);
+	for (const name of providers) if (name !== ANTHROPIC_NATIVE && !workers.providers[name]) throw new WorkersConfigError(`no provider named "${name}". Configured: ${Object.keys(workers.providers).join(", ") || "(none)"}`);
+	workers.capabilities[capability] = providers;
+	writeWorkersSection(raw, workers, configPath);
+	return workers;
+}
+function unsetCapabilityPreference(capability, configPath) {
+	const { raw, workers } = readWorkersSection(configPath);
+	if (!(capability in workers.capabilities)) throw new WorkersConfigError(`no capability preference set for "${capability}"`);
+	delete workers.capabilities[capability];
+	writeWorkersSection(raw, workers, configPath);
+	return workers;
+}
+/**
+* `pai worker capability` with no args: every configured `capabilities:`
+* preference and what it resolves to right now — provider/model/engine, or
+* `fallback: <provider>/<model>` when nothing on the list actually declares
+* the capability (see resolveCapability's fellBack flag).
+*/
+function describeCapabilities(workers) {
+	const names = Object.keys(workers.capabilities);
+	if (!names.length) return ["no capability preferences set — set one with `pai worker capability <name> <provider>[,<provider>…]`"];
+	return names.map((cap) => {
+		const pref = workers.capabilities[cap];
+		try {
+			const r = resolveCapability(workers, cap);
+			const resolved = r.fellBack ? `fallback: ${r.provider}/${r.model}` : `${r.provider}/${r.model}  engine ${r.engine}`;
+			return `${cap}: [${pref.join(", ")}] -> ${resolved}`;
+		} catch (e) {
+			return `${cap}: [${pref.join(", ")}] -> unresolved: ${e instanceof Error ? e.message : String(e)}`;
+		}
+	});
+}
 
 //#endregion
 //#region src/workers/fallback.ts
@@ -1826,5 +2076,5 @@ function fallbackStatusText(s) {
 }
 
 //#endregion
-export { readSpecPrompt as C, statusLineOutput as S, updateProvider as _, addProvider as a, psOutput as b, describeProviders as c, resolveProviderName as d, setClass as f, unsetClass as g, setWorkersEnabled as h, fallbackStatusText as i, modelPrefsText as l, setProviderModel as m, fallbackOn as n, classTargetText as o, setProviderEnabled as p, fallbackStatus as r, describeModels as s, fallbackOff as t, removeProvider as u, useProvider as v, resolveSpecPath as w, replayOutput as x, followWorkers as y };
-//# sourceMappingURL=fallback-IeR2FrFn.mjs.map
+export { getConfigValueOp as A, psOutput as C, resolveSpecPath as D, readSpecPrompt as E, setConfigValueOp as M, unsetConfigValueOp as N, MainConfigOpsError as O, followWorkers as S, statusLineOutput as T, setWorkersEnabled as _, addProvider as a, updateProvider as b, describeModels as c, removeProvider as d, resolveProviderName as f, setProviderModel as g, setProviderEnabled as h, fallbackStatusText as i, listConfigOp as j, formatConfigGetOutput as k, describeProviders as l, setClass as m, fallbackOn as n, classTargetText as o, setCapabilityPreference as p, fallbackStatus as r, describeCapabilities as s, fallbackOff as t, modelPrefsText as u, unsetCapabilityPreference as v, replayOutput as w, useProvider as x, unsetClass as y };
+//# sourceMappingURL=fallback-CIGspCSi.mjs.map