@tekmidian/pai 0.49.0 → 0.50.0

package/dist/{program-D9-wfmkZ.mjs → program-BX67-4I2.mjs}

@@ -8,21 +8,22 @@ import { i as indexProject, n as indexAll, t as embedChunks } from "./sync-Btcb6
 import { t as STOP_WORDS } from "./stop-words-BaMEGVeY.mjs";
 import { a as searchMemory, i as populateSlugs } from "./search-B69cQwDB.mjs";
 import { n as formatDetection, r as formatDetectionJson, t as detectProject } from "./detect-Bf2z-oKB.mjs";
-import { B as claudeProjectsDir, C as findLatestNote, H as scanTranscriptFolders, I as resolveHome, L as saveScanConfig, M as cmdScan, N as loadScanConfig, P as migrateScanConfig, R as upsertProject, S as applyContinue, T as readBodyFile, U as transcriptFiles, V as findMovedProjects, d as migrateWorkQueue, g as migrateSummaryCooldowns, t as readContextHandoverCache, v as extractAndStoreTriples, w as findNotesDir$1, x as appendCheckpointToNote, z as upsertSession } from "./context-handover-cache-B9NKSjwR.mjs";
-import { a as expandHome, c as paiConfigFilePath, i as ensureConfigDir, l as OWNER_LABEL_PREFIX, n as CONFIG_FILE$2, o as loadConfig, s as migrateConfigFile, t as CONFIG_DIR, u as UNROUTED } from "./config-DCu8THKi.mjs";
+import { B as claudeProjectsDir, C as findLatestNote, H as scanTranscriptFolders, I as resolveHome, L as saveScanConfig, M as cmdScan, N as loadScanConfig, P as migrateScanConfig, R as upsertProject, S as applyContinue, T as readBodyFile, U as transcriptFiles, V as findMovedProjects, d as migrateWorkQueue, g as migrateSummaryCooldowns, t as readContextHandoverCache, v as extractAndStoreTriples, w as findNotesDir$1, x as appendCheckpointToNote, z as upsertSession } from "./context-handover-cache-yOuK9RIk.mjs";
+import { b as OWNER_LABEL_PREFIX, c as migrateConfigFile, d as readMainConfigRaw, f as writeMainConfigRaw, h as resolvedMainConfigPath, l as paiConfigFilePath, m as migrateMainConfigToYaml, n as CONFIG_FILE$2, o as expandHome, p as MainConfigError, s as loadConfig, t as CONFIG_DIR, u as paiConfigYamlFilePath, v as readJsonStrict, x as UNROUTED, y as writeJsonAtomic } from "./config-Bn9jpblO.mjs";
 import { a as schedulerLogPath, i as paiSocketPath, n as daemonLogPath, r as daemonPidPath } from "./runtime-paths-B0P1TvUr.mjs";
-import { A as DEFAULT_CONTEXT_WINDOW, C as inlineWorkersYamlKeys, D as relocateWorkersYaml, E as parseWorkersYamlDocument, M as stripModelVariant, N as readJsonStrict, O as workersYamlLegacyNotice, P as writeJsonAtomic, S as initWorkersYaml, T as needsWorkersYamlRelocation, d as getProviderOrNative, f as isModelCapability, h as nativeAnthropicProvider, i as PROVIDER_TAGS, j as contextWindowFromModelId, k as workersYamlPath, m as maskKey, o as WorkersConfigError, r as MODEL_CAPABILITIES, t as ANTHROPIC_NATIVE, u as expandHome$1, v as readWorkersSection, w as migrateWorkersToYaml } from "./config-DxMZjpvY.mjs";
-import { A as isLive, B as parseRunnerArgs, F as ownsPid, H as describeMcp, I as saveStatus, L as setWorkerLabel, M as loadStatuses, R as waitForTerminalStatus, S as appendLedger, U as expandMcpNames, a as projectLaunchConfig, c as discardWorker, f as sayToWorker, g as openPaneForWorker, h as openFollowPane, i as usageContextTokens, j as loadStatus, k as isChatPane, l as mergeWorker, m as checkPaneForWorker, n as runWorker, o as parseWorkerReport, r as testProvider, u as handoffFromInside, w as UNLABELED, z as longInlinePromptHint } from "./run-Cls0YGgV.mjs";
+import { A as migrateWorkersToYaml, C as readWorkersSection, F as workersYamlPath, I as DEFAULT_CONTEXT_WINDOW, L as contextWindowFromModelId, M as parseWorkersYamlDocument, N as relocateWorkersYaml, O as initWorkersYaml, P as workersYamlLegacyNotice, R as stripModelVariant, _ as isModelCapability, b as nativeAnthropicProvider, c as MODEL_CAPABILITIES, d as WorkersConfigError, g as getProviderOrNative, h as expandHome$1, j as needsWorkersYamlRelocation, k as inlineWorkersYamlKeys, l as PROVIDER_TAGS, t as ANTHROPIC_NATIVE, y as maskKey } from "./config-DYXARgk8.mjs";
+import { B as setWorkerLabel, C as mergeWorker, D as UNLABELED, F as loadStatuses, G as describeMcp, H as longInlinePromptHint, K as expandMcpNames, M as isChatPane, N as isLive, P as loadStatus, R as ownsPid, S as discardWorker, T as appendLedger, U as parseRunnerArgs, V as waitForTerminalStatus, a as projectLaunchConfig, c as handoffFromInside, f as checkPaneForWorker, i as usageContextTokens, m as openPaneForWorker, n as runWorker, o as parseWorkerReport, p as openFollowPane, r as testProvider, u as sayToWorker, z as saveStatus } from "./run-TChOnMO_.mjs";
+import { a as totalUsageTokens, i as parseSessionUsage, r as sessionKeepaliveLedgerSummary, t as loadSessionKeepaliveState } from "./session-keepalive-BuG3wvik.mjs";
 import { t as PaiClient } from "./ipc-client-C6NryMMb.mjs";
-import { r as humanDuration, t as createStorageBackend } from "./factory-DNYAqjH0.mjs";
-import { n as migrateIdentityFile } from "./wakeup-UrhiW-KU.mjs";
-import { a as renderDedupedSessions, c as probeResume, d as fmtAge, f as migrateSessionScanCache, h as scanSessions, i as normalizeName$2, l as restoreTopLevel, m as scanCacheFilePath, o as hasConversation, p as resolveSessionByNameOrId, r as buildDeduped, s as launchInDir, t as cmdMain, u as printExitDir } from "./main-resolver-DvYu9jbl.mjs";
-import { n as queriesDirPath, t as migrateQueriesDir } from "./query-feedback-CYyOGi3y.mjs";
-import { s as kgQuery } from "./kg-entity-BSjM5xZh.mjs";
-import { _ as workersLogDir, f as ensureNoMcpConfig, i as buildRunEnv, m as ledgerPath, n as ensureProxyRunning, p as eventsPath, r as stopProxy, t as DEFAULT_PROXY_PORT } from "./server-Ch99xt5K.mjs";
-import { i as sendToSession, n as fetchLiveSessions, r as revealItermSession, t as callAiBroker } from "./aibroker-client-Bn9SnGMa.mjs";
-import { t as runChain } from "./chain-CNSa0A3G.mjs";
-import { C as readSpecPrompt, S as statusLineOutput, _ as updateProvider, a as addProvider, b as psOutput, c as describeProviders, d as resolveProviderName, f as setClass, g as unsetClass, h as setWorkersEnabled, i as fallbackStatusText, l as modelPrefsText, m as setProviderModel, n as fallbackOn, o as classTargetText, p as setProviderEnabled, r as fallbackStatus, s as describeModels, t as fallbackOff, u as removeProvider, v as useProvider, w as resolveSpecPath, x as replayOutput, y as followWorkers } from "./fallback-IeR2FrFn.mjs";
+import { r as humanDuration, t as createStorageBackend } from "./factory-Bt7TWQje.mjs";
+import { A as getConfigValueOp, C as psOutput, D as resolveSpecPath, E as readSpecPrompt, M as setConfigValueOp, N as unsetConfigValueOp, O as MainConfigOpsError, S as followWorkers, T as statusLineOutput, _ as setWorkersEnabled, a as addProvider, b as updateProvider, c as describeModels, d as removeProvider, f as resolveProviderName, g as setProviderModel, h as setProviderEnabled, i as fallbackStatusText, j as listConfigOp, k as formatConfigGetOutput, l as describeProviders, m as setClass, n as fallbackOn, o as classTargetText, p as setCapabilityPreference, r as fallbackStatus, s as describeCapabilities, t as fallbackOff, u as modelPrefsText, v as unsetCapabilityPreference, w as replayOutput, x as useProvider, y as unsetClass } from "./fallback-CIGspCSi.mjs";
+import { n as migrateIdentityFile } from "./wakeup-Yk5lQ0jb.mjs";
+import { a as renderDedupedSessions, c as probeResume, d as fmtAge, f as migrateSessionScanCache, h as scanSessions, i as normalizeName$2, l as restoreTopLevel, m as scanCacheFilePath, o as hasConversation, p as resolveSessionByNameOrId, r as buildDeduped, s as launchInDir, t as cmdMain, u as printExitDir } from "./main-resolver-BmZPCmgj.mjs";
+import { n as queriesDirPath, t as migrateQueriesDir } from "./query-feedback-CTs_jx6i.mjs";
+import { s as kgQuery } from "./kg-entity-BSW7ra8i.mjs";
+import { g as ledgerPath, h as eventsPath, i as buildRunEnv, m as ensureNoMcpConfig, n as ensureProxyRunning, r as stopProxy, t as DEFAULT_PROXY_PORT, y as workersLogDir } from "./server-R9UkCn3v.mjs";
+import { i as sendToSession, n as fetchLiveSessions, r as revealItermSession, t as callAiBroker } from "./aibroker-client-CDIXmq-e.mjs";
+import { t as runChain } from "./chain-BBbVbWVv.mjs";
 import { appendFileSync, chmodSync, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, platform, tmpdir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
@@ -1974,7 +1975,7 @@ function cmdUnregister(db, slug, opts = {}) {
 //#region src/cli/commands/project/projects-index.ts
 function registerProjectsCommands(projectsCmd, getDb) {
 	projectsCmd.command("list", { isDefault: true }).description("Show the unified deduped listing (same as `pai`).\nUse --all to include cold / zero-session / archived projects.").option("--all", "Show all entries including cold / zero-session / archived projects").option("-n, --n <count>", "Max rows to show", "20").action(async (opts) => {
-		const { cmdMain } = await import("./main-resolver-CnfnWa8C.mjs");
+		const { cmdMain } = await import("./main-resolver-BTastpp4.mjs");
 		await cmdMain(getDb(), void 0, void 0, opts);
 	});
 	projectsCmd.command("list-raw").description("Raw registry listing with slug, path, status, last_active columns").option("--all", "Include archived projects (default: active only)").option("--status <status>", "Filter by status: active | archived").option("--tag <tag>", "Filter by tag").option("--type <type>", "Filter by type").action((opts) => {
@@ -2976,7 +2977,7 @@ function registerStatsCommands(memoryCmd, getDb) {
 			console.log(`  ${bold$1("defaultLimit:")}     ${search.defaultLimit}`);
 			console.log(`  ${bold$1("snippetLength:")}    ${search.snippetLength}`);
 			console.log();
-			console.log(dim$1(`  Config file: ${CONFIG_FILE$2}`));
+			console.log(dim$1(`  Config file: ${paiConfigFilePath()}`));
 			console.log(dim$1(`  Edit directly or use: pai memory settings <key> <value>`));
 			console.log();
 			return;
@@ -3005,11 +3006,11 @@ function registerStatsCommands(memoryCmd, getDb) {
 			process.exitCode = 1;
 			return;
 		}
-		let fileConfig = {};
-		if (existsSync(CONFIG_FILE$2)) try {
-			fileConfig = JSON.parse(readFileSync(CONFIG_FILE$2, "utf-8"));
-		} catch {
-			console.error(err(`Could not parse ${CONFIG_FILE$2}`));
+		let fileConfig;
+		try {
+			fileConfig = readMainConfigRaw();
+		} catch (e) {
+			console.error(err(`Could not read config: ${e instanceof Error ? e.message : String(e)}`));
 			process.exitCode = 1;
 			return;
 		}
@@ -3037,8 +3038,7 @@ function registerStatsCommands(memoryCmd, getDb) {
 		}
 		fileConfig.search[key] = parsed;
 		try {
-			ensureConfigDir();
-			writeFileSync(CONFIG_FILE$2, JSON.stringify(fileConfig, null, 2) + "\n", "utf-8");
+			writeMainConfigRaw(fileConfig);
 			console.log(ok$1(`Set search.${key} = ${parsed}`));
 			console.log(dim$1(`  Restart daemon to apply: pai daemon restart`));
 		} catch (e) {
@@ -3052,8 +3052,8 @@ function registerStatsCommands(memoryCmd, getDb) {
 //#region src/cli/commands/memory/sources-cmd.ts
 function registerSourcesCommand(memoryCmd) {
 	memoryCmd.command("sources").description("Show what the indexer has taken in: composition by source, which roots\ncontent enters from, the heaviest single files, and how many chunks are\nrewritten per day (which distinguishes a finite backlog from a treadmill).").option("--limit <n>", "Rows per section (default 8)", "8").action(async (opts) => {
-		const { createStorageBackend } = await import("./factory-47Qf_df7.mjs");
-		const { loadConfig } = await import("./config-DeqFqa1N.mjs");
+		const { createStorageBackend } = await import("./factory-Ba8j9K7q.mjs");
+		const { loadConfig } = await import("./config-RjeVGJ7K.mjs");
 		const { cmdMemorySources } = await import("./sources-KBGEA_E6.mjs");
 		let backend;
 		try {
@@ -3153,23 +3153,17 @@ function checkDeliveryReachability(deliverTo, sendingAccount, sendingAccountAlia
 //#endregion
 //#region src/cli/commands/identity.ts
 function readConfig() {
-	if (!existsSync(CONFIG_FILE$2)) return {};
 	try {
-		return JSON.parse(readFileSync(CONFIG_FILE$2, "utf-8"));
+		return readMainConfigRaw();
 	} catch (e) {
-		console.error(err("pai identity: ") + `Could not parse ${CONFIG_FILE$2}: ${String(e)}`);
+		console.error(err("pai identity: ") + `Could not read ${paiConfigFilePath()}: ${String(e)}`);
 		process.exit(1);
 	}
 }
-/**
-* Write via a temp file and rename, so an interrupted write cannot leave the
-* config truncated. The daemon reads this file; a half-written one takes the
-* whole system down rather than just this command.
-*/
+/** Writes through writeMainConfigRaw — comment-preserving into config.yaml
+*  when it exists, else atomic into config.json. */
 function writeConfig(config) {
-	const tmp = `${CONFIG_FILE$2}.identity.tmp`;
-	writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n", "utf-8");
-	renameSync(tmp, CONFIG_FILE$2);
+	writeMainConfigRaw(config);
 }
 function identityOf(config) {
 	return config.identity ?? { selfEmails: [] };
@@ -3263,6 +3257,33 @@ function registerIdentityCommands(identityCmd) {
 	});
 }
 
+//#endregion
+//#region src/config/voices-config.ts
+/**
+* voices-config.ts — voices.json / voices.yaml, the same load-either /
+* migrate pattern as the main config (see main-config.ts) and workers.yaml.
+*
+* Nothing in src/ currently reads voices.json (see the note on
+* migrateVoicesJson in pai-files.ts) — this exists so the one place that
+* would ever load it has the YAML-preferring behaviour already in place,
+* and so `pai config yaml` has one JSON→YAML step to run for it, same as
+* every other PAI config file.
+*/
+function voicesJsonPath() {
+	return paiHomePath("voices.json");
+}
+function voicesYamlPath() {
+	return paiHomePath("voices.yaml");
+}
+/** `pai config yaml`'s voices.json → voices.yaml step. */
+function migrateVoicesToYaml(opts = {}) {
+	return migrateMainConfigToYaml(voicesJsonPath(), {
+		...opts,
+		yamlPath: voicesYamlPath(),
+		sectionComments: {}
+	});
+}
+
 //#endregion
 //#region src/tasks/dispatch.ts
 /**
@@ -3732,7 +3753,7 @@ async function escalate(task, headline, detail, state, now, opts) {
 	let delivered = false;
 	try {
 		const { routeNotification } = await import("./router-CremHKTI.mjs");
-		const { loadConfig } = await import("./config-DeqFqa1N.mjs");
+		const { loadConfig } = await import("./config-RjeVGJ7K.mjs");
 		delivered = (await routeNotification({
 			event: "error",
 			title: `PAI: ${headline}`,
@@ -5153,42 +5174,38 @@ function checkHealth(vaultPath, db) {
 //#endregion
 //#region src/cli/commands/obsidian.ts
 /**
-* Read obsidianVaultPath from CONFIG_FILE.
-* Falls back to defaultVaultPath() if not set.
+* Read obsidianVaultPath from the main config (config.yaml if it exists,
+* else config.json). Falls back to defaultVaultPath() if not set.
 */
 function getVaultPath(override) {
 	if (override) return expandHome(override);
 	try {
-		const raw = readFileSync(CONFIG_FILE$2, "utf-8");
-		const cfg = JSON.parse(raw);
+		const cfg = readMainConfigRaw();
 		if (typeof cfg.obsidianVaultPath === "string" && cfg.obsidianVaultPath) return expandHome(cfg.obsidianVaultPath);
 	} catch {}
 	return defaultVaultPath();
 }
 /**
-* Read obsidianVaultPath from CONFIG_FILE without falling back to
+* Read obsidianVaultPath from the main config without falling back to
 * defaultVaultPath() — undefined means "not set", distinct from getVaultPath's
 * "give me something usable". Used by `pai config migrate` to decide whether
 * the stored path still points at the pre-2026-09-19 default.
 */
 function getConfigObsidianVaultPathRaw() {
 	try {
-		const raw = readFileSync(CONFIG_FILE$2, "utf-8");
-		const cfg = JSON.parse(raw);
+		const cfg = readMainConfigRaw();
 		if (typeof cfg.obsidianVaultPath === "string" && cfg.obsidianVaultPath) return expandHome(cfg.obsidianVaultPath);
 	} catch {}
 }
-/**
-* Persist obsidianVaultPath into config.json so future syncs use the same path.
-*/
+/** Persist obsidianVaultPath into the main config so future syncs use the
+*  same path (config.yaml if it exists, else config.json). */
 function saveVaultPath(vaultPath) {
 	let cfg = {};
 	try {
-		cfg = JSON.parse(readFileSync(CONFIG_FILE$2, "utf-8"));
+		cfg = readMainConfigRaw();
 	} catch {}
 	cfg.obsidianVaultPath = vaultPath;
-	mkdirSync(dirname(CONFIG_FILE$2), { recursive: true });
-	writeFileSync(CONFIG_FILE$2, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+	writeMainConfigRaw(cfg);
 }
 function cmdSync(db, opts) {
 	const vaultPath = getVaultPath(opts.vault);
@@ -5956,15 +5973,17 @@ function migrateObsidianVaultPathConfig(dryRun) {
 function registerConfigCommands(configCmd) {
 	configCmd.command("path").description("Print the PAI_HOME namespace dir and each resolved per-user file").action(() => {
 		console.log(bold$1("PAI_HOME: ") + paiHomeDir());
-		console.log(`  config.json:              ${paiConfigFilePath()}`);
+		console.log(`  config.json / config.yaml: ${paiConfigFilePath()} / ${paiConfigYamlFilePath()}`);
 		console.log(`  workers.yaml:             ${workersYamlPath()}`);
 		console.log(`  whisper-rules.md:         ${whisperRulesPath()}`);
 		console.log(`  advisor-mode.json:        ${advisorModePath()}`);
 		console.log(`  session-state/:           ${sessionStateDir()}`);
 		console.log(`  session-scan-cache.json:  ${scanCacheFilePath()}`);
 		console.log(`  queries/:                 ${queriesDirPath()}`);
-		console.log(`  summary-cooldowns.json, work-queue.json, kg-backfill-state.json,`);
-		console.log(`  voices.json, federation.db (orphan): all under PAI_HOME`);
+		console.log(`  summary-cooldowns.json, work-queue.json, kg-backfill-state.json:`);
+		console.log(`                            all under PAI_HOME`);
+		console.log(`  voices.json / voices.yaml: ${voicesJsonPath()} / ${voicesYamlPath()}`);
+		console.log(`  federation.db (orphan): under PAI_HOME`);
 		console.log(`  logs/workers/:            ${paiHomePath("logs", "workers")} (pass --logs to move)`);
 		console.log(`  History/:                 ${paiHomePath("History")} (pass --history to move)`);
 		console.log(`  agent-sessions.json, session-routing.json, History/security/security-events.jsonl:`);
@@ -5979,6 +5998,65 @@ function registerConfigCommands(configCmd) {
 		console.log(`  agents/:                  ${paiHomePath("agents")} (~/.claude/Agents symlinks here after migrate)`);
 		console.log(`  commands/:                ${paiHomePath("commands")} (~/.claude/Commands symlinks here after migrate)`);
 	});
+	configCmd.command("yaml").description("Convert config.json → config.yaml (and voices.json → voices.yaml), with a short\n      # comment above every top-level section and any \"_comment\"/\"_...Note\" JSON-\n      workaround key re-attached as a real comment. Verifies the generated YAML\n      re-parses to the exact same data before writing anything; the JSON is then\n      renamed to <name>.migrated-<YYYY-MM-DD> (never deleted). Every writer keeps\n      working unmodified afterwards — see docs/config.md.").option("--dry-run", "Print the plan without writing anything").option("--force", "Regenerate config.yaml (or voices.yaml) even if it already exists").action((opts) => {
+		let hadError = false;
+		const run = (label, fn) => {
+			try {
+				const r = fn();
+				if (r.dryRun) console.log(dim$1(`  ${label}: would write ${r.yamlPath}`));
+				else console.log(ok$1(`  ${label}: `) + `${r.backupPath} → ${r.yamlPath}`);
+			} catch (e) {
+				hadError = true;
+				console.error(err(`  ${label}: `) + (e instanceof MainConfigError ? e.message : String(e instanceof Error ? e.message : e)));
+			}
+		};
+		run("config.yaml", () => migrateMainConfigToYaml(paiConfigFilePath(), {
+			dryRun: opts.dryRun,
+			force: opts.force
+		}));
+		run("voices.yaml", () => migrateVoicesToYaml({
+			dryRun: opts.dryRun,
+			force: opts.force
+		}));
+		if (hadError) process.exitCode = 1;
+	});
+	configCmd.command("list").description("Print the main PAI config as YAML (secrets masked). Defaults to what the file explicitly sets.").option("--all", "Include every default value, not just what the file sets").option("--json", "Print JSON instead of YAML").action((opts) => {
+		const r = listConfigOp({ all: opts.all });
+		console.log(opts.json ? JSON.stringify(r.data, null, 2) : r.yaml.trimEnd());
+	});
+	configCmd.command("get <path>").description("Print one config value (dotted path, e.g. search.recencyBoostDays), masked if it looks like a secret. An object/array subtree prints as YAML; pass --json for JSON.").option("--json", "Print an object/array value as JSON instead of YAML").action((path, opts) => {
+		try {
+			const r = getConfigValueOp(path);
+			if (!r.found) {
+				console.error(err(`Not set: ${path}`));
+				process.exitCode = 1;
+				return;
+			}
+			console.log(formatConfigGetOutput(r.value, { json: opts.json }));
+		} catch (e) {
+			console.error(err(e instanceof MainConfigOpsError ? e.message : String(e instanceof Error ? e.message : e)));
+			process.exitCode = 1;
+		}
+	});
+	configCmd.command("set <path> <value>").description("Set one config value (dotted path). Value parsing: true/false, null, numbers,\n      [...] / {...} as JSON, else a string. Creates config.yaml (from config.json,\n      if any) on first use, then writes comment-preserving.").option("--force", "Set an unknown top-level key, or a value of a different type than the default").action((path, value, opts) => {
+		try {
+			const r = setConfigValueOp(path, value, { force: opts.force });
+			if (r.yamlCreated) console.log(dim$1(`  created ${r.yamlPath}`));
+			console.log(ok$1(`Set ${path} = `) + (typeof r.value === "object" ? JSON.stringify(r.value) : String(r.value)));
+		} catch (e) {
+			console.error(err(e instanceof MainConfigOpsError || e instanceof MainConfigError ? e.message : String(e instanceof Error ? e.message : e)));
+			process.exitCode = 1;
+		}
+	});
+	configCmd.command("unset <path>").description("Remove one config value (dotted path), reverting it to the built-in default").action((path) => {
+		try {
+			const r = unsetConfigValueOp(path);
+			console.log(r.existed ? ok$1(`Unset ${path}`) : dim$1(`  ${path} was not set`));
+		} catch (e) {
+			console.error(err(e instanceof MainConfigOpsError ? e.message : String(e instanceof Error ? e.message : e)));
+			process.exitCode = 1;
+		}
+	});
 	configCmd.command("migrate").description("Move config.json, workers.yaml, whisper-rules.md, advisor-mode.json, session-state/,\nsession-scan-cache.json, queries/, summary-cooldowns.json, work-queue.json,\nkg-backfill-state.json, voices.json, the orphaned federation.db,\n~/.pai/registry.db, ~/.pai/federation.db (live), ~/.pai/backups/,\n~/.pai/obsidian-vault/, ~/.pai/scheduler-state.json, and ~/.claude/Agents/,\n~/.claude/Commands/ into PAI_HOME.\nregistry.db and federation.db each get an extra WAL checkpoint and PRAGMA\nintegrity_check (sqlite3 CLI, if present) on top of the byte-identical copy.\nbackups/ is copied and sha256-verified file-by-file into\nbackups/legacy-pai-backups/ rather than merged in place. Agents/ and Commands/ each\nget a symlink left at the old ~/.claude path once their content has moved, so\nClaude Code still finds them at its fixed harness paths.\nEach file is copied, verified byte-identical, then the old file is renamed to\n<name>.migrated-<YYYYMMDD> (never deleted); directories move their contents, then\nthe emptied old directory is renamed the same way. Idempotent — entries already at\nthe new location, or with nothing old to migrate, are skipped.").option("--dry-run", "Print the plan without writing anything").option("--logs", "Also move ~/.claude/logs/workers into PAI_HOME: an atomic rename plus a\n      symlink left at the old path, so any worker still writing there\n      keeps landing in the new directory (falls back to copy+verify\n      across volumes, refusing while a worker is RUNNING — see\n      `pai worker ps` — only in that fallback case)").option("--history", "Also move ~/.claude/History/, agent-sessions.json, session-routing.json\n      and history/security/security-events.jsonl into PAI_HOME. These are\n      written by hooks on EVERY session's every turn, not just spawned\n      workers — refuses while any worker other than the interactive\n      session is RUNNING (see `pai worker ps`), but that guard cannot see\n      OTHER interactive `claude` sessions on this machine. Confirm none\n      are active (`ps aux | grep claude`, `aibroker sessions list`) before\n      passing this flag.").action((opts) => {
 		const dryRun = !!opts.dryRun;
 		let hadError = false;
@@ -6578,6 +6656,35 @@ async function cmdMigrate(connectionString) {
 		process.exitCode = result.status ?? 1;
 	}
 }
+function cmdKeepalive() {
+	const config = loadConfig().sessions.cacheKeepalive;
+	console.log();
+	console.log(bold$1("  Session cache keepalive"));
+	console.log();
+	console.log(config.enabled ? ok$1(`  enabled`) : warn$1(`  disabled`));
+	console.log(dim$1(`    idleMinutes: ${config.idleMinutes}  maxBeats: ${config.maxBeats}  activeHours: ${config.activeHours}  minContextTokens: ${config.minContextTokens}  prompt: "${config.prompt}"`));
+	if (!config.enabled) {
+		console.log();
+		console.log(dim$1(`  Enable it in ${resolvedMainConfigPath(paiConfigFilePath())}: sessions.cacheKeepalive.enabled: true`));
+		console.log(dim$1(`    pai config set sessions.cacheKeepalive.enabled true`));
+	}
+	const state = loadSessionKeepaliveState();
+	const ids = Object.keys(state);
+	console.log();
+	if (ids.length === 0) console.log(dim$1("  No per-session beat counters recorded yet."));
+	else {
+		console.log(bold$1("  Per-session beat counters"));
+		for (const id of ids) {
+			const e = state[id];
+			console.log(dim$1(`    ${id}: beats=${e.beats} lastBeatAt=${e.lastBeatAt ?? "never"}`));
+		}
+	}
+	const summary = sessionKeepaliveLedgerSummary();
+	console.log();
+	console.log(bold$1(`  Ledger: ${summary.sent} sent, ${summary.skipped} skipped`));
+	for (const line of summary.lastLines) console.log(dim$1(`    ${line}`));
+	console.log();
+}
 function cmdLogs(opts) {
 	const lines = opts.lines ?? "50";
 	if (!existsSync(DAEMON_LOG)) {
@@ -6598,8 +6705,8 @@ function cmdLogs(opts) {
 }
 function registerDaemonCommands(daemonCmd) {
 	daemonCmd.command("serve").description("Start the PAI daemon in the foreground").action(async () => {
-		const { serve } = await import("./daemon-CYpVy_Dw.mjs");
-		const { loadConfig: lc, ensureConfigDir } = await import("./config-DeqFqa1N.mjs");
+		const { serve } = await import("./daemon-Vf7pHnjR.mjs");
+		const { loadConfig: lc, ensureConfigDir } = await import("./config-RjeVGJ7K.mjs");
 		ensureConfigDir();
 		await serve(lc());
 	});
@@ -6618,6 +6725,9 @@ function registerDaemonCommands(daemonCmd) {
 	daemonCmd.command("uninstall").description("Remove the launchd service and revert to direct MCP").action(() => {
 		cmdUninstall();
 	});
+	daemonCmd.command("keepalive").description("Show interactive-session cache keepalive config, per-session beat counters, and recent ledger lines").action(() => {
+		cmdKeepalive();
+	});
 	daemonCmd.command("logs").description(`Tail the daemon log (${DAEMON_LOG})`).option("-n, --lines <n>", "Number of lines to show", "50").option("-f, --follow", "Follow log output (like tail -f)").action((opts) => {
 		cmdLogs(opts);
 	});
@@ -6959,10 +7069,10 @@ async function promptYesNo(rl, question, defaultYes = true) {
 * current command happened to be setting.
 */
 function readConfigRaw() {
-	return readJsonStrict(CONFIG_FILE$2, CONFIG_FILE$2);
+	return readMainConfigRaw();
 }
 function writeConfigRaw(data) {
-	writeJsonAtomic(CONFIG_FILE$2, data, { label: CONFIG_FILE$2 });
+	writeMainConfigRaw(data);
 }
 function mergeConfig(updates) {
 	const current = readConfigRaw();
@@ -9202,7 +9312,7 @@ async function cmdExplore(note, opts) {
 	const depth = parseInt(opts.depth ?? "3", 10);
 	const direction = opts.direction ?? "both";
 	const mode = opts.mode ?? "all";
-	const { zettelExplore } = await import("./zettelkasten-BBjA7GcP.mjs");
+	const { zettelExplore } = await import("./zettelkasten-DezbXghl.mjs");
 	const result = zettelExplore(getFedDb(), {
 		startNote: note,
 		depth,
@@ -9267,7 +9377,7 @@ async function cmdHealth(opts) {
 	const projectPath = opts.project;
 	const recentDays = parseInt(opts.days ?? "30", 10);
 	const includeTypes = opts.include ? opts.include.split(",").map((s) => s.trim()) : void 0;
-	const { zettelHealth } = await import("./zettelkasten-BBjA7GcP.mjs");
+	const { zettelHealth } = await import("./zettelkasten-DezbXghl.mjs");
 	const result = zettelHealth(getFedDb(), {
 		scope,
 		projectPath,
@@ -9338,7 +9448,7 @@ async function cmdSurprise(note, opts) {
 	const limit = parseInt(opts.limit ?? "10", 10);
 	const minSimilarity = parseFloat(opts.minSimilarity ?? "0.3");
 	const minGraphDistance = parseInt(opts.minDistance ?? "3", 10);
-	const { zettelSurprise } = await import("./zettelkasten-BBjA7GcP.mjs");
+	const { zettelSurprise } = await import("./zettelkasten-DezbXghl.mjs");
 	const db = getFedDb();
 	console.log();
 	console.log(header("  PAI Zettel Surprise"));
@@ -9393,7 +9503,7 @@ async function cmdSuggest(note, opts) {
 	const vaultProjectId = parseInt(opts.vaultProjectId, 10);
 	const limit = parseInt(opts.limit ?? "5", 10);
 	const excludeLinked = opts.excludeLinked !== false;
-	const { zettelSuggest } = await import("./zettelkasten-BBjA7GcP.mjs");
+	const { zettelSuggest } = await import("./zettelkasten-DezbXghl.mjs");
 	const db = getFedDb();
 	console.log();
 	console.log(header("  PAI Zettel Suggest"));
@@ -9446,7 +9556,7 @@ async function cmdConverse(question, opts) {
 	const vaultProjectId = parseInt(opts.vaultProjectId, 10);
 	const depth = parseInt(opts.depth ?? "2", 10);
 	const limit = parseInt(opts.limit ?? "15", 10);
-	const { zettelConverse } = await import("./zettelkasten-BBjA7GcP.mjs");
+	const { zettelConverse } = await import("./zettelkasten-DezbXghl.mjs");
 	const db = getFedDb();
 	console.log();
 	console.log(header("  PAI Zettel Converse"));
@@ -9509,7 +9619,7 @@ async function cmdThemes(opts) {
 	const minClusterSize = parseInt(opts.minSize ?? "3", 10);
 	const maxThemes = parseInt(opts.maxThemes ?? "10", 10);
 	const similarityThreshold = parseFloat(opts.threshold ?? "0.65");
-	const { zettelThemes } = await import("./zettelkasten-BBjA7GcP.mjs");
+	const { zettelThemes } = await import("./zettelkasten-DezbXghl.mjs");
 	const db = getFedDb();
 	console.log();
 	console.log(header("  PAI Zettel Themes"));
@@ -10028,200 +10138,6 @@ function auditHooks(cwd) {
 	};
 }
 
-//#endregion
-//#region src/audit/session-usage.ts
-/**
-* session-usage.ts — parse the usage numbers out of a Claude Code session
-* (or subagent, or pai-worker event-mirror) JSONL transcript.
-*
-* All three log shapes share the same assistant-message envelope
-* ({ type: "assistant", message: { id, model, usage } }), so one parser
-* covers `pai audit tokens session` and the per-log readings feeding
-* `pai audit tokens spawn`.
-*
-* Streaming writes one JSONL line per content block of the same logical
-* turn, repeating message.id and usage each time — summing every line would
-* multiply usage by the block count. Keeping only the first line seen per
-* message.id is what the reference script (and this parser) count instead.
-*/
-const USAGE_KEYS = [
-	"cache_read_input_tokens",
-	"cache_creation_input_tokens",
-	"input_tokens",
-	"output_tokens"
-];
-function emptyTotals() {
-	return {
-		cache_read_input_tokens: 0,
-		cache_creation_input_tokens: 0,
-		input_tokens: 0,
-		output_tokens: 0
-	};
-}
-/**
-* `type:"system"` `subtype:"compact_boundary"` lines mark a compaction.
-* turnIndex is the count of assistant turns already folded when it fired,
-* so it lines up with the turn numbering the text/JSON report prints.
-*/
-function isCompactBoundary(line) {
-	return line.type === "system" && line.subtype === "compact_boundary";
-}
-function parseCompactionEvent(line, turnIndex) {
-	const meta = line.compactMetadata;
-	if (!meta || typeof meta.preTokens !== "number") return null;
-	return {
-		trigger: meta.trigger ?? "unknown",
-		preTokens: meta.preTokens,
-		turnIndex
-	};
-}
-/**
-* `type:"system"` `subtype:"model_refusal_fallback"` lines mark an
-* automatic model switch fired by an API safety refusal (e.g. "cyber"
-* category), not a user or config choice — worth flagging separately since
-* it can rebuild the whole prompt cache mid-session.
-*/
-function isModelFallback(line) {
-	return line.type === "system" && line.subtype === "model_refusal_fallback";
-}
-function parseFallbackEvent(line, turnIndex) {
-	return {
-		turnIndex,
-		from: line.originalModel ?? "unknown",
-		to: line.fallbackModel ?? "unknown",
-		category: line.apiRefusalCategory ?? "unknown",
-		scope: line.scope ?? "unknown"
-	};
-}
-/**
-* Fold one already-parsed JSONL line into a report being accumulated.
-* Exported separately so both the streaming file reader below and tests
-* (which build fixtures as arrays of objects, not files) share one path.
-* Returns the turn's context value when a new turn was counted, else null
-* (non-assistant line, no usage, or a duplicate message.id already seen).
-*/
-function foldAssistantLine(report, seenIds, line, threshold) {
-	if (line.type !== "assistant") return null;
-	const message = line.message;
-	const usage = message?.usage;
-	if (!usage) return null;
-	const id = message?.id ?? line.uuid;
-	if (id) {
-		if (seenIds.has(id)) return null;
-		seenIds.add(id);
-	}
-	report.turns++;
-	for (const key of USAGE_KEYS) {
-		const v = usage[key];
-		if (typeof v === "number") report.totals[key] += v;
-	}
-	const context = (Number(usage.cache_read_input_tokens) || 0) + (Number(usage.cache_creation_input_tokens) || 0) + (Number(usage.input_tokens) || 0);
-	if (report.firstTurnContext === null) {
-		report.firstTurnContext = context;
-		report.firstTurnAt = line.timestamp ?? null;
-	}
-	report.lastTurnContext = context;
-	report.maxContext = report.maxContext === null ? context : Math.max(report.maxContext, context);
-	if (context > threshold) report.turnsAboveThreshold++;
-	if ((Number(usage.cache_creation_input_tokens) || 0) > 2e4) report.cacheRebuildTurns++;
-	const model = message?.model ?? "unknown";
-	report.models[model] = (report.models[model] ?? 0) + 1;
-	if (report.lastModel !== null && report.lastModel !== model) report.modelSwitches.push({
-		turnIndex: report.turns,
-		from: report.lastModel,
-		to: model,
-		cacheRead: Number(usage.cache_read_input_tokens) || 0,
-		cacheCreation: Number(usage.cache_creation_input_tokens) || 0
-	});
-	report.lastModel = model;
-	const split = usage.cache_creation;
-	if (split) {
-		report.cacheCreationSplit.ephemeral5m += Number(split.ephemeral_5m_input_tokens) || 0;
-		report.cacheCreationSplit.ephemeral1h += Number(split.ephemeral_1h_input_tokens) || 0;
-	}
-	return context;
-}
-/**
-* True for a real human-authored `type:"user"` prompt line: content is a
-* plain string, or a content array with no `tool_result` block. Claude Code
-* encodes tool results as `type:"user"` messages whose content array is
-* entirely (or partly) tool_result blocks — those must not count as prompts.
-*/
-function isRealUserPrompt(line) {
-	if (line.type !== "user") return false;
-	if (line.isMeta) return false;
-	if (line.origin?.kind && line.origin.kind !== "human") return false;
-	const content = line.message?.content;
-	if (typeof content === "string") return true;
-	if (Array.isArray(content)) return !content.some((block) => block?.type === "tool_result");
-	return false;
-}
-/** Parse a session/subagent/worker-event JSONL file into a usage report. */
-async function parseSessionUsage(path, threshold = 2e5) {
-	const report = {
-		path,
-		sizeBytes: existsSync(path) ? readFileSync(path).byteLength : 0,
-		turns: 0,
-		totals: emptyTotals(),
-		models: {},
-		firstTurnContext: null,
-		lastTurnContext: null,
-		cacheCreationSplit: {
-			ephemeral5m: 0,
-			ephemeral1h: 0
-		},
-		avgContext: null,
-		maxContext: null,
-		turnsAboveThreshold: 0,
-		cacheRebuildTurns: 0,
-		userPrompts: 0,
-		promptExposure: 0,
-		compactions: [],
-		firstTurnAt: null,
-		lastModel: null,
-		modelSwitches: [],
-		fallbacks: []
-	};
-	const seenIds = /* @__PURE__ */ new Set();
-	let contextSum = 0;
-	const rl = createInterface({
-		input: createReadStream(path, "utf8"),
-		crlfDelay: Infinity
-	});
-	for await (const raw of rl) {
-		if (!raw.trim()) continue;
-		let obj;
-		try {
-			obj = JSON.parse(raw);
-		} catch {
-			continue;
-		}
-		if (obj.type === "user") {
-			if (isRealUserPrompt(obj)) report.userPrompts++;
-			continue;
-		}
-		if (isCompactBoundary(obj)) {
-			const event = parseCompactionEvent(obj, report.turns);
-			if (event) report.compactions.push(event);
-			continue;
-		}
-		if (isModelFallback(obj)) {
-			report.fallbacks.push(parseFallbackEvent(obj, report.turns));
-			continue;
-		}
-		const context = foldAssistantLine(report, seenIds, obj, threshold);
-		if (context !== null) {
-			contextSum += context;
-			report.promptExposure += report.userPrompts;
-		}
-	}
-	report.avgContext = report.turns > 0 ? Math.round(contextSum / report.turns) : null;
-	return report;
-}
-function totalUsageTokens(totals) {
-	return totals.cache_read_input_tokens + totals.cache_creation_input_tokens + totals.input_tokens + totals.output_tokens;
-}
-
 //#endregion
 //#region src/audit/first-turn.ts
 /**
@@ -10534,7 +10450,8 @@ function newestSessionLog() {
 async function auditSession(path, threshold) {
 	const target = path ?? newestSessionLog();
 	if (!target) return null;
-	const report = await parseSessionUsage(target, threshold);
+	const keepaliveWord = loadConfig().sessions.cacheKeepalive.prompt;
+	const report = await parseSessionUsage(target, threshold, keepaliveWord);
 	const total = totalUsageTokens(report.totals) || 1;
 	const percentages = {};
 	for (const [key, value] of Object.entries(report.totals)) percentages[key] = 100 * value / total;
@@ -12086,6 +12003,7 @@ function printSession(report) {
 		console.log(`safeguard fallbacks: ${report.fallbacks.length}`);
 		for (const f of report.fallbacks) console.log(dim$1(`  ${f.from} -> ${f.to} before turn ${f.turnIndex}: ${f.category} (${f.scope})`));
 	}
+	console.log(dim$1(`idle gaps > 60min: ${report.idleGapsOver60min}, keepalive beats: ${report.keepaliveBeats ?? "n/a"}`));
 }
 function printTurnBreakdown(tb) {
 	console.log(header(`turn ${tb.turn} attribution (live lineage, cl100k)`));
@@ -15411,8 +15329,8 @@ function cmdActive(db, opts) {
 async function cmdAutoRoute(opts) {
 	const { autoRoute, formatAutoRoute, formatAutoRouteJson } = await import("./auto-route-CcD0OWWB.mjs");
 	const { openRegistry } = await import("./db-DbY2O8QO.mjs");
-	const { createStorageBackend } = await import("./factory-47Qf_df7.mjs");
-	const { loadConfig } = await import("./config-DeqFqa1N.mjs");
+	const { createStorageBackend } = await import("./factory-Ba8j9K7q.mjs");
+	const { loadConfig } = await import("./config-RjeVGJ7K.mjs");
 	const config = loadConfig();
 	const registryDb = openRegistry();
 	const federation = await createStorageBackend(config);
@@ -17442,7 +17360,7 @@ function deriveLabel(prompt, klass) {
 
 //#endregion
 //#region src/cli/commands/worker/providers.ts
-function fail$3(e) {
+function fail$4(e) {
 	const msg = e instanceof Error ? e.message : String(e);
 	console.error(err("pai worker: ") + msg);
 	process.exitCode = 1;
@@ -17505,12 +17423,12 @@ function registerWorkerProviderCommands(providersCmd) {
 		if (legacyNotice) console.log(dim$1(`  ${legacyNotice}`));
 		console.log();
 	});
-	providersCmd.command("add <name>").description("Add a provider; the first one also turns workers on and seeds classes.\nExample: pai worker providers add glm --url https://…/anthropic \\\n           --key sk-… --model glm-5.3 --fast-model glm-5.3-flash\n--key writes the token inline as `key:` in workers.yaml (quoted, file kept 0600);\n--key-file writes only a path to a 0600 file holding it — use one or the other.\nOpenAI-protocol: --protocol openai --upstream-url https://…/v1 (runs via the PAI proxy).\nCodex (ChatGPT plan): --engine codex — runs through the Codex CLI.").option("--base-url <url>", "Anthropic-compatible API base URL (required unless --protocol openai)").option("--url <url>", "Alias of --base-url").requiredOption("--model <model>", "Default model id for this provider").option("--key <token>", "API token, written inline as `key:` (quoted); use instead of --key-file").option("--key-file <path>", "File holding the API token (0600); omit for token \"local\"").option("--fast-model <model>", "Cheaper model for spotchecks and routing").option("--env <name=value>", "Extra env for runs (repeatable)", (v, acc) => [...acc, v], []).option("--note <text>", "Human note shown in `providers list`").option("--protocol <proto>", "anthropic (default) or openai — openai runs through the local PAI proxy").option("--upstream-url <url>", "Chat Completions base URL (required for --protocol openai)").option("--engine <engine>", "claude (default) or codex — codex runs `codex exec --json`").option("--context-window <tokens>", "Context window for the meter (default 200000; init event overrides)", parseIntArg$1).option("--quota-probe <url>", "URL whose JSON first number is the quota percent (0-100)").option("--cost-tier <1-5>", "Cost tier 1 (cheapest) … 5 (most expensive; default 3)", parseCostTier).option("--tags <tags>", "Capability tags, comma-separated (from: " + PROVIDER_TAGS.join(", ") + ")", (v, acc) => [...acc, v], []).action((name, opts) => {
+	providersCmd.command("add <name>").description("Add a provider; the first one also turns workers on and seeds classes.\nExample: pai worker providers add glm --url https://…/anthropic \\\n           --key sk-… --model glm-5.3 --fast-model glm-5.3-flash\n--key writes the token inline as `key:` in workers.yaml (quoted, file kept 0600);\n--key-file writes only a path to a 0600 file holding it — use one or the other.\nOpenAI-protocol: --protocol openai --upstream-url https://…/v1 (runs via the PAI proxy).\nCodex (ChatGPT plan): --engine codex — runs through the Codex CLI.\nImage generation: --engine image — `pai worker run --capability image` then POSTs\nstraight to {url}/images/generations instead of spawning claude.").option("--base-url <url>", "Anthropic-compatible API base URL (required unless --protocol openai)").option("--url <url>", "Alias of --base-url").requiredOption("--model <model>", "Default model id for this provider").option("--key <token>", "API token, written inline as `key:` (quoted); use instead of --key-file").option("--key-file <path>", "File holding the API token (0600); omit for token \"local\"").option("--fast-model <model>", "Cheaper model for spotchecks and routing").option("--env <name=value>", "Extra env for runs (repeatable)", (v, acc) => [...acc, v], []).option("--note <text>", "Human note shown in `providers list`").option("--protocol <proto>", "anthropic (default) or openai — openai runs through the local PAI proxy").option("--upstream-url <url>", "Chat Completions base URL (required for --protocol openai)").option("--engine <engine>", "claude (default), codex, or image — codex runs `codex exec --json`, image POSTs {url}/images/generations").option("--context-window <tokens>", "Context window for the meter (default 200000; init event overrides)", parseIntArg$1).option("--quota-probe <url>", "URL whose JSON first number is the quota percent (0-100)").option("--cost-tier <1-5>", "Cost tier 1 (cheapest) … 5 (most expensive; default 3)", parseCostTier).option("--tags <tags>", "Capability tags, comma-separated (from: " + PROVIDER_TAGS.join(", ") + ")", (v, acc) => [...acc, v], []).action((name, opts) => {
 		try {
 			const protocol = opts.protocol;
 			const engine = opts.engine;
 			if (protocol && protocol !== "anthropic" && protocol !== "openai") throw new WorkersConfigError(`--protocol must be anthropic or openai, got "${protocol}"`);
-			if (engine && engine !== "claude" && engine !== "codex") throw new WorkersConfigError(`--engine must be claude or codex, got "${engine}"`);
+			if (engine && engine !== "claude" && engine !== "codex" && engine !== "image") throw new WorkersConfigError(`--engine must be claude, codex, or image, got "${engine}"`);
 			const baseUrl = opts.baseUrl ?? opts.url;
 			if (protocol !== "openai" && !baseUrl) throw new WorkersConfigError("--base-url (or --url) is required (only --protocol openai goes without it)");
 			if (opts.key && opts.keyFile) throw new WorkersConfigError("--key and --key-file are alternatives — pass one, not both");
@@ -17537,7 +17455,7 @@ function registerWorkerProviderCommands(providersCmd) {
 			if (workers.active === name) console.log(`  active: ${name} — workers ${workers.enabled ? "on" : "off"}`);
 			for (const line of describeProviders(workers)) console.log(dim$1(`  ${line}`));
 		} catch (e) {
-			fail$3(e);
+			fail$4(e);
 		}
 	});
 	providersCmd.command("update <name>").description("Change cost tier and tags of a provider (routing constraints use these)").option("--cost-tier <1-5>", "Cost tier 1 (cheapest) … 5 (most expensive)", parseCostTier).option("--tags <tags>", "Capability tags, comma-separated (from: " + PROVIDER_TAGS.join(", ") + "); --tags '' clears", (v, acc) => [...acc, v], []).action((name, opts) => {
@@ -17552,7 +17470,7 @@ function registerWorkerProviderCommands(providersCmd) {
 			const { workers } = readWorkersSection();
 			for (const line of describeProviders(workers)) console.log(dim$1(`  ${line}`));
 		} catch (e) {
-			fail$3(e);
+			fail$4(e);
 		}
 	});
 	providersCmd.command("remove <name>").description("Remove a provider and any classes pointing at it").action((name) => {
@@ -17560,7 +17478,7 @@ function registerWorkerProviderCommands(providersCmd) {
 			removeProvider(name);
 			console.log(ok$1(`provider ${name} removed`));
 		} catch (e) {
-			fail$3(e);
+			fail$4(e);
 		}
 	});
 	providersCmd.command("use <name>").description("Make this provider the active one for runs without --provider/--class").action((name) => {
@@ -17568,7 +17486,7 @@ function registerWorkerProviderCommands(providersCmd) {
 			useProvider(name);
 			console.log(ok$1(`active provider: ${name}`));
 		} catch (e) {
-			fail$3(e);
+			fail$4(e);
 		}
 	});
 	providersCmd.command("enable <name>").description("Enable a provider (also clears its cooldown)").action((name) => {
@@ -17576,7 +17494,7 @@ function registerWorkerProviderCommands(providersCmd) {
 			setProviderEnabled(name, true);
 			console.log(ok$1(`provider ${name} enabled`));
 		} catch (e) {
-			fail$3(e);
+			fail$4(e);
 		}
 	});
 	providersCmd.command("disable <name>").description("Disable a provider (auto-routing skips it; --provider still works)").action((name) => {
@@ -17584,7 +17502,7 @@ function registerWorkerProviderCommands(providersCmd) {
 			setProviderEnabled(name, false);
 			console.log(ok$1(`provider ${name} disabled`));
 		} catch (e) {
-			fail$3(e);
+			fail$4(e);
 		}
 	});
 	providersCmd.command("test [name]").description("One-word pong probe through a provider (default: the active one)").action(async (name) => {
@@ -17604,7 +17522,7 @@ function registerWorkerProviderCommands(providersCmd) {
 			console.log(`  reply: ${r.result.slice(0, 200)}`);
 			process.exitCode = r.ok ? 0 : 1;
 		} catch (e) {
-			fail$3(e);
+			fail$4(e);
 		}
 	});
 }
@@ -17625,7 +17543,7 @@ function registerClassSubcommands(classesCmd) {
 			setClass(cls, built);
 			console.log(ok$1(`class ${cls} → ${classTargetText(built)}`));
 		} catch (e) {
-			fail$3(e);
+			fail$4(e);
 		}
 	});
 	classesCmd.command("unset <class>").description("Remove a class (runs then use the active provider)").action((cls) => {
@@ -17633,7 +17551,7 @@ function registerClassSubcommands(classesCmd) {
 			unsetClass(cls);
 			console.log(ok$1(`class ${cls} removed`));
 		} catch (e) {
-			fail$3(e);
+			fail$4(e);
 		}
 	});
 }
@@ -17645,13 +17563,13 @@ function registerWorkerClassCommands(workerCmd) {
 
 //#endregion
 //#region src/cli/commands/worker/model.ts
-function fail$2(e) {
+function fail$3(e) {
 	const msg = e instanceof Error ? e.message : String(e);
 	console.error(err("pai worker: ") + msg);
 	process.exitCode = 1;
 }
 function registerWorkerModelCommand(workerCmd) {
-	workerCmd.command("model [what] [model]").description("Model ids per provider: no args lists them,\n`model <model-id>` sets the active provider's default model (back-compat),\n`model <capability>` shows one capability, `model <capability> <model-id>` sets it.\nCapabilities: default, fast, image. --provider targets another provider.").option("--provider <name>", "Provider to read or change (default: the active one)").action((what, model, opts) => {
+	workerCmd.command("model [what] [model]").description("Model ids per provider: no args lists them,\n`model <model-id>` sets the active provider's default model (back-compat),\n`model <capability>` shows one capability, `model <capability> <model-id>` sets it.\nCapability names are open (default, fast, image, … — any ^[a-z][a-z0-9-]*$ name);\n`pai worker capability` picks which provider serves one across the whole config.\n--provider targets another provider.").option("--provider <name>", "Provider to read or change (default: the active one)").action((what, model, opts) => {
 		try {
 			const { workers } = readWorkersSection();
 			if (what === void 0) {
@@ -17676,6 +17594,39 @@ function registerWorkerModelCommand(workerCmd) {
 				console.log(ok$1(`${name} ${capability} model: ${p.models[capability]}`));
 				console.log(dim$1(`  ${modelPrefsText(p)}`));
 			}
+		} catch (e) {
+			fail$3(e);
+		}
+	});
+}
+
+//#endregion
+//#region src/cli/commands/worker/capability.ts
+function fail$2(e) {
+	const msg = e instanceof Error ? e.message : String(e);
+	console.error(err("pai worker: ") + msg);
+	process.exitCode = 1;
+}
+function registerWorkerCapabilityCommand(workerCmd) {
+	workerCmd.command("capability [name] [providers]").description("Which provider(s) serve a capability (e.g. image), independent of any one\nprovider's own model table: no args lists every preference and what it\nresolves to; `capability <name> <provider>[,<provider>…]` sets the\npreference list (first usable one wins); `capability <name> --unset`\nremoves it. An `engine: image` provider preferred for \"image\" runs\n`pai worker run --capability image` directly against its images API.").option("--unset", "Remove the preference for <name>").option("--json", "Machine-readable output").action((name, providers, opts) => {
+		try {
+			if (name === void 0) {
+				const { workers } = readWorkersSection();
+				const lines = describeCapabilities(workers);
+				if (opts.json) console.log(JSON.stringify(lines));
+				else for (const line of lines) console.log(`  ${line}`);
+				return;
+			}
+			if (opts.unset) {
+				unsetCapabilityPreference(name);
+				console.log(ok$1(`removed the capability preference for "${name}"`));
+				return;
+			}
+			if (providers === void 0) throw new Error(`usage: pai worker capability ${name} <provider>[,<provider>…]  (or --unset to remove it)`);
+			const workers = setCapabilityPreference(name, providers.split(",").map((p) => p.trim()));
+			const line = describeCapabilities(workers).find((l) => l.startsWith(`${name}:`));
+			console.log(ok$1(`${name}: [${workers.capabilities[name]?.join(", ")}]`));
+			if (line) console.log(`  -> ${line.split(" -> ")[1]}`);
 		} catch (e) {
 			fail$2(e);
 		}
@@ -17873,7 +17824,7 @@ function fail(e) {
 	process.exitCode = 1;
 }
 function registerWorkerCommands(workerCmd) {
-	workerCmd.command("run").description("Run one claude-code worker through the configured provider.\nUnknown options are passed to claude verbatim (e.g. -p, --allowedTools);\n--output-format/--verbose are handled here.\n--label \"<goal>\" is optional — it is the row shown in ps / follow /\nthe status line; when absent it is derived from the prompt's first line\n(--chain/--agent derive their own instead).\n--spec <file> (or --spec -) reads the prompt from a file/stdin instead of\nan inline -p '<prompt>', which breaks on shell quoting; mutually\nexclusive with -p.\nGrant MCP tools by naming mcp__server__tool in --allowedTools (the server loads automatically);\n--chain draft,implement[,review] runs a spec-first pipeline;\n--agent <name> runs an agent definition from ~/.claude/agents.").allowUnknownOption(true).option("--provider <name>", "Provider to run on (default: active, else routing order)").option("--class <name>", "Use the provider of this class (draft, implement, review, research, spotcheck, simple, complex, image)").option("--role <name>", "Alias of --class (roles were renamed to classes)").option("--chain <stages>", "Comma-separated stage classes, e.g. draft,implement or draft,implement,review").option("--agent <name>", "Run the agent definition ~/.claude/agents/<name>.md on a worker").option("--model <model>", "Override the model for this run. Headless (-p) workers default to the --class model; an interactive launch (no -p) with no --model uses the harness default model from settings.json.").option("--label <text>", "Short task label shown in ps / follow / status line (default: first line of the prompt)").option("--spec <path>", "Read the prompt from this file (or - for stdin) instead of -p; mutually exclusive with -p").option("--cwd <dir>", "Directory the worker runs in (default: this process's cwd)").option("--mcp <names>", "MCP servers/sets this worker may use (comma-separated; see `pai worker mcp`)").option("--no-pane", "Do not open a follow pane for this worker").option("--worktree", "Run in a git worktree on branch worker/<id> (default for implement/complex/plan in a git repo)").option("--no-worktree", "Run in place, no worktree").option("--print-cmd", "Print the assembled claude argv as JSON and exit, without spawning (audit tool)").option("--report <format>", "Final-report contract/parser: json or ag2 (default: ag2, or PAI_WORKER_REPORT)").option("--no-report-retry", "Skip the one bounded re-ask when the final AG2 message fails validation").argument("[args...]", "claude arguments, e.g. -p '<task>' --allowedTools 'Read,Edit,Bash'").action(async (args, opts) => {
+	workerCmd.command("run").description("Run one claude-code worker through the configured provider.\nUnknown options are passed to claude verbatim (e.g. -p, --allowedTools);\n--output-format/--verbose are handled here.\n--label \"<goal>\" is optional — it is the row shown in ps / follow /\nthe status line; when absent it is derived from the prompt's first line\n(--chain/--agent derive their own instead).\n--spec <file> (or --spec -) reads the prompt from a file/stdin instead of\nan inline -p '<prompt>', which breaks on shell quoting; mutually\nexclusive with -p.\nGrant MCP tools by naming mcp__server__tool in --allowedTools (the server loads automatically);\n--chain draft,implement[,review] runs a spec-first pipeline;\n--agent <name> runs an agent definition from ~/.claude/agents.").allowUnknownOption(true).option("--provider <name>", "Provider to run on (default: active, else routing order)").option("--class <name>", "Use the provider of this class (draft, implement, review, research, spotcheck, simple, complex, image)").option("--role <name>", "Alias of --class (roles were renamed to classes)").option("--capability <name>", "Run on whichever configured provider serves this capability (see `pai worker capability`), not the active provider or --class's own one — e.g. --capability image runs an `engine: image` provider directly, POSTing a prompt and writing the PNG instead of spawning claude").option("--for <name>", "Alias of --capability").option("--out <file>", "Where an image-capability run writes its PNG (default: <logDir>/<worker-id>.png)").option("--size <WxH>", "Image size for an image-capability run, e.g. 1024x1024 (default: 1024x1024)").option("--timeout-ms <n>", "Timeout for an image-capability run's HTTP request (default: 120000)", parseIntArg).option("--chain <stages>", "Comma-separated stage classes, e.g. draft,implement or draft,implement,review").option("--agent <name>", "Run the agent definition ~/.claude/agents/<name>.md on a worker").option("--model <model>", "Override the model for this run. Headless (-p) workers default to the --class model; an interactive launch (no -p) with no --model uses the harness default model from settings.json.").option("--label <text>", "Short task label shown in ps / follow / status line (default: first line of the prompt)").option("--spec <path>", "Read the prompt from this file (or - for stdin) instead of -p; mutually exclusive with -p").option("--cwd <dir>", "Directory the worker runs in (default: this process's cwd)").option("--mcp <names>", "MCP servers/sets this worker may use (comma-separated; see `pai worker mcp`)").option("--no-pane", "Do not open a follow pane for this worker").option("--worktree", "Run in a git worktree on branch worker/<id> (default for implement/complex/plan in a git repo)").option("--no-worktree", "Run in place, no worktree").option("--print-cmd", "Print the assembled claude argv as JSON and exit, without spawning (audit tool)").option("--report <format>", "Final-report contract/parser: json or ag2 (default: ag2, or PAI_WORKER_REPORT)").option("--no-report-retry", "Skip the one bounded re-ask when the final AG2 message fails validation").argument("[args...]", "claude arguments, e.g. -p '<task>' --allowedTools 'Read,Edit,Bash'").action(async (args, opts) => {
 		try {
 			const className = opts.class ?? opts.role;
 			if (opts.report !== void 0 && opts.report !== "json" && opts.report !== "ag2") throw new Error(`--report: expected "json" or "ag2", got "${opts.report}"`);
@@ -17944,6 +17895,10 @@ function registerWorkerCommands(workerCmd) {
 				printCmd: opts.printCmd,
 				reportFormatFlag,
 				noReportRetry: opts.reportRetry === false,
+				capabilityFlag: opts.capability ?? opts.for,
+				imageOut: opts.out,
+				imageSize: opts.size,
+				imageTimeoutMs: opts.timeoutMs,
 				claudeArgs
 			});
 			process.exitCode = rc;
@@ -18286,6 +18241,7 @@ function registerWorkerCommands(workerCmd) {
 	registerWorkerProviderCommands(workerCmd.command("providers").description("Providers: list, add, remove, use, enable, disable, test"));
 	registerWorkerClassCommands(workerCmd);
 	registerWorkerModelCommand(workerCmd);
+	registerWorkerCapabilityCommand(workerCmd);
 	registerWorkerConfigCommands(workerCmd);
 }
 function parseIntArg(v) {
@@ -18948,7 +18904,7 @@ function analyzeProject(db, project) {
 async function countVectorDbPaths(oldPaths) {
 	if (oldPaths.length === 0) return 0;
 	try {
-		const { loadConfig } = await import("./config-DeqFqa1N.mjs");
+		const { loadConfig } = await import("./config-RjeVGJ7K.mjs");
 		const { PostgresBackend } = await import("./postgres-CUSXWgTG.mjs");
 		const config = loadConfig();
 		if (config.storageBackend !== "postgres") return 0;
@@ -18969,7 +18925,7 @@ async function countVectorDbPaths(oldPaths) {
 async function updateVectorDbPaths(moves) {
 	if (moves.length === 0) return 0;
 	try {
-		const { loadConfig } = await import("./config-DeqFqa1N.mjs");
+		const { loadConfig } = await import("./config-RjeVGJ7K.mjs");
 		const { PostgresBackend } = await import("./postgres-CUSXWgTG.mjs");
 		const config = loadConfig();
 		if (config.storageBackend !== "postgres") return 0;
@@ -20510,4 +20466,4 @@ claude() {
 
 //#endregion
 export { drainStdio as n, buildProgram as t };
-//# sourceMappingURL=program-D9-wfmkZ.mjs.map
+//# sourceMappingURL=program-BX67-4I2.mjs.map