@tekmidian/pai 0.60.0 → 0.61.0

package/dist/{run-BFxuNnIJ.mjs → run-CxxZKEZw.mjs}

@@ -1,9 +1,9 @@
-import { i as getRegistryBackend } from "./factory-ChfAvCzO.mjs";
-import { D as resolveModelCapability, O as resolveProviderKey, T as readWorkersSection, h as classModelCapability, m as assertProviderRunnable, n as claudeCommand, p as WorkersConfigError, t as buildRunEnv, w as providerKeyPath, y as isModelCapability } from "./run-env-kbWVwUvU.mjs";
-import { _ as statusPath, d as resolveTarget, f as setCooldown, g as panesDir, h as ledgerPath, i as capabilityForRun, m as eventsPath, n as ensureProxyRunning, o as isQuotaFailure, p as ensureNoMcpConfig, s as nextAutoProvider, t as DEFAULT_PROXY_PORT, u as resolveCapabilityRun, v as workersLogDir } from "./server-B0vBmfJt.mjs";
-import { appendFileSync, closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { i as getRegistryBackend } from "./factory-EUUhSSoq.mjs";
+import { E as readWorkersSection, O as resolveModelCapability, T as providerKeyPath, b as isModelCapability, d as NATIVE_ANTHROPIC_MODELS, g as classModelCapability, h as assertProviderRunnable, k as resolveProviderKey, m as WorkersConfigError, n as claudeCommand, t as buildRunEnv } from "./run-env-BE5xyCwy.mjs";
+import { _ as statusPath, d as resolveTarget, f as setCooldown, g as panesDir, h as ledgerPath, i as capabilityForRun, m as eventsPath, n as ensureProxyRunning, o as isQuotaFailure, p as ensureNoMcpConfig, s as nextAutoProvider, t as DEFAULT_PROXY_PORT, u as resolveCapabilityRun, v as workersLogDir } from "./server-BY6AedmC.mjs";
+import { appendFileSync, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { execFileSync, spawn } from "node:child_process";
 import { connect, createServer } from "node:net";
 import { createInterface } from "node:readline";
@@ -336,9 +336,10 @@ function saveStatus(logDir, status, d = /* @__PURE__ */ new Date()) {
 	const path = statusPath(logDir, status.id);
 	const baseline = firstWrittenLabel.get(status.id);
 	if (baseline === void 0) firstWrittenLabel.set(status.id, status.label);
-	else if (status.label === baseline) {
-		const onDisk = loadStatus(logDir, status.id);
-		if (onDisk && onDisk.label !== status.label) status.label = onDisk.label;
+	const onDisk = baseline === void 0 ? void 0 : loadStatus(logDir, status.id);
+	if (onDisk) {
+		if (status.label === baseline && onDisk.label !== status.label) status.label = onDisk.label;
+		if (onDisk.controlsHeld) status.controlsHeld = true;
 	}
 	const tmp = statusTmpPath(logDir, status.id);
 	if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
@@ -639,7 +640,8 @@ function isGitRepo(cwd) {
 function promptLooksReadonly(prompt) {
 	const p = prompt.trim();
 	if (!p) return true;
-	if (/\b(read[- ]only|do not (modify|change|edit|write)|don'?t (modify|change|edit|write)|no changes)\b/i.test(p)) return true;
+	const firstLine = p.split("\n", 1)[0];
+	if (/\b(read[- ]only|do not (modify|change|edit|write)|don'?t (modify|change|edit|write)|no changes)\b/i.test(firstLine)) return true;
 	return /^(review|read|analy[sz]e|research|summar[iy]|inspect|investigate|spotcheck|report|find|list|check|verify|describe|explain|show)\b/i.test(p);
 }
 /** The classes whose runs write files and therefore default to a worktree. */
@@ -843,18 +845,58 @@ function uncommittedPaths(wtDir) {
 	return [...tracked, ...untracked];
 }
 /**
+* True when `wtDir`/`relPath` is a symlink whose target resolves outside
+* `wtDir` — e.g. a worker's `node_modules -> <main checkout>/node_modules`
+* convenience link. A `.gitignore` using `dir/` (directories only) does not
+* ignore such a link, so it turns up as untracked; staging and merging it
+* lets git replace the real directory on the other side with a symlink to
+* itself. Never a candidate for salvage.
+*/
+function symlinkEscapesWorktree(wtDir, relPath) {
+	const full = join(wtDir, relPath);
+	let stat;
+	try {
+		stat = lstatSync(full);
+	} catch {
+		return false;
+	}
+	if (!stat.isSymbolicLink()) return false;
+	const target = readlinkSync(full);
+	const resolvedTarget = isAbsolute(target) ? target : resolve(dirname(full), target);
+	const realTarget = existsSync(resolvedTarget) ? realpathSync(resolvedTarget) : resolvedTarget;
+	const realWtDir = realpathSync(wtDir);
+	return realTarget !== realWtDir && !realTarget.startsWith(realWtDir + sep);
+}
+/**
 * Commit a worktree's uncommitted changes to its branch so the merge carries
 * them. `git merge` only moves committed work, so a worker that stopped
 * without committing would lose its edits to `worktree remove` — exactly
-* what happened live on 2026-09-17. Returns the salvaged paths, [] when the
-* worktree is clean. A failed commit throws with the worktree untouched:
+* what happened live on 2026-09-17. Returns the salvaged paths, empty when
+* the worktree is clean. A symlink pointing outside the worktree (see
+* `symlinkEscapesWorktree`) is never staged; it is left on disk and reported
+* as skipped instead. A failed commit throws with the worktree untouched:
 * its edits are still on disk, so nothing is lost.
 */
 function salvageUncommitted(wtDir, label) {
 	const paths = uncommittedPaths(wtDir);
-	if (!paths.length) return [];
+	if (!paths.length) return {
+		committed: [],
+		skipped: []
+	};
+	const skipped = [];
+	const toStage = [];
+	for (const p of paths) if (symlinkEscapesWorktree(wtDir, p)) skipped.push(`symlink ${p} -> ${readlinkSync(join(wtDir, p))} (points outside the worktree)`);
+	else toStage.push(p);
+	if (!toStage.length) return {
+		committed: [],
+		skipped
+	};
 	try {
-		git(wtDir, ["add", "-A"]);
+		git(wtDir, [
+			"add",
+			"--",
+			...toStage
+		]);
 		git(wtDir, [
 			"commit",
 			"-m",
@@ -863,7 +905,10 @@ function salvageUncommitted(wtDir, label) {
 	} catch (e) {
 		throw new Error(`cannot salvage the uncommitted changes in ${wtDir} — ${e.message}; nothing was lost: commit them there by hand, then re-run merge`);
 	}
-	return paths;
+	return {
+		committed: toStage,
+		skipped
+	};
 }
 /**
 * The dirty paths of a checkout, parsed from `git status --porcelain -z`:
@@ -914,9 +959,14 @@ function assertNoDirtyOverlap(cwd, incoming, id, branch) {
 	if (!overlap.length) return;
 	throw new Error(`worker ${id}: the checkout ${cwd} has uncommitted changes in paths ${branch} touches: ${overlap.join(", ")}. Commit or stash them in the checkout, then re-run: pai worker merge ${id}. No merge was made; the worktree was kept.`);
 }
-/** Never remove a worktree that still holds uncommitted changes. */
+/**
+* Never remove a worktree that still holds uncommitted changes — except a
+* symlink escaping the worktree (see `symlinkEscapesWorktree`): it was
+* deliberately left uncommitted by `salvageUncommitted`, and deleting the
+* link itself touches nothing outside the worktree.
+*/
 function assertWorktreeClean(wtDir, id) {
-	const leftover = uncommittedPaths(wtDir);
+	const leftover = uncommittedPaths(wtDir).filter((p) => !symlinkEscapesWorktree(wtDir, p));
 	if (leftover.length) throw new Error(`worker ${id}: the worktree ${wtDir} still holds uncommitted changes (${leftover.join(", ")}) — it was NOT removed; commit or copy them by hand, then re-run merge`);
 }
 /** Blob sha of `path` at `rev` in `cwd`, or null when it does not exist there. */
@@ -970,7 +1020,10 @@ function mergeSnapshotWorker(logDir, id, st) {
 	const snapshot = st.worktreeBase;
 	const branch = st.branch;
 	const worktreeDir = st.worktreeDir;
-	const salvaged = existsSync(worktreeDir) ? salvageUncommitted(worktreeDir, st.label || UNLABELED) : [];
+	const salvage = existsSync(worktreeDir) ? salvageUncommitted(worktreeDir, st.label || UNLABELED) : {
+		committed: [],
+		skipped: []
+	};
 	if ((parseInt(git(st.cwd, [
 		"rev-list",
 		"--count",
@@ -1029,7 +1082,10 @@ function mergeSnapshotWorker(logDir, id, st) {
 		merged: true
 	});
 	const base = `applied worker ${id}'s changes (branch ${branch}) to ${st.cwd} as uncommitted changes: ${changedPaths.join(", ")} (worktree removed, branch deleted)`;
-	return salvaged.length ? `${base}; salvaged ${salvaged.length} uncommitted change(s) onto the branch first: ${salvaged.join(", ")}` : base;
+	const notes = [];
+	if (salvage.committed.length) notes.push(`salvaged ${salvage.committed.length} uncommitted change(s) onto the branch first: ${salvage.committed.join(", ")}`);
+	if (salvage.skipped.length) notes.push(`skipped ${salvage.skipped.join(", ")}`);
+	return notes.length ? `${base}; ${notes.join("; ")}` : base;
 }
 /**
 * `pai worker merge <id>`: salvage whatever the worker left uncommitted onto
@@ -1044,7 +1100,10 @@ function mergeWorker(logDir, id) {
 	const st = mustHaveBranch(logDir, id);
 	if (st.merged) return `worker ${id}: branch ${st.branch} already merged`;
 	if (st.worktreeSnapshot) return mergeSnapshotWorker(logDir, id, st);
-	const salvaged = existsSync(st.worktreeDir) ? salvageUncommitted(st.worktreeDir, st.label || UNLABELED) : [];
+	const salvage = existsSync(st.worktreeDir) ? salvageUncommitted(st.worktreeDir, st.label || UNLABELED) : {
+		committed: [],
+		skipped: []
+	};
 	if ((parseInt(git(st.cwd, [
 		"rev-list",
 		"--count",
@@ -1074,7 +1133,7 @@ function mergeWorker(logDir, id) {
 		throw new Error(`worker ${id}: git refused the merge of ${st.branch} — ${e.message}. The worktree ${st.worktreeDir} was kept: resolve the conflict, then re-run merge`);
 	}
 	if (existsSync(st.worktreeDir)) assertWorktreeClean(st.worktreeDir, id);
-	removeWorktree(st.cwd, st.worktreeDir, false);
+	removeWorktree(st.cwd, st.worktreeDir, true);
 	let branchGone = true;
 	try {
 		git(st.cwd, [
@@ -1090,7 +1149,10 @@ function mergeWorker(logDir, id) {
 		merged: true
 	});
 	const base = `merged ${st.branch} into ${st.cwd} (worktree removed${branchGone ? ", branch deleted" : "; branch kept: git refused -d"})`;
-	return salvaged.length ? `${base}; salvaged ${salvaged.length} uncommitted change(s): ${salvaged.join(", ")}` : base;
+	const notes = [];
+	if (salvage.committed.length) notes.push(`salvaged ${salvage.committed.length} uncommitted change(s): ${salvage.committed.join(", ")}`);
+	if (salvage.skipped.length) notes.push(`skipped ${salvage.skipped.join(", ")}`);
+	return notes.length ? `${base}; ${notes.join("; ")}` : base;
 }
 /** `pai worker discard <id>`: drop worktree and branch, keep nothing. */
 function discardWorker(logDir, id) {
@@ -1172,9 +1234,10 @@ function inPlaceSystemPrompt() {
 * If neither is available, viewers fall back to "all workers".
 *
 * A third case: workers spawned from a Claude Code Bash tool (the
-* orchestrator pattern) have neither — Claude Code exports no terminal or
-* session identity to its Bash children. Those record `spawnerSession`, the
-* orchestrator's claude session id bridged through the status line's
+* orchestrator pattern) inherit the orchestrator's `ITERM_SESSION_ID`, which
+* identifies the orchestrator's own pane, not a pane for the sub-worker —
+* so it does not key the sub-worker's tab. Those record `spawnerSession`,
+* the orchestrator's claude session id bridged through the status line's
 * session map (see below), so their tab still claims them.
 */
 const AIBROKER_REGISTRY = join(homedir(), ".aibroker", "session-names.json");
@@ -1896,7 +1959,10 @@ function absoluteCliPath() {
 }
 /** Open (or only report on) the stacked follow pane of one worker. */
 async function openPaneForWorker(logDir, config, wid, term) {
-	if (workerPaneOpen(wid)) return `pane for ${wid} already open`;
+	if (workerPaneOpen(wid)) return {
+		message: `pane for ${wid} already open`,
+		session: null
+	};
 	const uid = itermUuid(term);
 	const regPath = join(panesDir(logDir), `${scopeKey(term)}.json`);
 	const reg = loadRegistry(regPath);
@@ -1920,7 +1986,10 @@ async function openPaneForWorker(logDir, config, wid, term) {
 		opened: (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19)
 	});
 	saveRegistry(regPath, pruned);
-	return `pane opened for ${wid}`;
+	return {
+		message: `pane opened for ${wid}`,
+		session: out.slice(bar + 1)
+	};
 }
 /**
 * One `--check` line with the bounds of the window hosting `term`'s iTerm
@@ -2040,6 +2109,34 @@ function launchParent(explicit, env = process.env) {
 function isWorkerId(logDir, id) {
 	return loadStatus(logDir, id) !== null;
 }
+/**
+* A worker owns its children's results (the worker contract says so): if
+* `parent` exits leaving sub-workers unaccounted for, its own run must not
+* report success. Two shapes count, both read off `runningChildren` and the
+* raw statuses, never a second live-child lookup:
+*
+*   - still live: left running untouched (killing another process's work
+*     here would be its own bug) but named in the reason.
+*   - marked "running" with a dead pid (the child never got to write its own
+*     terminal state before its parent vanished from under it): finalised
+*     here as failed, so `ps` stops showing a corpse as live.
+*
+* Returns the reason string for the parent's own report, or null when every
+* child it started is accounted for.
+*/
+function checkOrphanedChildren(logDir, parent) {
+	const statuses = loadStatuses(logDir);
+	const live = runningChildren(statuses, parent);
+	const abandoned = statuses.filter((s) => s.parent === parent && s.state === "running" && !isLive(s));
+	for (const child of abandoned) saveStatus(logDir, {
+		...child,
+		state: "failed",
+		last: `parent ${parent} exited`
+	});
+	const ids = [...live, ...abandoned].map((s) => s.id);
+	if (!ids.length) return null;
+	return `exited with ${ids.length} sub-worker${ids.length === 1 ? "" : "s"} still running (${ids.join(", ")}); they were not waited for — run children in the foreground or wait for them before finishing`;
+}
 
 //#endregion
 //#region src/workers/operator.ts
@@ -2282,6 +2379,16 @@ function ag2Spec() {
 	return cachedSpec;
 }
 /**
+* Strip what workers wrap around a report: one surrounding ``` fence (opening
+* line may carry a language tag) and a leading `[YYYY-MM-DD HH:MM]` stamp line.
+*/
+function unwrapAg2(text) {
+	let t = (text ?? "").trim();
+	const fenced = t.match(/^```[^\n]*\n([\s\S]*?)\n?```$/);
+	if (fenced) t = fenced[1].trim();
+	return t.replace(/^\[\d{4}-\d{2}-\d{2}[^\]\n]*\][ \t]*\n/, "").trim();
+}
+/**
 * Parse one AG2 message: first non-empty line is the kind (T R S Q A X,
 * optionally followed by trailing text — only the first character is the
 * kind), later lines are `key=value` or `@n=path` symbol declarations.
@@ -2297,7 +2404,7 @@ function parseAg2Report(text) {
 		"A",
 		"X"
 	]);
-	const lines = (text ?? "").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("```"));
+	const lines = unwrapAg2(text).split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("```"));
 	if (!lines.length) return null;
 	const kind = lines[0][0];
 	if (!kinds.has(kind)) return null;
@@ -2341,11 +2448,17 @@ function ag2ToWorkerReport(parsed) {
 			summary: entry.slice(cut + 1).trim()
 		};
 	});
-	if (f.t) out.checks = f.t.split(/\s+/).filter(Boolean).map((entry) => ({
-		name: entry.slice(0, -1),
-		ok: passed(entry),
-		detail: entry.slice(-1)
-	}));
+	if (f.t) {
+		const tokens = f.t.split(/\s+/).filter(Boolean);
+		out.checks = tokens.length > 0 && tokens.every((tok) => /^\S+[+\-~?!]$/.test(tok)) ? tokens.map((entry) => ({
+			name: entry.slice(0, -1),
+			ok: passed(entry),
+			detail: entry.slice(-1)
+		})) : [{
+			name: "tests",
+			detail: f.t
+		}];
+	}
 	if (f.p) out.commands = f.p.split("|").map((s) => s.trim()).filter(Boolean);
 	const open = [];
 	if (f.x) open.push(f.x);
@@ -2371,7 +2484,7 @@ function validateAg2(text) {
 			"-",
 			"--json"
 		], {
-			input: text,
+			input: unwrapAg2(text),
 			timeout: 5e3,
 			stdio: [
 				"pipe",
@@ -2599,7 +2712,7 @@ function renderReport(c, prefix, r, cwd = "") {
 	if (has(r.checks)) {
 		out.push(`${prefix}${c("bold", "checks")}`);
 		for (const ck of r.checks) {
-			const mark = ck.ok === false ? c("red", "✗") : c("green", "✓");
+			const mark = ck.ok === false ? c("red", "✗") : ck.ok === true ? c("green", "✓") : c("dim", "·");
 			const detail = ck.detail ? c("dim", ` · ${shortText(ck.detail, 80)}`) : "";
 			out.push(`${prefix}  ${mark} ${ck.name ?? "?"}${detail}`);
 		}
@@ -3011,16 +3124,22 @@ function toolResultFailed(block) {
 	const m = toolResultText(block.content).match(/Exit code (\d+)/);
 	return m !== null && Number(m[1]) !== 0;
 }
+/** CLI aliases the built-in provider hands to `--model` (NATIVE_ANTHROPIC_MODELS'
+*  values): a bare name like "sonnet", not a concrete id, so the init event's
+*  resolved id is always the more useful thing to display. */
+const NATIVE_MODEL_ALIASES = new Set(Object.values(NATIVE_ANTHROPIC_MODELS));
 /**
 * The model the init event announces, adopted into the status when the spawn
 * could not name one (a caller that passed `--model` itself in the claude
-* args, or a provider whose table has no entry for the capability). The run's
-* real model is then only knowable from the first event it sends. Never
-* overwrites an explicit model — a resolved or pinned model stays the
+* args, or a provider whose table has no entry for the capability) or named
+* only a CLI alias (the built-in provider's "sonnet"/"haiku", which tracks
+* whatever release is current — the init event says which one actually ran).
+* The run's real model is then only knowable from the first event it sends.
+* Never overwrites a concrete resolved or pinned model — that stays the
 * recorded truth.
 */
 function adoptInitModel(status, e) {
-	if (status.model) return;
+	if (status.model && !NATIVE_MODEL_ALIASES.has(status.model)) return;
 	const m = (e.model ?? "").trim();
 	if (m) status.model = m;
 }
@@ -3115,7 +3234,7 @@ async function runWorker(opts) {
 	const logDir = workersLogDir(config);
 	mkdirSync(logDir, { recursive: true });
 	if (opts.className === "plan" && !opts._planner) {
-		const { runPlanner } = await import("./planner-DbpsMZqY.mjs");
+		const { runPlanner } = await import("./planner-D8jAr_sx.mjs");
 		return runPlanner(opts);
 	}
 	const parent = launchParent(opts.parent);
@@ -3319,6 +3438,64 @@ function interactiveMcpTools(explicitMcp, callerTools, projectLaunch) {
 		tools: !callerTools && projectLaunch?.tools?.length ? projectLaunch.tools : []
 	};
 }
+/**
+* The finalisation every engine shares: orphaned-children check, state, the
+* WORKER-END ledger line, worktree outcome, parent handoff, final rc. A worker
+* owns its children's results (the worker contract says so): if it
+* backgrounded a sub-worker and exited without waiting, the run must not
+* report success, whatever the process returned.
+*/
+async function finaliseRun(f) {
+	const { logDir, ledger, ok, rc } = f;
+	let { status, report } = f;
+	const wid = status.id;
+	const orphanReason = checkOrphanedChildren(logDir, wid);
+	const succeeded = ok && !orphanReason;
+	status.state = succeeded ? "done" : "failed";
+	status.rc = rc;
+	status.secs = f.secs;
+	if (orphanReason) {
+		status.last = shortText(orphanReason, 90);
+		report = {
+			...report ?? {},
+			notes: orphanReason,
+			result: "-"
+		};
+		appendLedger(ledger, "WORKER-ORPHAN-CHILDREN", {
+			id: wid,
+			reason: orphanReason
+		});
+	}
+	saveStatus(logDir, status);
+	appendLedger(ledger, "WORKER-END", {
+		id: wid,
+		...f.end,
+		rc,
+		secs: f.secs
+	});
+	if (f.worktree) status = recordWorktree(logDir, status, f.worktree, ok);
+	const early = await f.beforeHandoff?.(status, report);
+	if (typeof early === "number") return early;
+	const finalRc = rc !== 0 ? rc : succeeded ? 0 : 1;
+	if (status.parent && isWorkerId(logDir, status.parent)) try {
+		await deliverHandoff(logDir, {
+			from: wid,
+			to: status.parent,
+			kind: "result",
+			text: shortText(report?.notes ?? f.fallbackText ?? (succeeded ? "done" : "failed"), 400),
+			data: {
+				rc: finalRc,
+				ok: succeeded,
+				...status.branch ? {
+					branch: status.branch,
+					commits: status.commits ?? 0
+				} : {},
+				...report ? { report } : {}
+			}
+		});
+	} catch {}
+	return finalRc;
+}
 async function executeImageRun(a) {
 	const { logDir, target, model, label, parsed } = a;
 	if (!parsed.headless || parsed.prompt === null) throw new Error(`provider "${target.providerName}" (engine image) supports headless runs only: pass the task with -p '<prompt>'`);
@@ -3365,6 +3542,14 @@ async function executeImageRun(a) {
 		capability: a.capability,
 		...a.specPath ? { spec: a.specPath } : {}
 	});
+	const imageEnd = {
+		provider: target.providerName,
+		mode: "headless",
+		engine: "image",
+		model,
+		label,
+		capability: a.capability
+	};
 	const t0 = Date.now();
 	try {
 		const result = await runImageCapability({
@@ -3377,46 +3562,61 @@ async function executeImageRun(a) {
 			timeoutMs: a.timeoutMs
 		});
 		const secs = Math.round((Date.now() - t0) / 1e3);
-		status.state = "done";
-		status.rc = 0;
-		status.secs = secs;
 		status.last = `wrote ${result.path}`;
-		saveStatus(logDir, status);
-		appendLedger(ledger, "WORKER-END", {
-			id: wid,
-			provider: target.providerName,
-			mode: "headless",
-			engine: "image",
-			model,
+		return await finaliseRun({
+			logDir,
+			ledger,
+			status,
+			ok: true,
 			rc: 0,
 			secs,
-			label,
-			capability: a.capability
+			end: imageEnd,
+			report: null,
+			beforeHandoff: () => {
+				if (!a.quiet) process.stdout.write(JSON.stringify(result) + "\n");
+			}
 		});
-		if (!a.quiet) process.stdout.write(JSON.stringify(result) + "\n");
-		return 0;
 	} catch (e) {
 		const secs = Math.round((Date.now() - t0) / 1e3);
-		const message = e instanceof Error ? e.message : String(e);
-		status.state = "failed";
-		status.rc = 1;
-		status.secs = secs;
-		status.last = message;
-		saveStatus(logDir, status);
-		appendLedger(ledger, "WORKER-END", {
-			id: wid,
-			provider: target.providerName,
-			mode: "headless",
-			engine: "image",
-			model,
+		status.last = e instanceof Error ? e.message : String(e);
+		await finaliseRun({
+			logDir,
+			ledger,
+			status,
+			ok: false,
 			rc: 1,
 			secs,
-			label,
-			capability: a.capability
+			end: imageEnd,
+			report: null
 		});
 		throw e;
 	}
 }
+/**
+* Follow pane, made observable on stderr (stdout stays pure JSON for
+* `--output-format json`): one line naming the outcome — opened, skipped
+* (with reason), or failed (with reason, alongside the existing PANE-FAIL
+* ledger line). Fire-and-forget, never blocks the worker.
+*/
+async function announcePane(logDir, config, wid, term, noPane, ledger) {
+	const skip = !noPane ? !config.pane.enabled ? "workers.pane.enabled is false" : process.env.PAI_WORKER_AUTOPANE === "0" ? "PAI_WORKER_AUTOPANE=0" : !term ? "not in iTerm2 (no ITERM_SESSION_ID)" : null : "--no-pane";
+	if (skip) {
+		process.stderr.write(`[pai worker] no pane for ${wid}: ${skip}\n`);
+		return;
+	}
+	try {
+		const r = await openPaneForWorker(logDir, config, wid, term);
+		const suffix = r.session ? ` (iTerm session ${r.session})` : "";
+		process.stderr.write(`[pai worker] pane opened for ${wid}${suffix}\n`);
+	} catch (e) {
+		const message = e instanceof Error ? e.message : String(e);
+		process.stderr.write(`[pai worker] no pane for ${wid}: ${message.slice(0, 200)}\n`);
+		appendLedger(ledger, "PANE-FAIL", {
+			id: wid,
+			error: message.slice(0, 200)
+		});
+	}
+}
 async function executeRun(a) {
 	const { config, logDir, target, model, label, parsed, noPane } = a;
 	const headless = parsed.headless;
@@ -3548,12 +3748,7 @@ async function executeRun(a) {
 		...a.capability ? { capability: a.capability } : {},
 		...a.specPath ? { spec: a.specPath } : {}
 	});
-	if (headless && !noPane && config.pane.enabled && term && process.env.PAI_WORKER_AUTOPANE !== "0") openPaneForWorker(logDir, config, wid, term).catch((e) => {
-		appendLedger(ledger, "PANE-FAIL", {
-			id: wid,
-			error: (e instanceof Error ? e.message : String(e)).slice(0, 200)
-		});
-	});
+	if (headless) announcePane(logDir, config, wid, term, noPane, ledger);
 	const t0 = Date.now();
 	const proc = spawn(cmd[0], cmd.slice(1), {
 		env,
@@ -3706,9 +3901,6 @@ async function executeRun(a) {
 	const secs = Math.floor((Date.now() - t0) / 1e3);
 	const resultEvent = ctx.resultEvent;
 	const ok = runSucceeded(headless, rc, resultEvent);
-	status.state = ok ? "done" : "failed";
-	status.rc = rc;
-	status.secs = secs;
 	if (resultEvent) status.last = shortText(resultEvent.result ?? "", 90);
 	if (ctx.resultReport?.notes) status.last = shortText(ctx.resultReport.notes, 90);
 	if (headless && a.reportFormat === "ag2" && resultEvent?.result) {
@@ -3760,66 +3952,55 @@ async function executeRun(a) {
 			});
 		}
 	}
-	saveStatus(logDir, status);
-	appendLedger(ledger, "WORKER-END", {
-		id: wid,
-		provider: target.providerName,
-		mode: headless ? "headless" : "interactive",
-		model,
+	return finaliseRun({
+		logDir,
+		ledger,
+		status,
+		ok,
 		rc,
 		secs,
-		turns: status.turns,
-		tools: status.tools,
-		label
-	});
-	if (worktree) status = recordWorktree(logDir, status, worktree, ok);
-	if (headless && !a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, ctx.resultReport, worktreeExtras(status));
-	const resultText = resultEvent?.result ?? "";
-	if (!ok && headless && a.target.via === "auto" && config.routing.retryOnQuota && status.turns <= 1 && status.tools === 0 && isQuotaFailure(resultText)) {
-		setCooldown(logDir, target.providerName, config.routing.cooldownMinutes);
-		const next = nextAutoProvider(config, logDir, target.providerName);
-		if (next && a.reroutes < config.routing.order.length) {
-			appendLedger(ledger, "WORKER-REROUTE", {
-				from: target.providerName,
-				to: next,
-				reason: "quota"
-			});
-			return runWorker({
-				providerFlag: next,
-				label,
-				noPane: a.noPane,
-				mcpFlag: a.mcpFlag,
-				cwd: a.cwd,
-				specPath: a.specPath,
-				parent: a.parent,
-				stage: a.stage,
-				claudeArgs: a.claudeArgs,
-				onWorkerStart: a.onWorkerStart,
-				worktreeFlag: a.worktreeFlag,
-				className: a.className,
-				_reroutes: a.reroutes + 1
-			});
-		}
-	}
-	const finalRc = rc !== 0 ? rc : ok ? 0 : 1;
-	if (status.parent && isWorkerId(logDir, status.parent)) try {
-		await deliverHandoff(logDir, {
-			from: wid,
-			to: status.parent,
-			kind: "result",
-			text: shortText(ctx.resultReport?.notes ?? resultEvent?.result ?? (ok ? "done" : "failed"), 400),
-			data: {
-				rc: finalRc,
-				ok,
-				...status.branch ? {
-					branch: status.branch,
-					commits: status.commits ?? 0
-				} : {},
-				...ctx.resultReport ? { report: ctx.resultReport } : {}
+		end: {
+			provider: target.providerName,
+			mode: headless ? "headless" : "interactive",
+			model,
+			turns: status.turns,
+			tools: status.tools,
+			label
+		},
+		report: ctx.resultReport,
+		fallbackText: resultEvent?.result,
+		worktree,
+		beforeHandoff: async (st, rep) => {
+			if (headless && !a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, rep, worktreeExtras(st));
+			const resultText = resultEvent?.result ?? "";
+			if (!ok && headless && a.target.via === "auto" && config.routing.retryOnQuota && status.turns <= 1 && status.tools === 0 && isQuotaFailure(resultText)) {
+				setCooldown(logDir, target.providerName, config.routing.cooldownMinutes);
+				const next = nextAutoProvider(config, logDir, target.providerName);
+				if (next && a.reroutes < config.routing.order.length) {
+					appendLedger(ledger, "WORKER-REROUTE", {
+						from: target.providerName,
+						to: next,
+						reason: "quota"
+					});
+					return runWorker({
+						providerFlag: next,
+						label,
+						noPane: a.noPane,
+						mcpFlag: a.mcpFlag,
+						cwd: a.cwd,
+						specPath: a.specPath,
+						parent: a.parent,
+						stage: a.stage,
+						claudeArgs: a.claudeArgs,
+						onWorkerStart: a.onWorkerStart,
+						worktreeFlag: a.worktreeFlag,
+						className: a.className,
+						_reroutes: a.reroutes + 1
+					});
+				}
 			}
-		});
-	} catch {}
-	return finalRc;
+		}
+	});
 }
 /** The worktree fields printResult adds to a json payload, when there is one. */
 function worktreeExtras(s) {
@@ -3944,12 +4125,7 @@ async function executeCodexRun(a) {
 		id: wid,
 		note: `dropped for codex: ${dropped.join(", ")}`
 	});
-	if (!noPane && config.pane.enabled && term && process.env.PAI_WORKER_AUTOPANE !== "0") openPaneForWorker(logDir, config, wid, term).catch((e) => {
-		appendLedger(ledger, "PANE-FAIL", {
-			id: wid,
-			error: (e instanceof Error ? e.message : String(e)).slice(0, 200)
-		});
-	});
+	announcePane(logDir, config, wid, term, noPane, ledger);
 	const t0 = Date.now();
 	const proc = spawn("codex", buildCodexArgs(prompt, parsed.callerModel ? void 0 : model), {
 		env,
@@ -4028,9 +4204,6 @@ async function executeCodexRun(a) {
 	};
 	writeEvent(resultEvent);
 	const ok = rc === 0 && !fold.isError;
-	status.state = ok ? "done" : "failed";
-	status.rc = rc;
-	status.secs = secs;
 	status.last = shortText(report?.notes ?? finalText, 90) || (ok ? "done" : "failed");
 	if (report?.changed?.length) {
 		const verify = verifyReportChanges(report.changed, worktree?.dir ?? cwd, t0);
@@ -4046,40 +4219,29 @@ async function executeCodexRun(a) {
 			});
 		}
 	}
-	saveStatus(logDir, status);
-	appendLedger(ledger, "WORKER-END", {
-		id: wid,
-		provider: target.providerName,
-		mode: "headless",
-		engine: "codex",
-		model,
+	return finaliseRun({
+		logDir,
+		ledger,
+		status,
+		ok,
 		rc,
 		secs,
-		turns: status.turns,
-		tools: status.tools,
-		label
+		end: {
+			provider: target.providerName,
+			mode: "headless",
+			engine: "codex",
+			model,
+			turns: status.turns,
+			tools: status.tools,
+			label
+		},
+		report,
+		fallbackText: finalText,
+		worktree,
+		beforeHandoff: (st, rep) => {
+			if (!a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, rep, worktreeExtras(st));
+		}
 	});
-	if (worktree) status = recordWorktree(logDir, status, worktree, ok);
-	if (!a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, report, worktreeExtras(status));
-	const finalRc = rc !== 0 ? rc : ok ? 0 : 1;
-	if (status.parent && isWorkerId(logDir, status.parent)) try {
-		await deliverHandoff(logDir, {
-			from: wid,
-			to: status.parent,
-			kind: "result",
-			text: shortText(report?.notes ?? finalText ?? (ok ? "done" : "failed"), 400),
-			data: {
-				rc: finalRc,
-				ok,
-				...status.branch ? {
-					branch: status.branch,
-					commits: status.commits ?? 0
-				} : {},
-				...report ? { report } : {}
-			}
-		});
-	} catch {}
-	return finalRc;
 }
 function printResult(fmt, resultEvent, rc, logDir, wid, report, extras) {
 	if (fmt === "stream-json") return;
@@ -4213,4 +4375,4 @@ function resultFromOutput(out) {
 
 //#endregion
 export { UNLABELED as A, newWorkerId as B, workerInScope as C, worktreesDir as D, mergeWorker as E, elapsedOf as F, waitForTerminalStatus as G, ownsPid as H, isChatPane as I, shortText as J, longInlinePromptHint as K, isLive as L, alive as M, contextLabel as N, appendLedger as O, contextPercent as P, loadStatus as R, sessionTag as S, git as T, saveStatus as U, nowStamp as V, setWorkerLabel as W, expandMcpNames as X, describeMcp as Y, currentTabKey as _, projectLaunchConfig as a, resolveSession as b, handoffFromInside as c, workerDepth as d, checkPaneForWorker as f, markControlsHeld as g, clickrControlsArgv as h, usageContextTokens as i, ageOf as j, ledgerSummary as k, readInbox as l, openPaneForWorker as m, runWorker as n, parseWorkerReport as o, openFollowPane as p, parseRunnerArgs as q, testProvider as r, renderReport as s, printResult as t, sayToWorker as u, itermForClaudeSession as v, discardWorker as w, sessionMapPath as x, itermUuid as y, loadStatuses as z };
-//# sourceMappingURL=run-BFxuNnIJ.mjs.map
+//# sourceMappingURL=run-CxxZKEZw.mjs.map