@tekmidian/pai 0.60.1 → 0.62.0

package/dist/{run-FeM1_UVa.mjs → run-BVQZI79D.mjs}

@@ -1,9 +1,9 @@
-import { i as getRegistryBackend } from "./factory-EUUhSSoq.mjs";
-import { D as resolveModelCapability, O as resolveProviderKey, T as readWorkersSection, h as classModelCapability, m as assertProviderRunnable, n as claudeCommand, p as WorkersConfigError, t as buildRunEnv, w as providerKeyPath, y as isModelCapability } from "./run-env-CEHTeIUM.mjs";
-import { _ as statusPath, d as resolveTarget, f as setCooldown, g as panesDir, h as ledgerPath, i as capabilityForRun, m as eventsPath, n as ensureProxyRunning, o as isQuotaFailure, p as ensureNoMcpConfig, s as nextAutoProvider, t as DEFAULT_PROXY_PORT, u as resolveCapabilityRun, v as workersLogDir } from "./server-CekGOJcp.mjs";
-import { appendFileSync, closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { i as getRegistryBackend } from "./factory-BozZa81q.mjs";
+import { E as readWorkersSection, O as resolveModelCapability, T as providerKeyPath, b as isModelCapability, d as NATIVE_ANTHROPIC_MODELS, g as classModelCapability, h as assertProviderRunnable, k as resolveProviderKey, m as WorkersConfigError, n as claudeCommand, t as buildRunEnv } from "./run-env-BE5xyCwy.mjs";
+import { _ as statusPath, d as resolveTarget, f as setCooldown, g as panesDir, h as ledgerPath, i as capabilityForRun, m as eventsPath, n as ensureProxyRunning, o as isQuotaFailure, p as ensureNoMcpConfig, s as nextAutoProvider, t as DEFAULT_PROXY_PORT, u as resolveCapabilityRun, v as workersLogDir } from "./server-BY6AedmC.mjs";
+import { appendFileSync, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { homedir, platform, tmpdir } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { execFileSync, spawn } from "node:child_process";
 import { connect, createServer } from "node:net";
 import { createInterface } from "node:readline";
@@ -336,9 +336,10 @@ function saveStatus(logDir, status, d = /* @__PURE__ */ new Date()) {
 	const path = statusPath(logDir, status.id);
 	const baseline = firstWrittenLabel.get(status.id);
 	if (baseline === void 0) firstWrittenLabel.set(status.id, status.label);
-	else if (status.label === baseline) {
-		const onDisk = loadStatus(logDir, status.id);
-		if (onDisk && onDisk.label !== status.label) status.label = onDisk.label;
+	const onDisk = baseline === void 0 ? void 0 : loadStatus(logDir, status.id);
+	if (onDisk) {
+		if (status.label === baseline && onDisk.label !== status.label) status.label = onDisk.label;
+		if (onDisk.controlsHeld) status.controlsHeld = true;
 	}
 	const tmp = statusTmpPath(logDir, status.id);
 	if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
@@ -597,7 +598,7 @@ function worktreePath(logDir, id) {
 	return join(worktreesDir(logDir), id);
 }
 /** Run git in `cwd` with an optional env override, trimmed stdout, stderr on failure. */
-function runGit(cwd, args, env) {
+function runGit(cwd, args, env, timeout = 3e4) {
 	try {
 		return execFileSync("git", [
 			"-C",
@@ -605,7 +606,7 @@ function runGit(cwd, args, env) {
 			...args
 		], {
 			encoding: "utf8",
-			timeout: 3e4,
+			timeout,
 			stdio: [
 				"ignore",
 				"pipe",
@@ -620,8 +621,8 @@ function runGit(cwd, args, env) {
 	}
 }
 /** Run git in `cwd`, returning trimmed stdout; throws with stderr on failure. */
-function git(cwd, args) {
-	return runGit(cwd, args);
+function git(cwd, args, timeoutMs) {
+	return runGit(cwd, args, void 0, timeoutMs);
 }
 /** Is `cwd` inside a git repository (a .git dir — worktrees: a .git file)? */
 function isGitRepo(cwd) {
@@ -631,30 +632,23 @@ function isGitRepo(cwd) {
 		return false;
 	}
 }
-/**
-* Does the prompt read as a read-only task? Writing classes default to a
-* worktree; a prompt that only asks to look at things should not pay for one.
-* First-word verbs plus the explicit markers people actually write.
-*/
-function promptLooksReadonly(prompt) {
-	const p = prompt.trim();
-	if (!p) return true;
-	const firstLine = p.split("\n", 1)[0];
-	if (/\b(read[- ]only|do not (modify|change|edit|write)|don'?t (modify|change|edit|write)|no changes)\b/i.test(firstLine)) return true;
-	return /^(review|read|analy[sz]e|research|summar[iy]|inspect|investigate|spotcheck|report|find|list|check|verify|describe|explain|show)\b/i.test(p);
-}
-/** The classes whose runs write files and therefore default to a worktree. */
-const WORKTREE_CLASSES = [
-	"implement",
-	"complex",
-	"plan"
+/** Tools that can write to the checkout (Bash can, via the shell). */
+const WRITING_TOOLS = [
+	"Edit",
+	"Write",
+	"MultiEdit",
+	"NotebookEdit",
+	"Bash"
 ];
-/** Should this run get a worktree? Explicit flag first, then the default rule. */
+/** Can a run with these --allowedTools write? No restriction at all means yes. */
+function toolsCanWrite(allowedTools) {
+	const names = allowedTools.flatMap((e) => e.split(",")).map((s) => s.trim().replace(/\(.*$/, "")).filter(Boolean);
+	return !names.length || names.some((n) => WRITING_TOOLS.includes(n));
+}
+/** Should this run get a worktree? Explicit flag first, then: can it write? */
 function worktreeWanted(flag, opts) {
 	if (flag !== void 0) return flag;
-	if (!opts.className || !WORKTREE_CLASSES.includes(opts.className)) return false;
-	if (!isGitRepo(opts.cwd)) return false;
-	return !promptLooksReadonly(opts.prompt ?? "");
+	return toolsCanWrite(opts.allowedTools) && isGitRepo(opts.cwd);
 }
 /**
 * Commit `cwd`'s current index + working tree (including untracked files) as
@@ -698,11 +692,6 @@ function snapshotUncommitted(cwd, id, head) {
 * degrade to an in-place run.
 */
 function addWorktree(logDir, id, cwd) {
-	const swept = sweepOrphanWorktrees(logDir);
-	if (swept.length) appendLedger(ledgerPath(logDir), "WORKER-NOTE", {
-		id,
-		note: `swept orphan worktree(s): ${swept.join(", ")}`
-	});
 	const dir = worktreePath(logDir, id);
 	const branch = worktreeBranch(id);
 	const head = git(cwd, ["rev-parse", "HEAD"]);
@@ -716,6 +705,7 @@ function addWorktree(logDir, id, cwd) {
 		branch,
 		base
 	]);
+	provisionDeps(logDir, id, cwd, dir);
 	return {
 		dir,
 		branch,
@@ -724,44 +714,60 @@ function addWorktree(logDir, id, cwd) {
 	};
 }
 /**
-* Remove worktrees (and their `worker/<id>` branches) whose worker no longer
-* exists — no status file left in the log dir. Killed and failed runs clean
-* up after themselves, but a `kill -9` or a crash strands a directory and a
-* branch; every worktree creation sweeps first so they cannot accumulate.
-* Directories younger than `minAgeMin` minutes are left alone: a run that is
-* just starting owns its worktree a moment before its status file exists.
+* Give the worktree its own dependencies so the worker never has to improvise
+* (symlinking node_modules to the main checkout, building in a /tmp copy).
+* A real node_modules directory in the main checkout is APFS-cloned
+* (`cp -c`, copy-on-write, near instant); elsewhere the lockfile installs it.
+* Never a symlink. Time-boxed and best effort: a failure is logged, the run
+* goes on.
 */
-function sweepOrphanWorktrees(logDir, minAgeMin = 10) {
-	const root = worktreesDir(logDir);
-	if (!existsSync(root)) return [];
-	const swept = [];
-	for (const ent of readdirSync(root, { withFileTypes: true })) {
-		if (!ent.isDirectory()) continue;
-		const id = ent.name;
-		const dir = join(root, id);
-		if (existsSync(statusPath(logDir, id))) continue;
-		try {
-			if ((Date.now() - statSync(dir).mtimeMs) / 6e4 < minAgeMin) continue;
-		} catch {}
-		let gitDir = null;
+function provisionDeps(logDir, id, cwd, wtDir) {
+	const note = (n) => appendLedger(ledgerPath(logDir), "WORKER-NOTE", {
+		id,
+		note: n
+	});
+	try {
+		const main = join(git(cwd, ["rev-parse", "--show-toplevel"]), "node_modules");
+		const dest = join(wtDir, "node_modules");
+		if (!existsSync(main) || lstatSync(main).isSymbolicLink() || existsSync(dest)) return;
 		try {
-			const raw = git(dir, ["rev-parse", "--git-common-dir"]);
-			gitDir = isAbsolute(raw) ? raw : resolve(dir, raw);
+			git(wtDir, [
+				"check-ignore",
+				"-q",
+				"node_modules"
+			]);
 		} catch {
-			gitDir = null;
+			return;
 		}
-		removeWorktree(gitDir ?? dir, dir, true);
-		if (gitDir) try {
-			git(gitDir, ["worktree", "prune"]);
-			git(gitDir, [
-				"branch",
-				"-D",
-				worktreeBranch(id)
-			]);
+		const t0 = Date.now();
+		const opts = {
+			cwd: wtDir,
+			stdio: "ignore",
+			timeout: 18e4
+		};
+		if (platform() === "darwin") try {
+			execFileSync("cp", [
+				"-cR",
+				main,
+				dest
+			], opts);
+			note(`node_modules cloned (apfs) in ${Date.now() - t0}ms`);
+			return;
+		} catch {
+			rmSync(dest, {
+				recursive: true,
+				force: true
+			});
+		}
+		if (existsSync(join(wtDir, "bun.lock"))) execFileSync("bun", ["install", "--frozen-lockfile"], opts);
+		else if (existsSync(join(wtDir, "package-lock.json"))) execFileSync("npm", ["ci"], opts);
+		else return;
+		note(`node_modules installed from lockfile in ${Date.now() - t0}ms`);
+	} catch (e) {
+		try {
+			note(`node_modules provisioning failed: ${e.message}`);
 		} catch {}
-		swept.push(id);
 	}
-	return swept;
 }
 /** Commits the branch collected on top of its base. */
 function commitsSince(dir, base) {
@@ -787,6 +793,12 @@ function recordWorktree(logDir, status, info, ok) {
 		s.worktreeDir = info.dir;
 		s.worktreeBase = info.base;
 		s.worktreeSnapshot = info.snapshot;
+	} else if (safeCommitsSince(info.dir, info.base) > 0) {
+		s.branch = info.branch;
+		s.commits = commitsSince(info.dir, info.base);
+		s.worktreeDir = info.dir;
+		s.worktreeBase = info.base;
+		s.worktreeSnapshot = info.snapshot;
 	} else {
 		removeWorktree(s.cwd, info.dir, true);
 		try {
@@ -805,6 +817,37 @@ function recordWorktree(logDir, status, info, ok) {
 	saveStatus(logDir, s);
 	return s;
 }
+function safeCommitsSince(dir, base) {
+	try {
+		return commitsSince(dir, base);
+	} catch {
+		return 0;
+	}
+}
+/**
+* Salvage for an exit path (run finaliser, kill signal): commit whatever the
+* worker left uncommitted, log WORKER-SALVAGE, never throw. Bounded by
+* `timeoutMs` per git call. Returns the committed paths.
+*/
+function salvageOnExit(ledger, id, label, wtDir, timeoutMs) {
+	try {
+		const { committed, skipped } = salvageUncommitted(wtDir, label, timeoutMs);
+		if (committed.length) appendLedger(ledger, "WORKER-SALVAGE", {
+			id,
+			paths: committed.join(","),
+			skipped: skipped.length
+		});
+		return committed;
+	} catch (e) {
+		try {
+			appendLedger(ledger, "WORKER-NOTE", {
+				id,
+				note: `salvage failed: ${e.message}`
+			});
+		} catch {}
+		return [];
+	}
+}
 /** Remove a worktree directory from git's books and the filesystem. */
 function removeWorktree(cwd, dir, force) {
 	try {
@@ -830,41 +873,86 @@ function removeWorktree(cwd, dir, force) {
 * carry used; name-only, not porcelain: a worktree-only change renders as
 * " M path" and the shared git() helper trims that leading space away.
 */
-function uncommittedPaths(wtDir) {
+function uncommittedPaths(wtDir, timeoutMs) {
 	const tracked = git(wtDir, [
 		"diff",
 		"--name-only",
 		"HEAD"
-	]).split("\n").filter(Boolean);
+	], timeoutMs).split("\n").filter(Boolean);
 	const untracked = git(wtDir, [
 		"ls-files",
 		"--others",
 		"--exclude-standard"
-	]).split("\n").filter(Boolean);
+	], timeoutMs).split("\n").filter(Boolean);
 	return [...tracked, ...untracked];
 }
 /**
+* True when `wtDir`/`relPath` is a symlink whose target resolves outside
+* `wtDir` — e.g. a worker's `node_modules -> <main checkout>/node_modules`
+* convenience link. A `.gitignore` using `dir/` (directories only) does not
+* ignore such a link, so it turns up as untracked; staging and merging it
+* lets git replace the real directory on the other side with a symlink to
+* itself. Never a candidate for salvage.
+*/
+function symlinkEscapesWorktree(wtDir, relPath) {
+	const full = join(wtDir, relPath);
+	let stat;
+	try {
+		stat = lstatSync(full);
+	} catch {
+		return false;
+	}
+	if (!stat.isSymbolicLink()) return false;
+	const target = readlinkSync(full);
+	const resolvedTarget = isAbsolute(target) ? target : resolve(dirname(full), target);
+	const realTarget = existsSync(resolvedTarget) ? realpathSync(resolvedTarget) : resolvedTarget;
+	const realWtDir = realpathSync(wtDir);
+	return realTarget !== realWtDir && !realTarget.startsWith(realWtDir + sep);
+}
+/**
 * Commit a worktree's uncommitted changes to its branch so the merge carries
 * them. `git merge` only moves committed work, so a worker that stopped
 * without committing would lose its edits to `worktree remove` — exactly
-* what happened live on 2026-09-17. Returns the salvaged paths, [] when the
-* worktree is clean. A failed commit throws with the worktree untouched:
+* what happened live on 2026-09-17. Returns the salvaged paths, empty when
+* the worktree is clean. A symlink pointing outside the worktree (see
+* `symlinkEscapesWorktree`) is never staged; it is left on disk and reported
+* as skipped instead. A failed commit throws with the worktree untouched:
 * its edits are still on disk, so nothing is lost.
 */
-function salvageUncommitted(wtDir, label) {
-	const paths = uncommittedPaths(wtDir);
-	if (!paths.length) return [];
+function salvageUncommitted(wtDir, label, timeoutMs) {
+	const paths = uncommittedPaths(wtDir, timeoutMs);
+	if (!paths.length) return {
+		committed: [],
+		skipped: []
+	};
+	const skipped = [];
+	const toStage = [];
+	for (const p of paths) if (symlinkEscapesWorktree(wtDir, p)) skipped.push(`symlink ${p} -> ${readlinkSync(join(wtDir, p))} (points outside the worktree)`);
+	else toStage.push(p);
+	if (!toStage.length) return {
+		committed: [],
+		skipped
+	};
 	try {
-		git(wtDir, ["add", "-A"]);
+		git(wtDir, [
+			"add",
+			"-A",
+			"--",
+			".",
+			...paths.filter((p) => !toStage.includes(p)).map((p) => `:(exclude,literal)${p}`)
+		], timeoutMs);
 		git(wtDir, [
 			"commit",
 			"-m",
 			`salvaged: ${label}`
-		]);
+		], timeoutMs);
 	} catch (e) {
 		throw new Error(`cannot salvage the uncommitted changes in ${wtDir} — ${e.message}; nothing was lost: commit them there by hand, then re-run merge`);
 	}
-	return paths;
+	return {
+		committed: toStage,
+		skipped
+	};
 }
 /**
 * The dirty paths of a checkout, parsed from `git status --porcelain -z`:
@@ -915,9 +1003,14 @@ function assertNoDirtyOverlap(cwd, incoming, id, branch) {
 	if (!overlap.length) return;
 	throw new Error(`worker ${id}: the checkout ${cwd} has uncommitted changes in paths ${branch} touches: ${overlap.join(", ")}. Commit or stash them in the checkout, then re-run: pai worker merge ${id}. No merge was made; the worktree was kept.`);
 }
-/** Never remove a worktree that still holds uncommitted changes. */
+/**
+* Never remove a worktree that still holds uncommitted changes — except a
+* symlink escaping the worktree (see `symlinkEscapesWorktree`): it was
+* deliberately left uncommitted by `salvageUncommitted`, and deleting the
+* link itself touches nothing outside the worktree.
+*/
 function assertWorktreeClean(wtDir, id) {
-	const leftover = uncommittedPaths(wtDir);
+	const leftover = uncommittedPaths(wtDir).filter((p) => !symlinkEscapesWorktree(wtDir, p));
 	if (leftover.length) throw new Error(`worker ${id}: the worktree ${wtDir} still holds uncommitted changes (${leftover.join(", ")}) — it was NOT removed; commit or copy them by hand, then re-run merge`);
 }
 /** Blob sha of `path` at `rev` in `cwd`, or null when it does not exist there. */
@@ -971,7 +1064,10 @@ function mergeSnapshotWorker(logDir, id, st) {
 	const snapshot = st.worktreeBase;
 	const branch = st.branch;
 	const worktreeDir = st.worktreeDir;
-	const salvaged = existsSync(worktreeDir) ? salvageUncommitted(worktreeDir, st.label || UNLABELED) : [];
+	const salvage = existsSync(worktreeDir) ? salvageUncommitted(worktreeDir, st.label || UNLABELED) : {
+		committed: [],
+		skipped: []
+	};
 	if ((parseInt(git(st.cwd, [
 		"rev-list",
 		"--count",
@@ -1030,7 +1126,10 @@ function mergeSnapshotWorker(logDir, id, st) {
 		merged: true
 	});
 	const base = `applied worker ${id}'s changes (branch ${branch}) to ${st.cwd} as uncommitted changes: ${changedPaths.join(", ")} (worktree removed, branch deleted)`;
-	return salvaged.length ? `${base}; salvaged ${salvaged.length} uncommitted change(s) onto the branch first: ${salvaged.join(", ")}` : base;
+	const notes = [];
+	if (salvage.committed.length) notes.push(`salvaged ${salvage.committed.length} uncommitted change(s) onto the branch first: ${salvage.committed.join(", ")}`);
+	if (salvage.skipped.length) notes.push(`skipped ${salvage.skipped.join(", ")}`);
+	return notes.length ? `${base}; ${notes.join("; ")}` : base;
 }
 /**
 * `pai worker merge <id>`: salvage whatever the worker left uncommitted onto
@@ -1045,7 +1144,10 @@ function mergeWorker(logDir, id) {
 	const st = mustHaveBranch(logDir, id);
 	if (st.merged) return `worker ${id}: branch ${st.branch} already merged`;
 	if (st.worktreeSnapshot) return mergeSnapshotWorker(logDir, id, st);
-	const salvaged = existsSync(st.worktreeDir) ? salvageUncommitted(st.worktreeDir, st.label || UNLABELED) : [];
+	const salvage = existsSync(st.worktreeDir) ? salvageUncommitted(st.worktreeDir, st.label || UNLABELED) : {
+		committed: [],
+		skipped: []
+	};
 	if ((parseInt(git(st.cwd, [
 		"rev-list",
 		"--count",
@@ -1075,7 +1177,7 @@ function mergeWorker(logDir, id) {
 		throw new Error(`worker ${id}: git refused the merge of ${st.branch} — ${e.message}. The worktree ${st.worktreeDir} was kept: resolve the conflict, then re-run merge`);
 	}
 	if (existsSync(st.worktreeDir)) assertWorktreeClean(st.worktreeDir, id);
-	removeWorktree(st.cwd, st.worktreeDir, false);
+	removeWorktree(st.cwd, st.worktreeDir, true);
 	let branchGone = true;
 	try {
 		git(st.cwd, [
@@ -1091,7 +1193,10 @@ function mergeWorker(logDir, id) {
 		merged: true
 	});
 	const base = `merged ${st.branch} into ${st.cwd} (worktree removed${branchGone ? ", branch deleted" : "; branch kept: git refused -d"})`;
-	return salvaged.length ? `${base}; salvaged ${salvaged.length} uncommitted change(s): ${salvaged.join(", ")}` : base;
+	const notes = [];
+	if (salvage.committed.length) notes.push(`salvaged ${salvage.committed.length} uncommitted change(s): ${salvage.committed.join(", ")}`);
+	if (salvage.skipped.length) notes.push(`skipped ${salvage.skipped.join(", ")}`);
+	return notes.length ? `${base}; ${notes.join("; ")}` : base;
 }
 /** `pai worker discard <id>`: drop worktree and branch, keep nothing. */
 function discardWorker(logDir, id) {
@@ -1154,6 +1259,139 @@ function inPlaceSystemPrompt() {
 		"Read-only git (status, diff, log, show, stash list) is fine."
 	].join("\n");
 }
+const GC_STAMP = "gc-last";
+/**
+* Archive worktrees of finished workers older than `olderThanHours` and
+* status-less orphan directories: uncommitted state is salvaged onto the
+* branch, the branch is x, the worktree is
+* removed. Nothing is deleted without a salvage first; a failed salvage skips
+* that worktree. Running workers are never touched. `dryRun` reports only.
+*/
+function gcWorktrees(logDir, olderThanHours = 24, dryRun = false, now = Date.now()) {
+	const cutoff = now - olderThanHours * 36e5;
+	const out = [];
+	const root = worktreesDir(logDir);
+	const known = /* @__PURE__ */ new Set();
+	const archive = (id, dir, repo, st) => {
+		const target = `refs/pai-archive/${id}`;
+		if (dryRun) return void out.push({
+			id,
+			archive: target
+		});
+		try {
+			if (!repo) throw new Error("not a git worktree");
+			const label = `archive: leftover state of worker ${id}`;
+			if (uncommittedPaths(dir).length) {
+				const res = salvageUncommitted(dir, label);
+				if (res.committed.length) git(dir, [
+					"commit",
+					"--amend",
+					"-q",
+					"-m",
+					label
+				]);
+				if (res.skipped.length && uncommittedPaths(dir).some((p) => !symlinkEscapesWorktree(dir, p))) throw new Error("uncommitted paths remain");
+			}
+			const src = worktreeBranch(id);
+			let hasBranch = true;
+			try {
+				git(repo, [
+					"rev-parse",
+					"--verify",
+					"-q",
+					`refs/heads/${src}`
+				]);
+			} catch {
+				hasBranch = false;
+			}
+			const tip = git(dir, ["rev-parse", "HEAD"]);
+			if (hasBranch) git(repo, [
+				"merge-base",
+				"--is-ancestor",
+				`refs/heads/${src}`,
+				tip
+			]);
+			git(repo, [
+				"update-ref",
+				target,
+				tip
+			]);
+			git(repo, [
+				"worktree",
+				"remove",
+				"--force",
+				dir
+			]);
+			if (hasBranch) git(repo, [
+				"branch",
+				"-D",
+				src
+			]);
+			if (st) saveStatus(logDir, {
+				...st,
+				branch: null,
+				worktreeDir: null,
+				archived: target
+			});
+			appendLedger(ledgerPath(logDir), "WORKER-GC", {
+				id,
+				archive: target
+			});
+			out.push({
+				id,
+				archive: target
+			});
+		} catch (e) {
+			out.push({
+				id,
+				skipped: e.message.split("\n")[0]
+			});
+		}
+	};
+	for (const st of loadStatuses(logDir)) {
+		known.add(st.id);
+		if (!st.worktreeDir || !existsSync(st.worktreeDir) || isLive(st)) continue;
+		let end = 0;
+		try {
+			end = statSync(statusPath(logDir, st.id)).mtimeMs;
+		} catch {
+			continue;
+		}
+		if (end > cutoff) continue;
+		archive(st.id, st.worktreeDir, st.cwd, st);
+	}
+	if (existsSync(root)) for (const ent of readdirSync(root, { withFileTypes: true })) {
+		if (!ent.isDirectory() || known.has(ent.name) || existsSync(statusPath(logDir, ent.name))) continue;
+		const dir = join(root, ent.name);
+		try {
+			if (statSync(dir).mtimeMs > cutoff) continue;
+		} catch {
+			continue;
+		}
+		let repo = null;
+		try {
+			const raw = git(dir, ["rev-parse", "--git-common-dir"]);
+			repo = isAbsolute(raw) ? raw : resolve(dir, raw);
+		} catch {
+			repo = null;
+		}
+		archive(ent.name, dir, repo, null);
+	}
+	if (!dryRun) for (const repo of new Set(loadStatuses(logDir).map((s) => s.cwd))) try {
+		git(repo, ["worktree", "prune"]);
+	} catch {}
+	return out;
+}
+/** Run `gcWorktrees` at most once per `everyMin` minutes (stamp file in the logDir). */
+function gcWorktreesThrottled(logDir, everyMin = 60, now = Date.now()) {
+	const stamp = join(logDir, GC_STAMP);
+	try {
+		if (now - statSync(stamp).mtimeMs < everyMin * 6e4) return null;
+	} catch {}
+	mkdirSync(logDir, { recursive: true });
+	writeFileSync(stamp, String(now), "utf8");
+	return gcWorktrees(logDir, 24, false, now);
+}
 
 //#endregion
 //#region src/workers/scope.ts
@@ -1173,9 +1411,10 @@ function inPlaceSystemPrompt() {
 * If neither is available, viewers fall back to "all workers".
 *
 * A third case: workers spawned from a Claude Code Bash tool (the
-* orchestrator pattern) have neither — Claude Code exports no terminal or
-* session identity to its Bash children. Those record `spawnerSession`, the
-* orchestrator's claude session id bridged through the status line's
+* orchestrator pattern) inherit the orchestrator's `ITERM_SESSION_ID`, which
+* identifies the orchestrator's own pane, not a pane for the sub-worker —
+* so it does not key the sub-worker's tab. Those record `spawnerSession`,
+* the orchestrator's claude session id bridged through the status line's
 * session map (see below), so their tab still claims them.
 */
 const AIBROKER_REGISTRY = join(homedir(), ".aibroker", "session-names.json");
@@ -1897,7 +2136,10 @@ function absoluteCliPath() {
 }
 /** Open (or only report on) the stacked follow pane of one worker. */
 async function openPaneForWorker(logDir, config, wid, term) {
-	if (workerPaneOpen(wid)) return `pane for ${wid} already open`;
+	if (workerPaneOpen(wid)) return {
+		message: `pane for ${wid} already open`,
+		session: null
+	};
 	const uid = itermUuid(term);
 	const regPath = join(panesDir(logDir), `${scopeKey(term)}.json`);
 	const reg = loadRegistry(regPath);
@@ -1921,7 +2163,10 @@ async function openPaneForWorker(logDir, config, wid, term) {
 		opened: (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19)
 	});
 	saveRegistry(regPath, pruned);
-	return `pane opened for ${wid}`;
+	return {
+		message: `pane opened for ${wid}`,
+		session: out.slice(bar + 1)
+	};
 }
 /**
 * One `--check` line with the bounds of the window hosting `term`'s iTerm
@@ -2041,6 +2286,34 @@ function launchParent(explicit, env = process.env) {
 function isWorkerId(logDir, id) {
 	return loadStatus(logDir, id) !== null;
 }
+/**
+* A worker owns its children's results (the worker contract says so): if
+* `parent` exits leaving sub-workers unaccounted for, its own run must not
+* report success. Two shapes count, both read off `runningChildren` and the
+* raw statuses, never a second live-child lookup:
+*
+*   - still live: left running untouched (killing another process's work
+*     here would be its own bug) but named in the reason.
+*   - marked "running" with a dead pid (the child never got to write its own
+*     terminal state before its parent vanished from under it): finalised
+*     here as failed, so `ps` stops showing a corpse as live.
+*
+* Returns the reason string for the parent's own report, or null when every
+* child it started is accounted for.
+*/
+function checkOrphanedChildren(logDir, parent) {
+	const statuses = loadStatuses(logDir);
+	const live = runningChildren(statuses, parent);
+	const abandoned = statuses.filter((s) => s.parent === parent && s.state === "running" && !isLive(s));
+	for (const child of abandoned) saveStatus(logDir, {
+		...child,
+		state: "failed",
+		last: `parent ${parent} exited`
+	});
+	const ids = [...live, ...abandoned].map((s) => s.id);
+	if (!ids.length) return null;
+	return `exited with ${ids.length} sub-worker${ids.length === 1 ? "" : "s"} still running (${ids.join(", ")}); they were not waited for — run children in the foreground or wait for them before finishing`;
+}
 
 //#endregion
 //#region src/workers/operator.ts
@@ -2283,6 +2556,16 @@ function ag2Spec() {
 	return cachedSpec;
 }
 /**
+* Strip what workers wrap around a report: one surrounding ``` fence (opening
+* line may carry a language tag) and a leading `[YYYY-MM-DD HH:MM]` stamp line.
+*/
+function unwrapAg2(text) {
+	let t = (text ?? "").trim();
+	const fenced = t.match(/^```[^\n]*\n([\s\S]*?)\n?```$/);
+	if (fenced) t = fenced[1].trim();
+	return t.replace(/^\[\d{4}-\d{2}-\d{2}[^\]\n]*\][ \t]*\n/, "").trim();
+}
+/**
 * Parse one AG2 message: first non-empty line is the kind (T R S Q A X,
 * optionally followed by trailing text — only the first character is the
 * kind), later lines are `key=value` or `@n=path` symbol declarations.
@@ -2298,7 +2581,7 @@ function parseAg2Report(text) {
 		"A",
 		"X"
 	]);
-	const lines = (text ?? "").split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("```"));
+	const lines = unwrapAg2(text).split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("```"));
 	if (!lines.length) return null;
 	const kind = lines[0][0];
 	if (!kinds.has(kind)) return null;
@@ -2342,11 +2625,17 @@ function ag2ToWorkerReport(parsed) {
 			summary: entry.slice(cut + 1).trim()
 		};
 	});
-	if (f.t) out.checks = f.t.split(/\s+/).filter(Boolean).map((entry) => ({
-		name: entry.slice(0, -1),
-		ok: passed(entry),
-		detail: entry.slice(-1)
-	}));
+	if (f.t) {
+		const tokens = f.t.split(/\s+/).filter(Boolean);
+		out.checks = tokens.length > 0 && tokens.every((tok) => /^\S+[+\-~?!]$/.test(tok)) ? tokens.map((entry) => ({
+			name: entry.slice(0, -1),
+			ok: passed(entry),
+			detail: entry.slice(-1)
+		})) : [{
+			name: "tests",
+			detail: f.t
+		}];
+	}
 	if (f.p) out.commands = f.p.split("|").map((s) => s.trim()).filter(Boolean);
 	const open = [];
 	if (f.x) open.push(f.x);
@@ -2372,7 +2661,7 @@ function validateAg2(text) {
 			"-",
 			"--json"
 		], {
-			input: text,
+			input: unwrapAg2(text),
 			timeout: 5e3,
 			stdio: [
 				"pipe",
@@ -2600,7 +2889,7 @@ function renderReport(c, prefix, r, cwd = "") {
 	if (has(r.checks)) {
 		out.push(`${prefix}${c("bold", "checks")}`);
 		for (const ck of r.checks) {
-			const mark = ck.ok === false ? c("red", "✗") : c("green", "✓");
+			const mark = ck.ok === false ? c("red", "✗") : ck.ok === true ? c("green", "✓") : c("dim", "·");
 			const detail = ck.detail ? c("dim", ` · ${shortText(ck.detail, 80)}`) : "";
 			out.push(`${prefix}  ${mark} ${ck.name ?? "?"}${detail}`);
 		}
@@ -3012,16 +3301,22 @@ function toolResultFailed(block) {
 	const m = toolResultText(block.content).match(/Exit code (\d+)/);
 	return m !== null && Number(m[1]) !== 0;
 }
+/** CLI aliases the built-in provider hands to `--model` (NATIVE_ANTHROPIC_MODELS'
+*  values): a bare name like "sonnet", not a concrete id, so the init event's
+*  resolved id is always the more useful thing to display. */
+const NATIVE_MODEL_ALIASES = new Set(Object.values(NATIVE_ANTHROPIC_MODELS));
 /**
 * The model the init event announces, adopted into the status when the spawn
 * could not name one (a caller that passed `--model` itself in the claude
-* args, or a provider whose table has no entry for the capability). The run's
-* real model is then only knowable from the first event it sends. Never
-* overwrites an explicit model — a resolved or pinned model stays the
+* args, or a provider whose table has no entry for the capability) or named
+* only a CLI alias (the built-in provider's "sonnet"/"haiku", which tracks
+* whatever release is current — the init event says which one actually ran).
+* The run's real model is then only knowable from the first event it sends.
+* Never overwrites a concrete resolved or pinned model — that stays the
 * recorded truth.
 */
 function adoptInitModel(status, e) {
-	if (status.model) return;
+	if (status.model && !NATIVE_MODEL_ALIASES.has(status.model)) return;
 	const m = (e.model ?? "").trim();
 	if (m) status.model = m;
 }
@@ -3115,8 +3410,12 @@ async function runWorker(opts) {
 	if (!config.enabled) throw new Error("workers are off. Turn them on with: pai worker on\n(then the Agent-tool hook stops denying Anthropic subagents only when you do)");
 	const logDir = workersLogDir(config);
 	mkdirSync(logDir, { recursive: true });
+	try {
+		const gc = gcWorktreesThrottled(logDir)?.filter((r) => r.archive);
+		if (gc?.length) process.stderr.write(`pai worker: archived ${gc.length} leftover worktree(s) (pai worker gc)\n`);
+	} catch {}
 	if (opts.className === "plan" && !opts._planner) {
-		const { runPlanner } = await import("./planner-DN967Lvm.mjs");
+		const { runPlanner } = await import("./planner-BG9ivPj0.mjs");
 		return runPlanner(opts);
 	}
 	const parent = launchParent(opts.parent);
@@ -3320,6 +3619,75 @@ function interactiveMcpTools(explicitMcp, callerTools, projectLaunch) {
 		tools: !callerTools && projectLaunch?.tools?.length ? projectLaunch.tools : []
 	};
 }
+/**
+* The finalisation every engine shares: orphaned-children check, state, the
+* WORKER-END ledger line, worktree outcome, parent handoff, final rc. A worker
+* owns its children's results (the worker contract says so): if it
+* backgrounded a sub-worker and exited without waiting, the run must not
+* report success, whatever the process returned.
+*/
+/** Per-git-call bound for the salvage a kill signal runs before exiting. */
+const SIGNAL_SALVAGE_MS = 5e3;
+async function finaliseRun(f) {
+	const { logDir, ledger, ok, rc } = f;
+	let { status, report } = f;
+	const wid = status.id;
+	const salvaged = f.worktree ? salvageOnExit(ledger, wid, status.label || UNLABELED, f.worktree.dir) : [];
+	if (salvaged.length) {
+		const msg = `WORKER-SALVAGE: committed uncommitted edits (${salvaged.join(", ")})`;
+		report = {
+			...report ?? {},
+			notes: [report?.notes ?? f.fallbackText, msg].filter(Boolean).join("\n"),
+			result: report?.result ?? "-"
+		};
+	}
+	const orphanReason = checkOrphanedChildren(logDir, wid);
+	const succeeded = ok && !orphanReason;
+	status.state = succeeded ? "done" : "failed";
+	status.rc = rc;
+	status.secs = f.secs;
+	if (orphanReason) {
+		status.last = shortText(orphanReason, 90);
+		report = {
+			...report ?? {},
+			notes: orphanReason,
+			result: "-"
+		};
+		appendLedger(ledger, "WORKER-ORPHAN-CHILDREN", {
+			id: wid,
+			reason: orphanReason
+		});
+	}
+	saveStatus(logDir, status);
+	appendLedger(ledger, "WORKER-END", {
+		id: wid,
+		...f.end,
+		rc,
+		secs: f.secs
+	});
+	if (f.worktree) status = recordWorktree(logDir, status, f.worktree, ok);
+	const early = await f.beforeHandoff?.(status, report);
+	if (typeof early === "number") return early;
+	const finalRc = rc !== 0 ? rc : succeeded ? 0 : 1;
+	if (status.parent && isWorkerId(logDir, status.parent)) try {
+		await deliverHandoff(logDir, {
+			from: wid,
+			to: status.parent,
+			kind: "result",
+			text: shortText(report?.notes ?? f.fallbackText ?? (succeeded ? "done" : "failed"), 400),
+			data: {
+				rc: finalRc,
+				ok: succeeded,
+				...status.branch ? {
+					branch: status.branch,
+					commits: status.commits ?? 0
+				} : {},
+				...report ? { report } : {}
+			}
+		});
+	} catch {}
+	return finalRc;
+}
 async function executeImageRun(a) {
 	const { logDir, target, model, label, parsed } = a;
 	if (!parsed.headless || parsed.prompt === null) throw new Error(`provider "${target.providerName}" (engine image) supports headless runs only: pass the task with -p '<prompt>'`);
@@ -3366,6 +3734,14 @@ async function executeImageRun(a) {
 		capability: a.capability,
 		...a.specPath ? { spec: a.specPath } : {}
 	});
+	const imageEnd = {
+		provider: target.providerName,
+		mode: "headless",
+		engine: "image",
+		model,
+		label,
+		capability: a.capability
+	};
 	const t0 = Date.now();
 	try {
 		const result = await runImageCapability({
@@ -3378,46 +3754,61 @@ async function executeImageRun(a) {
 			timeoutMs: a.timeoutMs
 		});
 		const secs = Math.round((Date.now() - t0) / 1e3);
-		status.state = "done";
-		status.rc = 0;
-		status.secs = secs;
 		status.last = `wrote ${result.path}`;
-		saveStatus(logDir, status);
-		appendLedger(ledger, "WORKER-END", {
-			id: wid,
-			provider: target.providerName,
-			mode: "headless",
-			engine: "image",
-			model,
+		return await finaliseRun({
+			logDir,
+			ledger,
+			status,
+			ok: true,
 			rc: 0,
 			secs,
-			label,
-			capability: a.capability
+			end: imageEnd,
+			report: null,
+			beforeHandoff: () => {
+				if (!a.quiet) process.stdout.write(JSON.stringify(result) + "\n");
+			}
 		});
-		if (!a.quiet) process.stdout.write(JSON.stringify(result) + "\n");
-		return 0;
 	} catch (e) {
 		const secs = Math.round((Date.now() - t0) / 1e3);
-		const message = e instanceof Error ? e.message : String(e);
-		status.state = "failed";
-		status.rc = 1;
-		status.secs = secs;
-		status.last = message;
-		saveStatus(logDir, status);
-		appendLedger(ledger, "WORKER-END", {
-			id: wid,
-			provider: target.providerName,
-			mode: "headless",
-			engine: "image",
-			model,
+		status.last = e instanceof Error ? e.message : String(e);
+		await finaliseRun({
+			logDir,
+			ledger,
+			status,
+			ok: false,
 			rc: 1,
 			secs,
-			label,
-			capability: a.capability
+			end: imageEnd,
+			report: null
 		});
 		throw e;
 	}
 }
+/**
+* Follow pane, made observable on stderr (stdout stays pure JSON for
+* `--output-format json`): one line naming the outcome — opened, skipped
+* (with reason), or failed (with reason, alongside the existing PANE-FAIL
+* ledger line). Fire-and-forget, never blocks the worker.
+*/
+async function announcePane(logDir, config, wid, term, noPane, ledger) {
+	const skip = !noPane ? !config.pane.enabled ? "workers.pane.enabled is false" : process.env.PAI_WORKER_AUTOPANE === "0" ? "PAI_WORKER_AUTOPANE=0" : !term ? "not in iTerm2 (no ITERM_SESSION_ID)" : null : "--no-pane";
+	if (skip) {
+		process.stderr.write(`[pai worker] no pane for ${wid}: ${skip}\n`);
+		return;
+	}
+	try {
+		const r = await openPaneForWorker(logDir, config, wid, term);
+		const suffix = r.session ? ` (iTerm session ${r.session})` : "";
+		process.stderr.write(`[pai worker] pane opened for ${wid}${suffix}\n`);
+	} catch (e) {
+		const message = e instanceof Error ? e.message : String(e);
+		process.stderr.write(`[pai worker] no pane for ${wid}: ${message.slice(0, 200)}\n`);
+		appendLedger(ledger, "PANE-FAIL", {
+			id: wid,
+			error: message.slice(0, 200)
+		});
+	}
+}
 async function executeRun(a) {
 	const { config, logDir, target, model, label, parsed, noPane } = a;
 	const headless = parsed.headless;
@@ -3432,8 +3823,7 @@ async function executeRun(a) {
 	let worktree = null;
 	if (headless && !a.printCmd && worktreeWanted(a.worktreeFlag, {
 		cwd,
-		className: a.className,
-		prompt: parsed.prompt
+		allowedTools: parsed.allowedTools
 	})) try {
 		worktree = addWorktree(logDir, wid, cwd);
 	} catch (e) {
@@ -3549,12 +3939,7 @@ async function executeRun(a) {
 		...a.capability ? { capability: a.capability } : {},
 		...a.specPath ? { spec: a.specPath } : {}
 	});
-	if (headless && !noPane && config.pane.enabled && term && process.env.PAI_WORKER_AUTOPANE !== "0") openPaneForWorker(logDir, config, wid, term).catch((e) => {
-		appendLedger(ledger, "PANE-FAIL", {
-			id: wid,
-			error: (e instanceof Error ? e.message : String(e)).slice(0, 200)
-		});
-	});
+	if (headless) announcePane(logDir, config, wid, term, noPane, ledger);
 	const t0 = Date.now();
 	const proc = spawn(cmd[0], cmd.slice(1), {
 		env,
@@ -3622,9 +4007,12 @@ async function executeRun(a) {
 			killed: 1,
 			label
 		});
-		if (worktree) try {
-			recordWorktree(logDir, status, worktree, false);
-		} catch {}
+		if (worktree) {
+			salvageOnExit(ledger, wid, label, worktree.dir, SIGNAL_SALVAGE_MS);
+			try {
+				recordWorktree(logDir, status, worktree, false);
+			} catch {}
+		}
 		cleanup();
 		try {
 			proc.kill();
@@ -3707,9 +4095,6 @@ async function executeRun(a) {
 	const secs = Math.floor((Date.now() - t0) / 1e3);
 	const resultEvent = ctx.resultEvent;
 	const ok = runSucceeded(headless, rc, resultEvent);
-	status.state = ok ? "done" : "failed";
-	status.rc = rc;
-	status.secs = secs;
 	if (resultEvent) status.last = shortText(resultEvent.result ?? "", 90);
 	if (ctx.resultReport?.notes) status.last = shortText(ctx.resultReport.notes, 90);
 	if (headless && a.reportFormat === "ag2" && resultEvent?.result) {
@@ -3761,66 +4146,55 @@ async function executeRun(a) {
 			});
 		}
 	}
-	saveStatus(logDir, status);
-	appendLedger(ledger, "WORKER-END", {
-		id: wid,
-		provider: target.providerName,
-		mode: headless ? "headless" : "interactive",
-		model,
+	return finaliseRun({
+		logDir,
+		ledger,
+		status,
+		ok,
 		rc,
 		secs,
-		turns: status.turns,
-		tools: status.tools,
-		label
-	});
-	if (worktree) status = recordWorktree(logDir, status, worktree, ok);
-	if (headless && !a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, ctx.resultReport, worktreeExtras(status));
-	const resultText = resultEvent?.result ?? "";
-	if (!ok && headless && a.target.via === "auto" && config.routing.retryOnQuota && status.turns <= 1 && status.tools === 0 && isQuotaFailure(resultText)) {
-		setCooldown(logDir, target.providerName, config.routing.cooldownMinutes);
-		const next = nextAutoProvider(config, logDir, target.providerName);
-		if (next && a.reroutes < config.routing.order.length) {
-			appendLedger(ledger, "WORKER-REROUTE", {
-				from: target.providerName,
-				to: next,
-				reason: "quota"
-			});
-			return runWorker({
-				providerFlag: next,
-				label,
-				noPane: a.noPane,
-				mcpFlag: a.mcpFlag,
-				cwd: a.cwd,
-				specPath: a.specPath,
-				parent: a.parent,
-				stage: a.stage,
-				claudeArgs: a.claudeArgs,
-				onWorkerStart: a.onWorkerStart,
-				worktreeFlag: a.worktreeFlag,
-				className: a.className,
-				_reroutes: a.reroutes + 1
-			});
-		}
-	}
-	const finalRc = rc !== 0 ? rc : ok ? 0 : 1;
-	if (status.parent && isWorkerId(logDir, status.parent)) try {
-		await deliverHandoff(logDir, {
-			from: wid,
-			to: status.parent,
-			kind: "result",
-			text: shortText(ctx.resultReport?.notes ?? resultEvent?.result ?? (ok ? "done" : "failed"), 400),
-			data: {
-				rc: finalRc,
-				ok,
-				...status.branch ? {
-					branch: status.branch,
-					commits: status.commits ?? 0
-				} : {},
-				...ctx.resultReport ? { report: ctx.resultReport } : {}
+		end: {
+			provider: target.providerName,
+			mode: headless ? "headless" : "interactive",
+			model,
+			turns: status.turns,
+			tools: status.tools,
+			label
+		},
+		report: ctx.resultReport,
+		fallbackText: resultEvent?.result,
+		worktree,
+		beforeHandoff: async (st, rep) => {
+			if (headless && !a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, rep, worktreeExtras(st));
+			const resultText = resultEvent?.result ?? "";
+			if (!ok && headless && a.target.via === "auto" && config.routing.retryOnQuota && status.turns <= 1 && status.tools === 0 && isQuotaFailure(resultText)) {
+				setCooldown(logDir, target.providerName, config.routing.cooldownMinutes);
+				const next = nextAutoProvider(config, logDir, target.providerName);
+				if (next && a.reroutes < config.routing.order.length) {
+					appendLedger(ledger, "WORKER-REROUTE", {
+						from: target.providerName,
+						to: next,
+						reason: "quota"
+					});
+					return runWorker({
+						providerFlag: next,
+						label,
+						noPane: a.noPane,
+						mcpFlag: a.mcpFlag,
+						cwd: a.cwd,
+						specPath: a.specPath,
+						parent: a.parent,
+						stage: a.stage,
+						claudeArgs: a.claudeArgs,
+						onWorkerStart: a.onWorkerStart,
+						worktreeFlag: a.worktreeFlag,
+						className: a.className,
+						_reroutes: a.reroutes + 1
+					});
+				}
 			}
-		});
-	} catch {}
-	return finalRc;
+		}
+	});
 }
 /** The worktree fields printResult adds to a json payload, when there is one. */
 function worktreeExtras(s) {
@@ -3879,8 +4253,7 @@ async function executeCodexRun(a) {
 	let worktree = null;
 	if (worktreeWanted(a.worktreeFlag, {
 		cwd,
-		className: a.className,
-		prompt: parsed.prompt
+		allowedTools: parsed.allowedTools
 	})) try {
 		worktree = addWorktree(logDir, wid, cwd);
 	} catch (e) {
@@ -3945,12 +4318,7 @@ async function executeCodexRun(a) {
 		id: wid,
 		note: `dropped for codex: ${dropped.join(", ")}`
 	});
-	if (!noPane && config.pane.enabled && term && process.env.PAI_WORKER_AUTOPANE !== "0") openPaneForWorker(logDir, config, wid, term).catch((e) => {
-		appendLedger(ledger, "PANE-FAIL", {
-			id: wid,
-			error: (e instanceof Error ? e.message : String(e)).slice(0, 200)
-		});
-	});
+	announcePane(logDir, config, wid, term, noPane, ledger);
 	const t0 = Date.now();
 	const proc = spawn("codex", buildCodexArgs(prompt, parsed.callerModel ? void 0 : model), {
 		env,
@@ -3990,9 +4358,12 @@ async function executeCodexRun(a) {
 			status.secs = Math.floor((Date.now() - t0) / 1e3);
 			status.last = `killed by signal ${sig}`;
 			saveStatus(logDir, status);
-			if (worktree) try {
-				recordWorktree(logDir, status, worktree, false);
-			} catch {}
+			if (worktree) {
+				salvageOnExit(ledger, wid, label, worktree.dir, SIGNAL_SALVAGE_MS);
+				try {
+					recordWorktree(logDir, status, worktree, false);
+				} catch {}
+			}
 			try {
 				proc.kill();
 			} catch {}
@@ -4029,9 +4400,6 @@ async function executeCodexRun(a) {
 	};
 	writeEvent(resultEvent);
 	const ok = rc === 0 && !fold.isError;
-	status.state = ok ? "done" : "failed";
-	status.rc = rc;
-	status.secs = secs;
 	status.last = shortText(report?.notes ?? finalText, 90) || (ok ? "done" : "failed");
 	if (report?.changed?.length) {
 		const verify = verifyReportChanges(report.changed, worktree?.dir ?? cwd, t0);
@@ -4047,40 +4415,29 @@ async function executeCodexRun(a) {
 			});
 		}
 	}
-	saveStatus(logDir, status);
-	appendLedger(ledger, "WORKER-END", {
-		id: wid,
-		provider: target.providerName,
-		mode: "headless",
-		engine: "codex",
-		model,
+	return finaliseRun({
+		logDir,
+		ledger,
+		status,
+		ok,
 		rc,
 		secs,
-		turns: status.turns,
-		tools: status.tools,
-		label
+		end: {
+			provider: target.providerName,
+			mode: "headless",
+			engine: "codex",
+			model,
+			turns: status.turns,
+			tools: status.tools,
+			label
+		},
+		report,
+		fallbackText: finalText,
+		worktree,
+		beforeHandoff: (st, rep) => {
+			if (!a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, rep, worktreeExtras(st));
+		}
 	});
-	if (worktree) status = recordWorktree(logDir, status, worktree, ok);
-	if (!a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, report, worktreeExtras(status));
-	const finalRc = rc !== 0 ? rc : ok ? 0 : 1;
-	if (status.parent && isWorkerId(logDir, status.parent)) try {
-		await deliverHandoff(logDir, {
-			from: wid,
-			to: status.parent,
-			kind: "result",
-			text: shortText(report?.notes ?? finalText ?? (ok ? "done" : "failed"), 400),
-			data: {
-				rc: finalRc,
-				ok,
-				...status.branch ? {
-					branch: status.branch,
-					commits: status.commits ?? 0
-				} : {},
-				...report ? { report } : {}
-			}
-		});
-	} catch {}
-	return finalRc;
 }
 function printResult(fmt, resultEvent, rc, logDir, wid, report, extras) {
 	if (fmt === "stream-json") return;
@@ -4213,5 +4570,5 @@ function resultFromOutput(out) {
 }
 
 //#endregion
-export { UNLABELED as A, newWorkerId as B, workerInScope as C, worktreesDir as D, mergeWorker as E, elapsedOf as F, waitForTerminalStatus as G, ownsPid as H, isChatPane as I, shortText as J, longInlinePromptHint as K, isLive as L, alive as M, contextLabel as N, appendLedger as O, contextPercent as P, loadStatus as R, sessionTag as S, git as T, saveStatus as U, nowStamp as V, setWorkerLabel as W, expandMcpNames as X, describeMcp as Y, currentTabKey as _, projectLaunchConfig as a, resolveSession as b, handoffFromInside as c, workerDepth as d, checkPaneForWorker as f, markControlsHeld as g, clickrControlsArgv as h, usageContextTokens as i, ageOf as j, ledgerSummary as k, readInbox as l, openPaneForWorker as m, runWorker as n, parseWorkerReport as o, openFollowPane as p, parseRunnerArgs as q, testProvider as r, renderReport as s, printResult as t, sayToWorker as u, itermForClaudeSession as v, discardWorker as w, sessionMapPath as x, itermUuid as y, loadStatuses as z };
-//# sourceMappingURL=run-FeM1_UVa.mjs.map
+export { appendLedger as A, loadStatus as B, workerInScope as C, mergeWorker as D, git as E, contextLabel as F, saveStatus as G, newWorkerId as H, contextPercent as I, longInlinePromptHint as J, setWorkerLabel as K, elapsedOf as L, UNLABELED as M, ageOf as N, uncommittedPaths as O, alive as P, expandMcpNames as Q, isChatPane as R, sessionTag as S, gcWorktrees as T, nowStamp as U, loadStatuses as V, ownsPid as W, shortText as X, parseRunnerArgs as Y, describeMcp as Z, currentTabKey as _, projectLaunchConfig as a, resolveSession as b, handoffFromInside as c, workerDepth as d, checkPaneForWorker as f, markControlsHeld as g, clickrControlsArgv as h, usageContextTokens as i, ledgerSummary as j, worktreesDir as k, readInbox as l, openPaneForWorker as m, runWorker as n, parseWorkerReport as o, openFollowPane as p, waitForTerminalStatus as q, testProvider as r, renderReport as s, printResult as t, sayToWorker as u, itermForClaudeSession as v, discardWorker as w, sessionMapPath as x, itermUuid as y, isLive as z };
+//# sourceMappingURL=run-BVQZI79D.mjs.map