@tekmidian/pai 0.65.2 → 0.66.1

package/dist/{run-DMaCpvMW.mjs → run-BCpbxqA5.mjs}

@@ -1,6 +1,6 @@
 import { i as getRegistryBackend } from "./factory-CNpPQQ-5.mjs";
-import { E as readWorkersSection, O as resolveModelCapability, T as providerKeyPath, b as isModelCapability, d as NATIVE_ANTHROPIC_MODELS, g as classModelCapability, h as assertProviderRunnable, k as resolveProviderKey, m as WorkersConfigError, n as claudeCommand, t as buildRunEnv } from "./run-env-BHWnXqle.mjs";
-import { _ as statusPath, d as resolveTarget, f as setCooldown, g as panesDir, h as ledgerPath, i as capabilityForRun, m as eventsPath, n as ensureProxyRunning, o as isQuotaFailure, p as ensureNoMcpConfig, s as nextAutoProvider, t as DEFAULT_PROXY_PORT, u as resolveCapabilityRun, v as workersLogDir } from "./server-DlL1QI2k.mjs";
+import { A as resolveProviderKey, D as readWorkersSection, E as providerKeyPath, _ as classModelCapability, f as NATIVE_ANTHROPIC_MODELS, g as assertProviderRunnable, h as WorkersConfigError, k as resolveModelCapability, n as claudeCommand, t as buildRunEnv, x as isModelCapability } from "./run-env-DRcp7A8K.mjs";
+import { _ as statusPath, d as resolveTarget, f as setCooldown, g as panesDir, h as ledgerPath, i as capabilityForRun, m as eventsPath, n as ensureProxyRunning, o as isQuotaFailure, p as ensureNoMcpConfig, s as nextAutoProvider, t as DEFAULT_PROXY_PORT, u as resolveCapabilityRun, v as workersLogDir } from "./server-DgmAHyFK.mjs";
 import { appendFileSync, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { homedir, platform, tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -1159,7 +1159,7 @@ function assertNoSnapshotDrift(cwd, snapshot, paths, id) {
 * started from. Works even if `cwd`'s HEAD moved since the snapshot: the
 * diff is applied to files, not merged into a tree.
 */
-function mergeSnapshotWorker(logDir, id, st) {
+function mergeSnapshotWorker(logDir, id, st, noCommit = false) {
 	const snapshot = st.worktreeBase;
 	const branch = st.branch;
 	const worktreeDir = st.worktreeDir;
@@ -1212,6 +1212,7 @@ function mergeSnapshotWorker(logDir, id, st) {
 		const why = (typeof err.stderr === "string" ? err.stderr : err.stderr?.toString("utf8")) || err.message || String(e);
 		throw new Error(`worker ${id}: git refused to apply ${branch}'s changes to ${st.cwd} — ${why.trim()}. The worktree ${worktreeDir} was kept: resolve by hand, then re-run merge`);
 	}
+	if (noCommit) return noCommitNextSteps(id, branch, worktreeDir, changedPaths);
 	removeWorktree(st.cwd, worktreeDir, true);
 	try {
 		git(st.cwd, [
@@ -1230,6 +1231,143 @@ function mergeSnapshotWorker(logDir, id, st) {
 	if (salvage.skipped.length) notes.push(`skipped ${salvage.skipped.join(", ")}`);
 	return notes.length ? `${base}; ${notes.join("; ")}` : base;
 }
+function noCommitNextSteps(id, branch, worktreeDir, paths) {
+	return `applied worker ${id}'s changes (branch ${branch}) to the checkout as uncommitted changes: ${paths.join(", ")}. Branch and worktree ${worktreeDir} were kept. Next: review (git diff), commit, then run: pai worker gc`;
+}
+/**
+* `merge --no-commit`: apply base..branch to the checkout with a 3-way
+* `git apply`, leaving the result uncommitted. On conflict the tree is left
+* as is (markers + unmerged index entries) and the conflicted paths are listed.
+*/
+function applyNoCommit(cwd, id, branch, worktreeDir, base, paths) {
+	const diff = execFileSync("git", [
+		"-C",
+		cwd,
+		"diff",
+		"--binary",
+		`${base}..${branch}`
+	], {
+		encoding: "buffer",
+		timeout: 3e4,
+		maxBuffer: 64 * 1024 * 1024,
+		env: {
+			...process.env,
+			LC_ALL: "C"
+		}
+	});
+	try {
+		execFileSync("git", [
+			"-C",
+			cwd,
+			"apply",
+			"--3way",
+			"--binary"
+		], {
+			input: diff,
+			timeout: 3e4,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...process.env,
+				LC_ALL: "C"
+			}
+		});
+	} catch (e) {
+		const conflicted = git(cwd, [
+			"diff",
+			"--name-only",
+			"--diff-filter=U"
+		]).split("\n").filter(Boolean);
+		const err = e;
+		const why = ((typeof err.stderr === "string" ? err.stderr : err.stderr?.toString("utf8")) || err.message || "").trim();
+		throw new Error(conflicted.length ? `worker ${id}: applying ${branch} conflicted in ${conflicted.join(", ")}. The tree was left for you: resolve those paths, review, commit; branch and worktree ${worktreeDir} were kept` : `worker ${id}: git refused to apply ${branch} to ${cwd} — ${why}. Nothing was changed; branch and worktree were kept`);
+	}
+	return noCommitNextSteps(id, branch, worktreeDir, paths);
+}
+/**
+* `pai worker verify <id>`: for every file the worker's branch (or its
+* refs/pai-archive/<id> archive once the branch is gone) changed since its
+* base, compare bytes with the working tree or `--against <ref>`.
+* identical = the target already holds the worker's version (a worker delete
+* counts as identical when the target lacks the file too); differs = other
+* bytes; missing = the worker's file is absent in the target; deleted = the
+* worker deleted it but the target still has it. ok = every file identical.
+*/
+function verifyWorker(logDir, id, opts = {}) {
+	const st = loadStatus(logDir, id);
+	if (!st) throw new Error(`no worker named "${id}"`);
+	const env = {
+		...process.env,
+		LC_ALL: "C"
+	};
+	const bytes = (args) => {
+		try {
+			return execFileSync("git", [
+				"-C",
+				st.cwd,
+				...args
+			], {
+				env,
+				timeout: 3e4,
+				maxBuffer: 256 * 1024 * 1024,
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			});
+		} catch {
+			return null;
+		}
+	};
+	const has = (ref) => bytes([
+		"rev-parse",
+		"--verify",
+		"-q",
+		`${ref}^{commit}`
+	]) !== null;
+	const ref = [`refs/heads/${worktreeBranch(id)}`, `refs/pai-archive/${id}`].find(has);
+	if (!ref) throw new Error(`worker ${id}: neither ${worktreeBranch(id)} nor refs/pai-archive/${id} exists in ${st.cwd}`);
+	const base = st.worktreeSnapshot && st.worktreeBase ? st.worktreeBase : git(st.cwd, [
+		"merge-base",
+		"HEAD",
+		ref
+	]);
+	const list = (bytes([
+		"diff",
+		"--name-status",
+		"--no-renames",
+		"-z",
+		`${base}..${ref}`
+	]) ?? Buffer.alloc(0)).toString("utf8").split("\0").filter(Boolean);
+	const files = [];
+	for (let i = 0; i + 1 < list.length; i += 2) {
+		const path = list[i + 1];
+		const deleted = list[i] === "D";
+		const target = opts.against ? bytes(["show", `${opts.against}:${path}`]) : existsSync(join(st.cwd, path)) ? readFileSync(join(st.cwd, path)) : null;
+		let state;
+		if (deleted) state = target ? "deleted" : "identical";
+		else {
+			const mine = bytes(["show", `${ref}:${path}`]);
+			state = !target ? "missing" : mine && mine.equals(target) ? "identical" : "differs";
+		}
+		files.push({
+			path,
+			state
+		});
+	}
+	return {
+		id,
+		ref,
+		base,
+		against: opts.against ?? "working tree",
+		files,
+		ok: files.every((f) => f.state === "identical")
+	};
+}
 /**
 * `pai worker merge <id>`: salvage whatever the worker left uncommitted onto
 * its branch, refuse when the original checkout is dirty in paths the branch
@@ -1239,10 +1377,10 @@ function mergeSnapshotWorker(logDir, id, st) {
 * genuinely means it holds nothing, and reporting success there would
 * destroy the worktree for no gain.
 */
-function mergeWorker(logDir, id) {
+function mergeWorker(logDir, id, opts = {}) {
 	const st = mustHaveBranch(logDir, id);
 	if (st.merged) return `worker ${id}: branch ${st.branch} already merged`;
-	if (st.worktreeSnapshot) return mergeSnapshotWorker(logDir, id, st);
+	if (st.worktreeSnapshot) return mergeSnapshotWorker(logDir, id, st, opts.noCommit);
 	const salvage = existsSync(st.worktreeDir) ? salvageUncommitted(st.worktreeDir, st.label || UNLABELED) : {
 		committed: [],
 		skipped: []
@@ -1264,6 +1402,7 @@ function mergeWorker(logDir, id) {
 		st.branch
 	]).split("\n").filter(Boolean);
 	assertNoDirtyOverlap(st.cwd, incomingPaths, id, st.branch);
+	if (opts.noCommit) return applyNoCommit(st.cwd, id, st.branch, st.worktreeDir, mergeBase, incomingPaths);
 	try {
 		git(st.cwd, [
 			"merge",
@@ -1635,6 +1774,126 @@ function itermForClaudeSession(logDir, claudeSession, now = Date.now()) {
 	return term ? itermUuid(term) : null;
 }
 
+//#endregion
+//#region src/workers/endreason.ts
+/**
+* Who or what ended a worker. One place decides the reason; the runner's
+* signal handlers and the deadline record it, `pai worker kill` and the daemon
+* leave a kill-request marker (`<logDir>/<id>.kill`) before signalling so the
+* runner can tell their stops from an external one.
+*/
+const killMarkerPath = (logDir, id) => join(logDir, `${id}.kill`);
+/** Best description of the invoking session: PAI parent/AIBroker session env, else the Claude Code session id. */
+function callerDescription(env = process.env) {
+	const name = env.PAI_WORKER_PARENT ?? env.PAI_SESSION_NAME ?? env.AIBROKER_SESSION_NAME ?? env.AIBROKER_SESSION;
+	if (name) return name;
+	if (env.CLAUDE_CODE_SESSION_ID) return `claude-session:${env.CLAUDE_CODE_SESSION_ID}`;
+	return env.CLAUDECODE ? "claude-code" : "shell";
+}
+/** Write the kill-request marker and the WORKER-KILL ledger line; call right before signalling. */
+function requestKill(logDir, ledger, id, by = callerDescription()) {
+	const req = {
+		ts: (/* @__PURE__ */ new Date()).toISOString(),
+		by,
+		pid: process.pid,
+		ppid: process.ppid,
+		cwd: process.cwd()
+	};
+	writeFileSync(killMarkerPath(logDir, id), JSON.stringify(req));
+	appendLedger(ledger, "WORKER-KILL", {
+		id,
+		by,
+		pid: req.pid,
+		ppid: req.ppid,
+		cwd: req.cwd
+	});
+}
+function readMarker(logDir, id) {
+	const p = killMarkerPath(logDir, id);
+	if (!existsSync(p)) return null;
+	try {
+		return JSON.parse(readFileSync(p, "utf8"));
+	} catch {
+		return {
+			ts: "",
+			by: "unknown",
+			pid: 0,
+			ppid: 0,
+			cwd: ""
+		};
+	} finally {
+		try {
+			unlinkSync(p);
+		} catch {}
+	}
+}
+function pidAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (e) {
+		return e.code === "EPERM";
+	}
+}
+/** Command name of a pid (`ps -o comm=`), or undefined when it is gone or ps fails. */
+function commOf(pid) {
+	try {
+		return execFileSync("ps", [
+			"-o",
+			"comm=",
+			"-p",
+			String(pid)
+		], { encoding: "utf8" }).trim() || void 0;
+	} catch {
+		return;
+	}
+}
+/** Parent facts recorded at start, for the end report ("parent: claude"). */
+function parentInfo() {
+	const parentPid = process.ppid;
+	return {
+		parentPid,
+		parentComm: commOf(parentPid),
+		parentBackground: process.env.CLAUDECODE ? true : void 0
+	};
+}
+/**
+* The single decision. `signal` = the signal the runner received (absent for a
+* deadline stop or a normal exit); `timedOut` = the deadline fired. Reads (and
+* consumes) the kill marker.
+*/
+function decideEndReason(a) {
+	if (a.timedOut) return { reason: "deadline" };
+	if (!a.signal) return { reason: "exit" };
+	const marker = readMarker(a.logDir, a.id);
+	if (marker) return {
+		reason: "pai-worker-kill",
+		by: marker.by,
+		note: `${a.signal} requested by pid ${marker.pid}`
+	};
+	const alive = (a.isAlive ?? pidAlive)(a.parentPid ?? process.ppid);
+	const parent = `parent ${a.parentPid ?? "?"}${a.parentComm ? ` (${a.parentComm})` : ""}`;
+	if (!alive) return {
+		reason: "parent-gone",
+		note: `${a.signal}; ${parent} not alive`
+	};
+	return {
+		reason: "external-signal",
+		note: `${a.signal}; sender unknown (not deadline, not pai worker kill); a Claude Code background task stop (TaskStop, Bash timeout, session end) is the usual source; ${parent} alive` + (a.parentBackground ? "; started from a Claude Code session" : "")
+	};
+}
+/** The status/ledger fields for an end. */
+function endFields(e) {
+	return {
+		reason: e.reason,
+		...e.by ? { by: e.by } : {}
+	};
+}
+/** "external-signal", "pai-worker-kill by <caller>" for a finished worker; null when nothing was recorded. */
+function endLabel(s) {
+	return s.endReason ? `${s.endReason}${s.endBy ? ` by ${s.endBy}` : ""}` : null;
+}
+
 //#endregion
 //#region src/workers/controls.ts
 /**
@@ -2951,6 +3210,7 @@ function fullContractPrompt(format) {
 		"116 s). Ending your turn ends this process, so a background job gets no later wake-up here:",
 		"run_in_background is denied. Run the long command in the FOREGROUND with a Bash timeout up to 600000 ms",
 		"and split longer jobs into steps that each fit it.",
+		"Kill only processes you started, by PID (`cmd & echo $! > /tmp/x.pid`, then `kill $(cat /tmp/x.pid)`); never `pkill`/`killall`/`kill $(pgrep ...)` — other workers' command lines contain your spec text.",
 		...fileNotInlineBlock(),
 		"",
 		`Operator messages: a user turn starting with ${OPERATOR_MARK} was typed by the operator while you`,
@@ -3115,6 +3375,118 @@ function relShort(p, cwd) {
 	return r && !r.startsWith("..") ? r : p;
 }
 
+//#endregion
+//#region src/workers/deadline.ts
+/** Local HH:MM → epoch ms: today, or tomorrow when already past. */
+function parseDeadline(hhmm, now = /* @__PURE__ */ new Date()) {
+	const m = /^(\d{1,2}):(\d{2})$/.exec(hhmm.trim());
+	if (!m || Number(m[1]) > 23 || Number(m[2]) > 59) throw new Error(`--deadline: expected HH:MM (local time, 00:00-23:59), got "${hhmm}"`);
+	const at = new Date(now);
+	at.setHours(Number(m[1]), Number(m[2]), 0, 0);
+	if (at.getTime() <= now.getTime()) at.setDate(at.getDate() + 1);
+	return at.getTime();
+}
+/** The run's limit, or null when disabled (--max-minutes 0 / default 0). */
+function resolveLimit(flags, defaultMinutes, now = /* @__PURE__ */ new Date()) {
+	if (flags.maxMinutes !== void 0 && flags.deadline !== void 0) throw new Error("--max-minutes and --deadline are mutually exclusive");
+	if (flags.deadline !== void 0) {
+		const deadlineAt = parseDeadline(flags.deadline, now);
+		return {
+			deadlineAt,
+			minutes: Math.max(1, Math.round((deadlineAt - now.getTime()) / 6e4))
+		};
+	}
+	const minutes = flags.maxMinutes ?? defaultMinutes;
+	if (!Number.isFinite(minutes) || minutes < 0) throw new Error(`--max-minutes: expected a non-negative number, got ${minutes}`);
+	return minutes === 0 ? null : {
+		deadlineAt: now.getTime() + minutes * 6e4,
+		minutes
+	};
+}
+const pad = (n) => String(n).padStart(2, "0");
+/** The one line injected into the worker's system prompt. */
+function deadlinePromptLine(limit) {
+	const d = new Date(limit.deadlineAt);
+	return `Hard deadline ${pad(d.getHours())}:${pad(d.getMinutes())} (${limit.minutes} min). Finish and report before it; at the deadline the run is stopped and whatever you have is salvaged.`;
+}
+/** ps column: "36s left", "12m left", "1h05m left" for running; "OVERDUE ..." for overdue; "timed out" for stopped; null otherwise. */
+function deadlineLabel(s, now = Date.now()) {
+	if (s.timedOut) return "timed out";
+	if (s.state !== "running" || !s.deadlineAt) return null;
+	const secs = Math.abs(s.deadlineAt - now) / 1e3;
+	let label;
+	if (secs < 60) label = `${Math.floor(secs)}s`;
+	else if (secs < 3600) label = `${Math.floor(secs / 60)}m`;
+	else {
+		const hours = Math.floor(secs / 3600);
+		const mins = Math.floor(secs % 3600 / 60);
+		label = `${hours}h${String(mins).padStart(2, "0")}m`;
+	}
+	return s.deadlineAt >= now ? `${label} left` : `OVERDUE ${label}`;
+}
+/** Grace between SIGTERM and SIGKILL. */
+const DEADLINE_GRACE_MS = 1e4;
+/**
+* Stop `proc` at the deadline: `onFire`, SIGTERM, SIGKILL after `graceMs`
+* when it is still alive. Returns the disarm function.
+*/
+function armDeadline(proc, limit, onFire, graceMs = DEADLINE_GRACE_MS) {
+	let kill = null;
+	const t = setTimeout(() => {
+		onFire();
+		try {
+			proc.kill("SIGTERM");
+		} catch {}
+		kill = setTimeout(() => {
+			if (proc.exitCode === null && proc.signalCode === null) try {
+				proc.kill("SIGKILL");
+			} catch {}
+		}, graceMs);
+		kill.unref();
+	}, Math.max(0, limit.deadlineAt - Date.now()));
+	return () => {
+		clearTimeout(t);
+		if (kill) clearTimeout(kill);
+	};
+}
+
+//#endregion
+//#region src/workers/browser-tools.ts
+/**
+* browser-tools.ts — what `--no-browser` strips: --chrome, every browser MCP
+* tool grant (mcp__claude-in-chrome__*, browsr, playwright, …) and browser
+* server names, from the caller's claude args. The PreToolUse worker guard
+* denies the same tools (hooks/ts/lib/worker-guard.ts) when
+* PAI_WORKER_NO_BROWSER=1.
+*/
+const BROWSER_SERVER = /chrome|browsr|browser|playwright|puppeteer/i;
+/** A browser MCP server name (bare, e.g. "browsr") or tool name (mcp__browsr__open). */
+function isBrowserTool(name) {
+	const server = /^mcp__(.+?)(__|$)/.exec(name)?.[1] ?? name;
+	return BROWSER_SERVER.test(server) && (name.startsWith("mcp__") || !name.includes("__"));
+}
+const keepNonBrowser = (list) => list.split(",").map((s) => s.trim()).filter((s) => s && !isBrowserTool(s));
+/** claude args without --chrome and browser tool grants (an emptied --allowedTools goes too). */
+function stripBrowserArgs(rest) {
+	const out = [];
+	for (let i = 0; i < rest.length; i++) {
+		const a = rest[i];
+		if (a === "--chrome") continue;
+		if (a === "--allowedTools" && i + 1 < rest.length && !rest[i + 1].startsWith("-")) {
+			const kept = keepNonBrowser(rest[++i]);
+			if (kept.length) out.push(a, kept.join(","));
+		} else if (a.startsWith("--allowedTools=")) {
+			const kept = keepNonBrowser(a.slice(15));
+			if (kept.length) out.push(`--allowedTools=${kept.join(",")}`);
+		} else out.push(a);
+	}
+	return out;
+}
+/** Comma-list entries (--mcp values, class MCP) without browser servers. */
+function stripBrowserNames(names) {
+	return names.map((n) => keepNonBrowser(n).join(",")).filter(Boolean);
+}
+
 //#endregion
 //#region src/workers/codex.ts
 /**
@@ -3523,7 +3895,7 @@ async function runWorker(opts) {
 		if (gc?.length) process.stderr.write(`pai worker: archived ${gc.length} leftover worktree(s) (pai worker gc)\n`);
 	} catch {}
 	if (opts.className === "plan" && !opts._planner) {
-		const { runPlanner } = await import("./planner-Dzs9-8AS.mjs");
+		const { runPlanner } = await import("./planner-Dm5Acyo1.mjs");
 		return runPlanner(opts);
 	}
 	const parent = launchParent(opts.parent);
@@ -3544,7 +3916,9 @@ async function runWorker(opts) {
 		className: opts.className
 	});
 	assertProviderRunnable(target.providerName, target.provider);
-	const parsed = parseRunnerArgs(opts.claudeArgs);
+	const limit = resolveLimit(opts, config.defaultMaxMinutes);
+	const noBrowser = opts.browser === void 0 ? config.noBrowserByDefault : !opts.browser;
+	const parsed = parseRunnerArgs(noBrowser ? stripBrowserArgs(opts.claudeArgs) : opts.claudeArgs);
 	const label = opts.label ?? shortText(parsed.prompt ?? UNLABELED, 70);
 	const model = capabilityResolution ? capabilityResolution.model : resolveRunModel(target, opts.className, opts.modelFlag);
 	const reportFormat = resolveReportFormat(opts.reportFormatFlag);
@@ -3593,7 +3967,9 @@ async function runWorker(opts) {
 			worktreeFlag: opts.worktreeFlag,
 			className: opts.className,
 			reportFormat,
-			capability: capability ?? void 0
+			capability: capability ?? void 0,
+			limit,
+			noBrowser
 		});
 		else rc = await executeRun({
 			config,
@@ -3618,7 +3994,9 @@ async function runWorker(opts) {
 			reroutes: opts._reroutes ?? 0,
 			printCmd: opts.printCmd,
 			reportFormat,
-			noReportRetry: opts.noReportRetry ?? false
+			noReportRetry: opts.noReportRetry ?? false,
+			limit,
+			noBrowser
 		});
 		await returnControlsIfHeld(logDir, workerId);
 		return rc;
@@ -3736,6 +4114,32 @@ function interactiveMcpTools(explicitMcp, callerTools, projectLaunch) {
 */
 /** Per-git-call bound for the salvage a kill signal runs before exiting. */
 const SIGNAL_SALVAGE_MS = 5e3;
+/** The deadline fired: record it on the status and in the ledger (the caller then stops the child). */
+function fireDeadline(logDir, status, ledger, limit) {
+	status.timedOut = true;
+	status.last = `deadline reached after ${limit.minutes} min`;
+	saveStatus(logDir, status);
+	appendLedger(ledger, "WORKER-DEADLINE", {
+		id: status.id,
+		minutes: limit.minutes
+	});
+}
+/** Decide why a signal ended the run and put it on the status; the caller writes WORKER-END. */
+function recordSignalEnd(logDir, status, signal) {
+	const end = decideEndReason({
+		logDir,
+		id: status.id,
+		signal,
+		timedOut: status.timedOut,
+		parentPid: status.parentPid,
+		parentComm: status.parentComm,
+		parentBackground: status.parentBackground
+	});
+	status.endReason = end.reason;
+	status.endBy = end.by;
+	status.endNote = end.note;
+	return end;
+}
 async function finaliseRun(f) {
 	const { logDir, ledger, ok, rc } = f;
 	let { status, report } = f;
@@ -3749,8 +4153,19 @@ async function finaliseRun(f) {
 			result: report?.result ?? "-"
 		};
 	}
+	if (f.timedOut) {
+		const reason = `deadline reached after ${f.timedOut} min`;
+		status.timedOut = true;
+		status.last = reason;
+		report = {
+			...report ?? {},
+			result: "~",
+			why: reason,
+			notes: [reason, report?.notes ?? f.fallbackText].filter(Boolean).join("\n")
+		};
+	}
 	const orphanReason = checkOrphanedChildren(logDir, wid);
-	const succeeded = ok && !orphanReason;
+	const succeeded = ok && !orphanReason && !f.timedOut;
 	status.state = succeeded ? "done" : "failed";
 	status.rc = rc;
 	status.secs = f.secs;
@@ -3766,12 +4181,19 @@ async function finaliseRun(f) {
 			reason: orphanReason
 		});
 	}
+	const end = decideEndReason({
+		logDir,
+		id: wid,
+		timedOut: f.timedOut !== void 0
+	});
+	status.endReason = end.reason;
 	saveStatus(logDir, status);
 	appendLedger(ledger, "WORKER-END", {
 		id: wid,
 		...f.end,
 		rc,
-		secs: f.secs
+		secs: f.secs,
+		...endFields(end)
 	});
 	if (f.worktree) status = recordWorktree(logDir, status, f.worktree, ok);
 	const early = await f.beforeHandoff?.(status, report);
@@ -3918,7 +4340,7 @@ async function announcePane(logDir, config, wid, term, noPane, ledger) {
 	}
 }
 async function executeRun(a) {
-	const { config, logDir, target, model, label, parsed, noPane } = a;
+	const { config, logDir, target, model, label, parsed, noPane, limit, noBrowser } = a;
 	const headless = parsed.headless;
 	let proxyUrl;
 	if (target.provider.protocol === "openai") proxyUrl = `${await ensureProxyRunning(DEFAULT_PROXY_PORT, logDir)}/${target.providerName}`;
@@ -3943,19 +4365,23 @@ async function executeRun(a) {
 		});
 	}
 	env.PAI_WORKER_ID = wid;
-	const chromeArgs = chromeGrantArgs([
-		...a.mcpFlag ? [a.mcpFlag] : [],
+	if (noBrowser) env.PAI_WORKER_NO_BROWSER = "1";
+	const mcpFlag = noBrowser ? stripBrowserNames(a.mcpFlag ? [a.mcpFlag] : [])[0] : a.mcpFlag;
+	const classMcp = noBrowser && target.classMcp ? stripBrowserNames(target.classMcp) : target.classMcp;
+	if (noBrowser) parsed.mcp = stripBrowserNames(parsed.mcp);
+	const chromeArgs = noBrowser ? [] : chromeGrantArgs([
+		...mcpFlag ? [mcpFlag] : [],
 		...parsed.mcp,
-		...target.classMcp ?? [],
+		...classMcp ?? [],
 		...parsed.allowedTools
 	], parsed.rest);
 	let mcpArgs = [];
 	let toolsFlag = headless ? headlessToolsFlag(parsed.allowedTools) : [];
 	if (headless && !parsed.callerMcpConfig) {
 		const wanted = [
-			...a.mcpFlag ? [a.mcpFlag] : [],
+			...mcpFlag ? [mcpFlag] : [],
 			...parsed.mcp,
-			...target.classMcp ?? [],
+			...classMcp ?? [],
 			...mcpServersFromToolGrants(parsed.allowedTools)
 		];
 		if (wanted.length) mcpArgs = [
@@ -3969,7 +4395,7 @@ async function executeRun(a) {
 			ensureNoMcpConfig(logDir)
 		];
 	} else if (!headless && !parsed.callerMcpConfig) {
-		const explicitMcp = [...a.mcpFlag ? [a.mcpFlag] : [], ...parsed.mcp];
+		const explicitMcp = [...mcpFlag ? [mcpFlag] : [], ...parsed.mcp];
 		const projectLaunch = await projectLaunchConfig(cwd);
 		const picked = interactiveMcpTools(explicitMcp, parsed.callerTools, projectLaunch);
 		const applied = projectLaunch && {
@@ -3996,19 +4422,26 @@ async function executeRun(a) {
 	cmd.push(...appendSystemPromptArgs([
 		...headless && !parsed.callerSystemPrompt ? [workerContractPrompt(a.className, a.reportFormat)] : [],
 		...headless ? [worktree ? worktreeSystemPrompt(wid, worktree.branch, worktree.dir, worktree.snapshot) : inPlaceSystemPrompt()] : [],
+		...headless && limit ? [deadlinePromptLine(limit)] : [],
 		...parsed.callerSystemPrompts
 	]));
 	cmd = ensureToolSearch(cmd);
 	if (a.printCmd) {
 		console.log(JSON.stringify({
 			cmd,
-			cwd: worktree?.dir ?? cwd
+			cwd: worktree?.dir ?? cwd,
+			browser: noBrowser ? "off" : "on",
+			...limit ? {
+				deadline: new Date(limit.deadlineAt).toISOString(),
+				maxMinutes: limit.minutes
+			} : {}
 		}));
 		return 0;
 	}
 	let status = {
 		id: wid,
 		pid: process.pid,
+		...parentInfo(),
 		label,
 		cwd,
 		term,
@@ -4038,7 +4471,11 @@ async function executeRun(a) {
 			worktreeBase: worktree.base,
 			worktreeSnapshot: worktree.snapshot
 		} : {},
-		...a.specPath ? { spec: a.specPath } : {}
+		...a.specPath ? { spec: a.specPath } : {},
+		...limit ? {
+			deadlineAt: limit.deadlineAt,
+			maxMinutes: limit.minutes
+		} : {}
 	};
 	saveStatus(logDir, status);
 	a.onWorkerStart?.(wid);
@@ -4106,7 +4543,9 @@ async function executeRun(a) {
 		});
 	}) : null;
 	let killed = false;
+	const stopDeadline = limit ? armDeadline(proc, limit, () => fireDeadline(logDir, status, ledger, limit)) : null;
 	const cleanup = () => {
+		stopDeadline?.();
 		if (closeTimer) clearTimeout(closeTimer);
 		operatorServer?.close();
 	};
@@ -4115,7 +4554,8 @@ async function executeRun(a) {
 		status.state = "killed";
 		status.rc = 143;
 		status.secs = Math.floor((Date.now() - t0) / 1e3);
-		status.last = `killed by signal ${sig}`;
+		const end = recordSignalEnd(logDir, status, sig);
+		status.last = `killed by signal ${sig} (${end.reason}${end.by ? ` by ${end.by}` : ""})`;
 		saveStatus(logDir, status);
 		appendLedger(ledger, "WORKER-END", {
 			id: wid,
@@ -4125,6 +4565,8 @@ async function executeRun(a) {
 			rc: 143,
 			secs: status.secs,
 			killed: 1,
+			...endFields(end),
+			note: end.note,
 			label
 		});
 		if (worktree) {
@@ -4284,6 +4726,7 @@ async function executeRun(a) {
 		report: ctx.resultReport,
 		fallbackText: resultEvent?.result,
 		worktree,
+		timedOut: status.timedOut ? limit?.minutes : void 0,
 		beforeHandoff: async (st, rep) => {
 			if (headless && !a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, rep, worktreeExtras(st));
 			const resultText = resultEvent?.result ?? "";
@@ -4385,10 +4828,11 @@ async function executeCodexRun(a) {
 		});
 	}
 	env.PAI_WORKER_ID = wid;
-	const prompt = (worktree ? worktreeSystemPrompt(wid, worktree.branch, worktree.dir, worktree.snapshot) + "\n\n" : "") + parsed.prompt;
+	const prompt = (a.limit ? deadlinePromptLine(a.limit) + "\n\n" : "") + (worktree ? worktreeSystemPrompt(wid, worktree.branch, worktree.dir, worktree.snapshot) + "\n\n" : "") + parsed.prompt;
 	let status = {
 		id: wid,
 		pid: process.pid,
+		...parentInfo(),
 		label,
 		cwd,
 		term,
@@ -4418,7 +4862,11 @@ async function executeCodexRun(a) {
 			worktreeBase: worktree.base,
 			worktreeSnapshot: worktree.snapshot
 		} : {},
-		...a.specPath ? { spec: a.specPath } : {}
+		...a.specPath ? { spec: a.specPath } : {},
+		...a.limit ? {
+			deadlineAt: a.limit.deadlineAt,
+			maxMinutes: a.limit.minutes
+		} : {}
 	};
 	saveStatus(logDir, status);
 	a.onWorkerStart?.(wid);
@@ -4467,6 +4915,7 @@ async function executeCodexRun(a) {
 		...target.provider.contextWindow ? { context_window: target.provider.contextWindow } : {}
 	});
 	let killed = false;
+	const stopDeadline = a.limit ? armDeadline(proc, a.limit, () => fireDeadline(logDir, status, ledger, a.limit)) : null;
 	process.once("SIGTERM", onCodexSignal("SIGTERM"));
 	process.once("SIGINT", onCodexSignal("SIGINT"));
 	process.once("SIGHUP", onCodexSignal("SIGHUP"));
@@ -4476,8 +4925,21 @@ async function executeCodexRun(a) {
 			status.state = "killed";
 			status.rc = 143;
 			status.secs = Math.floor((Date.now() - t0) / 1e3);
-			status.last = `killed by signal ${sig}`;
+			const end = recordSignalEnd(logDir, status, sig);
+			status.last = `killed by signal ${sig} (${end.reason}${end.by ? ` by ${end.by}` : ""})`;
 			saveStatus(logDir, status);
+			appendLedger(ledger, "WORKER-END", {
+				id: wid,
+				provider: target.providerName,
+				mode: "headless",
+				model,
+				rc: 143,
+				secs: status.secs,
+				killed: 1,
+				...endFields(end),
+				note: end.note,
+				label
+			});
 			if (worktree) {
 				salvageOnExit(ledger, wid, label, worktree.dir, SIGNAL_SALVAGE_MS);
 				try {
@@ -4507,6 +4969,7 @@ async function executeCodexRun(a) {
 		proc.on("error", reject);
 		proc.on("close", (code) => resolve(code ?? (killed ? 143 : 1)));
 	});
+	stopDeadline?.();
 	closeSync(eventsFd);
 	const secs = Math.floor((Date.now() - t0) / 1e3);
 	const finalText = fold.finalText ?? "";
@@ -4554,6 +5017,7 @@ async function executeCodexRun(a) {
 		report,
 		fallbackText: finalText,
 		worktree,
+		timedOut: status.timedOut ? a.limit?.minutes : void 0,
 		beforeHandoff: (st, rep) => {
 			if (!a.quiet) printResult(parsed.outputFormat, resultEvent, rc, logDir, wid, rep, worktreeExtras(st));
 		}
@@ -4690,5 +5154,5 @@ function resultFromOutput(out) {
 }
 
 //#endregion
-export { expandMcpNames as $, ledgerSummary as A, loadStatuses as B, discardWorker as C, uncommittedPaths as D, mergeWorker as E, contextPercent as F, setWorkerLabel as G, nowStamp as H, elapsedOf as I, parseRunnerArgs as J, waitForTerminalStatus as K, isChatPane as L, ageOf as M, alive as N, worktreesDir as O, contextLabel as P, describeMcp as Q, isLive as R, workerInScope as S, git as T, ownsPid as U, newWorkerId as V, saveStatus as W, pinNotices as X, shortText as Y, projectLaunchConfig as Z, itermForClaudeSession as _, parseWorkerReport as a, sessionMapPath as b, readInbox as c, checkPaneForWorker as d, openFollowPane as f, currentTabKey as g, markControlsHeld as h, usageContextTokens as i, UNLABELED as j, appendLedger as k, sayToWorker as l, clickrControlsArgv as m, runWorker as n, renderReport as o, openPaneForWorker as p, longInlinePromptHint as q, testProvider as r, handoffFromInside as s, printResult as t, workerDepth as u, itermUuid as v, gcWorktrees as w, sessionTag as x, resolveSession as y, loadStatus as z };
-//# sourceMappingURL=run-DMaCpvMW.mjs.map
+export { parseRunnerArgs as $, mergeWorker as A, contextPercent as B, resolveSession as C, discardWorker as D, workerInScope as E, ledgerSummary as F, loadStatuses as G, isChatPane as H, UNLABELED as I, ownsPid as J, newWorkerId as K, ageOf as L, verifyWorker as M, worktreesDir as N, gcWorktrees as O, appendLedger as P, longInlinePromptHint as Q, alive as R, itermUuid as S, sessionTag as T, isLive as U, elapsedOf as V, loadStatus as W, setWorkerLabel as X, saveStatus as Y, waitForTerminalStatus as Z, callerDescription as _, deadlineLabel as a, currentTabKey as b, handoffFromInside as c, workerDepth as d, shortText as et, checkPaneForWorker as f, markControlsHeld as g, clickrControlsArgv as h, usageContextTokens as i, expandMcpNames as it, uncommittedPaths as j, git as k, readInbox as l, openPaneForWorker as m, runWorker as n, projectLaunchConfig as nt, parseWorkerReport as o, openFollowPane as p, nowStamp as q, testProvider as r, describeMcp as rt, renderReport as s, printResult as t, pinNotices as tt, sayToWorker as u, endLabel as v, sessionMapPath as w, itermForClaudeSession as x, requestKill as y, contextLabel as z };
+//# sourceMappingURL=run-BCpbxqA5.mjs.map