@tekmidian/pai 0.66.0 → 0.66.2

package/dist/{run-Z4akoa8G.mjs → run-CLYTOm0x.mjs}

@@ -1,11 +1,12 @@
-import { i as getRegistryBackend } from "./factory-CNpPQQ-5.mjs";
-import { A as resolveProviderKey, D as readWorkersSection, E as providerKeyPath, _ as classModelCapability, f as NATIVE_ANTHROPIC_MODELS, g as assertProviderRunnable, h as WorkersConfigError, k as resolveModelCapability, n as claudeCommand, t as buildRunEnv, x as isModelCapability } from "./run-env-DRcp7A8K.mjs";
-import { _ as statusPath, d as resolveTarget, f as setCooldown, g as panesDir, h as ledgerPath, i as capabilityForRun, m as eventsPath, n as ensureProxyRunning, o as isQuotaFailure, p as ensureNoMcpConfig, s as nextAutoProvider, t as DEFAULT_PROXY_PORT, u as resolveCapabilityRun, v as workersLogDir } from "./server-DgmAHyFK.mjs";
+import { i as getRegistryBackend } from "./factory-Ypf8r0fK.mjs";
+import { a as paiHomePath, o as resolvePaiFile } from "./pai-home-Cm9rcJgX.mjs";
+import { A as resolveProviderKey, D as readWorkersSection, E as providerKeyPath, O as resolveCapability, T as providerCostTier, _ as classModelCapability, b as getProviderOrNative, f as NATIVE_ANTHROPIC_MODELS, g as assertProviderRunnable, h as WorkersConfigError, k as resolveModelCapability, m as WORKER_CLASSES, n as claudeCommand, o as DEFAULT_LOG_DIR, r as ANTHROPIC_NATIVE, t as buildRunEnv, x as isModelCapability, y as expandHome } from "./run-env-Bnmf6bRI.mjs";
 import { appendFileSync, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { homedir, platform, tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { execFileSync, spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
 import { connect, createServer } from "node:net";
+import { execFileSync, spawn } from "node:child_process";
 import { createInterface } from "node:readline";
 
 //#region src/workers/mcp.ts
@@ -223,6 +224,399 @@ function pinNotices(launch, claudeJson) {
 	return lines;
 }
 
+//#endregion
+//#region src/workers/paths.ts
+/**
+* paths.ts — where worker run artefacts live.
+*
+* Everything a run writes (event mirror, status file, pane registry, routing
+* state, the empty MCP config) sits under one logDir so the whole tree is
+* disposable and configurable: `workers.logDir`, default ~/.claude/logs/workers.
+*/
+/**
+* Absolute logDir for the given config. An explicit `logDir` in workers.yaml
+* is honored verbatim (the user chose it). Otherwise this resolves like every
+* other PAI_HOME file: PAI_HOME/logs/workers if it exists, else the old
+* ~/.claude/logs/workers (with a one-time notice), else the new path.
+*/
+function workersLogDir(config) {
+	const expanded = expandHome(config.logDir);
+	if (config.logDir !== DEFAULT_LOG_DIR) return expanded;
+	return resolvePaiFile(paiHomePath("logs", "workers"), [expanded], "pai config migrate --logs");
+}
+/** The strict empty MCP config for headless runs, written on demand. */
+function ensureNoMcpConfig(logDir) {
+	const path = noMcpConfigPath(logDir);
+	if (!existsSync(path)) {
+		mkdirSync(logDir, { recursive: true });
+		writeFileSync(path, "{ \"mcpServers\": {} }\n", "utf8");
+	}
+	return path;
+}
+function statusPath(logDir, id) {
+	return join(logDir, `${id}.status`);
+}
+function eventsPath(logDir, id) {
+	return join(logDir, `${id}.jsonl`);
+}
+function ledgerPath(logDir) {
+	return join(logDir, "ledger.log");
+}
+function routingStatePath(logDir) {
+	return join(logDir, "routing-state.json");
+}
+function panesDir(logDir) {
+	return join(logDir, "panes");
+}
+/**
+* The strict empty MCP config handed to headless workers. Written into the
+* logDir on demand (never into the user's vendor config directory — this is
+* PAI state, not vendor state).
+*/
+function noMcpConfigPath(logDir) {
+	return join(logDir, "no-mcp.json");
+}
+
+//#endregion
+//#region src/workers/routing.ts
+/**
+* routing.ts — provider selection: flag > class > active (possibly "auto").
+*
+* Auto-routing walks `workers.routing.order` — or the class's own `order` —
+* and takes the first provider that is enabled, out of cooldown, (when it
+* defines a quotaProbe) under its quotaSkipAt threshold, and — when the class
+* constrains it — within `maxCostTier` and carrying all `requireTags`. A run
+* that dies of a quota/rate error puts its provider in cooldown for
+* cooldownMinutes; when that happens before the first tool call and
+* retryOnQuota is set, the runner restarts the same task on the next provider
+* (ledger: WORKER-REROUTE).
+*
+* An explicit --provider or a class mapping that pins a provider always
+* bypasses all of this.
+*/
+const QUOTA_SKIP_DEFAULT = 95;
+const PROBE_TIMEOUT_MS = 1e4;
+function readRoutingState(logDir) {
+	const path = routingStatePath(logDir);
+	if (!existsSync(path)) return { cooldowns: {} };
+	try {
+		return { cooldowns: JSON.parse(readFileSync(path, "utf8")).cooldowns ?? {} };
+	} catch {
+		return { cooldowns: {} };
+	}
+}
+function writeRoutingState(logDir, state) {
+	const path = routingStatePath(logDir);
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n", "utf8");
+	renameSync(tmp, path);
+}
+function cooldownRemaining(state, provider, now = /* @__PURE__ */ new Date()) {
+	const end = state.cooldowns[provider];
+	if (!end) return 0;
+	const ms = Date.parse(end) - now.getTime();
+	return ms > 0 ? ms : 0;
+}
+function setCooldown(logDir, provider, minutes, now = /* @__PURE__ */ new Date()) {
+	const state = readRoutingState(logDir);
+	state.cooldowns[provider] = new Date(now.getTime() + minutes * 6e4).toISOString();
+	writeRoutingState(logDir, state);
+}
+function clearCooldown(logDir, provider) {
+	const state = readRoutingState(logDir);
+	if (!(provider in state.cooldowns)) return;
+	delete state.cooldowns[provider];
+	writeRoutingState(logDir, state);
+}
+/**
+* Run a provider's quotaProbe and return its percentage (0–100), or null when
+* there is no probe or it printed nothing usable. A probe must never break
+* routing: failures read as "unknown", not as "full".
+*/
+function probeQuota(provider) {
+	if (!provider.quotaProbe) return null;
+	try {
+		const m = execFileSync("/bin/sh", ["-c", provider.quotaProbe], {
+			timeout: PROBE_TIMEOUT_MS,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).match(/(\d+(?:\.\d+)?)/);
+		if (!m) return null;
+		return Math.min(100, Math.max(0, Math.round(parseFloat(m[1]))));
+	} catch {
+		return null;
+	}
+}
+function quotaSkipThreshold(provider) {
+	return provider.quotaSkipAt ?? QUOTA_SKIP_DEFAULT;
+}
+/** Does this provider exceed its quota threshold right now? */
+function quotaExceeded(provider) {
+	const used = probeQuota(provider);
+	return used !== null && used >= quotaSkipThreshold(provider);
+}
+var NoProviderError = class extends WorkersConfigError {};
+function mustExist(config, name) {
+	const p = getProviderOrNative(config, name);
+	if (!p) throw new NoProviderError(`no worker provider named "${name}". Configured: ${Object.keys(config.providers).join(", ") || "(none)"}.\nAdd one with: pai worker providers add <name> --base-url <url> --key-file <path> --model <model>`);
+	return p;
+}
+function mustBeRunnable(name, p) {
+	if (!p.enabled) throw new NoProviderError(`provider "${name}" is disabled. Enable it with: pai worker providers enable ${name}`);
+	return p;
+}
+/** Why one provider of a routing order did not qualify (message fragment). */
+function exclusionReason(config, state, name, cls) {
+	const p = getProviderOrNative(config, name);
+	if (!p) return "not configured";
+	if (!p.enabled) return "disabled";
+	if (cooldownRemaining(state, name) > 0) return "cooldown";
+	if (quotaExceeded(p)) return "quota";
+	const tier = providerCostTier(p);
+	if (cls?.maxCostTier !== void 0 && tier > cls.maxCostTier) return `cost tier ${tier} > max ${cls.maxCostTier}`;
+	if (cls?.requireTags?.length) {
+		const have = p.tags ?? [];
+		const missing = cls.requireTags.filter((t) => !have.includes(t));
+		if (missing.length) return `missing tags: ${missing.join(", ")}`;
+	}
+	return null;
+}
+/**
+* Resolve which provider (and model alias) a run uses.
+*
+* @param flagProvider --provider value, highest precedence
+* @param className    --class value (the old --role), looked up in workers.classes
+*/
+function resolveTarget(config, logDir, opts = {}) {
+	if (opts.flagProvider) return {
+		providerName: opts.flagProvider,
+		provider: mustBeRunnable(opts.flagProvider, mustExist(config, opts.flagProvider)),
+		modelAlias: null,
+		classMcp: null,
+		via: "flag"
+	};
+	const clsTarget = opts.className ? config.classes[opts.className] : void 0;
+	const cls = typeof clsTarget === "object" && clsTarget !== null ? clsTarget : void 0;
+	if (opts.className && clsTarget !== void 0 && typeof clsTarget !== "object") {
+		const [name, alias] = clsTarget.split("/");
+		return {
+			providerName: name,
+			provider: mustBeRunnable(name, mustExist(config, name)),
+			modelAlias: alias ?? null,
+			classMcp: null,
+			via: "class"
+		};
+	}
+	if (opts.className && cls?.provider) {
+		const provider = mustBeRunnable(cls.provider, mustExist(config, cls.provider));
+		return {
+			providerName: cls.provider,
+			provider,
+			modelAlias: null,
+			classMcp: cls.mcp ?? null,
+			via: "class"
+		};
+	}
+	if (opts.className && clsTarget === void 0) {
+		if (!WORKER_CLASSES.includes(opts.className)) throw new NoProviderError(`no class named "${opts.className}". Standard classes: ${WORKER_CLASSES.join(", ")}.Defined: ${Object.keys(config.classes).join(", ") || "(none)"}.\nSet one with: pai worker classes set ${opts.className}=<provider[/alias]>`);
+	}
+	if (config.active !== "auto") {
+		const name = config.active ?? ANTHROPIC_NATIVE;
+		return {
+			providerName: name,
+			provider: mustBeRunnable(name, mustExist(config, name)),
+			modelAlias: null,
+			classMcp: null,
+			via: "active"
+		};
+	}
+	const state = readRoutingState(logDir);
+	const order = cls?.order ?? config.routing.order;
+	const excluded = [];
+	for (const name of order) {
+		const p = getProviderOrNative(config, name);
+		const why = exclusionReason(config, state, name, cls);
+		if (why) {
+			excluded.push(`${name}: ${why}`);
+			continue;
+		}
+		return {
+			providerName: name,
+			provider: p,
+			modelAlias: null,
+			classMcp: cls?.mcp ?? null,
+			via: "auto"
+		};
+	}
+	throw new NoProviderError(`auto-routing found no usable provider${opts.className ? ` for class "${opts.className}"` : ""} (order: [${order.join(", ")}]).${excluded.length ? `\nExcluded: ${excluded.join("; ")}.` : ""}\nClear a cooldown with: pai worker providers enable <name>; widen the class with: pai worker classes set ${opts.className ?? "<class>"}=<target>`);
+}
+/**
+* Next provider after `from` in auto order, applying the same filters.
+* Used by rerouting; null when the order is exhausted.
+*/
+function nextAutoProvider(config, logDir, from, now = /* @__PURE__ */ new Date()) {
+	const state = readRoutingState(logDir);
+	const order = config.routing.order;
+	const start = order.indexOf(from);
+	for (let i = start + 1; i < order.length; i++) {
+		const name = order[i];
+		const p = getProviderOrNative(config, name);
+		if (!p || !p.enabled) continue;
+		const end = state.cooldowns[name];
+		if (end && Date.parse(end) > now.getTime()) continue;
+		if (quotaExceeded(p)) continue;
+		return name;
+	}
+	return null;
+}
+/**
+* Was this failure a quota/rate failure? Detected from the result text the
+* endpoint produced (HTTP status is not visible in the stream events).
+*/
+function isQuotaFailure(resultText) {
+	return /usage limit reached|rate limit|quota/i.test(resultText);
+}
+/**
+* Whether a run should resolve through `resolveCapability` instead of
+* `resolveTarget`: an explicit `--capability` always does. A `--class`
+* whose implied capability is not "default" (e.g. `image`) does too, but
+* only when the class itself names no provider — a class already pinned to
+* one (`image: glm/image`) always wins unchanged, same as any other class.
+*/
+function capabilityForRun(config, opts) {
+	if (opts.capabilityFlag) return opts.capabilityFlag;
+	if (!opts.className) return null;
+	const capability = classModelCapability(opts.className);
+	if (capability === "default") return null;
+	const clsTarget = config.classes[opts.className];
+	return (typeof clsTarget === "string" ? true : Boolean(clsTarget?.provider)) ? null : capability;
+}
+/**
+* resolveCapability, turned into a runnable provider (NoProviderError-shaped
+* on failure). Unlike resolveCapability itself — which falls back to the
+* active provider's default model so `describeCapabilities` has something to
+* report — an actual run refuses the fallback: silently running a normal
+* model on a prompt written for a capability it does not have (an image
+* prompt fed to a text model, say) produces a confusing non-answer instead
+* of a clear error naming the config key to set.
+*/
+function resolveCapabilityRun(config, capability) {
+	const r = resolveCapability(config, capability);
+	if (r.fellBack) throw new NoProviderError(`no provider declares the "${capability}" capability — configure one with: pai worker capability ${capability} <provider>[,<provider>…], or pai worker model ${capability} <model-id> --provider <name>`);
+	if (capability === "image" && r.engine !== "image") throw new NoProviderError(`provider "${r.provider}" has no image engine (it would run "${r.model}" on its normal ${r.engine} engine, not generate an image) — configure an engine=image provider with: pai worker providers add <name> --engine image --url <url> --key <key> --model <id>, then pai worker capability image <name>`);
+	const provider = getProviderOrNative(config, r.provider);
+	if (!provider) throw new NoProviderError(`capability "${capability}" resolved to unknown provider "${r.provider}"`);
+	return {
+		providerName: r.provider,
+		provider,
+		model: r.model,
+		engine: r.engine,
+		fellBack: r.fellBack,
+		capability
+	};
+}
+
+//#endregion
+//#region src/workers/proxy/server.ts
+/**
+* server.ts — the PAI worker proxy: Anthropic Messages API on the front,
+* OpenAI Chat Completions on the back, loopback only.
+*
+* One proxy serves every OpenAI-protocol provider: Claude Code points
+* ANTHROPIC_BASE_URL at `http://127.0.0.1:8797/<provider>` and the provider
+* name in the path selects the upstream (`upstreamUrl` + `keyFile` from the
+* workers config, re-read per request so config edits apply without a
+* restart). `run` starts the proxy on demand (detached, pid file under the
+* logDir) and `pai worker proxy stop` stops it again.
+*
+* All translation lives in translate.ts; this file is only HTTP plumbing.
+*/
+const DEFAULT_PROXY_PORT = 8797;
+const HOST = "127.0.0.1";
+function proxyPidPath(logDir) {
+	return join(logDir, "proxy.pid");
+}
+/** True when something already accepts connections on the port. */
+function proxyListening(port = DEFAULT_PROXY_PORT, timeoutMs = 400) {
+	return new Promise((resolve) => {
+		const sock = connect({
+			port,
+			host: HOST
+		});
+		const done = (ok) => {
+			sock.removeAllListeners();
+			sock.destroy();
+			resolve(ok);
+		};
+		sock.setTimeout(timeoutMs, () => done(false));
+		sock.once("connect", () => done(true));
+		sock.once("error", () => done(false));
+	});
+}
+/**
+* Where the standalone proxy artefact lives, found from this module's own
+* location (dist/cli bundle → ../hooks/, dev checkout → <repo>/dist/hooks).
+*/
+function standaloneProxyPath() {
+	let dir = dirname(fileURLToPath(import.meta.url));
+	for (let i = 0; i < 6; i++) {
+		for (const cand of [
+			join(dir, "worker-proxy.mjs"),
+			join(dir, "hooks", "worker-proxy.mjs"),
+			join(dir, "dist", "hooks", "worker-proxy.mjs")
+		]) if (existsSync(cand)) return cand;
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return null;
+}
+/**
+* Ensure a proxy is listening on the port; start the detached standalone when
+* nothing answers. Returns the base URL (`http://127.0.0.1:<port>`).
+*/
+async function ensureProxyRunning(port, logDir) {
+	if (await proxyListening(port)) return `http://${HOST}:${port}`;
+	const script = standaloneProxyPath();
+	if (!script) throw new Error(`the PAI worker proxy is not running and its build was not found — run \`bun run build\` (or start one with: pai worker proxy --port ${port})`);
+	if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
+	const child = spawn(process.execPath, [
+		script,
+		"--port",
+		String(port)
+	], {
+		detached: true,
+		stdio: "ignore"
+	});
+	child.unref();
+	writeFileSync(proxyPidPath(logDir), `${child.pid}\n`, "utf8");
+	for (let i = 0; i < 40; i++) {
+		if (await proxyListening(port)) return `http://${HOST}:${port}`;
+		await new Promise((r) => setTimeout(r, 250));
+	}
+	throw new Error(`the PAI worker proxy did not come up on port ${port} (see ${proxyPidPath(logDir)})`);
+}
+/** `pai worker proxy stop`: SIGTERM the pid from the pid file. */
+function stopProxy(logDir) {
+	const path = proxyPidPath(logDir);
+	if (!existsSync(path)) return "no proxy pid file — nothing to stop";
+	const pid = parseInt(readFileSync(path, "utf8").trim(), 10);
+	unlinkSync(path);
+	if (!Number.isFinite(pid)) return "stale proxy pid file removed";
+	try {
+		process.kill(pid, "SIGTERM");
+	} catch {
+		return `proxy pid ${pid} was not running (pid file removed)`;
+	}
+	return `proxy pid ${pid} stopped`;
+}
+
 //#endregion
 //#region src/workers/args.ts
 function parseRunnerArgs(argv) {
@@ -1774,6 +2168,126 @@ function itermForClaudeSession(logDir, claudeSession, now = Date.now()) {
 	return term ? itermUuid(term) : null;
 }
 
+//#endregion
+//#region src/workers/endreason.ts
+/**
+* Who or what ended a worker. One place decides the reason; the runner's
+* signal handlers and the deadline record it, `pai worker kill` and the daemon
+* leave a kill-request marker (`<logDir>/<id>.kill`) before signalling so the
+* runner can tell their stops from an external one.
+*/
+const killMarkerPath = (logDir, id) => join(logDir, `${id}.kill`);
+/** Best description of the invoking session: PAI parent/AIBroker session env, else the Claude Code session id. */
+function callerDescription(env = process.env) {
+	const name = env.PAI_WORKER_PARENT ?? env.PAI_SESSION_NAME ?? env.AIBROKER_SESSION_NAME ?? env.AIBROKER_SESSION;
+	if (name) return name;
+	if (env.CLAUDE_CODE_SESSION_ID) return `claude-session:${env.CLAUDE_CODE_SESSION_ID}`;
+	return env.CLAUDECODE ? "claude-code" : "shell";
+}
+/** Write the kill-request marker and the WORKER-KILL ledger line; call right before signalling. */
+function requestKill(logDir, ledger, id, by = callerDescription()) {
+	const req = {
+		ts: (/* @__PURE__ */ new Date()).toISOString(),
+		by,
+		pid: process.pid,
+		ppid: process.ppid,
+		cwd: process.cwd()
+	};
+	writeFileSync(killMarkerPath(logDir, id), JSON.stringify(req));
+	appendLedger(ledger, "WORKER-KILL", {
+		id,
+		by,
+		pid: req.pid,
+		ppid: req.ppid,
+		cwd: req.cwd
+	});
+}
+function readMarker(logDir, id) {
+	const p = killMarkerPath(logDir, id);
+	if (!existsSync(p)) return null;
+	try {
+		return JSON.parse(readFileSync(p, "utf8"));
+	} catch {
+		return {
+			ts: "",
+			by: "unknown",
+			pid: 0,
+			ppid: 0,
+			cwd: ""
+		};
+	} finally {
+		try {
+			unlinkSync(p);
+		} catch {}
+	}
+}
+function pidAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (e) {
+		return e.code === "EPERM";
+	}
+}
+/** Command name of a pid (`ps -o comm=`), or undefined when it is gone or ps fails. */
+function commOf(pid) {
+	try {
+		return execFileSync("ps", [
+			"-o",
+			"comm=",
+			"-p",
+			String(pid)
+		], { encoding: "utf8" }).trim() || void 0;
+	} catch {
+		return;
+	}
+}
+/** Parent facts recorded at start, for the end report ("parent: claude"). */
+function parentInfo() {
+	const parentPid = process.ppid;
+	return {
+		parentPid,
+		parentComm: commOf(parentPid),
+		parentBackground: process.env.CLAUDECODE ? true : void 0
+	};
+}
+/**
+* The single decision. `signal` = the signal the runner received (absent for a
+* deadline stop or a normal exit); `timedOut` = the deadline fired. Reads (and
+* consumes) the kill marker.
+*/
+function decideEndReason(a) {
+	if (a.timedOut) return { reason: "deadline" };
+	if (!a.signal) return { reason: "exit" };
+	const marker = readMarker(a.logDir, a.id);
+	if (marker) return {
+		reason: "pai-worker-kill",
+		by: marker.by,
+		note: `${a.signal} requested by pid ${marker.pid}`
+	};
+	const alive = (a.isAlive ?? pidAlive)(a.parentPid ?? process.ppid);
+	const parent = `parent ${a.parentPid ?? "?"}${a.parentComm ? ` (${a.parentComm})` : ""}`;
+	if (!alive) return {
+		reason: "parent-gone",
+		note: `${a.signal}; ${parent} not alive`
+	};
+	return {
+		reason: "external-signal",
+		note: `${a.signal}; sender unknown (not deadline, not pai worker kill); a Claude Code background task stop (TaskStop, Bash timeout, session end) is the usual source; ${parent} alive` + (a.parentBackground ? "; started from a Claude Code session" : "")
+	};
+}
+/** The status/ledger fields for an end. */
+function endFields(e) {
+	return {
+		reason: e.reason,
+		...e.by ? { by: e.by } : {}
+	};
+}
+/** "external-signal", "pai-worker-kill by <caller>" for a finished worker; null when nothing was recorded. */
+function endLabel(s) {
+	return s.endReason ? `${s.endReason}${s.endBy ? ` by ${s.endBy}` : ""}` : null;
+}
+
 //#endregion
 //#region src/workers/controls.ts
 /**
@@ -1938,7 +2452,7 @@ async function runImageCapability(opts) {
 * dynamic profile (Close Sessions On End), so panes disappear by themselves.
 *
 * Panes are tracked per scope (AIBroker session id, else tab key) in
-* <logDir>/panes/<key>.json, keyed by iTerm session unique id, newest first —
+* <logDir>/panes/<key>/<worker id>.json (one file per worker), iTerm session unique id, newest first —
 * the split lands below the lowest live worker pane.
 *
 * The dynamic profile's font is the family of iTerm's DEFAULT profile (the
@@ -2339,21 +2853,204 @@ async function followProfile(fontSize, read = itermPrefs) {
 	process.stderr.write(`pai worker pane: profile ${PROFILE_NAME} not visible, splitting with default\n`);
 	return "";
 }
-function loadRegistry(path) {
+/**
+* One file per worker, `<panes>/<scope>/<worker id>.json`: concurrent opens
+* for the same scope write different files, so none can be lost (the former
+* shared `<scope>.json` list was a read-modify-write that dropped entries when
+* workers started a second apart). Legacy `<scope>.json` lists are still read.
+*/
+function readEntry(path, scope) {
 	try {
-		const reg = JSON.parse(readFileSync(path, "utf8"));
-		return Array.isArray(reg) ? reg : [];
+		const v = JSON.parse(readFileSync(path, "utf8"));
+		return (Array.isArray(v) ? v : [v]).filter((e) => !!e && typeof e.session === "string" && typeof e.worker === "string").map((e) => ({
+			...e,
+			scope
+		}));
 	} catch {
 		return [];
 	}
 }
-function saveRegistry(path, reg) {
-	const dir = dirname(path);
-	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-	const tmp = `${path}.tmp`;
-	writeFileSync(tmp, JSON.stringify(reg, null, 1), "utf8");
+/** Registry entries of one scope (`scope` set) or of all scopes, oldest first. */
+function loadRegistry(logDir, scope) {
+	const root = panesDir(logDir);
+	const out = [];
+	let names = [];
+	try {
+		names = readdirSync(root);
+	} catch {
+		return out;
+	}
+	for (const name of names.sort()) {
+		const full = join(root, name);
+		if (name.endsWith(".json")) {
+			const sc = name.slice(0, -5);
+			if (!scope || sc === scope) out.push(...readEntry(full, sc));
+		} else if (!scope || name === scope) try {
+			for (const f of readdirSync(full)) if (f.endsWith(".json")) out.push(...readEntry(join(full, f), name));
+		} catch {}
+	}
+	return out.sort((x, y) => x.opened.localeCompare(y.opened));
+}
+function entryPath(logDir, e) {
+	return join(panesDir(logDir), e.scope ?? "", `${e.worker}.json`);
+}
+function saveEntry(logDir, e) {
+	const path = entryPath(logDir, e);
+	mkdirSync(dirname(path), { recursive: true });
+	const tmp = `${path}.${process.pid}.tmp`;
+	writeFileSync(tmp, JSON.stringify({
+		session: e.session,
+		worker: e.worker,
+		opened: e.opened
+	}, null, 1), "utf8");
 	renameSync(tmp, path);
 }
+/** Forget an entry (its per-worker file; a legacy list is rewritten without it). */
+function dropEntry(logDir, e) {
+	const legacy = join(panesDir(logDir), `${e.scope}.json`);
+	rmSync(entryPath(logDir, e), { force: true });
+	if (existsSync(legacy)) {
+		const rest = readEntry(legacy, e.scope ?? "").filter((x) => x.session !== e.session);
+		writeFileSync(legacy, JSON.stringify(rest.map(({ scope: _s, ...x }) => x), null, 1), "utf8");
+	}
+}
+const LIST_SESSIONS_SCRIPT = `on run(argv)
+    set out to ""
+    tell application id "com.googlecode.iterm2"
+        if not running then return ""
+        repeat with w in windows
+            repeat with t in tabs of w
+                repeat with s in sessions of t
+                    set out to out & (id of s as text) & (ASCII character 9) & (tty of s as text) & (ASCII character 9) & (name of s as text) & linefeed
+                end repeat
+            end repeat
+        end repeat
+    end tell
+    return out
+end run`;
+const END_SESSION_SCRIPT = `on run(argv)
+    set targetID to item 1 of argv
+    tell application id "com.googlecode.iterm2"
+        if not running then return "notrunning"
+        repeat with w in windows
+            repeat with t in tabs of w
+                repeat with s in sessions of t
+                    if id of s is targetID then
+                        close s
+                        return "closed"
+                    end if
+                end repeat
+            end repeat
+        end repeat
+    end tell
+    return "notfound"
+end run`;
+const realPaneOps = {
+	async listIterm() {
+		if (process.platform !== "darwin") return [];
+		try {
+			const p = await osascript(LIST_SESSIONS_SCRIPT, []);
+			const cmdByTty = /* @__PURE__ */ new Map();
+			for (const line of psOutput("tty=,command=").split("\n")) {
+				const [tty, ...rest] = line.trim().split(/\s+/);
+				if (tty && tty !== "??") cmdByTty.set(`/dev/${tty}`, rest.join(" "));
+			}
+			return p.stdout.split("\n").filter(Boolean).map((l) => {
+				const [id, tty, ...name] = l.split("	");
+				return {
+					id,
+					name: `${name.join("	")} ${cmdByTty.get(tty) ?? ""}`.trim()
+				};
+			});
+		} catch {
+			return [];
+		}
+	},
+	async closeIterm(id) {
+		return (await osascript(END_SESSION_SCRIPT, [id])).stdout.trim() === "closed";
+	},
+	listTmux() {
+		try {
+			return execFileSync("tmux", [
+				"list-panes",
+				"-a",
+				"-F",
+				"#{pane_id}	#{pane_start_command}"
+			], {
+				encoding: "utf8",
+				stdio: [
+					"ignore",
+					"pipe",
+					"ignore"
+				]
+			}).split("\n").filter(Boolean).map((l) => ({
+				id: l.split("	")[0],
+				command: l.split("	").slice(1).join(" ")
+			}));
+		} catch {
+			return [];
+		}
+	},
+	closeTmux(id) {
+		try {
+			execFileSync("tmux", [
+				"kill-pane",
+				"-t",
+				id
+			], { stdio: "ignore" });
+			return true;
+		} catch {
+			return false;
+		}
+	}
+};
+const FOLLOW_ID = /worker[- ]follow (\d{8}-\d{6}-\d+)/;
+/**
+* Close every open follow pane whose worker has ended: registry entries first
+* (by worker id), then any iTerm session named after / tmux pane started with a
+* `worker follow <id>` command of an ended worker. `ended(id)` says whether
+* that worker is over; unknown ids are never closed. `dryRun` only reports.
+*/
+async function closeEndedPanes(logDir, ended, dryRun, ops = realPaneOps) {
+	const res = {
+		closed: [],
+		kept: []
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const handle = async (backend, id, worker, entry) => {
+		const key = `${backend}:${id}`;
+		if (seen.has(key)) return;
+		seen.add(key);
+		if (!ended(worker)) {
+			res.kept.push(`${worker} ${key} (running)`);
+			return;
+		}
+		if (!dryRun) {
+			const ok = backend === "tmux" ? ops.closeTmux(id) : await ops.closeIterm(id).catch(() => false);
+			if (entry) dropEntry(logDir, entry);
+			if (!ok && !entry) return;
+		}
+		res.closed.push(`${worker} ${key}${dryRun ? " (dry run)" : ""}`);
+	};
+	const sessions = await ops.listIterm();
+	const open = new Set(sessions.map((s) => s.id));
+	for (const e of loadRegistry(logDir)) {
+		if (sessions.length && !open.has(e.session)) {
+			if (!dryRun) dropEntry(logDir, e);
+			continue;
+		}
+		await handle("iterm", e.session, e.worker, e);
+	}
+	for (const s of sessions) {
+		const m = FOLLOW_ID.exec(s.name);
+		if (m) await handle("iterm", s.id, m[1]);
+	}
+	for (const t of ops.listTmux()) {
+		const m = FOLLOW_ID.exec(t.command);
+		if (m) await handle("tmux", t.id, m[1]);
+	}
+	return res;
+}
 /**
 * The command a worker pane runs: one exec-able line with no shell syntax —
 * iTerm's split command parameter execs without a shell (proven live: panes
@@ -2417,8 +3114,8 @@ async function openPaneForWorker(logDir, config, wid, term) {
 		};
 	}
 	const uid = itermUuid(term);
-	const regPath = join(panesDir(logDir), `${scopeKey(term)}.json`);
-	const reg = loadRegistry(regPath);
+	const scope = scopeKey(term);
+	const reg = loadRegistry(logDir, scope);
 	const profile = await followProfile(config.pane.fontSize);
 	const cmd = followCommand(wid, config.pane.autoExitSecs);
 	const p = await osascript(WORKER_SPLIT_SCRIPT, [
@@ -2432,13 +3129,13 @@ async function openPaneForWorker(logDir, config, wid, term) {
 	const bar = out.indexOf("|");
 	if (bar < 0) throw new Error(`pai worker pane: osascript failed: ${(p.stderr || out).slice(0, 200)}`);
 	const live = new Set(out.slice(0, bar).split(",").filter(Boolean));
-	const pruned = reg.filter((e) => live.has(e.session));
-	pruned.push({
+	for (const e of reg) if (!live.has(e.session)) dropEntry(logDir, e);
+	saveEntry(logDir, {
 		session: out.slice(bar + 1),
 		worker: wid,
-		opened: (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19)
+		opened: (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19),
+		scope
 	});
-	saveRegistry(regPath, pruned);
 	return {
 		message: `pane opened for ${wid}`,
 		session: out.slice(bar + 1)
@@ -3090,6 +3787,7 @@ function fullContractPrompt(format) {
 		"116 s). Ending your turn ends this process, so a background job gets no later wake-up here:",
 		"run_in_background is denied. Run the long command in the FOREGROUND with a Bash timeout up to 600000 ms",
 		"and split longer jobs into steps that each fit it.",
+		"Kill only processes you started, by PID (`cmd & echo $! > /tmp/x.pid`, then `kill $(cat /tmp/x.pid)`); never `pkill`/`killall`/`kill $(pgrep ...)` — other workers' command lines contain your spec text.",
 		...fileNotInlineBlock(),
 		"",
 		`Operator messages: a user turn starting with ${OPERATOR_MARK} was typed by the operator while you`,
@@ -3774,7 +4472,7 @@ async function runWorker(opts) {
 		if (gc?.length) process.stderr.write(`pai worker: archived ${gc.length} leftover worktree(s) (pai worker gc)\n`);
 	} catch {}
 	if (opts.className === "plan" && !opts._planner) {
-		const { runPlanner } = await import("./planner-EJPZnnif.mjs");
+		const { runPlanner } = await import("./planner-D5yt0EfA.mjs");
 		return runPlanner(opts);
 	}
 	const parent = launchParent(opts.parent);
@@ -4003,6 +4701,22 @@ function fireDeadline(logDir, status, ledger, limit) {
 		minutes: limit.minutes
 	});
 }
+/** Decide why a signal ended the run and put it on the status; the caller writes WORKER-END. */
+function recordSignalEnd(logDir, status, signal) {
+	const end = decideEndReason({
+		logDir,
+		id: status.id,
+		signal,
+		timedOut: status.timedOut,
+		parentPid: status.parentPid,
+		parentComm: status.parentComm,
+		parentBackground: status.parentBackground
+	});
+	status.endReason = end.reason;
+	status.endBy = end.by;
+	status.endNote = end.note;
+	return end;
+}
 async function finaliseRun(f) {
 	const { logDir, ledger, ok, rc } = f;
 	let { status, report } = f;
@@ -4044,12 +4758,19 @@ async function finaliseRun(f) {
 			reason: orphanReason
 		});
 	}
+	const end = decideEndReason({
+		logDir,
+		id: wid,
+		timedOut: f.timedOut !== void 0
+	});
+	status.endReason = end.reason;
 	saveStatus(logDir, status);
 	appendLedger(ledger, "WORKER-END", {
 		id: wid,
 		...f.end,
 		rc,
-		secs: f.secs
+		secs: f.secs,
+		...endFields(end)
 	});
 	if (f.worktree) status = recordWorktree(logDir, status, f.worktree, ok);
 	const early = await f.beforeHandoff?.(status, report);
@@ -4297,6 +5018,7 @@ async function executeRun(a) {
 	let status = {
 		id: wid,
 		pid: process.pid,
+		...parentInfo(),
 		label,
 		cwd,
 		term,
@@ -4409,7 +5131,8 @@ async function executeRun(a) {
 		status.state = "killed";
 		status.rc = 143;
 		status.secs = Math.floor((Date.now() - t0) / 1e3);
-		status.last = `killed by signal ${sig}`;
+		const end = recordSignalEnd(logDir, status, sig);
+		status.last = `killed by signal ${sig} (${end.reason}${end.by ? ` by ${end.by}` : ""})`;
 		saveStatus(logDir, status);
 		appendLedger(ledger, "WORKER-END", {
 			id: wid,
@@ -4419,6 +5142,8 @@ async function executeRun(a) {
 			rc: 143,
 			secs: status.secs,
 			killed: 1,
+			...endFields(end),
+			note: end.note,
 			label
 		});
 		if (worktree) {
@@ -4684,6 +5409,7 @@ async function executeCodexRun(a) {
 	let status = {
 		id: wid,
 		pid: process.pid,
+		...parentInfo(),
 		label,
 		cwd,
 		term,
@@ -4776,8 +5502,21 @@ async function executeCodexRun(a) {
 			status.state = "killed";
 			status.rc = 143;
 			status.secs = Math.floor((Date.now() - t0) / 1e3);
-			status.last = `killed by signal ${sig}`;
+			const end = recordSignalEnd(logDir, status, sig);
+			status.last = `killed by signal ${sig} (${end.reason}${end.by ? ` by ${end.by}` : ""})`;
 			saveStatus(logDir, status);
+			appendLedger(ledger, "WORKER-END", {
+				id: wid,
+				provider: target.providerName,
+				mode: "headless",
+				model,
+				rc: 143,
+				secs: status.secs,
+				killed: 1,
+				...endFields(end),
+				note: end.note,
+				label
+			});
 			if (worktree) {
 				salvageOnExit(ledger, wid, label, worktree.dir, SIGNAL_SALVAGE_MS);
 				try {
@@ -4992,5 +5731,5 @@ function resultFromOutput(out) {
 }
 
 //#endregion
-export { projectLaunchConfig as $, worktreesDir as A, isLive as B, workerInScope as C, mergeWorker as D, git as E, alive as F, ownsPid as G, loadStatuses as H, contextLabel as I, waitForTerminalStatus as J, saveStatus as K, contextPercent as L, ledgerSummary as M, UNLABELED as N, uncommittedPaths as O, ageOf as P, pinNotices as Q, elapsedOf as R, sessionTag as S, gcWorktrees as T, newWorkerId as U, loadStatus as V, nowStamp as W, parseRunnerArgs as X, longInlinePromptHint as Y, shortText as Z, currentTabKey as _, deadlineLabel as a, resolveSession as b, handoffFromInside as c, workerDepth as d, describeMcp as et, checkPaneForWorker as f, markControlsHeld as g, clickrControlsArgv as h, usageContextTokens as i, appendLedger as j, verifyWorker as k, readInbox as l, openPaneForWorker as m, runWorker as n, parseWorkerReport as o, openFollowPane as p, setWorkerLabel as q, testProvider as r, renderReport as s, printResult as t, expandMcpNames as tt, sayToWorker as u, itermForClaudeSession as v, discardWorker as w, sessionMapPath as x, itermUuid as y, isChatPane as z };
-//# sourceMappingURL=run-Z4akoa8G.mjs.map
+export { longInlinePromptHint as $, git as A, contextLabel as B, itermUuid as C, workerInScope as D, sessionTag as E, appendLedger as F, loadStatus as G, elapsedOf as H, ledgerSummary as I, nowStamp as J, loadStatuses as K, UNLABELED as L, uncommittedPaths as M, verifyWorker as N, discardWorker as O, worktreesDir as P, waitForTerminalStatus as Q, ageOf as R, itermForClaudeSession as S, sessionMapPath as T, isChatPane as U, contextPercent as V, isLive as W, saveStatus as X, ownsPid as Y, setWorkerLabel as Z, markControlsHeld as _, expandMcpNames as _t, deadlineLabel as a, clearCooldown as at, requestKill as b, handoffFromInside as c, resolveTarget as ct, workerDepth as d, ledgerPath as dt, parseRunnerArgs as et, checkPaneForWorker as f, statusPath as ft, clickrControlsArgv as g, describeMcp as gt, openPaneForWorker as h, projectLaunchConfig as ht, usageContextTokens as i, stopProxy as it, mergeWorker as j, gcWorktrees as k, readInbox as l, ensureNoMcpConfig as lt, openFollowPane as m, pinNotices as mt, runWorker as n, DEFAULT_PROXY_PORT as nt, parseWorkerReport as o, probeQuota as ot, closeEndedPanes as p, workersLogDir as pt, newWorkerId as q, testProvider as r, ensureProxyRunning as rt, renderReport as s, quotaSkipThreshold as st, printResult as t, shortText as tt, sayToWorker as u, eventsPath as ut, callerDescription as v, resolveSession as w, currentTabKey as x, endLabel as y, alive as z };
+//# sourceMappingURL=run-CLYTOm0x.mjs.map