@tekmidian/pai 0.66.48 → 0.66.49

package/dist/{run-a_JzcVwv.mjs → run-CsrBbtj_.mjs}

@@ -1,18 +1,19 @@
 import { u as paiHomePath } from "./runtime-paths-DkZoxofH.mjs";
-import { C as isModelCapability, E as nativeAnthropicProvider, F as readWorkersSection, I as resolveCapability, L as resolveModelCapability, N as providerCostTier, P as providerKeyPath, R as resolveProviderKey, T as maskKey, _ as assertProviderRunnable, f as MODEL_CAPABILITIES, g as WorkersConfigError, h as WORKER_CLASSES, p as NATIVE_ANTHROPIC_MODELS, t as ANTHROPIC_NATIVE, tt as certainContextWindow, v as classModelCapability, x as getProviderOrNative } from "./config-2pR0RqHM.mjs";
-import { B as parseRunnerArgs, F as preambleBlock, G as ledgerPath, H as stripPromptValues, I as preambleLine, J as statusPath, K as panesDir, P as loadPreamble, R as appendSystemPromptArgs, U as ensureNoMcpConfig, V as shortText, W as eventsPath, Y as workersLogDir, _ as parseSleepSecs, d as isLive, f as loadStatus, h as nowStamp, m as newWorkerId, p as loadStatuses, q as routingStatePath, s as describeTool, t as UNLABELED, v as saveStatus } from "./status-C3fBJKU_.mjs";
-import { a as gcWorktreesThrottled, b as appendLedger, c as markResumed, d as recordWorktree, f as salvageOnExit, h as worktreeWanted, m as worktreeSystemPrompt, n as adoptTree, s as inPlaceSystemPrompt, t as addWorktree } from "./worktree-lnmAOFQv.mjs";
+import { B as resolveModelCapability, E as isModelCapability, I as providerCostTier, L as providerKeyPath, O as maskKey, R as readWorkersSection, V as resolveProviderKey, a as DEFAULT_BUDGET_WALLS, b as assertProviderRunnable, g as NATIVE_ANTHROPIC_MODELS, h as MODEL_CAPABILITIES, i as DEFAULT_BUDGET_WALL, it as certainContextWindow, k as nativeAnthropicProvider, r as DEFAULT_BUDGET_PRIORITY, t as ANTHROPIC_NATIVE, v as WORKER_CLASSES, w as getProviderOrNative, x as classModelCapability, y as WorkersConfigError, z as resolveCapability } from "./config-CYjjGSWq.mjs";
+import { B as parseRunnerArgs, F as preambleBlock, G as ledgerPath, H as stripPromptValues, I as preambleLine, J as statusPath, K as panesDir, P as loadPreamble, R as appendSystemPromptArgs, U as ensureNoMcpConfig, V as shortText, W as eventsPath, Y as workersLogDir, _ as parseSleepSecs, d as isLive, f as loadStatus, h as nowStamp, m as newWorkerId, p as loadStatuses, q as routingStatePath, s as describeTool, t as UNLABELED, v as saveStatus } from "./status-B0br9zV0.mjs";
+import { a as gcWorktreesThrottled, b as appendLedger, c as markResumed, d as recordWorktree, f as salvageOnExit, h as worktreeWanted, m as worktreeSystemPrompt, n as adoptTree, s as inPlaceSystemPrompt, t as addWorktree } from "./worktree-B6d-1uIn.mjs";
 import { i as getRegistryBackend } from "./factory-DRAEDNKV.mjs";
-import { _ as readMcpServers, c as poolSettings, g as mcpServersFromToolGrants, h as grantsChrome, i as poolIneligibleReason, l as poolSlotCwd, m as expandMcpNames, u as postTaskToPool, v as writeMcpConfig } from "./pool-DLhqOY3P.mjs";
-import { n as claudeCommand, r as pinnedSettingsArgs, t as buildRunEnv } from "./run-env-DyFZ8C1s.mjs";
+import { _ as readMcpServers, c as poolSettings, g as mcpServersFromToolGrants, h as grantsChrome, i as poolIneligibleReason, l as poolSlotCwd, m as expandMcpNames, u as postTaskToPool, v as writeMcpConfig } from "./pool-CgsnP3La.mjs";
+import { n as claudeCommand, r as pinnedSettingsArgs, t as buildRunEnv } from "./run-env-Cyw2iwBh.mjs";
 import { appendFileSync, closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { execFileSync, spawn } from "node:child_process";
+import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
-import { connect, createServer } from "node:net";
-import { createServer as createServer$1 } from "node:http";
+import net, { connect, createServer } from "node:net";
+import http, { createServer as createServer$1 } from "node:http";
+import https from "node:https";
 import { createInterface } from "node:readline";
 
 //#region src/workers/scope.ts
@@ -1275,6 +1276,595 @@ function pinNotices(launch, claudeJson) {
 	return lines;
 }
 
+//#endregion
+//#region src/router/limits.ts
+/**
+* limits.ts — per-provider plan limits for the cockpit. Polled at most once a
+* minute and cached; keys and tokens stay in this process and never reach the
+* page or the JSON it is served.
+*
+*   anthropic  Max plan 5h/7d via the OAuth usage endpoint (token from the
+*              keychain, as the statusline does); on a failed poll (http 429)
+*              the last good reading is served with its age and the poll backs
+*              off, advisor-mode.json only when no last good reading exists
+*   others     the provider's workers.yaml `usage` block (jq expressions)
+*   local      up/down (TCP), RSS of the listener, tokens/s from accounting
+*   rest       counted requests vs a configured limit, labelled "estimated"
+*/
+const ESTIMATE_FILE = join(homedir(), ".claude", "pai", "router-limits.json");
+const ADVISOR_FILE = join(homedir(), ".claude", "pai", "advisor-mode.json");
+/** Last good plan reading per provider, so a rate-limited poll shows an age, not "reset unknown". */
+const LASTGOOD_FILE = join(homedir(), ".claude", "pai", "logs", "router-limits-last.json");
+/** A last good reading older than this is too stale to serve when the endpoint fails. */
+const PLAN_LASTGOOD_MAX_AGE = 2 * 36e5;
+/** Upper bound for the poll delay after repeated 429s. */
+const BACKOFF_MAX = 30 * 6e4;
+function readLastGood(file = LASTGOOD_FILE) {
+	try {
+		const j = JSON.parse(readFileSync(file, "utf8"));
+		const out = {};
+		for (const [k, v] of Object.entries(j)) if (v && Array.isArray(v.windows) && typeof v.fetchedAt === "number") out[k] = {
+			windows: v.windows,
+			fetchedAt: v.fetchedAt
+		};
+		return out;
+	} catch {
+		return {};
+	}
+}
+function writeLastGood(file, entries) {
+	try {
+		mkdirSync(dirname(file), { recursive: true });
+		writeFileSync(file, JSON.stringify(entries, null, 1));
+	} catch {}
+}
+/**
+* The reading to show when a poll failed: the last good one, with its age in
+* the error field, while it is fresh enough to trust; undefined otherwise.
+*/
+function staleReading(provider, entry, cause, now, maxAge = PLAN_LASTGOOD_MAX_AGE) {
+	if (!entry || !entry.windows.length || now - entry.fetchedAt >= maxAge) return void 0;
+	const min = Math.round((now - entry.fetchedAt) / 6e4);
+	return {
+		provider,
+		kind: "plan",
+		windows: entry.windows,
+		fetchedAt: entry.fetchedAt,
+		error: `stale ${min}min (${cause})`
+	};
+}
+/** Per-provider poll backoff after a http 429: the interval doubles per strike, resets on success. */
+var Backoff = class {
+	mult = /* @__PURE__ */ new Map();
+	until = /* @__PURE__ */ new Map();
+	constructor(baseMs, maxMs = BACKOFF_MAX) {
+		this.baseMs = baseMs;
+		this.maxMs = maxMs;
+	}
+	/** Record a 429 seen for `provider` at `now`; returns the delay before its next poll. */
+	penalize(provider, now) {
+		const m = Math.min((this.mult.get(provider) ?? 1) * 2, this.maxMs / this.baseMs);
+		this.mult.set(provider, m);
+		this.until.set(provider, now + m * this.baseMs);
+		return m * this.baseMs;
+	}
+	/** ms until `provider` is due again; 0 when it may be polled now. */
+	remaining(provider, now) {
+		return Math.max(0, (this.until.get(provider) ?? 0) - now);
+	}
+	/** A poll succeeded: forget the strikes. */
+	reset(provider) {
+		this.mult.delete(provider);
+		this.until.delete(provider);
+	}
+};
+function toMs(v, unit) {
+	if (v === null || v === void 0 || v === "") return void 0;
+	if (unit === "iso" || unit === void 0 && typeof v === "string" && !/^\d+(\.\d+)?$/.test(v)) {
+		const t = Date.parse(String(v));
+		return Number.isFinite(t) ? t : void 0;
+	}
+	const n = Number(v);
+	if (!Number.isFinite(n)) return void 0;
+	return unit === "s" ? n * 1e3 : n;
+}
+function jq(expr, input) {
+	const r = spawnSync("jq", ["-r", expr], {
+		input,
+		encoding: "utf8",
+		timeout: 3e3
+	});
+	if (r.status !== 0) return void 0;
+	const out = r.stdout.trim().split("\n")[0];
+	return out === void 0 || out === "" || out === "null" ? void 0 : out;
+}
+/** Windows of a provider usage response, using its configured jq expressions. */
+function windowsFromJson(body, cfg) {
+	const out = [];
+	for (const w of cfg.windows) {
+		const pct = Number(jq(w.percent, body));
+		if (!Number.isFinite(pct) || jq(w.percent, body) === void 0) continue;
+		const reset = w.resetAt ? toMs(jq(w.resetAt, body), w.resetUnit) : void 0;
+		out.push({
+			name: w.name,
+			percent: Math.round(pct * 10) / 10,
+			...reset ? { resetAt: reset } : {}
+		});
+	}
+	return out;
+}
+/** Anthropic OAuth usage response: five_hour / seven_day {utilization, resets_at ISO}. */
+function parseAnthropicUsage(body) {
+	let j;
+	try {
+		j = JSON.parse(body);
+	} catch {
+		return [];
+	}
+	const out = [];
+	for (const [key, name] of [["five_hour", "5h"], ["seven_day", "7d"]]) {
+		const w = j[key];
+		if (!w || typeof w.utilization !== "number") continue;
+		const reset = toMs(w.resets_at, "iso");
+		out.push({
+			name,
+			percent: w.utilization,
+			...reset ? { resetAt: reset } : {}
+		});
+	}
+	return out;
+}
+/** Counted requests inside each window vs a configured cap: labelled estimated. */
+function estimateWindows(rows, provider, caps, now) {
+	const spans = {
+		"5h": 5 * 36e5,
+		"7d": 7 * 864e5
+	};
+	const out = [];
+	for (const [name, span] of Object.entries(spans)) {
+		const cap = caps[name];
+		if (!cap) continue;
+		const inWin = rows.filter((r) => r.provider === provider && Date.parse(r.ts) >= now - span);
+		const first = inWin.reduce((m, r) => Math.min(m, Date.parse(r.ts)), Infinity);
+		out.push({
+			name,
+			percent: Math.round(inWin.length / cap * 1e3) / 10,
+			...Number.isFinite(first) ? { resetAt: first + span } : {},
+			estimated: true
+		});
+	}
+	return out;
+}
+function readEstimateCaps(file = ESTIMATE_FILE) {
+	try {
+		return existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {};
+	} catch {
+		return {};
+	}
+}
+/** The OAuth usage endpoint the anthropic plan readings come from. */
+const ANTHROPIC_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+function getJson(url, headers) {
+	return new Promise((resolve, reject) => {
+		const rq = (url.protocol === "https:" ? https : http).get(url, {
+			headers,
+			timeout: 5e3
+		}, (res) => {
+			let t = "";
+			res.on("data", (c) => t += c);
+			res.on("end", () => res.statusCode === 200 ? resolve(t) : reject(/* @__PURE__ */ new Error(`http ${res.statusCode}`)));
+		});
+		rq.on("timeout", () => rq.destroy(/* @__PURE__ */ new Error("timeout")));
+		rq.on("error", reject);
+	});
+}
+function sh(cmd, args) {
+	return new Promise((resolve) => execFile(cmd, args, { timeout: 4e3 }, (_e, out) => resolve(String(out ?? "").trim())));
+}
+async function anthropicToken() {
+	for (const args of [["-a", process.env.USER ?? ""], []]) {
+		const raw = await sh("security", [
+			"find-generic-password",
+			"-s",
+			"Claude Code-credentials",
+			...args,
+			"-w"
+		]);
+		try {
+			const t = JSON.parse(raw).claudeAiOauth?.accessToken;
+			if (t) return t;
+		} catch {}
+	}
+}
+async function anthropicLimits(now, advisorFile, lastGood) {
+	const base = {
+		provider: "anthropic",
+		kind: "plan",
+		fetchedAt: now
+	};
+	try {
+		const token = await anthropicToken();
+		if (!token) throw new Error("no OAuth token in keychain");
+		const windows = parseAnthropicUsage(await getJson(new URL(ANTHROPIC_USAGE_URL), {
+			authorization: `Bearer ${token}`,
+			"anthropic-beta": "oauth-2025-04-20"
+		}));
+		if (windows.length) return {
+			...base,
+			windows
+		};
+		throw new Error("no usage windows in response");
+	} catch (e) {
+		const stale = staleReading("anthropic", lastGood, e.message, now);
+		if (stale) return stale;
+		try {
+			const a = JSON.parse(readFileSync(advisorFile, "utf8"));
+			if (typeof a.weeklyBudgetPercent === "number" && a.asOf && now / 1e3 - a.asOf < 6 * 3600) return {
+				...base,
+				windows: [{
+					name: "7d",
+					percent: a.weeklyBudgetPercent
+				}],
+				error: `${e.message}; advisor-mode fallback`
+			};
+		} catch {}
+		return {
+			...base,
+			windows: [],
+			error: e.message
+		};
+	}
+}
+async function providerPlanLimits(name, p, now, lastGood) {
+	const base = {
+		provider: name,
+		kind: "plan",
+		fetchedAt: now
+	};
+	const u = p.usage;
+	try {
+		const key = resolveProviderKey(p);
+		const [hn, ...pre] = (u.authHeader ?? "Authorization: Bearer").split(/:\s*/);
+		const prefix = pre.join(": ");
+		const headers = { [hn.toLowerCase()]: prefix ? `${prefix} ${key}` : String(key) };
+		const windows = windowsFromJson(await getJson(new URL(u.url), headers), u);
+		return windows.length ? {
+			...base,
+			windows
+		} : {
+			...base,
+			windows,
+			error: "no windows parsed"
+		};
+	} catch (e) {
+		const msg = e.message.replace(/Bearer\s+\S+/g, "Bearer ***");
+		return staleReading(name, lastGood, msg, now) ?? {
+			...base,
+			windows: [],
+			error: msg
+		};
+	}
+}
+function probeTcp(port, host) {
+	return new Promise((resolve) => {
+		const s = net.connect({
+			port,
+			host,
+			timeout: 800
+		});
+		s.on("connect", () => (s.destroy(), resolve(true)));
+		s.on("timeout", () => (s.destroy(), resolve(false)));
+		s.on("error", () => resolve(false));
+	});
+}
+async function localLimits(name, p, rows, now) {
+	const u = new URL(p.baseUrl);
+	const port = Number(u.port) || 80;
+	const listening = await probeTcp(port, u.hostname);
+	const served = listening ? await servedModels(u) : void 0;
+	const up = listening && modelServed(served, Object.values(p.models).filter((m) => typeof m === "string"));
+	let rssMb;
+	if (up) {
+		const pid = (await sh("lsof", [
+			"-ti",
+			`tcp:${port}`,
+			"-sTCP:LISTEN"
+		])).split("\n")[0];
+		const rss = pid ? Number(await sh("ps", [
+			"-o",
+			"rss=",
+			"-p",
+			pid
+		])) : NaN;
+		if (Number.isFinite(rss) && rss > 0) rssMb = Math.round(rss / 1024);
+	}
+	return {
+		provider: name,
+		kind: "local",
+		windows: [],
+		up,
+		...rssMb ? { rssMb } : {},
+		...served ? { served } : {},
+		...tokensPerSec(rows, name, now),
+		fetchedAt: now
+	};
+}
+/** Model ids the server at this base URL lists on GET /v1/models; undefined when it cannot say. */
+async function servedModels(base) {
+	try {
+		const ids = (JSON.parse(await getJson(new URL("/v1/models", base), {})).data ?? []).map((m) => m.id).filter((i) => typeof i === "string");
+		return ids.length ? ids : void 0;
+	} catch {
+		return;
+	}
+}
+/** Several providers can share one port: the provider is up only if its model is the one served. Unknown list = port decides. */
+function modelServed(served, wanted) {
+	if (!served) return true;
+	return wanted.some((w) => served.includes(w));
+}
+/** output tokens / generation seconds over the last hour (slow-path requests only). */
+function tokensPerSec(rows, provider, now) {
+	let out = 0;
+	let ms = 0;
+	for (const r of rows) {
+		if (r.provider !== provider || Date.parse(r.ts) < now - 36e5 || r.status !== 200 || !r.output_tokens) continue;
+		out += r.output_tokens;
+		ms += r.ms;
+	}
+	return ms ? { tokensPerSec: Math.round(out / (ms / 1e3) * 10) / 10 } : {};
+}
+function isLocalUrl(u) {
+	try {
+		const h = new URL(u).hostname;
+		return h === "127.0.0.1" || h === "localhost";
+	} catch {
+		return false;
+	}
+}
+/**
+* Polls all providers at most once per `ttlMs`; concurrent callers share one
+* poll. A provider whose poll answered http 429 is not fetched again until its
+* backoff (the interval doubled per strike, capped) has run out — its last
+* good reading is served with the current age instead.
+*/
+var LimitsCache = class {
+	value = [];
+	at = 0;
+	inflight;
+	backoff;
+	constructor(deps, ttlMs = 6e4) {
+		this.deps = deps;
+		this.ttlMs = ttlMs;
+		this.backoff = new Backoff(ttlMs);
+	}
+	get(now = Date.now()) {
+		if (this.value.length && now - this.at < this.ttlMs) return Promise.resolve(this.value);
+		this.inflight ??= this.poll(now).then((v) => {
+			this.value = v;
+			this.at = now;
+			this.inflight = void 0;
+			return v;
+		});
+		return this.inflight;
+	}
+	async poll(now) {
+		const rows = this.deps.rows();
+		let providers = {};
+		try {
+			providers = this.deps.providers();
+		} catch {}
+		const caps = readEstimateCaps(this.deps.estimateFile);
+		const lastGoodFile = this.deps.lastGoodFile ?? LASTGOOD_FILE;
+		const lastGood = readLastGood(lastGoodFile);
+		const previous = new Map(this.value.map((v) => [v.provider, v]));
+		const jobs = [];
+		const skipped = [];
+		/** Queue a plan poll unless the provider is backing off from a 429. */
+		const plan = (name, fn) => {
+			if (this.backoff.remaining(name, now) > 0) {
+				skipped.push(name);
+				return;
+			}
+			jobs.push(fn(lastGood[name]));
+		};
+		plan("anthropic", (lg) => anthropicLimits(now, this.deps.advisorFile ?? ADVISOR_FILE, lg));
+		for (const [name, p] of Object.entries(providers)) {
+			if (p.native || name === "anthropic" || p.enabled === false || !p.baseUrl) continue;
+			if (isLocalUrl(p.baseUrl)) jobs.push(localLimits(name, p, rows, now));
+			else if (p.usage) plan(name, (lg) => providerPlanLimits(name, p, now, lg));
+			else if (caps[name]) jobs.push(Promise.resolve({
+				provider: name,
+				kind: "estimated",
+				windows: estimateWindows(rows, name, caps[name], now),
+				fetchedAt: now
+			}));
+		}
+		const results = await Promise.all(jobs);
+		const store = { ...lastGood };
+		let dirty = false;
+		for (const r of results) if (r.error) {
+			if (r.error.includes("http 429")) this.backoff.penalize(r.provider, now);
+		} else {
+			this.backoff.reset(r.provider);
+			if (r.windows.length) {
+				store[r.provider] = {
+					windows: r.windows,
+					fetchedAt: r.fetchedAt
+				};
+				dirty = true;
+			}
+		}
+		if (dirty) writeLastGood(lastGoodFile, store);
+		for (const name of skipped) {
+			const prev = previous.get(name);
+			const cause = prev?.error?.includes("http 429") ? "http 429" : prev?.error ?? "http 429";
+			results.push(prev ? {
+				...prev,
+				error: `stale ${Math.max(0, Math.round((now - prev.fetchedAt) / 6e4))}min (${cause})`
+			} : {
+				provider: name,
+				kind: "plan",
+				windows: [],
+				error: cause,
+				fetchedAt: now
+			});
+		}
+		return results;
+	}
+};
+
+//#endregion
+//#region src/workers/budget.ts
+/**
+* budget.ts — live budget probes for budget-aware routing (policy "budget").
+*
+* One reading per provider: {percent, resetAt} of its most-constrained usage
+* window, from the same endpoints the cockpit limits card polls — anthropic
+* via the OAuth usage endpoint (keychain token), every other provider via its
+* workers.yaml `usage` block. Readings are cached for BUDGET_TTL_MS so a
+* burst of spawns costs one poll, and a failed probe reads as "unknown",
+* never as "full": routing must not break because an endpoint did.
+*
+* The routing decision itself lives in routing.ts (wall skip, cooldown until
+* reset); this module only fetches and caches. Keys never leave this process
+* and never appear in a reading or an error.
+*/
+/** How long a reading is trusted before the next spawn re-probes. */
+const BUDGET_TTL_MS = 5 * 6e4;
+/**
+* The most-constrained window of a usage response: highest percent, with its
+* reset. A provider is as full as its fullest window (a 96% 5h window is the
+* wall even when the 7d window reads 20%).
+*/
+function pickBudgetWindow(windows, now) {
+	let best = null;
+	for (const w of windows) if (!best || w.percent > best.percent) best = w;
+	if (!best) return {
+		percent: null,
+		resetAt: null,
+		fetchedAt: now
+	};
+	return {
+		percent: best.percent,
+		resetAt: best.resetAt ?? null,
+		fetchedAt: now
+	};
+}
+/**
+* Fetch one provider's budget reading. anthropic (native) reads the OAuth
+* usage endpoint with the keychain token; every other provider its
+* workers.yaml `usage` block. Any failure — no key, no network, bad JSON —
+* is "unknown", and unknown never walls a provider.
+*/
+async function fetchBudgetReading(name, p) {
+	const now = Date.now();
+	try {
+		if (p.native || name === "anthropic") {
+			const token = await anthropicToken();
+			if (!token) throw new Error("no OAuth token in keychain");
+			return pickBudgetWindow(parseAnthropicUsage(await getJson(new URL(ANTHROPIC_USAGE_URL), {
+				authorization: `Bearer ${token}`,
+				"anthropic-beta": "oauth-2025-04-20"
+			})), now);
+		}
+		if (!p.usage) return {
+			percent: null,
+			resetAt: null,
+			fetchedAt: now
+		};
+		const key = resolveProviderKey(p);
+		const [hn, ...pre] = (p.usage.authHeader ?? "Authorization: Bearer").split(/:\s*/);
+		const prefix = pre.join(": ");
+		return pickBudgetWindow(windowsFromJson(await getJson(new URL(p.usage.url), { [hn.toLowerCase()]: prefix ? `${prefix} ${key}` : String(key) }), p.usage), now);
+	} catch {
+		return {
+			percent: null,
+			resetAt: null,
+			fetchedAt: now
+		};
+	}
+}
+/**
+* Budget readings for spawn-time routing, at most one poll per TTL;
+* concurrent warmers share the inflight poll. `seed` lets tests (and a
+* caller with fresh readings of its own) put values in without a poll.
+*/
+var BudgetCache = class {
+	value = {};
+	at = 0;
+	inflight;
+	constructor(ttlMs = BUDGET_TTL_MS, fetch = fetchBudgetReading) {
+		this.ttlMs = ttlMs;
+		this.fetch = fetch;
+	}
+	/** Refresh every stale provider of `config`; resolves to the full map. */
+	async warm(config, now = Date.now()) {
+		if (this.at && now - this.at < this.ttlMs) return this.value;
+		this.inflight ??= this.poll(config).then((v) => {
+			this.value = v;
+			this.at = now;
+			this.inflight = void 0;
+			return v;
+		});
+		return this.inflight;
+	}
+	async poll(config) {
+		const out = { ...this.value };
+		const jobs = [this.fetch("anthropic", nativeAnthropicProvider(config.nativeModels)).then((r) => {
+			out.anthropic = r;
+		})];
+		for (const [name, p] of Object.entries(config.providers)) jobs.push(this.fetch(name, p).then((r) => {
+			out[name] = r;
+		}));
+		await Promise.all(jobs);
+		return out;
+	}
+	/** Synchronous read for routing (possibly absent — absence is "unknown"). */
+	get(name) {
+		return this.value[name];
+	}
+	snapshot() {
+		return { ...this.value };
+	}
+	seed(map, at = Date.now()) {
+		this.value = { ...map };
+		this.at = at;
+	}
+	clear() {
+		this.value = {};
+		this.at = 0;
+		this.inflight = void 0;
+	}
+};
+/** The process-wide cache routing reads; run.ts warms it before resolving. */
+const budgetCache = new BudgetCache();
+/** A provider's wall: routing.budgetWalls[name], else the built-in default for it, else 95. */
+function budgetWall(routing, name) {
+	return routing.budgetWalls[name] ?? DEFAULT_BUDGET_WALLS[name] ?? DEFAULT_BUDGET_WALL;
+}
+/** At or above its wall? Unknown (absent/null percent) is never full. */
+function budgetExceeded(r, wall) {
+	return !!r && r.percent !== null && r.percent >= wall;
+}
+/** Is this reading fresh enough to act on (wall cooldowns) at `now`? */
+function budgetFresh(r, now, ttlMs = BUDGET_TTL_MS) {
+	return now - r.fetchedAt < ttlMs;
+}
+/** "08:02" for a reading's reset, else now + 10 min — the reason line's clock. */
+function budgetUntilLabel(r, now = /* @__PURE__ */ new Date()) {
+	const t = r.resetAt && r.resetAt > now.getTime() ? r.resetAt : now.getTime() + 10 * 6e4;
+	const d = new Date(t);
+	return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+/**
+* Why `chosen` is not the walled provider skipped ahead of it:
+* "anthropic 96% until 08:02" — the one-line switch reason.
+*/
+function budgetSkipReason(name, r, now = /* @__PURE__ */ new Date()) {
+	return `${name} ${r.percent}% until ${budgetUntilLabel(r, now)}`;
+}
+
 //#endregion
 //#region src/workers/routing.ts
 /**
@@ -1289,11 +1879,24 @@ function pinNotices(launch, claudeJson) {
 * retryOnQuota is set, the runner restarts the same task on the next provider
 * (ledger: WORKER-REROUTE).
 *
+* Policy "budget" (the default) orders candidates by routing.priority —
+* falling back to routing.order, else DEFAULT_BUDGET_PRIORITY — sorted by
+* percent ascending within equal priority, and additionally skips every
+* provider whose live budget reading (budget.ts) reads at or above its wall
+* (routing.budgetWalls). A walled provider gets a cooldown until
+* max(now + BUDGET_COOLDOWN_MIN, resetAt), so it stays skipped until its
+* window resets and re-enters on its own. The chosen target carries a
+* `switchReason` ("glm: anthropic 96% until 08:02") when budget skipped a
+* higher-priority provider. A run's provider is resolved once at spawn; a
+* running worker is never switched mid-flight.
+*
 * An explicit --provider or a class mapping that pins a provider always
 * bypasses all of this.
 */
 const QUOTA_SKIP_DEFAULT = 95;
 const PROBE_TIMEOUT_MS = 1e4;
+/** Minimum minutes a budget-walled provider stays in cooldown, even when its reset is closer. */
+const BUDGET_COOLDOWN_MIN = 10;
 function readRoutingState(logDir) {
 	const path = routingStatePath(logDir);
 	if (!existsSync(path)) return { cooldowns: {} };
@@ -1329,6 +1932,18 @@ function clearCooldown(logDir, provider) {
 	writeRoutingState(logDir, state);
 }
 /**
+* The candidate order for auto-routing: the class's own order, else — policy
+* "budget" — routing.priority, falling back to routing.order, else
+* DEFAULT_BUDGET_PRIORITY. Policy "order" uses routing.order as before.
+*/
+function autoOrder(config, cls) {
+	if (cls?.order?.length) return cls.order;
+	if (config.routing.policy === "order") return config.routing.order;
+	if (config.routing.priority.length) return config.routing.priority;
+	if (config.routing.order.length) return config.routing.order;
+	return [...DEFAULT_BUDGET_PRIORITY];
+}
+/**
 * Run a provider's quotaProbe and return its percentage (0–100), or null when
 * there is no probe or it printed nothing usable. A probe must never break
 * routing: failures read as "unknown", not as "full".
@@ -1359,6 +1974,28 @@ function quotaExceeded(provider) {
 	const used = probeQuota(provider);
 	return used !== null && used >= quotaSkipThreshold(provider);
 }
+/**
+* Put every provider whose fresh budget reading is at or above its wall into
+* a cooldown until max(now + BUDGET_COOLDOWN_MIN, resetAt), so the walk below
+* skips it until its window resets and it re-enters on its own. Never
+* shortens an existing cooldown (a quota-failure cooldown outlasting the
+* reset stays). Fresh readings only: a stale cache must not re-wall anyone.
+*/
+function recordBudgetCooldowns(config, logDir, now = /* @__PURE__ */ new Date()) {
+	if (config.routing.policy === "order") return;
+	const state = readRoutingState(logDir);
+	let dirty = false;
+	for (const [name, r] of Object.entries(budgetCache.snapshot())) {
+		if (r.percent === null || !budgetFresh(r, now.getTime())) continue;
+		if (!budgetExceeded(r, budgetWall(config.routing, name))) continue;
+		const until = Math.max(now.getTime() + BUDGET_COOLDOWN_MIN * 6e4, r.resetAt ?? 0);
+		const prev = state.cooldowns[name];
+		if (prev && Date.parse(prev) >= until) continue;
+		state.cooldowns[name] = new Date(until).toISOString();
+		dirty = true;
+	}
+	if (dirty) writeRoutingState(logDir, state);
+}
 var NoProviderError = class extends WorkersConfigError {};
 function mustExist(config, name) {
 	const p = getProviderOrNative(config, name);
@@ -1370,12 +2007,16 @@ function mustBeRunnable(name, p) {
 	return p;
 }
 /** Why one provider of a routing order did not qualify (message fragment). */
-function exclusionReason(config, state, name, cls) {
+function exclusionReason(config, state, name, cls, budgets) {
 	const p = getProviderOrNative(config, name);
 	if (!p) return "not configured";
 	if (!p.enabled) return "disabled";
 	if (cooldownRemaining(state, name) > 0) return "cooldown";
 	if (quotaExceeded(p)) return "quota";
+	if (budgets) {
+		const r = budgets[name];
+		if (r && r.percent !== null && budgetExceeded(r, budgetWall(config.routing, name))) return `budget ${r.percent}% ≥ wall ${budgetWall(config.routing, name)}`;
+	}
 	const tier = providerCostTier(p);
 	if (cls?.maxCostTier !== void 0 && tier > cls.maxCostTier) return `cost tier ${tier} > max ${cls.maxCostTier}`;
 	if (cls?.requireTags?.length) {
@@ -1435,13 +2076,22 @@ function resolveTarget(config, logDir, opts = {}) {
 		};
 	}
 	const state = readRoutingState(logDir);
-	const order = cls?.order ?? config.routing.order;
+	const useBudget = config.routing.policy !== "order";
+	const order = autoOrder(config, cls);
+	const budgets = useBudget ? budgetCache.snapshot() : void 0;
+	const candidates = useBudget ? order.map((name, idx) => ({
+		name,
+		idx,
+		percent: budgets?.[name]?.percent
+	})).sort((a, b) => a.idx - b.idx || (a.percent ?? 0) - (b.percent ?? 0)).map((c) => c.name) : order;
 	const excluded = [];
-	for (const name of order) {
+	let budgetSkipped = null;
+	for (const name of candidates) {
 		const p = getProviderOrNative(config, name);
-		const why = exclusionReason(config, state, name, cls);
+		const why = exclusionReason(config, state, name, cls, budgets);
 		if (why) {
 			excluded.push(`${name}: ${why}`);
+			if (useBudget && budgetSkipped === null && why.startsWith("budget") && p) budgetSkipped = budgetSkipReason(name, budgets[name]);
 			continue;
 		}
 		return {
@@ -1449,18 +2099,23 @@ function resolveTarget(config, logDir, opts = {}) {
 			provider: p,
 			modelAlias: null,
 			classMcp: cls?.mcp ?? null,
-			via: "auto"
+			via: "auto",
+			...budgetSkipped ? { switchReason: `${name}: ${budgetSkipped}` } : {}
 		};
 	}
 	throw new NoProviderError(`auto-routing found no usable provider${opts.className ? ` for class "${opts.className}"` : ""} (order: [${order.join(", ")}]).${excluded.length ? `\nExcluded: ${excluded.join("; ")}.` : ""}\nClear a cooldown with: pai worker providers enable <name>; widen the class with: pai worker classes set ${opts.className ?? "<class>"}=<target>`);
 }
 /**
-* Next provider after `from` in auto order, applying the same filters.
-* Used by rerouting; null when the order is exhausted.
+* Next provider after `from` in auto order, applying the same filters —
+* including the budget wall under policy "budget", so a reroute never moves
+* a run onto a provider with no budget left. Used by rerouting; null when
+* the order is exhausted.
 */
 function nextAutoProvider(config, logDir, from, now = /* @__PURE__ */ new Date()) {
 	const state = readRoutingState(logDir);
-	const order = config.routing.order;
+	const useBudget = config.routing.policy !== "order";
+	const order = autoOrder(config);
+	const budgets = useBudget ? budgetCache.snapshot() : void 0;
 	const start = order.indexOf(from);
 	for (let i = start + 1; i < order.length; i++) {
 		const name = order[i];
@@ -1469,6 +2124,10 @@ function nextAutoProvider(config, logDir, from, now = /* @__PURE__ */ new Date()
 		const end = state.cooldowns[name];
 		if (end && Date.parse(end) > now.getTime()) continue;
 		if (quotaExceeded(p)) continue;
+		if (budgets) {
+			const r = budgets[name];
+			if (r && budgetExceeded(r, budgetWall(config.routing, name))) continue;
+		}
 		return name;
 	}
 	return null;
@@ -4459,7 +5118,7 @@ async function runWorker(opts) {
 		if (gc?.length) process.stderr.write(`pai worker: archived ${gc.length} leftover worktree(s) (pai worker gc)\n`);
 	} catch {}
 	if (opts.className === "plan" && !opts._planner) {
-		const { runPlanner } = await import("./planner-dO-3PLjD.mjs");
+		const { runPlanner } = await import("./planner-ZKXZf9JS.mjs");
 		return runPlanner(opts);
 	}
 	const parent = launchParent(opts.parent);
@@ -4478,6 +5137,10 @@ async function runWorker(opts) {
 			providerFlag = routed.providerFlag ?? void 0;
 		}
 	}
+	if (!providerFlag && !capabilityResolution && config.routing.policy !== "order") try {
+		await budgetCache.warm(config);
+		recordBudgetCooldowns(config, logDir);
+	} catch {}
 	const target = capabilityResolution ? {
 		providerName: capabilityResolution.providerName,
 		provider: capabilityResolution.provider,
@@ -5203,6 +5866,7 @@ async function executeRun(a) {
 		origin: headless ? "spawn" : "chat",
 		outputFormat: parsed.outputFormat,
 		...a.route ? { route: a.route } : {},
+		...target.via === "auto" && target.switchReason ? { switchReason: target.switchReason } : {},
 		...a.fallThroughOf ? { fallThroughOf: a.fallThroughOf } : {},
 		...headless ? { reportFormat: a.reportFormat } : {},
 		...trailerApplied ? { promptTrailer: true } : {},
@@ -5245,7 +5909,8 @@ async function executeRun(a) {
 		cwd,
 		label,
 		...a.capability ? { capability: a.capability } : {},
-		...a.specPath ? { spec: a.specPath } : {}
+		...a.specPath ? { spec: a.specPath } : {},
+		...target.switchReason ? { switch: target.switchReason } : {}
 	});
 	if (paneVerified) status.pane = { opened: true };
 	else if (headless) announcePane(logDir, config, wid, term, noPane, ledger, status);
@@ -5599,7 +6264,7 @@ async function executeRun(a) {
 			if (!ok && headless && a.target.via === "auto" && config.routing.retryOnQuota && status.turns <= 1 && status.tools === 0 && isQuotaFailure(resultText)) {
 				setCooldown(logDir, target.providerName, config.routing.cooldownMinutes);
 				const next = nextAutoProvider(config, logDir, target.providerName);
-				if (next && a.reroutes < config.routing.order.length) {
+				if (next && a.reroutes < autoOrder(config).length) {
 					appendLedger(ledger, "WORKER-REROUTE", {
 						from: target.providerName,
 						to: next,
@@ -6026,5 +6691,5 @@ function resultFromOutput(out) {
 }
 
 //#endregion
-export { ensureProxyRunning as $, routeRun as A, detectCurrentProviderName as B, workerDepth as C, workerInScope as Ct, onBattery as D, findLocal as E, endLabel as F, detectToolErrors as G, maskLaunchEnv as H, requestKill as I, parseSince as J, errorsTable as K, buildLaunchPlan as L, clickrControlsArgv as M, markControlsHeld as N, parseDuration as O, callerDescription as P, DEFAULT_PROXY_PORT as Q, buildLaunchRows as R, sayToWorker as S, sessionTag as St, clearPolicy as T, SAME_WORKER_WINDOW_MS as U, launchableProviderNames as V, detectRunningWorkerErrors as W, toolErrorSigTag as X, readToolErrors as Y, toolErrorText as Z, waitOnCallLine as _, itermForClaudeSession as _t, deadlineLabel as a, pinNotices as at, handoffFromInside as b, resolveSession as bt, parseDenialText as c, checkPaneForWorker as ct, realDeps as d, headlessAllowed as dt, stopProxy as et, statusMarker as f, openFollowPane as ft, realWaitDeps as g, currentTabKey as gt, parseWaitOn as h, resolveHostSession as ht, usageContextTokens as i, resolveTarget as it, writePolicy as j, readPolicy as k, parseWorkerReport as l, closeEndedPanes as lt, detachedLine as m, paneBackend as mt, runWorker as n, probeQuota as nt, denialLines as o, projectLaunchConfig as ot, waitOn as p, openPaneForWorker as pt, groupToolErrors as q, testProvider as r, quotaSkipThreshold as rt, denialMark as s, assertPaneNotDisabled as st, printResult as t, clearCooldown as tt, renderReport as u, closeOwnPane as ut, waitOnResultLine as v, itermUuid as vt, POLICY_MODES as w, readInbox as x, sessionMapPath as xt, waitingLine as y, ownerSessionName as yt, detectCurrentModel as z };
-//# sourceMappingURL=run-a_JzcVwv.mjs.map
+export { ensureProxyRunning as $, routeRun as A, detectCurrentProviderName as B, workerDepth as C, sessionTag as Ct, onBattery as D, findLocal as E, endLabel as F, detectToolErrors as G, maskLaunchEnv as H, requestKill as I, parseSince as J, errorsTable as K, buildLaunchPlan as L, clickrControlsArgv as M, markControlsHeld as N, parseDuration as O, callerDescription as P, DEFAULT_PROXY_PORT as Q, buildLaunchRows as R, sayToWorker as S, sessionMapPath as St, clearPolicy as T, SAME_WORKER_WINDOW_MS as U, launchableProviderNames as V, detectRunningWorkerErrors as W, toolErrorSigTag as X, readToolErrors as Y, toolErrorText as Z, waitOnCallLine as _, currentTabKey as _t, deadlineLabel as a, LimitsCache as at, handoffFromInside as b, ownerSessionName as bt, parseDenialText as c, assertPaneNotDisabled as ct, realDeps as d, closeOwnPane as dt, stopProxy as et, statusMarker as f, headlessAllowed as ft, realWaitDeps as g, resolveHostSession as gt, parseWaitOn as h, paneBackend as ht, usageContextTokens as i, resolveTarget as it, writePolicy as j, readPolicy as k, parseWorkerReport as l, checkPaneForWorker as lt, detachedLine as m, openPaneForWorker as mt, runWorker as n, probeQuota as nt, denialLines as o, pinNotices as ot, waitOn as p, openFollowPane as pt, groupToolErrors as q, testProvider as r, quotaSkipThreshold as rt, denialMark as s, projectLaunchConfig as st, printResult as t, clearCooldown as tt, renderReport as u, closeEndedPanes as ut, waitOnResultLine as v, itermForClaudeSession as vt, POLICY_MODES as w, workerInScope as wt, readInbox as x, resolveSession as xt, waitingLine as y, itermUuid as yt, detectCurrentModel as z };
+//# sourceMappingURL=run-CsrBbtj_.mjs.map