@tekmidian/pai 0.66.7 → 0.66.9

package/dist/worktree-CwMRTa0H.mjs

@@ -0,0 +1,1578 @@
+import { d as resolvePaiFile, u as paiHomePath } from "./runtime-paths-DkZoxofH.mjs";
+import { _ as expandHome, i as DEFAULT_LOG_DIR } from "./config-Dpe2JlbY.mjs";
+import { appendFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { platform, tmpdir } from "node:os";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { execFileSync } from "node:child_process";
+
+//#region src/workers/paths.ts
+/**
+* paths.ts — where worker run artefacts live.
+*
+* Everything a run writes (event mirror, status file, pane registry, routing
+* state, the empty MCP config) sits under one logDir so the whole tree is
+* disposable and configurable: `workers.logDir`, default ~/.claude/logs/workers.
+*/
+/**
+* Absolute logDir for the given config. An explicit `logDir` in workers.yaml
+* is honored verbatim (the user chose it). Otherwise this resolves like every
+* other PAI_HOME file: PAI_HOME/logs/workers if it exists, else the old
+* ~/.claude/logs/workers (with a one-time notice), else the new path.
+*/
+function workersLogDir(config) {
+	const expanded = expandHome(config.logDir);
+	if (config.logDir !== DEFAULT_LOG_DIR) return expanded;
+	return resolvePaiFile(paiHomePath("logs", "workers"), [expanded], "pai config migrate --logs");
+}
+/** The strict empty MCP config for headless runs, written on demand. */
+function ensureNoMcpConfig(logDir) {
+	const path = noMcpConfigPath(logDir);
+	if (!existsSync(path)) {
+		mkdirSync(logDir, { recursive: true });
+		writeFileSync(path, "{ \"mcpServers\": {} }\n", "utf8");
+	}
+	return path;
+}
+function statusPath(logDir, id) {
+	return join(logDir, `${id}.status`);
+}
+function eventsPath(logDir, id) {
+	return join(logDir, `${id}.jsonl`);
+}
+function ledgerPath(logDir) {
+	return join(logDir, "ledger.log");
+}
+function routingStatePath(logDir) {
+	return join(logDir, "routing-state.json");
+}
+function panesDir(logDir) {
+	return join(logDir, "panes");
+}
+/**
+* The strict empty MCP config handed to headless workers. Written into the
+* logDir on demand (never into the user's vendor config directory — this is
+* PAI state, not vendor state).
+*/
+function noMcpConfigPath(logDir) {
+	return join(logDir, "no-mcp.json");
+}
+
+//#endregion
+//#region src/workers/args.ts
+function parseRunnerArgs(argv) {
+	let prompt = null;
+	let outputFormat = "text";
+	const rest = [];
+	let headless = false;
+	let callerModel = false;
+	let callerMcpConfig = false;
+	let callerSystemPrompt = false;
+	const callerSystemPrompts = [];
+	let callerTools = false;
+	const mcp = [];
+	const allowedTools = [];
+	let i = 0;
+	while (i < argv.length) {
+		const a = argv[i];
+		if (a === "-p" || a === "--print") {
+			headless = true;
+			rest.push(a);
+			if (i + 1 < argv.length && !argv[i + 1].startsWith("-")) {
+				prompt = argv[i + 1];
+				rest.push(prompt);
+				i += 1;
+			}
+		} else if (a === "--output-format") {
+			const v = argv[i + 1];
+			if (v === "json" || v === "stream-json") outputFormat = v;
+			i += 1;
+		} else if (a.startsWith("--output-format=")) {
+			const v = a.slice(16);
+			if (v === "json" || v === "stream-json") outputFormat = v;
+		} else if (a === "--verbose") {} else if (a === "--append-system-prompt") {
+			callerSystemPrompt = true;
+			if (i + 1 < argv.length) callerSystemPrompts.push(argv[++i]);
+		} else if (a.startsWith("--append-system-prompt=")) {
+			callerSystemPrompt = true;
+			callerSystemPrompts.push(a.slice(23));
+		} else if (a === "--mcp") {
+			const v = argv[i + 1];
+			if (v !== void 0 && !v.startsWith("-")) {
+				mcp.push(v);
+				i += 1;
+			}
+		} else if (a.startsWith("--mcp=")) mcp.push(a.slice(6));
+		else if (a === "--allowedTools") {
+			rest.push(a);
+			const v = argv[i + 1];
+			if (v !== void 0 && !v.startsWith("-")) {
+				allowedTools.push(v);
+				rest.push(v);
+				i += 1;
+			}
+		} else if (a.startsWith("--allowedTools=")) {
+			allowedTools.push(a.slice(15));
+			rest.push(a);
+		} else {
+			if (a === "--model") callerModel = true;
+			if (a.startsWith("--model=")) callerModel = true;
+			if (a === "--mcp-config") callerMcpConfig = true;
+			if (a.startsWith("--mcp-config=")) callerMcpConfig = true;
+			if (a === "--tools") callerTools = true;
+			if (a.startsWith("--tools=")) callerTools = true;
+			if (prompt === null && !a.startsWith("-") && rest.length > 0 && (rest[rest.length - 1] === "-p" || rest[rest.length - 1] === "--print")) prompt = a;
+			rest.push(a);
+		}
+		i += 1;
+	}
+	return {
+		prompt,
+		outputFormat,
+		rest,
+		headless,
+		callerModel,
+		callerMcpConfig,
+		callerSystemPrompt,
+		callerSystemPrompts,
+		callerTools,
+		mcp,
+		allowedTools
+	};
+}
+/**
+* The one --append-system-prompt flag for a spawn: claude keeps only the LAST
+* occurrence, so every piece is joined (blank line between) into a single flag.
+* Empty parts are dropped; no parts, no flag.
+*/
+function appendSystemPromptArgs(parts) {
+	const text = parts.filter((p) => p.trim()).join("\n\n");
+	return text ? ["--append-system-prompt", text] : [];
+}
+/**
+* Turn `-p "<prompt>"` into bare `-p` (same for --print): for stream-json
+* stdin runs the prompt moves to the first user message on stdin, so the
+* value must not stay on the command line. Only prompt values directly
+* following the flag are touched; everything else passes through.
+*/
+function stripPromptValues(argv) {
+	const out = [];
+	for (let i = 0; i < argv.length; i++) {
+		const a = argv[i];
+		const isPrint = a === "-p" || a === "--print";
+		out.push(a);
+		if (isPrint && i + 1 < argv.length && !argv[i + 1].startsWith("-")) i += 1;
+	}
+	return out;
+}
+/**
+* A one-line stderr hint (never blocking) for an inline -p prompt long or
+* multi-line enough to be a shell-quoting risk — write it to a file and pass
+* --spec instead. null when the prompt is short/simple enough to be fine.
+*/
+function longInlinePromptHint(prompt) {
+	if (!prompt) return null;
+	const newlines = (prompt.match(/\n/g) ?? []).length;
+	if (prompt.length > 600 || newlines > 3) return "hint: long inline prompts break on shell quoting — write the spec to a file and use --spec <file>";
+	return null;
+}
+/** Collapse whitespace and cut to n chars with an ellipsis (label rendering). */
+function shortText(s, n) {
+	const t = String(s ?? "").split(/\s+/).filter(Boolean).join(" ");
+	return t.length <= n ? t : t.slice(0, n - 1) + "…";
+}
+
+//#endregion
+//#region src/workers/status.ts
+/**
+* status.ts — the live per-worker status file.
+*
+* One JSON file per run, rewritten atomically on every turn, read by `ps`,
+* `follow`, the status line and the pane logic. Same field set the Python
+* runner wrote, plus `provider` (routing is multi-provider now) and `session`
+* (the AIBroker identity of the launching session, see scope.ts).
+*/
+/** Label a worker gets when launched with neither --label nor a prompt. */
+const UNLABELED = "unlabeled";
+/**
+* Whether a status is the terminal's interactive chat pane, not a spawned
+* task worker. `origin` is the real discriminator; the fallback catches
+* running entries from before the flag existed (unlabeled, no turns yet).
+* Removable once every pane runs code that writes `origin`.
+*/
+function isChatPane(s) {
+	return s.origin === "chat" || !s.origin && (s.label === UNLABELED || s.label === "(no prompt)") && s.turns === 0;
+}
+/** Context-meter percentage 0–100, null when the numbers are missing. */
+function contextPercent(s) {
+	if (!s.contextTokens || !s.contextWindow) return null;
+	return Math.round(s.contextTokens / s.contextWindow * 100);
+}
+/** Compact token count: 84k, 200k, 900. */
+function fmtContextK(n) {
+	return n >= 1e3 ? `${Math.round(n / 1e3)}k` : String(n);
+}
+/**
+* The one context-meter label, shared by every renderer so identical
+* numbers always render identically: `ctx 84k/200k (42%)` — used-style
+* percent. Empty when the numbers are missing (callers drop the part).
+*/
+function contextLabel(s) {
+	const pct = contextPercent(s);
+	if (pct === null) return "";
+	return `ctx ${fmtContextK(s.contextTokens ?? 0)}/${fmtContextK(s.contextWindow ?? 0)} (${pct}%)`;
+}
+/** Timestamp format shared by status files and the ledger. */
+function nowStamp(d = /* @__PURE__ */ new Date()) {
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`;
+}
+let lastId = "";
+let idSeq = 0;
+function newWorkerId(d = /* @__PURE__ */ new Date(), pid = process.pid) {
+	const p = (n) => String(n).padStart(2, "0");
+	const base = `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}-${pid}`;
+	if (base === lastId) {
+		idSeq += 1;
+		return `${base}-${String(idSeq).padStart(2, "0")}`;
+	}
+	lastId = base;
+	idSeq = 0;
+	return base;
+}
+let tmpSeq = 0;
+/** A temp path only this call owns — never the same string twice. */
+function statusTmpPath(logDir, id) {
+	return `${statusPath(logDir, id)}.${process.pid}.${tmpSeq++}.tmp`;
+}
+const firstWrittenLabel = /* @__PURE__ */ new Map();
+/** Write status atomically (temp + rename) and stamp `updated`. */
+function saveStatus(logDir, status, d = /* @__PURE__ */ new Date()) {
+	status.updated = nowStamp(d);
+	const path = statusPath(logDir, status.id);
+	const baseline = firstWrittenLabel.get(status.id);
+	if (baseline === void 0) firstWrittenLabel.set(status.id, status.label);
+	const onDisk = baseline === void 0 ? void 0 : loadStatus(logDir, status.id);
+	if (onDisk) {
+		if (status.label === baseline && onDisk.label !== status.label) status.label = onDisk.label;
+		if (onDisk.controlsHeld) status.controlsHeld = true;
+	}
+	const tmp = statusTmpPath(logDir, status.id);
+	if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
+	try {
+		writeFileSync(tmp, JSON.stringify(status), "utf8");
+		renameSync(tmp, path);
+	} catch (e) {
+		try {
+			rmSync(tmp, { force: true });
+		} catch {}
+		throw e;
+	}
+}
+/**
+* Set a worker's goal (the operator's `--label`), atomically, through the
+* same saveStatus path everything else writes with. Used by `pai worker
+* goal` and the `--goal` option of `say`: a fresh call in a fresh process, so
+* it always carries no baseline yet and always wins over the worker's own
+* next periodic write (see saveStatus above).
+*/
+function setWorkerLabel(logDir, id, label) {
+	const status = loadStatus(logDir, id);
+	if (!status) throw new Error(`no worker named "${id}"`);
+	status.label = label;
+	saveStatus(logDir, status);
+	return status;
+}
+/** Load every status file in the logDir, oldest id first, skipping damage. */
+function loadStatuses(logDir) {
+	if (!existsSync(logDir)) return [];
+	const out = [];
+	for (const name of readdirSync(logDir).sort()) {
+		if (!name.endsWith(".status")) continue;
+		try {
+			out.push(JSON.parse(readFileSync(join(logDir, name), "utf8")));
+		} catch {}
+	}
+	return out;
+}
+function loadStatus(logDir, id) {
+	const path = statusPath(logDir, id);
+	if (!existsSync(path)) return null;
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+/**
+* Wait for a worker to record its own terminal state (the run's signal
+* handler writes killed/rc/secs). Returns that status, or null when it is
+* still "running" after `timeoutMs` — the caller then writes the state itself.
+*/
+async function waitForTerminalStatus(logDir, id, timeoutMs = 2e3, stepMs = 50) {
+	const deadline = Date.now() + timeoutMs;
+	for (;;) {
+		const s = loadStatus(logDir, id);
+		if (s && s.state !== "running") return s;
+		if (Date.now() >= deadline) return null;
+		await new Promise((r) => setTimeout(r, stepMs));
+	}
+}
+function alive(pid) {
+	if (!pid || pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Whether `status.pid` still names the process that was started as this
+* worker, not a later, unrelated process the OS handed the same pid to after
+* the worker exited. `alive()` alone can't tell these apart — a pid observed
+* live on 2026-09-19 (worker 20260919-083549-90913) had been reused, and
+* `pai worker kill` signalled the wrong, unrelated process. `ps -o lstart=`
+* reads the running process's actual start time and compares it against the
+* status file's own `started` stamp; a reused pid almost never starts within
+* 120s of the original, so a wider drift means "different process".
+*/
+function ownsPid(status) {
+	if (status.pid <= 0 || !alive(status.pid)) return false;
+	try {
+		const out = execFileSync("ps", [
+			"-o",
+			"lstart=",
+			"-p",
+			String(status.pid)
+		], {
+			encoding: "utf8",
+			env: {
+				...process.env,
+				LC_ALL: "C"
+			}
+		}).trim();
+		const psStart = Date.parse(out);
+		const started = Date.parse(status.started.replace(" ", "T"));
+		if (Number.isNaN(psStart) || Number.isNaN(started)) return alive(status.pid);
+		return Math.abs(psStart - started) <= 12e4;
+	} catch {
+		return alive(status.pid);
+	}
+}
+/** Whether a status is both marked "running" and still owns its recorded pid. */
+function isLive(status) {
+	return status.state === "running" && ownsPid(status);
+}
+/** "42s" under 90s, "7m" above — the coarse age the table and bar show. */
+function ageOf(ts, now = /* @__PURE__ */ new Date()) {
+	const t = Date.parse(ts.replace(" ", "T"));
+	if (Number.isNaN(t)) return "?";
+	const s = Math.max(0, Math.floor((now.getTime() - t) / 1e3));
+	return s < 90 ? `${s}s` : `${Math.floor(s / 60)}m`;
+}
+/** Precise elapsed time: "45s", "1m 23s", "12m 05s", "1h 02m 05s" — seconds zero-padded after a larger unit. */
+function elapsedOf(ts, now = /* @__PURE__ */ new Date()) {
+	const t = Date.parse(ts.replace(" ", "T"));
+	if (Number.isNaN(t)) return "?";
+	const secs = Math.max(0, Math.floor((now.getTime() - t) / 1e3));
+	const hours = Math.floor(secs / 3600);
+	const mins = Math.floor(secs % 3600 / 60);
+	const sec = secs % 60;
+	if (hours > 0) return `${hours}h ${String(mins).padStart(2, "0")}m ${String(sec).padStart(2, "0")}s`;
+	if (mins > 0) return `${mins}m ${String(sec).padStart(2, "0")}s`;
+	return `${sec}s`;
+}
+/** Shorter sleeps are legitimate polling — not worth a supervision event. */
+const SLEEP_FLOOR_SECS = 60;
+const SLEEP_RE = /^\s*sleep\s+([0-9]+(?:\.[0-9]+)?)([smhd]?)\s*(?:$|[;&|])/;
+/** s/m/h/d suffix to seconds multiplier, shared by every `sleep N<unit>` parse below. */
+function sleepUnitMultiplier(unit) {
+	return unit === "m" ? 60 : unit === "h" ? 3600 : unit === "d" ? 86400 : 1;
+}
+/**
+* Seconds of a `sleep N` (N plain or with an s/m/h/d suffix) that stands alone
+* or leads a compound command (`sleep 150; cat f`, `sleep 2m && tail f`,
+* `sleep 90 || true`, `sleep 60 &`), or null when no long sleep leads: anchored
+* to the start of the command, so a filename containing "sleep" or an
+* `echo sleep 500` never trips it, and floored at SLEEP_FLOOR_SECS so ordinary
+* polling stays invisible.
+*/
+function parseSleepSecs(command) {
+	const m = command.match(SLEEP_RE);
+	if (!m) return null;
+	const secs = Number(m[1]) * sleepUnitMultiplier(m[2]);
+	return Number.isFinite(secs) && secs >= SLEEP_FLOOR_SECS ? secs : null;
+}
+/** One-line description of a tool call, e.g. "Bash: npm test". */
+function describeTool(name, inp) {
+	if (typeof inp !== "object" || inp === null) return name;
+	const i = inp;
+	const get = (k) => typeof i[k] === "string" ? i[k] : "";
+	if (name === "Bash") return `Bash: ${shortText(get("command"), 70)}`;
+	if (name === "Read" || name === "Edit" || name === "Write" || name === "MultiEdit") return `${name}: ${get("file_path").split("/").pop() ?? ""}`;
+	if (name === "Grep" || name === "Glob") return `${name}: ${shortText(get("pattern"), 50)}`;
+	if (name === "WebSearch") return `${name}: ${shortText(get("query"), 50)}`;
+	if (name === "WebFetch") return `${name}: ${shortText(get("url"), 60)}`;
+	return name;
+}
+
+//#endregion
+//#region src/workers/ledger.ts
+/**
+* ledger.ts — the routing ledger, one append-only log for every worker event.
+*
+* Line shapes (whitespace-aligned so `tail` reads as a table):
+*
+*   2026-09-17 12:00:00 WORKER-START id=<id> provider=<p> mode=headless model=<m> cwd=<cwd> label=<label>
+*   2026-09-17 12:01:00 WORKER-END   id=<id> provider=<p> mode=headless model=<m> rc=0 secs=60 turns=3 tools=8 label=<label>
+*   2026-09-17 12:00:20 WORKER-REROUTE from=<a> to=<b> reason=quota
+*   2026-09-17 12:00:00 DENIED-ANTHROPIC-AGENT cwd=<cwd> desc=<desc>
+*   2026-09-17 12:00:00 ALLOWED-ANTHROPIC-AGENT cwd=<cwd> desc=<desc>
+*
+* `pai worker log` (and glm-log before it) counts these; keep the tags stable.
+*/
+function ledgerStamp(d = /* @__PURE__ */ new Date()) {
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`;
+}
+/** Parse `2026-09-17 12:00:00 TAG key=value …` into its parts. */
+function parseLedgerLine(line) {
+	const m = line.match(/^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) (\S+)(?: (.*))?$/);
+	if (!m) return null;
+	const fields = {};
+	for (const part of (m[3] ?? "").split(" ")) {
+		if (!part) continue;
+		const eq = part.indexOf("=");
+		if (eq <= 0) continue;
+		fields[part.slice(0, eq)] = part.slice(eq + 1);
+	}
+	return {
+		stamp: m[1],
+		event: m[2],
+		fields
+	};
+}
+/** Append one ledger line. `kv` order is the caller's; values are flattened. */
+function appendLedger(path, event, kv, now = /* @__PURE__ */ new Date()) {
+	const parts = [];
+	for (const [k, v] of Object.entries(kv)) {
+		if (v === void 0 || v === null) continue;
+		parts.push(`${k}=${String(v).replace(/\s+/g, " ")}`);
+	}
+	const dir = dirname(path);
+	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+	const tail = parts.length ? " " + parts.join(" ") : "";
+	appendFileSync(path, `${ledgerStamp(now)} ${event}${tail}\n`, "utf8");
+}
+/** The counts `pai worker log` prints, over today's lines or the whole file. */
+function ledgerSummary(path, scope, lastN = 15, now = /* @__PURE__ */ new Date()) {
+	if (!existsSync(path)) return null;
+	const text = readFileSync(path, "utf8");
+	const today = ledgerStamp(now).slice(0, 10);
+	const lines = text.split("\n").filter((l) => l.trim());
+	const parsed = (scope === "all" ? lines : lines.filter((l) => l.startsWith(today))).map(parseLedgerLine).filter((x) => x !== null);
+	const count = (ev) => parsed.filter((p) => p.event === ev).length;
+	const ends = parsed.filter((p) => p.event === "WORKER-END");
+	const ok = ends.filter((p) => p.fields.rc === "0").length;
+	return {
+		scope: scope === "all" ? "all time" : `today ${today}`,
+		started: count("WORKER-START"),
+		endedOk: ok,
+		endedFailed: ends.length - ok,
+		denied: count("DENIED-ANTHROPIC-AGENT"),
+		allowed: count("ALLOWED-ANTHROPIC-AGENT"),
+		reroutes: count("WORKER-REROUTE"),
+		lastLines: lines.slice(-lastN)
+	};
+}
+
+//#endregion
+//#region src/workers/pending.ts
+/**
+* Pending worker results: finished workers whose worktree branch still holds
+* work that never reached the repo (commits not in HEAD, or uncommitted
+* files). Surfaced by `pai worker ps/pending`, the SessionStart hook, the
+* status line and the prepublish gate so an unmerged fix cannot be forgotten.
+*/
+/** Stale after this long: `pai worker gc` (archive) instead of merge. */
+const STALE_HOURS = 24;
+function toplevel(dir) {
+	try {
+		return git(dir, ["rev-parse", "--show-toplevel"]);
+	} catch {
+		return null;
+	}
+}
+function fmtAge(ms) {
+	const h = Math.floor(ms / 36e5);
+	return h >= 48 ? `${Math.floor(h / 24)}d` : h >= 1 ? `${h}h` : `${Math.floor(ms / 6e4)}m`;
+}
+/** Finished workers with unmerged work; `repoRoot` limits to one repo, else every repo. */
+function pendingResults(logDir, repoRoot, now = Date.now()) {
+	const want = repoRoot ? toplevel(repoRoot) : null;
+	if (repoRoot && !want) return [];
+	const out = [];
+	for (const st of loadStatuses(logDir)) {
+		if (st.archived || st.merged || isLive(st)) continue;
+		if (!st.worktreeDir || !existsSync(st.worktreeDir)) continue;
+		const repo = toplevel(st.cwd);
+		if (!repo || want && repo !== want) continue;
+		let commits = 0;
+		let dirty = 0;
+		try {
+			if (st.branch) commits = git(repo, [
+				"cherry",
+				"HEAD",
+				`refs/heads/${st.branch}`
+			]).split("\n").filter((l) => l.startsWith("+")).length;
+			dirty = uncommittedPaths(st.worktreeDir).filter((p) => !/(^|\/)node_modules(\/|$)/.test(p)).length;
+		} catch {
+			continue;
+		}
+		if (!commits && !dirty) continue;
+		let ageMs = 0;
+		try {
+			ageMs = Math.max(0, now - statSync(statusPath(logDir, st.id)).mtimeMs);
+		} catch {}
+		out.push({
+			id: st.id,
+			label: st.label,
+			repo,
+			ageMs,
+			age: fmtAge(ageMs),
+			commits,
+			dirty
+		});
+	}
+	return out;
+}
+/** One human line per result, with the exact next command. */
+function formatPending(results, showRepo = false) {
+	return results.map((r) => {
+		const next = r.ageMs > STALE_HOURS * 36e5 ? "pai worker gc" : `pai worker merge ${r.id}`;
+		const repo = showRepo ? `  ${r.repo}` : "";
+		return `${r.id}  ${r.age}  ${r.commits} commit(s), ${r.dirty} dirty  ${r.label}${repo}  -> ${next}`;
+	}).join("\n");
+}
+/**
+* Release gate: exit code and message for `pai worker pending --gate`.
+* PAI_ALLOW_PENDING=1 overrides.
+*/
+function pendingGate(results, env = process.env) {
+	if (!results.length || env.PAI_ALLOW_PENDING === "1") return {
+		code: 0,
+		message: ""
+	};
+	return {
+		code: 1,
+		message: `${results.length} unmerged worker result(s) in this repo — merge or discard before publishing:\n${formatPending(results)}\nOverride deliberately with PAI_ALLOW_PENDING=1.`
+	};
+}
+/** Invalidate pending cache entries for a repo and its subdirectories. */
+function invalidatePendingCache(logDir, repoRoot) {
+	const file = join(logDir, "pending-cache.json");
+	let cache = {};
+	try {
+		cache = JSON.parse(readFileSync(file, "utf8"));
+	} catch {
+		return;
+	}
+	const resolved = repoRoot.endsWith("/") ? repoRoot : `${repoRoot}/`;
+	let changed = false;
+	for (const key of Object.keys(cache)) if (key === repoRoot || key.startsWith(resolved)) {
+		delete cache[key];
+		changed = true;
+	}
+	if (!changed) return;
+	try {
+		writeFileSync(file, JSON.stringify(cache));
+	} catch {}
+}
+
+//#endregion
+//#region src/workers/worktree.ts
+/**
+* worktree.ts — one git worktree per writing worker.
+*
+* A run whose class edits files (implement, complex, plan) and whose cwd is a
+* git repository gets its own worktree by default: `git worktree add
+* <logDir>/worktrees/<id> -b worker/<id>` from the current HEAD. The worker
+* commits its own work on that branch — the no-commit rule applies to the
+* main branch only — and the parent (or the operator) merges the result back:
+*
+*   pai worker merge <id>     git merge --no-ff worker/<id> + remove worktree + delete branch
+*   pai worker discard <id>   remove worktree and branch, keep nothing
+*
+* `ps` marks a worker with an unmerged branch `⎇`. Draft and review run in
+* place; `--no-worktree` opts out, `--worktree` forces one on.
+*/
+function worktreesDir(logDir) {
+	return join(logDir, "worktrees");
+}
+function worktreeBranch(id) {
+	return `worker/${id}`;
+}
+function worktreePath(logDir, id) {
+	return join(worktreesDir(logDir), id);
+}
+/** Run git in `cwd` with an optional env override, trimmed stdout, stderr on failure. */
+function runGit(cwd, args, env, timeout = 3e4) {
+	try {
+		return execFileSync("git", [
+			"-C",
+			cwd,
+			...args
+		], {
+			encoding: "utf8",
+			timeout,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			...env ? { env } : {}
+		}).trim();
+	} catch (e) {
+		const err = e;
+		const why = (typeof err.stderr === "string" ? err.stderr : err.stderr?.toString("utf8")) || err.message || String(e);
+		throw new Error(`git ${args.join(" ")} in ${cwd}: ${why.trim()}`);
+	}
+}
+/** Run git in `cwd`, returning trimmed stdout; throws with stderr on failure. */
+function git(cwd, args, timeoutMs) {
+	return runGit(cwd, args, void 0, timeoutMs);
+}
+/** Is `cwd` inside a git repository (a .git dir — worktrees: a .git file)? */
+function isGitRepo(cwd) {
+	try {
+		return git(cwd, ["rev-parse", "--git-dir"]) !== "";
+	} catch {
+		return false;
+	}
+}
+/** Tools that can write to the checkout (Bash can, via the shell). */
+const WRITING_TOOLS = [
+	"Edit",
+	"Write",
+	"MultiEdit",
+	"NotebookEdit",
+	"Bash"
+];
+/** Can a run with these --allowedTools write? No restriction at all means yes. */
+function toolsCanWrite(allowedTools) {
+	const names = allowedTools.flatMap((e) => e.split(",")).map((s) => s.trim().replace(/\(.*$/, "")).filter(Boolean);
+	return !names.length || names.some((n) => WRITING_TOOLS.includes(n));
+}
+/** Should this run get a worktree? Explicit flag first, then: can it write? */
+function worktreeWanted(flag, opts) {
+	if (flag !== void 0) return flag;
+	return toolsCanWrite(opts.allowedTools) && isGitRepo(opts.cwd);
+}
+/**
+* Commit `cwd`'s current index + working tree (including untracked files) as
+* a floating commit on top of HEAD, without touching the real index, working
+* tree or HEAD: a temporary `GIT_INDEX_FILE` collects the snapshot, `git
+* commit-tree` writes the commit object directly (it updates no ref). The
+* caller then branches a worktree from that commit, so the worktree sees
+* exactly what was on disk, uncommitted or not.
+*/
+function snapshotUncommitted(cwd, id, head) {
+	const idxDir = mkdtempSync(join(tmpdir(), "pai-worktree-idx-"));
+	const idx = join(idxDir, "index");
+	try {
+		const env = {
+			...process.env,
+			GIT_INDEX_FILE: idx
+		};
+		runGit(cwd, ["read-tree", head], env);
+		runGit(cwd, ["add", "-A"], env);
+		return runGit(cwd, [
+			"commit-tree",
+			runGit(cwd, ["write-tree"], env),
+			"-p",
+			head,
+			"-m",
+			`worker ${id}: snapshot of uncommitted checkout`
+		]);
+	} finally {
+		rmSync(idxDir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/**
+* Create the worktree and branch for `id` from `cwd`'s HEAD — or, when the
+* checkout has uncommitted changes, from a snapshot commit of that dirty
+* state (see `snapshotUncommitted`), so a worktree worker sees the same
+* files the operator sees, not just what was last committed. Throws when git
+* refuses (no commits yet, branch exists, …) — the caller decides whether to
+* degrade to an in-place run.
+*/
+function addWorktree(logDir, id, cwd) {
+	const dir = worktreePath(logDir, id);
+	const branch = worktreeBranch(id);
+	const head = git(cwd, ["rev-parse", "HEAD"]);
+	const dirty = dirtyPaths(cwd).length > 0;
+	const base = dirty ? snapshotUncommitted(cwd, id, head) : head;
+	git(cwd, [
+		"worktree",
+		"add",
+		dir,
+		"-b",
+		branch,
+		base
+	]);
+	provisionDeps(logDir, id, cwd, dir);
+	return {
+		dir,
+		branch,
+		base,
+		snapshot: dirty
+	};
+}
+/**
+* Give the worktree its own dependencies so the worker never has to improvise
+* (symlinking node_modules to the main checkout, building in a /tmp copy).
+* A real node_modules directory in the main checkout is APFS-cloned
+* (`cp -c`, copy-on-write, near instant); elsewhere the lockfile installs it.
+* Never a symlink. Time-boxed and best effort: a failure is logged, the run
+* goes on.
+*/
+function provisionDeps(logDir, id, cwd, wtDir) {
+	const note = (n) => appendLedger(ledgerPath(logDir), "WORKER-NOTE", {
+		id,
+		note: n
+	});
+	try {
+		const main = join(git(cwd, ["rev-parse", "--show-toplevel"]), "node_modules");
+		const dest = join(wtDir, "node_modules");
+		if (!existsSync(main) || lstatSync(main).isSymbolicLink() || existsSync(dest)) return;
+		try {
+			git(wtDir, [
+				"check-ignore",
+				"-q",
+				"node_modules"
+			]);
+		} catch {
+			return;
+		}
+		const t0 = Date.now();
+		const opts = {
+			cwd: wtDir,
+			stdio: "ignore",
+			timeout: 18e4
+		};
+		if (platform() === "darwin") try {
+			execFileSync("cp", [
+				"-cR",
+				main,
+				dest
+			], opts);
+			note(`node_modules cloned (apfs) in ${Date.now() - t0}ms`);
+			return;
+		} catch {
+			rmSync(dest, {
+				recursive: true,
+				force: true
+			});
+		}
+		if (existsSync(join(wtDir, "bun.lock"))) execFileSync("bun", ["install", "--frozen-lockfile"], opts);
+		else if (existsSync(join(wtDir, "package-lock.json"))) execFileSync("npm", ["ci"], opts);
+		else return;
+		note(`node_modules installed from lockfile in ${Date.now() - t0}ms`);
+	} catch (e) {
+		try {
+			note(`node_modules provisioning failed: ${e.message}`);
+		} catch {}
+	}
+}
+/** Commits the branch collected on top of its base. */
+function commitsSince(dir, base) {
+	try {
+		return parseInt(git(dir, [
+			"rev-list",
+			"--count",
+			`${base}..HEAD`
+		]), 10) || 0;
+	} catch {
+		return 0;
+	}
+}
+/**
+* Record the worktree result in the status file: branch and commit count on
+* success, the worktree cleaned up on failure. Returns the updated status.
+*/
+function recordWorktree(logDir, status, info, ok) {
+	const s = { ...status };
+	if (ok) {
+		s.branch = info.branch;
+		s.commits = commitsSince(info.dir, info.base);
+		s.worktreeDir = info.dir;
+		s.worktreeBase = info.base;
+		s.worktreeSnapshot = info.snapshot;
+	} else if (safeCommitsSince(info.dir, info.base) > 0) {
+		s.branch = info.branch;
+		s.commits = commitsSince(info.dir, info.base);
+		s.worktreeDir = info.dir;
+		s.worktreeBase = info.base;
+		s.worktreeSnapshot = info.snapshot;
+	} else {
+		removeWorktree(s.cwd, info.dir, true);
+		try {
+			git(s.cwd, [
+				"branch",
+				"-D",
+				info.branch
+			]);
+		} catch {}
+		s.branch = null;
+		s.worktreeDir = null;
+		s.worktreeBase = null;
+		s.commits = null;
+		s.worktreeSnapshot = null;
+	}
+	saveStatus(logDir, s);
+	invalidatePendingCache(logDir, s.cwd);
+	return s;
+}
+function safeCommitsSince(dir, base) {
+	try {
+		return commitsSince(dir, base);
+	} catch {
+		return 0;
+	}
+}
+/**
+* Salvage for an exit path (run finaliser, kill signal): commit whatever the
+* worker left uncommitted, log WORKER-SALVAGE, never throw. Bounded by
+* `timeoutMs` per git call. Returns the committed paths.
+*/
+function salvageOnExit(ledger, id, label, wtDir, timeoutMs) {
+	try {
+		const { committed, skipped } = salvageUncommitted(wtDir, label, timeoutMs);
+		if (committed.length) appendLedger(ledger, "WORKER-SALVAGE", {
+			id,
+			paths: committed.join(","),
+			skipped: skipped.length
+		});
+		if (skipped.length) appendLedger(ledger, "WORKER-NOTE", {
+			id,
+			note: `salvage skipped: ${skipped.join("; ")}`
+		});
+		return committed;
+	} catch (e) {
+		try {
+			appendLedger(ledger, "WORKER-NOTE", {
+				id,
+				note: `salvage failed: ${e.message}`
+			});
+		} catch {}
+		return [];
+	}
+}
+/** Remove a worktree directory from git's books and the filesystem. */
+function removeWorktree(cwd, dir, force) {
+	try {
+		git(cwd, [
+			"worktree",
+			"remove",
+			...force ? ["--force"] : [],
+			dir
+		]);
+		return;
+	} catch {}
+	if (existsSync(dir)) try {
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+		git(cwd, ["worktree", "prune"]);
+	} catch {}
+}
+/**
+* Tracked changes (staged or not) plus untracked files — everything a
+* `git add -A` in `wtDir` would commit. The same two calls the old patch
+* carry used; name-only, not porcelain: a worktree-only change renders as
+* " M path" and the shared git() helper trims that leading space away.
+*/
+function uncommittedPaths(wtDir, timeoutMs) {
+	const tracked = git(wtDir, [
+		"diff",
+		"--name-only",
+		"HEAD"
+	], timeoutMs).split("\n").filter(Boolean);
+	const untracked = git(wtDir, [
+		"ls-files",
+		"--others",
+		"--exclude-standard"
+	], timeoutMs).split("\n").filter(Boolean);
+	return [...tracked, ...untracked];
+}
+/**
+* True when `wtDir`/`relPath` is a symlink whose target resolves outside
+* `wtDir` — e.g. a worker's `node_modules -> <main checkout>/node_modules`
+* convenience link. A `.gitignore` using `dir/` (directories only) does not
+* ignore such a link, so it turns up as untracked; staging and merging it
+* lets git replace the real directory on the other side with a symlink to
+* itself. Never a candidate for salvage.
+*/
+function symlinkEscapesWorktree(wtDir, relPath) {
+	const full = join(wtDir, relPath);
+	let stat;
+	try {
+		stat = lstatSync(full);
+	} catch {
+		return false;
+	}
+	if (!stat.isSymbolicLink()) return false;
+	const target = readlinkSync(full);
+	const resolvedTarget = isAbsolute(target) ? target : resolve(dirname(full), target);
+	const realTarget = existsSync(resolvedTarget) ? realpathSync(resolvedTarget) : resolvedTarget;
+	const realWtDir = realpathSync(wtDir);
+	return realTarget !== realWtDir && !realTarget.startsWith(realWtDir + sep);
+}
+/**
+* Commit a worktree's uncommitted changes to its branch so the merge carries
+* them. `git merge` only moves committed work, so a worker that stopped
+* without committing would lose its edits to `worktree remove` — exactly
+* what happened live on 2026-09-17. Returns the salvaged paths, empty when
+* the worktree is clean. A symlink pointing outside the worktree (see
+* `symlinkEscapesWorktree`) is never staged; it is left on disk and reported
+* as skipped instead. A failed commit throws with the worktree untouched:
+* its edits are still on disk, so nothing is lost.
+*/
+function salvageUncommitted(wtDir, label, timeoutMs) {
+	const paths = uncommittedPaths(wtDir, timeoutMs);
+	if (!paths.length) return {
+		committed: [],
+		skipped: []
+	};
+	const skipped = [];
+	const missing = new Set(git(wtDir, ["ls-files", "--deleted"], timeoutMs).split("\n").filter(Boolean));
+	const toStage = [];
+	for (const p of paths) if (missing.has(p)) skipped.push(`${p} (missing, not committed)`);
+	else if (symlinkEscapesWorktree(wtDir, p)) skipped.push(`symlink ${p} -> ${readlinkSync(join(wtDir, p))} (points outside the worktree)`);
+	else toStage.push(p);
+	if (!toStage.length) return {
+		committed: [],
+		skipped
+	};
+	try {
+		git(wtDir, [
+			"add",
+			"--ignore-removal",
+			"--",
+			".",
+			...paths.filter((p) => !toStage.includes(p)).map((p) => `:(exclude,literal)${p}`)
+		], timeoutMs);
+		const deleted = git(wtDir, [
+			"diff",
+			"--cached",
+			"--diff-filter=D",
+			"--name-only"
+		], timeoutMs).split("\n").filter(Boolean);
+		if (deleted.length > MAX_SALVAGE_DELETES) {
+			git(wtDir, ["reset", "-q"], timeoutMs);
+			throw new Error(`salvage would delete ${deleted.length} tracked files (${deleted.slice(0, 5).join(", ")}, ...), refused`);
+		}
+		git(wtDir, [
+			"commit",
+			"-m",
+			`salvaged: ${label}`
+		], timeoutMs);
+	} catch (e) {
+		throw new Error(`cannot salvage the uncommitted changes in ${wtDir} — ${e.message}; nothing was lost: commit them there by hand, then re-run merge`);
+	}
+	return {
+		committed: toStage,
+		skipped
+	};
+}
+/** A salvage commit that deletes more tracked files than this is refused. */
+const MAX_SALVAGE_DELETES = 5;
+/**
+* The dirty paths of a checkout, parsed from `git status --porcelain -z`:
+* NUL-separated (a path with a newline in it cannot corrupt the parse),
+* rename entries contribute both sides, and any quoting is stripped.
+*/
+function dirtyPaths(cwd) {
+	const fields = execFileSync("git", [
+		"-C",
+		cwd,
+		"status",
+		"--porcelain",
+		"-z"
+	], {
+		encoding: "utf8",
+		timeout: 3e4,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	}).split("\0");
+	const strip = (p) => p.startsWith("\"") && p.endsWith("\"") ? p.slice(1, -1) : p;
+	const out = [];
+	for (let i = 0; i < fields.length; i++) {
+		const f = fields[i];
+		if (!f || f.length < 4 || f.charAt(2) !== " ") continue;
+		out.push(strip(f.slice(3)));
+		const xy = f.slice(0, 2);
+		if (xy.includes("R") || xy.includes("C")) {
+			const orig = fields[i + 1];
+			if (orig && orig.charAt(2) !== " ") {
+				out.push(strip(orig));
+				i += 1;
+			}
+		}
+	}
+	return out;
+}
+/**
+* Refuse the merge when the original checkout is dirty in paths the branch
+* touches: the merge would overwrite those edits or fail on them, either way
+* leaving a half-state. No merge is made, the worktree stays.
+*/
+function assertNoDirtyOverlap(cwd, incoming, id, branch) {
+	const dirty = new Set(dirtyPaths(cwd));
+	const overlap = [...new Set(incoming)].filter((p) => dirty.has(p)).sort();
+	if (!overlap.length) return;
+	throw new Error(`worker ${id}: the checkout ${cwd} has uncommitted changes in paths ${branch} touches: ${overlap.join(", ")}. Commit or stash them in the checkout, then re-run: pai worker merge ${id}. No merge was made; the worktree was kept.`);
+}
+/**
+* Never remove a worktree that still holds uncommitted changes — except a
+* symlink escaping the worktree (see `symlinkEscapesWorktree`): it was
+* deliberately left uncommitted by `salvageUncommitted`, and deleting the
+* link itself touches nothing outside the worktree.
+*/
+function assertWorktreeClean(wtDir, id) {
+	const leftover = uncommittedPaths(wtDir).filter((p) => !symlinkEscapesWorktree(wtDir, p));
+	if (leftover.length) throw new Error(`worker ${id}: the worktree ${wtDir} still holds uncommitted changes (${leftover.join(", ")}) — it was NOT removed; commit or copy them by hand, then re-run merge`);
+}
+/** Blob sha of `path` at `rev` in `cwd`, or null when it does not exist there. */
+function blobAt(cwd, rev, path) {
+	try {
+		return git(cwd, [
+			"rev-parse",
+			"--verify",
+			"-q",
+			`${rev}:${path}`
+		]);
+	} catch {
+		return null;
+	}
+}
+/** Blob sha of `path` as it sits on disk in `cwd`, or null when it is absent. */
+function workingBlob(cwd, path) {
+	if (!existsSync(join(cwd, path))) return null;
+	try {
+		return git(cwd, [
+			"hash-object",
+			"--",
+			path
+		]);
+	} catch {
+		return null;
+	}
+}
+/**
+* Refuse a snapshot merge when the checkout differs from the snapshot the
+* worker branched from, for any path the branch touched: the operator edited
+* it, or it was created/deleted since — applying the branch's diff on top
+* would silently discard that. Absent-in-both counts as equal.
+*/
+function assertNoSnapshotDrift(cwd, snapshot, paths, id) {
+	const drifted = paths.filter((p) => blobAt(cwd, snapshot, p) !== workingBlob(cwd, p)).sort();
+	if (!drifted.length) return;
+	throw new Error(`worker ${id}: the checkout ${cwd} has changed since the worktree's snapshot in paths the branch touches: ${drifted.join(", ")}. Resolve by hand, then re-run: pai worker merge ${id}. No merge was made; the worktree was kept.`);
+}
+/**
+* `pai worker merge <id>` for a snapshot-based worktree (see `addWorktree`):
+* git's own merge only moves committed history, and the snapshot commit was
+* never on any branch reachable from `cwd`'s HEAD, so there is nothing to
+* `git merge` here. Instead the worker's own changes — `git diff --binary
+* <snapshot> <branch>` — are applied straight onto the checkout's working
+* tree as uncommitted edits, exactly like the uncommitted state the worker
+* started from. Works even if `cwd`'s HEAD moved since the snapshot: the
+* diff is applied to files, not merged into a tree.
+*/
+function mergeSnapshotWorker(logDir, id, st, noCommit = false) {
+	const snapshot = st.worktreeBase;
+	const branch = st.branch;
+	const worktreeDir = st.worktreeDir;
+	const salvage = existsSync(worktreeDir) ? salvageUncommitted(worktreeDir, st.label || UNLABELED) : {
+		committed: [],
+		skipped: []
+	};
+	if ((parseInt(git(st.cwd, [
+		"rev-list",
+		"--count",
+		`${snapshot}..${branch}`
+	]), 10) || 0) <= 0) throw new Error(`worker ${id}: branch ${branch} has no commits beyond its snapshot to merge. The worktree ${worktreeDir} was NOT removed — uncommitted work there would be destroyed. Commit it yourself, or drop everything with: pai worker discard ${id}`);
+	const changedPaths = git(st.cwd, [
+		"diff",
+		"--name-only",
+		snapshot,
+		branch
+	]).split("\n").filter(Boolean);
+	assertNoSnapshotDrift(st.cwd, snapshot, changedPaths, id);
+	const diff = execFileSync("git", [
+		"-C",
+		st.cwd,
+		"diff",
+		"--binary",
+		snapshot,
+		branch
+	], {
+		encoding: "utf8",
+		timeout: 3e4,
+		maxBuffer: 64 * 1024 * 1024
+	});
+	if (diff.trim()) try {
+		execFileSync("git", [
+			"-C",
+			st.cwd,
+			"apply",
+			"--binary"
+		], {
+			input: diff,
+			encoding: "utf8",
+			timeout: 3e4,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+	} catch (e) {
+		const err = e;
+		const why = (typeof err.stderr === "string" ? err.stderr : err.stderr?.toString("utf8")) || err.message || String(e);
+		throw new Error(`worker ${id}: git refused to apply ${branch}'s changes to ${st.cwd} — ${why.trim()}. The worktree ${worktreeDir} was kept: resolve by hand, then re-run merge`);
+	}
+	if (noCommit) return noCommitNextSteps(id, branch, worktreeDir, changedPaths);
+	removeWorktree(st.cwd, worktreeDir, true);
+	try {
+		git(st.cwd, [
+			"branch",
+			"-D",
+			branch
+		]);
+	} catch {}
+	saveStatus(logDir, {
+		...st,
+		merged: true
+	});
+	const base = `applied worker ${id}'s changes (branch ${branch}) to ${st.cwd} as uncommitted changes: ${changedPaths.join(", ")} (worktree removed, branch deleted)`;
+	const notes = [];
+	if (salvage.committed.length) notes.push(`salvaged ${salvage.committed.length} uncommitted change(s) onto the branch first: ${salvage.committed.join(", ")}`);
+	if (salvage.skipped.length) notes.push(`skipped ${salvage.skipped.join(", ")}`);
+	return notes.length ? `${base}; ${notes.join("; ")}` : base;
+}
+function noCommitNextSteps(id, branch, worktreeDir, paths) {
+	return `applied worker ${id}'s changes (branch ${branch}) to the checkout as uncommitted changes: ${paths.join(", ")}. Branch and worktree ${worktreeDir} were kept. Next: review (git diff), commit, then run: pai worker gc`;
+}
+/**
+* `merge --no-commit`: apply base..branch to the checkout with a 3-way
+* `git apply`, leaving the result uncommitted. On conflict the tree is left
+* as is (markers + unmerged index entries) and the conflicted paths are listed.
+*/
+function applyNoCommit(cwd, id, branch, worktreeDir, base, paths) {
+	const diff = execFileSync("git", [
+		"-C",
+		cwd,
+		"diff",
+		"--binary",
+		`${base}..${branch}`
+	], {
+		encoding: "buffer",
+		timeout: 3e4,
+		maxBuffer: 64 * 1024 * 1024,
+		env: {
+			...process.env,
+			LC_ALL: "C"
+		}
+	});
+	try {
+		execFileSync("git", [
+			"-C",
+			cwd,
+			"apply",
+			"--3way",
+			"--binary"
+		], {
+			input: diff,
+			timeout: 3e4,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...process.env,
+				LC_ALL: "C"
+			}
+		});
+	} catch (e) {
+		const conflicted = git(cwd, [
+			"diff",
+			"--name-only",
+			"--diff-filter=U"
+		]).split("\n").filter(Boolean);
+		const err = e;
+		const why = ((typeof err.stderr === "string" ? err.stderr : err.stderr?.toString("utf8")) || err.message || "").trim();
+		throw new Error(conflicted.length ? `worker ${id}: applying ${branch} conflicted in ${conflicted.join(", ")}. The tree was left for you: resolve those paths, review, commit; branch and worktree ${worktreeDir} were kept` : `worker ${id}: git refused to apply ${branch} to ${cwd} — ${why}. Nothing was changed; branch and worktree were kept`);
+	}
+	return noCommitNextSteps(id, branch, worktreeDir, paths);
+}
+/**
+* `pai worker verify <id>`: for every file the worker's branch (or its
+* refs/pai-archive/<id> archive once the branch is gone) changed since its
+* base, compare bytes with the working tree or `--against <ref>`.
+* identical = the target already holds the worker's version (a worker delete
+* counts as identical when the target lacks the file too); differs = other
+* bytes; missing = the worker's file is absent in the target; deleted = the
+* worker deleted it but the target still has it. ok = every file identical.
+*/
+function verifyWorker(logDir, id, opts = {}) {
+	const st = loadStatus(logDir, id);
+	if (!st) throw new Error(`no worker named "${id}"`);
+	const env = {
+		...process.env,
+		LC_ALL: "C"
+	};
+	const bytes = (args) => {
+		try {
+			return execFileSync("git", [
+				"-C",
+				st.cwd,
+				...args
+			], {
+				env,
+				timeout: 3e4,
+				maxBuffer: 256 * 1024 * 1024,
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			});
+		} catch {
+			return null;
+		}
+	};
+	const has = (ref) => bytes([
+		"rev-parse",
+		"--verify",
+		"-q",
+		`${ref}^{commit}`
+	]) !== null;
+	const ref = [`refs/heads/${worktreeBranch(id)}`, `refs/pai-archive/${id}`].find(has);
+	if (!ref) throw new Error(`worker ${id}: neither ${worktreeBranch(id)} nor refs/pai-archive/${id} exists in ${st.cwd}`);
+	const base = st.worktreeSnapshot && st.worktreeBase ? st.worktreeBase : git(st.cwd, [
+		"merge-base",
+		"HEAD",
+		ref
+	]);
+	const list = (bytes([
+		"diff",
+		"--name-status",
+		"--no-renames",
+		"-z",
+		`${base}..${ref}`
+	]) ?? Buffer.alloc(0)).toString("utf8").split("\0").filter(Boolean);
+	const files = [];
+	for (let i = 0; i + 1 < list.length; i += 2) {
+		const path = list[i + 1];
+		const deleted = list[i] === "D";
+		const target = opts.against ? bytes(["show", `${opts.against}:${path}`]) : existsSync(join(st.cwd, path)) ? readFileSync(join(st.cwd, path)) : null;
+		let state;
+		if (deleted) state = target ? "deleted" : "identical";
+		else {
+			const mine = bytes(["show", `${ref}:${path}`]);
+			state = !target ? "missing" : mine && mine.equals(target) ? "identical" : "differs";
+		}
+		files.push({
+			path,
+			state
+		});
+	}
+	return {
+		id,
+		ref,
+		base,
+		against: opts.against ?? "working tree",
+		files,
+		ok: files.every((f) => f.state === "identical")
+	};
+}
+/**
+* `pai worker merge <id>`: salvage whatever the worker left uncommitted onto
+* its branch, refuse when the original checkout is dirty in paths the branch
+* touches, merge with --no-ff (the merge commit names the worker), then
+* remove the worktree and delete the branch; the status gains `merged: true`.
+* A branch with nothing to merge is refused loudly — after salvage that
+* genuinely means it holds nothing, and reporting success there would
+* destroy the worktree for no gain.
+*/
+function mergeWorker(logDir, id, opts = {}) {
+	const st = mustHaveBranch(logDir, id);
+	if (st.merged) return `worker ${id}: branch ${st.branch} already merged`;
+	if (st.worktreeSnapshot) return mergeSnapshotWorker(logDir, id, st, opts.noCommit);
+	const salvage = existsSync(st.worktreeDir) ? salvageUncommitted(st.worktreeDir, st.label || UNLABELED) : {
+		committed: [],
+		skipped: []
+	};
+	if ((parseInt(git(st.cwd, [
+		"rev-list",
+		"--count",
+		`HEAD..${st.branch}`
+	]), 10) || 0) <= 0) throw new Error(`worker ${id}: branch ${st.branch} has no commits to merge. The worktree ${st.worktreeDir} was NOT removed — uncommitted work there would be destroyed. Commit it yourself, or drop everything with: pai worker discard ${id}`);
+	const mergeBase = git(st.cwd, [
+		"merge-base",
+		"HEAD",
+		st.branch
+	]);
+	const incomingPaths = git(st.cwd, [
+		"diff",
+		"--name-only",
+		mergeBase,
+		st.branch
+	]).split("\n").filter(Boolean);
+	assertNoDirtyOverlap(st.cwd, incomingPaths, id, st.branch);
+	if (opts.noCommit) return applyNoCommit(st.cwd, id, st.branch, st.worktreeDir, mergeBase, incomingPaths);
+	try {
+		git(st.cwd, [
+			"merge",
+			"--no-ff",
+			st.branch,
+			"-m",
+			`merge worker ${id} (${st.label})`
+		]);
+	} catch (e) {
+		throw new Error(`worker ${id}: git refused the merge of ${st.branch} — ${e.message}. The worktree ${st.worktreeDir} was kept: resolve the conflict, then re-run merge`);
+	}
+	if (existsSync(st.worktreeDir)) assertWorktreeClean(st.worktreeDir, id);
+	removeWorktree(st.cwd, st.worktreeDir, true);
+	let branchGone = true;
+	try {
+		git(st.cwd, [
+			"branch",
+			"-d",
+			st.branch
+		]);
+	} catch {
+		branchGone = false;
+	}
+	saveStatus(logDir, {
+		...st,
+		merged: true
+	});
+	invalidatePendingCache(logDir, st.cwd);
+	const base = `merged ${st.branch} into ${st.cwd} (worktree removed${branchGone ? ", branch deleted" : "; branch kept: git refused -d"})`;
+	const notes = [];
+	if (salvage.committed.length) notes.push(`salvaged ${salvage.committed.length} uncommitted change(s): ${salvage.committed.join(", ")}`);
+	if (salvage.skipped.length) notes.push(`skipped ${salvage.skipped.join(", ")}`);
+	return notes.length ? `${base}; ${notes.join("; ")}` : base;
+}
+/** `pai worker discard <id>`: drop worktree and branch, keep nothing. */
+function discardWorker(logDir, id) {
+	const st = mustHaveBranch(logDir, id);
+	removeWorktree(st.cwd, st.worktreeDir, true);
+	let branchGone = false;
+	try {
+		git(st.cwd, [
+			"branch",
+			"-D",
+			st.branch
+		]);
+		branchGone = true;
+	} catch {
+		branchGone = false;
+	}
+	saveStatus(logDir, {
+		...st,
+		branch: null,
+		worktreeDir: null,
+		worktreeBase: null,
+		worktreeSnapshot: null,
+		commits: null,
+		merged: false
+	});
+	invalidatePendingCache(logDir, st.cwd);
+	return `discarded worker ${id}: worktree removed${branchGone ? `, branch ${st.branch} deleted` : ""}`;
+}
+function mustHaveBranch(logDir, id) {
+	const st = loadStatus(logDir, id);
+	if (!st) throw new Error(`no worker named "${id}"`);
+	if (!st.branch || !st.worktreeDir) throw new Error(`worker ${id} has no worktree branch to ${st.branch ? "clean up" : "merge"} — it ran in place or its branch was already handled`);
+	return st;
+}
+/**
+* The paragraph a worktree run's system prompt gains: it may commit on its
+* own branch (the no-commit rule holds for the main branch only), it must not
+* merge or push itself, and the parent or operator merges.
+*/
+function worktreeSystemPrompt(id, branch, dir, snapshot = false) {
+	return [
+		"You are running in your own git worktree:",
+		`  ${dir} on branch ${branch} (worker id ${id}).`,
+		"Commit your work on that branch as you go (git add / git commit) — committing here is expected;",
+		"the no-commit rule applies to the main branch only, and this is not it.",
+		"Do not merge, rebase or push; the operator merges your branch back with `pai worker merge`.",
+		"Use ONLY relative paths inside the worktree, never absolute worktree paths — absolute paths break after merge and leak machine layout.",
+		...snapshot ? ["This worktree was branched from a snapshot that includes files the parent checkout had uncommitted at spawn time — not just its last commit."] : []
+	].join("\n");
+}
+/**
+* For headless runs WITHOUT a worktree: the worker shares the operator's
+* checkout with other in-flight workers, so a hook blocks git stash (except
+* list/show), reset, clean, checkout/restore of paths, switch, rebase and
+* merge — take baselines from measurements before editing, not from stash.
+*/
+function inPlaceSystemPrompt() {
+	return [
+		"You are running in the operator's shared git checkout, alongside other workers editing it at the same time.",
+		"A hook blocks git stash (except list/show), reset, clean, checkout/restore of files, switch, rebase and merge — take baselines from measurements taken before you edit, not from stashing.",
+		"Read-only git (status, diff, log, show, stash list) is fine."
+	].join("\n");
+}
+const GC_STAMP = "gc-last";
+/**
+* Archive worktrees of finished workers older than `olderThanHours` and
+* status-less orphan directories: uncommitted state is salvaged onto the
+* branch, the branch is x, the worktree is
+* removed. Nothing is deleted without a salvage first; a failed salvage skips
+* that worktree. Running workers are never touched. `dryRun` reports only.
+*/
+function gcWorktrees(logDir, olderThanHours = 24, dryRun = false, now = Date.now()) {
+	const cutoff = now - olderThanHours * 36e5;
+	const out = [];
+	const root = worktreesDir(logDir);
+	const known = /* @__PURE__ */ new Set();
+	const archive = (id, dir, st) => {
+		const target = `refs/pai-archive/${id}`;
+		if (dryRun) return void out.push({
+			id,
+			archive: target
+		});
+		try {
+			let repo;
+			try {
+				const raw = git(dir, ["rev-parse", "--git-common-dir"]);
+				repo = isAbsolute(raw) ? raw : resolve(dir, raw);
+			} catch {
+				throw new Error("not a git worktree");
+			}
+			const label = `archive: leftover state of worker ${id}`;
+			if (uncommittedPaths(dir).length) {
+				const res = salvageUncommitted(dir, label);
+				if (res.committed.length) git(dir, [
+					"commit",
+					"--amend",
+					"-q",
+					"-m",
+					label
+				]);
+				if (res.skipped.length && uncommittedPaths(dir).some((p) => !symlinkEscapesWorktree(dir, p))) throw new Error("uncommitted paths remain");
+			}
+			const src = worktreeBranch(id);
+			let hasBranch = true;
+			try {
+				git(repo, [
+					"rev-parse",
+					"--verify",
+					"-q",
+					`refs/heads/${src}`
+				]);
+			} catch {
+				hasBranch = false;
+			}
+			const tip = git(dir, ["rev-parse", "HEAD"]);
+			if (hasBranch) git(repo, [
+				"merge-base",
+				"--is-ancestor",
+				`refs/heads/${src}`,
+				tip
+			]);
+			git(repo, [
+				"update-ref",
+				target,
+				tip
+			]);
+			git(repo, [
+				"worktree",
+				"remove",
+				"--force",
+				dir
+			]);
+			if (hasBranch) git(repo, [
+				"branch",
+				"-D",
+				src
+			]);
+			if (st) saveStatus(logDir, {
+				...st,
+				branch: null,
+				worktreeDir: null,
+				archived: target
+			});
+			appendLedger(ledgerPath(logDir), "WORKER-GC", {
+				id,
+				archive: target
+			});
+			out.push({
+				id,
+				archive: target
+			});
+		} catch (e) {
+			out.push({
+				id,
+				skipped: e.message.split("\n")[0]
+			});
+		}
+	};
+	for (const st of loadStatuses(logDir)) {
+		known.add(st.id);
+		if (!st.worktreeDir || !existsSync(st.worktreeDir) || isLive(st)) continue;
+		let end = 0;
+		try {
+			end = statSync(statusPath(logDir, st.id)).mtimeMs;
+		} catch {
+			continue;
+		}
+		if (end > cutoff) continue;
+		archive(st.id, st.worktreeDir, st);
+	}
+	if (existsSync(root)) for (const ent of readdirSync(root, { withFileTypes: true })) {
+		if (!ent.isDirectory() || known.has(ent.name) || existsSync(statusPath(logDir, ent.name))) continue;
+		const dir = join(root, ent.name);
+		try {
+			if (statSync(dir).mtimeMs > cutoff) continue;
+		} catch {
+			continue;
+		}
+		archive(ent.name, dir, null);
+	}
+	if (!dryRun) for (const repo of new Set(loadStatuses(logDir).map((s) => s.cwd))) {
+		try {
+			git(repo, ["worktree", "prune"]);
+		} catch {}
+		invalidatePendingCache(logDir, repo);
+	}
+	return out;
+}
+/** Run `gcWorktrees` at most once per `everyMin` minutes (stamp file in the logDir). */
+function gcWorktreesThrottled(logDir, everyMin = 60, now = Date.now()) {
+	const stamp = join(logDir, GC_STAMP);
+	try {
+		if (now - statSync(stamp).mtimeMs < everyMin * 6e4) return null;
+	} catch {}
+	mkdirSync(logDir, { recursive: true });
+	writeFileSync(stamp, String(now), "utf8");
+	return gcWorktrees(logDir, 24, false, now);
+}
+
+//#endregion
+export { newWorkerId as A, shortText as B, contextPercent as C, isLive as D, isChatPane as E, setWorkerLabel as F, panesDir as G, ensureNoMcpConfig as H, waitForTerminalStatus as I, routingStatePath as K, appendSystemPromptArgs as L, ownsPid as M, parseSleepSecs as N, loadStatus as O, saveStatus as P, longInlinePromptHint as R, contextLabel as S, elapsedOf as T, eventsPath as U, stripPromptValues as V, ledgerPath as W, appendLedger as _, git as a, ageOf as b, recordWorktree as c, worktreeSystemPrompt as d, worktreeWanted as f, pendingResults as g, pendingGate as h, gcWorktreesThrottled as i, nowStamp as j, loadStatuses as k, salvageOnExit as l, formatPending as m, discardWorker as n, inPlaceSystemPrompt as o, worktreesDir as p, workersLogDir as q, gcWorktrees as r, mergeWorker as s, addWorktree as t, verifyWorker as u, ledgerSummary as v, describeTool as w, alive as x, UNLABELED as y, parseRunnerArgs as z };
+//# sourceMappingURL=worktree-CwMRTa0H.mjs.map