@tekmidian/pai 1.0.0 → 1.0.2

package/dist/{local-candidate-jOjTNlOL.mjs → scheduler-CtUyWJ3O.mjs}

@@ -1,7 +1,6 @@
-import { L as isLoopbackHostname, tt as workersYamlPath } from "./config-D5chi2LO.mjs";
-import { _ as readLocalConfig } from "./local-tiers-DPZYqv9m.mjs";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { n as minOf } from "./min-max-DrSRUaWQ.mjs";
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 
 //#region src/router/scheduler.ts
 /**
@@ -133,7 +132,7 @@ var RequestScheduler = class {
 		if (eng.inflight) backlogged.add(eng.inflight.session);
 		if (!backlogged.has(session)) {
 			const others = [...backlogged].map((s) => ctr.get(s) ?? 0);
-			const floor = others.length ? Math.min(...others) : 0;
+			const floor = others.length ? minOf(others) : 0;
 			ctr.set(session, Math.max(ctr.get(session) ?? 0, floor));
 		} else if (!ctr.has(session)) ctr.set(session, 0);
 		const acct = this.acct(worker, session, engineName);
@@ -181,7 +180,7 @@ var RequestScheduler = class {
 		let bestAt = Infinity;
 		for (const s of sessions) {
 			const c = ctr.get(s) ?? 0;
-			const at = Math.min(...eng.waiting.filter((w) => w.session === s).map((w) => w.at));
+			const at = minOf(eng.waiting.filter((w) => w.session === s).map((w) => w.at));
 			if (c < bestC || c === bestC && at < bestAt) {
 				best = s;
 				bestC = c;
@@ -390,106 +389,5 @@ function schedPlain(s, names) {
 }
 
 //#endregion
-//#region src/workers/local-status.ts
-/**
-* local-status.ts — the one authoritative answer to "which local model is
-* running?" (incident 2026-10-19: a session curled ports 8010/8011/8020, found
-* nothing, and went looking for how to start a model server while the running
-* one was never considered). The PAI daemon computes the answer every 30 s and
-* caches it in <logDir>/local-status.json; everything else only reads it:
-* `pai worker local`, the `local_status` MCP tool, resolveLocalProvider, the
-* prompt hint and the Bash guard. Readers fall back to a direct probe only
-* when the cache is missing or stale (daemon unreachable).
-*/
-const LOCAL_STATUS_REFRESH_MS = 3e4;
-/** A cache older than this means the daemon is not refreshing it. */
-const LOCAL_STATUS_MAX_AGE_MS = 18e4;
-const localStatusPath = (logDir) => join(logDir, "local-status.json");
-const NO_SERVER_HINT = "do not start model servers";
-function localStatusLine(st) {
-	if (st.running.length) return `local: ${st.running.map((r) => `${r.provider} (${r.model})`).join(", ")} running — use \`pai worker run --local\``;
-	return `local: none running — local work is not available; ${NO_SERVER_HINT}`;
-}
-function writeLocalStatus(logDir, st) {
-	const path = localStatusPath(logDir);
-	mkdirSync(dirname(path), { recursive: true });
-	const tmp = `${path}.${process.pid}.tmp`;
-	writeFileSync(tmp, JSON.stringify(st) + "\n", "utf8");
-	renameSync(tmp, path);
-}
-/** Like readLocalStatus, but says why there is no answer: missing, unparsable, stale (age) or bad shape. */
-function readLocalStatusWhy(logDir, now = Date.now(), maxAgeMs = LOCAL_STATUS_MAX_AGE_MS) {
-	const path = localStatusPath(logDir);
-	if (!existsSync(path)) return {
-		status: null,
-		reason: "status file missing"
-	};
-	let st;
-	try {
-		st = JSON.parse(readFileSync(path, "utf8"));
-	} catch {
-		return {
-			status: null,
-			reason: "status file unparsable"
-		};
-	}
-	if (!st || typeof st !== "object") return {
-		status: null,
-		reason: "status file has a bad shape"
-	};
-	const raw = st.running;
-	st.running = Array.isArray(raw) ? raw : raw && typeof raw === "object" ? [raw] : [];
-	const at = Date.parse(st.at);
-	if (Number.isNaN(at) || !Array.isArray(st.down) || !Array.isArray(st.disabled)) return {
-		status: null,
-		reason: "status file has a bad shape"
-	};
-	const age = now - at;
-	if (age > maxAgeMs) return {
-		status: null,
-		reason: `status ${Math.round(age / 1e3)} s old (max ${Math.round(maxAgeMs / 1e3)} s)`
-	};
-	return { status: st };
-}
-/** The daemon's cached answer; null when absent, damaged or older than maxAgeMs. */
-function readLocalStatus(logDir, now = Date.now(), maxAgeMs = LOCAL_STATUS_MAX_AGE_MS) {
-	return readLocalStatusWhy(logDir, now, maxAgeMs).status;
-}
-/** Text + JSON of the answer for the CLI and the MCP tool. */
-function localStatusReport(st) {
-	const extra = (st.down.length ? ` down: ${st.down.join(", ")}.` : "") + (st.disabled.length ? ` disabled: ${st.disabled.join(", ")}.` : "");
-	return {
-		text: localStatusLine(st) + (extra ? `\n${extra.trim()}` : ""),
-		json: st
-	};
-}
-
-//#endregion
-//#region src/workers/local-candidate.ts
-/**
-* Providers a `local:` tier launches. `pai worker local <tier>` and the cockpit
-* start those without touching `enabled:`, so a running tier server is a
-* candidate for --local even when its provider entry is switched off.
-*/
-function tierProviderNames(yamlPath = workersYamlPath()) {
-	try {
-		return Object.values(readLocalConfig(yamlPath).tiers).map((t) => t.provider);
-	} catch {
-		return [];
-	}
-}
-function isLoopbackBaseUrl(url) {
-	try {
-		return isLoopbackHostname(new URL(url).hostname);
-	} catch {
-		return false;
-	}
-}
-/** A loopback provider --local may run on: enabled, or launched by a tier. */
-function isLocalCandidate(p, name, tierProviders) {
-	return (p.enabled || tierProviders.includes(name)) && isLoopbackBaseUrl(p.baseUrl);
-}
-
-//#endregion
-export { localStatusReport as a, mirrorTo as c, schedConfigFrom as d, schedEnabled as f, sharedScheduler as g, setSchedConfigSource as h, localStatusLine as i, newPrefill as l, schedPlain as m, tierProviderNames as n, readLocalStatus as o, schedLine as p, LOCAL_STATUS_REFRESH_MS as r, writeLocalStatus as s, isLocalCandidate as t, readSchedFile as u };
-//# sourceMappingURL=local-candidate-jOjTNlOL.mjs.map
+export { newPrefill as a, schedEnabled as c, setSchedConfigSource as d, sharedScheduler as f, mirrorTo as i, schedLine as l, RequestScheduler as n, readSchedFile as o, SCHED_FILE as r, schedConfigFrom as s, DEFAULT_SCHED as t, schedPlain as u };
+//# sourceMappingURL=scheduler-CtUyWJ3O.mjs.map

package/dist/scheduler-dmHXoRvm.mjs

@@ -0,0 +1,3 @@
+import { a as newPrefill, c as schedEnabled, d as setSchedConfigSource, f as sharedScheduler, i as mirrorTo, l as schedLine, n as RequestScheduler, o as readSchedFile, r as SCHED_FILE, s as schedConfigFrom, t as DEFAULT_SCHED, u as schedPlain } from "./scheduler-CtUyWJ3O.mjs";
+
+export { DEFAULT_SCHED, RequestScheduler, SCHED_FILE, mirrorTo, newPrefill, readSchedFile, schedConfigFrom, schedEnabled, schedLine, schedPlain, setSchedConfigSource, sharedScheduler };

package/dist/{scope-D5VSQxe4.mjs → scope-D-h6F6DN.mjs}

@@ -1,6 +1,6 @@
-import { j as readWorkersSection } from "./config-D5chi2LO.mjs";
-import { c as slotCurrentPath, u as workersLogDir } from "./paths-DoIyRnhx.mjs";
-import { _ as isTerminal, v as loadStatus } from "./status-CvVi9cDf.mjs";
+import { j as readWorkersSection } from "./config-XpZWOYOG.mjs";
+import { c as slotCurrentPath, u as workersLogDir } from "./paths-CHifubDh.mjs";
+import { _ as isTerminal, v as loadStatus } from "./status-ggJ7lgVg.mjs";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
@@ -221,4 +221,4 @@ function terminalHasName(name, term, registryPath = AIBROKER_REGISTRY) {
 
 //#endregion
 export { ownerSessionName as a, scopeKey as c, terminalHasName as d, workerInScope as f, itermUuid as i, sessionMapPath as l, currentTabKey as n, resolveSession as o, currentWorkerId as p, itermForClaudeSession as r, resolveSpawnerSession as s, AIBROKER_REGISTRY as t, sessionTag as u };
-//# sourceMappingURL=scope-D5VSQxe4.mjs.map
+//# sourceMappingURL=scope-D-h6F6DN.mjs.map

package/dist/{search-CPoE0830.mjs → search-RSyeQqj1.mjs}

@@ -1,4 +1,4 @@
-import { t as STOP_WORDS } from "./stop-words-SdSL1WKH.mjs";
+import { t as STOP_WORDS } from "./stop-words-DSEYQdNe.mjs";
 
 //#region src/memory/search.ts
 /**
@@ -8,6 +8,20 @@ import { t as STOP_WORDS } from "./stop-words-SdSL1WKH.mjs";
 * back into buildFtsQuery()/isQuerySyntaxError() from this module.
 */
 /**
+* Did SQLite reject the QUERY, or fail at the STORE?
+*
+* Only the first justifies an empty result. FTS5 reports a bad MATCH expression
+* with a recognisable message; a missing table, a corrupt index or a locked
+* database do not, and must not be reported as "nothing found".
+*
+* Matching on message text is unlovely, and the alternative — treating every
+* failure as empty — is what produced a confidently wrong answer to a human.
+*/
+function isQuerySyntaxError(e) {
+	const msg = e instanceof Error ? e.message : String(e);
+	return /fts5|malformed MATCH|syntax error|unterminated string|no such column/i.test(msg);
+}
+/**
 * Convert a free-text query into an FTS5 query string.
 *
 * Strategy:
@@ -21,24 +35,10 @@ import { t as STOP_WORDS } from "./stop-words-SdSL1WKH.mjs";
 * scoring naturally ranks chunks where more terms match higher, so the most
 * relevant chunks still surface at the top.
 *
-* Example: "Synchrotech interview follow-up Gilles"
-*   → `"synchrotech" OR "interview" OR "follow" OR "gilles"`
+* Example: "Acme interview follow-up Alice"
+*   → `"acme" OR "interview" OR "follow" OR "alice"`
 *   → chunks matching any term, ranked by how many terms match
 */
-/**
-* Did SQLite reject the QUERY, or fail at the STORE?
-*
-* Only the first justifies an empty result. FTS5 reports a bad MATCH expression
-* with a recognisable message; a missing table, a corrupt index or a locked
-* database do not, and must not be reported as "nothing found".
-*
-* Matching on message text is unlovely, and the alternative — treating every
-* failure as empty — is what produced a confidently wrong answer to a human.
-*/
-function isQuerySyntaxError(e) {
-	const msg = e instanceof Error ? e.message : String(e);
-	return /fts5|malformed MATCH|syntax error|unterminated string|no such column/i.test(msg);
-}
 function buildFtsQuery(query) {
 	const tokens = query.toLowerCase().split(/[\s\p{P}]+/u).filter(Boolean).filter((t) => t.length >= 2).filter((t) => !STOP_WORDS.has(t)).map((t) => `"${t.replace(/"/g, "\"\"")}"`);
 	if (tokens.length === 0) return `"${query.replace(/"/g, "\"\"")}"`;
@@ -104,4 +104,4 @@ function applyRecencyBoost(results, halfLifeDays = 90) {
 
 //#endregion
 export { populateSlugs as i, buildFtsQuery as n, isQuerySyntaxError as r, applyRecencyBoost as t };
-//# sourceMappingURL=search-CPoE0830.mjs.map
+//# sourceMappingURL=search-RSyeQqj1.mjs.map

package/dist/session-Bok2PqRS.mjs

@@ -0,0 +1,35 @@
+import "./utils-J2b9y8PC.mjs";
+import "./migrate-DrA_OwlZ.mjs";
+import "./config-XpZWOYOG.mjs";
+import "./config-Bu1_vbY8.mjs";
+import "./paths-CHifubDh.mjs";
+import "./worktree-CrnOqTBW.mjs";
+import "./status-ggJ7lgVg.mjs";
+import "./pool-BRvoOkv6.mjs";
+import "./registrable-Uzgmfyhz.mjs";
+import "./pai-marker-DurzIbw8.mjs";
+import "./helpers-CRuBUas3.mjs";
+import "./scope-D-h6F6DN.mjs";
+import "./routing-BAAST9vT.mjs";
+import "./tool-errors-7E13StWd.mjs";
+import "./wait-ByV0OyMZ.mjs";
+import "./local-tiers-BE4jGaMa.mjs";
+import "./caller-identity-yLFb7CKq.mjs";
+import "./capacity-DEveQdFV.mjs";
+import "./local-instances-DOxSgT_L.mjs";
+import "./local-candidate-DLdwQt0s.mjs";
+import "./factory-DjAAsqr_.mjs";
+import "./postgres-C6ti4haA.mjs";
+import "./embedding-gate-6rZrWRXa.mjs";
+import "./embeddings-BVq3esBF.mjs";
+import "./router-CQSc3lk3.mjs";
+import "./detect-9CZNO0yf.mjs";
+import "./helpers-BD6V-p9w.mjs";
+import "./scan-ZQWm-_se.mjs";
+import { a as newTop, c as planOpen, d as runNewDefault, f as sessionCommand, i as lsCommand, l as renameTop, n as collectRows, o as oneLine, p as sessionDir, r as collectView, s as openTop, t as applyProfileChat, u as rowsTable } from "./session-DVUExUnX.mjs";
+import "./launch-Jh5NVeNe.mjs";
+import "./health-Dnym-qcT.mjs";
+import "./launch-CXVlZjHt.mjs";
+import "./session-scan-W-gbwJHM.mjs";
+
+export { runNewDefault };

package/dist/{session-CNXF6DLP.mjs → session-DVUExUnX.mjs}

@@ -1,24 +1,24 @@
 import { _ as warn, a as fmtDate, c as ok, d as scaffoldProjectDirs, f as shortenPath, i as err, l as renderTable, n as dim, o as header, p as slugFromPath, r as encodeDir, s as now, t as bold, u as resolvePath } from "./utils-J2b9y8PC.mjs";
 import { u as claudeProjectsDir } from "./runtime-paths-WsO9sJFc.mjs";
-import { b as nativeOrchestratorModel, j as readWorkersSection, p as getProviderOrNative, t as ANTHROPIC_NATIVE, vt as stripModelVariant, wt as appendLedger } from "./config-D5chi2LO.mjs";
-import { i as ledgerPath, u as workersLogDir } from "./paths-DoIyRnhx.mjs";
-import { A as trustProjectPath } from "./pool-CZ5MZaXg.mjs";
-import { a as unregistrableReason } from "./registrable-LrRIVYQc.mjs";
-import { n as ensurePaiMarker } from "./pai-marker-kIYuNt3c.mjs";
-import { t as STOP_WORDS } from "./stop-words-SdSL1WKH.mjs";
-import { bt as routeVerdictLine, on as SESSION_NAME_ENV, sn as getProfile, x as SESSION_WORKER_PROVIDER_ENV } from "./routing-CUyiglfu.mjs";
-import { n as OPT, t as CliError } from "./define-DGFu-sCf.mjs";
-import { i as getRegistryBackend } from "./factory-BtjbQ0np.mjs";
-import { n as formatDetection, r as formatDetectionJson, t as detectProject } from "./detect-C1d5cUkT.mjs";
-import { a as getSessionCount, c as upsertTag$1, i as getProjectTags, n as getProject$1, o as requireProject, r as getProjectAliases, s as resolveIdentifier, t as getLastSessionDate } from "./helpers-DFmYRCOa.mjs";
-import { a as resolveHome, n as loadScanConfig } from "./scan-B7I0gPe-.mjs";
-import { n as buildLaunchPlan, o as launchableProviderNames, s as maskLaunchEnv, t as LaunchError } from "./launch-DgqQdAjI.mjs";
-import { a as colorEnabled, f as renderTable$1, i as saveBudgetSnapshot, n as readBudget, o as makeStyle, r as readBudgetSnapshot, t as providerHealth } from "./health-C6jZWvRG.mjs";
-import { d as printExitDir, i as probeResume, u as transcriptModelFor } from "./launch-CLp0OJxV.mjs";
-import { n as fetchLiveSessions } from "./aibroker-client-CXEYBzbf.mjs";
-import { a as resolveSessionByNameOrId, s as scanSessions, t as fmtAge } from "./session-scan-BDLEc4w1.mjs";
+import { b as nativeOrchestratorModel, j as readWorkersSection, p as getProviderOrNative, t as ANTHROPIC_NATIVE, vt as stripModelVariant, wt as appendLedger } from "./config-XpZWOYOG.mjs";
+import { i as ledgerPath, u as workersLogDir } from "./paths-CHifubDh.mjs";
+import { A as trustProjectPath } from "./pool-BRvoOkv6.mjs";
+import { a as unregistrableReason } from "./registrable-Uzgmfyhz.mjs";
+import { n as ensurePaiMarker } from "./pai-marker-DurzIbw8.mjs";
+import { t as STOP_WORDS } from "./stop-words-DSEYQdNe.mjs";
+import { cn as getProfile, sn as SESSION_NAME_ENV, x as SESSION_WORKER_PROVIDER_ENV, xt as routeVerdictLine } from "./routing-BAAST9vT.mjs";
+import { n as OPT, t as CliError } from "./define-CjJsmq-6.mjs";
+import { i as getRegistryBackend } from "./factory-DjAAsqr_.mjs";
+import { n as formatDetection, r as formatDetectionJson, t as detectProject } from "./detect-9CZNO0yf.mjs";
+import { a as getSessionCount, c as upsertTag$1, i as getProjectTags, n as getProject$1, o as requireProject, r as getProjectAliases, s as resolveIdentifier, t as getLastSessionDate } from "./helpers-BD6V-p9w.mjs";
+import { a as resolveHome, n as loadScanConfig } from "./scan-ZQWm-_se.mjs";
+import { n as buildLaunchPlan, o as launchableProviderNames, s as maskLaunchEnv, t as LaunchError } from "./launch-Jh5NVeNe.mjs";
+import { a as colorEnabled, f as renderTable$1, i as saveBudgetSnapshot, n as readBudget, o as makeStyle, r as readBudgetSnapshot, t as providerHealth } from "./health-Dnym-qcT.mjs";
+import { d as printExitDir, i as probeResume, u as transcriptModelFor } from "./launch-CXVlZjHt.mjs";
+import { n as fetchLiveSessions } from "./aibroker-client-CQPGqLxL.mjs";
+import { a as resolveSessionByNameOrId, s as scanSessions, t as fmtAge } from "./session-scan-W-gbwJHM.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
-import { basename, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import chalk from "chalk";
 import { homedir } from "node:os";
 import { spawnSync } from "node:child_process";
@@ -1066,7 +1066,7 @@ async function getSessionTags(registryBackend, sessionId) {
 * Session CRUD commands: list, info, rename, slug, tag, route, active, auto-route.
 */
 async function cmdList(projectSlug, opts) {
-	const { getRegistryBackend } = await import("./factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	const limit = parseInt(opts.limit ?? "20", 10);
 	let project;
@@ -1131,7 +1131,7 @@ async function cmdList(projectSlug, opts) {
 	console.log(dim(`  ${rows.length} session(s) shown (limit: ${limit})`));
 }
 async function cmdInfo(projectSlug, sessionNumber) {
-	const { getRegistryBackend } = await import("./factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	const project = await getProject(registryBackend, projectSlug);
 	if (!project) {
@@ -1155,9 +1155,20 @@ async function cmdInfo(projectSlug, sessionNumber) {
 	console.log();
 }
 async function cmdRename(projectSlug, numberOrLatest, newSlug) {
-	const { getRegistryBackend } = await import("./factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
 	await cmdRenameWith(await getRegistryBackend(), projectSlug, numberOrLatest, newSlug);
 }
+/** Strips path separators and ".." so a title can never leave the notes dir. */
+function sanitizeTitle(title) {
+	return title.replace(/[\\/]/g, " ").replace(/\.{2,}/g, " ").replace(/\s+/g, " ").trim();
+}
+/** Target path for a rename; throws unless it stays inside notesDir and does not clobber another note. */
+function checkedRenameTarget(notesDir, oldPath, newFilename) {
+	const newPath = join(notesDir, newFilename);
+	if (resolve(dirname(newPath)) !== resolve(notesDir)) throw new Error(`target escapes the notes directory: ${newFilename}`);
+	if (newPath !== oldPath && existsSync(newPath)) throw new Error(`refusing to overwrite existing note: ${newFilename}`);
+	return newPath;
+}
 async function cmdRenameWith(registryBackend, projectSlug, numberOrLatest, newSlug) {
 	const project = await getProject(registryBackend, projectSlug);
 	if (!project) {
@@ -1172,10 +1183,23 @@ async function cmdRenameWith(registryBackend, projectSlug, numberOrLatest, newSl
 		process.exitCode = 1;
 		return;
 	}
+	newSlug = sanitizeTitle(newSlug);
+	if (!newSlug) {
+		console.error(err("Title is empty after removing path separators."));
+		process.exitCode = 1;
+		return;
+	}
 	const titleSlug = toTitleCase(newSlug);
 	const newFilename = formatFilename(session.number, session.date, titleSlug);
 	const oldPath = join(notesDir, session.filename);
-	const newPath = join(notesDir, newFilename);
+	let newPath;
+	try {
+		newPath = checkedRenameTarget(notesDir, oldPath, newFilename);
+	} catch (e) {
+		console.error(err(e instanceof Error ? e.message : String(e)));
+		process.exitCode = 1;
+		return;
+	}
 	if (existsSync(oldPath)) {
 		if (oldPath !== newPath) try {
 			renameSync(oldPath, newPath);
@@ -1218,7 +1242,7 @@ async function cmdRenameWith(registryBackend, projectSlug, numberOrLatest, newSl
 	console.log();
 }
 async function cmdSlug(projectSlug, numberOrLatest, opts) {
-	const { getRegistryBackend } = await import("./factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	const project = await getProject(registryBackend, projectSlug);
 	if (!project) {
@@ -1248,7 +1272,7 @@ async function cmdSlug(projectSlug, numberOrLatest, opts) {
 	}
 }
 async function cmdTag(projectSlug, sessionNumber, rawTags) {
-	const { getRegistryBackend } = await import("./factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	const project = await getProject(registryBackend, projectSlug);
 	if (!project) {
@@ -1288,7 +1312,7 @@ async function cmdTag(projectSlug, sessionNumber, rawTags) {
 	console.log();
 }
 async function cmdRoute(projectSlug, sessionNumber, targetProjectSlug, opts) {
-	const { getRegistryBackend } = await import("./factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	const project = await getProject(registryBackend, projectSlug);
 	if (!project) {
@@ -1330,7 +1354,7 @@ async function cmdRoute(projectSlug, sessionNumber, targetProjectSlug, opts) {
 	console.log();
 }
 async function cmdActive(opts) {
-	const { getRegistryBackend } = await import("./factory-DAGG9_n8.mjs");
+	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
 	const registryBackend = await getRegistryBackend();
 	const minutes = parseInt(opts.minutes ?? "60", 10);
 	const cutoff = Date.now() - minutes * 60 * 1e3;
@@ -1417,9 +1441,9 @@ async function cmdActive(opts) {
 	], rows));
 }
 async function cmdAutoRoute(opts) {
-	const { autoRoute, formatAutoRouteJson } = await import("./auto-route-BRk8NEFv.mjs");
-	const { getRegistryBackend, createStorageBackend } = await import("./factory-DAGG9_n8.mjs");
-	const { loadConfig } = await import("./config-TaWmdTLx.mjs");
+	const { autoRoute, formatAutoRouteJson } = await import("./auto-route-BjoMHKyI.mjs");
+	const { getRegistryBackend, createStorageBackend } = await import("./factory-Bsib-qDG.mjs");
+	const { loadConfig } = await import("./config-DtENJ6cL.mjs");
 	const config = loadConfig();
 	const registryBackend = await getRegistryBackend();
 	const federation = await createStorageBackend(config);
@@ -1830,7 +1854,7 @@ const newCommand = {
 		const name = ctx.opts.name;
 		const withSetup = ctx.opts.with;
 		if (withSetup) {
-			const { runNewWith } = await import("./root-xI9DqVIe.mjs");
+			const { runNewWith } = await import("./root-wC_6Fx0B.mjs");
 			return runNewWith({
 				dir,
 				with: withSetup,
@@ -1936,4 +1960,4 @@ const renameTop = {
 
 //#endregion
 export { cmdAdd as A, cmdRebind as B, assertAvailable as C, execHarness as D, dryRunText as E, cmdEdit as F, cmdUnarchive as H, cmdGo as I, cmdInfo$1 as L, cmdArchive as M, cmdConsolidate as N, looksLikePath as O, cmdDetect as P, cmdList$1 as R, legacy as S, buildHarness as T, findMovedPath as U, cmdTag$1 as V, cmdList as _, newTop as a, cmdSlug as b, planOpen as c, runNewDefault as d, sessionCommand as f, cmdInfo as g, cmdAutoRoute as h, lsCommand as i, cmdAlias as j, prepareDir as k, renameTop as l, cmdActive as m, collectRows as n, oneLine as o, sessionDir as p, collectView as r, openTop as s, applyProfileChat as t, rowsTable as u, cmdRename as v, modelFor as w, cmdTag as x, cmdRoute as y, cmdMove as z };
-//# sourceMappingURL=session-CNXF6DLP.mjs.map
+//# sourceMappingURL=session-DVUExUnX.mjs.map

package/dist/session-scan-BJI_ZO8M.mjs

@@ -0,0 +1,9 @@
+import "./utils-J2b9y8PC.mjs";
+import "./config-XpZWOYOG.mjs";
+import "./config-Bu1_vbY8.mjs";
+import "./paths-CHifubDh.mjs";
+import "./status-ggJ7lgVg.mjs";
+import "./scope-D-h6F6DN.mjs";
+import { a as resolveSessionByNameOrId, c as transcriptCustomTitle, i as resolveFriendlyName, n as loadBrokerNames, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "./session-scan-W-gbwJHM.mjs";
+
+export { loadBrokerNames, transcriptCustomTitle };

package/dist/{session-scan-BDLEc4w1.mjs → session-scan-W-gbwJHM.mjs}

@@ -1,9 +1,9 @@
 import { h as smartDecodeDir } from "./utils-J2b9y8PC.mjs";
 import { _ as resolvePaiFile, f as legacyConfigDir, g as paiHomePath, l as claudeHomeDir, m as migratePaiFile, u as claudeProjectsDir } from "./runtime-paths-WsO9sJFc.mjs";
-import { j as readWorkersSection } from "./config-D5chi2LO.mjs";
-import { u as workersLogDir } from "./paths-DoIyRnhx.mjs";
-import { t as fmtAge$1 } from "./fmt-age-BiSHrTKN.mjs";
-import { i as itermUuid, l as sessionMapPath, t as AIBROKER_REGISTRY } from "./scope-D5VSQxe4.mjs";
+import { j as readWorkersSection } from "./config-XpZWOYOG.mjs";
+import { u as workersLogDir } from "./paths-CHifubDh.mjs";
+import { t as fmtAge$1 } from "./fmt-age-ByDkvkoU.mjs";
+import { i as itermUuid, l as sessionMapPath, t as AIBROKER_REGISTRY } from "./scope-D-h6F6DN.mjs";
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { basename, join } from "node:path";
 
@@ -137,7 +137,7 @@ function loadBrokerNames(registryPath = AIBROKER_REGISTRY, mapPath) {
 /** Build encoded_dir → root_path map from PAI registry (authoritative cwd). */
 async function buildRegistryRootPathMap() {
 	try {
-		const { getRegistryBackend } = await import("./factory-DAGG9_n8.mjs");
+		const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
 		const projects = await (await getRegistryBackend()).listProjects();
 		const map = /* @__PURE__ */ new Map();
 		for (const p of projects) if (p.encoded_dir) map.set(p.encoded_dir, p.root_path);
@@ -870,4 +870,4 @@ function transcriptCustomTitle(claudeSessionId, projectsDir = CLAUDE_PROJECTS_DI
 
 //#endregion
 export { resolveSessionByNameOrId as a, transcriptCustomTitle as c, resolveFriendlyName as i, loadBrokerNames as n, scanCacheFilePath as o, migrateSessionScanCache as r, scanSessions as s, fmtAge as t };
-//# sourceMappingURL=session-scan-BDLEc4w1.mjs.map
+//# sourceMappingURL=session-scan-W-gbwJHM.mjs.map

package/dist/{sources-CjhUKKtO.mjs → sources-ESUkZaWv.mjs}

@@ -114,4 +114,4 @@ function tail(s, n) {
 
 //#endregion
 export { cmdMemorySources };
-//# sourceMappingURL=sources-CjhUKKtO.mjs.map
+//# sourceMappingURL=sources-ESUkZaWv.mjs.map

package/dist/{status-DYydKQUI.mjs → status-Dm4dYciN.mjs}

@@ -1,6 +1,6 @@
-import "./config-D5chi2LO.mjs";
-import "./config-BSXKyeJ1.mjs";
-import "./paths-DoIyRnhx.mjs";
-import { A as setWorkerLabel, C as nowStamp, D as pidAlive, E as parseSleepSecs, M as spawnTimeOf, N as statusTmpPath, O as reconcileStatuses, P as waitForTerminalStatus, S as newWorkerId, T as ownsPidCached, _ as isTerminal, a as UNLABELED, b as loadStatusesCached, c as contextFooter, d as describeTool, f as elapsedOf, g as isLive, h as isChatPane, i as TERMINAL_RECHECK_MS, j as setWorkerNote, k as saveStatus, l as contextLabel, m as fmtTokens, n as OWNS_TTL_MS, o as ageOf, p as fmtContextK, r as SLEEP_FLOOR_SECS, s as alive, t as LOST_GRACE_MS, u as contextPercent, v as loadStatus, w as ownsPid, x as markStartFailed, y as loadStatuses } from "./status-CvVi9cDf.mjs";
+import "./config-XpZWOYOG.mjs";
+import "./config-Bu1_vbY8.mjs";
+import "./paths-CHifubDh.mjs";
+import { A as setWorkerLabel, C as nowStamp, D as pidAlive, E as parseSleepSecs, M as spawnTimeOf, N as statusTmpPath, O as reconcileStatuses, P as waitForTerminalStatus, S as newWorkerId, T as ownsPidCached, _ as isTerminal, a as UNLABELED, b as loadStatusesCached, c as contextFooter, d as describeTool, f as elapsedOf, g as isLive, h as isChatPane, i as TERMINAL_RECHECK_MS, j as setWorkerNote, k as saveStatus, l as contextLabel, m as fmtTokens, n as OWNS_TTL_MS, o as ageOf, p as fmtContextK, r as SLEEP_FLOOR_SECS, s as alive, t as LOST_GRACE_MS, u as contextPercent, v as loadStatus, w as ownsPid, x as markStartFailed, y as loadStatuses } from "./status-ggJ7lgVg.mjs";
 
 export { loadStatus };

package/dist/{status-CvVi9cDf.mjs → status-ggJ7lgVg.mjs}

@@ -1,10 +1,10 @@
-import { f as readMainConfigRaw } from "./config-BSXKyeJ1.mjs";
-import { l as statusPath } from "./paths-DoIyRnhx.mjs";
+import { f as readMainConfigRaw } from "./config-Bu1_vbY8.mjs";
+import { l as statusPath } from "./paths-CHifubDh.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { execFileSync, spawnSync } from "node:child_process";
 import { parse } from "yaml";
-import { createHash } from "node:crypto";
 
 //#region src/workers/args.ts
 /**
@@ -259,16 +259,24 @@ function resolveToken() {
 	return process.env.FORGE_TOKEN || process.env.AIBROKER_FORGE_TOKEN || void 0;
 }
 /** Real transport: curl; the token goes in on stdin so it never shows in ps. */
-const curlHttp = (method, url, token, body, timeoutMs) => {
-	const cfg = [
-		`url = "${url}"`,
-		`request = "${method}"`,
-		`header = "Authorization: token ${token}"`,
+/** Escape a value for a double-quoted curl config string; newlines would inject directives. */
+function curlQuote(v) {
+	if (/[\r\n]/.test(v)) throw new ForgeError("refusing newline in curl config value");
+	return v.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+}
+function buildCurlConfig(method, url, token, timeoutMs) {
+	return [
+		`url = "${curlQuote(url)}"`,
+		`request = "${curlQuote(method)}"`,
+		`header = "Authorization: token ${curlQuote(token)}"`,
 		`header = "Content-Type: application/json"`,
 		`max-time = ${Math.max(.5, timeoutMs / 1e3)}`,
 		`silent`,
 		`write-out = "\\n%{http_code}"`
 	].join("\n");
+}
+const curlHttp = (method, url, token, body, timeoutMs) => {
+	const cfg = buildCurlConfig(method, url, token, timeoutMs);
 	const r = spawnSync("curl", body !== void 0 ? [
 		"-K",
 		"-",
@@ -913,4 +921,4 @@ function describeTool(name, inp) {
 
 //#endregion
 export { isFlagToken as $, setWorkerLabel as A, loadStatusConfig as B, nowStamp as C, pidAlive as D, parseSleepSecs as E, ForgeError as F, writeSectionToForge as G, setClaim as H, PROJECT_CONFIG_REL as I, loadPreamble as J, PREAMBLE_MAX_BYTES as K, formatStale as L, spawnTimeOf as M, statusTmpPath as N, reconcileStatuses as O, waitForTerminalStatus as P, appendSystemPromptArgs as Q, listClaims as R, newWorkerId as S, ownsPidCached as T, upsertSection as U, parseStatusConfig as V, writeContinueToForge as W, preambleLine as X, preambleBlock as Y, projectRoot as Z, isTerminal as _, UNLABELED as a, loadStatusesCached as b, contextFooter as c, describeTool as d, longInlinePromptHint as et, elapsedOf as f, isLive as g, isChatPane as h, TERMINAL_RECHECK_MS as i, setWorkerNote as j, saveStatus as k, contextLabel as l, fmtTokens as m, OWNS_TTL_MS as n, shortText as nt, ageOf as o, fmtContextK as p, PREAMBLE_REL as q, SLEEP_FLOOR_SECS as r, stripPromptValues as rt, alive as s, LOST_GRACE_MS as t, parseRunnerArgs as tt, contextPercent as u, loadStatus as v, ownsPid as w, markStartFailed as x, loadStatuses as y, listStale as z };
-//# sourceMappingURL=status-CvVi9cDf.mjs.map
+//# sourceMappingURL=status-ggJ7lgVg.mjs.map

package/dist/{stop-words-SdSL1WKH.mjs → stop-words-DSEYQdNe.mjs}

@@ -323,4 +323,4 @@ const TITLE_STOP_WORDS = STOP_WORDS;
 
 //#endregion
 export { TITLE_STOP_WORDS as n, STOP_WORDS as t };
-//# sourceMappingURL=stop-words-SdSL1WKH.mjs.map
+//# sourceMappingURL=stop-words-DSEYQdNe.mjs.map

package/dist/{test-isolation-CoDeOVXb.mjs → test-isolation-lqSmYxr0.mjs}

@@ -39,4 +39,4 @@ function assertTestWriteAllowed(path) {
 
 //#endregion
 export { isTestRunner as n, assertTestWriteAllowed as t };
-//# sourceMappingURL=test-isolation-CoDeOVXb.mjs.map
+//# sourceMappingURL=test-isolation-lqSmYxr0.mjs.map

package/dist/{timeouts-OwEONmc8.mjs → timeouts-1MLooEBB.mjs}

@@ -11,4 +11,4 @@ const TAILSCALE_STATUS_TIMEOUT_MS = 3e3;
 
 //#endregion
 export { TAILSCALE_STATUS_TIMEOUT_MS as n, LOCAL_PROBE_TIMEOUT_MS as t };
-//# sourceMappingURL=timeouts-OwEONmc8.mjs.map
+//# sourceMappingURL=timeouts-1MLooEBB.mjs.map

package/dist/{tool-errors-AeRQuG3Y.mjs → tool-errors-7E13StWd.mjs}

@@ -1,4 +1,5 @@
-import { n as bashExitCode, r as isExpectedWaitExit } from "./wait-BMUR-U-U.mjs";
+import { t as maxOf } from "./min-max-DrSRUaWQ.mjs";
+import { n as bashExitCode, r as isExpectedWaitExit } from "./wait-ByV0OyMZ.mjs";
 import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, statSync } from "node:fs";
 import { join } from "node:path";
 
@@ -582,10 +583,10 @@ function errorsTable(groups) {
 		hhmm(g.first),
 		hhmm(g.last)
 	]);
-	const w = rows[0].map((_, i) => Math.max(...rows.map((r) => r[i].length)));
+	const w = rows[0].map((_, i) => maxOf(rows.map((r) => r[i].length)));
 	return rows.map((r) => r.map((c, i) => c.padEnd(w[i])).join("  ")).join("\n");
 }
 
 //#endregion
 export { toolErrorSigTag as C, toolErrorsPath as E, summarizeToolInput as S, toolErrorText as T, lastCommand as _, SAME_WORKER_WINDOW_MS as a, readToolErrors as b, classifyToolError as c, detectToolErrors as d, errorsTable as f, isBenignBash as g, harnessToolErrorTexts as h, SAME_WORKER_MIN as i, clipRaw as l, groupToolErrors as m, CROSS_WORKER_WINDOW_MS as n, TOOL_ERRORS_FILE as o, grantedToolNames as p, RESEND_MS as r, benignNote as s, CROSS_WORKER_MIN as t, detectRunningWorkerErrors as u, normalizeError as v, toolErrorSummary as w, recordToolError as x, parseSince as y };
-//# sourceMappingURL=tool-errors-AeRQuG3Y.mjs.map
+//# sourceMappingURL=tool-errors-7E13StWd.mjs.map

package/dist/{tool-errors-R5E0fCgf.mjs → tool-errors-CJWODvlo.mjs}

@@ -1,8 +1,8 @@
-import "./config-D5chi2LO.mjs";
-import "./config-BSXKyeJ1.mjs";
-import "./paths-DoIyRnhx.mjs";
-import "./status-CvVi9cDf.mjs";
-import { C as toolErrorSigTag, E as toolErrorsPath, S as summarizeToolInput, T as toolErrorText, _ as lastCommand, a as SAME_WORKER_WINDOW_MS, b as readToolErrors, c as classifyToolError, d as detectToolErrors, f as errorsTable, g as isBenignBash, h as harnessToolErrorTexts, i as SAME_WORKER_MIN, l as clipRaw, m as groupToolErrors, n as CROSS_WORKER_WINDOW_MS, o as TOOL_ERRORS_FILE, p as grantedToolNames, r as RESEND_MS, s as benignNote, t as CROSS_WORKER_MIN, u as detectRunningWorkerErrors, v as normalizeError, w as toolErrorSummary, x as recordToolError, y as parseSince } from "./tool-errors-AeRQuG3Y.mjs";
-import "./wait-BMUR-U-U.mjs";
+import "./config-XpZWOYOG.mjs";
+import "./config-Bu1_vbY8.mjs";
+import "./paths-CHifubDh.mjs";
+import "./status-ggJ7lgVg.mjs";
+import { C as toolErrorSigTag, E as toolErrorsPath, S as summarizeToolInput, T as toolErrorText, _ as lastCommand, a as SAME_WORKER_WINDOW_MS, b as readToolErrors, c as classifyToolError, d as detectToolErrors, f as errorsTable, g as isBenignBash, h as harnessToolErrorTexts, i as SAME_WORKER_MIN, l as clipRaw, m as groupToolErrors, n as CROSS_WORKER_WINDOW_MS, o as TOOL_ERRORS_FILE, p as grantedToolNames, r as RESEND_MS, s as benignNote, t as CROSS_WORKER_MIN, u as detectRunningWorkerErrors, v as normalizeError, w as toolErrorSummary, x as recordToolError, y as parseSince } from "./tool-errors-7E13StWd.mjs";
+import "./wait-ByV0OyMZ.mjs";
 
 export { errorsTable, groupToolErrors, parseSince, readToolErrors };