@tekmidian/pai 1.0.3 → 1.0.4

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "pai",
   "displayName": "PAI Knowledge OS",
   "description": "Personal AI Infrastructure — persistent memory, session continuity, and knowledge graph for Claude Code",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "author": {
     "name": "Matthias Nott"
   },

package/dist/{auto-route-B7Yu6Uam.mjs → auto-route-21GdHL70.mjs}

@@ -158,4 +158,4 @@ function formatAutoRouteJson(result) {
 
 //#endregion
 export { formatAutoRouteJson as n, detectTopicShift as r, autoRoute as t };
-//# sourceMappingURL=auto-route-B7Yu6Uam.mjs.map
+//# sourceMappingURL=auto-route-21GdHL70.mjs.map

package/dist/{auto-route-CjjQqU1o.mjs → auto-route-C3S2W3Bc.mjs}

@@ -6,6 +6,6 @@ import "./status-ggJ7lgVg.mjs";
 import "./pool-Dh-q3iJi.mjs";
 import "./registrable-DpyTtajg.mjs";
 import "./pai-marker-BcZyJguM.mjs";
-import { n as formatAutoRouteJson, t as autoRoute } from "./auto-route-B7Yu6Uam.mjs";
+import { n as formatAutoRouteJson, t as autoRoute } from "./auto-route-21GdHL70.mjs";
 
 export { autoRoute, formatAutoRouteJson };

package/dist/{budget-Dod6rnA9.mjs → budget-BrloTOZW.mjs}

@@ -3,7 +3,7 @@ import "./config-Bu1_vbY8.mjs";
 import "./paths-CHifubDh.mjs";
 import "./status-ggJ7lgVg.mjs";
 import "./scope-D-h6F6DN.mjs";
-import { A as budgetSkipReason, D as budgetExceeded, E as budgetCache, M as budgetWall, N as fetchBudgetReading, O as budgetFresh, P as pickBudgetWindow, T as BudgetCache, j as budgetUntilLabel, k as budgetFull, w as BUDGET_TTL_MS } from "./routing-BAAST9vT.mjs";
+import { A as budgetSkipReason, D as budgetExceeded, E as budgetCache, M as budgetWall, N as fetchBudgetReading, O as budgetFresh, P as pickBudgetWindow, T as BudgetCache, j as budgetUntilLabel, k as budgetFull, w as BUDGET_TTL_MS } from "./routing-DmkheCRH.mjs";
 import "./tool-errors-7E13StWd.mjs";
 import "./wait-ByV0OyMZ.mjs";
 import "./local-tiers-BE4jGaMa.mjs";

package/dist/{chain-7n9Gx56r.mjs → chain-D7PFur8Y.mjs}

@@ -1,7 +1,7 @@
 import { j as readWorkersSection, wt as appendLedger } from "./config-XpZWOYOG.mjs";
 import { i as ledgerPath, u as workersLogDir } from "./paths-CHifubDh.mjs";
 import { $ as isFlagToken, S as newWorkerId, nt as shortText } from "./status-ggJ7lgVg.mjs";
-import { t as runWorker } from "./run-CSC7mgPf.mjs";
+import { t as runWorker } from "./run-BwZKBJZZ.mjs";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
@@ -163,4 +163,4 @@ async function runChain(opts, deps = {}) {
 
 //#endregion
 export { swapPromptArg as n, runChain as t };
-//# sourceMappingURL=chain-7n9Gx56r.mjs.map
+//# sourceMappingURL=chain-D7PFur8Y.mjs.map

package/dist/cli/index.mjs

@@ -14,7 +14,7 @@ import "../helpers-CRuBUas3.mjs";
 import { t as applyRecencyBoost } from "../search-RSyeQqj1.mjs";
 import { t as dropItermBundleId } from "../env-BE8mrsxr.mjs";
 import { a as ownerSessionName, d as terminalHasName } from "../scope-D-h6F6DN.mjs";
-import { An as saveSetup, Bn as aggregate, Dt as routerPort, E as budgetCache, Et as routerHandler, F as LimitsCache, Hn as appendUsage, In as parkConfigFrom, Jn as readUsage, Ln as setParkConfigSource, Nn as setupsPath, On as loadSaved, Rn as sharedParker, Tn as downLocalProviders, U as computeInventory, Un as formatSessionStats, Vn as aggregateBySession, W as currentInventory, Wn as formatStats, Wt as sessionStartTarget, Y as inventoryText, at as readInventoryInput, hn as localProviderForDelegation, m as readRoutingState, pt as isLoopbackProvider, qn as parseSince, sn as SESSION_NAME_ENV, un as readProfiles, wn as allSetups, x as SESSION_WORKER_PROVIDER_ENV, xt as routeVerdictLine, yn as providerHostPort, zn as recordDuration } from "../routing-BAAST9vT.mjs";
+import { At as hostAllowed, Bn as parkConfigFrom, Cn as providerHostPort, Dt as routerPort, E as budgetCache, Et as routerHandler, F as LimitsCache, Gn as aggregateBySession, Hn as sharedParker, Jn as formatStats, Jt as sessionStartTarget, Kn as appendUsage, Ln as setupsPath, Mn as loadSaved, On as allSetups, Ot as defaultV1Guard, Pn as saveSetup, Qn as readUsage, U as computeInventory, Un as recordDuration, Vn as setParkConfigSource, W as currentInventory, Wn as aggregate, Y as inventoryText, Zn as parseSince, at as readInventoryInput, dn as SESSION_NAME_ENV, jt as resolveBindAddress, kn as downLocalProviders, kt as displayHost, m as readRoutingState, mn as readProfiles, pt as isLoopbackProvider, qn as formatSessionStats, x as SESSION_WORKER_PROVIDER_ENV, xt as routeVerdictLine, yn as localProviderForDelegation } from "../routing-DmkheCRH.mjs";
 import { n as minOf } from "../min-max-DrSRUaWQ.mjs";
 import "../tool-errors-7E13StWd.mjs";
 import "../wait-ByV0OyMZ.mjs";
@@ -24,48 +24,48 @@ import { d as setSchedConfigSource, f as sharedScheduler, i as mirrorTo, s as sc
 import { i as effectiveCap, o as providerCap, r as capacityOf } from "../capacity-DEveQdFV.mjs";
 import "../local-instances-DOxSgT_L.mjs";
 import { n as tierProviderNames, t as isLocalCandidate } from "../local-candidate-DLdwQt0s.mjs";
-import { n as TAILSCALE_STATUS_TIMEOUT_MS } from "../timeouts-1MLooEBB.mjs";
 import { n as OPT, t as CliError } from "../define-CjJsmq-6.mjs";
-import { a as getStorageBackend, c as MergeError, f as humanDuration, i as getRegistryBackend, l as federationDbPath, o as oldRegistryPath, r as createStorageBackend, s as registryDbPath, u as oldFederationPath } from "../factory-DjAAsqr_.mjs";
-import { c as resolveFromModule, i as retryTransient, n as embedChunksWithBackend, r as indexProjectWithBackend, s as packageRoot } from "../postgres-C6ti4haA.mjs";
+import { a as getStorageBackend, c as MergeError, f as humanDuration, i as getRegistryBackend, l as federationDbPath, o as oldRegistryPath, r as createStorageBackend, s as registryDbPath, u as oldFederationPath } from "../factory-B7nv75rC.mjs";
+import { c as resolveFromModule, i as retryTransient, n as embedChunksWithBackend, r as indexProjectWithBackend, s as packageRoot } from "../postgres-DNIOQijl.mjs";
 import { d as OLLAMA_ID, f as ollamaDefaultUrl, i as measureThroughput, l as provisionOllama, o as createBackend, s as detectBackends, u as OLLAMA_DEFAULT_MODEL } from "../embedding-gate-6rZrWRXa.mjs";
 import "../embeddings-BVq3esBF.mjs";
 import "../router-CQSc3lk3.mjs";
-import { t as detectProject } from "../detect-9CZNO0yf.mjs";
-import { n as getProject$1, o as requireProject, r as getProjectAliases, s as resolveIdentifier } from "../helpers-BD6V-p9w.mjs";
-import { a as resolveHome, c as upsertSession, d as scanTranscriptFolders, f as transcriptFiles, l as claudeProjectsDir$1, n as loadScanConfig, o as saveScanConfig, r as migrateScanConfig, s as upsertProject, t as cmdScan, u as findMovedProjects } from "../scan-C_Y5W9py.mjs";
-import { A as cmdAdd, B as cmdRebind, F as cmdEdit, H as cmdUnarchive, I as cmdGo, L as cmdInfo$1, M as cmdArchive, N as cmdConsolidate, P as cmdDetect, R as cmdList$1, S as legacy, U as findMovedPath, V as cmdTag$1, _ as cmdList, a as newTop, b as cmdSlug, f as sessionCommand, g as cmdInfo, h as cmdAutoRoute, i as lsCommand, j as cmdAlias, l as renameTop, m as cmdActive, r as collectView, s as openTop, v as cmdRename, x as cmdTag, y as cmdRoute, z as cmdMove } from "../session-8iqQDkqb.mjs";
-import { a as detectCurrentProviderName, i as detectCurrentModel, n as buildLaunchPlan, o as launchableProviderNames, r as buildLaunchRows, s as maskLaunchEnv } from "../launch-Jh5NVeNe.mjs";
-import { a as colorEnabled, c as renderCommandHelp, d as renderOverview, f as renderTable$2, l as renderMarkdown, m as usageLine, o as makeStyle, p as suggest, s as mdCommand, u as renderMore } from "../health-Dnym-qcT.mjs";
-import { a as providerResumePlan, n as launchInDir, o as restoreTopLevel, r as launchPrompt, s as resumeArgvText, t as hasConversation } from "../launch-CXVlZjHt.mjs";
-import { _ as setupsTable, a as lastSetup, m as rootCommand } from "../root-Xglu0OPD.mjs";
+import { t as detectProject } from "../detect-BLKsUOgG.mjs";
+import { n as getProject$1, o as requireProject, r as getProjectAliases, s as resolveIdentifier } from "../helpers-DSNK_1KP.mjs";
+import { a as resolveHome, c as upsertSession, d as scanTranscriptFolders, f as transcriptFiles, l as claudeProjectsDir$1, n as loadScanConfig, o as saveScanConfig, r as migrateScanConfig, s as upsertProject, t as cmdScan, u as findMovedProjects } from "../scan-BBGvU5EB.mjs";
+import { A as cmdAdd, B as cmdRebind, F as cmdEdit, H as cmdUnarchive, I as cmdGo, L as cmdInfo$1, M as cmdArchive, N as cmdConsolidate, P as cmdDetect, R as cmdList$1, S as legacy, U as findMovedPath, V as cmdTag$1, _ as cmdList, a as newTop, b as cmdSlug, f as sessionCommand, g as cmdInfo, h as cmdAutoRoute, i as lsCommand, j as cmdAlias, l as renameTop, m as cmdActive, r as collectView, s as openTop, v as cmdRename, x as cmdTag, y as cmdRoute, z as cmdMove } from "../session-Dn5OJXlg.mjs";
+import { a as detectCurrentProviderName, i as detectCurrentModel, n as buildLaunchPlan, o as launchableProviderNames, r as buildLaunchRows, s as maskLaunchEnv } from "../launch-Di7N-J5X.mjs";
+import { a as colorEnabled, c as renderCommandHelp, d as renderOverview, f as renderTable$2, l as renderMarkdown, m as usageLine, o as makeStyle, p as suggest, s as mdCommand, u as renderMore } from "../health-C4FQmkJn.mjs";
+import { a as providerResumePlan, n as launchInDir, o as restoreTopLevel, r as launchPrompt, s as resumeArgvText, t as hasConversation } from "../launch-DlZTKE3u.mjs";
+import { _ as setupsTable, a as lastSetup, m as rootCommand } from "../root-C4oXlXS_.mjs";
 import { n as fetchLiveSessions, r as sendToSession, t as callAiBroker } from "../aibroker-client-CQPGqLxL.mjs";
-import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-W-gbwJHM.mjs";
-import { A as routerPidFile, B as usageContextTokens, D as routerHandoverFile, E as probeRouter, F as startHandover, I as paneWaiver, L as launchPane, M as routerSwapArgs, P as spawnRouter, R as noTerminalReasons, S as usageJson, T as projectLaunchConfig, b as renderUsage, c as reportOriginWithHost, f as dirtyPaths, g as realRunnerDeps, j as routerRunningPid, k as routerLogFile, l as runMessenger, s as finishDetached, u as startDetached, w as pinNotices, x as transcriptUsage, y as priceTableText } from "../run-CSC7mgPf.mjs";
-import { C as readRunLog, D as resumeState, E as requestPlanStop, F as runLogPath, I as PlanTracker, M as dirtyConflicts, O as runExitCode, P as loadPlan, S as planStopPath, T as renderStatus, Y as readRunLock, ht as resolveHostSession, j as PlanError, jt as runPaneExec, k as runPlan, l as PlanReporter, nt as closePaneForWorker, ot as inVisiblePane, q as planLockPath, rt as closeSelfPane, u as QueueReporter, vt as writePaneTitle, w as renderSchedule, x as planStatus, y as blockedMessage, yt as psTable } from "../controls-CPoeudou.mjs";
-import "../endreason-C577xIQz.mjs";
-import { N as endBuildWait, j as beginBuildWait } from "../render-BYmQkuLd.mjs";
+import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-DUn10MBd.mjs";
+import { A as routerPidFile, B as usageContextTokens, D as routerHandoverFile, E as probeRouter, F as startHandover, I as paneWaiver, L as launchPane, M as routerSwapArgs, P as spawnRouter, R as noTerminalReasons, S as usageJson, T as projectLaunchConfig, b as renderUsage, c as reportOriginWithHost, f as dirtyPaths, g as realRunnerDeps, j as routerRunningPid, k as routerLogFile, l as runMessenger, s as finishDetached, u as startDetached, w as pinNotices, x as transcriptUsage, y as priceTableText } from "../run-BwZKBJZZ.mjs";
+import { C as readRunLog, D as resumeState, E as requestPlanStop, F as runLogPath, I as PlanTracker, M as dirtyConflicts, O as runExitCode, P as loadPlan, S as planStopPath, T as renderStatus, Y as readRunLock, ht as resolveHostSession, j as PlanError, jt as runPaneExec, k as runPlan, l as PlanReporter, nt as closePaneForWorker, ot as inVisiblePane, q as planLockPath, rt as closeSelfPane, u as QueueReporter, vt as writePaneTitle, w as renderSchedule, x as planStatus, y as blockedMessage, yt as psTable } from "../controls-JLm6g0yP.mjs";
+import "../endreason-BC-v05H_.mjs";
+import { N as endBuildWait, j as beginBuildWait } from "../render-C84BqQRC.mjs";
 import "../operator-CyuB3aVw.mjs";
-import "../kill-tree-EWYaEk5v.mjs";
+import "../kill-tree-DleMNZX3.mjs";
 import { s as poolReloadLive } from "../pool-cli-BggU8GRp.mjs";
-import "../chain-7n9Gx56r.mjs";
-import { _ as issueClaims, a as branchDiff, b as workerCommand, c as runQueue, d as loadSettings, f as move, g as issueClaim, h as renderReview, i as projectChecks, l as QueueStore, m as renderList, n as initProject, o as realQueueDeps, p as queueStatePath, r as isGitProject, s as acceptItems, t as formatCheck, u as again, v as issueStale } from "../project-setup-jvfONJTQ.mjs";
-import { m as runInPane, r as closeFinishedPanes } from "../pane-audit-DKQt71s4.mjs";
-import "../viewer-mDXUNHNy.mjs";
-import { g as setWorkersEnabled, s as describeProviders } from "../providers-CblTFrhz.mjs";
-import { $ as exportDefaultLayout, B as mergeSettings, G as cachedRows, J as handleCockpit, K as cachedSessionMap, Q as warmCockpit, W as SystemMonitor, X as setEndpointHealth, Y as setActionHooks, Z as setRuntimeSampler, ct as providersCommand, et as createEndpointHealth, it as withWorkerAttribution, n as WORKER_CONFIG_COMMANDS, nt as loadWorkerWindows, q as cachedWorkerWindows, rt as sessionDisplayName, t as PROVIDER_EDIT_COMMANDS, tt as loadSessionMap, z as installWorkers } from "../worker-config-CJhEMk19.mjs";
-import { a as listConfigOp, i as getConfigValueOp, n as formatConfigGetOutput, o as setConfigValueOp, r as formatConfigSource, s as unsetConfigValueOp, t as MainConfigOpsError } from "../main-config-ops-BEMpuhDz.mjs";
-import { H as acquireRun, U as readRun, V as cockpitProbeSettings, k as readRuntimeCommands } from "../cockpit-actions-BBHeyEZI.mjs";
-import { n as PaiClient } from "../ipc-client-CaiGJnSM.mjs";
-import { a as EMBED_PASS_BATCH_SIZE, c as liveYieldCheck, n as DEFAULT_EMBED_MAX_LOAD, o as formatEmbedStatus, r as DEFAULT_EMBED_MAX_MINUTES, s as lastRecordedEmbedPass } from "../embed-pass-DIWjA68P.mjs";
-import "../fallback-DFlItw1Z.mjs";
-import { At as readQuiet, Bt as appendCheckpointToNote, C as migrateSummaryCooldowns, Et as totalUsageTokens, Gt as restartRouter, Ht as findLatestNote, It as resolveDaemonPid, Nt as writeQuiet, Ot as describeQuiet, Pt as LAUNCHD_LABEL, Rt as readContextHandoverCache, St as loadSessionKeepaliveState, Tt as parseSessionUsage, Ut as findNotesDir$1, Vt as applyContinue, Wt as readBodyFile, bt as reapJob, ht as obsidianEnabled, i as reexecBackground, kt as nextOccurrence, mt as OBSIDIAN_DISABLED_MESSAGE, o as backfillKgFromNotes, s as migrateKgBackfillState, v as migrateWorkQueue, vt as migrateIdentityFile, wt as sessionKeepaliveLedgerSummary, yt as jobPaths } from "../indexer-backend-Cll7le4P.mjs";
-import { n as queriesDirPath, t as migrateQueriesDir } from "../query-feedback-BRfPtqki.mjs";
+import "../chain-D7PFur8Y.mjs";
+import { _ as issueClaims, a as branchDiff, b as workerCommand, c as runQueue, d as loadSettings, f as move, g as issueClaim, h as renderReview, i as projectChecks, l as QueueStore, m as renderList, n as initProject, o as realQueueDeps, p as queueStatePath, r as isGitProject, s as acceptItems, t as formatCheck, u as again, v as issueStale } from "../project-setup-CBRtFFh0.mjs";
+import { m as runInPane, r as closeFinishedPanes } from "../pane-audit-Lqy9N_Ki.mjs";
+import "../viewer-wfKnvnrI.mjs";
+import "../fallback-CBWpp2F2.mjs";
+import { g as setWorkersEnabled, s as describeProviders } from "../providers-C9QC0TtO.mjs";
+import { $ as exportDefaultLayout, B as mergeSettings, G as cachedRows, J as handleCockpit, K as cachedSessionMap, Q as warmCockpit, W as SystemMonitor, X as setEndpointHealth, Y as setActionHooks, Z as setRuntimeSampler, at as withWorkerAttribution, et as loadBuildsConfig, it as sessionDisplayName, lt as providersCommand, n as WORKER_CONFIG_COMMANDS, nt as loadSessionMap, q as cachedWorkerWindows, rt as loadWorkerWindows, t as PROVIDER_EDIT_COMMANDS, tt as createEndpointHealth, z as installWorkers } from "../worker-config-eY5Qy4vl.mjs";
+import { a as listConfigOp, i as getConfigValueOp, n as formatConfigGetOutput, o as setConfigValueOp, r as formatConfigSource, s as unsetConfigValueOp, t as MainConfigOpsError } from "../main-config-ops-kTXR8Pyv.mjs";
+import { H as acquireRun, U as readRun, V as cockpitProbeSettings, k as readRuntimeCommands } from "../cockpit-actions-OodH_vx_.mjs";
+import { n as PaiClient } from "../ipc-client-CnYEF31R.mjs";
+import { a as EMBED_PASS_BATCH_SIZE, c as liveYieldCheck, n as DEFAULT_EMBED_MAX_LOAD, o as formatEmbedStatus, r as DEFAULT_EMBED_MAX_MINUTES, s as lastRecordedEmbedPass } from "../embed-pass-e64AwDCa.mjs";
+import { i as totalUsageTokens, r as parseSessionUsage } from "../session-usage-CPvXvSkw.mjs";
+import { Bt as findLatestNote, C as migrateSummaryCooldowns, Dt as nextOccurrence, Et as describeQuiet, Ht as readBodyFile, It as readContextHandoverCache, Mt as LAUNCHD_LABEL, Ot as readQuiet, Pt as resolveDaemonPid, Rt as appendCheckpointToNote, St as loadSessionKeepaliveState, Ut as restartRouter, Vt as findNotesDir$1, bt as reapJob, ht as obsidianEnabled, i as reexecBackground, jt as writeQuiet, mt as OBSIDIAN_DISABLED_MESSAGE, o as backfillKgFromNotes, s as migrateKgBackfillState, v as migrateWorkQueue, vt as migrateIdentityFile, wt as sessionKeepaliveLedgerSummary, yt as jobPaths, zt as applyContinue } from "../indexer-backend-BdjeL4P8.mjs";
+import { n as queriesDirPath, t as migrateQueriesDir } from "../query-feedback-DN52N9C5.mjs";
 import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, createWriteStream, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import chalk from "chalk";
-import { cpus, homedir, networkInterfaces, platform, userInfo } from "node:os";
+import { cpus, homedir, platform, userInfo } from "node:os";
 import { execFile, execFileSync, execSync, spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import http from "node:http";
@@ -590,77 +590,6 @@ function startStallMonitor(o) {
 	};
 }
 
-//#endregion
-//#region src/router/cockpit-auth.ts
-/** The /v1 remote rule: loopback (any 127/8, ::1, v4-mapped) or the tailnet. */
-function defaultV1Guard(remoteAddress) {
-	return isLoopbackAddress(remoteAddress) || inTailscaleRange(remoteAddress);
-}
-/** Strip the ::ffff: IPv4-mapped prefix (Node reports v4 peers this way on v6 sockets). */
-function normalizeIp(ip) {
-	const a = (ip ?? "").trim().toLowerCase();
-	return a.startsWith("::ffff:") ? a.slice(7) : a;
-}
-function isLoopbackAddress(ip) {
-	const a = normalizeIp(ip);
-	return a === "::1" || a.startsWith("127.");
-}
-function ipv4ToInt(ip) {
-	const parts = ip.split(".");
-	if (parts.length !== 4) return null;
-	let out = 0;
-	for (const p of parts) {
-		if (!/^\d{1,3}$/.test(p)) return null;
-		const n = Number(p);
-		if (n > 255) return null;
-		out = out * 256 + n;
-	}
-	return out;
-}
-function inTailscaleRange(ip) {
-	const n = ipv4ToInt(normalizeIp(ip));
-	if (n === null) return false;
-	return (n & 4290772992) === 1681915904;
-}
-/**
-* router.bind → a concrete address. "loopback" (also empty/unset) is
-* 127.0.0.1; "tailscale" resolves the utun/tailscale interface's IPv4 inside
-* 100.64.0.0/10 (null when Tailscale is down); anything else must be a dotted
-* quad — 0.0.0.0 and every non-IPv4 value are refused (null).
-*/
-function resolveBindAddress(bind, interfaces = networkInterfaces) {
-	const v = (bind ?? "").trim().toLowerCase();
-	if (!v || v === "loopback") return LOOPBACK_HOST;
-	if (v === "tailscale") {
-		let fallback;
-		for (const [name, addrs] of Object.entries(interfaces() ?? {})) for (const a of addrs ?? []) {
-			if (a.family !== "IPv4" && a.family !== 4) continue;
-			if (!inTailscaleRange(a.address)) continue;
-			if (/^(utun|tailscale)/i.test(name)) return a.address;
-			fallback ??= a.address;
-		}
-		return fallback ?? null;
-	}
-	if (v === "0.0.0.0" || v === "::" || v === "*") return null;
-	return ipv4ToInt(v) !== null ? v : null;
-}
-/**
-* The address to show a human for a bind address: the tailnet hostname
-* (MagicDNS name, from `tailscale status --json`) when the address is the
-* machine's own Tailscale IP, else the address itself.
-*/
-async function displayHost(addr) {
-	if (!inTailscaleRange(addr)) return addr;
-	try {
-		const { execFile } = await import("node:child_process");
-		const { promisify } = await import("node:util");
-		const { stdout } = await promisify(execFile)("tailscale", ["status", "--json"], { timeout: TAILSCALE_STATUS_TIMEOUT_MS });
-		const self = JSON.parse(stdout).Self;
-		if (self?.DNSName && self.TailscaleIPs?.includes(addr)) return self.DNSName.replace(/\.$/, "");
-	} catch {}
-	return addr;
-}
-
 //#endregion
 //#region src/router/runtime-samples.ts
 /**
@@ -901,7 +830,7 @@ function routerSamplerDeps(sched, engineStatusTimeoutMs = () => DEFAULT_RUNTIME_
 	});
 	return {
 		inventory: async () => {
-			const { currentInventory } = await import("../model-inventory-BFVSNFT3.mjs");
+			const { currentInventory } = await import("../model-inventory-h6Z9fN_o.mjs");
 			return currentInventory();
 		},
 		sched,
@@ -916,7 +845,7 @@ function routerSamplerDeps(sched, engineStatusTimeoutMs = () => DEFAULT_RUNTIME_
 			}
 		},
 		async rssMb(port) {
-			const { processTreeRssMb } = await import("../model-inventory-BFVSNFT3.mjs");
+			const { processTreeRssMb } = await import("../model-inventory-h6Z9fN_o.mjs");
 			const pid = (await exec("lsof", [
 				"-ti",
 				`tcp:${port}`,
@@ -1231,6 +1160,12 @@ const runCommand = {
 		const addr = resolveBindAddress(bindName);
 		if (!addr) throw new CliError(`cannot resolve router.bind "${bindName}" — use "loopback", "tailscale", or an IPv4 (never 0.0.0.0)`, "pai daemon status");
 		const remote = addr !== LOOPBACK_HOST;
+		const extraHosts = (loadConfig().router.allowedHosts ?? []).filter((h) => h.trim());
+		const hosts = remote ? {
+			bind: addr,
+			extraHosts
+		} : void 0;
+		if (remote && !extraHosts.some((h) => hostAllowed(`${h}:${port}`, addr, extraHosts))) process.stderr.write(`pai: router: router.allowedHosts has no entry matching the bind ${addr} — cockpit requests by hostname will be refused (403)\n`);
 		const rows = cachedRows(usageFile);
 		let schedCache;
 		setSchedConfigSource(() => {
@@ -1279,7 +1214,7 @@ const runCommand = {
 		sampler.start();
 		setRuntimeSampler(sampler);
 		setActionHooks({ runLocalJob: async (kind, tier) => {
-			const { startTier, stopAll } = await import("../worker-config-DESkIjMF.mjs");
+			const { startTier, stopAll } = await import("../worker-config-CO5FXLAT.mjs");
 			const { readLocalConfig } = await import("../local-tiers-DNMI5W86.mjs");
 			const { workersYamlPath } = await import("../workers-config-f8KrkY4L.mjs");
 			const cfg = readLocalConfig(workersYamlPath());
@@ -1295,7 +1230,10 @@ const runCommand = {
 		setEndpointHealth(endpointHealth);
 		const serve = (req, res) => handleCockpit(req, res, limits, rows, sessionMap, system, workerWindows);
 		const inner = routerHandler(void 0, void 0, void 0, usageFile ? () => void 0 : (row) => appendUsage(row), serve, {
-			...remote ? { remoteAllowed: defaultV1Guard } : {},
+			...remote ? {
+				remoteAllowed: defaultV1Guard,
+				hosts
+			} : {},
 			isUp: limits.isUp,
 			health: endpointHealth
 		});
@@ -1657,7 +1595,7 @@ const modelsCommand = {
 		if (words[0] === "add") {
 			const source = words[1];
 			if (!source) throw new Error("usage: pai models add <hf-id|path> [--name n] [--download] [--try]");
-			const { addModel } = await import("../models-add-C1QIc1DA.mjs");
+			const { addModel } = await import("../models-add-TVni3A7V.mjs");
 			const r = await addModel({
 				source,
 				name: typeof ctx.opts.name === "string" ? ctx.opts.name : void 0,
@@ -1672,7 +1610,7 @@ const modelsCommand = {
 		if (op) {
 			const runtime = words[1];
 			if (!runtime) throw new Error(`usage: pai models ${op} <runtime> (configured: ${Object.keys(readRuntimeCommands()).join(", ") || "none"})`);
-			const { defaultDeps, runtimeStartStop } = await import("../cockpit-actions-DR9X514g.mjs");
+			const { defaultDeps, runtimeStartStop } = await import("../cockpit-actions-BfRMr2sm.mjs");
 			const r = await runtimeStartStop(runtime, op, defaultDeps(), { model: typeof ctx.opts.model === "string" ? ctx.opts.model : void 0 });
 			process.stdout.write(r.message + "\n");
 			if (!r.ok) process.exitCode = 1;
@@ -2987,7 +2925,7 @@ async function cmdPause(opts) {
 		process.exitCode = 1;
 		return;
 	}
-	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("../factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	const cwd = process.cwd();
 	const project = await resolveProjectByCwd(registryBackend, cwd);
@@ -3087,7 +3025,7 @@ function touchSentinel(rootPath) {
 async function cmdAutosave(opts) {
 	const minGap = parseInt(opts.minGap ?? String(DEFAULT_MIN_GAP), 10);
 	const cwd = process.cwd();
-	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("../factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	const project = await resolveProjectByCwd(registryBackend, cwd);
 	if (!project) return;
@@ -3313,7 +3251,7 @@ function finalizeNote(notePath) {
 }
 async function cmdEnd(opts) {
 	await cmdPause(opts);
-	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("../factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	const cwd = process.cwd();
 	const project = await registryBackend.findProjectByCwdPrefix(cwd);
@@ -3494,7 +3432,7 @@ function buildStopBody(project, sessionId) {
 	}
 }
 async function cmdHandover(projectSlug, numberOrLatest, sessionId) {
-	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("../factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	let project;
 	if (projectSlug) {
@@ -4441,7 +4379,7 @@ async function countVectorDbPaths(oldPaths) {
 	if (oldPaths.length === 0) return 0;
 	try {
 		const { loadConfig } = await import("../config-DtENJ6cL.mjs");
-		const { createStorageBackend } = await import("../factory-Bsib-qDG.mjs");
+		const { createStorageBackend } = await import("../factory-Bs9imVMq.mjs");
 		const config = loadConfig();
 		if (config.storageBackend !== "postgres") return 0;
 		const backend = await createStorageBackend(config);
@@ -4459,7 +4397,7 @@ async function updateVectorDbPaths(moves) {
 	if (moves.length === 0) return 0;
 	try {
 		const { loadConfig } = await import("../config-DtENJ6cL.mjs");
-		const { createStorageBackend } = await import("../factory-Bsib-qDG.mjs");
+		const { createStorageBackend } = await import("../factory-Bs9imVMq.mjs");
 		const config = loadConfig();
 		if (config.storageBackend !== "postgres") return 0;
 		const backend = await createStorageBackend(config);
@@ -4546,7 +4484,7 @@ async function displayDryRun(plans) {
 	console.log();
 }
 async function executeCleanup(plans, skipReindex) {
-	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("../factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	let deleted = 0;
 	let renamed = 0;
@@ -4746,7 +4684,7 @@ async function executeCleanup(plans, skipReindex) {
 * them into YYYY/MM/ folders and renumber. Dry run unless `execute` is set.
 */
 async function runCleanup(projectSlug, opts) {
-	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("../factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	const dryRun = !opts.execute;
 	const skipReindex = opts.reindex === false;
@@ -9029,7 +8967,7 @@ function cmdLogs(opts) {
 	return 0;
 }
 async function daemonServeCmd() {
-	const { serve } = await import("../daemon-DKdBNKfa.mjs");
+	const { serve } = await import("../daemon-DeYImF1F.mjs");
 	const { loadConfig: lc, ensureConfigDir } = await import("../config-DtENJ6cL.mjs");
 	ensureConfigDir();
 	await serve(lc());
@@ -11201,54 +11139,6 @@ async function watchTicket(dir, id, deps = {}, intervalMs = 1e3, simctl, reap) {
 	}
 }
 
-//#endregion
-//#region src/hooks/ts/lib/build-gate.ts
-/** Tiny reader for the two keys of builds.yaml: flow `[a, b]` or block `- a` lists. */
-function parseBuildsYaml(text) {
-	const res = {
-		doors: [],
-		patterns: []
-	};
-	let key = null;
-	const unq = (s) => s.trim().replace(/^(['"])(.*)\1$/, "$2");
-	for (const raw of text.split("\n")) {
-		const line = raw.replace(/(^|\s)#.*$/, "");
-		if (!line.trim()) continue;
-		const m = /^(doors|patterns)\s*:\s*(.*)$/.exec(line);
-		if (m) {
-			key = m[1];
-			const rest = m[2].trim();
-			if (rest.startsWith("[")) {
-				res[key].push(...rest.replace(/^\[|\]$/g, "").split(",").map(unq).filter(Boolean));
-				key = null;
-			}
-			continue;
-		}
-		const li = /^\s*-\s+(.*)$/.exec(line);
-		if (li && key) res[key].push(unq(li[1]));
-		else if (!/^\s/.test(line)) key = null;
-	}
-	return res;
-}
-/** The nearest `.pai/builds.yaml` at or above `cwd`. */
-function loadBuildsConfig(cwd) {
-	let dir = resolve(cwd);
-	for (;;) {
-		const f = join(dir, ".pai", "builds.yaml");
-		if (existsSync(f)) try {
-			return {
-				root: dir,
-				...parseBuildsYaml(readFileSync(f, "utf8"))
-			};
-		} catch {
-			return null;
-		}
-		const up = dirname(dir);
-		if (up === dir) return null;
-		dir = up;
-	}
-}
-
 //#endregion
 //#region src/builds/doctor.ts
 /**
@@ -15034,7 +14924,7 @@ async function migrateToPostgres(opts = {}) {
 		const dump = pgDump(container, pgConfig, dumpPath);
 		if (!dump.ok) return refused(dump.reason, dryRun);
 	}
-	const { PostgresBackend } = await import("../postgres-BdBNkL_l.mjs");
+	const { PostgresBackend } = await import("../postgres-BK4FP9Zg.mjs");
 	await PostgresBackend.ensureDatabase(pgConfig);
 	const sqlite = new BetterSqlite3(sqliteFederationPath, { readonly: true });
 	const registrySqlite = sqliteRegistryPath === sqliteFederationPath ? sqlite : new BetterSqlite3(sqliteRegistryPath, { readonly: true });
@@ -16421,7 +16311,7 @@ const out = (s) => process.stdout.write(s + "\n");
 async function repoOf(project) {
 	if (typeof project === "string" && project) {
 		if (existsSync(project)) return resolve(project);
-		const { getProject } = await import("../helpers-CMGjy_0N.mjs");
+		const { getProject } = await import("../helpers-Dz7mjTSw.mjs");
 		const row = await getProject(project);
 		if (!row) throw new CliError(`no project ${project}`, "pai projects list");
 		return row.root_path;
@@ -17244,7 +17134,7 @@ async function cmdPromote(opts) {
 		console.error(dim$1(`  Pick a durable location for the new project.`));
 		process.exit(1);
 	}
-	const { getRegistryBackend } = await import("../factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("../factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	const encodedDir = encodeDir(targetPath);
 	if (await registryBackend.getProjectBySlug(slug) ?? await registryBackend.getProjectByRootPath(targetPath) ?? await registryBackend.getProjectByEncodedDir(encodedDir)) {
@@ -18488,7 +18378,7 @@ async function cmdUnregister(slug, opts = {}) {
 * deprecated alias that forwards here with a stderr notice.
 */
 async function projectListCmd(opts) {
-	const { cmdMain } = await import("../main-resolver-3Ns1HPmS.mjs");
+	const { cmdMain } = await import("../main-resolver-yp_puSSb.mjs");
 	await cmdMain(void 0, void 0, opts);
 	return 0;
 }
@@ -22163,9 +22053,9 @@ async function memorySearchCmd(query, opts) {
 //#region src/cli/commands/memory/sources-cmd.ts
 /** `pai memory sources` — what the indexer has taken in. */
 async function memorySourcesCmd(opts) {
-	const { createStorageBackend } = await import("../factory-Bsib-qDG.mjs");
+	const { createStorageBackend } = await import("../factory-Bs9imVMq.mjs");
 	const { loadConfig } = await import("../config-DtENJ6cL.mjs");
-	const { cmdMemorySources } = await import("../sources-ESUkZaWv.mjs");
+	const { cmdMemorySources } = await import("../sources-CiE3rZek.mjs");
 	let backend;
 	try {
 		backend = await createStorageBackend(loadConfig());
@@ -22924,7 +22814,7 @@ async function zettelExploreCmd(note, opts) {
 	const depth = opts.depth ?? 3;
 	const direction = opts.direction ?? "both";
 	const mode = opts.mode ?? "all";
-	const { zettelExplore } = await import("../zettelkasten-B_rRRRvD.mjs");
+	const { zettelExplore } = await import("../zettelkasten-tpCRBYvH.mjs");
 	const result = await zettelExplore(await getFedBackend(), {
 		startNote: note,
 		depth,
@@ -22980,7 +22870,7 @@ async function zettelHealthCmd(opts) {
 	const projectPath = opts.project;
 	const recentDays = opts.days ?? 30;
 	const includeTypes = opts.include ? opts.include.split(",").map((s) => s.trim()) : void 0;
-	const { zettelHealth } = await import("../zettelkasten-B_rRRRvD.mjs");
+	const { zettelHealth } = await import("../zettelkasten-tpCRBYvH.mjs");
 	const result = await zettelHealth(await getFedBackend(), {
 		scope,
 		projectPath,
@@ -23038,7 +22928,7 @@ async function zettelSurpriseCmd(note, opts) {
 	const limit = opts.limit ?? 10;
 	const minSimilarity = opts.minSimilarity ?? .3;
 	const minGraphDistance = opts.minDistance ?? 3;
-	const { zettelSurprise } = await import("../zettelkasten-B_rRRRvD.mjs");
+	const { zettelSurprise } = await import("../zettelkasten-tpCRBYvH.mjs");
 	const backend = await getFedBackend();
 	console.log();
 	console.log(header("  PAI Zettel Surprise"));
@@ -23080,7 +22970,7 @@ async function zettelConverseCmd(question, opts) {
 	const vaultProjectId = Number(opts.vaultProjectId);
 	const depth = opts.depth ?? 2;
 	const limit = opts.limit ?? 15;
-	const { zettelConverse } = await import("../zettelkasten-B_rRRRvD.mjs");
+	const { zettelConverse } = await import("../zettelkasten-tpCRBYvH.mjs");
 	const backend = await getFedBackend();
 	console.log();
 	console.log(header("  PAI Zettel Converse"));
@@ -23130,7 +23020,7 @@ async function zettelThemesCmd(opts) {
 	const minClusterSize = opts.minSize ?? 3;
 	const maxThemes = opts.maxThemes ?? 10;
 	const similarityThreshold = opts.threshold ?? .65;
-	const { zettelThemes } = await import("../zettelkasten-B_rRRRvD.mjs");
+	const { zettelThemes } = await import("../zettelkasten-tpCRBYvH.mjs");
 	const backend = await getFedBackend();
 	console.log();
 	console.log(header("  PAI Zettel Themes"));
@@ -23178,7 +23068,7 @@ async function zettelSuggestCmd(note, opts) {
 	const vaultProjectId = Number(opts.vaultProjectId);
 	const limit = opts.limit ?? 5;
 	const excludeLinked = opts.excludeLinked !== true;
-	const { zettelSuggest } = await import("../zettelkasten-B_rRRRvD.mjs");
+	const { zettelSuggest } = await import("../zettelkasten-tpCRBYvH.mjs");
 	const backend = await getFedBackend();
 	console.log();
 	console.log(header("  PAI Zettel Suggest"));

package/dist/{cockpit-actions-DR9X514g.mjs → cockpit-actions-BfRMr2sm.mjs}

@@ -3,7 +3,7 @@ import "./config-Bu1_vbY8.mjs";
 import "./paths-CHifubDh.mjs";
 import "./status-ggJ7lgVg.mjs";
 import "./scope-D-h6F6DN.mjs";
-import "./routing-BAAST9vT.mjs";
+import "./routing-DmkheCRH.mjs";
 import "./tool-errors-7E13StWd.mjs";
 import "./wait-ByV0OyMZ.mjs";
 import "./local-tiers-BE4jGaMa.mjs";
@@ -11,10 +11,10 @@ import "./caller-identity-yLFb7CKq.mjs";
 import "./capacity-DEveQdFV.mjs";
 import "./local-instances-DOxSgT_L.mjs";
 import "./local-candidate-DLdwQt0s.mjs";
-import "./providers-CblTFrhz.mjs";
-import "./main-config-ops-BEMpuhDz.mjs";
-import { C as runtimeOpRefusal, D as writeLedgerLine, E as tierNames, S as runtimeJobProgress, T as spawnMemoryRun, _ as resolveTierName, a as classesOnProvider, b as runningRuntimeJob, c as defaultDeps, d as labelPath, f as logTailSince, g as readLabels, h as readCockpitJob, i as WORKER_ROLE_CLASSES, l as engineInflight, m as orchestratorProvider, n as RUNTIME_START_EVENT, o as cockpitActionLedger, p as memoryRunRefusal, r as RUNTIME_STOP_EVENT, s as cockpitJobFile, t as COCKPIT_ACTION_EVENT, u as labelFor, v as runCockpitAction, w as runtimeStartStop, x as runningRuntimeJobs, y as runningLocalModel } from "./cockpit-actions-BBHeyEZI.mjs";
-import "./ipc-client-CaiGJnSM.mjs";
-import "./embed-pass-DIWjA68P.mjs";
+import "./providers-C9QC0TtO.mjs";
+import "./main-config-ops-kTXR8Pyv.mjs";
+import { C as runtimeOpRefusal, D as writeLedgerLine, E as tierNames, S as runtimeJobProgress, T as spawnMemoryRun, _ as resolveTierName, a as classesOnProvider, b as runningRuntimeJob, c as defaultDeps, d as labelPath, f as logTailSince, g as readLabels, h as readCockpitJob, i as WORKER_ROLE_CLASSES, l as engineInflight, m as orchestratorProvider, n as RUNTIME_START_EVENT, o as cockpitActionLedger, p as memoryRunRefusal, r as RUNTIME_STOP_EVENT, s as cockpitJobFile, t as COCKPIT_ACTION_EVENT, u as labelFor, v as runCockpitAction, w as runtimeStartStop, x as runningRuntimeJobs, y as runningLocalModel } from "./cockpit-actions-OodH_vx_.mjs";
+import "./ipc-client-CnYEF31R.mjs";
+import "./embed-pass-e64AwDCa.mjs";
 
 export { COCKPIT_ACTION_EVENT, RUNTIME_START_EVENT, RUNTIME_STOP_EVENT, WORKER_ROLE_CLASSES, classesOnProvider, cockpitActionLedger, cockpitJobFile, defaultDeps, engineInflight, labelFor, labelPath, logTailSince, memoryRunRefusal, orchestratorProvider, readCockpitJob, readLabels, resolveTierName, runCockpitAction, runningLocalModel, runningRuntimeJob, runningRuntimeJobs, runtimeJobProgress, runtimeOpRefusal, runtimeStartStop, spawnMemoryRun, tierNames, writeLedgerLine };