@tekmidian/pai 1.0.3 → 1.0.4

package/dist/{fallback-DFlItw1Z.mjs → fallback-CBWpp2F2.mjs}

@@ -2,11 +2,233 @@ import { l as claudeHomeDir, t as aibrokerHomeDir } from "./runtime-paths-WsO9sJ
 import { F as writeWorkersSection, N as resolveModelCapability, P as resolveProviderKey, c as WorkersConfigError, j as readWorkersSection } from "./config-XpZWOYOG.mjs";
 import { D as readJsonStrict, O as writeJsonAtomic } from "./config-Bu1_vbY8.mjs";
 import { u as workersLogDir } from "./paths-CHifubDh.mjs";
-import { _ as resolveTarget } from "./routing-BAAST9vT.mjs";
+import { _ as resolveTarget } from "./routing-DmkheCRH.mjs";
+import { yt as psTable } from "./controls-JLm6g0yP.mjs";
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { execFileSync } from "node:child_process";
+import { isAbsolute, join, relative } from "node:path";
+import { execFileSync, spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
 
+//#region src/workers/hang-probe.ts
+/**
+* hang-probe.ts — `pai worker test-run -- <command>`: runs a test command and, when it goes silent,
+* tells the model WHERE it is stuck.
+*
+* A synchronous infinite loop blocks Node's event loop, so the test runner cannot even report its own
+* timeout and the model sees nothing. Node's `--report-on-signal` does not help: it is serviced by the
+* event loop (measured: a `while(true){}` process never writes the report). The child therefore runs with a
+* preloaded watchdog (NODE_OPTIONS --require): a worker thread per process that, when a trigger file appears,
+* attaches the inspector to the main thread, pauses it (V8 interrupts a running loop) and writes the call
+* frames. After the command was silent for the idle threshold the wrapper triggers every node process under
+* it and maps the frames to the worktree's files. The worker guard rewrites test commands into this wrapper
+* (see wrapTestCommand).
+*/
+/** Marker line every diagnosis carries; the loop guard keys on it. */
+const HANG_MARKER = "[pai hang probe]";
+const DEFAULT_IDLE_SECS = 60;
+/** Seconds of the first `timeout N` in the command, else null. */
+function timeoutSecs(command) {
+	const m = /\b(?:g?timeout)\s+(?:-[ks]\s+\S+\s+|-\S+\s+)*(\d+(?:\.\d+)?)([smhd]?)\b/.exec(command);
+	if (!m) return null;
+	return Number(m[1]) * {
+		"": 1,
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2]];
+}
+function killQuiet(pid, sig) {
+	try {
+		process.kill(pid, sig);
+	} catch {}
+}
+function rmQuiet(f) {
+	try {
+		unlinkSync(f);
+	} catch {}
+}
+const shq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+/** The command line test-run executes: the decoded --cmd-b64 payload, else the words after `--`, each shell-quoted. */
+function commandToRun(cmdB64, words) {
+	if (cmdB64) return Buffer.from(cmdB64, "base64").toString("utf8");
+	return words.map(shq).join(" ");
+}
+/** Call frames of one probed process, user code only, files relative to cwd. */
+function userFrames(frames, cwd) {
+	const out = [];
+	for (const f of frames) {
+		let file = f.url;
+		if (file.startsWith("file://")) try {
+			file = fileURLToPath(file);
+		} catch {
+			continue;
+		}
+		if (!file || file.startsWith("node:") || file.includes("node_modules") || !isAbsolute(file)) continue;
+		const rel = relative(cwd, file);
+		if (rel.startsWith("..")) continue;
+		out.push({
+			fn: f.functionName || "(anonymous)",
+			file: rel,
+			line: f.lineNumber + 1
+		});
+	}
+	return out;
+}
+/** The model-facing diagnosis for the reports taken after `idleSecs` of silence. */
+function diagnose(probed, cwd, idleSecs) {
+	const stuck = probed.map((r) => userFrames(r, cwd)).find((f) => f.length > 0);
+	if (stuck) {
+		const [top, ...rest] = stuck;
+		const via = rest[0] ? ` (called from ${rest[0].file}:${rest[0].line} ${rest[0].fn}())` : "";
+		return `${HANG_MARKER} test run hung with no output for ${idleSecs} s; the main thread is stuck in ${top.file}:${top.line} ${top.fn}()${via}. A synchronous loop that never ends blocks the runner's own timeout. Fix that loop; rerunning unchanged will hang again.\n` + stuck.slice(0, 6).map((f) => `  at ${f.fn} (${f.file}:${f.line})`).join("\n");
+	}
+	return `${HANG_MARKER} test run printed nothing for ${idleSecs} s and the main thread is idle in the event loop: it is waiting (async), not spinning. A test awaits a promise, timer, process or socket that never completes (vitest's own per-test timeout ends it unless the test raised it). Find the await and give it an end; rerunning unchanged will wait again.`;
+}
+function listProcs() {
+	try {
+		return psTable("pid=,ppid=,command=").split("\n").flatMap((l) => {
+			const m = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(l);
+			return m ? [{
+				pid: Number(m[1]),
+				ppid: Number(m[2]),
+				cmd: m[3]
+			}] : [];
+		});
+	} catch {
+		return [];
+	}
+}
+/** Pids of node processes below `root`. */
+function nodeDescendants(root, procs = listProcs()) {
+	const seen = new Set([root]);
+	for (let grew = true; grew;) {
+		grew = false;
+		for (const p of procs) if (!seen.has(p.pid) && seen.has(p.ppid)) seen.add(p.pid), grew = true;
+	}
+	return procs.filter((p) => p.pid !== root && seen.has(p.pid) && /(?:^|\/)node(?:\s|$)/.test(p.cmd)).map((p) => p.pid);
+}
+/** Runs the command, passes its output through, probes once when it goes silent. Resolves to the exit code. */
+async function runProbed(o) {
+	const out = o.out ?? ((s) => process.stdout.write(s));
+	const err = o.err ?? ((s) => process.stderr.write(s));
+	mkdirSync(o.reportDir, { recursive: true });
+	const t = timeoutSecs(o.command);
+	const idle = Math.max(2, Math.min(o.idleSecs ?? DEFAULT_IDLE_SECS, t !== null ? t - 8 : Infinity));
+	const preload = join(o.reportDir, "preload.cjs");
+	writeFileSync(preload, PRELOAD_SOURCE);
+	const env = {
+		...process.env,
+		PAI_HANG_PROBE_DIR: o.reportDir,
+		NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ""} --require=${preload}`.trim()
+	};
+	const child = spawn("bash", ["-c", o.command], {
+		cwd: o.cwd,
+		env,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	let last = Date.now();
+	let probing = false;
+	let announcedIdle = false;
+	let spun = false;
+	let pending = Promise.resolve();
+	child.stdout.on("data", (d) => (last = Date.now(), out(d.toString())));
+	child.stderr.on("data", (d) => (last = Date.now(), err(d.toString())));
+	const timer = setInterval(() => {
+		if (probing || spun || Date.now() - last < idle * 1e3 || !child.pid) return;
+		probing = true;
+		const pids = nodeDescendants(child.pid);
+		for (const p of pids) writeFileSync(join(o.reportDir, `probe-${p}`), "");
+		pending = collectFrames(o.reportDir, pids, 3e3).then((frames) => {
+			for (const p of pids) rmQuiet(join(o.reportDir, `probe-${p}`));
+			const stuck = frames.some((f) => userFrames(f, o.cwd).length > 0);
+			if (stuck || !announcedIdle) err(`\n${diagnose(frames, o.cwd, idle)}\n`);
+			announcedIdle = true;
+			probing = false;
+			if (stuck) {
+				spun = true;
+				for (const p of [...pids, child.pid]) killQuiet(p, "SIGTERM");
+				setTimeout(() => pids.forEach((p) => killQuiet(p, "SIGKILL")), 2e3).unref();
+			}
+		});
+	}, 1e3);
+	return await new Promise((resolve) => {
+		child.on("close", (code, sig) => {
+			clearInterval(timer);
+			pending.then(() => resolve(spun ? 124 : code ?? (sig ? 128 + (sig === "SIGKILL" ? 9 : 15) : 1)));
+		});
+	});
+}
+/** Frames each probed pid reported (empty list: its main thread was idle); pids that never answered are left out. */
+async function collectFrames(dir, pids, waitMs) {
+	const got = /* @__PURE__ */ new Map();
+	for (const end = Date.now() + waitMs; Date.now() < end && got.size < pids.length;) {
+		for (const p of pids) {
+			const f = join(dir, `frames-${p}.json`);
+			if (got.has(p) || !existsSync(f)) continue;
+			try {
+				got.set(p, JSON.parse(readFileSync(f, "utf8")).frames);
+				unlinkSync(f);
+			} catch {}
+		}
+		await new Promise((r) => setTimeout(r, 100));
+	}
+	return [...got.values()];
+}
+/** Preloaded into every node process of the test run (CommonJS, so it also loads under --require). */
+const PRELOAD_SOURCE = `"use strict";
+const { Worker, isMainThread } = require("node:worker_threads");
+if (isMainThread) {
+  const code = \`
+    const { existsSync, unlinkSync, writeFileSync, renameSync } = require("node:fs");
+    const { Session } = require("node:inspector");
+    const { workerData } = require("node:worker_threads");
+    const trigger = workerData.dir + "/probe-" + workerData.pid;
+    const done = (frames) => {
+      const tmp = workerData.dir + "/tmp-" + workerData.pid;
+      writeFileSync(tmp, JSON.stringify({ frames }));
+      renameSync(tmp, workerData.dir + "/frames-" + workerData.pid + ".json");
+    };
+    setInterval(() => {
+      if (!existsSync(trigger)) return;
+      try { unlinkSync(trigger); } catch {}
+      const s = new Session();
+      s.connectToMainThread();
+      let answered = false;
+      const urls = {}, maps = {};
+      s.on("Debugger.scriptParsed", (m) => { urls[m.params.scriptId] = m.params.url; maps[m.params.scriptId] = m.params.sourceMapURL; });
+      // transformed code (vite-node, tsx) has shifted lines: map back through its inline source map
+      const where = (f) => {
+        const id = f.location.scriptId;
+        let url = urls[id] || f.url, line = f.location.lineNumber;
+        const m = /^data:[^,]*;base64,(.*)$/.exec(maps[id] || "");
+        if (m) try {
+          const e = new (require("node:module").SourceMap)(JSON.parse(Buffer.from(m[1], "base64").toString())).findEntry(line, f.location.columnNumber || 0);
+          if (e && e.originalSource) { url = new URL(e.originalSource, url).href; line = e.originalLine; }
+        } catch {}
+        return { functionName: f.functionName, url, lineNumber: line };
+      };
+      s.on("Debugger.paused", (m) => {
+        answered = true;
+        done(m.params.callFrames.map(where));
+        s.post("Debugger.resume", () => s.post("Debugger.disable", () => s.disconnect()));
+      });
+      s.post("Debugger.enable", () => s.post("Debugger.pause"));
+      // an idle event loop runs no JS to pause in
+      setTimeout(() => { if (!answered) { done([]); s.post("Debugger.disable", () => s.disconnect()); } }, 800);
+    }, 200);
+  \`;
+  try {
+    new Worker(code, { eval: true, workerData: { dir: process.env.PAI_HANG_PROBE_DIR, pid: process.pid } }).unref();
+  } catch {}
+}
+`;
+
+//#endregion
 //#region src/workers/fallback.ts
 /**
 * fallback.ts — machine-wide Claude Code fallback to a worker provider.
@@ -271,5 +493,5 @@ function fallbackStatusText(s) {
 }
 
 //#endregion
-export { fallbackStatusText as i, fallbackOn as n, fallbackStatus as r, fallbackOff as t };
-//# sourceMappingURL=fallback-DFlItw1Z.mjs.map
+export { DEFAULT_IDLE_SECS as a, fallbackStatusText as i, fallbackOn as n, commandToRun as o, fallbackStatus as r, runProbed as s, fallbackOff as t };
+//# sourceMappingURL=fallback-CBWpp2F2.mjs.map

package/dist/{health-Dnym-qcT.mjs → health-C4FQmkJn.mjs}

@@ -1,6 +1,6 @@
 import { g as paiHomePath } from "./runtime-paths-WsO9sJFc.mjs";
 import { t as ANTHROPIC_NATIVE } from "./config-XpZWOYOG.mjs";
-import { A as budgetSkipReason, D as budgetExceeded, E as budgetCache, M as budgetWall } from "./routing-BAAST9vT.mjs";
+import { A as budgetSkipReason, D as budgetExceeded, E as budgetCache, M as budgetWall } from "./routing-DmkheCRH.mjs";
 import { n as tierProviderNames, t as isLocalCandidate } from "./local-candidate-DLdwQt0s.mjs";
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { Chalk } from "chalk";
@@ -311,4 +311,4 @@ function saveBudgetSnapshot(map, now = Date.now()) {
 
 //#endregion
 export { colorEnabled as a, renderCommandHelp as c, renderOverview as d, renderTable as f, saveBudgetSnapshot as i, renderMarkdown as l, usageLine as m, readBudget as n, makeStyle as o, suggest as p, readBudgetSnapshot as r, mdCommand as s, providerHealth as t, renderMore as u };
-//# sourceMappingURL=health-Dnym-qcT.mjs.map
+//# sourceMappingURL=health-C4FQmkJn.mjs.map

package/dist/{helpers-BD6V-p9w.mjs → helpers-DSNK_1KP.mjs}

@@ -1,4 +1,4 @@
-import { i as getRegistryBackend } from "./factory-DjAAsqr_.mjs";
+import { i as getRegistryBackend } from "./factory-B7nv75rC.mjs";
 
 //#region src/cli/impl/project/helpers.ts
 /**
@@ -66,4 +66,4 @@ async function upsertTag(tagName) {
 
 //#endregion
 export { getSessionCount as a, upsertTag as c, getProjectTags as i, getProject as n, requireProject as o, getProjectAliases as r, resolveIdentifier as s, getLastSessionDate as t };
-//# sourceMappingURL=helpers-BD6V-p9w.mjs.map
+//# sourceMappingURL=helpers-DSNK_1KP.mjs.map

package/dist/{helpers-CMGjy_0N.mjs → helpers-Dz7mjTSw.mjs}

@@ -1,10 +1,10 @@
 import "./config-Bu1_vbY8.mjs";
 import "./helpers-CRuBUas3.mjs";
-import "./factory-DjAAsqr_.mjs";
-import "./postgres-C6ti4haA.mjs";
+import "./factory-B7nv75rC.mjs";
+import "./postgres-DNIOQijl.mjs";
 import "./embedding-gate-6rZrWRXa.mjs";
 import "./embeddings-BVq3esBF.mjs";
 import "./router-CQSc3lk3.mjs";
-import { a as getSessionCount, c as upsertTag, i as getProjectTags, n as getProject, o as requireProject, r as getProjectAliases, s as resolveIdentifier, t as getLastSessionDate } from "./helpers-BD6V-p9w.mjs";
+import { a as getSessionCount, c as upsertTag, i as getProjectTags, n as getProject, o as requireProject, r as getProjectAliases, s as resolveIdentifier, t as getLastSessionDate } from "./helpers-DSNK_1KP.mjs";
 
 export { getProject };

package/dist/hooks/capture-all-events.mjs

@@ -7738,8 +7738,18 @@ function maskSecrets(text) {
   return text.split("\n").map((l) => SECRET_LINE.test(l) ? MASKED_LINE : l).join("\n");
 }
 
+// src/utils/hash.ts
+import { createHash } from "node:crypto";
+function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
 // src/hooks/ts/lib/raw-capture.ts
 var RAW_CAPTURE_MAX_BYTES = 10 * 1024 * 1024;
+function captureEventId(parts) {
+  const joined = `${parts.sessionId ?? ""}|${parts.toolUseId ?? ""}|${parts.event ?? ""}|${parts.ts ?? ""}`;
+  return sha256(joined).slice(0, 16);
+}
 function redactDeep(value) {
   if (typeof value === "string") return maskSecrets(value);
   if (Array.isArray(value)) return value.map(redactDeep);
@@ -7855,13 +7865,22 @@ async function main() {
         setAgentForSession(sessionId, agentName);
       }
     }
+    const timestamp = Date.now();
     let event = {
       source_app: agentName,
       session_id: hookData.session_id || "main",
       hook_event_type: eventType,
       payload: redactDeep(hookData),
-      timestamp: Date.now(),
-      timestamp_local: getLocalTimestamp()
+      timestamp,
+      timestamp_local: getLocalTimestamp(),
+      source: "hook",
+      fidelity: "observed",
+      eventId: captureEventId({
+        sessionId: hookData.session_id,
+        toolUseId: hookData.tool_use_id,
+        event: eventType,
+        ts: String(timestamp)
+      })
     };
     if (isAgentSpawningCall(hookData.tool_name, hookData.tool_input)) {
       event = enrichEventWithAgentMetadata(

package/dist/hooks/capture-tool-output.mjs

@@ -155,8 +155,18 @@ function maskSecrets(text) {
   return text.split("\n").map((l) => SECRET_LINE.test(l) ? MASKED_LINE : l).join("\n");
 }
 
+// src/utils/hash.ts
+import { createHash } from "node:crypto";
+function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
 // src/hooks/ts/lib/raw-capture.ts
 var RAW_CAPTURE_MAX_BYTES = 10 * 1024 * 1024;
+function captureEventId(parts) {
+  const joined = `${parts.sessionId ?? ""}|${parts.toolUseId ?? ""}|${parts.event ?? ""}|${parts.ts ?? ""}`;
+  return sha256(joined).slice(0, 16);
+}
 function redactDeep(value) {
   if (typeof value === "string") return maskSecrets(value);
   if (Array.isArray(value)) return value.map(redactDeep);
@@ -202,12 +212,21 @@ async function main() {
     const yearMonth = today.substring(0, 7);
     const dateDir = join3(CAPTURE_DIR, yearMonth);
     const captureFile = join3(dateDir, `${today}_tool-outputs.jsonl`);
+    const timestamp = data.timestamp || now.toISOString();
     const captureEntry = JSON.stringify({
-      timestamp: data.timestamp || now.toISOString(),
+      timestamp,
       tool: data.tool_name,
       input: redactDeep(data.tool_input),
       output: redactDeep(data.tool_response),
-      session: data.session_id
+      session: data.session_id,
+      source: "hook",
+      fidelity: "observed",
+      eventId: captureEventId({
+        sessionId: data.session_id,
+        toolUseId: data.tool_use_id,
+        event: "PostToolUse",
+        ts: timestamp
+      })
     }) + "\n";
     appendRawCapture(captureFile, dateDir, captureEntry);
     process.exit(0);

package/dist/hooks/worker-pool-host.mjs

@@ -20935,6 +20935,17 @@ var init_kg_triples = __esm({
 async function ensureObservationTables(pool) {
   if (_tablesEnsured) return;
   await pool.query(SCHEMA_SQL);
+  const colCheck = await pool.query(
+    `SELECT column_name FROM information_schema.columns
+     WHERE table_name = 'pai_observations' AND column_name IN ('source', 'fidelity')`
+  );
+  const existing = new Set(colCheck.rows.map((r) => r.column_name));
+  if (!existing.has("source")) {
+    await pool.query("ALTER TABLE pai_observations ADD COLUMN IF NOT EXISTS source TEXT");
+  }
+  if (!existing.has("fidelity")) {
+    await pool.query("ALTER TABLE pai_observations ADD COLUMN IF NOT EXISTS fidelity TEXT");
+  }
   _tablesEnsured = true;
 }
 async function ensureSkillTelemetryTable(pool) {
@@ -20962,8 +20973,9 @@ async function storeObservation(pool, obs) {
   const result = await pool.query(
     `INSERT INTO pai_observations
        (session_id, project_id, project_slug, type, title, narrative,
-        tool_name, tool_input_summary, files_read, files_modified, concepts, content_hash)
-     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::jsonb, $10::jsonb, $11::jsonb, $12)
+        tool_name, tool_input_summary, files_read, files_modified, concepts, content_hash,
+        source, fidelity)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::jsonb, $10::jsonb, $11::jsonb, $12, $13, $14)
      RETURNING id`,
     [
       obs.session_id,
@@ -20977,7 +20989,9 @@ async function storeObservation(pool, obs) {
       JSON.stringify(obs.files_read),
       JSON.stringify(obs.files_modified),
       JSON.stringify(obs.concepts),
-      hash
+      hash,
+      obs.source ?? null,
+      obs.fidelity ?? null
     ]
   );
   return result.rows[0]?.id ?? null;
@@ -21019,7 +21033,7 @@ async function queryObservations(pool, opts = {}) {
     `SELECT id, session_id, project_id, project_slug, type, title, narrative,
             tool_name, tool_input_summary,
             files_read, files_modified, concepts,
-            content_hash, created_at
+            content_hash, source, fidelity, created_at
      FROM pai_observations
      ${where}
      ORDER BY created_at DESC
@@ -21034,7 +21048,7 @@ async function queryRecentObservations(pool, projectId, limit) {
     `SELECT id, session_id, project_id, project_slug, type, title, narrative,
             tool_name, tool_input_summary,
             files_read, files_modified, concepts,
-            content_hash, created_at
+            content_hash, source, fidelity, created_at
      FROM pai_observations
      WHERE project_id = $1
      ORDER BY created_at DESC
@@ -21049,7 +21063,7 @@ async function querySessionObservations(pool, sessionId) {
     `SELECT id, session_id, project_id, project_slug, type, title, narrative,
             tool_name, tool_input_summary,
             files_read, files_modified, concepts,
-            content_hash, created_at
+            content_hash, source, fidelity, created_at
      FROM pai_observations
      WHERE session_id = $1
      ORDER BY created_at ASC`,
@@ -21219,6 +21233,8 @@ CREATE TABLE IF NOT EXISTS pai_observations (
   files_modified JSONB DEFAULT '[]'::jsonb,
   concepts JSONB DEFAULT '[]'::jsonb,
   content_hash TEXT,
+  source TEXT,
+  fidelity TEXT,
   created_at TIMESTAMPTZ DEFAULT NOW()
 );
 
@@ -27711,6 +27727,16 @@ var init_route_table = __esm({
   }
 });
 
+// src/router/cockpit-auth.ts
+var init_cockpit_auth = __esm({
+  "src/router/cockpit-auth.ts"() {
+    "use strict";
+    init_pai_home();
+    init_loopback();
+    init_timeouts();
+  }
+});
+
 // src/router/router.ts
 var routerPort;
 var init_router2 = __esm({
@@ -27730,6 +27756,7 @@ var init_router2 = __esm({
     init_local_instances();
     init_route_table();
     init_loopback_guard();
+    init_cockpit_auth();
     routerPort = () => loadConfig().router.port;
   }
 });
@@ -28014,6 +28041,13 @@ function requestKill(logDir2, ledger, id, by = callerDescription(), forced = fal
   writeFileAtomic(killMarkerPath(logDir2, id), JSON.stringify(req));
   appendLedger(ledger, "WORKER-KILL", { id, by, pid: req.pid, ppid: req.ppid, cwd: req.cwd, ...forced ? { forced: 1 } : {}, ...reason ? { reason } : {} });
 }
+function peekMarker(logDir2, id) {
+  try {
+    return JSON.parse(readFileSync36(killMarkerPath(logDir2, id), "utf8"));
+  } catch {
+    return null;
+  }
+}
 function readMarker(logDir2, id) {
   const p = killMarkerPath(logDir2, id);
   if (!existsSync36(p)) return null;
@@ -28047,8 +28081,11 @@ function parentInfo() {
 function decideEndReason(a) {
   if (a.timedOut) return { reason: "deadline" };
   if (a.loopStopped) return { reason: "loop-stopped" };
-  if (!a.signal) return { reason: "exit" };
-  const marker = readMarker(a.logDir, a.id);
+  const marker = a.signal || peekMarker(a.logDir, a.id)?.by === "pane audit" ? readMarker(a.logDir, a.id) : null;
+  if (!a.signal && !marker) return { reason: "exit" };
+  if (!a.signal && marker) {
+    return { reason: "pai-worker-kill", by: marker.by, note: `killed by ${marker.by}${marker.reason ? `: ${marker.reason}` : ""}`, ...marker.reason ? { killReason: marker.reason } : {}, forced: true };
+  }
   if (marker) {
     return {
       reason: "pai-worker-kill",
@@ -30957,6 +30994,7 @@ function fireDeadline(logDir2, status, ledger, limit) {
   status.last = what;
   saveStatus(logDir2, status);
   appendLedger(ledger, "WORKER-DEADLINE", { id: status.id, minutes: limit.minutes, waitedMin: waited });
+  appendStopEvent(logDir2, status.id, { killed_by: "deadline", forced: false, reason: `${what} (timer: --max-minutes/--deadline, armed at spawn)` });
   void killTree(logDir2, status.id, { skipRoot: true, by: "deadline", reason: `parent worker ${what}` }).catch(() => void 0);
 }
 function trackBlocked(logDir2, status, limit) {
@@ -31032,6 +31070,10 @@ async function finaliseRun(f) {
   }
   const end = decideEndReason({ logDir: logDir2, id: wid, timedOut: f.timedOut !== void 0, loopStopped: !!loopStop });
   status.endReason = end.reason;
+  if (end.reason === "pai-worker-kill" && !f.timedOut && end.killReason && !succeeded) {
+    status.last = shortText(end.killReason, 90);
+    report = { ...report ?? {}, result: report?.result ?? "-", why: end.killReason, notes: [end.killReason, report?.notes ?? f.fallbackText].filter(Boolean).join("\n") };
+  }
   status.claimsContinue = report?.result === "~";
   saveStatus(logDir2, status);
   appendLedger(ledger, "WORKER-END", { id: wid, ...f.end, rc, secs: f.secs, ...endFields(end) });
@@ -31658,7 +31700,8 @@ async function openOwnedPane(o) {
   let pidWaiter = null;
   let ended = false;
   let startedAt = 0;
-  const record = (extra = {}) => writeJson(recordPath(o.id), { id: o.id, kind: o.kind, caller: process.pid, wrapper: wrapper || void 0, session, startedMs: startedAt || Date.now(), ...extra });
+  const openedAt = Date.now();
+  const record = (extra = {}) => writeJson(recordPath(o.id), { id: o.id, kind: o.kind, caller: process.pid, wrapper: wrapper || void 0, session, openedMs: openedAt, startedMs: startedAt || openedAt, ...extra });
   const settle = (code, signal) => {
     if (ended) return;
     ended = true;

package/dist/hooks/worker-status-line.mjs

@@ -10565,6 +10565,7 @@ var init_pane_audit = __esm({
     init_ledger();
     init_paths();
     init_kill_tree();
+    init_endreason();
     init_status();
     init_plan_status();
     init_pane_run();
@@ -18041,6 +18042,17 @@ var init_kg_triples = __esm({
 async function ensureObservationTables(pool) {
   if (_tablesEnsured) return;
   await pool.query(SCHEMA_SQL);
+  const colCheck = await pool.query(
+    `SELECT column_name FROM information_schema.columns
+     WHERE table_name = 'pai_observations' AND column_name IN ('source', 'fidelity')`
+  );
+  const existing = new Set(colCheck.rows.map((r) => r.column_name));
+  if (!existing.has("source")) {
+    await pool.query("ALTER TABLE pai_observations ADD COLUMN IF NOT EXISTS source TEXT");
+  }
+  if (!existing.has("fidelity")) {
+    await pool.query("ALTER TABLE pai_observations ADD COLUMN IF NOT EXISTS fidelity TEXT");
+  }
   _tablesEnsured = true;
 }
 async function ensureSkillTelemetryTable(pool) {
@@ -18068,8 +18080,9 @@ async function storeObservation(pool, obs) {
   const result = await pool.query(
     `INSERT INTO pai_observations
        (session_id, project_id, project_slug, type, title, narrative,
-        tool_name, tool_input_summary, files_read, files_modified, concepts, content_hash)
-     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::jsonb, $10::jsonb, $11::jsonb, $12)
+        tool_name, tool_input_summary, files_read, files_modified, concepts, content_hash,
+        source, fidelity)
+     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::jsonb, $10::jsonb, $11::jsonb, $12, $13, $14)
      RETURNING id`,
     [
       obs.session_id,
@@ -18083,7 +18096,9 @@ async function storeObservation(pool, obs) {
       JSON.stringify(obs.files_read),
       JSON.stringify(obs.files_modified),
       JSON.stringify(obs.concepts),
-      hash
+      hash,
+      obs.source ?? null,
+      obs.fidelity ?? null
     ]
   );
   return result.rows[0]?.id ?? null;
@@ -18125,7 +18140,7 @@ async function queryObservations(pool, opts = {}) {
     `SELECT id, session_id, project_id, project_slug, type, title, narrative,
             tool_name, tool_input_summary,
             files_read, files_modified, concepts,
-            content_hash, created_at
+            content_hash, source, fidelity, created_at
      FROM pai_observations
      ${where}
      ORDER BY created_at DESC
@@ -18140,7 +18155,7 @@ async function queryRecentObservations(pool, projectId, limit) {
     `SELECT id, session_id, project_id, project_slug, type, title, narrative,
             tool_name, tool_input_summary,
             files_read, files_modified, concepts,
-            content_hash, created_at
+            content_hash, source, fidelity, created_at
      FROM pai_observations
      WHERE project_id = $1
      ORDER BY created_at DESC
@@ -18155,7 +18170,7 @@ async function querySessionObservations(pool, sessionId) {
     `SELECT id, session_id, project_id, project_slug, type, title, narrative,
             tool_name, tool_input_summary,
             files_read, files_modified, concepts,
-            content_hash, created_at
+            content_hash, source, fidelity, created_at
      FROM pai_observations
      WHERE session_id = $1
      ORDER BY created_at ASC`,
@@ -18325,6 +18340,8 @@ CREATE TABLE IF NOT EXISTS pai_observations (
   files_modified JSONB DEFAULT '[]'::jsonb,
   concepts JSONB DEFAULT '[]'::jsonb,
   content_hash TEXT,
+  source TEXT,
+  fidelity TEXT,
   created_at TIMESTAMPTZ DEFAULT NOW()
 );
 
@@ -24629,6 +24646,16 @@ var init_loopback_guard = __esm({
   }
 });
 
+// src/router/cockpit-auth.ts
+var init_cockpit_auth = __esm({
+  "src/router/cockpit-auth.ts"() {
+    "use strict";
+    init_pai_home();
+    init_loopback();
+    init_timeouts();
+  }
+});
+
 // src/router/router.ts
 var init_router2 = __esm({
   "src/router/router.ts"() {
@@ -24647,6 +24674,7 @@ var init_router2 = __esm({
     init_local_instances();
     init_route_table();
     init_loopback_guard();
+    init_cockpit_auth();
   }
 });