@tekmidian/pai 1.0.3 → 1.0.4

package/dist/{routing-BAAST9vT.mjs → routing-DmkheCRH.mjs}

@@ -1,6 +1,6 @@
 import { g as paiHomePath, h as paiHomeDir } from "./runtime-paths-WsO9sJFc.mjs";
 import { t as writeFileAtomic } from "./atomic-file-BorMa4T3.mjs";
-import { A as providerQuotaSkipAt, F as writeWorkersSection, L as isLoopbackHostname, M as resolveCapability, N as resolveModelCapability, O as providerCostTier, P as resolveProviderKey, R as isLoopbackUrl$1, at as MAX_ROUTE_MODELS, b as nativeOrchestratorModel, c as WorkersConfigError, ct as entryProvider, dt as migrateSessionRoutes, ft as parseEntry, j as readWorkersSection, lt as findTier, m as isLocalProvider, mt as targetList, p as getProviderOrNative, pt as sessionTier, s as WORKER_CLASSES, st as classRoute, t as ANTHROPIC_NATIVE, tt as workersYamlPath, u as classModelCapability, ut as listForPolicy, vt as stripModelVariant, y as nativeAnthropicProvider, z as loopbackUrl$1 } from "./config-XpZWOYOG.mjs";
+import { A as providerQuotaSkipAt, F as writeWorkersSection, I as LOOPBACK_HOST, L as isLoopbackHostname, M as resolveCapability, N as resolveModelCapability, O as providerCostTier, P as resolveProviderKey, R as isLoopbackUrl$1, at as MAX_ROUTE_MODELS, b as nativeOrchestratorModel, c as WorkersConfigError, ct as entryProvider, dt as migrateSessionRoutes, ft as parseEntry, j as readWorkersSection, lt as findTier, m as isLocalProvider, mt as targetList, p as getProviderOrNative, pt as sessionTier, s as WORKER_CLASSES, st as classRoute, t as ANTHROPIC_NATIVE, tt as workersYamlPath, u as classModelCapability, ut as listForPolicy, vt as stripModelVariant, y as nativeAnthropicProvider, z as loopbackUrl$1 } from "./config-XpZWOYOG.mjs";
 import { c as loadConfig, f as readMainConfigRaw } from "./config-Bu1_vbY8.mjs";
 import { s as routingStatePath, u as workersLogDir } from "./paths-CHifubDh.mjs";
 import { g as isLive, v as loadStatus, y as loadStatuses } from "./status-ggJ7lgVg.mjs";
@@ -12,11 +12,11 @@ import { a as newPrefill, c as schedEnabled, f as sharedScheduler } from "./sche
 import { i as effectiveCap } from "./capacity-DEveQdFV.mjs";
 import { i as instanceNumber, l as readInstances, r as instanceEngineKey, s as pickInstance, t as endpointRegistry, u as readLiveInstances } from "./local-instances-DOxSgT_L.mjs";
 import { c as writeLocalStatus, n as tierProviderNames, r as LOCAL_STATUS_REFRESH_MS, s as readLocalStatus, t as isLocalCandidate } from "./local-candidate-DLdwQt0s.mjs";
-import { t as LOCAL_PROBE_TIMEOUT_MS } from "./timeouts-1MLooEBB.mjs";
+import { n as TAILSCALE_STATUS_TIMEOUT_MS, t as LOCAL_PROBE_TIMEOUT_MS } from "./timeouts-1MLooEBB.mjs";
 import { appendFileSync, chmodSync, closeSync, existsSync, fstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { delimiter, dirname, join } from "node:path";
-import { homedir, tmpdir } from "node:os";
+import { homedir, networkInterfaces, tmpdir } from "node:os";
 import { execFile, execFileSync, spawnSync } from "node:child_process";
 import { parse, stringify } from "yaml";
 import http from "node:http";
@@ -1664,7 +1664,7 @@ function currentSessionName(env = process.env) {
 */
 async function registryProjectName(cwd) {
 	try {
-		const { detectProject } = await import("./detect-D1ziFFfA.mjs");
+		const { detectProject } = await import("./detect-Rrimh0xc.mjs");
 		return (await detectProject(cwd))?.display_name || void 0;
 	} catch {
 		return;
@@ -1690,7 +1690,7 @@ async function detectSessionName(env = process.env, deps = {}) {
 	let name;
 	const registry = deps.registryPath ?? AIBROKER_REGISTRY;
 	const claudeId = env.CLAUDE_CODE_SESSION_ID?.trim();
-	const { loadBrokerNames, transcriptCustomTitle } = await import("./session-scan-BJI_ZO8M.mjs");
+	const { loadBrokerNames, transcriptCustomTitle } = await import("./session-scan-B57dNuA4.mjs");
 	name = resolveSession(env.ITERM_SESSION_ID ?? "", registry)?.name ?? (claudeId ? loadBrokerNames(registry, deps.mapPath).get(claudeId) ?? transcriptCustomTitle(claudeId, deps.projectsDir) : void 0) ?? await (deps.projectName ?? registryProjectName)(cwd);
 	cached = {
 		key,
@@ -2380,6 +2380,105 @@ function isTailnetOrLocalName(hostname) {
 	return hostname.endsWith(".ts.net") || /^[a-z0-9-]+$/i.test(hostname) && !/^\d+$/.test(hostname);
 }
 
+//#endregion
+//#region src/router/cockpit-auth.ts
+/** The /v1 remote rule: loopback (any 127/8, ::1, v4-mapped) or the tailnet. */
+function defaultV1Guard(remoteAddress) {
+	return isLoopbackAddress(remoteAddress) || inTailscaleRange(remoteAddress);
+}
+/** Strip the ::ffff: IPv4-mapped prefix (Node reports v4 peers this way on v6 sockets). */
+function normalizeIp(ip) {
+	const a = (ip ?? "").trim().toLowerCase();
+	return a.startsWith("::ffff:") ? a.slice(7) : a;
+}
+function isLoopbackAddress(ip) {
+	const a = normalizeIp(ip);
+	return a === "::1" || a.startsWith("127.");
+}
+function ipv4ToInt(ip) {
+	const parts = ip.split(".");
+	if (parts.length !== 4) return null;
+	let out = 0;
+	for (const p of parts) {
+		if (!/^\d{1,3}$/.test(p)) return null;
+		const n = Number(p);
+		if (n > 255) return null;
+		out = out * 256 + n;
+	}
+	return out;
+}
+function inTailscaleRange(ip) {
+	const n = ipv4ToInt(normalizeIp(ip));
+	if (n === null) return false;
+	return (n & 4290772992) === 1681915904;
+}
+/**
+* router.bind → a concrete address. "loopback" (also empty/unset) is
+* 127.0.0.1; "tailscale" resolves the utun/tailscale interface's IPv4 inside
+* 100.64.0.0/10 (null when Tailscale is down); anything else must be a dotted
+* quad — 0.0.0.0 and every non-IPv4 value are refused (null).
+*/
+function resolveBindAddress(bind, interfaces = networkInterfaces) {
+	const v = (bind ?? "").trim().toLowerCase();
+	if (!v || v === "loopback") return LOOPBACK_HOST;
+	if (v === "tailscale") {
+		let fallback;
+		for (const [name, addrs] of Object.entries(interfaces() ?? {})) for (const a of addrs ?? []) {
+			if (a.family !== "IPv4" && a.family !== 4) continue;
+			if (!inTailscaleRange(a.address)) continue;
+			if (/^(utun|tailscale)/i.test(name)) return a.address;
+			fallback ??= a.address;
+		}
+		return fallback ?? null;
+	}
+	if (v === "0.0.0.0" || v === "::" || v === "*") return null;
+	return ipv4ToInt(v) !== null ? v : null;
+}
+function isCockpitPath(path) {
+	return path === "/cockpit" || path.startsWith("/cockpit/") || path.startsWith("/api/session/");
+}
+/**
+* DNS-rebinding check on the Host header. Allowed: `127.0.0.1[:port]`,
+* `localhost[:port]`, `[::1][:port]`, the bind address itself (loopback when
+* `bind` is empty/"loopback"), and any entry of `extraHosts` (tailnet names;
+* router.allowedHosts in config.yaml). A missing or unparsable Host is
+* rejected — non-browser clients always send one, so accepting its absence
+* would hand an attacker the whole check.
+*/
+function hostAllowed(hostHeader, bind, extraHosts) {
+	if (!hostHeader || !URL.canParse(`http://${hostHeader}`)) return false;
+	const hostname = new URL(`http://${hostHeader}`).hostname.replace(/^\[|\]$/g, "");
+	if (hostname === LOOPBACK_HOST || hostname === "localhost" || hostname === "::1") return true;
+	const bindAddr = resolveBindAddress(bind);
+	if (bindAddr && hostname === bindAddr) return true;
+	return extraHosts.some((h) => h.trim().toLowerCase() === hostname);
+}
+/**
+* Cross-site check on the Origin header: no Origin passes (curl, the Claude
+* client); an Origin present must carry the same host:port as the Host header.
+*/
+function originAllowed(originHeader, hostHeader) {
+	if (!originHeader) return true;
+	if (!hostHeader || !URL.canParse(`http://${hostHeader}`) || !URL.canParse(originHeader)) return false;
+	return new URL(originHeader).host === new URL(`http://${hostHeader}`).host;
+}
+/**
+* The address to show a human for a bind address: the tailnet hostname
+* (MagicDNS name, from `tailscale status --json`) when the address is the
+* machine's own Tailscale IP, else the address itself.
+*/
+async function displayHost(addr) {
+	if (!inTailscaleRange(addr)) return addr;
+	try {
+		const { execFile } = await import("node:child_process");
+		const { promisify } = await import("node:util");
+		const { stdout } = await promisify(execFile)("tailscale", ["status", "--json"], { timeout: TAILSCALE_STATUS_TIMEOUT_MS });
+		const self = JSON.parse(stdout).Self;
+		if (self?.DNSName && self.TailscaleIPs?.includes(addr)) return self.DNSName.replace(/\.$/, "");
+	} catch {}
+	return addr;
+}
+
 //#endregion
 //#region src/router/router.ts
 /**
@@ -2821,6 +2920,25 @@ function routerHandler(loadProviders = () => withTierProviders(readWorkersSectio
 		log(`${(/* @__PURE__ */ new Date()).toISOString()} warning: model id ${model} is declared by several providers (${cands.join(", ")}); preferring one that is up`);
 	};
 	return (req, res) => {
+		const hosts = options?.hosts;
+		if (hosts) {
+			const path = (req.url ?? "/").split("?")[0];
+			const mutating = [
+				"POST",
+				"PUT",
+				"PATCH",
+				"DELETE"
+			].includes((req.method ?? "GET").toUpperCase());
+			if (isCockpitPath(path) || mutating) {
+				const refuse = (error) => {
+					res.writeHead(403, { "content-type": "application/json" });
+					res.end(JSON.stringify({ error }));
+					log(`${(/* @__PURE__ */ new Date()).toISOString()} ${req.method ?? "-"} ${path} 403 ${error}`);
+				};
+				if (!hostAllowed(req.headers.host, hosts.bind, hosts.extraHosts)) return refuse("host not allowed");
+				if (!originAllowed(req.headers.origin, req.headers.host)) return refuse("origin not allowed");
+			}
+		}
 		if (extra?.(req, res)) return;
 		const guard = options?.remoteAllowed;
 		if (guard && !guard(req.socket.remoteAddress ?? void 0)) {
@@ -5907,5 +6025,5 @@ function resolveCapabilityRun(config, capability) {
 }
 
 //#endregion
-export { parseFootprint as $, findLocal as $t, budgetSkipReason as A, saveSetup as An, TIGHT_PERCENT as At, MODEL_INVENTORY_MAX_AGE_MS as B, aggregate as Bn, routeRows as Bt, detectSessionProvider as C, PORT_TIMEOUT_MS as Cn, removeRunSettings as Ct, budgetExceeded as D, httpModelsCheck as Dn, routerPort as Dt, budgetCache as E, findSetup as En, routerHandler as Et, LimitsCache as F, workersLabel as Fn, flowText as Ft, fmtMem as G, isTimeOrdered as Gn, setRoute as Gt, ProbeHold as H, appendUsage as Hn, servingChip as Ht, buildSpeed as I, parkConfigFrom as In, parseSelector as It, inventoryRows as J, readUsage as Jn, validateRoute as Jt, fmtMemMapped as K, markTimeOrdered as Kn, setSessionRoute as Kt, percentile as L, setParkConfigSource as Ln, resolveSelector as Lt, budgetWall as M, setupWorkersLabel as Mn, clearSessionRoute as Mt, fetchBudgetReading as N, setupsPath as Nn, configuredLocal as Nt, budgetFresh as O, loadSaved as On, isTailnetOrLocalName as Ot, pickBudgetWindow as P, shortModel as Pn, entryLabel as Pt, modelLabel as Q, fallThroughReason as Qt, DOWN_AFTER_MISSES as R, sharedParker as Rn, resolveSessionArg as Rt, applySessionProviderEnv as S, startLocalStatusRefresh as Sn, gcSettingsFiles as St, BudgetCache as T, downLocalProviders as Tn, duplicateModelIds as Tt, computeInventory as U, formatSessionStats as Un, sessionRoutesPatch as Ut, MODEL_INVENTORY_REFRESH_MS as V, aggregateBySession as Vn, routeText as Vt, currentInventory as W, formatStats as Wn, sessionStartTarget as Wt, liveDeps as X, usageLogFile as Xn, clearPolicy as Xt, inventoryText as Y, splitBySessionKind as Yn, POLICY_MODES as Yt, modelKind as Z, committedFallThrough as Zt, resolveTarget as _, pickLocal as _n, nativeRoutePreflight as _t, clearCooldown as a, detectSessionName as an, readInventoryInput as at, SESSION_PROVIDER_ENV as b, resolveLocalProvider as bn, routeLoopbackViaRouter as bt, exclusionReason as c, getProfile as cn, writeInventory as ct, probeQuota as d, updateProfile as dn, claudeCommand as dt, onBattery as en, parseSizeMb as et, quotaExceeded as f, LOCAL_MECHANISM_LINE as fn, claudeSettingsExtra as ft, resolveCapabilityRun as g, localTierOrder as gn, nativeLaunchSettingsArgs as gt, recordBudgetCooldowns as h, localProviderForDelegation as hn, nativeLaunchEnv as ht, capabilityForRun as i, writePolicy as in, readInventory as it, budgetUntilLabel as j, setupProfile as jn, applyPolicyToRoutes as jt, budgetFull as k, orchestratorLabel as kn, loopbackRefusal as kt, isQuotaFailure as l, profilesPath as ln, addSchedulingHeaders as lt, readRoutingState as m, currentLocalStatus as mn, loopbackRouterChoice as mt, NoProviderError as n, readPolicy as nn, processTreeMemory as nt, cooldownRemaining as o, BATCH_ENV as on, readModelLabels as ot, quotaSkipThreshold as p, NoLocalServerError as pn, isLoopbackProvider as pt, inventoryPath as q, parseSince as qn, tierFlow as qt, autoOrder as r, routeRun as rn, processTreeRssMb as rt, entryModel as s, SESSION_NAME_ENV as sn, startInventoryRefresh as st, BUDGET_COOLDOWN_MIN as t, parseDuration as tn, parseTable as tt, nextAutoProvider as u, readProfiles as un, buildRunEnv as ut, setCooldown as v, probeLoopback as vn, pinnedSettings as vt, BUDGET_TTL_MS as w, allSetups as wn, writePrivateFile as wt, SESSION_WORKER_PROVIDER_ENV as x, resolveRunnerProvider as xn, routeVerdictLine as xt, writeRoutingState as y, providerHostPort as yn, pinnedSettingsArgs as yt, INVENTORY_HEADERS as z, recordDuration as zn, routeChoices as zt };
-//# sourceMappingURL=routing-BAAST9vT.mjs.map
+export { parseFootprint as $, splitBySessionKind as $n, POLICY_MODES as $t, budgetSkipReason as A, findSetup as An, hostAllowed as At, MODEL_INVENTORY_MAX_AGE_MS as B, parkConfigFrom as Bn, parseSelector as Bt, detectSessionProvider as C, providerHostPort as Cn, removeRunSettings as Ct, budgetExceeded as D, PORT_TIMEOUT_MS as Dn, routerPort as Dt, budgetCache as E, startLocalStatusRefresh as En, routerHandler as Et, LimitsCache as F, setupProfile as Fn, applyPolicyToRoutes as Ft, fmtMem as G, aggregateBySession as Gn, routeText as Gt, ProbeHold as H, sharedParker as Hn, resolveSessionArg as Ht, buildSpeed as I, setupWorkersLabel as In, clearSessionRoute as It, inventoryRows as J, formatStats as Jn, sessionStartTarget as Jt, fmtMemMapped as K, appendUsage as Kn, servingChip as Kt, percentile as L, setupsPath as Ln, configuredLocal as Lt, budgetWall as M, loadSaved as Mn, isTailnetOrLocalName as Mt, fetchBudgetReading as N, orchestratorLabel as Nn, loopbackRefusal as Nt, budgetFresh as O, allSetups as On, defaultV1Guard as Ot, pickBudgetWindow as P, saveSetup as Pn, TIGHT_PERCENT as Pt, modelLabel as Q, readUsage as Qn, validateRoute as Qt, DOWN_AFTER_MISSES as R, shortModel as Rn, entryLabel as Rt, applySessionProviderEnv as S, probeLoopback as Sn, gcSettingsFiles as St, BudgetCache as T, resolveRunnerProvider as Tn, duplicateModelIds as Tt, computeInventory as U, recordDuration as Un, routeChoices as Ut, MODEL_INVENTORY_REFRESH_MS as V, setParkConfigSource as Vn, resolveSelector as Vt, currentInventory as W, aggregate as Wn, routeRows as Wt, liveDeps as X, markTimeOrdered as Xn, setSessionRoute as Xt, inventoryText as Y, isTimeOrdered as Yn, setRoute as Yt, modelKind as Z, parseSince as Zn, tierFlow as Zt, resolveTarget as _, NoLocalServerError as _n, nativeRoutePreflight as _t, clearCooldown as a, parseDuration as an, readInventoryInput as at, SESSION_PROVIDER_ENV as b, localTierOrder as bn, routeLoopbackViaRouter as bt, exclusionReason as c, writePolicy as cn, writeInventory as ct, probeQuota as d, SESSION_NAME_ENV as dn, claudeCommand as dt, clearPolicy as en, usageLogFile as er, parseSizeMb as et, quotaExceeded as f, getProfile as fn, claudeSettingsExtra as ft, resolveCapabilityRun as g, LOCAL_MECHANISM_LINE as gn, nativeLaunchSettingsArgs as gt, recordBudgetCooldowns as h, updateProfile as hn, nativeLaunchEnv as ht, capabilityForRun as i, onBattery as in, readInventory as it, budgetUntilLabel as j, httpModelsCheck as jn, resolveBindAddress as jt, budgetFull as k, downLocalProviders as kn, displayHost as kt, isQuotaFailure as l, detectSessionName as ln, addSchedulingHeaders as lt, readRoutingState as m, readProfiles as mn, loopbackRouterChoice as mt, NoProviderError as n, fallThroughReason as nn, processTreeMemory as nt, cooldownRemaining as o, readPolicy as on, readModelLabels as ot, quotaSkipThreshold as p, profilesPath as pn, isLoopbackProvider as pt, inventoryPath as q, formatSessionStats as qn, sessionRoutesPatch as qt, autoOrder as r, findLocal as rn, processTreeRssMb as rt, entryModel as s, routeRun as sn, startInventoryRefresh as st, BUDGET_COOLDOWN_MIN as t, committedFallThrough as tn, parseTable as tt, nextAutoProvider as u, BATCH_ENV as un, buildRunEnv as ut, setCooldown as v, currentLocalStatus as vn, pinnedSettings as vt, BUDGET_TTL_MS as w, resolveLocalProvider as wn, writePrivateFile as wt, SESSION_WORKER_PROVIDER_ENV as x, pickLocal as xn, routeVerdictLine as xt, writeRoutingState as y, localProviderForDelegation as yn, pinnedSettingsArgs as yt, INVENTORY_HEADERS as z, workersLabel as zn, flowText as zt };
+//# sourceMappingURL=routing-DmkheCRH.mjs.map

package/dist/{routing-CENt4HH1.mjs → routing-f2zulGwD.mjs}

@@ -3,7 +3,7 @@ import "./config-Bu1_vbY8.mjs";
 import "./paths-CHifubDh.mjs";
 import "./status-ggJ7lgVg.mjs";
 import "./scope-D-h6F6DN.mjs";
-import { _ as resolveTarget, a as clearCooldown, c as exclusionReason, d as probeQuota, f as quotaExceeded, g as resolveCapabilityRun, h as recordBudgetCooldowns, i as capabilityForRun, l as isQuotaFailure, m as readRoutingState, n as NoProviderError, o as cooldownRemaining, p as quotaSkipThreshold, r as autoOrder, s as entryModel, t as BUDGET_COOLDOWN_MIN, u as nextAutoProvider, v as setCooldown, y as writeRoutingState } from "./routing-BAAST9vT.mjs";
+import { _ as resolveTarget, a as clearCooldown, c as exclusionReason, d as probeQuota, f as quotaExceeded, g as resolveCapabilityRun, h as recordBudgetCooldowns, i as capabilityForRun, l as isQuotaFailure, m as readRoutingState, n as NoProviderError, o as cooldownRemaining, p as quotaSkipThreshold, r as autoOrder, s as entryModel, t as BUDGET_COOLDOWN_MIN, u as nextAutoProvider, v as setCooldown, y as writeRoutingState } from "./routing-DmkheCRH.mjs";
 import "./tool-errors-7E13StWd.mjs";
 import "./wait-ByV0OyMZ.mjs";
 import "./local-tiers-BE4jGaMa.mjs";

package/dist/{run-CSC7mgPf.mjs → run-BwZKBJZZ.mjs}

@@ -6,7 +6,7 @@ import { A as applyScratchEnv, C as worktreeWanted, S as worktreeSystemPrompt, _
 import { C as nowStamp, D as pidAlive, E as parseSleepSecs, J as loadPreamble, Q as appendSystemPromptArgs, S as newWorkerId, X as preambleLine, Y as preambleBlock, Z as projectRoot, a as UNLABELED, d as describeTool, g as isLive, k as saveStatus, nt as shortText, rt as stripPromptValues, tt as parseRunnerArgs, v as loadStatus, x as markStartFailed, y as loadStatuses } from "./status-ggJ7lgVg.mjs";
 import { D as readMcpServers, E as mcpServersFromToolGrants, O as writeMcpConfig, S as inputSideTokens, T as grantsChrome, d as poolIneligibleReason, g as postTaskToPool, h as poolSettings, n as SLOT_TOOLS, r as UNIT_MARKER, t as SHARED_MARKER, w as expandMcpNames, y as reloadInProgress } from "./pool-Dh-q3iJi.mjs";
 import { i as itermUuid, o as resolveSession, s as resolveSpawnerSession } from "./scope-D-h6F6DN.mjs";
-import { Cn as PORT_TIMEOUT_MS, Ct as removeRunSettings, Dn as httpModelsCheck, Dt as routerPort, E as budgetCache, Qt as fallThroughReason, S as applySessionProviderEnv, Zt as committedFallThrough, _ as resolveTarget, an as detectSessionName, bn as resolveLocalProvider, bt as routeLoopbackViaRouter, cn as getProfile, dt as claudeCommand, fn as LOCAL_MECHANISM_LINE, ft as claudeSettingsExtra, g as resolveCapabilityRun, h as recordBudgetCooldowns, i as capabilityForRun, k as budgetFull, l as isQuotaFailure, lt as addSchedulingHeaders, n as NoProviderError, o as cooldownRemaining, on as BATCH_ENV, pn as NoLocalServerError, pt as isLoopbackProvider, r as autoOrder, rn as routeRun, u as nextAutoProvider, ut as buildRunEnv, v as setCooldown, vn as probeLoopback, vt as pinnedSettings, wt as writePrivateFile, x as SESSION_WORKER_PROVIDER_ENV, xn as resolveRunnerProvider, yn as providerHostPort } from "./routing-BAAST9vT.mjs";
+import { Cn as providerHostPort, Ct as removeRunSettings, Dn as PORT_TIMEOUT_MS, Dt as routerPort, E as budgetCache, S as applySessionProviderEnv, Sn as probeLoopback, Tn as resolveRunnerProvider, _ as resolveTarget, _n as NoLocalServerError, bt as routeLoopbackViaRouter, dt as claudeCommand, fn as getProfile, ft as claudeSettingsExtra, g as resolveCapabilityRun, gn as LOCAL_MECHANISM_LINE, h as recordBudgetCooldowns, i as capabilityForRun, jn as httpModelsCheck, k as budgetFull, l as isQuotaFailure, ln as detectSessionName, lt as addSchedulingHeaders, n as NoProviderError, nn as fallThroughReason, o as cooldownRemaining, pt as isLoopbackProvider, r as autoOrder, sn as routeRun, tn as committedFallThrough, u as nextAutoProvider, un as BATCH_ENV, ut as buildRunEnv, v as setCooldown, vt as pinnedSettings, wn as resolveLocalProvider, wt as writePrivateFile, x as SESSION_WORKER_PROVIDER_ENV } from "./routing-DmkheCRH.mjs";
 import { t as maxOf } from "./min-max-DrSRUaWQ.mjs";
 import { b as readToolErrors, h as harnessToolErrorTexts, p as grantedToolNames, x as recordToolError } from "./tool-errors-7E13StWd.mjs";
 import { _ as workerContractPrompt, b as killProcessTree, c as checkProof, d as parseWorkerReport, f as promptTrailer, g as verifyReportChanges, h as verifyFailNote, l as newUntracked, m as untrackedPaths, o as AG2_REASK_TEXT, s as OPERATOR_MARK, u as noteTokenSentence, v as repairAndValidateAg2, x as processTree, y as validateAg2 } from "./wait-ByV0OyMZ.mjs";
@@ -14,13 +14,13 @@ import { a as buildsDir, d as releaseBuildsOf } from "./caller-identity-yLFb7CKq
 import { c as queuedText, d as resolveCap, h as staggerGate, m as recordWarmup, n as capacityGate, p as sessionScopeKey, t as admitCap } from "./capacity-DEveQdFV.mjs";
 import { n as tierProviderNames, t as isLocalCandidate } from "./local-candidate-DLdwQt0s.mjs";
 import { t as LOCAL_PROBE_TIMEOUT_MS } from "./timeouts-1MLooEBB.mjs";
-import { i as getRegistryBackend } from "./factory-DjAAsqr_.mjs";
-import { c as ensureProxyRunning, i as detectCurrentModel, l as proxyPort } from "./launch-Jh5NVeNe.mjs";
-import { A as tail, Et as openOwnedPane, Kt as isHandoffMessage, Q as NoTerminalError, Wt as deliverHandoff, Xt as localFailures, _ as troublePolicy, _t as paneTitle, at as headlessAllowed, d as aibrokerMessenger, f as detachRun, h as originFromEnv, ht as resolveHostSession, it as followCommand, m as markRunDone, mt as realPaneOps, nt as closePaneForWorker, o as ownerOf, p as eventLine, r as returnControlsIfHeld, ut as openVerifiedPane, v as appendRunLog, z as gatePhaseName } from "./controls-CPoeudou.mjs";
-import { i as endFields, o as parentInfo, r as decideEndReason } from "./endreason-C577xIQz.mjs";
-import { A as resolveLimit, E as armDeadline, F as checkOrphanedChildren, I as isWorkerId, L as launchParent, M as blockedMsOf, O as deadlinePromptLine, P as assertChildAllowed, T as recordDenial, k as extendLimit, w as parseDenialText } from "./render-BYmQkuLd.mjs";
+import { i as getRegistryBackend } from "./factory-B7nv75rC.mjs";
+import { c as ensureProxyRunning, i as detectCurrentModel, l as proxyPort } from "./launch-Di7N-J5X.mjs";
+import { A as tail, Et as openOwnedPane, Kt as isHandoffMessage, Q as NoTerminalError, Wt as deliverHandoff, Xt as localFailures, _ as troublePolicy, _t as paneTitle, at as headlessAllowed, d as aibrokerMessenger, f as detachRun, h as originFromEnv, ht as resolveHostSession, it as followCommand, m as markRunDone, mt as realPaneOps, nt as closePaneForWorker, o as ownerOf, p as eventLine, r as returnControlsIfHeld, ut as openVerifiedPane, v as appendRunLog, z as gatePhaseName } from "./controls-JLm6g0yP.mjs";
+import { i as endFields, o as parentInfo, r as decideEndReason, t as appendStopEvent } from "./endreason-BC-v05H_.mjs";
+import { A as resolveLimit, E as armDeadline, F as checkOrphanedChildren, I as isWorkerId, L as launchParent, M as blockedMsOf, O as deadlinePromptLine, P as assertChildAllowed, T as recordDenial, k as extendLimit, w as parseDenialText } from "./render-C84BqQRC.mjs";
 import { t as createOperatorServer } from "./operator-CyuB3aVw.mjs";
-import { i as killTree } from "./kill-tree-EWYaEk5v.mjs";
+import { i as killTree } from "./kill-tree-DleMNZX3.mjs";
 import { r as ensurePoolHost } from "./pool-cli-BggU8GRp.mjs";
 import { closeSync, existsSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { createHash, randomBytes } from "node:crypto";
@@ -936,6 +936,11 @@ function fireDeadline(logDir, status, ledger, limit) {
 		minutes: limit.minutes,
 		waitedMin: waited
 	});
+	appendStopEvent(logDir, status.id, {
+		killed_by: "deadline",
+		forced: false,
+		reason: `${what} (timer: --max-minutes/--deadline, armed at spawn)`
+	});
 	killTree(logDir, status.id, {
 		skipRoot: true,
 		by: "deadline",
@@ -1063,6 +1068,15 @@ async function finaliseRun(f) {
 		loopStopped: !!loopStop
 	});
 	status.endReason = end.reason;
+	if (end.reason === "pai-worker-kill" && !f.timedOut && end.killReason && !succeeded) {
+		status.last = shortText(end.killReason, 90);
+		report = {
+			...report ?? {},
+			result: report?.result ?? "-",
+			why: end.killReason,
+			notes: [end.killReason, report?.notes ?? f.fallbackText].filter(Boolean).join("\n")
+		};
+	}
 	status.claimsContinue = report?.result === "~";
 	saveStatus(logDir, status);
 	appendLedger(ledger, "WORKER-END", {
@@ -3413,8 +3427,8 @@ function resolveWorkers(args, ctx) {
 async function liveResolveCtx(env = process.env, warm = true) {
 	const [{ readWorkersSection }, { budgetCache }, { readRoutingState }, { workersLogDir }] = await Promise.all([
 		import("./config-Cxi-aBf4.mjs"),
-		import("./budget-Dod6rnA9.mjs"),
-		import("./routing-CENt4HH1.mjs"),
+		import("./budget-BrloTOZW.mjs"),
+		import("./routing-f2zulGwD.mjs"),
 		import("./paths-CFHTloSe.mjs")
 	]);
 	const { workers } = readWorkersSection();
@@ -4882,7 +4896,7 @@ async function runWorker(opts) {
 		if (gc?.length) process.stderr.write(`pai worker: archived ${gc.length} leftover worktree(s) (pai worker gc)\n`);
 	} catch {}
 	if (opts.className === "plan" && !opts._planner) {
-		const { runPlanner } = await import("./planner-BmFACdLa.mjs");
+		const { runPlanner } = await import("./planner-j77ndkBf.mjs");
 		return runPlanner(opts);
 	}
 	const parent = launchParent(opts.parent);
@@ -5106,4 +5120,4 @@ setRunWorker(runWorker);
 
 //#endregion
 export { routerPidFile as A, usageContextTokens as B, workerUsage as C, routerHandoverFile as D, probeRouter as E, startHandover as F, testProvider as H, paneWaiver as I, launchPane as L, routerSwapArgs as M, runRouterTick as N, routerIsStale as O, spawnRouter as P, noTerminalReasons as R, usageJson as S, projectLaunchConfig as T, endProcesses as U, printResult as V, findWorktreeOrphans as W, stopLaunchedWorkers as _, resolveWorkers as a, renderUsage as b, reportOriginWithHost as c, capture as d, dirtyPaths as f, realRunnerDeps as g, realCommitsAhead as h, liveResolveCtx as i, routerRunningPid as j, routerLogFile as k, runMessenger as l, mergeBranch as m, LocalProviderRefusedError as n, sessionWorkersLine as o, launchWorker as p, PoolRefusedError as r, finishDetached as s, runWorker as t, startDetached as u, parseWhen as v, pinNotices as w, transcriptUsage as x, priceTableText as y, recordSystemJobStart as z };
-//# sourceMappingURL=run-CSC7mgPf.mjs.map
+//# sourceMappingURL=run-BwZKBJZZ.mjs.map

package/dist/{scan-C_Y5W9py.mjs → scan-BBGvU5EB.mjs}

@@ -4,7 +4,7 @@ import { a as slugify, i as parseSessionFilename, n as decodeEncodedDir, t as bu
 import { D as readJsonStrict, O as writeJsonAtomic, o as expandHome } from "./config-Bu1_vbY8.mjs";
 import { a as unregistrableReason, o as workerWorktreesRoot, r as pruneWorktreeProjects } from "./registrable-DpyTtajg.mjs";
 import { n as ensurePaiMarker, t as discoverPaiMarkers } from "./pai-marker-BcZyJguM.mjs";
-import { i as getRegistryBackend } from "./factory-DjAAsqr_.mjs";
+import { i as getRegistryBackend } from "./factory-B7nv75rC.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { basename, join, resolve } from "node:path";
 import { homedir } from "node:os";
@@ -718,4 +718,4 @@ async function cmdScan(opts = {}) {
 
 //#endregion
 export { resolveHome as a, upsertSession as c, scanTranscriptFolders as d, transcriptFiles as f, performScan as i, claudeProjectsDir as l, loadScanConfig as n, saveScanConfig as o, migrateScanConfig as r, upsertProject as s, cmdScan as t, findMovedProjects as u };
-//# sourceMappingURL=scan-C_Y5W9py.mjs.map
+//# sourceMappingURL=scan-BBGvU5EB.mjs.map

package/dist/{session-BeqAbNPd.mjs → session-BAhtXdxj.mjs}

@@ -10,7 +10,7 @@ import "./registrable-DpyTtajg.mjs";
 import "./pai-marker-BcZyJguM.mjs";
 import "./helpers-CRuBUas3.mjs";
 import "./scope-D-h6F6DN.mjs";
-import "./routing-BAAST9vT.mjs";
+import "./routing-DmkheCRH.mjs";
 import "./tool-errors-7E13StWd.mjs";
 import "./wait-ByV0OyMZ.mjs";
 import "./local-tiers-BE4jGaMa.mjs";
@@ -18,18 +18,18 @@ import "./caller-identity-yLFb7CKq.mjs";
 import "./capacity-DEveQdFV.mjs";
 import "./local-instances-DOxSgT_L.mjs";
 import "./local-candidate-DLdwQt0s.mjs";
-import "./factory-DjAAsqr_.mjs";
-import "./postgres-C6ti4haA.mjs";
+import "./factory-B7nv75rC.mjs";
+import "./postgres-DNIOQijl.mjs";
 import "./embedding-gate-6rZrWRXa.mjs";
 import "./embeddings-BVq3esBF.mjs";
 import "./router-CQSc3lk3.mjs";
-import "./detect-9CZNO0yf.mjs";
-import "./helpers-BD6V-p9w.mjs";
-import "./scan-C_Y5W9py.mjs";
-import { a as newTop, c as planOpen, d as runNewDefault, f as sessionCommand, i as lsCommand, l as renameTop, n as collectRows, o as oneLine, p as sessionDir, r as collectView, s as openTop, t as applyProfileChat, u as rowsTable } from "./session-8iqQDkqb.mjs";
-import "./launch-Jh5NVeNe.mjs";
-import "./health-Dnym-qcT.mjs";
-import "./launch-CXVlZjHt.mjs";
-import "./session-scan-W-gbwJHM.mjs";
+import "./detect-BLKsUOgG.mjs";
+import "./helpers-DSNK_1KP.mjs";
+import "./scan-BBGvU5EB.mjs";
+import { a as newTop, c as planOpen, d as runNewDefault, f as sessionCommand, i as lsCommand, l as renameTop, n as collectRows, o as oneLine, p as sessionDir, r as collectView, s as openTop, t as applyProfileChat, u as rowsTable } from "./session-Dn5OJXlg.mjs";
+import "./launch-Di7N-J5X.mjs";
+import "./health-C4FQmkJn.mjs";
+import "./launch-DlZTKE3u.mjs";
+import "./session-scan-DUn10MBd.mjs";
 
 export { runNewDefault };

package/dist/{session-8iqQDkqb.mjs → session-Dn5OJXlg.mjs}

@@ -6,17 +6,17 @@ import { M as trustProjectPath } from "./pool-Dh-q3iJi.mjs";
 import { a as unregistrableReason } from "./registrable-DpyTtajg.mjs";
 import { n as ensurePaiMarker } from "./pai-marker-BcZyJguM.mjs";
 import { t as STOP_WORDS } from "./stop-words-DSEYQdNe.mjs";
-import { cn as getProfile, sn as SESSION_NAME_ENV, x as SESSION_WORKER_PROVIDER_ENV, xt as routeVerdictLine } from "./routing-BAAST9vT.mjs";
+import { dn as SESSION_NAME_ENV, fn as getProfile, x as SESSION_WORKER_PROVIDER_ENV, xt as routeVerdictLine } from "./routing-DmkheCRH.mjs";
 import { n as OPT, t as CliError } from "./define-CjJsmq-6.mjs";
-import { i as getRegistryBackend } from "./factory-DjAAsqr_.mjs";
-import { n as formatDetection, r as formatDetectionJson, t as detectProject } from "./detect-9CZNO0yf.mjs";
-import { a as getSessionCount, c as upsertTag$1, i as getProjectTags, n as getProject$1, o as requireProject, r as getProjectAliases, s as resolveIdentifier, t as getLastSessionDate } from "./helpers-BD6V-p9w.mjs";
-import { a as resolveHome, n as loadScanConfig } from "./scan-C_Y5W9py.mjs";
-import { n as buildLaunchPlan, o as launchableProviderNames, s as maskLaunchEnv, t as LaunchError } from "./launch-Jh5NVeNe.mjs";
-import { a as colorEnabled, f as renderTable$1, i as saveBudgetSnapshot, n as readBudget, o as makeStyle, r as readBudgetSnapshot, t as providerHealth } from "./health-Dnym-qcT.mjs";
-import { d as printExitDir, i as probeResume, u as transcriptModelFor } from "./launch-CXVlZjHt.mjs";
+import { i as getRegistryBackend } from "./factory-B7nv75rC.mjs";
+import { n as formatDetection, r as formatDetectionJson, t as detectProject } from "./detect-BLKsUOgG.mjs";
+import { a as getSessionCount, c as upsertTag$1, i as getProjectTags, n as getProject$1, o as requireProject, r as getProjectAliases, s as resolveIdentifier, t as getLastSessionDate } from "./helpers-DSNK_1KP.mjs";
+import { a as resolveHome, n as loadScanConfig } from "./scan-BBGvU5EB.mjs";
+import { n as buildLaunchPlan, o as launchableProviderNames, s as maskLaunchEnv, t as LaunchError } from "./launch-Di7N-J5X.mjs";
+import { a as colorEnabled, f as renderTable$1, i as saveBudgetSnapshot, n as readBudget, o as makeStyle, r as readBudgetSnapshot, t as providerHealth } from "./health-C4FQmkJn.mjs";
+import { d as printExitDir, i as probeResume, u as transcriptModelFor } from "./launch-DlZTKE3u.mjs";
 import { n as fetchLiveSessions } from "./aibroker-client-CQPGqLxL.mjs";
-import { a as resolveSessionByNameOrId, s as scanSessions, t as fmtAge } from "./session-scan-W-gbwJHM.mjs";
+import { a as resolveSessionByNameOrId, s as scanSessions, t as fmtAge } from "./session-scan-DUn10MBd.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import chalk from "chalk";
@@ -1066,7 +1066,7 @@ async function getSessionTags(registryBackend, sessionId) {
 * Session CRUD commands: list, info, rename, slug, tag, route, active, auto-route.
 */
 async function cmdList(projectSlug, opts) {
-	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("./factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	const limit = parseInt(opts.limit ?? "20", 10);
 	let project;
@@ -1131,7 +1131,7 @@ async function cmdList(projectSlug, opts) {
 	console.log(dim(`  ${rows.length} session(s) shown (limit: ${limit})`));
 }
 async function cmdInfo(projectSlug, sessionNumber) {
-	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("./factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	const project = await getProject(registryBackend, projectSlug);
 	if (!project) {
@@ -1155,7 +1155,7 @@ async function cmdInfo(projectSlug, sessionNumber) {
 	console.log();
 }
 async function cmdRename(projectSlug, numberOrLatest, newSlug) {
-	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("./factory-Bs9imVMq.mjs");
 	await cmdRenameWith(await getRegistryBackend(), projectSlug, numberOrLatest, newSlug);
 }
 /** Strips path separators and ".." so a title can never leave the notes dir. */
@@ -1242,7 +1242,7 @@ async function cmdRenameWith(registryBackend, projectSlug, numberOrLatest, newSl
 	console.log();
 }
 async function cmdSlug(projectSlug, numberOrLatest, opts) {
-	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("./factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	const project = await getProject(registryBackend, projectSlug);
 	if (!project) {
@@ -1272,7 +1272,7 @@ async function cmdSlug(projectSlug, numberOrLatest, opts) {
 	}
 }
 async function cmdTag(projectSlug, sessionNumber, rawTags) {
-	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("./factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	const project = await getProject(registryBackend, projectSlug);
 	if (!project) {
@@ -1312,7 +1312,7 @@ async function cmdTag(projectSlug, sessionNumber, rawTags) {
 	console.log();
 }
 async function cmdRoute(projectSlug, sessionNumber, targetProjectSlug, opts) {
-	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("./factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	const project = await getProject(registryBackend, projectSlug);
 	if (!project) {
@@ -1354,7 +1354,7 @@ async function cmdRoute(projectSlug, sessionNumber, targetProjectSlug, opts) {
 	console.log();
 }
 async function cmdActive(opts) {
-	const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
+	const { getRegistryBackend } = await import("./factory-Bs9imVMq.mjs");
 	const registryBackend = await getRegistryBackend();
 	const minutes = parseInt(opts.minutes ?? "60", 10);
 	const cutoff = Date.now() - minutes * 60 * 1e3;
@@ -1441,8 +1441,8 @@ async function cmdActive(opts) {
 	], rows));
 }
 async function cmdAutoRoute(opts) {
-	const { autoRoute, formatAutoRouteJson } = await import("./auto-route-CjjQqU1o.mjs");
-	const { getRegistryBackend, createStorageBackend } = await import("./factory-Bsib-qDG.mjs");
+	const { autoRoute, formatAutoRouteJson } = await import("./auto-route-C3S2W3Bc.mjs");
+	const { getRegistryBackend, createStorageBackend } = await import("./factory-Bs9imVMq.mjs");
 	const { loadConfig } = await import("./config-DtENJ6cL.mjs");
 	const config = loadConfig();
 	const registryBackend = await getRegistryBackend();
@@ -1854,7 +1854,7 @@ const newCommand = {
 		const name = ctx.opts.name;
 		const withSetup = ctx.opts.with;
 		if (withSetup) {
-			const { runNewWith } = await import("./root-FtJsxYnm.mjs");
+			const { runNewWith } = await import("./root-DD1xx_Vu.mjs");
 			return runNewWith({
 				dir,
 				with: withSetup,
@@ -1960,4 +1960,4 @@ const renameTop = {
 
 //#endregion
 export { cmdAdd as A, cmdRebind as B, assertAvailable as C, execHarness as D, dryRunText as E, cmdEdit as F, cmdUnarchive as H, cmdGo as I, cmdInfo$1 as L, cmdArchive as M, cmdConsolidate as N, looksLikePath as O, cmdDetect as P, cmdList$1 as R, legacy as S, buildHarness as T, findMovedPath as U, cmdTag$1 as V, cmdList as _, newTop as a, cmdSlug as b, planOpen as c, runNewDefault as d, sessionCommand as f, cmdInfo as g, cmdAutoRoute as h, lsCommand as i, cmdAlias as j, prepareDir as k, renameTop as l, cmdActive as m, collectRows as n, oneLine as o, sessionDir as p, collectView as r, openTop as s, applyProfileChat as t, rowsTable as u, cmdRename as v, modelFor as w, cmdTag as x, cmdRoute as y, cmdMove as z };
-//# sourceMappingURL=session-8iqQDkqb.mjs.map
+//# sourceMappingURL=session-Dn5OJXlg.mjs.map

package/dist/{session-scan-BJI_ZO8M.mjs → session-scan-B57dNuA4.mjs}

@@ -4,6 +4,6 @@ import "./config-Bu1_vbY8.mjs";
 import "./paths-CHifubDh.mjs";
 import "./status-ggJ7lgVg.mjs";
 import "./scope-D-h6F6DN.mjs";
-import { a as resolveSessionByNameOrId, c as transcriptCustomTitle, i as resolveFriendlyName, n as loadBrokerNames, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "./session-scan-W-gbwJHM.mjs";
+import { a as resolveSessionByNameOrId, c as transcriptCustomTitle, i as resolveFriendlyName, n as loadBrokerNames, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "./session-scan-DUn10MBd.mjs";
 
 export { loadBrokerNames, transcriptCustomTitle };

package/dist/{session-scan-W-gbwJHM.mjs → session-scan-DUn10MBd.mjs}

@@ -137,7 +137,7 @@ function loadBrokerNames(registryPath = AIBROKER_REGISTRY, mapPath) {
 /** Build encoded_dir → root_path map from PAI registry (authoritative cwd). */
 async function buildRegistryRootPathMap() {
 	try {
-		const { getRegistryBackend } = await import("./factory-Bsib-qDG.mjs");
+		const { getRegistryBackend } = await import("./factory-Bs9imVMq.mjs");
 		const projects = await (await getRegistryBackend()).listProjects();
 		const map = /* @__PURE__ */ new Map();
 		for (const p of projects) if (p.encoded_dir) map.set(p.encoded_dir, p.root_path);
@@ -870,4 +870,4 @@ function transcriptCustomTitle(claudeSessionId, projectsDir = CLAUDE_PROJECTS_DI
 
 //#endregion
 export { resolveSessionByNameOrId as a, transcriptCustomTitle as c, resolveFriendlyName as i, loadBrokerNames as n, scanCacheFilePath as o, migrateSessionScanCache as r, scanSessions as s, fmtAge as t };
-//# sourceMappingURL=session-scan-W-gbwJHM.mjs.map
+//# sourceMappingURL=session-scan-DUn10MBd.mjs.map