@tekmidian/pai 1.0.6 → 1.0.7

package/dist/cli/index.mjs

@@ -2,28 +2,28 @@
 import { _ as warn$1, a as fmtDate, c as ok$1, d as scaffoldProjectDirs, f as shortenPath, g as stripAnsi, h as smartDecodeDir, i as err, l as renderTable$1, m as slugify, n as dim$1, o as header, r as encodeDir, s as now, t as bold$1, u as resolvePath } from "../utils-J2b9y8PC.mjs";
 import { _ as paiHomePath, a as paiCacheDir, c as PaiFileMigrationError, d as defaultPaiHomeDir, f as legacyConfigDir, g as paiHomeDir, h as migratePaiFile, l as claudeHomeDir, m as migratePaiDir, o as paiSocketPath, r as daemonLogPath, s as schedulerLogPath, u as claudeProjectsDir, v as resolvePaiFile } from "../runtime-paths-twfV23YL.mjs";
 import { a as slugify$1, i as parseSessionFilename } from "../migrate-C2z1YmWC.mjs";
-import { Et as appendLedger, M as readWorkersSection, R as LOOPBACK_HOST, _t as DEFAULT_CONTEXT_WINDOW, bt as stripModelVariant, c as WorkersConfigError, et as relocateWorkersYaml, f as escalationCloud, m as isLocalProvider, p as getProviderOrNative, rt as workersYamlPath, t as ANTHROPIC_NATIVE, v as nativeAnthropicModels, yt as contextWindowFromModelId } from "../config-Bz8pAU5Q.mjs";
+import { Et as appendLedger, M as readWorkersSection, R as LOOPBACK_HOST, _t as DEFAULT_CONTEXT_WINDOW, bt as stripModelVariant, c as WorkersConfigError, et as relocateWorkersYaml, f as escalationCloud, m as isLocalProvider, p as getProviderOrNative, rt as workersYamlPath, t as ANTHROPIC_NATIVE, v as nativeAnthropicModels, yt as contextWindowFromModelId } from "../config-DGV64YJa.mjs";
 import { A as DEFAULT_PG_CONNECTION_TIMEOUT_MS, C as migrateMainConfigToYaml, F as quoteIdent, M as isContainerTarget, N as postgresConnectionString, O as readJsonStrict, P as postgresFullTarget, S as MainConfigError, T as resolvedMainConfigPath, c as loadConfig, d as paiConfigYamlFilePath, f as readMainConfigRaw, h as effectiveMainConfig, j as assertPgName, k as writeJsonAtomic, l as migrateConfigFile, n as CONFIG_FILE$2, o as expandHome, p as writeMainConfigRaw, t as CONFIG_DIR, u as paiConfigFilePath } from "../config-SlZ-Z52i.mjs";
-import { i as ledgerPath, n as ensureNoMcpConfig, r as eventsPath, u as workersLogDir } from "../paths-CypxFTfn.mjs";
-import "../worktree-O_kU6Q3y.mjs";
-import { K as writeSectionToForge, R as formatStale, V as loadStatusConfig, W as upsertSection, b as loadStatusesCached, g as isLive, h as isChatPane, v as loadStatus, y as loadStatuses } from "../status-Cecau8Ps.mjs";
-import { A as readClaudeJson, N as writeClaudeJson, S as inputSideTokens, h as poolSettings, i as bundleBuildStamp, j as registerMcpScript, k as mcpEntryRunsScript, v as readPoolState, w as expandMcpNames } from "../pool-9EsbKD-U.mjs";
-import { a as unregistrableReason, s as worktreeReason } from "../registrable-Dxs4oKIj.mjs";
-import "../pai-marker-D6OoVbM_.mjs";
+import { i as ledgerPath, n as ensureNoMcpConfig, r as eventsPath, u as workersLogDir } from "../paths-BwfwHOvN.mjs";
+import "../worktree-7ZS3RBf8.mjs";
+import { K as writeSectionToForge, R as formatStale, V as loadStatusConfig, W as upsertSection, b as loadStatusesCached, g as isLive, h as isChatPane, v as loadStatus, y as loadStatuses } from "../status-DTMT5lyn.mjs";
+import { A as readClaudeJson, N as writeClaudeJson, S as inputSideTokens, h as poolSettings, i as bundleBuildStamp, j as registerMcpScript, k as mcpEntryRunsScript, v as readPoolState, w as expandMcpNames } from "../pool-CFeHGX7q.mjs";
+import { a as unregistrableReason, s as worktreeReason } from "../registrable-D_4qXCnq.mjs";
+import "../pai-marker-kA0iM7rP.mjs";
 import "../helpers-CRuBUas3.mjs";
 import { t as applyRecencyBoost } from "../search-RSyeQqj1.mjs";
 import { t as dropItermBundleId } from "../env-BE8mrsxr.mjs";
-import { a as ownerSessionName, d as terminalHasName } from "../scope-BTWstJ1B.mjs";
-import { At as resolveBindAddress, Bn as setParkConfigSource, Dn as allSetups, Dt as routerPort, E as budgetCache, Et as routerHandler, F as LimitsCache, Gn as appendUsage, Hn as recordDuration, In as setupsPath, Kn as formatSessionStats, Nn as saveSetup, On as downLocalProviders, Ot as defaultV1Guard, Sn as providerHostPort, U as computeInventory, Un as aggregate, Vn as sharedParker, W as currentInventory, Wn as aggregateBySession, Xn as parseSince, Y as inventoryText, Zn as readUsage, at as readInventoryInput, jn as loadSaved, kt as displayHost, m as readRoutingState, pn as readProfiles, pt as isLoopbackProvider, qn as formatStats, qt as sessionStartTarget, un as SESSION_NAME_ENV, vn as localProviderForDelegation, x as SESSION_WORKER_PROVIDER_ENV, xt as routeVerdictLine, zn as parkConfigFrom } from "../routing-aJKMIagQ.mjs";
+import { a as ownerSessionName, d as terminalHasName } from "../scope-BRcaPw5D.mjs";
+import { At as resolveBindAddress, Bn as setParkConfigSource, Dn as allSetups, Dt as routerPort, E as budgetCache, Et as routerHandler, F as LimitsCache, Gn as appendUsage, Hn as recordDuration, In as setupsPath, Kn as formatSessionStats, Nn as saveSetup, On as downLocalProviders, Ot as defaultV1Guard, Sn as providerHostPort, U as computeInventory, Un as aggregate, Vn as sharedParker, W as currentInventory, Wn as aggregateBySession, Xn as parseSince, Y as inventoryText, Zn as readUsage, at as readInventoryInput, jn as loadSaved, kt as displayHost, m as readRoutingState, pn as readProfiles, pt as isLoopbackProvider, qn as formatStats, qt as sessionStartTarget, un as SESSION_NAME_ENV, vn as localProviderForDelegation, x as SESSION_WORKER_PROVIDER_ENV, xt as routeVerdictLine, zn as parkConfigFrom } from "../routing-CF0wlR-_.mjs";
 import { n as minOf } from "../min-max-DrSRUaWQ.mjs";
-import "../tool-errors-BFw1gv-z.mjs";
-import "../wait-C5iWILj_.mjs";
+import "../tool-errors-BOW2n882.mjs";
+import "../wait-BindDA5w.mjs";
 import "../local-tiers-CqwGUcEn.mjs";
-import { a as buildsDir, c as listBuilds, f as removeTicket, h as tryStart, i as buildNext, o as enqueue, p as renderBuildQueue, r as buildLogPath, s as getTicket, u as patchTicket, v as poolSlots, y as slotsFor } from "../caller-identity-C6Nc96iM.mjs";
+import { a as buildsDir, c as listBuilds, f as removeTicket, h as tryStart, i as buildNext, o as enqueue, p as renderBuildQueue, r as buildLogPath, s as getTicket, u as patchTicket, v as poolSlots, y as slotsFor } from "../caller-identity-DPDSrZE2.mjs";
 import { d as setSchedConfigSource, f as sharedScheduler, i as mirrorTo, s as schedConfigFrom } from "../scheduler-CtUyWJ3O.mjs";
-import { i as effectiveCap, o as providerCap, r as capacityOf } from "../capacity-B2PgKAg4.mjs";
+import { i as effectiveCap, o as providerCap, r as capacityOf } from "../capacity-CThSydrd.mjs";
 import "../local-instances-DhF4_sV2.mjs";
-import { n as tierProviderNames, t as isLocalCandidate } from "../local-candidate-DFd4pp-w.mjs";
+import { n as tierProviderNames, t as isLocalCandidate } from "../local-candidate-C2FGhf54.mjs";
 import { n as OPT, t as CliError } from "../define-CjJsmq-6.mjs";
 import { a as getStorageBackend, c as MergeError, f as humanDuration, i as getRegistryBackend, l as federationDbPath, o as oldRegistryPath, r as createStorageBackend, s as registryDbPath, u as oldFederationPath } from "../factory-CYwa0jYj.mjs";
 import { c as resolveFromModule, i as retryTransient, n as embedChunksWithBackend, r as indexProjectWithBackend, s as packageRoot } from "../postgres-BL5oBBgY.mjs";
@@ -32,34 +32,34 @@ import "../embeddings-BVq3esBF.mjs";
 import "../router-D2476pOp.mjs";
 import { t as detectProject } from "../detect-DLjeYwnt.mjs";
 import { n as getProject$1, o as requireProject, r as getProjectAliases, s as resolveIdentifier } from "../helpers-Dj2nY56t.mjs";
-import { a as resolveHome, c as upsertSession, d as scanTranscriptFolders, f as transcriptFiles, l as claudeProjectsDir$1, n as loadScanConfig, o as saveScanConfig, r as migrateScanConfig, s as upsertProject, t as cmdScan, u as findMovedProjects } from "../scan-CNMcltOX.mjs";
-import { A as cmdAdd, B as cmdRebind, F as cmdEdit, H as cmdUnarchive, I as cmdGo, L as cmdInfo$1, M as cmdArchive, N as cmdConsolidate, P as cmdDetect, R as cmdList$1, S as legacy, U as findMovedPath, V as cmdTag$1, _ as cmdList, a as newTop, b as cmdSlug, f as sessionCommand, g as cmdInfo, h as cmdAutoRoute, i as lsCommand, j as cmdAlias, l as renameTop, m as cmdActive, r as collectView, s as openTop, v as cmdRename, x as cmdTag, y as cmdRoute, z as cmdMove } from "../session-HBYOABWU.mjs";
-import { a as detectCurrentProviderName, i as detectCurrentModel, n as buildLaunchPlan, o as launchableProviderNames, r as buildLaunchRows, s as maskLaunchEnv } from "../launch-Bn2Zf90h.mjs";
-import { a as colorEnabled, c as renderCommandHelp, d as renderOverview, f as renderTable$2, l as renderMarkdown, m as usageLine, o as makeStyle, p as suggest, s as mdCommand, u as renderMore } from "../health-D0mUAVdw.mjs";
-import { a as providerResumePlan, n as launchInDir, o as restoreTopLevel, r as launchPrompt, s as resumeArgvText, t as hasConversation } from "../launch-BZT3JDoZ.mjs";
-import { _ as setupsTable, a as lastSetup, m as rootCommand } from "../root-DmOzMeSv.mjs";
+import { a as resolveHome, c as upsertSession, d as scanTranscriptFolders, f as transcriptFiles, l as claudeProjectsDir$1, n as loadScanConfig, o as saveScanConfig, r as migrateScanConfig, s as upsertProject, t as cmdScan, u as findMovedProjects } from "../scan-ew8M6tTH.mjs";
+import { A as cmdAdd, B as cmdRebind, F as cmdEdit, H as cmdUnarchive, I as cmdGo, L as cmdInfo$1, M as cmdArchive, N as cmdConsolidate, P as cmdDetect, R as cmdList$1, S as legacy, U as findMovedPath, V as cmdTag$1, _ as cmdList, a as newTop, b as cmdSlug, f as sessionCommand, g as cmdInfo, h as cmdAutoRoute, i as lsCommand, j as cmdAlias, l as renameTop, m as cmdActive, r as collectView, s as openTop, v as cmdRename, x as cmdTag, y as cmdRoute, z as cmdMove } from "../session-C1JnDXvP.mjs";
+import { a as detectCurrentProviderName, i as detectCurrentModel, n as buildLaunchPlan, o as launchableProviderNames, r as buildLaunchRows, s as maskLaunchEnv } from "../launch-CV6oPHI2.mjs";
+import { a as colorEnabled, c as renderCommandHelp, d as renderOverview, f as renderTable$2, l as renderMarkdown, m as usageLine, o as makeStyle, p as suggest, s as mdCommand, u as renderMore } from "../health-Bb2U4PNK.mjs";
+import { a as providerResumePlan, n as launchInDir, o as restoreTopLevel, r as launchPrompt, s as resumeArgvText, t as hasConversation } from "../launch-Dy8qQnSD.mjs";
+import { _ as setupsTable, a as lastSetup, m as rootCommand } from "../root-B-ZYiEgi.mjs";
 import { n as fetchLiveSessions, r as sendToSession, t as callAiBroker } from "../aibroker-client-CXsyC7A8.mjs";
-import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-CX3MKCNg.mjs";
-import { A as routerPidFile, B as usageContextTokens, D as routerHandoverFile, E as probeRouter, F as startHandover, I as paneWaiver, L as launchPane, M as routerSwapArgs, P as spawnRouter, R as noTerminalReasons, S as usageJson, T as projectLaunchConfig, b as renderUsage, c as reportOriginWithHost, f as dirtyPaths, g as realRunnerDeps, j as routerRunningPid, k as routerLogFile, l as runMessenger, s as finishDetached, u as startDetached, w as pinNotices, x as transcriptUsage, y as priceTableText } from "../run-DE9Q0ldN.mjs";
-import { C as readRunLog, D as resumeState, E as requestPlanStop, F as runLogPath, I as PlanTracker, M as dirtyConflicts, O as runExitCode, Ot as runPaneExec, P as loadPlan, S as planStopPath, T as renderStatus, Y as readRunLock, ht as resolveHostSession, j as PlanError, k as runPlan, l as PlanReporter, nt as closePaneForWorker, ot as inVisiblePane, q as planLockPath, rt as closeSelfPane, u as QueueReporter, vt as writePaneTitle, w as renderSchedule, x as planStatus, y as blockedMessage } from "../controls-rIItFeIJ.mjs";
-import "../endreason-C2-hYK0_.mjs";
-import { B as scanTranscript, H as loadBuildsConfig, L as listRules, N as endBuildWait, P as claudeSessionTranscript, R as loadRules, V as maskSecrets, j as beginBuildWait, q as psTable, z as userRuleDirs } from "../render-jPpMrudf.mjs";
-import "../operator-Br6GeswF.mjs";
-import "../kill-tree-DPiMscaY.mjs";
-import { s as poolReloadLive } from "../pool-cli-Db0uDwB9.mjs";
-import "../chain-CtK49-Ma.mjs";
-import { _ as issueClaims, a as branchDiff, b as workerCommand, c as runQueue, d as loadSettings, f as move, g as issueClaim, h as renderReview, i as projectChecks, l as QueueStore, m as renderList, n as initProject, o as realQueueDeps, p as queueStatePath, r as isGitProject, s as acceptItems, t as formatCheck, u as again, v as issueStale } from "../project-setup-DHxdJjEc.mjs";
-import { m as runInPane, r as closeFinishedPanes } from "../pane-audit-DLYy9-4g.mjs";
-import "../viewer-DvBg6N22.mjs";
-import { g as setWorkersEnabled, s as describeProviders } from "../providers-BNV7CzC-.mjs";
-import { $ as exportDefaultLayout, B as mergeSettings, G as cachedRows, J as handleCockpit, K as cachedSessionMap, Q as warmCockpit, W as SystemMonitor, X as setEndpointHealth, Y as setActionHooks, Z as setRuntimeSampler, ct as providersCommand, et as createEndpointHealth, it as withWorkerAttribution, n as WORKER_CONFIG_COMMANDS, nt as loadWorkerWindows, q as cachedWorkerWindows, rt as sessionDisplayName, t as PROVIDER_EDIT_COMMANDS, tt as loadSessionMap, z as installWorkers } from "../worker-config-DkONNk_H.mjs";
-import { a as listConfigOp, i as getConfigValueOp, n as formatConfigGetOutput, o as setConfigValueOp, r as formatConfigSource, s as unsetConfigValueOp, t as MainConfigOpsError } from "../main-config-ops-rda08BCD.mjs";
-import { H as acquireRun, U as readRun, V as cockpitProbeSettings, k as readRuntimeCommands } from "../cockpit-actions-D1OPP6Es.mjs";
+import { a as resolveSessionByNameOrId, o as scanCacheFilePath, r as migrateSessionScanCache, s as scanSessions, t as fmtAge } from "../session-scan-DihMibI-.mjs";
+import { A as routerPidFile, B as usageContextTokens, D as routerHandoverFile, E as probeRouter, F as startHandover, I as paneWaiver, L as launchPane, M as routerSwapArgs, P as spawnRouter, R as noTerminalReasons, S as usageJson, T as projectLaunchConfig, b as renderUsage, c as reportOriginWithHost, f as dirtyPaths, g as realRunnerDeps, j as routerRunningPid, k as routerLogFile, l as runMessenger, s as finishDetached, u as startDetached, w as pinNotices, x as transcriptUsage, y as priceTableText } from "../run-CAjfKBQV.mjs";
+import { C as readRunLog, D as resumeState, E as requestPlanStop, F as runLogPath, I as PlanTracker, M as dirtyConflicts, O as runExitCode, Ot as runPaneExec, P as loadPlan, S as planStopPath, T as renderStatus, Y as readRunLock, ht as resolveHostSession, j as PlanError, k as runPlan, l as PlanReporter, nt as closePaneForWorker, ot as inVisiblePane, q as planLockPath, rt as closeSelfPane, u as QueueReporter, vt as writePaneTitle, w as renderSchedule, x as planStatus, y as blockedMessage } from "../controls-ByrcupcA.mjs";
+import "../endreason-BjPom527.mjs";
+import { B as userRuleDirs, H as maskSecrets, J as psTable, L as listRules, N as endBuildWait, P as claudeSessionTranscript, R as loadRules, U as loadBuildsConfig, V as scanTranscript, j as beginBuildWait, z as projectRuleDirs } from "../render-CbifCwTb.mjs";
+import "../operator-lRGvYr3D.mjs";
+import "../kill-tree-DTmiEb3T.mjs";
+import { s as poolReloadLive } from "../pool-cli-DOLgPgOM.mjs";
+import "../chain-BvdKqRiZ.mjs";
+import { _ as issueClaims, a as branchDiff, b as workerCommand, c as runQueue, d as loadSettings, f as move, g as issueClaim, h as renderReview, i as projectChecks, l as QueueStore, m as renderList, n as initProject, o as realQueueDeps, p as queueStatePath, r as isGitProject, s as acceptItems, t as formatCheck, u as again, v as issueStale } from "../project-setup-i5D0xkTn.mjs";
+import { m as runInPane, r as closeFinishedPanes } from "../pane-audit-DUuilP1V.mjs";
+import "../viewer-4BU8w_gK.mjs";
+import { g as setWorkersEnabled, s as describeProviders } from "../providers-BC2Myo_O.mjs";
+import { $ as exportDefaultLayout, B as mergeSettings, G as cachedRows, J as handleCockpit, K as cachedSessionMap, Q as warmCockpit, W as SystemMonitor, X as setEndpointHealth, Y as setActionHooks, Z as setRuntimeSampler, ct as providersCommand, et as createEndpointHealth, it as withWorkerAttribution, n as WORKER_CONFIG_COMMANDS, nt as loadWorkerWindows, q as cachedWorkerWindows, rt as sessionDisplayName, t as PROVIDER_EDIT_COMMANDS, tt as loadSessionMap, z as installWorkers } from "../worker-config-CdPmb4_2.mjs";
+import { a as listConfigOp, i as getConfigValueOp, n as formatConfigGetOutput, o as setConfigValueOp, r as formatConfigSource, s as unsetConfigValueOp, t as MainConfigOpsError } from "../main-config-ops-C_fkINDv.mjs";
+import { H as acquireRun, U as readRun, V as cockpitProbeSettings, k as readRuntimeCommands } from "../cockpit-actions-BgdKB9G3.mjs";
 import { n as PaiClient } from "../ipc-client-CmagIFLh.mjs";
-import { a as EMBED_PASS_BATCH_SIZE, c as liveYieldCheck, n as DEFAULT_EMBED_MAX_LOAD, o as formatEmbedStatus, r as DEFAULT_EMBED_MAX_MINUTES, s as lastRecordedEmbedPass } from "../embed-pass-CN1D8MXl.mjs";
-import { a as liveWorkersConfigShadows, i as totalUsageTokens, r as parseSessionUsage } from "../session-usage-CCmPFFa6.mjs";
-import "../fallback-CwPSCrX8.mjs";
-import { $t as readBodyFile, At as jobPaths, Ct as historyDir, D as migrateWorkQueue, Et as obsidianEnabled, Ft as sessionKeepaliveLedgerSummary, Gt as resolveDaemonPid, Ht as writeQuiet, Lt as describeQuiet, M as migrateSummaryCooldowns, Nt as loadSessionKeepaliveState, Qt as findNotesDir$1, Rt as nextOccurrence, Ut as LAUNCHD_LABEL, Xt as applyContinue, Yt as appendCheckpointToNote, Zt as findLatestNote, c as proposeFromTranscript, en as restartRouter, g as migrateKgBackfillState, h as backfillKgFromNotes, i as getLesson, jt as reapJob, kt as migrateIdentityFile, l as setState, n as LESSON_STATES, o as listLessons, p as reexecBackground, qt as readContextHandoverCache, r as addLesson, s as promoteLesson, t as LESSON_KINDS, wt as OBSIDIAN_DISABLED_MESSAGE, zt as readQuiet } from "../lessons-CFVU0cwA.mjs";
+import { a as EMBED_PASS_BATCH_SIZE, c as liveYieldCheck, n as DEFAULT_EMBED_MAX_LOAD, o as formatEmbedStatus, r as DEFAULT_EMBED_MAX_MINUTES, s as lastRecordedEmbedPass } from "../embed-pass-DdTMn4DH.mjs";
+import { a as liveWorkersConfigShadows, i as totalUsageTokens, r as parseSessionUsage } from "../session-usage-BRIWFYPS.mjs";
+import "../fallback-CQ8_CuVu.mjs";
+import { $t as readBodyFile, At as jobPaths, Ct as historyDir, D as migrateWorkQueue, Et as obsidianEnabled, Ft as sessionKeepaliveLedgerSummary, Gt as resolveDaemonPid, Ht as writeQuiet, Lt as describeQuiet, M as migrateSummaryCooldowns, Nt as loadSessionKeepaliveState, Qt as findNotesDir$1, Rt as nextOccurrence, Ut as LAUNCHD_LABEL, Xt as applyContinue, Yt as appendCheckpointToNote, Zt as findLatestNote, c as proposeFromTranscript, en as restartRouter, g as migrateKgBackfillState, h as backfillKgFromNotes, i as getLesson, jt as reapJob, kt as migrateIdentityFile, l as setState, n as LESSON_STATES, o as listLessons, p as reexecBackground, qt as readContextHandoverCache, r as addLesson, s as promoteLesson, t as LESSON_KINDS, wt as OBSIDIAN_DISABLED_MESSAGE, zt as readQuiet } from "../lessons-CdmqZD0G.mjs";
 import { n as queriesDirPath, t as migrateQueriesDir } from "../query-feedback-BWl2HRwN.mjs";
 import { appendFileSync, chmodSync, closeSync, copyFileSync, cpSync, createReadStream, createWriteStream, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
@@ -830,7 +830,7 @@ function routerSamplerDeps(sched, engineStatusTimeoutMs = () => DEFAULT_RUNTIME_
 	});
 	return {
 		inventory: async () => {
-			const { currentInventory } = await import("../model-inventory-BXv15B0d.mjs");
+			const { currentInventory } = await import("../model-inventory-BYNrSTaY.mjs");
 			return currentInventory();
 		},
 		sched,
@@ -845,7 +845,7 @@ function routerSamplerDeps(sched, engineStatusTimeoutMs = () => DEFAULT_RUNTIME_
 			}
 		},
 		async rssMb(port) {
-			const { processTreeRssMb } = await import("../model-inventory-BXv15B0d.mjs");
+			const { processTreeRssMb } = await import("../model-inventory-BYNrSTaY.mjs");
 			const pid = (await exec("lsof", [
 				"-ti",
 				`tcp:${port}`,
@@ -1214,9 +1214,9 @@ const runCommand = {
 		sampler.start();
 		setRuntimeSampler(sampler);
 		setActionHooks({ runLocalJob: async (kind, tier) => {
-			const { startTier, stopAll } = await import("../worker-config-BmcJ9R0U.mjs");
-			const { readLocalConfig } = await import("../local-tiers-DSlIYvvm.mjs");
-			const { workersYamlPath } = await import("../workers-config-DwzrtdYu.mjs");
+			const { startTier, stopAll } = await import("../worker-config-CfV2dgSb.mjs");
+			const { readLocalConfig } = await import("../local-tiers-X_dQfI4Q.mjs");
+			const { workersYamlPath } = await import("../workers-config-2VipVOYk.mjs");
 			const cfg = readLocalConfig(workersYamlPath());
 			if (kind === "off") return void await stopAll(cfg);
 			const t = cfg.tiers[tier];
@@ -1593,7 +1593,7 @@ const modelsCommand = {
 		if (words[0] === "add") {
 			const source = words[1];
 			if (!source) throw new Error("usage: pai models add <hf-id|path> [--name n] [--download] [--try]");
-			const { addModel } = await import("../models-add-5yXTyz3g.mjs");
+			const { addModel } = await import("../models-add-Dc7VXmcu.mjs");
 			const r = await addModel({
 				source,
 				name: typeof ctx.opts.name === "string" ? ctx.opts.name : void 0,
@@ -1608,7 +1608,7 @@ const modelsCommand = {
 		if (op) {
 			const runtime = words[1];
 			if (!runtime) throw new Error(`usage: pai models ${op} <runtime> (configured: ${Object.keys(readRuntimeCommands()).join(", ") || "none"})`);
-			const { defaultDeps, runtimeStartStop } = await import("../cockpit-actions-C73mJAJ8.mjs");
+			const { defaultDeps, runtimeStartStop } = await import("../cockpit-actions-DNl0rKfW.mjs");
 			const r = await runtimeStartStop(runtime, op, defaultDeps(), { model: typeof ctx.opts.model === "string" ? ctx.opts.model : void 0 });
 			process.stdout.write(r.message + "\n");
 			if (!r.ok) process.exitCode = 1;
@@ -8969,7 +8969,7 @@ function cmdLogs(opts) {
 	return 0;
 }
 async function daemonServeCmd() {
-	const { serve } = await import("../daemon-176qA79N.mjs");
+	const { serve } = await import("../daemon-iymy18Ie.mjs");
 	const { loadConfig: lc, ensureConfigDir } = await import("../config-DHgPx3ER.mjs");
 	ensureConfigDir();
 	await serve(lc());
@@ -18656,7 +18656,7 @@ async function cmdUnregister(slug, opts = {}) {
 * deprecated alias that forwards here with a stderr notice.
 */
 async function projectListCmd(opts) {
-	const { cmdMain } = await import("../main-resolver-BKwI0I6H.mjs");
+	const { cmdMain } = await import("../main-resolver-CN_sfG1R.mjs");
 	await cmdMain(void 0, void 0, opts);
 	return 0;
 }
@@ -20079,7 +20079,7 @@ async function registryScanCmd(opts) {
 		return 0;
 	}
 	if (opts.filterReport) {
-		const { reportUnregistrable } = await import("../registrable-BwFiqazy.mjs");
+		const { reportUnregistrable } = await import("../registrable-Ct0DKNKS.mjs");
 		const r = await reportUnregistrable(await getRegistryBackend());
 		console.log(`Registry rows: ${r.total}`);
 		console.log(`  matching the registration filter: ${r.matching} (${r.matchingMissing} with a missing path)`);
@@ -24464,7 +24464,7 @@ function auditFiles(paths) {
 * markdown copy — run 11 measured both present on the same turn, so both are
 * counted.
 */
-function parseLines(path) {
+function parseLines$1(path) {
 	const lines = [];
 	for (const raw of readFileSync(path, "utf8").split("\n")) {
 		if (!raw.trim()) continue;
@@ -24538,7 +24538,7 @@ function apiContextOf(usage) {
 */
 function turnBreakdown(path, turn) {
 	if (!existsSync(path)) return null;
-	const lines = parseLines(path);
+	const lines = parseLines$1(path);
 	const byUuid = /* @__PURE__ */ new Map();
 	for (const l of lines) if (l.uuid) byUuid.set(l.uuid, l);
 	const seen = /* @__PURE__ */ new Set();
@@ -24644,7 +24644,7 @@ function firstTurnBreakdown(path) {
 	if (!existsSync(path)) return empty;
 	const tb = turnBreakdown(path, 1);
 	if (!tb) return empty;
-	const lines = parseLines(path);
+	const lines = parseLines$1(path);
 	const byUuid = /* @__PURE__ */ new Map();
 	let firstIndex = -1;
 	for (let i = 0; i < lines.length; i++) {
@@ -27012,7 +27012,7 @@ async function auditScanCmd(opts) {
 		console.error(err("  No transcript found."));
 		return 1;
 	}
-	const { rules, errors } = loadRules(userRuleDirs(process.cwd()));
+	const { rules, errors } = loadRules(userRuleDirs(process.cwd()), { projectDirs: projectRuleDirs(process.cwd()) });
 	for (const e of errors) console.error(dim$1(`rule: ${e}`));
 	const findings = await scanTranscript(target, rules);
 	if (opts.json) {
@@ -27506,6 +27506,26 @@ const EDIT_TOOLS = new Set([
 const HOOK_MARKER = "# PAI-GIT-NOTES: managed by `pai git setup`";
 const NOTES_REF = "refs/notes/pai";
 const LOOKBACK_MS = 6 * 3600 * 1e3;
+const MAX_CAPTURE_BYTES = 8 * 1024 * 1024;
+const HOOK_BUDGET_MS = 500;
+/** A refusal `pai git setup` reports to the user as-is. */
+var GitNotesError = class extends Error {};
+/** Call `onLine` for each line of `file`, reading in chunks; stops early when it returns false. */
+function eachLine(file, onLine) {
+	const fd = openSync(file, "r");
+	try {
+		const buf = Buffer.alloc(64 * 1024);
+		let rest = "";
+		for (let n = readSync(fd, buf, 0, buf.length, null); n > 0; n = readSync(fd, buf, 0, buf.length, null)) {
+			const parts = (rest + buf.toString("utf8", 0, n)).split("\n");
+			rest = parts.pop() ?? "";
+			for (const l of parts) if (!onLine(l)) return;
+		}
+		if (rest) onLine(rest);
+	} finally {
+		closeSync(fd);
+	}
+}
 const real = (p) => {
 	try {
 		return realpathSync(p);
@@ -27531,43 +27551,47 @@ function jsonlFiles(dir, sinceMs, out = []) {
 	return out;
 }
 /** Sessions whose Edit/Write-style tool events (after `sinceMs`) touched any of `paths`. */
-function sessionsTouching(paths, sinceMs, captureDir) {
+function sessionsTouching(paths, sinceMs, captureDir, deadline = Infinity) {
 	const wanted = new Map(paths.map((p) => [real(p), p]));
 	const bySession = /* @__PURE__ */ new Map();
 	for (const file of jsonlFiles(captureDir, sinceMs)) {
-		let text;
+		if (Date.now() > deadline) break;
 		try {
-			text = readFileSync(file, "utf8");
+			if (statSync(file).size > MAX_CAPTURE_BYTES) continue;
 		} catch {
 			continue;
 		}
-		for (const line of text.split("\n")) {
-			if (!line.includes("file_path") && !line.includes("notebook_path")) continue;
-			let e;
-			try {
-				e = JSON.parse(line);
-			} catch {
-				continue;
-			}
-			const tool = e.tool ?? e.payload?.tool_name;
-			if (!EDIT_TOOLS.has(tool)) continue;
-			const ts = typeof e.timestamp === "number" ? e.timestamp : Date.parse(e.timestamp);
-			if (Number.isFinite(ts) && ts < sinceMs) continue;
-			const input = e.input ?? e.payload?.tool_input ?? {};
-			const fp = input.file_path ?? input.notebook_path;
-			const sessionId = e.session ?? e.session_id;
-			if (typeof fp !== "string" || typeof sessionId !== "string") continue;
-			const orig = wanted.get(real(fp));
-			if (!orig) continue;
-			const workerId = e.workerId ?? e.worker_id ?? e.env?.PAI_WORKER_ID ?? e.payload?.env?.PAI_WORKER_ID;
-			const cur = bySession.get(sessionId) ?? {
-				sessionId,
-				files: []
-			};
-			if (typeof workerId === "string" && !cur.workerId) cur.workerId = workerId;
-			if (!cur.files.includes(orig)) cur.files.push(orig);
-			bySession.set(sessionId, cur);
-		}
+		try {
+			eachLine(file, (line) => {
+				if (Date.now() > deadline) return false;
+				if (!line.includes("file_path") && !line.includes("notebook_path")) return true;
+				let e;
+				try {
+					e = JSON.parse(line);
+				} catch {
+					return true;
+				}
+				const tool = e.tool ?? e.payload?.tool_name;
+				if (!EDIT_TOOLS.has(tool)) return true;
+				const ts = typeof e.timestamp === "number" ? e.timestamp : Date.parse(e.timestamp);
+				if (Number.isFinite(ts) && ts < sinceMs) return true;
+				const input = e.input ?? e.payload?.tool_input ?? {};
+				const fp = input.file_path ?? input.notebook_path;
+				const sessionId = e.session ?? e.session_id;
+				if (typeof fp !== "string" || typeof sessionId !== "string") return true;
+				const orig = wanted.get(real(fp));
+				if (!orig) return true;
+				const workerId = e.workerId ?? e.worker_id ?? e.env?.PAI_WORKER_ID ?? e.payload?.env?.PAI_WORKER_ID;
+				const cur = bySession.get(sessionId) ?? {
+					sessionId,
+					files: []
+				};
+				if (typeof workerId === "string" && !cur.workerId) cur.workerId = workerId;
+				if (!cur.files.includes(orig)) cur.files.push(orig);
+				bySession.set(sessionId, cur);
+				return true;
+			});
+		} catch {}
 	}
 	return [...bySession.values()];
 }
@@ -27621,6 +27645,7 @@ const gitOk = (repo, args) => {
 };
 /** The post-commit work: note the sessions that edited the files of HEAD. Never throws. */
 function postCommitHook(repo, captureDir, env = process.env, now = Date.now()) {
+	const deadline = now + HOOK_BUDGET_MS;
 	try {
 		if (/rebase/.test(env.GIT_REFLOG_ACTION ?? "")) return false;
 		if (gitOk(repo, [
@@ -27642,7 +27667,8 @@ function postCommitHook(repo, captureDir, env = process.env, now = Date.now()) {
 			"--name-only",
 			"-r",
 			"HEAD"
-		]).split("\n").filter(Boolean).map((f) => join(top, f)), now - LOOKBACK_MS, captureDir));
+		]).split("\n").filter(Boolean).map((f) => join(top, f)), now - LOOKBACK_MS, captureDir, deadline));
+		if (Date.now() > deadline) return false;
 		return text ? writeNote(repo, "HEAD", text) : false;
 	} catch {
 		return false;
@@ -27659,13 +27685,17 @@ function hookPath(repo) {
 /** Install the post-commit hook, chaining an existing foreign hook as post-commit.pre-pai. */
 function setupGitNotes(repo) {
 	const hook = hookPath(repo);
+	const gitDirs = ["--git-dir", "--git-common-dir"].map((a) => real(resolve(repo, git(repo, ["rev-parse", a]))));
+	const hookDir = real(dirname(hook));
+	if (!gitDirs.some((d) => hookDir === d || hookDir.startsWith(d + sep))) throw new GitNotesError(`core.hooksPath points outside .git (${hook}); refusing to write a hook there. Unset it or install the hook yourself`);
 	const old = `${hook}.pre-pai`;
 	let chained = existsSync(old);
 	if (existsSync(hook) && !readFileSync(hook, "utf8").includes(HOOK_MARKER)) {
+		if (existsSync(old)) throw new GitNotesError(`${old} already exists; refusing to overwrite it. Move it away and re-run`);
 		renameSync(hook, old);
 		chained = true;
 	}
-	writeFileSync(hook, `#!/bin/sh\n${HOOK_MARKER}\n${chained ? "d=$(dirname \"$0\")\n[ -x \"$d/post-commit.pre-pai\" ] && \"$d/post-commit.pre-pai\" \"$@\"\n" : ""}pai git hook post-commit || true\n`);
+	writeFileSync(hook, `#!/bin/sh\n${HOOK_MARKER}\n${chained ? "d=$(dirname \"$0\")\n[ -x \"$d/post-commit.pre-pai\" ] && \"$d/post-commit.pre-pai\" \"$@\"\n" : ""}( pai git hook post-commit >/dev/null 2>&1 & )\n`);
 	chmodSync(hook, 493);
 	git(repo, [
 		"config",
@@ -27732,7 +27762,8 @@ const gitCommand = {
 					const r = setupGitNotes(repoOrFail());
 					process.stdout.write(`Installed ${r.hook}${r.chained ? " (existing hook chained)" : ""}\n`);
 					return 0;
-				} catch {
+				} catch (e) {
+					if (e instanceof GitNotesError) throw new CliError(e.message, "Fix it and re-run pai git setup");
 					throw new CliError("Not a git repository", "Run it inside a repository");
 				}
 			}
@@ -28106,33 +28137,60 @@ function sessionFiles(dir) {
 		return [];
 	}
 }
+const CHUNK = 64 * 1024;
+/** Parsed lines of `text`; the first and last may be cut by the chunk edge, so `partialFirst`/`partialLast` drop them. */
+function parseLines(text, partialFirst, partialLast) {
+	const lines = text.split("\n");
+	if (partialFirst) lines.shift();
+	if (partialLast) lines.pop();
+	const out = [];
+	for (const raw of lines) {
+		if (!raw.trim()) continue;
+		try {
+			out.push(JSON.parse(raw));
+		} catch {}
+	}
+	return out;
+}
+/** The session of one transcript, reading only its first and last 64 KB; null when the file vanished. */
 function toSession$1(harness, file, dir) {
 	const id = file.slice(0, -6);
+	const path = join(dir, file);
 	let startedAt;
 	let updatedAt;
 	let cwd;
+	let mtime;
 	try {
-		for (const raw of readFileSync(join(dir, file), "utf8").split("\n")) {
-			if (!raw.trim()) continue;
-			let obj;
+		const size = statSync(path).size;
+		mtime = new Date(statSync(path).mtimeMs).toISOString();
+		try {
+			const fd = openSync(path, "r");
 			try {
-				obj = JSON.parse(raw);
-			} catch {
-				continue;
-			}
-			if (typeof obj.cwd === "string" && obj.cwd) cwd ??= obj.cwd;
-			if (typeof obj.timestamp === "string" && obj.timestamp) {
-				startedAt ??= obj.timestamp;
-				updatedAt = obj.timestamp;
+				const read = (pos, len) => {
+					const buf = Buffer.alloc(len);
+					return buf.toString("utf8", 0, readSync(fd, buf, 0, len, pos));
+				};
+				const head = parseLines(read(0, Math.min(size, CHUNK)), false, size > CHUNK);
+				for (const obj of head) {
+					if (typeof obj.cwd === "string" && obj.cwd) cwd ??= obj.cwd;
+					if (typeof obj.timestamp === "string" && obj.timestamp) startedAt ??= obj.timestamp;
+					if (cwd && startedAt) break;
+				}
+				const from = Math.max(0, size - CHUNK);
+				const tail = parseLines(read(from, size - from), from > 0, false);
+				for (const obj of tail) if (typeof obj.timestamp === "string" && obj.timestamp) updatedAt = obj.timestamp;
+			} finally {
+				closeSync(fd);
 			}
-		}
-	} catch {}
-	const mtime = new Date(statSync(join(dir, file)).mtimeMs).toISOString();
+		} catch {}
+	} catch {
+		return null;
+	}
 	return {
 		harness,
 		id,
 		cwd,
-		path: join(dir, file),
+		path,
 		startedAt,
 		updatedAt: updatedAt ?? mtime
 	};
@@ -28150,7 +28208,10 @@ const claudeCodeAdapter = {
 		for (const d of dirs) {
 			const dir = join(projectsDir, d);
 			if (!existsSync(dir)) continue;
-			for (const f of sessionFiles(dir)) out.push(toSession$1(this.name, f, dir));
+			for (const f of sessionFiles(dir)) {
+				const sess = toSession$1(this.name, f, dir);
+				if (sess) out.push(sess);
+			}
 		}
 		const since = opts.sinceMs !== void 0 ? Date.now() - opts.sinceMs : void 0;
 		return out.filter((s) => since === void 0 || Date.parse(s.updatedAt) >= since).sort((a, b) => Date.parse(b.updatedAt) - Date.parse(a.updatedAt));
@@ -28511,9 +28572,11 @@ function splitSegments(command) {
 * Order is fixed: the first block hit wins, else the first confirm hit, else
 * the first warn hit. Text inside quotes is not a command, so rules test the
 * content with quoted strings removed; rules marked `quoted: true` also test
-* it with only the quote marks removed (as detectAttack did before);
-* confirm rules additionally test per-segment, so a quoted `git push -f` in a
-* commit message stays inert while a quoted `+main` refspec still counts.
+* it as written and with only the quote marks removed — every builtin block
+* rule whose payload can sit inside `bash -c "..."` is marked, and anchors on
+* command position so a message that merely mentions the payload stays
+* allowed. Confirm rules test per-segment, so a quoted `git push -f` in a commit
+* message stays inert while a quoted `+main` refspec still counts.
 */
 /** Quoted strings removed: text inside a commit message or echo is not a command. */
 function dropQuoted(segment) {
@@ -28532,7 +28595,7 @@ function ruleRegex(rule) {
 	const cached = regexCache.get(key);
 	if (cached) return cached;
 	try {
-		const re = new RegExp(rule.match, rule.flags ?? "");
+		const re = new RegExp(rule.match, (rule.flags ?? "").replace(/[gy]/g, ""));
 		regexCache.set(key, re);
 		return re;
 	} catch {
@@ -28603,7 +28666,13 @@ function sequenceHit(rule, steps) {
 		if (step.tool && !new RegExp(step.tool).test(tool ?? "Bash")) return false;
 		if (step.match.includes("\\1") && prior.length) {
 			const cap = prior[0][1];
-			if (!cap || !new RegExp(step.match.replace(/\\1/g, cap), step.flags ?? "").test(content)) return false;
+			if (!cap) return false;
+			const lit = cap.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+			try {
+				if (!new RegExp(step.match.replace(/\\1/g, () => lit), step.flags ?? "").test(content)) return false;
+			} catch {
+				return false;
+			}
 			continue;
 		}
 		const re = stepRegex(step);
@@ -28659,11 +28728,12 @@ function lintRules(rules) {
 //#endregion
 //#region src/cli/commands/rules.ts
 function listCmd(json) {
-	const { rules, errors } = listRules(userRuleDirs(process.cwd()));
+	const { rules, errors, ignored } = listRules(userRuleDirs(process.cwd()), { projectDirs: projectRuleDirs(process.cwd()) });
 	if (json) {
 		console.log(JSON.stringify({
 			rules,
-			errors
+			errors,
+			ignored
 		}, null, 2));
 		return 0;
 	}
@@ -28679,10 +28749,11 @@ function listCmd(json) {
 		r.severity === "off" ? "off" : "on"
 	])));
 	for (const e of errors) console.log(err(`load error: ${e}`));
+	for (const i of ignored) console.log(warn$1(`ignored: ${i}`));
 	return 0;
 }
 function lintCmd(json) {
-	const { rules, errors } = listRules(userRuleDirs(process.cwd()));
+	const { rules, errors } = listRules(userRuleDirs(process.cwd()), { projectDirs: projectRuleDirs(process.cwd()) });
 	const enabled = rules.filter((r) => r.severity !== "off");
 	const lints = lintRules(enabled);
 	const failed = lints.filter((l) => !l.ok);