@tekmidian/pai 1.0.6 → 1.0.7

package/dist/hooks/worker-proxy.mjs

@@ -8179,6 +8179,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8773,6 +8774,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8909,6 +8917,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,

package/dist/hooks/worker-status-line.mjs

@@ -8416,6 +8416,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num2(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num2(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num2(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num2(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num2(stagger.localDefaultSec, 20),
@@ -9008,6 +9009,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -9144,6 +9152,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,
@@ -10215,27 +10224,57 @@ var init_hang_probe = __esm({
 });
 
 // src/utils/redact.ts
-var REDACTED, REDACTED_RE, KEY_WORDS, VAL, REDACT_RULES, LINE_RULES, LONG_RUN, KEY_LINE;
+var REDACTED, REDACTED_RE, KEY_WORDS, PROSE, VAL, REDACT_RULES, LINE_RULES, LONG_RUN, LONG_RUN_MAX_LINE, KEY_LINE;
 var init_redact = __esm({
   "src/utils/redact.ts"() {
     "use strict";
     REDACTED = "[REDACTED]";
     REDACTED_RE = String.raw`\[REDACTED\]`;
     KEY_WORDS = "password|passwd|secret|token|api[_-]?key|credential|auth(?:orization)?|bearer";
+    PROSE = "is|are|was|were|be|to|of|in|on|for|and|or|the|a|an|that|this|it|not|out|here|there|so|as|at|by|with|if|when|which";
     VAL = String.raw`(?:"[^"]*"|'[^']*'|[^\s'"]+)`;
     REDACT_RULES = [
       {
         // `Authorization: Bearer xxx` / `Authorization: Basic xxx` — keep the scheme
         id: "authorization",
-        re: /(Authorization\s*:\s*)(Bearer|Basic)\s+(\S+)/gi,
+        re: /(Authorization\s*:\s*)(Bearer|Basic)\s+([^\s'"]+)/gi,
         replace: (_m, head, scheme) => `${head}${scheme} ${REDACTED}`
       },
+      {
+        // `Cookie: a=b; c=d` — keep the cookie names, redact every value
+        id: "cookie",
+        re: /((?:Set-)?Cookie\s*:\s*)([^\n]+)/gi,
+        replace: (_m, head, rest) => `${head}${rest.replace(/([^=;\s'"]+=)[^;'"]*/g, `$1${REDACTED}`)}`
+      },
       {
         // `key=value`, `key: value`, `"key": "value"` — key carries a secret-ish word;
-        // the word must be a whole key segment, so `monkeys=` stays untouched
+        // the word must be a whole key segment, so `monkeys=` stays untouched.
+        // The separator may start with the key's closing quote (JSON); it is kept.
         id: "key-value",
-        re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(${VAL})`, "gi"),
-        replace: (_m, key, sep) => `${key}${sep}${REDACTED}`
+        re: new RegExp(String.raw`(?<![A-Za-z0-9])((?:[A-Za-z0-9]+[_-])?(?:${KEY_WORDS})(?![A-Za-z0-9])[A-Za-z0-9_-]*)(["']?\s*[:=]\s*)(?!(?:Bearer|Basic) ${REDACTED_RE})(?!(?:${PROSE})\b)(${VAL})`, "gi"),
+        replace: (m, key, sep, val) => {
+          if (/[_-](?:count|length|len|size|limit|max|min|budget)$/i.test(key) && /^\d+$/.test(val)) return m;
+          const q = sep[0] === '"' || sep[0] === "'" ? val[0] : "";
+          return q && (q === '"' || q === "'") ? `${key}${sep}${q}${REDACTED}${q}` : `${key}${sep}${REDACTED}`;
+        }
+      },
+      {
+        // npmrc `//registry/:_authToken=xxx`
+        id: "npm-auth-token",
+        re: new RegExp(String.raw`(_authToken\s*=\s*)(${VAL})`, "g"),
+        replace: (_m, head) => `${head}${REDACTED}`
+      },
+      {
+        // `curl -u user:pass` / `--user user:pass` — keep the user
+        id: "curl-user",
+        re: /(\bcurl\b[^\n]{0,500}?\s(?:-u|--user)[\s=]+['"]?[^\s:'"]+:)([^\s'"]+)/g,
+        replace: (_m, head) => `${head}${REDACTED}`
+      },
+      {
+        // `mysql -phunter2` / `mysqldump -p'hunter2'` — attached password only
+        id: "mysql-p",
+        re: /(\bmysql(?:dump)?\b[^\n]{0,300}?\s-p)('[^']*'|"[^"]*"|[^\s'"-][^\s'"]*)/g,
+        replace: (_m, head) => `${head}${REDACTED}`
       },
       {
         // `export FOO_TOKEN=...` / `FOO_KEY=...` — SCREAMING_SNAKE env style
@@ -10259,19 +10298,20 @@ var init_redact = __esm({
         // provider token prefixes: sk-ant-, sk-, ghp_/gho_/ghu_/ghs_/ghr_, github_pat_,
         // glpat-, xoxb-/xoxp-/xoxa-, AKIA/ASIA + 16 chars, AIza + 35 chars, JWT (eyJ… three segments)
         id: "token-prefix",
-        re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[A-Z0-9]{16}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
+        re: /\b(?:sk-ant-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[bap]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA|AGPA|AIDA|AROA)[A-Z0-9]{16}|[sr]k_(?:live|test)_[A-Za-z0-9]{20,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z0-9]{30,}|AIza[A-Za-z0-9_-]{35}(?![A-Za-z0-9_-])|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/g,
         replace: REDACTED
       },
       {
         // 40+ char opaque base64/hex run, only on a line that also has a secret-ish key word
         id: "long-run",
-        re: /\b[A-Za-z0-9+/]{40,}={0,2}(?![\w/])/g,
+        re: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{40,4096}={0,2}(?![\w/])/g,
         // a bare 40-hex git SHA stays; it is only redacted as the value of a secret key
         replace: (m) => /^[0-9a-f]{40}$/i.test(m) ? m : REDACTED
       }
     ];
     LINE_RULES = REDACT_RULES.filter((r) => r.id !== "long-run");
     LONG_RUN = REDACT_RULES.find((r) => r.id === "long-run");
+    LONG_RUN_MAX_LINE = 64 * 1024;
     KEY_LINE = new RegExp(`(?:${KEY_WORDS})`, "i");
   }
 });
@@ -10302,10 +10342,12 @@ var init_loop_guard = __esm({
 });
 
 // src/audit/scan.ts
+var MAX_TEXT_BYTES;
 var init_scan = __esm({
   "src/audit/scan.ts"() {
     "use strict";
     init_loop_guard();
+    MAX_TEXT_BYTES = 256 * 1024;
   }
 });
 

package/dist/hooks/worker-supervision.mjs

@@ -8183,6 +8183,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8777,6 +8778,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8913,6 +8921,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,

package/dist/hooks/worker-tool-name-repair.mjs

@@ -8177,6 +8177,7 @@ function defaultWorkersConfig() {
     cacheKeepaliveSecs: num(w.cacheKeepaliveSecs, 0),
     defaultMaxMinutes: num(w.defaultMaxMinutes, 60),
     waitAlarmMinutes: num(w.waitAlarmMinutes, 120),
+    scanBudgetMs: num(w.scanBudgetMs, 5e3),
     stagger: {
       enabled: bool(stagger.enabled, true),
       localDefaultSec: num(stagger.localDefaultSec, 20),
@@ -8771,6 +8772,13 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     }
     waitAlarmMinutes = w.waitAlarmMinutes;
   }
+  let scanBudgetMs = d.scanBudgetMs ?? 5e3;
+  if (w.scanBudgetMs !== void 0) {
+    if (typeof w.scanBudgetMs !== "number" || !Number.isInteger(w.scanBudgetMs) || w.scanBudgetMs < 1) {
+      bad(".scanBudgetMs", "must be a positive integer (milliseconds)");
+    }
+    scanBudgetMs = w.scanBudgetMs;
+  }
   const stagger = { ...d.stagger };
   if (w.stagger !== void 0) {
     if (typeof w.stagger !== "object" || w.stagger === null || Array.isArray(w.stagger)) {
@@ -8907,6 +8915,7 @@ function parseWorkersConfig(raw, yamlProviders = {}) {
     cacheKeepaliveSecs,
     defaultMaxMinutes,
     waitAlarmMinutes,
+    scanBudgetMs,
     stagger,
     capacity,
     localIdle,

package/dist/index.mjs

@@ -1,13 +1,13 @@
 import "./utils-J2b9y8PC.mjs";
 import { a as slugify, i as parseSessionFilename, n as decodeEncodedDir, r as migrateFromJson } from "./migrate-C2z1YmWC.mjs";
-import "./config-Bz8pAU5Q.mjs";
+import "./config-DGV64YJa.mjs";
 import "./config-SlZ-Z52i.mjs";
-import "./paths-CypxFTfn.mjs";
-import "./worktree-O_kU6Q3y.mjs";
-import "./status-Cecau8Ps.mjs";
-import "./pool-9EsbKD-U.mjs";
-import "./registrable-Dxs4oKIj.mjs";
-import { n as ensurePaiMarker, r as readPaiMarker, t as discoverPaiMarkers } from "./pai-marker-D6OoVbM_.mjs";
+import "./paths-BwfwHOvN.mjs";
+import "./worktree-7ZS3RBf8.mjs";
+import "./status-DTMT5lyn.mjs";
+import "./pool-CFeHGX7q.mjs";
+import "./registrable-D_4qXCnq.mjs";
+import { n as ensurePaiMarker, r as readPaiMarker, t as discoverPaiMarkers } from "./pai-marker-kA0iM7rP.mjs";
 import { d as estimateTokens, l as buildOutline, p as parseHeadings, r as detectTier, u as chunkMarkdown } from "./helpers-CRuBUas3.mjs";
 import { i as populateSlugs, n as buildFtsQuery } from "./search-RSyeQqj1.mjs";
 import { n as rerankResults, t as configureRerankerModel } from "./reranker-CqCbpGnX.mjs";

package/dist/kill-tree-BlPw1vaU.mjs

@@ -0,0 +1,10 @@
+import "./config-DGV64YJa.mjs";
+import "./config-SlZ-Z52i.mjs";
+import "./paths-BwfwHOvN.mjs";
+import "./status-DTMT5lyn.mjs";
+import "./scope-BRcaPw5D.mjs";
+import "./caller-identity-DPDSrZE2.mjs";
+import "./endreason-BjPom527.mjs";
+import { i as killTree, n as isOwner, r as killRefusal, t as descendantsLeavesFirst } from "./kill-tree-DTmiEb3T.mjs";
+
+export { killTree };

package/dist/{kill-tree-DPiMscaY.mjs → kill-tree-DTmiEb3T.mjs}

@@ -1,9 +1,9 @@
-import { Et as appendLedger } from "./config-Bz8pAU5Q.mjs";
-import { i as ledgerPath } from "./paths-CypxFTfn.mjs";
-import { D as pidAlive, F as waitForTerminalStatus, k as saveStatus, v as loadStatus, w as ownsPid, y as loadStatuses } from "./status-Cecau8Ps.mjs";
-import { i as itermUuid } from "./scope-BTWstJ1B.mjs";
-import { a as buildsDir, d as releaseBuildsOf, t as callerIdentity } from "./caller-identity-C6Nc96iM.mjs";
-import { n as callerDescription, s as requestKill, t as appendStopEvent } from "./endreason-C2-hYK0_.mjs";
+import { Et as appendLedger } from "./config-DGV64YJa.mjs";
+import { i as ledgerPath } from "./paths-BwfwHOvN.mjs";
+import { D as pidAlive, F as waitForTerminalStatus, k as saveStatus, v as loadStatus, w as ownsPid, y as loadStatuses } from "./status-DTMT5lyn.mjs";
+import { i as itermUuid } from "./scope-BRcaPw5D.mjs";
+import { a as buildsDir, d as releaseBuildsOf, t as callerIdentity } from "./caller-identity-DPDSrZE2.mjs";
+import { n as callerDescription, s as requestKill, t as appendStopEvent } from "./endreason-BjPom527.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -257,4 +257,4 @@ async function killTree(logDir, id, opts = {}) {
 
 //#endregion
 export { killTree as i, isOwner as n, killRefusal as r, descendantsLeavesFirst as t };
-//# sourceMappingURL=kill-tree-DPiMscaY.mjs.map
+//# sourceMappingURL=kill-tree-DTmiEb3T.mjs.map

package/dist/{launch-Bn2Zf90h.mjs → launch-CV6oPHI2.mjs}

@@ -1,5 +1,5 @@
-import { M as readWorkersSection, R as LOOPBACK_HOST, _ as maskKey, a as MODEL_CAPABILITIES, b as nativeOrchestratorModel, c as WorkersConfigError, p as getProviderOrNative, t as ANTHROPIC_NATIVE, y as nativeAnthropicProvider } from "./config-Bz8pAU5Q.mjs";
-import { _t as nativeRoutePreflight, b as SESSION_PROVIDER_ENV, ut as buildRunEnv, yt as pinnedSettingsArgs } from "./routing-aJKMIagQ.mjs";
+import { M as readWorkersSection, R as LOOPBACK_HOST, _ as maskKey, a as MODEL_CAPABILITIES, b as nativeOrchestratorModel, c as WorkersConfigError, p as getProviderOrNative, t as ANTHROPIC_NATIVE, y as nativeAnthropicProvider } from "./config-DGV64YJa.mjs";
+import { _t as nativeRoutePreflight, b as SESSION_PROVIDER_ENV, ut as buildRunEnv, yt as pinnedSettingsArgs } from "./routing-CF0wlR-_.mjs";
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -258,4 +258,4 @@ function maskLaunchEnv(env) {
 
 //#endregion
 export { detectCurrentProviderName as a, ensureProxyRunning as c, detectCurrentModel as i, proxyPort as l, buildLaunchPlan as n, launchableProviderNames as o, buildLaunchRows as r, maskLaunchEnv as s, LaunchError as t, stopProxy as u };
-//# sourceMappingURL=launch-Bn2Zf90h.mjs.map
+//# sourceMappingURL=launch-CV6oPHI2.mjs.map

package/dist/{launch-BZT3JDoZ.mjs → launch-Dy8qQnSD.mjs}

@@ -1,6 +1,6 @@
 import { i as err } from "./utils-J2b9y8PC.mjs";
-import { M as readWorkersSection, bt as stripModelVariant, t as ANTHROPIC_NATIVE } from "./config-Bz8pAU5Q.mjs";
-import { _t as nativeRoutePreflight, b as SESSION_PROVIDER_ENV, dt as claudeCommand, gt as nativeLaunchSettingsArgs, ht as nativeLaunchEnv, ut as buildRunEnv, xt as routeVerdictLine, yt as pinnedSettingsArgs } from "./routing-aJKMIagQ.mjs";
+import { M as readWorkersSection, bt as stripModelVariant, t as ANTHROPIC_NATIVE } from "./config-DGV64YJa.mjs";
+import { _t as nativeRoutePreflight, b as SESSION_PROVIDER_ENV, dt as claudeCommand, gt as nativeLaunchSettingsArgs, ht as nativeLaunchEnv, ut as buildRunEnv, xt as routeVerdictLine, yt as pinnedSettingsArgs } from "./routing-CF0wlR-_.mjs";
 import { closeSync, copyFileSync, existsSync, fstatSync, linkSync, openSync, readSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 import chalk from "chalk";
@@ -740,4 +740,4 @@ function launchInDir(dir, name, opts = {}) {
 
 //#endregion
 export { providerResumePlan as a, resumeOfferBlock as c, printExitDir as d, probeResume as i, resumeRouteFor as l, launchInDir as n, restoreTopLevel as o, launchPrompt as r, resumeArgvText as s, hasConversation as t, transcriptModelFor as u };
-//# sourceMappingURL=launch-BZT3JDoZ.mjs.map
+//# sourceMappingURL=launch-Dy8qQnSD.mjs.map

package/dist/{lessons-CFVU0cwA.mjs → lessons-CdmqZD0G.mjs}

@@ -1,18 +1,18 @@
 import { _ as paiHomePath, a as paiCacheDir, d as defaultPaiHomeDir, f as legacyConfigDir, h as migratePaiFile, i as daemonPidPath, l as claudeHomeDir, u as claudeProjectsDir, v as resolvePaiFile } from "./runtime-paths-twfV23YL.mjs";
 import { t as writeFileAtomic } from "./atomic-file-BorMa4T3.mjs";
-import { Et as appendLedger, M as readWorkersSection, P as resolveModelCapability, d as defaultWorkersConfig } from "./config-Bz8pAU5Q.mjs";
+import { Et as appendLedger, M as readWorkersSection, P as resolveModelCapability, d as defaultWorkersConfig } from "./config-DGV64YJa.mjs";
 import { c as loadConfig, f as readMainConfigRaw, k as writeJsonAtomic, n as CONFIG_FILE, p as writeMainConfigRaw } from "./config-SlZ-Z52i.mjs";
-import { n as ensureNoMcpConfig, u as workersLogDir } from "./paths-CypxFTfn.mjs";
-import { w as worktreesDir } from "./worktree-O_kU6Q3y.mjs";
-import { G as writeContinueToForge, V as loadStatusConfig } from "./status-Cecau8Ps.mjs";
-import { i as itermUuid, l as sessionMapPath } from "./scope-BTWstJ1B.mjs";
-import { _ as resolveTarget, mt as loopbackRouterChoice, ut as buildRunEnv } from "./routing-aJKMIagQ.mjs";
+import { n as ensureNoMcpConfig, u as workersLogDir } from "./paths-BwfwHOvN.mjs";
+import { w as worktreesDir } from "./worktree-7ZS3RBf8.mjs";
+import { G as writeContinueToForge, V as loadStatusConfig } from "./status-DTMT5lyn.mjs";
+import { i as itermUuid, l as sessionMapPath } from "./scope-BRcaPw5D.mjs";
+import { _ as resolveTarget, mt as loopbackRouterChoice, ut as buildRunEnv } from "./routing-CF0wlR-_.mjs";
 import { i as getRegistryBackend, r as createStorageBackend } from "./factory-CYwa0jYj.mjs";
-import { c as ensureProxyRunning, l as proxyPort } from "./launch-Bn2Zf90h.mjs";
+import { c as ensureProxyRunning, l as proxyPort } from "./launch-CV6oPHI2.mjs";
 import { n as fetchLiveSessions, r as sendToSession } from "./aibroker-client-CXsyC7A8.mjs";
-import { E as probeRouter, z as recordSystemJobStart } from "./run-DE9Q0ldN.mjs";
-import { J as psTableOrNull, U as redactSecrets } from "./render-jPpMrudf.mjs";
-import { n as isRealUserPrompt, t as extractUserPromptText } from "./session-usage-CCmPFFa6.mjs";
+import { E as probeRouter, z as recordSystemJobStart } from "./run-CAjfKBQV.mjs";
+import { W as redactSecrets, Y as psTableOrNull } from "./render-CbifCwTb.mjs";
+import { n as isRealUserPrompt, t as extractUserPromptText } from "./session-usage-BRIWFYPS.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { basename, delimiter, dirname, join } from "node:path";
@@ -4242,13 +4242,14 @@ function getLesson(id) {
 /** Add a candidate lesson; the slug comes from the title, made unique with -2, -3, ... */
 function addLesson(input) {
 	if (!LESSON_KINDS.includes(input.kind)) throw new Error(`invalid kind "${input.kind}" (${LESSON_KINDS.join("|")})`);
-	const base = slugify(input.title);
+	const title = redactSecrets(input.title);
+	const base = slugify(title);
 	let id = base;
 	for (let n = 2; existsSync(lessonPath(id)); n++) id = `${base}-${n}`;
 	const now = (/* @__PURE__ */ new Date()).toISOString();
 	const lesson = {
 		id,
-		title: input.title,
+		title,
 		state: "candidate",
 		kind: input.kind,
 		applies_when: input.applies_when,
@@ -4256,7 +4257,7 @@ function addLesson(input) {
 		evidence: input.evidence ?? [],
 		created: now,
 		updated: now,
-		body: input.body ?? ""
+		body: redactSecrets(input.body ?? "")
 	};
 	writeLesson(lesson);
 	return lesson;
@@ -4315,18 +4316,17 @@ function promoteLesson(id, opts) {
 	writeLesson(lesson);
 	return paths;
 }
+/** A correction signal must sit in the first 30 chars of the message; later words are not corrections. */
 const CORRECTION = [
 	/^\s*no\b[,.!]/i,
 	/\bdon'?t\b/i,
 	/\bnever\b/i,
-	/\bstop\b/i,
 	/\bwrong\b/i,
 	/\bthat'?s not\b/i,
 	/\bnein\b/i,
-	/\bnicht\b/i,
-	/\bfalsch\b/i,
-	/\bnie\b/i
+	/\bfalsch\b/i
 ];
+const CORRECTION_WINDOW = 30;
 function userText(content) {
 	if (typeof content === "string") return content;
 	if (!Array.isArray(content)) return "";
@@ -4347,8 +4347,8 @@ function proposeFromTranscript(transcriptPath) {
 		}
 		if (ev.type !== "user" || ev.isMeta) continue;
 		const text = userText(ev.message?.content).trim();
-		if (!text || text.startsWith("<") || !CORRECTION.some((re) => re.test(text))) continue;
-		const title = text.replace(/\s+/g, " ").slice(0, 80);
+		if (!text || text.startsWith("<") || !CORRECTION.some((re) => re.test(text.slice(0, CORRECTION_WINDOW)))) continue;
+		const title = redactSecrets(text.replace(/\s+/g, " ")).slice(0, 80);
 		if (seen.has(title)) continue;
 		seen.add(title);
 		out.push({
@@ -4356,7 +4356,7 @@ function proposeFromTranscript(transcriptPath) {
 			kind: "correction",
 			applies_when: "",
 			evidence: [sessionId],
-			body: text.slice(0, 600)
+			body: redactSecrets(text).slice(0, 600)
 		});
 	}
 	return out;
@@ -4364,4 +4364,4 @@ function proposeFromTranscript(transcriptPath) {
 
 //#endregion
 export { setIndexSchedulerTimer as $, readBodyFile as $t, getGitContext as A, jobPaths as At, lastEmbedPass as B, registerQuietRunner as Bt, hasPendingOrProcessingOfType as C, historyDir as Ct, migrateWorkQueue as D, vaultIndexEnabled as Dt, markFailed as E, obsidianEnabled as Et, daemonConfig as F, sessionKeepaliveLedgerSummary as Ft, notificationConfig as G, resolveDaemonPid as Gt, lastIndexPass as H, writeQuiet as Ht, embedInProgress as I, deferIfQuiet as It, setCacheKeepaliveTimer as J, writeContextHandoverCache as Jt, passFailures as K, writeDaemonPidfile as Kt, embedSchedulerTimer as L, describeQuiet as Lt, migrateSummaryCooldowns as M, sweepOrphans as Mt, spawnSummarizer as N, loadSessionKeepaliveState as Nt, contentToText as O, buildWakeupContext as Ot, cacheKeepaliveTimer as P, runSessionKeepaliveTick as Pt, setIndexInProgress as Q, findNotesDir$1 as Qt, indexInProgress as R, nextOccurrence as Rt, getStats as S, findNotesDir as St, markCompleted as T, lessonsIndexEnabled as Tt, lastIndexTime as U, LAUNCHD_LABEL as Ut, lastEmbedTime as V, startQuietWatcher as Vt, lastVaultIndexTime as W, removeDaemonPidfile as Wt, setEmbedInProgress as X, applyContinue as Xt, setDaemonConfig as Y, appendCheckpointToNote as Yt, setEmbedSchedulerTimer as Z, findLatestNote as Zt, NonRetryableError as _, addWorkToSessionNote as _t, lessonsDir as a, setNotificationConfig as at, enqueue as b, getCurrentNotePath as bt, proposeFromTranscript as c, setStartTime as ct, buildPassCommand as d, shutdownRequested as dt, restartRouter as en, setLastEmbedPass as et, cliEntry as f, startTime as ft, migrateKgBackfillState as g, updateTodoContinue as gt, backfillKgFromNotes as h, sessionIdFromTranscript as ht, getLesson as i, setLastVaultIndexTime as it, handleSessionSummary as j, reapJob as jt, findLatestJsonl as k, migrateIdentityFile as kt, setState as l, setStorageBackend as lt, runPassChild as m, vaultIndexInProgress as mt, LESSON_STATES as n, setLastIndexPass as nt, listLessons as o, setRegistryBackend as ot, reexecBackground as p, storageBackend as pt, registryBackend as q, readContextHandoverCache as qt, addLesson as r, setLastIndexTime as rt, promoteLesson as s, setShutdownRequested as st, LESSON_KINDS as t, setLastEmbedTime as tt, PassSpawnError as u, setVaultIndexInProgress as ut, cleanup as v, appendCheckpoint as vt, loadQueue as w, OBSIDIAN_DISABLED_MESSAGE as wt, enqueueCoalesced as x, archiveSessionFilesToSessionsDir as xt, dequeue as y, finalizeSessionNote as yt, indexSchedulerTimer as z, readQuiet as zt };
-//# sourceMappingURL=lessons-CFVU0cwA.mjs.map
+//# sourceMappingURL=lessons-CdmqZD0G.mjs.map

package/dist/{local-candidate-DFd4pp-w.mjs → local-candidate-C2FGhf54.mjs}

@@ -1,4 +1,4 @@
-import { rt as workersYamlPath, z as isLoopbackHostname } from "./config-Bz8pAU5Q.mjs";
+import { rt as workersYamlPath, z as isLoopbackHostname } from "./config-DGV64YJa.mjs";
 import { _ as readLocalConfig } from "./local-tiers-CqwGUcEn.mjs";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -109,4 +109,4 @@ function isLocalCandidate(p, name, tierProviders) {
 
 //#endregion
 export { localStatusReport as a, writeLocalStatus as c, localStatusLine as i, tierProviderNames as n, primaryLocal as o, LOCAL_STATUS_REFRESH_MS as r, readLocalStatus as s, isLocalCandidate as t };
-//# sourceMappingURL=local-candidate-DFd4pp-w.mjs.map
+//# sourceMappingURL=local-candidate-C2FGhf54.mjs.map

package/dist/{local-instances-KTh8IeOT.mjs → local-instances-GgXydQ2P.mjs}

@@ -1,4 +1,4 @@
-import "./config-Bz8pAU5Q.mjs";
+import "./config-DGV64YJa.mjs";
 import "./config-SlZ-Z52i.mjs";
 import "./local-tiers-CqwGUcEn.mjs";
 import { a as instancesFromProcesses, c as pidAlive, d as reconcileInstances, f as registeredInstances, i as instanceNumber, l as readInstances, n as engineKey, o as localInstancesPath, p as writeInstances, r as instanceEngineKey, s as pickInstance, t as endpointRegistry, u as readLiveInstances } from "./local-instances-DhF4_sV2.mjs";

package/dist/{local-tiers-DSlIYvvm.mjs → local-tiers-X_dQfI4Q.mjs}

@@ -1,4 +1,4 @@
-import "./config-Bz8pAU5Q.mjs";
+import "./config-DGV64YJa.mjs";
 import "./config-SlZ-Z52i.mjs";
 import { C as stopLines, S as stopLine, T as tierButtons, _ as readLocalConfig, a as LocalTierError, b as splitCommand, c as fetchServedModels, d as installedModelDirs, f as listensOnPort, g as planStart, h as parseServers, i as DEFAULT_RESERVE_GB, l as fmtRss, m as parseLocalConfig, n as DEFAULT_HEALTH, o as defaultLauncher, p as logPathFor, r as DEFAULT_MAX_INSTANCES, s as defaultStrataPython, t as DEFAULT_COMMON_FLAGS, u as healthUrl, v as resolveModelPath, w as strataInfo, x as stopCommandFor, y as shellQuote } from "./local-tiers-CqwGUcEn.mjs";
 

package/dist/{main-config-ops-rda08BCD.mjs → main-config-ops-C_fkINDv.mjs}

@@ -1,4 +1,4 @@
-import { M as readWorkersSection, _ as maskKey, rt as workersYamlPath } from "./config-Bz8pAU5Q.mjs";
+import { M as readWorkersSection, _ as maskKey, rt as workersYamlPath } from "./config-DGV64YJa.mjs";
 import { C as migrateMainConfigToYaml, D as writeYamlFileAtomic, c as loadConfig, d as paiConfigYamlFilePath, f as readMainConfigRaw, i as defaults, p as writeMainConfigRaw, u as paiConfigFilePath, x as userWorkersYamlRaw } from "./config-SlZ-Z52i.mjs";
 import { existsSync } from "node:fs";
 import { Document } from "yaml";
@@ -239,4 +239,4 @@ function unsetConfigValueOp(dottedPath) {
 
 //#endregion
 export { listConfigOp as a, getConfigValueOp as i, formatConfigGetOutput as n, setConfigValueOp as o, formatConfigSource as r, unsetConfigValueOp as s, MainConfigOpsError as t };
-//# sourceMappingURL=main-config-ops-rda08BCD.mjs.map
+//# sourceMappingURL=main-config-ops-C_fkINDv.mjs.map

package/dist/{main-resolver-BKwI0I6H.mjs → main-resolver-CN_sfG1R.mjs}

@@ -1,20 +1,20 @@
 import { _ as warn, c as ok, i as err, l as renderTable, n as dim, o as header } from "./utils-J2b9y8PC.mjs";
-import "./config-Bz8pAU5Q.mjs";
+import "./config-DGV64YJa.mjs";
 import "./config-SlZ-Z52i.mjs";
-import "./paths-CypxFTfn.mjs";
-import "./status-Cecau8Ps.mjs";
-import { d as terminalHasName } from "./scope-BTWstJ1B.mjs";
-import "./routing-aJKMIagQ.mjs";
-import "./tool-errors-BFw1gv-z.mjs";
-import "./wait-C5iWILj_.mjs";
+import "./paths-BwfwHOvN.mjs";
+import "./status-DTMT5lyn.mjs";
+import { d as terminalHasName } from "./scope-BRcaPw5D.mjs";
+import "./routing-CF0wlR-_.mjs";
+import "./tool-errors-BOW2n882.mjs";
+import "./wait-BindDA5w.mjs";
 import "./local-tiers-CqwGUcEn.mjs";
-import "./caller-identity-C6Nc96iM.mjs";
-import "./capacity-B2PgKAg4.mjs";
+import "./caller-identity-DPDSrZE2.mjs";
+import "./capacity-CThSydrd.mjs";
 import "./local-instances-DhF4_sV2.mjs";
-import "./local-candidate-DFd4pp-w.mjs";
-import { c as resumeOfferBlock, l as resumeRouteFor, n as launchInDir } from "./launch-BZT3JDoZ.mjs";
+import "./local-candidate-C2FGhf54.mjs";
+import { c as resumeOfferBlock, l as resumeRouteFor, n as launchInDir } from "./launch-Dy8qQnSD.mjs";
 import { i as switchToSession, n as fetchLiveSessions } from "./aibroker-client-CXsyC7A8.mjs";
-import { s as scanSessions, t as fmtAge } from "./session-scan-CX3MKCNg.mjs";
+import { s as scanSessions, t as fmtAge } from "./session-scan-DihMibI-.mjs";
 import { createReadStream, existsSync, realpathSync } from "node:fs";
 import { basename, join } from "node:path";
 import chalk from "chalk";
@@ -784,4 +784,4 @@ async function cmdMain(query, pickN, opts) {
 
 //#endregion
 export { cmdMain };
-//# sourceMappingURL=main-resolver-BKwI0I6H.mjs.map
+//# sourceMappingURL=main-resolver-CN_sfG1R.mjs.map

package/dist/{model-inventory-BXv15B0d.mjs → model-inventory-BYNrSTaY.mjs}

@@ -1,15 +1,15 @@
-import "./config-Bz8pAU5Q.mjs";
+import "./config-DGV64YJa.mjs";
 import "./config-SlZ-Z52i.mjs";
-import "./paths-CypxFTfn.mjs";
-import "./status-Cecau8Ps.mjs";
-import "./scope-BTWstJ1B.mjs";
-import { $ as parseFootprint, B as MODEL_INVENTORY_MAX_AGE_MS, G as fmtMem, H as ProbeHold, J as inventoryRows, K as fmtMemMapped, Q as modelLabel, R as DOWN_AFTER_MISSES, U as computeInventory, V as MODEL_INVENTORY_REFRESH_MS, W as currentInventory, X as liveDeps, Y as inventoryText, Z as modelKind, at as readInventoryInput, ct as writeInventory, et as parseSizeMb, it as readInventory, nt as processTreeMemory, ot as readModelLabels, q as inventoryPath, rt as processTreeRssMb, st as startInventoryRefresh, tt as parseTable, z as INVENTORY_HEADERS } from "./routing-aJKMIagQ.mjs";
-import "./tool-errors-BFw1gv-z.mjs";
-import "./wait-C5iWILj_.mjs";
+import "./paths-BwfwHOvN.mjs";
+import "./status-DTMT5lyn.mjs";
+import "./scope-BRcaPw5D.mjs";
+import { $ as parseFootprint, B as MODEL_INVENTORY_MAX_AGE_MS, G as fmtMem, H as ProbeHold, J as inventoryRows, K as fmtMemMapped, Q as modelLabel, R as DOWN_AFTER_MISSES, U as computeInventory, V as MODEL_INVENTORY_REFRESH_MS, W as currentInventory, X as liveDeps, Y as inventoryText, Z as modelKind, at as readInventoryInput, ct as writeInventory, et as parseSizeMb, it as readInventory, nt as processTreeMemory, ot as readModelLabels, q as inventoryPath, rt as processTreeRssMb, st as startInventoryRefresh, tt as parseTable, z as INVENTORY_HEADERS } from "./routing-CF0wlR-_.mjs";
+import "./tool-errors-BOW2n882.mjs";
+import "./wait-BindDA5w.mjs";
 import "./local-tiers-CqwGUcEn.mjs";
-import "./caller-identity-C6Nc96iM.mjs";
-import "./capacity-B2PgKAg4.mjs";
+import "./caller-identity-DPDSrZE2.mjs";
+import "./capacity-CThSydrd.mjs";
 import "./local-instances-DhF4_sV2.mjs";
-import "./local-candidate-DFd4pp-w.mjs";
+import "./local-candidate-C2FGhf54.mjs";
 
 export { computeInventory, currentInventory, processTreeRssMb, readInventoryInput, writeInventory };

package/dist/{models-add-5yXTyz3g.mjs → models-add-Dc7VXmcu.mjs}

@@ -1,43 +1,43 @@
 import "./utils-J2b9y8PC.mjs";
-import { rt as workersYamlPath } from "./config-Bz8pAU5Q.mjs";
+import { rt as workersYamlPath } from "./config-DGV64YJa.mjs";
 import "./config-SlZ-Z52i.mjs";
-import "./paths-CypxFTfn.mjs";
-import "./worktree-O_kU6Q3y.mjs";
-import "./status-Cecau8Ps.mjs";
-import "./pool-9EsbKD-U.mjs";
+import "./paths-BwfwHOvN.mjs";
+import "./worktree-7ZS3RBf8.mjs";
+import "./status-DTMT5lyn.mjs";
+import "./pool-CFeHGX7q.mjs";
 import "./helpers-CRuBUas3.mjs";
-import "./scope-BTWstJ1B.mjs";
-import "./routing-aJKMIagQ.mjs";
-import "./tool-errors-BFw1gv-z.mjs";
-import "./wait-C5iWILj_.mjs";
+import "./scope-BRcaPw5D.mjs";
+import "./routing-CF0wlR-_.mjs";
+import "./tool-errors-BOW2n882.mjs";
+import "./wait-BindDA5w.mjs";
 import { g as planStart, m as parseLocalConfig, o as defaultLauncher, y as shellQuote } from "./local-tiers-CqwGUcEn.mjs";
-import "./caller-identity-C6Nc96iM.mjs";
-import "./capacity-B2PgKAg4.mjs";
+import "./caller-identity-DPDSrZE2.mjs";
+import "./capacity-CThSydrd.mjs";
 import "./local-instances-DhF4_sV2.mjs";
-import "./local-candidate-DFd4pp-w.mjs";
+import "./local-candidate-C2FGhf54.mjs";
 import "./factory-CYwa0jYj.mjs";
 import "./postgres-BL5oBBgY.mjs";
 import "./embedding-gate-iq0oQEkF.mjs";
 import "./embeddings-BVq3esBF.mjs";
 import "./router-D2476pOp.mjs";
-import "./launch-Bn2Zf90h.mjs";
-import "./health-D0mUAVdw.mjs";
-import "./run-DE9Q0ldN.mjs";
-import "./controls-rIItFeIJ.mjs";
-import "./endreason-C2-hYK0_.mjs";
-import "./render-jPpMrudf.mjs";
-import "./operator-Br6GeswF.mjs";
-import "./kill-tree-DPiMscaY.mjs";
-import "./pool-cli-Db0uDwB9.mjs";
-import "./pane-audit-DLYy9-4g.mjs";
-import "./providers-BNV7CzC-.mjs";
-import { H as canBind, U as sizeOnDiskGb, V as allocatePort, at as defaultRegistryCtx, f as killInstance, g as portListeners, ot as hashText, p as launchDetached, st as saveRegistry, u as healthOk } from "./worker-config-DkONNk_H.mjs";
-import "./main-config-ops-rda08BCD.mjs";
-import "./cockpit-actions-D1OPP6Es.mjs";
+import "./launch-CV6oPHI2.mjs";
+import "./health-Bb2U4PNK.mjs";
+import "./run-CAjfKBQV.mjs";
+import "./controls-ByrcupcA.mjs";
+import "./endreason-BjPom527.mjs";
+import "./render-CbifCwTb.mjs";
+import "./operator-lRGvYr3D.mjs";
+import "./kill-tree-DTmiEb3T.mjs";
+import "./pool-cli-DOLgPgOM.mjs";
+import "./pane-audit-DUuilP1V.mjs";
+import "./providers-BC2Myo_O.mjs";
+import { H as canBind, U as sizeOnDiskGb, V as allocatePort, at as defaultRegistryCtx, f as killInstance, g as portListeners, ot as hashText, p as launchDetached, st as saveRegistry, u as healthOk } from "./worker-config-CdPmb4_2.mjs";
+import "./main-config-ops-C_fkINDv.mjs";
+import "./cockpit-actions-BgdKB9G3.mjs";
 import "./ipc-client-CmagIFLh.mjs";
-import "./embed-pass-CN1D8MXl.mjs";
-import "./session-usage-CCmPFFa6.mjs";
-import "./fallback-CwPSCrX8.mjs";
+import "./embed-pass-DdTMn4DH.mjs";
+import "./session-usage-BRIWFYPS.mjs";
+import "./fallback-CQ8_CuVu.mjs";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, join } from "node:path";
 import { homedir } from "node:os";
@@ -333,4 +333,4 @@ async function smokeTest(cfg, name, d = {}) {
 
 //#endregion
 export { addModel };
-//# sourceMappingURL=models-add-5yXTyz3g.mjs.map
+//# sourceMappingURL=models-add-Dc7VXmcu.mjs.map

package/dist/operator-IrLbk8hy.mjs

@@ -0,0 +1,7 @@
+import "./config-DGV64YJa.mjs";
+import "./config-SlZ-Z52i.mjs";
+import "./paths-BwfwHOvN.mjs";
+import "./status-DTMT5lyn.mjs";
+import { n as operatorSocketPath, r as sayToWorker, t as createOperatorServer } from "./operator-lRGvYr3D.mjs";
+
+export { sayToWorker };

package/dist/{operator-Br6GeswF.mjs → operator-lRGvYr3D.mjs}

@@ -1,4 +1,4 @@
-import { g as isLive, v as loadStatus } from "./status-Cecau8Ps.mjs";
+import { g as isLive, v as loadStatus } from "./status-DTMT5lyn.mjs";
 import { existsSync, unlinkSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { join } from "node:path";
@@ -95,4 +95,4 @@ function sayToWorker(logDir, id, text, timeoutMs = 4e3) {
 
 //#endregion
 export { operatorSocketPath as n, sayToWorker as r, createOperatorServer as t };
-//# sourceMappingURL=operator-Br6GeswF.mjs.map
+//# sourceMappingURL=operator-lRGvYr3D.mjs.map