@krapht/ork 1.0.0-alpha.0 → 1.0.0-alpha.10

package/dist/src-oaJYIddp.mjs

@@ -0,0 +1,2255 @@
+import { Ht as FEEDBACK_KINDS, Ut as FEEDBACK_SEVERITIES, Wt as FEEDBACK_TARGETS, cn as MASK, dt as parseReport, mr as AGENT_DRIVERS, un as maskSecrets } from "./src-Df6KOIDC.mjs";
+import path from "node:path";
+import { z } from "zod";
+import { existsSync, linkSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { homedir, tmpdir } from "node:os";
+import { createInterface } from "node:readline";
+import { execFile, spawn } from "node:child_process";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { createServer } from "node:http";
+// ../runtime/src/hold.ts
+/**
+* Waits at a tool call while `hold` is held: "go" once it is released within
+* the window (or at once when it is not held), "defer" after the window.
+*/
+const holdAtTool = async (hold, signal, windowMs) => {
+	if (!hold.held()) return "go";
+	const window = new AbortController();
+	const timer = setTimeout(() => {
+		window.abort();
+	}, windowMs);
+	try {
+		await hold.wait("tool", AbortSignal.any([signal, window.signal]));
+	} finally {
+		clearTimeout(timer);
+	}
+	return hold.held() && !signal.aborted ? "defer" : "go";
+};
+/** The name Claude Code gives an Ork tool: `mcp__ork__<name>`. */
+const toolId = (name) => `mcp__ork__${name}`;
+const text = (value) => ({ content: [{
+	type: "text",
+	text: value
+}] });
+const issueAt = (issue) => {
+	const where = z.core.toDotPath(issue.path);
+	return where === "" ? "" : `${where}: `;
+};
+/** Whether `issue` is about a field of the object `parent` is about. */
+const isFieldOf = (issue, parent) => issue.path.length === parent.path.length + 1 && parent.path.every((key, index) => key === issue.path[index]);
+const expectedField = (issue) => `; the field is \`${String(issue.path.at(-1))}\`${issue.code === "invalid_value" ? `, one of: ${issue.values.join(", ")}` : ""}`;
+/**
+* A failed parse as text a model can act on. A stray key is reported with the
+* fields its object lacks, read from the schema's own issues: a wrong name is
+* otherwise only a "missing" error that hides what was sent.
+*/
+const readableIssues = (issues) => {
+	const strays = issues.filter((issue) => issue.code === "unrecognized_keys");
+	const lacking = issues.filter((issue) => issue.input === void 0 && strays.some((stray) => isFieldOf(issue, stray)));
+	return [...strays.map((stray) => `${issueAt(stray)}unknown field ${stray.keys.map((key) => `\`${key}\``).join(", ")}${lacking.filter((issue) => isFieldOf(issue, stray)).map((issue) => expectedField(issue)).join("")}`), ...issues.filter((issue) => issue.code !== "unrecognized_keys" && !lacking.includes(issue)).map((issue) => `${issueAt(issue)}${issue.message}`)].join("\n");
+};
+const defineTool = (definition) => ({
+	name: definition.name,
+	bind: (context) => {
+		if (!(definition.available?.(context) ?? true)) return null;
+		const shape = typeof definition.shape === "function" ? definition.shape(context) : definition.shape;
+		const schema = z.object(shape);
+		return {
+			name: definition.name,
+			description: typeof definition.description === "function" ? definition.description(context) : definition.description,
+			shape,
+			schema,
+			preapproved: definition.preapproved ?? true,
+			call: (args) => {
+				const parsed = schema.safeParse(args, { reportInput: true });
+				return parsed.success ? definition.run(context, parsed.data) : Promise.resolve({
+					...text(readableIssues(parsed.error.issues)),
+					isError: true
+				});
+			}
+		};
+	}
+});
+// ../runtime/src/mcp-http.ts
+/**
+* @file A minimal MCP server over the streamable HTTP transport, for the
+*   `claude` CLI driver. It answers with plain JSON (no SSE stream), which the
+*   transport allows, and implements only what Ork needs: `initialize`, `ping`,
+*   `tools/list` and `tools/call`. Beside it, `/hold` answers the session's
+*   `PreToolUse` HTTP hook, which waits while the node is paused (ADR-041).
+*/
+const PATH = "/mcp";
+const HOLD_PATH = "/hold";
+const MAX_BODY = 1048576;
+const MCP_PROTOCOL_FALLBACK = "2025-06-18";
+const JsonRpcSchema = z.object({
+	jsonrpc: z.literal("2.0"),
+	id: z.union([z.string(), z.number()]).optional(),
+	method: z.string(),
+	params: z.record(z.string(), z.unknown()).optional()
+});
+/** Handles one JSON-RPC request; `null` for a notification (no reply). */
+const handleRpc = async (tools, message) => {
+	const parsed = JsonRpcSchema.safeParse(message);
+	if (!parsed.success) return { error: {
+		code: -32600,
+		message: "invalid request"
+	} };
+	const { id, method, params } = parsed.data;
+	if (id === void 0) return null;
+	switch (method) {
+		case "initialize": {
+			const requested = params?.["protocolVersion"];
+			return { result: {
+				protocolVersion: typeof requested === "string" ? requested : MCP_PROTOCOL_FALLBACK,
+				capabilities: { tools: {} },
+				serverInfo: {
+					name: "ork",
+					version: "0.0.0"
+				}
+			} };
+		}
+		case "ping": return { result: {} };
+		case "tools/list": return { result: { tools: tools.map((t) => ({
+			name: t.name,
+			description: t.description,
+			inputSchema: z.toJSONSchema(t.schema)
+		})) } };
+		case "tools/call": {
+			const tool = tools.find((t) => t.name === params?.["name"]);
+			if (tool === void 0) return { error: {
+				code: -32602,
+				message: "unknown tool"
+			} };
+			try {
+				return { result: await tool.call(params?.["arguments"] ?? {}) };
+			} catch (error) {
+				return { result: {
+					content: [{
+						type: "text",
+						text: error instanceof Error ? error.message : "tool failed"
+					}],
+					isError: true
+				} };
+			}
+		}
+		default: return { error: {
+			code: -32601,
+			message: `unknown method ${method}`
+		} };
+	}
+};
+const authorized = (req, token) => {
+	const expected = Buffer.from(`Bearer ${token}`);
+	const given = Buffer.from(req.headers.authorization ?? "");
+	return given.length === expected.length && timingSafeEqual(given, expected);
+};
+const readBody = async (req) => {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+		size += buffer.length;
+		if (size > MAX_BODY) return null;
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+};
+const respond = (res, status, body) => {
+	if (body === void 0) {
+		res.writeHead(status).end();
+		return;
+	}
+	res.writeHead(status, { "content-type": "application/json" }).end(JSON.stringify(body));
+};
+/** The hook's POST: waits for `hold`; a closed connection gives up. */
+const serveHold = async (req, res, hold) => {
+	if (req.method !== "POST") {
+		respond(res, 405);
+		return;
+	}
+	if (await readBody(req) === null) {
+		respond(res, 413);
+		return;
+	}
+	const gone = new AbortController();
+	res.once("close", () => {
+		gone.abort();
+	});
+	const output = await hold(gone.signal);
+	if (!gone.signal.aborted) respond(res, 200, output);
+};
+const serve = async (req, res, tools, token, hold) => {
+	if (!authorized(req, token)) {
+		respond(res, 401);
+		return;
+	}
+	if (req.url === HOLD_PATH && hold !== void 0) {
+		await serveHold(req, res, hold);
+		return;
+	}
+	if (req.url !== PATH) {
+		respond(res, 404);
+		return;
+	}
+	if (req.method !== "POST") {
+		respond(res, 405);
+		return;
+	}
+	const body = await readBody(req);
+	if (body === null) {
+		respond(res, 413);
+		return;
+	}
+	let message;
+	try {
+		message = JSON.parse(body);
+	} catch {
+		respond(res, 400);
+		return;
+	}
+	const id = message !== null && typeof message === "object" && "id" in message ? message.id : null;
+	const reply = await handleRpc(tools, message);
+	if (reply === null) {
+		respond(res, 202);
+		return;
+	}
+	respond(res, 200, {
+		jsonrpc: "2.0",
+		id,
+		...reply
+	});
+};
+/**
+* Serves Ork's tools to one `claude` CLI session: on 127.0.0.1 only, on a
+* random port, behind a per-session bearer token.
+*/
+const startOrkMcpHttp = async (tools, hold) => {
+	const token = randomBytes(24).toString("hex");
+	const http = createServer((req, res) => {
+		serve(req, res, tools, token, hold).catch(() => {
+			if (!res.headersSent) respond(res, 500);
+		});
+	});
+	await new Promise((resolve) => {
+		http.listen(0, "127.0.0.1", resolve);
+	});
+	const address = http.address();
+	const port = typeof address === "object" && address !== null ? address.port : 0;
+	return {
+		url: `http://127.0.0.1:${port}${PATH}`,
+		holdUrl: `http://127.0.0.1:${port}${HOLD_PATH}`,
+		token,
+		close: () => new Promise((resolve) => {
+			http.closeAllConnections();
+			http.close(() => {
+				resolve();
+			});
+		})
+	};
+};
+// ../runtime/src/session-leg.ts
+/**
+* @file One process (leg) of a session the runner drives: it writes the queued
+*   stdin lines, yields the adapter's decoded events, and says how it ended. A
+*   session is one leg, or several when a paused node's tool call was deferred
+*   or a message waits for a tool that takes none mid-session; a resumed leg
+*   carries what the legs before it spent, and its start is not news.
+*/
+const REASON_LIMIT = 500;
+/** Marks a session's start with the driver that runs it. */
+const withDriver = (event, driver) => event.type === "session.started" ? {
+	...event,
+	driver
+} : event;
+/** A finished event for a session the driver could not run. */
+const driverFailure = (message) => ({
+	type: "session.finished",
+	outcome: {
+		subtype: "error_driver",
+		sessionId: "",
+		report: null,
+		text: "",
+		usage: {
+			costUsd: 0,
+			inputTokens: 0,
+			outputTokens: 0,
+			cacheReadTokens: 0,
+			cacheWriteTokens: 0,
+			turns: 0,
+			durationMs: 0
+		},
+		errors: [message]
+	}
+});
+/**
+* What one decoded line yields, and how the leg ends if it does: a result is
+* the session's end, unless the hold hook deferred a call or a message waits; a
+* resumed leg's start is not news, and its end carries what the legs before it
+* spent.
+*/
+const legStep = (decoded, input) => {
+	const { adapter, carried } = input;
+	const deferred = input.deferred() && decoded.deferred === true;
+	const events = [];
+	let ended;
+	for (const said of decoded.events) {
+		const event = said.type === "session.finished" && input.reported !== void 0 ? {
+			...said,
+			outcome: {
+				...said.outcome,
+				report: input.reported()
+			}
+		} : said;
+		if (event.type === "session.started" && carried !== void 0) continue;
+		if (event.type !== "session.finished") events.push(withDriver(event, adapter.driver));
+		else if (deferred) ended = {
+			kind: "deferred",
+			sessionId: event.outcome.sessionId,
+			usage: event.outcome.usage,
+			last: event
+		};
+		else {
+			const usage = carried === void 0 ? event.outcome.usage : adapter.usage.combine(carried, event.outcome.usage);
+			const last = {
+				...event,
+				outcome: {
+					...event.outcome,
+					usage
+				}
+			};
+			if (input.withhold() && event.outcome.subtype === "success") ended = {
+				kind: "continued",
+				sessionId: event.outcome.sessionId,
+				usage: event.outcome.usage,
+				last
+			};
+			else {
+				events.push(last);
+				ended = { kind: "finished" };
+			}
+		}
+	}
+	return ended === void 0 ? { events } : {
+		events,
+		ended
+	};
+};
+/** Noise a Node crash ends stderr with, or a stack frame: never the reason. */
+const isNoise = (line) => /^Node\.js v\d/u.test(line) || /^\s+at /u.test(line);
+/**
+* Why a process ended without a result: the last block of its stderr as one
+* masked, capped line (the reason reaches the terminal, which is not masked).
+*/
+const failureReason = (name, stderr, code) => {
+	const block = stderr.split("\n").filter((line) => !isNoise(line)).join("\n").split(/\n\s*\n/u).map((text) => text.trim().replaceAll(/\s*\n\s*/gu, " ")).findLast((text) => text !== "");
+	return block === void 0 ? `${name} exited with code ${String(code)}` : maskSecrets(block).slice(0, REASON_LIMIT);
+};
+/** Runs one process of a session, yielding its events; returns how it ended. */
+const runLeg = async function* (input) {
+	const child = spawn(input.bin, input.args, {
+		cwd: input.cwd,
+		env: { ...input.env },
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		]
+	});
+	const exited = new Promise((resolve) => {
+		child.on("close", (code, signal) => {
+			resolve({
+				code,
+				signal
+			});
+		});
+	});
+	const spawnError = new Promise((resolve) => {
+		child.on("error", resolve);
+	});
+	let stderr = "";
+	child.stderr.setEncoding("utf8");
+	child.stderr.on("data", (chunk) => {
+		stderr = (stderr + chunk).slice(-16384);
+	});
+	const write = (line) => {
+		if (child.stdin.writable) child.stdin.write(line);
+	};
+	let stopped = false;
+	input.attach({
+		write,
+		stop: () => {
+			stopped = true;
+			child.kill("SIGINT");
+		}
+	});
+	for (const line of input.pending.splice(0)) write(line);
+	if (input.adapter.command.input === void 0) child.stdin.end();
+	let outcome;
+	const { decoder } = input;
+	const decode = decoder?.decode ?? input.adapter.decoder?.() ?? input.adapter.decode;
+	try {
+		for await (const line of createInterface({ input: child.stdout })) {
+			const { events, ended } = legStep(decode(line), input);
+			yield* events;
+			if (ended !== void 0) {
+				child.stdin.end();
+				outcome = ended;
+			}
+		}
+		const end = await Promise.race([exited, spawnError.then((error) => error)]);
+		if (outcome !== void 0) return outcome;
+		if (decoder !== void 0 && !(end instanceof Error) && !stopped && end.signal === null) {
+			const { events, ended } = legStep({ events: decoder.exit(end.code) }, input);
+			yield* events;
+			if (ended !== void 0) return ended;
+		}
+		if (end instanceof Error) return {
+			kind: "failed",
+			reason: `could not start ${input.bin}: ${end.message}`
+		};
+		return {
+			kind: "failed",
+			reason: stopped || end.signal !== null ? "interrupted" : failureReason(input.adapter.command.bin, stderr, end.code)
+		};
+	} finally {
+		input.attach();
+		if (child.exitCode === null) child.kill();
+	}
+};
+// ../runtime/src/tools/ask-user.ts
+const askUserTool = defineTool({
+	name: "ask_user",
+	description: "Ask the user to decide something only they can decide. Give two to four options and the one you recommend. The run waits for the answer.",
+	shape: {
+		question: z.string().describe("One clear question."),
+		options: z.array(z.object({
+			id: z.string().describe("A short id, e.g. 'keep-api'."),
+			label: z.string().optional(),
+			description: z.string().optional().describe("What choosing it means.")
+		})).min(2).max(4),
+		recommended: z.string().optional().describe("The id you recommend."),
+		context: z.string().optional().describe("What the user needs to know to decide, in a few sentences.")
+	},
+	run: async ({ nodeId, ports }, args) => {
+		let note;
+		let owner;
+		const question = {
+			nodeId,
+			onNote: (given) => {
+				note = given;
+			},
+			onOwner: (given) => {
+				owner = given;
+			},
+			question: args.question,
+			options: args.options.map((o) => {
+				const choice = { id: o.id };
+				if (o.label !== void 0) choice.label = o.label;
+				if (o.description !== void 0) choice.description = o.description;
+				return choice;
+			})
+		};
+		if (args.recommended !== void 0) question.recommended = args.recommended;
+		if (args.context !== void 0) question.context = args.context;
+		const answer = await ports.human.ask(question);
+		const who = owner === void 0 ? "The user" : `Your owner, \`${owner}\`,`;
+		return text(note === void 0 ? `${who} chose: ${answer}` : `${who} chose: ${answer}\nThey said: ${note}`);
+	}
+});
+// ../runtime/src/tools/claims.ts
+/**
+* @file `claim` and `release`: a session's side of the run's claims. A node
+*   claims a file, folder or other resource before changing it, so nodes
+*   running at the same time do not change the same thing; a refused claim says
+*   who holds it. Only sessions that may write while another does get them.
+*/
+const contended = ({ ports }) => ports.claims?.contended() === true;
+const resource = z.string().min(1).describe("A path from the project root (a folder covers everything in it), or a name for something else shared, e.g. 'db:migrations'.");
+const claimTool = defineTool({
+	name: "claim",
+	description: "Claim a file, folder or other shared resource before you change it, so other nodes running in this run leave it alone. If another node holds it (or something overlapping), you are told who; Ork tells you when it is released.",
+	shape: { resource },
+	available: contended,
+	run: ({ ports }, args) => {
+		const claimed = ports.claims?.claim(args.resource);
+		if (claimed === void 0) return Promise.resolve(text("No claims."));
+		if (!claimed.ok) return Promise.resolve(text(`Not claimed: ${claimed.error}.`));
+		return Promise.resolve(text(claimed.already ? `You already hold ${claimed.resource}.` : `Claimed ${claimed.resource}.`));
+	}
+});
+const releaseTool = defineTool({
+	name: "release",
+	description: "Release a claim you are done with, so other nodes can take it. Ork releases your remaining claims when you finish.",
+	shape: { resource },
+	available: contended,
+	run: ({ ports }, args) => {
+		const released = ports.claims?.release(args.resource);
+		if (released === void 0) return Promise.resolve(text("No claims."));
+		return Promise.resolve(text(released.ok ? `Released ${released.resource}.` : `Not released: ${released.error}.`));
+	}
+});
+// ../runtime/src/tools/delegate.ts
+const BRIEF = z.string().min(1).describe("Self-contained: the goal, the files that matter, and what done looks like. The child does not see your conversation.");
+/** What the leader reads back: each report without the usage details. */
+const reportLine = (report) => {
+	const { usage, ...output } = report.output;
+	const cost = usage !== null && typeof usage === "object" && "costUsd" in usage ? usage.costUsd : void 0;
+	return {
+		child: report.child,
+		ok: report.ok,
+		...output,
+		...cost === void 0 ? {} : { costUsd: cost },
+		...report.ok || report.error === void 0 || report.error === output["summary"] ? {} : { error: report.error }
+	};
+};
+const delegationText = (delegation) => text(JSON.stringify({
+	reports: delegation.reports.map(reportLine),
+	...delegation.notes.length > 0 ? { notes: delegation.notes } : {}
+}));
+/** Why a child the leader owns isn't offered, so it doesn't go looking. */
+const fannedNote = (fanned) => fanned.length === 0 ? "" : ` Not listed: ${fanned.join(", ")}; such a node runs once per item of a list, from its edges, so it can't be delegated to.`;
+const delegateTool = defineTool({
+	name: "delegate",
+	description: ({ ports }) => `Hand tasks to nodes you own. Tasks in one call run in parallel; the call returns every child's report when all are done. Ork merges a passing child's branch into yours.${fannedNote(ports.ownership?.fanned ?? [])}`,
+	shape: ({ ports }) => {
+		const ids = ports.ownership?.children.map((child) => child.id) ?? [];
+		return { tasks: z.array(z.strictObject({
+			child: z.enum(ids).describe(`The id of a node you own: ${ids.join(", ")}.`),
+			brief: BRIEF
+		})).min(1) };
+	},
+	available: ({ ports }) => (ports.ownership?.children.length ?? 0) > 0,
+	run: async ({ ports }, args) => {
+		if (ports.ownership === void 0) return text("You own no nodes.");
+		return delegationText(await ports.ownership.delegate(args.tasks));
+	}
+});
+const spawnWorkerTool = defineTool({
+	name: "spawn_worker",
+	description: "Start new instances of a child worker for work that splits into independent parts. Each runs in its own worktree; the call returns their reports when all are done.",
+	shape: ({ ports }) => {
+		const ids = ports.ownership?.templates ?? [];
+		return { tasks: z.array(z.strictObject({
+			template: z.enum(ids).describe(`The id of a child worker you own: ${ids.join(", ")}.`),
+			brief: BRIEF
+		})).min(1) };
+	},
+	available: ({ ports }) => ports.ownership !== void 0 && ports.ownership.templates.length > 0 && ports.ownership.workersLeft() > 0,
+	run: async ({ ports }, args) => {
+		if (ports.ownership === void 0) return text("You own no workers.");
+		return delegationText(await ports.ownership.spawn(args.tasks));
+	}
+});
+// ../runtime/src/tools/feedback.ts
+/**
+* @file `feedback`: a session's way to report what got in its way, kept on the
+*   user's machine (specs/feedback.md). Every session inside a run gets it; Ork
+*   caps reports per session and drops a run's duplicates.
+*/
+const feedbackTool = defineTool({
+	name: "feedback",
+	description: "Report something that materially got in the way of your task: a tool that failed or misled you, context or instructions that were missing or wrong, a skill that did not fit, or a flaw in the workflow. One line plus a short body; at most a few per session. Do not report routine work or your own mistakes.",
+	shape: {
+		kind: z.enum(FEEDBACK_KINDS),
+		target: z.enum(FEEDBACK_TARGETS).optional().describe("What it is about: ork (the harness and its tools), workflow (this workflow's briefs, models, budgets, loops), or project (AGENTS.md, CLAUDE.md, skills, docs). Default: from the kind."),
+		severity: z.enum(FEEDBACK_SEVERITIES).optional(),
+		title: z.string().min(1).describe("One line."),
+		body: z.string().optional().describe("A few sentences: what happened and what would have helped."),
+		evidence: z.array(z.string()).optional().describe("File paths, tool names; never pasted file contents.")
+	},
+	available: ({ ports }) => ports.feedback !== void 0,
+	run: ({ ports }, args) => {
+		const draft = {
+			kind: args.kind,
+			title: args.title
+		};
+		if (args.target !== void 0) draft.target = args.target;
+		if (args.severity !== void 0) draft.severity = args.severity;
+		if (args.body !== void 0) draft.body = args.body;
+		if (args.evidence !== void 0) draft.evidence = args.evidence;
+		const sent = ports.feedback?.report(draft);
+		if (sent === void 0) return Promise.resolve(text("No feedback here."));
+		return Promise.resolve(text(sent.ok ? "Recorded. Thank you; carry on with your task." : `Not recorded: ${sent.error}.`));
+	}
+});
+// ../runtime/src/tools/input.ts
+/**
+* @file `read_input`: what the workflow sent a node back with, whole. A loop's
+*   re-entry note shows the first 8 KiB of it; when that cut it, the session
+*   gets this tool and reads the rest a page at a time, so a long review's last
+*   findings reach the node.
+*/
+/** The characters one call returns. */
+const INPUT_PAGE = 32e3;
+const readInputTool = defineTool({
+	name: "read_input",
+	description: `Read what the workflow sent your task back with, whole, when Ork's message cut it. Returns up to ${INPUT_PAGE.toLocaleString("en-US")} characters, from \`from\`.`,
+	shape: { from: z.number().int().nonnegative().optional().describe("The character to start at. Default: 0.") },
+	available: ({ ports }) => ports.input !== void 0,
+	run: ({ ports }, args) => {
+		const whole = ports.input ?? "";
+		const from = Math.min(args.from ?? 0, whole.length);
+		const end = Math.min(from + INPUT_PAGE, whole.length);
+		const where = end < whole.length ? `[characters ${String(from)}–${String(end)} of ${String(whole.length)}; call read_input with from: ${String(end)} for the rest]` : `[characters ${String(from)}–${String(end)} of ${String(whole.length)}: the end]`;
+		return Promise.resolve(text(`${whole.slice(from, end)}\n\n${where}`));
+	}
+});
+// ../runtime/src/tools/messages.ts
+/**
+* @file `send_message`, `read_inbox` and `answer`: a session's side of the
+*   run's message bus. A message lands in the recipient's inbox and a live
+*   session gets a one-line notice; `answer` replies to a question Ork asked an
+*   owner about a node it owns. Only sessions inside a run get them.
+*/
+/**
+* Peers are mutual: a node no one may write to has no inbox to read, unless it
+* may be linked later, since a session's tools are set when it starts.
+*/
+const hasPeers = ({ ports }) => (ports.mailbox?.peers().length ?? 0) > 0 || ports.mailbox?.linkable() === true;
+/** A program or a rule may write to a node with no one to write to itself. */
+const hasInbox = (context) => hasPeers(context) || context.ports.mailbox?.hears() === true;
+const MAX_WAIT_SECONDS = 3600;
+const DEFAULT_WAIT_SECONDS = 300;
+const inboxText = (unread) => JSON.stringify({ messages: unread.map((m) => ({
+	from: m.from,
+	...m.via === void 0 ? {} : { via: m.via },
+	body: m.body
+})) });
+const sendMessageTool = defineTool({
+	name: "send_message",
+	description: "Send a short message to a node you can reach: your owner, a node you own, one you share a declared channel with, or a node of another run the user linked you to. It sees a notice and reads the message with read_inbox. Use it for what they need to know now; your report still goes to your owner at the end.",
+	shape: {
+		to: z.string().describe("The node's id, or <run>/<node> for a linked node."),
+		body: z.string().min(1).describe("Self-contained: the recipient does not see your work.")
+	},
+	available: hasPeers,
+	run: ({ ports }, args) => {
+		const sent = ports.mailbox?.send(args.to, args.body);
+		if (sent === void 0) return Promise.resolve(text("No message bus."));
+		if (!sent.ok) return Promise.resolve(text(`Not sent: ${sent.error}.`));
+		return Promise.resolve(text(sent.delivered === "now" ? `Sent to ${args.to}; it sees a notice at its next step.` : `Sent to ${args.to}; it is not running now and sees the message if it starts again.`));
+	}
+});
+const readInboxTool = defineTool({
+	name: "read_inbox",
+	description: "Read your unread messages from other nodes, oldest first. Ork tells you when one arrives.",
+	shape: {},
+	available: hasInbox,
+	run: ({ ports }) => {
+		const unread = ports.mailbox?.read() ?? [];
+		return Promise.resolve(text(unread.length === 0 ? "No unread messages." : inboxText(unread)));
+	}
+});
+const waitForMessagesTool = defineTool({
+	name: "wait_for_messages",
+	description: "Wait for a message from another node when you cannot go on without its reply, instead of ending your session. Returns what arrived, or says none did in time. You hold no session slot while you wait.",
+	shape: { timeoutSeconds: z.number().int().positive().max(MAX_WAIT_SECONDS).optional().describe(`How long to wait. Default: ${String(DEFAULT_WAIT_SECONDS)}.`) },
+	available: hasInbox,
+	run: async ({ ports }, args) => {
+		const seconds = args.timeoutSeconds ?? DEFAULT_WAIT_SECONDS;
+		await ports.mailbox?.wait(seconds * 1e3);
+		const unread = ports.mailbox?.read() ?? [];
+		return text(unread.length === 0 ? `No message yet, after waiting up to ${String(seconds)} seconds. Ork may have told you something; if not, wait again or go on.` : inboxText(unread));
+	}
+});
+const answerTool = defineTool({
+	name: "answer",
+	description: "Answer a question Ork asked you as the owner of a node, such as a loop of yours that ran out of rounds. The question's id and options are in Ork's message.",
+	shape: {
+		question: z.string().describe("The question's id, e.g. 'q1'."),
+		choice: z.string().describe("One of its options."),
+		note: z.string().optional().describe("Why, in a sentence or two; it is recorded with your answer.")
+	},
+	available: ({ ports }) => ports.mailbox !== void 0 && ports.ownership !== void 0,
+	run: ({ ports }, args) => {
+		const answered = ports.mailbox?.answer(args.question, args.choice, args.note);
+		if (answered === void 0) return Promise.resolve(text("No questions."));
+		return Promise.resolve(text(answered.ok ? `Answered ${args.question}: ${args.choice}.` : `Not answered: ${answered.error}.`));
+	}
+});
+// ../runtime/src/tools/permission.ts
+/**
+* @file `permission`: the `claude` CLI's `--permission-prompt-tool`, which
+*   sends each permission prompt to the run's `HumanChannel`.
+*/
+const permissionTool = defineTool({
+	name: "permission",
+	description: "Ork's permission prompt for the claude CLI.",
+	shape: {
+		tool_name: z.string(),
+		input: z.record(z.string(), z.unknown()),
+		tool_use_id: z.string().optional()
+	},
+	preapproved: false,
+	available: ({ driver }) => driver === "claude-code",
+	run: async ({ nodeId, ports }, args) => {
+		const decision = await ports.human.permit({
+			nodeId,
+			toolName: args.tool_name,
+			input: args.input
+		});
+		return text(JSON.stringify(decision.allow ? {
+			behavior: "allow",
+			updatedInput: args.input
+		} : {
+			behavior: "deny",
+			message: decision.message
+		}));
+	}
+});
+// ../runtime/src/tools/report.ts
+/**
+* @file The `report` tool: how a session hands Ork its final report when its
+*   driver cannot hold the final answer to a JSON Schema itself (`reportSchema`
+*   false, RFC-014). The report is checked against the node's report schema
+*   with zod; a report that breaks it comes back to the model as a tool error
+*   naming each violation, so it can fix it and call again. One that fits is
+*   kept as the session's report, and the session runner ends the session with
+*   it instead of what the tool's last line says.
+*/
+const REPORT_TOOL = "report";
+/** Whether the driver holds a session's final answer to its schema itself. */
+const checksItsReport = (driver) => AGENT_DRIVERS.find((d) => d.id === driver)?.capabilities.reportSchema ?? true;
+/**
+* The report schema as zod. shortcut: a schema zod cannot read takes any
+* object, and `parseReport` still demands a status and a summary; upgrade if a
+* node's `output.schema` ever uses JSON Schema zod does not support.
+*/
+const reportValidator = (schema) => {
+	try {
+		return z.fromJSONSchema(schema);
+	} catch {
+		return z.record(z.string(), z.unknown());
+	}
+};
+const failed = (why) => ({
+	...text(`The report was not accepted; fix it and call ${REPORT_TOOL} again.\n${why}`),
+	isError: true
+});
+const bound = (report) => {
+	const schema = reportValidator(report.schema);
+	return {
+		name: REPORT_TOOL,
+		description: "Hand in your final report: call this once your work is done, as your last step, with the report the task asks for. A report that does not fit comes back with what to fix; call again with the fixed report. The last report accepted is the one your owner gets.",
+		shape: schema instanceof z.ZodObject ? schema.shape : {},
+		schema,
+		preapproved: true,
+		call: (args) => {
+			const parsed = schema.safeParse(args, { reportInput: true });
+			if (!parsed.success) return Promise.resolve(failed(readableIssues(parsed.error.issues)));
+			const kept = parseReport(parsed.data);
+			if (kept === null) return Promise.resolve(failed("A report needs a `status` and a `summary`."));
+			report.submit(kept);
+			return Promise.resolve(text("Report accepted. End your turn now; there is nothing more to do."));
+		}
+	};
+};
+// ../runtime/src/tools/registry.ts
+/**
+* @file The registry of Ork's MCP tools. Both drivers serve what it binds for a
+*   session; a new tool is one file here and one line in `ORK_TOOLS`.
+*/
+const ORK_TOOLS = [
+	askUserTool,
+	permissionTool,
+	delegateTool,
+	spawnWorkerTool,
+	sendMessageTool,
+	readInboxTool,
+	waitForMessagesTool,
+	answerTool,
+	readInputTool,
+	claimTool,
+	releaseTool,
+	feedbackTool,
+	{
+		name: REPORT_TOOL,
+		bind: (context) => context.report === void 0 || checksItsReport(context.driver) ? null : bound(context.report)
+	}
+];
+/** The tools one session gets. */
+const orkTools = (context) => ORK_TOOLS.flatMap((tool) => tool.bind(context) ?? []);
+/** Their Claude Code names, for the session's allowed tools. */
+const preapprovedTools = (tools) => tools.filter((t) => t.preapproved).map((t) => toolId(t.name));
+// ../runtime/src/session-runner.ts
+/** A spec that resumes `sessionId`; a fork's later legs continue the fork. */
+const resumed = (spec, sessionId) => ({
+	...spec,
+	resume: sessionId,
+	fork: false
+});
+/**
+* Wires a session to Ork's endpoint, yielding a `session.waiting` event each
+* time the wiring says it waits (a lease waits for its checkout).
+*/
+const wireSaying = async function* (adapter, spec, endpoint, signal, options) {
+	const waits = [];
+	let woke;
+	const woken = () => new Promise((resolve) => {
+		woke = () => {
+			resolve(false);
+		};
+	});
+	const wiring = adapter.mcp.wire(spec, endpoint, {
+		waiting: (reason) => {
+			waits.push(reason);
+			woke?.();
+		},
+		signal,
+		bin: options.bin ?? adapter.command.bin,
+		env: options.env ?? process.env,
+		...options.runs === void 0 ? {} : { runs: options.runs }
+	});
+	const done = wiring.then(() => true, () => true);
+	for (;;) {
+		const finished = waits.length === 0 && await Promise.race([done, woken()]);
+		for (const reason of waits.splice(0)) yield {
+			type: "session.waiting",
+			reason
+		};
+		if (finished) return wiring;
+	}
+};
+/**
+* A runtime that drives `adapter`'s tool, as the user installed and logged it
+* in. Ork never reads or passes its credentials.
+*/
+const createSessionRuntime = (adapter, options = {}) => ({
+	driver: adapter.driver,
+	start: (spec, ports) => {
+		const { input } = adapter.command;
+		const pending = input === void 0 ? [] : [input(spec.prompt, false)];
+		const queued = [];
+		let io;
+		const ended = new AbortController();
+		/** The hold hook deferred a call in the running process. */
+		let deferring = false;
+		/** The last report the `report` tool accepted, across legs. */
+		let reported = null;
+		const { hold } = ports;
+		const hook = hold === void 0 ? void 0 : adapter.hold;
+		const events = async function* () {
+			const tools = orkTools({
+				nodeId: spec.nodeId,
+				driver: adapter.driver,
+				ports,
+				report: {
+					schema: spec.reportSchema,
+					submit: (report) => {
+						reported = report;
+					}
+				}
+			});
+			const byTool = tools.some((tool) => tool.name === REPORT_TOOL);
+			const mcp = await startOrkMcpHttp(tools, hold === void 0 || hook === void 0 ? void 0 : async (gone) => {
+				const answer = await holdAtTool(hold, AbortSignal.any([gone, ended.signal]), options.holdWindowMs ?? hook.windowMs);
+				if (answer === "defer") deferring = true;
+				return hook.answer(answer);
+			});
+			const endpoint = hook === void 0 ? {
+				url: mcp.url,
+				token: mcp.token
+			} : mcp;
+			const allowed = preapprovedTools(tools);
+			let wired;
+			try {
+				try {
+					wired = yield* wireSaying(adapter, spec, endpoint, ended.signal, options);
+				} catch (error) {
+					yield driverFailure(`could not reach Ork's tools: ${error instanceof Error ? error.message : String(error)}`);
+					return;
+				}
+				const env = {
+					...options.env ?? process.env,
+					...adapter.context.env(spec),
+					...wired.env
+				};
+				const legOf = (legSpec, carried) => ({
+					adapter,
+					bin: options.bin ?? adapter.command.bin,
+					env,
+					cwd: spec.cwd,
+					args: [...adapter.command.args(legSpec, {
+						endpoint,
+						allowed
+					}), ...wired?.args ?? []],
+					carried,
+					...adapter.legDecoder === void 0 ? {} : { decoder: adapter.legDecoder(legSpec) },
+					pending,
+					deferred: () => deferring,
+					withhold: () => input === void 0 && queued.length > 0,
+					...byTool ? { reported: () => reported } : {},
+					attach: (attached) => {
+						io = attached;
+					}
+				});
+				let legSpec = spec;
+				let spent;
+				for (;;) {
+					if (ended.signal.aborted) {
+						yield driverFailure("interrupted");
+						return;
+					}
+					const leg = yield* runLeg(legOf(legSpec, spent));
+					if (leg.kind === "failed") {
+						yield driverFailure(leg.reason);
+						return;
+					}
+					if (leg.kind === "finished") return;
+					deferring = false;
+					spent = spent === void 0 ? leg.usage : adapter.usage.combine(spent, leg.usage);
+					if (leg.kind === "deferred") await hold?.wait("tool", ended.signal);
+					if (ended.signal.aborted) {
+						yield leg.last;
+						return;
+					}
+					legSpec = leg.kind === "continued" ? {
+						...resumed(spec, leg.sessionId),
+						prompt: queued.splice(0).join("\n\n")
+					} : resumed(spec, leg.sessionId);
+				}
+			} finally {
+				await wired?.release();
+				await mcp.close();
+			}
+		};
+		return {
+			events: events(),
+			send: (text) => {
+				if (input === void 0) {
+					queued.push(text);
+					return;
+				}
+				const line = input(text, true);
+				if (io === void 0) pending.push(line);
+				else io.write(line);
+			},
+			interrupt: () => {
+				ended.abort();
+				io?.stop();
+				return Promise.resolve();
+			}
+		};
+	}
+});
+// ../runtime/src/adapters/claude-code-events.ts
+/**
+* @file The `claude-code` adapter's `EventDecoder` and `UsageReader`: maps the
+*   `claude` CLI's `stream-json` lines to Ork's runtime events, marks the
+*   result of a turn the hold hook deferred, and adds up a session's legs.
+*/
+const isObject$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const get$1 = (value, key) => isObject$2(value) ? value[key] : void 0;
+const num$2 = (value) => typeof value === "number" ? value : 0;
+const str$2 = (value) => typeof value === "string" ? value : "";
+const blocks = (message) => {
+	const content = get$1(get$1(message, "message"), "content");
+	return Array.isArray(content) ? content.filter((item) => isObject$2(item)) : [];
+};
+const usageOf = (result) => {
+	const usage = get$1(result, "usage");
+	return {
+		costUsd: num$2(result["total_cost_usd"]),
+		inputTokens: num$2(get$1(usage, "input_tokens")),
+		outputTokens: num$2(get$1(usage, "output_tokens")),
+		cacheReadTokens: num$2(get$1(usage, "cache_read_input_tokens")),
+		cacheWriteTokens: num$2(get$1(usage, "cache_creation_input_tokens")),
+		turns: num$2(result["num_turns"]),
+		durationMs: num$2(result["duration_ms"])
+	};
+};
+/** The outcome a `result` message describes. */
+const outcomeOf = (result) => {
+	const errors = result["errors"];
+	return {
+		subtype: str$2(result["subtype"]) || "unknown",
+		sessionId: str$2(result["session_id"]),
+		report: parseReport(result["structured_output"]),
+		text: str$2(result["result"]),
+		usage: usageOf(result),
+		errors: Array.isArray(errors) ? errors.filter((e) => typeof e === "string") : []
+	};
+};
+/** The year 2286: a reset beyond this is not in seconds. */
+const MAX_RESET_SECONDS = 1e10;
+/**
+* What a subscription's limit said (RFC-007). Only the fields Claude Code
+* documents are read, so `utilization`, often absent, plays no part.
+*/
+const planLimitOf = (info) => {
+	const status = get$1(info, "status");
+	if (status !== "allowed" && status !== "allowed_warning" && status !== "rejected") return [];
+	const window = get$1(info, "rateLimitType");
+	const resets = get$1(info, "resetsAt");
+	const overage = get$1(info, "overageStatus");
+	return [{
+		type: "plan.limit",
+		status: status === "rejected" && !(status === "rejected" && overage !== "allowed" && overage !== "allowed_warning") ? "allowed_warning" : status,
+		window: typeof window === "string" ? window : "plan",
+		...typeof resets === "number" && resets > 0 && resets < MAX_RESET_SECONDS ? { resetsAt: (/* @__PURE__ */ new Date(resets * 1e3)).toISOString() } : {}
+	}];
+};
+/** Maps one driver message to zero or more normalized events. */
+const normalize = (message) => {
+	if (!isObject$2(message)) return [];
+	switch (message["type"]) {
+		case "system": {
+			if (message["subtype"] !== "init") return [];
+			const started = {
+				type: "session.started",
+				sessionId: str$2(message["session_id"]),
+				model: str$2(message["model"])
+			};
+			if (str$2(message["cwd"]) !== "") started.cwd = str$2(message["cwd"]);
+			return [started];
+		}
+		case "assistant": return blocks(message).flatMap((block) => {
+			if (block["type"] === "text" && str$2(block["text"]).trim() !== "") return [{
+				type: "assistant.text",
+				text: str$2(block["text"])
+			}];
+			if (block["type"] === "tool_use") {
+				const input = block["input"];
+				return [{
+					type: "tool.called",
+					id: str$2(block["id"]),
+					name: str$2(block["name"]),
+					input: isObject$2(input) ? input : {}
+				}];
+			}
+			return [];
+		});
+		case "user": return blocks(message).filter((block) => block["type"] === "tool_result").map((block) => ({
+			type: "tool.result",
+			id: str$2(block["tool_use_id"]),
+			isError: block["is_error"] === true
+		}));
+		case "rate_limit_event": return planLimitOf(message["rate_limit_info"]);
+		case "result": return [{
+			type: "session.finished",
+			outcome: outcomeOf(message)
+		}];
+		default: return [];
+	}
+};
+/** Whether a stream-json message is the result of a deferred tool call. */
+const isDeferredResult = (message) => get$1(message, "type") === "result" && get$1(message, "stop_reason") === "tool_deferred";
+const parseLine$2 = (line) => {
+	try {
+		return JSON.parse(line);
+	} catch {
+		return;
+	}
+};
+/** One `stream-json` line, decoded. */
+const decodeClaudeLine = (line) => {
+	const message = parseLine$2(line);
+	return {
+		events: normalize(message),
+		deferred: isDeferredResult(message)
+	};
+};
+/**
+* Two legs of one session, as one: the tokens of both, and the later leg's
+* cost, which is already the session's total (ADR-046).
+*/
+const addUsage = (a, b) => ({
+	costUsd: Math.max(a.costUsd, b.costUsd),
+	inputTokens: a.inputTokens + b.inputTokens,
+	outputTokens: a.outputTokens + b.outputTokens,
+	cacheReadTokens: a.cacheReadTokens + b.cacheReadTokens,
+	cacheWriteTokens: a.cacheWriteTokens + b.cacheWriteTokens,
+	turns: a.turns + b.turns,
+	durationMs: a.durationMs + b.durationMs
+});
+/** `claude` reports dollars (a client-side estimate) and tokens. */
+const claudeUsage = {
+	dollars: true,
+	combine: addUsage
+};
+// ../runtime/src/adapters/claude-code.ts
+/**
+* Per-request timeout for Ork's MCP server, in ms. The CLI otherwise gives an
+* HTTP server's request 60 seconds and drops a call silent for 5 minutes, and
+* `delegate` waits for whole child sessions (the per-server `timeout` raises
+* both; `MCP_TOOL_TIMEOUT` still caps it).
+*/
+const ORK_TOOL_TIMEOUT_MS = 864e5;
+/** Claude Code's switch for the one-hour prompt cache. */
+const PROMPT_CACHE_1H = "ENABLE_PROMPT_CACHING_1H";
+/** Claude Code's switch that turns its auto-memory off. */
+const NO_AUTO_MEMORY = "CLAUDE_CODE_DISABLE_AUTO_MEMORY";
+/**
+* The CLI flag that moves the per-machine sections (working directory, memory
+* path, git status) out of the system prompt.
+*/
+const EXCLUDE_DYNAMIC_SECTIONS = "--exclude-dynamic-system-prompt-sections";
+/** How long a hook holds a call before it defers it instead. */
+const HOLD_WINDOW_MS = 54e4;
+/** The variables a session's prompt cache asks of Claude Code. */
+const cacheEnv = (spec) => spec.promptCache === "1h" ? { [PROMPT_CACHE_1H]: "1" } : {};
+/** Whether the session loads no MCP server but Ork's. */
+const strictMcpOf = (spec) => spec.tools.strictMcp === true || spec.machineClaude !== true;
+/** The variables that keep the machine's auto-memory out of a session. */
+const memoryEnv = (spec) => spec.machineClaude === true ? {} : { [NO_AUTO_MEMORY]: "1" };
+/** Everything a session adds to its driver's environment. */
+const driverEnv = (spec) => ({
+	...cacheEnv(spec),
+	...memoryEnv(spec)
+});
+/** A later message goes in at the next step, even mid-turn. */
+const userLine = (text, later = false) => `${JSON.stringify({
+	type: "user",
+	message: {
+		role: "user",
+		content: text
+	},
+	parent_tool_use_id: null,
+	...later ? { priority: "next" } : {}
+})}\n`;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* The node's `--settings` with Ork's `PreToolUse` HTTP hook added: before every
+* tool call, pre-approved ones included, the session asks whether its node may
+* go on.
+*/
+const withHoldHook = (settings, holdUrl, token) => {
+	const hooks = isRecord(settings?.["hooks"]) ? settings["hooks"] : {};
+	const listed = hooks["PreToolUse"];
+	const before = Array.isArray(listed) ? [...listed] : [];
+	const hook = {
+		type: "http",
+		url: holdUrl,
+		headers: { Authorization: `Bearer ${token}` },
+		timeout: 600
+	};
+	return {
+		...settings,
+		hooks: {
+			...hooks,
+			PreToolUse: [...before, {
+				matcher: "*",
+				hooks: [hook]
+			}]
+		}
+	};
+};
+/** The hook's answer: nothing to say for "go", the deferral otherwise. */
+const hookOutput = (answer) => answer === "go" ? {} : { hookSpecificOutput: {
+	hookEventName: "PreToolUse",
+	permissionDecision: "defer",
+	permissionDecisionReason: "Ork paused this node; it goes on from this call when it continues."
+} };
+const claudeHold = {
+	answer: hookOutput,
+	windowMs: HOLD_WINDOW_MS
+};
+/**
+* The `claude -p` arguments for a session spec. The brief goes on stdin;
+* `allowed` are the Ork tools that need no permission prompt.
+*/
+const buildCliArgs = (spec, mcp, allowed) => {
+	const mcpConfig = { mcpServers: {
+		...spec.mcpServers,
+		["ork"]: {
+			type: "http",
+			url: mcp.url,
+			headers: { Authorization: `Bearer ${mcp.token}` },
+			timeout: ORK_TOOL_TIMEOUT_MS
+		}
+	} };
+	const args = [
+		"-p",
+		"--input-format",
+		"stream-json",
+		"--output-format",
+		"stream-json",
+		"--verbose",
+		"--setting-sources",
+		spec.settingSources.join(","),
+		"--append-system-prompt",
+		spec.systemAppend,
+		EXCLUDE_DYNAMIC_SECTIONS,
+		"--permission-mode",
+		spec.permissionMode,
+		"--json-schema",
+		JSON.stringify(spec.reportSchema),
+		"--mcp-config",
+		JSON.stringify(mcpConfig),
+		"--permission-prompt-tool",
+		toolId("permission"),
+		"--allowedTools",
+		[...spec.tools.allow, ...allowed].join(",")
+	];
+	if (spec.tools.only !== void 0) args.push("--tools", spec.tools.only.join(","));
+	if (strictMcpOf(spec)) args.push("--strict-mcp-config");
+	if (spec.agents !== void 0) args.push("--agents", JSON.stringify(spec.agents));
+	if (spec.tools.deny.length > 0) args.push("--disallowedTools", spec.tools.deny.join(","));
+	if (spec.model !== void 0) args.push("--model", spec.model);
+	if (spec.effort !== void 0) args.push("--effort", spec.effort);
+	if (spec.maxTurns !== void 0) args.push("--max-turns", String(spec.maxTurns));
+	if (spec.budgetUsd !== void 0) args.push("--max-budget-usd", String(spec.budgetUsd));
+	if (spec.resume !== void 0) args.push("--resume", spec.resume);
+	if (spec.resume !== void 0 && spec.fork === true) args.push("--fork-session");
+	for (const dir of spec.plugins ?? []) args.push("--plugin-dir", dir);
+	const settings = mcp.holdUrl === void 0 ? spec.settings : withHoldHook(spec.settings, mcp.holdUrl, mcp.token);
+	if (settings !== void 0) args.push("--settings", JSON.stringify(settings));
+	return args;
+};
+/** `claude`, as the session runner's strategies. */
+const claudeCodeAdapter = {
+	driver: "claude-code",
+	command: {
+		bin: "claude",
+		args: (spec, leg) => buildCliArgs(spec, leg.endpoint, leg.allowed),
+		input: userLine
+	},
+	decode: decodeClaudeLine,
+	mcp: {
+		kind: "flag",
+		wire: () => Promise.resolve({
+			args: [],
+			env: {},
+			release: () => Promise.resolve()
+		})
+	},
+	permissions: {
+		kind: "callback",
+		denyByDefault: false
+	},
+	usage: claudeUsage,
+	context: {
+		instructions: ["CLAUDE.md", "AGENTS.md"],
+		skills: ".claude/skills",
+		agents: ".claude/agents",
+		env: driverEnv
+	},
+	hold: claudeHold
+};
+// ../runtime/src/lease-ledger.ts
+/**
+* @file The ledger of Command Code leases (RFC-014, `lease.ts`): one record per
+*   checkout in a folder of the project's runs folder, naming the session's
+*   process and its `ork` entry, and the sweep that removes the entry of every
+*   record whose process is gone (the next session's start, and `ork doctor`).
+*   Only the `ork` entry is touched; the user's other entries stay as they
+*   were.
+*/
+/** One session's hold on a checkout. `pid` 0: its entry could not be removed. */
+const LeaseSchema = z.object({
+	id: z.string(),
+	folder: z.string(),
+	pid: z.number(),
+	entry: z.string()
+});
+/** A local-scope file: only `mcpServers` is read; the rest is kept as is. */
+const LocalScopeSchema = z.looseObject({ mcpServers: z.record(z.string(), z.unknown()).optional() });
+const codeOf = (error) => error instanceof Error && "code" in error ? error.code : void 0;
+const CMD_TIMEOUT_MS = 3e4;
+/** Where a project's lease records live, inside its runs folder. */
+const leaseLedger = (runsDir) => path.join(runsDir, ".leases");
+const alive = (pid) => {
+	if (pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return codeOf(error) === "EPERM";
+	}
+};
+const readLease = (file) => {
+	try {
+		return LeaseSchema.parse(JSON.parse(readFileSync(file, "utf8")));
+	} catch {
+		return;
+	}
+};
+const runCmd = (options, args, cwd) => new Promise((resolve) => {
+	execFile(options.bin, args, {
+		cwd,
+		env: { ...options.env ?? process.env },
+		encoding: "utf8",
+		timeout: CMD_TIMEOUT_MS
+	}, (error, stdout, stderr) => {
+		resolve({
+			ok: error === null,
+			out: `${stdout}${stderr}`.trim()
+		});
+	});
+});
+/** Drops the `ork` entry from a local-scope file whose folder is gone. */
+const dropFromFile = (entry) => {
+	if (!existsSync(entry)) return true;
+	try {
+		const config = LocalScopeSchema.parse(JSON.parse(readFileSync(entry, "utf8")));
+		const { ["ork"]: ours, ...others } = config.mcpServers ?? {};
+		if (ours === void 0) return true;
+		const kept = {
+			...config,
+			mcpServers: others
+		};
+		writeFileSync(entry, `${JSON.stringify(kept, null, 2)}\n`, { mode: 384 });
+		return true;
+	} catch {
+		return false;
+	}
+};
+/** Removes a lease's `ork` entry; true once it is gone. */
+const removeEntry = async (options, lease) => {
+	if (!existsSync(lease.folder)) return dropFromFile(lease.entry);
+	const removed = await runCmd(options, [
+		"mcp",
+		"remove",
+		"--scope",
+		"local",
+		"ork"
+	], lease.folder);
+	return removed.ok || removed.out.includes("not found");
+};
+/** Deletes a record if it is still `lease`'s, not a newer one's. */
+const dropRecord = (file, lease) => {
+	if (readLease(file)?.id === lease.id) rmSync(file, { force: true });
+};
+/**
+* Deletes a record that exists but can't be read: records are written whole (a
+* link, a rename), so one that does not parse is corrupt, and stale.
+*/
+const dropIfCorrupt = (file) => {
+	let text;
+	try {
+		text = readFileSync(file, "utf8");
+	} catch {
+		return;
+	}
+	try {
+		LeaseSchema.parse(JSON.parse(text));
+	} catch {
+		rmSync(file, { force: true });
+	}
+};
+/**
+* Removes the `ork` entry of every lease whose session is gone (a crash, or a
+* removal that failed), and its record. Live leases are left alone.
+*/
+const cleanStaleLeases = async (options) => {
+	const sweep = {
+		cleaned: [],
+		failed: []
+	};
+	if (!existsSync(options.ledger)) return sweep;
+	for (const name of readdirSync(options.ledger)) {
+		if (!name.endsWith(".json")) continue;
+		const file = path.join(options.ledger, name);
+		const lease = readLease(file);
+		if (lease === void 0) dropIfCorrupt(file);
+		if (lease === void 0 || alive(lease.pid)) continue;
+		if (await removeEntry(options, lease)) {
+			dropRecord(file, lease);
+			sweep.cleaned.push(lease.folder);
+		} else sweep.failed.push(lease.folder);
+	}
+	return sweep;
+};
+// ../runtime/src/lease.ts
+/**
+* @file The `lease` kind of `McpWiring` (RFC-014): Command Code reads MCP
+*   servers from a per-folder local scope (`~/.commandcode/projects/<slug>/`),
+*   so a session gets Ork's endpoint through an `ork` entry added there with
+*   `cmd mcp add --scope local` and removed with `cmd mcp remove` after it.
+*   Because the entry is per folder, a checkout holds one session at a time: a
+*   record in the ledger (`lease-ledger.ts`) is the lock, and a second session
+*   waits for it, and says so.
+*/
+/**
+* Command Code's folder name for a checkout, as measured on 1.88.5: its real
+* path with every character but letters and digits made `-`, the leading one
+* dropped (`/private/tmp/a b` -> `private-tmp-a-b`). Leases key on it, so two
+* folders Command Code would share also share one lease.
+*/
+const slugOf = (folder) => realpathSync(folder).replaceAll(/[^a-zA-Z0-9]/gu, "-").replace(/^-+/u, "");
+const entryFileOf = (env, slug) => path.join(env["HOME"] ?? homedir(), ".commandcode", "projects", slug, "mcp.json");
+/** Takes the record for `slug`, or returns the live lease that holds it. */
+const tryTake = (file, lease) => {
+	const draft = `${file}.${lease.id}`;
+	writeFileSync(draft, JSON.stringify(lease), { mode: 384 });
+	try {
+		linkSync(draft, file);
+		return;
+	} catch (error) {
+		if (codeOf(error) !== "EEXIST") throw error;
+		const holder = readLease(file);
+		if (holder !== void 0) return holder;
+		dropIfCorrupt(file);
+		return {
+			...lease,
+			pid: 0
+		};
+	} finally {
+		rmSync(draft, { force: true });
+	}
+};
+const masked = (text, endpoint) => maskSecrets(text.replaceAll(endpoint.token, MASK));
+/**
+* The lease's options: those given, else the runner's program, environment and
+* the project's runs folder (the ledger lives there, where `ork doctor`
+* looks).
+*/
+const optionsOf = (given, hooks) => {
+	const ledger = given.ledger ?? (hooks.runs === void 0 ? void 0 : leaseLedger(hooks.runs));
+	if (ledger === void 0) throw new Error("a Command Code session needs the project's runs folder for its lease");
+	const env = given.env ?? hooks.env;
+	return {
+		...given,
+		bin: given.bin ?? hooks.bin ?? "cmd",
+		ledger,
+		...env === void 0 ? {} : { env }
+	};
+};
+/**
+* Ork's endpoint for a Command Code session, through an `ork` entry in the
+* checkout's local scope, held for the session. A second session in the same
+* checkout waits for the first, and says so.
+*/
+const leaseWiring = (given) => ({
+	kind: "lease",
+	wire: async (spec, endpoint, hooks) => {
+		const options = optionsOf(given, hooks);
+		const env = options.env ?? process.env;
+		const slug = slugOf(spec.cwd);
+		const file = path.join(options.ledger, `${slug}.json`);
+		const lease = {
+			id: randomUUID(),
+			folder: realpathSync(spec.cwd),
+			pid: process.pid,
+			entry: entryFileOf(env, slug)
+		};
+		const fail = (message) => {
+			dropRecord(file, lease);
+			throw new Error(masked(message, endpoint));
+		};
+		mkdirSync(options.ledger, {
+			recursive: true,
+			mode: 448
+		});
+		await cleanStaleLeases(options);
+		let told = false;
+		for (;;) {
+			const holder = tryTake(file, lease);
+			if (holder === void 0) break;
+			if (alive(holder.pid)) {
+				if (!told) {
+					hooks.waiting(`waiting for ${lease.folder}: Command Code runs one session per checkout`);
+					told = true;
+				}
+				await setTimeout$1(options.pollMs ?? 1e3, void 0, { signal: hooks.signal });
+			} else {
+				const { failed } = await cleanStaleLeases(options);
+				if (failed.includes(holder.folder)) fail(`could not remove the \`ork\` MCP entry a stopped session left in ${holder.folder}; run \`ork doctor\``);
+			}
+		}
+		const existing = await runCmd(options, [
+			"mcp",
+			"get",
+			"ork"
+		], lease.folder);
+		if (existing.ok && /Scope:\s+local/u.test(existing.out)) fail(`Command Code already has an \`ork\` MCP entry for ${lease.folder}; remove it with \`cmd mcp remove --scope local ork\` there`);
+		const added = await runCmd(options, [
+			"mcp",
+			"add",
+			"--transport",
+			"http",
+			"--scope",
+			"local",
+			"ork",
+			endpoint.url,
+			"--header",
+			`Authorization: Bearer ${endpoint.token}`
+		], lease.folder);
+		if (!added.ok) fail(`cmd mcp add failed: ${added.out}`);
+		return {
+			args: [],
+			env: {},
+			release: async () => {
+				if (await removeEntry(options, lease)) {
+					dropRecord(file, lease);
+					return;
+				}
+				const draft = `${file}.${lease.id}`;
+				writeFileSync(draft, JSON.stringify({
+					...lease,
+					pid: 0
+				}), { mode: 384 });
+				renameSync(draft, file);
+			}
+		};
+	}
+});
+// ../runtime/src/adapters/command-code-events.ts
+const isObject$1 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const num$1 = (value) => typeof value === "number" ? value : 0;
+const str$1 = (value) => typeof value === "string" ? value : "";
+/** Command Code's own tool names, as Ork (and Claude Code) names them. */
+const COMMAND_CODE_TOOLS = {
+	shell: "Bash",
+	shell_command: "Bash",
+	read_file: "Read",
+	read_multiple_files: "Read",
+	read_directory: "Read",
+	glob: "Glob",
+	grep: "Grep",
+	edit_file: "Edit",
+	write_file: "Write",
+	web_fetch: "WebFetch",
+	web_search: "WebSearch",
+	agent: "Task"
+};
+/** A tool's name as Ork shows it; MCP and unknown names stay as they are. */
+const orkToolName = (name) => COMMAND_CODE_TOOLS[name] ?? name;
+/** The result line's subtypes, as Ork's outcome names them. */
+const SUBTYPES = {
+	success: "success",
+	max_turns: "error_max_turns",
+	error: "error_during_execution"
+};
+/** The text blocks of a `message_end` frame's content. */
+const textOf = (content) => (Array.isArray(content) ? content : []).filter((item) => isObject$1(item)).filter((block) => block["type"] === "text").map((block) => str$1(block["text"])).join("");
+/** The frames that end a tool call as an error: failed, denied, or blocked. */
+const REFUSED = /* @__PURE__ */ new Set([
+	"tool_errored",
+	"tool_denied",
+	"tool_hook_blocked"
+]);
+const parseLine$1 = (line) => {
+	try {
+		return JSON.parse(line);
+	} catch {
+		return;
+	}
+};
+/** A decoder for one leg of a Command Code session. */
+const commandCodeDecoder = () => {
+	let sessionId = "";
+	let turns = 0;
+	const frame = (event) => {
+		const type = event["type"];
+		const id = str$1(event["toolCallId"]);
+		const name = orkToolName(str$1(event["toolName"]));
+		if (type === "run_start") {
+			sessionId = str$1(event["sessionId"]);
+			return [{
+				type: "session.started",
+				sessionId,
+				model: ""
+			}];
+		}
+		if (type === "turn_start") turns += 1;
+		if (type === "message_end") {
+			const text = textOf(event["content"]);
+			return text.trim() === "" ? [] : [{
+				type: "assistant.text",
+				text
+			}];
+		}
+		if (type === "tool_queued") {
+			const input = event["input"];
+			return [{
+				type: "tool.called",
+				id,
+				name,
+				input: isObject$1(input) ? input : {}
+			}];
+		}
+		if (type === "tool_completed") return [{
+			type: "tool.result",
+			id,
+			isError: false
+		}];
+		if (typeof type === "string" && REFUSED.has(type)) return [{
+			type: "tool.result",
+			id,
+			isError: true
+		}];
+		return [];
+	};
+	const result = (line) => {
+		const usage = isObject$1(line["usage"]) ? line["usage"] : {};
+		const error = str$1(line["error"]);
+		return {
+			type: "session.finished",
+			outcome: {
+				subtype: SUBTYPES[str$1(line["subtype"])] ?? "error_during_execution",
+				sessionId: str$1(line["sessionId"]) || sessionId,
+				report: null,
+				text: str$1(line["finalText"]),
+				usage: {
+					costUsd: 0,
+					inputTokens: num$1(usage["inputTokens"]),
+					outputTokens: num$1(usage["outputTokens"]),
+					cacheReadTokens: num$1(usage["cacheReadTokens"]),
+					cacheWriteTokens: num$1(usage["cacheWriteTokens"]),
+					turns,
+					durationMs: num$1(line["durationMs"])
+				},
+				errors: error === "" ? [] : [error]
+			}
+		};
+	};
+	return (line) => {
+		const message = parseLine$1(line);
+		if (!isObject$1(message)) return { events: [] };
+		if (message["type"] === "result") return { events: [result(message)] };
+		const event = message["event"];
+		return { events: message["type"] === "event" && isObject$1(event) ? frame(event) : [] };
+	};
+};
+/** Command Code reports tokens, never dollars. */
+const commandCodeUsage = {
+	dollars: false,
+	combine: (a, b) => addUsage(a, b)
+};
+// ../runtime/src/adapters/command-code-mod.ts
+/**
+* @file The Command Code mod that holds a session to its node's tool rules
+*   (RFC-014, deny by default). Command Code takes permission rules only from
+*   settings files (the user's, and two in the checkout), so Ork runs it with
+*   `--permission-mode yolo` and loads, with `--mod`, a mod written for the
+*   session outside the checkout: its `beforeToolCall` hook blocks every call
+*   the node did not allow. Ork's own tools (`mcp__ork__*`) always go through.
+*   The rules are the node's, in Claude Code's words (`Bash(git:*)`, `Read`,
+*   `mcp__github`); a specifier Ork does not read never allows a call and
+*   always denies one.
+*/
+/** The rules of a session: an `acceptEdits` node may edit without a rule. */
+const modRules = (spec) => ({
+	allow: [...spec.tools.allow, ...spec.permissionMode === "acceptEdits" ? ["Edit"] : []],
+	deny: spec.tools.deny,
+	...spec.tools.only === void 0 ? {} : { only: spec.tools.only }
+});
+/**
+* The mod's source. It is plain JavaScript that Command Code loads (a default
+* export taking the mod API), so it carries its own matcher.
+*/
+const modSource = (rules) => `// Ork's rules for one session; written by Ork, removed after it.
+const RULES = ${JSON.stringify(rules)};
+const TOOLS = ${JSON.stringify(COMMAND_CODE_TOOLS)};
+// A rule's word, as Command Code reads it, covers these of Ork's tool names.
+const COVERS = { read: ["Read", "Glob", "Grep"], edit: ["Edit", "Write"] };
+const norm = text => text.trim().replace(/\\s+/g, " ");
+const split = rule => {
+  const at = rule.indexOf("(");
+  return at < 0 || !rule.endsWith(")")
+    ? { token: rule.trim() }
+    : { token: rule.slice(0, at).trim(), spec: rule.slice(at + 1, -1) };
+};
+const shellMatches = (command, pattern) => {
+  let p = norm(pattern);
+  const c = norm(command);
+  if (p.endsWith(":*")) p = p.slice(0, -2) + " *";
+  if (!p.endsWith(" *")) return c === p;
+  const head = p.slice(0, -2);
+  return c === head || c.startsWith(head + " ");
+};
+// true: the rule covers the call; false: it does not; null: Ork can't tell.
+const matches = (rule, name, input) => {
+  const { token, spec } = split(rule);
+  if (token.startsWith("mcp__")) {
+    const rest = token.slice(5);
+    const at = rest.indexOf("__");
+    if (at < 0) return name.startsWith("mcp__" + rest + "__");
+    const tool = rest.slice(at + 2);
+    return tool === "*" ? name.startsWith("mcp__" + rest.slice(0, at) + "__") : name === token;
+  }
+  const ork = TOOLS[name] ?? name;
+  const word = token.toLowerCase();
+  const covered = (COVERS[word] ?? [token]).some(each => each.toLowerCase() === ork.toLowerCase());
+  if (!covered && name !== token) return false;
+  if (spec === undefined || spec === "" || spec === "*") return true;
+  if (ork === "Bash" && typeof input?.command === "string") return shellMatches(input.command, spec);
+  return null;
+};
+export const decide = (name, input) => {
+  if (RULES.deny.some(rule => matches(rule, name, input) !== false)) return "denied for this node";
+  if (name.startsWith("mcp__ork__")) return undefined;
+  if (RULES.only !== undefined && !RULES.only.some(rule => matches(rule, name, input) === true)) {
+    return "not one of this node's tools";
+  }
+  if (RULES.allow.some(rule => matches(rule, name, input) === true)) return undefined;
+  return "not allowed for this node";
+};
+export default cc => {
+  cc.hooks({
+    beforeToolCall: async call => {
+      const why = decide(call.toolName, call.input);
+      return why === undefined
+        ? undefined
+        : { block: true, additionalContext: "Ork: " + call.toolName + " is " + why + ". Do not retry it." };
+    },
+  });
+};
+`;
+/**
+* Writes a session's mod outside the checkout (a fresh folder under the
+* system's temp folder, 0700, the file 0600); it holds no secret.
+*/
+const writeMod = (spec) => {
+	const dir = mkdtempSync(path.join(tmpdir(), "ork-cmd-mod-"));
+	const file = path.join(dir, "ork-rules.mjs");
+	writeFileSync(file, modSource(modRules(spec)), { mode: 384 });
+	return {
+		file,
+		remove: () => {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+};
+// ../runtime/src/adapters/command-code.ts
+/**
+* The brief, with Ork's instructions before it on a session's first leg:
+* Command Code has no flag that adds to its system prompt. A resumed leg's
+* session already holds them.
+*/
+const queryOf = (spec) => {
+	const text = spec.resume === void 0 ? `${spec.systemAppend}\n\n${spec.prompt}` : spec.prompt;
+	return text.startsWith("-") ? ` ${text}` : text;
+};
+/**
+* The `cmd` arguments for a session spec. `yolo`: Command Code prompts for
+* nothing, and the session's mod refuses what the node did not allow.
+*/
+const commandCodeArgs = (spec) => {
+	const args = [
+		"-p",
+		queryOf(spec),
+		"--output-format",
+		"json",
+		"--permission-mode",
+		"yolo",
+		"--skip-onboarding",
+		"--no-auto-update"
+	];
+	if (spec.model !== void 0) args.push("--model", spec.model);
+	if (spec.effort !== void 0) args.push("--effort", spec.effort);
+	if (spec.maxTurns !== void 0) args.push("--max-turns", String(spec.maxTurns));
+	if (spec.resume !== void 0) args.push("--resume", spec.resume);
+	if (spec.resume !== void 0 && spec.fork === true) args.push("--fork-session");
+	return args;
+};
+const lease = leaseWiring({});
+/** `cmd`, as the session runner's strategies. */
+const commandCodeAdapter = {
+	driver: "command-code",
+	command: {
+		bin: "cmd",
+		args: (spec) => commandCodeArgs(spec)
+	},
+	decode: (line) => commandCodeDecoder()(line),
+	decoder: commandCodeDecoder,
+	mcp: {
+		kind: "lease",
+		wire: async (spec, endpoint, hooks) => {
+			const wired = await lease.wire(spec, endpoint, hooks);
+			try {
+				const mod = writeMod(spec);
+				return {
+					args: [
+						...wired.args,
+						"--mod",
+						mod.file
+					],
+					env: wired.env,
+					release: async () => {
+						mod.remove();
+						await wired.release();
+					}
+				};
+			} catch (error) {
+				await wired.release();
+				throw error;
+			}
+		}
+	},
+	permissions: {
+		kind: "rules",
+		denyByDefault: true
+	},
+	usage: commandCodeUsage,
+	context: {
+		instructions: ["AGENTS.md"],
+		skills: ".commandcode/skills",
+		agents: ".commandcode/agents",
+		env: () => ({})
+	}
+};
+// ../runtime/src/secret-file.ts
+/**
+* @file A session's private folder for files that hold a secret, such as a
+*   config carrying Ork's bearer token (RFC-014): a 0700 folder outside the
+*   checkout, under the system's temporary folder, named after the process that
+*   made it, with each file written at mode 0600. The session removes it when
+*   it ends; a folder whose process is gone (a crash) is removed when the next
+*   one is made. Nothing here logs what it writes.
+*/
+/** Where sessions' private folders live unless a caller names another place. */
+const secretRoot = () => path.join(tmpdir(), "ork-sessions");
+/** Removes the folders under `root` whose process is gone; returns them. */
+const sweepSecretFolders = (root) => {
+	let names;
+	try {
+		names = readdirSync(root);
+	} catch {
+		return [];
+	}
+	return names.flatMap((name) => {
+		const pid = Number(name.split("-")[0]);
+		if (!Number.isInteger(pid) || alive(pid)) return [];
+		const dir = path.join(root, name);
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+		return [dir];
+	});
+};
+/** A new private folder under `root`, after sweeping the stale ones. */
+const makeSecretFolder = (root = secretRoot()) => {
+	mkdirSync(root, {
+		recursive: true,
+		mode: 448
+	});
+	sweepSecretFolders(root);
+	const dir = mkdtempSync(path.join(root, `${String(process.pid)}-`));
+	return {
+		dir,
+		write: (name, content) => {
+			const file = path.join(dir, name);
+			writeFileSync(file, content, { mode: 384 });
+			return file;
+		},
+		remove: () => {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+};
+/** Claude Code tool names, as OpenCode's permission actions. */
+const ACTIONS = {
+	Read: "read",
+	Glob: "glob",
+	Grep: "grep",
+	Edit: "edit",
+	Write: "edit",
+	MultiEdit: "edit",
+	NotebookEdit: "edit",
+	Bash: "shell",
+	WebFetch: "webfetch",
+	WebSearch: "websearch",
+	Task: "subagent",
+	Agent: "subagent",
+	Skill: "skill",
+	TodoWrite: "todowrite"
+};
+const BUILT_IN = new Set(Object.values(ACTIONS));
+/** Actions whose resource is a path: a bare allow stays in the worktree. */
+const PATH_ACTIONS = /* @__PURE__ */ new Set(["read", "edit"]);
+/** OpenCode's name for an MCP server's tool: other characters become `_`. */
+const mcpAction = (server, tool) => `${server}_${tool}`.replaceAll(/[^A-Za-z0-9_*-]/gu, "_");
+/** A shell rule's resource: Claude Code's `git status:*` is `git status *`. */
+const shellResource = (spec) => spec.replace(/:\*$/u, " *");
+/**
+* One Claude Code rule (`Bash(git status:*)`, `Edit`, `mcp__github__*`) as an
+* OpenCode rule, or none for a tool OpenCode has no action for (still denied).
+*/
+const ruleOf = (rule, effect, cwd) => {
+	const match = /^([^()]+)(?:\((.*)\))?$/su.exec(rule.trim());
+	if (match === null) return void 0;
+	const [, name = "", spec] = match;
+	const mcp = /^mcp__([^_]+(?:_[^_]+)*)(?:__(.*))?$/u.exec(name);
+	if (mcp !== null) {
+		const [, server = "", tool] = mcp;
+		return {
+			action: mcpAction(server, tool ?? "*"),
+			resource: "*",
+			effect
+		};
+	}
+	const action = ACTIONS[name];
+	if (action === void 0) return void 0;
+	if (spec !== void 0) return {
+		action,
+		resource: action === "shell" ? shellResource(spec) : PATH_ACTIONS.has(action) ? path.resolve(cwd, spec) : spec,
+		effect
+	};
+	return {
+		action,
+		resource: effect === "allow" && PATH_ACTIONS.has(action) ? `${cwd}/*` : "*",
+		effect
+	};
+};
+const rulesOf = (rules, effect, cwd) => rules.flatMap((rule) => ruleOf(rule, effect, cwd) ?? []);
+/**
+* The session's rules, in order: deny everything; read in the worktree (as
+* Claude Code reads without asking); edits there under `acceptEdits`; the
+* node's allows (only its `only` tools, if it names them); Ork's tools; then
+* `.env` reads, plan mode's edits and shell, and the node's denies, refused.
+*/
+const permissionRules = (spec) => {
+	const { cwd, tools } = spec;
+	const only = tools.only === void 0 ? void 0 : new Set(rulesOf(tools.only, "allow", cwd).map((r) => r.action));
+	const inOnly = (rule) => only === void 0 || only.has(rule.action) || !BUILT_IN.has(rule.action);
+	const worktree = (action) => ({
+		action,
+		resource: `${cwd}/*`,
+		effect: "allow"
+	});
+	return [
+		{
+			action: "*",
+			resource: "*",
+			effect: "deny"
+		},
+		...[
+			worktree("read"),
+			...spec.permissionMode === "acceptEdits" ? [worktree("edit")] : [],
+			...rulesOf(tools.allow, "allow", cwd)
+		].filter((rule) => inOnly(rule)),
+		{
+			action: `ork_*`,
+			resource: "*",
+			effect: "allow"
+		},
+		{
+			action: "read",
+			resource: "*.env",
+			effect: "deny"
+		},
+		...spec.permissionMode === "plan" ? ["edit", "shell"].map((action) => ({
+			action,
+			resource: "*",
+			effect: "deny"
+		})) : [],
+		...rulesOf(tools.deny, "deny", cwd)
+	];
+};
+/**
+* A `.mcp.json` entry as an OpenCode server: `local` with a command, else
+* `remote`.
+*/
+const serverOf = (entry) => {
+	const { command, args, env, url, headers } = entry;
+	const listed = Array.isArray(args) ? args.map(String) : [];
+	return typeof command === "string" ? {
+		type: "local",
+		command: [command, ...listed],
+		...env === void 0 ? {} : { environment: env },
+		codemode: false
+	} : {
+		type: "remote",
+		url,
+		oauth: false,
+		codemode: false,
+		headers
+	};
+};
+/** The whole config file for one session. */
+const sessionConfig = (spec, endpoint, instructions) => ({
+	instructions: [instructions],
+	mcp: { servers: {
+		...Object.fromEntries(Object.entries(spec.mcpServers ?? {}).map(([name, entry]) => [name, serverOf(entry)])),
+		["ork"]: {
+			type: "remote",
+			url: endpoint.url,
+			oauth: false,
+			codemode: false,
+			headers: { Authorization: `Bearer ${endpoint.token}` }
+		}
+	} },
+	permissions: permissionRules(spec),
+	agents: { ["ork"]: {
+		mode: "primary",
+		...spec.maxTurns === void 0 ? {} : { steps: spec.maxTurns }
+	} }
+});
+// ../runtime/src/adapters/open-code-events.ts
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const get = (value, key) => isObject(value) ? value[key] : void 0;
+const num = (value) => typeof value === "number" ? value : 0;
+const str = (value) => typeof value === "string" ? value : "";
+/** OpenCode's built-in tools, by Claude Code's names. */
+const TOOL_NAMES = {
+	shell: "Bash",
+	read: "Read",
+	edit: "Edit",
+	write: "Write",
+	patch: "Edit",
+	glob: "Glob",
+	grep: "Grep",
+	webfetch: "WebFetch",
+	websearch: "WebSearch",
+	subagent: "Task",
+	skill: "Skill",
+	todowrite: "TodoWrite"
+};
+const ORK_PREFIX = `ork_`;
+/** A tool's name as a node's rules and Ork's views say it. */
+const toolName = (name) => TOOL_NAMES[name] ?? (name.startsWith(ORK_PREFIX) ? toolId(name.slice(ORK_PREFIX.length)) : name);
+const parseLine = (line) => {
+	try {
+		return JSON.parse(line);
+	} catch {
+		return;
+	}
+};
+/** One `step_finish`'s spending, as a whole session's of one turn. */
+const stepUsage = (part) => {
+	const tokens = get(part, "tokens");
+	const cache = get(tokens, "cache");
+	return {
+		costUsd: num(get(part, "cost")),
+		inputTokens: num(get(tokens, "input")),
+		outputTokens: num(get(tokens, "output")) + num(get(tokens, "reasoning")),
+		cacheReadTokens: num(get(cache, "read")),
+		cacheWriteTokens: num(get(cache, "write")),
+		turns: 1,
+		durationMs: 0
+	};
+};
+/** Two spans of one session, as one: OpenCode reports each step's own cost. */
+const sumUsage = (a, b) => ({
+	costUsd: a.costUsd + b.costUsd,
+	inputTokens: a.inputTokens + b.inputTokens,
+	outputTokens: a.outputTokens + b.outputTokens,
+	cacheReadTokens: a.cacheReadTokens + b.cacheReadTokens,
+	cacheWriteTokens: a.cacheWriteTokens + b.cacheWriteTokens,
+	turns: a.turns + b.turns,
+	durationMs: a.durationMs + b.durationMs
+});
+const openCodeUsage = {
+	dollars: true,
+	combine: sumUsage
+};
+const NONE = {
+	costUsd: 0,
+	inputTokens: 0,
+	outputTokens: 0,
+	cacheReadTokens: 0,
+	cacheWriteTokens: 0,
+	turns: 0,
+	durationMs: 0
+};
+/** One finished tool call: its call and its result. */
+const toolEvents = (part) => {
+	const id = str(get(part, "id")) || str(get(part, "partID"));
+	const state = get(part, "state");
+	const input = get(state, "input");
+	return [{
+		type: "tool.called",
+		id,
+		name: toolName(str(get(part, "tool"))),
+		input: isObject(input) ? input : {}
+	}, {
+		type: "tool.result",
+		id,
+		isError: get(state, "status") === "error"
+	}];
+};
+/** What one line says by itself: text and finished tool calls. */
+const decodeOpenCodeLine = (line) => {
+	const message = parseLine(line);
+	const part = get(message, "part");
+	switch (get(message, "type")) {
+		case "text": {
+			const said = str(get(part, "text"));
+			return { events: said.trim() === "" ? [] : [{
+				type: "assistant.text",
+				text: said
+			}] };
+		}
+		case "tool_use": return { events: toolEvents(part) };
+		default: return { events: [] };
+	}
+};
+/**
+* A decoder for one leg of a session: it starts the session at the first line
+* that names it, and keeps the last text, the steps' usage and the errors for
+* the end.
+*/
+const openCodeDecoder = (spec) => {
+	const began = Date.now();
+	let sessionId = "";
+	let text = "";
+	let usage = NONE;
+	const errors = [];
+	return {
+		decode: (line) => {
+			const message = parseLine(line);
+			if (!isObject(message)) return { events: [] };
+			const events = [];
+			if (sessionId === "" && str(message["sessionID"]) !== "") {
+				sessionId = str(message["sessionID"]);
+				events.push({
+					type: "session.started",
+					sessionId,
+					model: spec.model ?? "default",
+					cwd: spec.cwd
+				});
+			}
+			const said = decodeOpenCodeLine(line).events;
+			events.push(...said);
+			const last = said.findLast((event) => event.type === "assistant.text");
+			if (last !== void 0) text = last.text;
+			switch (message["type"]) {
+				case "step_finish":
+					usage = sumUsage(usage, stepUsage(message["part"]));
+					break;
+				case "error": {
+					const error = message["error"];
+					errors.push(str(get(get(error, "data"), "message")) || str(get(error, "message")) || str(get(error, "name")) || "error");
+					break;
+				}
+			}
+			return { events };
+		},
+		exit: (code) => {
+			if (code !== 0 && errors.length === 0) return [];
+			return [{
+				type: "session.finished",
+				outcome: {
+					subtype: code === 0 ? "success" : "error_during_execution",
+					sessionId,
+					report: null,
+					text,
+					usage: {
+						...usage,
+						durationMs: Date.now() - began
+					},
+					errors
+				}
+			}];
+		}
+	};
+};
+// ../runtime/src/adapters/open-code.ts
+/**
+* @file The `open-code` adapter: the user's own `opencode run` (2.1.0), on a
+*   private server (`--standalone`; the background service would ignore the
+*   session's environment), started in the node's worktree, which pins its
+*   working folder. Ork's endpoint, the permission rules and the `ork` agent go
+*   in a config file named by `OPENCODE_CONFIG` (the `config-file` wiring),
+*   written at 0600 in a private folder outside the checkout and removed after
+*   the session (`secret-file.ts`). The machine's and the project's OpenCode
+*   config stay out: `XDG_CONFIG_HOME` is an empty folder beside the file, and
+*   the project's config is switched off. The brief and each later message are
+*   the message argument of a leg; a message waits for the next leg, which
+*   continues the session. Never `--auto`: it approves what no rule denies.
+*/
+/** The `opencode run` arguments for one leg; the message is the last one. */
+const openCodeArgs = (spec) => [
+	"run",
+	"--standalone",
+	"--format",
+	"json",
+	"--agent",
+	"ork",
+	...spec.model === void 0 ? [] : ["--model", spec.model],
+	...spec.resume === void 0 ? [] : ["--session", spec.resume],
+	...spec.resume !== void 0 && spec.fork === true ? ["--fork"] : [],
+	spec.prompt.startsWith("-") ? ` ${spec.prompt}` : spec.prompt
+];
+/**
+* What keeps the machine's and the project's own OpenCode setup out, and
+* OpenCode's reading of `.claude/` and `CLAUDE.md` (RFC-014 open question 3).
+*/
+const OPEN_CODE_ENV = {
+	OPENCODE_DISABLE_PROJECT_CONFIG: "1",
+	OPENCODE_DISABLE_CLAUDE_CODE: "1",
+	OPENCODE_DISABLE_CLAUDE_CODE_SKILLS: "1",
+	OPENCODE_CONFIG_DIR: "",
+	OPENCODE_CONFIG_CONTENT: ""
+};
+/** The config file, Ork's instructions and an empty config home, per session. */
+const configFile = (root) => ({
+	kind: "config-file",
+	wire: (spec, endpoint) => {
+		const folder = makeSecretFolder(root);
+		try {
+			const instructions = folder.write("ork.md", spec.systemAppend);
+			const config = folder.write("opencode.json", JSON.stringify(sessionConfig(spec, endpoint, instructions)));
+			const home = path.join(folder.dir, "config");
+			mkdirSync(home, { mode: 448 });
+			return Promise.resolve({
+				args: [],
+				env: {
+					OPENCODE_CONFIG: config,
+					XDG_CONFIG_HOME: home
+				},
+				release: () => {
+					folder.remove();
+					return Promise.resolve();
+				}
+			});
+		} catch (error) {
+			folder.remove();
+			throw error;
+		}
+	}
+});
+/** `opencode`, as the session runner's strategies. */
+const createOpenCodeAdapter = (options = {}) => ({
+	driver: "open-code",
+	command: {
+		bin: "opencode",
+		args: openCodeArgs
+	},
+	decode: decodeOpenCodeLine,
+	legDecoder: openCodeDecoder,
+	mcp: configFile(options.secretRoot ?? secretRoot()),
+	permissions: {
+		kind: "rules",
+		denyByDefault: true
+	},
+	usage: openCodeUsage,
+	context: {
+		instructions: ["AGENTS.md"],
+		skills: ".opencode/skills",
+		agents: ".opencode/agents",
+		env: () => OPEN_CODE_ENV
+	}
+});
+const openCodeAdapter = createOpenCodeAdapter();
+// ../runtime/src/registry.ts
+/** The message a session on a driver with no adapter yet ends with. */
+const notBuiltYet = (driver) => `The ${driver} driver is not built yet; use claude-code.`;
+const notBuilt = (driver) => ({
+	driver,
+	start: () => ({
+		events: (async function* () {
+			yield driverFailure(notBuiltYet(driver));
+		})(),
+		send: () => {},
+		interrupt: () => Promise.resolve()
+	})
+});
+const ADAPTERS = {
+	"claude-code": claudeCodeAdapter,
+	"open-code": openCodeAdapter,
+	"command-code": commandCodeAdapter
+};
+/**
+* The runtime for a driver id, with the user's environment and the project's
+* runs folder (where a Command Code lease is recorded).
+*/
+const createRuntime = (driver, env, runs) => {
+	const adapter = ADAPTERS[driver];
+	return adapter === null ? notBuilt(driver) : createSessionRuntime(adapter, {
+		env,
+		...runs === void 0 ? {} : { runs }
+	});
+};
+export { cleanStaleLeases, createRuntime, leaseLedger };