@krapht/ork 1.0.0-alpha.10 → 1.0.0-alpha.11

package/dist/{src-cmmXKHn1.mjs → src-9iGkjnsy.mjs}

@@ -1,10 +1,11 @@
-import { Bt as mcpNotText, Ft as declaredOutputOf, Hn as beforeOf, Mt as calledWorkflows, Nt as envReadsOf, Un as programsRunBy, Vt as serversIn, ar as timeoutMs, cr as integrationFor, ct as planNodeSession, en as evaluate, er as isClaudeNode, ft as reportSchemaFor, jt as declaredProblem, kt as runScope, nn as renderTemplate, or as INTEGRATIONS, qn as markValue, s as planReason, sr as TOOL_PREFIX, tn as parseTemplate, tr as isToolNode, ut as sessionDriver, yt as heldTimeout, zt as MCP_FILE } from "./src-Df6KOIDC.mjs";
+import { $t as endOf, Bt as lowerChild, Cr as TOOL_PREFIX, Ft as failedWith, Ht as envReadsOf, It as stoppedEnd, Lt as calledWorkflows, Mt as runScope, Nt as declaredProblem, Pt as endedWith, Rt as slotClock, Sr as INTEGRATIONS, Vt as startAt, Wt as declaredOutputOf, Xt as mcpNotText, Yt as MCP_FILE, Zt as serversIn, _n as parseTemplate, _r as isToolNode, ar as programsRunBy, at as planReason, bt as heldTimeout, dt as sessionDriver, en as outcomeEnd, gn as evaluate, gr as isClaudeNode, ir as beforeOf, lr as markValue, lt as planNodeSession, pt as reportSchemaFor, rn as endFor, tn as END_DETAIL_LIMIT, vn as renderTemplate, wr as integrationFor, xr as timeoutMs } from "./src-D6_xjm-x.mjs";
 import path from "node:path";
 import { accessSync, constants, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { Readable } from "node:stream";
 // ../nodes/src/call.ts
 /**
 * @file The `workflow.call` node type (RFC-004): renders what the node asks for
@@ -18,23 +19,16 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 */
 const limitedCall = (result) => {
 	if (result.ok) return result;
-	return (result.error ?? "").includes("Not started: ") || result.output["runStatus"] === "quota_exhausted" ? {
+	const why = result.end?.detail ?? result.error;
+	return result.end?.kind === "plan_limit" || (why ?? "").includes("Not started: ") || result.output["runStatus"] === "quota_exhausted" ? {
 		...result,
-		limited: result.error ?? "the called run reached a limit"
+		limited: why ?? "the called run reached a limit"
 	} : result;
 };
 const callExecutor = (context) => {
 	const { node, calls } = context;
-	if (node.type !== "workflow.call") return Promise.resolve({
-		ok: false,
-		output: {},
-		error: `${context.id} is not a call`
-	});
-	if (calls === void 0) return Promise.resolve({
-		ok: false,
-		output: { status: "fail" },
-		error: "This run cannot call workflows."
-	});
+	if (node.type !== "workflow.call") return Promise.resolve(failedWith(endFor("unknown", {}, `${context.id} is not a call`), {}));
+	if (calls === void 0) return Promise.resolve(failedWith(endFor("invalid_node", { reason: "this run cannot call workflows" }), { status: "fail" }));
 	const scope = runScope(context.inputs, context.outputs, context.runId, context.item);
 	const render = (text) => {
 		const template = parseTemplate(text);
@@ -90,30 +84,27 @@ const planOptionsOf = (context, inPlace) => {
 // ../nodes/src/claude-result.ts
 /**
 * @file A finished session as a node's result: its report is the output, held
-*   to what the node declares (RFC-010).
+*   to what the node declares (RFC-010), and how it ended is its end kind
+*   (specs/runtime/session-ends.md).
 */
+/** How a session with no report ended; a driver's `done` without one is not. */
+const withoutReport = (outcome) => {
+	const end = outcomeEnd(outcome);
+	return end.kind === "done" || end.kind === "reported_failure" ? endFor("no_report", {}, end.detail) : end;
+};
 /** A finished session as a node result: its report is the node's output. */
 const resultOf = (outcome, declared) => {
-	if (outcome === null) return {
-		ok: false,
-		output: {
-			status: "fail",
-			summary: "the session ended without a result"
-		},
-		error: "the session ended without a result"
-	};
+	if (outcome === null) return failedWith(endFor("driver_crashed", {}, "the session ended without a result"));
 	const { report, usage } = outcome;
 	if (report === null) {
-		const reason = outcome.errors[0] ?? "no valid report";
+		const end = withoutReport(outcome);
 		return {
-			ok: false,
-			output: {
+			...failedWith(end, {
 				status: "fail",
-				summary: reason,
+				summary: end.message,
 				usage
-			},
+			}),
 			usage,
-			error: `ended without a report (${outcome.subtype}): ${reason}`,
 			sessionId: outcome.sessionId
 		};
 	}
@@ -127,7 +118,7 @@ const resultOf = (outcome, declared) => {
 	};
 	if (report.branch !== void 0) output["branch"] = report.branch;
 	const problem = declaredProblem(declared, output);
-	if (problem !== null) return {
+	if (problem !== null) return endedWith({
 		ok: false,
 		output: {
 			status: "fail",
@@ -137,17 +128,15 @@ const resultOf = (outcome, declared) => {
 			...report.branch === void 0 ? {} : { branch: report.branch }
 		},
 		usage,
-		error: problem,
 		...ran
-	};
-	const result = {
-		ok: report.status !== "fail",
+	}, endFor("invalid_report", { reason: problem }));
+	const ok = report.status !== "fail";
+	return endedWith({
+		ok,
 		output,
 		usage,
 		...ran
-	};
-	if (!result.ok) result.error = report.summary;
-	return result;
+	}, endFor(ok ? "done" : "reported_failure"));
 };
 // ../nodes/src/environ.ts
 /** A variable of the user's. */
@@ -537,13 +526,16 @@ const withUsageOf = (first, later) => {
 */
 const afterLateTurn = (first, later) => {
 	const merged = withUsageOf(first, later);
-	return later.report === null ? {
-		...merged,
+	if (later.report !== null) return merged;
+	const { end: _later, ...rest } = merged;
+	return {
+		...rest,
 		report: first.report,
 		subtype: first.subtype,
+		...first.end === void 0 ? {} : { end: first.end },
 		text: first.text,
 		errors: first.errors
-	} : merged;
+	};
 };
 /**
 * What another turn of a session may use. `spent` and `turns` are this
@@ -602,24 +594,38 @@ const limitWatch = (context) => {
 				},
 				ended: (outcome) => {
 					if (refused !== void 0 && (outcome?.report ?? null) === null) why = refused;
-					if (left !== void 0 && asked.budgetUsd !== void 0 && asked.budgetUsd >= left && outcome?.subtype === "error_max_budget_usd") why = context.quota?.().blocked ?? "a session reached what was left of a quota";
+					const capped = left !== void 0 && asked.budgetUsd !== void 0 && asked.budgetUsd >= left;
+					const spent = outcome !== null && outcomeEnd(outcome).kind === "budget_limit";
+					if (capped && spent) why = context.quota?.().blocked ?? "a session reached what was left of a quota";
 				}
 			};
 		},
-		result: (result) => result.ok || why === void 0 ? result : {
-			...result,
-			limited: why
+		result: (result) => {
+			if (result.ok) return result;
+			if (why !== void 0) return {
+				...endedWith(result, endFor("plan_limit", {}, why)),
+				limited: why
+			};
+			const { end } = result;
+			return end?.kind === "plan_limit" ? {
+				...result,
+				limited: end.message
+			} : result;
 		}
 	};
 };
-/** No session started: nothing was left for one. */
-const notStarted = (reason, limited) => ({
-	ok: false,
-	error: `not started: ${reason}`,
-	output: {
+/**
+* No session started: nothing was left for one, or nothing to start it. Its
+* summary keeps Ork's reason, `end.detail` too; the message is the kind's.
+*/
+const notStarted = (kind, reason, limited) => ({
+	...failedWith(endFor(kind, {
+		reason,
+		program: "an agent driver"
+	}, reason), {
 		status: "fail",
 		summary: `not started: ${reason}`
-	},
+	}),
 	...limited === void 0 ? {} : { limited }
 });
 // ../nodes/src/tool-output.ts
@@ -864,6 +870,51 @@ const tokenize = (command) => {
 		args
 	};
 };
+// ../nodes/src/tool-ends.ts
+/**
+* @file How a tool node ended (specs/runtime/session-ends.md): a node that
+*   could not run its command, JSON that broke its declared output, or how a
+*   command that ran exited: done, stopped, never started, signed out, or
+*   failed. Ork's message names the program; its stderr is the detail.
+*/
+/** A node that could not run its command: its own definition is wrong. */
+const failed$1 = (error, kind = "invalid_node") => endedWith({
+	ok: false,
+	output: {
+		exitCode: -1,
+		stdout: "",
+		stderr: error
+	}
+}, endFor(kind, { reason: error }, error));
+/** JSON that broke what the node declares, or that it could not read. */
+const invalidOutput = (output, reason) => endedWith({
+	ok: false,
+	output
+}, endFor("invalid_output", { reason }));
+/**
+* How a command that ran and exited non-zero ended: stopped, never started, a
+* sign-in its program asks for (`signedOut`), or a plain failure.
+*/
+const exitKind = (run, context, signedOut) => {
+	if (context.signal.aborted) return "interrupted";
+	if (run.exitCode === -1 && /\bENOENT\b/u.test(run.stderr)) return "tool_missing";
+	return signedOut?.(run) === true ? "auth" : "command_failed";
+};
+/** How a command that ran ended, by its exit code; `program` is scrubbed. */
+const exitEnd = (output, run, context, program, signedOut) => {
+	if (run.exitCode === 0) return endedWith({
+		ok: true,
+		output
+	}, endFor("done"));
+	const end = endFor(exitKind(run, context, signedOut), {
+		program,
+		exitCode: run.exitCode
+	}, run.stderr.trim().slice(-END_DETAIL_LIMIT));
+	return endedWith({
+		ok: false,
+		output
+	}, end);
+};
 // ../nodes/src/tool-scrub.ts
 /**
 * @file Masking a secret in what a program prints. A plain search, so a value
@@ -1265,19 +1316,10 @@ const capped = (text, file) => {
 * what a session is told. All of it is kept in the output's fields and files.
 */
 const clipError = (text) => text.length <= ERROR_LIMIT ? text : `${text.slice(0, ERROR_LIMIT)}…`;
-const failed$1 = (error) => ({
-	ok: false,
-	output: {
-		exitCode: -1,
-		stdout: "",
-		stderr: error
-	},
-	error
-});
 /** Runs a user's CLI through its integration's adapter, with its own login. */
 const toolExecutor = (given, options = {}) => async (context) => {
 	const { node } = context;
-	if (!isToolNode(node)) return failed$1(`${context.id} is not a tool node`);
+	if (!isToolNode(node)) return failed$1(`${context.id} is not a tool`, "unknown");
 	const environ = options.environ ?? process.env;
 	const scrub = scrubberOf(secretsOf(context.workflow, environ, options.maskedNames));
 	const command = commandOf(node, context);
@@ -1304,6 +1346,7 @@ const toolExecutor = (given, options = {}) => async (context) => {
 		...node.watch === void 0 ? {} : { [STATE_ENV]: prepareStateFile(context.runDir, context.id) }
 	};
 	const names = Object.keys(nodeEnv.values);
+	const release = await context.machine?.slot([command.program, ...command.args].join(" "), context.signal);
 	context.emit({
 		type: "tool.called",
 		id: context.id,
@@ -1318,11 +1361,13 @@ const toolExecutor = (given, options = {}) => async (context) => {
 		}
 	});
 	const scriptFile = node.script === void 0 ? void 0 : writeScriptFile(context.runDir, context.id, context.round, node.script);
+	const priority = context.machine?.priority;
 	const raw = await runner(command.program, scriptFile === void 0 ? command.args : [...command.args, scriptFile], {
 		cwd,
 		signal: context.signal,
-		env
-	});
+		env,
+		...priority === void 0 ? {} : { priority }
+	}).finally(() => release?.());
 	if (scriptFile !== void 0) removeOutputFile(scriptFile);
 	const run = {
 		exitCode: raw.exitCode,
@@ -1359,30 +1404,14 @@ const toolExecutor = (given, options = {}) => async (context) => {
 	context.emit({
 		type: "tool.result",
 		id: context.id,
-		isError: run.exitCode !== 0 || json?.ok === false || declared !== null
+		isError: run.exitCode !== 0 || json?.ok === false || declared !== null,
+		...raw.cpu === void 0 ? {} : { cpu: raw.cpu }
 	});
-	if (json?.ok === false) return {
-		ok: false,
-		output,
-		error: `${context.id}: ${json.error}`
-	};
-	if (declared !== null) return {
-		ok: false,
-		output,
-		error: declared
-	};
+	if (json?.ok === false) return invalidOutput(output, json.error);
+	if (declared !== null) return invalidOutput(output, declared);
 	if (json !== null) output["json"] = json.json;
-	if (run.exitCode === 0) return {
-		ok: true,
-		output
-	};
-	const last = run.stderr.trim().split("\n").at(-1) ?? "";
-	return {
-		ok: false,
-		transient: true,
-		output,
-		error: `${scrub(command.program)} exited with ${String(run.exitCode)}${last === "" ? "" : `: ${clipError(last)}`}`
-	};
+	const signedOut = integration?.signedOut;
+	return exitEnd(output, run, context, scrub(command.program), signedOut);
 };
 // ../nodes/src/verify.ts
 /**
@@ -1394,15 +1423,17 @@ const toolExecutor = (given, options = {}) => async (context) => {
 /** A setup that failed: no session started, so nothing was spent on it. */
 const beforeFailed = (ran) => {
 	const error = `its before step failed: ${ran.error ?? "no reason given"}`;
-	return {
+	return endedWith({
 		ok: false,
-		error,
 		output: {
 			status: "fail",
 			summary: error,
 			before: ran.output
 		}
-	};
+	}, endOf({
+		...ran,
+		ok: false
+	}));
 };
 /** With nothing to run a step, a report cannot be accepted. */
 const noSteps = () => Promise.resolve({
@@ -1423,20 +1454,23 @@ const runStep = async (tool, given, { timeout, ...fields }, step) => {
 		type: "tool.shell",
 		...fields
 	};
-	const context = {
-		...given,
-		step
-	};
 	const ms = timeoutMs(timeout);
 	if (ms === void 0) return tool({
-		...context,
+		...given,
+		step,
 		node
 	});
+	const { clock, machine } = slotClock(given.hold, given.machine);
+	const context = {
+		...given,
+		step,
+		...machine === void 0 ? {} : { machine }
+	};
 	const limit = new AbortController();
 	const finished = new AbortController();
 	let expired = false;
 	const watch = async () => {
-		if (await heldTimeout(context.hold, ms, AbortSignal.any([context.signal, finished.signal]))) {
+		if (await heldTimeout(clock, ms, AbortSignal.any([context.signal, finished.signal]))) {
 			expired = true;
 			limit.abort();
 		}
@@ -1547,17 +1581,19 @@ const checkedResult = (result, { check, resumes }) => {
 	};
 	const reason = `its check failed: ${check.error ?? "no reason given"}`;
 	const error = result.ok ? reason : `${reason} (then: ${result.error ?? "no report"})`;
-	return {
+	return endedWith({
 		...result,
 		ok: false,
-		error,
 		output: {
 			...result.output,
 			status: "fail",
 			summary: error,
 			verify
 		}
-	};
+	}, endOf(result.ok ? {
+		...check,
+		ok: false
+	} : result));
 };
 // ../nodes/src/claude.ts
 /**
@@ -1615,28 +1651,26 @@ const claudeExecutor = (options) => async (context) => {
 		});
 		if (!ran.ok) return beforeFailed(ran);
 		await context.hold?.wait("start", context.signal);
-		if (context.signal.aborted) return beforeFailed({
-			...ran,
-			error: "the node was stopped"
-		});
+		if (context.signal.aborted) {
+			const end = stoppedEnd(context.signal);
+			return beforeFailed({
+				...ran,
+				ok: false,
+				error: end.message,
+				end
+			});
+		}
 		planOptions.before = ran.output;
 	}
 	const blocked = context.quota?.().blocked;
-	if (blocked !== void 0) return notStarted(blocked, blocked);
+	if (blocked !== void 0) return notStarted("plan_limit", blocked, blocked);
 	const budget = await budgetToStart(context);
-	if (budget !== void 0 && budget <= 0) return notStarted("nothing is left of the run's budget");
+	if (budget !== void 0 && budget <= 0) return notStarted("budget_limit", "nothing is left of the run's budget");
 	if (budget !== void 0) planOptions.budgetLeftUsd = budget;
 	const plan = planNodeSession(context.workflow, context.id, planOptions);
-	if (!plan.ok) return {
-		ok: false,
-		output: {
-			status: "fail",
-			summary: plan.error
-		},
-		error: plan.error
-	};
+	if (!plan.ok) return notStarted("invalid_node", plan.error);
 	const servers = namedMcpEntries(context.projectRoot, plan.mcp);
-	if (!servers.ok) return notStarted(servers.error);
+	if (!servers.ok) return notStarted("invalid_node", servers.error);
 	const spec = {
 		...specFor(plan.spec, context),
 		...servers.value
@@ -1647,7 +1681,7 @@ const claudeExecutor = (options) => async (context) => {
 		named: plan.driver,
 		ready: options.readyDriver
 	});
-	if (driver === void 0) return notStarted("no agent driver is ready; see `ork doctor`");
+	if (driver === void 0) return notStarted("tool_missing", "no agent driver is ready; see `ork doctor`");
 	const runtime = await options.runtimeFor(driver);
 	const ports = { human: context.owner === void 0 ? withdrawnOnStop(context) : ownerFirst(context, context.owner, {
 		runtimeFor: options.runtimeFor,
@@ -1656,6 +1690,7 @@ const claudeExecutor = (options) => async (context) => {
 		inPlace: options.inPlace
 	}) };
 	if (context.hold !== void 0) ports.hold = context.hold;
+	if (context.machine !== void 0) ports.machine = context.machine;
 	if (context.ownership !== void 0) ports.ownership = context.ownership;
 	if (context.mailbox !== void 0) ports.mailbox = context.mailbox;
 	if (context.claims !== void 0) ports.claims = context.claims;
@@ -1814,21 +1849,22 @@ const gateExecutor = async (context) => {
 	})];
 	try {
 		const output = await Promise.race([answer, ...expired]);
-		if (!options.some((o) => o.id === output.choice)) return {
-			ok: false,
-			output,
-			error: "no one answered the gate"
-		};
+		if (!options.some((o) => o.id === output.choice)) {
+			const facts = node.timeout === void 0 ? {} : { timeout: node.timeout };
+			return endedWith({
+				ok: false,
+				output
+			}, endFor("timed_out", facts, "no one answered the gate"));
+		}
 		return {
 			ok: true,
 			output
 		};
 	} catch {
-		return {
+		return endedWith({
 			ok: false,
-			output: {},
-			error: "the gate was withdrawn"
-		};
+			output: {}
+		}, endFor("interrupted", {}, "the gate was withdrawn"));
 	} finally {
 		answered.abort();
 	}
@@ -1843,18 +1879,16 @@ const gateExecutor = async (context) => {
 */
 /** A node's `timeout:` is what limits a call; this only lifts the SDK's 60 s. */
 const NO_LIMIT_MS = 864e5;
-const failed = (error, output = {}) => ({
-	ok: false,
-	output,
-	error
-});
-/** A failure another try might not have, so a `watch:` looks again. */
-const missed = (error, output = {}) => ({
+const failed = (kind, facts, detail, output = {}) => endedWith({
 	ok: false,
-	transient: true,
-	output,
-	error
-});
+	output
+}, endFor(kind, facts, detail));
+/** How a call that threw ended: a sign-in, a server that won't start, or else. */
+const thrownKind = (error) => {
+	const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+	if (code === 401 || error?.constructor.name === "UnauthorizedError") return "auth";
+	return code === "ENOENT" ? "tool_missing" : "command_failed";
+};
 /**
 * A string's templates rendered. A string that is one `{{ … }}` and nothing
 * else keeps its value's type, so a tool that asks for a number gets one.
@@ -1898,17 +1932,20 @@ const reasonOf = (error, server) => {
 };
 const mcpCallExecutor = (options = {}) => async (context) => {
 	const { node } = context;
-	if (node.type !== "mcp.call") return failed(`${context.id} is not an MCP call`);
+	if (node.type !== "mcp.call") {
+		const said = `${context.id} is not an MCP call`;
+		return failed("unknown", {}, said);
+	}
 	const environ = options.environ ?? process.env;
 	const declared = readMcpServer(context.projectRoot, node.server);
-	if (!declared.ok) return failed(declared.error);
+	if (!declared.ok) return failed("invalid_node", { reason: declared.error });
 	const nodeEnv = renderEnv(node, context, environ);
-	if (!nodeEnv.ok) return failed(nodeEnv.error);
+	if (!nodeEnv.ok) return failed("invalid_node", { reason: nodeEnv.error });
 	const expanded = expandServer(declared.value, {
 		...environ,
 		...nodeEnv.values
 	}, node.plainEnv);
-	if (!expanded.ok) return failed(expanded.error);
+	if (!expanded.ok) return failed("invalid_node", { reason: expanded.error });
 	const scrub = scrubberOf([...secretsOf(context.workflow, environ, options.maskedNames), ...expanded.value.values]);
 	const scope = runScope(context.inputs, context.outputs, context.runId, context.item);
 	const args = Object.fromEntries(Object.entries(node.arguments ?? {}).map(([key, value]) => [key, renderValue(value, scope)]));
@@ -1951,19 +1988,22 @@ const mcpCallExecutor = (options = {}) => async (context) => {
 			id: context.id,
 			isError: reported || tooLong || problem !== null
 		});
-		if (reported) return missed(`${name} failed: ${clipError(said)}`, output);
-		if (tooLong) return failed(`${name}'s result is over 64 KiB`, output);
-		return problem === null ? {
+		if (reported) return failed("command_failed", { program: name }, said, output);
+		if (tooLong) {
+			const reason = `${name}'s result is over 64 KiB`;
+			return failed("invalid_output", { reason }, void 0, output);
+		}
+		return problem === null ? endedWith({
 			ok: true,
 			output
-		} : failed(problem, output);
+		}, endFor("done")) : failed("invalid_output", { reason: problem }, void 0, output);
 	} catch (error) {
 		context.emit({
 			type: "tool.result",
 			id: context.id,
 			isError: true
 		});
-		return missed(clipError(scrub(reasonOf(error, node.server))));
+		return failed(thrownKind(error), { program: `MCP server \`${node.server}\`` }, clipError(scrub(reasonOf(error, node.server))));
 	} finally {
 		await client.close().catch(() => {});
 	}
@@ -1974,13 +2014,39 @@ const mcpCallExecutor = (options = {}) => async (context) => {
 *   text. A program runs in its own process group, so aborting it reaches
 *   whatever it started: SIGTERM, then SIGKILL for what ignores that. A stop or
 *   a timeout therefore leaves nothing running, and an escaped process that
-*   keeps the output pipes open cannot hold the node.
+*   keeps the output pipes open cannot hold the node. Off Windows it runs under
+*   `sh`, whose `times` says the CPU the program and its children used, and at
+*   the project's priority: `low` starts it below Ork's own (nice, and on macOS
+*   utility QoS).
 */
 /** How long a program may take to end after SIGTERM. */
 const KILL_AFTER_MS = 2e3;
 /** How long to wait for the pipes to close after SIGKILL. */
 const CLOSE_AFTER_MS = 500;
-const spawnTool = (program, args, { cwd, signal, env }) => {
+/**
+* Runs `$0 "$@"`, then writes the shell's `times` to fd 3: its children's user
+* and system time, the program's whole tree that it waited for. A program that
+* isn't there says so on fd 3, as spawn's ENOENT would.
+*/
+const TIMED = String.raw`command -v "$0" >/dev/null 2>&1 || { echo ork-missing >&3; exit 127; }; "$0" "$@" 3>&-; s=$?; times >&3; exit $s`;
+const MISSING = "ork-missing";
+/** The children's line of `times` (`0m1.250s 0m0.300s`), in milliseconds. */
+const cpuOfTimes = (text) => {
+	const [, , user, system] = [...text.matchAll(/(\d+)m([\d.]+)s/gu)].map(([, m = "0", s = "0"]) => Number(m) * 60 + Number(s));
+	return user === void 0 || system === void 0 ? void 0 : {
+		userMs: Math.round(user * 1e3),
+		systemMs: Math.round(system * 1e3)
+	};
+};
+const timed = process.platform !== "win32";
+/** What to start: the program, under `sh` to time it, at the priority. */
+const startOf = (program, args, priority) => timed ? startAt(priority, "sh", [
+	"-c",
+	TIMED,
+	program,
+	...args
+]) : [program, [...args]];
+const spawnTool = (program, args, { cwd, signal, env, priority }) => {
 	if (signal.aborted) return Promise.resolve({
 		exitCode: -1,
 		stdout: "",
@@ -1990,7 +2056,9 @@ const spawnTool = (program, args, { cwd, signal, env }) => {
 		const stdout = [];
 		const stderr = [];
 		const timers = [];
-		const child = spawn(program, args, {
+		const times = [];
+		const [bin, argv] = startOf(program, args, priority);
+		const child = spawn(bin, argv, {
 			cwd,
 			detached: true,
 			env: {
@@ -2000,9 +2068,15 @@ const spawnTool = (program, args, { cwd, signal, env }) => {
 			stdio: [
 				"ignore",
 				"pipe",
+				"pipe",
 				"pipe"
 			]
 		});
+		lowerChild(priority, child.pid);
+		const fd3 = child.stdio[3];
+		if (fd3 instanceof Readable) fd3.setEncoding("utf8").on("data", (chunk) => {
+			times.push(chunk);
+		});
 		const killGroup = (kill) => {
 			if (child.pid === void 0) return;
 			try {
@@ -2014,11 +2088,21 @@ const spawnTool = (program, args, { cwd, signal, env }) => {
 			signal.removeEventListener("abort", abort);
 			resolve(run);
 		};
-		const collected = (exitCode) => ({
-			exitCode,
-			stdout: stdout.join(""),
-			stderr: stderr.join("")
-		});
+		const collected = (exitCode) => {
+			const said = times.join("");
+			if (said.includes(MISSING)) return {
+				exitCode: -1,
+				stdout: stdout.join(""),
+				stderr: `could not run ${program}: spawn ${program} ENOENT`
+			};
+			const cpu = cpuOfTimes(said);
+			return {
+				exitCode,
+				stdout: stdout.join(""),
+				stderr: stderr.join(""),
+				...cpu === void 0 ? {} : { cpu }
+			};
+		};
 		const abort = () => {
 			killGroup("SIGTERM");
 			timers.push(setTimeout(() => {
@@ -2029,10 +2113,10 @@ const spawnTool = (program, args, { cwd, signal, env }) => {
 			}, KILL_AFTER_MS));
 		};
 		signal.addEventListener("abort", abort, { once: true });
-		child.stdout.setEncoding("utf8").on("data", (chunk) => {
+		child.stdout?.setEncoding("utf8").on("data", (chunk) => {
 			stdout.push(chunk);
 		});
-		child.stderr.setEncoding("utf8").on("data", (chunk) => {
+		child.stderr?.setEncoding("utf8").on("data", (chunk) => {
 			stderr.push(chunk);
 		});
 		child.on("error", (error) => {