@krapht/ork 1.0.0-alpha.10 → 1.0.0-alpha.11

package/dist/{src-oaJYIddp.mjs → src-BnZgZGrf.mjs}

@@ -1,4 +1,4 @@
-import { Ht as FEEDBACK_KINDS, Ut as FEEDBACK_SEVERITIES, Wt as FEEDBACK_TARGETS, cn as MASK, dt as parseReport, mr as AGENT_DRIVERS, un as maskSecrets } from "./src-Df6KOIDC.mjs";
+import { Ar as AGENT_DRIVERS, Bt as lowerChild, En as maskSecrets, Vt as startAt, an as FEEDBACK_SEVERITIES, en as outcomeEnd, ft as parseReport, in as FEEDBACK_KINDS, nn as END_KINDS, on as FEEDBACK_TARGETS, rn as endFor, wn as MASK } from "./src-D6_xjm-x.mjs";
 import path from "node:path";
 import { z } from "zod";
 import { existsSync, linkSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
@@ -26,6 +26,113 @@ const holdAtTool = async (hold, signal, windowMs) => {
 	}
 	return hold.held() && !signal.aborted ? "defer" : "go";
 };
+// ../runtime/src/heavy-hook.ts
+/**
+* @file A session's slot for a heavy Bash call (the project's `heavy` rule),
+*   taken in the hook before a tool call, where a pause holds the call too
+*   (ADR-041): a slot that frees within the hold window lets the call go; past
+*   it the call is deferred, as a pause defers it, and the session resumes once
+*   the slot is taken. The slot is released after the call (the hook after it),
+*   at the session's next call, or at the session's end. The wait itself (its
+*   events, the clock standing still) is the node's machine port.
+*/
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** The command of a Bash call's hook input, as Claude Code sends it. */
+const bashCommand = (input) => {
+	if (!isRecord$1(input) || input["tool_name"] !== "Bash") return void 0;
+	const tool = input["tool_input"];
+	const command = isRecord$1(tool) ? tool["command"] : void 0;
+	return typeof command === "string" ? command : void 0;
+};
+/** The hook for one session; with no machine port, every call goes. */
+const heavyHook = (machine) => {
+	let held;
+	let waiting;
+	const free = () => {
+		held?.release();
+		held = void 0;
+	};
+	/** Gives up the wait; a slot it already got is given back. */
+	const abandon = () => {
+		const pending = waiting;
+		waiting = void 0;
+		if (pending === void 0) return;
+		pending.stop.abort();
+		pending.slot.then((release) => {
+			release();
+			return null;
+		});
+	};
+	return {
+		before: async (input, signal, windowMs) => {
+			const command = bashCommand(input);
+			if (held !== void 0 && !held.ran && held.command === command) {
+				held.ran = true;
+				return "go";
+			}
+			free();
+			if (waiting !== void 0 && waiting.command !== command) abandon();
+			if (machine === void 0 || command === void 0) return "go";
+			if (waiting === void 0) {
+				const stop = new AbortController();
+				waiting = {
+					command,
+					stop,
+					slot: machine.slot(command, stop.signal)
+				};
+			}
+			const pending = waiting;
+			const window = new AbortController();
+			const release = await Promise.race([pending.slot, setTimeout$1(windowMs, null, { signal: AbortSignal.any([signal, window.signal]) }).catch(() => null)]);
+			window.abort();
+			if (release === null) return signal.aborted ? "go" : "defer";
+			waiting = void 0;
+			held = {
+				command,
+				release,
+				ran: true
+			};
+			return "go";
+		},
+		after: () => {
+			if (held?.ran === true) free();
+		},
+		ready: async () => {
+			const pending = waiting;
+			if (pending === void 0) return;
+			const release = await pending.slot;
+			if (waiting !== pending) return;
+			waiting = void 0;
+			held = {
+				command: pending.command,
+				release,
+				ran: false
+			};
+		},
+		release: () => {
+			abandon();
+			free();
+		}
+	};
+};
+/** Whether a hook's input is from after a tool call. */
+const afterCall = (input) => isRecord$1(input) && input["hook_event_name"] === "PostToolUse";
+/**
+* A session's hook on its tool calls. Before one, a pause holds it (ADR-041),
+* then a heavy Bash call waits for its slot; past the window either defers it
+* (`onDefer`). After a call, its slot is freed.
+*/
+const toolHook = (given) => async (gone, input) => {
+	if (afterCall(input)) {
+		given.heavy.after();
+		return {};
+	}
+	const signal = AbortSignal.any([gone, given.ended]);
+	let answer = await holdAtTool(given.hold, signal, given.windowMs);
+	if (answer === "go") answer = await given.heavy.before(input, signal, given.windowMs);
+	if (answer === "defer") given.onDefer();
+	return given.answer(answer);
+};
 /** The name Claude Code gives an Ork tool: `mcp__ork__<name>`. */
 const toolId = (name) => `mcp__ork__${name}`;
 const text = (value) => ({ content: [{
@@ -77,7 +184,8 @@ const defineTool = (definition) => ({
 *   `claude` CLI driver. It answers with plain JSON (no SSE stream), which the
 *   transport allows, and implements only what Ork needs: `initialize`, `ping`,
 *   `tools/list` and `tools/call`. Beside it, `/hold` answers the session's
-*   `PreToolUse` HTTP hook, which waits while the node is paused (ADR-041).
+*   `PreToolUse` HTTP hook, which waits while the node is paused (ADR-041) or
+*   for a heavy command's slot, and its `PostToolUse` hook, which frees it.
 */
 const PATH = "/mcp";
 const HOLD_PATH = "/hold";
@@ -169,15 +277,22 @@ const serveHold = async (req, res, hold) => {
 		respond(res, 405);
 		return;
 	}
-	if (await readBody(req) === null) {
+	const body = await readBody(req);
+	if (body === null) {
 		respond(res, 413);
 		return;
 	}
+	let input;
+	try {
+		input = JSON.parse(body);
+	} catch {
+		input = void 0;
+	}
 	const gone = new AbortController();
 	res.once("close", () => {
 		gone.abort();
 	});
-	const output = await hold(gone.signal);
+	const output = await hold(gone.signal, input);
 	if (!gone.signal.aborted) respond(res, 200, output);
 };
 const serve = async (req, res, tools, token, hold) => {
@@ -249,25 +364,139 @@ const startOrkMcpHttp = async (tools, hold) => {
 		})
 	};
 };
-// ../runtime/src/session-leg.ts
+// ../runtime/src/provider-errors.ts
 /**
-* @file One process (leg) of a session the runner drives: it writes the queued
-*   stdin lines, yields the adapter's decoded events, and says how it ended. A
-*   session is one leg, or several when a paused node's tool call was deferred
-*   or a message waits for a tool that takes none mid-session; a resumed leg
-*   carries what the legs before it spent, and its start is not news.
+* @file The provider-error classifier every driver's adapter uses (specs/
+*   runtime/session-ends.md): an error a model provider sent back (Anthropic,
+*   OpenAI-style, or a proxy such as OpenCode's `commandcode`) to one end kind.
+*   It reads the error's type or code first, its HTTP status next, and its
+*   words last, so a changed sentence rarely changes the kind.
 */
-const REASON_LIMIT = 500;
-/** Marks a session's start with the driver that runs it. */
-const withDriver = (event, driver) => event.type === "session.started" ? {
-	...event,
-	driver
-} : event;
-/** A finished event for a session the driver could not run. */
-const driverFailure = (message) => ({
+/** Error types and codes the providers document, by the kind they mean. */
+const TYPES = {
+	rate_limit_error: "rate_limited",
+	overloaded_error: "provider_unavailable",
+	api_error: "provider_unavailable",
+	timeout_error: "provider_unavailable",
+	authentication_error: "auth",
+	permission_error: "auth",
+	billing_error: "out_of_credits",
+	not_found_error: "model_unavailable",
+	request_too_large: "context_too_long",
+	insufficient_quota: "out_of_credits",
+	invalid_api_key: "auth",
+	context_length_exceeded: "context_too_long",
+	model_not_found: "model_unavailable",
+	rate_limit_exceeded: "rate_limited",
+	server_error: "provider_unavailable",
+	ProviderAuthError: "auth",
+	MessageAbortedError: "interrupted"
+};
+const TYPE = new RegExp(`\\b(${Object.keys(TYPES).join("|")})\\b`, "u");
+/** HTTP statuses that decide by themselves; 400 needs the words. */
+const statusKind = (status) => {
+	if (status === 401 || status === 403) return "auth";
+	if (status === 402) return "out_of_credits";
+	if (status === 404) return "model_unavailable";
+	if (status === 413) return "context_too_long";
+	if (status === 429) return "rate_limited";
+	if (status === 408 || status === 529 || status >= 500 && status < 600) return "provider_unavailable";
+	return null;
+};
+/** The words, when neither type nor status decided; the first match wins. */
+const WORDS = [
+	["plan_limit", /\busage limit reached\b|\bhit your (?:usage )?limit\b|\blimit will reset\b/iu],
+	["context_too_long", /\bprompt is too long\b|\bcontext (?:length|window)\b|\bmaximum context\b|\btoo many tokens\b/iu],
+	["out_of_credits", /\bcredit balance\b|\binsufficient (?:credits?|funds|balance|quota)\b|\bout of credits?\b|\bexceeded your current quota\b/iu],
+	["rate_limited", /\brate.?limit(?:ed)?\b|\btoo many requests\b/iu],
+	["auth", /\binvalid (?:x-)?api.?key\b|\bnot (?:logged|signed) in\b|\bplease run \/login\b|\bunauthori[sz]ed\b|\bOAuth token has expired\b/iu],
+	["provider_unavailable", /\boverloaded\b|\bservice unavailable\b|\bbad gateway\b|\bECONNRESET\b|\bECONNREFUSED\b|\bETIMEDOUT\b|\bENOTFOUND\b|\bEAI_AGAIN\b|\bfetch failed\b|\bsocket hang up\b|\bnetwork error\b/iu],
+	["model_unavailable", /\bassistant message prefill\b|\bInvalid `signature` in `thinking` block\b|\bmodel(?: \S+)? (?:not found|does not exist|is not supported)\b|\bdoes not support\b|\bunknown model\b/iu]
+];
+/** Generic refusals: the provider would not serve the request as it was. */
+const REFUSED$1 = /\binvalid_request_error\b|\binvalid_request\b/u;
+/** A status written in the text, e.g. Claude Code's `API Error: 529 {…}`. */
+const STATUS_IN_TEXT = /\bAPI Error:? (\d{3})\b|"(?:status|statusCode)"\s*:\s*(\d{3})\b|\b(?:status|HTTP)[ :]+(\d{3})\b/u;
+const statusIn = (text) => {
+	const found = STATUS_IN_TEXT.exec(text);
+	const digits = found?.[1] ?? found?.[2] ?? found?.[3];
+	return digits === void 0 ? void 0 : Number(digits);
+};
+const classed = (kind) => ({
+	kind,
+	message: END_KINDS[kind].message({})
+});
+/**
+* The end kind a provider's error means, with Ork's sentence for it; `null`
+* when nothing in it is recognized. `status` is the HTTP status when the caller
+* has it; otherwise one written in the text is read.
+*/
+const classifyProviderError = (text, status) => {
+	const type = TYPE.exec(text)?.[1];
+	if (type !== void 0) return classed(TYPES[type] ?? "unknown");
+	const code = status ?? statusIn(text);
+	const byStatus = code === void 0 ? null : statusKind(code);
+	if (byStatus !== null) return classed(byStatus);
+	const byWords = WORDS.find(([, pattern]) => pattern.test(text))?.[0];
+	if (byWords !== void 0) return classed(byWords);
+	return REFUSED$1.test(text) || code === 400 ? classed("model_unavailable") : null;
+};
+// ../runtime/src/session-end.ts
+/**
+* @file How a session ended, as its adapter's decoder and the session runner
+*   settle it (specs/runtime/session-ends.md): a decoder names the signal only
+*   it can see (a turn cap, an exit code, a provider's error), and the report
+*   the session handed in decides the rest. The runner then writes the end in
+*   the node's numbers, its detail scrubbed with the feedback redactor. A
+*   session the driver could not run ends as `driverFailure` says.
+*/
+/** The end a report gives: done, a reported failure, or none handed in. */
+const reportEnd = (report) => {
+	if (report === null) return endFor("no_report");
+	return endFor(report.status === "fail" ? "reported_failure" : "done");
+};
+/**
+* A session's end: a report it handed in decides it (the node's result is that
+* report), then the decoder's `signal`, then `no_report`.
+*/
+const sessionEnd = (signal, report) => report !== null || signal === null ? reportEnd(report) : signal;
+/**
+* The end an error's text means: the provider classifier's kind, or `fallback`
+* when it recognizes nothing. The text is the detail either way.
+*/
+const errorEnd = (text, fallback = "unknown", status) => endFor(classifyProviderError(text, status)?.kind ?? fallback, {}, text);
+/**
+* The outcome with its end settled: a report decides it, also one handed in
+* through Ork's `report` tool after the decoder's end said none; the message is
+* written with the node's numbers; the detail is scrubbed and capped. An
+* adapter whose decoder sets no end gets one read from the outcome.
+*/
+const settleEnd = (outcome, facts, scrub) => {
+	const end = outcome.report === null ? outcome.end ?? outcomeEnd(outcome) : reportEnd(outcome.report);
+	return {
+		...outcome,
+		end: endFor(end.kind, facts, end.detail, scrub)
+	};
+};
+/**
+* The kind of a failure to run the driver: its program missing, else what a
+* provider's words in it say, else a crash.
+*/
+const failureKind = (error) => {
+	if (error instanceof Error && "code" in error && error.code === "ENOENT") return "tool_missing";
+	const text = error instanceof Error ? error.message : String(error);
+	if (/\bENOENT\b/u.test(text)) return "tool_missing";
+	return classifyProviderError(text)?.kind ?? "driver_crashed";
+};
+/**
+* A finished event for a session the driver could not run, ended as `kind` with
+* `message` (Ork's words or the tool's, masked) as its detail.
+*/
+const driverFailure = (message, kind, scope) => ({
 	type: "session.finished",
 	outcome: {
 		subtype: "error_driver",
+		end: endFor(kind, scope.facts, kind === "interrupted" ? void 0 : message, scope.scrub),
 		sessionId: "",
 		report: null,
 		text: "",
@@ -283,6 +512,30 @@ const driverFailure = (message) => ({
 		errors: [message]
 	}
 });
+// ../runtime/src/session-leg.ts
+/**
+* @file One process (leg) of a session the runner drives: it writes the queued
+*   stdin lines, yields the adapter's decoded events, and says how it ended. A
+*   session is one leg, or several when a paused node's tool call was deferred
+*   or a message waits for a tool that takes none mid-session; a resumed leg
+*   carries what the legs before it spent, and its start is not news.
+*/
+const REASON_LIMIT = 500;
+/** Marks a session's start with the driver that runs it. */
+const withDriver = (event, driver) => event.type === "session.started" ? {
+	...event,
+	driver
+} : event;
+/**
+* A session's outcome with its report (the one Ork's `report` tool accepted,
+* when the session has that tool) and its end settled.
+*/
+const settled = (outcome, input) => settleEnd(input.reported === void 0 ? outcome : {
+	...outcome,
+	report: input.reported()
+}, input.scope.facts, input.scope.scrub);
+/** The kinds of a session that ended well, so a queued message continues it. */
+const wentWell = (kind) => kind === "done" || kind === "reported_failure" || kind === "no_report";
 /**
 * What one decoded line yields, and how the leg ends if it does: a result is
 * the session's end, unless the hold hook deferred a call or a message waits; a
@@ -295,12 +548,9 @@ const legStep = (decoded, input) => {
 	const events = [];
 	let ended;
 	for (const said of decoded.events) {
-		const event = said.type === "session.finished" && input.reported !== void 0 ? {
+		const event = said.type === "session.finished" ? {
 			...said,
-			outcome: {
-				...said.outcome,
-				report: input.reported()
-			}
+			outcome: settled(said.outcome, input)
 		} : said;
 		if (event.type === "session.started" && carried !== void 0) continue;
 		if (event.type !== "session.finished") events.push(withDriver(event, adapter.driver));
@@ -319,7 +569,7 @@ const legStep = (decoded, input) => {
 					usage
 				}
 			};
-			if (input.withhold() && event.outcome.subtype === "success") ended = {
+			if (input.withhold() && wentWell(event.outcome.end?.kind)) ended = {
 				kind: "continued",
 				sessionId: event.outcome.sessionId,
 				usage: event.outcome.usage,
@@ -348,7 +598,8 @@ const failureReason = (name, stderr, code) => {
 };
 /** Runs one process of a session, yielding its events; returns how it ended. */
 const runLeg = async function* (input) {
-	const child = spawn(input.bin, input.args, {
+	const [bin, args] = startAt(input.priority, input.bin, input.args, input.env);
+	const child = spawn(bin, args, {
 		cwd: input.cwd,
 		env: { ...input.env },
 		stdio: [
@@ -357,6 +608,7 @@ const runLeg = async function* (input) {
 			"pipe"
 		]
 	});
+	lowerChild(input.priority, child.pid);
 	const exited = new Promise((resolve) => {
 		child.on("close", (code, signal) => {
 			resolve({
@@ -388,7 +640,7 @@ const runLeg = async function* (input) {
 	if (input.adapter.command.input === void 0) child.stdin.end();
 	let outcome;
 	const { decoder } = input;
-	const decode = decoder?.decode ?? input.adapter.decoder?.() ?? input.adapter.decode;
+	const decode = decoder?.decode ?? input.adapter.decode;
 	try {
 		for await (const line of createInterface({ input: child.stdout })) {
 			const { events, ended } = legStep(decode(line), input);
@@ -400,18 +652,26 @@ const runLeg = async function* (input) {
 		}
 		const end = await Promise.race([exited, spawnError.then((error) => error)]);
 		if (outcome !== void 0) return outcome;
-		if (decoder !== void 0 && !(end instanceof Error) && !stopped && end.signal === null) {
+		if (decoder !== void 0 && !(end instanceof Error) && !stopped) {
 			const { events, ended } = legStep({ events: decoder.exit(end.code) }, input);
 			yield* events;
 			if (ended !== void 0) return ended;
 		}
 		if (end instanceof Error) return {
 			kind: "failed",
-			reason: `could not start ${input.bin}: ${end.message}`
+			reason: `could not start ${input.bin}: ${end.message}`,
+			end: failureKind(end)
+		};
+		if (stopped || end.signal !== null) return {
+			kind: "failed",
+			reason: "interrupted",
+			end: "interrupted"
 		};
+		const reason = failureReason(input.adapter.command.bin, stderr, end.code);
 		return {
 			kind: "failed",
-			reason: stopped || end.signal !== null ? "interrupted" : failureReason(input.adapter.command.bin, stderr, end.code)
+			reason,
+			end: classifyProviderError(reason)?.kind ?? "driver_crashed"
 		};
 	} finally {
 		input.attach();
@@ -774,6 +1034,33 @@ const orkTools = (context) => ORK_TOOLS.flatMap((tool) => tool.bind(context) ??
 /** Their Claude Code names, for the session's allowed tools. */
 const preapprovedTools = (tools) => tools.filter((t) => t.preapproved).map((t) => toolId(t.name));
 // ../runtime/src/session-runner.ts
+/**
+* @file The session runner: one agent CLI session, driven through an adapter's
+*   strategies (`adapter.ts`), written once for every driver. It serves Ork's
+*   tools on a local MCP endpoint, wires the session to it, and runs the tool
+*   as one or more processes (legs). A paused node's tool call is held, and
+*   past the hold window deferred; the next leg resumes the session once the
+*   node continues (ADR-041). A tool that takes no message mid-session gets one
+*   at the next leg, which resumes the session with it. A driver that cannot
+*   hold the final answer to the report schema gets Ork's `report` tool, and
+*   the session ends with the report it accepted. Interrupting stops the
+*   running process.
+*/
+/**
+* What a session's end is written with: the node's limits and program, and its
+* folder and the home folder taken out of the detail.
+*/
+const scopeOf = (spec, bin, env) => ({
+	facts: {
+		...spec.maxTurns === void 0 ? {} : { maxTurns: spec.maxTurns },
+		...spec.budgetUsd === void 0 ? {} : { budgetUsd: spec.budgetUsd },
+		program: path.basename(bin)
+	},
+	scrub: {
+		roots: [spec.cwd],
+		home: env["HOME"] ?? homedir()
+	}
+});
 /** A spec that resumes `sessionId`; a fork's later legs continue the fork. */
 const resumed = (spec, sessionId) => ({
 	...spec,
@@ -830,6 +1117,12 @@ const createSessionRuntime = (adapter, options = {}) => ({
 		let reported = null;
 		const { hold } = ports;
 		const hook = hold === void 0 ? void 0 : adapter.hold;
+		const heavy = heavyHook(ports.machine);
+		ended.signal.addEventListener("abort", () => {
+			heavy.release();
+		}, { once: true });
+		const bin = options.bin ?? adapter.command.bin;
+		const scope = scopeOf(spec, bin, options.env ?? process.env);
 		const events = async function* () {
 			const tools = orkTools({
 				nodeId: spec.nodeId,
@@ -843,11 +1136,16 @@ const createSessionRuntime = (adapter, options = {}) => ({
 				}
 			});
 			const byTool = tools.some((tool) => tool.name === REPORT_TOOL);
-			const mcp = await startOrkMcpHttp(tools, hold === void 0 || hook === void 0 ? void 0 : async (gone) => {
-				const answer = await holdAtTool(hold, AbortSignal.any([gone, ended.signal]), options.holdWindowMs ?? hook.windowMs);
-				if (answer === "defer") deferring = true;
-				return hook.answer(answer);
-			});
+			const mcp = await startOrkMcpHttp(tools, hold === void 0 || hook === void 0 ? void 0 : toolHook({
+				hold,
+				heavy,
+				answer: hook.answer,
+				windowMs: options.holdWindowMs ?? hook.windowMs,
+				ended: ended.signal,
+				onDefer: () => {
+					deferring = true;
+				}
+			}));
 			const endpoint = hook === void 0 ? {
 				url: mcp.url,
 				token: mcp.token
@@ -858,19 +1156,22 @@ const createSessionRuntime = (adapter, options = {}) => ({
 				try {
 					wired = yield* wireSaying(adapter, spec, endpoint, ended.signal, options);
 				} catch (error) {
-					yield driverFailure(`could not reach Ork's tools: ${error instanceof Error ? error.message : String(error)}`);
+					yield driverFailure(`could not reach Ork's tools: ${error instanceof Error ? error.message : String(error)}`, failureKind(error), scope);
 					return;
 				}
 				const env = {
 					...options.env ?? process.env,
+					PWD: spec.cwd,
 					...adapter.context.env(spec),
 					...wired.env
 				};
 				const legOf = (legSpec, carried) => ({
 					adapter,
-					bin: options.bin ?? adapter.command.bin,
+					bin,
 					env,
+					scope,
 					cwd: spec.cwd,
+					...ports.machine === void 0 ? {} : { priority: ports.machine.priority },
 					args: [...adapter.command.args(legSpec, {
 						endpoint,
 						allowed
@@ -889,18 +1190,21 @@ const createSessionRuntime = (adapter, options = {}) => ({
 				let spent;
 				for (;;) {
 					if (ended.signal.aborted) {
-						yield driverFailure("interrupted");
+						yield driverFailure("interrupted", "interrupted", scope);
 						return;
 					}
 					const leg = yield* runLeg(legOf(legSpec, spent));
 					if (leg.kind === "failed") {
-						yield driverFailure(leg.reason);
+						yield driverFailure(leg.reason, leg.end, scope);
 						return;
 					}
 					if (leg.kind === "finished") return;
 					deferring = false;
 					spent = spent === void 0 ? leg.usage : adapter.usage.combine(spent, leg.usage);
-					if (leg.kind === "deferred") await hold?.wait("tool", ended.signal);
+					if (leg.kind === "deferred") {
+						await heavy.ready();
+						await hold?.wait("tool", ended.signal);
+					}
 					if (ended.signal.aborted) {
 						yield leg.last;
 						return;
@@ -911,6 +1215,7 @@ const createSessionRuntime = (adapter, options = {}) => ({
 					} : resumed(spec, leg.sessionId);
 				}
 			} finally {
+				heavy.release();
 				await wired?.release();
 				await mcp.close();
 			}
@@ -960,16 +1265,38 @@ const usageOf = (result) => {
 		durationMs: num$2(result["duration_ms"])
 	};
 };
+/** Claude Code's error subtypes that name their own kind. */
+const SUBTYPE_KINDS = {
+	error_max_turns: "turn_limit",
+	error_max_budget_usd: "budget_limit",
+	error_max_structured_output_retries: "invalid_report"
+};
+/**
+* What a result says went wrong, if anything: a subtype that names its kind, or
+* an error (`is_error`, or an error subtype) read by the provider classifier,
+* `unknown` when it says nothing Ork knows.
+*/
+const signalOf$1 = (subtype, result, errors) => {
+	const text = [...errors, str$2(result["result"])].join("\n").trim();
+	const named = SUBTYPE_KINDS[subtype];
+	if (named !== void 0) return endFor(named, {}, text);
+	if (subtype === "success" && result["is_error"] !== true) return null;
+	return errorEnd(text);
+};
 /** The outcome a `result` message describes. */
 const outcomeOf = (result) => {
-	const errors = result["errors"];
+	const said = result["errors"];
+	const errors = Array.isArray(said) ? said.filter((e) => typeof e === "string") : [];
+	const subtype = str$2(result["subtype"]) || "unknown";
+	const report = parseReport(result["structured_output"]);
 	return {
-		subtype: str$2(result["subtype"]) || "unknown",
+		subtype,
+		end: sessionEnd(signalOf$1(subtype, result, errors), report),
 		sessionId: str$2(result["session_id"]),
-		report: parseReport(result["structured_output"]),
+		report,
 		text: str$2(result["result"]),
 		usage: usageOf(result),
-		errors: Array.isArray(errors) ? errors.filter((e) => typeof e === "string") : []
+		errors
 	};
 };
 /** The year 2286: a reset beyond this is not in seconds. */
@@ -1113,12 +1440,14 @@ const isRecord = (value) => typeof value === "object" && value !== null && !Arra
 /**
 * The node's `--settings` with Ork's `PreToolUse` HTTP hook added: before every
 * tool call, pre-approved ones included, the session asks whether its node may
-* go on.
+* go on. Its `PostToolUse` hook after a Bash call frees the call's slot.
 */
 const withHoldHook = (settings, holdUrl, token) => {
 	const hooks = isRecord(settings?.["hooks"]) ? settings["hooks"] : {};
-	const listed = hooks["PreToolUse"];
-	const before = Array.isArray(listed) ? [...listed] : [];
+	const listed = (event) => {
+		const own = hooks[event];
+		return Array.isArray(own) ? [...own] : [];
+	};
 	const hook = {
 		type: "http",
 		url: holdUrl,
@@ -1129,9 +1458,13 @@ const withHoldHook = (settings, holdUrl, token) => {
 		...settings,
 		hooks: {
 			...hooks,
-			PreToolUse: [...before, {
+			PreToolUse: [...listed("PreToolUse"), {
 				matcher: "*",
 				hooks: [hook]
+			}],
+			PostToolUse: [...listed("PostToolUse"), {
+				matcher: "Bash",
+				hooks: [hook]
 			}]
 		}
 	};
@@ -1273,9 +1606,11 @@ const runCmd = (options, args, cwd) => new Promise((resolve) => {
 		encoding: "utf8",
 		timeout: CMD_TIMEOUT_MS
 	}, (error, stdout, stderr) => {
+		const said = `${stdout}${stderr}`.trim();
+		const missing = error?.code === "ENOENT" ? `spawn ${options.bin} ENOENT` : "";
 		resolve({
 			ok: error === null,
-			out: `${stdout}${stderr}`.trim()
+			out: said || missing
 		});
 	});
 });
@@ -1487,6 +1822,17 @@ const leaseWiring = (given) => ({
 	}
 });
 // ../runtime/src/adapters/command-code-events.ts
+/**
+* @file The `command-code` adapter's `LegDecoder` and `UsageReader`: maps
+*   Command Code's `--output-format json` lines (`{"type":"event"}` frames,
+*   then one `{"type":"result"}` line; measured on 1.88.5,
+*   specs/architecture.md, "Command Code") to Ork's runtime events. Tool names
+*   are given Ork's (Claude Code's) names, so logs and the node's rules read
+*   the same on every driver. One decoder reads one leg: the session id comes
+*   in an early `run_start` frame and the result line counts no turns, so it
+*   keeps both. The result line is held until the process exits: its exit code
+*   says how the session ended (specs/architecture/command-code.md).
+*/
 const isObject$1 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const num$1 = (value) => typeof value === "number" ? value : 0;
 const str$1 = (value) => typeof value === "string" ? value : "";
@@ -1513,6 +1859,28 @@ const SUBTYPES = {
 	max_turns: "error_max_turns",
 	error: "error_during_execution"
 };
+/**
+* Command Code's exit codes, by the kind they mean; 0 is a session that ended
+* well and 1 an error its text explains.
+*/
+const COMMAND_CODE_EXITS = {
+	3: "auth",
+	4: "auth",
+	5: "rate_limited",
+	6: "provider_unavailable",
+	7: "provider_unavailable",
+	8: "turn_limit",
+	9: "provider_unavailable",
+	10: "out_of_credits",
+	130: "interrupted"
+};
+/** What a leg's exit code and result line say went wrong, if anything. */
+const signalOf = (code, error) => {
+	const kind = code === null ? void 0 : COMMAND_CODE_EXITS[code];
+	if (kind !== void 0) return endFor(kind, {}, error);
+	if ((code === 0 || code === null) && error === "") return null;
+	return errorEnd(error);
+};
 /** The text blocks of a `message_end` frame's content. */
 const textOf = (content) => (Array.isArray(content) ? content : []).filter((item) => isObject$1(item)).filter((block) => block["type"] === "text").map((block) => str$1(block["text"])).join("");
 /** The frames that end a tool call as an error: failed, denied, or blocked. */
@@ -1528,10 +1896,14 @@ const parseLine$1 = (line) => {
 		return;
 	}
 };
-/** A decoder for one leg of a Command Code session. */
+/**
+* A decoder for one leg of a Command Code session; its end comes at the exit,
+* from the held result line and the exit code.
+*/
 const commandCodeDecoder = () => {
 	let sessionId = "";
 	let turns = 0;
+	let held;
 	const frame = (event) => {
 		const type = event["type"];
 		const id = str$1(event["toolCallId"]);
@@ -1573,13 +1945,16 @@ const commandCodeDecoder = () => {
 		}];
 		return [];
 	};
-	const result = (line) => {
+	const result = (line, code) => {
 		const usage = isObject$1(line["usage"]) ? line["usage"] : {};
 		const error = str$1(line["error"]);
+		const subtype = str$1(line["subtype"]);
+		const signal = subtype === "max_turns" ? endFor("turn_limit", {}, error) : signalOf(code, error);
 		return {
 			type: "session.finished",
 			outcome: {
-				subtype: SUBTYPES[str$1(line["subtype"])] ?? "error_during_execution",
+				subtype: SUBTYPES[subtype] ?? "error_during_execution",
+				end: signal ?? endFor("no_report"),
 				sessionId: str$1(line["sessionId"]) || sessionId,
 				report: null,
 				text: str$1(line["finalText"]),
@@ -1596,12 +1971,21 @@ const commandCodeDecoder = () => {
 			}
 		};
 	};
-	return (line) => {
-		const message = parseLine$1(line);
-		if (!isObject$1(message)) return { events: [] };
-		if (message["type"] === "result") return { events: [result(message)] };
-		const event = message["event"];
-		return { events: message["type"] === "event" && isObject$1(event) ? frame(event) : [] };
+	return {
+		decode: (line) => {
+			const message = parseLine$1(line);
+			if (!isObject$1(message)) return { events: [] };
+			if (message["type"] === "result") {
+				held = message;
+				return { events: [] };
+			}
+			const event = message["event"];
+			return { events: message["type"] === "event" && isObject$1(event) ? frame(event) : [] };
+		},
+		exit: (code) => {
+			if (held !== void 0) return [result(held, code)];
+			return (code === null ? void 0 : COMMAND_CODE_EXITS[code]) === void 0 ? [] : [result({ error: "" }, code)];
+		}
 	};
 };
 /** Command Code reports tokens, never dollars. */
@@ -1617,12 +2001,14 @@ const commandCodeUsage = {
 *   `--permission-mode yolo` and loads, with `--mod`, a mod written for the
 *   session outside the checkout: its `beforeToolCall` hook blocks every call
 *   the node did not allow. Ork's own tools (`mcp__ork__*`) always go through.
-*   The rules are the node's, in Claude Code's words (`Bash(git:*)`, `Read`,
-*   `mcp__github`); a specifier Ork does not read never allows a call and
-*   always denies one.
+*   Command Code's tool loader passes, and reads inside the worktree need no
+*   rule, as with Claude Code; one reaching outside it does. The rules are the
+*   node's, in Claude Code's words (`Bash(git:*)`, `Read`, `mcp__github`); a
+*   specifier Ork does not read never allows a call and always denies one.
 */
 /** The rules of a session: an `acceptEdits` node may edit without a rule. */
 const modRules = (spec) => ({
+	cwd: spec.cwd,
 	allow: [...spec.tools.allow, ...spec.permissionMode === "acceptEdits" ? ["Edit"] : []],
 	deny: spec.tools.deny,
 	...spec.tools.only === void 0 ? {} : { only: spec.tools.only }
@@ -1632,7 +2018,20 @@ const modRules = (spec) => ({
 * export taking the mod API), so it carries its own matcher.
 */
 const modSource = (rules) => `// Ork's rules for one session; written by Ork, removed after it.
+import { relative, resolve } from "node:path";
 const RULES = ${JSON.stringify(rules)};
+// Command Code's own: loading a deferred tool's schema, Ork's report included.
+const META = new Set(["search_tools", "tool_search"]);
+// Reads a session makes in its worktree without a rule, as Claude Code does.
+const READS = new Set(["read_file", "read_multiple_files", "read_directory", "glob", "grep"]);
+const pathsOf = input => Object.entries(input ?? {})
+  .filter(([key]) => /path|file|dir/i.test(key))
+  .flatMap(([, value]) => (Array.isArray(value) ? value : [value]))
+  .filter(value => typeof value === "string");
+const inside = input => pathsOf(input).every(each => {
+  const from = relative(RULES.cwd, resolve(RULES.cwd, each));
+  return from === "" || (!from.startsWith("..") && !from.startsWith("/"));
+});
 const TOOLS = ${JSON.stringify(COMMAND_CODE_TOOLS)};
 // A rule's word, as Command Code reads it, covers these of Ork's tool names.
 const COVERS = { read: ["Read", "Glob", "Grep"], edit: ["Edit", "Write"] };
@@ -1671,10 +2070,11 @@ const matches = (rule, name, input) => {
 };
 export const decide = (name, input) => {
   if (RULES.deny.some(rule => matches(rule, name, input) !== false)) return "denied for this node";
-  if (name.startsWith("mcp__ork__")) return undefined;
+  if (name.startsWith("mcp__ork__") || META.has(name)) return undefined;
   if (RULES.only !== undefined && !RULES.only.some(rule => matches(rule, name, input) === true)) {
     return "not one of this node's tools";
   }
+  if (READS.has(name) && inside(input)) return undefined;
   if (RULES.allow.some(rule => matches(rule, name, input) === true)) return undefined;
   return "not allowed for this node";
 };
@@ -1718,8 +2118,10 @@ const queryOf = (spec) => {
 	return text.startsWith("-") ? ` ${text}` : text;
 };
 /**
-* The `cmd` arguments for a session spec. `yolo`: Command Code prompts for
-* nothing, and the session's mod refuses what the node did not allow.
+* The `cmd` arguments for a session spec. `--dangerously-skip-permissions`: in
+* `-p` mode only it lifts Command Code's own gate on edits and shell (the
+* permission mode alone does not), so the session's mod, which refuses what the
+* node did not allow, is the only gate.
 */
 const commandCodeArgs = (spec) => {
 	const args = [
@@ -1729,6 +2131,7 @@ const commandCodeArgs = (spec) => {
 		"json",
 		"--permission-mode",
 		"yolo",
+		"--dangerously-skip-permissions",
 		"--skip-onboarding",
 		"--no-auto-update"
 	];
@@ -1747,8 +2150,8 @@ const commandCodeAdapter = {
 		bin: "cmd",
 		args: (spec) => commandCodeArgs(spec)
 	},
-	decode: (line) => commandCodeDecoder()(line),
-	decoder: commandCodeDecoder,
+	decode: (line) => commandCodeDecoder().decode(line),
+	legDecoder: () => commandCodeDecoder(),
 	mcp: {
 		kind: "lease",
 		wire: async (spec, endpoint, hooks) => {
@@ -1856,8 +2259,16 @@ const ACTIONS = {
 	TodoWrite: "todowrite"
 };
 const BUILT_IN = new Set(Object.values(ACTIONS));
-/** Actions whose resource is a path: a bare allow stays in the worktree. */
+/**
+* Actions whose resource is a path. OpenCode matches it relative to the
+* worktree (an absolute path inside it too), `*` across folders, and asks
+* `external_directory`, denied first, for any path outside it.
+*/
 const PATH_ACTIONS = /* @__PURE__ */ new Set(["read", "edit"]);
+/** A rule's path as OpenCode matches it: relative to the worktree. */
+const pathResource = (spec, cwd) => {
+	return (path.isAbsolute(spec) ? path.relative(cwd, spec) : spec).replace(/^\.\//u, "") || "*";
+};
 /** OpenCode's name for an MCP server's tool: other characters become `_`. */
 const mcpAction = (server, tool) => `${server}_${tool}`.replaceAll(/[^A-Za-z0-9_*-]/gu, "_");
 /** A shell rule's resource: Claude Code's `git status:*` is `git status *`. */
@@ -1883,16 +2294,22 @@ const ruleOf = (rule, effect, cwd) => {
 	if (action === void 0) return void 0;
 	if (spec !== void 0) return {
 		action,
-		resource: action === "shell" ? shellResource(spec) : PATH_ACTIONS.has(action) ? path.resolve(cwd, spec) : spec,
+		resource: action === "shell" ? shellResource(spec) : PATH_ACTIONS.has(action) ? pathResource(spec, cwd) : spec,
 		effect
 	};
 	return {
 		action,
-		resource: effect === "allow" && PATH_ACTIONS.has(action) ? `${cwd}/*` : "*",
+		resource: "*",
 		effect
 	};
 };
 const rulesOf = (rules, effect, cwd) => rules.flatMap((rule) => ruleOf(rule, effect, cwd) ?? []);
+/** An action allowed anywhere in the worktree; outside it is denied. */
+const worktree = (action) => ({
+	action,
+	resource: "*",
+	effect: "allow"
+});
 /**
 * The session's rules, in order: deny everything; read in the worktree (as
 * Claude Code reads without asking); edits there under `acceptEdits`; the
@@ -1903,11 +2320,6 @@ const permissionRules = (spec) => {
 	const { cwd, tools } = spec;
 	const only = tools.only === void 0 ? void 0 : new Set(rulesOf(tools.only, "allow", cwd).map((r) => r.action));
 	const inOnly = (rule) => only === void 0 || only.has(rule.action) || !BUILT_IN.has(rule.action);
-	const worktree = (action) => ({
-		action,
-		resource: `${cwd}/*`,
-		effect: "allow"
-	});
 	return [
 		{
 			action: "*",
@@ -1977,6 +2389,16 @@ const sessionConfig = (spec, endpoint, instructions) => ({
 	} }
 });
 // ../runtime/src/adapters/open-code-events.ts
+/**
+* @file The `open-code` adapter's decoder and usage reader. `opencode run
+*   --format json` prints one JSON object per line, `{type, timestamp,
+*   sessionID, part}` (2.1.0, read from its source): `step_start`, `text`,
+*   `tool_use` (a finished call, `state.status` `completed` or `error`),
+*   `step_finish` (`cost` in dollars, `tokens`) and `error`. There is no result
+*   line: the last `text` is the final text and the process's exit ends the
+*   session. Tool names come back in Claude Code's words (`shell` is `Bash`,
+*   `ork_report` is `mcp__ork__report`), the words a node's rules use.
+*/
 const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const get = (value, key) => isObject(value) ? value[key] : void 0;
 const num = (value) => typeof value === "number" ? value : 0;
@@ -2075,10 +2497,27 @@ const decodeOpenCodeLine = (line) => {
 		default: return { events: [] };
 	}
 };
+/** An `error` line's words, for the session's errors. */
+const errorText = (error) => str(get(get(error, "data"), "message")) || str(get(error, "message")) || str(get(error, "name")) || "error";
+/** An `error` line's end: its name, status and body, through the classifier. */
+const errorLineEnd = (error) => {
+	const data = get(error, "data");
+	const status = get(data, "statusCode");
+	const said = [
+		str(get(error, "name")),
+		errorText(error),
+		str(get(data, "responseBody"))
+	].filter((part) => part !== "").join("\n");
+	return errorEnd(said, "unknown", typeof status === "number" ? status : void 0);
+};
+/** The exit code OpenCode gives an interrupted session. */
+const INTERRUPTED = 130;
 /**
 * A decoder for one leg of a session: it starts the session at the first line
 * that names it, and keeps the last text, the steps' usage and the errors for
-* the end.
+* the end. OpenCode prints nothing at its step cap (`steps`, the node's
+* `maxTurns`): a session that used every step and handed in no report reached
+* its turn limit, which the runner settles once it knows the report.
 */
 const openCodeDecoder = (spec) => {
 	const began = Date.now();
@@ -2086,6 +2525,7 @@ const openCodeDecoder = (spec) => {
 	let text = "";
 	let usage = NONE;
 	const errors = [];
+	let failed = null;
 	return {
 		decode: (line) => {
 			const message = parseLine(line);
@@ -2108,20 +2548,22 @@ const openCodeDecoder = (spec) => {
 				case "step_finish":
 					usage = sumUsage(usage, stepUsage(message["part"]));
 					break;
-				case "error": {
-					const error = message["error"];
-					errors.push(str(get(get(error, "data"), "message")) || str(get(error, "message")) || str(get(error, "name")) || "error");
-					break;
-				}
+				case "error":
+					errors.push(errorText(message["error"]));
+					failed ??= errorLineEnd(message["error"]);
 			}
 			return { events };
 		},
 		exit: (code) => {
-			if (code !== 0 && errors.length === 0) return [];
+			const interrupted = code === INTERRUPTED;
+			if (code !== 0 && errors.length === 0 && !interrupted) return [];
+			const capped = spec.maxTurns !== void 0 && usage.turns >= spec.maxTurns;
+			const end = interrupted ? endFor("interrupted", {}, errors.join("\n")) : failed ?? endFor(capped ? "turn_limit" : "no_report");
 			return [{
 				type: "session.finished",
 				outcome: {
 					subtype: code === 0 ? "success" : "error_during_execution",
+					end,
 					sessionId,
 					report: null,
 					text,
@@ -2230,7 +2672,7 @@ const notBuilt = (driver) => ({
 	driver,
 	start: () => ({
 		events: (async function* () {
-			yield driverFailure(notBuiltYet(driver));
+			yield driverFailure(notBuiltYet(driver), "model_unavailable", { facts: {} });
 		})(),
 		send: () => {},
 		interrupt: () => Promise.resolve()