@krapht/ork 1.0.0-alpha.16 → 1.0.0-alpha.18

package/dist/parse-BzWpMN-a.mjs

@@ -0,0 +1,107 @@
+// ../core/src/list-filters/time.ts
+/**
+* @file The times every list's `--since` and `--until` take (specs/usage.md,
+*   RFC-017), and `ork prune --older-than`'s age: an age (`24h`, `30d`, `12w`)
+*   or a day (`2026-11-01`, in the machine's time zone).
+*/
+const UNITS = {
+	h: 36e5,
+	d: 864e5,
+	w: 6048e5
+};
+/** `30d`, `12w`, `24h` before `now`, as an ISO time; `null` when it is not one. */
+const agoTime = (text, now) => {
+	const match = /^(\d+)([hdw])$/u.exec(text);
+	if (match === null) return null;
+	const [, amount = "0", unit = "d"] = match;
+	if (Number(amount) === 0) return null;
+	const date = new Date(now - Number(amount) * (UNITS[unit] ?? 0));
+	return Number.isNaN(date.getTime()) ? null : date.toISOString();
+};
+/** A `YYYY-MM-DD` day's start in the machine's time zone, `after` days on. */
+const dayTime = (text, after) => {
+	const match = /^(\d{4})-(\d{2})-(\d{2})$/u.exec(text);
+	if (match === null) return null;
+	const [, year = "", month = "", day = ""] = match;
+	const start = new Date(Number(year), Number(month) - 1, Number(day));
+	if (start.getMonth() !== Number(month) - 1) return null;
+	if (start.getDate() !== Number(day)) return null;
+	start.setDate(start.getDate() + after);
+	return start.toISOString();
+};
+/** The start of the day `days` whole days ago, counting today as one. */
+const wholeDays = (days, now) => {
+	const today = new Date(now);
+	return new Date(today.getFullYear(), today.getMonth(), today.getDate() - (days - 1)).toISOString();
+};
+/**
+* `--since`: an age or the day it starts from. Days and weeks are whole days,
+* today among them, as the Usage panel counts them; hours are exact.
+*/
+const sinceTime = (text, now) => {
+	const ago = agoTime(text, now);
+	if (ago === null) return dayTime(text, 0);
+	if (text.endsWith("h")) return ago;
+	const amount = Number(text.slice(0, -1));
+	return wholeDays(text.endsWith("w") ? amount * 7 : amount, now);
+};
+/** `--until`: the last day it includes. */
+const untilTime = (text) => dayTime(text, 1);
+// ../core/src/list-filters/parse.ts
+/**
+* @file Reads a list's filter flags against its field table (RFC-017): each
+*   value checked, times turned into ISO times, and `--limit`.
+*/
+const FOR = /^(agent|me|(project|person):\S+)$/u;
+/** The field's value, checked; `null` when the field does not take it. */
+const valueOf = (field, text, now) => {
+	if (text === "all" && field.all === true) return "all";
+	return {
+		enum: () => field.values?.includes(text) === true ? text : null,
+		text: () => text === "" ? null : text,
+		for: () => FOR.test(text) ? text : null,
+		since: () => sinceTime(text, now),
+		until: () => untilTime(text)
+	}[field.type]();
+};
+/** What the field takes, for the error that refuses a value. */
+const takes = (field) => {
+	const all = field.all === true ? ["all"] : [];
+	const or = all.length === 0 ? "" : " or all";
+	return {
+		enum: `one of ${[...field.values ?? [], ...all].join(", ")}`,
+		text: `a value${or}`,
+		for: "agent, me, project:<name> or person:<name>",
+		since: `an age (30d), a day (2026-11-01)${or}`,
+		until: "a day (2026-11-01)"
+	}[field.type];
+};
+/**
+* The filter `given` (a command's parsed flags, by field name) asks for, each
+* value checked against `table`; `now` dates an age. The first value a field
+* does not take is refused, naming the flag and what it takes.
+*/
+const parseFilters = (table, given, now) => {
+	const filter = {};
+	for (const field of table.fields) {
+		const text = given[field.name];
+		if (typeof text !== "string") continue;
+		const value = valueOf(field, text, now);
+		if (value === null) return {
+			ok: false,
+			error: `--${field.name} takes ${takes(field)}, not \`${text}\`.`
+		};
+		filter[field.name] = value;
+	}
+	return {
+		ok: true,
+		filter
+	};
+};
+/** `--limit`: a positive whole number, else `null` (`0`, `-1`, `abc`, `2.5`). */
+const parseLimit = (text) => {
+	if (!/^[1-9]\d*$/u.test(text)) return null;
+	const limit = Number(text);
+	return Number.isSafeInteger(limit) ? limit : null;
+};
+export { parseLimit as n, agoTime as r, parseFilters as t };

package/dist/{pause-Cy11KrXK.mjs → pause-8gnVgICR.mjs}

@@ -1,7 +1,7 @@
-import { En as requestPause, L as openStore, Tn as requestContinue } from "./src-DN-RPsil.mjs";
-import { t as findRun } from "./find-mLYsR0uC.mjs";
+import { Dn as requestPause, En as requestContinue, L as openStore } from "./src-Frwpx3WF.mjs";
+import { t as findRun } from "./find-P-VV4B47.mjs";
 import { c as write, l as writeErr, s as style } from "./output-B1kwo0YU.mjs";
-import { i as continueRefusal } from "./in-a-run-a447hxq8.mjs";
+import { i as continueRefusal } from "./in-a-run-DKoMGTNE.mjs";
 import { defineCommand } from "citty";
 // src/commands/pause.ts
 /**

package/dist/{post-C9soCx7i.mjs → post-y1qL1Fnj.mjs}

@@ -1,5 +1,5 @@
-import { ir as redact } from "./src-DN-RPsil.mjs";
-import { b as githubDraftRefusal } from "./__build_info__-DcRdK0Du.mjs";
+import { ar as redact } from "./src-Frwpx3WF.mjs";
+import { b as githubDraftRefusal } from "./__build_info__-B8TNbFtN.mjs";
 // ../core/src/follow-ups/post.ts
 /** Posts `f`'s draft as a GitHub comment once `confirmed`, and marks it done. */
 const postFollowUpMessage = async (f, options) => {

package/dist/{print-BaWiWf4v.mjs → print-DLe4MHn-.mjs}

@@ -1,5 +1,5 @@
-import { a as refuseIdsWithJson } from "./flags-CdgIH1L6.mjs";
 import { c as write } from "./output-B1kwo0YU.mjs";
+import { a as refuseIdsWithJson } from "./flags-CqjJ44uW.mjs";
 // src/list/print.ts
 /**
 * Prints `rows`: `--ids` their ids (`table.id`) comma-separated; `--json` the

package/dist/{project-records-BRiyQzUo.mjs → project-records-CsILxwfI.mjs}

@@ -1,4 +1,4 @@
-import { Ar as hasInRepoFiles, Br as projectRootOf, Fr as projectsHome, L as openStore, Lr as shownPath, Mr as newProjectId, Nr as placeFiles, jr as inRepoPlace } from "./src-DN-RPsil.mjs";
+import { Ir as projectsHome, L as openStore, Mr as inRepoPlace, Nr as newProjectId, Pr as placeFiles, Rr as shownPath, Vr as projectRootOf, jr as hasInRepoFiles } from "./src-Frwpx3WF.mjs";
 import { C as termOf, c as write, l as writeErr, s as style, w as cut } from "./output-B1kwo0YU.mjs";
 import { n as chip } from "./chips-BqcT58qr.mjs";
 import path from "node:path";

package/dist/{relay-C0M1TWMB.mjs → relay-Bvm9JEoN.mjs}

@@ -1,4 +1,4 @@
-import { Cn as linkNodes, L as openStore, wn as unlinkNodes, xn as addressOf } from "./src-DN-RPsil.mjs";
+import { L as openStore, Sn as addressOf, Tn as unlinkNodes, wn as linkNodes } from "./src-Frwpx3WF.mjs";
 import { c as write, l as writeErr, s as style } from "./output-B1kwo0YU.mjs";
 import { defineCommand } from "citty";
 // src/commands/relay.ts

package/dist/{run-B-j3Qxqc.mjs → run-D4yuTmmJ.mjs}

@@ -1,13 +1,13 @@
-import { Ct as startRun, G as parseInputPairs, Gn as endOf, Hn as loadProject, Ir as runDirOf, K as resolveInputs, L as openStore, Nr as placeFiles, Pn as templateOf, Qr as beforeOf, Qt as git, Sn as endLinksOf, St as walkSummary, Ti as DRIVER_IDS, Tt as userMessageText, U as createReplay, Un as machineRulesOf, Vn as gitRulesOf, W as replayLoopAnswers, Wn as createSignals, Zt as inspectProject, _n as deliverFollowUp, _r as maskReplacer, _t as planNodeSession, ar as createFeedback, at as adoptedCalls, ct as DETACHED_ENV, dn as createFollowUps, dr as renderTemplate, dt as NOT_STARTED, et as createRelay, fn as checkFollowUpsDue, gn as takeFollowUps, in as sessionDriver, it as createCalls, kn as liveStatus, lt as detachRun, m as resolveBase, mi as retiredDriverHint, mr as socketPath, n as resumedOptions, pr as serveRun, t as createWorkspace, tr as runGh, ui as isClaudeNode, ur as parseTemplate, wi as AGENT_DRIVERS, xi as readyDriver, zr as inside } from "./src-DN-RPsil.mjs";
-import { c as callsShown, d as createDecisionQueue, l as createTerminalHuman, o as formatEvent, s as formatRunEvent, t as attachRun } from "./attach-B-FeE1dJ.mjs";
-import { h as nodeSession, n as ORK_VERSION, v as findFollowUp } from "./__build_info__-DcRdK0Du.mjs";
-import { n as newRunId } from "./find-mLYsR0uC.mjs";
+import { $r as beforeOf, $t as git, An as liveStatus, Br as inside, Cn as endLinksOf, Ct as startRun, Ei as DRIVER_IDS, Fn as templateOf, G as parseInputPairs, Gn as createSignals, Hn as gitRulesOf, K as resolveInputs, Kn as endOf, L as openStore, Lr as runDirOf, Pr as placeFiles, Qt as inspectProject, R as storePath, Si as readyDriver, St as walkSummary, Ti as AGENT_DRIVERS, Tt as userMessageText, U as createReplay, Un as loadProject, W as replayLoopAnswers, Wn as machineRulesOf, _n as takeFollowUps, _t as planNodeSession, an as sessionDriver, at as adoptedCalls, ct as DETACHED_ENV, di as isClaudeNode, dr as parseTemplate, dt as NOT_STARTED, et as createRelay, fn as createFollowUps, fr as renderTemplate, hi as retiredDriverHint, hr as socketPath, it as createCalls, lt as detachRun, m as resolveBase, mr as serveRun, n as resumedOptions, nr as runGh, or as createFeedback, pn as checkFollowUpsDue, t as createWorkspace, vn as deliverFollowUp, vr as maskReplacer } from "./src-Frwpx3WF.mjs";
+import { c as callsShown, d as createDecisionQueue, l as createTerminalHuman, o as formatEvent, s as formatRunEvent, t as attachRun } from "./attach-qvfyaQXC.mjs";
+import { h as nodeSession, n as ORK_VERSION, v as findFollowUp } from "./__build_info__-B8TNbFtN.mjs";
+import { n as newRunId } from "./find-P-VV4B47.mjs";
 import { c as write, i as detachHint, l as writeErr, s as style } from "./output-B1kwo0YU.mjs";
-import { _ as namedMcpEntries, a as builtinExecutors, d as maskedEnv, f as maskedNamesOfRun, g as clearOutputFiles, h as sessionEnv, i as onPath, l as clearStateFiles, m as runScrubber, n as missingProgramMessage, r as missingPrograms, t as envProblems, v as resultOf } from "./src-DHDQ0itC.mjs";
-import { i as refusedBuiltin, o as workflowArg } from "./workflows-Bvl2Fquu.mjs";
-import { a as formatReport, c as checksHere, d as runReadyDriver, f as unfitLines, i as walkLoaded, l as chooseReadyDriver, o as warningLines, s as budgetWarningLines, t as loadWorkflow, u as overrideRefusal } from "./validate-BVrT43GO.mjs";
+import { _ as clearOutputFiles, a as builtinExecutors, d as maskedEnv, f as maskedNamesOfRun, i as onPath, l as clearStateFiles, m as sessionEnv, n as missingProgramMessage, p as runScrubber, r as missingPrograms, t as envProblems, v as namedMcpEntries, y as resultOf } from "./src-CVeA4tAw.mjs";
+import { i as refusedBuiltin, o as workflowArg } from "./workflows-CBYtycIy.mjs";
+import { a as formatReport, c as checksHere, d as runReadyDriver, f as unfitLines, i as walkLoaded, l as chooseReadyDriver, o as warningLines, s as budgetWarningLines, t as loadWorkflow, u as overrideRefusal } from "./validate-Xn2ZbJQC.mjs";
 import { a as createView, o as styler } from "./verdict-CMvPCpWC.mjs";
-import { i as runLimits, r as limitsRefusal, t as chatNotice } from "./limits-C_Xz_t3C.mjs";
+import { i as runLimits, r as limitsRefusal, t as chatNotice } from "./limits-DrsKCqaN.mjs";
 import path from "node:path";
 import { appendFileSync, existsSync, linkSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
@@ -1162,7 +1162,8 @@ const runWorkflowFile = async (options) => {
 	const executorOptions = {
 		runtimeFor: (driver) => options.runtime(driver, placeFiles(place).runs),
 		inPlace: options.inPlace,
-		maskedNames
+		maskedNames,
+		store: storePath(options.home)
 	};
 	if (options.driver !== void 0) executorOptions.driver = options.driver;
 	if (ready.readyDriver !== void 0) executorOptions.readyDriver = ready.readyDriver;
@@ -1251,7 +1252,7 @@ const isDriver = (value) => AGENT_DRIVERS.some((d) => d.id === value);
 /** Why `--driver` refuses a value: a retired id names its replacement. */
 const badDriver = (value) => `--${retiredDriverHint(value) ?? `driver must be one of ${AGENT_DRIVERS.map((d) => d.id).join(", ")}, got \`${value}\``}`;
 /** Loads the drivers only when a run starts, so other commands stay fast. */
-const loadRuntime = async (driver, runs) => (await import("./src-CXBmaGwS.mjs")).createRuntime(driver, sessionEnv(process.env), runs);
+const loadRuntime = async (driver, runs) => (await import("./src-ygFMh2eP.mjs")).createRuntime(driver, sessionEnv(process.env), runs);
 /**
 * Ctrl-C asks the run to stop, and so does a terminal closing or a polite kill,
 * so that the run ends tidily and leaves no result unscrubbed.
@@ -1302,7 +1303,7 @@ const run = defineCommand({
 		},
 		"follow-ups": {
 			type: "string",
-			description: "Follow-up ids an agent does (repeatable or comma-separated): they become the run's brief, done when it publishes"
+			description: "Follow-up ids an agent does, or `due` for every due one (repeatable or comma-separated): they become the run's brief, done when it publishes"
 		},
 		driver: {
 			type: "string",
@@ -1373,8 +1374,9 @@ const run = defineCommand({
 			process.exitCode = 1;
 			return;
 		}
+		const { prepareFollowUps: prepare, followUpsFlagFine: flagFine } = await import("./brief-Bh1FnAHv.mjs");
 		const cwd = process.cwd();
-		if (refusedBuiltin([args.workflow], cwd)) return;
+		if (refusedBuiltin([args.workflow], cwd) || !flagFine(rawArgs)) return;
 		const target = workflowArg(args.workflow, cwd);
 		const store = openStore();
 		if (args.detach) {
@@ -1406,9 +1408,8 @@ const run = defineCommand({
 			}
 			return;
 		}
-		const { prepareFollowUps } = await import("./brief-BvMtIFio.mjs");
-		const taking = prepareFollowUps(store, rawArgs, args["run-id"], target);
-		if (taking === void 0) {
+		const taken = await prepare(store, rawArgs, args["run-id"], target);
+		if (taken === void 0) {
 			store.close();
 			return;
 		}
@@ -1416,7 +1417,7 @@ const run = defineCommand({
 		const common = {
 			file: target.file,
 			cwd,
-			inputs: taking.inputs,
+			...taken,
 			inPlace: args["in-place"],
 			...args["machine-claude"] ? { machineClaude: true } : {},
 			json: args.json,
@@ -1424,7 +1425,6 @@ const run = defineCommand({
 			runtime: loadRuntime,
 			store,
 			...human === void 0 ? {} : { human },
-			...taking.runId === void 0 ? {} : { runId: taking.runId },
 			out: write,
 			err: writeErr,
 			...args.driver === void 0 ? {} : { driver: args.driver }

package/dist/{run-D_u9V_Ve.mjs → run-y8jI7bAI.mjs}

@@ -1,4 +1,4 @@
-import { $t as gitOk, Qt as git } from "./src-DN-RPsil.mjs";
+import { $t as git, en as gitOk } from "./src-Frwpx3WF.mjs";
 import path from "node:path";
 import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";

package/dist/{send-qBxj0JbJ.mjs → send-BV9eIxQ7.mjs}

@@ -1,6 +1,6 @@
-import { $ as sendFromScript, L as openStore, Q as scriptRefusal, Z as TOO_LONG } from "./src-DN-RPsil.mjs";
+import { $ as sendFromScript, L as openStore, Q as scriptRefusal, Z as TOO_LONG } from "./src-Frwpx3WF.mjs";
 import { l as writeErr } from "./output-B1kwo0YU.mjs";
-import { u as inheritedScrubber } from "./src-DHDQ0itC.mjs";
+import { u as inheritedScrubber } from "./src-CVeA4tAw.mjs";
 import { defineCommand } from "citty";
 // src/commands/send.ts
 /**

package/dist/{src-DHDQ0itC.mjs → src-CVeA4tAw.mjs}

@@ -1,8 +1,8 @@
-import { $r as programsRunBy, At as endedWith, Dt as runScope, Et as heldTimeout, Gn as endOf, It as lowerChild, Kn as outcomeEnd, Mt as stoppedEnd, Nt as declaredProblem, Ot as calledWorkflows, Pt as slotClock, Qr as beforeOf, Rt as startAt, Y as sessionRefusals, Yn as endFor, _i as TOOL_PREFIX, _t as planNodeSession, cn as mcpNotText, di as isToolNode, dr as renderTemplate, gi as INTEGRATIONS, hi as timeoutMs, in as sessionDriver, jt as failedWith, ln as serversIn, lr as evaluate, mt as planReason, on as declaredOutputOf, qn as END_DETAIL_LIMIT, ri as markValue, sn as MCP_FILE, tn as envReadsOf, ui as isClaudeNode, ur as parseTemplate, vi as integrationFor, wi as AGENT_DRIVERS, yt as reportSchemaFor, zn as countedTokens } from "./src-DN-RPsil.mjs";
-import { t as runOnce } from "./run-D_u9V_Ve.mjs";
+import { $r as beforeOf, At as endedWith, Bn as countedTokens, Dt as runScope, Et as heldTimeout, It as lowerChild, Jn as END_DETAIL_LIMIT, Kn as endOf, Mt as stoppedEnd, Nt as declaredProblem, Ot as calledWorkflows, Pt as slotClock, R as storePath, Rt as startAt, Ti as AGENT_DRIVERS, Xn as endFor, Y as sessionRefusals, _i as INTEGRATIONS, _t as planNodeSession, an as sessionDriver, cn as MCP_FILE, di as isClaudeNode, dr as parseTemplate, ei as programsRunBy, fi as isToolNode, fr as renderTemplate, gi as timeoutMs, ii as markValue, jt as failedWith, ln as mcpNotText, mt as planReason, nn as envReadsOf, qn as outcomeEnd, sn as declaredOutputOf, un as serversIn, ur as evaluate, vi as TOOL_PREFIX, yi as integrationFor, yt as reportSchemaFor } from "./src-Frwpx3WF.mjs";
+import { t as runOnce } from "./run-y8jI7bAI.mjs";
 import { n as holdGuard, r as orphanGuard, t as KILL_AFTER_MS } from "./orphan-guard-BFKg8VSd.mjs";
 import path from "node:path";
-import { accessSync, constants, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { accessSync, constants, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { Readable } from "node:stream";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -1100,6 +1100,62 @@ const skippedCheck = (outputFile) => {
 		}
 	}, endFor("done"));
 };
+// ../nodes/src/run-marker.ts
+/**
+* @file The marker a run leaves on its sessions and programs (ADR-047), and the
+*   stores it guards: the commands that act as the user refuse in the stores of
+*   the runs that started a process, and everywhere under a marker that lists
+*   none, which an older `ork` sets.
+*/
+/** Set for a program in a run. */
+const RUN_ENV = "ORK_RUN";
+/** Set for a Claude session. It says no more than that: no run, no node. */
+const SESSION_ENV = "ORK_SESSION";
+/**
+* The stores whose runs started a session or program, as a JSON array of real
+* paths: the commands that act as the user refuse only in these.
+*/
+const GUARDED_STORES_ENV = "ORK_GUARDED_STORES";
+/**
+* The variable that says a program in a run or a session started this process,
+* or `null` when none does.
+*/
+const runMarkerIn = (env) => ["ORK_RUN", "ORK_SESSION"].find((name) => env[name] !== void 0) ?? null;
+/** The stores `env` lists, or `undefined` when it lists none or garbles it. */
+const listIn = (env) => {
+	const text = env[GUARDED_STORES_ENV];
+	if (text === void 0) return void 0;
+	try {
+		const value = JSON.parse(text);
+		return Array.isArray(value) && value.every((item) => typeof item === "string") ? value : void 0;
+	} catch {
+		return;
+	}
+};
+/** A store file's real path, so a symlinked `~/.ork` is the same store. */
+const realStore = (store) => {
+	try {
+		return realpathSync(store);
+	} catch {
+		return path.resolve(store);
+	}
+};
+/**
+* The stores a run that started this process is in: `null` when no run did, and
+* `"all"` when one did but listed none (an older `ork`), which fails closed.
+*/
+const guardedStoresIn = (env) => runMarkerIn(env) === null ? null : listIn(env) ?? "all";
+/** Whether a run in `store` (a store file) started this process. */
+const storeGuarded = (env, store) => {
+	const guarded = guardedStoresIn(env);
+	return guarded === "all" || guarded !== null && guarded.includes(realStore(store));
+};
+/**
+* What a run in `store` (default: the user's) tells its sessions and programs:
+* the stores it inherited, and its own. Nothing when it inherited "all", so
+* that holds.
+*/
+const guardOf = (env, store = storePath()) => guardedStoresIn(env) === "all" ? {} : { [GUARDED_STORES_ENV]: JSON.stringify([.../* @__PURE__ */ new Set([...listIn(env) ?? [], realStore(store)])]) };
 // ../nodes/src/tool-scrub.ts
 /**
 * @file Masking a secret in what a program prints. A plain search, so a value
@@ -1263,16 +1319,13 @@ const scrubberOf = (values) => {
 const OUTPUT_ENV = "ORK_OUTPUT";
 /** A file a `watch:` node's program keeps between looks (RFC-011). */
 const STATE_ENV = "ORK_STATE";
-/** Set for a program in a run. */
-const RUN_ENV = "ORK_RUN";
-/** Set for a Claude session. It says no more than that: no run, no node. */
-const SESSION_ENV = "ORK_SESSION";
 /** The variables a caller's run reads, for a run it calls to mask too. */
 const MASKED_ENV = "ORK_MASKED";
 /** Every variable Ork sets itself; a workflow's `env:` cannot set them. */
 const IDENTITY_KEYS = /* @__PURE__ */ new Set([
 	RUN_ENV,
 	SESSION_ENV,
+	GUARDED_STORES_ENV,
 	MASKED_ENV,
 	"ORK_NODE",
 	"ORK_ROUND",
@@ -1291,20 +1344,21 @@ const IDENTITY_KEYS = /* @__PURE__ */ new Set([
 */
 const withoutIdentity = (env) => Object.fromEntries(Object.entries(env).flatMap(([key, value]) => value === void 0 || IDENTITY_KEYS.has(key) ? [] : [[key, value]]));
 /**
-* What a Claude session runs with: no identity, only the marker that stops its
-* Bash from speaking as the user through `ork chat`.
+* What a Claude session of a run in `store` (default: the user's) runs with: no
+* identity, only the marker that stops its Bash from speaking as the user
+* through `ork chat`, and the stores it must not do that in.
 */
-const sessionEnv = (env) => ({
+const sessionEnv = (env, store) => ({
 	...withoutIdentity(env),
-	[SESSION_ENV]: "1"
+	[SESSION_ENV]: "1",
+	...guardOf(env, store)
 });
 /**
-* The variable that says a program in a run or a session started this process,
-* or `null` when none does.
+* Who a node's program is, and the stores its run guards (none listed without
+* `store`, which guards every one). It is attribution, not a boundary.
 */
-const runMarkerIn = (env) => ["ORK_RUN", SESSION_ENV].find((name) => env[name] !== void 0) ?? null;
-/** Who a node's program is. It is attribution, not a security boundary. */
-const identityOf = (context, orkBin) => ({
+const identityOf = (context, orkBin, environ = {}, store) => ({
+	...store === void 0 ? {} : guardOf(environ, store),
 	[RUN_ENV]: context.runId,
 	ORK_NODE: context.id,
 	ORK_ROUND: String(context.round),
@@ -1526,7 +1580,7 @@ const toolExecutor = (given, options = {}) => async (context) => {
 	const outputFile = node.output?.format === "json" ? prepareOutputFile(context.runDir, context.id, context.round) : void 0;
 	const env = {
 		...nodeEnv.values,
-		...identityOf(context, options.orkBin),
+		...identityOf(context, options.orkBin, environ, options.store),
 		...maskedEnv(namesToMask(context.workflow, environ, options.maskedNames)),
 		...outputFile === void 0 ? {} : { [OUTPUT_ENV]: outputFile },
 		...node.watch === void 0 ? {} : { [STATE_ENV]: prepareStateFile(context.runDir, context.id) }
@@ -2320,6 +2374,7 @@ const spawnTool = (program, args, { cwd, signal, env, priority }) => {
 const builtinExecutors = (options) => {
 	const tool = toolExecutor(options.tools ?? spawnTool, {
 		...options.orkBin === void 0 ? {} : { orkBin: options.orkBin },
+		...options.store === void 0 ? {} : { store: options.store },
 		...options.maskedNames === void 0 ? {} : { maskedNames: options.maskedNames }
 	});
 	const claude = claudeExecutor({
@@ -2460,4 +2515,4 @@ const missingPrograms = (workflow, installed = (program) => onPath(program)) =>
 	}
 	return [...missing.values()];
 };
-export { namedMcpEntries as _, builtinExecutors as a, toolExecutor as c, maskedEnv as d, maskedNamesOfRun as f, clearOutputFiles as g, sessionEnv as h, onPath as i, clearStateFiles as l, runScrubber as m, missingProgramMessage as n, spawnTool as o, runMarkerIn as p, missingPrograms as r, mcpCallExecutor as s, envProblems as t, inheritedScrubber as u, resultOf as v };
+export { clearOutputFiles as _, builtinExecutors as a, toolExecutor as c, maskedEnv as d, maskedNamesOfRun as f, storeGuarded as g, runMarkerIn as h, onPath as i, clearStateFiles as l, sessionEnv as m, missingProgramMessage as n, spawnTool as o, runScrubber as p, missingPrograms as r, mcpCallExecutor as s, envProblems as t, inheritedScrubber as u, namedMcpEntries as v, resultOf as y };