@krapht/ork 1.0.0-alpha.17 → 1.0.0-alpha.18

package/dist/{src-BHod38UQ.mjs → src-ygFMh2eP.mjs}

@@ -1,8 +1,8 @@
-import { $n as FEEDBACK_TARGETS, Bn as countedTokens, It as lowerChild, Lt as programFound, Qn as FEEDBACK_SEVERITIES, Rt as startAt, Ti as AGENT_DRIVERS, Xn as endFor, Yn as END_KINDS, Zn as FEEDBACK_KINDS, _r as MASK, dn as FOLLOW_UP_KINDS, qn as outcomeEnd, vt as parseReport, yr as maskSecrets } from "./src-DLsFsmOD.mjs";
+import { $n as FEEDBACK_TARGETS, Bn as countedTokens, It as lowerChild, Lt as programFound, Qn as FEEDBACK_SEVERITIES, Rt as startAt, Ti as AGENT_DRIVERS, Xn as endFor, Yn as END_KINDS, Zn as FEEDBACK_KINDS, _r as MASK, dn as FOLLOW_UP_KINDS, qn as outcomeEnd, vt as parseReport, yr as maskSecrets } from "./src-Frwpx3WF.mjs";
 import { n as holdGuard, r as orphanGuard } from "./orphan-guard-BFKg8VSd.mjs";
 import path from "node:path";
 import { z } from "zod";
-import { existsSync, linkSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { homedir, tmpdir } from "node:os";
 import { createInterface } from "node:readline";
@@ -1608,183 +1608,6 @@ const claudeUsage = {
 	dollars: true,
 	combine: addUsage
 };
-// ../runtime/src/adapters/claude-code.ts
-/**
-* Per-request timeout for Ork's MCP server, in ms. The CLI otherwise gives an
-* HTTP server's request 60 seconds and drops a call silent for 5 minutes, and
-* `delegate` waits for whole child sessions (the per-server `timeout` raises
-* both; `MCP_TOOL_TIMEOUT` still caps it).
-*/
-const ORK_TOOL_TIMEOUT_MS = 864e5;
-/** Claude Code's switch for the one-hour prompt cache. */
-const PROMPT_CACHE_1H = "ENABLE_PROMPT_CACHING_1H";
-/** Claude Code's switch that turns its auto-memory off. */
-const NO_AUTO_MEMORY = "CLAUDE_CODE_DISABLE_AUTO_MEMORY";
-/**
-* The CLI flag that moves the per-machine sections (working directory, memory
-* path, git status) out of the system prompt.
-*/
-const EXCLUDE_DYNAMIC_SECTIONS = "--exclude-dynamic-system-prompt-sections";
-/** How long a hook holds a call before it defers it instead. */
-const HOLD_WINDOW_MS = 54e4;
-/** The variables a session's prompt cache asks of Claude Code. */
-const cacheEnv = (spec) => spec.promptCache === "1h" ? { [PROMPT_CACHE_1H]: "1" } : {};
-/** Whether the session loads no MCP server but Ork's. */
-const strictMcpOf = (spec) => spec.tools.strictMcp === true || spec.machineClaude !== true;
-/** The variables that keep the machine's auto-memory out of a session. */
-const memoryEnv = (spec) => spec.machineClaude === true ? {} : { [NO_AUTO_MEMORY]: "1" };
-/** Claude Code's default timeout for a Bash call, in milliseconds. */
-const BASH_TIMEOUT = "BASH_DEFAULT_TIMEOUT_MS";
-/**
-* Ten minutes, Claude Code's own most for a Bash call. At its default of two, a
-* longer command (a typecheck of the workspace) moves to the background, and
-* the session then polls it with `sleep`, `until` or `Monitor`, which ask.
-*/
-const BASH_TIMEOUT_MS = 6e5;
-/** The variables that let a session's Bash calls run to the end in front. */
-const bashEnv = () => ({ [BASH_TIMEOUT]: String(BASH_TIMEOUT_MS) });
-/** Everything a session adds to its driver's environment. */
-const driverEnv = (spec) => ({
-	...bashEnv(),
-	...cacheEnv(spec),
-	...memoryEnv(spec)
-});
-/** A later message goes in at the next step, even mid-turn. */
-const userLine = (text, later = false) => `${JSON.stringify({
-	type: "user",
-	message: {
-		role: "user",
-		content: text
-	},
-	parent_tool_use_id: null,
-	...later ? { priority: "next" } : {}
-})}\n`;
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/**
-* The node's `--settings` with Ork's `PreToolUse` HTTP hook added: before every
-* tool call, pre-approved ones included, the session asks whether its node may
-* go on. Its `PostToolUse` hook after a Bash call frees the call's slot.
-*/
-const withHoldHook = (settings, holdUrl, token) => {
-	const hooks = isRecord(settings?.["hooks"]) ? settings["hooks"] : {};
-	const listed = (event) => {
-		const own = hooks[event];
-		return Array.isArray(own) ? [...own] : [];
-	};
-	const hook = {
-		type: "http",
-		url: holdUrl,
-		headers: { Authorization: `Bearer ${token}` },
-		timeout: 600
-	};
-	return {
-		...settings,
-		hooks: {
-			...hooks,
-			PreToolUse: [...listed("PreToolUse"), {
-				matcher: "*",
-				hooks: [hook]
-			}],
-			PostToolUse: [...listed("PostToolUse"), {
-				matcher: "Bash",
-				hooks: [hook]
-			}]
-		}
-	};
-};
-/** The hook's answer: nothing to say for "go", the deferral otherwise. */
-const hookOutput = (answer) => answer === "go" ? {} : { hookSpecificOutput: {
-	hookEventName: "PreToolUse",
-	permissionDecision: "defer",
-	permissionDecisionReason: "Ork paused this node; it goes on from this call when it continues."
-} };
-const claudeHold = {
-	answer: hookOutput,
-	windowMs: HOLD_WINDOW_MS
-};
-/**
-* The `claude -p` arguments for a session spec. The brief goes on stdin;
-* `allowed` are the Ork tools that need no permission prompt.
-*/
-const buildCliArgs = (spec, mcp, allowed) => {
-	const mcpConfig = { mcpServers: {
-		...spec.mcpServers,
-		["ork"]: {
-			type: "http",
-			url: mcp.url,
-			headers: { Authorization: `Bearer ${mcp.token}` },
-			timeout: ORK_TOOL_TIMEOUT_MS
-		}
-	} };
-	const args = [
-		"-p",
-		"--input-format",
-		"stream-json",
-		"--output-format",
-		"stream-json",
-		"--verbose",
-		"--setting-sources",
-		spec.settingSources.join(","),
-		"--append-system-prompt",
-		spec.systemAppend,
-		EXCLUDE_DYNAMIC_SECTIONS,
-		"--permission-mode",
-		spec.permissionMode,
-		"--json-schema",
-		JSON.stringify(spec.reportSchema),
-		"--mcp-config",
-		JSON.stringify(mcpConfig),
-		"--permission-prompt-tool",
-		toolId("permission"),
-		"--allowedTools",
-		[...spec.tools.allow, ...allowed].join(",")
-	];
-	if (spec.tools.only !== void 0) args.push("--tools", spec.tools.only.join(","));
-	if (strictMcpOf(spec)) args.push("--strict-mcp-config");
-	if (spec.agents !== void 0) args.push("--agents", JSON.stringify(spec.agents));
-	if (spec.tools.deny.length > 0) args.push("--disallowedTools", spec.tools.deny.join(","));
-	if (spec.model !== void 0) args.push("--model", spec.model);
-	if (spec.effort !== void 0) args.push("--effort", spec.effort);
-	if (spec.maxTurns !== void 0) args.push("--max-turns", String(spec.maxTurns));
-	if (spec.budgetUsd !== void 0) args.push("--max-budget-usd", String(spec.budgetUsd));
-	if (spec.resume !== void 0) args.push("--resume", spec.resume);
-	if (spec.resume !== void 0 && spec.fork === true) args.push("--fork-session");
-	for (const dir of spec.plugins ?? []) args.push("--plugin-dir", dir);
-	const settings = mcp.holdUrl === void 0 ? spec.settings : withHoldHook(spec.settings, mcp.holdUrl, mcp.token);
-	if (settings !== void 0) args.push("--settings", JSON.stringify(settings));
-	return args;
-};
-/** `claude`, as the session runner's strategies. */
-const claudeCodeAdapter = {
-	driver: "claude-code",
-	command: {
-		bin: "claude",
-		args: (spec, leg) => buildCliArgs(spec, leg.endpoint, leg.allowed),
-		input: userLine
-	},
-	decode: decodeClaudeLine,
-	legDecoder: claudeDecoder,
-	mcp: {
-		kind: "flag",
-		wire: () => Promise.resolve({
-			args: [],
-			env: {},
-			release: () => Promise.resolve()
-		})
-	},
-	permissions: {
-		kind: "callback",
-		denyByDefault: false
-	},
-	usage: claudeUsage,
-	context: {
-		instructions: ["CLAUDE.md", "AGENTS.md"],
-		skills: ".claude/skills",
-		agents: ".claude/agents",
-		env: driverEnv
-	},
-	hold: claudeHold
-};
 // ../runtime/src/lease-ledger.ts
 /**
 * @file The ledger of Command Code leases (RFC-014, `lease.ts`): one record per
@@ -1911,6 +1734,280 @@ const cleanStaleLeases = async (options) => {
 	}
 	return sweep;
 };
+// ../runtime/src/secret-file.ts
+/**
+* @file A session's private folder for files that hold a secret, such as a
+*   config carrying Ork's bearer token (RFC-014): a 0700 folder outside the
+*   checkout, under the system's temporary folder, named after the process that
+*   made it, with each file written at mode 0600. The session removes it when
+*   it ends; a folder whose process is gone (a crash) is removed when the next
+*   one is made. Nothing here logs what it writes.
+*/
+/** Where sessions' private folders live unless a caller names another place. */
+const secretRoot = () => path.join(tmpdir(), "ork-sessions");
+/** Removes the folders under `root` whose process is gone; returns them. */
+const sweepSecretFolders = (root) => {
+	let names;
+	try {
+		names = readdirSync(root);
+	} catch {
+		return [];
+	}
+	return names.flatMap((name) => {
+		const pid = Number(name.split("-")[0]);
+		if (!Number.isInteger(pid) || alive(pid)) return [];
+		const dir = path.join(root, name);
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+		return [dir];
+	});
+};
+/**
+* Refuses a root that isn't this user's own folder: in a shared temporary
+* folder another user could have made it first, or put a link there, to read or
+* swap what a session loads. One of ours that is open to others is closed.
+*/
+const holdPrivate = (root) => {
+	const held = lstatSync(root);
+	const uid = process.getuid?.();
+	if (!held.isDirectory() || uid !== void 0 && held.uid !== uid) throw new Error(`${root} is not a folder of this user's; remove it, or set TMPDIR to a private folder`);
+	if ((held.mode & 63) !== 0) chmodSync(root, 448);
+};
+/** A new private folder under `root`, after sweeping the stale ones. */
+const makeSecretFolder = (root = secretRoot()) => {
+	mkdirSync(root, {
+		recursive: true,
+		mode: 448
+	});
+	holdPrivate(root);
+	sweepSecretFolders(root);
+	const dir = mkdtempSync(path.join(root, `${String(process.pid)}-`));
+	return {
+		dir,
+		write: (name, content) => {
+			const file = path.join(dir, name);
+			writeFileSync(file, content, { mode: 384 });
+			return file;
+		},
+		remove: () => {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+};
+// ../runtime/src/adapters/claude-code-flags.ts
+/**
+* Per-request timeout for Ork's MCP server, in ms. The CLI otherwise gives an
+* HTTP server's request 60 seconds and drops a call silent for 5 minutes, and
+* `delegate` waits for whole child sessions (the per-server `timeout` raises
+* both; `MCP_TOOL_TIMEOUT` still caps it).
+*/
+const ORK_TOOL_TIMEOUT_MS = 864e5;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* The node's `--settings` with Ork's `PreToolUse` HTTP hook added: before every
+* tool call, pre-approved ones included, the session asks whether its node may
+* go on. Its `PostToolUse` hook after a Bash call frees the call's slot.
+*/
+const withHoldHook = (settings, holdUrl, token) => {
+	const hooks = isRecord(settings?.["hooks"]) ? settings["hooks"] : {};
+	const listed = (event) => {
+		const own = hooks[event];
+		return Array.isArray(own) ? [...own] : [];
+	};
+	const hook = {
+		type: "http",
+		url: holdUrl,
+		headers: { Authorization: `Bearer ${token}` },
+		timeout: 600
+	};
+	return {
+		...settings,
+		hooks: {
+			...hooks,
+			PreToolUse: [...listed("PreToolUse"), {
+				matcher: "*",
+				hooks: [hook]
+			}],
+			PostToolUse: [...listed("PostToolUse"), {
+				matcher: "Bash",
+				hooks: [hook]
+			}]
+		}
+	};
+};
+/** The session's `--mcp-config`: its servers, and Ork's with the token. */
+const mcpConfigOf = (spec, mcp) => ({ mcpServers: {
+	...spec.mcpServers,
+	["ork"]: {
+		type: "http",
+		url: mcp.url,
+		headers: { Authorization: `Bearer ${mcp.token}` },
+		timeout: ORK_TOOL_TIMEOUT_MS
+	}
+} });
+/** The session's `--settings`, with the hold hook (and its token) when held. */
+const settingsOf = (spec, mcp) => mcp.holdUrl === void 0 ? spec.settings : withHoldHook(spec.settings, mcp.holdUrl, mcp.token);
+/** The flags whose values carry Ork's token. */
+const SECRET_FLAGS = /* @__PURE__ */ new Set(["--mcp-config", "--settings"]);
+/**
+* `args` without the flags that carry Ork's token: a process's arguments can be
+* read by other users of the machine, so the session passes them as files.
+*/
+const withoutSecretFlags = (args) => args.filter((arg, at) => !SECRET_FLAGS.has(arg) && !SECRET_FLAGS.has(args[at - 1] ?? ""));
+/**
+* Writes the session's MCP config and settings into a private folder (0700,
+* each file 0600) and passes their paths; the folder goes when the session
+* ends.
+*/
+const secretFlags = {
+	kind: "flag",
+	wire: (spec, endpoint) => {
+		const folder = makeSecretFolder();
+		try {
+			const config = JSON.stringify(mcpConfigOf(spec, endpoint));
+			const args = ["--mcp-config", folder.write("mcp.json", config)];
+			const settings = settingsOf(spec, endpoint);
+			if (settings !== void 0) args.push("--settings", folder.write("settings.json", JSON.stringify(settings)));
+			return Promise.resolve({
+				args,
+				env: {},
+				release: () => {
+					folder.remove();
+					return Promise.resolve();
+				}
+			});
+		} catch (error) {
+			folder.remove();
+			throw error;
+		}
+	}
+};
+// ../runtime/src/adapters/claude-code.ts
+/** Claude Code's switch for the one-hour prompt cache. */
+const PROMPT_CACHE_1H = "ENABLE_PROMPT_CACHING_1H";
+/** Claude Code's switch that turns its auto-memory off. */
+const NO_AUTO_MEMORY = "CLAUDE_CODE_DISABLE_AUTO_MEMORY";
+/**
+* The CLI flag that moves the per-machine sections (working directory, memory
+* path, git status) out of the system prompt.
+*/
+const EXCLUDE_DYNAMIC_SECTIONS = "--exclude-dynamic-system-prompt-sections";
+/** How long a hook holds a call before it defers it instead. */
+const HOLD_WINDOW_MS = 54e4;
+/** The variables a session's prompt cache asks of Claude Code. */
+const cacheEnv = (spec) => spec.promptCache === "1h" ? { [PROMPT_CACHE_1H]: "1" } : {};
+/** Whether the session loads no MCP server but Ork's. */
+const strictMcpOf = (spec) => spec.tools.strictMcp === true || spec.machineClaude !== true;
+/** The variables that keep the machine's auto-memory out of a session. */
+const memoryEnv = (spec) => spec.machineClaude === true ? {} : { [NO_AUTO_MEMORY]: "1" };
+/** Claude Code's default timeout for a Bash call, in milliseconds. */
+const BASH_TIMEOUT = "BASH_DEFAULT_TIMEOUT_MS";
+/**
+* Ten minutes, Claude Code's own most for a Bash call. At its default of two, a
+* longer command (a typecheck of the workspace) moves to the background, and
+* the session then polls it with `sleep`, `until` or `Monitor`, which ask.
+*/
+const BASH_TIMEOUT_MS = 6e5;
+/** The variables that let a session's Bash calls run to the end in front. */
+const bashEnv = () => ({ [BASH_TIMEOUT]: String(BASH_TIMEOUT_MS) });
+/** Everything a session adds to its driver's environment. */
+const driverEnv = (spec) => ({
+	...bashEnv(),
+	...cacheEnv(spec),
+	...memoryEnv(spec)
+});
+/** A later message goes in at the next step, even mid-turn. */
+const userLine = (text, later = false) => `${JSON.stringify({
+	type: "user",
+	message: {
+		role: "user",
+		content: text
+	},
+	parent_tool_use_id: null,
+	...later ? { priority: "next" } : {}
+})}\n`;
+/** The hook's answer: nothing to say for "go", the deferral otherwise. */
+const hookOutput = (answer) => answer === "go" ? {} : { hookSpecificOutput: {
+	hookEventName: "PreToolUse",
+	permissionDecision: "defer",
+	permissionDecisionReason: "Ork paused this node; it goes on from this call when it continues."
+} };
+const claudeHold = {
+	answer: hookOutput,
+	windowMs: HOLD_WINDOW_MS
+};
+/**
+* The `claude -p` arguments for a session spec. The brief goes on stdin;
+* `allowed` are the Ork tools that need no permission prompt.
+*/
+const buildCliArgs = (spec, mcp, allowed) => {
+	const args = [
+		"-p",
+		"--input-format",
+		"stream-json",
+		"--output-format",
+		"stream-json",
+		"--verbose",
+		"--setting-sources",
+		spec.settingSources.join(","),
+		"--append-system-prompt",
+		spec.systemAppend,
+		EXCLUDE_DYNAMIC_SECTIONS,
+		"--permission-mode",
+		spec.permissionMode,
+		"--json-schema",
+		JSON.stringify(spec.reportSchema),
+		"--mcp-config",
+		JSON.stringify(mcpConfigOf(spec, mcp)),
+		"--permission-prompt-tool",
+		toolId("permission"),
+		"--allowedTools",
+		[...spec.tools.allow, ...allowed].join(",")
+	];
+	if (spec.tools.only !== void 0) args.push("--tools", spec.tools.only.join(","));
+	if (strictMcpOf(spec)) args.push("--strict-mcp-config");
+	if (spec.agents !== void 0) args.push("--agents", JSON.stringify(spec.agents));
+	if (spec.tools.deny.length > 0) args.push("--disallowedTools", spec.tools.deny.join(","));
+	if (spec.model !== void 0) args.push("--model", spec.model);
+	if (spec.effort !== void 0) args.push("--effort", spec.effort);
+	if (spec.maxTurns !== void 0) args.push("--max-turns", String(spec.maxTurns));
+	if (spec.budgetUsd !== void 0) args.push("--max-budget-usd", String(spec.budgetUsd));
+	if (spec.resume !== void 0) args.push("--resume", spec.resume);
+	if (spec.resume !== void 0 && spec.fork === true) args.push("--fork-session");
+	for (const dir of spec.plugins ?? []) args.push("--plugin-dir", dir);
+	const settings = settingsOf(spec, mcp);
+	if (settings !== void 0) args.push("--settings", JSON.stringify(settings));
+	return args;
+};
+/** `claude`, as the session runner's strategies. */
+const claudeCodeAdapter = {
+	driver: "claude-code",
+	command: {
+		bin: "claude",
+		args: (spec, leg) => withoutSecretFlags(buildCliArgs(spec, leg.endpoint, leg.allowed)),
+		input: userLine
+	},
+	decode: decodeClaudeLine,
+	legDecoder: claudeDecoder,
+	mcp: secretFlags,
+	permissions: {
+		kind: "callback",
+		denyByDefault: false
+	},
+	usage: claudeUsage,
+	context: {
+		instructions: ["CLAUDE.md", "AGENTS.md"],
+		skills: ".claude/skills",
+		agents: ".claude/agents",
+		env: driverEnv
+	},
+	hold: claudeHold
+};
 // ../runtime/src/lease.ts
 /**
 * @file The `lease` kind of `McpWiring` (RFC-014): Command Code reads MCP
@@ -2250,9 +2347,12 @@ const commandCodeUsage = {
 *   session outside the checkout: its `beforeToolCall` hook blocks every call
 *   the node did not allow. Ork's own tools (`mcp__ork__*`) always go through.
 *   Command Code's tool loader passes, and reads inside the worktree need no
-*   rule, as with Claude Code; one reaching outside it does. The rules are the
-*   node's, in Claude Code's words (`Bash(git:*)`, `Read`, `mcp__github`); a
-*   specifier Ork does not read never allows a call and always denies one.
+*   rule, as with Claude Code; one reaching outside it (by its real path, links
+*   followed) does. The rules are the node's, in Claude Code's words
+*   (`Bash(git:*)`, `Read`, `mcp__github`); a specifier Ork does not read never
+*   allows a call and always denies one. A shell line is checked command by
+*   command: each must be allowed, and one with a substitution Ork can't read
+*   is allowed only by a plain `Bash` rule.
 */
 /** The rules of a session: an `acceptEdits` node may edit without a rule. */
 const modRules = (spec) => ({
@@ -2266,19 +2366,38 @@ const modRules = (spec) => ({
 * export taking the mod API), so it carries its own matcher.
 */
 const modSource = (rules) => `// Ork's rules for one session; written by Ork, removed after it.
-import { relative, resolve } from "node:path";
+import { realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 const RULES = ${JSON.stringify(rules)};
 // Command Code's own: loading a deferred tool's schema, Ork's report included.
 const META = new Set(["search_tools", "tool_search"]);
 // Reads a session makes in its worktree without a rule, as Claude Code does.
 const READS = new Set(["read_file", "read_multiple_files", "read_directory", "glob", "grep"]);
+// A read's paths: every value of a path-like key, and any other string that
+// looks like a path out (absolute, from the home folder, or climbing with ..).
+const looksOut = text => isAbsolute(text) || text.startsWith("~") || text.split("/").includes("..");
 const pathsOf = input => Object.entries(input ?? {})
-  .filter(([key]) => /path|file|dir/i.test(key))
-  .flatMap(([, value]) => (Array.isArray(value) ? value : [value]))
-  .filter(value => typeof value === "string");
+  .flatMap(([key, value]) => (Array.isArray(value) ? value : [value]).map(each => [key, each]))
+  .filter(([key, value]) => typeof value === "string" && (/path|file|dir/i.test(key) || looksOut(value)))
+  .map(([, value]) => value);
+// Where a path really is: the nearest folder of it that exists, with its links
+// followed, and the rest of the path on top.
+const real = at => {
+  const rest = [];
+  for (let here = at; ; here = dirname(here)) {
+    try {
+      return resolve(realpathSync(here), ...rest.reverse());
+    } catch {
+      if (dirname(here) === here) return at;
+      rest.push(basename(here));
+    }
+  }
+};
+const ROOT = real(RULES.cwd);
 const inside = input => pathsOf(input).every(each => {
-  const from = relative(RULES.cwd, resolve(RULES.cwd, each));
-  return from === "" || (!from.startsWith("..") && !from.startsWith("/"));
+  if (each.startsWith("~")) return false;
+  const from = relative(ROOT, real(resolve(RULES.cwd, each)));
+  return from === "" || (from !== ".." && !from.startsWith("../") && !isAbsolute(from));
 });
 const TOOLS = ${JSON.stringify(COMMAND_CODE_TOOLS)};
 // A rule's word, as Command Code reads it, covers these of Ork's tool names.
@@ -2290,6 +2409,80 @@ const split = rule => {
     ? { token: rule.trim() }
     : { token: rule.slice(0, at).trim(), spec: rule.slice(at + 1, -1) };
 };
+// The simple commands of a shell line, split at ; & | && || and line breaks
+// outside quotes. null when Ork can't read it: a command or process
+// substitution, an unclosed quote, or nothing at all.
+const TICK = String.fromCharCode(96);
+const BACKSLASH = String.fromCharCode(92);
+const shellParts = line => {
+  const parts = [];
+  let part = "";
+  let quote = null;
+  for (let i = 0; i < line.length; i += 1) {
+    const ch = line[i];
+    const next = line[i + 1];
+    if (quote === "'") {
+      part += ch;
+      if (ch === "'") quote = null;
+      continue;
+    }
+    if (ch === BACKSLASH) {
+      part += ch + (next ?? "");
+      i += 1;
+      continue;
+    }
+    if (ch === TICK || (ch === "$" && next === "(")) return null;
+    if (quote === '"') {
+      part += ch;
+      if (ch === '"') quote = null;
+      continue;
+    }
+    if ((ch === "<" || ch === ">") && next === "(") return null;
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      part += ch;
+      continue;
+    }
+    // Writing a file is an edit, so output goes only to /dev/null or to
+    // another stream (2>&1); any other target makes the line one Ork can't read.
+    if (ch === ">") {
+      let j = i + 1;
+      if (line[j] === ">" || line[j] === "|") j += 1;
+      if (line[j] === "&") {
+        if (!/[0-9-]/.test(line[j + 1] ?? "")) return null;
+        part += line.slice(i, j + 2);
+        i = j + 1;
+        continue;
+      }
+      while (line[j] === " " || line[j] === "\\t") j += 1;
+      let k = j;
+      while (k < line.length && !" \\t;&|<>\\n\\r".includes(line[k])) k += 1;
+      if (line.slice(j, k) !== "/dev/null") return null;
+      part += line.slice(i, k);
+      i = k - 1;
+      continue;
+    }
+    // 2>&1 and &> are redirections, not a command's end.
+    const redirect = ch === "&" && (next === ">" || line[i - 1] === ">" || line[i - 1] === "<");
+    if (!redirect && (ch === ";" || ch === "&" || ch === "|" || ch === "\\n" || ch === "\\r")) {
+      parts.push(part);
+      part = "";
+      continue;
+    }
+    part += ch;
+  }
+  if (quote !== null) return null;
+  parts.push(part);
+  const commands = parts.map(norm).filter(each => each !== "");
+  return commands.length === 0 ? null : commands;
+};
+// The calls a rule is checked against: a shell line's simple commands, each
+// alone; one Ork can't read has no command, so only a plain rule covers it.
+const callsOf = (name, input) => {
+  if ((TOOLS[name] ?? name) !== "Bash" || typeof input?.command !== "string") return [input];
+  const parts = shellParts(input.command);
+  return parts === null ? [{}] : parts.map(command => ({ ...input, command }));
+};
 const shellMatches = (command, pattern) => {
   let p = norm(pattern);
   const c = norm(command);
@@ -2316,14 +2509,21 @@ const matches = (rule, name, input) => {
   if (ork === "Bash" && typeof input?.command === "string") return shellMatches(input.command, spec);
   return null;
 };
+// A deny covers a shell line when it covers any of its commands; an allow,
+// only when every command is covered by one rule or another.
+const anyDenied = (name, calls) =>
+  calls.some(call => RULES.deny.some(rule => matches(rule, name, call) !== false));
+const allCovered = (rules, name, calls) =>
+  calls.every(call => rules.some(rule => matches(rule, name, call) === true));
 export const decide = (name, input) => {
-  if (RULES.deny.some(rule => matches(rule, name, input) !== false)) return "denied for this node";
+  const calls = callsOf(name, input);
+  if (anyDenied(name, calls)) return "denied for this node";
   if (name.startsWith("mcp__ork__") || META.has(name)) return undefined;
-  if (RULES.only !== undefined && !RULES.only.some(rule => matches(rule, name, input) === true)) {
+  if (RULES.only !== undefined && !allCovered(RULES.only, name, calls)) {
     return "not one of this node's tools";
   }
   if (READS.has(name) && inside(input)) return undefined;
-  if (RULES.allow.some(rule => matches(rule, name, input) === true)) return undefined;
+  if (allCovered(RULES.allow, name, calls)) return undefined;
   return "not allowed for this node";
 };
 export default cc => {
@@ -2436,59 +2636,6 @@ const commandCodeAdapter = {
 		env: () => ({})
 	}
 };
-// ../runtime/src/secret-file.ts
-/**
-* @file A session's private folder for files that hold a secret, such as a
-*   config carrying Ork's bearer token (RFC-014): a 0700 folder outside the
-*   checkout, under the system's temporary folder, named after the process that
-*   made it, with each file written at mode 0600. The session removes it when
-*   it ends; a folder whose process is gone (a crash) is removed when the next
-*   one is made. Nothing here logs what it writes.
-*/
-/** Where sessions' private folders live unless a caller names another place. */
-const secretRoot = () => path.join(tmpdir(), "ork-sessions");
-/** Removes the folders under `root` whose process is gone; returns them. */
-const sweepSecretFolders = (root) => {
-	let names;
-	try {
-		names = readdirSync(root);
-	} catch {
-		return [];
-	}
-	return names.flatMap((name) => {
-		const pid = Number(name.split("-")[0]);
-		if (!Number.isInteger(pid) || alive(pid)) return [];
-		const dir = path.join(root, name);
-		rmSync(dir, {
-			recursive: true,
-			force: true
-		});
-		return [dir];
-	});
-};
-/** A new private folder under `root`, after sweeping the stale ones. */
-const makeSecretFolder = (root = secretRoot()) => {
-	mkdirSync(root, {
-		recursive: true,
-		mode: 448
-	});
-	sweepSecretFolders(root);
-	const dir = mkdtempSync(path.join(root, `${String(process.pid)}-`));
-	return {
-		dir,
-		write: (name, content) => {
-			const file = path.join(dir, name);
-			writeFileSync(file, content, { mode: 384 });
-			return file;
-		},
-		remove: () => {
-			rmSync(dir, {
-				recursive: true,
-				force: true
-			});
-		}
-	};
-};
 /** Claude Code tool names, as OpenCode's permission actions. */
 const ACTIONS = {
 	Read: "read",