@krapht/ork 1.0.0-alpha.17 → 1.0.0-alpha.19

package/dist/{src-DLsFsmOD.mjs → src-Ciy7i3se.mjs}

@@ -1,7 +1,7 @@
 import path from "node:path";
 import { LineCounter, YAMLMap, YAMLSeq, isAlias, isCollection, isMap, isNode, isPair, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
 import { z } from "zod";
-import { appendFileSync, closeSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { appendFileSync, chmodSync, closeSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { constants as constants$1, homedir, setPriority, tmpdir } from "node:os";
 import { createConnection, createServer } from "node:net";
@@ -1268,6 +1268,13 @@ const nodeTypeMessage = (issue, value) => {
 	const types = NODE_TYPES.map((type) => markValue(type)).join(", ");
 	return value === void 0 ? `node needs a \`type\`: one of ${types}` : `unknown node type ${markValue(typeof value === "string" ? value : JSON.stringify(value) ?? "")}: expected one of ${types}`;
 };
+/**
+* The text for a file without `schemaVersion`, else `null`: Zod's own words
+* ("Invalid input: expected 1") don't say the key is missing.
+*/
+const versionMessage = (issue, path, value) => issue.code === "invalid_value" && path.length === 1 && path[0] === "schemaVersion" && value === void 0 ? `schemaVersion is missing: write schemaVersion: ${String(issue.values[0])}` : null;
+/** The text Ork has for an issue instead of Zod's, else `null`. */
+const knownMessage = (issue, path, value) => forEachMessage(issue, path, value) ?? listRuleMessage(issue, value) ?? nodeTypeMessage(issue, value) ?? versionMessage(issue, path, value);
 // ../schema/src/newer-version.ts
 /**
 * A file with a higher `schemaVersion` than this Ork reads was made by a newer
@@ -1319,7 +1326,7 @@ const describeIssue = (issue, raw, path) => {
 		};
 	}
 	const value = valueAt(raw, path);
-	const said = forEachMessage(issue, path, value) ?? listRuleMessage(issue, value) ?? nodeTypeMessage(issue, value);
+	const said = knownMessage(issue, path, value);
 	if (said !== null) return {
 		message: said,
 		path
@@ -3921,26 +3928,295 @@ const writePlugin = (stack, dir, description) => {
 	}
 	return dir;
 };
+// ../core/src/store/secret-patterns.ts
+const SECRET_PATTERNS = [
+	{
+		name: "aws-access-key-id",
+		pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/u
+	},
+	{
+		name: "github-token",
+		pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/u
+	},
+	{
+		name: "github-fine-grained-token",
+		pattern: /\bgithub_pat_[A-Za-z0-9_]{50,}\b/u
+	},
+	{
+		name: "anthropic-api-key",
+		pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}/u
+	},
+	{
+		name: "openai-api-key",
+		pattern: /\bsk-(?!ant-)(?:proj-)?[A-Za-z0-9_-]{40,}/u
+	},
+	{
+		name: "npm-token",
+		pattern: /\bnpm_[A-Za-z0-9]{36}\b/u
+	},
+	{
+		name: "slack-token",
+		pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/u
+	},
+	{
+		name: "google-api-key",
+		pattern: /\bAIza[0-9A-Za-z_-]{35}\b/u
+	},
+	{
+		name: "stripe-live-key",
+		pattern: /\b[rs]k_live_[0-9A-Za-z]{20,}\b/u
+	},
+	{
+		name: "private-key-block",
+		pattern: /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY(?: BLOCK)?-----/u
+	}
+];
 // ../core/src/store/mask.ts
 /**
 * @file Masks secrets before anything is stored: tokens and keys in common
 *   formats, anywhere in an event's strings. The store and feedback records use
 *   the same patterns; the terminal is not masked (it is the user's own).
 */
-const PATTERNS = [
+/** Looser than the shared list, for masking only; they run first. */
+const MASK_ONLY = [
 	/sk-ant-[\w-]{20,}/gu,
 	/\bgh[opsur]_[A-Za-z0-9]{20,}/gu,
 	/\bgithub_pat_\w{20,}/gu,
-	/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/gu,
 	/\bxox[abprs]-[\w-]{10,}/gu,
 	/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gu,
 	/(?<=\bbearer\s+)[\w.~+/-]{20,}=*/giu,
 	/(?<=aws_secret_access_key\s*[=:]\s*)\S+/giu
 ];
+/**
+* The value after a secret-sounding key, as `key=v`, `key: v` or JSON's `"key":
+* "v"`; 8 characters or more, so short words and fixtures stay. A `{{…}}`
+* template is not a value, so a workflow's `env:` stays readable.
+*/
+const GENERIC = /(?<=(?:password|passwd|secret|token|api[_-]key)["']?\s*[=:]\s*["']?)(?!\{\{)[^\s"'`&,;]{8,}/giu;
+const PATTERNS = [
+	...MASK_ONLY,
+	...SECRET_PATTERNS.map(({ pattern }) => new RegExp(pattern.source, `${pattern.flags}g`)),
+	GENERIC
+];
 const MASK = "[masked]";
 const maskSecrets = (text) => PATTERNS.reduce((out, pattern) => out.replaceAll(pattern, MASK), text);
 /** A `JSON.stringify` replacer that masks every string. */
 const maskReplacer = (_key, value) => typeof value === "string" ? maskSecrets(value) : value;
+// ../core/src/control/queue.ts
+const PERMISSION_OPTIONS = [{
+	id: "allow",
+	label: "Allow"
+}, {
+	id: "deny",
+	label: "Deny"
+}];
+const DENIED = "The user did not allow this tool.";
+/** The deny message a session gets, with the person's words when given. */
+const deniedMessage = (note) => note === void 0 ? DENIED : `${DENIED} They said: ${note}`;
+/** The input fields that say what a tool will do, the first one present. */
+const TOOL_INPUT_KEYS = [
+	"command",
+	"file_path",
+	"path",
+	"url",
+	"pattern"
+];
+/** A tool's input for the decision's context: as written, cut at `max`. */
+const inputContext = (input, max = 4e3) => {
+	const key = TOOL_INPUT_KEYS.find((k) => typeof input[k] === "string");
+	const text = key === void 0 ? JSON.stringify(input, void 0, 2) : String(input[key]);
+	return text.length > max ? `${text.slice(0, max - 1)}…` : text;
+};
+const createDecisionQueue = (options) => {
+	const { store, runId, emit } = options;
+	const earlier = store.decisions({ runId });
+	let count = Math.max(0, ...earlier.map(({ id }) => Number(id.slice(runId.length + 1)) || 0));
+	for (const { id, node, status } of earlier) {
+		if (status !== "open") continue;
+		store.withdrawDecision(id);
+		emit({
+			type: "decision.withdrawn",
+			node,
+			decision: id
+		});
+	}
+	/** Opens a decision and settles it with the first answer. */
+	const decide = (open, local, withdrawn) => {
+		count += 1;
+		const id = `${runId}-${String(count)}`;
+		const record = store.openDecision({
+			...open,
+			id,
+			runId
+		});
+		const event = {
+			type: "decision.opened",
+			node: record.node,
+			decision: id,
+			kind: record.kind,
+			question: record.question,
+			options: record.options
+		};
+		if (record.recommended !== void 0) event.recommended = record.recommended;
+		if (record.owner !== void 0) event.owner = record.owner;
+		emit(event);
+		const { promise, resolve, reject } = Promise.withResolvers();
+		const settled = new AbortController();
+		/** `note` is the stored one: masked, and absent when blank. */
+		const finish = (answer, by, note) => {
+			if (settled.signal.aborted) return;
+			settled.abort();
+			const answered = {
+				type: "decision.answered",
+				node: open.node,
+				decision: id,
+				answer,
+				by
+			};
+			if (note !== void 0) answered.note = note;
+			emit(answered);
+			resolve(note === void 0 ? {
+				answer,
+				by
+			} : {
+				answer,
+				by,
+				note
+			});
+		};
+		const withdraw = () => {
+			if (settled.signal.aborted) return;
+			settled.abort();
+			store.withdrawDecision(id);
+			emit({
+				type: "decision.withdrawn",
+				node: open.node,
+				decision: id
+			});
+			reject(/* @__PURE__ */ new Error("the question was withdrawn"));
+		};
+		if (withdrawn?.aborted === true) withdraw();
+		withdrawn?.addEventListener("abort", withdraw, { once: true });
+		const fromStore = async () => {
+			try {
+				const closed = await options.waitFor(id, settled.signal);
+				if (closed.status === "answered" && closed.answer !== void 0) finish(closed.answer, closed.answeredBy ?? "decide", closed.note);
+			} catch {}
+		};
+		const fromTerminal = async (ask) => {
+			try {
+				const { answer, note } = await ask(settled.signal);
+				if (store.answerDecision(id, answer, "terminal", note)) finish(answer, "terminal", store.decision(id)?.note);
+			} catch {}
+		};
+		fromStore();
+		if (local !== void 0) fromTerminal(local);
+		return promise;
+	};
+	return {
+		ask: (question) => {
+			const open = {
+				node: question.nodeId,
+				kind: "question",
+				question: question.question,
+				options: question.options
+			};
+			if (question.recommended !== void 0) open.recommended = question.recommended;
+			if (question.context !== void 0) open.context = question.context;
+			if (question.document !== void 0) open.document = question.document;
+			if (question.owner !== void 0) open.owner = question.owner;
+			const { local } = options;
+			return decide(open, local === void 0 ? void 0 : (signal) => {
+				let note;
+				return local.ask({
+					...question,
+					question: maskSecrets(question.question),
+					...question.context === void 0 ? {} : { context: maskSecrets(question.context) },
+					...question.document === void 0 ? {} : { document: maskSecrets(question.document) },
+					signal,
+					onNote: (given) => {
+						note = given;
+					}
+				}).then((answer) => note === void 0 ? { answer } : {
+					answer,
+					note
+				});
+			}, question.signal).then(({ answer, note }) => {
+				if (note !== void 0) question.onNote?.(note);
+				return answer;
+			});
+		},
+		settled: (question) => {
+			count += 1;
+			const id = `${runId}-${String(count)}`;
+			const { owner } = question;
+			const record = store.openDecision({
+				id,
+				runId,
+				node: question.nodeId,
+				kind: "question",
+				question: question.question,
+				options: question.options,
+				owner,
+				...question.recommended === void 0 ? {} : { recommended: question.recommended },
+				...question.context === void 0 ? {} : { context: question.context }
+			});
+			emit({
+				type: "decision.opened",
+				node: record.node,
+				decision: id,
+				kind: "question",
+				question: record.question,
+				options: record.options,
+				owner,
+				...record.recommended === void 0 ? {} : { recommended: record.recommended }
+			});
+			store.answerDecision(id, question.answer, "owner", question.note);
+			const note = store.decision(id)?.note;
+			emit({
+				type: "decision.answered",
+				node: record.node,
+				decision: id,
+				answer: question.answer,
+				by: "owner",
+				owner,
+				...note === void 0 ? {} : { note }
+			});
+		},
+		permit: async (request) => {
+			const { local } = options;
+			let localMessage = DENIED;
+			const { answer, note } = await decide({
+				node: request.nodeId,
+				kind: "permission",
+				question: `Allow ${request.toolName}?`,
+				options: PERMISSION_OPTIONS,
+				context: inputContext(request.input)
+			}, local === void 0 ? void 0 : (signal) => {
+				let said;
+				return local.permit({
+					...request,
+					signal,
+					onNote: (given) => {
+						said = given;
+					}
+				}).then((result) => {
+					if (!result.allow) localMessage = result.message;
+					const choice = result.allow ? "allow" : "deny";
+					return said === void 0 ? { answer: choice } : {
+						answer: choice,
+						note: said
+					};
+				});
+			}, request.signal);
+			if (note !== void 0) request.onNote?.(note);
+			return answer === "allow" ? { allow: true } : {
+				allow: false,
+				message: note === void 0 ? localMessage : deniedMessage(note)
+			};
+		}
+	};
+};
 // ../core/src/control/socket.ts
 /**
 * @file The per-run local socket (`~/.ork/sockets/<run>.sock`): the fast path
@@ -3990,7 +4266,10 @@ const messageOf$3 = (line) => {
 };
 /** Listens on the run's socket; resolves once it is listening. */
 const serveRun = async (options) => {
-	mkdirSync(path.dirname(options.path), { recursive: true });
+	mkdirSync(path.dirname(options.path), {
+		recursive: true,
+		mode: 448
+	});
 	rmSync(options.path, { force: true });
 	const followers = /* @__PURE__ */ new Set();
 	const server = createServer((socket) => {
@@ -4079,6 +4358,75 @@ const followSocket = (file, after, onEvent, signal) => {
 	});
 	return promise;
 };
+// ../core/src/control/control.ts
+const startControl = async (options) => {
+	const { store, runId } = options;
+	const waiting = /* @__PURE__ */ new Map();
+	let stopped = false;
+	const check = () => {
+		for (const [id, resolve] of waiting) {
+			const decision = store.decision(id);
+			if (decision !== void 0 && decision.status !== "open") {
+				waiting.delete(id);
+				resolve(decision);
+			}
+		}
+		for (const command of store.takeCommands(runId)) if (command.kind === "message") options.onMessage(command.node, command.body);
+		else if (command.kind === "relay") options.onRelay?.(command.node, command.from, command.body);
+		else if (command.kind === "script") options.onScript?.(command.node, command.from, command.body);
+		else if (command.kind === "notice") options.onNotice?.(command.node, command.body);
+		else if (command.kind === "stop" && command.node === void 0) {
+			if (stopped) continue;
+			stopped = true;
+			options.emit({
+				type: "run.command",
+				command: "stop"
+			});
+			options.onStop();
+		} else if (!stopped) {
+			if (options.onControl?.(command.kind, command.node) ?? false) options.emit({
+				type: "run.command",
+				command: command.kind,
+				...command.node === void 0 ? {} : { node: command.node }
+			});
+		}
+	};
+	const timer = setInterval(check, options.intervalMs ?? 1e3);
+	let socket;
+	try {
+		socket = await serveRun({
+			path: socketPath(runId, options.home),
+			onWake: check,
+			backlog: (after) => store.events(runId, after)
+		});
+	} catch {}
+	return {
+		human: createDecisionQueue({
+			store,
+			runId,
+			emit: options.emit,
+			waitFor: (id, signal) => {
+				const { promise, resolve, reject } = Promise.withResolvers();
+				waiting.set(id, resolve);
+				signal.addEventListener("abort", () => {
+					waiting.delete(id);
+					reject(/* @__PURE__ */ new Error("settled"));
+				}, { once: true });
+				check();
+				return promise;
+			},
+			...options.local === void 0 ? {} : { local: options.local }
+		}),
+		publish: (stored) => {
+			socket?.publish(stored);
+		},
+		check,
+		close: async () => {
+			clearInterval(timer);
+			await socket?.close();
+		}
+	};
+};
 // ../core/src/expr/parse.ts
 /**
 * @file A small, safe expression language for `when:` conditions and `{{ }}`
@@ -4632,6 +4980,60 @@ const renderTemplate = (parts, scope, { readable = false } = {}) => {
 	}
 	return text;
 };
+// ../core/src/feedback/actions.ts
+const ALLOWED = { ok: true };
+const no = (why, error) => ({
+	ok: false,
+	why,
+	error
+});
+/** A dismissed item allows nothing until it's restored. */
+const dismissed = (short) => no("dismissed; restore it first", `${short} is dismissed; restore it first.`);
+const already = (short, status) => no(`${status} already`, `${short} is ${status} already.`);
+/**
+* `fixRun` is a running `ork:feedback-apply` run for the item ({@link
+* openFixRun}): a second fix isn't started beside it.
+*/
+const feedbackActions = (item, fixRun) => {
+	const short = item.id.slice(0, 12);
+	const isOrk = item.target === "ork";
+	if (item.status === "dismissed") {
+		const check = dismissed(short);
+		return {
+			accept: check,
+			lesson: check,
+			apply: check,
+			publish: check
+		};
+	}
+	const settled = item.status === "resolved" || item.status === "published";
+	const accept = item.status === "accepted" || settled ? already(short, item.status) : ALLOWED;
+	let lesson = ALLOWED;
+	if (isOrk) lesson = no("about Ork itself", `${short} is about Ork itself, so it isn't a lesson for a workflow; share it with Ork's maintainers instead.`);
+	else if (item.workflows.length === 0) lesson = no("no workflow recorded, so no lessons file", `No workflow is recorded for ${short}, so it has no lessons file.`);
+	let apply = ALLOWED;
+	if (isOrk) apply = no("about Ork itself", `${short} is about Ork itself, so its fix isn't in this project; share it with Ork's maintainers instead.`);
+	else if (settled) apply = already(short, item.status);
+	else if (fixRun !== void 0) apply = no(`run ${fixRun} is proposing a fix`, `Run ${fixRun} is proposing a fix for ${short} already: answer its question in \`ork decide\` or the UI, or stop it first.`);
+	let publish = ALLOWED;
+	if (!isOrk) publish = no("only feedback about Ork is shared", `${short} is about this ${item.target}, not Ork itself: only feedback about Ork is shared, and the rest stays on your machine.`);
+	else if (item.status === "published") publish = already(short, item.status);
+	return {
+		accept,
+		lesson,
+		apply,
+		publish
+	};
+};
+/** The running `ork:feedback-apply` run proposing a fix for `item`, if any. */
+const openFixRun = (store, item) => {
+	const short = item.id.slice(0, 12);
+	return store.runs().filter((run) => run.workflow === "ork-feedback-apply" && run.status === "running").find((run) => {
+		const [first] = store.events(run.id);
+		const event = first?.event;
+		return event?.type === "run.started" && event.inputs?.["item"] === short;
+	})?.id;
+};
 // ../core/src/feedback/fingerprint.ts
 /**
 * @file Feedback fingerprints: records about the same thing (same target, kind,
@@ -4654,16 +5056,17 @@ const defaultTarget = (kind) => {
 };
 /** The draft's target, or its kind's default. */
 const targetOf = (draft) => draft.target ?? defaultTarget(draft.kind);
-const MAX_TITLE = 120;
+const MAX_TITLE$1 = 120;
 const MAX_BODY = 2e3;
 const MAX_EVIDENCE = 10;
-const createFeedback = ({ graph, onEvent }) => {
+const createFeedback = ({ graph, onEvent, scrub = (text) => text }) => {
 	const seen = /* @__PURE__ */ new Set();
+	const clean = (text) => scrub(maskSecrets(text));
 	return { port: (id, template) => {
 		let left = 3;
 		const nodeType = graph.nodes.get(template ?? id)?.node.type;
 		return { report: (draft) => {
-			const title = maskSecrets(draft.title.trim()).slice(0, MAX_TITLE);
+			const title = clean(draft.title.trim()).slice(0, MAX_TITLE$1);
 			if (title === "") return {
 				ok: false,
 				error: "the title is empty"
@@ -4693,8 +5096,8 @@ const createFeedback = ({ graph, onEvent }) => {
 					target,
 					severity: draft.severity ?? "medium",
 					title,
-					body: maskSecrets(draft.body?.trim() ?? "").slice(0, MAX_BODY),
-					evidence: (draft.evidence ?? []).slice(0, MAX_EVIDENCE).map((e) => maskSecrets(e)),
+					body: clean(draft.body?.trim() ?? "").slice(0, MAX_BODY),
+					evidence: (draft.evidence ?? []).slice(0, MAX_EVIDENCE).map((e) => clean(e)),
 					fingerprint: print,
 					origin: nodeType === void 0 ? {} : { nodeType }
 				}
@@ -4958,6 +5361,136 @@ const FEEDBACK_SEVERITIES = [
 	"medium",
 	"high"
 ];
+// ../core/src/feedback/human.ts
+const RATINGS = ["good", "bad"];
+const MAX_TITLE = 120;
+/**
+* The run event a note becomes; its title is the note's first line. `scrub` (an
+* env-value scrubber) runs after `maskSecrets`.
+*/
+const humanNoteEvent = (note, scrub = (text) => text) => {
+	const text = scrub(maskSecrets(note.text.trim()));
+	const [first = ""] = text.split("\n");
+	const title = first.slice(0, MAX_TITLE);
+	const kind = note.kind ?? "friction";
+	const target = targetOf({
+		kind,
+		title,
+		...note.target === void 0 ? {} : { target: note.target }
+	});
+	const feedback = {
+		source: "human",
+		kind,
+		target,
+		severity: note.severity ?? (note.rating === "bad" ? "high" : "medium"),
+		title,
+		body: text,
+		evidence: note.rating === void 0 ? [] : [`rating: ${note.rating}`],
+		fingerprint: fingerprint({
+			target,
+			kind,
+			title
+		}),
+		origin: { workflow: note.workflow }
+	};
+	return {
+		type: "feedback.recorded",
+		...note.node === void 0 ? {} : { node: note.node },
+		feedback
+	};
+};
+/** `value` when it's one of `allowed`, or why not. */
+const checked = (name, value, allowed) => {
+	if (value === void 0) return { ok: true };
+	const found = allowed.find((a) => a === value);
+	return found === void 0 ? {
+		ok: false,
+		error: `${name} is one of ${allowed.join(", ")}`
+	} : {
+		ok: true,
+		value: found
+	};
+};
+/**
+* Whether a note can be recorded, before anything else is done: its words,
+* kind, severity and rating. `flag` names the options as the caller does (`--`
+* for the CLI).
+*/
+const checkNote = (ask, flag = "") => {
+	if (ask.text.trim() === "") return {
+		ok: false,
+		error: "The note is empty."
+	};
+	const kind = checked(`${flag}kind`, ask.kind, FEEDBACK_KINDS);
+	const severity = checked(`${flag}severity`, ask.severity, FEEDBACK_SEVERITIES);
+	const rating = checked(`${flag}rating`, ask.rating, RATINGS);
+	if (!kind.ok) return kind;
+	if (!severity.ok) return severity;
+	if (!rating.ok) return rating;
+	return {
+		ok: true,
+		...kind.value === void 0 ? {} : { kind: kind.value },
+		...severity.value === void 0 ? {} : { severity: severity.value },
+		...rating.value === void 0 ? {} : { rating: rating.value }
+	};
+};
+/**
+* Records a person's note on `run`, or one node that ran in it, as that run's
+* feedback (a run that ended takes it too); returns the item it joins (the one
+* it was merged into, when triage merged it), or why it can't. `ork feedback
+* note`, `ork decide --note` and the UI write it.
+*/
+const recordNote = (store, run, ask, flag = "", scrub) => {
+	const note = checkNote(ask, flag);
+	if (!note.ok) return note;
+	const ran = store.events(run.id).some(({ event }) => "id" in event && event.id === ask.node);
+	if (ask.node !== void 0 && !ran) return {
+		ok: false,
+		error: `No node ${ask.node} ran in run ${run.id}.`
+	};
+	const event = humanNoteEvent({
+		text: ask.text,
+		workflow: run.workflow,
+		...ask.node === void 0 ? {} : { node: ask.node },
+		...note.kind === void 0 ? {} : { kind: note.kind },
+		...note.severity === void 0 ? {} : { severity: note.severity },
+		...note.rating === void 0 ? {} : { rating: note.rating }
+	}, scrub);
+	store.append(run.id, event);
+	const recorded = event.type === "feedback.recorded" ? event.feedback.fingerprint : "";
+	return {
+		ok: true,
+		item: store.findFeedback(recorded)[0]?.id ?? recorded
+	};
+};
+// ../core/src/feedback/preview.ts
+/**
+* @file The preview of an `ork` item as a post to Ork's Discussions (ADR-059),
+*   for `ork feedback publish` and the Feedback panel. The projects its records
+*   came from and every registered one are rewritten to `<project>`, and when
+*   names are hidden their folders' and the workflows' names go too. What the
+*   person confirms is what is sent.
+*/
+/** The item as a post, or why it isn't shared. */
+const previewPost = (store, item, ask) => {
+	const allowed = feedbackActions(item).publish;
+	if (!allowed.ok) return {
+		ok: false,
+		error: allowed.error
+	};
+	const records = store.feedbackRecords(item.id);
+	const runRoots = records.flatMap((r) => store.lookup(r.runId).find((run) => run.id === r.runId)?.project ?? []);
+	const roots = [.../* @__PURE__ */ new Set([...runRoots, ...ask.registered.map((p) => p.root)])];
+	const names = ask.hideNames ? [...item.workflows, ...roots.map((root) => path.basename(root))] : [];
+	return {
+		ok: true,
+		post: publishPost(item, records, {
+			roots,
+			home: ask.home,
+			names
+		})
+	};
+};
 // ../core/src/runtime/ends.ts
 /**
 * @file How a node ended, as one of a closed set of kinds (specs/runtime/
@@ -5313,6 +5846,137 @@ const createSignals = (options = {}) => {
 		return signal === null ? [event] : [event, ...record(...signal)];
 	};
 };
+// ../core/src/follow-ups/change.ts
+/** The project's follow-up whose id is, or starts with, `prefix`. */
+const findFollowUp = (rows, project, prefix) => {
+	const exact = rows.followUp(project, prefix);
+	if (exact !== void 0) return {
+		ok: true,
+		followUp: exact
+	};
+	const matches = prefix === "" ? [] : rows.followUps(project).filter((f) => f.id.startsWith(prefix));
+	const [only, other] = matches;
+	if (only === void 0) return {
+		ok: false,
+		error: `No follow-up \`${prefix}\` in this project.`
+	};
+	if (other !== void 0) return {
+		ok: false,
+		error: `\`${prefix}\` matches ${matches.map((f) => f.id).join(", ")}; give more of the id.`
+	};
+	return {
+		ok: true,
+		followUp: only
+	};
+};
+/** Which statuses each action starts from, and where it goes. */
+const ACTIONS = {
+	done: {
+		from: ["waiting", "due"],
+		to: () => "done",
+		note: "done"
+	},
+	drop: {
+		from: ["waiting", "due"],
+		to: () => "dropped",
+		note: "dropped"
+	},
+	reopen: {
+		from: ["done", "dropped"],
+		to: (f) => f.due === "now" ? "due" : "waiting",
+		note: "reopened"
+	},
+	due: {
+		from: ["waiting"],
+		to: () => "due",
+		note: "marked due"
+	}
+};
+/** Why `action` can't be done to `f` now, or `undefined`. */
+const refusal$1 = (f, action) => {
+	const rule = ACTIONS[action];
+	return rule.from.includes(f.status) ? void 0 : `${f.id} is ${f.status}, so it can't be ${rule.note}.`;
+};
+const check = (f, action) => {
+	const error = refusal$1(f, action);
+	return error === void 0 ? { ok: true } : {
+		ok: false,
+		kind: "status",
+		why: `it is ${f.status}`,
+		error
+	};
+};
+/** Whether `to` names one GitHub issue or pull request by its URL. */
+const isGithubIssueUrl = (to) => /^https:\/\/github\.com\/[^/\s]+\/[^/\s]+\/(?:issues|pull)\/\d+$/u.test(to);
+/**
+* Why `f`'s draft can't be posted to GitHub whatever its status, or
+* `undefined`.
+*/
+const githubDraftRefusal = (f) => {
+	if (f.kind !== "message" || f.draft?.channel !== "github") return {
+		why: "not drafted for the github channel",
+		error: "only a message drafted for the github channel is posted; send the others yourself"
+	};
+	return isGithubIssueUrl(f.draft.to) ? void 0 : {
+		why: "its `to` isn't a GitHub issue or pull request URL",
+		error: `${f.id}'s \`to\` (${f.draft.to}) isn't a GitHub issue or pull request URL, so it is not posted; copy the text and send it yourself.`
+	};
+};
+const postCheck = (f) => {
+	const open = f.status === "waiting" || f.status === "due";
+	const refused = githubDraftRefusal(f);
+	if (refused !== void 0) return {
+		ok: false,
+		kind: "draft",
+		...refused
+	};
+	return open ? { ok: true } : {
+		ok: false,
+		kind: "status",
+		why: `it is ${f.status}`,
+		error: `${f.id} is ${f.status}, so it is not posted.`
+	};
+};
+const followUpActions = (f) => ({
+	done: check(f, "done"),
+	drop: check(f, "drop"),
+	reopen: check(f, "reopen"),
+	due: check(f, "due"),
+	post: postCheck(f)
+});
+/** Applies `action` to `followUp`, and keeps it. */
+const changeFollowUp = (rows, followUp, action, now = () => (/* @__PURE__ */ new Date()).toISOString()) => {
+	const rule = ACTIONS[action];
+	const refused = refusal$1(followUp, action);
+	if (refused !== void 0) return {
+		ok: false,
+		error: refused
+	};
+	const { note: _old, ...rest } = followUp;
+	const changed = {
+		...rest,
+		status: rule.to(followUp),
+		note: rule.note,
+		updatedAt: now()
+	};
+	rows.putFollowUp(changed);
+	return {
+		ok: true,
+		followUp: changed
+	};
+};
+/**
+* Why a due follow-up is due, read from the note `due.ts` left: its ref merged,
+* its date came, its ref closed unmerged, or a person marked it. `undefined`
+* for one that is not due, or was due from the start.
+*/
+const dueCause = (f) => {
+	if (f.status !== "due" || f.note === void 0) return void 0;
+	if (f.note.includes("closed without merging")) return "closed-unmerged";
+	if (f.note.endsWith(" merged")) return "merged";
+	if (f.note.startsWith("due on ")) return "overdue";
+	return f.note === "marked due" ? "marked" : void 0;
+};
 // ../core/src/project/heavy.ts
 /**
 * @file A project's rules for the machine its runs share: the heavy commands
@@ -5351,6 +6015,16 @@ const matchesPattern = (pattern, command) => {
 };
 /** Whether `command` is one of the project's heavy commands. */
 const isHeavy = (heavy, command) => heavy.some((pattern) => matchesPattern(pattern, command));
+/**
+* The commands of a shell script, as far as a heavy check can tell without a
+* shell: comments dropped, split at newlines, `;`, `&&`, `||`, `|` and `&` (not
+* the `&` of a redirect such as `2>&1`), each trimmed, without a leading
+* `VAR=value` or `then`/`do`/`else`. shortcut: it splits inside quotes too and
+* cannot see `eval`, variables, heredocs or called scripts (specs/gaps).
+*/
+const scriptCommands = (script) => script.split("\n").map((line) => line.replace(/(?:^|\s)#.*$/u, "")).flatMap((line) => line.split(/&&|\|\||;|\||(?<![<>])&(?!>)/u)).map((part) => part.trim().replace(/^(?:(?:then|do|else)(?:\s+|$))?(?:\w+=\S*\s+)*/u, "")).filter((part) => part !== "");
+/** Whether any command of a shell script is one of the project's heavy ones. */
+const isHeavyScript = (heavy, script) => heavy.length > 0 && scriptCommands(script).some((command) => isHeavy(heavy, command));
 const machineRulesOf = (project) => ({
 	heavy: project?.heavy ?? [],
 	priority: project?.priority ?? "low"
@@ -6308,18 +6982,30 @@ const sameFiles = (a, b) => a.length === b.length && a.toSorted().join("\n") ===
 * title.
 */
 const sameFollowUp = (kept, input) => (kept.status === "waiting" || kept.status === "due") && kept.for === input.for && sameFiles(kept.where, input.where) && nearTitle(kept.title, input.title);
-/** `input` with what shouldn't be kept or leave the machine taken out. */
-const scrubFollowUp = (input, options) => {
-	const scrub = (text) => redact(text, options);
+/** Who a follow-up is for, its name scrubbed and its kind kept. */
+const scrubFor = (to, scrub) => {
+	if (to.startsWith("project:")) return `project:${scrub(to.slice(8))}`;
+	if (to.startsWith("person:")) return `person:${scrub(to.slice(7))}`;
+	return to;
+};
+/**
+* `input` with what shouldn't be kept or leave the machine taken out: each text
+* passed through `scrub` (the store's redactor, or a run's env-value
+* scrubber).
+*/
+const scrubFollowUp = (input, scrub) => {
 	return {
 		...input,
+		for: scrubFor(input.for, scrub),
 		title: scrub(input.title),
+		...input.ref === void 0 ? {} : { ref: scrub(input.ref) },
 		...input.body === void 0 ? {} : { body: scrub(input.body) },
 		...input.where === void 0 ? {} : { where: input.where.map(scrub) },
 		...input.draft === void 0 ? {} : { draft: {
 			...input.draft,
 			to: scrub(input.draft.to),
-			text: scrub(input.draft.text)
+			text: scrub(input.draft.text),
+			...input.draft.channel === void 0 ? {} : { channel: scrub(input.draft.channel) }
 		} },
 		...input.steps === void 0 ? {} : { steps: input.steps.map((step) => ({
 			text: scrub(step.text),
@@ -6354,10 +7040,10 @@ const followUpStore = (options) => {
 	return {
 		place: adapter.place,
 		add: async (raw) => {
-			const input = scrubFollowUp(raw, {
+			const input = scrubFollowUp(raw, (text) => redact(text, {
 				roots: [project, worktree],
 				home
-			});
+			}));
 			const where = input.where ?? [];
 			const at = now();
 			const kept = list().find((f) => sameFollowUp(f, {
@@ -6554,7 +7240,8 @@ const deliverFollowUp = async (input, options) => {
 *   too, with a note saying so, never dropped. A dated one is due on its date;
 *   `after-deploy` only when someone says so (`markDue`). A run that publishes
 *   records its ref on the follow-ups it left (`recordPublished`), and the
-*   `agent` follow-ups it took as its brief are done.
+*   `agent` follow-ups it took as its brief are done (taking them is
+*   `take.ts`).
 */
 const DATE = /^\d{4}-\d{2}-\d{2}$/u;
 const why = (result) => result.stderr.trim() || result.stdout.trim() || "no output";
@@ -6700,25 +7387,6 @@ const recordPublished = (rows, published, now = () => (/* @__PURE__ */ new Date(
 	};
 };
 /**
-* `ork run start --follow-ups <ids>`: the open `agent` follow-ups among `ids`
-* become `run`'s brief; why each other id wasn't taken.
-*/
-const takeFollowUps = (rows, taking, now = () => (/* @__PURE__ */ new Date()).toISOString()) => {
-	const taken = [];
-	const refused = [];
-	for (const id of taking.ids) {
-		const f = rows.followUp(taking.project, id);
-		if (f === void 0) refused.push(`${id}: there is no such follow-up`);
-		else if (f.for !== "agent") refused.push(`${id}: it is for ${f.for}`);
-		else if (f.status === "done" || f.status === "dropped") refused.push(`${id}: it is ${f.status}`);
-		else taken.push(changed(rows, f, { takenBy: taking.run }, now()));
-	}
-	return {
-		taken,
-		refused
-	};
-};
-/**
 * Checks the projects' follow-ups now and on a schedule, while `ork ui` or `ork
 * watch` runs; `onDue` hears of those that came due (a notification). Returns
 * the stop. A check still going when the next is due is not doubled.
@@ -6754,18 +7422,61 @@ const startFollowUpChecks = (options) => {
 		clearInterval(timer);
 	};
 };
-const createFollowUps = ({ runId, sink }) => ({ 
+// ../core/src/follow-ups/post.ts
+/** Posts `f`'s draft as a GitHub comment once `confirmed`, and marks it done. */
+const postFollowUpMessage = async (f, options) => {
+	const draft = f.draft;
+	const refused = githubDraftRefusal(f);
+	if (refused !== void 0 || draft === void 0) return {
+		ok: false,
+		error: refused?.error ?? "it has no draft"
+	};
+	if (!options.confirmed) return {
+		ok: false,
+		error: "posting to GitHub needs the maintainer's confirmation"
+	};
+	const body = redact(draft.text, {
+		roots: [f.project],
+		home: options.home
+	});
+	const on = /\/pull\/\d+/u.test(draft.to) ? "pr" : "issue";
+	const result = await options.gh([
+		on,
+		"comment",
+		draft.to,
+		"--body",
+		body
+	], { cwd: f.project });
+	if (!result.ok) return {
+		ok: false,
+		error: `gh failed: ${result.stderr.trim() || result.stdout.trim() || "no output"}`
+	};
+	const url = result.stdout.trim().split("\n").findLast((line) => line.startsWith("https://"));
+	const done = {
+		...f,
+		status: "done",
+		note: `posted${url === void 0 ? "" : ` as ${url}`}`,
+		updatedAt: options.now?.() ?? (/* @__PURE__ */ new Date()).toISOString()
+	};
+	options.rows.putFollowUp(done);
+	return {
+		ok: true,
+		followUp: done,
+		...url === void 0 ? {} : { url }
+	};
+};
+const createFollowUps = ({ runId, sink, scrub }) => ({ 
 /** One session's port. */
 port: (node, cwd) => {
 	let left = 30;
-	return { add: async (input) => {
+	return { add: async (raw) => {
 		if (left === 0) return {
 			ok: false,
 			error: `you already left ${String(30)} follow-ups in this session; put the rest in your report`
 		};
 		left -= 1;
 		const result = await sink({
-			...input,
+			...scrub === void 0 ? raw : scrubFollowUp(raw, (text) => scrub(maskSecrets(text))),
 			from: {
 				run: runId,
 				node
@@ -9364,8 +10075,9 @@ const machinePort = (options, runId, id, clock) => {
 	const { rules, ledger } = machine;
 	return {
 		priority: rules.priority,
-		slot: async (command, signal) => {
-			if (ledger === void 0 || !isHeavy(rules.heavy, command)) return none;
+		slot: async (command, signal, run) => {
+			const heavy = isHeavy(rules.heavy, command) || run?.script !== void 0 && isHeavyScript(rules.heavy, run.script);
+			if (ledger === void 0 || !heavy) return none;
 			let waited = false;
 			const release = await clock.waitFor(id, () => ledger.take({
 				run: runId,
@@ -9415,11 +10127,11 @@ const slotClock = (base, machine) => {
 		},
 		machine: machine === void 0 ? void 0 : {
 			...machine,
-			slot: async (command, signal) => {
+			slot: async (command, signal, run) => {
 				waiting += 1;
 				tell();
 				try {
-					return await machine.slot(command, signal);
+					return await machine.slot(command, signal, run);
 				} finally {
 					waiting -= 1;
 					tell();
@@ -10414,7 +11126,8 @@ const jobOf = (id, task, template) => {
 		brief: task.brief
 	};
 	if (template !== void 0) job.template = template;
-	const description = task.description?.replaceAll(/[\s\p{Cc}]+/gu, " ").trim().slice(0, 80);
+	const folded = task.description?.replaceAll(/[\s\p{Cc}]+/gu, " ").trim();
+	const description = folded === void 0 ? void 0 : Array.from(maskSecrets(folded)).slice(0, 80).join("");
 	if (description !== void 0 && description !== "") job.description = description;
 	return job;
 };
@@ -10436,8 +11149,17 @@ const createOwnership = (hooks) => {
 	const leaderNode = owner?.node;
 	const maxWorkers = leaderNode?.type === "agent.leader" ? leaderNode.maxWorkers ?? 0 : 0;
 	const spawned = [];
-	/** Runs the accepted jobs in parallel; the slot goes to them meanwhile. */
+	const reserved = /* @__PURE__ */ new Set();
+	/** Runs the accepted jobs, then frees the children it reserved. */
 	const runJobs = async (jobs) => {
+		try {
+			return await runAccepted(jobs);
+		} finally {
+			for (const job of jobs) if ("brief" in job) reserved.delete(job.id);
+		}
+	};
+	/** Runs the accepted jobs in parallel; the slot goes to them meanwhile. */
+	const runAccepted = async (jobs) => {
 		const accepted = jobs.filter((j) => "brief" in j);
 		const notes = [];
 		if (accepted.length > 0) {
@@ -10465,14 +11187,13 @@ const createOwnership = (hooks) => {
 		}
 	};
 	const delegate = (tasks) => {
-		const seen = /* @__PURE__ */ new Set();
 		const jobs = tasks.map((task) => {
 			if (!children.some((c) => c.id === task.child)) {
 				const names = children.map((c) => c.id).join(", ");
 				return rejected(task.child, `not one of your children (${names === "" ? "you have none" : names})`);
 			}
-			if (seen.has(task.child) || hooks.isRunning(task.child)) return rejected(task.child, templates.includes(task.child) && maxWorkers > 0 ? "already running; use spawn_worker for another instance" : "already running");
-			seen.add(task.child);
+			if (reserved.has(task.child) || hooks.isRunning(task.child)) return rejected(task.child, templates.includes(task.child) && maxWorkers > 0 ? "already running; use spawn_worker for another instance" : "already running");
+			reserved.add(task.child);
 			return jobOf(task.child, task);
 		});
 		return runJobs(jobs);
@@ -10989,14 +11710,34 @@ const summaryOf = (summaries, id) => {
 	summaries.set(id, created);
 	return created;
 };
-/** A run's summary; a resumed run's leaders keep their forks' spend (ADR-063). */
-const createSummaries = (earlier) => {
+/**
+* A run's summary; a resumed run's leaders keep their forks' spend (ADR-063).
+* `record` counts a result, `replayed` when a resume handed it back; `counted`
+* gives the nodes and, on a resumed run, how many were `kept`: handed back
+* whole, with no result of their own this time.
+*/
+const createSummaries = (replay) => {
 	const summaries = /* @__PURE__ */ new Map();
+	/** Nodes with a result of this run's own: they ran, not kept. */
+	const anew = /* @__PURE__ */ new Set();
 	const summary = (id) => summaryOf(summaries, id);
-	for (const [id, costUsd] of earlier?.forks ?? []) summary(id).costUsd += costUsd;
+	for (const [id, costUsd] of replay?.earlier?.forks ?? []) summary(id).costUsd += costUsd;
+	const record = (id, result, replayed) => {
+		if (!replayed) anew.add(id);
+		recordRun(summary(id), result);
+	};
+	const counted = () => {
+		const nodes = [...summaries.values()];
+		if (replay === void 0) return { nodes };
+		return {
+			nodes,
+			kept: nodes.filter((n) => n.runs > 0 && !anew.has(n.id)).length
+		};
+	};
 	return {
-		summaries,
-		summary
+		summary,
+		record,
+		counted
 	};
 };
 /** The tighter of the workflow's budget and what a caller left it, if any. */
@@ -11047,6 +11788,7 @@ const runResult = (run) => ({
 	worktrees: run.worktrees,
 	...run.outputs === void 0 ? {} : { outputs: run.outputs },
 	skipped: run.nodes.filter((node) => node.runs === 0).length,
+	...run.kept === void 0 ? {} : { kept: run.kept },
 	failuresHandled: run.failuresHandled,
 	...unreadOf(run.nodes, run.unread)
 });
@@ -12142,14 +12884,16 @@ const createOwners = (graph) => {
 *   the process (`feedback/agent.ts`) and follow-ups about the product
 *   (`follow-ups/session.ts`), the latter only when the run keeps them.
 */
-const createSessionReports = ({ graph, runId, sink, onEvent }) => {
+const createSessionReports = ({ graph, runId, sink, onEvent, scrub }) => {
 	const feedback = createFeedback({
 		graph,
-		onEvent
+		onEvent,
+		scrub
 	});
 	const followUps = sink === void 0 ? void 0 : createFollowUps({
 		runId,
-		sink
+		sink,
+		scrub
 	});
 	return { 
 	/** One session's ports; `template` is a spawned worker's node. */
@@ -12243,7 +12987,8 @@ const createRunPorts = ({ options, runId, slots, scope, stopping }) => {
 		graph,
 		runId,
 		sink: options.followUps,
-		onEvent
+		onEvent,
+		scrub
 	});
 	const send = bus.rule;
 	const rules = createRules({
@@ -12381,7 +13126,7 @@ const startRun = (options) => {
 	const sessionIds = /* @__PURE__ */ new Map();
 	const spend = spendOf(limits.budgetUsd, options, limits.budgetTokens);
 	const running = /* @__PURE__ */ new Set();
-	const { summaries, summary } = createSummaries(options.replay?.earlier);
+	const { summary, record, counted } = createSummaries(options.replay);
 	const queue = [];
 	const reasons = [];
 	const stops = createStops(abort.signal);
@@ -12472,7 +13217,7 @@ const startRun = (options) => {
 			runId,
 			stopped,
 			...spend.sums(),
-			nodes: [...summaries.values()],
+			...counted(),
 			reasons,
 			worktrees,
 			outputs: renderOutputs(graph.workflow.outputs, scope()),
@@ -12560,7 +13305,7 @@ const startRun = (options) => {
 		clock.leave(id);
 		outputs[id] = result.output;
 		if (result.sessionId !== void 0) sessionIds.set(id, result.sessionId);
-		recordRun(summary(id), result);
+		record(id, result, recorded !== null);
 		if (recorded === null) {
 			options.replay?.ran(result);
 			onEvent(finishedEvent(id, round, result));
@@ -13614,6 +14359,13 @@ const STANDARD = /* @__PURE__ */ new Set([
 	"artifacts",
 	"branch"
 ]);
+/**
+* A name git takes as a branch (`git check-ref-format --branch`'s rules), and
+* nothing a command would read as an option or a refspec: no leading `-`, no
+* `:` or `+`, no space or control character. A reported branch reaches tool
+* arguments, so one that isn't a plain branch name is dropped.
+*/
+const isBranchName = (name) => name !== "" && name !== "@" && !name.startsWith("-") && !name.startsWith("/") && !name.endsWith("/") && !name.endsWith(".") && !name.endsWith(".lock") && !name.includes("..") && !name.includes("//") && !name.includes("@{") && !name.includes("/.") && !name.startsWith(".") && !/[\u0000-\u0020\u007F~^:?*[\\+]/u.test(name);
 /** Reads a driver's structured output as a report, or `null` if it is not one. */
 const parseReport = (value) => {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
@@ -13630,7 +14382,7 @@ const parseReport = (value) => {
 		artifacts: paths,
 		fields: Object.fromEntries(Object.entries(record).filter(([key]) => !STANDARD.has(key)))
 	};
-	if (typeof branch === "string" && branch !== "") report.branch = branch;
+	if (typeof branch === "string" && isBranchName(branch)) report.branch = branch;
 	return report;
 };
 // ../core/src/run/brief.ts
@@ -16141,6 +16893,19 @@ const onNoBranch = async (entry) => entry === void 0 ? "0" : (await git(entry.pa
 	"--tags",
 	"--remotes"
 ])).stdout;
+/**
+* Whether a detached worktree's HEAD is already in the current branch's
+* history.
+*/
+const headIsMerged = async (root, path) => {
+	const head = await git(path, ["rev-parse", "HEAD"]);
+	return head.code === 0 && (await git(root, [
+		"merge-base",
+		"--is-ancestor",
+		head.stdout.trim(),
+		"HEAD"
+	])).code === 0;
+};
 /** One created worktree or branch, with its state read from git. */
 const stateOf = async (root, entries, item, recorded) => {
 	const { branch } = item;
@@ -16157,6 +16922,7 @@ const stateOf = async (root, entries, item, recorded) => {
 	])).stdout;
 	const ahead = Number(counted);
 	const changes = lines(status).length;
+	const merged = on === void 0 ? entry !== void 0 && !missing && await headIsMerged(root, entry.path) : ahead === 0;
 	return {
 		...branch === void 0 ? {} : { branch },
 		...checkedOut === void 0 ? {} : { checkedOut },
@@ -16168,7 +16934,7 @@ const stateOf = async (root, entries, item, recorded) => {
 		dirty: changes > 0,
 		changes,
 		ahead: Number.isNaN(ahead) ? 0 : ahead,
-		merged: on !== void 0 && ahead === 0,
+		merged,
 		inMainCheckout: entry?.path === root || holder?.path === root,
 		...holder === void 0 || holder.path === root ? {} : { heldBy: holder.path }
 	};
@@ -16325,6 +17091,31 @@ const applyPrune = (store, plan) => {
 	}
 	return outcome;
 };
+// ../core/src/store/recorder.ts
+/**
+* @file Records a run as it happens: each event appended to the store and
+*   copied to the run's `events.jsonl`, both with secrets masked, before
+*   anything else sees it; and adds to a finished run (`ork chat`).
+*/
+const EVENTS_FILE = "events.jsonl";
+/**
+* Appends to a run already in the store, e.g. `ork chat` resuming a finished
+* node's session; `runDir` gets the JSONL copy.
+*/
+const appendRecorder = (store, runId, runDir) => {
+	mkdirSync(runDir, { recursive: true });
+	const file = path.join(runDir, EVENTS_FILE);
+	return (event) => {
+		const stored = store.append(runId, event);
+		appendFileSync(file, `${JSON.stringify(stored, maskReplacer)}\n`);
+		return stored;
+	};
+};
+/** Begins `run` in the store; `runDir` gets the JSONL copy. */
+const createRecorder = (store, run, runDir) => {
+	store.begin(run);
+	return appendRecorder(store, run.id, runDir);
+};
 // ../core/src/store/decisions.ts
 const choicesOf = (json) => {
 	const parsed = JSON.parse(json);
@@ -17210,10 +18001,25 @@ const openReadOnly = (file) => {
 		throw error;
 	}
 };
+/**
+* Keeps Ork's folder for the person alone: `~/.ork` holds every run's prompts
+* and output, its sockets and its locks, so it is made 0700, and one an older
+* Ork made with the umask's mode is narrowed. A store elsewhere (a test's) only
+* gets its folder made.
+*/
+const keepPrivate = (dir) => {
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	if (path.basename(dir) !== ".ork") return;
+	if ((statSync(dir).mode & 63) !== 0) chmodSync(dir, 448);
+};
 /** A database opened for writing: created, in WAL mode, migrated. */
 const openWritable = (file) => {
-	if (file !== ":memory:") mkdirSync(path.dirname(file), { recursive: true });
+	if (file !== ":memory:") keepPrivate(path.dirname(file));
 	const db = new DatabaseSync(file);
+	if (file !== ":memory:") chmodSync(file, 384);
 	db.exec("PRAGMA busy_timeout = 5000");
 	db.exec("PRAGMA journal_mode = WAL");
 	db.exec("PRAGMA synchronous = NORMAL");
@@ -18360,11 +19166,17 @@ const syncFrom = async (worktree, from) => {
 */
 /** An item's name: its branch, or its run and node when created detached. */
 const labelOf = (item) => item.branch ?? `${item.runId}/${item.nodeId}`;
-/** Merged into the current branch, not, or detached on no branch at all. */
+/**
+* Merged into the current branch (a detached worktree too, when its HEAD is
+* already there), not, or detached on no branch with work the current branch
+* lacks.
+*/
 const mergeStateOf = (item) => {
-	if (item.branch === void 0 && item.checkedOut === void 0) return "detached";
-	return item.merged ? "merged" : "unmerged";
+	if (item.merged) return "merged";
+	return item.branch === void 0 && item.checkedOut === void 0 ? "detached" : "unmerged";
 };
+/** On no branch at all: created detached and not on a branch since. */
+const isDetached = (item) => item.branch === void 0 && item.checkedOut === void 0;
 /** `3 commits`, `1 commit`. */
 const counted = (count, noun) => `${String(count)} ${noun}${count === 1 ? "" : "s"}`;
 /**
@@ -18385,12 +19197,11 @@ const stateParts = (item, into) => {
 	else if (item.missing) part("missing (prunable)");
 	if (item.checkedOut !== void 0) part(`on the workflow's branch ${item.checkedOut}`);
 	if (item.dirty) part("uncommitted changes", true);
-	const state = mergeStateOf(item);
-	if (state === "unmerged") {
+	if (mergeStateOf(item) === "unmerged") {
 		const where = into === void 0 ? "" : ` into ${into}`;
 		part(`${counted(item.ahead, "commit")} not merged${where}`);
 	}
-	if (state === "detached") {
+	if (isDetached(item)) {
 		if (item.ahead > 0) part(`${counted(item.ahead, "commit")} on no branch`, true);
 		else if (item.path !== null && !item.missing) part("nothing committed");
 	}
@@ -18412,7 +19223,7 @@ const planWhat = (step) => {
 const planLine = (step) => {
 	const { item } = step;
 	return {
-		text: `${item.branch === void 0 && item.checkedOut === void 0 ? `${labelOf(item)} (detached)` : labelOf(item)}: ${planWhat(step)}`,
+		text: `${isDetached(item) ? `${labelOf(item)} (detached)` : labelOf(item)}: ${planWhat(step)}`,
 		...step.skip === void 0 ? {} : { reason: step.skip }
 	};
 };
@@ -19019,4 +19830,4 @@ const createWorkspace = (options) => {
 		close
 	};
 };
-export { sendFromScript as $, FEEDBACK_TARGETS as $n, beforeOf as $r, git as $t, declaredTriggers as A, knownExperiments as Ai, liveStatus as An, loadAgents as Ar, endedWith as At, planPrune as B, countedTokens as Bn, inside as Br, decisionListTable as Bt, compareVersions as C, AGENT_TOOL_LAYOUTS as Ci, endLinksOf as Cn, linkTools as Cr, startRun as Ct, triggersReport as D, firstLine as Di, requestPause as Dn, deleteAgent as Dr, runScope as Dt, lateTriggers as E, DRIVER_IDS as Ei, requestContinue as En, createAgent as Er, heldTimeout as Et, activeTree as F, templateOf$1 as Fn, placeFor as Fr, slotWaitLine as Ft, parseInputPairs as G, createSignals as Gn, plainPathInside as Gr, worktreeListTable as Gt, listOrkWorktrees as H, gitRulesOf as Hn, LESSON_CAP_TOKENS as Hr, followUpListTable as Ht, isNodeEvent as I, processAlive as In, projectsHome as Ir, lowerChild as It, driverRefusals as J, END_DETAIL_LIMIT as Jn, WorkflowEditSchema as Jr, keyOf as Jt, resolveInputs as K, endOf as Kn, writePlainFile as Kr, applyClean as Kt, openStore as L, stillTheSameProcess as Ln, runDirOf as Lr, programFound as Lt, workflowTextHash as M, pausedOf as Mn, inRepoPlace as Mr, stoppedEnd as Mt, takeWatchLock as N, runStatus as Nn, newProjectId as Nr, declaredProblem as Nt, createWatcher as O, EXPERIMENTS as Oi, requestStop as On, AGENT_SOURCES as Or, calledWorkflows as Ot, watchingPid as P, slotWaitsOf as Pn, placeFiles as Pr, slotClock as Pt, scriptRefusal as Q, FEEDBACK_SEVERITIES as Qn, renameNodeTypes as Qr, inspectProject as Qt, storePath as R, isItem as Rn, shownPath as Rr, startAt as Rt, detectInstaller as S, readyDriver as Si, addressOf as Sn, planMoveInto as Sr, walkSummary as St, parseVersion as T, AGENT_DRIVERS as Ti, unlinkNodes as Tn, toolsInUse as Tr, userMessageText as Tt, createReplay as U, loadProject as Un, estimateTokens as Ur, runListTable as Ut, createdWorktrees as V, PROJECT_FILE as Vn, projectRootOf as Vr, feedbackListTable as Vt, replayLoopAnswers as W, machineRulesOf as Wn, guardedBase as Wr, usageListTable as Wt, driverQueues as X, endFor as Xn, newWorkflowText as Xr, stepActs as Xt, sessionRefusals as Y, END_KINDS as Yn, applyEdits as Yr, planClean as Yt, TOO_LONG as Z, FEEDBACK_KINDS as Zn, readDocument as Zr, stepPrunes as Zt, capsHere as _, INTEGRATIONS as _i, takeFollowUps as _n, MASK as _r, planNodeSession as _t, planRemove as a, EdgeInputSchema as ai, sessionDriver as an, redact as ar, adoptedCalls as at, runningRunIds as b, PREFERRED_DRIVER as bi, liveSessionOf as bn, planAgentMigration as br, checkWorkflowText as bt, repoRoot as c, expandEdge as ci, MCP_FILE as cn, normalizeTitle as cr, DETACHED_ENV as ct, planLine as d, isClaudeNode as di, FOLLOW_UP_KINDS as dn, parseTemplate as dr, NOT_STARTED as dt, programsRunBy as ei, gitOk as en, DISCUSSIONS as er, createRelay as et, removeRefusal as f, isToolNode as fi, createFollowUps as fn, renderTemplate as fr, limitsNow as ft, usageReport as g, timeoutMs as gi, startFollowUpChecks as gn, socketRoom as gr, explainSession as gt, USAGE_DIMENSIONS as h, retiredDriverHint as hi, recordPublished as hn, socketPath as hr, explainWorkflowText as ht, lostWork as i, markValue as ii, namingNoDriver as in, publishPost as ir, createCalls as it, readProjectTriggers as j, lockWaitsOf as jn, hasInRepoFiles as jr, failedWith as jt, triggerStanding as k, experimentsOn as ki, tellLiveRun as kn, catalogAgent as kr, lockWaitLine as kt, labelOf as l, settingsOf as li, mcpNotText as ln, targetOf as lr, detachRun as lt, resolveBase as m, NodeIdSchema as mi, markDue as mn, serveRun as mr, planReason as mt, resumedOptions as n, parseWorkflow as ni, envReadsOf as nn, runGh as nr, answerDecision as nt, projectHead as o, WorkflowSchema as oi, nodeSays as on, createFeedback as or, detachResume as ot, stateParts as p, DriverSchema as pi, checkFollowUpsDue as pn, readCondition as pr, limitsReport as pt, budgetWarnings as q, outcomeEnd as qn, skillsIn as qr, cleanStep as qt, applyRemove as r, serializeWorkflow as ri, modelDriver as rn, sendPost as rr, pendingDecisions as rt, readWorktrees as s, CheckReportSchema as si, declaredOutputOf as sn, fingerprint as sr, resumable as st, createWorkspace as t, renderJsonSchema as ti, clearGitLocalEnv as tn, planPost as tr, followRunTree as tt, mergeStateOf as u, NodeSchema as ui, serversIn as un, evaluate as ur, followEvents as ut, planUpgrade as v, TOOL_PREFIX as vi, deliverFollowUp as vn, maskReplacer as vr, parseReport as vt, isNewer as w, ORK_LAYOUT as wi, linkNodes as wn, toolLinks as wr, MESSAGE_LIMIT as wt, runningScript as x, driverChecks as xi, DEFAULT_FOLLOW_UPS_RULE as xn, applySteps as xr, walkChecks as xt, releaseNotes as y, integrationFor as yi, followUpProblem as yn, maskSecrets as yr, reportSchemaFor as yt, applyPrune as z, nestItems as zn, workflowDirOf as zr, LIST_TABLES as zt };
+export { driverQueues as $, createSignals as $n, guardedBase as $r, stepActs as $t, triggerStanding as A, driverChecks as Ai, requestPause as An, applySteps as Ar, runScope as At, appendRecorder as B, stillTheSameProcess as Bn, hasInRepoFiles as Br, programFound as Bt, detectInstaller as C, NodeIdSchema as Ci, liveSessionOf as Cn, startControl as Cr, checkWorkflowText as Ct, lateTriggers as D, TOOL_PREFIX as Di, linkNodes as Dn, maskReplacer as Dr, MESSAGE_LIMIT as Dt, parseVersion as E, INTEGRATIONS as Ei, endLinksOf as En, MASK as Er, startRun as Et, watchingPid as F, DRIVER_IDS as Fi, pausedOf as Fn, createAgent as Fr, stoppedEnd as Ft, listOrkWorktrees as G, gitRulesOf as Gn, projectsHome as Gr, followUpListTable as Gt, applyPrune as H, nestItems as Hn, newProjectId as Hr, LIST_TABLES as Ht, activeTree as I, firstLine as Ii, runStatus as In, deleteAgent as Ir, declaredProblem as It, parseInputPairs as J, changeFollowUp as Jn, workflowDirOf as Jr, worktreeListTable as Jt, createReplay as K, loadProject as Kn, runDirOf as Kr, runListTable as Kt, isNodeEvent as L, EXPERIMENTS as Li, slotWaitsOf as Ln, AGENT_SOURCES as Lr, slotClock as Lt, readProjectTriggers as M, AGENT_TOOL_LAYOUTS as Mi, tellLiveRun as Mn, linkTools as Mr, lockWaitLine as Mt, workflowTextHash as N, ORK_LAYOUT as Ni, liveStatus as Nn, toolLinks as Nr, endedWith as Nt, triggersReport as O, integrationFor as Oi, unlinkNodes as On, maskSecrets as Or, userMessageText as Ot, takeWatchLock as P, AGENT_DRIVERS as Pi, lockWaitsOf as Pn, toolsInUse as Pr, failedWith as Pt, sessionRefusals as Q, isGithubIssueUrl as Qn, estimateTokens as Qr, planClean as Qt, openStore as R, experimentsOn as Ri, templateOf$1 as Rn, catalogAgent as Rr, slotWaitLine as Rt, runningScript as S, DriverSchema as Si, followUpProblem as Sn, readCondition as Sr, reportSchemaFor as St, isNewer as T, timeoutMs as Ti, addressOf as Tn, TOOL_INPUT_KEYS as Tr, walkSummary as Tt, planPrune as U, countedTokens as Un, placeFiles as Ur, decisionListTable as Ut, createRecorder as V, isItem as Vn, inRepoPlace as Vr, startAt as Vt, createdWorktrees as W, PROJECT_FILE as Wn, placeFor as Wr, feedbackListTable as Wt, budgetWarnings as X, findFollowUp as Xn, projectRootOf as Xr, cleanStep as Xt, resolveInputs as Y, dueCause as Yn, inside as Yr, applyClean as Yt, driverRefusals as Z, followUpActions as Zn, LESSON_CAP_TOKENS as Zr, keyOf as Zt, usageReport as _, expandEdge as _i, checkFollowUpsDue as _n, feedbackActions as _r, planReason as _t, planRemove as a, newWorkflowText as ai, envReadsOf as an, previewPost as ar, answerDecision as at, releaseNotes as b, isClaudeNode as bi, startFollowUpChecks as bn, parseTemplate as br, planNodeSession as bt, repoRoot as c, beforeOf as ci, sessionDriver as cn, FEEDBACK_KINDS as cr, adoptedCalls as ct, mergeStateOf as d, parseWorkflow as di, MCP_FILE as dn, DISCUSSIONS as dr, DETACHED_ENV as dt, plainPathInside as ei, stepPrunes as en, endOf as er, TOO_LONG as et, planLine as f, serializeWorkflow as fi, mcpNotText as fn, planPost as fr, detachRun as ft, USAGE_DIMENSIONS as g, CheckReportSchema as gi, postFollowUpMessage as gn, normalizeTitle as gr, limitsReport as gt, resolveBase as h, WorkflowSchema as hi, createFollowUps as hn, createFeedback as hr, limitsNow as ht, lostWork as i, applyEdits as ii, clearGitLocalEnv as in, endFor as ir, followRunTree as it, declaredTriggers as j, readyDriver as ji, requestStop as jn, planMoveInto as jr, calledWorkflows as jt, createWatcher as k, PREFERRED_DRIVER as ki, requestContinue as kn, planAgentMigration as kr, heldTimeout as kt, isDetached as l, programsRunBy as li, nodeSays as ln, FEEDBACK_SEVERITIES as lr, detachResume as lt, stateParts as m, EdgeInputSchema as mi, FOLLOW_UP_KINDS as mn, sendPost as mr, NOT_STARTED as mt, resumedOptions as n, skillsIn as ni, git as nn, END_DETAIL_LIMIT as nr, sendFromScript as nt, projectHead as o, readDocument as oi, modelDriver as on, checkNote as or, pendingDecisions as ot, removeRefusal as p, markValue as pi, serversIn as pn, runGh as pr, followEvents as pt, replayLoopAnswers as q, machineRulesOf as qn, shownPath as qr, usageListTable as qt, applyRemove as r, WorkflowEditSchema as ri, gitOk as rn, END_KINDS as rr, createRelay as rt, readWorktrees as s, renameNodeTypes as si, namingNoDriver as sn, recordNote as sr, createCalls as st, createWorkspace as t, writePlainFile as ti, inspectProject as tn, outcomeEnd as tr, scriptRefusal as tt, labelOf as u, renderJsonSchema as ui, declaredOutputOf as un, FEEDBACK_TARGETS as ur, resumable as ut, capsHere as v, settingsOf as vi, markDue as vn, openFixRun as vr, explainWorkflowText as vt, compareVersions as w, retiredDriverHint as wi, DEFAULT_FOLLOW_UPS_RULE as wn, socketRoom as wr, walkChecks as wt, runningRunIds as x, isToolNode as xi, deliverFollowUp as xn, renderTemplate as xr, parseReport as xt, planUpgrade as y, NodeSchema as yi, recordPublished as yn, evaluate as yr, explainSession as yt, storePath as z, knownExperiments as zi, processAlive as zn, loadAgents as zr, lowerChild as zt };