@krapht/ork 1.0.0-alpha.19 → 1.0.0-alpha.20

package/dist/{run-D6yU2rLf.mjs → run-Bvvg-fiF.mjs}

@@ -1,4 +1,4 @@
-import { nn as git, rn as gitOk } from "./src-Ciy7i3se.mjs";
+import { in as gitOk, rn as git } from "./src-8cOPOgrT.mjs";
 import path from "node:path";
 import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
@@ -10,14 +10,27 @@ import { tmpdir } from "node:os";
 *   written through a temporary index so the real one is untouched, with `HEAD`
 *   and the repository's common git folder, where passes are kept for every
 *   worktree. The key is the files, not the commit: a commit or a no-op rebase
-*   keeps it.
+*   keeps it. With pathspecs (`--on`), only the files they match count.
 */
 /**
+* Git rejected the pathspecs, or they match no file: a usage error, never a
+* silent hit.
+*/
+var OncePathspecError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OncePathspecError";
+	}
+};
+/** The part of the key a pass is matched on: the files, else the tree. */
+const filesOf = (key) => key.files ?? key.tree;
+/**
 * The key of the files in the worktree at `cwd`. Rejects outside a git
-* repository. Starts from a copy of the real index, so git hashes only the
-* files whose stat changed.
+* repository, and with `OncePathspecError` when git rejects `on` or it matches
+* no file. Starts from a copy of the real index, so git hashes only the files
+* whose stat changed.
 */
-const treeKeyOf = async (cwd) => {
+const treeKeyOf = async (cwd, { on = [] } = {}) => {
 	const [commonDir = "", index = ""] = (await gitOk(cwd, [
 		"rev-parse",
 		"--git-common-dir",
@@ -36,11 +49,28 @@ const treeKeyOf = async (cwd) => {
 			"-q",
 			"HEAD"
 		]);
-		return {
+		const key = {
 			tree,
 			head: head.code === 0 ? head.stdout.trim() : null,
 			commonDir
 		};
+		if (on.length === 0) return key;
+		const listed = await git(cwd, [
+			"ls-files",
+			"-s",
+			"-z",
+			"--full-name",
+			"--",
+			...on
+		], env);
+		if (listed.code !== 0) throw new OncePathspecError(`git rejected the pathspecs ${on.join(" ")}: ${listed.stderr.trim()}`);
+		if (listed.stdout === "") throw new OncePathspecError(`the pathspecs ${on.join(" ")} match no file: check them, or drop --on to key every file`);
+		const files = createHash("sha256").update(listed.stdout).digest("hex");
+		return {
+			...key,
+			files,
+			on: [...on]
+		};
 	} finally {
 		rmSync(scratch, {
 			recursive: true,
@@ -60,10 +90,16 @@ const treeKeyOf = async (cwd) => {
 const ONCE_MAX_AGE_MS = 6048e5;
 /** The folder of passes for a repository's common git folder. */
 const onceDirOf = (commonDir) => path.join(commonDir, "ork-once");
-const fileOf = (dir, name, tree, node) => path.join(dir, `${createHash("sha256").update(JSON.stringify([
+/** Without pathspecs the name key is unchanged, so earlier passes still hit. */
+const fileOf = (dir, name, key, node) => path.join(dir, `${createHash("sha256").update(JSON.stringify(key.on === void 0 || key.on.length === 0 ? [
 	name,
-	tree,
+	key.tree,
 	node
+] : [
+	name,
+	filesOf(key),
+	node,
+	key.on
 ])).digest("hex")}.json`);
 const read = (file) => {
 	try {
@@ -84,8 +120,8 @@ const read = (file) => {
 };
 /** The pass of `name` on these files, or `null`. */
 const findPass = ({ key, name, withHead = false, node = process.version }) => {
-	const pass = read(fileOf(onceDirOf(key.commonDir), name, key.tree, node));
-	if (pass === null || pass.tree !== key.tree || pass.node !== node) return null;
+	const pass = read(fileOf(onceDirOf(key.commonDir), name, key, node));
+	if (pass === null || pass.tree !== filesOf(key) || pass.node !== node) return null;
 	return withHead && pass.head !== key.head ? null : pass;
 };
 /** Records a pass under `name` and each covered name, then prunes. */
@@ -94,7 +130,7 @@ const recordPass = ({ key, name, covers = [], who, node = process.version, at =
 	mkdirSync(dir, { recursive: true });
 	const pass = {
 		name,
-		tree: key.tree,
+		tree: filesOf(key),
 		head: key.head,
 		node,
 		at: at.toISOString(),
@@ -106,7 +142,7 @@ const recordPass = ({ key, name, covers = [], who, node = process.version, at =
 			...pass,
 			name: each
 		})}\n`);
-		renameSync(temp, fileOf(dir, each, pass.tree, node));
+		renameSync(temp, fileOf(dir, each, key, node));
 	}
 	prunePasses(key.commonDir, { now: at });
 	return pass;
@@ -147,15 +183,21 @@ const prunePasses = (commonDir, { now = /* @__PURE__ */ new Date(), maxAgeMs = O
 *   exits 0 and the files didn't change while it ran. `force` and
 *   `ORK_ONCE=off` run it anyway; outside a git repository it always runs.
 */
-/** `null` outside a git repository: nothing to key the files by. */
-const keyOf = (cwd) => treeKeyOf(cwd).catch(() => null);
+/**
+* `null` outside a git repository: nothing to key the files by. Rejected
+* pathspecs reject, so a bad `--on` is an error, never a run without a key.
+*/
+const keyOf = (cwd, on) => treeKeyOf(cwd, { on }).catch((error) => {
+	if (error instanceof OncePathspecError) throw error;
+	return null;
+});
 /** Runs `run` unless the check already passed on these files. */
-const runOnce = async ({ cwd, name, covers = [], withHead = false, force = false, who = "you", run, env = process.env, node = process.version }) => {
+const runOnce = async ({ cwd, name, covers = [], withHead = false, on = [], force = false, who = "you", run, env = process.env, node = process.version }) => {
 	if (env["ORK_ONCE"] === "off") return {
 		skipped: false,
 		code: await run()
 	};
-	const before = await keyOf(cwd);
+	const before = await keyOf(cwd, on);
 	const earlier = before === null || force ? null : findPass({
 		key: before,
 		name,
@@ -172,8 +214,8 @@ const runOnce = async ({ cwd, name, covers = [], withHead = false, force = false
 		skipped: false,
 		code
 	};
-	const after = await keyOf(cwd);
-	if (after?.tree !== before.tree || after.head !== before.head) return {
+	const after = await keyOf(cwd, on).catch(() => null);
+	if (after === null || filesOf(after) !== filesOf(before) || after.head !== before.head) return {
 		skipped: false,
 		code
 	};
@@ -189,4 +231,4 @@ const runOnce = async ({ cwd, name, covers = [], withHead = false, force = false
 		code
 	};
 };
-export { runOnce as t };
+export { OncePathspecError as n, runOnce as t };

package/dist/{run-C0C54UiU.mjs → run-DBUAq-Uu.mjs}

@@ -1,13 +1,13 @@
-import { $n as createSignals, B as appendRecorder, Cr as startControl, En as endLinksOf, Et as startRun, Fi as DRIVER_IDS, Gn as gitRulesOf, J as parseInputPairs, K as createReplay, Kn as loadProject, Kr as runDirOf, Nn as liveStatus, Ot as userMessageText, Pi as AGENT_DRIVERS, R as openStore, Rn as templateOf, Tt as walkSummary, Ur as placeFiles, V as createRecorder, Xn as findFollowUp, Y as resolveInputs, Yr as inside, _n as checkFollowUpsDue, bi as isClaudeNode, br as parseTemplate, bt as planNodeSession, ci as beforeOf, cn as sessionDriver, ct as adoptedCalls, dt as DETACHED_ENV, er as endOf, h as resolveBase, hn as createFollowUps, hr as createFeedback, ji as readyDriver, mt as NOT_STARTED, n as resumedOptions, nn as git, pr as runGh, q as replayLoopAnswers, qn as machineRulesOf, rt as createRelay, st as createCalls, t as createWorkspace, tn as inspectProject, wi as retiredDriverHint, xn as deliverFollowUp, xr as renderTemplate, z as storePath } from "./src-Ciy7i3se.mjs";
-import { _ as clearOutputFiles, a as builtinExecutors, b as runScrubber, d as maskedEnv, f as maskedNamesOfRun, i as onPath, l as clearStateFiles, m as sessionEnv, n as missingProgramMessage, r as missingPrograms, t as envProblems, v as namedMcpEntries, y as resultOf } from "./src-DP02RP9O.mjs";
-import { n as newRunId } from "./find-B30-rd-u.mjs";
-import { h as nodeSession, n as ORK_VERSION } from "./__build_info__-dPf4cEGL.mjs";
+import { B as appendRecorder, Dn as endLinksOf, Dt as startRun, Et as walkSummary, Fi as AGENT_DRIVERS, Ii as DRIVER_IDS, J as parseInputPairs, Jn as machineRulesOf, K as createReplay, Kn as gitRulesOf, Mi as readyDriver, Pn as liveStatus, R as openStore, Sn as deliverFollowUp, Sr as renderTemplate, Ti as retiredDriverHint, V as createRecorder, Wr as placeFiles, Xr as inside, Y as resolveInputs, Zn as findFollowUp, ct as createCalls, er as createSignals, ft as DETACHED_ENV, gn as createFollowUps, gr as createFeedback, h as resolveBase, ht as NOT_STARTED, kt as userMessageText, li as beforeOf, ln as sessionDriver, lt as adoptedCalls, mr as runGh, n as resumedOptions, nn as inspectProject, q as replayLoopAnswers, qn as loadProject, qr as runDirOf, rn as git, rt as createRelay, t as createWorkspace, tr as endOf, vn as checkFollowUpsDue, wr as startControl, xi as isClaudeNode, xr as parseTemplate, xt as planNodeSession, z as storePath, zn as templateOf } from "./src-8cOPOgrT.mjs";
+import { _ as clearOutputFiles, a as builtinExecutors, b as runScrubber, d as maskedEnv, f as maskedNamesOfRun, i as onPath, l as clearStateFiles, m as sessionEnv, n as missingProgramMessage, r as missingPrograms, t as envProblems, v as namedMcpEntries, y as resultOf } from "./src-I_RyKu6_.mjs";
+import { n as newRunId } from "./find-BTikxc54.mjs";
+import { h as nodeSession, n as ORK_VERSION } from "./__build_info__-D6mXC4cD.mjs";
 import { c as write, l as writeErr, s as style } from "./output-B1kwo0YU.mjs";
-import { c as callsShown, l as createTerminalHuman, o as formatEvent, s as formatRunEvent, t as attachRun } from "./attach-DhZQ87Nz.mjs";
-import { a as refusedBuiltin, s as workflowArg, t as WORKFLOW_DIR } from "./workflows-8GV-SeRm.mjs";
-import { a as formatReport, c as checksHere, d as runReadyDriver, f as unfitLines, i as walkLoaded, l as chooseReadyDriver, o as warningLines, s as budgetWarningLines, t as loadWorkflow, u as overrideRefusal } from "./validate-UrmC5AG1.mjs";
+import { d as formatEvent, f as formatRunEvent, m as createTerminalHuman, p as callsShown, t as attachRun } from "./attach-CEGbRg1D.mjs";
+import { a as refusedBuiltin, s as workflowArg, t as WORKFLOW_DIR } from "./workflows-DHHi-APg.mjs";
+import { a as formatReport, c as checksHere, d as runReadyDriver, f as unfitLines, i as walkLoaded, l as chooseReadyDriver, o as warningLines, s as budgetWarningLines, t as loadWorkflow, u as overrideRefusal } from "./validate-BxayjjkV.mjs";
 import { a as createView, o as styler } from "./verdict-CMvPCpWC.mjs";
-import { i as runLimits, r as limitsRefusal, t as chatNotice } from "./limits-CXh052II.mjs";
+import { i as runLimits, r as limitsRefusal, t as chatNotice } from "./limits-VQqsBoQk.mjs";
 import path from "node:path";
 import { existsSync, linkSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
@@ -25,14 +25,19 @@ const put = (rows, f, run, at) => {
 	return next;
 };
 /**
-* Whether another, live run has taken `f`: it is not free to take again. A run
-* the store does not know counts as live while the mark is recent, so a run
-* that fails its preflight frees its follow-ups when the window ends.
+* Why `f` is held by the run that took it, as the end of `taken by run <id>,
+* <note>`; `undefined` when it is free. A run the store does not know counts as
+* live while the mark is recent, so a run that fails its preflight frees its
+* follow-ups when the window ends.
 */
-const heldByLive = (f, run, isLive, now) => {
-	if (f.takenBy === void 0 || f.takenBy === run) return false;
-	return isLive(f.takenBy) ?? now - Date.parse(f.updatedAt) < 12e4;
+const heldNote = (f, isLive, now) => {
+	if (f.takenBy === void 0) return void 0;
+	const live = isLive(f.takenBy);
+	if (live !== void 0) return live ? "still running" : void 0;
+	return now - Date.parse(f.updatedAt) < 12e4 ? "not started yet; free in under 2 minutes" : void 0;
 };
+/** Whether another run holds `f`: it is not free to take again. */
+const heldByLive = (f, run, isLive, now) => f.takenBy !== run && heldNote(f, isLive, now) !== void 0;
 /**
 * The project's due `agent` follow-ups no live run has taken (`ids`), and those
 * a live run holds (`held`), so a second `--follow-ups due` doesn't take them
@@ -54,13 +59,17 @@ const availableDue = (rows, project, isLive, run = "", now = () => (/* @__PURE__
 const takeFollowUps = (rows, taking, now = () => (/* @__PURE__ */ new Date()).toISOString()) => {
 	const taken = [];
 	const refused = [];
+	const at = Date.parse(now());
 	for (const id of taking.ids) {
 		const f = rows.followUp(taking.project, id);
 		if (f === void 0) refused.push(`${id}: there is no such follow-up`);
 		else if (f.for !== "agent") refused.push(`${id}: it is for ${f.for}`);
 		else if (f.status === "done" || f.status === "dropped") refused.push(`${id}: it is ${f.status}`);
-		else if (heldByLive(f, taking.run, taking.isLive, Date.parse(now()))) refused.push(`${id}: taken by run ${f.takenBy}, still running`);
-		else taken.push(put(rows, f, taking.run, now()));
+		else {
+			const note = f.takenBy === taking.run ? void 0 : heldNote(f, taking.isLive, at);
+			if (note === void 0) taken.push(put(rows, f, taking.run, now()));
+			else refused.push(`${id}: taken by run ${f.takenBy}, ${note}`);
+		}
 	}
 	return {
 		taken,
@@ -1246,7 +1255,7 @@ const isDriver = (value) => AGENT_DRIVERS.some((d) => d.id === value);
 /** Why `--driver` refuses a value: a retired id names its replacement. */
 const badDriver = (value) => `--${retiredDriverHint(value) ?? `driver must be one of ${AGENT_DRIVERS.map((d) => d.id).join(", ")}, got \`${value}\``}`;
 /** Loads the drivers only when a run starts, so other commands stay fast. */
-const loadRuntime = async (driver, runs) => (await import("./src-D2qpd-G7.mjs")).createRuntime(driver, sessionEnv(process.env), runs);
+const loadRuntime = async (driver, runs) => (await import("./src-D4JSymhK.mjs")).createRuntime(driver, sessionEnv(process.env), runs);
 /**
 * Ctrl-C asks the run to stop, and so does a terminal closing or a polite kill,
 * so that the run ends tidily and leaves no result unscrubbed.
@@ -1368,14 +1377,14 @@ const run = defineCommand({
 			process.exitCode = 1;
 			return;
 		}
-		const { prepareFollowUps: prepare, followUpsFlagFine: flagFine } = await import("./brief-BQbeoPMc.mjs");
+		const { prepareFollowUps: prepare, followUpsFlagFine: flagFine } = await import("./brief-DH66xmj8.mjs");
 		const cwd = process.cwd();
 		if (refusedBuiltin([args.workflow], cwd) || !flagFine(rawArgs)) return;
 		const target = workflowArg(args.workflow, cwd);
 		const store = openStore();
 		if (args.detach) {
 			try {
-				const { startDetached } = await import("./detached-BQlbmqR0.mjs");
+				const { startDetached } = await import("./detached-Dakw5RZj.mjs");
 				await startDetached(store, {
 					rawArgs,
 					cwd,
@@ -1440,4 +1449,4 @@ const run = defineCommand({
 		}
 	}
 });
-export { machineSlotLedger as _, onInterrupt as a, runWorkflowFile as c, followUpsRule as d, refreshDue as f, sweepLocks as g, machineLocksDir as h, loadRuntime as i, briefOf as l, resumeChat as m, flagValues as n, run as o, runIsLive as p, isDriver as r, terminalHuman as s, badDriver as t, checkTakeable as u, availableDue as v, takeFollowUps as y };
+export { machineSlotLedger as _, onInterrupt as a, takeFollowUps as b, runWorkflowFile as c, followUpsRule as d, refreshDue as f, sweepLocks as g, machineLocksDir as h, loadRuntime as i, briefOf as l, resumeChat as m, flagValues as n, run as o, runIsLive as p, isDriver as r, terminalHuman as s, badDriver as t, checkTakeable as u, availableDue as v, heldNote as y };

package/dist/{send-DqgF58hb.mjs → send-nrKtak5F.mjs}

@@ -1,5 +1,5 @@
-import { R as openStore, et as TOO_LONG, nt as sendFromScript, tt as scriptRefusal } from "./src-Ciy7i3se.mjs";
-import { u as inheritedScrubber } from "./src-DP02RP9O.mjs";
+import { R as openStore, et as TOO_LONG, nt as sendFromScript, tt as scriptRefusal } from "./src-8cOPOgrT.mjs";
+import { u as inheritedScrubber } from "./src-I_RyKu6_.mjs";
 import { l as writeErr } from "./output-B1kwo0YU.mjs";
 import { defineCommand } from "citty";
 // src/commands/send.ts

package/dist/{src-Ciy7i3se.mjs → src-8cOPOgrT.mjs}

@@ -5003,7 +5003,8 @@ const feedbackActions = (item, fixRun) => {
 			accept: check,
 			lesson: check,
 			apply: check,
-			publish: check
+			publish: check,
+			resolve: check
 		};
 	}
 	const settled = item.status === "resolved" || item.status === "published";
@@ -5018,11 +5019,13 @@ const feedbackActions = (item, fixRun) => {
 	let publish = ALLOWED;
 	if (!isOrk) publish = no("only feedback about Ork is shared", `${short} is about this ${item.target}, not Ork itself: only feedback about Ork is shared, and the rest stays on your machine.`);
 	else if (item.status === "published") publish = already(short, item.status);
+	const resolve = settled ? already(short, item.status) : ALLOWED;
 	return {
 		accept,
 		lesson,
 		apply,
-		publish
+		publish,
+		resolve
 	};
 };
 /** The running `ork:feedback-apply` run proposing a fix for `item`, if any. */
@@ -16278,7 +16281,7 @@ const answerDecision = async (store, id, choice, home, by = "decide", note) => {
 * Calls `onEvent` for each event of `root` and of the runs it called, once
 * each. A called run's stored events come right after the `call.started` that
 * started it; live events as they arrive. Ends when the root ends or `signal`
-* aborts.
+* aborts; with `follow: false`, once the stored events are read.
 */
 const followRunTree = async (store, root, onEvent, options = {}) => {
 	/** Every run followed, with its call path, in the order found. */
@@ -16286,6 +16289,7 @@ const followRunTree = async (store, root, onEvent, options = {}) => {
 	/** Each run's last event seen, for the catch-up once the root ends. */
 	const seqs = /* @__PURE__ */ new Map();
 	const followers = [];
+	const live = options.follow ?? true;
 	/** Ends the called runs' following once the root's has ended. */
 	const halt = new AbortController();
 	const signal = options.signal === void 0 ? halt.signal : AbortSignal.any([options.signal, halt.signal]);
@@ -16303,7 +16307,7 @@ const followRunTree = async (store, root, onEvent, options = {}) => {
 		paths.set(run, path);
 		followers.push(followEvents(store, run, handle(run, path), {
 			...options,
-			follow: true,
+			follow: live,
 			after: seqs.get(run) ?? 0,
 			signal
 		}));
@@ -16314,7 +16318,7 @@ const followRunTree = async (store, root, onEvent, options = {}) => {
 	};
 	const end = await followEvents(store, root, handle(root, []), {
 		...options,
-		follow: true
+		follow: live
 	});
 	halt.abort();
 	await settle();
@@ -16333,6 +16337,95 @@ const followRunTree = async (store, root, onEvent, options = {}) => {
 		})
 	};
 };
+// ../core/src/remote/follow-runs.ts
+/**
+* @file Following many runs at once (`ork logs -f --all`, `ork decide
+*   --follow`): each live top-level run through `followRunTree`, so a called
+*   run is reached through its caller and seen once, and a run that starts
+*   later found by polling the run list, since no socket announces a new run.
+*/
+/**
+* Calls `onEvent` for each event of the live runs in `scope` and of the runs
+* they call, once each: stored events first, then live ones. Roots are the live
+* runs with no `parent`, and a called run whose caller is not followed (out of
+* scope, or ended while it runs on). A root's end does not end the watch.
+*/
+const followRuns = async (store, scope, onEvent, options = {}) => {
+	/** Each followed tree's runs, by its root, while it is followed. */
+	const trees = /* @__PURE__ */ new Map();
+	const followers = /* @__PURE__ */ new Set();
+	/** Each run's last event passed on: a run followed again starts after it. */
+	const seqs = /* @__PURE__ */ new Map();
+	const workflows = /* @__PURE__ */ new Map();
+	const failure = {};
+	/** Ends every follower once one has failed. */
+	const halt = new AbortController();
+	const signal = options.signal === void 0 ? halt.signal : AbortSignal.any([options.signal, halt.signal]);
+	const { project } = scope;
+	const filter = project === void 0 || project === "all" ? {} : { project };
+	/** What each tree takes: `untilIdle` is the watch's, not a tree's. */
+	const { untilIdle, ...poll } = options;
+	const followed = (run) => [...trees.values()].some((runs) => runs.has(run));
+	const workflowOf = (run) => {
+		const known = workflows.get(run);
+		if (known !== void 0) return known;
+		const name = store.lookup(run).find((r) => r.id === run)?.workflow ?? "";
+		workflows.set(run, name);
+		return name;
+	};
+	const inScope = (run) => (scope.run === void 0 || run.id === scope.run) && (scope.workflow === void 0 || run.workflow === scope.workflow);
+	const adopt = (root) => {
+		const runs = /* @__PURE__ */ new Set([root]);
+		trees.set(root, runs);
+		const following = followRunTree(store, root, (event) => {
+			runs.add(event.run);
+			if (event.stored.seq <= (seqs.get(event.run) ?? 0)) return;
+			seqs.set(event.run, event.stored.seq);
+			onEvent({
+				...event,
+				workflow: workflowOf(event.run)
+			});
+		}, {
+			...poll,
+			signal
+		}).catch((error) => {
+			failure.error ??= error;
+			halt.abort();
+		}).finally(() => {
+			trees.delete(root);
+			followers.delete(following);
+		});
+		followers.add(following);
+	};
+	/** Starts a tree for each live run in scope that no tree reaches. */
+	const discover = () => {
+		const live = store.runs(filter).filter((run) => liveStatus(run) === "running" && inScope(run));
+		for (const run of live) workflows.set(run.id, run.workflow);
+		const unseen = live.filter((run) => !followed(run.id));
+		const pending = new Set(unseen.map((run) => run.id));
+		for (const run of unseen) {
+			const { parent } = run;
+			const orphan = parent === void 0 || !followed(parent) && !pending.has(parent);
+			if (scope.run !== void 0 || orphan) adopt(run.id);
+		}
+	};
+	const settle = async () => {
+		await Promise.all(followers);
+		if ("error" in failure) throw failure.error;
+	};
+	for (;;) {
+		if (signal.aborted) break;
+		discover();
+		if (untilIdle === true && trees.size === 0) return "idle";
+		try {
+			await setTimeout$1(options.intervalMs ?? 1e3, void 0, { signal });
+		} catch {
+			break;
+		}
+	}
+	await settle();
+	return "aborted";
+};
 // ../core/src/remote/relay.ts
 /**
 * @file A run's side of the relay (RFC-003): its nodes' links, read from the
@@ -17342,7 +17435,11 @@ const feedbackQueries = (db) => {
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
 	const insertItem = db.prepare(`INSERT INTO feedback_items (fingerprint, status, updated_at)
      VALUES (?, 'new', ?) ON CONFLICT (fingerprint) DO NOTHING`);
-	const shown = db.prepare(`${ITEMS} WHERE r.status != 'dismissed' GROUP BY r.fingerprint ORDER BY last_seen DESC`);
+	const shown = db.prepare(`${ITEMS} WHERE r.status NOT IN ('dismissed', 'resolved') GROUP BY r.fingerprint ORDER BY last_seen DESC`);
+	const reopen = db.prepare(`UPDATE feedback_items SET status = 'new', updated_at = ?
+     WHERE fingerprint = (
+       SELECT COALESCE(merged_into, fingerprint) FROM feedback_items WHERE fingerprint = ?
+     ) AND status = 'resolved' AND updated_at < ?`);
 	const every = db.prepare(`${ITEMS} GROUP BY r.fingerprint ORDER BY last_seen DESC`);
 	const byPrefix = db.prepare(`${ITEMS} WHERE r.fingerprint IN (
        SELECT COALESCE(merged_into, fingerprint) FROM feedback_items
@@ -17367,6 +17464,7 @@ const feedbackQueries = (db) => {
 		const { origin } = feedback;
 		insert.run(runId, seq, at, node ?? null, feedback.source, feedback.kind, feedback.target, feedback.severity, maskSecrets(feedback.title), maskSecrets(feedback.body), JSON.stringify(feedback.evidence.map((e) => maskSecrets(e))), feedback.code ?? null, feedback.fingerprint, origin.workflow ?? null, origin.workflowHash ?? null, origin.nodeType ?? null, origin.model ?? null, origin.driver ?? null, origin.version ?? null, 1);
 		insertItem.run(feedback.fingerprint, at);
+		reopen.run(at, feedback.fingerprint, at);
 	};
 	return {
 		insertFeedback: insertRecord,
@@ -18321,14 +18419,62 @@ const takeWatchLock = (store, pid = process.pid) => {
 		}
 	};
 };
+// ../core/src/triggers/check-reads.ts
+/**
+* @file What a trigger's check runs beyond its own words, for the hash a person
+*   accepts: the `.mcp.json` its server comes from, and the project's files its
+*   command, interpreter or server program names (`--config=./x.json` names
+*   `./x.json`). What those files read in turn, a program outside the project
+*   and a path built from an env variable are not in it. Only files inside the
+*   project are read, and what goes into the hash is the text of `.mcp.json`
+*   and a digest of each named file's bytes, never anything else.
+*/
+/** A file's text; `undefined` only when it isn't there. Anything else throws. */
+const readText = (file) => {
+	try {
+		return readFileSync(file, "utf8");
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return;
+		throw error;
+	}
+};
+const isFile = (file) => statSync(file, { throwIfNoEntry: false })?.isFile() === true;
+/**
+* What a word names, if it is a file in the project: the word and a digest of
+* the file's bytes, not its text, so a compiled program that differs only in
+* bytes that aren't UTF-8 still changes the hash. A file outside the project, a
+* missing one and a word that is no file add nothing.
+*/
+const fileRead = (root, from, word) => {
+	const file = path.resolve(from, word.replace(/^-{1,2}[^=\s]+=/u, ""));
+	return word !== "" && inside(root, file) && isFile(file) ? [`${word}\0${createHash("sha256").update(readFileSync(file)).digest("hex")}`] : [];
+};
+/** The in-repo files a stdio server's program and arguments name. */
+const serverReads = (root, server) => {
+	const read = serversIn(root);
+	const entry = read.ok ? read.value[server] : void 0;
+	if (typeof entry !== "object" || entry === null) return [];
+	const command = Reflect.get(entry, "command");
+	const args = Reflect.get(entry, "args");
+	return [command, ...Array.isArray(args) ? args : []].flatMap((word) => typeof word === "string" ? fileRead(root, root, word) : []);
+};
+/** The texts a check's hash covers beyond its own words. */
+const checkReads = (root, check) => {
+	if (check === void 0) return [];
+	if (check.type === "mcp.call") return [readText(path.join(root, ".mcp.json")) ?? "", ...serverReads(root, check.server)];
+	const from = path.resolve(root, check.cwd ?? ".");
+	return [check.command, check.interpreter].join(" ").split(/\s+/u).flatMap((word) => fileRead(root, from, word));
+};
 // ../core/src/triggers/trust.ts
 /**
 * @file What a person accepts (RFC-011): a trigger, the workflow it starts,
 *   what its check runs beyond its own words, and the folder it was accepted
 *   in. A branch can change any of them and so what runs here with nobody
 *   there, so a change to one turns the trigger off until someone accepts it
-*   again. It can't cover all a run reads: skills, agents, scripts and called
-*   workflows aren't in it.
+*   again. That includes the project's files a check's command or an MCP
+*   check's server program names. It can't cover all a run reads: skills,
+*   agents, what a script or server program itself reads, programs outside the
+*   project and called workflows aren't in it.
 */
 const sorted = (value) => {
 	if (Array.isArray(value)) return value.map((item) => sorted(item));
@@ -18354,29 +18500,6 @@ const triggerHash = (trigger, workflowText, root = "", reads = []) => {
 *   Read fresh each time, so a file changed by a pull turns its trigger off
 *   rather than running as it was.
 */
-/** A file's text; `undefined` only when it isn't there. Anything else throws. */
-const readText = (file) => {
-	try {
-		return readFileSync(file, "utf8");
-	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return;
-		throw error;
-	}
-};
-const isFile = (file) => statSync(file, { throwIfNoEntry: false })?.isFile() === true;
-/**
-* What a check runs beyond its own words, for what a person accepts: the
-* `.mcp.json` its server comes from, or the project's files its command names.
-*/
-const checkReads = (root, check) => {
-	if (check === void 0) return [];
-	if (check.type === "mcp.call") return [readText(path.join(root, ".mcp.json")) ?? ""];
-	const from = path.resolve(root, check.cwd ?? ".");
-	return [check.command, check.interpreter].join(" ").split(/\s+/u).flatMap((word) => {
-		const file = path.resolve(from, word);
-		return word !== "" && inside(root, file) && isFile(file) ? [`${word}\0${readFileSync(file, "utf8")}`] : [];
-	});
-};
 /** Where a project's workflow of this name is. */
 const workflowFileOf = (place, name) => path.join(placeFiles(place).workflows, `${name}.ork.yaml`);
 const readTriggers = (file, place, home, registered) => {
@@ -19830,4 +19953,4 @@ const createWorkspace = (options) => {
 		close
 	};
 };
-export { driverQueues as $, createSignals as $n, guardedBase as $r, stepActs as $t, triggerStanding as A, driverChecks as Ai, requestPause as An, applySteps as Ar, runScope as At, appendRecorder as B, stillTheSameProcess as Bn, hasInRepoFiles as Br, programFound as Bt, detectInstaller as C, NodeIdSchema as Ci, liveSessionOf as Cn, startControl as Cr, checkWorkflowText as Ct, lateTriggers as D, TOOL_PREFIX as Di, linkNodes as Dn, maskReplacer as Dr, MESSAGE_LIMIT as Dt, parseVersion as E, INTEGRATIONS as Ei, endLinksOf as En, MASK as Er, startRun as Et, watchingPid as F, DRIVER_IDS as Fi, pausedOf as Fn, createAgent as Fr, stoppedEnd as Ft, listOrkWorktrees as G, gitRulesOf as Gn, projectsHome as Gr, followUpListTable as Gt, applyPrune as H, nestItems as Hn, newProjectId as Hr, LIST_TABLES as Ht, activeTree as I, firstLine as Ii, runStatus as In, deleteAgent as Ir, declaredProblem as It, parseInputPairs as J, changeFollowUp as Jn, workflowDirOf as Jr, worktreeListTable as Jt, createReplay as K, loadProject as Kn, runDirOf as Kr, runListTable as Kt, isNodeEvent as L, EXPERIMENTS as Li, slotWaitsOf as Ln, AGENT_SOURCES as Lr, slotClock as Lt, readProjectTriggers as M, AGENT_TOOL_LAYOUTS as Mi, tellLiveRun as Mn, linkTools as Mr, lockWaitLine as Mt, workflowTextHash as N, ORK_LAYOUT as Ni, liveStatus as Nn, toolLinks as Nr, endedWith as Nt, triggersReport as O, integrationFor as Oi, unlinkNodes as On, maskSecrets as Or, userMessageText as Ot, takeWatchLock as P, AGENT_DRIVERS as Pi, lockWaitsOf as Pn, toolsInUse as Pr, failedWith as Pt, sessionRefusals as Q, isGithubIssueUrl as Qn, estimateTokens as Qr, planClean as Qt, openStore as R, experimentsOn as Ri, templateOf$1 as Rn, catalogAgent as Rr, slotWaitLine as Rt, runningScript as S, DriverSchema as Si, followUpProblem as Sn, readCondition as Sr, reportSchemaFor as St, isNewer as T, timeoutMs as Ti, addressOf as Tn, TOOL_INPUT_KEYS as Tr, walkSummary as Tt, planPrune as U, countedTokens as Un, placeFiles as Ur, decisionListTable as Ut, createRecorder as V, isItem as Vn, inRepoPlace as Vr, startAt as Vt, createdWorktrees as W, PROJECT_FILE as Wn, placeFor as Wr, feedbackListTable as Wt, budgetWarnings as X, findFollowUp as Xn, projectRootOf as Xr, cleanStep as Xt, resolveInputs as Y, dueCause as Yn, inside as Yr, applyClean as Yt, driverRefusals as Z, followUpActions as Zn, LESSON_CAP_TOKENS as Zr, keyOf as Zt, usageReport as _, expandEdge as _i, checkFollowUpsDue as _n, feedbackActions as _r, planReason as _t, planRemove as a, newWorkflowText as ai, envReadsOf as an, previewPost as ar, answerDecision as at, releaseNotes as b, isClaudeNode as bi, startFollowUpChecks as bn, parseTemplate as br, planNodeSession as bt, repoRoot as c, beforeOf as ci, sessionDriver as cn, FEEDBACK_KINDS as cr, adoptedCalls as ct, mergeStateOf as d, parseWorkflow as di, MCP_FILE as dn, DISCUSSIONS as dr, DETACHED_ENV as dt, plainPathInside as ei, stepPrunes as en, endOf as er, TOO_LONG as et, planLine as f, serializeWorkflow as fi, mcpNotText as fn, planPost as fr, detachRun as ft, USAGE_DIMENSIONS as g, CheckReportSchema as gi, postFollowUpMessage as gn, normalizeTitle as gr, limitsReport as gt, resolveBase as h, WorkflowSchema as hi, createFollowUps as hn, createFeedback as hr, limitsNow as ht, lostWork as i, applyEdits as ii, clearGitLocalEnv as in, endFor as ir, followRunTree as it, declaredTriggers as j, readyDriver as ji, requestStop as jn, planMoveInto as jr, calledWorkflows as jt, createWatcher as k, PREFERRED_DRIVER as ki, requestContinue as kn, planAgentMigration as kr, heldTimeout as kt, isDetached as l, programsRunBy as li, nodeSays as ln, FEEDBACK_SEVERITIES as lr, detachResume as lt, stateParts as m, EdgeInputSchema as mi, FOLLOW_UP_KINDS as mn, sendPost as mr, NOT_STARTED as mt, resumedOptions as n, skillsIn as ni, git as nn, END_DETAIL_LIMIT as nr, sendFromScript as nt, projectHead as o, readDocument as oi, modelDriver as on, checkNote as or, pendingDecisions as ot, removeRefusal as p, markValue as pi, serversIn as pn, runGh as pr, followEvents as pt, replayLoopAnswers as q, machineRulesOf as qn, shownPath as qr, usageListTable as qt, applyRemove as r, WorkflowEditSchema as ri, gitOk as rn, END_KINDS as rr, createRelay as rt, readWorktrees as s, renameNodeTypes as si, namingNoDriver as sn, recordNote as sr, createCalls as st, createWorkspace as t, writePlainFile as ti, inspectProject as tn, outcomeEnd as tr, scriptRefusal as tt, labelOf as u, renderJsonSchema as ui, declaredOutputOf as un, FEEDBACK_TARGETS as ur, resumable as ut, capsHere as v, settingsOf as vi, markDue as vn, openFixRun as vr, explainWorkflowText as vt, compareVersions as w, retiredDriverHint as wi, DEFAULT_FOLLOW_UPS_RULE as wn, socketRoom as wr, walkChecks as wt, runningRunIds as x, isToolNode as xi, deliverFollowUp as xn, renderTemplate as xr, parseReport as xt, planUpgrade as y, NodeSchema as yi, recordPublished as yn, evaluate as yr, explainSession as yt, storePath as z, knownExperiments as zi, processAlive as zn, loadAgents as zr, lowerChild as zt };
+export { driverQueues as $, isGithubIssueUrl as $n, estimateTokens as $r, planClean as $t, triggerStanding as A, PREFERRED_DRIVER as Ai, requestContinue as An, planAgentMigration as Ar, heldTimeout as At, appendRecorder as B, knownExperiments as Bi, processAlive as Bn, loadAgents as Br, lowerChild as Bt, detectInstaller as C, DriverSchema as Ci, followUpProblem as Cn, readCondition as Cr, reportSchemaFor as Ct, lateTriggers as D, INTEGRATIONS as Di, endLinksOf as Dn, MASK as Dr, startRun as Dt, parseVersion as E, timeoutMs as Ei, addressOf as En, TOOL_INPUT_KEYS as Er, walkSummary as Et, watchingPid as F, AGENT_DRIVERS as Fi, lockWaitsOf as Fn, toolsInUse as Fr, failedWith as Ft, listOrkWorktrees as G, PROJECT_FILE as Gn, placeFor as Gr, feedbackListTable as Gt, applyPrune as H, isItem as Hn, inRepoPlace as Hr, startAt as Ht, activeTree as I, DRIVER_IDS as Ii, pausedOf as In, createAgent as Ir, stoppedEnd as It, parseInputPairs as J, machineRulesOf as Jn, shownPath as Jr, usageListTable as Jt, createReplay as K, gitRulesOf as Kn, projectsHome as Kr, followUpListTable as Kt, isNodeEvent as L, firstLine as Li, runStatus as Ln, deleteAgent as Lr, declaredProblem as Lt, readProjectTriggers as M, readyDriver as Mi, requestStop as Mn, planMoveInto as Mr, calledWorkflows as Mt, workflowTextHash as N, AGENT_TOOL_LAYOUTS as Ni, tellLiveRun as Nn, linkTools as Nr, lockWaitLine as Nt, triggersReport as O, TOOL_PREFIX as Oi, linkNodes as On, maskReplacer as Or, MESSAGE_LIMIT as Ot, takeWatchLock as P, ORK_LAYOUT as Pi, liveStatus as Pn, toolLinks as Pr, endedWith as Pt, sessionRefusals as Q, followUpActions as Qn, LESSON_CAP_TOKENS as Qr, keyOf as Qt, openStore as R, EXPERIMENTS as Ri, slotWaitsOf as Rn, AGENT_SOURCES as Rr, slotClock as Rt, runningScript as S, isToolNode as Si, deliverFollowUp as Sn, renderTemplate as Sr, parseReport as St, isNewer as T, retiredDriverHint as Ti, DEFAULT_FOLLOW_UPS_RULE as Tn, socketRoom as Tr, walkChecks as Tt, planPrune as U, nestItems as Un, newProjectId as Ur, LIST_TABLES as Ut, createRecorder as V, stillTheSameProcess as Vn, hasInRepoFiles as Vr, programFound as Vt, createdWorktrees as W, countedTokens as Wn, placeFiles as Wr, decisionListTable as Wt, budgetWarnings as X, dueCause as Xn, inside as Xr, applyClean as Xt, resolveInputs as Y, changeFollowUp as Yn, workflowDirOf as Yr, worktreeListTable as Yt, driverRefusals as Z, findFollowUp as Zn, projectRootOf as Zr, cleanStep as Zt, usageReport as _, CheckReportSchema as _i, postFollowUpMessage as _n, normalizeTitle as _r, limitsReport as _t, planRemove as a, applyEdits as ai, clearGitLocalEnv as an, endFor as ar, followRunTree as at, releaseNotes as b, NodeSchema as bi, recordPublished as bn, evaluate as br, explainSession as bt, repoRoot as c, renameNodeTypes as ci, namingNoDriver as cn, recordNote as cr, createCalls as ct, mergeStateOf as d, renderJsonSchema as di, declaredOutputOf as dn, FEEDBACK_TARGETS as dr, resumable as dt, guardedBase as ei, stepActs as en, createSignals as er, TOO_LONG as et, planLine as f, parseWorkflow as fi, MCP_FILE as fn, DISCUSSIONS as fr, DETACHED_ENV as ft, USAGE_DIMENSIONS as g, WorkflowSchema as gi, createFollowUps as gn, createFeedback as gr, limitsNow as gt, resolveBase as h, EdgeInputSchema as hi, FOLLOW_UP_KINDS as hn, sendPost as hr, NOT_STARTED as ht, lostWork as i, WorkflowEditSchema as ii, gitOk as in, END_KINDS as ir, followRuns as it, declaredTriggers as j, driverChecks as ji, requestPause as jn, applySteps as jr, runScope as jt, createWatcher as k, integrationFor as ki, unlinkNodes as kn, maskSecrets as kr, userMessageText as kt, isDetached as l, beforeOf as li, sessionDriver as ln, FEEDBACK_KINDS as lr, adoptedCalls as lt, stateParts as m, markValue as mi, serversIn as mn, runGh as mr, followEvents as mt, resumedOptions as n, writePlainFile as ni, inspectProject as nn, outcomeEnd as nr, sendFromScript as nt, projectHead as o, newWorkflowText as oi, envReadsOf as on, previewPost as or, answerDecision as ot, removeRefusal as p, serializeWorkflow as pi, mcpNotText as pn, planPost as pr, detachRun as pt, replayLoopAnswers as q, loadProject as qn, runDirOf as qr, runListTable as qt, applyRemove as r, skillsIn as ri, git as rn, END_DETAIL_LIMIT as rr, createRelay as rt, readWorktrees as s, readDocument as si, modelDriver as sn, checkNote as sr, pendingDecisions as st, createWorkspace as t, plainPathInside as ti, stepPrunes as tn, endOf as tr, scriptRefusal as tt, labelOf as u, programsRunBy as ui, nodeSays as un, FEEDBACK_SEVERITIES as ur, detachResume as ut, capsHere as v, expandEdge as vi, checkFollowUpsDue as vn, feedbackActions as vr, planReason as vt, compareVersions as w, NodeIdSchema as wi, liveSessionOf as wn, startControl as wr, checkWorkflowText as wt, runningRunIds as x, isClaudeNode as xi, startFollowUpChecks as xn, parseTemplate as xr, planNodeSession as xt, planUpgrade as y, settingsOf as yi, markDue as yn, openFixRun as yr, explainWorkflowText as yt, storePath as z, experimentsOn as zi, templateOf$1 as zn, catalogAgent as zr, slotWaitLine as zt };