@krapht/ork 1.0.0-alpha.2 → 1.0.0-alpha.20

package/dist/src-D4JSymhK.mjs

@@ -0,0 +1,3104 @@
+import { Bt as lowerChild, Dr as MASK, Fi as AGENT_DRIVERS, Ht as startAt, St as parseReport, Vt as programFound, Wn as countedTokens, ar as endFor, dr as FEEDBACK_TARGETS, hn as FOLLOW_UP_KINDS, ir as END_KINDS, kr as maskSecrets, lr as FEEDBACK_KINDS, nr as outcomeEnd, ur as FEEDBACK_SEVERITIES } from "./src-8cOPOgrT.mjs";
+import { n as holdGuard, r as orphanGuard } from "./orphan-guard-BFKg8VSd.mjs";
+import path from "node:path";
+import { z } from "zod";
+import { chmodSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { homedir, tmpdir } from "node:os";
+import { createInterface } from "node:readline";
+import { execFile, spawn } from "node:child_process";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { createServer } from "node:http";
+// ../runtime/src/hold.ts
+/**
+* Waits at a tool call while `hold` is held: "go" once it is released within
+* the window (or at once when it is not held), "defer" after the window.
+*/
+const holdAtTool = async (hold, signal, windowMs) => {
+	if (!hold.held()) return "go";
+	const window = new AbortController();
+	const timer = setTimeout(() => {
+		window.abort();
+	}, windowMs);
+	try {
+		await hold.wait("tool", AbortSignal.any([signal, window.signal]));
+	} finally {
+		clearTimeout(timer);
+	}
+	return hold.held() && !signal.aborted ? "defer" : "go";
+};
+// ../runtime/src/heavy-hook.ts
+/**
+* @file A session's slot for a heavy Bash call (the project's `heavy` rule),
+*   taken in the hook before a tool call, where a pause holds the call too
+*   (ADR-041): a slot that frees within the hold window lets the call go; past
+*   it the call is deferred, as a pause defers it, and the session resumes once
+*   the slot is taken. The slot is released after the call (the hook after it),
+*   at the session's next call, or at the session's end. The wait itself (its
+*   events, the clock standing still) is the node's machine port.
+*/
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** The command of a Bash call's hook input, as Claude Code sends it. */
+const bashCommand = (input) => {
+	if (!isRecord$1(input) || input["tool_name"] !== "Bash") return void 0;
+	const tool = input["tool_input"];
+	const command = isRecord$1(tool) ? tool["command"] : void 0;
+	return typeof command === "string" ? command : void 0;
+};
+/** The hook for one session; with no machine port, every call goes. */
+const heavyHook = (machine) => {
+	let held;
+	let waiting;
+	const free = () => {
+		held?.release();
+		held = void 0;
+	};
+	/** Gives up the wait; a slot it already got is given back. */
+	const abandon = () => {
+		const pending = waiting;
+		waiting = void 0;
+		if (pending === void 0) return;
+		pending.stop.abort();
+		pending.slot.then((release) => {
+			release();
+			return null;
+		});
+	};
+	return {
+		before: async (input, signal, windowMs) => {
+			const command = bashCommand(input);
+			if (held !== void 0 && !held.ran && held.command === command) {
+				held.ran = true;
+				return "go";
+			}
+			free();
+			if (waiting !== void 0 && waiting.command !== command) abandon();
+			if (machine === void 0 || command === void 0) return "go";
+			if (waiting === void 0) {
+				const stop = new AbortController();
+				waiting = {
+					command,
+					stop,
+					slot: machine.slot(command, stop.signal)
+				};
+			}
+			const pending = waiting;
+			const window = new AbortController();
+			const release = await Promise.race([pending.slot, setTimeout$1(windowMs, null, { signal: AbortSignal.any([signal, window.signal]) }).catch(() => null)]);
+			window.abort();
+			if (release === null) return signal.aborted ? "go" : "defer";
+			waiting = void 0;
+			held = {
+				command,
+				release,
+				ran: true
+			};
+			return "go";
+		},
+		after: () => {
+			if (held?.ran === true) free();
+		},
+		ready: async () => {
+			const pending = waiting;
+			if (pending === void 0) return;
+			const release = await pending.slot;
+			if (waiting !== pending) return;
+			waiting = void 0;
+			held = {
+				command: pending.command,
+				release,
+				ran: false
+			};
+		},
+		release: () => {
+			abandon();
+			free();
+		}
+	};
+};
+/** Whether a hook's input is from after a tool call. */
+const afterCall = (input) => isRecord$1(input) && input["hook_event_name"] === "PostToolUse";
+/**
+* A session's hook on its tool calls. Before one, a pause holds it (ADR-041),
+* then a heavy Bash call waits for its slot; past the window either defers it
+* (`onDefer`). After a call, its slot is freed.
+*/
+const toolHook = (given) => async (gone, input) => {
+	if (afterCall(input)) {
+		given.heavy.after();
+		return {};
+	}
+	const signal = AbortSignal.any([gone, given.ended]);
+	let answer = await holdAtTool(given.hold, signal, given.windowMs);
+	if (answer === "go") answer = await given.heavy.before(input, signal, given.windowMs);
+	if (answer === "defer") given.onDefer();
+	return given.answer(answer);
+};
+/** The name Claude Code gives an Ork tool: `mcp__ork__<name>`. */
+const toolId = (name) => `mcp__ork__${name}`;
+const text = (value) => ({ content: [{
+	type: "text",
+	text: value
+}] });
+const issueAt = (issue) => {
+	const where = z.core.toDotPath(issue.path);
+	return where === "" ? "" : `${where}: `;
+};
+/** Whether `issue` is about a field of the object `parent` is about. */
+const isFieldOf = (issue, parent) => issue.path.length === parent.path.length + 1 && parent.path.every((key, index) => key === issue.path[index]);
+const expectedField = (issue) => `; the field is \`${String(issue.path.at(-1))}\`${issue.code === "invalid_value" ? `, one of: ${issue.values.join(", ")}` : ""}`;
+/**
+* A failed parse as text a model can act on. A stray key is reported with the
+* fields its object lacks, read from the schema's own issues: a wrong name is
+* otherwise only a "missing" error that hides what was sent.
+*/
+const readableIssues = (issues) => {
+	const strays = issues.filter((issue) => issue.code === "unrecognized_keys");
+	const lacking = issues.filter((issue) => issue.input === void 0 && strays.some((stray) => isFieldOf(issue, stray)));
+	return [...strays.map((stray) => `${issueAt(stray)}unknown field ${stray.keys.map((key) => `\`${key}\``).join(", ")}${lacking.filter((issue) => isFieldOf(issue, stray)).map((issue) => expectedField(issue)).join("")}`), ...issues.filter((issue) => issue.code !== "unrecognized_keys" && !lacking.includes(issue)).map((issue) => `${issueAt(issue)}${issue.message}`)].join("\n");
+};
+const defineTool = (definition) => ({
+	name: definition.name,
+	bind: (context) => {
+		if (!(definition.available?.(context) ?? true)) return null;
+		const shape = typeof definition.shape === "function" ? definition.shape(context) : definition.shape;
+		const schema = z.object(shape);
+		return {
+			name: definition.name,
+			description: typeof definition.description === "function" ? definition.description(context) : definition.description,
+			shape,
+			schema,
+			preapproved: definition.preapproved ?? true,
+			call: (args) => {
+				const parsed = schema.safeParse(args, { reportInput: true });
+				return parsed.success ? definition.run(context, parsed.data) : Promise.resolve({
+					...text(readableIssues(parsed.error.issues)),
+					isError: true
+				});
+			}
+		};
+	}
+});
+// ../runtime/src/mcp-http.ts
+/**
+* @file A minimal MCP server over the streamable HTTP transport, for the
+*   `claude` CLI driver. It answers with plain JSON (no SSE stream), which the
+*   transport allows, and implements only what Ork needs: `initialize`, `ping`,
+*   `tools/list` and `tools/call`. Beside it, `/hold` answers the session's
+*   `PreToolUse` HTTP hook, which waits while the node is paused (ADR-041) or
+*   for a heavy command's slot, and its `PostToolUse` hook, which frees it.
+*/
+const PATH = "/mcp";
+const HOLD_PATH = "/hold";
+const MAX_BODY = 1048576;
+const MCP_PROTOCOL_FALLBACK = "2025-06-18";
+const JsonRpcSchema = z.object({
+	jsonrpc: z.literal("2.0"),
+	id: z.union([z.string(), z.number()]).optional(),
+	method: z.string(),
+	params: z.record(z.string(), z.unknown()).optional()
+});
+/** Handles one JSON-RPC request; `null` for a notification (no reply). */
+const handleRpc = async (tools, message) => {
+	const parsed = JsonRpcSchema.safeParse(message);
+	if (!parsed.success) return { error: {
+		code: -32600,
+		message: "invalid request"
+	} };
+	const { id, method, params } = parsed.data;
+	if (id === void 0) return null;
+	switch (method) {
+		case "initialize": {
+			const requested = params?.["protocolVersion"];
+			return { result: {
+				protocolVersion: typeof requested === "string" ? requested : MCP_PROTOCOL_FALLBACK,
+				capabilities: { tools: {} },
+				serverInfo: {
+					name: "ork",
+					version: "0.0.0"
+				}
+			} };
+		}
+		case "ping": return { result: {} };
+		case "tools/list": return { result: { tools: tools.map((t) => ({
+			name: t.name,
+			description: t.description,
+			inputSchema: z.toJSONSchema(t.schema)
+		})) } };
+		case "tools/call": {
+			const tool = tools.find((t) => t.name === params?.["name"]);
+			if (tool === void 0) return { error: {
+				code: -32602,
+				message: "unknown tool"
+			} };
+			try {
+				return { result: await tool.call(params?.["arguments"] ?? {}) };
+			} catch (error) {
+				return { result: {
+					content: [{
+						type: "text",
+						text: error instanceof Error ? error.message : "tool failed"
+					}],
+					isError: true
+				} };
+			}
+		}
+		default: return { error: {
+			code: -32601,
+			message: `unknown method ${method}`
+		} };
+	}
+};
+const authorized = (req, token) => {
+	const expected = Buffer.from(`Bearer ${token}`);
+	const given = Buffer.from(req.headers.authorization ?? "");
+	return given.length === expected.length && timingSafeEqual(given, expected);
+};
+const readBody = async (req) => {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+		size += buffer.length;
+		if (size > MAX_BODY) return null;
+		chunks.push(buffer);
+	}
+	return Buffer.concat(chunks).toString("utf8");
+};
+const respond = (res, status, body) => {
+	if (body === void 0) {
+		res.writeHead(status).end();
+		return;
+	}
+	res.writeHead(status, { "content-type": "application/json" }).end(JSON.stringify(body));
+};
+/** The hook's POST: waits for `hold`; a closed connection gives up. */
+const serveHold = async (req, res, hold) => {
+	if (req.method !== "POST") {
+		respond(res, 405);
+		return;
+	}
+	const body = await readBody(req);
+	if (body === null) {
+		respond(res, 413);
+		return;
+	}
+	let input;
+	try {
+		input = JSON.parse(body);
+	} catch {
+		input = void 0;
+	}
+	const gone = new AbortController();
+	res.once("close", () => {
+		gone.abort();
+	});
+	const output = await hold(gone.signal, input);
+	if (!gone.signal.aborted) respond(res, 200, output);
+};
+const serve = async (req, res, tools, token, hold) => {
+	if (!authorized(req, token)) {
+		respond(res, 401);
+		return;
+	}
+	if (req.url === HOLD_PATH && hold !== void 0) {
+		await serveHold(req, res, hold);
+		return;
+	}
+	if (req.url !== PATH) {
+		respond(res, 404);
+		return;
+	}
+	if (req.method !== "POST") {
+		respond(res, 405);
+		return;
+	}
+	const body = await readBody(req);
+	if (body === null) {
+		respond(res, 413);
+		return;
+	}
+	let message;
+	try {
+		message = JSON.parse(body);
+	} catch {
+		respond(res, 400);
+		return;
+	}
+	const id = message !== null && typeof message === "object" && "id" in message ? message.id : null;
+	const reply = await handleRpc(tools, message);
+	if (reply === null) {
+		respond(res, 202);
+		return;
+	}
+	respond(res, 200, {
+		jsonrpc: "2.0",
+		id,
+		...reply
+	});
+};
+/**
+* Serves Ork's tools to one `claude` CLI session: on 127.0.0.1 only, on a
+* random port, behind a per-session bearer token.
+*/
+const startOrkMcpHttp = async (tools, hold) => {
+	const token = randomBytes(24).toString("hex");
+	const http = createServer((req, res) => {
+		serve(req, res, tools, token, hold).catch(() => {
+			if (!res.headersSent) respond(res, 500);
+		});
+	});
+	await new Promise((resolve) => {
+		http.listen(0, "127.0.0.1", resolve);
+	});
+	const address = http.address();
+	const port = typeof address === "object" && address !== null ? address.port : 0;
+	return {
+		url: `http://127.0.0.1:${port}${PATH}`,
+		holdUrl: `http://127.0.0.1:${port}${HOLD_PATH}`,
+		token,
+		close: () => new Promise((resolve) => {
+			http.closeAllConnections();
+			http.close(() => {
+				resolve();
+			});
+		})
+	};
+};
+// ../runtime/src/provider-errors.ts
+/**
+* @file The provider-error classifier every driver's adapter uses (specs/
+*   runtime/session-ends.md): an error a model provider sent back (Anthropic,
+*   OpenAI-style, or a proxy such as OpenCode's `commandcode`) to one end kind.
+*   It reads the error's type or code first, its HTTP status next, and its
+*   words last, so a changed sentence rarely changes the kind.
+*/
+/** Error types and codes the providers document, by the kind they mean. */
+const TYPES = {
+	rate_limit_error: "rate_limited",
+	overloaded_error: "provider_unavailable",
+	api_error: "provider_unavailable",
+	timeout_error: "provider_unavailable",
+	authentication_error: "auth",
+	permission_error: "auth",
+	billing_error: "out_of_credits",
+	not_found_error: "model_unavailable",
+	request_too_large: "context_too_long",
+	insufficient_quota: "out_of_credits",
+	invalid_api_key: "auth",
+	context_length_exceeded: "context_too_long",
+	model_not_found: "model_unavailable",
+	rate_limit_exceeded: "rate_limited",
+	server_error: "provider_unavailable",
+	ProviderAuthError: "auth",
+	MessageAbortedError: "interrupted"
+};
+const TYPE = new RegExp(`\\b(${Object.keys(TYPES).join("|")})\\b`, "u");
+/** HTTP statuses that decide by themselves; 400 needs the words. */
+const statusKind = (status) => {
+	if (status === 401 || status === 403) return "auth";
+	if (status === 402) return "out_of_credits";
+	if (status === 404) return "model_unavailable";
+	if (status === 413) return "context_too_long";
+	if (status === 429) return "rate_limited";
+	if (status === 408 || status === 529 || status >= 500 && status < 600) return "provider_unavailable";
+	return null;
+};
+/** The words, when neither type nor status decided; the first match wins. */
+const WORDS = [
+	["plan_limit", /\busage limit reached\b|\bhit your (?:usage )?limit\b|\blimit will reset\b/iu],
+	["context_too_long", /\bprompt is too long\b|\bcontext (?:length|window)\b|\bmaximum context\b|\btoo many tokens\b/iu],
+	["out_of_credits", /\bcredit balance\b|\binsufficient (?:credits?|funds|balance|quota)\b|\bout of credits?\b|\bexceeded your current quota\b/iu],
+	["rate_limited", /\brate.?limit(?:ed)?\b|\btoo many requests\b/iu],
+	["auth", /\binvalid (?:x-)?api.?key\b|\bnot (?:logged|signed) in\b|\bplease run \/login\b|\bunauthori[sz]ed\b|\bOAuth token has expired\b/iu],
+	["provider_unavailable", /\boverloaded\b|\bservice unavailable\b|\bbad gateway\b|\bECONNRESET\b|\bECONNREFUSED\b|\bETIMEDOUT\b|\bENOTFOUND\b|\bEAI_AGAIN\b|\bfetch failed\b|\bsocket hang up\b|\bnetwork error\b/iu],
+	["model_unavailable", /\bassistant message prefill\b|\bInvalid `signature` in `thinking` block\b|\bmodel(?: \S+)? (?:not found|does not exist|is not supported)\b|\bdoes not support\b|\bunknown model\b/iu]
+];
+/** Generic refusals: the provider would not serve the request as it was. */
+const REFUSED$1 = /\binvalid_request_error\b|\binvalid_request\b/u;
+/** A status written in the text, e.g. Claude Code's `API Error: 529 {…}`. */
+const STATUS_IN_TEXT = /\bAPI Error:? (\d{3})\b|"(?:status|statusCode)"\s*:\s*(\d{3})\b|\b(?:status|HTTP)[ :]+(\d{3})\b/u;
+const statusIn = (text) => {
+	const found = STATUS_IN_TEXT.exec(text);
+	const digits = found?.[1] ?? found?.[2] ?? found?.[3];
+	return digits === void 0 ? void 0 : Number(digits);
+};
+const classed = (kind) => ({
+	kind,
+	message: END_KINDS[kind].message({})
+});
+/**
+* The end kind a provider's error means, with Ork's sentence for it; `null`
+* when nothing in it is recognized. `status` is the HTTP status when the caller
+* has it; otherwise one written in the text is read.
+*/
+const classifyProviderError = (text, status) => {
+	const type = TYPE.exec(text)?.[1];
+	if (type !== void 0) return classed(TYPES[type] ?? "unknown");
+	const code = status ?? statusIn(text);
+	const byStatus = code === void 0 ? null : statusKind(code);
+	if (byStatus !== null) return classed(byStatus);
+	const byWords = WORDS.find(([, pattern]) => pattern.test(text))?.[0];
+	if (byWords !== void 0) return classed(byWords);
+	return REFUSED$1.test(text) || code === 400 ? classed("model_unavailable") : null;
+};
+// ../runtime/src/session-end.ts
+/**
+* @file How a session ended, as its adapter's decoder and the session runner
+*   settle it (specs/runtime/session-ends.md): a decoder names the signal only
+*   it can see (a turn cap, an exit code, a provider's error), and the report
+*   the session handed in decides the rest. The runner then writes the end in
+*   the node's numbers, its detail scrubbed with the feedback redactor. A
+*   session the driver could not run (or that was stopped, with what it had
+*   spent) ends as `driverFailure` says, one whose process died as
+*   `failureReason` explains, and one that reached its token cap as
+*   `tokenCapOutcome` says.
+*/
+/** The end a report gives: done, a reported failure, or none handed in. */
+const reportEnd = (report) => {
+	if (report === null) return endFor("no_report");
+	return endFor(report.status === "fail" ? "reported_failure" : "done");
+};
+/**
+* A session's end: a report it handed in decides it (the node's result is that
+* report), then the decoder's `signal`, then `no_report`.
+*/
+const sessionEnd = (signal, report) => report !== null || signal === null ? reportEnd(report) : signal;
+/**
+* The end an error's text means: the provider classifier's kind, or `fallback`
+* when it recognizes nothing. The text is the detail either way.
+*/
+const errorEnd = (text, fallback = "unknown", status) => endFor(classifyProviderError(text, status)?.kind ?? fallback, {}, text);
+/**
+* The outcome with its end settled: a report decides it, also one handed in
+* through Ork's `report` tool after the decoder's end said none; the message is
+* written with the node's numbers; the detail is scrubbed and capped. An
+* adapter whose decoder sets no end gets one read from the outcome.
+*/
+const settleEnd = (outcome, facts, scrub) => {
+	const end = outcome.report === null ? outcome.end ?? outcomeEnd(outcome) : reportEnd(outcome.report);
+	const { usage } = outcome;
+	const used = {
+		...facts,
+		usedTokens: countedTokens(usage),
+		...usage.costUsd > 0 ? { usedUsd: usage.costUsd } : {}
+	};
+	return {
+		...outcome,
+		end: endFor(end.kind, used, end.detail, scrub)
+	};
+};
+/**
+* What a session's end is written with: the node's limits and program, and its
+* folder and the home folder taken out of the detail.
+*/
+const scopeOf = (spec, bin, env) => ({
+	facts: {
+		...spec.maxTurns === void 0 ? {} : { maxTurns: spec.maxTurns },
+		...spec.budgetUsd === void 0 ? {} : { budgetUsd: spec.budgetUsd },
+		...spec.budgetTokens === void 0 ? {} : { budgetTokens: spec.budgetTokens },
+		program: path.basename(bin)
+	},
+	scrub: {
+		roots: [spec.cwd],
+		home: env["HOME"] ?? homedir()
+	}
+});
+/**
+* The outcome of a session stopped once its counted tokens (RFC-015) reach
+* `budgetTokens`: `budget_limit`, with what it used so far; `undefined` under
+* the cap, or with none.
+*/
+const tokenCapOutcome = ({ budgetTokens }, usage, sessionId) => budgetTokens === void 0 || usage === void 0 || countedTokens(usage) < budgetTokens ? void 0 : {
+	subtype: "error_max_budget_tokens",
+	end: endFor("budget_limit"),
+	sessionId,
+	report: null,
+	text: "",
+	usage,
+	errors: [`Reached the token budget (${String(budgetTokens)})`]
+};
+const REASON_LIMIT = 500;
+/** Noise a Node crash ends stderr with, or a stack frame: never the reason. */
+const isNoise = (line) => /^Node\.js v\d/u.test(line) || /^\s+at /u.test(line);
+/**
+* Why a process ended without a result: the last block of its stderr as one
+* masked, capped line (the reason reaches the terminal, which is not masked).
+*/
+const failureReason = (name, stderr, code) => {
+	const block = stderr.split("\n").filter((line) => !isNoise(line)).join("\n").split(/\n\s*\n/u).map((text) => text.trim().replaceAll(/\s*\n\s*/gu, " ")).findLast((text) => text !== "");
+	return block === void 0 ? `${name} exited with code ${String(code)}` : maskSecrets(block).slice(0, REASON_LIMIT);
+};
+/**
+* The kind of a failure to run the driver: its program missing, else what a
+* provider's words in it say, else a crash.
+*/
+const failureKind = (error) => {
+	if (error instanceof Error && "code" in error && error.code === "ENOENT") return "tool_missing";
+	const text = error instanceof Error ? error.message : String(error);
+	if (/\bENOENT\b/u.test(text)) return "tool_missing";
+	return classifyProviderError(text)?.kind ?? "driver_crashed";
+};
+const NOTHING_SPENT = {
+	usage: {
+		costUsd: 0,
+		inputTokens: 0,
+		outputTokens: 0,
+		cacheReadTokens: 0,
+		cacheWriteTokens: 0,
+		turns: 0,
+		durationMs: 0
+	},
+	sessionId: ""
+};
+/**
+* A finished event for a session the driver could not run, ended as `kind` with
+* `message` (Ork's words or the tool's, masked) as its detail; a stopped one
+* keeps what it had `spent` (its tokens decoded so far, dollars $0).
+*/
+const driverFailure = (message, kind, scope, spent = NOTHING_SPENT) => ({
+	type: "session.finished",
+	outcome: {
+		subtype: "error_driver",
+		end: endFor(kind, scope.facts, kind === "interrupted" ? void 0 : message, scope.scrub),
+		sessionId: spent.sessionId,
+		report: null,
+		text: "",
+		usage: spent.usage,
+		errors: [message]
+	}
+});
+// ../runtime/src/leg-spawn.ts
+/**
+* @file Starting one process (leg) of a session: at the project's priority, and
+*   off Windows in its own process group beside the orphan guard, so it and
+*   what it started end with `ork`, whatever ends `ork`. The process's pid, and
+*   the SIGINT that stops it, stay the driver's own.
+*/
+/** The fd of the orphan guard's pipe from `ork`. */
+const WATCH_FD = 3;
+/**
+* Starts the orphan guard, then becomes the driver. The pipe is closed by a
+* bare `exec`: macOS's `sh` keeps a copy of a descriptor an `exec` command
+* closes, which the driver and its leftovers would then inherit.
+*/
+const GUARDED = `${orphanGuard(WATCH_FD)}exec ${String(WATCH_FD)}<&-; exec "$0" "$@"`;
+const piped = (child) => child.stdin !== null && child.stdout !== null && child.stderr !== null;
+/**
+* Spawns the leg's process. A program that isn't there is spawned bare, so it
+* fails as spawn's ENOENT; the guard is released once the driver exits, so a
+* session that ends normally leaves its leftovers alone.
+*/
+const spawnLeg = (start) => {
+	const [bin, args] = startAt(start.priority, start.bin, start.args, start.env);
+	const guarded = process.platform !== "win32" && programFound(start.bin, start.env);
+	const child = spawn(guarded ? "/bin/sh" : bin, guarded ? [
+		"-c",
+		GUARDED,
+		bin,
+		...args
+	] : args, {
+		cwd: start.cwd,
+		detached: guarded,
+		env: { ...start.env },
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe",
+			guarded ? "pipe" : "ignore"
+		]
+	});
+	if (!piped(child)) throw new Error(`${start.bin} was started without pipes`);
+	if (guarded) {
+		const release = holdGuard(child.stdio[WATCH_FD]);
+		child.once("exit", release);
+	}
+	return child;
+};
+// ../runtime/src/session-leg.ts
+/**
+* @file One process (leg) of a session the runner drives: it writes the queued
+*   stdin lines, yields the adapter's decoded events, and says how it ended. A
+*   session is one leg, or several when a paused node's tool call was deferred
+*   or a message waits for a tool that takes none mid-session; a resumed leg
+*   carries what the legs before it spent, and its start is not news. Off
+*   Windows the process ends with `ork`, whatever ends `ork` (the orphan
+*   guard).
+*/
+/** Marks a session's start with the driver that runs it. */
+const withDriver = (event, driver) => event.type === "session.started" ? {
+	...event,
+	driver
+} : event;
+/**
+* A session's outcome with its report (the one Ork's `report` tool accepted,
+* when the session has that tool) and its end settled.
+*/
+const settled = (outcome, input) => settleEnd(input.reported === void 0 ? outcome : {
+	...outcome,
+	report: input.reported()
+}, input.scope.facts, input.scope.scrub);
+/** What this leg `used`, with what the legs before it spent. */
+const withCarried = (input, used) => used === void 0 || input.carried === void 0 ? used ?? input.carried : input.adapter.usage.combine(input.carried, used);
+/** The session's end at its token cap, its earlier legs' usage included. */
+const tokenCapEnd = (input, used, sessionId) => {
+	const capped = tokenCapOutcome(input.scope.facts, used === void 0 ? void 0 : withCarried(input, used), sessionId);
+	return capped === void 0 ? void 0 : {
+		type: "session.finished",
+		outcome: settled(capped, input)
+	};
+};
+/** The kinds of a session that ended well, so a queued message continues it. */
+const wentWell = (kind) => kind === "done" || kind === "reported_failure" || kind === "no_report";
+/**
+* What one decoded line yields, and how the leg ends if it does: a result is
+* the session's end, unless the hold hook deferred a call or a message waits; a
+* resumed leg's start is not news, and its end carries what the legs before it
+* spent.
+*/
+const legStep = (decoded, input) => {
+	const { adapter, carried } = input;
+	const deferred = input.deferred() && decoded.deferred === true;
+	const events = [];
+	let ended;
+	for (const said of decoded.events) {
+		if (said.type === "session.started" && carried !== void 0) continue;
+		if (said.type !== "session.finished") {
+			events.push(withDriver(said, adapter.driver));
+			continue;
+		}
+		const own = said.outcome.usage;
+		const usage = carried === void 0 ? own : adapter.usage.combine(carried, own);
+		const last = {
+			...said,
+			outcome: settled({
+				...said.outcome,
+				usage
+			}, input)
+		};
+		const { sessionId, end } = last.outcome;
+		if (deferred) ended = {
+			kind: "deferred",
+			sessionId,
+			usage: own,
+			last
+		};
+		else if (input.withhold() && wentWell(end?.kind)) ended = {
+			kind: "continued",
+			sessionId,
+			usage: own,
+			last
+		};
+		else {
+			events.push(last);
+			ended = { kind: "finished" };
+		}
+	}
+	return ended === void 0 ? { events } : {
+		events,
+		ended
+	};
+};
+/** Runs one process of a session, yielding its events; returns how it ended. */
+const runLeg = async function* (input) {
+	const child = spawnLeg(input);
+	lowerChild(input.priority, child.pid);
+	const exited = new Promise((resolve) => {
+		child.on("close", (code, signal) => {
+			resolve({
+				code,
+				signal
+			});
+		});
+	});
+	const spawnError = new Promise((resolve) => {
+		child.on("error", resolve);
+	});
+	let stderr = "";
+	child.stderr.setEncoding("utf8");
+	child.stderr.on("data", (chunk) => {
+		stderr = (stderr + chunk).slice(-16384);
+	});
+	const write = (line) => {
+		if (child.stdin.writable) child.stdin.write(line);
+	};
+	let stopped = false;
+	input.attach({
+		write,
+		stop: () => {
+			stopped = true;
+			child.kill("SIGINT");
+		}
+	});
+	for (const line of input.pending.splice(0)) write(line);
+	if (input.adapter.command.input === void 0) child.stdin.end();
+	let outcome;
+	let sessionId = "";
+	/** What this leg has used so far, as the last usage step said. */
+	let used;
+	const { decoder } = input;
+	const decode = decoder?.decode ?? input.adapter.decode;
+	try {
+		for await (const line of createInterface({ input: child.stdout })) {
+			const decoded = decode(line);
+			used = decoded.usage ?? used;
+			const { events, ended } = legStep(decoded, input);
+			for (const event of decoded.events) if (event.type === "session.started") sessionId = event.sessionId;
+			yield* events;
+			if (ended !== void 0) {
+				child.stdin.end();
+				outcome = ended;
+			}
+			const capped = outcome === void 0 ? tokenCapEnd(input, decoded.usage, sessionId) : void 0;
+			if (capped !== void 0) {
+				stopped = true;
+				child.kill("SIGINT");
+				yield capped;
+				return { kind: "finished" };
+			}
+		}
+		const end = await Promise.race([exited, spawnError.then((error) => error)]);
+		if (outcome !== void 0) return outcome;
+		if (decoder !== void 0 && !(end instanceof Error) && !stopped) {
+			const { events, ended } = legStep({ events: decoder.exit(end.code) }, input);
+			yield* events;
+			if (ended !== void 0) return ended;
+		}
+		if (end instanceof Error) return {
+			kind: "failed",
+			reason: `could not start ${input.bin}: ${end.message}`,
+			end: failureKind(end)
+		};
+		if (stopped || end.signal !== null) {
+			const usage = withCarried(input, used);
+			return {
+				kind: "failed",
+				reason: "interrupted",
+				end: "interrupted",
+				...usage === void 0 ? {} : { spent: {
+					usage,
+					sessionId
+				} }
+			};
+		}
+		const reason = failureReason(input.adapter.command.bin, stderr, end.code);
+		return {
+			kind: "failed",
+			reason,
+			end: classifyProviderError(reason)?.kind ?? "driver_crashed"
+		};
+	} finally {
+		input.attach();
+		if (child.exitCode === null) child.kill();
+	}
+};
+// ../runtime/src/tools/ask-user.ts
+const askUserTool = defineTool({
+	name: "ask_user",
+	description: "Ask the user to decide something only they can decide. Give two to four options and the one you recommend. The run waits for the answer.",
+	shape: {
+		question: z.string().describe("One clear question."),
+		options: z.array(z.object({
+			id: z.string().describe("A short id, e.g. 'keep-api'."),
+			label: z.string().optional(),
+			description: z.string().optional().describe("What choosing it means.")
+		})).min(2).max(4),
+		recommended: z.string().optional().describe("The id you recommend."),
+		context: z.string().optional().describe("What the user needs to know to decide, in a few sentences.")
+	},
+	run: async ({ nodeId, ports }, args) => {
+		let note;
+		let owner;
+		const question = {
+			nodeId,
+			onNote: (given) => {
+				note = given;
+			},
+			onOwner: (given) => {
+				owner = given;
+			},
+			question: args.question,
+			options: args.options.map((o) => {
+				const choice = { id: o.id };
+				if (o.label !== void 0) choice.label = o.label;
+				if (o.description !== void 0) choice.description = o.description;
+				return choice;
+			})
+		};
+		if (args.recommended !== void 0) question.recommended = args.recommended;
+		if (args.context !== void 0) question.context = args.context;
+		const answer = await ports.human.ask(question);
+		const who = owner === void 0 ? "The user" : `Your owner, \`${owner}\`,`;
+		return text(note === void 0 ? `${who} chose: ${answer}` : `${who} chose: ${answer}\nThey said: ${note}`);
+	}
+});
+// ../runtime/src/tools/claims.ts
+/**
+* @file `claim` and `release`: a session's side of the run's claims. A node
+*   claims a file, folder or other resource before changing it, so nodes
+*   running at the same time do not change the same thing; a refused claim says
+*   who holds it. Only sessions that may write while another does get them.
+*/
+const contended = ({ ports }) => ports.claims?.contended() === true;
+const resource = z.string().min(1).describe("A path from the project root (a folder covers everything in it), or a name for something else shared, e.g. 'db:migrations'.");
+const claimTool = defineTool({
+	name: "claim",
+	description: "Claim a file, folder or other shared resource before you change it, so other nodes running in this run leave it alone. If another node holds it (or something overlapping), you are told who; Ork tells you when it is released.",
+	shape: { resource },
+	available: contended,
+	run: ({ ports }, args) => {
+		const claimed = ports.claims?.claim(args.resource);
+		if (claimed === void 0) return Promise.resolve(text("No claims."));
+		if (!claimed.ok) return Promise.resolve(text(`Not claimed: ${claimed.error}.`));
+		return Promise.resolve(text(claimed.already ? `You already hold ${claimed.resource}.` : `Claimed ${claimed.resource}.`));
+	}
+});
+const releaseTool = defineTool({
+	name: "release",
+	description: "Release a claim you are done with, so other nodes can take it. Ork releases your remaining claims when you finish.",
+	shape: { resource },
+	available: contended,
+	run: ({ ports }, args) => {
+		const released = ports.claims?.release(args.resource);
+		if (released === void 0) return Promise.resolve(text("No claims."));
+		return Promise.resolve(text(released.ok ? `Released ${released.resource}.` : `Not released: ${released.error}.`));
+	}
+});
+// ../runtime/src/tools/delegate.ts
+const BRIEF = z.string().min(1).describe("Self-contained: the goal, the files that matter, and what done looks like. The child does not see your conversation.");
+const DESCRIPTION = z.string().exactOptional().describe("A few words naming this task; shown as the child's label.");
+/** What the leader reads back: each report without the usage details. */
+const reportLine = (report) => {
+	const { usage, ...output } = report.output;
+	const cost = usage !== null && typeof usage === "object" && "costUsd" in usage ? usage.costUsd : void 0;
+	return {
+		child: report.child,
+		ok: report.ok,
+		...output,
+		...cost === void 0 ? {} : { costUsd: cost },
+		...report.ok || report.error === void 0 || report.error === output["summary"] ? {} : { error: report.error }
+	};
+};
+const delegationText = (delegation) => text(JSON.stringify({
+	reports: delegation.reports.map(reportLine),
+	...delegation.notes.length > 0 ? { notes: delegation.notes } : {}
+}));
+/** Why a child the leader owns isn't offered, so it doesn't go looking. */
+const fannedNote = (fanned) => fanned.length === 0 ? "" : ` Not listed: ${fanned.join(", ")}; such a node runs once per item of a list, from its edges, so it can't be delegated to.`;
+const delegateTool = defineTool({
+	name: "delegate",
+	description: ({ ports }) => `Hand tasks to nodes you own. Tasks in one call run in parallel; the call returns every child's report when all are done. Ork merges a passing child's branch into yours.${fannedNote(ports.ownership?.fanned ?? [])}`,
+	shape: ({ ports }) => {
+		const ids = ports.ownership?.children.map((child) => child.id) ?? [];
+		return { tasks: z.array(z.strictObject({
+			child: z.enum(ids).describe(`The id of a node you own: ${ids.join(", ")}.`),
+			brief: BRIEF,
+			description: DESCRIPTION
+		})).min(1) };
+	},
+	available: ({ ports }) => (ports.ownership?.children.length ?? 0) > 0,
+	run: async ({ ports }, args) => {
+		if (ports.ownership === void 0) return text("You own no nodes.");
+		return delegationText(await ports.ownership.delegate(args.tasks));
+	}
+});
+const spawnWorkerTool = defineTool({
+	name: "spawn_worker",
+	description: "Start new instances of a child worker for work that splits into independent parts. Each runs in its own worktree; the call returns their reports when all are done.",
+	shape: ({ ports }) => {
+		const ids = ports.ownership?.templates ?? [];
+		return { tasks: z.array(z.strictObject({
+			template: z.enum(ids).describe(`The id of a child worker you own: ${ids.join(", ")}.`),
+			brief: BRIEF,
+			description: DESCRIPTION
+		})).min(1) };
+	},
+	available: ({ ports }) => ports.ownership !== void 0 && ports.ownership.templates.length > 0 && ports.ownership.workersLeft() > 0,
+	run: async ({ ports }, args) => {
+		if (ports.ownership === void 0) return text("You own no workers.");
+		return delegationText(await ports.ownership.spawn(args.tasks));
+	}
+});
+// ../runtime/src/tools/feedback.ts
+/**
+* @file `feedback`: a session's way to report what got in its way, kept on the
+*   user's machine (specs/feedback.md). Every session inside a run gets it; Ork
+*   caps reports per session and drops a run's duplicates.
+*/
+const feedbackTool = defineTool({
+	name: "feedback",
+	description: "Report something that materially got in the way of your task: a tool that failed or misled you, context or instructions that were missing or wrong, a skill that did not fit, or a flaw in the workflow. One line plus a short body; at most a few per session. Do not report routine work or your own mistakes.",
+	shape: {
+		kind: z.enum(FEEDBACK_KINDS),
+		target: z.enum(FEEDBACK_TARGETS).optional().describe("What it is about: ork (the harness and its tools), workflow (this workflow's briefs, models, budgets, loops), or project (AGENTS.md, CLAUDE.md, skills, docs). Default: from the kind."),
+		severity: z.enum(FEEDBACK_SEVERITIES).optional(),
+		title: z.string().min(1).describe("One line."),
+		body: z.string().optional().describe("A few sentences: what happened and what would have helped."),
+		evidence: z.array(z.string()).optional().describe("File paths, tool names; never pasted file contents.")
+	},
+	available: ({ ports }) => ports.feedback !== void 0,
+	run: ({ ports }, args) => {
+		const draft = {
+			kind: args.kind,
+			title: args.title
+		};
+		if (args.target !== void 0) draft.target = args.target;
+		if (args.severity !== void 0) draft.severity = args.severity;
+		if (args.body !== void 0) draft.body = args.body;
+		if (args.evidence !== void 0) draft.evidence = args.evidence;
+		const sent = ports.feedback?.report(draft);
+		if (sent === void 0) return Promise.resolve(text("No feedback here."));
+		return Promise.resolve(text(sent.ok ? "Recorded. Thank you; carry on with your task." : `Not recorded: ${sent.error}.`));
+	}
+});
+// ../runtime/src/tools/follow-up.ts
+/**
+* @file `follow_up`: a session's way to leave work the change leaves for later
+*   (a change for a later run, a note for another project, a message a person
+*   must send, a task or a check for the maintainer). Ork keeps it where the
+*   project's `followUps` rule says, merges duplicates, caps it per session,
+*   and never sends or runs anything on its own.
+*/
+const isFor = (value) => /^(?:agent|me|project:\S.*|person:\S.*)$/u.test(value);
+const isDue = (value) => /^(?:now|after-merge|after-deploy|\d{4}-\d{2}-\d{2})$/u.test(value);
+const followUpTool = defineTool({
+	name: "follow_up",
+	description: "Leave work this change leaves for later and that is not yours to do now: a change for a later run (for: agent), something for another registered project (for: project:<name>), a message a person must get (for: person:<name>, kind: message, with a draft), or a task or check for the maintainer (for: me, with steps). Ork keeps it, merges duplicates, and sends or runs nothing itself. Not for problems with Ork or the workflow (use feedback), nor for what you can finish now.",
+	shape: {
+		title: z.string().min(1).max(200).describe("One line."),
+		body: z.string().max(4e3).optional().describe("What and why, briefly."),
+		for: z.string().refine(isFor, "agent, me, project:<name> or person:<name>").describe("Who acts: agent, me, project:<name> or person:<name>."),
+		kind: z.enum(FOLLOW_UP_KINDS),
+		due: z.string().refine(isDue, "now, after-merge, after-deploy or YYYY-MM-DD").describe("now, after-merge, after-deploy, or a YYYY-MM-DD date."),
+		where: z.array(z.string()).max(20).optional().describe("Files it is about, relative to the project root."),
+		ref: z.string().min(1).optional().describe("The pull request or branch an after-merge follow-up waits on, when you know it."),
+		draft: z.strictObject({
+			to: z.string().min(1),
+			channel: z.string().optional().describe("github (to: an issue or PR URL), email, slack… A hint for the maintainer."),
+			text: z.string().min(1).max(4e3)
+		}).optional().describe("For a message: what the maintainer will send."),
+		steps: z.array(z.strictObject({
+			text: z.string().trim().min(1),
+			command: z.string().optional().describe("Shown to the maintainer to copy; Ork never runs it.")
+		})).max(20).optional().describe("For a task or check: what to do, in order.")
+	},
+	available: ({ ports }) => ports.followUps !== void 0,
+	run: async ({ ports }, args) => {
+		const port = ports.followUps;
+		if (port === void 0) return text("No follow-ups here.");
+		if (!isFor(args.for) || !isDue(args.due)) return text("Not kept.");
+		const input = {
+			title: args.title,
+			for: args.for,
+			kind: args.kind,
+			due: args.due,
+			...args.body === void 0 ? {} : { body: args.body },
+			...args.where === void 0 ? {} : { where: args.where },
+			...args.ref === void 0 ? {} : { ref: args.ref },
+			...args.draft === void 0 ? {} : { draft: {
+				to: args.draft.to,
+				text: args.draft.text,
+				...args.draft.channel === void 0 ? {} : { channel: args.draft.channel }
+			} },
+			...args.steps === void 0 ? {} : { steps: args.steps.map((step) => ({
+				text: step.text,
+				...step.command === void 0 ? {} : { command: step.command }
+			})) }
+		};
+		const result = await port.add(input);
+		if (!result.ok) return {
+			...text(`Not kept: ${result.error}.`),
+			isError: true
+		};
+		const { followUp, merged, note } = result.added;
+		return text([
+			merged ? `Merged into follow-up ${followUp.id}, which was already kept.` : `Kept as follow-up ${followUp.id}.`,
+			...note === void 0 ? [] : [note],
+			...result.relayed === void 0 ? [] : [`Also sent to ${result.relayed.run}/${result.relayed.node}, a live run of that project.`],
+			"Carry on with your task."
+		].join(" "));
+	}
+});
+// ../runtime/src/tools/input.ts
+/**
+* @file `read_input`: what the workflow sent a node back with, whole. A loop's
+*   re-entry note shows the first 8 KiB of it; when that cut it, the session
+*   gets this tool and reads the rest a page at a time, so a long review's last
+*   findings reach the node.
+*/
+/** The characters one call returns. */
+const INPUT_PAGE = 32e3;
+const readInputTool = defineTool({
+	name: "read_input",
+	description: `Read what the workflow sent your task back with, whole, when Ork's message cut it. Returns up to ${INPUT_PAGE.toLocaleString("en-US")} characters, from \`from\`.`,
+	shape: { from: z.number().int().nonnegative().optional().describe("The character to start at. Default: 0.") },
+	available: ({ ports }) => ports.input !== void 0,
+	run: ({ ports }, args) => {
+		const whole = ports.input ?? "";
+		const from = Math.min(args.from ?? 0, whole.length);
+		const end = Math.min(from + INPUT_PAGE, whole.length);
+		const where = end < whole.length ? `[characters ${String(from)}–${String(end)} of ${String(whole.length)}; call read_input with from: ${String(end)} for the rest]` : `[characters ${String(from)}–${String(end)} of ${String(whole.length)}: the end]`;
+		return Promise.resolve(text(`${whole.slice(from, end)}\n\n${where}`));
+	}
+});
+// ../runtime/src/tools/messages.ts
+/**
+* @file `send_message`, `read_inbox` and `answer`: a session's side of the
+*   run's message bus. A message lands in the recipient's inbox and a live
+*   session gets a one-line notice; `answer` replies to a question Ork asked an
+*   owner about a node it owns. Only sessions inside a run get them.
+*/
+/**
+* Peers are mutual: a node no one may write to has no inbox to read, unless it
+* may be linked later, since a session's tools are set when it starts.
+*/
+const hasPeers = ({ ports }) => (ports.mailbox?.peers().length ?? 0) > 0 || ports.mailbox?.linkable() === true;
+/** A program or a rule may write to a node with no one to write to itself. */
+const hasInbox = (context) => hasPeers(context) || context.ports.mailbox?.hears() === true;
+const MAX_WAIT_SECONDS = 3600;
+const DEFAULT_WAIT_SECONDS = 300;
+const inboxText = (unread) => JSON.stringify({ messages: unread.map((m) => ({
+	from: m.from,
+	...m.via === void 0 ? {} : { via: m.via },
+	body: m.body
+})) });
+const sendMessageTool = defineTool({
+	name: "send_message",
+	description: "Send a short message to a node you can reach: your owner, a node you own, one you share a declared channel with, or a node of another run the user linked you to. It sees a notice and reads the message with read_inbox. Use it for what they need to know now; your report still goes to your owner at the end.",
+	shape: {
+		to: z.string().describe("The node's id, or <run>/<node> for a linked node."),
+		body: z.string().min(1).describe("Self-contained: the recipient does not see your work.")
+	},
+	available: hasPeers,
+	run: ({ ports }, args) => {
+		const sent = ports.mailbox?.send(args.to, args.body);
+		if (sent === void 0) return Promise.resolve(text("No message bus."));
+		if (!sent.ok) return Promise.resolve(text(`Not sent: ${sent.error}.`));
+		return Promise.resolve(text(sent.delivered === "now" ? `Sent to ${args.to}; it sees a notice at its next step.` : `Sent to ${args.to}; it is not running now and sees the message if it starts again.`));
+	}
+});
+const readInboxTool = defineTool({
+	name: "read_inbox",
+	description: "Read your unread messages from other nodes, oldest first. Ork tells you when one arrives.",
+	shape: {},
+	available: hasInbox,
+	run: ({ ports }) => {
+		const unread = ports.mailbox?.read() ?? [];
+		return Promise.resolve(text(unread.length === 0 ? "No unread messages." : inboxText(unread)));
+	}
+});
+const waitForMessagesTool = defineTool({
+	name: "wait_for_messages",
+	description: "Wait for a message from another node when you cannot go on without its reply, instead of ending your session. Returns what arrived, or says none did in time. You hold no session slot while you wait.",
+	shape: { timeoutSeconds: z.number().int().positive().max(MAX_WAIT_SECONDS).optional().describe(`How long to wait. Default: ${String(DEFAULT_WAIT_SECONDS)}.`) },
+	available: hasInbox,
+	run: async ({ ports }, args) => {
+		const seconds = args.timeoutSeconds ?? DEFAULT_WAIT_SECONDS;
+		await ports.mailbox?.wait(seconds * 1e3);
+		const unread = ports.mailbox?.read() ?? [];
+		return text(unread.length === 0 ? `No message yet, after waiting up to ${String(seconds)} seconds. Ork may have told you something; if not, wait again or go on.` : inboxText(unread));
+	}
+});
+const answerTool = defineTool({
+	name: "answer",
+	description: "Answer a question Ork asked you as the owner of a node, such as a loop of yours that ran out of rounds. The question's id and options are in Ork's message.",
+	shape: {
+		question: z.string().describe("The question's id, e.g. 'q1'."),
+		choice: z.string().describe("One of its options."),
+		note: z.string().optional().describe("Why, in a sentence or two; it is recorded with your answer.")
+	},
+	available: ({ ports }) => ports.mailbox !== void 0 && ports.ownership !== void 0,
+	run: ({ ports }, args) => {
+		const answered = ports.mailbox?.answer(args.question, args.choice, args.note);
+		if (answered === void 0) return Promise.resolve(text("No questions."));
+		return Promise.resolve(text(answered.ok ? `Answered ${args.question}: ${args.choice}.` : `Not answered: ${answered.error}.`));
+	}
+});
+// ../runtime/src/tools/permission.ts
+/**
+* @file `permission`: the `claude` CLI's `--permission-prompt-tool`, which
+*   sends each permission prompt to the run's `HumanChannel`.
+*/
+const permissionTool = defineTool({
+	name: "permission",
+	description: "Ork's permission prompt for the claude CLI.",
+	shape: {
+		tool_name: z.string(),
+		input: z.record(z.string(), z.unknown()),
+		tool_use_id: z.string().optional()
+	},
+	preapproved: false,
+	available: ({ driver }) => driver === "claude-code",
+	run: async ({ nodeId, ports }, args) => {
+		const decision = await ports.human.permit({
+			nodeId,
+			toolName: args.tool_name,
+			input: args.input
+		});
+		return text(JSON.stringify(decision.allow ? {
+			behavior: "allow",
+			updatedInput: args.input
+		} : {
+			behavior: "deny",
+			message: decision.message
+		}));
+	}
+});
+// ../runtime/src/tools/report.ts
+/**
+* @file The `report` tool: how a session hands Ork its final report when its
+*   driver cannot hold the final answer to a JSON Schema itself (`reportSchema`
+*   false, RFC-014). The report is checked against the node's report schema
+*   with zod; a report that breaks it comes back to the model as a tool error
+*   naming each violation, so it can fix it and call again. One that fits is
+*   kept as the session's report, and the session runner ends the session with
+*   it instead of what the tool's last line says.
+*/
+const REPORT_TOOL$1 = "report";
+/** Whether the driver holds a session's final answer to its schema itself. */
+const checksItsReport = (driver) => AGENT_DRIVERS.find((d) => d.id === driver)?.capabilities.reportSchema ?? true;
+/**
+* The report schema as zod. shortcut: a schema zod cannot read takes any
+* object, and `parseReport` still demands a status and a summary; upgrade if a
+* node's `output.schema` ever uses JSON Schema zod does not support.
+*/
+const reportValidator = (schema) => {
+	try {
+		return z.fromJSONSchema(schema);
+	} catch {
+		return z.record(z.string(), z.unknown());
+	}
+};
+const failed = (why) => ({
+	...text(`The report was not accepted; fix it and call ${REPORT_TOOL$1} again.\n${why}`),
+	isError: true
+});
+const bound = (report) => {
+	const schema = reportValidator(report.schema);
+	return {
+		name: REPORT_TOOL$1,
+		description: "Hand in your final report: call this once your work is done, as your last step, with the report the task asks for. A report that does not fit comes back with what to fix; call again with the fixed report. The last report accepted is the one your owner gets.",
+		shape: schema instanceof z.ZodObject ? schema.shape : {},
+		schema,
+		preapproved: true,
+		call: (args) => {
+			const parsed = schema.safeParse(args, { reportInput: true });
+			if (!parsed.success) return Promise.resolve(failed(readableIssues(parsed.error.issues)));
+			const kept = parseReport(parsed.data);
+			if (kept === null) return Promise.resolve(failed("A report needs a `status` and a `summary`."));
+			report.submit(kept);
+			return Promise.resolve(text("Report accepted. End your turn now; there is nothing more to do."));
+		}
+	};
+};
+// ../runtime/src/tools/registry.ts
+/**
+* @file The registry of Ork's MCP tools. Both drivers serve what it binds for a
+*   session; a new tool is one file here and one line in `ORK_TOOLS`.
+*/
+const ORK_TOOLS = [
+	askUserTool,
+	permissionTool,
+	delegateTool,
+	spawnWorkerTool,
+	sendMessageTool,
+	readInboxTool,
+	waitForMessagesTool,
+	answerTool,
+	readInputTool,
+	claimTool,
+	releaseTool,
+	feedbackTool,
+	followUpTool,
+	{
+		name: REPORT_TOOL$1,
+		bind: (context) => context.report === void 0 || checksItsReport(context.driver) ? null : bound(context.report)
+	}
+];
+/** The tools one session gets. */
+const orkTools = (context) => ORK_TOOLS.flatMap((tool) => tool.bind(context) ?? []);
+/** Their Claude Code names, for the session's allowed tools. */
+const preapprovedTools = (tools) => tools.filter((t) => t.preapproved).map((t) => toolId(t.name));
+// ../runtime/src/session-runner.ts
+/** A spec that resumes `sessionId`; a fork's later legs continue the fork. */
+const resumed = (spec, sessionId) => ({
+	...spec,
+	resume: sessionId,
+	fork: false
+});
+/**
+* Wires a session to Ork's endpoint, yielding a `session.waiting` event each
+* time the wiring says it waits (a lease waits for its checkout).
+*/
+const wireSaying = async function* (adapter, spec, endpoint, signal, options) {
+	const waits = [];
+	let woke;
+	const woken = () => new Promise((resolve) => {
+		woke = () => {
+			resolve(false);
+		};
+	});
+	const wiring = adapter.mcp.wire(spec, endpoint, {
+		waiting: (reason) => {
+			waits.push(reason);
+			woke?.();
+		},
+		signal,
+		bin: options.bin ?? adapter.command.bin,
+		env: options.env ?? process.env,
+		...options.runs === void 0 ? {} : { runs: options.runs }
+	});
+	const done = wiring.then(() => true, () => true);
+	for (;;) {
+		const finished = waits.length === 0 && await Promise.race([done, woken()]);
+		for (const reason of waits.splice(0)) yield {
+			type: "session.waiting",
+			reason
+		};
+		if (finished) return wiring;
+	}
+};
+/**
+* A runtime that drives `adapter`'s tool, as the user installed and logged it
+* in. Ork never reads or passes its credentials.
+*/
+const createSessionRuntime = (adapter, options = {}) => ({
+	driver: adapter.driver,
+	start: (spec, ports) => {
+		const { input } = adapter.command;
+		const pending = input === void 0 ? [] : [input(spec.prompt, false)];
+		const queued = [];
+		let io;
+		const ended = new AbortController();
+		/** The hold hook deferred a call in the running process. */
+		let deferring = false;
+		/** The last report the `report` tool accepted, across legs. */
+		let reported = null;
+		const { hold } = ports;
+		const hook = hold === void 0 ? void 0 : adapter.hold;
+		const heavy = heavyHook(ports.machine);
+		ended.signal.addEventListener("abort", () => {
+			heavy.release();
+		}, { once: true });
+		const bin = options.bin ?? adapter.command.bin;
+		const scope = scopeOf(spec, bin, options.env ?? process.env);
+		const events = async function* () {
+			const tools = orkTools({
+				nodeId: spec.nodeId,
+				driver: adapter.driver,
+				ports,
+				report: {
+					schema: spec.reportSchema,
+					submit: (report) => {
+						reported = report;
+					}
+				}
+			});
+			const byTool = tools.some((tool) => tool.name === REPORT_TOOL$1);
+			const mcp = await startOrkMcpHttp(tools, hold === void 0 || hook === void 0 ? void 0 : toolHook({
+				hold,
+				heavy,
+				answer: hook.answer,
+				windowMs: options.holdWindowMs ?? hook.windowMs,
+				ended: ended.signal,
+				onDefer: () => {
+					deferring = true;
+				}
+			}));
+			const endpoint = hook === void 0 ? {
+				url: mcp.url,
+				token: mcp.token
+			} : mcp;
+			const allowed = preapprovedTools(tools);
+			let wired;
+			try {
+				try {
+					wired = yield* wireSaying(adapter, spec, endpoint, ended.signal, options);
+				} catch (error) {
+					yield driverFailure(`could not reach Ork's tools: ${error instanceof Error ? error.message : String(error)}`, failureKind(error), scope);
+					return;
+				}
+				const env = {
+					...options.env ?? process.env,
+					PWD: spec.cwd,
+					...adapter.context.env(spec),
+					...wired.env
+				};
+				const legOf = (legSpec, carried) => ({
+					adapter,
+					bin,
+					env,
+					scope,
+					cwd: spec.cwd,
+					...ports.machine === void 0 ? {} : { priority: ports.machine.priority },
+					args: [...adapter.command.args(legSpec, {
+						endpoint,
+						allowed
+					}), ...wired?.args ?? []],
+					carried,
+					...adapter.legDecoder === void 0 ? {} : { decoder: adapter.legDecoder(legSpec) },
+					pending,
+					deferred: () => deferring,
+					withhold: () => input === void 0 && queued.length > 0,
+					...byTool ? { reported: () => reported } : {},
+					attach: (attached) => {
+						io = attached;
+					}
+				});
+				let legSpec = spec;
+				let spent;
+				for (;;) {
+					if (ended.signal.aborted) {
+						yield driverFailure("interrupted", "interrupted", scope);
+						return;
+					}
+					const leg = yield* runLeg(legOf(legSpec, spent));
+					if (leg.kind === "failed") {
+						const { spent: stopped } = leg;
+						if (stopped?.sessionId === "") stopped.sessionId = legSpec.resume ?? "";
+						yield driverFailure(leg.reason, leg.end, scope, stopped);
+						return;
+					}
+					if (leg.kind === "finished") return;
+					deferring = false;
+					spent = spent === void 0 ? leg.usage : adapter.usage.combine(spent, leg.usage);
+					if (leg.kind === "deferred") {
+						await heavy.ready();
+						await hold?.wait("tool", ended.signal);
+					}
+					if (ended.signal.aborted) {
+						yield leg.last;
+						return;
+					}
+					legSpec = leg.kind === "continued" ? {
+						...resumed(spec, leg.sessionId),
+						prompt: queued.splice(0).join("\n\n")
+					} : resumed(spec, leg.sessionId);
+				}
+			} finally {
+				heavy.release();
+				await wired?.release();
+				await mcp.close();
+			}
+		};
+		return {
+			events: events(),
+			send: (text) => {
+				if (input === void 0) {
+					queued.push(text);
+					return;
+				}
+				const line = input(text, true);
+				if (io === void 0) pending.push(line);
+				else io.write(line);
+			},
+			interrupt: () => {
+				ended.abort();
+				io?.stop();
+				return Promise.resolve();
+			}
+		};
+	}
+});
+// ../runtime/src/adapters/claude-code-events.ts
+/**
+* @file The `claude-code` adapter's `EventDecoder` and `UsageReader`: maps the
+*   `claude` CLI's `stream-json` lines to Ork's runtime events, marks the
+*   result of a turn the hold hook deferred, and adds up a session's legs. Its
+*   leg decoder keeps a report the session handed in and then wrote past.
+*/
+const isObject$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const get$1 = (value, key) => isObject$2(value) ? value[key] : void 0;
+const num$2 = (value) => typeof value === "number" ? value : 0;
+const str$2 = (value) => typeof value === "string" ? value : "";
+const blocks = (message) => {
+	const content = get$1(get$1(message, "message"), "content");
+	return Array.isArray(content) ? content.filter((item) => isObject$2(item)) : [];
+};
+const usageOf = (result) => {
+	const usage = get$1(result, "usage");
+	return {
+		costUsd: num$2(result["total_cost_usd"]),
+		inputTokens: num$2(get$1(usage, "input_tokens")),
+		outputTokens: num$2(get$1(usage, "output_tokens")),
+		cacheReadTokens: num$2(get$1(usage, "cache_read_input_tokens")),
+		cacheWriteTokens: num$2(get$1(usage, "cache_creation_input_tokens")),
+		turns: num$2(result["num_turns"]),
+		durationMs: num$2(result["duration_ms"])
+	};
+};
+/** Claude Code's error subtypes that name their own kind. */
+const SUBTYPE_KINDS = {
+	error_max_turns: "turn_limit",
+	error_max_budget_usd: "budget_limit",
+	error_max_structured_output_retries: "invalid_report"
+};
+/**
+* What a result says went wrong, if anything: a subtype that names its kind, or
+* an error (`is_error`, or an error subtype) read by the provider classifier,
+* `unknown` when it says nothing Ork knows.
+*/
+const signalOf$1 = (subtype, result, errors) => {
+	const text = [...errors, str$2(result["result"])].join("\n").trim();
+	const named = SUBTYPE_KINDS[subtype];
+	if (named !== void 0) return endFor(named, {}, text);
+	if (subtype === "success" && result["is_error"] !== true) return null;
+	return errorEnd(text);
+};
+/** The outcome a `result` message describes. */
+const outcomeOf = (result) => {
+	const said = result["errors"];
+	const errors = Array.isArray(said) ? said.filter((e) => typeof e === "string") : [];
+	const subtype = str$2(result["subtype"]) || "unknown";
+	const report = parseReport(result["structured_output"]);
+	return {
+		subtype,
+		end: sessionEnd(signalOf$1(subtype, result, errors), report),
+		sessionId: str$2(result["session_id"]),
+		report,
+		text: str$2(result["result"]),
+		usage: usageOf(result),
+		errors
+	};
+};
+/** The year 2286: a reset beyond this is not in seconds. */
+const MAX_RESET_SECONDS = 1e10;
+/**
+* What a subscription's limit said (RFC-007). Only the fields Claude Code
+* documents are read, so `utilization`, often absent, plays no part.
+*/
+const planLimitOf = (info) => {
+	const status = get$1(info, "status");
+	if (status !== "allowed" && status !== "allowed_warning" && status !== "rejected") return [];
+	const window = get$1(info, "rateLimitType");
+	const resets = get$1(info, "resetsAt");
+	const overage = get$1(info, "overageStatus");
+	return [{
+		type: "plan.limit",
+		status: status === "rejected" && !(status === "rejected" && overage !== "allowed" && overage !== "allowed_warning") ? "allowed_warning" : status,
+		window: typeof window === "string" ? window : "plan",
+		...typeof resets === "number" && resets > 0 && resets < MAX_RESET_SECONDS ? { resetsAt: (/* @__PURE__ */ new Date(resets * 1e3)).toISOString() } : {}
+	}];
+};
+/** Maps one driver message to zero or more normalized events. */
+const normalize = (message) => {
+	if (!isObject$2(message)) return [];
+	switch (message["type"]) {
+		case "system": {
+			if (message["subtype"] !== "init") return [];
+			const started = {
+				type: "session.started",
+				sessionId: str$2(message["session_id"]),
+				model: str$2(message["model"])
+			};
+			if (str$2(message["cwd"]) !== "") started.cwd = str$2(message["cwd"]);
+			return [started];
+		}
+		case "assistant": return blocks(message).flatMap((block) => {
+			if (block["type"] === "text" && str$2(block["text"]).trim() !== "") return [{
+				type: "assistant.text",
+				text: str$2(block["text"])
+			}];
+			if (block["type"] === "tool_use") {
+				const input = block["input"];
+				return [{
+					type: "tool.called",
+					id: str$2(block["id"]),
+					name: str$2(block["name"]),
+					input: isObject$2(input) ? input : {}
+				}];
+			}
+			return [];
+		});
+		case "user": return blocks(message).filter((block) => block["type"] === "tool_result").map((block) => ({
+			type: "tool.result",
+			id: str$2(block["tool_use_id"]),
+			isError: block["is_error"] === true
+		}));
+		case "rate_limit_event": return planLimitOf(message["rate_limit_info"]);
+		case "result": return [{
+			type: "session.finished",
+			outcome: outcomeOf(message)
+		}];
+		default: return [];
+	}
+};
+/** Whether a stream-json message is the result of a deferred tool call. */
+const isDeferredResult = (message) => get$1(message, "type") === "result" && get$1(message, "stop_reason") === "tool_deferred";
+const parseLine$2 = (line) => {
+	try {
+		return JSON.parse(line);
+	} catch {
+		return;
+	}
+};
+/** One `stream-json` line, decoded. */
+const decodeClaudeLine = (line) => {
+	const message = parseLine$2(line);
+	return {
+		events: normalize(message),
+		deferred: isDeferredResult(message)
+	};
+};
+/** The tool `claude` hands a `--json-schema` report in with. */
+const REPORT_TOOL = "StructuredOutput";
+/**
+* A leg's decoder that keeps the last report `claude` accepted (a
+* `StructuredOutput` call whose result was not an error). When the session
+* writes on after it, `claude`'s result can come without `structured_output`;
+* the kept report is then the result's, so a session that reported is not read
+* as one that didn't.
+*/
+const claudeDecoder = () => {
+	const calls = /* @__PURE__ */ new Map();
+	let accepted;
+	/** Each model response's usage, by message id: its blocks repeat it. */
+	const responses = /* @__PURE__ */ new Map();
+	/** The leg's usage so far, when `message` is a model response. */
+	const usageSoFar = (message) => {
+		const inner = get$1(message, "message");
+		const id = get$1(inner, "id");
+		if (get$1(message, "type") !== "assistant" || typeof id !== "string") return;
+		responses.set(id, {
+			...usageOf({ usage: get$1(inner, "usage") }),
+			turns: 1
+		});
+		return [...responses.values()].reduce((a, b) => addUsage(a, b));
+	};
+	return {
+		decode: (line) => {
+			const message = parseLine$2(line);
+			const usage = usageSoFar(message);
+			for (const block of blocks(message)) {
+				if (block["type"] === "tool_use" && block["name"] === REPORT_TOOL) calls.set(str$2(block["id"]), block["input"]);
+				const id = str$2(block["tool_use_id"]);
+				if (block["type"] === "tool_result" && calls.has(id)) {
+					if (block["is_error"] !== true) accepted = calls.get(id);
+					calls.delete(id);
+				}
+			}
+			const kept = isObject$2(message) && message["type"] === "result" && (message["structured_output"] ?? null) === null && accepted !== void 0 ? {
+				...message,
+				structured_output: accepted
+			} : message;
+			return {
+				events: normalize(kept),
+				deferred: isDeferredResult(message),
+				...usage === void 0 ? {} : { usage }
+			};
+		},
+		exit: () => []
+	};
+};
+/**
+* Two legs of one session, as one: the tokens of both, and the later leg's
+* cost, which is already the session's total (ADR-046).
+*/
+const addUsage = (a, b) => ({
+	costUsd: Math.max(a.costUsd, b.costUsd),
+	inputTokens: a.inputTokens + b.inputTokens,
+	outputTokens: a.outputTokens + b.outputTokens,
+	cacheReadTokens: a.cacheReadTokens + b.cacheReadTokens,
+	cacheWriteTokens: a.cacheWriteTokens + b.cacheWriteTokens,
+	turns: a.turns + b.turns,
+	durationMs: a.durationMs + b.durationMs
+});
+/** `claude` reports dollars (a client-side estimate) and tokens. */
+const claudeUsage = {
+	dollars: true,
+	combine: addUsage
+};
+// ../runtime/src/lease-ledger.ts
+/**
+* @file The ledger of Command Code leases (RFC-014, `lease.ts`): one record per
+*   checkout in a folder of the project's runs folder, naming the session's
+*   process and its `ork` entry, and the sweep that removes the entry of every
+*   record whose process is gone (the next session's start, and `ork doctor`).
+*   Only the `ork` entry is touched; the user's other entries stay as they
+*   were.
+*/
+/** One session's hold on a checkout. `pid` 0: its entry could not be removed. */
+const LeaseSchema = z.object({
+	id: z.string(),
+	folder: z.string(),
+	pid: z.number(),
+	entry: z.string()
+});
+/** A local-scope file: only `mcpServers` is read; the rest is kept as is. */
+const LocalScopeSchema = z.looseObject({ mcpServers: z.record(z.string(), z.unknown()).optional() });
+const codeOf = (error) => error instanceof Error && "code" in error ? error.code : void 0;
+const CMD_TIMEOUT_MS = 3e4;
+/** Where a project's lease records live, inside its runs folder. */
+const leaseLedger = (runsDir) => path.join(runsDir, ".leases");
+const alive = (pid) => {
+	if (pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return codeOf(error) === "EPERM";
+	}
+};
+const readLease = (file) => {
+	try {
+		return LeaseSchema.parse(JSON.parse(readFileSync(file, "utf8")));
+	} catch {
+		return;
+	}
+};
+const runCmd = (options, args, cwd) => new Promise((resolve) => {
+	execFile(options.bin, args, {
+		cwd,
+		env: { ...options.env ?? process.env },
+		encoding: "utf8",
+		timeout: CMD_TIMEOUT_MS
+	}, (error, stdout, stderr) => {
+		const said = `${stdout}${stderr}`.trim();
+		const missing = error?.code === "ENOENT" ? `spawn ${options.bin} ENOENT` : "";
+		resolve({
+			ok: error === null,
+			out: said || missing
+		});
+	});
+});
+/** Drops the `ork` entry from a local-scope file whose folder is gone. */
+const dropFromFile = (entry) => {
+	if (!existsSync(entry)) return true;
+	try {
+		const config = LocalScopeSchema.parse(JSON.parse(readFileSync(entry, "utf8")));
+		const { ["ork"]: ours, ...others } = config.mcpServers ?? {};
+		if (ours === void 0) return true;
+		const kept = {
+			...config,
+			mcpServers: others
+		};
+		writeFileSync(entry, `${JSON.stringify(kept, null, 2)}\n`, { mode: 384 });
+		return true;
+	} catch {
+		return false;
+	}
+};
+/** Removes a lease's `ork` entry; true once it is gone. */
+const removeEntry = async (options, lease) => {
+	if (!existsSync(lease.folder)) return dropFromFile(lease.entry);
+	const removed = await runCmd(options, [
+		"mcp",
+		"remove",
+		"--scope",
+		"local",
+		"ork"
+	], lease.folder);
+	return removed.ok || removed.out.includes("not found");
+};
+/** Deletes a record if it is still `lease`'s, not a newer one's. */
+const dropRecord = (file, lease) => {
+	if (readLease(file)?.id === lease.id) rmSync(file, { force: true });
+};
+/**
+* Deletes a record that exists but can't be read: records are written whole (a
+* link, a rename), so one that does not parse is corrupt, and stale.
+*/
+const dropIfCorrupt = (file) => {
+	let text;
+	try {
+		text = readFileSync(file, "utf8");
+	} catch {
+		return;
+	}
+	try {
+		LeaseSchema.parse(JSON.parse(text));
+	} catch {
+		rmSync(file, { force: true });
+	}
+};
+/**
+* Removes the `ork` entry of every lease whose session is gone (a crash, or a
+* removal that failed), and its record. Live leases are left alone.
+*/
+const cleanStaleLeases = async (options) => {
+	const sweep = {
+		cleaned: [],
+		failed: []
+	};
+	if (!existsSync(options.ledger)) return sweep;
+	for (const name of readdirSync(options.ledger)) {
+		if (!name.endsWith(".json")) continue;
+		const file = path.join(options.ledger, name);
+		const lease = readLease(file);
+		if (lease === void 0) dropIfCorrupt(file);
+		if (lease === void 0 || alive(lease.pid)) continue;
+		if (await removeEntry(options, lease)) {
+			dropRecord(file, lease);
+			sweep.cleaned.push(lease.folder);
+		} else sweep.failed.push(lease.folder);
+	}
+	return sweep;
+};
+// ../runtime/src/secret-file.ts
+/**
+* @file A session's private folder for files that hold a secret, such as a
+*   config carrying Ork's bearer token (RFC-014): a 0700 folder outside the
+*   checkout, under the system's temporary folder, named after the process that
+*   made it, with each file written at mode 0600. The session removes it when
+*   it ends; a folder whose process is gone (a crash) is removed when the next
+*   one is made. Nothing here logs what it writes.
+*/
+/** Where sessions' private folders live unless a caller names another place. */
+const secretRoot = () => path.join(tmpdir(), "ork-sessions");
+/** Removes the folders under `root` whose process is gone; returns them. */
+const sweepSecretFolders = (root) => {
+	let names;
+	try {
+		names = readdirSync(root);
+	} catch {
+		return [];
+	}
+	return names.flatMap((name) => {
+		const pid = Number(name.split("-")[0]);
+		if (!Number.isInteger(pid) || alive(pid)) return [];
+		const dir = path.join(root, name);
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+		return [dir];
+	});
+};
+/**
+* Refuses a root that isn't this user's own folder: in a shared temporary
+* folder another user could have made it first, or put a link there, to read or
+* swap what a session loads. One of ours that is open to others is closed.
+*/
+const holdPrivate = (root) => {
+	const held = lstatSync(root);
+	const uid = process.getuid?.();
+	if (!held.isDirectory() || uid !== void 0 && held.uid !== uid) throw new Error(`${root} is not a folder of this user's; remove it, or set TMPDIR to a private folder`);
+	if ((held.mode & 63) !== 0) chmodSync(root, 448);
+};
+/** A new private folder under `root`, after sweeping the stale ones. */
+const makeSecretFolder = (root = secretRoot()) => {
+	mkdirSync(root, {
+		recursive: true,
+		mode: 448
+	});
+	holdPrivate(root);
+	sweepSecretFolders(root);
+	const dir = mkdtempSync(path.join(root, `${String(process.pid)}-`));
+	return {
+		dir,
+		write: (name, content) => {
+			const file = path.join(dir, name);
+			writeFileSync(file, content, { mode: 384 });
+			return file;
+		},
+		remove: () => {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+};
+// ../runtime/src/adapters/claude-code-flags.ts
+/**
+* Per-request timeout for Ork's MCP server, in ms. The CLI otherwise gives an
+* HTTP server's request 60 seconds and drops a call silent for 5 minutes, and
+* `delegate` waits for whole child sessions (the per-server `timeout` raises
+* both; `MCP_TOOL_TIMEOUT` still caps it).
+*/
+const ORK_TOOL_TIMEOUT_MS = 864e5;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* The node's `--settings` with Ork's `PreToolUse` HTTP hook added: before every
+* tool call, pre-approved ones included, the session asks whether its node may
+* go on. Its `PostToolUse` hook after a Bash call frees the call's slot.
+*/
+const withHoldHook = (settings, holdUrl, token) => {
+	const hooks = isRecord(settings?.["hooks"]) ? settings["hooks"] : {};
+	const listed = (event) => {
+		const own = hooks[event];
+		return Array.isArray(own) ? [...own] : [];
+	};
+	const hook = {
+		type: "http",
+		url: holdUrl,
+		headers: { Authorization: `Bearer ${token}` },
+		timeout: 600
+	};
+	return {
+		...settings,
+		hooks: {
+			...hooks,
+			PreToolUse: [...listed("PreToolUse"), {
+				matcher: "*",
+				hooks: [hook]
+			}],
+			PostToolUse: [...listed("PostToolUse"), {
+				matcher: "Bash",
+				hooks: [hook]
+			}]
+		}
+	};
+};
+/** The session's `--mcp-config`: its servers, and Ork's with the token. */
+const mcpConfigOf = (spec, mcp) => ({ mcpServers: {
+	...spec.mcpServers,
+	["ork"]: {
+		type: "http",
+		url: mcp.url,
+		headers: { Authorization: `Bearer ${mcp.token}` },
+		timeout: ORK_TOOL_TIMEOUT_MS
+	}
+} });
+/** The session's `--settings`, with the hold hook (and its token) when held. */
+const settingsOf = (spec, mcp) => mcp.holdUrl === void 0 ? spec.settings : withHoldHook(spec.settings, mcp.holdUrl, mcp.token);
+/** The flags whose values carry Ork's token. */
+const SECRET_FLAGS = /* @__PURE__ */ new Set(["--mcp-config", "--settings"]);
+/**
+* `args` without the flags that carry Ork's token: a process's arguments can be
+* read by other users of the machine, so the session passes them as files.
+*/
+const withoutSecretFlags = (args) => args.filter((arg, at) => !SECRET_FLAGS.has(arg) && !SECRET_FLAGS.has(args[at - 1] ?? ""));
+/**
+* Writes the session's MCP config and settings into a private folder (0700,
+* each file 0600) and passes their paths; the folder goes when the session
+* ends.
+*/
+const secretFlags = {
+	kind: "flag",
+	wire: (spec, endpoint) => {
+		const folder = makeSecretFolder();
+		try {
+			const config = JSON.stringify(mcpConfigOf(spec, endpoint));
+			const args = ["--mcp-config", folder.write("mcp.json", config)];
+			const settings = settingsOf(spec, endpoint);
+			if (settings !== void 0) args.push("--settings", folder.write("settings.json", JSON.stringify(settings)));
+			return Promise.resolve({
+				args,
+				env: {},
+				release: () => {
+					folder.remove();
+					return Promise.resolve();
+				}
+			});
+		} catch (error) {
+			folder.remove();
+			throw error;
+		}
+	}
+};
+// ../runtime/src/adapters/claude-code.ts
+/** Claude Code's switch for the one-hour prompt cache. */
+const PROMPT_CACHE_1H = "ENABLE_PROMPT_CACHING_1H";
+/** Claude Code's switch that turns its auto-memory off. */
+const NO_AUTO_MEMORY = "CLAUDE_CODE_DISABLE_AUTO_MEMORY";
+/**
+* The CLI flag that moves the per-machine sections (working directory, memory
+* path, git status) out of the system prompt.
+*/
+const EXCLUDE_DYNAMIC_SECTIONS = "--exclude-dynamic-system-prompt-sections";
+/** How long a hook holds a call before it defers it instead. */
+const HOLD_WINDOW_MS = 54e4;
+/** The variables a session's prompt cache asks of Claude Code. */
+const cacheEnv = (spec) => spec.promptCache === "1h" ? { [PROMPT_CACHE_1H]: "1" } : {};
+/** Whether the session loads no MCP server but Ork's. */
+const strictMcpOf = (spec) => spec.tools.strictMcp === true || spec.machineClaude !== true;
+/** The variables that keep the machine's auto-memory out of a session. */
+const memoryEnv = (spec) => spec.machineClaude === true ? {} : { [NO_AUTO_MEMORY]: "1" };
+/** Claude Code's default timeout for a Bash call, in milliseconds. */
+const BASH_TIMEOUT = "BASH_DEFAULT_TIMEOUT_MS";
+/**
+* Ten minutes, Claude Code's own most for a Bash call. At its default of two, a
+* longer command (a typecheck of the workspace) moves to the background, and
+* the session then polls it with `sleep`, `until` or `Monitor`, which ask.
+*/
+const BASH_TIMEOUT_MS = 6e5;
+/** The variables that let a session's Bash calls run to the end in front. */
+const bashEnv = () => ({ [BASH_TIMEOUT]: String(BASH_TIMEOUT_MS) });
+/** Everything a session adds to its driver's environment. */
+const driverEnv = (spec) => ({
+	...bashEnv(),
+	...cacheEnv(spec),
+	...memoryEnv(spec)
+});
+/** A later message goes in at the next step, even mid-turn. */
+const userLine = (text, later = false) => `${JSON.stringify({
+	type: "user",
+	message: {
+		role: "user",
+		content: text
+	},
+	parent_tool_use_id: null,
+	...later ? { priority: "next" } : {}
+})}\n`;
+/** The hook's answer: nothing to say for "go", the deferral otherwise. */
+const hookOutput = (answer) => answer === "go" ? {} : { hookSpecificOutput: {
+	hookEventName: "PreToolUse",
+	permissionDecision: "defer",
+	permissionDecisionReason: "Ork paused this node; it goes on from this call when it continues."
+} };
+const claudeHold = {
+	answer: hookOutput,
+	windowMs: HOLD_WINDOW_MS
+};
+/**
+* The `claude -p` arguments for a session spec. The brief goes on stdin;
+* `allowed` are the Ork tools that need no permission prompt.
+*/
+const buildCliArgs = (spec, mcp, allowed) => {
+	const args = [
+		"-p",
+		"--input-format",
+		"stream-json",
+		"--output-format",
+		"stream-json",
+		"--verbose",
+		"--setting-sources",
+		spec.settingSources.join(","),
+		"--append-system-prompt",
+		spec.systemAppend,
+		EXCLUDE_DYNAMIC_SECTIONS,
+		"--permission-mode",
+		spec.permissionMode,
+		"--json-schema",
+		JSON.stringify(spec.reportSchema),
+		"--mcp-config",
+		JSON.stringify(mcpConfigOf(spec, mcp)),
+		"--permission-prompt-tool",
+		toolId("permission"),
+		"--allowedTools",
+		[...spec.tools.allow, ...allowed].join(",")
+	];
+	if (spec.tools.only !== void 0) args.push("--tools", spec.tools.only.join(","));
+	if (strictMcpOf(spec)) args.push("--strict-mcp-config");
+	if (spec.agents !== void 0) args.push("--agents", JSON.stringify(spec.agents));
+	if (spec.tools.deny.length > 0) args.push("--disallowedTools", spec.tools.deny.join(","));
+	if (spec.model !== void 0) args.push("--model", spec.model);
+	if (spec.effort !== void 0) args.push("--effort", spec.effort);
+	if (spec.maxTurns !== void 0) args.push("--max-turns", String(spec.maxTurns));
+	if (spec.budgetUsd !== void 0) args.push("--max-budget-usd", String(spec.budgetUsd));
+	if (spec.resume !== void 0) args.push("--resume", spec.resume);
+	if (spec.resume !== void 0 && spec.fork === true) args.push("--fork-session");
+	for (const dir of spec.plugins ?? []) args.push("--plugin-dir", dir);
+	const settings = settingsOf(spec, mcp);
+	if (settings !== void 0) args.push("--settings", JSON.stringify(settings));
+	return args;
+};
+/** `claude`, as the session runner's strategies. */
+const claudeCodeAdapter = {
+	driver: "claude-code",
+	command: {
+		bin: "claude",
+		args: (spec, leg) => withoutSecretFlags(buildCliArgs(spec, leg.endpoint, leg.allowed)),
+		input: userLine
+	},
+	decode: decodeClaudeLine,
+	legDecoder: claudeDecoder,
+	mcp: secretFlags,
+	permissions: {
+		kind: "callback",
+		denyByDefault: false
+	},
+	usage: claudeUsage,
+	context: {
+		instructions: ["CLAUDE.md", "AGENTS.md"],
+		skills: ".claude/skills",
+		agents: ".claude/agents",
+		env: driverEnv
+	},
+	hold: claudeHold
+};
+// ../runtime/src/lease.ts
+/**
+* @file The `lease` kind of `McpWiring` (RFC-014): Command Code reads MCP
+*   servers from a per-folder local scope (`~/.commandcode/projects/<slug>/`),
+*   so a session gets Ork's endpoint through an `ork` entry added there with
+*   `cmd mcp add --scope local` and removed with `cmd mcp remove` after it.
+*   Because the entry is per folder, a checkout holds one session at a time: a
+*   record in the ledger (`lease-ledger.ts`) is the lock, and a second session
+*   waits for it, and says so.
+*/
+/**
+* Command Code's folder name for a checkout, as measured on 1.88.5: its real
+* path with every character but letters and digits made `-`, the leading one
+* dropped (`/private/tmp/a b` -> `private-tmp-a-b`). Leases key on it, so two
+* folders Command Code would share also share one lease.
+*/
+const slugOf = (folder) => realpathSync(folder).replaceAll(/[^a-zA-Z0-9]/gu, "-").replace(/^-+/u, "");
+const entryFileOf = (env, slug) => path.join(env["HOME"] ?? homedir(), ".commandcode", "projects", slug, "mcp.json");
+/** Takes the record for `slug`, or returns the live lease that holds it. */
+const tryTake = (file, lease) => {
+	const draft = `${file}.${lease.id}`;
+	writeFileSync(draft, JSON.stringify(lease), { mode: 384 });
+	try {
+		linkSync(draft, file);
+		return;
+	} catch (error) {
+		if (codeOf(error) !== "EEXIST") throw error;
+		const holder = readLease(file);
+		if (holder !== void 0) return holder;
+		dropIfCorrupt(file);
+		return {
+			...lease,
+			pid: 0
+		};
+	} finally {
+		rmSync(draft, { force: true });
+	}
+};
+const masked = (text, endpoint) => maskSecrets(text.replaceAll(endpoint.token, MASK));
+/**
+* The lease's options: those given, else the runner's program, environment and
+* the project's runs folder (the ledger lives there, where `ork doctor`
+* looks).
+*/
+const optionsOf = (given, hooks) => {
+	const ledger = given.ledger ?? (hooks.runs === void 0 ? void 0 : leaseLedger(hooks.runs));
+	if (ledger === void 0) throw new Error("a Command Code session needs the project's runs folder for its lease");
+	const env = given.env ?? hooks.env;
+	return {
+		...given,
+		bin: given.bin ?? hooks.bin ?? "cmd",
+		ledger,
+		...env === void 0 ? {} : { env }
+	};
+};
+/**
+* Ork's endpoint for a Command Code session, through an `ork` entry in the
+* checkout's local scope, held for the session. A second session in the same
+* checkout waits for the first, and says so.
+*/
+const leaseWiring = (given) => ({
+	kind: "lease",
+	wire: async (spec, endpoint, hooks) => {
+		const options = optionsOf(given, hooks);
+		const env = options.env ?? process.env;
+		const slug = slugOf(spec.cwd);
+		const file = path.join(options.ledger, `${slug}.json`);
+		const lease = {
+			id: randomUUID(),
+			folder: realpathSync(spec.cwd),
+			pid: process.pid,
+			entry: entryFileOf(env, slug)
+		};
+		const fail = (message) => {
+			dropRecord(file, lease);
+			throw new Error(masked(message, endpoint));
+		};
+		mkdirSync(options.ledger, {
+			recursive: true,
+			mode: 448
+		});
+		await cleanStaleLeases(options);
+		let told = false;
+		for (;;) {
+			const holder = tryTake(file, lease);
+			if (holder === void 0) break;
+			if (alive(holder.pid)) {
+				if (!told) {
+					hooks.waiting(`waiting for ${lease.folder}: Command Code runs one session per checkout`);
+					told = true;
+				}
+				await setTimeout$1(options.pollMs ?? 1e3, void 0, { signal: hooks.signal });
+			} else {
+				const { failed } = await cleanStaleLeases(options);
+				if (failed.includes(holder.folder)) fail(`could not remove the \`ork\` MCP entry a stopped session left in ${holder.folder}; run \`ork doctor\``);
+			}
+		}
+		const existing = await runCmd(options, [
+			"mcp",
+			"get",
+			"ork"
+		], lease.folder);
+		if (existing.ok && /Scope:\s+local/u.test(existing.out)) fail(`Command Code already has an \`ork\` MCP entry for ${lease.folder}; remove it with \`cmd mcp remove --scope local ork\` there`);
+		const added = await runCmd(options, [
+			"mcp",
+			"add",
+			"--transport",
+			"http",
+			"--scope",
+			"local",
+			"ork",
+			endpoint.url,
+			"--header",
+			`Authorization: Bearer ${endpoint.token}`
+		], lease.folder);
+		if (!added.ok) fail(`cmd mcp add failed: ${added.out}`);
+		return {
+			args: [],
+			env: {},
+			release: async () => {
+				if (await removeEntry(options, lease)) {
+					dropRecord(file, lease);
+					return;
+				}
+				const draft = `${file}.${lease.id}`;
+				writeFileSync(draft, JSON.stringify({
+					...lease,
+					pid: 0
+				}), { mode: 384 });
+				renameSync(draft, file);
+			}
+		};
+	}
+});
+// ../runtime/src/adapters/command-code-events.ts
+/**
+* @file The `command-code` adapter's `LegDecoder` and `UsageReader`: maps
+*   Command Code's `--output-format json` lines (`{"type":"event"}` frames,
+*   then one `{"type":"result"}` line; measured on 1.88.5,
+*   specs/architecture.md, "Command Code") to Ork's runtime events. Tool names
+*   are given Ork's (Claude Code's) names, so logs and the node's rules read
+*   the same on every driver. One decoder reads one leg: the session id comes
+*   in an early `run_start` frame and the result line counts no turns, so it
+*   keeps both. The result line is held until the process exits: its exit code
+*   says how the session ended (specs/architecture/command-code.md).
+*/
+const isObject$1 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const num$1 = (value) => typeof value === "number" ? value : 0;
+const str$1 = (value) => typeof value === "string" ? value : "";
+/** Command Code's own tool names, as Ork (and Claude Code) names them. */
+const COMMAND_CODE_TOOLS = {
+	shell: "Bash",
+	shell_command: "Bash",
+	read_file: "Read",
+	read_multiple_files: "Read",
+	read_directory: "Read",
+	glob: "Glob",
+	grep: "Grep",
+	edit_file: "Edit",
+	write_file: "Write",
+	web_fetch: "WebFetch",
+	web_search: "WebSearch",
+	agent: "Task"
+};
+/** A tool's name as Ork shows it; MCP and unknown names stay as they are. */
+const orkToolName = (name) => COMMAND_CODE_TOOLS[name] ?? name;
+/** The result line's subtypes, as Ork's outcome names them. */
+const SUBTYPES = {
+	success: "success",
+	max_turns: "error_max_turns",
+	error: "error_during_execution"
+};
+/**
+* Command Code's exit codes, by the kind they mean; 0 is a session that ended
+* well and 1 an error its text explains.
+*/
+const COMMAND_CODE_EXITS = {
+	3: "auth",
+	4: "auth",
+	5: "rate_limited",
+	6: "provider_unavailable",
+	7: "provider_unavailable",
+	8: "turn_limit",
+	9: "provider_unavailable",
+	10: "out_of_credits",
+	130: "interrupted"
+};
+/** What a leg's exit code and result line say went wrong, if anything. */
+const signalOf = (code, error) => {
+	const kind = code === null ? void 0 : COMMAND_CODE_EXITS[code];
+	if (kind !== void 0) return endFor(kind, {}, error);
+	if ((code === 0 || code === null) && error === "") return null;
+	return errorEnd(error);
+};
+/** The text blocks of a `message_end` frame's content. */
+const textOf = (content) => (Array.isArray(content) ? content : []).filter((item) => isObject$1(item)).filter((block) => block["type"] === "text").map((block) => str$1(block["text"])).join("");
+/** The frames that end a tool call as an error: failed, denied, or blocked. */
+const REFUSED = /* @__PURE__ */ new Set([
+	"tool_errored",
+	"tool_denied",
+	"tool_hook_blocked"
+]);
+const parseLine$1 = (line) => {
+	try {
+		return JSON.parse(line);
+	} catch {
+		return;
+	}
+};
+/**
+* A decoder for one leg of a Command Code session; its end comes at the exit,
+* from the held result line and the exit code.
+*/
+const commandCodeDecoder = () => {
+	let sessionId = "";
+	let turns = 0;
+	let held;
+	/** The leg's tokens so far, from each `model_request_end` frame. */
+	let used;
+	/** A model request's usage, added to the leg's so far. */
+	const requestEnded = (usage) => {
+		const said = isObject$1(usage) ? usage : {};
+		const own = {
+			costUsd: 0,
+			inputTokens: num$1(said["inputTokens"]),
+			outputTokens: num$1(said["outputTokens"]),
+			cacheReadTokens: num$1(said["cacheReadTokens"]),
+			cacheWriteTokens: num$1(said["cacheWriteTokens"]),
+			turns,
+			durationMs: 0
+		};
+		used = used === void 0 ? own : {
+			...addUsage(used, own),
+			turns
+		};
+		return used;
+	};
+	const frame = (event) => {
+		const type = event["type"];
+		const id = str$1(event["toolCallId"]);
+		const name = orkToolName(str$1(event["toolName"]));
+		if (type === "run_start") {
+			sessionId = str$1(event["sessionId"]);
+			return [{
+				type: "session.started",
+				sessionId,
+				model: ""
+			}];
+		}
+		if (type === "turn_start") turns += 1;
+		if (type === "message_end") {
+			const text = textOf(event["content"]);
+			return text.trim() === "" ? [] : [{
+				type: "assistant.text",
+				text
+			}];
+		}
+		if (type === "tool_queued") {
+			const input = event["input"];
+			return [{
+				type: "tool.called",
+				id,
+				name,
+				input: isObject$1(input) ? input : {}
+			}];
+		}
+		if (type === "tool_completed") return [{
+			type: "tool.result",
+			id,
+			isError: false
+		}];
+		if (typeof type === "string" && REFUSED.has(type)) return [{
+			type: "tool.result",
+			id,
+			isError: true
+		}];
+		return [];
+	};
+	const result = (line, code) => {
+		const usage = isObject$1(line["usage"]) ? line["usage"] : {};
+		const error = str$1(line["error"]);
+		const subtype = str$1(line["subtype"]);
+		const signal = subtype === "max_turns" ? endFor("turn_limit", {}, error) : signalOf(code, error);
+		return {
+			type: "session.finished",
+			outcome: {
+				subtype: SUBTYPES[subtype] ?? "error_during_execution",
+				end: signal ?? endFor("no_report"),
+				sessionId: str$1(line["sessionId"]) || sessionId,
+				report: null,
+				text: str$1(line["finalText"]),
+				usage: {
+					costUsd: 0,
+					inputTokens: num$1(usage["inputTokens"]),
+					outputTokens: num$1(usage["outputTokens"]),
+					cacheReadTokens: num$1(usage["cacheReadTokens"]),
+					cacheWriteTokens: num$1(usage["cacheWriteTokens"]),
+					turns,
+					durationMs: num$1(line["durationMs"])
+				},
+				errors: error === "" ? [] : [error]
+			}
+		};
+	};
+	return {
+		decode: (line) => {
+			const message = parseLine$1(line);
+			if (!isObject$1(message)) return { events: [] };
+			if (message["type"] === "result") {
+				held = message;
+				return { events: [] };
+			}
+			const event = message["event"];
+			if (message["type"] !== "event" || !isObject$1(event)) return { events: [] };
+			return {
+				events: frame(event),
+				...event["type"] === "model_request_end" ? { usage: requestEnded(event["usage"]) } : {}
+			};
+		},
+		exit: (code) => {
+			if (held !== void 0) return [result(held, code)];
+			return (code === null ? void 0 : COMMAND_CODE_EXITS[code]) === void 0 ? [] : [result({ error: "" }, code)];
+		}
+	};
+};
+/** Command Code reports tokens, never dollars. */
+const commandCodeUsage = {
+	dollars: false,
+	combine: (a, b) => addUsage(a, b)
+};
+// ../runtime/src/adapters/command-code-mod.ts
+/**
+* @file The Command Code mod that holds a session to its node's tool rules
+*   (RFC-014, deny by default). Command Code takes permission rules only from
+*   settings files (the user's, and two in the checkout), so Ork runs it with
+*   `--permission-mode yolo` and loads, with `--mod`, a mod written for the
+*   session outside the checkout: its `beforeToolCall` hook blocks every call
+*   the node did not allow. Ork's own tools (`mcp__ork__*`) always go through.
+*   Command Code's tool loader passes, and reads inside the worktree need no
+*   rule, as with Claude Code; one reaching outside it (by its real path, links
+*   followed) does. The rules are the node's, in Claude Code's words
+*   (`Bash(git:*)`, `Read`, `mcp__github`); a specifier Ork does not read never
+*   allows a call and always denies one. A shell line is checked command by
+*   command: each must be allowed, and one with a substitution Ork can't read
+*   is allowed only by a plain `Bash` rule.
+*/
+/** The rules of a session: an `acceptEdits` node may edit without a rule. */
+const modRules = (spec) => ({
+	cwd: spec.cwd,
+	allow: [...spec.tools.allow, ...spec.permissionMode === "acceptEdits" ? ["Edit"] : []],
+	deny: spec.tools.deny,
+	...spec.tools.only === void 0 ? {} : { only: spec.tools.only }
+});
+/**
+* The mod's source. It is plain JavaScript that Command Code loads (a default
+* export taking the mod API), so it carries its own matcher.
+*/
+const modSource = (rules) => `// Ork's rules for one session; written by Ork, removed after it.
+import { realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
+const RULES = ${JSON.stringify(rules)};
+// Command Code's own: loading a deferred tool's schema, Ork's report included.
+const META = new Set(["search_tools", "tool_search"]);
+// Reads a session makes in its worktree without a rule, as Claude Code does.
+const READS = new Set(["read_file", "read_multiple_files", "read_directory", "glob", "grep"]);
+// A read's paths: every value of a path-like key, and any other string that
+// looks like a path out (absolute, from the home folder, or climbing with ..).
+const looksOut = text => isAbsolute(text) || text.startsWith("~") || text.split("/").includes("..");
+const pathsOf = input => Object.entries(input ?? {})
+  .flatMap(([key, value]) => (Array.isArray(value) ? value : [value]).map(each => [key, each]))
+  .filter(([key, value]) => typeof value === "string" && (/path|file|dir/i.test(key) || looksOut(value)))
+  .map(([, value]) => value);
+// Where a path really is: the nearest folder of it that exists, with its links
+// followed, and the rest of the path on top.
+const real = at => {
+  const rest = [];
+  for (let here = at; ; here = dirname(here)) {
+    try {
+      return resolve(realpathSync(here), ...rest.reverse());
+    } catch {
+      if (dirname(here) === here) return at;
+      rest.push(basename(here));
+    }
+  }
+};
+const ROOT = real(RULES.cwd);
+const inside = input => pathsOf(input).every(each => {
+  if (each.startsWith("~")) return false;
+  const from = relative(ROOT, real(resolve(RULES.cwd, each)));
+  return from === "" || (from !== ".." && !from.startsWith("../") && !isAbsolute(from));
+});
+const TOOLS = ${JSON.stringify(COMMAND_CODE_TOOLS)};
+// A rule's word, as Command Code reads it, covers these of Ork's tool names.
+const COVERS = { read: ["Read", "Glob", "Grep"], edit: ["Edit", "Write"] };
+const norm = text => text.trim().replace(/\\s+/g, " ");
+const split = rule => {
+  const at = rule.indexOf("(");
+  return at < 0 || !rule.endsWith(")")
+    ? { token: rule.trim() }
+    : { token: rule.slice(0, at).trim(), spec: rule.slice(at + 1, -1) };
+};
+// The simple commands of a shell line, split at ; & | && || and line breaks
+// outside quotes. null when Ork can't read it: a command or process
+// substitution, an unclosed quote, or nothing at all.
+const TICK = String.fromCharCode(96);
+const BACKSLASH = String.fromCharCode(92);
+const shellParts = line => {
+  const parts = [];
+  let part = "";
+  let quote = null;
+  for (let i = 0; i < line.length; i += 1) {
+    const ch = line[i];
+    const next = line[i + 1];
+    if (quote === "'") {
+      part += ch;
+      if (ch === "'") quote = null;
+      continue;
+    }
+    if (ch === BACKSLASH) {
+      part += ch + (next ?? "");
+      i += 1;
+      continue;
+    }
+    if (ch === TICK || (ch === "$" && next === "(")) return null;
+    if (quote === '"') {
+      part += ch;
+      if (ch === '"') quote = null;
+      continue;
+    }
+    if ((ch === "<" || ch === ">") && next === "(") return null;
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      part += ch;
+      continue;
+    }
+    // Writing a file is an edit, so output goes only to /dev/null or to
+    // another stream (2>&1); any other target makes the line one Ork can't read.
+    if (ch === ">") {
+      let j = i + 1;
+      if (line[j] === ">" || line[j] === "|") j += 1;
+      if (line[j] === "&") {
+        if (!/[0-9-]/.test(line[j + 1] ?? "")) return null;
+        part += line.slice(i, j + 2);
+        i = j + 1;
+        continue;
+      }
+      while (line[j] === " " || line[j] === "\\t") j += 1;
+      let k = j;
+      while (k < line.length && !" \\t;&|<>\\n\\r".includes(line[k])) k += 1;
+      if (line.slice(j, k) !== "/dev/null") return null;
+      part += line.slice(i, k);
+      i = k - 1;
+      continue;
+    }
+    // 2>&1 and &> are redirections, not a command's end.
+    const redirect = ch === "&" && (next === ">" || line[i - 1] === ">" || line[i - 1] === "<");
+    if (!redirect && (ch === ";" || ch === "&" || ch === "|" || ch === "\\n" || ch === "\\r")) {
+      parts.push(part);
+      part = "";
+      continue;
+    }
+    part += ch;
+  }
+  if (quote !== null) return null;
+  parts.push(part);
+  const commands = parts.map(norm).filter(each => each !== "");
+  return commands.length === 0 ? null : commands;
+};
+// The calls a rule is checked against: a shell line's simple commands, each
+// alone; one Ork can't read has no command, so only a plain rule covers it.
+const callsOf = (name, input) => {
+  if ((TOOLS[name] ?? name) !== "Bash" || typeof input?.command !== "string") return [input];
+  const parts = shellParts(input.command);
+  return parts === null ? [{}] : parts.map(command => ({ ...input, command }));
+};
+const shellMatches = (command, pattern) => {
+  let p = norm(pattern);
+  const c = norm(command);
+  if (p.endsWith(":*")) p = p.slice(0, -2) + " *";
+  if (!p.endsWith(" *")) return c === p;
+  const head = p.slice(0, -2);
+  return c === head || c.startsWith(head + " ");
+};
+// true: the rule covers the call; false: it does not; null: Ork can't tell.
+const matches = (rule, name, input) => {
+  const { token, spec } = split(rule);
+  if (token.startsWith("mcp__")) {
+    const rest = token.slice(5);
+    const at = rest.indexOf("__");
+    if (at < 0) return name.startsWith("mcp__" + rest + "__");
+    const tool = rest.slice(at + 2);
+    return tool === "*" ? name.startsWith("mcp__" + rest.slice(0, at) + "__") : name === token;
+  }
+  const ork = TOOLS[name] ?? name;
+  const word = token.toLowerCase();
+  const covered = (COVERS[word] ?? [token]).some(each => each.toLowerCase() === ork.toLowerCase());
+  if (!covered && name !== token) return false;
+  if (spec === undefined || spec === "" || spec === "*") return true;
+  if (ork === "Bash" && typeof input?.command === "string") return shellMatches(input.command, spec);
+  return null;
+};
+// A deny covers a shell line when it covers any of its commands; an allow,
+// only when every command is covered by one rule or another.
+const anyDenied = (name, calls) =>
+  calls.some(call => RULES.deny.some(rule => matches(rule, name, call) !== false));
+const allCovered = (rules, name, calls) =>
+  calls.every(call => rules.some(rule => matches(rule, name, call) === true));
+export const decide = (name, input) => {
+  const calls = callsOf(name, input);
+  if (anyDenied(name, calls)) return "denied for this node";
+  if (name.startsWith("mcp__ork__") || META.has(name)) return undefined;
+  if (RULES.only !== undefined && !allCovered(RULES.only, name, calls)) {
+    return "not one of this node's tools";
+  }
+  if (READS.has(name) && inside(input)) return undefined;
+  if (allCovered(RULES.allow, name, calls)) return undefined;
+  return "not allowed for this node";
+};
+export default cc => {
+  cc.hooks({
+    beforeToolCall: async call => {
+      const why = decide(call.toolName, call.input);
+      return why === undefined
+        ? undefined
+        : { block: true, additionalContext: "Ork: " + call.toolName + " is " + why + ". Do not retry it." };
+    },
+  });
+};
+`;
+/**
+* Writes a session's mod outside the checkout (a fresh folder under the
+* system's temp folder, 0700, the file 0600); it holds no secret.
+*/
+const writeMod = (spec) => {
+	const dir = mkdtempSync(path.join(tmpdir(), "ork-cmd-mod-"));
+	const file = path.join(dir, "ork-rules.mjs");
+	writeFileSync(file, modSource(modRules(spec)), { mode: 384 });
+	return {
+		file,
+		remove: () => {
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+		}
+	};
+};
+// ../runtime/src/adapters/command-code.ts
+/**
+* The brief, with Ork's instructions before it on a session's first leg:
+* Command Code has no flag that adds to its system prompt. A resumed leg's
+* session already holds them.
+*/
+const queryOf = (spec) => {
+	const text = spec.resume === void 0 ? `${spec.systemAppend}\n\n${spec.prompt}` : spec.prompt;
+	return text.startsWith("-") ? ` ${text}` : text;
+};
+/**
+* The `cmd` arguments for a session spec. `--dangerously-skip-permissions`: in
+* `-p` mode only it lifts Command Code's own gate on edits and shell (the
+* permission mode alone does not), so the session's mod, which refuses what the
+* node did not allow, is the only gate.
+*/
+const commandCodeArgs = (spec) => {
+	const args = [
+		"-p",
+		queryOf(spec),
+		"--output-format",
+		"json",
+		"--permission-mode",
+		"yolo",
+		"--dangerously-skip-permissions",
+		"--skip-onboarding",
+		"--no-auto-update"
+	];
+	if (spec.model !== void 0) args.push("--model", spec.model);
+	if (spec.effort !== void 0) args.push("--effort", spec.effort);
+	if (spec.maxTurns !== void 0) args.push("--max-turns", String(spec.maxTurns));
+	if (spec.resume !== void 0) args.push("--resume", spec.resume);
+	if (spec.resume !== void 0 && spec.fork === true) args.push("--fork-session");
+	return args;
+};
+const lease = leaseWiring({});
+/** `cmd`, as the session runner's strategies. */
+const commandCodeAdapter = {
+	driver: "command-code",
+	command: {
+		bin: "cmd",
+		args: (spec) => commandCodeArgs(spec)
+	},
+	decode: (line) => commandCodeDecoder().decode(line),
+	legDecoder: () => commandCodeDecoder(),
+	mcp: {
+		kind: "lease",
+		wire: async (spec, endpoint, hooks) => {
+			const wired = await lease.wire(spec, endpoint, hooks);
+			try {
+				const mod = writeMod(spec);
+				return {
+					args: [
+						...wired.args,
+						"--mod",
+						mod.file
+					],
+					env: wired.env,
+					release: async () => {
+						mod.remove();
+						await wired.release();
+					}
+				};
+			} catch (error) {
+				await wired.release();
+				throw error;
+			}
+		}
+	},
+	permissions: {
+		kind: "rules",
+		denyByDefault: true
+	},
+	usage: commandCodeUsage,
+	context: {
+		instructions: ["AGENTS.md"],
+		skills: ".commandcode/skills",
+		agents: ".commandcode/agents",
+		env: () => ({})
+	}
+};
+/** Claude Code tool names, as OpenCode's permission actions. */
+const ACTIONS = {
+	Read: "read",
+	Glob: "glob",
+	Grep: "grep",
+	Edit: "edit",
+	Write: "edit",
+	MultiEdit: "edit",
+	NotebookEdit: "edit",
+	Bash: "shell",
+	WebFetch: "webfetch",
+	WebSearch: "websearch",
+	Task: "subagent",
+	Agent: "subagent",
+	Skill: "skill",
+	TodoWrite: "todowrite"
+};
+const BUILT_IN = new Set(Object.values(ACTIONS));
+/**
+* Actions whose resource is a path. OpenCode matches it relative to the
+* worktree (an absolute path inside it too), `*` across folders, and asks
+* `external_directory`, denied first, for any path outside it.
+*/
+const PATH_ACTIONS = /* @__PURE__ */ new Set(["read", "edit"]);
+/** A rule's path as OpenCode matches it: relative to the worktree. */
+const pathResource = (spec, cwd) => {
+	return (path.isAbsolute(spec) ? path.relative(cwd, spec) : spec).replace(/^\.\//u, "") || "*";
+};
+/** OpenCode's name for an MCP server's tool: other characters become `_`. */
+const mcpAction = (server, tool) => `${server}_${tool}`.replaceAll(/[^A-Za-z0-9_*-]/gu, "_");
+/** A shell rule's resource: Claude Code's `git status:*` is `git status *`. */
+const shellResource = (spec) => spec.replace(/:\*$/u, " *");
+/**
+* One Claude Code rule (`Bash(git status:*)`, `Edit`, `mcp__github__*`) as an
+* OpenCode rule, or none for a tool OpenCode has no action for (still denied).
+*/
+const ruleOf = (rule, effect, cwd) => {
+	const match = /^([^()]+)(?:\((.*)\))?$/su.exec(rule.trim());
+	if (match === null) return void 0;
+	const [, name = "", spec] = match;
+	const mcp = /^mcp__([^_]+(?:_[^_]+)*)(?:__(.*))?$/u.exec(name);
+	if (mcp !== null) {
+		const [, server = "", tool] = mcp;
+		return {
+			action: mcpAction(server, tool ?? "*"),
+			resource: "*",
+			effect
+		};
+	}
+	const action = ACTIONS[name];
+	if (action === void 0) return void 0;
+	if (spec !== void 0) return {
+		action,
+		resource: action === "shell" ? shellResource(spec) : PATH_ACTIONS.has(action) ? pathResource(spec, cwd) : spec,
+		effect
+	};
+	return {
+		action,
+		resource: "*",
+		effect
+	};
+};
+const rulesOf = (rules, effect, cwd) => rules.flatMap((rule) => ruleOf(rule, effect, cwd) ?? []);
+/** An action allowed anywhere in the worktree; outside it is denied. */
+const worktree = (action) => ({
+	action,
+	resource: "*",
+	effect: "allow"
+});
+/**
+* The session's rules, in order: deny everything; read in the worktree (as
+* Claude Code reads without asking); edits there under `acceptEdits`; the
+* node's allows (only its `only` tools, if it names them); Ork's tools; then
+* `.env` reads, plan mode's edits and shell, and the node's denies, refused.
+*/
+const permissionRules = (spec) => {
+	const { cwd, tools } = spec;
+	const only = tools.only === void 0 ? void 0 : new Set(rulesOf(tools.only, "allow", cwd).map((r) => r.action));
+	const inOnly = (rule) => only === void 0 || only.has(rule.action) || !BUILT_IN.has(rule.action);
+	return [
+		{
+			action: "*",
+			resource: "*",
+			effect: "deny"
+		},
+		...[
+			worktree("read"),
+			...spec.permissionMode === "acceptEdits" ? [worktree("edit")] : [],
+			...rulesOf(tools.allow, "allow", cwd)
+		].filter((rule) => inOnly(rule)),
+		...ORK_TOOLS.map((tool) => ({
+			action: mcpAction("ork", tool.name),
+			resource: "*",
+			effect: "allow"
+		})),
+		{
+			action: "read",
+			resource: "*.env",
+			effect: "deny"
+		},
+		...spec.permissionMode === "plan" ? ["edit", "shell"].map((action) => ({
+			action,
+			resource: "*",
+			effect: "deny"
+		})) : [],
+		...rulesOf(tools.deny, "deny", cwd)
+	];
+};
+/**
+* A `.mcp.json` entry as an OpenCode server: `local` with a command, else
+* `remote`.
+*/
+const serverOf = (entry) => {
+	const { command, args, env, url, headers } = entry;
+	const listed = Array.isArray(args) ? args.map(String) : [];
+	return typeof command === "string" ? {
+		type: "local",
+		command: [command, ...listed],
+		...env === void 0 ? {} : { environment: env },
+		codemode: false
+	} : {
+		type: "remote",
+		url,
+		oauth: false,
+		codemode: false,
+		headers
+	};
+};
+/**
+* The node's servers, refusing one named `ork` or `ork_<x>`: OpenCode names a
+* tool `<server>_<tool>`, so its tools could pass for Ork's `ork_<tool>`. The
+* error names the server only, never its env or headers.
+*/
+const nodeServers = (spec) => Object.entries(spec.mcpServers ?? {}).map(([name, entry]) => {
+	if (name === "ork" || name.startsWith(`ork_`)) throw new Error(`the MCP server \`${name}\` can't load under OpenCode: the name \`ork\` and the prefix \`ork_\` are reserved for Ork's tools; rename it in .mcp.json`);
+	return [name, serverOf(entry)];
+});
+/** The whole config file for one session. */
+const sessionConfig = (spec, endpoint, instructions) => ({
+	instructions: [instructions],
+	mcp: { servers: {
+		...Object.fromEntries(nodeServers(spec)),
+		["ork"]: {
+			type: "remote",
+			url: endpoint.url,
+			oauth: false,
+			codemode: false,
+			headers: { Authorization: `Bearer ${endpoint.token}` }
+		}
+	} },
+	permissions: permissionRules(spec),
+	agents: { ["ork"]: {
+		mode: "primary",
+		...spec.maxTurns === void 0 ? {} : { steps: spec.maxTurns }
+	} }
+});
+// ../runtime/src/adapters/open-code-events.ts
+/**
+* @file The `open-code` adapter's decoder and usage reader. `opencode run
+*   --format json` prints one JSON object per line, `{type, timestamp,
+*   sessionID, part}` (2.1.0, read from its source): `step_start`, `text`,
+*   `tool_use` (a finished call, `state.status` `completed` or `error`),
+*   `step_finish` (`cost` in dollars, `tokens`) and `error`. There is no result
+*   line: the last `text` is the final text and the process's exit ends the
+*   session. Tool names come back in Claude Code's words (`shell` is `Bash`,
+*   `ork_report` is `mcp__ork__report`), the words a node's rules use.
+*/
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const get = (value, key) => isObject(value) ? value[key] : void 0;
+const num = (value) => typeof value === "number" ? value : 0;
+const str = (value) => typeof value === "string" ? value : "";
+/** OpenCode's built-in tools, by Claude Code's names. */
+const TOOL_NAMES = {
+	shell: "Bash",
+	read: "Read",
+	edit: "Edit",
+	write: "Write",
+	patch: "Edit",
+	glob: "Glob",
+	grep: "Grep",
+	webfetch: "WebFetch",
+	websearch: "WebSearch",
+	subagent: "Task",
+	skill: "Skill",
+	todowrite: "TodoWrite"
+};
+const ORK_PREFIX = `ork_`;
+/** A tool's name as a node's rules and Ork's views say it. */
+const toolName = (name) => TOOL_NAMES[name] ?? (name.startsWith(ORK_PREFIX) ? toolId(name.slice(ORK_PREFIX.length)) : name);
+const parseLine = (line) => {
+	try {
+		return JSON.parse(line);
+	} catch {
+		return;
+	}
+};
+/** One `step_finish`'s spending, as a whole session's of one turn. */
+const stepUsage = (part) => {
+	const tokens = get(part, "tokens");
+	const cache = get(tokens, "cache");
+	return {
+		costUsd: num(get(part, "cost")),
+		inputTokens: num(get(tokens, "input")),
+		outputTokens: num(get(tokens, "output")) + num(get(tokens, "reasoning")),
+		cacheReadTokens: num(get(cache, "read")),
+		cacheWriteTokens: num(get(cache, "write")),
+		turns: 1,
+		durationMs: 0
+	};
+};
+/** Two spans of one session, as one: OpenCode reports each step's own cost. */
+const sumUsage = (a, b) => ({
+	costUsd: a.costUsd + b.costUsd,
+	inputTokens: a.inputTokens + b.inputTokens,
+	outputTokens: a.outputTokens + b.outputTokens,
+	cacheReadTokens: a.cacheReadTokens + b.cacheReadTokens,
+	cacheWriteTokens: a.cacheWriteTokens + b.cacheWriteTokens,
+	turns: a.turns + b.turns,
+	durationMs: a.durationMs + b.durationMs
+});
+const openCodeUsage = {
+	dollars: true,
+	combine: sumUsage
+};
+const NONE = {
+	costUsd: 0,
+	inputTokens: 0,
+	outputTokens: 0,
+	cacheReadTokens: 0,
+	cacheWriteTokens: 0,
+	turns: 0,
+	durationMs: 0
+};
+/** One finished tool call: its call and its result. */
+const toolEvents = (part) => {
+	const id = str(get(part, "id")) || str(get(part, "partID"));
+	const state = get(part, "state");
+	const input = get(state, "input");
+	return [{
+		type: "tool.called",
+		id,
+		name: toolName(str(get(part, "tool"))),
+		input: isObject(input) ? input : {}
+	}, {
+		type: "tool.result",
+		id,
+		isError: get(state, "status") === "error"
+	}];
+};
+/** What one line says by itself: text and finished tool calls. */
+const decodeOpenCodeLine = (line) => {
+	const message = parseLine(line);
+	const part = get(message, "part");
+	switch (get(message, "type")) {
+		case "text": {
+			const said = str(get(part, "text"));
+			return { events: said.trim() === "" ? [] : [{
+				type: "assistant.text",
+				text: said
+			}] };
+		}
+		case "tool_use": return { events: toolEvents(part) };
+		default: return { events: [] };
+	}
+};
+/** An `error` line's words, for the session's errors. */
+const errorText = (error) => str(get(get(error, "data"), "message")) || str(get(error, "message")) || str(get(error, "name")) || "error";
+/** An `error` line's end: its name, status and body, through the classifier. */
+const errorLineEnd = (error) => {
+	const data = get(error, "data");
+	const status = get(data, "statusCode");
+	const said = [
+		str(get(error, "name")),
+		errorText(error),
+		str(get(data, "responseBody"))
+	].filter((part) => part !== "").join("\n");
+	return errorEnd(said, "unknown", typeof status === "number" ? status : void 0);
+};
+/** The exit code OpenCode gives an interrupted session. */
+const INTERRUPTED = 130;
+/**
+* A decoder for one leg of a session: it starts the session at the first line
+* that names it, and keeps the last text, the steps' usage and the errors for
+* the end. OpenCode prints nothing at its step cap (`steps`, the node's
+* `maxTurns`): a session that used every step and handed in no report reached
+* its turn limit, which the runner settles once it knows the report.
+*/
+const openCodeDecoder = (spec) => {
+	const began = Date.now();
+	let sessionId = "";
+	let text = "";
+	let usage = NONE;
+	const errors = [];
+	let failed = null;
+	return {
+		decode: (line) => {
+			const message = parseLine(line);
+			if (!isObject(message)) return { events: [] };
+			const events = [];
+			if (sessionId === "" && str(message["sessionID"]) !== "") {
+				sessionId = str(message["sessionID"]);
+				events.push({
+					type: "session.started",
+					sessionId,
+					model: spec.model ?? "default",
+					cwd: spec.cwd
+				});
+			}
+			const said = decodeOpenCodeLine(line).events;
+			events.push(...said);
+			const last = said.findLast((event) => event.type === "assistant.text");
+			if (last !== void 0) text = last.text;
+			switch (message["type"]) {
+				case "step_finish":
+					usage = sumUsage(usage, stepUsage(message["part"]));
+					return {
+						events,
+						usage
+					};
+				case "error":
+					errors.push(errorText(message["error"]));
+					failed ??= errorLineEnd(message["error"]);
+			}
+			return { events };
+		},
+		exit: (code) => {
+			const interrupted = code === INTERRUPTED;
+			if (code !== 0 && errors.length === 0 && !interrupted) return [];
+			const capped = spec.maxTurns !== void 0 && usage.turns >= spec.maxTurns;
+			const end = interrupted ? endFor("interrupted", {}, errors.join("\n")) : failed ?? endFor(capped ? "turn_limit" : "no_report");
+			return [{
+				type: "session.finished",
+				outcome: {
+					subtype: code === 0 ? "success" : "error_during_execution",
+					end,
+					sessionId,
+					report: null,
+					text,
+					usage: {
+						...usage,
+						durationMs: Date.now() - began
+					},
+					errors
+				}
+			}];
+		}
+	};
+};
+// ../runtime/src/adapters/open-code.ts
+/**
+* @file The `open-code` adapter: the user's own `opencode run` (2.1.0), on a
+*   private server (`--standalone`; the background service would ignore the
+*   session's environment), started in the node's worktree, which pins its
+*   working folder. Ork's endpoint, the permission rules and the `ork` agent go
+*   in a config file named by `OPENCODE_CONFIG` (the `config-file` wiring),
+*   written at 0600 in a private folder outside the checkout and removed after
+*   the session (`secret-file.ts`). The machine's and the project's OpenCode
+*   config stay out: `XDG_CONFIG_HOME` is an empty folder beside the file, and
+*   the project's config is switched off. The brief and each later message are
+*   the message argument of a leg; a message waits for the next leg, which
+*   continues the session. Never `--auto`: it approves what no rule denies.
+*/
+/** The `opencode run` arguments for one leg; the message is the last one. */
+const openCodeArgs = (spec) => [
+	"run",
+	"--standalone",
+	"--format",
+	"json",
+	"--agent",
+	"ork",
+	...spec.model === void 0 ? [] : ["--model", spec.model],
+	...spec.resume === void 0 ? [] : ["--session", spec.resume],
+	...spec.resume !== void 0 && spec.fork === true ? ["--fork"] : [],
+	spec.prompt.startsWith("-") ? ` ${spec.prompt}` : spec.prompt
+];
+/**
+* What keeps the machine's and the project's own OpenCode setup out, and
+* OpenCode's reading of `.claude/` and `CLAUDE.md` (RFC-014 open question 3).
+*/
+const OPEN_CODE_ENV = {
+	OPENCODE_DISABLE_PROJECT_CONFIG: "1",
+	OPENCODE_DISABLE_CLAUDE_CODE: "1",
+	OPENCODE_DISABLE_CLAUDE_CODE_SKILLS: "1",
+	OPENCODE_CONFIG_DIR: "",
+	OPENCODE_CONFIG_CONTENT: ""
+};
+/** The config file, Ork's instructions and an empty config home, per session. */
+const configFile = (root) => ({
+	kind: "config-file",
+	wire: (spec, endpoint) => {
+		const folder = makeSecretFolder(root);
+		try {
+			const instructions = folder.write("ork.md", spec.systemAppend);
+			const config = folder.write("opencode.json", JSON.stringify(sessionConfig(spec, endpoint, instructions)));
+			const home = path.join(folder.dir, "config");
+			mkdirSync(home, { mode: 448 });
+			return Promise.resolve({
+				args: [],
+				env: {
+					OPENCODE_CONFIG: config,
+					XDG_CONFIG_HOME: home
+				},
+				release: () => {
+					folder.remove();
+					return Promise.resolve();
+				}
+			});
+		} catch (error) {
+			folder.remove();
+			throw error;
+		}
+	}
+});
+/** `opencode`, as the session runner's strategies. */
+const createOpenCodeAdapter = (options = {}) => ({
+	driver: "open-code",
+	command: {
+		bin: "opencode",
+		args: openCodeArgs
+	},
+	decode: decodeOpenCodeLine,
+	legDecoder: openCodeDecoder,
+	mcp: configFile(options.secretRoot ?? secretRoot()),
+	permissions: {
+		kind: "rules",
+		denyByDefault: true
+	},
+	usage: openCodeUsage,
+	context: {
+		instructions: ["AGENTS.md"],
+		skills: ".opencode/skills",
+		agents: ".opencode/agents",
+		env: () => OPEN_CODE_ENV
+	}
+});
+const openCodeAdapter = createOpenCodeAdapter();
+// ../runtime/src/registry.ts
+/** The message a session on a driver with no adapter yet ends with. */
+const notBuiltYet = (driver) => `The ${driver} driver is not built yet; use claude-code.`;
+const notBuilt = (driver) => ({
+	driver,
+	start: () => ({
+		events: (async function* () {
+			yield driverFailure(notBuiltYet(driver), "model_unavailable", { facts: {} });
+		})(),
+		send: () => {},
+		interrupt: () => Promise.resolve()
+	})
+});
+const ADAPTERS = {
+	"claude-code": claudeCodeAdapter,
+	"open-code": openCodeAdapter,
+	"command-code": commandCodeAdapter
+};
+/**
+* The runtime for a driver id, with the user's environment and the project's
+* runs folder (where a Command Code lease is recorded).
+*/
+const createRuntime = (driver, env, runs) => {
+	const adapter = ADAPTERS[driver];
+	return adapter === null ? notBuilt(driver) : createSessionRuntime(adapter, {
+		env,
+		...runs === void 0 ? {} : { runs }
+	});
+};
+export { cleanStaleLeases, createRuntime, leaseLedger };