@krapht/ork 1.0.0-alpha.2 → 1.0.0-alpha.20

package/dist/{src-DOcK8Jfp.mjs → src-I_RyKu6_.mjs}

@@ -1,10 +1,176 @@
-import { $n as timeoutMs, $t as parseTemplate, At as runScope, F as declaredProblem, Jn as beforeOf, Mt as envReadsOf, Ot as heldTimeout, Pt as declaredOutputOf, Qt as evaluate, Vn as markValue, Xn as isToolNode, Zn as programsRunBy, en as renderTemplate, er as INTEGRATIONS, ft as sessionDriver, jt as calledWorkflows, mt as reportSchemaFor, nr as integrationFor, s as planReason, tr as TOOL_PREFIX, ut as planNodeSession } from "./src-Dujmvv4s.mjs";
+import { At as heldTimeout, Bt as lowerChild, Ct as reportSchemaFor, Di as INTEGRATIONS, Ei as timeoutMs, Fi as AGENT_DRIVERS, Ft as failedWith, Gr as placeFor, Ht as startAt, It as stoppedEnd, Lt as declaredProblem, Mt as calledWorkflows, Oi as TOOL_PREFIX, Pt as endedWith, Q as sessionRefusals, Rt as slotClock, Si as isToolNode, Sr as renderTemplate, Wn as countedTokens, ar as endFor, br as evaluate, dn as declaredOutputOf, fi as parseWorkflow, fn as MCP_FILE, jt as runScope, ki as integrationFor, li as beforeOf, ln as sessionDriver, mi as markValue, mn as serversIn, nr as outcomeEnd, on as envReadsOf, pn as mcpNotText, rr as END_DETAIL_LIMIT, tr as endOf, ui as programsRunBy, vt as planReason, xi as isClaudeNode, xr as parseTemplate, xt as planNodeSession, z as storePath } from "./src-8cOPOgrT.mjs";
+import { t as runOnce } from "./run-Bvvg-fiF.mjs";
+import { n as holdGuard, r as orphanGuard, t as KILL_AFTER_MS } from "./orphan-guard-BFKg8VSd.mjs";
 import path from "node:path";
-import { accessSync, constants, existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { accessSync, constants, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { spawn } from "node:child_process";
+import { Readable } from "node:stream";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+// ../core/src/project/environ.ts
+/** A variable of the user's. */
+const readEnv = (environ, name) => Object.hasOwn(environ, name) ? environ[name] : void 0;
+// ../core/src/store/scrub.ts
+/**
+* @file Masking the values of the user's secret variables in text Ork stores:
+*   what a tool node's program prints, and a run's own messages. A plain
+*   search, so a value of any size or shape takes time in step with the text:
+*   it looks in the text as it is, and with JSON's escapes decoded once and
+*   twice, so that it does not matter which characters an encoder chose to
+*   escape. It masks the value, and the pieces programs print on their own:
+*   each line, and each value of a JSON document. Other encodings, such as
+*   base64, are out of its reach (L81).
+*/
+/** Shorter values than this would mask ordinary text: `1`, `true`, a word. */
+const MIN_SECRET_LENGTH = 8;
+const SHORT_ESCAPES = {
+	"\"": "\"",
+	"\\": "\\",
+	"/": "/",
+	b: "\b",
+	f: "\f",
+	n: "\n",
+	r: "\r",
+	t: "	"
+};
+/** The unit an escape at `at` stands for, and how long it is written. */
+const escapeAt = (text, at) => {
+	const next = text.charAt(at + 1);
+	const short = SHORT_ESCAPES[next];
+	if (short !== void 0) return {
+		unit: short,
+		width: 2
+	};
+	if (next !== "u") return null;
+	const hex = text.slice(at + 2, at + 6);
+	return /^[\da-f]{4}$/iu.test(hex) ? {
+		unit: String.fromCodePoint(Number(`0x${hex}`)),
+		width: 6
+	} : null;
+};
+/** The last mark at or before `index`, by a binary search. */
+const lastMark = (marks, index) => {
+	let low = 0;
+	let high = marks.length - 1;
+	while (low < high) {
+		const middle = Math.ceil((low + high) / 2);
+		if ((marks[middle] ?? 0) <= index) low = middle;
+		else high = middle - 1;
+	}
+	return low;
+};
+/** The view with its escapes decoded; `null` when it has none. */
+const decoded = (view) => {
+	const { text } = view;
+	const parts = [];
+	const decodedAt = [0];
+	const sourceAt = [0];
+	let from = 0;
+	let length = 0;
+	let at = text.indexOf("\\");
+	while (at !== -1) {
+		const escape = escapeAt(text, at);
+		if (escape === null) at = text.indexOf("\\", at + 1);
+		else {
+			parts.push(text.slice(from, at), escape.unit);
+			length += at - from;
+			decodedAt.push(length);
+			sourceAt.push(at);
+			length += 1;
+			from = at + escape.width;
+			decodedAt.push(length);
+			sourceAt.push(from);
+			at = text.indexOf("\\", from);
+		}
+	}
+	if (from === 0) return null;
+	parts.push(text.slice(from));
+	return {
+		text: parts.join(""),
+		toSource: (index) => {
+			const mark = lastMark(decodedAt, index);
+			return view.toSource((sourceAt[mark] ?? 0) + (index - (decodedAt[mark] ?? 0)));
+		}
+	};
+};
+/** The text as it is, then decoded as far as JSON inside JSON goes. */
+const viewsOf = (text) => {
+	const raw = {
+		text,
+		toSource: (index) => index
+	};
+	const once = decoded(raw);
+	const twice = once === null ? null : decoded(once);
+	return [
+		raw,
+		...once === null ? [] : [once],
+		...twice === null ? [] : [twice]
+	];
+};
+/** Where each secret is in the text, overlapping ones joined. */
+const rangesOf = (text, secrets) => {
+	const found = [];
+	for (const view of viewsOf(text)) for (const secret of secrets) {
+		let at = view.text.indexOf(secret);
+		while (at !== -1) {
+			found.push([view.toSource(at), view.toSource(at + secret.length)]);
+			at = view.text.indexOf(secret, at + secret.length);
+		}
+	}
+	const joined = [];
+	for (const [start, end] of found.toSorted((a, b) => a[0] - b[0])) {
+		const last = joined.at(-1);
+		if (last !== void 0 && start < last[1]) last[1] = Math.max(last[1], end);
+		else joined.push([start, end]);
+	}
+	return joined;
+};
+/** The strings and numbers inside a parsed JSON document. */
+const leavesOf = (value) => {
+	if (typeof value === "string") return [value];
+	if (typeof value === "number") return [String(value)];
+	if (typeof value === "object" && value !== null) return Object.values(value).flatMap((item) => leavesOf(item));
+	return [];
+};
+/** A value's leaves, when it is a JSON object or array. */
+const jsonLeavesOf = (value) => {
+	if (!/^\s*[[{]/u.test(value)) return [];
+	try {
+		return leavesOf(JSON.parse(value));
+	} catch {
+		return [];
+	}
+};
+/** A value, and the pieces of it a program may well print on their own. */
+const formsOf = (value) => [
+	value,
+	value.trim(),
+	...value.split(/\r?\n|\r/u).map((line) => line.trim()),
+	...jsonLeavesOf(value)
+];
+/** Replaces the values, in any form JSON writes them, with `[masked]`. */
+const scrubberOf = (values) => {
+	const secrets = [...new Set(values.flatMap((value) => formsOf(value)))].filter((secret) => secret.trim().length >= MIN_SECRET_LENGTH);
+	return (text) => {
+		if (secrets.length === 0) return text;
+		const parts = [];
+		let from = 0;
+		for (const [start, end] of rangesOf(text, secrets)) {
+			parts.push(text.slice(from, start), "[masked]");
+			from = end;
+		}
+		parts.push(text.slice(from));
+		return parts.join("");
+	};
+};
+/** The values of the variables named that are set. */
+const envValuesOf = (names, environ) => names.flatMap((name) => {
+	const value = readEnv(environ, name);
+	return value === void 0 ? [] : [value];
+});
+/** What a run masks in a message of its own: the named variables' values. */
+const runScrubber = (names, environ) => scrubberOf(envValuesOf(names, environ));
 // ../nodes/src/call.ts
 /**
 * @file The `workflow.call` node type (RFC-004): renders what the node asks for
@@ -18,24 +184,17 @@ import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/
 */
 const limitedCall = (result) => {
 	if (result.ok) return result;
-	return (result.error ?? "").includes("Not started: ") || result.output["runStatus"] === "quota_exhausted" ? {
+	const why = result.end?.detail ?? result.error;
+	return result.end?.kind === "plan_limit" || (why ?? "").includes("Not started: ") || result.output["runStatus"] === "quota_exhausted" ? {
 		...result,
-		limited: result.error ?? "the called run reached a limit"
+		limited: why ?? "the called run reached a limit"
 	} : result;
 };
 const callExecutor = (context) => {
 	const { node, calls } = context;
-	if (node.type !== "workflow.call") return Promise.resolve({
-		ok: false,
-		output: {},
-		error: `${context.id} is not a call`
-	});
-	if (calls === void 0) return Promise.resolve({
-		ok: false,
-		output: { status: "fail" },
-		error: "This run cannot call workflows."
-	});
-	const scope = runScope(context.inputs, context.outputs, context.runId);
+	if (node.type !== "workflow.call") return Promise.resolve(failedWith(endFor("unknown", {}, `${context.id} is not a call`), {}));
+	if (calls === void 0) return Promise.resolve(failedWith(endFor("invalid_node", { reason: "this run cannot call workflows" }), { status: "fail" }));
+	const scope = runScope(context.inputs, context.outputs, context.runId, context.item);
 	const render = (text) => {
 		const template = parseTemplate(text);
 		return template.ok ? renderTemplate(template.parts, scope) : text;
@@ -61,33 +220,82 @@ const callExecutor = (context) => {
 		}
 	}, context.signal).then(limitedCall);
 };
+// ../nodes/src/claude-plan.ts
+/**
+* @file What a Claude node's session is planned with, read from the node's
+*   context, and what it is told beyond its plan: the note of a sent-back input
+*   on re-entry, a resumed leader's message, and the turn for messages that
+*   came in as it finished.
+*/
+/** The plan options every session of a node starts from. */
+const planOptionsOf = (context, inPlace) => {
+	const planOptions = {
+		cwd: context.cwd,
+		inputs: context.inputs,
+		outputs: context.outputs,
+		inPlace,
+		workflowDir: context.workflowDir,
+		projectRoot: context.projectRoot,
+		...context.orkDir === void 0 ? {} : { orkDir: context.orkDir },
+		pluginDir: path.join(context.runDir, "plugins", context.id)
+	};
+	if (context.checkout !== void 0) planOptions.checkout = context.checkout;
+	if (context.brief !== void 0) planOptions.brief = context.brief;
+	if (context.template !== void 0) planOptions.template = context.template;
+	if (context.item !== void 0) planOptions.item = context.item;
+	if (context.ownership !== void 0) planOptions.ownership = context.ownership;
+	if (context.mailbox !== void 0) planOptions.mailbox = context.mailbox;
+	if (context.claims !== void 0) planOptions.claims = context.claims;
+	return planOptions;
+};
+const MAX_INPUT = 8192;
+const inputJson = (input) => JSON.stringify(input ?? {}, void 0, 2);
+/** What a sent-back input is whole, for `read_input`, when its note cuts it. */
+const wholeInput = (input) => {
+	const json = inputJson(input);
+	return json.length > MAX_INPUT ? json : void 0;
+};
+/** A re-entry's note of what was sent back; `read_input` has a cut rest. */
+const reentryNote = (round, input) => {
+	const json = inputJson(input);
+	const cut = json.length > MAX_INPUT;
+	const body = cut ? `${json.slice(0, MAX_INPUT)}\n…` : json;
+	const rest = cut ? `\n\nThat is the first ${String(MAX_INPUT)} of its ${String(json.length)} characters. Call read_input for all of it before you act on it.` : "";
+	return `\n\n## Round ${String(round)}\n\nThe workflow sent this task back to you with:\n\n\`\`\`json\n${body}\n\`\`\`${rest}`;
+};
+/**
+* What a resumed leader is told: it already has its brief and its earlier work,
+* so only the new round, and the new task when its owner sent one.
+*/
+const resumeMessage = (round, input, brief) => [brief === void 0 ? sentBack(round, input) : `## New task from \`${brief.from}\`\n\n${brief.text}`, "End with a new structured report."].join("\n\n");
+/** A first-round resume is a session the run was cut off in (`ork resume`). */
+const sentBack = (round, input) => round === 1 ? "Ork was stopped while you worked on this task, and the run is resumed. Your earlier turns are above: check what you finished, and carry on from there." : `The workflow sent your task back to you.${reentryNote(round, input)}`;
+/** What a session is told when messages came in as it finished. */
+const lateMessage = (count) => `[ork] ${String(count)} message${count === 1 ? "" : "s"} came in while you finished. Call read_inbox, act on ${count === 1 ? "it" : "them"} if needed, and end with a new structured report.`;
 // ../nodes/src/claude-result.ts
 /**
 * @file A finished session as a node's result: its report is the output, held
-*   to what the node declares (RFC-010).
+*   to what the node declares (RFC-010), and how it ended is its end kind
+*   (specs/runtime/session-ends.md).
 */
+/** How a session with no report ended; a driver's `done` without one is not. */
+const withoutReport = (outcome) => {
+	const end = outcomeEnd(outcome);
+	return end.kind === "done" || end.kind === "reported_failure" ? endFor("no_report", {}, end.detail) : end;
+};
 /** A finished session as a node result: its report is the node's output. */
 const resultOf = (outcome, declared) => {
-	if (outcome === null) return {
-		ok: false,
-		output: {
-			status: "fail",
-			summary: "the session ended without a result"
-		},
-		error: "the session ended without a result"
-	};
+	if (outcome === null) return failedWith(endFor("driver_crashed", {}, "the session ended without a result"));
 	const { report, usage } = outcome;
 	if (report === null) {
-		const reason = outcome.errors[0] ?? "no valid report";
+		const end = withoutReport(outcome);
 		return {
-			ok: false,
-			output: {
+			...failedWith(end, {
 				status: "fail",
-				summary: reason,
+				summary: end.message,
 				usage
-			},
+			}),
 			usage,
-			error: `ended without a report (${outcome.subtype}): ${reason}`,
 			sessionId: outcome.sessionId
 		};
 	}
@@ -101,7 +309,7 @@ const resultOf = (outcome, declared) => {
 	};
 	if (report.branch !== void 0) output["branch"] = report.branch;
 	const problem = declaredProblem(declared, output);
-	if (problem !== null) return {
+	if (problem !== null) return endedWith({
 		ok: false,
 		output: {
 			status: "fail",
@@ -111,18 +319,163 @@ const resultOf = (outcome, declared) => {
 			...report.branch === void 0 ? {} : { branch: report.branch }
 		},
 		usage,
-		error: problem,
 		...ran
-	};
-	const result = {
-		ok: report.status !== "fail",
+	}, endFor("invalid_report", { reason: problem }));
+	const ok = report.status !== "fail";
+	return endedWith({
+		ok,
 		output,
 		usage,
 		...ran
+	}, endFor(ok ? "done" : "reported_failure"));
+};
+// ../nodes/src/mcp-servers.ts
+/**
+* @file Reading an MCP server's definition from the project's `.mcp.json`, the
+*   file Claude Code reads too, so a server is defined in one place (RFC-006).
+*   `${VAR}` and `${VAR:-default}` read the user's environment, which is where
+*   secrets stay: Ork stores none, and a run masks each value read this way. A
+*   server that needs an OAuth sign-in holds Claude Code's tokens, not Ork's,
+*   so it is refused.
+*/
+const VARIABLE = /\$\{([A-Za-z_]\w*)(?::-([^}]*))?\}/gu;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const stringsOf = (value) => isRecord(value) ? Object.fromEntries(Object.entries(value).flatMap(([key, item]) => typeof item === "string" ? [[key, item]] : [])) : {};
+const listOf = (value) => Array.isArray(value) ? value.flatMap((item) => typeof item === "string" ? [item] : []) : [];
+/** The server as written, or why Ork can't call it. */
+const readMcpServer = (root, name) => {
+	const servers = serversIn(root);
+	if (!servers.ok) return servers;
+	const known = Object.keys(servers.value);
+	const server = Object.hasOwn(servers.value, name) ? servers.value[name] : void 0;
+	if (!isRecord(server)) return {
+		ok: false,
+		error: `no MCP server \`${name}\` in ${MCP_FILE}${known.length === 0 ? "" : `, which has ${known.join(", ")}`}`
+	};
+	if ("oauth" in server) return {
+		ok: false,
+		error: `MCP server \`${name}\` signs in with OAuth, whose tokens are Claude Code's: give it a token through headers and \`env:\`, or call it from a session`
+	};
+	const notText = mcpNotText(server);
+	if (notText !== void 0) return {
+		ok: false,
+		error: `MCP server \`${name}\` has a value in ${notText} that isn't a string: write it in quotes`
+	};
+	const { type, url, command } = server;
+	if (type === "http" && typeof url === "string") return {
+		ok: true,
+		value: {
+			kind: "http",
+			url,
+			headers: stringsOf(server["headers"])
+		}
+	};
+	if ((type === void 0 || type === "stdio") && typeof command === "string") return {
+		ok: true,
+		value: {
+			kind: "stdio",
+			command,
+			args: listOf(server["args"]),
+			env: stringsOf(server["env"])
+		}
+	};
+	return {
+		ok: false,
+		error: `MCP server \`${name}\` is not one Ork can call: it takes stdio and http servers`
+	};
+};
+/**
+* The named servers' entries as written, for a session: `${VAR}` stays text for
+* the `claude` that loads them to expand. The compiler has checked the names.
+*/
+const namedMcpEntries = (root, names) => {
+	if (names.length === 0) return {
+		ok: true,
+		value: {}
+	};
+	const servers = serversIn(root);
+	if (!servers.ok) return servers;
+	const mcpServers = {};
+	for (const name of names) {
+		const server = Object.hasOwn(servers.value, name) ? servers.value[name] : void 0;
+		if (!isRecord(server)) return {
+			ok: false,
+			error: `no MCP server \`${name}\` in ${MCP_FILE}`
+		};
+		mcpServers[name] = server;
+	}
+	return {
+		ok: true,
+		value: { mcpServers }
+	};
+};
+/** Each variable a server reads, and whether it has a default. */
+const readsOf = (server) => {
+	return (server.kind === "stdio" ? [
+		server.command,
+		...server.args,
+		...Object.values(server.env)
+	] : [server.url, ...Object.values(server.headers)]).flatMap((text) => [...text.matchAll(VARIABLE)].map((match) => ({
+		name: String(match[1]),
+		fallback: match[2] !== void 0
+	})));
+};
+/**
+* The server with its variables filled in, and the values to mask: all it read
+* but those `plain` names, which aren't secret.
+*/
+const expandServer = (server, environ, plain = []) => {
+	const unset = readsOf(server).find(({ name, fallback }) => !fallback && readEnv(environ, name) === void 0);
+	if (unset !== void 0) return {
+		ok: false,
+		error: `${MCP_FILE} reads ${unset.name}, which is not set`
+	};
+	const values = [];
+	const fill = (text) => text.replaceAll(VARIABLE, (_all, name, fallback) => {
+		const value = readEnv(environ, name);
+		if (value !== void 0 && !plain.includes(name)) values.push(value);
+		return value ?? fallback ?? "";
+	});
+	const fillAll = (record) => Object.fromEntries(Object.entries(record).map(([key, text]) => [key, fill(text)]));
+	return {
+		ok: true,
+		value: {
+			server: server.kind === "stdio" ? {
+				kind: "stdio",
+				command: fill(server.command),
+				args: server.args.map((arg) => fill(arg)),
+				env: fillAll(server.env)
+			} : {
+				kind: "http",
+				url: fill(server.url),
+				headers: fillAll(server.headers)
+			},
+			values
+		}
 	};
-	if (!result.ok) result.error = report.summary;
-	return result;
 };
+/** What a workflow's MCP servers read of the user's, unless called not secret. */
+const mcpVariablesOf = (workflow, root) => Object.values(workflow.nodes).flatMap((node) => {
+	if (node.type !== "mcp.call") return [];
+	const read = readMcpServer(root, node.server);
+	return read.ok ? readsOf(read.value).map(({ name }) => name).filter((name) => node.plainEnv?.includes(name) !== true) : [];
+});
+/** A stdio server's program, when its name can be known before it is filled in. */
+const programOf = (server) => server.kind === "stdio" && !server.command.includes("$") ? server.command : void 0;
+/**
+* What stops a workflow's `mcp.call` nodes, found before a run spends anything:
+* a server that isn't there or can't be called, a program that isn't installed,
+* or a variable that is not set.
+*/
+const mcpProblems = (workflow, root, environ = process.env, finished = /* @__PURE__ */ new Set(), installed = () => true) => Object.entries(workflow.nodes).flatMap(([id, node]) => {
+	if (node.type !== "mcp.call" || finished.has(id)) return [];
+	const read = readMcpServer(root, node.server);
+	if (!read.ok) return [`${id}: ${read.error}`];
+	const given = new Set(Object.keys(node.env ?? {}));
+	const unset = readsOf(read.value).flatMap(({ name, fallback }) => fallback || given.has(name) || readEnv(environ, name) !== void 0 ? [] : [`${id}: ${MCP_FILE} reads ${name}, which is not set`]);
+	const program = programOf(read.value);
+	return program === void 0 || installed(program) ? unset : [`\`${id}\`: MCP server \`${node.server}\` runs \`${program}\`, which is not installed`].concat(unset);
+});
 /** The only built-in tools a fork has: it reads, and reports. */
 const FORK_TOOLS = [
 	"Read",
@@ -158,7 +511,7 @@ const forkPrompt = (question, passOn) => [
 /** The fork's report: one of the options or the pass-on, and a note. */
 const forkReportSchema = (ids) => {
 	const node = {
-		type: "claude.worker",
+		type: "agent.worker",
 		prompt: "",
 		output: { schema: {
 			choice: [...ids],
@@ -274,28 +627,42 @@ const askFork = async (context, owner, question, deps) => {
 	if (signal.aborted) return null;
 	return answerOf(outcome, [...question.options.map((option) => option.id), passOn]);
 };
-/** What the person sees of a question its asker's owner passed on. */
-const passedOnContext = (context, owner, note) => [...context === void 0 ? [] : [context, ""], note === void 0 ? `${owner} passed this on.` : `${owner} passed this on: ${note}`].join("\n");
+/** What the person sees of a question its asker's owner passed on. */
+const passedOnContext = (context, owner, note) => [...context === void 0 ? [] : [context, ""], note === void 0 ? `${owner} passed this on.` : `${owner} passed this on: ${note}`].join("\n");
+/**
+* The node's channel to the person: what it asked is withdrawn when it stops,
+* so a stopped node leaves no decision open.
+*/
+const withdrawnOnStop = (context) => {
+	const { human } = context;
+	const signalOf = (asked) => asked === void 0 ? context.signal : AbortSignal.any([asked, context.signal]);
+	return {
+		permit: (request) => human.permit({
+			...request,
+			signal: signalOf(request.signal)
+		}),
+		ask: (question) => human.ask({
+			...question,
+			signal: signalOf(question.signal)
+		}),
+		...human.settled === void 0 ? {} : { settled: human.settled }
+	};
+};
 /**
 * The child's channel when its owner takes its questions first: a question goes
 * to a fork of the owner's session, then to the person if the fork passes it on
 * or can't answer. Permission prompts go to the person as before.
 */
 const ownerFirst = (context, owner, deps) => {
-	const { human } = context;
+	const human = withdrawnOnStop(context);
 	return {
 		permit: (request) => human.permit(request),
 		ask: async (question) => {
 			const answered = await askFork(context, owner, question, deps);
 			if (context.signal.aborted) throw new Error(`${context.id} was stopped`);
-			const signal = question.signal === void 0 ? context.signal : AbortSignal.any([question.signal, context.signal]);
-			if (answered === null) return human.ask({
-				...question,
-				signal
-			});
+			if (answered === null) return human.ask(question);
 			if (answered.choice === passOnId(question.options)) return human.ask({
 				...question,
-				signal,
 				owner: owner.id,
 				context: passedOnContext(question.context, owner.id, answered.note)
 			});
@@ -347,50 +714,79 @@ const withUsageOf = (first, later) => {
 */
 const afterLateTurn = (first, later) => {
 	const merged = withUsageOf(first, later);
-	return later.report === null ? {
-		...merged,
+	if (later.report !== null) return merged;
+	const { end: _later, ...rest } = merged;
+	return {
+		...rest,
 		report: first.report,
 		subtype: first.subtype,
+		...first.end === void 0 ? {} : { end: first.end },
 		text: first.text,
 		errors: first.errors
-	} : merged;
+	};
+};
+/** The least of the limits that are set; `undefined` with none. */
+const least = (...limits) => {
+	const known = limits.filter((limit) => limit !== void 0);
+	return known.length === 0 ? void 0 : Math.min(...known);
 };
+/** A cap less what this activation used, beside what a quota says is left. */
+const leftOf = (caps, used, quotaLeft) => least(...caps.map((cap) => cap === void 0 ? void 0 : cap - used), quotaLeft);
 /**
-* What another turn of a session may use. `spent` and `turns` are this
-* activation's, which neither the node's cap nor the run's budget has counted.
-* The quota has: the ledger took it as the session finished, so what it says is
-* left is left. `null` when nothing is, and the turn does not start.
+* What another turn of a session may use. `spent`, `tokens` (counted, RFC-015)
+* and `turns` are this activation's, which neither the node's cap nor the run's
+* budget has counted. The quota has: the ledger took it as the session
+* finished, so what it says is left is left. The run's tokens left have too:
+* only the node's own `budgetTokens` takes `tokens` off. `null` when nothing
+* is, and the turn does not start. `turnsAtLeast` lifts the turns left to that
+* many (a failed check's resume: `CHECK_RETRY_TURNS`).
 */
-const lateLimits = (spec, { spent, turns }, runLeft, quotaLeft) => {
-	const budgets = [...[spec.budgetUsd, runLeft].flatMap((limit) => limit === void 0 ? [] : [limit - spent]), ...quotaLeft === void 0 ? [] : [quotaLeft]];
-	const budgetUsd = budgets.length === 0 ? void 0 : Math.min(...budgets);
-	if (budgetUsd !== void 0 && budgetUsd <= 0) return null;
-	const maxTurns = spec.maxTurns === void 0 ? void 0 : spec.maxTurns - turns;
-	if (maxTurns !== void 0 && maxTurns <= 0) return null;
+const lateLimits = (spec, used, runLeft, quotaLeft, tokensLeft = {}, turnsAtLeast = 0) => {
+	const budgetUsd = leftOf([spec.budgetUsd, runLeft], used.spent, quotaLeft);
+	const budgetTokens = leftOf([spec.budgetTokens], used.tokens ?? 0, least(tokensLeft.run, tokensLeft.quota));
+	const maxTurns = spec.maxTurns === void 0 ? void 0 : Math.max(spec.maxTurns - used.turns, turnsAtLeast);
+	if ([
+		budgetUsd,
+		budgetTokens,
+		maxTurns
+	].some((left) => (left ?? 1) <= 0)) return null;
 	return {
 		...budgetUsd === void 0 ? {} : { budgetUsd },
+		...budgetTokens === void 0 ? {} : { budgetTokens },
 		...maxTurns === void 0 ? {} : { maxTurns }
 	};
 };
-/** What a session may spend as it starts: the least of the budget and any quota. */
-const budgetNow = (context) => {
-	if (context.budgetLeftNow === void 0) return context.budgetLeftUsd;
-	const known = [context.budgetLeftNow(), context.quota?.().leftUsd].flatMap((left) => left === void 0 ? [] : [left]);
-	return known.length === 0 ? void 0 : Math.min(...known);
+const reached = (cap, used) => cap !== void 0 && used >= cap;
+/**
+* Why the run's budget stopped a session that reached its cap, if it did. A
+* unit blames the run when the session reached it, or when it is the only cap
+* the session had; otherwise the node's own cap in the other unit may have
+* stopped it. A resumed turn's dollars are its own: its cost is the session's
+* total (ADR-046) while its cap is what was left, so `priorCostUsd` comes off,
+* read as `ownSpend` reads it (a lower total counted again from zero).
+*/
+const runSpent = (run, asked, outcome, priorCostUsd) => {
+	const total = outcome.usage.costUsd;
+	const turnCostUsd = total < priorCostUsd ? total : total - priorCostUsd;
+	if (run.tokens !== void 0 && (reached(asked.budgetTokens, countedTokens(outcome.usage)) || asked.budgetUsd === void 0)) return `the run's budget of ${String(run.tokens)} tokens is spent`;
+	return run.usd !== void 0 && (reached(asked.budgetUsd, turnCostUsd) || asked.budgetTokens === void 0) ? `the run's budget of $${String(run.usd)} is spent` : void 0;
 };
 /**
 * Whether a limit across runs, rather than the node's work, ended a node: a
 * session whose cap was a quota's and that ran into it, or one its plan refused
-* and that gave no report. A node that still succeeded is left alone.
+* and that gave no report. A session whose cap was the run's budget and that
+* ran into it stops the run as `budget_exhausted` (`run`, from `runCapsOf`). A
+* node that still succeeded is left alone.
 */
-const limitWatch = (context) => {
+const limitWatch = (context, run = {}) => {
 	let why;
+	let runWhy;
 	return {
 		stoppedBy: (reason) => {
 			why = reason;
 		},
-		session: (asked) => {
-			const left = context.quota?.().leftUsd;
+		session: (asked, priorCostUsd = 0) => {
+			const { leftUsd: left, leftTokens } = context.quota?.() ?? {};
 			let refused;
 			return {
 				saw: (event) => {
@@ -398,26 +794,151 @@ const limitWatch = (context) => {
 				},
 				ended: (outcome) => {
 					if (refused !== void 0 && (outcome?.report ?? null) === null) why = refused;
-					if (left !== void 0 && asked.budgetUsd !== void 0 && asked.budgetUsd >= left && outcome?.subtype === "error_max_budget_usd") why = context.quota?.().blocked ?? "a session reached what was left of a quota";
+					const capped = left !== void 0 && asked.budgetUsd !== void 0 && asked.budgetUsd >= left || leftTokens !== void 0 && asked.budgetTokens !== void 0 && asked.budgetTokens >= leftTokens;
+					const spent = outcome !== null && outcomeEnd(outcome).kind === "budget_limit";
+					if (capped && spent) why = context.quota?.().blocked ?? "a session reached what was left of a quota";
+					else if (spent) runWhy = runSpent(run, asked, outcome, priorCostUsd);
 				}
 			};
 		},
-		result: (result) => result.ok || why === void 0 ? result : {
-			...result,
-			limited: why
+		result: (result) => {
+			if (result.ok) return result;
+			if (why !== void 0) return {
+				...endedWith(result, endFor("plan_limit", {}, why)),
+				limited: why
+			};
+			if (runWhy !== void 0) return {
+				...result,
+				limited: runWhy,
+				stopsAs: "budget_exhausted"
+			};
+			const { end } = result;
+			return end?.kind === "plan_limit" ? {
+				...result,
+				limited: end.message
+			} : result;
 		}
 	};
 };
-/** No session started: nothing was left for one. */
-const notStarted = (reason, limited) => ({
-	ok: false,
-	error: `not started: ${reason}`,
-	output: {
+/**
+* No session started: nothing was left for one, or nothing to start it. Its
+* summary keeps Ork's reason, `end.detail` too; the message is the kind's.
+*/
+const notStarted = (kind, reason, limited) => ({
+	...failedWith(endFor(kind, {
+		reason,
+		program: "an agent driver"
+	}, reason), {
 		status: "fail",
 		summary: `not started: ${reason}`
-	},
+	}),
 	...limited === void 0 ? {} : { limited }
 });
+// ../nodes/src/session-driver.ts
+/**
+* @file The driver a Claude node's session starts on (core's `sessionDriver`),
+*   and, when its model names that driver (`command-code.deepseek/…`, RFC-015),
+*   the fit check on the value an item rendered: the run's own check before it
+*   started saw only the written model.
+*/
+/** What stops the node from running on `driver`, in one line, or nothing. */
+const refusalOn = (context, driver, drivers) => {
+	const id = context.template ?? context.id;
+	const node = context.workflow.nodes[id];
+	const descriptor = drivers.find((d) => d.id === driver);
+	if (node === void 0 || descriptor === void 0) return void 0;
+	const refusals = sessionRefusals(id, node, context.workflow, descriptor);
+	return refusals.length === 0 ? void 0 : refusals.map((r) => r.message).join("; ");
+};
+/** The session's driver, or the node's result when none fits. */
+const sessionDriverOf = (context, plan, options) => {
+	const driver = sessionDriver({
+		pinned: plan.pinned,
+		override: options.driver,
+		named: plan.driver,
+		ready: options.readyDriver
+	});
+	if (driver === void 0) return notStarted("tool_missing", "no agent driver is ready; see `ork doctor`");
+	const unfit = plan.pinned === void 0 ? void 0 : refusalOn(context, driver, options.drivers ?? AGENT_DRIVERS);
+	return unfit === void 0 ? driver : notStarted("invalid_node", unfit);
+};
+// ../nodes/src/start-budgets.ts
+/** What a session may spend as it starts: the least of the budget and any quota. */
+const budgetNow = (context) => context.budgetLeftNow === void 0 ? context.budgetLeftUsd : least(context.budgetLeftNow(), context.quota?.().leftUsd);
+/** The counted tokens a session may use as it starts: the run's and a quota's. */
+const tokensNow = (context) => least(context.tokensLeftNow?.(), context.quota?.().leftTokens);
+/**
+* What is `left` now, with `own` (the node's cap) set aside through `reserve`
+* in the same step; with nothing left, it waits for a worker's reserve to
+* free.
+*/
+const startWith = async (context, left, own, reserve) => {
+	const now = left();
+	if (now !== void 0 && now <= 0) {
+		context.reserveBudget?.(0);
+		context.reserveTokens?.(0);
+		return await context.budgetFreed?.(context.signal) === true ? startWith(context, left, own, reserve) : now;
+	}
+	reserve?.(own === void 0 || now === void 0 ? now : Math.min(own, now));
+	return now;
+};
+/**
+* What a node's first session may spend, set aside from the run's budget in the
+* same step that reads it (ADR-077), so a node starting beside it is never
+* offered the same part: the least of what is left and the node's own
+* `budgetUsd`. With nothing left, it waits for a worker running beside it to
+* finish, as long as one may.
+*/
+const budgetToStart = (context) => startWith(context, () => budgetNow(context), ownCaps(context).usd, context.reserveBudget);
+/** The node's own caps: its `budgetUsd` and `budgetTokens`, else the defaults'. */
+const ownCaps = (context) => isClaudeNode(context.node) ? {
+	usd: context.node.budgetUsd ?? context.workflow.defaults?.budgetUsd,
+	tokens: context.node.budgetTokens ?? context.workflow.defaults?.budgetTokens
+} : {};
+/**
+* Where the run's budget, not the node's own cap, caps the node's first
+* session: the run has a budget in that unit, and what `startBudgets` left the
+* session is below the node's own cap, or it has none. A later turn of the
+* session keeps them: both its caps go down by what it used, and the run's by
+* what others used too.
+*/
+const runCapsOf = (context, planOptions) => {
+	const own = ownCaps(context);
+	const limits = context.workflow.limits;
+	const caps = {};
+	const usd = planOptions.budgetLeftUsd;
+	if (context.budgetLeftNow?.() !== void 0 && limits?.budgetUsd !== void 0 && usd !== void 0 && usd < (own.usd ?? Infinity)) caps.usd = limits.budgetUsd;
+	const tokens = planOptions.budgetLeftTokens;
+	if (context.tokensLeftNow?.() !== void 0 && limits?.budgetTokens !== void 0 && tokens !== void 0 && tokens < (own.tokens ?? Infinity)) caps.tokens = limits.budgetTokens;
+	return caps;
+};
+/** `budgetToStart` in counted tokens: the run's `budgetTokens` and a quota's. */
+const tokensToStart = (context) => startWith(context, () => tokensNow(context), ownCaps(context).tokens, context.reserveTokens);
+/**
+* What a node's first session may spend, in dollars and in counted tokens, set
+* into `planOptions`; the node's result instead when nothing is left of
+* either.
+*/
+const startBudgets = async (context, planOptions) => {
+	const usd = await budgetToStart(context);
+	if (usd !== void 0 && usd <= 0) return notStarted("budget_limit", "nothing is left of the run's budget");
+	if (usd !== void 0) planOptions.budgetLeftUsd = usd;
+	const waited = { done: false };
+	const tokens = await tokensToStart({
+		...context,
+		budgetFreed: async (signal) => {
+			waited.done = true;
+			return await context.budgetFreed?.(signal) ?? false;
+		}
+	});
+	if (tokens !== void 0 && tokens <= 0) return notStarted("budget_limit", "nothing is left of the run's tokens");
+	if (waited.done) {
+		context.reserveTokens?.(0);
+		return startBudgets(context, planOptions);
+	}
+	if (tokens !== void 0) planOptions.budgetLeftTokens = tokens;
+	return null;
+};
 // ../nodes/src/tool-output.ts
 /**
 * @file A tool node's structured result (`output: { format: json }`): the file
@@ -660,315 +1181,172 @@ const tokenize = (command) => {
 		args
 	};
 };
-// ../nodes/src/environ.ts
-/** A variable of the user's. */
-const readEnv = (environ, name) => Object.hasOwn(environ, name) ? environ[name] : void 0;
-// ../nodes/src/mcp-servers.ts
 /**
-* @file Reading an MCP server's definition from the project's `.mcp.json`, the
-*   file Claude Code reads too, so a server is defined in one place (RFC-006).
-*   `${VAR}` and `${VAR:-default}` read the user's environment, which is where
-*   secrets stay: Ork stores none, and a run masks each value read this way. A
-*   server that needs an OAuth sign-in holds Claude Code's tokens, not Ork's,
-*   so it is refused.
+* Runs `execute`, or, with `once: true`, skips it after a pass on these files:
+* `null` then, and `verify.skipped` is recorded. `shown` is the scrubbed
+* command.
 */
-const MCP_FILE = ".mcp.json";
-const VARIABLE = /\$\{([A-Za-z_]\w*)(?::-([^}]*))?\}/gu;
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** The file's `mcpServers`; `{}` when there is no file. */
-const serversIn = (root) => {
-	const file = path.join(root, MCP_FILE);
-	if (!existsSync(file)) return {
-		ok: true,
-		value: {}
-	};
-	try {
-		const parsed = JSON.parse(readFileSync(file, "utf8"));
-		const servers = isRecord(parsed) ? parsed["mcpServers"] : void 0;
-		return {
-			ok: true,
-			value: isRecord(servers) ? servers : {}
-		};
-	} catch (error) {
-		const reason = error instanceof SyntaxError ? "it is not valid JSON" : error instanceof Error ? error.message : String(error);
-		return {
-			ok: false,
-			error: `${MCP_FILE} can't be read: ${reason}`
-		};
-	}
-};
-const stringsOf = (value) => isRecord(value) ? Object.fromEntries(Object.entries(value).flatMap(([key, item]) => typeof item === "string" ? [[key, item]] : [])) : {};
-const listOf = (value) => Array.isArray(value) ? value.flatMap((item) => typeof item === "string" ? [item] : []) : [];
-/** A server's field that holds something other than text: it would be dropped. */
-const notTextIn = (server) => [
-	"args",
-	"env",
-	"headers"
-].find((field) => {
-	const value = server[field];
-	return (Array.isArray(value) ? value : isRecord(value) ? Object.values(value) : []).some((item) => typeof item !== "string");
-});
-/** The server as written, or why Ork can't call it. */
-const readMcpServer = (root, name) => {
-	const servers = serversIn(root);
-	if (!servers.ok) return servers;
-	const known = Object.keys(servers.value);
-	const server = Object.hasOwn(servers.value, name) ? servers.value[name] : void 0;
-	if (!isRecord(server)) return {
-		ok: false,
-		error: `no MCP server \`${name}\` in ${MCP_FILE}${known.length === 0 ? "" : `, which has ${known.join(", ")}`}`
-	};
-	if ("oauth" in server) return {
-		ok: false,
-		error: `MCP server \`${name}\` signs in with OAuth, whose tokens are Claude Code's: give it a token through headers and \`env:\`, or call it from a session`
-	};
-	const notText = notTextIn(server);
-	if (notText !== void 0) return {
-		ok: false,
-		error: `MCP server \`${name}\` has a value in ${notText} that isn't a string: write it in quotes`
-	};
-	const { type, url, command } = server;
-	if (type === "http" && typeof url === "string") return {
-		ok: true,
-		value: {
-			kind: "http",
-			url,
-			headers: stringsOf(server["headers"])
-		}
-	};
-	if ((type === void 0 || type === "stdio") && typeof command === "string") return {
-		ok: true,
-		value: {
-			kind: "stdio",
-			command,
-			args: listOf(server["args"]),
-			env: stringsOf(server["env"])
+const runUnlessPassed = async ({ node, context, cwd, shown, environ, execute }) => {
+	if (node.once !== true) return execute();
+	const done = {};
+	const once = await runOnce({
+		cwd,
+		name: node.script === void 0 ? shown : `${shown}\n${node.script}`,
+		who: `${context.runId}/${context.id}`,
+		env: environ,
+		run: async () => {
+			done.run = await execute();
+			return done.run.exitCode;
 		}
-	};
-	return {
-		ok: false,
-		error: `MCP server \`${name}\` is not one Ork can call: it takes stdio and http servers`
-	};
-};
-/** Each variable a server reads, and whether it has a default. */
-const readsOf = (server) => {
-	return (server.kind === "stdio" ? [
-		server.command,
-		...server.args,
-		...Object.values(server.env)
-	] : [server.url, ...Object.values(server.headers)]).flatMap((text) => [...text.matchAll(VARIABLE)].map((match) => ({
-		name: String(match[1]),
-		fallback: match[2] !== void 0
-	})));
-};
-/**
-* The server with its variables filled in, and the values to mask: all it read
-* but those `plain` names, which aren't secret.
-*/
-const expandServer = (server, environ, plain = []) => {
-	const unset = readsOf(server).find(({ name, fallback }) => !fallback && readEnv(environ, name) === void 0);
-	if (unset !== void 0) return {
-		ok: false,
-		error: `${MCP_FILE} reads ${unset.name}, which is not set`
-	};
-	const values = [];
-	const fill = (text) => text.replaceAll(VARIABLE, (_all, name, fallback) => {
-		const value = readEnv(environ, name);
-		if (value !== void 0 && !plain.includes(name)) values.push(value);
-		return value ?? fallback ?? "";
 	});
-	const fillAll = (record) => Object.fromEntries(Object.entries(record).map(([key, text]) => [key, fill(text)]));
-	return {
-		ok: true,
-		value: {
-			server: server.kind === "stdio" ? {
-				kind: "stdio",
-				command: fill(server.command),
-				args: server.args.map((arg) => fill(arg)),
-				env: fillAll(server.env)
-			} : {
-				kind: "http",
-				url: fill(server.url),
-				headers: fillAll(server.headers)
-			},
-			values
-		}
-	};
-};
-/** What a workflow's MCP servers read of the user's, unless called not secret. */
-const mcpVariablesOf = (workflow, root) => Object.values(workflow.nodes).flatMap((node) => {
-	if (node.type !== "mcp.call") return [];
-	const read = readMcpServer(root, node.server);
-	return read.ok ? readsOf(read.value).map(({ name }) => name).filter((name) => node.plainEnv?.includes(name) !== true) : [];
-});
-/** A stdio server's program, when its name can be known before it is filled in. */
-const programOf = (server) => server.kind === "stdio" && !server.command.includes("$") ? server.command : void 0;
-/**
-* What stops a workflow's `mcp.call` nodes, found before a run spends anything:
-* a server that isn't there or can't be called, a program that isn't installed,
-* or a variable that is not set.
-*/
-const mcpProblems = (workflow, root, environ = process.env, finished = /* @__PURE__ */ new Set(), installed = () => true) => Object.entries(workflow.nodes).flatMap(([id, node]) => {
-	if (node.type !== "mcp.call" || finished.has(id)) return [];
-	const read = readMcpServer(root, node.server);
-	if (!read.ok) return [`${id}: ${read.error}`];
-	const given = new Set(Object.keys(node.env ?? {}));
-	const unset = readsOf(read.value).flatMap(({ name, fallback }) => fallback || given.has(name) || readEnv(environ, name) !== void 0 ? [] : [`${id}: ${MCP_FILE} reads ${name}, which is not set`]);
-	const program = programOf(read.value);
-	return program === void 0 || installed(program) ? unset : [`\`${id}\`: MCP server \`${node.server}\` runs \`${program}\`, which is not installed`].concat(unset);
-});
-// ../nodes/src/tool-scrub.ts
-/**
-* @file Masking a secret in what a program prints. A plain search, so a value
-*   of any size or shape takes time in step with the text: it looks in the text
-*   as it is, and with JSON's escapes decoded once and twice, so that it does
-*   not matter which characters an encoder chose to escape. It masks the value,
-*   and the pieces programs print on their own: each line, and each value of a
-*   JSON document. Other encodings, such as base64, are out of its reach
-*   (L81).
-*/
-/** Shorter values than this would mask ordinary text: `1`, `true`, a word. */
-const MIN_SECRET_LENGTH = 8;
-const SHORT_ESCAPES = {
-	"\"": "\"",
-	"\\": "\\",
-	"/": "/",
-	b: "\b",
-	f: "\f",
-	n: "\n",
-	r: "\r",
-	t: "	"
-};
-/** The unit an escape at `at` stands for, and how long it is written. */
-const escapeAt = (text, at) => {
-	const next = text.charAt(at + 1);
-	const short = SHORT_ESCAPES[next];
-	if (short !== void 0) return {
-		unit: short,
-		width: 2
-	};
-	if (next !== "u") return null;
-	const hex = text.slice(at + 2, at + 6);
-	return /^[\da-f]{4}$/iu.test(hex) ? {
-		unit: String.fromCodePoint(Number(`0x${hex}`)),
-		width: 6
-	} : null;
-};
-/** The last mark at or before `index`, by a binary search. */
-const lastMark = (marks, index) => {
-	let low = 0;
-	let high = marks.length - 1;
-	while (low < high) {
-		const middle = Math.ceil((low + high) / 2);
-		if ((marks[middle] ?? 0) <= index) low = middle;
-		else high = middle - 1;
-	}
-	return low;
-};
-/** The view with its escapes decoded; `null` when it has none. */
-const decoded = (view) => {
-	const { text } = view;
-	const parts = [];
-	const decodedAt = [0];
-	const sourceAt = [0];
-	let from = 0;
-	let length = 0;
-	let at = text.indexOf("\\");
-	while (at !== -1) {
-		const escape = escapeAt(text, at);
-		if (escape === null) at = text.indexOf("\\", at + 1);
-		else {
-			parts.push(text.slice(from, at), escape.unit);
-			length += at - from;
-			decodedAt.push(length);
-			sourceAt.push(at);
-			length += 1;
-			from = at + escape.width;
-			decodedAt.push(length);
-			sourceAt.push(from);
-			at = text.indexOf("\\", from);
-		}
-	}
-	if (from === 0) return null;
-	parts.push(text.slice(from));
-	return {
-		text: parts.join(""),
-		toSource: (index) => {
-			const mark = lastMark(decodedAt, index);
-			return view.toSource((sourceAt[mark] ?? 0) + (index - (decodedAt[mark] ?? 0)));
-		}
-	};
+	if (!once.skipped) return done.run ?? execute();
+	context.skipped?.(shown, once.pass);
+	return null;
 };
-/** The text as it is, then decoded as far as JSON inside JSON goes. */
-const viewsOf = (text) => {
-	const raw = {
-		text,
-		toSource: (index) => index
+// ../nodes/src/tool-dash.ts
+/**
+* @file The leading-`-` guard on a tool node's command: an argument that starts
+*   with a template reading `nodes.*.output` and renders to a leading `-` would
+*   read as an option of the program, so it is refused unless a `--` comes
+*   before it. A literal `-x` and `--flag={{…}}` are not affected. Also how a
+*   tool node renders one argument (or its `cwd`) with that guard.
+*/
+/** The error for a rendered argument that reads as an option, or `undefined`. */
+const leadingDashError = (parts, value) => {
+	const first = parts[0];
+	if (!value.startsWith("-") || typeof first !== "object" || first.expr.kind !== "path" || first.expr.segments[0] !== "nodes" || first.expr.segments[2] !== "output") return;
+	return `argument from nodes.${String(first.expr.segments[1])}.output starts with \`-\`; put \`--\` before it in the command`;
+};
+/** One templated argument, rendered; `guardDash` refuses a leading `-`. */
+const renderArg = (text, context, guardDash = false) => {
+	const template = parseTemplate(text);
+	if (!template.ok) return {
+		ok: false,
+		error: template.message
+	};
+	const value = renderTemplate(template.parts, runScope(context.inputs, context.outputs, context.runId, context.item));
+	const error = guardDash ? leadingDashError(template.parts, value) : void 0;
+	return error === void 0 ? {
+		ok: true,
+		value
+	} : {
+		ok: false,
+		error
 	};
-	const once = decoded(raw);
-	const twice = once === null ? null : decoded(once);
-	return [
-		raw,
-		...once === null ? [] : [once],
-		...twice === null ? [] : [twice]
-	];
 };
-/** Where each secret is in the text, overlapping ones joined. */
-const rangesOf = (text, secrets) => {
-	const found = [];
-	for (const view of viewsOf(text)) for (const secret of secrets) {
-		let at = view.text.indexOf(secret);
-		while (at !== -1) {
-			found.push([view.toSource(at), view.toSource(at + secret.length)]);
-			at = view.text.indexOf(secret, at + secret.length);
-		}
-	}
-	const joined = [];
-	for (const [start, end] of found.toSorted((a, b) => a[0] - b[0])) {
-		const last = joined.at(-1);
-		if (last !== void 0 && start < last[1]) last[1] = Math.max(last[1], end);
-		else joined.push([start, end]);
+// ../nodes/src/tool-ends.ts
+/**
+* @file How a tool node ended (specs/runtime/session-ends.md): a node that
+*   could not run its command, JSON that broke its declared output, or how a
+*   command that ran exited: done, stopped, never started, signed out, or
+*   failed. Ork's message names the program; its stderr is the detail.
+*/
+/** A node that could not run its command: its own definition is wrong. */
+const failed$1 = (error, kind = "invalid_node") => endedWith({
+	ok: false,
+	output: {
+		exitCode: -1,
+		stdout: "",
+		stderr: error
 	}
-	return joined;
+}, endFor(kind, { reason: error }, error));
+/** JSON that broke what the node declares, or that it could not read. */
+const invalidOutput = (output, reason) => endedWith({
+	ok: false,
+	output
+}, endFor("invalid_output", { reason }));
+/**
+* How a command that ran and exited non-zero ended: stopped, never started, a
+* sign-in its program asks for (`signedOut`), or a plain failure.
+*/
+const exitKind = (run, context, signedOut) => {
+	if (context.signal.aborted) return "interrupted";
+	if (run.exitCode === -1 && /\bENOENT\b/u.test(run.stderr)) return "tool_missing";
+	return signedOut?.(run) === true ? "auth" : "command_failed";
+};
+/** How a command that ran ended, by its exit code; `program` is scrubbed. */
+const exitEnd = (output, run, context, program, signedOut) => {
+	if (run.exitCode === 0) return endedWith({
+		ok: true,
+		output
+	}, endFor("done"));
+	const end = endFor(exitKind(run, context, signedOut), {
+		program,
+		exitCode: run.exitCode
+	}, run.stderr.trim().slice(-END_DETAIL_LIMIT));
+	return endedWith({
+		ok: false,
+		output
+	}, end);
 };
-/** The strings and numbers inside a parsed JSON document. */
-const leavesOf = (value) => {
-	if (typeof value === "string") return [value];
-	if (typeof value === "number") return [String(value)];
-	if (typeof value === "object" && value !== null) return Object.values(value).flatMap((item) => leavesOf(item));
-	return [];
+/** The result of a skipped check: it passed, and printed nothing this time. */
+const skippedCheck = (outputFile) => {
+	if (outputFile !== void 0) removeOutputFile(outputFile);
+	return endedWith({
+		ok: true,
+		output: {
+			exitCode: 0,
+			stdout: "",
+			stderr: ""
+		}
+	}, endFor("done"));
 };
-/** A value's leaves, when it is a JSON object or array. */
-const jsonLeavesOf = (value) => {
-	if (!/^\s*[[{]/u.test(value)) return [];
+// ../nodes/src/run-marker.ts
+/**
+* @file The marker a run leaves on its sessions and programs (ADR-047), and the
+*   stores it guards: the commands that act as the user refuse in the stores of
+*   the runs that started a process, and everywhere under a marker that lists
+*   none, which an older `ork` sets.
+*/
+/** Set for a program in a run. */
+const RUN_ENV = "ORK_RUN";
+/** Set for a Claude session. It says no more than that: no run, no node. */
+const SESSION_ENV = "ORK_SESSION";
+/**
+* The stores whose runs started a session or program, as a JSON array of real
+* paths: the commands that act as the user refuse only in these.
+*/
+const GUARDED_STORES_ENV = "ORK_GUARDED_STORES";
+/**
+* The variable that says a program in a run or a session started this process,
+* or `null` when none does.
+*/
+const runMarkerIn = (env) => ["ORK_RUN", "ORK_SESSION"].find((name) => env[name] !== void 0) ?? null;
+/** The stores `env` lists, or `undefined` when it lists none or garbles it. */
+const listIn = (env) => {
+	const text = env[GUARDED_STORES_ENV];
+	if (text === void 0) return void 0;
 	try {
-		return leavesOf(JSON.parse(value));
+		const value = JSON.parse(text);
+		return Array.isArray(value) && value.every((item) => typeof item === "string") ? value : void 0;
 	} catch {
-		return [];
+		return;
 	}
 };
-/** A value, and the pieces of it a program may well print on their own. */
-const formsOf = (value) => [
-	value,
-	value.trim(),
-	...value.split(/\r?\n|\r/u).map((line) => line.trim()),
-	...jsonLeavesOf(value)
-];
-/** Replaces the values, in any form JSON writes them, with `[masked]`. */
-const scrubberOf = (values) => {
-	const secrets = [...new Set(values.flatMap((value) => formsOf(value)))].filter((secret) => secret.trim().length >= MIN_SECRET_LENGTH);
-	return (text) => {
-		if (secrets.length === 0) return text;
-		const parts = [];
-		let from = 0;
-		for (const [start, end] of rangesOf(text, secrets)) {
-			parts.push(text.slice(from, start), "[masked]");
-			from = end;
-		}
-		parts.push(text.slice(from));
-		return parts.join("");
-	};
+/** A store file's real path, so a symlinked `~/.ork` is the same store. */
+const realStore = (store) => {
+	try {
+		return realpathSync(store);
+	} catch {
+		return path.resolve(store);
+	}
 };
+/**
+* The stores a run that started this process is in: `null` when no run did, and
+* `"all"` when one did but listed none (an older `ork`), which fails closed.
+*/
+const guardedStoresIn = (env) => runMarkerIn(env) === null ? null : listIn(env) ?? "all";
+/** Whether a run in `store` (a store file) started this process. */
+const storeGuarded = (env, store) => {
+	const guarded = guardedStoresIn(env);
+	return guarded === "all" || guarded !== null && guarded.includes(realStore(store));
+};
+/**
+* What a run in `store` (default: the user's) tells its sessions and programs:
+* the stores it inherited, and its own. Nothing when it inherited "all", so
+* that holds.
+*/
+const guardOf = (env, store = storePath()) => guardedStoresIn(env) === "all" ? {} : { [GUARDED_STORES_ENV]: JSON.stringify([.../* @__PURE__ */ new Set([...listIn(env) ?? [], realStore(store)])]) };
 // ../nodes/src/tool-env.ts
 /**
 * @file What a tool node's program sees besides what it inherits: who it is
@@ -980,16 +1358,13 @@ const scrubberOf = (values) => {
 const OUTPUT_ENV = "ORK_OUTPUT";
 /** A file a `watch:` node's program keeps between looks (RFC-011). */
 const STATE_ENV = "ORK_STATE";
-/** Set for a program in a run. */
-const RUN_ENV = "ORK_RUN";
-/** Set for a Claude session. It says no more than that: no run, no node. */
-const SESSION_ENV = "ORK_SESSION";
 /** The variables a caller's run reads, for a run it calls to mask too. */
 const MASKED_ENV = "ORK_MASKED";
 /** Every variable Ork sets itself; a workflow's `env:` cannot set them. */
 const IDENTITY_KEYS = /* @__PURE__ */ new Set([
 	RUN_ENV,
 	SESSION_ENV,
+	GUARDED_STORES_ENV,
 	MASKED_ENV,
 	"ORK_NODE",
 	"ORK_ROUND",
@@ -998,7 +1373,9 @@ const IDENTITY_KEYS = /* @__PURE__ */ new Set([
 	"ORK_WORKFLOW",
 	"ORK_BIN",
 	OUTPUT_ENV,
-	STATE_ENV
+	STATE_ENV,
+	"ORK_ITEM",
+	"ORK_INDEX"
 ]);
 /**
 * `env` without Ork's identity variables. A run started by a program in another
@@ -1006,27 +1383,32 @@ const IDENTITY_KEYS = /* @__PURE__ */ new Set([
 */
 const withoutIdentity = (env) => Object.fromEntries(Object.entries(env).flatMap(([key, value]) => value === void 0 || IDENTITY_KEYS.has(key) ? [] : [[key, value]]));
 /**
-* What a Claude session runs with: no identity, only the marker that stops its
-* Bash from speaking as the user through `ork chat`.
+* What a Claude session of a run in `store` (default: the user's) runs with: no
+* identity, only the marker that stops its Bash from speaking as the user
+* through `ork chat`, and the stores it must not do that in.
 */
-const sessionEnv = (env) => ({
+const sessionEnv = (env, store) => ({
 	...withoutIdentity(env),
-	[SESSION_ENV]: "1"
+	[SESSION_ENV]: "1",
+	...guardOf(env, store)
 });
 /**
-* The variable that says a program in a run or a session started this process,
-* or `null` when none does.
+* Who a node's program is, and the stores its run guards (none listed without
+* `store`, which guards every one). It is attribution, not a boundary.
 */
-const runMarkerIn = (env) => ["ORK_RUN", SESSION_ENV].find((name) => env[name] !== void 0) ?? null;
-/** Who a node's program is. It is attribution, not a security boundary. */
-const identityOf = (context, orkBin) => ({
+const identityOf = (context, orkBin, environ = {}, store) => ({
+	...store === void 0 ? {} : guardOf(environ, store),
 	[RUN_ENV]: context.runId,
 	ORK_NODE: context.id,
 	ORK_ROUND: String(context.round),
 	ORK_RUN_DIR: context.runDir,
 	ORK_PROJECT: context.projectRoot,
 	ORK_WORKFLOW: context.workflow.name,
-	...orkBin === void 0 ? {} : { ORK_BIN: orkBin }
+	...orkBin === void 0 ? {} : { ORK_BIN: orkBin },
+	...context.item === void 0 ? {} : {
+		ORK_ITEM: typeof context.item.value === "string" ? context.item.value : JSON.stringify(context.item.value),
+		ORK_INDEX: String(context.item.index)
+	}
 });
 /** The variables a workflow's nodes read that no `plainEnv` excuses. */
 const secretNamesOf = (workflow) => Object.values(workflow.nodes).flatMap((node) => programsRunBy(node, workflow.defaults)).flatMap(({ program }) => {
@@ -1043,6 +1425,23 @@ const inheritedNames = (environ) => (environ[MASKED_ENV] ?? "").split(",").filte
 */
 const maskedNamesOfRun = (workflow, own, registered, environ = process.env) => [...new Set([workflow, ...calledWorkflows(workflow, own, registered, { everyCall: true })].flatMap((one) => secretNamesOf(one)).concat(mcpVariablesOf(workflow, own.root), inheritedNames(environ)))];
 /**
+* The env-value scrubber of a recorded run, from its workflow file as it is
+* now, for what is written to it from outside the run (a person's note);
+* `undefined` when the file is gone or no longer parses.
+*/
+const scrubberOfRun = (run, registered, environ = process.env) => {
+	let text;
+	try {
+		text = readFileSync(run.file, "utf8");
+	} catch {
+		return;
+	}
+	const parsed = parseWorkflow(text);
+	if (!parsed.ok) return void 0;
+	const own = placeFor(path.dirname(run.file), registered);
+	return runScrubber(maskedNamesOfRun(parsed.workflow, own, registered, environ), environ);
+};
+/**
 * A program learns the names too, never their values: `ork send` masks with
 * them before it writes to the store, and a run the program starts passes them
 * on.
@@ -1052,23 +1451,17 @@ const namesToMask = (workflow, environ, also = []) => [.../* @__PURE__ */ new Se
 	...also,
 	...inheritedNames(environ)
 ])];
-const valuesOf = (names, environ) => names.flatMap((name) => {
-	const value = readEnv(environ, name);
-	return value === void 0 ? [] : [value];
-});
 /** What a process in a program masks: what its run told it to. */
-const inheritedScrubber = (environ) => scrubberOf(valuesOf(inheritedNames(environ), environ));
-/** What a run masks in a message of its own: the same names' values. */
-const runScrubber = (names, environ) => scrubberOf(valuesOf(names, environ));
+const inheritedScrubber = (environ) => scrubberOf(envValuesOf(inheritedNames(environ), environ));
 /** What a run tells a run it calls: names, never values. */
 const maskedEnv = (names) => names.length === 0 ? {} : { [MASKED_ENV]: names.join(",") };
 /** The values to mask: what the workflow reads, and the names given. */
-const secretsOf = (workflow, environ, also = []) => valuesOf(namesToMask(workflow, environ, also), environ);
+const secretsOf = (workflow, environ, also = []) => envValuesOf(namesToMask(workflow, environ, also), environ);
 /** A node's `env:`, rendered. */
 const renderEnv = (node, context, environ) => {
 	const values = {};
 	const scope = {
-		...runScope(context.inputs, context.outputs, context.runId),
+		...runScope(context.inputs, context.outputs, context.runId, context.item),
 		output: { env: environ }
 	};
 	for (const [key, text] of Object.entries(node.env ?? {})) {
@@ -1141,26 +1534,22 @@ const clearStateFiles = (runDir, warn) => {
 *   without a shell, checked against `allow` (or the integration's default),
 *   its arguments and observed output fields from the integration's adapter,
 *   long output kept in run files. It sees who it is and the node's `env:`
-*   (`tool-env.ts`), and may return JSON (`tool-output.ts`).
+*   (`tool-env.ts`), may return JSON (`tool-output.ts`), and may run once per
+*   set of files (`runUnlessPassed` in `tool-command.ts`).
 */
 /** How much of stdout and stderr a node's output keeps. */
 const OUTPUT_LIMIT = 65536;
 const ERROR_LIMIT = 1024;
+/** The interpreters whose script's commands a heavy check reads. */
+const SHELLS = /* @__PURE__ */ new Set([
+	"sh",
+	"bash",
+	"zsh"
+]);
 /** Whether `args` starts with one of the allowed prefixes (`"pr merge"`). */
 const isAllowed = (args, allow) => allow === void 0 || allow.some((prefix) => {
 	return prefix.trim().split(/\s+/u).every((word, i) => args[i] === word);
 });
-const render = (text, context) => {
-	const template = parseTemplate(text);
-	if (!template.ok) return {
-		ok: false,
-		error: template.message
-	};
-	return {
-		ok: true,
-		value: renderTemplate(template.parts, runScope(context.inputs, context.outputs, context.runId))
-	};
-};
 /** The program and arguments a tool node runs, before the allow check. */
 const commandOf = (node, context) => {
 	const line = commandLineOf(node);
@@ -1171,12 +1560,14 @@ const commandOf = (node, context) => {
 	const tokens = tokenize(line);
 	if (!tokens.ok) return tokens;
 	const args = [];
+	let afterSeparator = false;
 	for (const token of tokens.args) {
 		if (node.script !== void 0) {
 			args.push(token);
 			continue;
 		}
-		const rendered = render(token, context);
+		const rendered = renderArg(token, context, !afterSeparator);
+		afterSeparator ||= token === "--";
 		if (!rendered.ok) return rendered;
 		args.push(rendered.value);
 	}
@@ -1212,19 +1603,10 @@ const capped = (text, file) => {
 * what a session is told. All of it is kept in the output's fields and files.
 */
 const clipError = (text) => text.length <= ERROR_LIMIT ? text : `${text.slice(0, ERROR_LIMIT)}…`;
-const failed$1 = (error) => ({
-	ok: false,
-	output: {
-		exitCode: -1,
-		stdout: "",
-		stderr: error
-	},
-	error
-});
 /** Runs a user's CLI through its integration's adapter, with its own login. */
 const toolExecutor = (given, options = {}) => async (context) => {
 	const { node } = context;
-	if (!isToolNode(node)) return failed$1(`${context.id} is not a tool node`);
+	if (!isToolNode(node)) return failed$1(`${context.id} is not a tool`, "unknown");
 	const environ = options.environ ?? process.env;
 	const scrub = scrubberOf(secretsOf(context.workflow, environ, options.maskedNames));
 	const command = commandOf(node, context);
@@ -1235,7 +1617,7 @@ const toolExecutor = (given, options = {}) => async (context) => {
 	if (!isAllowed(checked, allow)) return failed$1(scrub(`${markValue(checked.join(" "))} is not in the node's allow list (${(allow ?? []).map((entry) => markValue(entry)).join(", ")})`));
 	let cwd = context.cwd;
 	if (node.cwd !== void 0) {
-		const rendered = render(node.cwd, context);
+		const rendered = renderArg(node.cwd, context);
 		if (!rendered.ok) return failed$1(rendered.error);
 		cwd = path.resolve(context.cwd, rendered.value);
 	}
@@ -1245,32 +1627,49 @@ const toolExecutor = (given, options = {}) => async (context) => {
 	const outputFile = node.output?.format === "json" ? prepareOutputFile(context.runDir, context.id, context.round) : void 0;
 	const env = {
 		...nodeEnv.values,
-		...identityOf(context, options.orkBin),
+		...identityOf(context, options.orkBin, environ, options.store),
 		...maskedEnv(namesToMask(context.workflow, environ, options.maskedNames)),
 		...outputFile === void 0 ? {} : { [OUTPUT_ENV]: outputFile },
 		...node.watch === void 0 ? {} : { [STATE_ENV]: prepareStateFile(context.runDir, context.id) }
 	};
 	const names = Object.keys(nodeEnv.values);
-	context.emit({
-		type: "tool.called",
-		id: context.id,
-		name: scrub(command.program),
-		input: {
-			command: scrub([
-				command.program,
-				...command.args,
-				...node.script === void 0 ? [] : ["<script>"]
-			].join(" ")),
-			...names.length === 0 ? {} : { env: names }
-		}
-	});
-	const scriptFile = node.script === void 0 ? void 0 : writeScriptFile(context.runDir, context.id, context.round, node.script);
-	const raw = await runner(command.program, scriptFile === void 0 ? command.args : [...command.args, scriptFile], {
+	const shown = scrub([
+		command.program,
+		...command.args,
+		...node.script === void 0 ? [] : ["<script>"]
+	].join(" "));
+	const execute = async () => {
+		const release = await context.machine?.slot([command.program, ...command.args].join(" "), context.signal, node.script !== void 0 && SHELLS.has(path.basename(command.program)) ? { script: node.script } : {});
+		context.emit({
+			type: "tool.called",
+			id: context.id,
+			name: scrub(command.program),
+			input: {
+				command: shown,
+				...names.length === 0 ? {} : { env: names }
+			}
+		});
+		const scriptFile = node.script === void 0 ? void 0 : writeScriptFile(context.runDir, context.id, context.round, node.script);
+		const priority = context.machine?.priority;
+		return runner(command.program, scriptFile === void 0 ? command.args : [...command.args, scriptFile], {
+			cwd,
+			signal: context.signal,
+			env,
+			...priority === void 0 ? {} : { priority }
+		}).finally(() => {
+			release?.();
+			if (scriptFile !== void 0) removeOutputFile(scriptFile);
+		});
+	};
+	const raw = await runUnlessPassed({
+		node,
+		context,
 		cwd,
-		signal: context.signal,
-		env
+		shown,
+		environ,
+		execute
 	});
-	if (scriptFile !== void 0) removeOutputFile(scriptFile);
+	if (raw === null) return skippedCheck(outputFile);
 	const run = {
 		exitCode: raw.exitCode,
 		stdout: scrub(raw.stdout),
@@ -1306,30 +1705,14 @@ const toolExecutor = (given, options = {}) => async (context) => {
 	context.emit({
 		type: "tool.result",
 		id: context.id,
-		isError: run.exitCode !== 0 || json?.ok === false || declared !== null
+		isError: run.exitCode !== 0 || json?.ok === false || declared !== null,
+		...raw.cpu === void 0 ? {} : { cpu: raw.cpu }
 	});
-	if (json?.ok === false) return {
-		ok: false,
-		output,
-		error: `${context.id}: ${json.error}`
-	};
-	if (declared !== null) return {
-		ok: false,
-		output,
-		error: declared
-	};
+	if (json?.ok === false) return invalidOutput(output, json.error);
+	if (declared !== null) return invalidOutput(output, declared);
 	if (json !== null) output["json"] = json.json;
-	if (run.exitCode === 0) return {
-		ok: true,
-		output
-	};
-	const last = run.stderr.trim().split("\n").at(-1) ?? "";
-	return {
-		ok: false,
-		transient: true,
-		output,
-		error: `${scrub(command.program)} exited with ${String(run.exitCode)}${last === "" ? "" : `: ${clipError(last)}`}`
-	};
+	const signedOut = integration?.signedOut;
+	return exitEnd(output, run, context, scrub(command.program), signedOut);
 };
 // ../nodes/src/verify.ts
 /**
@@ -1341,15 +1724,17 @@ const toolExecutor = (given, options = {}) => async (context) => {
 /** A setup that failed: no session started, so nothing was spent on it. */
 const beforeFailed = (ran) => {
 	const error = `its before step failed: ${ran.error ?? "no reason given"}`;
-	return {
+	return endedWith({
 		ok: false,
-		error,
 		output: {
 			status: "fail",
 			summary: error,
 			before: ran.output
 		}
-	};
+	}, endOf({
+		...ran,
+		ok: false
+	}));
 };
 /** With nothing to run a step, a report cannot be accepted. */
 const noSteps = () => Promise.resolve({
@@ -1370,20 +1755,23 @@ const runStep = async (tool, given, { timeout, ...fields }, step) => {
 		type: "tool.shell",
 		...fields
 	};
-	const context = {
-		...given,
-		step
-	};
 	const ms = timeoutMs(timeout);
 	if (ms === void 0) return tool({
-		...context,
+		...given,
+		step,
 		node
 	});
+	const { clock, machine } = slotClock(given.hold, given.machine);
+	const context = {
+		...given,
+		step,
+		...machine === void 0 ? {} : { machine }
+	};
 	const limit = new AbortController();
 	const finished = new AbortController();
 	let expired = false;
 	const watch = async () => {
-		if (await heldTimeout(context.hold, ms, AbortSignal.any([context.signal, finished.signal]))) {
+		if (await heldTimeout(clock, ms, AbortSignal.any([context.signal, finished.signal]))) {
 			expired = true;
 			limit.abort();
 		}
@@ -1494,42 +1882,28 @@ const checkedResult = (result, { check, resumes }) => {
 	};
 	const reason = `its check failed: ${check.error ?? "no reason given"}`;
 	const error = result.ok ? reason : `${reason} (then: ${result.error ?? "no report"})`;
-	return {
+	return endedWith({
 		...result,
 		ok: false,
-		error,
 		output: {
 			...result.output,
 			status: "fail",
 			summary: error,
 			verify
 		}
-	};
+	}, endOf(result.ok ? {
+		...check,
+		ok: false
+	} : result));
 };
 // ../nodes/src/claude.ts
 /**
-* @file The Claude node type: runs a `claude.leader` or `claude.worker` as one
+* @file The Claude node type: runs an `agent.leader` or `agent.worker` as one
 *   session, planned with the run's outputs (and the brief its owner gave it),
 *   and turns its report into the node's output. A leader gets its children
 *   through the session's ports, and resumes its session on re-entry
 *   (ADR-019).
 */
-const MAX_INPUT = 8192;
-/** On a loop re-entry, the brief carries what the workflow sent back. */
-const reentryNote = (round, input) => {
-	const json = JSON.stringify(input ?? {}, void 0, 2);
-	const body = json.length > MAX_INPUT ? `${json.slice(0, MAX_INPUT)}\n…` : json;
-	return `\n\n## Round ${String(round)}\n\nThe workflow sent this task back to you with:\n\n\`\`\`json\n${body}\n\`\`\``;
-};
-/**
-* What a resumed leader is told: it already has its brief and its earlier work,
-* so only the new round, and the new task when its owner sent one.
-*/
-const resumeMessage = (round, input, brief) => [brief === void 0 ? sentBack(round, input) : `## New task from \`${brief.from}\`\n\n${brief.text}`, "End with a new structured report."].join("\n\n");
-/** A first-round resume is a session the run was cut off in (`ork resume`). */
-const sentBack = (round, input) => round === 1 ? "Ork was stopped while you worked on this task, and the run is resumed. Your earlier turns are above: check what you finished, and carry on from there." : `The workflow sent your task back to you.${reentryNote(round, input)}`;
-/** What a session is told when messages came in as it finished. */
-const lateMessage = (count) => `[ork] ${String(count)} message${count === 1 ? "" : "s"} came in while you finished. Call read_inbox, act on ${count === 1 ? "it" : "them"} if needed, and end with a new structured report.`;
 /** A re-entered leader resumes; anyone else starts with the full brief. */
 const specFor = (spec, context) => {
 	if (context.resume !== void 0) return {
@@ -1543,24 +1917,9 @@ const specFor = (spec, context) => {
 	};
 	return spec;
 };
-/** Runs a `claude.leader` or `claude.worker` as one session. */
+/** Runs an `agent.leader` or `agent.worker` as one session. */
 const claudeExecutor = (options) => async (context) => {
-	const planOptions = {
-		cwd: context.cwd,
-		inputs: context.inputs,
-		outputs: context.outputs,
-		inPlace: options.inPlace,
-		workflowDir: context.workflowDir,
-		projectRoot: context.projectRoot,
-		...context.orkDir === void 0 ? {} : { orkDir: context.orkDir },
-		pluginDir: path.join(context.runDir, "plugins", context.id)
-	};
-	if (context.checkout !== void 0) planOptions.checkout = context.checkout;
-	if (context.brief !== void 0) planOptions.brief = context.brief;
-	if (context.template !== void 0) planOptions.template = context.template;
-	if (context.ownership !== void 0) planOptions.ownership = context.ownership;
-	if (context.mailbox !== void 0) planOptions.mailbox = context.mailbox;
-	if (context.claims !== void 0) planOptions.claims = context.claims;
+	const planOptions = planOptionsOf(context, options.inPlace);
 	const before = beforeOf(context.node, context.workflow.defaults);
 	if (before !== void 0) {
 		const ran = await runStep(options.steps ?? noSteps, context, before, {
@@ -1569,49 +1928,53 @@ const claudeExecutor = (options) => async (context) => {
 		});
 		if (!ran.ok) return beforeFailed(ran);
 		await context.hold?.wait("start", context.signal);
-		if (context.signal.aborted) return beforeFailed({
-			...ran,
-			error: "the node was stopped"
-		});
+		if (context.signal.aborted) {
+			const end = stoppedEnd(context.signal);
+			return beforeFailed({
+				...ran,
+				ok: false,
+				error: end.message,
+				end
+			});
+		}
 		planOptions.before = ran.output;
 	}
 	const blocked = context.quota?.().blocked;
-	if (blocked !== void 0) return notStarted(blocked, blocked);
-	const budget = budgetNow(context);
-	if (budget !== void 0 && budget <= 0) return notStarted("nothing is left of the run's budget");
-	if (budget !== void 0) planOptions.budgetLeftUsd = budget;
+	if (blocked !== void 0) return notStarted("plan_limit", blocked, blocked);
+	const refused = await startBudgets(context, planOptions);
+	if (refused !== null) return refused;
 	const plan = planNodeSession(context.workflow, context.id, planOptions);
-	if (!plan.ok) return {
-		ok: false,
-		output: {
-			status: "fail",
-			summary: plan.error
-		},
-		error: plan.error
+	if (!plan.ok) return notStarted("invalid_node", plan.error);
+	const servers = namedMcpEntries(context.projectRoot, plan.mcp);
+	if (!servers.ok) return notStarted("invalid_node", servers.error);
+	const spec = {
+		...specFor(plan.spec, context),
+		...servers.value
 	};
-	const spec = specFor(plan.spec, context);
 	if (options.machineClaude === true) spec.machineClaude = true;
-	const driver = sessionDriver({
-		override: options.driver,
-		named: plan.driver,
-		ready: options.readyDriver
-	});
-	if (driver === void 0) return notStarted("no Claude driver is ready; see `ork doctor`");
+	const driver = sessionDriverOf(context, plan, options);
+	if (typeof driver !== "string") return driver;
 	const runtime = await options.runtimeFor(driver);
-	const ports = { human: context.owner === void 0 ? context.human : ownerFirst(context, context.owner, {
+	const ports = { human: context.owner === void 0 ? withdrawnOnStop(context) : ownerFirst(context, context.owner, {
 		runtimeFor: options.runtimeFor,
 		driver: options.driver,
 		readyDriver: options.readyDriver,
 		inPlace: options.inPlace
 	}) };
 	if (context.hold !== void 0) ports.hold = context.hold;
+	if (context.machine !== void 0) ports.machine = context.machine;
 	if (context.ownership !== void 0) ports.ownership = context.ownership;
 	if (context.mailbox !== void 0) ports.mailbox = context.mailbox;
 	if (context.claims !== void 0) ports.claims = context.claims;
 	if (context.feedback !== void 0) ports.feedback = context.feedback;
-	const watch = limitWatch(context);
-	const run = async (asked) => {
-		const watching = watch.session(asked);
+	if (context.followUps !== void 0) ports.followUps = context.followUps;
+	const whole = context.round > 1 ? wholeInput(context.input) : void 0;
+	if (whole !== void 0) ports.input = whole;
+	const watch = limitWatch(context, runCapsOf(context, planOptions));
+	const run = async (asked, prior = 0) => {
+		const watching = watch.session(asked, prior);
+		context.reserveBudget?.(asked.budgetUsd);
+		context.reserveTokens?.(asked.budgetTokens);
 		const session = runtime.start(asked, ports);
 		const stop = () => {
 			session.interrupt();
@@ -1629,6 +1992,8 @@ const claudeExecutor = (options) => async (context) => {
 				context.emit(event);
 			}
 		} finally {
+			context.reserveBudget?.(0);
+			context.reserveTokens?.(0);
 			disconnect?.();
 			context.signal.removeEventListener("abort", stop);
 		}
@@ -1636,7 +2001,7 @@ const claudeExecutor = (options) => async (context) => {
 		return outcome;
 	};
 	const first = await run(spec);
-	const limitsAfter = ({ sessionId, usage }) => {
+	const limitsAfter = ({ sessionId, usage }, turnsAtLeast = 0) => {
 		const quota = context.quota?.();
 		if (quota?.blocked !== void 0) {
 			watch.stoppedBy(quota.blocked);
@@ -1644,15 +2009,19 @@ const claudeExecutor = (options) => async (context) => {
 		}
 		return lateLimits(spec, {
 			spent: context.ownSpend?.(sessionId, usage.costUsd) ?? usage.costUsd,
-			turns: usage.turns
-		}, context.budgetLeftNow?.(), quota?.leftUsd);
+			turns: usage.turns,
+			tokens: countedTokens(usage)
+		}, context.budgetLeftNow?.(), quota?.leftUsd, {
+			run: context.tokensLeftNow?.(),
+			quota: quota?.leftTokens
+		}, turnsAtLeast);
 	};
 	const resumeWith = (outcome, prompt, limits) => run({
 		...spec,
 		...limits,
 		resume: outcome.sessionId,
 		prompt
-	});
+	}, outcome.usage.costUsd);
 	const lateTurn = (current) => {
 		const late = context.mailbox?.pending() ?? 0;
 		const limits = limitsAfter(current);
@@ -1678,7 +2047,7 @@ const claudeExecutor = (options) => async (context) => {
 		},
 		late: lateTurn,
 		resume: async (current, check) => {
-			const limits = limitsAfter(current);
+			const limits = limitsAfter(current, 20);
 			if (limits === null) return null;
 			await context.hold?.wait("start", context.signal);
 			return context.signal.aborted ? null : resumeWith(current, checkFailedMessage(check, {
@@ -1691,10 +2060,11 @@ const claudeExecutor = (options) => async (context) => {
 };
 // ../nodes/src/gate.ts
 /**
-* @file The `human.gate` node type: asks the human the rendered question,
-*   outputs their choice with the note they gave, and answers with the
-*   `default` when the `timeout` passes. The timeout counts only while the run
-*   and the gate are not paused (ADR-041).
+* @file The `human.gate` node type: asks the human the rendered question, with
+*   its document if it has one, both in readable text (no raw JSON), outputs
+*   their choice with the note they gave, and answers with the `default` when
+*   the `timeout` passes. The timeout counts only while the run and the gate
+*   are not paused (ADR-041).
 */
 /** A promise that never settles: the losing side of a race. */
 const NEVER = new Promise(() => {});
@@ -1716,8 +2086,13 @@ const gateExecutor = async (context) => {
 		output: {},
 		error: `${context.id} is not a gate`
 	};
-	const template = parseTemplate(node.question);
-	const question = template.ok ? renderTemplate(template.parts, runScope(context.inputs, context.outputs, context.runId)) : node.question;
+	const scope = runScope(context.inputs, context.outputs, context.runId);
+	const render = (text) => {
+		const template = parseTemplate(text);
+		return template.ok ? renderTemplate(template.parts, scope, { readable: true }) : text;
+	};
+	const question = render(node.question);
+	const document = render(node.document ?? "");
 	const options = node.options.map((o) => choiceOf(o));
 	const withdraw = new AbortController();
 	context.signal.addEventListener("abort", () => {
@@ -1728,12 +2103,14 @@ const gateExecutor = async (context) => {
 		nodeId: context.id,
 		question,
 		options,
+		waits: true,
 		signal: withdraw.signal,
 		onNote: (given) => {
 			note = given;
 		}
 	};
 	if (node.recommended !== void 0) asked.recommended = node.recommended;
+	if (document.trim() !== "") asked.document = document;
 	const answer = context.human.ask(asked).then((choice) => ({
 		choice,
 		answeredBy: "user",
@@ -1752,21 +2129,22 @@ const gateExecutor = async (context) => {
 	})];
 	try {
 		const output = await Promise.race([answer, ...expired]);
-		if (!options.some((o) => o.id === output.choice)) return {
-			ok: false,
-			output,
-			error: "no one answered the gate"
-		};
+		if (!options.some((o) => o.id === output.choice)) {
+			const facts = node.timeout === void 0 ? {} : { timeout: node.timeout };
+			return endedWith({
+				ok: false,
+				output
+			}, endFor("timed_out", facts, "no one answered the gate"));
+		}
 		return {
 			ok: true,
 			output
 		};
 	} catch {
-		return {
+		return endedWith({
 			ok: false,
-			output: {},
-			error: "the gate was withdrawn"
-		};
+			output: {}
+		}, endFor("interrupted", {}, "the gate was withdrawn"));
 	} finally {
 		answered.abort();
 	}
@@ -1781,18 +2159,16 @@ const gateExecutor = async (context) => {
 */
 /** A node's `timeout:` is what limits a call; this only lifts the SDK's 60 s. */
 const NO_LIMIT_MS = 864e5;
-const failed = (error, output = {}) => ({
+const failed = (kind, facts, detail, output = {}) => endedWith({
 	ok: false,
-	output,
-	error
-});
-/** A failure another try might not have, so a `watch:` looks again. */
-const missed = (error, output = {}) => ({
-	ok: false,
-	transient: true,
-	output,
-	error
-});
+	output
+}, endFor(kind, facts, detail));
+/** How a call that threw ended: a sign-in, a server that won't start, or else. */
+const thrownKind = (error) => {
+	const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+	if (code === 401 || error?.constructor.name === "UnauthorizedError") return "auth";
+	return code === "ENOENT" ? "tool_missing" : "command_failed";
+};
 /**
 * A string's templates rendered. A string that is one `{{ … }}` and nothing
 * else keeps its value's type, so a tool that asks for a number gets one.
@@ -1836,19 +2212,22 @@ const reasonOf = (error, server) => {
 };
 const mcpCallExecutor = (options = {}) => async (context) => {
 	const { node } = context;
-	if (node.type !== "mcp.call") return failed(`${context.id} is not an MCP call`);
+	if (node.type !== "mcp.call") {
+		const said = `${context.id} is not an MCP call`;
+		return failed("unknown", {}, said);
+	}
 	const environ = options.environ ?? process.env;
 	const declared = readMcpServer(context.projectRoot, node.server);
-	if (!declared.ok) return failed(declared.error);
+	if (!declared.ok) return failed("invalid_node", { reason: declared.error });
 	const nodeEnv = renderEnv(node, context, environ);
-	if (!nodeEnv.ok) return failed(nodeEnv.error);
+	if (!nodeEnv.ok) return failed("invalid_node", { reason: nodeEnv.error });
 	const expanded = expandServer(declared.value, {
 		...environ,
 		...nodeEnv.values
 	}, node.plainEnv);
-	if (!expanded.ok) return failed(expanded.error);
+	if (!expanded.ok) return failed("invalid_node", { reason: expanded.error });
 	const scrub = scrubberOf([...secretsOf(context.workflow, environ, options.maskedNames), ...expanded.value.values]);
-	const scope = runScope(context.inputs, context.outputs, context.runId);
+	const scope = runScope(context.inputs, context.outputs, context.runId, context.item);
 	const args = Object.fromEntries(Object.entries(node.arguments ?? {}).map(([key, value]) => [key, renderValue(value, scope)]));
 	const name = `${node.server}.${node.tool}`;
 	context.emit({
@@ -1889,19 +2268,22 @@ const mcpCallExecutor = (options = {}) => async (context) => {
 			id: context.id,
 			isError: reported || tooLong || problem !== null
 		});
-		if (reported) return missed(`${name} failed: ${clipError(said)}`, output);
-		if (tooLong) return failed(`${name}'s result is over 64 KiB`, output);
-		return problem === null ? {
+		if (reported) return failed("command_failed", { program: name }, said, output);
+		if (tooLong) {
+			const reason = `${name}'s result is over 64 KiB`;
+			return failed("invalid_output", { reason }, void 0, output);
+		}
+		return problem === null ? endedWith({
 			ok: true,
 			output
-		} : failed(problem, output);
+		}, endFor("done")) : failed("invalid_output", { reason: problem }, void 0, output);
 	} catch (error) {
 		context.emit({
 			type: "tool.result",
 			id: context.id,
 			isError: true
 		});
-		return missed(clipError(scrub(reasonOf(error, node.server))));
+		return failed(thrownKind(error), { program: `MCP server \`${node.server}\`` }, clipError(scrub(reasonOf(error, node.server))));
 	} finally {
 		await client.close().catch(() => {});
 	}
@@ -1912,13 +2294,42 @@ const mcpCallExecutor = (options = {}) => async (context) => {
 *   text. A program runs in its own process group, so aborting it reaches
 *   whatever it started: SIGTERM, then SIGKILL for what ignores that. A stop or
 *   a timeout therefore leaves nothing running, and an escaped process that
-*   keeps the output pipes open cannot hold the node.
+*   keeps the output pipes open cannot hold the node. Off Windows it runs under
+*   `sh`, whose `times` says the CPU the program and its children used, beside
+*   the orphan guard, which ends the group when `ork` dies, and at the
+*   project's priority: `low` starts it below Ork's own (nice, and on macOS
+*   utility QoS).
 */
-/** How long a program may take to end after SIGTERM. */
-const KILL_AFTER_MS = 2e3;
 /** How long to wait for the pipes to close after SIGKILL. */
 const CLOSE_AFTER_MS = 500;
-const spawnTool = (program, args, { cwd, signal, env }) => {
+/** The fd of the orphan guard's pipe from `ork`. */
+const WATCH_FD = 4;
+/**
+* Runs `$0 "$@"` beside the orphan guard, which ends the group if `ork` dies,
+* and stops the guard once the program ends, so its leftovers live on as
+* before. Then writes the shell's `times` to fd 3: its children's user and
+* system time, the program's whole tree that it waited for. A program that
+* isn't there says so on fd 3, as spawn's ENOENT would.
+*/
+const TIMED = String.raw`command -v "$0" >/dev/null 2>&1 || { echo ork-missing >&3; exit 127; }; ${orphanGuard(WATCH_FD)}w=$!; "$0" "$@" 3>&- ${String(WATCH_FD)}<&-; s=$?; kill -s KILL $w 2>/dev/null; times >&3; exit $s`;
+const MISSING = "ork-missing";
+/** The children's line of `times` (`0m1.250s 0m0.300s`), in milliseconds. */
+const cpuOfTimes = (text) => {
+	const [, , user, system] = [...text.matchAll(/(\d+)m([\d.]+)s/gu)].map(([, m = "0", s = "0"]) => Number(m) * 60 + Number(s));
+	return user === void 0 || system === void 0 ? void 0 : {
+		userMs: Math.round(user * 1e3),
+		systemMs: Math.round(system * 1e3)
+	};
+};
+const timed = process.platform !== "win32";
+/** What to start: the program, under `sh` to time it, at the priority. */
+const startOf = (program, args, priority) => timed ? startAt(priority, "sh", [
+	"-c",
+	TIMED,
+	program,
+	...args
+]) : [program, [...args]];
+const spawnTool = (program, args, { cwd, signal, env, priority }) => {
 	if (signal.aborted) return Promise.resolve({
 		exitCode: -1,
 		stdout: "",
@@ -1928,7 +2339,9 @@ const spawnTool = (program, args, { cwd, signal, env }) => {
 		const stdout = [];
 		const stderr = [];
 		const timers = [];
-		const child = spawn(program, args, {
+		const times = [];
+		const [bin, argv] = startOf(program, args, priority);
+		const child = spawn(bin, argv, {
 			cwd,
 			detached: true,
 			env: {
@@ -1938,9 +2351,17 @@ const spawnTool = (program, args, { cwd, signal, env }) => {
 			stdio: [
 				"ignore",
 				"pipe",
+				"pipe",
+				"pipe",
 				"pipe"
 			]
 		});
+		lowerChild(priority, child.pid);
+		holdGuard(child.stdio[WATCH_FD]);
+		const fd3 = child.stdio[3];
+		if (fd3 instanceof Readable) fd3.setEncoding("utf8").on("data", (chunk) => {
+			times.push(chunk);
+		});
 		const killGroup = (kill) => {
 			if (child.pid === void 0) return;
 			try {
@@ -1952,11 +2373,21 @@ const spawnTool = (program, args, { cwd, signal, env }) => {
 			signal.removeEventListener("abort", abort);
 			resolve(run);
 		};
-		const collected = (exitCode) => ({
-			exitCode,
-			stdout: stdout.join(""),
-			stderr: stderr.join("")
-		});
+		const collected = (exitCode) => {
+			const said = times.join("");
+			if (said.includes(MISSING)) return {
+				exitCode: -1,
+				stdout: stdout.join(""),
+				stderr: `could not run ${program}: spawn ${program} ENOENT`
+			};
+			const cpu = cpuOfTimes(said);
+			return {
+				exitCode,
+				stdout: stdout.join(""),
+				stderr: stderr.join(""),
+				...cpu === void 0 ? {} : { cpu }
+			};
+		};
 		const abort = () => {
 			killGroup("SIGTERM");
 			timers.push(setTimeout(() => {
@@ -1967,10 +2398,10 @@ const spawnTool = (program, args, { cwd, signal, env }) => {
 			}, KILL_AFTER_MS));
 		};
 		signal.addEventListener("abort", abort, { once: true });
-		child.stdout.setEncoding("utf8").on("data", (chunk) => {
+		child.stdout?.setEncoding("utf8").on("data", (chunk) => {
 			stdout.push(chunk);
 		});
-		child.stderr.setEncoding("utf8").on("data", (chunk) => {
+		child.stderr?.setEncoding("utf8").on("data", (chunk) => {
 			stderr.push(chunk);
 		});
 		child.on("error", (error) => {
@@ -1990,6 +2421,7 @@ const spawnTool = (program, args, { cwd, signal, env }) => {
 const builtinExecutors = (options) => {
 	const tool = toolExecutor(options.tools ?? spawnTool, {
 		...options.orkBin === void 0 ? {} : { orkBin: options.orkBin },
+		...options.store === void 0 ? {} : { store: options.store },
 		...options.maskedNames === void 0 ? {} : { maskedNames: options.maskedNames }
 	});
 	const claude = claudeExecutor({
@@ -1997,8 +2429,8 @@ const builtinExecutors = (options) => {
 		steps: tool
 	});
 	const executors = {
-		"claude.leader": claude,
-		"claude.worker": claude,
+		"agent.leader": claude,
+		"agent.worker": claude,
 		"human.gate": gateExecutor,
 		"workflow.call": callExecutor,
 		"mcp.call": mcpCallExecutor(options.maskedNames === void 0 ? {} : { maskedNames: options.maskedNames })
@@ -2130,4 +2562,4 @@ const missingPrograms = (workflow, installed = (program) => onPath(program)) =>
 	}
 	return [...missing.values()];
 };
-export { resultOf as _, builtinExecutors as a, toolExecutor as c, maskedEnv as d, maskedNamesOfRun as f, clearOutputFiles as g, sessionEnv as h, onPath as i, clearStateFiles as l, runScrubber as m, missingProgramMessage as n, spawnTool as o, runMarkerIn as p, missingPrograms as r, mcpCallExecutor as s, envProblems as t, inheritedScrubber as u };
+export { clearOutputFiles as _, builtinExecutors as a, runScrubber as b, toolExecutor as c, maskedEnv as d, maskedNamesOfRun as f, storeGuarded as g, runMarkerIn as h, onPath as i, clearStateFiles as l, sessionEnv as m, missingProgramMessage as n, spawnTool as o, scrubberOfRun as p, missingPrograms as r, mcpCallExecutor as s, envProblems as t, inheritedScrubber as u, namedMcpEntries as v, resultOf as y };