@krapht/ork 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/{src-BbyEoMn4.mjs → src-BrFfDKux.mjs}

@@ -1,152 +1,87 @@
-import { B as linkNodes, Cn as runDirOf, Ct as walkChecks, En as inside, Fn as applyEdits, G as requestContinue, Gn as expandEdge, Hn as EdgeInputSchema, Ht as planPost, In as newWorkflowText, J as tellLiveRun, K as requestPause, Ln as readDocument, Nn as skillsIn, Nt as nodeSays, On as LESSON_CAP_TOKENS, Pn as WorkflowEditSchema, Rn as renderJsonSchema, St as checkWorkflowText, Tn as workflowDirOf, U as unlinkNodes, Ut as runGh, Vt as DISCUSSIONS, Wt as sendPost, _t as runStatus, bn as placeFiles, bt as processAlive, ct as explainWorkflowText, d as runningRunIds, f as runningScript, gt as pausedOf, hn as loadAgents, ht as liveStatus, l as planUpgrade, nt as resumable, o as limitsReport, ot as detachRun, p as detectInstaller, q as requestStop, qn as NodeSchema, r as capsHere, st as followEvents, tn as readCondition, tt as detachResume, u as releaseNotes, v as triggersReport, vt as runTree, wt as walkSummary, xn as placeFor, zn as parseWorkflow } from "./src-Dujmvv4s.mjs";
-import { C as feedbackActions, S as placeOf$1, _ as previewPost, a as registryShown, b as acceptItem, c as checkDue, f as readUpdateCache, g as nodeSession, h as writeUpdateCache, i as registryOf, l as fetchLatest, m as updateCachePath, o as updateSwitchOff, p as refreshUpdateCache, s as runInstall, u as newerVersion, w as openFixRun, x as lessonPlaceOf, y as recordNote } from "./__build_info__-fy6L1Mrd.mjs";
-import { n as pendingDecisions, r as builtinProblem, t as answerDecision } from "./decide-CGyx9rv7.mjs";
-import { n as newRunId, t as findRun } from "./find-D6Gj1sxg.mjs";
-import { c as openStore, l as storePath, s as nodeOf } from "./output-BLQWD6MJ.mjs";
-import { n as usageReport } from "./report-DK4LGqwF.mjs";
-import { a as planClean, i as keyOf, o as stepActs, r as cleanStep, s as stepPrunes, t as applyClean } from "./clean-DaHjs__2.mjs";
-import { a as readWorktrees, c as planLine, i as projectHead, l as removeRefusal, n as lostWork, o as labelOf, r as planRemove, s as mergeStateOf, t as applyRemove, u as stateParts } from "./remove-BeGdqroy.mjs";
+import { $n as findFollowUp, $t as planClean, An as requestContinue, C as detectInstaller, Et as walkSummary, Gn as nestItems, Gt as feedbackListTable, Hn as processAlive, Hr as loadAgents, I as activeTree, In as pausedOf, Jt as usageListTable, Kr as placeFiles, Kt as followUpListTable, L as isNodeEvent, Ln as runStatus, Mn as requestStop, Nn as tellLiveRun, O as triggersReport, On as linkNodes, Pn as liveStatus, Qn as dueCause, Qr as inside, Qt as keyOf, R as openStore, S as runningScript, Si as NodeSchema, Tn as DEFAULT_FOLLOW_UPS_RULE, Tr as readCondition, Tt as walkChecks, Ut as LIST_TABLES, Vn as yoloOf, Wt as decisionListTable, Xt as applyClean, Yn as loadProject, Yr as runDirOf, Yt as worktreeListTable, Zn as changeFollowUp, Zr as workflowDirOf, Zt as cleanStep, _ as usageReport, _i as EdgeInputSchema, _n as postFollowUpMessage, _r as sendPost, _t as limitsReport, a as planRemove, ai as skillsIn, b as releaseNotes, bi as expandEdge, br as feedbackActions, ci as newWorkflowText, cr as previewPost, d as mergeStateOf, dt as resumable, ei as LESSON_CAP_TOKENS, en as stepActs, er as followUpActions, f as planLine, gr as runGh, hr as planPost, i as lostWork, jn as requestPause, kn as unlinkNodes, li as readDocument, m as stateParts, mi as parseWorkflow, mr as DISCUSSIONS, mt as followEvents, o as projectHead, oi as WorkflowEditSchema, or as END_KINDS, ot as answerDecision, p as removeRefusal, pi as renderJsonSchema, pt as detachRun, qr as placeFor, qt as runListTable, r as applyRemove, rr as endOf, s as readWorktrees, si as applyEdits, st as pendingDecisions, tn as stepPrunes, u as labelOf, un as nodeSays, ur as recordNote, ut as detachResume, v as capsHere, vn as checkFollowUpsDue, wn as liveSessionOf, wt as checkWorkflowText, x as runningRunIds, xn as startFollowUpChecks, xr as openFixRun, y as planUpgrade, yt as explainWorkflowText, z as storePath } from "./src-BuF9Lbow.mjs";
+import { a as placeOf$1, i as lessonPlaceOf, n as nodeSession, r as acceptItem, t as runInstall } from "./install-Hji6LIei.mjs";
+import { t as applyFilters } from "./apply-Mb0fNpCX.mjs";
+import { i as parseLimit, n as unknownProjectRefusal, r as parseFilters, t as limitRefusal } from "./refusals-DQQX3AIb.mjs";
+import { t as builtinProblem } from "./builtin-files-YYAnbZGD.mjs";
+import { n as newRunId, t as findRun } from "./find-Ct5CNl1J.mjs";
+import { t as outputsText } from "./outputs-text-CNTJ7Qq_.mjs";
+import { a as registryShown, c as fetchLatest, d as readUpdateCache, f as refreshUpdateCache, i as registryOf, l as newerVersion, m as writeUpdateCache, o as updateSwitchOff, p as updateCachePath, s as checkDue } from "./__build_info__-0wqQ-rtf.mjs";
 import path from "node:path";
 import { z } from "zod";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { homedir } from "node:os";
 import { createServer } from "node:http";
-// ../core/src/store/activity.ts
-const LONGEST_LINE = 120;
+// ../server/src/contract-lists.ts
+/** A filter's value: any text; the handler checks it with core. */
+const text = () => z.string().min(1).optional();
 /**
-* The fields of a tool's input that say what it's working on, best first. Only
-* these are shown, so what else a tool was given stays in the logs.
+* A `since` or `until`: `all`, an age (`24h`), a day, or an ISO time. Read with
+* core by the handler, so a bad one is refused in the CLI's words.
 */
-const TARGETS = [
-	"file_path",
-	"notebook_path",
-	"path",
-	"url",
-	"pattern",
-	"query",
-	"command"
-];
-const oneLine = (text) => {
-	const line = text.replaceAll(/\s+/gu, " ").trim();
-	return line.length > LONGEST_LINE ? `${line.slice(0, 119)}…` : line;
-};
-const toolLine = ({ name, input }) => {
-	const target = TARGETS.map((field) => input[field]).find((value) => typeof value === "string" && value.trim() !== "");
-	if (typeof target !== "string") return name;
-	return oneLine(target.startsWith(`${name} `) ? target : `${name} ${target}`);
-};
-/** What a finished node said, or why it failed. */
-const finishedNow = (ok, error, summary) => {
-	if (!ok) return error === void 0 ? void 0 : oneLine(error);
-	return typeof summary === "string" && summary.trim() !== "" ? oneLine(summary) : void 0;
-};
-/** Each node's activity, by id; a node that never started has none. */
-const runActivity = (stored) => {
-	const nodes = /* @__PURE__ */ new Map();
-	const of = (id) => {
-		const found = nodes.get(id);
-		if (found !== void 0) return found;
-		const fresh = {};
-		nodes.set(id, fresh);
-		return fresh;
-	};
-	for (const { at, event } of stored) if (event.type === "node.started") {
-		const node = of(event.id);
-		node.startedAt ??= at;
-		delete node.finishedAt;
-		delete node.now;
-	} else if (event.type === "node.event") {
-		if (event.event.type === "tool.called") of(event.id).now = toolLine(event.event);
-	} else if (event.type === "decision.opened") of(event.node).now = oneLine(`Asked: ${event.question}`);
-	else if (event.type === "decision.answered") of(event.node).now = oneLine(`Answered: ${event.answer}`);
-	else if (event.type === "decision.withdrawn") delete of(event.node).now;
-	else if (event.type === "node.finished") {
-		const node = of(event.id);
-		node.finishedAt = at;
-		const now = finishedNow(event.ok, event.error, event.output["summary"]);
-		if (now === void 0) delete node.now;
-		else node.now = now;
-	}
-	return nodes;
-};
-/** The ownership tree, with what each node is doing and when it ran. */
-const activeTree = (stored) => {
-	const activity = runActivity(stored);
-	const dress = (node) => {
-		Object.assign(node, activity.get(node.id));
-		for (const child of node.children) dress(child);
-	};
-	const roots = runTree(stored.map(({ event }) => event));
-	for (const root of roots) dress(root);
-	return roots;
-};
-// ../server/src/contract-builder.ts
-/** A new workflow's name, as its file and its `name:` take it. */
-const NewWorkflowSchema = z.strictObject({ name: z.string().min(1) });
-/** The server checks each edit; this file imports only types of the schema. */
-const WorkflowEditsSchema = z.strictObject({ edits: z.array(z.custom()).min(1) });
-/** Earlier text, and the file it was based on, to ask before replacing it. */
-const DraftTextSchema = z.strictObject({
-	text: z.string(),
-	baseHash: z.string().nullable()
-});
-const SaveWorkflowSchema = z.strictObject({ 
-/** Write over a file that changed since this draft began. */
-force: z.boolean().optional() });
-const BUILDER_API = {
-	builderSchema: {
-		method: "GET",
-		path: "/api/workflow-schema"
-	},
-	builderCatalog: {
-		method: "GET",
-		path: "/api/projects/:id/catalog"
-	},
-	builderDrafts: {
-		method: "GET",
-		path: "/api/projects/:id/builder"
-	},
-	builderView: {
-		method: "GET",
-		path: "/api/projects/:id/builder/:name"
-	},
-	builderCreate: {
-		method: "POST",
-		path: "/api/projects/:id/builder",
-		body: NewWorkflowSchema
+const time = text;
+/** Each list's filter fields, by flag name, in its core table's order. */
+const LIST_SHAPES = {
+	runs: {
+		status: text(),
+		workflow: text(),
+		project: text(),
+		since: time(),
+		until: time()
 	},
-	builderEdit: {
-		method: "POST",
-		path: "/api/projects/:id/builder/:name/edits",
-		body: WorkflowEditsSchema
+	feedback: {
+		status: text(),
+		kind: text(),
+		severity: text(),
+		workflow: text(),
+		run: text()
 	},
-	builderRestore: {
-		method: "POST",
-		path: "/api/projects/:id/builder/:name/text",
-		body: DraftTextSchema
+	"follow-ups": {
+		status: text(),
+		for: text(),
+		kind: text(),
+		due: text(),
+		project: text()
 	},
-	builderDiscard: {
-		method: "POST",
-		path: "/api/projects/:id/builder/:name/discard"
+	decisions: {
+		workflow: text(),
+		run: text(),
+		project: text()
 	},
-	builderSave: {
-		method: "POST",
-		path: "/api/projects/:id/builder/:name/save",
-		body: SaveWorkflowSchema
-	}
-};
-// ../server/src/contract-context.ts
-const CONTEXT_API = {
-	runContext: {
-		method: "GET",
-		path: "/api/runs/:id/nodes/:node/context"
+	worktrees: {
+		run: text(),
+		project: text()
 	},
-	builderContext: {
-		method: "GET",
-		path: "/api/projects/:id/builder/:name/nodes/:node/context"
+	usage: {
+		workflow: text(),
+		project: text(),
+		since: time(),
+		until: time()
 	}
 };
+/** A list's filter fields as query params: its core table's, each optional. */
+const listShape = (list) => LIST_SHAPES[list];
+Object.keys(LIST_SHAPES.runs), Object.keys(LIST_SHAPES.feedback), Object.keys(LIST_SHAPES["follow-ups"]), Object.keys(LIST_SHAPES.decisions), Object.keys(LIST_SHAPES.worktrees), Object.keys(LIST_SHAPES.usage);
+const Count$1 = z.coerce.number().int().positive();
+/** `GET /api/runs`: `runListTable`'s fields, and the newest `limit`. */
+const RunsQuerySchema = z.strictObject({
+	limit: Count$1.optional(),
+	...LIST_SHAPES.runs
+});
+/**
+* `GET /api/usage`: `usageListTable`'s fields; `since` and `until` also take
+* ISO times (`since` included, `until` not), as before.
+*/
+const UsageQuerySchema = z.strictObject(LIST_SHAPES.usage);
+/**
+* `GET /api/decisions`: `decisionListTable`'s fields; `workflow` is ANDed with
+* `run` or `project`.
+*/
+const DecisionsQuerySchema = z.strictObject(LIST_SHAPES.decisions);
+const LISTS_API = { listFields: {
+	method: "GET",
+	path: "/api/list-fields"
+} };
 // ../server/src/contract-feedback.ts
 const NoteSchema = z.strictObject({
 	/** Its first line is the title. */
@@ -167,7 +102,13 @@ const AcceptSchema = z.strictObject({
 	/** Which workflow's lessons, when it was seen in more than one. */
 	workflow: z.string().min(1).optional()
 });
-const ApplySchema = z.strictObject({ driver: z.enum(["sdk", "cli"]).optional() });
+const DriverIdSchema = z.enum({
+	"claude-code": "claude-code",
+	"open-code": "open-code",
+	"command-code": "command-code"
+});
+DriverIdSchema.options;
+const ApplySchema = z.strictObject({ driver: DriverIdSchema.optional() });
 const PublishPreviewSchema = z.strictObject({ 
 /** Also hide the repositories' and workflows' names. */
 hideNames: z.boolean() });
@@ -176,6 +117,11 @@ const PublishSchema = z.strictObject({
 	/** The preview's digest: what the person saw, so nothing else is sent. */
 	digest: z.string().min(1)
 });
+/**
+* The filters are core's `feedbackListTable` fields; with none, every item
+* comes, dismissed too (the panel hides them itself).
+*/
+const FeedbackItemsQuerySchema = z.strictObject(listShape("feedback"));
 const FEEDBACK_API = {
 	note: {
 		method: "POST",
@@ -184,7 +130,8 @@ const FEEDBACK_API = {
 	},
 	feedbackItems: {
 		method: "GET",
-		path: "/api/feedback"
+		path: "/api/feedback",
+		query: FeedbackItemsQuerySchema
 	},
 	feedbackItem: {
 		method: "GET",
@@ -220,6 +167,125 @@ const FEEDBACK_API = {
 		path: "/api/feedback/:id/split"
 	}
 };
+// ../server/src/contract-follow-ups.ts
+/**
+* The filters are core's `followUpListTable` fields. `status` is `open` (due
+* and waiting, the default), `all` (adds done and dropped), or the table's.
+*/
+const FollowUpsQuerySchema = z.strictObject(listShape("follow-ups"));
+const FollowUpChangeSchema = z.strictObject({ action: z.enum([
+	"done",
+	"drop",
+	"reopen",
+	"due"
+]) });
+/**
+* Posts a drafted GitHub comment through the person's own `gh`. `confirm` says
+* yes, and `digest` is the detail's `draftDigest`, which stands for the
+* recipient and text they saw: the route refuses when the draft is no longer
+* that, so nothing else is sent.
+*/
+const FollowUpPostSchema = z.strictObject({
+	confirm: z.literal(true),
+	digest: z.string().min(1)
+});
+const FOLLOW_UPS_API = {
+	followUps: {
+		method: "GET",
+		path: "/api/projects/:id/follow-ups",
+		query: FollowUpsQuerySchema
+	},
+	followUp: {
+		method: "GET",
+		path: "/api/projects/:id/follow-ups/:followUp"
+	},
+	followUpChange: {
+		method: "POST",
+		path: "/api/projects/:id/follow-ups/:followUp",
+		body: FollowUpChangeSchema
+	},
+	followUpPost: {
+		method: "POST",
+		path: "/api/projects/:id/follow-ups/:followUp/post",
+		body: FollowUpPostSchema
+	}
+};
+// ../server/src/contract-after.ts
+/**
+* @file What the API offers after runs: the feedback loop's routes
+*   (contract-feedback.ts) and the follow-ups' (contract-follow-ups.ts), joined
+*   so the contract reads one part for both.
+*/
+const AFTER_API = {
+	...FEEDBACK_API,
+	...FOLLOW_UPS_API
+};
+// ../server/src/contract-builder.ts
+/** A new workflow's name, as its file and its `name:` take it. */
+const NewWorkflowSchema = z.strictObject({ name: z.string().min(1) });
+/** The server checks each edit; this file imports only types of the schema. */
+const WorkflowEditsSchema = z.strictObject({ edits: z.array(z.custom()).min(1) });
+/** Earlier text, and the file it was based on, to ask before replacing it. */
+const DraftTextSchema = z.strictObject({
+	text: z.string(),
+	baseHash: z.string().nullable()
+});
+const SaveWorkflowSchema = z.strictObject({ 
+/** Write over a file that changed since this draft began. */
+force: z.boolean().optional() });
+const BUILDER_API = {
+	builderSchema: {
+		method: "GET",
+		path: "/api/workflow-schema"
+	},
+	builderCatalog: {
+		method: "GET",
+		path: "/api/projects/:id/catalog"
+	},
+	builderDrafts: {
+		method: "GET",
+		path: "/api/projects/:id/builder"
+	},
+	builderView: {
+		method: "GET",
+		path: "/api/projects/:id/builder/:name"
+	},
+	builderCreate: {
+		method: "POST",
+		path: "/api/projects/:id/builder",
+		body: NewWorkflowSchema
+	},
+	builderEdit: {
+		method: "POST",
+		path: "/api/projects/:id/builder/:name/edits",
+		body: WorkflowEditsSchema
+	},
+	builderRestore: {
+		method: "POST",
+		path: "/api/projects/:id/builder/:name/text",
+		body: DraftTextSchema
+	},
+	builderDiscard: {
+		method: "POST",
+		path: "/api/projects/:id/builder/:name/discard"
+	},
+	builderSave: {
+		method: "POST",
+		path: "/api/projects/:id/builder/:name/save",
+		body: SaveWorkflowSchema
+	}
+};
+// ../server/src/contract-context.ts
+const CONTEXT_API = {
+	runContext: {
+		method: "GET",
+		path: "/api/runs/:id/nodes/:node/context"
+	},
+	builderContext: {
+		method: "GET",
+		path: "/api/projects/:id/builder/:name/nodes/:node/context"
+	}
+};
 // ../server/src/contract-links.ts
 /**
 * @file The routes that link two nodes of live runs (RFC-003): list, link and
@@ -275,9 +341,11 @@ planId: z.string().min(1) })
 };
 // ../server/src/contract-worktrees.ts
 const Root = z.string().min(1);
-const WorktreesQuerySchema = z.strictObject({ 
-/** A project's root; every project Ork knows without one. */
-project: Root.optional() });
+/**
+* The filters are core's `worktreeListTable` fields (`project`: a root; every
+* project without one).
+*/
+const WorktreesQuerySchema = z.strictObject(listShape("worktrees"));
 const RemovePlanSchema = z.strictObject({
 	project: Root,
 	/** The item's branch, or a detached worktree's path. */
@@ -327,18 +395,6 @@ const WORKTREES_API = {
 // ../server/src/contract.ts
 const Count = z.coerce.number().int().positive();
 const Seq = z.coerce.number().int().nonnegative();
-const Driver = z.enum(["sdk", "cli"]);
-const RunsQuerySchema = z.strictObject({
-	project: z.string().min(1).optional(),
-	limit: Count.optional()
-});
-const UsageQuerySchema = z.strictObject({
-	project: z.string().min(1).optional(),
-	workflow: z.string().min(1).optional(),
-	/** ISO times: `since` included, `until` not. */
-	since: z.iso.datetime().optional(),
-	until: z.iso.datetime().optional()
-});
 const EventsQuerySchema = z.strictObject({
 	after: Seq.optional(),
 	node: z.string().min(1).optional(),
@@ -347,10 +403,6 @@ const EventsQuerySchema = z.strictObject({
 	/** Only the newest this many, still oldest first. */
 	last: Count.optional()
 });
-const DecisionsQuerySchema = z.strictObject({
-	run: z.string().min(1).optional(),
-	project: z.string().min(1).optional()
-});
 /** An answer: the option, and what the person said with it, if anything. */
 const AnswerSchema = z.strictObject({
 	choose: z.string().min(1),
@@ -358,7 +410,7 @@ const AnswerSchema = z.strictObject({
 });
 const RunFlags = {
 	inputs: z.record(z.string(), z.string()).optional(),
-	driver: Driver.optional(),
+	driver: DriverIdSchema.optional(),
 	inPlace: z.boolean().optional(),
 	allowDirty: z.boolean().optional()
 };
@@ -384,10 +436,16 @@ const API = {
 		method: "GET",
 		path: "/api/health"
 	},
+	/** Bearer token only (RFC-019): mints a single-use code for `/?code=`. */
+	signIn: {
+		method: "POST",
+		path: "/api/sign-in"
+	},
 	...BUILDER_API,
 	...CONTEXT_API,
-	...FEEDBACK_API,
+	...AFTER_API,
 	...WORKTREES_API,
+	...LISTS_API,
 	...UPDATE_API,
 	projects: {
 		method: "GET",
@@ -483,11 +541,70 @@ const STREAMS = {
 	run: "/api/runs/:id/stream",
 	/**
 	* `runs`, `decisions`, `version`, each when it changes; `?project=` keeps
-	* one. `upgrade`: the upgrade's output, then `end` (contract-update.ts).
+	* one, `?workflow=` narrows `decisions` to that workflow's. `upgrade`: the
+	* upgrade's output, then `end` (contract-update.ts).
 	*/
 	overview: "/api/stream",
 	upgrade: "/api/upgrade/stream"
 };
+/** A route's path with its `:params` filled in, each encoded. */
+const fillPath = (path, params) => path.replaceAll(/:(\w+)/gu, (_, name) => encodeURIComponent(params[name] ?? ""));
+// ../server/src/client.ts
+/**
+* @file The typed client of the API (ADR-039), built from the contract: a call
+*   names a route and passes its params, query and body, and gets the route's
+*   response type back, or the server's error. The UI uses it in the browser
+*   (the session cookie goes with each request on its own); scripts pass the
+*   token. It uses only `fetch`, so it runs in a browser and in Node.
+*/
+/** An object's string and number fields, as text. */
+const entries = (value) => typeof value === "object" && value !== null ? Object.entries(value).flatMap(([key, field]) => typeof field === "string" || typeof field === "number" ? [[key, String(field)]] : []) : [];
+const queryString = (query) => {
+	const search = new URLSearchParams();
+	for (const [key, value] of entries(query)) search.set(key, value);
+	const text = search.toString();
+	return text === "" ? "" : `?${text}`;
+};
+const errorOf = (body, status) => typeof body === "object" && body !== null && "error" in body && typeof body.error === "string" ? body.error : `The server answered ${String(status)}.`;
+const createClient = (options = {}) => {
+	const send = (url, init) => (options.fetch ?? globalThis.fetch)(url, init);
+	return { call: async (name, ...[input]) => {
+		const route = API[name];
+		const parts = input ?? {};
+		const params = Object.fromEntries(entries(parts.params));
+		const url = `${options.base ?? ""}${fillPath(route.path, params)}${queryString(parts.query)}`;
+		const headers = { accept: "application/json" };
+		if (options.token !== void 0) headers["authorization"] = `Bearer ${options.token}`;
+		const init = {
+			method: route.method,
+			headers
+		};
+		if (route.method === "POST") {
+			headers["content-type"] = "application/json";
+			init.body = JSON.stringify(parts.body ?? {});
+		}
+		let response;
+		try {
+			response = await send(url, init);
+		} catch (error) {
+			return {
+				ok: false,
+				status: 0,
+				error: `No answer: ${error instanceof Error ? error.message : String(error)}`
+			};
+		}
+		const body = await response.json().catch(() => null);
+		return response.ok ? {
+			ok: true,
+			status: response.status,
+			data: body
+		} : {
+			ok: false,
+			status: response.status,
+			error: errorOf(body, response.status)
+		};
+	} };
+};
 // ../server/src/graph.ts
 /**
 * @file A workflow or a run as the graph the UI draws: its nodes, its edges
@@ -509,7 +626,8 @@ const workflowGraph = (workflow) => ({
 			maxRounds
 		})) : [];
 	}),
-	channels: (workflow.messages ?? []).map(({ between: [a, b] }) => [a, b])
+	channels: (workflow.messages ?? []).map(({ between: [a, b] }) => [a, b]),
+	...workflow.limits?.budgetTokens === void 0 ? {} : { budgetTokens: workflow.limits.budgetTokens }
 });
 /** The graph of a workflow file, or `null` if it is gone or does not parse. */
 const readWorkflowGraph = (file) => {
@@ -536,18 +654,22 @@ const runGraph = (events, file) => {
 		})),
 		edges: edges ?? onFile?.edges ?? [],
 		channels: channels ?? onFile?.channels ?? [],
-		...started?.type === "run.started" && started.budgetUsd !== void 0 ? { budgetUsd: started.budgetUsd } : {}
+		...started?.type === "run.started" && started.budgetUsd !== void 0 ? { budgetUsd: started.budgetUsd } : {},
+		...onFile?.budgetTokens === void 0 ? {} : { budgetTokens: onFile.budgetTokens }
 	};
 };
 // ../server/src/guards.ts
 /**
-* @file What the server lets in (ADR-039,
+* @file What the server lets in (ADR-039, RFC-019,
 *   specs/server/streams-contract-and-security.md#security): only its own
-*   loopback `Host` (against DNS rebinding); only with its token, from the
-*   session cookie or an `Authorization: Bearer` header; and, for a write sent
-*   with the cookie, only from its own `Origin` (against CSRF). The token in
-*   `?token=` is swapped once for the cookie, with a redirect that takes it out
-*   of the address bar. Pure: it reads the request's parts and decides.
+*   loopback `Host` (against DNS rebinding); only with the token in an
+*   `Authorization: Bearer` header (scripts, `ork mcp`) or the session secret
+*   in the cookie (the browser); and, for a write sent with the cookie, only
+*   from its own `Origin` (against CSRF). A single-use code in `?code=` is
+*   swapped once for the cookie, with a redirect that takes it out of the
+*   address bar; the token itself never reaches a browser. It reads the
+*   request's parts and decides; its only state is the code store it spends
+*   from.
 */
 const WRITES = /* @__PURE__ */ new Set([
 	"POST",
@@ -555,11 +677,13 @@ const WRITES = /* @__PURE__ */ new Set([
 	"PATCH",
 	"DELETE"
 ]);
+/** What a used, expired or wrong code all get, so none tells them apart. */
+const BAD_CODE = "That sign-in link is not valid any more; open it again with `ork ui`.";
 /** A new token: 32 random bytes. */
 const newToken = () => randomBytes(32).toString("base64url");
 /** The session cookie's name; one per port, as cookies ignore ports. */
 const cookieName = (port) => `ork_ui_${String(port)}`;
-/** Whether `given` is the token, compared in constant time. */
+/** Whether `given` is the token (or session secret), compared in constant time. */
 const sameToken = (given, token) => {
 	const a = Buffer.from(given);
 	const b = Buffer.from(token);
@@ -575,22 +699,22 @@ const cookieValue = (request, name) => (header(request, "cookie") ?? "").split("
 const bearer = (request) => {
 	return /^Bearer\s+(\S+)$/iu.exec(header(request, "authorization") ?? "")?.[1];
 };
-/** The session cookie that holds `token`. */
-const sessionCookie = (port, token) => `${cookieName(port)}=${token}; HttpOnly; SameSite=Strict; Path=/`;
+/** The session cookie that holds the session secret. */
+const sessionCookie = (port, session) => `${cookieName(port)}=${session}; HttpOnly; SameSite=Strict; Path=/`;
 const exchange = (request, context) => {
-	const url = new URL(request.url, "http://127.0.0.1");
-	const given = url.searchParams.get("token");
+	const url = new URL(request.url.replace(/^[/\\]+/u, "/"), "http://127.0.0.1");
+	const given = url.searchParams.get("code");
 	if (given === null || request.method !== "GET") return null;
-	if (!sameToken(given, context.token)) return {
+	if (!context.codes.redeem(given)) return {
 		kind: "refuse",
 		status: 401,
-		error: "That link's token is not this server's; open it again with `ork ui`."
+		error: BAD_CODE
 	};
-	url.searchParams.delete("token");
+	url.searchParams.delete("code");
 	return {
 		kind: "exchange",
-		cookie: sessionCookie(context.port, context.token),
-		location: `${url.pathname}${url.search}`
+		cookie: sessionCookie(context.port, context.session),
+		location: `${url.pathname.replace(/^\/+/u, "/")}${url.search}`
 	};
 };
 /** Decides whether a request may go on. */
@@ -605,15 +729,20 @@ const guard = (request, context) => {
 	if (exchanged !== null) return exchanged;
 	const fromBearer = bearer(request);
 	const fromCookie = cookieValue(request, cookieName(context.port));
+	const via = fromBearer === void 0 ? "cookie" : "bearer";
 	const given = fromBearer ?? fromCookie;
-	if (given === void 0 || !sameToken(given, context.token)) return {
+	const secret = via === "bearer" ? context.token : context.session;
+	if (given === void 0 || !sameToken(given, secret)) return {
 		kind: "refuse",
 		status: 401,
 		error: "Not signed in; open the UI with `ork ui`."
 	};
-	if (!WRITES.has(request.method)) return { kind: "pass" };
+	if (!WRITES.has(request.method)) return {
+		kind: "pass",
+		via
+	};
 	const origin = header(request, "origin");
-	if ((fromBearer === void 0 || origin !== void 0) && (origin === void 0 || !ownOrigins(context.port).includes(origin))) return {
+	if ((via === "cookie" || origin !== void 0) && (origin === void 0 || !ownOrigins(context.port).includes(origin))) return {
 		kind: "refuse",
 		status: 403,
 		error: `Origin ${origin ?? "(none)"} may not write here.`
@@ -624,7 +753,10 @@ const guard = (request, context) => {
 		status: 415,
 		error: "Send JSON (Content-Type: application/json)."
 	};
-	return { kind: "pass" };
+	return {
+		kind: "pass",
+		via
+	};
 };
 /** How often an open event stream gets a keep-alive comment. */
 const KEEP_ALIVE_MS = 15e3;
@@ -821,6 +953,29 @@ const route = async (handlers, req, res, url) => {
 	else sendJson(res, reply.status, reply.body);
 	return true;
 };
+// ../server/src/list-fields-routes.ts
+/**
+* @file `GET /api/list-fields`: the filter fields of each list, from core's
+*   tables (RFC-017), as text without their functions, so the UI builds its
+*   filter bar without importing core.
+*/
+const infoOf = (field) => ({
+	name: field.name,
+	description: field.description,
+	type: field.type,
+	...field.values === void 0 ? {} : { values: [...field.values] },
+	...field.all === true ? { all: true } : {}
+});
+/** The answer, built once: the tables do not change while the server runs. */
+const listFields = () => ({
+	runs: LIST_TABLES.ps.fields.map(infoOf),
+	feedback: LIST_TABLES["feedback list"].fields.map(infoOf),
+	"follow-ups": LIST_TABLES["follow-ups list"].fields.map(infoOf),
+	decisions: LIST_TABLES["decide --list"].fields.map(infoOf),
+	worktrees: LIST_TABLES["worktrees list"].fields.map(infoOf),
+	usage: LIST_TABLES.usage.fields.map(infoOf)
+});
+const listFieldsRoutes = () => ({ listFields: () => ok(listFields()) });
 // ../server/src/context.ts
 /**
 * @file What the server's handlers share: the store it reads and writes, where
@@ -841,11 +996,21 @@ const runOf = (context, id) => {
 const projectOf = (context, key) => context.store.projects().find((p) => p.id === key || p.root === key);
 /** A run as the API shows it: with its live status and what is paused. */
 const viewOf$2 = (context, run) => {
-	const events = run.status === "running" ? context.store.events(run.id).map((stored) => stored.event) : [];
+	const events = run.status === "running" ? context.store.controlEvents(run.id).map((stored) => stored.event) : [];
 	return {
 		...run,
 		live: runStatus(run, events),
-		paused: pausedOf(events)
+		paused: pausedOf(events),
+		...yoloOf(events) ? { yolo: true } : {}
+	};
+};
+/** The run's view plus its last finish's declared outputs, when it has any. */
+const viewWithOutputs = (context, run) => {
+	const finished = context.store.controlEvents(run.id).map((stored) => stored.event).findLast((event) => event.type === "run.finished");
+	const outputs = outputsText(finished?.type === "run.finished" ? finished.result.outputs : void 0);
+	return {
+		...viewOf$2(context, run),
+		...outputs.length === 0 ? {} : { outputs }
 	};
 };
 // ../server/src/mcp-answers.ts
@@ -1108,17 +1273,14 @@ const checkTool = (context) => tool("check", "Checks a workflow as `ork validate
 	return answer({
 		errors: count("error"),
 		warnings: count("warning"),
-		diagnostics: diagnostics.map(({ severity, code, message, line, column }) => line === void 0 ? {
+		diagnostics: diagnostics.map(({ severity, code, message, file, line, column }) => Object.assign({
 			severity,
 			code,
 			message
-		} : {
-			severity,
-			code,
-			message,
+		}, file === void 0 ? {} : { file }, line === void 0 ? {} : {
 			line,
 			column
-		}),
+		})),
 		walk: walk === void 0 ? null : walkSummary(walk),
 		...args.paths === true && walk !== void 0 ? { endings: walk.endings.slice(0, MOST_ENDINGS) } : {}
 	});
@@ -1512,6 +1674,136 @@ const builderRoutes = (context) => {
 		builderSave: ({ params, body }) => inProject(params.id, (project) => saveDraft(context, project, params.name, body.force === true))
 	};
 };
+// ../server/src/end-view.ts
+/**
+* @file Resolves how nodes ended for the API: each `node.finished` event (read
+*   through core's `endOf`, so a run stored before ends existed gets a kind
+*   too) and each tree node get an `EndView` (contract-ends.ts).
+*/
+/** Core's hints send the reader to Details; with no detail there is none. */
+const HINT_TO_DETAILS = /\bIts (?:last )?(?:output|detail) is under Details(?:; |\.\s*)/u;
+const hintFor = (hint, hasDetail) => {
+	if (hasDetail) return hint;
+	const rest = hint.replace(HINT_TO_DETAILS, "");
+	return rest === "" ? rest : rest[0]?.toUpperCase() + rest.slice(1);
+};
+const endViewOf = (end) => {
+	const info = END_KINDS[end.kind];
+	return {
+		kind: end.kind,
+		message: end.message,
+		...end.detail === void 0 ? {} : { detail: end.detail },
+		label: info.label,
+		actor: info.actor,
+		transient: info.transient,
+		hint: hintFor(info.hint, end.detail !== void 0),
+		docsAnchor: info.docsAnchor
+	};
+};
+/** The event as served: a `node.finished` gets its `end`, old ones too. */
+const servedEvent = (stored) => {
+	const { event } = stored;
+	return event.type === "node.finished" ? {
+		...stored,
+		event: {
+			...event,
+			end: endViewOf(endOf(event))
+		}
+	} : {
+		...stored,
+		event
+	};
+};
+/**
+* The tree with each node's latest end, from the events it was folded from. A
+* node that started again has none until it finishes; a failed node's `now` is
+* the end's message, not the raw error.
+*/
+const treeWithEnds = (roots, stored) => {
+	const ends = /* @__PURE__ */ new Map();
+	for (const { event } of stored) if (event.type === "node.started") ends.delete(event.id);
+	else if (event.type === "node.finished") ends.set(event.id, endViewOf(endOf(event)));
+	const dress = (node) => {
+		const end = ends.get(node.id);
+		const children = node.children.map(dress);
+		if (end === void 0) return {
+			...node,
+			children
+		};
+		const failed = node.state === "failed" && end.actor !== null;
+		return {
+			...node,
+			...failed ? { now: end.message } : {},
+			end,
+			children
+		};
+	};
+	return roots.map((node) => dress(node));
+};
+// ../server/src/list-query.ts
+/**
+* @file Reads a list route's filter fields the way the CLI reads its flags
+*   (RFC-017, ADR-088): each value checked by core's `parseFilters` against the
+*   list's table, a refused one answered as 400 in the CLI's words. A full ISO
+*   time in `since` or `until` is taken as given (the form `usage` had before
+*   the tables), the rest are an age, a day or `all`.
+*/
+/** A `2026-11-01T10:00:00Z`-style time, as an ISO time; else `undefined`. */
+const isoTime = (value) => {
+	if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T/u.test(value)) return;
+	const time = Date.parse(value);
+	return Number.isNaN(time) ? void 0 : new Date(time).toISOString();
+};
+/**
+* The filter `query` asks for, checked against `table`; a value the table
+* refuses is a 400.
+*/
+const filterOf = (table, query) => {
+	const times = {};
+	const rest = { ...query };
+	for (const name of ["since", "until"]) {
+		const iso = isoTime(query[name]);
+		if (iso === void 0) continue;
+		times[name] = iso;
+		delete rest[name];
+	}
+	const parsed = parseFilters(table, rest, Date.now());
+	return parsed.ok ? {
+		ok: true,
+		filter: {
+			...parsed.filter,
+			...times
+		}
+	} : {
+		ok: false,
+		refusal: fail(400, parsed.error)
+	};
+};
+/**
+* The root a filter's `project` names (a registered project's id or root, else
+* the value as a root); `undefined` without one or for `all`.
+*/
+const projectRootOf = (context, filter) => {
+	const key = filter["project"];
+	return key === void 0 || key === "all" ? void 0 : projectOf(context, key)?.root ?? key;
+};
+/** `now` is injectable so a test can move the clock. */
+const createSignInCodes = (now = Date.now) => {
+	const expiries = /* @__PURE__ */ new Map();
+	return {
+		mint: () => {
+			for (const [code, expiry] of expiries) if (expiry <= now()) expiries.delete(code);
+			const code = randomBytes(32).toString("base64url");
+			expiries.set(code, now() + 6e4);
+			return code;
+		},
+		redeem: (code) => {
+			const expiry = expiries.get(code);
+			expiries.delete(code);
+			return expiry !== void 0 && expiry > now();
+		}
+	};
+};
 // ../server/src/workflows.ts
 /**
 * @file A project's workflows, for the UI's Run workflow dialog: each
@@ -1570,47 +1862,71 @@ const projectWorkflows = (project) => {
 *   decisions, and usage. Each reads the store as the matching CLI command does
 *   (`ork projects`, `ps`, `tree`, `logs`, `decide --list`, `usage`).
 */
-/** A project filter's root: a registered project's, or the value as a root. */
 /** A registered project's place; caps are only known for one. */
 const placeOf = (context, key) => {
 	const known = key === void 0 ? void 0 : projectOf(context, key);
 	return known === void 0 ? void 0 : placeFor(known.root, context.store.projects());
 };
-const projectRoot = (context, key) => projectOf(context, key)?.root ?? key;
+/** `ork ps`'s table, matching `--status` on the live status the API shows. */
+const liveRunTable = {
+	...runListTable,
+	fields: runListTable.fields.map((field) => field.name === "status" ? Object.assign({}, field, { get: (run) => run.live }) : field)
+};
 const readRoutes = (context) => ({
+	...listFieldsRoutes(),
 	health: () => ok({
 		version: context.version,
 		pid: context.pid,
 		startedAt: context.startedAt
 	}),
+	signIn: () => ok({
+		code: context.codes.mint(),
+		expiresIn: 60
+	}),
 	projects: () => ok(context.store.projects()),
 	triggers: () => ok(triggersReport(context.store, context.store.projects(), context.home)),
 	links: ({ query }) => ok(context.store.links(query.run === void 0 ? {} : { run: query.run })),
-	usage: ({ query }) => ok({
-		...usageReport(context.store.usage({
-			...query.project === void 0 ? {} : { project: projectRoot(context, query.project) },
-			...query.workflow === void 0 ? {} : { workflow: query.workflow },
-			...query.since === void 0 ? {} : { since: query.since },
-			...query.until === void 0 ? {} : { until: query.until }
-		})),
-		limits: limitsReport(context.store, capsHere(context.home, placeOf(context, query.project)), /* @__PURE__ */ new Date())
-	}),
+	usage: ({ query }) => {
+		const read = filterOf(usageListTable, query);
+		if (!read.ok) return read.refusal;
+		const { filter } = read;
+		const { workflow, since, until } = filter;
+		const root = projectRootOf(context, filter);
+		return ok({
+			...usageReport(context.store.usage({
+				...root === void 0 ? {} : { project: root },
+				...workflow === void 0 ? {} : { workflow },
+				...since === void 0 || since === "all" ? {} : { since },
+				...until === void 0 ? {} : { until }
+			})),
+			limits: limitsReport(context.store, capsHere(context.home, placeOf(context, root)), /* @__PURE__ */ new Date())
+		});
+	},
 	workflows: ({ params }) => {
 		const project = projectOf(context, params.id);
 		return project === void 0 ? fail(404, `No registered project \`${params.id}\`.`) : ok(projectWorkflows(project));
 	},
-	runs: ({ query }) => ok(context.store.runs({
-		limit: query.limit ?? 20,
-		...query.project === void 0 ? {} : { project: projectRoot(context, query.project) }
-	}).map((run) => viewOf$2(context, run))),
+	runs: ({ query }) => {
+		const read = filterOf(liveRunTable, query);
+		if (!read.ok) return read.refusal;
+		const root = projectRootOf(context, read.filter);
+		const limit = query.limit ?? 20;
+		const narrowed = Object.keys(read.filter).some((name) => name !== "project");
+		const views = context.store.runs({
+			...root === void 0 ? {} : { project: root },
+			...narrowed ? {} : { limit }
+		}).map((run) => viewOf$2(context, run));
+		return ok(applyFilters(liveRunTable, views, read.filter).slice(0, limit));
+	},
 	run: ({ params }) => {
 		const found = runOf(context, params.id);
-		return found.ok ? ok(viewOf$2(context, found.run)) : found.refusal;
+		return found.ok ? ok(viewWithOutputs(context, found.run)) : found.refusal;
 	},
 	tree: ({ params }) => {
 		const found = runOf(context, params.id);
 		if (!found.ok) return found.refusal;
-		return ok(activeTree(context.store.events(found.run.id)));
+		const stored = context.store.events(found.run.id);
+		return ok(treeWithEnds(nestItems(activeTree(stored)), stored));
 	},
 	graph: ({ params }) => {
 		const found = runOf(context, params.id);
@@ -1620,15 +1936,28 @@ const readRoutes = (context) => ({
 	events: ({ params, query }) => {
 		const found = runOf(context, params.id);
 		if (!found.ok) return found.refusal;
-		const events = context.store.events(found.run.id, query.after ?? 0).filter((s) => query.node === void 0 || nodeOf(s.event) === query.node);
+		const events = context.store.events(found.run.id, query.after ?? 0).filter((s) => query.node === void 0 || isNodeEvent(s.event, query.node));
 		const newest = query.last === void 0 ? events : events.slice(-query.last);
-		return ok(query.limit === void 0 ? newest : newest.slice(0, query.limit));
+		return ok((query.limit === void 0 ? newest : newest.slice(0, query.limit)).map((stored) => servedEvent(stored)));
 	},
 	decisions: ({ query }) => {
-		if (query.run === void 0) return ok(pendingDecisions(context.store, query.project === void 0 ? {} : { project: projectRoot(context, query.project) }));
-		const found = runOf(context, query.run);
-		if (!found.ok) return found.refusal;
-		return ok(pendingDecisions(context.store, { runId: found.run.id }));
+		const read = filterOf(decisionListTable, query);
+		if (!read.ok) return read.refusal;
+		const { run, workflow: named } = read.filter;
+		const workflow = named === void 0 ? {} : { workflow: named };
+		if (run === void 0) {
+			const root = projectRootOf(context, read.filter);
+			return ok(pendingDecisions(context.store, {
+				...workflow,
+				...root === void 0 ? {} : { project: root }
+			}));
+		}
+		const found = runOf(context, run);
+		if (!found.ok) return fail(400, `--run finds no run: ${found.refusal.error}`);
+		return ok(pendingDecisions(context.store, {
+			...workflow,
+			runId: found.run.id
+		}));
 	},
 	decision: ({ params }) => {
 		const found = context.store.decision(params.id);
@@ -1654,6 +1983,8 @@ const RECENT_EVENTS = 30;
 const ANSWERED_BY_A_PERSON = "Only a person answers these: in `ork ui`, or with `ork decide` in their own terminal. Tell them what waits, and where.";
 const project = z.string().min(1).describe("A registered project's id or root");
 const run = z.string().min(1).describe("A run's id, or a unique start of it");
+/** An error answer, in the CLI's words, when `project` names none registered. */
+const unknownProject = (context, key) => key === void 0 || key === "all" || projectOf(context, key) !== void 0 ? void 0 : refused$1(unknownProjectRefusal(key, context.store.projects().map((p) => p.id)));
 const mcpTools = (context) => {
 	const read = readRoutes(context);
 	const { builderCatalog } = builderRoutes(context);
@@ -1668,13 +1999,22 @@ const mcpTools = (context) => {
 			...NO_QUERY,
 			params: { id: args.project }
 		}))),
-		tool("runs", "Runs, newest first, with their live status and cost. 10 unless a limit is given.", RunsQuerySchema.shape, (args) => fromReply(read.runs({
-			...NO_QUERY,
-			query: {
-				limit: 10,
-				...args
-			}
-		}))),
+		tool("runs", "Runs, newest first, with their live status and cost. 10 unless a limit is given. Narrow them with `status` (running, paused, crashed, succeeded, failed, … or all), `workflow`, `project` (or all), `since` (24h, 30d, 2026-11-01, all) and `until` (a day).", {
+			...RunsQuerySchema.shape,
+			limit: z.union([z.number(), z.string()]).optional()
+		}, ({ limit, ...args }) => {
+			const bad = unknownProject(context, args.project);
+			if (bad !== void 0) return bad;
+			const count = limit === void 0 ? 10 : parseLimit(String(limit));
+			if (count === null) return refused$1(limitRefusal(String(limit)));
+			return fromReply(read.runs({
+				...NO_QUERY,
+				query: {
+					...args,
+					limit: count
+				}
+			}));
+		}),
 		tool("run", "One run: its status, what it waits on, its cost, and each node's state.", { run }, async (args) => {
 			const view = await read.run({
 				...NO_QUERY,
@@ -1704,11 +2044,11 @@ const mcpTools = (context) => {
 				}
 			}));
 		}),
-		tool("usage", "What runs spent, by workflow and model, and how close the limits are. `since` and `until` are ISO times.", UsageQuerySchema.shape, (args) => fromReply(read.usage({
+		tool("usage", "What runs spent, by workflow and model, and how close the limits are. Narrow it with `workflow`, `project` (or all), `since` and `until`: an age (24h, 30d), a day (2026-11-01) or an ISO time; `since` also takes all.", UsageQuerySchema.shape, (args) => unknownProject(context, args.project) ?? fromReply(read.usage({
 			...NO_QUERY,
 			query: args
 		}))),
-		tool("decisions", "The decisions open in live runs, waiting on a person. This server can't answer them.", DecisionsQuerySchema.shape, (args) => fromReply(read.decisions({
+		tool("decisions", "The decisions open in live runs, waiting on a person. This server can't answer them. Narrow them with `workflow`, `run` (an id or a start of one) and `project` (or all).", DecisionsQuerySchema.shape, (args) => unknownProject(context, args.project) ?? fromReply(read.decisions({
 			...NO_QUERY,
 			query: args
 		}), (open) => ({
@@ -1820,7 +2160,8 @@ const openMcp = (options) => {
 		startedAt: (/* @__PURE__ */ new Date()).toISOString(),
 		...options.home === void 0 ? {} : { home: options.home },
 		...options.script === void 0 ? {} : { script: options.script },
-		updates: createUpdates({ version: options.version })
+		updates: createUpdates({ version: options.version }),
+		codes: createSignInCodes()
 	};
 	return {
 		tools: [...mcpTools(context), ...actingTools(context, { start: options.start })],
@@ -1838,6 +2179,17 @@ const openMcp = (options) => {
 		}
 	};
 };
+// ../server/src/access.ts
+/**
+* @file The secrets a server starts with (RFC-019): the API token (bearer), the
+*   session secret (the browser's cookie) and the sign-in code store. Each is
+*   the caller's or a new one.
+*/
+const createAccess = (given) => ({
+	token: given.token ?? newToken(),
+	session: given.session ?? newToken(),
+	codes: given.codes ?? createSignInCodes()
+});
 // ../server/src/assets.ts
 /**
 * @file The built UI's files (`packages/ui/dist`, shipped as the CLI's
@@ -2010,7 +2362,7 @@ const applyRoute = async (context, item, driver) => {
 *   workflows would go and how big that file is, the project a fix would be
 *   proposed in, and the run proposing one now, if any.
 */
-const detailOf = (store, item) => {
+const detailOf$1 = (store, item) => {
 	const registered = store.projects();
 	const fixRun = openFixRun(store, item);
 	const actions = feedbackActions(item, fixRun);
@@ -2106,14 +2458,18 @@ const feedbackRoutes = (context) => {
 		note: ({ params, body }) => {
 			const found = runOf(context, params.id);
 			if (!found.ok) return found.refusal;
-			const noted = recordNote(store, found.run, body);
+			const scrub = context.noteScrub?.(found.run, store.projects());
+			const noted = recordNote(store, found.run, body, "", scrub);
 			return noted.ok ? ok({ item: noted.item }) : fail(400, noted.error);
 		},
-		feedbackItems: () => ok(store.feedbackItems({ all: true })),
+		feedbackItems: ({ query }) => {
+			const read = filterOf(feedbackListTable, query);
+			return read.ok ? ok(applyFilters(feedbackListTable, store.feedbackItems({ all: true }), read.filter)) : read.refusal;
+		},
 		feedbackItem: ({ params }) => {
 			const found = itemOf(store, params.id);
 			if (!found.ok) return found.refusal;
-			return ok(detailOf(store, found.item));
+			return ok(detailOf$1(store, found.item));
 		},
 		feedbackStatus: ({ params, body }) => {
 			const found = itemOf(store, params.id);
@@ -2162,6 +2518,174 @@ const feedbackRoutes = (context) => {
 		}
 	};
 };
+// ../server/src/follow-up-routes.ts
+/**
+* @file The follow-ups' routes (specs/follow-ups.md), through the same core
+*   functions as `ork follow-ups`: a project's list (after the due check, which
+*   reads pull requests through the person's own `gh` and only reports a `gh`
+*   that fails), one follow-up with what to copy and what can be done to it,
+*   done, drop, reopen and due, and posting a drafted GitHub comment only with
+*   the person's confirmation of the draft they saw (its digest). Ork never
+*   runs a task's commands.
+*/
+const OPEN = ["due", "waiting"];
+/** Stands for what a person saw of a draft: its recipient and text. */
+const digestOf$1 = (f) => f.draft === void 0 ? void 0 : createHash("sha256").update(JSON.stringify([f.draft.to, f.draft.text])).digest("hex");
+/** The place a project's rule keeps follow-ups in. */
+const ruleOf = (project) => (loadProject(project.root, placeFiles(project).rules).project?.followUps ?? DEFAULT_FOLLOW_UPS_RULE).store;
+/** Why a follow-up isn't where the project's rule says, when it isn't. */
+const fallbackOf = (placed, rule) => {
+	if (placed === rule) return void 0;
+	return rule === "github" ? "GitHub couldn't be used when it was added (gh not signed in, or the issue failed), so Ork's store keeps it." : `It couldn't be written to ${rule} when it was added, so Ork's store keeps it.`;
+};
+const deliveryOf = (store, f) => {
+	if (!f.for.startsWith("project:")) return void 0;
+	const name = f.for.slice(8).trim();
+	const target = store.projects().find((p) => p.id === name);
+	if (target === void 0) return {
+		project: name,
+		registered: false
+	};
+	const live = liveSessionOf(store, target.root);
+	return {
+		project: name,
+		registered: true,
+		root: target.root,
+		keptIn: ruleOf(target),
+		...live === void 0 ? {} : { live }
+	};
+};
+/** `f`, what can be done to it, where it is kept, and what to copy from it. */
+const detailOf = (context, project, f) => {
+	const rule = ruleOf(project);
+	const fallback = fallbackOf(f.place, rule);
+	const cause = dueCause(f);
+	const delivery = deliveryOf(context.store, f);
+	const digest = digestOf$1(f);
+	return {
+		followUp: f,
+		actions: followUpActions(f),
+		...cause === void 0 ? {} : { cause },
+		keptIn: {
+			place: f.place,
+			rule,
+			...f.url === void 0 ? {} : { url: f.url },
+			...fallback === void 0 ? {} : { fallback }
+		},
+		...delivery === void 0 ? {} : { delivery },
+		...digest === void 0 ? {} : { draftDigest: digest },
+		copy: {
+			text: f.draft?.text ?? "",
+			commands: (f.steps ?? []).flatMap((step) => step.command === void 0 ? [] : [step.command])
+		}
+	};
+};
+const toItem = (f) => ({
+	id: f.id,
+	project: f.project,
+	title: f.title,
+	for: f.for,
+	kind: f.kind,
+	...f.note === void 0 ? {} : { note: f.note }
+});
+/** The due follow-ups of `roots`, most recently changed first. */
+const dueOf = (store, roots) => {
+	const due = roots.flatMap((root) => store.followUps(root)).filter((f) => f.status === "due").toSorted((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+	return {
+		count: due.length,
+		items: due.slice(0, 20).map((f) => toItem(f))
+	};
+};
+const found = (context, params) => {
+	const project = projectOf(context, params.id);
+	if (project === void 0) return {
+		ok: false,
+		refusal: fail(404, `No registered project \`${params.id}\`.`)
+	};
+	if (params.followUp === void 0) return {
+		ok: true,
+		project
+	};
+	const one = findFollowUp(context.store, project.root, params.followUp);
+	if (!one.ok) {
+		const status = one.error.startsWith("No follow-up") ? 404 : 400;
+		return {
+			ok: false,
+			refusal: fail(status, one.error)
+		};
+	}
+	return {
+		ok: true,
+		project,
+		followUp: one.followUp
+	};
+};
+const followUpRoutes = (context) => {
+	const { store } = context;
+	const gh = context.gh ?? runGh;
+	return {
+		followUps: async ({ params, query }) => {
+			const one = found(context, params);
+			if (!one.ok) return one.refusal;
+			const { root } = one.project;
+			const errors = await checkFollowUpsDue({
+				rows: store,
+				project: root,
+				gh
+			}).then((checked) => checked.errors).catch((error) => [error instanceof Error ? error.message : String(error)]);
+			const all = store.followUps(root);
+			const open = (query.status ?? "open") === "open";
+			const read = filterOf(followUpListTable, {
+				...query,
+				...open ? { status: "all" } : {}
+			});
+			if (!read.ok) return read.refusal;
+			const other = projectRootOf(context, read.filter);
+			const matched = other === void 0 || other === root ? applyFilters(followUpListTable, all, read.filter) : [];
+			const shown = open ? matched.filter((f) => OPEN.some((s) => s === f.status)) : matched;
+			return ok({
+				project: root,
+				followUps: shown,
+				due: all.filter((f) => f.status === "due").length,
+				checker: {
+					available: errors.length === 0,
+					errors
+				}
+			});
+		},
+		followUp: ({ params }) => {
+			const one = found(context, params);
+			if (!one.ok) return one.refusal;
+			return one.followUp === void 0 ? fail(404, "No such follow-up.") : ok(detailOf(context, one.project, one.followUp));
+		},
+		followUpChange: ({ params, body }) => {
+			const one = found(context, params);
+			if (!one.ok) return one.refusal;
+			if (one.followUp === void 0) return fail(404, "No such follow-up.");
+			const changed = changeFollowUp(store, one.followUp, body.action);
+			return changed.ok ? ok(detailOf(context, one.project, changed.followUp)) : fail(409, changed.error);
+		},
+		followUpPost: async ({ params, body }) => {
+			const one = found(context, params);
+			if (!one.ok) return one.refusal;
+			const { followUp } = one;
+			if (followUp === void 0) return fail(404, "No such follow-up.");
+			const check = followUpActions(followUp).post;
+			if (!check.ok) return fail(409, check.error);
+			if (digestOf$1(followUp) !== body.digest) return fail(409, "The draft is no longer the one you confirmed; open the follow-up again.");
+			const posted = await postFollowUpMessage(followUp, {
+				rows: store,
+				gh,
+				confirmed: body.confirm,
+				home: context.home ?? homedir()
+			});
+			return posted.ok ? ok({
+				...posted.url === void 0 ? {} : { url: posted.url },
+				followUp: detailOf(context, one.project, posted.followUp)
+			}) : fail(409, posted.error);
+		}
+	};
+};
 const ANSI = /\u001B\[[0-?]*[ -/]*[@-~]|\u001B\][^\u0007\u001B]*(?:\u0007|\u001B\\)|\u001B[@-Z\\-_]/gu;
 /** A line as a terminal would end up showing it. */
 const plainLine = (raw) => (raw.replaceAll(ANSI, "").split("\r").findLast((part) => part !== "") ?? "").replaceAll(/\s+$/gu, "");
@@ -2668,9 +3192,15 @@ const worktreesRoutes = (context) => {
 	};
 	return {
 		worktrees: async ({ query }) => {
-			const all = await readAll(query.project);
+			const filtered = filterOf(worktreeListTable, query);
+			if (!filtered.ok) return filtered.refusal;
+			const all = await readAll(projectRootOf(context, filtered.filter));
 			if (!all.ok) return all.refusal;
-			return ok({ projects: all.reads.map((read) => listed(context, read)) });
+			return ok({ projects: all.reads.map((read) => {
+				const project = listed(context, read);
+				project.items = applyFilters(worktreeListTable, project.items, filtered.filter);
+				return project;
+			}) });
 		},
 		worktreeRemovePlan: async ({ body }) => {
 			const planned = await removePlanOf(context, body);
@@ -2716,6 +3246,7 @@ const apiRoutes = (context, port) => ({
 	...builderRoutes(context),
 	...contextRoutes(context),
 	...feedbackRoutes(context),
+	...followUpRoutes(context),
 	...worktreesRoutes(context),
 	...updateRoutes(context, port)
 });
@@ -2856,7 +3387,7 @@ const runStream = async (context, req, res, url, id, shutdown) => {
 	}
 	const stream = openEventStream(res);
 	const end = await followEvents(context.store, found.run.id, (stored) => {
-		stream.send("run-event", stored, stored.seq);
+		stream.send("run-event", servedEvent(stored), stored.seq);
 	}, {
 		follow: true,
 		after,
@@ -2869,11 +3400,16 @@ const runStream = async (context, req, res, url, id, shutdown) => {
 const overviewStream = (context, res, url, shutdown) => {
 	const key = url.searchParams.get("project");
 	const root = key === null ? void 0 : projectOf(context, key)?.root ?? key;
+	const workflow = url.searchParams.get("workflow");
 	const stream = openEventStream(res);
 	const last = {
 		runs: "",
 		decisions: "",
-		version: ""
+		version: "",
+		followUps: JSON.stringify({
+			count: 0,
+			items: []
+		})
 	};
 	const tick = () => {
 		const filter = root === void 0 ? {} : { project: root };
@@ -2881,11 +3417,15 @@ const overviewStream = (context, res, url, shutdown) => {
 			...filter,
 			limit: OVERVIEW_RUNS
 		}).map((run) => viewOf$2(context, run));
-		const decisions = pendingDecisions(context.store, filter);
+		const decisions = pendingDecisions(context.store, {
+			...filter,
+			...workflow === null ? {} : { workflow }
+		});
 		for (const [name, value] of [
 			["runs", runs],
 			["decisions", decisions],
-			["version", context.updates.info()]
+			["version", context.updates.info()],
+			["followUps", dueOf(context.store, root === void 0 ? context.store.projects().map((p) => p.root) : [root])]
 		]) {
 			const text = JSON.stringify(value);
 			if (text === last[name]) continue;
@@ -2959,7 +3499,9 @@ const createDispatch = (context, access) => {
 			headers: req.headers
 		}, {
 			port: access.port(),
-			token: access.token
+			token: access.token,
+			session: access.session,
+			codes: context.codes
 		});
 		if (verdict.kind === "refuse") {
 			if (api) sendError(res, verdict.status, verdict.error);
@@ -2974,6 +3516,10 @@ const createDispatch = (context, access) => {
 			}).end();
 			return;
 		}
+		if (url.pathname === API.signIn.path && verdict.via !== "bearer") {
+			sendError(res, 403, "Sign-in codes are minted with the API token only.");
+			return;
+		}
 		const streamed = RUN_STREAM.pattern.exec(url.pathname);
 		if (method === "GET" && streamed !== null) {
 			const id = decodeURIComponent(streamed[1] ?? "");
@@ -3043,6 +3589,8 @@ const runningServer = (file) => {
 */
 /** The port `ork ui` serves on unless told otherwise. */
 const DEFAULT_PORT = 4417;
+/** The overview stream sends the due follow-ups itself; nothing more here. */
+const noticed = () => {};
 const listen = (server, port) => new Promise((resolve, reject) => {
 	server.once("error", (error) => {
 		reject(error.code === "EADDRINUSE" ? /* @__PURE__ */ new Error(`Port ${String(port)} is in use; start Ork's UI on another with \`--port <n>\`.`) : error);
@@ -3060,7 +3608,13 @@ const startServer = async (options) => {
 		...options.home === void 0 ? {} : { home: options.home },
 		...options.update === void 0 ? {} : { options: options.update }
 	});
+	const { token, session, codes } = createAccess({
+		...options.token === void 0 ? {} : { token: options.token },
+		...options.sessionSecret === void 0 ? {} : { session: options.sessionSecret },
+		...options.codes === void 0 ? {} : { codes: options.codes }
+	});
 	const context = {
+		codes,
 		store,
 		version: options.version,
 		pid: process.pid,
@@ -3070,9 +3624,9 @@ const startServer = async (options) => {
 		...uiDir === void 0 ? {} : { uiDir },
 		...options.gh === void 0 ? {} : { gh: options.gh },
 		updates,
-		...options.restart === void 0 ? {} : { restart: options.restart }
+		...options.restart === void 0 ? {} : { restart: options.restart },
+		...options.noteScrub === void 0 ? {} : { noteScrub: options.noteScrub }
 	};
-	const token = options.token ?? newToken();
 	const shutdown = new AbortController();
 	const log = options.log ?? ((line) => {
 		process.stderr.write(`${line}\n`);
@@ -3081,6 +3635,7 @@ const startServer = async (options) => {
 	const handle = createDispatch(context, {
 		port: () => port,
 		token,
+		session,
 		shutdown: shutdown.signal
 	});
 	const server = createServer((req, res) => {
@@ -3104,6 +3659,15 @@ const startServer = async (options) => {
 		token,
 		startedAt
 	});
+	const stopChecks = startFollowUpChecks({
+		rows: store,
+		gh: options.gh ?? runGh,
+		projects: () => store.projects().map((project) => project.root),
+		onDue: noticed,
+		onError: (error) => {
+			log(`ork ui: follow-ups: ${error}`);
+		}
+	});
 	let closed;
 	return {
 		port,
@@ -3116,6 +3680,7 @@ const startServer = async (options) => {
 		close: () => {
 			closed ??= new Promise((resolve) => {
 				shutdown.abort();
+				stopChecks();
 				updates.close();
 				server.close(() => {
 					store.close();
@@ -3128,4 +3693,4 @@ const startServer = async (options) => {
 		}
 	};
 };
-export { openMcp as a, refused$1 as c, uiFilePath as i, newToken as l, startServer as n, tool as o, runningServer as r, answer as s, DEFAULT_PORT as t };
+export { openMcp as a, refused$1 as c, uiFilePath as i, newToken as l, startServer as n, tool as o, runningServer as r, answer as s, DEFAULT_PORT as t, createClient as u };