@krapht/ork 1.0.0-alpha.3 → 1.0.0-alpha.5

package/dist/{src-XDSRnAZV.mjs → src-HxtJOMRr.mjs}

@@ -1,6 +1,6 @@
-import { $n as timeoutMs, $t as parseTemplate, At as runScope, F as declaredProblem, Jn as beforeOf, Mt as envReadsOf, Ot as heldTimeout, Pt as declaredOutputOf, Qt as evaluate, Vn as markValue, Xn as isToolNode, Zn as programsRunBy, en as renderTemplate, er as INTEGRATIONS, ft as sessionDriver, jt as calledWorkflows, mt as reportSchemaFor, nr as integrationFor, s as planReason, tr as TOOL_PREFIX, ut as planNodeSession } from "./src-DnETlJ1r.mjs";
+import { $n as isToolNode, $t as evaluate, At as runScope, Bt as serversIn, F as declaredProblem, Mt as envReadsOf, Ot as heldTimeout, Pt as declaredOutputOf, Rt as MCP_FILE, Wn as markValue, Zn as beforeOf, ar as integrationFor, en as parseTemplate, er as programsRunBy, ft as sessionDriver, ir as TOOL_PREFIX, jt as calledWorkflows, mt as reportSchemaFor, nr as timeoutMs, rr as INTEGRATIONS, s as planReason, tn as renderTemplate, ut as planNodeSession, zt as mcpNotText } from "./src-Do_MhwiV.mjs";
 import path from "node:path";
-import { accessSync, constants, existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { accessSync, constants, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
@@ -123,6 +123,156 @@ const resultOf = (outcome, declared) => {
 	if (!result.ok) result.error = report.summary;
 	return result;
 };
+// ../nodes/src/environ.ts
+/** A variable of the user's. */
+const readEnv = (environ, name) => Object.hasOwn(environ, name) ? environ[name] : void 0;
+// ../nodes/src/mcp-servers.ts
+/**
+* @file Reading an MCP server's definition from the project's `.mcp.json`, the
+*   file Claude Code reads too, so a server is defined in one place (RFC-006).
+*   `${VAR}` and `${VAR:-default}` read the user's environment, which is where
+*   secrets stay: Ork stores none, and a run masks each value read this way. A
+*   server that needs an OAuth sign-in holds Claude Code's tokens, not Ork's,
+*   so it is refused.
+*/
+const VARIABLE = /\$\{([A-Za-z_]\w*)(?::-([^}]*))?\}/gu;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const stringsOf = (value) => isRecord(value) ? Object.fromEntries(Object.entries(value).flatMap(([key, item]) => typeof item === "string" ? [[key, item]] : [])) : {};
+const listOf = (value) => Array.isArray(value) ? value.flatMap((item) => typeof item === "string" ? [item] : []) : [];
+/** The server as written, or why Ork can't call it. */
+const readMcpServer = (root, name) => {
+	const servers = serversIn(root);
+	if (!servers.ok) return servers;
+	const known = Object.keys(servers.value);
+	const server = Object.hasOwn(servers.value, name) ? servers.value[name] : void 0;
+	if (!isRecord(server)) return {
+		ok: false,
+		error: `no MCP server \`${name}\` in ${MCP_FILE}${known.length === 0 ? "" : `, which has ${known.join(", ")}`}`
+	};
+	if ("oauth" in server) return {
+		ok: false,
+		error: `MCP server \`${name}\` signs in with OAuth, whose tokens are Claude Code's: give it a token through headers and \`env:\`, or call it from a session`
+	};
+	const notText = mcpNotText(server);
+	if (notText !== void 0) return {
+		ok: false,
+		error: `MCP server \`${name}\` has a value in ${notText} that isn't a string: write it in quotes`
+	};
+	const { type, url, command } = server;
+	if (type === "http" && typeof url === "string") return {
+		ok: true,
+		value: {
+			kind: "http",
+			url,
+			headers: stringsOf(server["headers"])
+		}
+	};
+	if ((type === void 0 || type === "stdio") && typeof command === "string") return {
+		ok: true,
+		value: {
+			kind: "stdio",
+			command,
+			args: listOf(server["args"]),
+			env: stringsOf(server["env"])
+		}
+	};
+	return {
+		ok: false,
+		error: `MCP server \`${name}\` is not one Ork can call: it takes stdio and http servers`
+	};
+};
+/**
+* The named servers' entries as written, for a session: `${VAR}` stays text for
+* the `claude` that loads them to expand. The compiler has checked the names.
+*/
+const namedMcpEntries = (root, names) => {
+	if (names.length === 0) return {
+		ok: true,
+		value: {}
+	};
+	const servers = serversIn(root);
+	if (!servers.ok) return servers;
+	const mcpServers = {};
+	for (const name of names) {
+		const server = Object.hasOwn(servers.value, name) ? servers.value[name] : void 0;
+		if (!isRecord(server)) return {
+			ok: false,
+			error: `no MCP server \`${name}\` in ${MCP_FILE}`
+		};
+		mcpServers[name] = server;
+	}
+	return {
+		ok: true,
+		value: { mcpServers }
+	};
+};
+/** Each variable a server reads, and whether it has a default. */
+const readsOf = (server) => {
+	return (server.kind === "stdio" ? [
+		server.command,
+		...server.args,
+		...Object.values(server.env)
+	] : [server.url, ...Object.values(server.headers)]).flatMap((text) => [...text.matchAll(VARIABLE)].map((match) => ({
+		name: String(match[1]),
+		fallback: match[2] !== void 0
+	})));
+};
+/**
+* The server with its variables filled in, and the values to mask: all it read
+* but those `plain` names, which aren't secret.
+*/
+const expandServer = (server, environ, plain = []) => {
+	const unset = readsOf(server).find(({ name, fallback }) => !fallback && readEnv(environ, name) === void 0);
+	if (unset !== void 0) return {
+		ok: false,
+		error: `${MCP_FILE} reads ${unset.name}, which is not set`
+	};
+	const values = [];
+	const fill = (text) => text.replaceAll(VARIABLE, (_all, name, fallback) => {
+		const value = readEnv(environ, name);
+		if (value !== void 0 && !plain.includes(name)) values.push(value);
+		return value ?? fallback ?? "";
+	});
+	const fillAll = (record) => Object.fromEntries(Object.entries(record).map(([key, text]) => [key, fill(text)]));
+	return {
+		ok: true,
+		value: {
+			server: server.kind === "stdio" ? {
+				kind: "stdio",
+				command: fill(server.command),
+				args: server.args.map((arg) => fill(arg)),
+				env: fillAll(server.env)
+			} : {
+				kind: "http",
+				url: fill(server.url),
+				headers: fillAll(server.headers)
+			},
+			values
+		}
+	};
+};
+/** What a workflow's MCP servers read of the user's, unless called not secret. */
+const mcpVariablesOf = (workflow, root) => Object.values(workflow.nodes).flatMap((node) => {
+	if (node.type !== "mcp.call") return [];
+	const read = readMcpServer(root, node.server);
+	return read.ok ? readsOf(read.value).map(({ name }) => name).filter((name) => node.plainEnv?.includes(name) !== true) : [];
+});
+/** A stdio server's program, when its name can be known before it is filled in. */
+const programOf = (server) => server.kind === "stdio" && !server.command.includes("$") ? server.command : void 0;
+/**
+* What stops a workflow's `mcp.call` nodes, found before a run spends anything:
+* a server that isn't there or can't be called, a program that isn't installed,
+* or a variable that is not set.
+*/
+const mcpProblems = (workflow, root, environ = process.env, finished = /* @__PURE__ */ new Set(), installed = () => true) => Object.entries(workflow.nodes).flatMap(([id, node]) => {
+	if (node.type !== "mcp.call" || finished.has(id)) return [];
+	const read = readMcpServer(root, node.server);
+	if (!read.ok) return [`${id}: ${read.error}`];
+	const given = new Set(Object.keys(node.env ?? {}));
+	const unset = readsOf(read.value).flatMap(({ name, fallback }) => fallback || given.has(name) || readEnv(environ, name) !== void 0 ? [] : [`${id}: ${MCP_FILE} reads ${name}, which is not set`]);
+	const program = programOf(read.value);
+	return program === void 0 || installed(program) ? unset : [`\`${id}\`: MCP server \`${node.server}\` runs \`${program}\`, which is not installed`].concat(unset);
+});
 /** The only built-in tools a fork has: it reads, and reports. */
 const FORK_TOOLS = [
 	"Read",
@@ -660,163 +810,6 @@ const tokenize = (command) => {
 		args
 	};
 };
-// ../nodes/src/environ.ts
-/** A variable of the user's. */
-const readEnv = (environ, name) => Object.hasOwn(environ, name) ? environ[name] : void 0;
-// ../nodes/src/mcp-servers.ts
-/**
-* @file Reading an MCP server's definition from the project's `.mcp.json`, the
-*   file Claude Code reads too, so a server is defined in one place (RFC-006).
-*   `${VAR}` and `${VAR:-default}` read the user's environment, which is where
-*   secrets stay: Ork stores none, and a run masks each value read this way. A
-*   server that needs an OAuth sign-in holds Claude Code's tokens, not Ork's,
-*   so it is refused.
-*/
-const MCP_FILE = ".mcp.json";
-const VARIABLE = /\$\{([A-Za-z_]\w*)(?::-([^}]*))?\}/gu;
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** The file's `mcpServers`; `{}` when there is no file. */
-const serversIn = (root) => {
-	const file = path.join(root, MCP_FILE);
-	if (!existsSync(file)) return {
-		ok: true,
-		value: {}
-	};
-	try {
-		const parsed = JSON.parse(readFileSync(file, "utf8"));
-		const servers = isRecord(parsed) ? parsed["mcpServers"] : void 0;
-		return {
-			ok: true,
-			value: isRecord(servers) ? servers : {}
-		};
-	} catch (error) {
-		const reason = error instanceof SyntaxError ? "it is not valid JSON" : error instanceof Error ? error.message : String(error);
-		return {
-			ok: false,
-			error: `${MCP_FILE} can't be read: ${reason}`
-		};
-	}
-};
-const stringsOf = (value) => isRecord(value) ? Object.fromEntries(Object.entries(value).flatMap(([key, item]) => typeof item === "string" ? [[key, item]] : [])) : {};
-const listOf = (value) => Array.isArray(value) ? value.flatMap((item) => typeof item === "string" ? [item] : []) : [];
-/** A server's field that holds something other than text: it would be dropped. */
-const notTextIn = (server) => [
-	"args",
-	"env",
-	"headers"
-].find((field) => {
-	const value = server[field];
-	return (Array.isArray(value) ? value : isRecord(value) ? Object.values(value) : []).some((item) => typeof item !== "string");
-});
-/** The server as written, or why Ork can't call it. */
-const readMcpServer = (root, name) => {
-	const servers = serversIn(root);
-	if (!servers.ok) return servers;
-	const known = Object.keys(servers.value);
-	const server = Object.hasOwn(servers.value, name) ? servers.value[name] : void 0;
-	if (!isRecord(server)) return {
-		ok: false,
-		error: `no MCP server \`${name}\` in ${MCP_FILE}${known.length === 0 ? "" : `, which has ${known.join(", ")}`}`
-	};
-	if ("oauth" in server) return {
-		ok: false,
-		error: `MCP server \`${name}\` signs in with OAuth, whose tokens are Claude Code's: give it a token through headers and \`env:\`, or call it from a session`
-	};
-	const notText = notTextIn(server);
-	if (notText !== void 0) return {
-		ok: false,
-		error: `MCP server \`${name}\` has a value in ${notText} that isn't a string: write it in quotes`
-	};
-	const { type, url, command } = server;
-	if (type === "http" && typeof url === "string") return {
-		ok: true,
-		value: {
-			kind: "http",
-			url,
-			headers: stringsOf(server["headers"])
-		}
-	};
-	if ((type === void 0 || type === "stdio") && typeof command === "string") return {
-		ok: true,
-		value: {
-			kind: "stdio",
-			command,
-			args: listOf(server["args"]),
-			env: stringsOf(server["env"])
-		}
-	};
-	return {
-		ok: false,
-		error: `MCP server \`${name}\` is not one Ork can call: it takes stdio and http servers`
-	};
-};
-/** Each variable a server reads, and whether it has a default. */
-const readsOf = (server) => {
-	return (server.kind === "stdio" ? [
-		server.command,
-		...server.args,
-		...Object.values(server.env)
-	] : [server.url, ...Object.values(server.headers)]).flatMap((text) => [...text.matchAll(VARIABLE)].map((match) => ({
-		name: String(match[1]),
-		fallback: match[2] !== void 0
-	})));
-};
-/**
-* The server with its variables filled in, and the values to mask: all it read
-* but those `plain` names, which aren't secret.
-*/
-const expandServer = (server, environ, plain = []) => {
-	const unset = readsOf(server).find(({ name, fallback }) => !fallback && readEnv(environ, name) === void 0);
-	if (unset !== void 0) return {
-		ok: false,
-		error: `${MCP_FILE} reads ${unset.name}, which is not set`
-	};
-	const values = [];
-	const fill = (text) => text.replaceAll(VARIABLE, (_all, name, fallback) => {
-		const value = readEnv(environ, name);
-		if (value !== void 0 && !plain.includes(name)) values.push(value);
-		return value ?? fallback ?? "";
-	});
-	const fillAll = (record) => Object.fromEntries(Object.entries(record).map(([key, text]) => [key, fill(text)]));
-	return {
-		ok: true,
-		value: {
-			server: server.kind === "stdio" ? {
-				kind: "stdio",
-				command: fill(server.command),
-				args: server.args.map((arg) => fill(arg)),
-				env: fillAll(server.env)
-			} : {
-				kind: "http",
-				url: fill(server.url),
-				headers: fillAll(server.headers)
-			},
-			values
-		}
-	};
-};
-/** What a workflow's MCP servers read of the user's, unless called not secret. */
-const mcpVariablesOf = (workflow, root) => Object.values(workflow.nodes).flatMap((node) => {
-	if (node.type !== "mcp.call") return [];
-	const read = readMcpServer(root, node.server);
-	return read.ok ? readsOf(read.value).map(({ name }) => name).filter((name) => node.plainEnv?.includes(name) !== true) : [];
-});
-/** A stdio server's program, when its name can be known before it is filled in. */
-const programOf = (server) => server.kind === "stdio" && !server.command.includes("$") ? server.command : void 0;
-/**
-* What stops a workflow's `mcp.call` nodes, found before a run spends anything:
-* a server that isn't there or can't be called, a program that isn't installed,
-* or a variable that is not set.
-*/
-const mcpProblems = (workflow, root, environ = process.env, finished = /* @__PURE__ */ new Set(), installed = () => true) => Object.entries(workflow.nodes).flatMap(([id, node]) => {
-	if (node.type !== "mcp.call" || finished.has(id)) return [];
-	const read = readMcpServer(root, node.server);
-	if (!read.ok) return [`${id}: ${read.error}`];
-	const given = new Set(Object.keys(node.env ?? {}));
-	const unset = readsOf(read.value).flatMap(({ name, fallback }) => fallback || given.has(name) || readEnv(environ, name) !== void 0 ? [] : [`${id}: ${MCP_FILE} reads ${name}, which is not set`]);
-	const program = programOf(read.value);
-	return program === void 0 || installed(program) ? unset : [`\`${id}\`: MCP server \`${node.server}\` runs \`${program}\`, which is not installed`].concat(unset);
-});
 // ../nodes/src/tool-scrub.ts
 /**
 * @file Masking a secret in what a program prints. A plain search, so a value
@@ -1589,7 +1582,12 @@ const claudeExecutor = (options) => async (context) => {
 		},
 		error: plan.error
 	};
-	const spec = specFor(plan.spec, context);
+	const servers = namedMcpEntries(context.projectRoot, plan.mcp);
+	if (!servers.ok) return notStarted(servers.error);
+	const spec = {
+		...specFor(plan.spec, context),
+		...servers.value
+	};
 	if (options.machineClaude === true) spec.machineClaude = true;
 	const driver = sessionDriver({
 		override: options.driver,
@@ -1691,10 +1689,11 @@ const claudeExecutor = (options) => async (context) => {
 };
 // ../nodes/src/gate.ts
 /**
-* @file The `human.gate` node type: asks the human the rendered question,
-*   outputs their choice with the note they gave, and answers with the
-*   `default` when the `timeout` passes. The timeout counts only while the run
-*   and the gate are not paused (ADR-041).
+* @file The `human.gate` node type: asks the human the rendered question, with
+*   its document if it has one, both in readable text (no raw JSON), outputs
+*   their choice with the note they gave, and answers with the `default` when
+*   the `timeout` passes. The timeout counts only while the run and the gate
+*   are not paused (ADR-041).
 */
 /** A promise that never settles: the losing side of a race. */
 const NEVER = new Promise(() => {});
@@ -1716,8 +1715,13 @@ const gateExecutor = async (context) => {
 		output: {},
 		error: `${context.id} is not a gate`
 	};
-	const template = parseTemplate(node.question);
-	const question = template.ok ? renderTemplate(template.parts, runScope(context.inputs, context.outputs, context.runId)) : node.question;
+	const scope = runScope(context.inputs, context.outputs, context.runId);
+	const render = (text) => {
+		const template = parseTemplate(text);
+		return template.ok ? renderTemplate(template.parts, scope, { readable: true }) : text;
+	};
+	const question = render(node.question);
+	const document = render(node.document ?? "");
 	const options = node.options.map((o) => choiceOf(o));
 	const withdraw = new AbortController();
 	context.signal.addEventListener("abort", () => {
@@ -1734,6 +1738,7 @@ const gateExecutor = async (context) => {
 		}
 	};
 	if (node.recommended !== void 0) asked.recommended = node.recommended;
+	if (document.trim() !== "") asked.document = document;
 	const answer = context.human.ask(asked).then((choice) => ({
 		choice,
 		answeredBy: "user",
@@ -2130,4 +2135,4 @@ const missingPrograms = (workflow, installed = (program) => onPath(program)) =>
 	}
 	return [...missing.values()];
 };
-export { resultOf as _, builtinExecutors as a, toolExecutor as c, maskedEnv as d, maskedNamesOfRun as f, clearOutputFiles as g, sessionEnv as h, onPath as i, clearStateFiles as l, runScrubber as m, missingProgramMessage as n, spawnTool as o, runMarkerIn as p, missingPrograms as r, mcpCallExecutor as s, envProblems as t, inheritedScrubber as u };
+export { namedMcpEntries as _, builtinExecutors as a, toolExecutor as c, maskedEnv as d, maskedNamesOfRun as f, clearOutputFiles as g, sessionEnv as h, onPath as i, clearStateFiles as l, runScrubber as m, missingProgramMessage as n, spawnTool as o, runMarkerIn as p, missingPrograms as r, mcpCallExecutor as s, envProblems as t, inheritedScrubber as u, resultOf as v };

package/dist/{src-BTDzibW3.mjs → src-QEycKJWk.mjs}

@@ -1,11 +1,11 @@
-import { B as linkNodes, Cn as runDirOf, Ct as walkChecks, En as inside, Fn as applyEdits, G as requestContinue, Gn as expandEdge, Hn as EdgeInputSchema, Ht as planPost, In as newWorkflowText, J as tellLiveRun, K as requestPause, Ln as readDocument, Nn as skillsIn, Nt as nodeSays, On as LESSON_CAP_TOKENS, Pn as WorkflowEditSchema, Rn as renderJsonSchema, St as checkWorkflowText, Tn as workflowDirOf, U as unlinkNodes, Ut as runGh, Vt as DISCUSSIONS, Wt as sendPost, _t as runStatus, bn as placeFiles, bt as processAlive, ct as explainWorkflowText, d as runningRunIds, f as runningScript, gt as pausedOf, hn as loadAgents, ht as liveStatus, l as planUpgrade, nt as resumable, o as limitsReport, ot as detachRun, p as detectInstaller, q as requestStop, qn as NodeSchema, r as capsHere, st as followEvents, tn as readCondition, tt as detachResume, u as releaseNotes, v as triggersReport, vt as runTree, wt as walkSummary, xn as placeFor, zn as parseWorkflow } from "./src-DnETlJ1r.mjs";
-import { C as feedbackActions, S as placeOf$1, _ as previewPost, a as registryShown, b as acceptItem, c as checkDue, f as readUpdateCache, g as nodeSession, h as writeUpdateCache, i as registryOf, l as fetchLatest, m as updateCachePath, o as updateSwitchOff, p as refreshUpdateCache, s as runInstall, u as newerVersion, w as openFixRun, x as lessonPlaceOf, y as recordNote } from "./__build_info__-BwrKe6yz.mjs";
-import { n as pendingDecisions, r as builtinProblem, t as answerDecision } from "./decide-BvZnKErW.mjs";
-import { n as newRunId, t as findRun } from "./find-CbetS8I2.mjs";
-import { c as openStore, l as storePath, s as nodeOf } from "./output-Q3TZ-Ave.mjs";
+import { B as linkNodes, Bn as readDocument, Cn as placeFiles, Ct as walkChecks, En as runDirOf, G as requestContinue, Gn as EdgeInputSchema, Gt as planPost, Hn as parseWorkflow, In as skillsIn, J as tellLiveRun, Jn as expandEdge, K as requestPause, Kt as runGh, Ln as WorkflowEditSchema, Nt as nodeSays, On as workflowDirOf, Rn as applyEdits, St as checkWorkflowText, U as unlinkNodes, Vn as renderJsonSchema, Wt as DISCUSSIONS, Xn as NodeSchema, _t as runStatus, bt as processAlive, ct as explainWorkflowText, d as runningRunIds, f as runningScript, gt as pausedOf, ht as liveStatus, jn as LESSON_CAP_TOKENS, kn as inside, l as planUpgrade, nn as readCondition, nt as resumable, o as limitsReport, ot as detachRun, p as detectInstaller, q as requestStop, qt as sendPost, r as capsHere, st as followEvents, tt as detachResume, u as releaseNotes, v as triggersReport, vn as loadAgents, vt as runTree, wn as placeFor, wt as walkSummary, zn as newWorkflowText } from "./src-Do_MhwiV.mjs";
+import { C as feedbackActions, S as placeOf$1, _ as previewPost, a as registryShown, b as acceptItem, c as checkDue, f as readUpdateCache, g as nodeSession, h as writeUpdateCache, i as registryOf, l as fetchLatest, m as updateCachePath, o as updateSwitchOff, p as refreshUpdateCache, s as runInstall, u as newerVersion, w as openFixRun, x as lessonPlaceOf, y as recordNote } from "./__build_info__-Dl8yTEu-.mjs";
+import { n as pendingDecisions, r as builtinProblem, t as answerDecision } from "./decide-CK_-lI5V.mjs";
+import { n as newRunId, t as findRun } from "./find-DWiDJ5Lc.mjs";
+import { c as openStore, l as storePath, s as nodeOf } from "./output-BhYkshYq.mjs";
 import { n as usageReport } from "./report-DK4LGqwF.mjs";
-import { a as planClean, i as keyOf, o as stepActs, r as cleanStep, s as stepPrunes, t as applyClean } from "./clean-hXSaN8BT.mjs";
-import { a as readWorktrees, c as planLine, i as projectHead, l as removeRefusal, n as lostWork, o as labelOf, r as planRemove, s as mergeStateOf, t as applyRemove, u as stateParts } from "./remove-IbcZOemm.mjs";
+import { a as planClean, i as keyOf, o as stepActs, r as cleanStep, s as stepPrunes, t as applyClean } from "./clean-DYVmLkd4.mjs";
+import { a as readWorktrees, c as planLine, i as projectHead, l as removeRefusal, n as lostWork, o as labelOf, r as planRemove, s as mergeStateOf, t as applyRemove, u as stateParts } from "./remove-RVcX1KqP.mjs";
 import path from "node:path";
 import { z } from "zod";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
@@ -349,7 +349,9 @@ const EventsQuerySchema = z.strictObject({
 });
 const DecisionsQuerySchema = z.strictObject({
 	run: z.string().min(1).optional(),
-	project: z.string().min(1).optional()
+	project: z.string().min(1).optional(),
+	/** Only runs of this workflow, by name; ANDed with `run` or `project`. */
+	workflow: z.string().min(1).optional()
 });
 /** An answer: the option, and what the person said with it, if anything. */
 const AnswerSchema = z.strictObject({
@@ -483,7 +485,8 @@ const STREAMS = {
 	run: "/api/runs/:id/stream",
 	/**
 	* `runs`, `decisions`, `version`, each when it changes; `?project=` keeps
-	* one. `upgrade`: the upgrade's output, then `end` (contract-update.ts).
+	* one, `?workflow=` narrows `decisions` to that workflow's. `upgrade`: the
+	* upgrade's output, then `end` (contract-update.ts).
 	*/
 	overview: "/api/stream",
 	upgrade: "/api/upgrade/stream"
@@ -1625,10 +1628,17 @@ const readRoutes = (context) => ({
 		return ok(query.limit === void 0 ? newest : newest.slice(0, query.limit));
 	},
 	decisions: ({ query }) => {
-		if (query.run === void 0) return ok(pendingDecisions(context.store, query.project === void 0 ? {} : { project: projectRoot(context, query.project) }));
+		const workflow = query.workflow === void 0 ? {} : { workflow: query.workflow };
+		if (query.run === void 0) return ok(pendingDecisions(context.store, {
+			...workflow,
+			...query.project === void 0 ? {} : { project: projectRoot(context, query.project) }
+		}));
 		const found = runOf(context, query.run);
 		if (!found.ok) return found.refusal;
-		return ok(pendingDecisions(context.store, { runId: found.run.id }));
+		return ok(pendingDecisions(context.store, {
+			...workflow,
+			runId: found.run.id
+		}));
 	},
 	decision: ({ params }) => {
 		const found = context.store.decision(params.id);
@@ -2869,6 +2879,7 @@ const runStream = async (context, req, res, url, id, shutdown) => {
 const overviewStream = (context, res, url, shutdown) => {
 	const key = url.searchParams.get("project");
 	const root = key === null ? void 0 : projectOf(context, key)?.root ?? key;
+	const workflow = url.searchParams.get("workflow");
 	const stream = openEventStream(res);
 	const last = {
 		runs: "",
@@ -2881,7 +2892,10 @@ const overviewStream = (context, res, url, shutdown) => {
 			...filter,
 			limit: OVERVIEW_RUNS
 		}).map((run) => viewOf$2(context, run));
-		const decisions = pendingDecisions(context.store, filter);
+		const decisions = pendingDecisions(context.store, {
+			...filter,
+			...workflow === null ? {} : { workflow }
+		});
 		for (const [name, value] of [
 			["runs", runs],
 			["decisions", decisions],