don't run which in subshell, so $ok trickles down