@gh-symphony/cli 0.0.19 → 0.0.21

package/dist/{chunk-M3IFVLQS.js → chunk-QEONJ5DZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-// ../core/dist/workflow/lifecycle.js
+// ../core/src/workflow/lifecycle.ts
 var DEFAULT_WORKFLOW_LIFECYCLE = {
   stateFieldName: "Status",
   activeStates: ["Todo", "In Progress"],
@@ -21,8 +21,9 @@ function normalizeWorkflowState(state) {
   return state.trim().toLowerCase();
 }
 
-// ../core/dist/workflow/config.js
+// ../core/src/workflow/config.ts
 var DEFAULT_CODEX_COMMAND = "codex app-server";
+var DEFAULT_CLAUDE_COMMAND = "claude";
 var DEFAULT_AGENT_COMMAND = DEFAULT_CODEX_COMMAND;
 var DEFAULT_HOOK_TIMEOUT_MS = 6e4;
 var DEFAULT_POLL_INTERVAL_MS = 3e4;
@@ -84,6 +85,7 @@ var DEFAULT_WORKFLOW_DEFINITION = {
   workspace: DEFAULT_WORKFLOW_WORKSPACE,
   hooks: DEFAULT_WORKFLOW_HOOKS,
   agent: DEFAULT_WORKFLOW_AGENT,
+  runtime: null,
   codex: DEFAULT_WORKFLOW_CODEX,
   lifecycle: DEFAULT_WORKFLOW_LIFECYCLE,
   format: "default",
@@ -92,8 +94,20 @@ var DEFAULT_WORKFLOW_DEFINITION = {
   hookPath: null,
   maxConcurrentByState: {}
 };
+function resolveWorkflowRuntimeCommand(workflow) {
+  if (!workflow.runtime) {
+    return workflow.codex.command;
+  }
+  if (workflow.runtime.args.length === 0) {
+    return workflow.runtime.command;
+  }
+  return [workflow.runtime.command, ...workflow.runtime.args].join(" ");
+}
+function resolveWorkflowRuntimeTimeouts(workflow) {
+  return workflow.runtime?.timeouts ?? workflow.codex;
+}
 
-// ../core/dist/workflow/parser.js
+// ../core/src/workflow/parser.ts
 function parseWorkflowMarkdown(markdown, env = process.env, options = {}) {
   const compatibilityMode = options.compatibilityMode ?? "strict";
   const frontMatterMatch = markdown.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
@@ -111,16 +125,39 @@ function parseWorkflowMarkdown(markdown, env = process.env, options = {}) {
   const workspace = readObject(frontMatter, "workspace");
   const hooks = readObject(frontMatter, "hooks");
   const agent = readObject(frontMatter, "agent");
-  const codex = readRequiredObject(frontMatter, "codex");
+  const runtimeNode = readOptionalRuntimeObject(frontMatter);
+  const hasRuntime = runtimeNode !== null;
+  const codex = hasRuntime ? readObject(frontMatter, "codex") : readRequiredObject(frontMatter, "codex");
   const trackerKind = readRequiredString(tracker, "kind", env);
   const activeStates = readStringList(tracker, "active_states") ?? DEFAULT_WORKFLOW_TRACKER.activeStates;
   const terminalStates = readStringList(tracker, "terminal_states") ?? DEFAULT_WORKFLOW_TRACKER.terminalStates;
   const blockerCheckStates = readStringList(tracker, "blocker_check_states") ?? DEFAULT_WORKFLOW_TRACKER.blockerCheckStates;
-  const maxConcurrentAgentsByState = readNumberMap(agent, "max_concurrent_agents_by_state");
-  const command = readOptionalString(codex, "command", env) ?? DEFAULT_AGENT_COMMAND;
+  const maxConcurrentAgentsByState = readNumberMap(
+    agent,
+    "max_concurrent_agents_by_state"
+  );
+  const runtime = hasRuntime ? parseRuntimeConfig(runtimeNode, env) : null;
+  const codexConfig = {
+    command: readOptionalString(codex, "command", env) ?? DEFAULT_AGENT_COMMAND,
+    approvalPolicy: readOptionalString(codex, "approval_policy", env),
+    threadSandbox: readOptionalString(codex, "thread_sandbox", env),
+    turnSandboxPolicy: readOptionalString(codex, "turn_sandbox_policy", env),
+    turnTimeoutMs: readOptionalIntegerLike(codex, "turn_timeout_ms") ?? DEFAULT_TURN_TIMEOUT_MS,
+    readTimeoutMs: readOptionalIntegerLike(codex, "read_timeout_ms") ?? DEFAULT_READ_TIMEOUT_MS,
+    stallTimeoutMs: readOptionalIntegerLike(codex, "stall_timeout_ms") ?? DEFAULT_STALL_TIMEOUT_MS
+  };
+  const agentCommand = resolveWorkflowRuntimeCommand({
+    runtime,
+    codex: codexConfig
+  });
   const parsed = {
     promptTemplate,
-    continuationGuidance: readOptionalWorkflowString(frontMatter, "continuationGuidance", "continuation_guidance", env),
+    continuationGuidance: readOptionalWorkflowString(
+      frontMatter,
+      "continuationGuidance",
+      "continuation_guidance",
+      env
+    ),
     tracker: {
       kind: trackerKind,
       endpoint: readOptionalString(tracker, "endpoint", env),
@@ -154,15 +191,8 @@ function parseWorkflowMarkdown(markdown, env = process.env, options = {}) {
       maxTurns: readOptionalIntegerLike(agent, "max_turns") ?? DEFAULT_MAX_TURNS,
       retryBaseDelayMs: readOptionalIntegerLike(agent, "retry_base_delay_ms") ?? DEFAULT_BASE_DELAY_MS
     },
-    codex: {
-      command,
-      approvalPolicy: readOptionalString(codex, "approval_policy", env),
-      threadSandbox: readOptionalString(codex, "thread_sandbox", env),
-      turnSandboxPolicy: readOptionalString(codex, "turn_sandbox_policy", env),
-      turnTimeoutMs: readOptionalIntegerLike(codex, "turn_timeout_ms") ?? DEFAULT_TURN_TIMEOUT_MS,
-      readTimeoutMs: readOptionalIntegerLike(codex, "read_timeout_ms") ?? DEFAULT_READ_TIMEOUT_MS,
-      stallTimeoutMs: readOptionalIntegerLike(codex, "stall_timeout_ms") ?? DEFAULT_STALL_TIMEOUT_MS
-    },
+    runtime,
+    codex: codexConfig,
     lifecycle: {
       stateFieldName: readOptionalString(tracker, "state_field", env) ?? DEFAULT_WORKFLOW_TRACKER.stateFieldName,
       activeStates,
@@ -171,7 +201,7 @@ function parseWorkflowMarkdown(markdown, env = process.env, options = {}) {
     },
     format: "front-matter",
     githubProjectId: readOptionalString(tracker, "project_id", env),
-    agentCommand: command,
+    agentCommand,
     hookPath: readOptionalString(hooks, "after_create", env),
     maxConcurrentByState: maxConcurrentAgentsByState
   };
@@ -209,17 +239,25 @@ function parseBlock(lines, startIndex, indent) {
       break;
     }
     if (lineIndent > indent) {
-      throw new Error(`Invalid workflow front matter indentation near "${line.trim()}".`);
+      throw new Error(
+        `Invalid workflow front matter indentation near "${line.trim()}".`
+      );
     }
     const trimmed = line.trim();
     if (trimmed.startsWith("- ")) {
       if (collectionType === "object") {
-        throw new Error("Cannot mix array and object values in workflow front matter.");
+        throw new Error(
+          "Cannot mix array and object values in workflow front matter."
+        );
       }
       collectionType = "array";
       const itemText = trimmed.slice(2).trim();
       if (itemText === "|" || itemText === "|-") {
-        const [multiline, nextIndex3] = parseMultilineScalar(lines, index + 1, indent + 2);
+        const [multiline, nextIndex3] = parseMultilineScalar(
+          lines,
+          index + 1,
+          indent + 2
+        );
         arrayValues.push(multiline);
         index = nextIndex3;
         continue;
@@ -235,7 +273,9 @@ function parseBlock(lines, startIndex, indent) {
       continue;
     }
     if (collectionType === "array") {
-      throw new Error("Cannot mix object and array values in workflow front matter.");
+      throw new Error(
+        "Cannot mix object and array values in workflow front matter."
+      );
     }
     collectionType = "object";
     const separatorIndex = trimmed.indexOf(":");
@@ -245,7 +285,11 @@ function parseBlock(lines, startIndex, indent) {
     const key = trimmed.slice(0, separatorIndex).trim();
     const remainder = trimmed.slice(separatorIndex + 1).trim();
     if (remainder === "|" || remainder === "|-") {
-      const [multiline, nextIndex2] = parseMultilineScalar(lines, index + 1, indent + 2);
+      const [multiline, nextIndex2] = parseMultilineScalar(
+        lines,
+        index + 1,
+        indent + 2
+      );
       objectValues[key] = multiline;
       index = nextIndex2;
       continue;
@@ -284,29 +328,131 @@ function countIndent(line) {
   return line.match(/^ */)?.[0].length ?? 0;
 }
 function parseScalar(value) {
-  if (value === "null")
-    return null;
-  if (value === "true")
-    return true;
-  if (value === "false")
-    return false;
-  if (/^-?\d+$/.test(value))
-    return Number.parseInt(value, 10);
+  if (value === "null") return null;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  if (value.startsWith("[") && value.endsWith("]")) {
+    return parseInlineArray(value);
+  }
+  if (/^-?\d+$/.test(value)) return Number.parseInt(value, 10);
   if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
     return value.slice(1, -1);
   }
   return value;
 }
-function readObject(input, key) {
+function parseInlineArray(value) {
+  const inner = value.slice(1, -1).trim();
+  if (!inner) {
+    return [];
+  }
+  return splitInlineArrayEntries(inner).map((entry) => parseScalar(entry));
+}
+function splitInlineArrayEntries(inner) {
+  const entries = [];
+  let current = "";
+  let quote = null;
+  for (const char of inner) {
+    if (quote) {
+      current += char;
+      if (char === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      current += char;
+      continue;
+    }
+    if (char === ",") {
+      pushInlineArrayEntry(entries, current, "middle");
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  if (quote) {
+    throw new Error("Workflow front matter inline array has an unterminated string.");
+  }
+  pushInlineArrayEntry(entries, current, "end");
+  return entries;
+}
+function pushInlineArrayEntry(entries, entry, position) {
+  const trimmed = entry.trim();
+  if (!trimmed) {
+    const reason = position === "end" ? "has a trailing comma" : "contains an empty item";
+    throw new Error(`Workflow front matter inline array ${reason}.`);
+  }
+  entries.push(trimmed);
+}
+function parseRuntimeConfig(runtime, env) {
+  const kind = readRuntimeKind(runtime, env);
+  const isolation = readObject(runtime, "isolation", "runtime.isolation");
+  const auth = readObject(runtime, "auth", "runtime.auth");
+  const timeouts = readObject(runtime, "timeouts", "runtime.timeouts");
+  const configuredCommand = readOptionalString(runtime, "command", env);
+  const command = configuredCommand ?? defaultRuntimeCommand(kind);
+  if (!command) {
+    throw new Error(
+      'Workflow front matter field "runtime.command" is required for runtime.kind "custom".'
+    );
+  }
+  return {
+    kind,
+    command,
+    args: readRuntimeArgs(runtime),
+    isolation: {
+      bare: readOptionalBoolean(isolation, "bare", "runtime.isolation.bare") ?? false,
+      strictMcpConfig: readOptionalBoolean(
+        isolation,
+        "strict_mcp_config",
+        "runtime.isolation.strict_mcp_config"
+      ) ?? false
+    },
+    auth: {
+      env: readOptionalString(auth, "env", env)
+    },
+    timeouts: {
+      turnTimeoutMs: readOptionalIntegerLike(timeouts, "turn_timeout_ms") ?? DEFAULT_TURN_TIMEOUT_MS,
+      readTimeoutMs: readOptionalIntegerLike(timeouts, "read_timeout_ms") ?? DEFAULT_READ_TIMEOUT_MS,
+      stallTimeoutMs: readOptionalIntegerLike(timeouts, "stall_timeout_ms") ?? DEFAULT_STALL_TIMEOUT_MS
+    }
+  };
+}
+function readRuntimeKind(runtime, env) {
+  const kind = readRequiredString(runtime, "kind", env);
+  if (kind === "codex-app-server" || kind === "claude-print" || kind === "custom") {
+    return kind;
+  }
+  throw new Error(
+    `Unsupported workflow runtime kind "${kind}". Supported values: codex-app-server, claude-print, custom.`
+  );
+}
+function defaultRuntimeCommand(kind) {
+  if (kind === "claude-print") {
+    return DEFAULT_CLAUDE_COMMAND;
+  }
+  if (kind === "codex-app-server") {
+    return DEFAULT_AGENT_COMMAND;
+  }
+  return null;
+}
+function readObject(input, key, path = key) {
   const value = input[key];
   if (value === void 0 || value === null) {
     return {};
   }
   if (typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`Workflow front matter field "${key}" must be an object.`);
+    throw new Error(`Workflow front matter field "${path}" must be an object.`);
   }
   return value;
 }
+function readOptionalRuntimeObject(input) {
+  if (input.runtime === void 0 || input.runtime === null) {
+    return null;
+  }
+  return readObject(input, "runtime");
+}
 function readRequiredObject(input, key) {
   if (!(key in input)) {
     throw new Error(`Workflow front matter field "${key}" is required.`);
@@ -342,7 +488,31 @@ function readStringList(input, key) {
     return value.split(",").map((entry) => entry.trim()).filter(Boolean);
   }
   if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
-    throw new Error(`Workflow front matter field "${key}" must be an array of strings or comma-separated string.`);
+    throw new Error(
+      `Workflow front matter field "${key}" must be an array of strings or comma-separated string.`
+    );
+  }
+  return value;
+}
+function readRuntimeArgs(input) {
+  const value = input.args;
+  if (value === void 0 || value === null) {
+    return [];
+  }
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+    throw new Error(
+      'Workflow front matter field "runtime.args" must be an array of strings.'
+    );
+  }
+  return value;
+}
+function readOptionalBoolean(input, key, path = key) {
+  const value = input[key];
+  if (value === void 0 || value === null) {
+    return null;
+  }
+  if (typeof value !== "boolean") {
+    throw new Error(`Workflow front matter field "${path}" must be a boolean.`);
   }
   return value;
 }
@@ -377,7 +547,9 @@ function readNumberMap(input, key) {
       result[entryKey] = Number.parseInt(entryValue, 10);
       continue;
     }
-    throw new Error(`Workflow front matter field "${key}.${entryKey}" must be an integer.`);
+    throw new Error(
+      `Workflow front matter field "${key}.${entryKey}" must be an integer.`
+    );
   }
   return result;
 }
@@ -386,27 +558,39 @@ function resolveEnvironmentValue(value, env) {
   if (value.startsWith("env:") && envTokenMatch) {
     const resolved = env[envTokenMatch[1]];
     if (!resolved) {
-      throw new Error(`Workflow front matter requires environment variable ${envTokenMatch[1]}.`);
+      throw new Error(
+        `Workflow front matter requires environment variable ${envTokenMatch[1]}.`
+      );
     }
     return resolved;
   }
   return value.replace(/\$\{([A-Z0-9_]+)\}/g, (_, name) => {
     const resolved = env[name];
     if (!resolved) {
-      throw new Error(`Workflow front matter requires environment variable ${name}.`);
+      throw new Error(
+        `Workflow front matter requires environment variable ${name}.`
+      );
     }
     return resolved;
   });
 }
 function matchOptionalSection(markdown, heading) {
   const escapedHeading = heading.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`## ${escapedHeading}\\n\\n([\\s\\S]*?)(?=\\n## |$)`);
+  const pattern = new RegExp(
+    `## ${escapedHeading}\\n\\n([\\s\\S]*?)(?=\\n## |$)`
+  );
   const match = markdown.match(pattern);
   return match?.[1]?.trim() ?? null;
 }
 
-// ../core/dist/workflow/render.js
-import { Liquid, ParseError, RenderError, TokenizationError, UndefinedVariableError } from "liquidjs";
+// ../core/src/workflow/render.ts
+import {
+  Liquid,
+  ParseError,
+  RenderError,
+  TokenizationError,
+  UndefinedVariableError
+} from "liquidjs";
 function buildPromptVariables(issue, options) {
   return {
     issue: {
@@ -459,7 +643,10 @@ function flattenVariables(obj, prefix = "") {
   for (const [key, value] of Object.entries(obj)) {
     const fullKey = prefix ? `${prefix}.${key}` : key;
     if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-      for (const [nestedKey, nestedValue] of flattenVariables(value, fullKey)) {
+      for (const [nestedKey, nestedValue] of flattenVariables(
+        value,
+        fullKey
+      )) {
         result.set(nestedKey, nestedValue);
       }
     } else {
@@ -470,19 +657,22 @@ function flattenVariables(obj, prefix = "") {
 }
 function renderLegacyPrompt(template, variables) {
   const flatVars = flattenVariables(variables);
-  return template.replace(/\{\{([a-zA-Z_][a-zA-Z0-9_.]*)\}\}/g, (match, key) => {
-    const value = flatVars.get(key);
-    if (value === void 0) {
-      return match;
-    }
-    if (value === null) {
-      return "";
+  return template.replace(
+    /\{\{([a-zA-Z_][a-zA-Z0-9_.]*)\}\}/g,
+    (match, key) => {
+      const value = flatVars.get(key);
+      if (value === void 0) {
+        return match;
+      }
+      if (value === null) {
+        return "";
+      }
+      return String(value);
     }
-    return String(value);
-  });
+  );
 }
 
-// ../core/dist/contracts/status-surface.js
+// ../core/src/contracts/status-surface.ts
 var WORKFLOW_EXECUTION_PHASES = [
   "planning",
   "human-review",
@@ -506,7 +696,7 @@ function isSessionExitClassification(value) {
   return typeof value === "string" && SESSION_EXIT_CLASSIFICATIONS.includes(value);
 }
 
-// ../core/dist/contracts/run-attempt-phase.js
+// ../core/src/contracts/run-attempt-phase.ts
 var RUN_ATTEMPT_PHASES = [
   "preparing_workspace",
   "building_prompt",
@@ -524,7 +714,7 @@ function isRunAttemptPhase(value) {
   return typeof value === "string" && RUN_ATTEMPT_PHASES.includes(value);
 }
 
-// ../core/dist/contracts/orchestrator-channel.js
+// ../core/src/contracts/orchestrator-channel.ts
 function isRecord(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -616,7 +806,7 @@ function isOrchestratorChannelEvent(value) {
   return false;
 }
 
-// ../core/dist/workflow/loader.js
+// ../core/src/workflow/loader.ts
 import { createHash } from "crypto";
 import { access, readFile, stat } from "fs/promises";
 import { constants } from "fs";
@@ -683,7 +873,7 @@ function toWorkflowResolution(workflowPath, workflow, metadata) {
   };
 }
 
-// ../core/dist/workflow/exit-classification.js
+// ../core/src/workflow/exit-classification.ts
 function classifySessionExit(params) {
   if (params.userInputRequired) {
     return "user-input-required";
@@ -706,7 +896,7 @@ function classifySessionExit(params) {
   return "error";
 }
 
-// ../core/dist/orchestration/retry-policy.js
+// ../core/src/orchestration/retry-policy.ts
 function calculateRetryDelay(attempt, options = {}) {
   const baseDelayMs = options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
   const maxDelayMs = options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
@@ -718,7 +908,100 @@ function scheduleRetryAt(now, attempt, options = {}) {
   return new Date(now.getTime() + calculateRetryDelay(attempt, options));
 }
 
-// ../core/dist/workspace/env-file.js
+// ../core/src/runtime/credentials.ts
+import { readFile as readFile2, writeFile } from "fs/promises";
+var TOKEN_REUSE_WINDOW_MS = 60 * 1e3;
+var CODEX_ENV_KEYS = [
+  "OPENAI_API_KEY",
+  "OPENAI_BASE_URL",
+  "OPENAI_ORG_ID",
+  "OPENAI_PROJECT"
+];
+function extractEnvForCodex(env) {
+  return pickRuntimeEnv(env, CODEX_ENV_KEYS);
+}
+function toAgentCredentialCacheEntry(brokerResponse, now = /* @__PURE__ */ new Date()) {
+  return {
+    env: brokerResponse.env,
+    expires_at: brokerResponse.expires_at,
+    cachedAt: now.toISOString()
+  };
+}
+function shouldReuseAgentCredentialCache(entry, now = /* @__PURE__ */ new Date()) {
+  if (Object.keys(entry.env).length === 0) {
+    return false;
+  }
+  if (!entry.expires_at) {
+    return true;
+  }
+  const expiresAt = Date.parse(entry.expires_at);
+  if (Number.isNaN(expiresAt)) {
+    return false;
+  }
+  return expiresAt - now.getTime() > TOKEN_REUSE_WINDOW_MS;
+}
+async function readAgentCredentialCache(path, readFileImpl = readFile2) {
+  try {
+    return normalizeAgentCredentialCacheEntry(
+      JSON.parse(await readFileImpl(path, "utf8"))
+    );
+  } catch {
+    return null;
+  }
+}
+async function writeAgentCredentialCache(path, brokerResponse, writeFileImpl = writeFile, now = /* @__PURE__ */ new Date()) {
+  const entry = toAgentCredentialCacheEntry(brokerResponse, now);
+  await writeFileImpl(path, JSON.stringify(entry), "utf8");
+  return entry;
+}
+function pickRuntimeEnv(env, keys) {
+  const resolved = {};
+  for (const key of keys) {
+    const value = env[key];
+    if (value) {
+      resolved[key] = value;
+    }
+  }
+  return resolved;
+}
+function normalizeAgentCredentialCacheEntry(payload) {
+  if (!isRecord2(payload)) {
+    return null;
+  }
+  if (!isRecord2(payload.env)) {
+    return null;
+  }
+  const env = Object.fromEntries(
+    Object.entries(payload.env).filter(
+      (entry) => typeof entry[1] === "string"
+    )
+  );
+  if (Object.keys(env).length === 0) {
+    return null;
+  }
+  return {
+    env,
+    expires_at: typeof payload.expires_at === "string" ? payload.expires_at : void 0,
+    cachedAt: typeof payload.cachedAt === "string" ? payload.cachedAt : (/* @__PURE__ */ new Date(0)).toISOString()
+  };
+}
+function isRecord2(value) {
+  return value !== null && typeof value === "object";
+}
+
+// ../core/src/runtime/events.ts
+var DEFAULT_AGENT_INPUT_REQUIRED_REASON = "turn_input_required: agent requires user input";
+function buildAgentInputRequiredReason(prompt) {
+  if (typeof prompt === "string") {
+    const trimmedPrompt = prompt.trim();
+    if (trimmedPrompt) {
+      return `turn_input_required: ${trimmedPrompt}`;
+    }
+  }
+  return DEFAULT_AGENT_INPUT_REQUIRED_REASON;
+}
+
+// ../core/src/workspace/env-file.ts
 import { existsSync, readFileSync } from "fs";
 function readEnvFile(path) {
   if (!existsSync(path)) {
@@ -735,10 +1018,10 @@ function readEnvFile(path) {
   }, {});
 }
 
-// ../core/dist/workspace/safety.js
+// ../core/src/workspace/safety.ts
 import { resolve } from "path";
 
-// ../core/dist/workspace/identity.js
+// ../core/src/workspace/identity.ts
 import { resolve as resolve2, join } from "path";
 import { createHash as createHash2 } from "crypto";
 function deriveIssueWorkspaceKey(identity, issueIdentifier) {
@@ -766,12 +1049,14 @@ function resolveIssueWorkspaceDirectory(projectDirectory, workspaceKey) {
   const normalizedProjectDirectory = resolve2(projectDirectory);
   const candidate = resolve2(normalizedProjectDirectory, "issues", workspaceKey);
   if (!candidate.startsWith(`${normalizedProjectDirectory}/`)) {
-    throw new Error("Issue workspace path escapes the configured project directory.");
+    throw new Error(
+      "Issue workspace path escapes the configured project directory."
+    );
   }
   return candidate;
 }
 
-// ../core/dist/workspace/hooks.js
+// ../core/src/workspace/hooks.ts
 import { spawn } from "child_process";
 var DEFAULT_HOOK_TIMEOUT_MS2 = 6e4;
 async function executeHook(options) {
@@ -906,10 +1191,20 @@ function normalizeHookCommand(command) {
   return command;
 }
 
-// ../core/dist/observability/snapshot-builder.js
+// ../core/src/observability/snapshot-builder.ts
 function buildProjectSnapshot(input) {
-  const { project, activeRuns, allRuns, summary, lastTickAt, lastError, rateLimits } = input;
-  const cumulativeTokenUsageByIssue = aggregateTokenUsageByIssue(allRuns ?? activeRuns);
+  const {
+    project,
+    activeRuns,
+    allRuns,
+    summary,
+    lastTickAt,
+    lastError,
+    rateLimits
+  } = input;
+  const cumulativeTokenUsageByIssue = aggregateTokenUsageByIssue(
+    allRuns ?? activeRuns
+  );
   return {
     projectId: project.projectId,
     slug: project.slug,
@@ -941,7 +1236,10 @@ function buildProjectSnapshot(input) {
       lastEventAt: run.lastEventAt ?? null,
       executionPhase: run.executionPhase ?? null,
       runPhase: run.runPhase ?? null,
-      tokenUsage: attachCumulativeTokenUsage(run.tokenUsage, cumulativeTokenUsageByIssue.get(run.issueId))
+      tokenUsage: attachCumulativeTokenUsage(
+        run.tokenUsage,
+        cumulativeTokenUsageByIssue.get(run.issueId)
+      )
     })),
     retryQueue: activeRuns.filter((run) => run.status === "retrying" && run.retryKind).map((run) => ({
       runId: run.runId,
@@ -1010,11 +1308,11 @@ function aggregateTokenUsage(runs, lastTickAt) {
   return { inputTokens, outputTokens, totalTokens, secondsRunning };
 }
 
-// ../core/dist/observability/fs-reader.js
-import { readFile as readFile2, readdir } from "fs/promises";
+// ../core/src/observability/fs-reader.ts
+import { readFile as readFile3, readdir } from "fs/promises";
 async function readJsonFile(path) {
   try {
-    const raw = await readFile2(path, "utf8");
+    const raw = await readFile3(path, "utf8");
     return JSON.parse(raw);
   } catch (error) {
     if (isFileMissing(error)) {
@@ -1034,10 +1332,12 @@ async function safeReadDir(path) {
   }
 }
 function isFileMissing(error) {
-  return Boolean(error && typeof error === "object" && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR"));
+  return Boolean(
+    error && typeof error === "object" && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")
+  );
 }
 
-// ../core/dist/observability/event-formatter.js
+// ../core/src/observability/event-formatter.ts
 function formatEventMessage(event) {
   switch (event.event) {
     case "run-dispatched":
@@ -1064,6 +1364,8 @@ function formatEventMessage(event) {
       return `Turn ${event.turnCount} completed in ${event.durationMs}ms`;
     case "turn_failed":
       return event.error ?? `Turn ${event.turnCount} failed`;
+    case "session_invalidated":
+      return event.reason;
     default:
       return null;
   }
@@ -1102,9 +1404,11 @@ function parseRunEventLine(line) {
   }
 }
 
-// ../core/dist/observability/status-assembler.js
+// ../core/src/observability/status-assembler.ts
 function isMatchingIssueRun(run, projectId, issueId, issueIdentifier) {
-  return Boolean(run && run.projectId === projectId && (run.issueId === issueId || run.issueIdentifier === issueIdentifier));
+  return Boolean(
+    run && run.projectId === projectId && (run.issueId === issueId || run.issueIdentifier === issueIdentifier)
+  );
 }
 function mapIssueOrchestrationStateToStatus(state) {
   switch (state) {
@@ -1123,6 +1427,593 @@ function mapIssueOrchestrationStateToStatus(state) {
   }
 }
 
+// ../runtime-claude/src/preflight.ts
+import { execFileSync } from "child_process";
+import { constants as constants2 } from "fs";
+import { access as access2, readFile as readFile4 } from "fs/promises";
+import { isAbsolute, join as join2, resolve as resolve3 } from "path";
+var DEFAULT_DEPENDENCIES = {
+  execFileSync,
+  readFile: readFile4,
+  access: access2,
+  fetchImpl: fetch,
+  platform: process.platform
+};
+var CREDENTIAL_BROKER_TIMEOUT_MS = 5e3;
+async function runClaudePreflight(options, dependencies = {}) {
+  const deps = { ...DEFAULT_DEPENDENCIES, ...dependencies };
+  const env = options.env ?? process.env;
+  const command = resolveRuntimeCommandBinary(options.command) ?? "claude";
+  const checks = [];
+  checks.push(checkClaudeBinary(command, options.cwd, deps));
+  checks.push(await checkAnthropicApiKey(env, options, deps));
+  checks.push(await checkWorkspaceMcpConfig(options.cwd, deps));
+  if (options.includeGhAuth) {
+    checks.push(checkGhAuthentication(options.cwd, deps));
+  }
+  return {
+    ok: checks.every((check) => check.status !== "fail"),
+    checks
+  };
+}
+function formatClaudePreflightText(report) {
+  const lines = ["Claude runtime preflight"];
+  for (const check of report.checks) {
+    const label = check.status === "pass" ? "PASS" : check.status === "warn" ? "WARN" : "FAIL";
+    lines.push(`${label} ${check.title}`);
+    lines.push(`  ${check.summary}`);
+    if (check.remediation) {
+      lines.push(`  Fix: ${check.remediation}`);
+    }
+  }
+  return lines.join("\n");
+}
+function pass(id, title, summary, details) {
+  return { id, title, status: "pass", summary, details };
+}
+function warn(id, title, summary, remediation, details) {
+  return { id, title, status: "warn", summary, remediation, details };
+}
+function fail(id, title, summary, remediation, details) {
+  return { id, title, status: "fail", summary, remediation, details };
+}
+function checkClaudeBinary(command, cwd, deps) {
+  const executable = resolveExecutableCommand(command, cwd);
+  try {
+    const locatedPath = locateClaudeBinary(executable, cwd, deps);
+    const version = deps.execFileSync(executable, ["--version"], {
+      encoding: "utf8",
+      cwd,
+      stdio: ["pipe", "pipe", "pipe"]
+    }).toString().trim();
+    return pass(
+      "claude_binary",
+      "Claude CLI binary",
+      version ? `${executable} is available: ${version}.` : `${executable} is available, but --version returned an empty response.`,
+      { command: executable, path: locatedPath, version }
+    );
+  } catch (error) {
+    return fail(
+      "claude_binary",
+      "Claude CLI binary",
+      `${executable} could not be found or executed from PATH.`,
+      `Install Claude Code and ensure '${executable}' is on PATH, then re-run the command.`,
+      {
+        command: executable,
+        error: error instanceof Error ? error.message : String(error)
+      }
+    );
+  }
+}
+function resolveExecutableCommand(command, cwd) {
+  if ((command.includes("/") || command.includes("\\")) && !isAbsolute(command)) {
+    return resolve3(cwd, command);
+  }
+  return command;
+}
+function locateClaudeBinary(command, cwd, deps) {
+  if (command.includes("/") || command.includes("\\")) {
+    return command;
+  }
+  try {
+    const locator = deps.platform === "win32" ? "where" : "which";
+    return deps.execFileSync(locator, [command], {
+      encoding: "utf8",
+      cwd,
+      stdio: ["pipe", "pipe", "pipe"]
+    }).toString().split(/\r?\n/).find((line) => line.trim())?.trim() ?? null;
+  } catch {
+    return null;
+  }
+}
+function checkGhAuthentication(cwd, deps) {
+  try {
+    deps.execFileSync("gh", ["auth", "status"], {
+      encoding: "utf8",
+      cwd,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return pass(
+      "gh_authentication",
+      "GitHub CLI authentication",
+      "gh auth status succeeded."
+    );
+  } catch (error) {
+    return fail(
+      "gh_authentication",
+      "GitHub CLI authentication",
+      "gh auth status failed or no GitHub login is configured.",
+      "Run 'gh auth login --scopes repo,read:org,project' and re-run the command.",
+      { error: error instanceof Error ? error.message : String(error) }
+    );
+  }
+}
+async function checkAnthropicApiKey(env, options, deps) {
+  if (env.ANTHROPIC_API_KEY?.trim()) {
+    return pass(
+      "anthropic_api_key",
+      "Anthropic API key",
+      "ANTHROPIC_API_KEY is configured in the environment.",
+      { source: "env" }
+    );
+  }
+  const brokerUrl = env.AGENT_CREDENTIAL_BROKER_URL?.trim();
+  const brokerSecret = env.AGENT_CREDENTIAL_BROKER_SECRET?.trim();
+  if (!brokerUrl || !brokerSecret) {
+    return fail(
+      "anthropic_api_key",
+      "Anthropic API key",
+      "Neither ANTHROPIC_API_KEY nor an agent credential broker is configured.",
+      "Set ANTHROPIC_API_KEY or configure AGENT_CREDENTIAL_BROKER_URL and AGENT_CREDENTIAL_BROKER_SECRET.",
+      { source: "missing" }
+    );
+  }
+  if (options.probeCredentialBroker === false) {
+    return pass(
+      "anthropic_api_key",
+      "Anthropic API key",
+      "Agent credential broker configuration is present.",
+      { source: "broker", brokerUrl }
+    );
+  }
+  try {
+    const response = await deps.fetchImpl(brokerUrl, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${brokerSecret}`
+      },
+      signal: AbortSignal.timeout(CREDENTIAL_BROKER_TIMEOUT_MS)
+    });
+    const payload = await response.json();
+    if (response.ok && payload.env?.ANTHROPIC_API_KEY?.trim()) {
+      return pass(
+        "anthropic_api_key",
+        "Anthropic API key",
+        "Agent credential broker is reachable and returned ANTHROPIC_API_KEY.",
+        { source: "broker", brokerUrl }
+      );
+    }
+    return fail(
+      "anthropic_api_key",
+      "Anthropic API key",
+      payload.error ? `Agent credential broker did not return ANTHROPIC_API_KEY: ${payload.error}.` : "Agent credential broker did not return ANTHROPIC_API_KEY.",
+      "Set ANTHROPIC_API_KEY or configure the credential broker to return ANTHROPIC_API_KEY.",
+      { source: "broker", brokerUrl, status: response.status }
+    );
+  } catch (error) {
+    return fail(
+      "anthropic_api_key",
+      "Anthropic API key",
+      "Agent credential broker could not be reached.",
+      "Set ANTHROPIC_API_KEY or fix AGENT_CREDENTIAL_BROKER_URL and AGENT_CREDENTIAL_BROKER_SECRET.",
+      {
+        source: "broker",
+        brokerUrl,
+        error: error instanceof Error ? error.message : String(error)
+      }
+    );
+  }
+}
+async function checkWorkspaceMcpConfig(cwd, deps) {
+  const path = join2(cwd, ".mcp.json");
+  try {
+    await deps.access(path, constants2.R_OK);
+  } catch (error) {
+    const err = error;
+    if (err.code === "ENOENT") {
+      return warn(
+        "claude_mcp_config",
+        "Workspace .mcp.json",
+        ".mcp.json was not found in the workspace root. Claude can still run without a workspace MCP config.",
+        void 0,
+        { path, reason: "missing" }
+      );
+    }
+    return warn(
+      "claude_mcp_config",
+      "Workspace .mcp.json",
+      `.mcp.json exists but is not readable: ${err.message}.`,
+      "Fix .mcp.json file permissions if this workspace needs Claude MCP servers.",
+      { path, reason: "unreadable", error: err.message }
+    );
+  }
+  try {
+    const content = await deps.readFile(path, "utf8");
+    JSON.parse(content);
+    return pass(
+      "claude_mcp_config",
+      "Workspace .mcp.json",
+      ".mcp.json is readable and contains valid JSON.",
+      { path }
+    );
+  } catch (error) {
+    return fail(
+      "claude_mcp_config",
+      "Workspace .mcp.json",
+      `.mcp.json could not be parsed as JSON: ${error instanceof Error ? error.message : String(error)}.`,
+      "Fix or remove the workspace root .mcp.json file, then re-run the command.",
+      { path, reason: "invalid_json" }
+    );
+  }
+}
+function isClaudeRuntimeCommand(command) {
+  return resolveClaudeCommandBinary(command) != null;
+}
+function resolveClaudeCommandBinary(command) {
+  const binary = resolveRuntimeCommandBinary(command);
+  return binary != null && isClaudeBinaryName(binary) ? binary : null;
+}
+function resolveRuntimeCommandBinary(command) {
+  const normalized = (command ?? "").trim();
+  if (!normalized) {
+    return null;
+  }
+  const tokens = tokenizeRuntimeCommand(normalized);
+  if (tokens.length === 0) {
+    return null;
+  }
+  const first = stripClaudeCommandQuotes(tokens[0]);
+  if ((first === "bash" || first === "sh" || first === "zsh" || first === "fish") && tokens.length >= 3) {
+    const flagIndex = tokens.findIndex((token) => {
+      const value = stripClaudeCommandQuotes(token);
+      return value === "-c" || value === "-lc";
+    });
+    if (flagIndex >= 0 && flagIndex + 1 < tokens.length) {
+      const shellCommand = stripClaudeCommandQuotes(tokens[flagIndex + 1]);
+      return resolveShellCommandClaudeBinary(shellCommand) ?? resolveRuntimeCommandBinary(shellCommand);
+    }
+  }
+  return first;
+}
+function stripClaudeCommandQuotes(value) {
+  return value.replace(/^['"]|['"]$/g, "");
+}
+function tokenizeRuntimeCommand(command) {
+  return command.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+}
+function resolveShellCommandClaudeBinary(command) {
+  for (const segment of command.split(/&&|\|\||[;\n]/g)) {
+    const tokens = tokenizeRuntimeCommand(segment);
+    for (const token of tokens) {
+      const value = stripClaudeCommandQuotes(token);
+      if (value.includes("=") && !value.startsWith("/") && !value.startsWith("./")) {
+        continue;
+      }
+      if (isClaudeBinaryName(value)) {
+        return value;
+      }
+    }
+  }
+  return null;
+}
+function isClaudeBinaryName(command) {
+  const normalized = (command.split(/[\\/]/).pop() ?? command).toLowerCase().replace(/\.(exe|cmd|bat)$/i, "");
+  return normalized === "claude" || normalized === "claude-code";
+}
+
+// ../runtime-claude/src/adapter.ts
+import { randomUUID } from "crypto";
+import { rm } from "fs/promises";
+import { join as join5 } from "path";
+
+// ../runtime-claude/src/mcp-compose.ts
+import { mkdir, readFile as readFile6, writeFile as writeFile3 } from "fs/promises";
+import { basename, dirname, join as join3, resolve as resolve4 } from "path";
+
+// ../tool-github-graphql/src/tool.ts
+import { readFile as readFile5, writeFile as writeFile2 } from "fs/promises";
+var DEFAULT_GITHUB_GRAPHQL_API_URL = "https://api.github.com/graphql";
+var TOKEN_REUSE_WINDOW_MS2 = 60 * 1e3;
+async function executeGitHubGraphQL(invocation, config, fetchImpl = fetch) {
+  const token = await resolveGitHubGraphQLToken(config, {
+    fetchImpl
+  });
+  const response = await fetchImpl(
+    config.apiUrl ?? DEFAULT_GITHUB_GRAPHQL_API_URL,
+    {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify(invocation)
+    }
+  );
+  const payload = await response.json();
+  if (!response.ok) {
+    throw new Error(
+      `GitHub GraphQL request failed with status ${response.status}: ${JSON.stringify(payload)}`
+    );
+  }
+  if (payload.errors?.length) {
+    throw new Error(payload.errors.map((error) => error.message).join("; "));
+  }
+  return payload;
+}
+async function resolveGitHubGraphQLToken(config, dependencies = {}) {
+  if (config.token) {
+    return config.token;
+  }
+  if (!config.tokenBrokerUrl || !config.tokenBrokerSecret) {
+    throw new Error(
+      "Either GITHUB_GRAPHQL_TOKEN or the runtime token broker configuration is required."
+    );
+  }
+  const now = dependencies.now ?? /* @__PURE__ */ new Date();
+  const readFileImpl = dependencies.readFileImpl ?? readFile5;
+  const writeFileImpl = dependencies.writeFileImpl ?? writeFile2;
+  const cachedToken = config.tokenCachePath ? await readCachedToken(config.tokenCachePath, readFileImpl) : null;
+  if (cachedToken && cachedToken.expiresAt.getTime() - now.getTime() > TOKEN_REUSE_WINDOW_MS2) {
+    return cachedToken.token;
+  }
+  const fetchImpl = dependencies.fetchImpl ?? fetch;
+  const response = await fetchImpl(config.tokenBrokerUrl, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${config.tokenBrokerSecret}`
+    }
+  });
+  const payload = await response.json();
+  if (!response.ok || !payload.token || !payload.expiresAt) {
+    throw new Error(
+      payload.error ?? `Runtime token broker request failed with status ${response.status}.`
+    );
+  }
+  if (config.tokenCachePath) {
+    await writeFileImpl(config.tokenCachePath, JSON.stringify(payload), "utf8");
+  }
+  return payload.token;
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function main() {
+  const rawInput = await readStdin();
+  const invocation = JSON.parse(rawInput);
+  const result = await executeGitHubGraphQL(invocation, {
+    token: process.env.GITHUB_GRAPHQL_TOKEN,
+    apiUrl: process.env.GITHUB_GRAPHQL_API_URL,
+    tokenBrokerUrl: process.env.GITHUB_TOKEN_BROKER_URL,
+    tokenBrokerSecret: process.env.GITHUB_TOKEN_BROKER_SECRET,
+    tokenCachePath: process.env.GITHUB_TOKEN_CACHE_PATH
+  });
+  process.stdout.write(`${JSON.stringify(result)}
+`);
+}
+if (import.meta.url === new URL(process.argv[1] ?? "", "file:").href) {
+  main().catch((error) => {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    process.stderr.write(`${message}
+`);
+    process.exitCode = 1;
+  });
+}
+async function readCachedToken(path, readFileImpl) {
+  try {
+    const payload = JSON.parse(await readFileImpl(path, "utf8"));
+    if (!payload.token || !payload.expiresAt) {
+      return null;
+    }
+    return {
+      token: payload.token,
+      expiresAt: new Date(payload.expiresAt)
+    };
+  } catch {
+    return null;
+  }
+}
+
+// ../tool-github-graphql/src/mcp-server.ts
+import { fileURLToPath } from "url";
+var TOOL_SCHEMA = {
+  name: "github_graphql",
+  description: "Execute GitHub GraphQL queries for the active workspace so the agent can mutate project and issue state directly.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      query: {
+        type: "string",
+        description: "GraphQL query or mutation document."
+      },
+      variables: {
+        type: "object",
+        description: "Variables for the GraphQL document."
+      },
+      operationName: {
+        type: "string",
+        description: "Optional GraphQL operation name."
+      }
+    },
+    required: ["query"],
+    additionalProperties: false
+  }
+};
+var lineBuffer = "";
+function resolveGitHubGraphQLMcpServerEntryPoint() {
+  return fileURLToPath(new URL("./mcp-server.js", import.meta.url));
+}
+function sendResponse(id, result) {
+  const msg = JSON.stringify({ jsonrpc: "2.0", id, result });
+  process.stdout.write(msg + "\n");
+}
+function sendError(id, code, message) {
+  const msg = JSON.stringify({
+    jsonrpc: "2.0",
+    id,
+    error: { code, message }
+  });
+  process.stdout.write(msg + "\n");
+}
+async function handleRequest(msg) {
+  const id = msg.id ?? null;
+  switch (msg.method) {
+    case "initialize": {
+      sendResponse(id, {
+        protocolVersion: "2024-11-05",
+        capabilities: { tools: {} },
+        serverInfo: {
+          name: "github-symphony-graphql",
+          version: "0.1.0"
+        }
+      });
+      process.stdout.write(
+        JSON.stringify({
+          jsonrpc: "2.0",
+          method: "notifications/initialized"
+        }) + "\n"
+      );
+      break;
+    }
+    case "tools/list": {
+      sendResponse(id, { tools: [TOOL_SCHEMA] });
+      break;
+    }
+    case "tools/call": {
+      const params = msg.params;
+      if (params.name !== "github_graphql") {
+        sendError(id, -32602, `Unknown tool: ${params.name}`);
+        return;
+      }
+      const args = params.arguments ?? {};
+      const invocation = {
+        query: args.query,
+        variables: args.variables,
+        operationName: args.operationName
+      };
+      try {
+        const result = await executeGitHubGraphQL(invocation, {
+          token: process.env.GITHUB_GRAPHQL_TOKEN,
+          apiUrl: process.env.GITHUB_GRAPHQL_API_URL,
+          tokenBrokerUrl: process.env.GITHUB_TOKEN_BROKER_URL,
+          tokenBrokerSecret: process.env.GITHUB_TOKEN_BROKER_SECRET,
+          tokenCachePath: process.env.GITHUB_TOKEN_CACHE_PATH
+        });
+        sendResponse(id, {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(result, null, 2)
+            }
+          ]
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        sendResponse(id, {
+          content: [{ type: "text", text: message }],
+          isError: true
+        });
+      }
+      break;
+    }
+    case "notifications/initialized":
+    case "ping": {
+      if (id !== null && id !== void 0) {
+        sendResponse(id, {});
+      }
+      break;
+    }
+    default: {
+      if (id !== null && id !== void 0) {
+        sendError(id, -32601, `Method not found: ${msg.method}`);
+      }
+    }
+  }
+}
+async function main2() {
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", (chunk) => {
+    lineBuffer += chunk;
+    const lines = lineBuffer.split("\n");
+    lineBuffer = lines.pop() ?? "";
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        const msg = JSON.parse(trimmed);
+        void handleRequest(msg);
+      } catch (err) {
+        process.stderr.write(
+          `[github-graphql-mcp] parse error: ${err instanceof Error ? err.message : String(err)}
+`
+        );
+      }
+    }
+  });
+  process.stdin.on("end", () => {
+    process.exit(0);
+  });
+}
+if (import.meta.url === new URL(process.argv[1] ?? "", "file:").href) {
+  main2().catch((err) => {
+    process.stderr.write(
+      `[github-graphql-mcp] fatal: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    process.exitCode = 1;
+  });
+}
+
+// ../tool-github-graphql/src/mcp-entry.ts
+var DEFAULT_GITHUB_GRAPHQL_API_URL2 = "https://api.github.com/graphql";
+function createGitHubGraphQLMcpServerEntry(options = {}) {
+  return {
+    command: "node",
+    args: [resolveGitHubGraphQLMcpServerEntryPoint()],
+    env: {
+      GITHUB_GRAPHQL_API_URL: options.githubGraphqlApiUrl ?? DEFAULT_GITHUB_GRAPHQL_API_URL2,
+      ...options.githubToken ? {
+        GITHUB_GRAPHQL_TOKEN: options.githubToken
+      } : {},
+      ...options.githubTokenBrokerUrl ? {
+        GITHUB_TOKEN_BROKER_URL: options.githubTokenBrokerUrl
+      } : {},
+      ...options.githubTokenBrokerSecret ? {
+        GITHUB_TOKEN_BROKER_SECRET: options.githubTokenBrokerSecret
+      } : {},
+      ...options.githubTokenCachePath ? {
+        GITHUB_TOKEN_CACHE_PATH: options.githubTokenCachePath
+      } : {},
+      ...options.githubProjectId ? {
+        GITHUB_PROJECT_ID: options.githubProjectId
+      } : {}
+    }
+  };
+}
+
+// ../runtime-claude/src/spawn.ts
+import { spawn as spawn2 } from "child_process";
+import { finished } from "stream/promises";
+
+// ../runtime-claude/src/session-store.ts
+import { mkdir as mkdir2, readFile as readFile7, rename, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname2, join as join4 } from "path";
+
 export {
   isOrchestratorChannelEvent,
   DEFAULT_WORKFLOW_LIFECYCLE,
@@ -1130,6 +2021,8 @@ export {
   isStateTerminal,
   matchesWorkflowState,
   DEFAULT_MAX_FAILURE_RETRIES,
+  resolveWorkflowRuntimeCommand,
+  resolveWorkflowRuntimeTimeouts,
   parseWorkflowMarkdown,
   WorkflowConfigStore,
   createDefaultWorkflowResolution,
@@ -1138,6 +2031,12 @@ export {
   renderPrompt,
   classifySessionExit,
   scheduleRetryAt,
+  extractEnvForCodex,
+  shouldReuseAgentCredentialCache,
+  readAgentCredentialCache,
+  writeAgentCredentialCache,
+  DEFAULT_AGENT_INPUT_REQUIRED_REASON,
+  buildAgentInputRequiredReason,
   readEnvFile,
   deriveIssueWorkspaceKey,
   deriveIssueWorkspaceKeyFromIdentifier,
@@ -1151,5 +2050,12 @@ export {
   isFileMissing,
   parseRecentEvents,
   isMatchingIssueRun,
-  mapIssueOrchestrationStateToStatus
+  mapIssueOrchestrationStateToStatus,
+  resolveGitHubGraphQLToken,
+  createGitHubGraphQLMcpServerEntry,
+  runClaudePreflight,
+  formatClaudePreflightText,
+  isClaudeRuntimeCommand,
+  resolveClaudeCommandBinary,
+  resolveRuntimeCommandBinary
 };