@hasna/workflows 0.1.0 → 0.1.1

package/dist/cli/index.js

@@ -1,16 +1,459 @@
 #!/usr/bin/env bun
 // @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
+
+// src/lanes/types.ts
+import { statSync } from "fs";
+function binaryOnPath(binary) {
+  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
+  for (const entry of pathEntries) {
+    try {
+      const stat = statSync(`${entry}/${binary}`);
+      if (stat.isFile())
+        return true;
+    } catch {}
+  }
+  return false;
+}
+function withTimeout(promise, timeoutMs, what) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`${what} exceeded the ${timeoutMs}ms budget`));
+    }, timeoutMs);
+    promise.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+function spawnCli(cmd, opts) {
+  const started = Date.now();
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+  let proc;
+  try {
+    proc = Bun.spawnSync({
+      cmd,
+      cwd: opts.cwd,
+      env: { ...process.env, ...opts.env ?? {} },
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: timeoutMs
+    });
+  } catch (err) {
+    const message = String(err instanceof Error ? err.message : err);
+    if (message.includes("ENOENT") || /not found/i.test(message)) {
+      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
+    }
+    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
+  }
+  const durationMs = Date.now() - started;
+  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
+  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
+  const output = stderr ? `${stdout}
+${stderr}`.trim() : stdout.trim();
+  const exitCode = proc.exitCode ?? 1;
+  return { ok: exitCode === 0, exitCode, output, durationMs };
+}
+var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000;
+var init_types = __esm(() => {
+  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
+  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneDependencyMissingError";
+    }
+  };
+  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneAdapterShapeError";
+    }
+  };
+});
+
+// src/lanes/claude.ts
+function createClaudeAdapter(deps = {}) {
+  return {
+    kind: "claude",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      try {
+        await loader();
+        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "claude")) {
+          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "claude",
+          sdk: "@anthropic-ai/claude-agent-sdk",
+          wired: false,
+          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch (err) {
+        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
+      }
+      const query = sdk.query;
+      if (typeof query !== "function") {
+        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
+      }
+      const prompt = job.prompt;
+      try {
+        const { output, isError } = await withTimeout((async () => {
+          const generator = await query({
+            prompt,
+            options: { model: job.model, maxTurns: 32, abortSignal: undefined }
+          });
+          let output2 = "";
+          let isError2 = false;
+          for await (const message of generator) {
+            if (message.type === "assistant") {
+              const content = message.message?.content;
+              if (Array.isArray(content)) {
+                for (const block of content) {
+                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
+                    output2 += block.text;
+                  }
+                }
+              }
+            }
+            if (message.type === "error")
+              isError2 = true;
+          }
+          return { output: output2, isError: isError2 };
+        })(), timeoutMs, `claude lane (${job.prompt.slice(0, 60)})`);
+        const durationMs = Date.now() - started;
+        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+      }
+    }
+  };
+}
+function runClaudeCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = spawnCli([cliPath, "-p", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
+  }
+}
+var init_claude = __esm(() => {
+  init_types();
+});
+
+// src/lanes/codex.ts
+function createCodexAdapter(deps = {}) {
+  return {
+    kind: "codex",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      try {
+        await loader();
+        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "codex")) {
+          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "codex",
+          sdk: "@openai/codex-sdk",
+          wired: false,
+          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
+      }
+      const CodexClass = sdk.Codex;
+      if (typeof CodexClass !== "function") {
+        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
+      }
+      try {
+        const client = await withTimeout(Promise.resolve(new CodexClass({
+          config: { model: job.model },
+          env: job.env
+        })), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
+        const thread = client.startThread?.();
+        if (!thread || typeof thread.run !== "function") {
+          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
+        }
+        const turn = await withTimeout(thread.run(job.prompt), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
+        const output = turn?.finalResponse ?? "";
+        const durationMs = Date.now() - started;
+        return { ok: true, exitCode: 0, output, durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+      }
+    }
+  };
+}
+function runCodexCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = spawnCli([cliPath, "exec", "--", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@openai/codex-sdk or the codex CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
+  }
+}
+var init_codex = __esm(() => {
+  init_types();
+});
+
+// src/lanes/cursor.ts
+function createCursorAdapter(deps = {}) {
+  return {
+    kind: "cursor",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      try {
+        await loader();
+        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
+          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "cursor",
+          sdk: "@cursor/sdk",
+          wired: false,
+          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
+      }
+      try {
+        const run = await withTimeout(runLocalAgent(sdk, job), timeoutMs, `cursor lane (${job.prompt.slice(0, 60)})`);
+        const durationMs = Date.now() - started;
+        const status = run?.status ?? "finished";
+        const ok = status === "finished";
+        return { ok, exitCode: ok ? 0 : 1, output: run?.result ?? "", durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
+      }
+    }
+  };
+}
+async function runLocalAgent(sdk, job) {
+  const AgentClass = sdk.Agent;
+  const CursorClass = sdk.Cursor;
+  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
+  }
+  const agent = typeof AgentClass === "function" ? new AgentClass : undefined;
+  if (!agent || typeof agent.send !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
+  }
+  const run = await agent.send(job.prompt, { model: job.model });
+  if (!run || typeof run !== "object") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
+  }
+  return run;
+}
+function runCursorCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = spawnCli([cliPath, "run", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
+  }
+}
+var init_cursor = __esm(() => {
+  init_types();
+});
+
+// src/lanes/grok.ts
+function createGrokAdapter(deps = {}) {
+  return {
+    kind: "grok",
+    async probe() {
+      const cliPath = deps.cliPath ?? "grok";
+      if (binaryOnPath(cliPath)) {
+        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
+      }
+      return {
+        kind: "grok",
+        sdk: "no npm SDK (measured 2026-08-25)",
+        wired: false,
+        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
+      };
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const cliPath = deps.cliPath ?? "grok";
+      try {
+        const result = spawnCli([cliPath, job.prompt], {
+          binaryName: cliPath,
+          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
+          timeoutMs,
+          env: job.env,
+          cwd: job.cwd
+        });
+        return { ...result, durationMs: Date.now() - started };
+      } catch (err) {
+        if (err instanceof LaneDependencyMissingError) {
+          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+        }
+        throw err;
+      }
+    }
+  };
+}
+var init_grok = __esm(() => {
+  init_types();
+});
+
+// src/lanes/index.ts
+var exports_lanes = {};
+__export(exports_lanes, {
+  runLaneJob: () => runLaneJob,
+  resolveLane: () => resolveLane,
+  probeLane: () => probeLane,
+  laneInventory: () => laneInventory,
+  createGrokAdapter: () => createGrokAdapter,
+  createCursorAdapter: () => createCursorAdapter,
+  createCodexAdapter: () => createCodexAdapter,
+  createClaudeAdapter: () => createClaudeAdapter,
+  binaryOnPath: () => binaryOnPath,
+  LaneDependencyMissingError: () => LaneDependencyMissingError,
+  LaneAdapterShapeError: () => LaneAdapterShapeError,
+  LANE_KINDS: () => LANE_KINDS2
+});
+function resolveLane(kind) {
+  const adapter = adapters.get(kind);
+  if (!adapter)
+    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
+  return adapter;
+}
+async function runLaneJob(job) {
+  return resolveLane(job.lane).run(job);
+}
+async function probeLane(kind) {
+  return resolveLane(kind).probe();
+}
+async function laneInventory() {
+  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
+}
+var adapters;
+var init_lanes = __esm(() => {
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  init_types();
+  init_types();
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  adapters = new Map([
+    ["claude", createClaudeAdapter()],
+    ["codex", createCodexAdapter()],
+    ["cursor", createCursorAdapter()],
+    ["grok", createGrokAdapter()]
+  ]);
+});
 
 // src/cli/index.ts
 import { Command } from "commander";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync } from "fs";
+import { hostname } from "os";
+import { join as join4 } from "path";
 
 // src/service.ts
-import { join } from "path";
+import { join as join3 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/workflows",
-  version: "0.1.0",
-  description: "Universal graph workflow app \u2014 scaffold with version/health/readiness on all four surfaces; graph language, store, session WAL, daemon, and lane adapters are roadmap",
+  version: "0.1.1",
+  description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
   type: "module",
   main: "./dist/index.js",
   types: "./types/index.d.ts",
@@ -80,10 +523,13 @@ var package_default = {
   author: "Hasna",
   license: "Apache-2.0",
   dependencies: {
+    "@anthropic-ai/claude-agent-sdk": "^0.3.234",
+    "@cursor/sdk": "^1.0.28",
+    "@openai/codex-sdk": "^0.147.0",
     commander: "^13.1.0"
   },
   devDependencies: {
-    "@hasna/contracts": "0.14.0",
+    "@hasna/contracts": "0.14.1",
     "@types/bun": "latest",
     "@types/pg": "^8.15.6",
     pg: "^8.16.3",
@@ -91,6 +537,1456 @@ var package_default = {
   }
 };
 
+// src/daemon.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/expr.ts
+class ExprSyntaxError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ExprSyntaxError";
+  }
+}
+
+class ExprEvalError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ExprEvalError";
+  }
+}
+var COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
+function tokenize(input) {
+  const tokens = [];
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (ch === " " || ch === "\t" || ch === `
+` || ch === "\r") {
+      i++;
+      continue;
+    }
+    if (ch === "(") {
+      tokens.push({ kind: "lparen", value: "(" });
+      i++;
+      continue;
+    }
+    if (ch === ")") {
+      tokens.push({ kind: "rparen", value: ")" });
+      i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      const quote = ch;
+      let j = i + 1;
+      let out = "";
+      let closed = false;
+      while (j < input.length) {
+        if (input[j] === quote) {
+          closed = true;
+          break;
+        }
+        out += input[j];
+        j++;
+      }
+      if (!closed)
+        throw new ExprSyntaxError(`unterminated string literal at offset ${i}`);
+      tokens.push({ kind: "string", value: out });
+      i = j + 1;
+      continue;
+    }
+    const two = input.slice(i, i + 2);
+    if (COMPARISON_OPS.has(two)) {
+      tokens.push({ kind: "op", value: two });
+      i += 2;
+      continue;
+    }
+    if (ch === "<" || ch === ">" || ch === "=" || ch === "!") {
+      tokens.push({ kind: "op", value: ch });
+      i++;
+      continue;
+    }
+    if (/[0-9]/.test(ch)) {
+      let j = i;
+      while (j < input.length && /[0-9.]/.test(input[j]))
+        j++;
+      tokens.push({ kind: "number", value: input.slice(i, j) });
+      i = j;
+      continue;
+    }
+    if (/[A-Za-z_]/.test(ch)) {
+      let j = i;
+      while (j < input.length && /[A-Za-z0-9_.]/.test(input[j]))
+        j++;
+      tokens.push({ kind: "ident", value: input.slice(i, j) });
+      i = j;
+      continue;
+    }
+    throw new ExprSyntaxError(`unexpected character ${JSON.stringify(ch)} at offset ${i}`);
+  }
+  return tokens;
+}
+
+class Parser {
+  tokens;
+  pos = 0;
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  peek() {
+    return this.tokens[this.pos];
+  }
+  next() {
+    return this.tokens[this.pos++];
+  }
+  expectOp(value) {
+    const t = this.next();
+    if (!t || t.kind !== "op" || t.value !== value) {
+      throw new ExprSyntaxError(`expected ${JSON.stringify(value)}`);
+    }
+  }
+  parse() {
+    if (this.tokens.length === 0)
+      throw new ExprSyntaxError("empty expression");
+    const node = this.parseOr();
+    if (this.pos < this.tokens.length) {
+      throw new ExprSyntaxError(`unexpected trailing token ${JSON.stringify(this.peek().value)}`);
+    }
+    return node;
+  }
+  parseOr() {
+    let left = this.parseAnd();
+    while (this.peek()?.kind === "ident" && this.peek().value === "or") {
+      this.next();
+      const right = this.parseAnd();
+      left = { kind: "or", left, right };
+    }
+    return left;
+  }
+  parseAnd() {
+    let left = this.parseNot();
+    while (this.peek()?.kind === "ident" && this.peek().value === "and") {
+      this.next();
+      const right = this.parseNot();
+      left = { kind: "and", left, right };
+    }
+    return left;
+  }
+  parseNot() {
+    if (this.peek()?.kind === "ident" && this.peek().value === "not") {
+      this.next();
+      return { kind: "not", operand: this.parseNot() };
+    }
+    return this.parseComparison();
+  }
+  parseComparison() {
+    const left = this.parsePrimary();
+    const t = this.peek();
+    if (t && t.kind === "op" && COMPARISON_OPS.has(t.value)) {
+      this.next();
+      const right = this.parsePrimary();
+      return { kind: "comparison", op: t.value, left, right };
+    }
+    return left;
+  }
+  parsePrimary() {
+    const t = this.next();
+    if (!t)
+      throw new ExprSyntaxError("unexpected end of expression");
+    if (t.kind === "lparen") {
+      const inner = this.parseOr();
+      this.expectCloseParen();
+      return inner;
+    }
+    if (t.kind === "number") {
+      const value = Number(t.value);
+      if (!Number.isFinite(value))
+        throw new ExprSyntaxError(`invalid number ${JSON.stringify(t.value)}`);
+      return { kind: "literal", value };
+    }
+    if (t.kind === "string")
+      return { kind: "literal", value: t.value };
+    if (t.kind === "ident") {
+      if (t.value === "true")
+        return { kind: "literal", value: true };
+      if (t.value === "false")
+        return { kind: "literal", value: false };
+      return { kind: "path", segments: t.value.split(".") };
+    }
+    throw new ExprSyntaxError(`unexpected token ${JSON.stringify(t.value)}`);
+  }
+  expectCloseParen() {
+    const t = this.next();
+    if (!t || t.kind !== "rparen")
+      throw new ExprSyntaxError("expected )");
+  }
+}
+function parseExpr(input) {
+  return new Parser(tokenize(input)).parse();
+}
+function resolvePath(segments, context) {
+  let current = context;
+  for (const segment of segments) {
+    if (current === null || typeof current !== "object")
+      return;
+    const record = current;
+    if (!(segment in record))
+      return;
+    current = record[segment];
+  }
+  if (typeof current === "number" || typeof current === "string" || typeof current === "boolean") {
+    return current;
+  }
+  return;
+}
+function evalNode(node, context) {
+  switch (node.kind) {
+    case "literal":
+      return node.value;
+    case "path":
+      return resolvePath(node.segments, context);
+    case "comparison": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (left === undefined || right === undefined) {
+        if (node.op === "==")
+          return left === undefined && right === undefined;
+        if (node.op === "!=")
+          return left !== right;
+        throw new ExprEvalError("cannot order-compare an unknown path");
+      }
+      if (typeof left !== typeof right) {
+        throw new ExprEvalError(`cannot compare ${JSON.stringify(left)} (${typeof left}) with ${JSON.stringify(right)} (${typeof right})`);
+      }
+      switch (node.op) {
+        case "==":
+          return left === right;
+        case "!=":
+          return left !== right;
+        case "<":
+          return left < right;
+        case "<=":
+          return left <= right;
+        case ">":
+          return left > right;
+        case ">=":
+          return left >= right;
+        default:
+          throw new ExprEvalError(`unknown operator ${node.op}`);
+      }
+    }
+    case "and": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (typeof left !== "boolean" || typeof right !== "boolean") {
+        throw new ExprEvalError("and requires boolean operands");
+      }
+      return left && right;
+    }
+    case "or": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (typeof left !== "boolean" || typeof right !== "boolean") {
+        throw new ExprEvalError("or requires boolean operands");
+      }
+      return left || right;
+    }
+    case "not": {
+      const operand = evalNode(node.operand, context);
+      if (typeof operand !== "boolean")
+        throw new ExprEvalError("not requires a boolean operand");
+      return !operand;
+    }
+  }
+}
+function evaluateExpr(input, context) {
+  const ast = parseExpr(input);
+  const value = evalNode(ast, context);
+  if (typeof value !== "boolean") {
+    throw new ExprEvalError(`condition must evaluate to a boolean, got ${typeof value}`);
+  }
+  return value;
+}
+
+// src/graph.ts
+var GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
+var LANE_KINDS = ["claude", "codex", "cursor", "grok"];
+var NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+function issue(issues, path, message) {
+  issues.push({ path, message });
+}
+function findNode(graph, id) {
+  return graph.nodes.find((n) => n.id === id);
+}
+function collectEdges(graph) {
+  const edges = [];
+  for (const node of graph.nodes) {
+    switch (node.type) {
+      case "start":
+      case "step":
+        if (node.next)
+          edges.push({ from: node.id, to: node.next });
+        break;
+      case "decision":
+        if (node.then)
+          edges.push({ from: node.id, to: node.then });
+        if (node.else)
+          edges.push({ from: node.id, to: node.else });
+        break;
+      case "while":
+        if (node.next)
+          edges.push({ from: node.id, to: node.next });
+        break;
+      case "end":
+        break;
+    }
+  }
+  return edges;
+}
+function reachableNodes(graph) {
+  const start = graph.nodes.find((n) => n.type === "start");
+  if (!start)
+    return [];
+  const seen = new Set;
+  const stack = [start.id];
+  while (stack.length > 0) {
+    const id = stack.pop();
+    if (seen.has(id))
+      continue;
+    seen.add(id);
+    const node = findNode(graph, id);
+    if (!node)
+      continue;
+    if (node.type === "start" || node.type === "step") {
+      if (node.next)
+        stack.push(node.next);
+    } else if (node.type === "decision") {
+      if (node.then)
+        stack.push(node.then);
+      if (node.else)
+        stack.push(node.else);
+    } else if (node.type === "while") {
+      for (const bodyId of node.body)
+        stack.push(bodyId);
+      if (node.next)
+        stack.push(node.next);
+    }
+  }
+  return [...seen];
+}
+function findCycles(graph) {
+  const edges = collectEdges(graph);
+  const adj = new Map;
+  for (const e of edges) {
+    const list = adj.get(e.from) ?? [];
+    list.push(e.to);
+    adj.set(e.from, list);
+  }
+  const color = new Map;
+  const stack = [];
+  const cycles = [];
+  function visit(id) {
+    color.set(id, "grey");
+    stack.push(id);
+    for (const to of adj.get(id) ?? []) {
+      const c = color.get(to);
+      if (c === "grey") {
+        const idx = stack.indexOf(to);
+        cycles.push([...stack.slice(idx), to]);
+      } else if (c === undefined) {
+        visit(to);
+      }
+    }
+    stack.pop();
+    color.set(id, "black");
+  }
+  for (const node of graph.nodes) {
+    if (color.get(node.id) === undefined)
+      visit(node.id);
+  }
+  return cycles;
+}
+function validateGraph(graph) {
+  const issues = [];
+  if (typeof graph.name !== "string" || graph.name.trim() === "") {
+    issue(issues, "name", "graph requires a non-empty name");
+  }
+  if (typeof graph.version !== "string" || graph.version.trim() === "") {
+    issue(issues, "version", "graph requires a version string");
+  }
+  if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) {
+    issue(issues, "nodes", "graph requires at least one node");
+    return { ok: false, issues };
+  }
+  const starts = graph.nodes.filter((n) => n.type === "start");
+  if (starts.length === 0)
+    issue(issues, "nodes", "graph requires exactly one start node (found none)");
+  if (starts.length > 1)
+    issue(issues, "nodes", "graph requires exactly one start node (found multiple)");
+  const ends = graph.nodes.filter((n) => n.type === "end");
+  if (ends.length === 0)
+    issue(issues, "nodes", "graph requires at least one end node");
+  const seenIds = new Map;
+  for (const node of graph.nodes) {
+    if (typeof node.id !== "string" || !NODE_ID_RE.test(node.id)) {
+      issue(issues, "nodes", `node id ${JSON.stringify(node.id)} must match ${String(NODE_ID_RE)}`);
+      continue;
+    }
+    if (seenIds.has(node.id)) {
+      issue(issues, `nodes.${node.id}`, `duplicate node id ${node.id}`);
+      continue;
+    }
+    seenIds.set(node.id, node);
+    if (!GRAPH_NODE_TYPES.includes(node.type)) {
+      issue(issues, `nodes.${node.id}`, `unknown node type ${JSON.stringify(node.type)}`);
+      continue;
+    }
+    validateNode(graph, node, issues);
+  }
+  for (const node of graph.nodes) {
+    const edges = nodeEdges(node);
+    for (const { kind, target } of edges) {
+      if (!seenIds.has(target)) {
+        issue(issues, `nodes.${node.id}`, `${kind} edge targets nonexistent node ${target}`);
+      }
+    }
+  }
+  if (starts.length === 1) {
+    const reachable = new Set(reachableNodes(graph));
+    for (const node of graph.nodes) {
+      if (!reachable.has(node.id)) {
+        issue(issues, `nodes.${node.id}`, `node ${node.id} is unreachable from start`);
+      }
+    }
+  }
+  const cycles = findCycles(graph);
+  for (const cycle of cycles) {
+    issue(issues, "nodes", `explicit cycle detected: ${cycle.join(" -> ")} (loop only via a while node)`);
+  }
+  return { ok: issues.length === 0, issues };
+}
+function nodeEdges(node) {
+  switch (node.type) {
+    case "start":
+    case "step":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "decision":
+      return [
+        ...node.then ? [{ kind: "then", target: node.then }] : [],
+        ...node.else ? [{ kind: "else", target: node.else }] : []
+      ];
+    case "while":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "end":
+      return [];
+  }
+}
+function validateNode(graph, node, issues) {
+  switch (node.type) {
+    case "start":
+      if (!node.next)
+        issue(issues, `nodes.${node.id}`, "start node requires a next edge");
+      break;
+    case "step": {
+      if (!node.prompt && !node.command) {
+        issue(issues, `nodes.${node.id}`, "step node requires prompt or command");
+      }
+      if (node.lane !== undefined && !LANE_KINDS.includes(node.lane)) {
+        issue(issues, `nodes.${node.id}`, `unknown lane ${JSON.stringify(node.lane)} (expected one of ${LANE_KINDS.join(", ")})`);
+      }
+      if (node.maxRetries !== undefined && (!Number.isInteger(node.maxRetries) || node.maxRetries < 0)) {
+        issue(issues, `nodes.${node.id}`, "maxRetries must be a non-negative integer");
+      }
+      if (node.timeoutMs !== undefined && (!Number.isInteger(node.timeoutMs) || node.timeoutMs < 1)) {
+        issue(issues, `nodes.${node.id}`, "timeoutMs must be a positive integer");
+      }
+      break;
+    }
+    case "decision": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "decision node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (!node.then && !node.else) {
+        issue(issues, `nodes.${node.id}`, "decision node requires then and/or else edge");
+      }
+      break;
+    }
+    case "while": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "while node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (node.maxIterations === undefined) {
+        issue(issues, `nodes.${node.id}`, "while node requires maxIterations (finite loop bound)");
+      } else if (!Number.isInteger(node.maxIterations) || node.maxIterations < 1) {
+        issue(issues, `nodes.${node.id}`, "maxIterations must be a positive integer");
+      }
+      if (!Array.isArray(node.body) || node.body.length === 0) {
+        issue(issues, `nodes.${node.id}`, "while node requires a non-empty body");
+      } else {
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode) {
+            issue(issues, `nodes.${node.id}`, `while body references nonexistent node ${bodyId}`);
+            continue;
+          }
+          if (bodyNode.type === "start" || bodyNode.type === "end" || bodyNode.type === "while") {
+            issue(issues, `nodes.${node.id}`, `while body may only contain step/decision nodes in v1 (found ${bodyNode.type})`);
+          }
+        }
+        const bodySet = new Set(node.body);
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode)
+            continue;
+          for (const { kind, target } of nodeEdges(bodyNode)) {
+            if (!bodySet.has(target)) {
+              issue(issues, `nodes.${node.id}`, `while body node ${bodyId} ${kind}-edge leaves the body (target ${target})`);
+            }
+          }
+        }
+      }
+      break;
+    }
+    case "end":
+      break;
+  }
+}
+
+// src/secrets.ts
+class SecretsGateError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SecretsGateError";
+  }
+}
+var p = (...parts) => parts.join("");
+var VALUE_PATTERNS = [
+  { detector: "anthropic_api_key", re: new RegExp(p("sk-", "ant-") + "[A-Za-z0-9_-]{10,}") },
+  { detector: "openai_api_key", re: new RegExp(p("sk-", "proj-") + "[A-Za-z0-9_-]{10,}") },
+  { detector: "npm_token", re: /npm_[A-Za-z0-9]{20,}/ },
+  { detector: "github_token", re: /gh[pousr]_[A-Za-z0-9]{20,}/ },
+  { detector: "aws_access_key", re: /AKIA[0-9A-Z]{16}/ },
+  { detector: "google_api_key", re: /AIza[0-9A-Za-z_-]{20,}/ },
+  { detector: "xai_api_key", re: new RegExp(p("xai-") + "[A-Za-z0-9]{20,}") },
+  { detector: "codex_token", re: new RegExp(p("ctx7", "sk-") + "[A-Za-z0-9]{10,}") },
+  { detector: "private_key_block", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/ },
+  { detector: "bearer_token", re: /Bearer [A-Za-z0-9._~+/=-]{20,}/ }
+];
+var CREDENTIAL_KEY_RE = /^(token|api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|secret[_-]?key|refresh[_-]?token|session[_-]?token|bot[_-]?token)$/i;
+function scanString(value, path, findings) {
+  for (const { detector, re } of VALUE_PATTERNS) {
+    if (re.test(value)) {
+      findings.push({ path, detector });
+      return;
+    }
+  }
+}
+function isTrivial(value) {
+  const v = value.trim();
+  if (v.length === 0)
+    return true;
+  const upper = v.toUpperCase();
+  if (upper.startsWith("REPLACE") || upper.startsWith("CHANGE") || upper.startsWith("YOUR_") || upper.startsWith("EXAMPLE") || upper.startsWith("PLACEHOLDER"))
+    return true;
+  if (v.length < 8)
+    return true;
+  return false;
+}
+function scanForSecrets(value, path = "$") {
+  const findings = [];
+  if (value === null || value === undefined)
+    return findings;
+  if (typeof value === "string") {
+    scanString(value, path, findings);
+    return findings;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => {
+      findings.push(...scanForSecrets(item, `${path}[${index}]`));
+    });
+    return findings;
+  }
+  if (typeof value === "object") {
+    const record = value;
+    for (const [key, child] of Object.entries(record)) {
+      if (CREDENTIAL_KEY_RE.test(key) && typeof child === "string" && !isTrivial(child)) {
+        findings.push({ path: `${path}.${key}`, detector: "credential_key_field" });
+      } else {
+        findings.push(...scanForSecrets(child, `${path}.${key}`));
+      }
+    }
+  }
+  return findings;
+}
+function assertNoSecrets(value, what) {
+  const findings = scanForSecrets(value);
+  if (findings.length === 0)
+    return;
+  const detail = findings.map((f) => `${f.path} (${f.detector})`).join(", ");
+  throw new SecretsGateError(`secrets write-gate refused to persist ${what}: credential-shaped value at ${detail}`);
+}
+
+// src/session.ts
+import { createHash } from "crypto";
+var DEFAULT_MAX_ATTEMPTS = 3;
+function repairTornRuns(store, wal, opts = {}) {
+  const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+  const replay = wal.replay();
+  const liveClaims = replay.liveClaims(opts.now);
+  const report = { interrupted: 0, requeued: 0, failed: 0 };
+  const running = store.listRuns({ status: "running", limit: 1000 });
+  for (const run of running) {
+    if (liveClaims.has(run.id))
+      continue;
+    report.interrupted++;
+    const nodes = store.listRunNodes(run.id);
+    if (run.attempts < maxAttempts) {
+      store.bumpAttempts(run.id);
+      store.setRunStatus(run.id, "interrupted", {
+        error: `torn run interrupted after claim loss (attempt ${run.attempts + 1}/${maxAttempts})`
+      });
+      for (const node of nodes) {
+        if (node.status === "running") {
+          store.setRunNodeStatus(node.id, "pending", { error: undefined });
+        }
+      }
+      report.requeued++;
+    } else {
+      store.setRunStatus(run.id, "failed", {
+        error: `torn run failed after ${maxAttempts} interrupted attempts`
+      });
+      for (const node of nodes) {
+        if (node.status === "running") {
+          store.setRunNodeStatus(node.id, "failed", { error: "run interrupted beyond retry budget" });
+        }
+      }
+      report.failed++;
+    }
+  }
+  return report;
+}
+function inputHash(payload) {
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+function memoKey(graphName, nodeId, input) {
+  return `${graphName}:${nodeId}:${inputHash(input)}`;
+}
+function tryMemoHit(store, graphName, nodeId, input) {
+  const key = memoKey(graphName, nodeId, input);
+  const memo = store.memoGet(key);
+  if (!memo)
+    return;
+  store.memoHit(key);
+  return memo;
+}
+function recordMemo(store, graphName, nodeId, input, output) {
+  const key = memoKey(graphName, nodeId, input);
+  store.memoPut(key, graphName, nodeId, inputHash(input), JSON.stringify(output));
+}
+function resetRunNodes(store, run) {
+  for (const node of store.listRunNodes(run.id)) {
+    if (node.status === "running") {
+      store.setRunNodeStatus(node.id, "pending", { error: undefined });
+    }
+  }
+}
+function restoreInterruptedRun(store, runId) {
+  const run = store.getRun(runId);
+  if (!run)
+    throw new Error(`no such run ${runId}`);
+  if (run.status !== "interrupted") {
+    throw new Error(`run ${runId} is ${run.status}; top-level resume restores interrupted runs \u2014 use 'runs resume' for cancelled/failed runs`);
+  }
+  const nodes = store.listRunNodes(runId);
+  let nodesRestored = 0;
+  let memoizedNodes = 0;
+  for (const node of nodes) {
+    if (node.status === "completed" && node.outputJson !== null) {
+      memoizedNodes++;
+    } else if (node.status === "running" || node.status === "pending") {
+      store.setRunNodeStatus(node.id, "pending", { error: undefined });
+      nodesRestored++;
+    }
+  }
+  store.setRunStatus(runId, "pending", { error: null });
+  return { runId, status: "pending", nodesRestored, memoizedNodes, attempts: run.attempts };
+}
+function findRunByIdempotencyKey(store, key) {
+  const runs = store.listRuns({ limit: 1000 });
+  for (const run of runs) {
+    try {
+      const context = JSON.parse(run.contextJson);
+      if (context?.__wf?.idempotencyKey === key)
+        return run;
+    } catch {}
+  }
+  return;
+}
+
+// src/daemon.ts
+init_types();
+var DEFAULT_LEASE_TTL_MS = 120000;
+var DEFAULT_MAX_ATTEMPTS2 = 3;
+var DEFAULT_MAX_DISPATCH = 4;
+var DEFAULT_MAX_STEPS = 25;
+var DEFAULT_TIMEOUT_MS = 120000;
+function nowIso() {
+  return new Date().toISOString();
+}
+function stripRunState(context) {
+  const { __wf: _wf, steps: _steps, ...user } = context;
+  return user;
+}
+function runCommand(job) {
+  if (!job.command) {
+    return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "no command" };
+  }
+  const started = Date.now();
+  const timeoutMs = job.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const proc = Bun.spawnSync({
+    cmd: ["/bin/sh", "-c", job.command],
+    cwd: job.cwd,
+    env: { ...process.env, ...job.env ?? {} },
+    stdout: "pipe",
+    stderr: "pipe",
+    timeout: timeoutMs
+  });
+  const durationMs = Date.now() - started;
+  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
+  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
+  const output = stderr ? `${stdout}
+${stderr}`.trim() : stdout.trim();
+  const exitCode = proc.exitCode ?? (proc.signalCode ? 1 : 1);
+  return { ok: exitCode === 0, exitCode, output, durationMs };
+}
+
+class WorkflowsDaemon {
+  store;
+  wal;
+  worker;
+  leaseTtlMs;
+  maxAttempts;
+  maxDispatchPerCycle;
+  maxStepsPerCycle;
+  time;
+  laneRunner;
+  env;
+  leases = new Map;
+  fencingCounter = new Map;
+  graphCache = new Map;
+  isolatedRunId = null;
+  constructor(store, wal, options = {}) {
+    this.store = store;
+    this.wal = wal;
+    this.worker = options.worker ?? "local";
+    this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
+    this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS2;
+    this.maxDispatchPerCycle = options.maxDispatchPerCycle ?? DEFAULT_MAX_DISPATCH;
+    this.maxStepsPerCycle = options.maxStepsPerCycle ?? DEFAULT_MAX_STEPS;
+    this.time = options.time ?? Date.now;
+    this.env = options.env ?? {};
+    this.laneRunner = options.laneRunner ?? defaultLaneRunner;
+    this.isolatedRunId = options.isolatedRunId ?? null;
+    this.replayRegisteredGraphs();
+  }
+  isolateRun(runId) {
+    this.isolatedRunId = runId;
+  }
+  replayRegisteredGraphs() {
+    const entries = this.wal.replay().entries;
+    for (const entry of entries) {
+      const op = entry.op;
+      if (op.op === "graph_registered") {
+        this.graphCache.set(op.name, op.graph);
+      }
+    }
+  }
+  liveLeases() {
+    const now = this.time();
+    for (const [runId, lease] of this.leases) {
+      if (lease.expiresAtMs <= now)
+        this.leases.delete(runId);
+    }
+    return this.leases;
+  }
+  claim(runId) {
+    const now = this.time();
+    const existing = this.leases.get(runId);
+    if (existing && existing.worker !== this.worker && existing.expiresAtMs > now) {
+      return null;
+    }
+    const liveClaims = this.wal.replay().liveClaims(now);
+    const foreign = liveClaims.get(runId);
+    if (foreign && foreign.worker !== this.worker && foreign.expiresAtMs > now) {
+      return null;
+    }
+    const fencing = (this.fencingCounter.get(runId) ?? 0) + 1;
+    this.fencingCounter.set(runId, fencing);
+    const lease = { runId, worker: this.worker, expiresAtMs: now + this.leaseTtlMs, fencing };
+    this.leases.set(runId, lease);
+    this.wal.append({
+      op: "claim_acquired",
+      runId,
+      worker: this.worker,
+      expiresAt: new Date(lease.expiresAtMs).toISOString(),
+      fencing,
+      at: nowIso()
+    });
+    return lease;
+  }
+  heartbeat(runId, fencing) {
+    const lease = this.leases.get(runId);
+    if (!lease || lease.fencing !== fencing)
+      return false;
+    lease.expiresAtMs = this.time() + this.leaseTtlMs;
+    return true;
+  }
+  release(runId, fencing) {
+    const lease = this.leases.get(runId);
+    if (!lease || lease.fencing !== fencing)
+      return false;
+    this.leases.delete(runId);
+    this.wal.append({ op: "claim_released", runId, fencing, at: nowIso() });
+    return true;
+  }
+  async reap() {
+    const report = { expired: 0, interrupted: 0, requeued: 0, failed: 0, dispatched: 0, advanced: 0, completed: 0 };
+    const now = this.time();
+    for (const [runId, lease] of this.leases) {
+      if (lease.expiresAtMs <= now) {
+        this.leases.delete(runId);
+        report.expired++;
+      }
+    }
+    if (this.isolatedRunId === null) {
+      const repair = repairTornRuns(this.store, this.wal, { maxAttempts: this.maxAttempts, now });
+      report.interrupted += repair.interrupted;
+      report.requeued += repair.requeued;
+      report.failed += repair.failed;
+    }
+    const pending = this.store.listRuns({ status: "pending", limit: this.maxDispatchPerCycle }).concat(this.store.listRuns({ status: "interrupted", limit: this.maxDispatchPerCycle })).sort((a, b) => a.createdAt === b.createdAt ? a.id < b.id ? 1 : -1 : a.createdAt < b.createdAt ? 1 : -1).slice(0, this.maxDispatchPerCycle);
+    for (const run of pending) {
+      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
+        continue;
+      const lease = this.claim(run.id);
+      if (!lease)
+        continue;
+      this.store.setRunStatus(run.id, "running");
+      this.wal.append({ op: "run_started", runId: run.id, at: nowIso() });
+      report.dispatched++;
+    }
+    const running = this.store.listRuns({ status: "running", limit: this.maxStepsPerCycle });
+    let steps = 0;
+    for (const run of running) {
+      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
+        continue;
+      if (steps >= this.maxStepsPerCycle)
+        break;
+      const outcome = await this.advanceRun(run.id);
+      steps++;
+      if (outcome.kind === "completed")
+        report.completed++;
+      if (outcome.kind === "failed")
+        report.failed++;
+      if (outcome.kind === "advanced")
+        report.advanced++;
+    }
+    return report;
+  }
+  startRun(graph, context) {
+    const validation = validateGraph(graph);
+    if (!validation.ok) {
+      throw new Error(`graph validation failed: ${validation.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+    }
+    assertNoSecrets(context, "run context");
+    assertNoSecrets(graph, "graph definition");
+    const existing = this.graphCache.get(graph.name);
+    const serialized = JSON.stringify(graph);
+    if (!existing || JSON.stringify(existing) !== serialized) {
+      this.graphCache.set(graph.name, graph);
+      this.wal.append({ op: "graph_registered", name: graph.name, version: graph.version, graph, at: nowIso() });
+    } else {
+      this.graphCache.set(graph.name, existing);
+    }
+    return this.store.createRun({ graphName: graph.name, graphVersion: graph.version, context: context ?? {} });
+  }
+  async advanceRun(runId) {
+    const run = this.store.getRun(runId);
+    if (!run || run.status !== "running")
+      return { kind: "noop" };
+    const lease = this.leases.get(runId);
+    if (!lease || lease.expiresAtMs <= this.time())
+      return { kind: "blocked" };
+    const graph = this.loadGraph(run.graphName);
+    if (!graph) {
+      this.failRun(run, `graph ${run.graphName} not found in daemon graph cache`);
+      return { kind: "failed", error: "graph not found" };
+    }
+    const context = JSON.parse(run.contextJson);
+    const rawWf = context.__wf ?? {};
+    const wf = {
+      ...rawWf,
+      cursor: typeof rawWf.cursor === "string" ? rawWf.cursor : undefined,
+      loops: rawWf.loops ?? {},
+      completedLoops: rawWf.completedLoops ?? {}
+    };
+    try {
+      const cursor = wf.cursor;
+      const node = cursor === undefined ? graph.nodes.find((n) => n.type === "start") : findNode(graph, cursor);
+      if (!node) {
+        this.failRun(run, `cursor ${cursor ?? "<start>"} resolves to no node`);
+        return { kind: "failed", error: "no node at cursor" };
+      }
+      switch (node.type) {
+        case "start": {
+          wf.cursor = node.next;
+          this.persistContext(run, context, wf);
+          return { kind: "advanced", nodeId: node.id };
+        }
+        case "step": {
+          return await this.executeStep(run, graph, context, wf, node);
+        }
+        case "decision": {
+          const value = evaluateExpr(node.condition, this.conditionScope(context));
+          const next = value ? node.then : node.else;
+          if (!next) {
+            this.failRun(run, `decision ${node.id} evaluated ${value} but no ${value ? "then" : "else"} edge`);
+            return { kind: "failed", error: "missing decision edge" };
+          }
+          wf.cursor = next;
+          this.persistContext(run, context, wf);
+          return { kind: "advanced", nodeId: node.id };
+        }
+        case "while": {
+          return this.executeWhile(run, graph, context, wf, node);
+        }
+        case "end": {
+          this.completeRun(run, context);
+          return { kind: "completed" };
+        }
+      }
+    } catch (err) {
+      if (err instanceof ExprEvalError || err instanceof ExprSyntaxError) {
+        this.failRun(run, `condition error at ${wf.cursor ?? "<start>"}: ${err.message}`);
+        return { kind: "failed", error: err.message };
+      }
+      throw err;
+    }
+  }
+  loadGraph(name) {
+    return this.graphCache.get(name);
+  }
+  conditionScope(context) {
+    return { ...context, steps: context.steps ?? {} };
+  }
+  persistContext(run, context, wf) {
+    context.__wf = wf;
+    this.store.setRunContext(run.id, context);
+  }
+  async executeStep(run, graph, context, wf, node) {
+    const nodeId = node.id;
+    const existing = this.store.listRunNodes(run.id).find((n) => n.nodeId === nodeId);
+    const nodeRow = existing ?? this.store.createRunNode({ runId: run.id, nodeId, lane: node.lane ?? "claude" });
+    if (node.memo) {
+      const memoInput = { command: node.command, prompt: node.prompt, context: stripRunState(context) };
+      const hit = tryMemoHit(this.store, run.graphName, nodeId, memoInput);
+      if (hit) {
+        const cached = JSON.parse(hit.outputJson);
+        this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: Number(cached.exitCode ?? 0), output: { ...cached, memoHit: true } });
+        this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
+        this.recordStepResult(context, nodeId, { ...cached, memoHit: true });
+        return this.afterNode(run, context, wf, node.next);
+      }
+    }
+    if (nodeRow.status !== "running") {
+      this.store.setRunNodeStatus(nodeRow.id, "running");
+      this.wal.append({ op: "node_started", runId: run.id, nodeId, at: nowIso() });
+    }
+    const job = {
+      lane: node.lane ?? "claude",
+      prompt: node.prompt,
+      command: node.command,
+      timeoutMs: node.timeoutMs,
+      env: this.env
+    };
+    let result;
+    try {
+      result = await this.laneRunner(job);
+    } catch (err) {
+      result = { ok: false, exitCode: 1, output: "", durationMs: 0, error: String(err instanceof Error ? err.message : err) };
+    }
+    const output = { ok: result.ok, exitCode: result.exitCode, output: result.output, durationMs: result.durationMs };
+    if (!result.ok) {
+      const retriesLeft = (node.maxRetries ?? 0) + 1 - nodeRow.attempts;
+      if (retriesLeft > 0) {
+        this.store.bumpAttemptsNode(nodeRow.id);
+        this.store.setRunNodeStatus(nodeRow.id, "pending", { error: result.error ?? `exit ${result.exitCode}` });
+        return { kind: "advanced", nodeId };
+      }
+      const error = result.error ?? `step ${nodeId} failed with exit ${result.exitCode}`;
+      this.store.setRunNodeStatus(nodeRow.id, "failed", { exitCode: result.exitCode, error });
+      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
+      this.failRun(run, error);
+      return { kind: "failed", error };
+    }
+    try {
+      assertNoSecrets(output, `node ${nodeId} output`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.store.setRunNodeStatus(nodeRow.id, "failed", { error: message });
+      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
+      this.failRun(run, message);
+      return { kind: "failed", error: message };
+    }
+    this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: result.exitCode, output });
+    this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
+    if (node.memo) {
+      recordMemo(this.store, run.graphName, nodeId, { command: node.command, prompt: node.prompt, context: stripRunState(context) }, output);
+      this.wal.append({ op: "memo_set", key: `${run.graphName}:${nodeId}:${createHash2("sha256").update(JSON.stringify({ command: node.command, prompt: node.prompt, context: stripRunState(context) })).digest("hex")}`, at: nowIso() });
+    }
+    this.recordStepResult(context, nodeId, output);
+    return this.afterNode(run, context, wf, node.next);
+  }
+  afterNode(run, context, wf, next) {
+    if (next) {
+      wf.cursor = next;
+      this.persistContext(run, context, wf);
+      return { kind: "advanced", nodeId: wf.cursor };
+    }
+    const cursor = wf.cursor;
+    const graph = this.loadGraph(run.graphName);
+    const whileNode = graph.nodes.find((n) => n.type === "while" && n.body.includes(cursor ?? ""));
+    if (whileNode) {
+      const index = whileNode.body.indexOf(cursor ?? "");
+      if (index >= 0 && index < whileNode.body.length - 1) {
+        wf.cursor = whileNode.body[index + 1];
+        this.persistContext(run, context, wf);
+        return { kind: "advanced", nodeId: wf.cursor };
+      }
+      wf.loops[whileNode.id] = (wf.loops[whileNode.id] ?? 0) + 1;
+      wf.cursor = whileNode.id;
+      this.persistContext(run, context, wf);
+      return { kind: "advanced", nodeId: whileNode.id };
+    }
+    this.completeRun(run, context);
+    return { kind: "completed" };
+  }
+  executeWhile(run, graph, context, wf, node) {
+    const iteration = wf.loops[node.id] ?? 0;
+    if (iteration >= node.maxIterations) {
+      const error = `while node ${node.id} exceeded maxIterations (${node.maxIterations})`;
+      this.failRun(run, error);
+      return { kind: "failed", error };
+    }
+    const scope = { ...this.conditionScope(context), i: iteration };
+    const keepGoing = evaluateExpr(node.condition, scope);
+    if (!keepGoing) {
+      wf.completedLoops[node.id] = iteration;
+      delete wf.loops[node.id];
+      wf.cursor = node.next;
+      this.persistContext(run, context, wf);
+      return { kind: "advanced", nodeId: node.id };
+    }
+    wf.cursor = node.body[0];
+    this.persistContext(run, context, wf);
+    return { kind: "advanced", nodeId: node.id };
+  }
+  recordStepResult(context, nodeId, output) {
+    const steps = context.steps ?? {};
+    steps[nodeId] = output;
+    context.steps = steps;
+  }
+  completeRun(run, context) {
+    const result = {
+      steps: context.steps ?? {},
+      iterations: context.__wf?.completedLoops ?? {}
+    };
+    try {
+      assertNoSecrets(result, "run result");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.failRun(run, message);
+      return;
+    }
+    this.store.setRunStatus(run.id, "completed", { result, finishedAt: nowIso(), error: null });
+    this.wal.append({ op: "run_finished", runId: run.id, status: "completed", at: nowIso() });
+    const lease = this.leases.get(run.id);
+    if (lease)
+      this.release(run.id, lease.fencing);
+  }
+  failRun(run, error) {
+    this.store.setRunStatus(run.id, "failed", { error, finishedAt: nowIso() });
+    this.wal.append({ op: "run_finished", runId: run.id, status: "failed", at: nowIso() });
+    const lease = this.leases.get(run.id);
+    if (lease)
+      this.release(run.id, lease.fencing);
+  }
+}
+var defaultLaneRunner = async (job) => {
+  if (job.command)
+    return runCommand(job);
+  const { runLaneJob: runLaneJob2 } = await Promise.resolve().then(() => (init_lanes(), exports_lanes));
+  return runLaneJob2(job);
+};
+async function runGraphToCompletion(store, wal, graph, context, options = {}) {
+  const daemon = new WorkflowsDaemon(store, wal, {
+    worker: "local",
+    laneRunner: options.laneRunner,
+    time: options.time,
+    env: options.env,
+    isolatedRunId: options.isolatedRunId
+  });
+  const run = daemon.startRun(graph, context);
+  daemon.isolateRun(run.id);
+  const maxCycles = options.maxCycles ?? 500;
+  for (let cycle = 0;cycle < maxCycles; cycle++) {
+    const report = await daemon.reap();
+    const current = store.getRun(run.id);
+    if (current.status !== "running")
+      return current;
+    if (report.advanced === 0 && report.dispatched === 0) {
+      return store.getRun(run.id);
+    }
+  }
+  return store.getRun(run.id);
+}
+
+// src/store.ts
+import { Database } from "bun:sqlite";
+import { mkdirSync } from "fs";
+import { join } from "path";
+import { randomUUID } from "crypto";
+function nowIso2() {
+  return new Date().toISOString();
+}
+function openStore(dataDir) {
+  mkdirSync(dataDir, { recursive: true });
+  const db = new Database(join(dataDir, "workflows.db"));
+  db.exec("PRAGMA journal_mode = WAL");
+  db.exec("PRAGMA foreign_keys = ON");
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS runs (
+      id            TEXT PRIMARY KEY,
+      graph_name    TEXT NOT NULL,
+      graph_version TEXT NOT NULL,
+      status        TEXT NOT NULL,
+      attempts      INTEGER NOT NULL DEFAULT 0,
+      context_json  TEXT NOT NULL,
+      result_json   TEXT,
+      error         TEXT,
+      started_at    TEXT,
+      finished_at   TEXT,
+      created_at    TEXT NOT NULL,
+      updated_at    TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS run_nodes (
+      id          TEXT PRIMARY KEY,
+      run_id      TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
+      node_id     TEXT NOT NULL,
+      status      TEXT NOT NULL,
+      attempts    INTEGER NOT NULL DEFAULT 0,
+      lane        TEXT,
+      exit_code   INTEGER,
+      output_json TEXT,
+      error       TEXT,
+      started_at  TEXT,
+      finished_at TEXT
+    );
+    CREATE TABLE IF NOT EXISTS memos (
+      key         TEXT PRIMARY KEY,
+      graph_name  TEXT NOT NULL,
+      node_id     TEXT NOT NULL,
+      input_hash  TEXT NOT NULL,
+      output_json TEXT NOT NULL,
+      hit_count   INTEGER NOT NULL DEFAULT 0,
+      created_at  TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
+    CREATE INDEX IF NOT EXISTS idx_runs_created ON runs(created_at);
+    CREATE INDEX IF NOT EXISTS idx_run_nodes_run ON run_nodes(run_id);
+  `);
+  const rowToRun = (r) => ({
+    id: String(r.id),
+    graphName: String(r.graph_name),
+    graphVersion: String(r.graph_version),
+    status: r.status,
+    attempts: Number(r.attempts),
+    contextJson: String(r.context_json),
+    resultJson: r.result_json === null ? null : String(r.result_json),
+    error: r.error === null ? null : String(r.error),
+    startedAt: r.started_at === null ? null : String(r.started_at),
+    finishedAt: r.finished_at === null ? null : String(r.finished_at),
+    createdAt: String(r.created_at),
+    updatedAt: String(r.updated_at)
+  });
+  const rowToNode = (r) => ({
+    id: String(r.id),
+    runId: String(r.run_id),
+    nodeId: String(r.node_id),
+    status: r.status,
+    attempts: Number(r.attempts),
+    lane: r.lane === null ? null : String(r.lane),
+    exitCode: r.exit_code === null ? null : Number(r.exit_code),
+    outputJson: r.output_json === null ? null : String(r.output_json),
+    error: r.error === null ? null : String(r.error),
+    startedAt: r.started_at === null ? null : String(r.started_at),
+    finishedAt: r.finished_at === null ? null : String(r.finished_at)
+  });
+  const rowToMemo = (r) => ({
+    key: String(r.key),
+    graphName: String(r.graph_name),
+    nodeId: String(r.node_id),
+    inputHash: String(r.input_hash),
+    outputJson: String(r.output_json),
+    hitCount: Number(r.hit_count),
+    createdAt: String(r.created_at)
+  });
+  return {
+    close() {
+      db.close();
+    },
+    listTables() {
+      const rows = db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'").all();
+      return rows.map((r) => r.name);
+    },
+    createRun(input) {
+      const id = randomUUID();
+      const now = nowIso2();
+      db.query(`INSERT INTO runs (id, graph_name, graph_version, status, attempts, context_json, created_at, updated_at)
+         VALUES (?, ?, ?, 'pending', 0, ?, ?, ?)`).run(id, input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), now, now);
+      return this.getRun(id);
+    },
+    getRun(id) {
+      const row = db.query(`SELECT * FROM runs WHERE id = ?`).get(id);
+      return row ? rowToRun(row) : undefined;
+    },
+    listRuns(opts = {}) {
+      const limit = Math.min(opts.limit ?? 100, 1000);
+      if (opts.status) {
+        const rows2 = db.query(`SELECT * FROM runs WHERE status = ? ORDER BY created_at DESC, id DESC LIMIT ?`).all(opts.status, limit);
+        return rows2.map((r) => rowToRun(r));
+      }
+      const rows = db.query(`SELECT * FROM runs ORDER BY created_at DESC, id DESC LIMIT ?`).all(limit);
+      return rows.map((r) => rowToRun(r));
+    },
+    setRunStatus(id, status, patch = {}) {
+      const now = nowIso2();
+      const existing = this.getRun(id);
+      const resultJson = patch.result !== undefined ? JSON.stringify(patch.result) : existing?.resultJson ?? null;
+      const error = patch.error !== undefined ? patch.error : existing?.error ?? null;
+      const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing?.startedAt === null ? now : existing?.startedAt ?? null;
+      const terminal = status === "completed" || status === "failed" || status === "cancelled" || status === "interrupted";
+      const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing?.finishedAt === null ? now : existing?.finishedAt ?? null;
+      db.query(`UPDATE runs SET status = ?, result_json = ?, error = ?, started_at = ?, finished_at = ?, updated_at = ? WHERE id = ?`).run(status, resultJson, error, startedAt, finishedAt, now, id);
+    },
+    bumpAttempts(id) {
+      db.query(`UPDATE runs SET attempts = attempts + 1, updated_at = ? WHERE id = ?`).run(nowIso2(), id);
+    },
+    setRunContext(id, context) {
+      db.query(`UPDATE runs SET context_json = ?, updated_at = ? WHERE id = ?`).run(JSON.stringify(context), nowIso2(), id);
+    },
+    createRunNode(input) {
+      const id = randomUUID();
+      db.query(`INSERT INTO run_nodes (id, run_id, node_id, status, attempts, lane)
+         VALUES (?, ?, ?, 'pending', 0, ?)`).run(id, input.runId, input.nodeId, input.lane ?? null);
+      return this.getRunNode(id);
+    },
+    getRunNode(id) {
+      const row = db.query(`SELECT * FROM run_nodes WHERE id = ?`).get(id);
+      return row ? rowToNode(row) : undefined;
+    },
+    listRunNodes(runId) {
+      const rows = db.query(`SELECT * FROM run_nodes WHERE run_id = ? ORDER BY rowid ASC`).all(runId);
+      return rows.map((r) => rowToNode(r));
+    },
+    setRunNodeStatus(id, status, patch = {}) {
+      const now = nowIso2();
+      const existing = this.getRunNode(id);
+      if (!existing)
+        return;
+      const exitCode = patch.exitCode !== undefined ? patch.exitCode : existing.exitCode;
+      const outputJson = patch.output !== undefined ? JSON.stringify(patch.output) : existing.outputJson;
+      const error = patch.error !== undefined ? patch.error : existing.error;
+      const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing.startedAt === null ? now : existing.startedAt;
+      const terminal = status === "completed" || status === "failed" || status === "skipped";
+      const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing.finishedAt === null ? now : existing.finishedAt;
+      db.query(`UPDATE run_nodes SET status = ?, exit_code = ?, output_json = ?, error = ?, started_at = ?, finished_at = ? WHERE id = ?`).run(status, exitCode, outputJson, error, startedAt, finishedAt, id);
+    },
+    bumpAttemptsNode(id) {
+      db.query(`UPDATE run_nodes SET attempts = attempts + 1 WHERE id = ?`).run(id);
+    },
+    memoPut(key, graphName, nodeId, inputHash2, outputJson) {
+      db.query(`INSERT INTO memos (key, graph_name, node_id, input_hash, output_json, hit_count, created_at)
+         VALUES (?, ?, ?, ?, ?, 0, ?)
+         ON CONFLICT(key) DO UPDATE SET output_json = excluded.output_json`).run(key, graphName, nodeId, inputHash2, outputJson, nowIso2());
+    },
+    memoGet(key) {
+      const row = db.query(`SELECT * FROM memos WHERE key = ?`).get(key);
+      return row ? rowToMemo(row) : undefined;
+    },
+    memoHit(key) {
+      db.query(`UPDATE memos SET hit_count = hit_count + 1 WHERE key = ?`).run(key);
+    },
+    memoList() {
+      const rows = db.query(`SELECT * FROM memos ORDER BY created_at DESC LIMIT 1000`).all();
+      return rows.map((r) => rowToMemo(r));
+    },
+    memoClear() {
+      db.exec(`DELETE FROM memos`);
+    }
+  };
+}
+
+// src/wal.ts
+import { createHash as createHash3 } from "crypto";
+import { appendFileSync, existsSync, mkdirSync as mkdirSync2, readFileSync, renameSync, truncateSync, writeFileSync } from "fs";
+import { join as join2 } from "path";
+var WAL_FILE_NAME = "session.wal";
+var SESSIONS_DIR_NAME = "sessions";
+var MAX_WAL_BYTES = 256 * 1024 * 1024;
+function checksumOf(op) {
+  if (op === undefined || op === null)
+    return "";
+  return createHash3("sha256").update(JSON.stringify(op)).digest("hex");
+}
+
+class SessionWAL {
+  filePath;
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  static open(dataDir) {
+    mkdirSync2(join2(dataDir, SESSIONS_DIR_NAME), { recursive: true });
+    const canonical = join2(dataDir, SESSIONS_DIR_NAME, WAL_FILE_NAME);
+    const legacy = join2(dataDir, WAL_FILE_NAME);
+    if (existsSync(legacy) && !existsSync(canonical)) {
+      try {
+        renameSync(legacy, canonical);
+      } catch {
+        return new SessionWAL(legacy);
+      }
+    }
+    return new SessionWAL(canonical);
+  }
+  static openAt(filePath) {
+    return new SessionWAL(filePath);
+  }
+  append(op) {
+    const at = op.at ?? new Date().toISOString();
+    const full = { ...op, at };
+    const nextSeq = this.nextSeq();
+    const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
+    appendFileSync(this.filePath, JSON.stringify(entry) + `
+`, "utf8");
+    return entry;
+  }
+  nextSeq() {
+    const replay = this.replay();
+    return replay.entries.length + 1;
+  }
+  replay() {
+    const entries = [];
+    let torn = false;
+    let repaired = false;
+    let content;
+    try {
+      content = readFileSync(this.filePath, "utf8");
+    } catch {
+      return { entries, torn, repaired, liveClaims: () => new Map };
+    }
+    if (content.length > MAX_WAL_BYTES) {
+      throw new Error(`session WAL exceeds ${MAX_WAL_BYTES} bytes; refusing to replay a truncated journal`);
+    }
+    if (content === "") {
+      return { entries, torn, repaired, liveClaims: () => new Map };
+    }
+    const lines = content.split(`
+`);
+    let badOffset = null;
+    let expectedSeq = 1;
+    for (let i = 0;i < lines.length; i++) {
+      const line = lines[i];
+      if (line === "")
+        continue;
+      if (badOffset !== null)
+        break;
+      const lineOffset = cumulativeOffset(lines, i);
+      let entry;
+      try {
+        entry = JSON.parse(line);
+      } catch {
+        badOffset = lineOffset;
+        break;
+      }
+      if (typeof entry?.seq !== "number" || entry.seq !== expectedSeq || entry.checksum !== checksumOf(entry.op)) {
+        badOffset = lineOffset;
+        break;
+      }
+      entries.push(entry);
+      expectedSeq++;
+    }
+    if (badOffset !== null) {
+      torn = true;
+      try {
+        truncateSync(this.filePath, badOffset);
+        repaired = true;
+      } catch {}
+    }
+    return {
+      entries,
+      torn,
+      repaired,
+      liveClaims: (nowMs) => reconstructLiveClaims(entries, nowMs)
+    };
+  }
+  close() {}
+}
+function cumulativeOffset(lines, index) {
+  let offset = 0;
+  for (let i = 0;i < index; i++) {
+    offset += Buffer.byteLength(lines[i]) + 1;
+  }
+  return offset;
+}
+function reconstructLiveClaims(entries, nowMs = Date.now()) {
+  const claims = new Map;
+  for (const entry of entries) {
+    const op = entry.op;
+    if (op.op === "claim_acquired") {
+      claims.set(op.runId, { worker: op.worker, fencing: op.fencing, expiresAtMs: Date.parse(op.expiresAt) });
+    } else if (op.op === "claim_released") {
+      const existing = claims.get(op.runId);
+      if (existing && existing.fencing === op.fencing) {
+        claims.delete(op.runId);
+      }
+    }
+  }
+  for (const [runId, claim] of claims) {
+    if (claim.expiresAtMs <= nowMs)
+      claims.delete(runId);
+  }
+  return claims;
+}
+
 // src/service.ts
 var DEFAULT_PORT = 8790;
 var DEFAULT_HOST = "127.0.0.1";
@@ -117,7 +2013,7 @@ function resolveWorkflowsConfig(overrides = {}) {
   return {
     port: overrides.port ?? envInt(["HASNA_WORKFLOWS_PORT", "WORKFLOWS_PORT"], DEFAULT_PORT),
     host: overrides.host ?? envString(["HASNA_WORKFLOWS_HOST", "WORKFLOWS_HOST"]) ?? DEFAULT_HOST,
-    dataDir: overrides.dataDir ?? envString(["HASNA_WORKFLOWS_DATA_DIR", "WORKFLOWS_DATA_DIR"]) ?? join(home, ".hasna", "workflows"),
+    dataDir: overrides.dataDir ?? envString(["HASNA_WORKFLOWS_DATA_DIR", "WORKFLOWS_DATA_DIR"]) ?? join3(home, ".hasna", "workflows"),
     apiUrl: overrides.apiUrl ?? envString(["WORKFLOWS_API_URL"]),
     apiKey: overrides.apiKey ?? envString(["WORKFLOWS_API_KEY"])
   };
@@ -149,11 +2045,263 @@ class WorkflowsService {
       checks: { version: "ok" }
     };
   }
+  async triggerRun(graph, context = {}, opts = {}) {
+    const store = openStore(this.config.dataDir);
+    const wal = SessionWAL.open(this.config.dataDir);
+    try {
+      if (opts.idempotencyKey) {
+        const existing = findRunByIdempotencyKey(store, opts.idempotencyKey);
+        if (existing) {
+          return {
+            runId: existing.id,
+            status: existing.status,
+            error: existing.error ?? null,
+            result: existing.resultJson ? JSON.parse(existing.resultJson) : null,
+            reused: true
+          };
+        }
+      }
+      const contextWithKey = opts.idempotencyKey ? {
+        ...context,
+        __wf: {
+          cursor: undefined,
+          loops: {},
+          completedLoops: {},
+          ...context?.__wf ?? {},
+          idempotencyKey: opts.idempotencyKey
+        }
+      } : context;
+      const maxCycles = Math.min(Math.max(opts.maxCycles ?? 500, 1), 2000);
+      const final = await runGraphToCompletion(store, wal, graph, contextWithKey, { maxCycles });
+      return {
+        runId: final.id,
+        status: final.status,
+        error: final.error ?? null,
+        result: final.resultJson ? JSON.parse(final.resultJson) : null,
+        reused: false
+      };
+    } finally {
+      store.close();
+    }
+  }
 }
 function createWorkflowsService(config = {}) {
   return new WorkflowsService(config);
 }
 
+// src/render.ts
+function nodeLabel(node) {
+  switch (node.type) {
+    case "start":
+      return "start";
+    case "end":
+      return "end";
+    case "step": {
+      const work = node.prompt ? `prompt=${JSON.stringify(node.prompt.slice(0, 40))}` : `command=${JSON.stringify((node.command ?? "").slice(0, 60))}`;
+      return `step ${work}${node.lane ? ` lane=${node.lane}` : ""}`;
+    }
+    case "decision":
+      return `decision if ${node.condition}`;
+    case "while":
+      return `while ${node.condition} maxIterations=${node.maxIterations} body=[${node.body.join(", ")}]`;
+  }
+}
+function renderGraphText(graph) {
+  const lines = [];
+  lines.push(`graph ${graph.name}@${graph.version} \u2014 ${graph.nodes.length} node(s)`);
+  for (const node of graph.nodes) {
+    switch (node.type) {
+      case "start":
+      case "step":
+        lines.push(`  ${node.id} [${nodeLabel(node)}]${node.next ? ` -> ${node.next}` : ""}`);
+        break;
+      case "decision":
+        lines.push(`  ${node.id} [${nodeLabel(node)}]${node.then ? ` then-> ${node.then}` : ""}${node.else ? ` else-> ${node.else}` : ""}`);
+        break;
+      case "while":
+        lines.push(`  ${node.id} [${nodeLabel(node)}]${node.next ? ` -> ${node.next}` : ""}`);
+        break;
+      case "end":
+        lines.push(`  ${node.id} [end]`);
+        break;
+    }
+  }
+  return lines.join(`
+`);
+}
+function renderGraphDot(graph) {
+  const lines = [];
+  lines.push(`digraph "${graph.name}" {`);
+  lines.push(`  graph [label="${graph.name}@${graph.version}"];`);
+  for (const node of graph.nodes) {
+    const shape = node.type === "decision" ? "diamond" : node.type === "while" ? "doubleoctagon" : node.type === "end" ? "doublecircle" : "box";
+    lines.push(`  "${node.id}" [shape=${shape}, label="${node.id}"];`);
+  }
+  for (const edge of collectEdges(graph)) {
+    lines.push(`  "${edge.from}" -> "${edge.to}";`);
+  }
+  for (const node of graph.nodes) {
+    if (node.type === "while") {
+      for (const bodyId of node.body) {
+        lines.push(`  "${node.id}" -> "${bodyId}" [style=dashed, label="body"];`);
+      }
+    }
+  }
+  lines.push("}");
+  return lines.join(`
+`);
+}
+function renderGraphJson(graph) {
+  const nodes = graph.nodes.map((node) => ({
+    id: node.id,
+    type: node.type,
+    ...node.type === "step" ? { lane: node.lane ?? "claude", hasPrompt: node.prompt !== undefined, hasCommand: node.command !== undefined } : {},
+    ...node.type === "decision" ? { condition: node.condition } : {},
+    ...node.type === "while" ? { condition: node.condition, maxIterations: node.maxIterations, body: node.body } : {}
+  }));
+  return {
+    name: graph.name,
+    version: graph.version,
+    nodes,
+    edges: collectEdges(graph),
+    whileBodies: graph.nodes.filter((n) => n.type === "while").map((n) => ({ id: n.id, body: n.body }))
+  };
+}
+
+// src/cli/index.ts
+init_lanes();
+init_types();
+
+// src/handlers.ts
+import { createHash as createHash4, timingSafeEqual } from "crypto";
+function jsonResponse(body, status = 200) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" }
+  });
+}
+function openApiDoc(service) {
+  return {
+    openapi: "3.0.3",
+    info: { title: "workflows", version: service.version },
+    paths: {
+      "/health": { get: { summary: "Service health", responses: { "200": { description: "ok" } } } },
+      "/ready": { get: { summary: "Service readiness", responses: { "200": { description: "ok" } } } },
+      "/version": { get: { summary: "Service version", responses: { "200": { description: "ok" } } } },
+      "/trigger": {
+        post: {
+          summary: "Authenticated trigger: run a workflow graph to a terminal state",
+          security: [{ bearerAuth: [] }],
+          requestBody: {
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  required: ["graph"],
+                  properties: {
+                    graph: { type: "object", description: "the workflow graph" },
+                    context: { type: "object", description: "optional run context" },
+                    idempotencyKey: { type: "string", description: "re-run with the same key returns the same run" },
+                    maxCycles: { type: "number", description: "bound on reap cycles (default 500, max 2000)" }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            "200": { description: "run summary" },
+            "401": { description: "missing or invalid Bearer token" },
+            "503": { description: "trigger not configured (WORKFLOWS_API_KEY unset)" }
+          }
+        }
+      }
+    },
+    components: {
+      securitySchemes: {
+        bearerAuth: { type: "http", scheme: "bearer" }
+      }
+    }
+  };
+}
+function bearerMatches(authHeader, expected) {
+  if (!authHeader.startsWith("Bearer "))
+    return false;
+  const supplied = authHeader.slice("Bearer ".length);
+  if (supplied.length === 0)
+    return false;
+  const a = createHash4("sha256").update(supplied).digest();
+  const b = createHash4("sha256").update(expected).digest();
+  return timingSafeEqual(a, b);
+}
+async function handleTrigger(service, req) {
+  const expected = service.config.apiKey;
+  if (!expected) {
+    return jsonResponse({ error: "trigger_not_configured", message: "WORKFLOWS_API_KEY is not configured \u2014 set it to enable the authenticated trigger" }, 503);
+  }
+  const auth = req.headers.get("authorization") ?? "";
+  if (!bearerMatches(auth, expected)) {
+    return jsonResponse({ error: "unauthorized", message: "a valid Bearer token is required" }, 401);
+  }
+  let body;
+  try {
+    body = await req.json();
+  } catch {
+    return jsonResponse({ error: "invalid_json", message: "request body must be JSON" }, 400);
+  }
+  const record = body;
+  if (record.graph === null || typeof record.graph !== "object" || Array.isArray(record.graph)) {
+    return jsonResponse({ error: "graph_required", message: "body.graph must be a workflow graph object" }, 400);
+  }
+  const context = record.context ?? {};
+  if (typeof context !== "object" || Array.isArray(context)) {
+    return jsonResponse({ error: "invalid_context", message: "body.context must be an object" }, 400);
+  }
+  const maxCycles = typeof record.maxCycles === "number" ? record.maxCycles : undefined;
+  const idempotencyKey = typeof record.idempotencyKey === "string" ? record.idempotencyKey : undefined;
+  try {
+    const summary = await service.triggerRun(record.graph, context, { maxCycles, idempotencyKey });
+    return jsonResponse(summary);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return jsonResponse({ error: "trigger_failed", message }, 400);
+  }
+}
+function createRequestHandler(service) {
+  return (req) => {
+    const url = new URL(req.url);
+    switch (url.pathname) {
+      case "/health":
+        return jsonResponse(service.health());
+      case "/ready":
+        return jsonResponse(service.ready());
+      case "/version":
+        return jsonResponse({ service: service.name, version: service.version });
+      case "/trigger":
+        return handleTrigger(service, req);
+      case "/openapi.json":
+        return jsonResponse(openApiDoc(service));
+      default:
+        return jsonResponse({ error: "not_found", path: url.pathname }, 404);
+    }
+  };
+}
+
+// src/serve/server.ts
+function createWorkflowsServer(service) {
+  const handler = createRequestHandler(service);
+  const server = Bun.serve({
+    hostname: service.config.host,
+    port: service.config.port,
+    fetch: handler
+  });
+  return {
+    port: server.port ?? 0,
+    stop: () => {
+      server.stop();
+    }
+  };
+}
+
 // src/cli/index.ts
 var program = new Command;
 program.name("workflows").description("Universal graph workflow app \u2014 CLI surface of @hasna/workflows").version(packageVersion());
@@ -180,6 +2328,614 @@ program.command("info").description("Show service configuration (never credentia
     apiUrl: service.config.apiUrl ?? null
   }, null, 2));
 });
+function loadGraph(file) {
+  let raw;
+  try {
+    raw = readFileSync2(file, "utf8");
+  } catch {
+    throw new Error(`cannot read graph file ${file}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`graph file ${file} is not valid JSON`);
+  }
+  return parsed;
+}
+function openLocal() {
+  const config = resolveWorkflowsConfig();
+  mkdirSync3(config.dataDir, { recursive: true });
+  return { store: openStore(config.dataDir), wal: SessionWAL.open(config.dataDir) };
+}
+function parseContext(raw) {
+  if (!raw)
+    return {};
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("context must be a JSON object");
+    }
+    return parsed;
+  } catch (err) {
+    throw new Error(`invalid --context JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function collectInput(value, previous) {
+  return [...previous, value];
+}
+function parseInputs(raw) {
+  const out = {};
+  for (const entry of raw) {
+    const eq = entry.indexOf("=");
+    if (eq <= 0)
+      throw new Error(`--input expects k=v, got ${JSON.stringify(entry)}`);
+    out[entry.slice(0, eq)] = entry.slice(eq + 1);
+  }
+  return out;
+}
+function mergeRunContext(contextRaw, inputs) {
+  return { ...parseContext(contextRaw), ...parseInputs(inputs) };
+}
+function withIdempotencyKey(context, key) {
+  return {
+    ...context,
+    __wf: {
+      cursor: undefined,
+      loops: {},
+      completedLoops: {},
+      ...context.__wf ?? {},
+      idempotencyKey: key
+    }
+  };
+}
+function runSummary(row) {
+  return {
+    runId: row.id,
+    status: row.status,
+    error: row.error ?? null,
+    result: row.resultJson ? JSON.parse(row.resultJson) : null
+  };
+}
+program.command("init").description("Create the store layout (workflows/, sessions/, workflows.db) and scaffold a sample graph").argument("[file]", "sample graph output path (default <dataDir>/workflows/demo.json)").action((file) => {
+  const config = resolveWorkflowsConfig();
+  mkdirSync3(join4(config.dataDir, "workflows"), { recursive: true });
+  mkdirSync3(join4(config.dataDir, SESSIONS_DIR_NAME), { recursive: true });
+  const store = openStore(config.dataDir);
+  store.close();
+  const target = file ?? join4(config.dataDir, "workflows", "demo.json");
+  if (existsSync2(target)) {
+    console.error(`refusing to overwrite existing file ${target}`);
+    process.exit(1);
+  }
+  const sample = {
+    name: "demo",
+    version: "1.0.0",
+    nodes: [
+      { id: "start", type: "start", next: "w" },
+      { id: "w", type: "while", condition: "steps.check.ok != true", body: ["work", "check"], maxIterations: 5, next: "done" },
+      { id: "work", type: "step", lane: "claude", prompt: "fix the failing check", maxRetries: 1 },
+      { id: "check", type: "step", command: "echo check-ok" },
+      { id: "done", type: "end" }
+    ]
+  };
+  writeFileSync2(target, JSON.stringify(sample, null, 2) + `
+`, "utf8");
+  console.log(`wrote ${target}`);
+  console.log(`store layout ready at ${config.dataDir} (workflows/, sessions/, workflows.db)`);
+});
+program.command("validate").description("Validate a workflow graph file").argument("<file>", "graph JSON file").option("-j, --json", "JSON output").action((file, opts) => {
+  const graph = loadGraph(file);
+  const result = validateGraph(graph);
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+  } else if (result.ok) {
+    console.log(`valid: ${graph.name}@${graph.version} (${graph.nodes.length} nodes)`);
+  } else {
+    for (const issue2 of result.issues) {
+      console.error(`${issue2.path}: ${issue2.message}`);
+    }
+    console.error(`invalid: ${result.issues.length} issue(s)`);
+  }
+  if (!result.ok)
+    process.exit(1);
+});
+program.command("graph").description("Render a workflow graph (text, DOT, or JSON)").argument("<file>", "graph JSON file").option("--format <format>", "text | dot | json (default text)", "text").option("-j, --json", "JSON output (shorthand for --format json)").action((file, opts) => {
+  const graph = loadGraph(file);
+  const validation = validateGraph(graph);
+  if (!validation.ok) {
+    console.error(`graph is invalid; rendering the structure as-is (${validation.issues.length} issue(s))`);
+  }
+  const format = opts.json ? "json" : opts.format ?? "text";
+  switch (format) {
+    case "text":
+      console.log(renderGraphText(graph));
+      return;
+    case "dot":
+      console.log(renderGraphDot(graph));
+      return;
+    case "json":
+      console.log(JSON.stringify(renderGraphJson(graph), null, 2));
+      return;
+    default:
+      throw new Error(`unknown --format ${format} (expected text | dot | json)`);
+  }
+});
+program.command("run").description("Run a workflow graph to a terminal state (bounded)").argument("<file>", "graph JSON file").option("--context <json>", "JSON context object for the run").option("--input <k=v>", "run input key=value (repeatable; merged over --context)", collectInput, []).option("--idempotency-key <key>", "re-run with the same key returns the existing run").option("--max-cycles <n>", "bound on reap cycles", "500").option("-j, --json", "JSON output").action(async (file, opts) => {
+  const graph = loadGraph(file);
+  const validation = validateGraph(graph);
+  if (!validation.ok) {
+    throw new Error(`graph validation failed: ${validation.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
+  }
+  const context = mergeRunContext(opts.context, opts.input ?? []);
+  const { store, wal } = openLocal();
+  try {
+    if (opts.idempotencyKey) {
+      const existing = findRunByIdempotencyKey(store, opts.idempotencyKey);
+      if (existing) {
+        const summary2 = { ...runSummary(existing), reused: true };
+        if (opts.json) {
+          console.log(JSON.stringify(summary2, null, 2));
+        } else {
+          console.log(`reused run ${existing.id}: ${existing.status}`);
+        }
+        if (existing.status !== "completed")
+          process.exit(1);
+        return;
+      }
+    }
+    const contextWithKey = opts.idempotencyKey ? withIdempotencyKey(context, opts.idempotencyKey) : context;
+    const maxCycles = Number(opts.maxCycles ?? 500);
+    const final = await runGraphToCompletion(store, wal, graph, contextWithKey, { maxCycles });
+    const summary = runSummary(final);
+    if (opts.json) {
+      console.log(JSON.stringify(summary, null, 2));
+    } else {
+      console.log(`run ${final.id}: ${final.status}${final.error ? ` \u2014 ${final.error}` : ""}`);
+      if (final.resultJson)
+        console.log(final.resultJson);
+    }
+    if (final.status !== "completed")
+      process.exit(1);
+  } finally {
+    store.close();
+  }
+});
+program.command("runs").description("Manage runs").argument("<action>", "list | show | cancel | resume | events").argument("[id]", "run id (show/cancel/resume/events)").option("--status <status>", "filter by status (list)").option("--limit <n>", "max rows (list)", "100").option("-j, --json", "JSON output").action((action, id, opts) => {
+  const { store, wal } = openLocal();
+  try {
+    switch (action) {
+      case "list": {
+        const runs = store.listRuns({ status: opts.status, limit: Number(opts.limit ?? 100) });
+        if (opts.json) {
+          console.log(JSON.stringify(runs, null, 2));
+        } else {
+          for (const run of runs) {
+            console.log(`${run.status.padEnd(11)} ${run.id}  ${run.graphName}@${run.graphVersion}  attempts=${run.attempts}`);
+          }
+        }
+        return;
+      }
+      case "show": {
+        if (!id)
+          throw new Error("runs show requires a run id");
+        const run = store.getRun(id);
+        if (!run)
+          throw new Error(`no such run ${id}`);
+        console.log(JSON.stringify(run, null, 2));
+        return;
+      }
+      case "cancel": {
+        if (!id)
+          throw new Error("runs cancel requires a run id");
+        const run = store.getRun(id);
+        if (!run)
+          throw new Error(`no such run ${id}`);
+        if (run.status !== "pending" && run.status !== "running") {
+          throw new Error(`run ${id} is ${run.status}; only pending/running runs can be cancelled`);
+        }
+        store.setRunStatus(id, "cancelled", { error: "cancelled by operator" });
+        console.log(`cancelled ${id}`);
+        return;
+      }
+      case "resume": {
+        if (!id)
+          throw new Error("runs resume requires a run id");
+        const run = store.getRun(id);
+        if (!run)
+          throw new Error(`no such run ${id}`);
+        if (run.status !== "cancelled" && run.status !== "failed") {
+          throw new Error(`run ${id} is ${run.status}; only cancelled/failed runs can be resumed`);
+        }
+        resetRunNodes(store, run);
+        store.setRunStatus(id, "pending", { error: undefined });
+        console.log(`resumed ${id} to pending`);
+        return;
+      }
+      case "events": {
+        if (!id)
+          throw new Error("runs events requires a run id");
+        const run = store.getRun(id);
+        if (!run)
+          throw new Error(`no such run ${id}`);
+        const events = wal.replay().entries.filter((entry) => {
+          const op = entry.op;
+          return typeof op.runId === "string" && op.runId === id;
+        }).map((entry) => ({ seq: entry.seq, at: entry.at, op: entry.op }));
+        if (opts.json) {
+          console.log(JSON.stringify(events, null, 2));
+        } else {
+          for (const event of events) {
+            console.log(`${event.seq.toString().padStart(4)} ${event.at}  ${JSON.stringify(event.op)}`);
+          }
+          console.log(`${events.length} event(s)`);
+        }
+        return;
+      }
+      default:
+        throw new Error(`unknown runs action ${action} (expected list | show | cancel | resume | events)`);
+    }
+  } finally {
+    store.close();
+  }
+});
+program.command("nodes").description("List or show a run's node executions").argument("[action]", "list | show (default list)").argument("[run]", "run id").argument("[node]", "node id (show)").option("--status <status>", "filter by status (list)").option("-j, --json", "JSON output").action((action, run, node, opts) => {
+  if (action !== "list" && action !== "show") {
+    node = run;
+    run = action;
+    action = "list";
+  }
+  if (!run)
+    throw new Error("nodes requires a run id");
+  const { store } = openLocal();
+  try {
+    if (action === "show") {
+      if (!node)
+        throw new Error("nodes show requires a run id and a node id");
+      const row = store.listRunNodes(run).find((n) => n.nodeId === node);
+      if (!row)
+        throw new Error(`run ${run} has no node ${node}`);
+      console.log(JSON.stringify(row, null, 2));
+      return;
+    }
+    const nodes = store.listRunNodes(run).filter((n) => opts.status ? n.status === opts.status : true);
+    if (opts.json) {
+      console.log(JSON.stringify(nodes, null, 2));
+    } else {
+      for (const n of nodes) {
+        console.log(`${n.status.padEnd(10)} ${n.nodeId}  attempts=${n.attempts}  lane=${n.lane ?? "-"}  exit=${n.exitCode ?? "-"}`);
+      }
+    }
+  } finally {
+    store.close();
+  }
+});
+program.command("sessions").description("Inspect the session WAL").argument("<action>", "list | pull").option("-j, --json", "JSON output").action((action, opts) => {
+  const { wal } = openLocal();
+  const replay = wal.replay();
+  switch (action) {
+    case "list": {
+      const entries = replay.entries.map((entry) => ({ seq: entry.seq, at: entry.at, op: entry.op }));
+      if (opts.json) {
+        console.log(JSON.stringify(entries, null, 2));
+      } else {
+        for (const entry of entries) {
+          console.log(`${entry.seq.toString().padStart(4)} ${entry.at}  ${JSON.stringify(entry.op)}`);
+        }
+        console.log(`${entries.length} WAL entry(ies)`);
+      }
+      return;
+    }
+    case "pull": {
+      const liveClaims = [...replay.liveClaims().entries()].map(([runId, claim]) => ({
+        runId,
+        worker: claim.worker,
+        fencing: claim.fencing,
+        expiresAt: new Date(claim.expiresAtMs).toISOString()
+      }));
+      const report = {
+        entries: replay.entries.length,
+        torn: replay.torn,
+        repaired: replay.repaired,
+        liveClaims,
+        walFile: wal.filePath
+      };
+      if (opts.json) {
+        console.log(JSON.stringify(report, null, 2));
+      } else {
+        console.log(`sessions pull: ${report.entries} WAL entr${report.entries === 1 ? "y" : "ies"}` + `  torn=${report.torn}  repaired=${report.repaired}  liveClaims=${report.liveClaims.length}`);
+        for (const claim of report.liveClaims) {
+          console.log(`  claim ${claim.runId} by ${claim.worker} until ${claim.expiresAt} (fencing ${claim.fencing})`);
+        }
+      }
+      return;
+    }
+    default:
+      throw new Error(`unknown sessions action ${action} (expected list | pull)`);
+  }
+});
+program.command("machines").description("List observed machines or report this machine's workflows status").argument("<action>", "list | status").option("-j, --json", "JSON output").action((action, opts) => {
+  const config = resolveWorkflowsConfig();
+  const { store, wal } = openLocal();
+  try {
+    switch (action) {
+      case "list": {
+        const seen = new Map;
+        for (const entry of wal.replay().entries) {
+          const op = entry.op;
+          if (op.op === "claim_acquired") {
+            const prev = seen.get(op.worker);
+            seen.set(op.worker, { lastSeenAt: op.at, claims: (prev?.claims ?? 0) + 1 });
+          }
+        }
+        const local = hostname();
+        const rows = [
+          { name: local, local: true, dataDir: config.dataDir, lastSeenAt: null, claims: 0 },
+          ...[...seen.entries()].map(([name, info]) => ({
+            name,
+            local: name === local,
+            dataDir: null,
+            lastSeenAt: info.lastSeenAt,
+            claims: info.claims
+          }))
+        ];
+        if (opts.json) {
+          console.log(JSON.stringify(rows, null, 2));
+        } else {
+          for (const row of rows) {
+            console.log(`${row.local ? "local " : "      "} ${row.name}  claims=${row.claims}  lastSeen=${row.lastSeenAt ?? "-"}`);
+          }
+        }
+        return;
+      }
+      case "status": {
+        const replay = wal.replay();
+        const pidFile = join4(config.dataDir, "daemon.pid");
+        const pid = existsSync2(pidFile) ? readFileSync2(pidFile, "utf8").trim() : null;
+        const running = pid !== null && processAlive(Number(pid));
+        const report = {
+          hostname: hostname(),
+          pid: process.pid,
+          dataDir: config.dataDir,
+          layout: {
+            workflows: existsSync2(join4(config.dataDir, "workflows")),
+            sessions: existsSync2(join4(config.dataDir, SESSIONS_DIR_NAME)),
+            db: existsSync2(join4(config.dataDir, "workflows.db"))
+          },
+          store: {
+            tables: store.listTables(),
+            runs: store.listRuns({ limit: 1000 }).length,
+            nodes: store.listRunNodes
+          },
+          wal: { entries: replay.entries.length, torn: replay.torn, repaired: replay.repaired },
+          daemon: { running, pid }
+        };
+        if (opts.json) {
+          console.log(JSON.stringify(report, null, 2));
+        } else {
+          console.log(`machine ${report.hostname} (pid ${report.pid})`);
+          console.log(`  dataDir   ${report.dataDir}`);
+          console.log(`  layout    workflows=${report.layout.workflows} sessions=${report.layout.sessions} db=${report.layout.db}`);
+          console.log(`  store     tables=${report.store.tables.join(",")} runs=${report.store.runs}`);
+          console.log(`  wal       ${report.wal.entries} entr${report.wal.entries === 1 ? "y" : "ies"} torn=${report.wal.torn}`);
+          console.log(`  daemon    ${report.daemon.running ? `running (pid ${report.daemon.pid})` : "not running"}`);
+        }
+        return;
+      }
+      default:
+        throw new Error(`unknown machines action ${action} (expected list | status)`);
+    }
+  } finally {
+    store.close();
+  }
+});
+program.command("lanes").description("List the four lane adapters (wired vs not-ready-with-reason) or probe one").argument("[action]", "list | probe (default list)").argument("[lane]", "lane to probe (claude | codex | cursor | grok)").option("-j, --json", "JSON output").action(async (action, lane, opts) => {
+  if (action === "probe") {
+    const kind = lane;
+    if (!LANE_KINDS2.includes(kind)) {
+      throw new Error(`unknown lane ${lane} (expected one of ${LANE_KINDS2.join(", ")})`);
+    }
+    const probe = await probeLane(kind);
+    if (opts.json) {
+      console.log(JSON.stringify(probe, null, 2));
+    } else if (probe.wired) {
+      console.log(`${probe.kind}: wired (${probe.via})`);
+    } else {
+      console.log(`${probe.kind}: NOT wired \u2014 ${probe.reason}`);
+      process.exitCode = 1;
+    }
+    return;
+  }
+  if (action !== undefined && action !== "list") {
+    throw new Error(`unknown lanes action ${action} (expected list | probe)`);
+  }
+  const inventory = await laneInventory();
+  if (opts.json) {
+    console.log(JSON.stringify(inventory, null, 2));
+  } else {
+    for (const laneProbe of inventory) {
+      if (laneProbe.wired) {
+        console.log(`${laneProbe.kind.padEnd(8)} wired (${laneProbe.via})`);
+      } else {
+        console.log(`${laneProbe.kind.padEnd(8)} NOT wired \u2014 ${laneProbe.reason}`);
+      }
+    }
+  }
+});
+program.command("daemon").description("Run or inspect the daemon").argument("<action>", "start | status | stop").option("--once", "run a single reap cycle and exit (start)").option("--interval-ms <n>", "reap interval (start)", "5000").option("--cycles <n>", "bound on consecutive cycles (start; default infinite until SIGINT)", "0").option("-j, --json", "JSON output").action(async (action, opts) => {
+  const config = resolveWorkflowsConfig();
+  const pidFile = join4(config.dataDir, "daemon.pid");
+  const statusFile = join4(config.dataDir, "daemon.status.json");
+  switch (action) {
+    case "start": {
+      const { store, wal } = openLocal();
+      try {
+        if (opts.once) {
+          const daemon2 = new WorkflowsDaemon(store, wal);
+          const report = await daemon2.reap();
+          writeReport(statusFile, report);
+          console.log(JSON.stringify(report, null, 2));
+          return;
+        }
+        mkdirSync3(config.dataDir, { recursive: true });
+        writeFileSync2(pidFile, String(process.pid) + `
+`, "utf8");
+        const intervalMs = Number(opts.intervalMs ?? 5000);
+        const cycles = Number(opts.cycles ?? 0);
+        const daemon = new WorkflowsDaemon(store, wal);
+        let ran = 0;
+        console.log(`daemon ${process.pid} started (interval ${intervalMs}ms)`);
+        const stop = () => {
+          cleanup();
+          process.exit(0);
+        };
+        process.on("SIGINT", stop);
+        process.on("SIGTERM", stop);
+        const cleanup = () => {
+          try {
+            rmSync(pidFile, { force: true });
+          } catch {}
+        };
+        for (;; ) {
+          const report = await daemon.reap();
+          writeReport(statusFile, report);
+          ran++;
+          if (opts.json)
+            console.log(JSON.stringify(report));
+          if (cycles > 0 && ran >= cycles) {
+            cleanup();
+            process.exit(0);
+          }
+          await new Promise((resolve) => setTimeout(resolve, intervalMs));
+        }
+      } finally {
+        store.close();
+      }
+    }
+    case "status": {
+      if (!existsSync2(statusFile)) {
+        if (opts.json) {
+          console.log(JSON.stringify({ running: false, lastReap: null }));
+        } else {
+          console.log("daemon not running (no status record)");
+        }
+        return;
+      }
+      const lastReap = JSON.parse(readFileSync2(statusFile, "utf8"));
+      const pid = existsSync2(pidFile) ? readFileSync2(pidFile, "utf8").trim() : null;
+      const running = pid !== null && processAlive(Number(pid));
+      if (opts.json) {
+        console.log(JSON.stringify({ running, pid, lastReap }, null, 2));
+      } else {
+        console.log(`daemon ${running ? `running (pid ${pid})` : "not running"} \u2014 last reap: ${JSON.stringify(lastReap)}`);
+      }
+      return;
+    }
+    case "stop": {
+      if (!existsSync2(pidFile)) {
+        console.error("no daemon pid file \u2014 nothing to stop");
+        process.exit(1);
+      }
+      const pid = Number(readFileSync2(pidFile, "utf8").trim());
+      try {
+        process.kill(pid, "SIGTERM");
+      } catch {
+        console.error(`cannot signal pid ${pid}`);
+        process.exit(1);
+      }
+      console.log(`stopping daemon ${pid}`);
+      return;
+    }
+    default:
+      throw new Error(`unknown daemon action ${action} (expected start | status | stop)`);
+  }
+});
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function writeReport(statusFile, report) {
+  mkdirSync3(join4(statusFile, ".."), { recursive: true });
+  writeFileSync2(statusFile, JSON.stringify({ ...report, at: new Date().toISOString() }), "utf8");
+}
+program.command("memos").description("Inspect or clear the memoization cache").argument("<action>", "list | clear").option("--yes", "confirm clear").option("-j, --json", "JSON output").action((action, opts) => {
+  const { store } = openLocal();
+  try {
+    switch (action) {
+      case "list": {
+        const memos = store.memoList();
+        if (opts.json) {
+          console.log(JSON.stringify(memos, null, 2));
+        } else {
+          for (const memo of memos) {
+            console.log(`${memo.key}  hits=${memo.hitCount}`);
+          }
+          console.log(`${memos.length} memo(s)`);
+        }
+        return;
+      }
+      case "clear": {
+        if (!opts.yes) {
+          console.error("refusing without --yes (memos clear is destructive)");
+          process.exit(1);
+        }
+        store.memoClear();
+        console.log("memo cache cleared");
+        return;
+      }
+      default:
+        throw new Error(`unknown memos action ${action} (expected list | clear)`);
+    }
+  } finally {
+    store.close();
+  }
+});
+program.command("resume").description("Restore an INTERRUPTED run from its durable cursor, reusing memoized node outputs").argument("<run-id>", "run id").option("-j, --json", "JSON output").action((runId, opts) => {
+  const { store } = openLocal();
+  try {
+    const restored = restoreInterruptedRun(store, runId);
+    if (opts.json) {
+      console.log(JSON.stringify(restored, null, 2));
+    } else {
+      console.log(`restored ${restored.runId} to ${restored.status} (nodesRestored=${restored.nodesRestored}, memoizedNodes=${restored.memoizedNodes}, attempts=${restored.attempts})`);
+    }
+  } finally {
+    store.close();
+  }
+});
+program.command("serve").description("Start the HTTP server surface (same as the workflows-serve bin)").option("--port <n>", "bind port (default from config)").option("--host <h>", "bind host (default 127.0.0.1)").action(async (opts) => {
+  const service = createWorkflowsService({
+    port: opts.port !== undefined ? Number(opts.port) : undefined,
+    host: opts.host
+  });
+  const server = createWorkflowsServer(service);
+  console.log(`workflows-serve listening on http://${service.config.host}:${server.port}`);
+  await new Promise((resolve) => {
+    const stop = () => {
+      server.stop();
+      resolve();
+    };
+    process.on("SIGINT", stop);
+    process.on("SIGTERM", stop);
+  });
+});
+program.command("repair").description("Repair torn runs (running runs whose claim is gone)").option("--max-attempts <n>", "retry budget before failing a torn run", "3").option("-j, --json", "JSON output").action((opts) => {
+  const { store, wal } = openLocal();
+  try {
+    const report = repairTornRuns(store, wal, { maxAttempts: Number(opts.maxAttempts ?? 3) });
+    if (opts.json) {
+      console.log(JSON.stringify(report, null, 2));
+    } else {
+      console.log(`interrupted=${report.interrupted} requeued=${report.requeued} failed=${report.failed}`);
+    }
+  } finally {
+    store.close();
+  }
+});
 program.parseAsync(process.argv).catch((err) => {
   console.error(String(err instanceof Error ? err.message : err));
   process.exit(1);