@hasna/workflows 0.1.4 → 0.2.1

package/dist/agent-tools.js

@@ -16,454 +16,7 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// src/lanes/types.ts
-import { statSync as statSync2 } from "fs";
-function binaryOnPath(binary) {
-  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
-  for (const entry of pathEntries) {
-    try {
-      const stat = statSync2(`${entry}/${binary}`);
-      if (stat.isFile())
-        return true;
-    } catch {}
-  }
-  return false;
-}
-function withTimeout(promise, timeoutMs, what) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      reject(new Error(`${what} exceeded the ${timeoutMs}ms budget`));
-    }, timeoutMs);
-    promise.then((value) => {
-      clearTimeout(timer);
-      resolve(value);
-    }, (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-  });
-}
-function spawnCli(cmd, opts) {
-  const started = Date.now();
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-  let proc;
-  try {
-    proc = Bun.spawnSync({
-      cmd,
-      cwd: opts.cwd,
-      env: { ...process.env, ...opts.env ?? {} },
-      stdout: "pipe",
-      stderr: "pipe",
-      timeout: timeoutMs
-    });
-  } catch (err) {
-    const message = String(err instanceof Error ? err.message : err);
-    if (message.includes("ENOENT") || /not found/i.test(message)) {
-      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
-    }
-    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
-  }
-  const durationMs = Date.now() - started;
-  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
-  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
-  const output = stderr ? `${stdout}
-${stderr}`.trim() : stdout.trim();
-  const exitCode = proc.exitCode ?? 1;
-  return { ok: exitCode === 0, exitCode, output, durationMs };
-}
-var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000;
-var init_types = __esm(() => {
-  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
-  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "LaneDependencyMissingError";
-    }
-  };
-  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "LaneAdapterShapeError";
-    }
-  };
-});
-
-// src/lanes/claude.ts
-function createClaudeAdapter(deps = {}) {
-  return {
-    kind: "claude",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
-      try {
-        await loader();
-        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "claude")) {
-          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "claude",
-          sdk: "@anthropic-ai/claude-agent-sdk",
-          wired: false,
-          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch (err) {
-        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
-      }
-      const query = sdk.query;
-      if (typeof query !== "function") {
-        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
-      }
-      const prompt = job.prompt;
-      try {
-        const { output, isError } = await withTimeout((async () => {
-          const generator = await query({
-            prompt,
-            options: { model: job.model, maxTurns: 32, abortSignal: undefined }
-          });
-          let output2 = "";
-          let isError2 = false;
-          for await (const message of generator) {
-            if (message.type === "assistant") {
-              const content = message.message?.content;
-              if (Array.isArray(content)) {
-                for (const block of content) {
-                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
-                    output2 += block.text;
-                  }
-                }
-              }
-            }
-            if (message.type === "error")
-              isError2 = true;
-          }
-          return { output: output2, isError: isError2 };
-        })(), timeoutMs, `claude lane (${job.prompt.slice(0, 60)})`);
-        const durationMs = Date.now() - started;
-        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
-      } catch (err) {
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
-      }
-    }
-  };
-}
-function runClaudeCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = spawnCli([cliPath, "-p", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-    }
-    throw err;
-  }
-}
-var init_claude = __esm(() => {
-  init_types();
-});
-
-// src/lanes/codex.ts
-function createCodexAdapter(deps = {}) {
-  return {
-    kind: "codex",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
-      try {
-        await loader();
-        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "codex")) {
-          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "codex",
-          sdk: "@openai/codex-sdk",
-          wired: false,
-          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch {
-        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
-      }
-      const CodexClass = sdk.Codex;
-      if (typeof CodexClass !== "function") {
-        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
-      }
-      try {
-        const client = await withTimeout(Promise.resolve(new CodexClass({
-          config: { model: job.model },
-          env: job.env
-        })), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
-        const thread = client.startThread?.();
-        if (!thread || typeof thread.run !== "function") {
-          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
-        }
-        const turn = await withTimeout(thread.run(job.prompt), timeoutMs, `codex lane (${job.prompt.slice(0, 60)})`);
-        const output = turn?.finalResponse ?? "";
-        const durationMs = Date.now() - started;
-        return { ok: true, exitCode: 0, output, durationMs };
-      } catch (err) {
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
-      }
-    }
-  };
-}
-function runCodexCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = spawnCli([cliPath, "exec", "--", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@openai/codex-sdk or the codex CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-    }
-    throw err;
-  }
-}
-var init_codex = __esm(() => {
-  init_types();
-});
-
-// src/lanes/cursor.ts
-function createCursorAdapter(deps = {}) {
-  return {
-    kind: "cursor",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
-      try {
-        await loader();
-        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
-          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "cursor",
-          sdk: "@cursor/sdk",
-          wired: false,
-          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch {
-        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
-      }
-      try {
-        const run = await withTimeout(runLocalAgent(sdk, job), timeoutMs, `cursor lane (${job.prompt.slice(0, 60)})`);
-        const durationMs = Date.now() - started;
-        const status = run.status;
-        const ok = status === "finished";
-        return { ok, exitCode: ok ? 0 : 1, output: run.result, durationMs };
-      } catch (err) {
-        if (err instanceof LaneAdapterShapeError)
-          throw err;
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err) };
-      }
-    }
-  };
-}
-async function runLocalAgent(sdk, job) {
-  const AgentClass = sdk.Agent;
-  const CursorClass = sdk.Cursor;
-  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
-    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
-  }
-  const agent = typeof AgentClass === "function" ? new AgentClass : undefined;
-  if (!agent || typeof agent.send !== "function") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
-  }
-  const run = await agent.send(job.prompt, { model: job.model });
-  if (!run || typeof run !== "object") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
-  }
-  const candidate = run;
-  if (typeof candidate.status !== "string" || !["finished", "error", "cancelled"].includes(candidate.status)) {
-    throw new LaneAdapterShapeError(`@cursor/sdk Agent.send() returned a Run without a terminal status (got ${JSON.stringify(candidate.status)}; expected finished|error|cancelled)`);
-  }
-  if (typeof candidate.result !== "string") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned a Run without a string result");
-  }
-  return { status: candidate.status, result: candidate.result };
-}
-function runCursorCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = spawnCli([cliPath, "run", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-    }
-    throw err;
-  }
-}
-var init_cursor = __esm(() => {
-  init_types();
-});
-
-// src/lanes/grok.ts
-function createGrokAdapter(deps = {}) {
-  return {
-    kind: "grok",
-    async probe() {
-      const cliPath = deps.cliPath ?? "grok";
-      if (binaryOnPath(cliPath)) {
-        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
-      }
-      return {
-        kind: "grok",
-        sdk: "no npm SDK (measured 2026-08-25)",
-        wired: false,
-        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
-      };
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const cliPath = deps.cliPath ?? "grok";
-      try {
-        const result = spawnCli([cliPath, job.prompt], {
-          binaryName: cliPath,
-          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
-          timeoutMs,
-          env: job.env,
-          cwd: job.cwd
-        });
-        return { ...result, durationMs: Date.now() - started };
-      } catch (err) {
-        if (err instanceof LaneDependencyMissingError) {
-          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-        }
-        throw err;
-      }
-    }
-  };
-}
-var init_grok = __esm(() => {
-  init_types();
-});
-
-// src/lanes/index.ts
-var exports_lanes = {};
-__export(exports_lanes, {
-  runLaneJob: () => runLaneJob,
-  resolveLane: () => resolveLane,
-  probeLane: () => probeLane,
-  laneInventory: () => laneInventory,
-  createGrokAdapter: () => createGrokAdapter,
-  createCursorAdapter: () => createCursorAdapter,
-  createCodexAdapter: () => createCodexAdapter,
-  createClaudeAdapter: () => createClaudeAdapter,
-  binaryOnPath: () => binaryOnPath,
-  LaneDependencyMissingError: () => LaneDependencyMissingError,
-  LaneAdapterShapeError: () => LaneAdapterShapeError,
-  LANE_KINDS: () => LANE_KINDS2
-});
-function resolveLane(kind) {
-  const adapter = adapters.get(kind);
-  if (!adapter)
-    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
-  return adapter;
-}
-async function runLaneJob(job) {
-  return resolveLane(job.lane).run(job);
-}
-async function probeLane(kind) {
-  return resolveLane(kind).probe();
-}
-async function laneInventory() {
-  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
-}
-var adapters;
-var init_lanes = __esm(() => {
-  init_claude();
-  init_codex();
-  init_cursor();
-  init_grok();
-  init_types();
-  init_types();
-  init_claude();
-  init_codex();
-  init_cursor();
-  init_grok();
-  adapters = new Map([
-    ["claude", createClaudeAdapter()],
-    ["codex", createCodexAdapter()],
-    ["cursor", createCursorAdapter()],
-    ["grok", createGrokAdapter()]
-  ]);
-});
-
 // src/expr.ts
-class ExprSyntaxError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ExprSyntaxError";
-  }
-}
-
-class ExprEvalError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ExprEvalError";
-  }
-}
-var COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
 function tokenize(input) {
   const tokens = [];
   let i = 0;
@@ -715,11 +268,24 @@ function evaluateExpr(input, context) {
   }
   return value;
 }
+var ExprSyntaxError, ExprEvalError, COMPARISON_OPS;
+var init_expr = __esm(() => {
+  ExprSyntaxError = class ExprSyntaxError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ExprSyntaxError";
+    }
+  };
+  ExprEvalError = class ExprEvalError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ExprEvalError";
+    }
+  };
+  COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
+});
 
 // src/graph.ts
-var GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
-var LANE_KINDS = ["claude", "codex", "cursor", "grok"];
-var NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
 function issue(issues, path, message) {
   issues.push({ path, message });
 }
@@ -816,6 +382,9 @@ function findCycles(graph) {
 }
 function validateGraph(graph) {
   const issues = [];
+  if (graph === null || typeof graph !== "object" || Array.isArray(graph)) {
+    return { ok: false, issues: [{ path: "graph", message: "graph must be an object" }] };
+  }
   if (typeof graph.name !== "string" || graph.name.trim() === "") {
     issue(issues, "name", "graph requires a non-empty name");
   }
@@ -838,6 +407,24 @@ function validateGraph(graph) {
     issue(issues, "nodes", "graph requires at least one node");
     return { ok: false, issues };
   }
+  for (let index = 0;index < graph.nodes.length; index++) {
+    const node = graph.nodes[index];
+    if (node === null || typeof node !== "object" || Array.isArray(node)) {
+      issue(issues, `nodes.${index}`, "node must be an object");
+      continue;
+    }
+    if (!GRAPH_NODE_TYPES.includes(node.type))
+      issue(issues, `nodes.${index}.type`, "type must be start, step, decision, while, or end");
+    for (const key of ["next", "then", "else", "prompt", "command"]) {
+      const value = node[key];
+      if (value !== undefined && (typeof value !== "string" || value.trim() === ""))
+        issue(issues, `nodes.${index}.${key}`, `${key} must be a non-empty string`);
+    }
+    if (node.type === "while" && (!Array.isArray(node.body) || node.body.some((id) => typeof id !== "string")))
+      issue(issues, `nodes.${index}.body`, "body must be an array of node ids");
+  }
+  if (issues.length)
+    return { ok: false, issues };
   const starts = graph.nodes.filter((n) => n.type === "start");
   if (starts.length === 0)
     issue(issues, "nodes", "graph requires exactly one start node (found none)");
@@ -899,6 +486,8 @@ function nodeEdges(node) {
       return node.next ? [{ kind: "next", target: node.next }] : [];
     case "end":
       return [];
+    default:
+      return [];
   }
 }
 function validateNode(graph, node, issues) {
@@ -914,6 +503,16 @@ function validateNode(graph, node, issues) {
       if (node.lane !== undefined && !LANE_KINDS.includes(node.lane)) {
         issue(issues, `nodes.${node.id}`, `unknown lane ${JSON.stringify(node.lane)} (expected one of ${LANE_KINDS.join(", ")})`);
       }
+      if (node.cwd !== undefined && (typeof node.cwd !== "string" || !node.cwd.trim() || node.cwd.includes("\x00"))) {
+        issue(issues, `nodes.${node.id}.cwd`, "cwd must be a non-empty path string without NUL characters on the executor");
+      }
+      if (node.codexMode !== undefined) {
+        if (!CODEX_EXECUTION_MODES.includes(node.codexMode)) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode must be repository or read-only");
+        } else if (node.lane !== "codex" || !node.prompt || node.command !== undefined) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode is supported only for a codex prompt step without command");
+        }
+      }
       if (node.maxRetries !== undefined && (!Number.isInteger(node.maxRetries) || node.maxRetries < 0)) {
         issue(issues, `nodes.${node.id}`, "maxRetries must be a non-negative integer");
       }
@@ -973,1002 +572,547 @@ function validateNode(graph, node, issues) {
             issue(issues, `nodes.${node.id}`, `while body may only contain step/decision nodes in v1 (found ${bodyNode.type})`);
           }
         }
-        const bodySet = new Set(node.body);
-        for (const bodyId of node.body) {
-          const bodyNode = findNode(graph, bodyId);
-          if (!bodyNode)
-            continue;
-          for (const { kind, target } of nodeEdges(bodyNode)) {
-            if (!bodySet.has(target)) {
-              issue(issues, `nodes.${node.id}`, `while body node ${bodyId} ${kind}-edge leaves the body (target ${target})`);
-            }
-          }
-        }
-      }
-      break;
-    }
-    case "end":
-      break;
-  }
-}
-
-// src/secrets.ts
-class SecretsGateError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "SecretsGateError";
-  }
-}
-var p = (...parts) => parts.join("");
-var VALUE_PATTERNS = [
-  { detector: "anthropic_api_key", re: new RegExp(p("sk-", "ant-") + "[A-Za-z0-9_-]{10,}") },
-  { detector: "openai_api_key", re: new RegExp(p("sk-", "proj-") + "[A-Za-z0-9_-]{10,}") },
-  { detector: "npm_token", re: /npm_[A-Za-z0-9]{20,}/ },
-  { detector: "github_token", re: /gh[pousr]_[A-Za-z0-9]{20,}/ },
-  { detector: "aws_access_key", re: /AKIA[0-9A-Z]{16}/ },
-  { detector: "google_api_key", re: /AIza[0-9A-Za-z_-]{20,}/ },
-  { detector: "xai_api_key", re: new RegExp(p("xai-") + "[A-Za-z0-9]{20,}") },
-  { detector: "codex_token", re: new RegExp(p("ctx7", "sk-") + "[A-Za-z0-9]{10,}") },
-  { detector: "private_key_block", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/ },
-  { detector: "bearer_token", re: /Bearer [A-Za-z0-9._~+/=-]{20,}/ }
-];
-var CREDENTIAL_KEY_RE = /^(token|api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|secret[_-]?key|refresh[_-]?token|session[_-]?token|bot[_-]?token)$/i;
-function scanString(value, path, findings) {
-  for (const { detector, re } of VALUE_PATTERNS) {
-    if (re.test(value)) {
-      findings.push({ path, detector });
-      return;
-    }
-  }
-}
-function isTrivial(value) {
-  const v = value.trim();
-  if (v.length === 0)
-    return true;
-  const upper = v.toUpperCase();
-  if (upper.startsWith("REPLACE") || upper.startsWith("CHANGE") || upper.startsWith("YOUR_") || upper.startsWith("EXAMPLE") || upper.startsWith("PLACEHOLDER"))
-    return true;
-  if (v.length < 8)
-    return true;
-  return false;
-}
-function scanForSecrets(value, path = "$") {
-  const findings = [];
-  if (value === null || value === undefined)
-    return findings;
-  if (typeof value === "string") {
-    scanString(value, path, findings);
-    return findings;
-  }
-  if (Array.isArray(value)) {
-    value.forEach((item, index) => {
-      findings.push(...scanForSecrets(item, `${path}[${index}]`));
-    });
-    return findings;
-  }
-  if (typeof value === "object") {
-    const record = value;
-    for (const [key, child] of Object.entries(record)) {
-      if (CREDENTIAL_KEY_RE.test(key) && typeof child === "string" && !isTrivial(child)) {
-        findings.push({ path: `${path}.${key}`, detector: "credential_key_field" });
-      } else {
-        findings.push(...scanForSecrets(child, `${path}.${key}`));
-      }
-    }
-  }
-  return findings;
-}
-function assertNoSecrets(value, what) {
-  const findings = scanForSecrets(value);
-  if (findings.length === 0)
-    return;
-  const detail = findings.map((f) => `${f.path} (${f.detector})`).join(", ");
-  throw new SecretsGateError(`secrets write-gate refused to persist ${what}: credential-shaped value at ${detail}`);
-}
-
-// src/session.ts
-import { createHash } from "crypto";
-import { readFileSync, statSync } from "fs";
-import { isAbsolute, join } from "path";
-var DEFAULT_MAX_ATTEMPTS = 3;
-function repairTornRuns(store, wal, opts = {}) {
-  const maxAttempts = opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
-  const replay = wal.replay();
-  const liveClaims = replay.liveClaims(opts.now);
-  const report = { interrupted: 0, requeued: 0, failed: 0 };
-  const running = store.listRuns({ status: "running", limit: 1000 });
-  for (const run of running) {
-    if (liveClaims.has(run.id))
-      continue;
-    report.interrupted++;
-    const nodes = store.listRunNodes(run.id);
-    if (run.attempts < maxAttempts) {
-      store.bumpAttempts(run.id);
-      store.setRunStatus(run.id, "interrupted", {
-        error: `torn run interrupted after claim loss (attempt ${run.attempts + 1}/${maxAttempts})`
-      });
-      for (const node of nodes) {
-        if (node.status === "running") {
-          store.setRunNodeStatus(node.id, "pending", { error: undefined });
-        }
-      }
-      report.requeued++;
-    } else {
-      store.setRunStatus(run.id, "failed", {
-        error: `torn run failed after ${maxAttempts} interrupted attempts`
-      });
-      for (const node of nodes) {
-        if (node.status === "running") {
-          store.setRunNodeStatus(node.id, "failed", { error: "run interrupted beyond retry budget" });
+        const bodySet = new Set(node.body);
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode)
+            continue;
+          for (const { kind, target } of nodeEdges(bodyNode)) {
+            if (!bodySet.has(target)) {
+              issue(issues, `nodes.${node.id}`, `while body node ${bodyId} ${kind}-edge leaves the body (target ${target})`);
+            }
+          }
         }
       }
-      report.failed++;
-    }
-  }
-  return report;
-}
-function inputHash(payload) {
-  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
-}
-function memoKey(graphName, nodeId, input) {
-  return `${graphName}:${nodeId}:${inputHash(input)}`;
-}
-function tryMemoHit(store, graphName, nodeId, input) {
-  const key = memoKey(graphName, nodeId, input);
-  const memo = store.memoGet(key);
-  if (!memo)
-    return;
-  store.memoHit(key);
-  return memo;
-}
-function recordMemo(store, graphName, nodeId, input, output) {
-  const key = memoKey(graphName, nodeId, input);
-  store.memoPut(key, graphName, nodeId, inputHash(input), JSON.stringify(output));
-}
-function memoWatchFingerprint(graph, dataDir) {
-  if (!graph.memoWatch || graph.memoWatch.length === 0)
-    return;
-  const entries = [];
-  for (const pattern of graph.memoWatch) {
-    if (hasGlobMagic(pattern)) {
-      const matches = [...new Bun.Glob(pattern).scanSync({ cwd: dataDir, onlyFiles: true })].sort();
-      for (const match of matches) {
-        const path2 = isAbsolute(match) ? match : join(dataDir, match);
-        entries.push(fingerprintFile(pattern, path2));
-      }
-      continue;
-    }
-    const path = isAbsolute(pattern) ? pattern : join(dataDir, pattern);
-    entries.push(fingerprintFile(pattern, path));
-  }
-  return entries;
-}
-function hasGlobMagic(pattern) {
-  return /[*?[\]{}]/.test(pattern);
-}
-function fingerprintFile(pattern, path) {
-  try {
-    const stat = statSync(path);
-    if (!stat.isFile()) {
-      return { pattern, path, missing: true, mtimeMs: null, size: null, sha256: null };
+      break;
     }
-    const content = readFileSync(path);
-    return {
-      pattern,
-      path,
-      missing: false,
-      mtimeMs: stat.mtimeMs,
-      size: content.byteLength,
-      sha256: createHash("sha256").update(content).digest("hex")
-    };
-  } catch {
-    return { pattern, path, missing: true, mtimeMs: null, size: null, sha256: null };
+    case "end":
+      break;
   }
 }
-function findRunByIdempotencyKey(store, key) {
-  const runs = store.listRuns({ limit: 1000 });
-  for (const run of runs) {
+var GRAPH_NODE_TYPES, LANE_KINDS, CODEX_EXECUTION_MODES, NODE_ID_RE;
+var init_graph = __esm(() => {
+  init_expr();
+  GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
+  LANE_KINDS = ["claude", "codex", "cursor", "grok"];
+  CODEX_EXECUTION_MODES = ["repository", "read-only"];
+  NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+});
+
+// src/lanes/types.ts
+import { statSync } from "fs";
+function binaryOnPath(binary) {
+  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
+  for (const entry of pathEntries) {
     try {
-      const context = JSON.parse(run.contextJson);
-      if (context?.__wf?.idempotencyKey === key)
-        return run;
+      const stat = statSync(`${entry}/${binary}`);
+      if (stat.isFile())
+        return true;
     } catch {}
   }
-  return;
+  return false;
 }
-
-// src/daemon.ts
-init_types();
-var DEFAULT_LEASE_TTL_MS = 120000;
-var DEFAULT_MAX_ATTEMPTS2 = 3;
-var DEFAULT_MAX_DISPATCH = 4;
-var DEFAULT_MAX_STEPS = 25;
-var DEFAULT_TIMEOUT_MS = 120000;
-function nowIso() {
-  return new Date().toISOString();
+function subscriptionEnvironment(overrides = {}) {
+  const paid = /^(OPENAI_API_KEY|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CODEX_API_KEY|CURSOR_API_KEY)$/;
+  const sensitive = /(?:API[_-]?KEY|SECRET|PASSWORD|TOKEN|DATABASE_URL|CREDENTIAL)/i;
+  const env = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (value !== undefined && !paid.test(name) && (!sensitive.test(name) || name === "CLAUDE_CODE_OAUTH_TOKEN"))
+      env[name] = value;
+  }
+  for (const [name, value] of Object.entries(overrides)) {
+    if (paid.test(name) || sensitive.test(name))
+      throw new Error(`lane environment field ${name} requires a supported scoped credential consumer`);
+    env[name] = value;
+  }
+  return env;
 }
-function stripRunState(context) {
-  const { __wf: _wf, steps: _steps, ...user } = context;
-  return user;
+function subscriptionSdkEnvironment(overrides = {}) {
+  const safe = subscriptionEnvironment(overrides);
+  return { ...Object.fromEntries(Object.keys(process.env).map((name) => [name, undefined])), ...safe };
 }
-function runCommand(job) {
-  if (!job.command) {
-    return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "no command" };
-  }
-  const started = Date.now();
-  const timeoutMs = job.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const proc = Bun.spawnSync({
-    cmd: ["/bin/sh", "-c", job.command],
-    cwd: job.cwd,
-    env: { ...process.env, ...job.env ?? {} },
-    stdout: "pipe",
-    stderr: "pipe",
-    timeout: timeoutMs
+function withTimeout(promise, timeoutMs, what, cancel) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      cancel?.();
+      reject(new LaneTimeoutError(what, timeoutMs));
+    }, timeoutMs);
+    promise.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
   });
-  const durationMs = Date.now() - started;
-  const stdout = proc.stdout ? new TextDecoder().decode(proc.stdout) : "";
-  const stderr = proc.stderr ? new TextDecoder().decode(proc.stderr) : "";
-  const output = stderr ? `${stdout}
-${stderr}`.trim() : stdout.trim();
-  const exitCode = proc.exitCode ?? (proc.signalCode ? 1 : 1);
-  return { ok: exitCode === 0, exitCode, output, durationMs };
 }
-
-class WorkflowsDaemon {
-  store;
-  wal;
-  worker;
-  leaseTtlMs;
-  maxAttempts;
-  maxDispatchPerCycle;
-  maxStepsPerCycle;
-  time;
-  laneRunner;
-  env;
-  leases = new Map;
-  fencingCounter = new Map;
-  graphCache = new Map;
-  isolatedRunId = null;
-  constructor(store, wal, options = {}) {
-    this.store = store;
-    this.wal = wal;
-    this.worker = options.worker ?? "local";
-    this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
-    this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS2;
-    this.maxDispatchPerCycle = options.maxDispatchPerCycle ?? DEFAULT_MAX_DISPATCH;
-    this.maxStepsPerCycle = options.maxStepsPerCycle ?? DEFAULT_MAX_STEPS;
-    this.time = options.time ?? Date.now;
-    this.env = options.env ?? {};
-    this.laneRunner = options.laneRunner ?? defaultLaneRunner;
-    this.isolatedRunId = options.isolatedRunId ?? null;
-    this.replayRegisteredGraphs();
-  }
-  isolateRun(runId) {
-    this.isolatedRunId = runId;
-  }
-  replayRegisteredGraphs() {
-    const entries = this.wal.replay().entries;
-    for (const entry of entries) {
-      const op = entry.op;
-      if (op.op === "graph_registered") {
-        this.graphCache.set(op.name, op.graph);
-      }
+async function spawnCli(cmd, opts) {
+  const started = Date.now();
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+  let proc;
+  try {
+    proc = Bun.spawn({
+      cmd,
+      cwd: opts.cwd,
+      env: subscriptionEnvironment(opts.env),
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: timeoutMs
+    });
+  } catch (err) {
+    const message = String(err instanceof Error ? err.message : err);
+    if (message.includes("ENOENT") || /not found/i.test(message)) {
+      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
     }
+    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
   }
-  liveLeases() {
-    const now = this.time();
-    for (const [runId, lease] of this.leases) {
-      if (lease.expiresAtMs <= now)
-        this.leases.delete(runId);
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  const output = opts.stdoutOnly ? stdout.trim() : stderr ? `${stdout}
+${stderr}`.trim() : stdout.trim();
+  return {
+    ok: exitCode === 0,
+    exitCode,
+    output,
+    durationMs: Date.now() - started,
+    ...opts.stdoutOnly && exitCode !== 0 && stderr.trim() ? { error: stderr.trim() } : {}
+  };
+}
+var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000, LaneTimeoutError;
+var init_types = __esm(() => {
+  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
+  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneDependencyMissingError";
     }
-    return this.leases;
-  }
-  claim(runId) {
-    const now = this.time();
-    const existing = this.leases.get(runId);
-    if (existing && existing.worker !== this.worker && existing.expiresAtMs > now) {
-      return null;
+  };
+  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneAdapterShapeError";
     }
-    const liveClaims = this.wal.replay().liveClaims(now);
-    const foreign = liveClaims.get(runId);
-    if (foreign && foreign.worker !== this.worker && foreign.expiresAtMs > now) {
-      return null;
+  };
+  LaneTimeoutError = class LaneTimeoutError extends Error {
+    constructor(what, timeoutMs) {
+      super(`${what} exceeded the ${timeoutMs}ms budget`);
+      this.name = "LaneTimeoutError";
     }
-    const fencing = (this.fencingCounter.get(runId) ?? 0) + 1;
-    this.fencingCounter.set(runId, fencing);
-    const lease = { runId, worker: this.worker, expiresAtMs: now + this.leaseTtlMs, fencing };
-    this.leases.set(runId, lease);
-    this.wal.append({
-      op: "claim_acquired",
-      runId,
-      worker: this.worker,
-      expiresAt: new Date(lease.expiresAtMs).toISOString(),
-      fencing,
-      at: nowIso()
-    });
-    return lease;
-  }
-  heartbeat(runId, fencing) {
-    const lease = this.leases.get(runId);
-    if (!lease || lease.fencing !== fencing)
-      return false;
-    lease.expiresAtMs = this.time() + this.leaseTtlMs;
-    return true;
-  }
-  release(runId, fencing) {
-    const lease = this.leases.get(runId);
-    if (!lease || lease.fencing !== fencing)
-      return false;
-    this.leases.delete(runId);
-    this.wal.append({ op: "claim_released", runId, fencing, at: nowIso() });
-    return true;
-  }
-  async reap() {
-    const report = { expired: 0, interrupted: 0, requeued: 0, failed: 0, dispatched: 0, advanced: 0, completed: 0 };
-    const now = this.time();
-    for (const [runId, lease] of this.leases) {
-      if (lease.expiresAtMs <= now) {
-        this.leases.delete(runId);
-        report.expired++;
+  };
+});
+
+// src/lanes/claude.ts
+function createClaudeAdapter(deps = {}) {
+  return {
+    kind: "claude",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      try {
+        await loader();
+        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "claude")) {
+          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "claude",
+          sdk: "@anthropic-ai/claude-agent-sdk",
+          wired: false,
+          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch (err) {
+        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
+      }
+      const query = sdk.query;
+      if (typeof query !== "function") {
+        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
+      }
+      const prompt = job.prompt;
+      const abortController = new AbortController;
+      try {
+        const { output, isError } = await withTimeout((async () => {
+          const generator = await query({
+            prompt,
+            options: { model: job.model, cwd: job.cwd, maxTurns: 32, abortController, env: subscriptionSdkEnvironment(job.env) }
+          });
+          let output2 = "";
+          let isError2 = false;
+          for await (const message of generator) {
+            if (message.type === "assistant") {
+              const content = message.message?.content;
+              if (Array.isArray(content)) {
+                for (const block of content) {
+                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
+                    output2 += block.text;
+                  }
+                }
+              }
+            }
+            if (message.type === "error")
+              isError2 = true;
+          }
+          return { output: output2, isError: isError2 };
+        })(), timeoutMs, "claude lane", () => abortController.abort());
+        const durationMs = Date.now() - started;
+        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
-    if (this.isolatedRunId === null) {
-      const repair = repairTornRuns(this.store, this.wal, { maxAttempts: this.maxAttempts, now });
-      report.interrupted += repair.interrupted;
-      report.requeued += repair.requeued;
-      report.failed += repair.failed;
-    }
-    const pending = this.store.listRuns({ status: "pending", limit: this.maxDispatchPerCycle }).concat(this.store.listRuns({ status: "interrupted", limit: this.maxDispatchPerCycle })).sort((a, b) => a.createdAt === b.createdAt ? a.id < b.id ? 1 : -1 : a.createdAt < b.createdAt ? 1 : -1).slice(0, this.maxDispatchPerCycle);
-    for (const run of pending) {
-      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
-        continue;
-      const lease = this.claim(run.id);
-      if (!lease)
-        continue;
-      this.store.setRunStatus(run.id, "running");
-      this.wal.append({ op: "run_started", runId: run.id, at: nowIso() });
-      report.dispatched++;
-    }
-    const running = this.store.listRuns({ status: "running", limit: this.maxStepsPerCycle });
-    let steps = 0;
-    for (const run of running) {
-      if (this.isolatedRunId !== null && run.id !== this.isolatedRunId)
-        continue;
-      if (steps >= this.maxStepsPerCycle)
-        break;
-      const outcome = await this.advanceRun(run.id);
-      steps++;
-      if (outcome.kind === "completed")
-        report.completed++;
-      if (outcome.kind === "failed")
-        report.failed++;
-      if (outcome.kind === "advanced")
-        report.advanced++;
-    }
-    return report;
-  }
-  startRun(graph, context) {
-    const validation = validateGraph(graph);
-    if (!validation.ok) {
-      throw new Error(`graph validation failed: ${validation.issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`);
-    }
-    assertNoSecrets(context, "run context");
-    assertNoSecrets(graph, "graph definition");
-    const existing = this.graphCache.get(graph.name);
-    const serialized = JSON.stringify(graph);
-    if (!existing || JSON.stringify(existing) !== serialized) {
-      this.graphCache.set(graph.name, graph);
-      this.wal.append({ op: "graph_registered", name: graph.name, version: graph.version, graph, at: nowIso() });
-    } else {
-      this.graphCache.set(graph.name, existing);
+  };
+}
+async function runClaudeCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = await spawnCli([cliPath, "-p", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
     }
-    return this.store.createRun({ graphName: graph.name, graphVersion: graph.version, context: context ?? {} });
+    throw err;
   }
-  async advanceRun(runId) {
-    const run = this.store.getRun(runId);
-    if (!run || run.status !== "running")
-      return { kind: "noop" };
-    const lease = this.leases.get(runId);
-    if (!lease || lease.expiresAtMs <= this.time())
-      return { kind: "blocked" };
-    const graph = this.loadGraph(run.graphName);
-    if (!graph) {
-      this.failRun(run, `graph ${run.graphName} not found in daemon graph cache`);
-      return { kind: "failed", error: "graph not found" };
-    }
-    const context = JSON.parse(run.contextJson);
-    const rawWf = context.__wf ?? {};
-    const wf = {
-      ...rawWf,
-      cursor: typeof rawWf.cursor === "string" ? rawWf.cursor : undefined,
-      loops: rawWf.loops ?? {},
-      completedLoops: rawWf.completedLoops ?? {}
-    };
-    try {
-      const cursor = wf.cursor;
-      const node = cursor === undefined ? graph.nodes.find((n) => n.type === "start") : findNode(graph, cursor);
-      if (!node) {
-        this.failRun(run, `cursor ${cursor ?? "<start>"} resolves to no node`);
-        return { kind: "failed", error: "no node at cursor" };
-      }
-      switch (node.type) {
-        case "start": {
-          wf.cursor = node.next;
-          this.persistContext(run, context, wf);
-          return { kind: "advanced", nodeId: node.id };
-        }
-        case "step": {
-          return await this.executeStep(run, graph, context, wf, node);
-        }
-        case "decision": {
-          const value = evaluateExpr(node.condition, this.conditionScope(context));
-          const next = value ? node.then : node.else;
-          if (!next) {
-            this.failRun(run, `decision ${node.id} evaluated ${value} but no ${value ? "then" : "else"} edge`);
-            return { kind: "failed", error: "missing decision edge" };
-          }
-          wf.cursor = next;
-          this.persistContext(run, context, wf);
-          return { kind: "advanced", nodeId: node.id };
+}
+var init_claude = __esm(() => {
+  init_types();
+});
+
+// src/lanes/codex.ts
+function createCodexAdapter(deps = {}) {
+  return {
+    kind: "codex",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      try {
+        await loader();
+        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "codex")) {
+          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
         }
-        case "while": {
-          return this.executeWhile(run, graph, context, wf, node);
+        return {
+          kind: "codex",
+          sdk: "@openai/codex-sdk",
+          wired: false,
+          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
+      }
+      if (job.codexMode !== undefined && (!CODEX_EXECUTION_MODES.includes(job.codexMode) || job.lane !== "codex" || job.command !== undefined)) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codexMode must be repository or read-only on a codex prompt without command", retryable: false };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
+      }
+      const CodexClass = sdk.Codex;
+      if (typeof CodexClass !== "function") {
+        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
+      }
+      const abortController = new AbortController;
+      try {
+        const client = await withTimeout(Promise.resolve(new CodexClass({
+          config: { model: job.model },
+          env: subscriptionEnvironment(job.env)
+        })), timeoutMs, "codex lane");
+        const thread = client.startThread?.({
+          model: job.model,
+          workingDirectory: job.cwd,
+          ...job.codexMode === "read-only" ? { sandboxMode: "read-only", skipGitRepoCheck: true, approvalPolicy: "never" } : {}
+        });
+        if (!thread || typeof thread.run !== "function") {
+          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
         }
-        case "end": {
-          this.completeRun(run, context);
-          return { kind: "completed" };
+        const turn = await withTimeout(thread.run(job.prompt, { signal: abortController.signal }), timeoutMs, "codex lane", () => abortController.abort());
+        const durationMs = Date.now() - started;
+        const output = turn?.finalResponse;
+        if (typeof output !== "string" || !output.trim()) {
+          return missingResponse(durationMs);
         }
+        return { ok: true, exitCode: 0, output, durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
-    } catch (err) {
-      if (err instanceof ExprEvalError || err instanceof ExprSyntaxError) {
-        this.failRun(run, `condition error at ${wf.cursor ?? "<start>"}: ${err.message}`);
-        return { kind: "failed", error: err.message };
-      }
-      throw err;
     }
+  };
+}
+async function runCodexCli(job, cliPath, started, timeoutMs) {
+  try {
+    const controls = job.codexMode === "read-only" ? ["--sandbox", "read-only", "--skip-git-repo-check", "--config", 'approval_policy="never"'] : [];
+    const result = await spawnCli([cliPath, "exec", ...controls, "--", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@openai/codex-sdk or the codex CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd,
+      stdoutOnly: true
+    });
+    const durationMs = Date.now() - started;
+    return result.ok && !result.output.trim() ? missingResponse(durationMs) : { ...result, durationMs };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
   }
-  loadGraph(name) {
-    return this.graphCache.get(name);
-  }
-  conditionScope(context) {
-    return { ...context, steps: context.steps ?? {} };
-  }
-  persistContext(run, context, wf) {
-    context.__wf = wf;
-    this.store.setRunContext(run.id, context);
-  }
-  async executeStep(run, graph, context, wf, node) {
-    const nodeId = node.id;
-    const latest = this.store.getLatestRunNode(run.id, nodeId);
-    const isLoopBody = graph.nodes.some((candidate) => candidate.type === "while" && candidate.body.includes(nodeId));
-    const nodeRow = latest === undefined || isLoopBody && latest.status === "completed" ? this.store.createRunNode({ runId: run.id, nodeId, lane: node.lane ?? "claude" }) : latest;
-    const memoWatch = node.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
-    const memoSource = { command: node.command, prompt: node.prompt, context: stripRunState(context) };
-    const memoInput = node.memo ? memoWatch !== undefined ? { ...memoSource, memoWatch } : memoSource : undefined;
-    if (memoInput !== undefined) {
-      const hit = tryMemoHit(this.store, run.graphName, nodeId, memoInput);
-      if (hit) {
-        const cached = JSON.parse(hit.outputJson);
-        this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: Number(cached.exitCode ?? 0), output: { ...cached, memoHit: true } });
-        this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
-        this.recordStepResult(context, nodeId, { ...cached, memoHit: true });
-        return this.afterNode(run, context, wf, node.next);
+}
+function missingResponse(durationMs) {
+  return { ok: false, exitCode: 1, output: "", durationMs, error: "Codex completed without an agent response; verify the native subscription and model route", retryable: false };
+}
+var init_codex = __esm(() => {
+  init_graph();
+  init_types();
+});
+
+// src/lanes/cursor.ts
+function createCursorAdapter(deps = {}) {
+  return {
+    kind: "cursor",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      try {
+        await loader();
+        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
+          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "cursor",
+          sdk: "@cursor/sdk",
+          wired: false,
+          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
+        };
       }
-    }
-    if (nodeRow.status !== "running") {
-      this.store.setRunNodeStatus(nodeRow.id, "running");
-      this.wal.append({ op: "node_started", runId: run.id, nodeId, at: nowIso() });
-    }
-    const job = {
-      lane: node.lane ?? "claude",
-      prompt: node.prompt,
-      command: node.command,
-      timeoutMs: node.timeoutMs,
-      env: this.env
-    };
-    let result;
-    try {
-      result = await this.laneRunner(job);
-    } catch (err) {
-      result = { ok: false, exitCode: 1, output: "", durationMs: 0, error: String(err instanceof Error ? err.message : err) };
-    }
-    const output = { ok: result.ok, exitCode: result.exitCode, output: result.output, durationMs: result.durationMs };
-    if (!result.ok) {
-      const shouldRetry = nodeRow.attempts < (node.maxRetries ?? 0);
-      this.store.bumpAttemptsNode(nodeRow.id);
-      if (shouldRetry) {
-        this.store.setRunNodeStatus(nodeRow.id, "pending", { error: result.error ?? `exit ${result.exitCode}` });
-        return { kind: "advanced", nodeId };
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
       }
-      const error = result.error ?? `step ${nodeId} failed with exit ${result.exitCode}`;
-      this.store.setRunNodeStatus(nodeRow.id, "failed", { exitCode: result.exitCode, error });
-      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
-      this.failRun(run, error);
-      return { kind: "failed", error };
-    }
-    try {
-      assertNoSecrets(output, `node ${nodeId} output`);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.store.setRunNodeStatus(nodeRow.id, "failed", { error: message });
-      this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "failed", at: nowIso() });
-      this.failRun(run, message);
-      return { kind: "failed", error: message };
-    }
-    this.store.setRunNodeStatus(nodeRow.id, "completed", { exitCode: result.exitCode, output });
-    this.wal.append({ op: "node_finished", runId: run.id, nodeId, status: "completed", at: nowIso() });
-    if (memoInput !== undefined) {
-      const memoInputAfter = node.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
-      const stable = memoWatch === undefined && memoInputAfter === undefined || memoWatch !== undefined && memoInputAfter !== undefined && JSON.stringify(memoWatch) === JSON.stringify(memoInputAfter);
-      if (stable) {
-        recordMemo(this.store, run.graphName, nodeId, memoInput, output);
-        this.wal.append({ op: "memo_set", key: memoKey(run.graphName, nodeId, memoInput), at: nowIso() });
+      if (!deps.sdkLoader && binaryOnPath(deps.cliPath ?? "cursor-agent"))
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", Date.now(), job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS);
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
       }
-    }
-    this.recordStepResult(context, nodeId, output);
-    return this.afterNode(run, context, wf, node.next);
-  }
-  afterNode(run, context, wf, next) {
-    if (next) {
-      wf.cursor = next;
-      this.persistContext(run, context, wf);
-      return { kind: "advanced", nodeId: wf.cursor };
-    }
-    const cursor = wf.cursor;
-    const graph = this.loadGraph(run.graphName);
-    const whileNode = graph.nodes.find((n) => n.type === "while" && n.body.includes(cursor ?? ""));
-    if (whileNode) {
-      const index = whileNode.body.indexOf(cursor ?? "");
-      if (index >= 0 && index < whileNode.body.length - 1) {
-        wf.cursor = whileNode.body[index + 1];
-        this.persistContext(run, context, wf);
-        return { kind: "advanced", nodeId: wf.cursor };
+      let cancel;
+      try {
+        subscriptionEnvironment(job.env);
+        if (!deps.sdkLoader && process.env.CURSOR_API_KEY)
+          throw new Error("cursor lane refuses ambient API billing; use the native subscription CLI");
+        const run = await withTimeout(runLocalAgent(sdk, job, (callback) => {
+          cancel = callback;
+        }), timeoutMs, "cursor lane", () => cancel?.());
+        const durationMs = Date.now() - started;
+        const status = run.status;
+        const ok = status === "finished";
+        return { ok, exitCode: ok ? 0 : 1, output: run.result, durationMs };
+      } catch (err) {
+        if (err instanceof LaneAdapterShapeError)
+          throw err;
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
-      wf.loops[whileNode.id] = (wf.loops[whileNode.id] ?? 0) + 1;
-      wf.cursor = whileNode.id;
-      this.persistContext(run, context, wf);
-      return { kind: "advanced", nodeId: whileNode.id };
     }
-    this.completeRun(run, context);
-    return { kind: "completed" };
+  };
+}
+async function runLocalAgent(sdk, job, onCancel) {
+  const AgentClass = sdk.Agent;
+  const CursorClass = sdk.Cursor;
+  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
   }
-  executeWhile(run, graph, context, wf, node) {
-    const iteration = wf.loops[node.id] ?? 0;
-    if (iteration >= node.maxIterations) {
-      const error = `while node ${node.id} exceeded maxIterations (${node.maxIterations})`;
-      this.failRun(run, error);
-      return { kind: "failed", error };
-    }
-    const scope = { ...this.conditionScope(context), i: iteration };
-    const keepGoing = evaluateExpr(node.condition, scope);
-    if (!keepGoing) {
-      wf.completedLoops[node.id] = iteration;
-      delete wf.loops[node.id];
-      wf.cursor = node.next;
-      this.persistContext(run, context, wf);
-      return { kind: "advanced", nodeId: node.id };
-    }
-    wf.cursor = node.body[0];
-    this.persistContext(run, context, wf);
-    return { kind: "advanced", nodeId: node.id };
+  const create = AgentClass.create;
+  const agent = typeof create === "function" ? await create.call(AgentClass, { local: { cwd: job.cwd, enableAgentRetries: false } }) : typeof AgentClass === "function" ? new AgentClass : undefined;
+  if (!agent || typeof agent.send !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
   }
-  recordStepResult(context, nodeId, output) {
-    const steps = context.steps ?? {};
-    steps[nodeId] = output;
-    context.steps = steps;
+  let run = await agent.send(job.prompt, { model: job.model });
+  if (run && typeof run === "object") {
+    const handle = run;
+    if (typeof handle.cancel === "function")
+      onCancel(() => {
+        handle.cancel().catch(() => {});
+      });
+    if (typeof handle.wait === "function")
+      run = await handle.wait();
   }
-  completeRun(run, context) {
-    const result = {
-      steps: context.steps ?? {},
-      iterations: context.__wf?.completedLoops ?? {}
-    };
-    try {
-      assertNoSecrets(result, "run result");
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      this.failRun(run, message);
-      return;
-    }
-    this.store.setRunStatus(run.id, "completed", { result, finishedAt: nowIso(), error: null });
-    this.wal.append({ op: "run_finished", runId: run.id, status: "completed", at: nowIso() });
-    const lease = this.leases.get(run.id);
-    if (lease)
-      this.release(run.id, lease.fencing);
+  if (!run || typeof run !== "object") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
   }
-  failRun(run, error) {
-    this.store.setRunStatus(run.id, "failed", { error, finishedAt: nowIso() });
-    this.wal.append({ op: "run_finished", runId: run.id, status: "failed", at: nowIso() });
-    const lease = this.leases.get(run.id);
-    if (lease)
-      this.release(run.id, lease.fencing);
+  const candidate = run;
+  if (typeof candidate.status !== "string" || !["finished", "error", "cancelled"].includes(candidate.status)) {
+    throw new LaneAdapterShapeError(`@cursor/sdk Agent.send() returned a Run without a terminal status (got ${JSON.stringify(candidate.status)}; expected finished|error|cancelled)`);
   }
-}
-var defaultLaneRunner = async (job) => {
-  if (job.command)
-    return runCommand(job);
-  const { runLaneJob: runLaneJob2 } = await Promise.resolve().then(() => (init_lanes(), exports_lanes));
-  return runLaneJob2(job);
-};
-async function runGraphToCompletion(store, wal, graph, context, options = {}) {
-  const daemon = new WorkflowsDaemon(store, wal, {
-    worker: "local",
-    laneRunner: options.laneRunner,
-    time: options.time,
-    env: options.env,
-    isolatedRunId: options.isolatedRunId
-  });
-  const run = daemon.startRun(graph, context);
-  options.onRunCreated?.(run);
-  daemon.isolateRun(run.id);
-  const maxCycles = options.maxCycles ?? 500;
-  for (let cycle = 0;cycle < maxCycles; cycle++) {
-    const report = await daemon.reap();
-    const current = store.getRun(run.id);
-    if (current.status !== "running")
-      return current;
-    if (report.advanced === 0 && report.dispatched === 0) {
-      return store.getRun(run.id);
-    }
+  if (typeof candidate.result !== "string") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned a Run without a string result");
   }
-  return store.getRun(run.id);
-}
-
-// src/agent-tools.ts
-init_lanes();
-
-// src/store.ts
-import { Database } from "bun:sqlite";
-import { mkdirSync } from "fs";
-import { join as join2 } from "path";
-import { randomUUID } from "crypto";
-function nowIso2() {
-  return new Date().toISOString();
-}
-var BUSY_TIMEOUT_MS = 3000;
-var BUSY_RETRIES = 2;
-var BUSY_RETRY_SLEEP_MS = 50;
-function isBusyError(err) {
-  if (!(err instanceof Error))
-    return false;
-  const code = String(err.code ?? "");
-  return code.includes("BUSY") || /\bdatabase is locked\b/i.test(err.message);
+  return { status: candidate.status, result: candidate.result };
 }
-function retryBusy(fn) {
-  let last;
-  for (let attempt = 0;attempt <= BUSY_RETRIES; attempt++) {
-    try {
-      return fn();
-    } catch (err) {
-      if (!isBusyError(err))
-        throw err;
-      last = err;
-      Bun.sleepSync(BUSY_RETRY_SLEEP_MS);
+async function runCursorCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = await spawnCli([cliPath, "--print", job.prompt, ...job.model ? ["--model", job.model] : []], {
+      binaryName: cliPath,
+      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
     }
+    throw err;
   }
-  throw last;
 }
-function openStore(dataDir) {
-  mkdirSync(dataDir, { recursive: true });
-  const db = new Database(join2(dataDir, "workflows.db"));
-  retryBusy(() => db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`));
-  retryBusy(() => db.exec("PRAGMA journal_mode = WAL"));
-  retryBusy(() => db.exec("PRAGMA foreign_keys = ON"));
-  retryBusy(() => db.exec(`
-    CREATE TABLE IF NOT EXISTS runs (
-      id            TEXT PRIMARY KEY,
-      graph_name    TEXT NOT NULL,
-      graph_version TEXT NOT NULL,
-      status        TEXT NOT NULL,
-      attempts      INTEGER NOT NULL DEFAULT 0,
-      context_json  TEXT NOT NULL,
-      result_json   TEXT,
-      error         TEXT,
-      started_at    TEXT,
-      finished_at   TEXT,
-      created_at    TEXT NOT NULL,
-      updated_at    TEXT NOT NULL
-    );
-    CREATE TABLE IF NOT EXISTS run_nodes (
-      id          TEXT PRIMARY KEY,
-      run_id      TEXT NOT NULL REFERENCES runs(id) ON DELETE CASCADE,
-      node_id     TEXT NOT NULL,
-      status      TEXT NOT NULL,
-      attempts    INTEGER NOT NULL DEFAULT 0,
-      lane        TEXT,
-      exit_code   INTEGER,
-      output_json TEXT,
-      error       TEXT,
-      started_at  TEXT,
-      finished_at TEXT
-    );
-    CREATE TABLE IF NOT EXISTS memos (
-      key         TEXT PRIMARY KEY,
-      graph_name  TEXT NOT NULL,
-      node_id     TEXT NOT NULL,
-      input_hash  TEXT NOT NULL,
-      output_json TEXT NOT NULL,
-      hit_count   INTEGER NOT NULL DEFAULT 0,
-      created_at  TEXT NOT NULL
-    );
-    CREATE INDEX IF NOT EXISTS idx_runs_status ON runs(status);
-    CREATE INDEX IF NOT EXISTS idx_runs_created ON runs(created_at);
-    CREATE INDEX IF NOT EXISTS idx_run_nodes_run ON run_nodes(run_id);
-  `));
-  const rowToRun = (r) => ({
-    id: String(r.id),
-    graphName: String(r.graph_name),
-    graphVersion: String(r.graph_version),
-    status: r.status,
-    attempts: Number(r.attempts),
-    contextJson: String(r.context_json),
-    resultJson: r.result_json === null ? null : String(r.result_json),
-    error: r.error === null ? null : String(r.error),
-    startedAt: r.started_at === null ? null : String(r.started_at),
-    finishedAt: r.finished_at === null ? null : String(r.finished_at),
-    createdAt: String(r.created_at),
-    updatedAt: String(r.updated_at)
-  });
-  const rowToNode = (r) => ({
-    id: String(r.id),
-    runId: String(r.run_id),
-    nodeId: String(r.node_id),
-    status: r.status,
-    attempts: Number(r.attempts),
-    lane: r.lane === null ? null : String(r.lane),
-    exitCode: r.exit_code === null ? null : Number(r.exit_code),
-    outputJson: r.output_json === null ? null : String(r.output_json),
-    error: r.error === null ? null : String(r.error),
-    startedAt: r.started_at === null ? null : String(r.started_at),
-    finishedAt: r.finished_at === null ? null : String(r.finished_at)
-  });
-  const rowToMemo = (r) => ({
-    key: String(r.key),
-    graphName: String(r.graph_name),
-    nodeId: String(r.node_id),
-    inputHash: String(r.input_hash),
-    outputJson: String(r.output_json),
-    hitCount: Number(r.hit_count),
-    createdAt: String(r.created_at)
-  });
+var init_cursor = __esm(() => {
+  init_types();
+});
+
+// src/lanes/grok.ts
+function createGrokAdapter(deps = {}) {
   return {
-    dataDir,
-    close() {
-      db.close();
-    },
-    listTables() {
-      const rows = retryBusy(() => db.query("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'").all());
-      return rows.map((r) => r.name);
-    },
-    createRun(input) {
-      const id = randomUUID();
-      const now = nowIso2();
-      retryBusy(() => db.query(`INSERT INTO runs (id, graph_name, graph_version, status, attempts, context_json, created_at, updated_at)
-             VALUES (?, ?, ?, 'pending', 0, ?, ?, ?)`).run(id, input.graphName, input.graphVersion, JSON.stringify(input.context ?? {}), now, now));
-      return this.getRun(id);
-    },
-    getRun(id) {
-      const row = retryBusy(() => db.query(`SELECT * FROM runs WHERE id = ?`).get(id));
-      return row ? rowToRun(row) : undefined;
-    },
-    listRuns(opts = {}) {
-      const limit = Math.min(opts.limit ?? 100, 1000);
-      if (opts.status) {
-        const status = opts.status;
-        const rows2 = retryBusy(() => db.query(`SELECT * FROM runs WHERE status = ? ORDER BY created_at DESC, id DESC LIMIT ?`).all(status, limit));
-        return rows2.map((r) => rowToRun(r));
+    kind: "grok",
+    async probe() {
+      const cliPath = deps.cliPath ?? "grok";
+      if (binaryOnPath(cliPath)) {
+        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
       }
-      const rows = retryBusy(() => db.query(`SELECT * FROM runs ORDER BY created_at DESC, id DESC LIMIT ?`).all(limit));
-      return rows.map((r) => rowToRun(r));
-    },
-    setRunStatus(id, status, patch = {}) {
-      const now = nowIso2();
-      const existing = this.getRun(id);
-      const resultJson = patch.result !== undefined ? JSON.stringify(patch.result) : existing?.resultJson ?? null;
-      const error = patch.error !== undefined ? patch.error : existing?.error ?? null;
-      const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing?.startedAt === null ? now : existing?.startedAt ?? null;
-      const terminal = status === "completed" || status === "failed" || status === "cancelled" || status === "interrupted";
-      const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing?.finishedAt === null ? now : existing?.finishedAt ?? null;
-      retryBusy(() => db.query(`UPDATE runs SET status = ?, result_json = ?, error = ?, started_at = ?, finished_at = ?, updated_at = ? WHERE id = ?`).run(status, resultJson, error, startedAt, finishedAt, now, id));
-    },
-    bumpAttempts(id) {
-      retryBusy(() => db.query(`UPDATE runs SET attempts = attempts + 1, updated_at = ? WHERE id = ?`).run(nowIso2(), id));
-    },
-    setRunContext(id, context) {
-      retryBusy(() => db.query(`UPDATE runs SET context_json = ?, updated_at = ? WHERE id = ?`).run(JSON.stringify(context), nowIso2(), id));
-    },
-    createRunNode(input) {
-      const id = randomUUID();
-      retryBusy(() => db.query(`INSERT INTO run_nodes (id, run_id, node_id, status, attempts, lane)
-             VALUES (?, ?, ?, 'pending', 0, ?)`).run(id, input.runId, input.nodeId, input.lane ?? null));
-      return this.getRunNode(id);
-    },
-    getRunNode(id) {
-      const row = retryBusy(() => db.query(`SELECT * FROM run_nodes WHERE id = ?`).get(id));
-      return row ? rowToNode(row) : undefined;
-    },
-    listRunNodes(runId) {
-      const rows = retryBusy(() => db.query(`SELECT * FROM run_nodes WHERE run_id = ? ORDER BY rowid ASC`).all(runId));
-      return rows.map((r) => rowToNode(r));
-    },
-    getLatestRunNode(runId, nodeId) {
-      const row = retryBusy(() => db.query(`SELECT * FROM run_nodes WHERE run_id = ? AND node_id = ? ORDER BY rowid DESC LIMIT 1`).get(runId, nodeId));
-      return row ? rowToNode(row) : undefined;
-    },
-    setRunNodeStatus(id, status, patch = {}) {
-      const now = nowIso2();
-      const existing = this.getRunNode(id);
-      if (!existing)
-        return;
-      const exitCode = patch.exitCode !== undefined ? patch.exitCode : existing.exitCode;
-      const outputJson = patch.output !== undefined ? JSON.stringify(patch.output) : existing.outputJson;
-      const error = patch.error !== undefined ? patch.error : existing.error;
-      const startedAt = patch.startedAt !== undefined ? patch.startedAt : status === "running" && existing.startedAt === null ? now : existing.startedAt;
-      const terminal = status === "completed" || status === "failed" || status === "skipped";
-      const finishedAt = patch.finishedAt !== undefined ? patch.finishedAt : terminal && existing.finishedAt === null ? now : existing.finishedAt;
-      retryBusy(() => db.query(`UPDATE run_nodes SET status = ?, exit_code = ?, output_json = ?, error = ?, started_at = ?, finished_at = ? WHERE id = ?`).run(status, exitCode, outputJson, error, startedAt, finishedAt, id));
-    },
-    bumpAttemptsNode(id) {
-      retryBusy(() => db.query(`UPDATE run_nodes SET attempts = attempts + 1 WHERE id = ?`).run(id));
-    },
-    memoPut(key, graphName, nodeId, inputHash2, outputJson) {
-      retryBusy(() => db.query(`INSERT INTO memos (key, graph_name, node_id, input_hash, output_json, hit_count, created_at)
-             VALUES (?, ?, ?, ?, ?, 0, ?)
-             ON CONFLICT(key) DO UPDATE SET output_json = excluded.output_json`).run(key, graphName, nodeId, inputHash2, outputJson, nowIso2()));
-    },
-    memoGet(key) {
-      const row = retryBusy(() => db.query(`SELECT * FROM memos WHERE key = ?`).get(key));
-      return row ? rowToMemo(row) : undefined;
-    },
-    memoHit(key) {
-      retryBusy(() => db.query(`UPDATE memos SET hit_count = hit_count + 1 WHERE key = ?`).run(key));
-    },
-    memoList() {
-      const rows = retryBusy(() => db.query(`SELECT * FROM memos ORDER BY created_at DESC LIMIT 1000`).all());
-      return rows.map((r) => rowToMemo(r));
+      return {
+        kind: "grok",
+        sdk: "no npm SDK (measured 2026-08-25)",
+        wired: false,
+        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
+      };
     },
-    memoClear() {
-      retryBusy(() => db.exec(`DELETE FROM memos`));
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const cliPath = deps.cliPath ?? "grok";
+      try {
+        const result = await spawnCli([cliPath, job.prompt], {
+          binaryName: cliPath,
+          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
+          timeoutMs,
+          env: job.env,
+          cwd: job.cwd
+        });
+        return { ...result, durationMs: Date.now() - started };
+      } catch (err) {
+        if (err instanceof LaneDependencyMissingError) {
+          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+        }
+        throw err;
+      }
     }
   };
 }
+var init_grok = __esm(() => {
+  init_types();
+});
 
-// src/wal.ts
-import { createHash as createHash2 } from "crypto";
-import { appendFileSync, existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync } from "fs";
-import { join as join3 } from "path";
-var WAL_FILE_NAME = "session.wal";
-var SESSIONS_DIR_NAME = "sessions";
-var MAX_WAL_BYTES = 256 * 1024 * 1024;
-function checksumOf(op) {
-  if (op === undefined || op === null)
-    return "";
-  return createHash2("sha256").update(JSON.stringify(op)).digest("hex");
+// src/lanes/index.ts
+var exports_lanes = {};
+__export(exports_lanes, {
+  runLaneJob: () => runLaneJob,
+  resolveLane: () => resolveLane,
+  probeLane: () => probeLane,
+  laneInventory: () => laneInventory,
+  createGrokAdapter: () => createGrokAdapter,
+  createCursorAdapter: () => createCursorAdapter,
+  createCodexAdapter: () => createCodexAdapter,
+  createClaudeAdapter: () => createClaudeAdapter,
+  binaryOnPath: () => binaryOnPath,
+  LaneDependencyMissingError: () => LaneDependencyMissingError,
+  LaneAdapterShapeError: () => LaneAdapterShapeError,
+  LANE_KINDS: () => LANE_KINDS2
+});
+function resolveLane(kind) {
+  const adapter = adapters.get(kind);
+  if (!adapter)
+    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
+  return adapter;
 }
-
-class SessionWAL {
-  filePath;
-  constructor(filePath) {
-    this.filePath = filePath;
-  }
-  static open(dataDir) {
-    mkdirSync2(join3(dataDir, SESSIONS_DIR_NAME), { recursive: true });
-    const canonical = join3(dataDir, SESSIONS_DIR_NAME, WAL_FILE_NAME);
-    const legacy = join3(dataDir, WAL_FILE_NAME);
-    if (existsSync(legacy) && !existsSync(canonical)) {
-      try {
-        renameSync(legacy, canonical);
-      } catch {
-        return new SessionWAL(legacy);
-      }
-    }
-    return new SessionWAL(canonical);
-  }
-  static openAt(filePath) {
-    return new SessionWAL(filePath);
-  }
-  append(op) {
-    const at = op.at ?? new Date().toISOString();
-    const full = { ...op, at };
-    const nextSeq = this.nextSeq();
-    const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
-    appendFileSync(this.filePath, JSON.stringify(entry) + `
-`, "utf8");
-    return entry;
-  }
-  nextSeq() {
-    const replay = this.replay();
-    return replay.entries.length + 1;
-  }
-  replay() {
-    const entries = [];
-    let torn = false;
-    let repaired = false;
-    let content;
-    try {
-      content = readFileSync2(this.filePath, "utf8");
-    } catch {
-      return { entries, torn, repaired, liveClaims: () => new Map };
-    }
-    if (content.length > MAX_WAL_BYTES) {
-      throw new Error(`session WAL exceeds ${MAX_WAL_BYTES} bytes; refusing to replay a truncated journal`);
-    }
-    if (content === "") {
-      return { entries, torn, repaired, liveClaims: () => new Map };
-    }
-    const lines = content.split(`
-`);
-    let badOffset = null;
-    let expectedSeq = 1;
-    for (let i = 0;i < lines.length; i++) {
-      const line = lines[i];
-      if (line === "")
-        continue;
-      if (badOffset !== null)
-        break;
-      const lineOffset = cumulativeOffset(lines, i);
-      let entry;
-      try {
-        entry = JSON.parse(line);
-      } catch {
-        badOffset = lineOffset;
-        break;
-      }
-      if (typeof entry?.seq !== "number" || entry.seq !== expectedSeq || entry.checksum !== checksumOf(entry.op)) {
-        badOffset = lineOffset;
-        break;
-      }
-      entries.push(entry);
-      expectedSeq++;
-    }
-    if (badOffset !== null) {
-      torn = true;
-      try {
-        truncateSync(this.filePath, badOffset);
-        repaired = true;
-      } catch {}
-    }
-    return {
-      entries,
-      torn,
-      repaired,
-      liveClaims: (nowMs) => reconstructLiveClaims(entries, nowMs)
-    };
-  }
-  close() {}
+async function runLaneJob(job) {
+  return resolveLane(job.lane).run(job);
 }
-function cumulativeOffset(lines, index) {
-  let offset = 0;
-  for (let i = 0;i < index; i++) {
-    offset += Buffer.byteLength(lines[i]) + 1;
-  }
-  return offset;
+async function probeLane(kind) {
+  return resolveLane(kind).probe();
 }
-function reconstructLiveClaims(entries, nowMs = Date.now()) {
-  const claims = new Map;
-  for (const entry of entries) {
-    const op = entry.op;
-    if (op.op === "claim_acquired") {
-      claims.set(op.runId, { worker: op.worker, fencing: op.fencing, expiresAtMs: Date.parse(op.expiresAt) });
-    } else if (op.op === "claim_released") {
-      const existing = claims.get(op.runId);
-      if (existing && existing.fencing === op.fencing) {
-        claims.delete(op.runId);
-      }
-    }
-  }
-  for (const [runId, claim] of claims) {
-    if (claim.expiresAtMs <= nowMs)
-      claims.delete(runId);
-  }
-  return claims;
+async function laneInventory() {
+  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
 }
+var adapters;
+var init_lanes = __esm(() => {
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  init_types();
+  init_types();
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  adapters = new Map([
+    ["claude", createClaudeAdapter()],
+    ["codex", createCodexAdapter()],
+    ["cursor", createCursorAdapter()],
+    ["grok", createGrokAdapter()]
+  ]);
+});
 
 // src/agent-tools.ts
+init_graph();
+init_lanes();
+
+// src/tool-definitions.ts
 function textResult(payload) {
   return { content: [{ type: "text", text: JSON.stringify(payload) }], isError: false };
 }
 function workflowsTools(_service) {
-  return [
+  const tools = [
     {
       name: "workflows_version",
       description: "Report the installed @hasna/workflows version.",
@@ -1981,7 +1125,7 @@ function workflowsTools(_service) {
     },
     {
       name: "workflows_ready",
-      description: "Report the workflows service readiness (version check).",
+      description: "Report the hosted workflows service readiness.",
       inputSchema: { type: "object", properties: {} }
     },
     {
@@ -2000,14 +1144,16 @@ function workflowsTools(_service) {
         type: "object",
         properties: {
           graph: { type: "object", description: "the workflow graph" },
-          context: { type: "object", description: "optional run context" }
+          context: { type: "object", description: "optional run context" },
+          idempotencyKey: { type: "string", description: "stable request key" },
+          maxCycles: { type: "integer", minimum: 1, maximum: 2000 }
         },
-        required: ["graph"]
+        required: ["graph", "idempotencyKey"]
       }
     },
     {
       name: "workflows_runs_list",
-      description: "List recent runs from the local store.",
+      description: "List recent runs from the configured hosted service.",
       inputSchema: {
         type: "object",
         properties: {
@@ -2022,7 +1168,13 @@ function workflowsTools(_service) {
       inputSchema: { type: "object", properties: {} }
     }
   ];
+  return tools.map((tool) => ({ ...tool, inputSchema: { ...tool.inputSchema, properties: {
+    ...tool.inputSchema.properties,
+    agent: { type: "string", description: "calling agent identity" }
+  } } }));
 }
+
+// src/agent-tools.ts
 async function callWorkflowTool(service, name, args) {
   switch (name) {
     case "workflows_version":
@@ -2030,42 +1182,26 @@ async function callWorkflowTool(service, name, args) {
     case "workflows_health":
       return textResult(service.health());
     case "workflows_ready":
-      return textResult(service.ready());
+      return textResult(await service.ready());
     case "workflows_validate": {
       const graph = args.graph;
       const result = validateGraph(graph);
       return textResult(result);
     }
-    case "workflows_run": {
-      const graph = args.graph;
-      const store = openStore(service.config.dataDir);
-      const wal = SessionWAL.open(service.config.dataDir);
-      try {
-        const final = await runGraphToCompletion(store, wal, graph, args.context ?? {});
-        return textResult({
-          runId: final.id,
-          status: final.status,
-          error: final.error ?? null,
-          result: final.resultJson ? JSON.parse(final.resultJson) : null
-        });
-      } finally {
-        store.close();
-      }
-    }
-    case "workflows_runs_list": {
-      const store = openStore(service.config.dataDir);
-      try {
-        const status = typeof args.status === "string" ? args.status : undefined;
-        const limit = typeof args.limit === "number" ? args.limit : 100;
-        return textResult(store.listRuns({ status, limit }));
-      } finally {
-        store.close();
-      }
-    }
+    case "workflows_run":
+      return textResult(await service.triggerRun(args.graph, args.context ?? {}, {
+        idempotencyKey: typeof args.idempotencyKey === "string" ? args.idempotencyKey : undefined,
+        maxCycles: typeof args.maxCycles === "number" ? args.maxCycles : undefined
+      }));
+    case "workflows_runs_list":
+      return textResult(await service.listRuns({
+        status: typeof args.status === "string" ? args.status : undefined,
+        limit: typeof args.limit === "number" ? args.limit : 100
+      }));
     case "workflows_lanes_list":
       return textResult(await laneInventory());
     default:
-      throw new Error(`Unknown tool: ${name}`);
+      throw new Error("Unknown workflows tool");
   }
 }
 export {