@hasna/workflows 0.2.0 → 0.2.1

package/dist/service.js

@@ -16,603 +16,7 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// src/lanes/types.ts
-import { statSync as statSync2 } from "fs";
-function binaryOnPath(binary) {
-  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
-  for (const entry of pathEntries) {
-    try {
-      const stat = statSync2(`${entry}/${binary}`);
-      if (stat.isFile())
-        return true;
-    } catch {}
-  }
-  return false;
-}
-function subscriptionEnvironment(overrides = {}) {
-  const paid = /^(OPENAI_API_KEY|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CODEX_API_KEY|CURSOR_API_KEY)$/;
-  const sensitive = /(?:API[_-]?KEY|SECRET|PASSWORD|TOKEN|DATABASE_URL|CREDENTIAL)/i;
-  const env = {};
-  for (const [name, value] of Object.entries(process.env)) {
-    if (value !== undefined && !paid.test(name) && (!sensitive.test(name) || name === "CLAUDE_CODE_OAUTH_TOKEN"))
-      env[name] = value;
-  }
-  for (const [name, value] of Object.entries(overrides)) {
-    if (paid.test(name) || sensitive.test(name))
-      throw new Error(`lane environment field ${name} requires a supported scoped credential consumer`);
-    env[name] = value;
-  }
-  return env;
-}
-function subscriptionSdkEnvironment(overrides = {}) {
-  const safe = subscriptionEnvironment(overrides);
-  return { ...Object.fromEntries(Object.keys(process.env).map((name) => [name, undefined])), ...safe };
-}
-function withTimeout(promise, timeoutMs, what, cancel) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      cancel?.();
-      reject(new LaneTimeoutError(what, timeoutMs));
-    }, timeoutMs);
-    promise.then((value) => {
-      clearTimeout(timer);
-      resolve(value);
-    }, (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-  });
-}
-async function spawnCli(cmd, opts) {
-  const started = Date.now();
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-  let proc;
-  try {
-    proc = Bun.spawn({
-      cmd,
-      cwd: opts.cwd,
-      env: subscriptionEnvironment(opts.env),
-      stdin: "ignore",
-      stdout: "pipe",
-      stderr: "pipe",
-      timeout: timeoutMs
-    });
-  } catch (err) {
-    const message = String(err instanceof Error ? err.message : err);
-    if (message.includes("ENOENT") || /not found/i.test(message)) {
-      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
-    }
-    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
-  }
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited
-  ]);
-  const output = stderr ? `${stdout}
-${stderr}`.trim() : stdout.trim();
-  return { ok: exitCode === 0, exitCode, output, durationMs: Date.now() - started };
-}
-var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000, LaneTimeoutError;
-var init_types = __esm(() => {
-  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
-  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "LaneDependencyMissingError";
-    }
-  };
-  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "LaneAdapterShapeError";
-    }
-  };
-  LaneTimeoutError = class LaneTimeoutError extends Error {
-    constructor(what, timeoutMs) {
-      super(`${what} exceeded the ${timeoutMs}ms budget`);
-      this.name = "LaneTimeoutError";
-    }
-  };
-});
-
-// src/lanes/claude.ts
-function createClaudeAdapter(deps = {}) {
-  return {
-    kind: "claude",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
-      try {
-        await loader();
-        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "claude")) {
-          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "claude",
-          sdk: "@anthropic-ai/claude-agent-sdk",
-          wired: false,
-          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch (err) {
-        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
-      }
-      const query = sdk.query;
-      if (typeof query !== "function") {
-        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
-      }
-      const prompt = job.prompt;
-      const abortController = new AbortController;
-      try {
-        const { output, isError } = await withTimeout((async () => {
-          const generator = await query({
-            prompt,
-            options: { model: job.model, cwd: job.cwd, maxTurns: 32, abortController, env: subscriptionSdkEnvironment(job.env) }
-          });
-          let output2 = "";
-          let isError2 = false;
-          for await (const message of generator) {
-            if (message.type === "assistant") {
-              const content = message.message?.content;
-              if (Array.isArray(content)) {
-                for (const block of content) {
-                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
-                    output2 += block.text;
-                  }
-                }
-              }
-            }
-            if (message.type === "error")
-              isError2 = true;
-          }
-          return { output: output2, isError: isError2 };
-        })(), timeoutMs, "claude lane", () => abortController.abort());
-        const durationMs = Date.now() - started;
-        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
-      } catch (err) {
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
-      }
-    }
-  };
-}
-async function runClaudeCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = await spawnCli([cliPath, "-p", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-    }
-    throw err;
-  }
-}
-var init_claude = __esm(() => {
-  init_types();
-});
-
-// src/lanes/codex.ts
-function createCodexAdapter(deps = {}) {
-  return {
-    kind: "codex",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
-      try {
-        await loader();
-        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "codex")) {
-          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "codex",
-          sdk: "@openai/codex-sdk",
-          wired: false,
-          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch {
-        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
-      }
-      const CodexClass = sdk.Codex;
-      if (typeof CodexClass !== "function") {
-        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
-      }
-      const abortController = new AbortController;
-      try {
-        const client = await withTimeout(Promise.resolve(new CodexClass({
-          config: { model: job.model },
-          env: subscriptionEnvironment(job.env)
-        })), timeoutMs, "codex lane");
-        const thread = client.startThread?.({ model: job.model, workingDirectory: job.cwd });
-        if (!thread || typeof thread.run !== "function") {
-          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
-        }
-        const turn = await withTimeout(thread.run(job.prompt, { signal: abortController.signal }), timeoutMs, "codex lane", () => abortController.abort());
-        const output = turn?.finalResponse ?? "";
-        const durationMs = Date.now() - started;
-        return { ok: true, exitCode: 0, output, durationMs };
-      } catch (err) {
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
-      }
-    }
-  };
-}
-async function runCodexCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = await spawnCli([cliPath, "exec", "--", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@openai/codex-sdk or the codex CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-    }
-    throw err;
-  }
-}
-var init_codex = __esm(() => {
-  init_types();
-});
-
-// src/lanes/cursor.ts
-function createCursorAdapter(deps = {}) {
-  return {
-    kind: "cursor",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
-      try {
-        await loader();
-        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
-          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "cursor",
-          sdk: "@cursor/sdk",
-          wired: false,
-          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
-      }
-      if (!deps.sdkLoader && binaryOnPath(deps.cliPath ?? "cursor-agent"))
-        return runCursorCli(job, deps.cliPath ?? "cursor-agent", Date.now(), job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS);
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch {
-        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
-      }
-      let cancel;
-      try {
-        subscriptionEnvironment(job.env);
-        if (!deps.sdkLoader && process.env.CURSOR_API_KEY)
-          throw new Error("cursor lane refuses ambient API billing; use the native subscription CLI");
-        const run2 = await withTimeout(runLocalAgent(sdk, job, (callback) => {
-          cancel = callback;
-        }), timeoutMs, "cursor lane", () => cancel?.());
-        const durationMs = Date.now() - started;
-        const status = run2.status;
-        const ok = status === "finished";
-        return { ok, exitCode: ok ? 0 : 1, output: run2.result, durationMs };
-      } catch (err) {
-        if (err instanceof LaneAdapterShapeError)
-          throw err;
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
-      }
-    }
-  };
-}
-async function runLocalAgent(sdk, job, onCancel) {
-  const AgentClass = sdk.Agent;
-  const CursorClass = sdk.Cursor;
-  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
-    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
-  }
-  const create = AgentClass.create;
-  const agent = typeof create === "function" ? await create.call(AgentClass, { local: { cwd: job.cwd, enableAgentRetries: false } }) : typeof AgentClass === "function" ? new AgentClass : undefined;
-  if (!agent || typeof agent.send !== "function") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
-  }
-  let run2 = await agent.send(job.prompt, { model: job.model });
-  if (run2 && typeof run2 === "object") {
-    const handle = run2;
-    if (typeof handle.cancel === "function")
-      onCancel(() => {
-        handle.cancel().catch(() => {});
-      });
-    if (typeof handle.wait === "function")
-      run2 = await handle.wait();
-  }
-  if (!run2 || typeof run2 !== "object") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
-  }
-  const candidate = run2;
-  if (typeof candidate.status !== "string" || !["finished", "error", "cancelled"].includes(candidate.status)) {
-    throw new LaneAdapterShapeError(`@cursor/sdk Agent.send() returned a Run without a terminal status (got ${JSON.stringify(candidate.status)}; expected finished|error|cancelled)`);
-  }
-  if (typeof candidate.result !== "string") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned a Run without a string result");
-  }
-  return { status: candidate.status, result: candidate.result };
-}
-async function runCursorCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = await spawnCli([cliPath, "--print", job.prompt, ...job.model ? ["--model", job.model] : []], {
-      binaryName: cliPath,
-      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-    }
-    throw err;
-  }
-}
-var init_cursor = __esm(() => {
-  init_types();
-});
-
-// src/lanes/grok.ts
-function createGrokAdapter(deps = {}) {
-  return {
-    kind: "grok",
-    async probe() {
-      const cliPath = deps.cliPath ?? "grok";
-      if (binaryOnPath(cliPath)) {
-        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
-      }
-      return {
-        kind: "grok",
-        sdk: "no npm SDK (measured 2026-08-25)",
-        wired: false,
-        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
-      };
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const cliPath = deps.cliPath ?? "grok";
-      try {
-        const result = await spawnCli([cliPath, job.prompt], {
-          binaryName: cliPath,
-          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
-          timeoutMs,
-          env: job.env,
-          cwd: job.cwd
-        });
-        return { ...result, durationMs: Date.now() - started };
-      } catch (err) {
-        if (err instanceof LaneDependencyMissingError) {
-          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-        }
-        throw err;
-      }
-    }
-  };
-}
-var init_grok = __esm(() => {
-  init_types();
-});
-
-// src/lanes/index.ts
-var exports_lanes = {};
-__export(exports_lanes, {
-  runLaneJob: () => runLaneJob,
-  resolveLane: () => resolveLane,
-  probeLane: () => probeLane,
-  laneInventory: () => laneInventory,
-  createGrokAdapter: () => createGrokAdapter,
-  createCursorAdapter: () => createCursorAdapter,
-  createCodexAdapter: () => createCodexAdapter,
-  createClaudeAdapter: () => createClaudeAdapter,
-  binaryOnPath: () => binaryOnPath,
-  LaneDependencyMissingError: () => LaneDependencyMissingError,
-  LaneAdapterShapeError: () => LaneAdapterShapeError,
-  LANE_KINDS: () => LANE_KINDS2
-});
-function resolveLane(kind) {
-  const adapter = adapters.get(kind);
-  if (!adapter)
-    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
-  return adapter;
-}
-async function runLaneJob(job) {
-  return resolveLane(job.lane).run(job);
-}
-async function probeLane(kind) {
-  return resolveLane(kind).probe();
-}
-async function laneInventory() {
-  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
-}
-var adapters;
-var init_lanes = __esm(() => {
-  init_claude();
-  init_codex();
-  init_cursor();
-  init_grok();
-  init_types();
-  init_types();
-  init_claude();
-  init_codex();
-  init_cursor();
-  init_grok();
-  adapters = new Map([
-    ["claude", createClaudeAdapter()],
-    ["codex", createCodexAdapter()],
-    ["cursor", createCursorAdapter()],
-    ["grok", createGrokAdapter()]
-  ]);
-});
-
-// src/service.ts
-import { createHash as createHash3 } from "crypto";
-// package.json
-var package_default = {
-  name: "@hasna/workflows",
-  version: "0.2.0",
-  description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
-  type: "module",
-  main: "./dist/index.js",
-  types: "./types/index.d.ts",
-  bin: {
-    workflows: "dist/cli/index.js",
-    "workflows-mcp": "dist/mcp/index.js",
-    "workflows-serve": "dist/serve/index.js"
-  },
-  exports: {
-    ".": {
-      types: "./types/index.d.ts",
-      import: "./dist/index.js"
-    },
-    "./sdk": {
-      types: "./types/sdk.d.ts",
-      import: "./dist/sdk.js"
-    },
-    "./cli": {
-      types: "./types/cli/index.d.ts",
-      import: "./dist/cli/index.js"
-    }
-  },
-  files: [
-    "dist",
-    "types",
-    "README.md",
-    "LICENSE",
-    "hasna.contract.json"
-  ],
-  scripts: {
-    build: "bun run check:sdk && bun run build:runtime && bun run build:types",
-    "generate:sdk": "bun scripts/generate-sdk.ts --write",
-    "check:sdk": "bun scripts/generate-sdk.ts",
-    "test:artifacts": "bun scripts/artifact-acceptance.ts",
-    "build:runtime": "bun build src/cli/index.ts --outdir dist/cli --target bun && bun build src/mcp/index.ts --outdir dist/mcp --target bun && bun build src/serve/index.ts src/serve/admin.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external && bun build src/sdk.ts --outdir dist --target node",
-    "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
-    "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
-    "contract:check": "bun scripts/contracts-cli.mjs repo-conformance .",
-    typecheck: "tsc --noEmit",
-    test: "bun test",
-    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a fresh test Postgres database}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/postgres-store.test.ts src/db/postgres-http.test.ts src/db/postgres-fencing.test.ts',
-    prepack: "bun run build && bun run artifact-scan",
-    prepublishOnly: "bun run test && bun run build"
-  },
-  keywords: [
-    "workflows",
-    "graph",
-    "automation",
-    "cli",
-    "typescript",
-    "bun",
-    "hasna"
-  ],
-  publishConfig: {
-    registry: "https://registry.npmjs.org",
-    access: "public"
-  },
-  repository: {
-    type: "git",
-    url: "https://github.com/hasna/apps.git",
-    directory: "apps/workflows"
-  },
-  homepage: "https://github.com/hasna/apps/tree/main/apps/workflows",
-  bugs: {
-    url: "https://github.com/hasna/apps/issues"
-  },
-  engines: {
-    bun: ">=1.0.0"
-  },
-  author: "Hasna",
-  license: "Apache-2.0",
-  dependencies: {
-    "@anthropic-ai/claude-agent-sdk": "0.3.234",
-    "@cursor/sdk": "^1.0.28",
-    "@openai/codex-sdk": "0.147.0",
-    commander: "^13.1.0",
-    "@hasna/contracts": "1.3.3",
-    pg: "^8.16.3"
-  },
-  devDependencies: {
-    "@types/bun": "1.3.14",
-    "@types/pg": "^8.15.6",
-    typescript: "^5.7.3"
-  }
-};
-
-// src/version.ts
-function packageVersion() {
-  return package_default.version;
-}
-
-// src/daemon.ts
-import { randomUUID as randomUUID2 } from "crypto";
-
 // src/expr.ts
-class ExprSyntaxError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ExprSyntaxError";
-  }
-}
-
-class ExprEvalError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ExprEvalError";
-  }
-}
-var COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
 function tokenize(input) {
   const tokens = [];
   let i = 0;
@@ -864,11 +268,24 @@ function evaluateExpr(input, context) {
   }
   return value;
 }
+var ExprSyntaxError, ExprEvalError, COMPARISON_OPS;
+var init_expr = __esm(() => {
+  ExprSyntaxError = class ExprSyntaxError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ExprSyntaxError";
+    }
+  };
+  ExprEvalError = class ExprEvalError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ExprEvalError";
+    }
+  };
+  COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
+});
 
 // src/graph.ts
-var GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
-var LANE_KINDS = ["claude", "codex", "cursor", "grok"];
-var NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
 function issue(issues, path, message) {
   issues.push({ path, message });
 }
@@ -954,216 +371,841 @@ function findCycles(graph) {
         visit(to);
       }
     }
-    stack.pop();
-    color.set(id, "black");
-  }
-  for (const node of graph.nodes) {
-    if (color.get(node.id) === undefined)
-      visit(node.id);
+    stack.pop();
+    color.set(id, "black");
+  }
+  for (const node of graph.nodes) {
+    if (color.get(node.id) === undefined)
+      visit(node.id);
+  }
+  return cycles;
+}
+function validateGraph(graph) {
+  const issues = [];
+  if (graph === null || typeof graph !== "object" || Array.isArray(graph)) {
+    return { ok: false, issues: [{ path: "graph", message: "graph must be an object" }] };
+  }
+  if (typeof graph.name !== "string" || graph.name.trim() === "") {
+    issue(issues, "name", "graph requires a non-empty name");
+  }
+  if (typeof graph.version !== "string" || graph.version.trim() === "") {
+    issue(issues, "version", "graph requires a version string");
+  }
+  if (graph.memoWatch !== undefined) {
+    if (!Array.isArray(graph.memoWatch) || graph.memoWatch.length === 0) {
+      issue(issues, "memoWatch", "memoWatch must be a non-empty array of file paths or globs");
+    } else {
+      for (const entry of graph.memoWatch) {
+        if (typeof entry !== "string" || entry.trim() === "") {
+          issue(issues, "memoWatch", "each memoWatch entry must be a non-empty path or glob string");
+          break;
+        }
+      }
+    }
+  }
+  if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) {
+    issue(issues, "nodes", "graph requires at least one node");
+    return { ok: false, issues };
+  }
+  for (let index = 0;index < graph.nodes.length; index++) {
+    const node = graph.nodes[index];
+    if (node === null || typeof node !== "object" || Array.isArray(node)) {
+      issue(issues, `nodes.${index}`, "node must be an object");
+      continue;
+    }
+    if (!GRAPH_NODE_TYPES.includes(node.type))
+      issue(issues, `nodes.${index}.type`, "type must be start, step, decision, while, or end");
+    for (const key of ["next", "then", "else", "prompt", "command"]) {
+      const value = node[key];
+      if (value !== undefined && (typeof value !== "string" || value.trim() === ""))
+        issue(issues, `nodes.${index}.${key}`, `${key} must be a non-empty string`);
+    }
+    if (node.type === "while" && (!Array.isArray(node.body) || node.body.some((id) => typeof id !== "string")))
+      issue(issues, `nodes.${index}.body`, "body must be an array of node ids");
+  }
+  if (issues.length)
+    return { ok: false, issues };
+  const starts = graph.nodes.filter((n) => n.type === "start");
+  if (starts.length === 0)
+    issue(issues, "nodes", "graph requires exactly one start node (found none)");
+  if (starts.length > 1)
+    issue(issues, "nodes", "graph requires exactly one start node (found multiple)");
+  const ends = graph.nodes.filter((n) => n.type === "end");
+  if (ends.length === 0)
+    issue(issues, "nodes", "graph requires at least one end node");
+  const seenIds = new Map;
+  for (const node of graph.nodes) {
+    if (typeof node.id !== "string" || !NODE_ID_RE.test(node.id)) {
+      issue(issues, "nodes", `node id ${JSON.stringify(node.id)} must match ${String(NODE_ID_RE)}`);
+      continue;
+    }
+    if (seenIds.has(node.id)) {
+      issue(issues, `nodes.${node.id}`, `duplicate node id ${node.id}`);
+      continue;
+    }
+    seenIds.set(node.id, node);
+    if (!GRAPH_NODE_TYPES.includes(node.type)) {
+      issue(issues, `nodes.${node.id}`, `unknown node type ${JSON.stringify(node.type)}`);
+      continue;
+    }
+    validateNode(graph, node, issues);
+  }
+  for (const node of graph.nodes) {
+    const edges = nodeEdges(node);
+    for (const { kind, target } of edges) {
+      if (!seenIds.has(target)) {
+        issue(issues, `nodes.${node.id}`, `${kind} edge targets nonexistent node ${target}`);
+      }
+    }
+  }
+  if (starts.length === 1) {
+    const reachable = new Set(reachableNodes(graph));
+    for (const node of graph.nodes) {
+      if (!reachable.has(node.id)) {
+        issue(issues, `nodes.${node.id}`, `node ${node.id} is unreachable from start`);
+      }
+    }
+  }
+  const cycles = findCycles(graph);
+  for (const cycle of cycles) {
+    issue(issues, "nodes", `explicit cycle detected: ${cycle.join(" -> ")} (loop only via a while node)`);
+  }
+  return { ok: issues.length === 0, issues };
+}
+function nodeEdges(node) {
+  switch (node.type) {
+    case "start":
+    case "step":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "decision":
+      return [
+        ...node.then ? [{ kind: "then", target: node.then }] : [],
+        ...node.else ? [{ kind: "else", target: node.else }] : []
+      ];
+    case "while":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "end":
+      return [];
+    default:
+      return [];
+  }
+}
+function validateNode(graph, node, issues) {
+  switch (node.type) {
+    case "start":
+      if (!node.next)
+        issue(issues, `nodes.${node.id}`, "start node requires a next edge");
+      break;
+    case "step": {
+      if (!node.prompt && !node.command) {
+        issue(issues, `nodes.${node.id}`, "step node requires prompt or command");
+      }
+      if (node.lane !== undefined && !LANE_KINDS.includes(node.lane)) {
+        issue(issues, `nodes.${node.id}`, `unknown lane ${JSON.stringify(node.lane)} (expected one of ${LANE_KINDS.join(", ")})`);
+      }
+      if (node.cwd !== undefined && (typeof node.cwd !== "string" || !node.cwd.trim() || node.cwd.includes("\x00"))) {
+        issue(issues, `nodes.${node.id}.cwd`, "cwd must be a non-empty path string without NUL characters on the executor");
+      }
+      if (node.codexMode !== undefined) {
+        if (!CODEX_EXECUTION_MODES.includes(node.codexMode)) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode must be repository or read-only");
+        } else if (node.lane !== "codex" || !node.prompt || node.command !== undefined) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode is supported only for a codex prompt step without command");
+        }
+      }
+      if (node.maxRetries !== undefined && (!Number.isInteger(node.maxRetries) || node.maxRetries < 0)) {
+        issue(issues, `nodes.${node.id}`, "maxRetries must be a non-negative integer");
+      }
+      if (node.timeoutMs !== undefined && (!Number.isInteger(node.timeoutMs) || node.timeoutMs < 1)) {
+        issue(issues, `nodes.${node.id}`, "timeoutMs must be a positive integer");
+      }
+      break;
+    }
+    case "decision": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "decision node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (!node.then && !node.else) {
+        issue(issues, `nodes.${node.id}`, "decision node requires then and/or else edge");
+      }
+      break;
+    }
+    case "while": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "while node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (node.maxIterations === undefined) {
+        issue(issues, `nodes.${node.id}`, "while node requires maxIterations (finite loop bound)");
+      } else if (!Number.isInteger(node.maxIterations) || node.maxIterations < 1) {
+        issue(issues, `nodes.${node.id}`, "maxIterations must be a positive integer");
+      }
+      if (!Array.isArray(node.body) || node.body.length === 0) {
+        issue(issues, `nodes.${node.id}`, "while node requires a non-empty body");
+      } else {
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode) {
+            issue(issues, `nodes.${node.id}`, `while body references nonexistent node ${bodyId}`);
+            continue;
+          }
+          if (bodyNode.type === "start" || bodyNode.type === "end" || bodyNode.type === "while") {
+            issue(issues, `nodes.${node.id}`, `while body may only contain step/decision nodes in v1 (found ${bodyNode.type})`);
+          }
+        }
+        const bodySet = new Set(node.body);
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode)
+            continue;
+          for (const { kind, target } of nodeEdges(bodyNode)) {
+            if (!bodySet.has(target)) {
+              issue(issues, `nodes.${node.id}`, `while body node ${bodyId} ${kind}-edge leaves the body (target ${target})`);
+            }
+          }
+        }
+      }
+      break;
+    }
+    case "end":
+      break;
   }
-  return cycles;
 }
-function validateGraph(graph) {
-  const issues = [];
-  if (graph === null || typeof graph !== "object" || Array.isArray(graph)) {
-    return { ok: false, issues: [{ path: "graph", message: "graph must be an object" }] };
+var GRAPH_NODE_TYPES, LANE_KINDS, CODEX_EXECUTION_MODES, NODE_ID_RE;
+var init_graph = __esm(() => {
+  init_expr();
+  GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
+  LANE_KINDS = ["claude", "codex", "cursor", "grok"];
+  CODEX_EXECUTION_MODES = ["repository", "read-only"];
+  NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+});
+
+// src/lanes/types.ts
+import { statSync as statSync2 } from "fs";
+function binaryOnPath(binary) {
+  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
+  for (const entry of pathEntries) {
+    try {
+      const stat = statSync2(`${entry}/${binary}`);
+      if (stat.isFile())
+        return true;
+    } catch {}
   }
-  if (typeof graph.name !== "string" || graph.name.trim() === "") {
-    issue(issues, "name", "graph requires a non-empty name");
+  return false;
+}
+function subscriptionEnvironment(overrides = {}) {
+  const paid = /^(OPENAI_API_KEY|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CODEX_API_KEY|CURSOR_API_KEY)$/;
+  const sensitive = /(?:API[_-]?KEY|SECRET|PASSWORD|TOKEN|DATABASE_URL|CREDENTIAL)/i;
+  const env = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (value !== undefined && !paid.test(name) && (!sensitive.test(name) || name === "CLAUDE_CODE_OAUTH_TOKEN"))
+      env[name] = value;
   }
-  if (typeof graph.version !== "string" || graph.version.trim() === "") {
-    issue(issues, "version", "graph requires a version string");
+  for (const [name, value] of Object.entries(overrides)) {
+    if (paid.test(name) || sensitive.test(name))
+      throw new Error(`lane environment field ${name} requires a supported scoped credential consumer`);
+    env[name] = value;
   }
-  if (graph.memoWatch !== undefined) {
-    if (!Array.isArray(graph.memoWatch) || graph.memoWatch.length === 0) {
-      issue(issues, "memoWatch", "memoWatch must be a non-empty array of file paths or globs");
-    } else {
-      for (const entry of graph.memoWatch) {
-        if (typeof entry !== "string" || entry.trim() === "") {
-          issue(issues, "memoWatch", "each memoWatch entry must be a non-empty path or glob string");
-          break;
-        }
-      }
+  return env;
+}
+function subscriptionSdkEnvironment(overrides = {}) {
+  const safe = subscriptionEnvironment(overrides);
+  return { ...Object.fromEntries(Object.keys(process.env).map((name) => [name, undefined])), ...safe };
+}
+function withTimeout(promise, timeoutMs, what, cancel) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      cancel?.();
+      reject(new LaneTimeoutError(what, timeoutMs));
+    }, timeoutMs);
+    promise.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+async function spawnCli(cmd, opts) {
+  const started = Date.now();
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+  let proc;
+  try {
+    proc = Bun.spawn({
+      cmd,
+      cwd: opts.cwd,
+      env: subscriptionEnvironment(opts.env),
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: timeoutMs
+    });
+  } catch (err) {
+    const message = String(err instanceof Error ? err.message : err);
+    if (message.includes("ENOENT") || /not found/i.test(message)) {
+      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
     }
+    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
   }
-  if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) {
-    issue(issues, "nodes", "graph requires at least one node");
-    return { ok: false, issues };
-  }
-  for (let index = 0;index < graph.nodes.length; index++) {
-    const node = graph.nodes[index];
-    if (node === null || typeof node !== "object" || Array.isArray(node)) {
-      issue(issues, `nodes.${index}`, "node must be an object");
-      continue;
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  const output = opts.stdoutOnly ? stdout.trim() : stderr ? `${stdout}
+${stderr}`.trim() : stdout.trim();
+  return {
+    ok: exitCode === 0,
+    exitCode,
+    output,
+    durationMs: Date.now() - started,
+    ...opts.stdoutOnly && exitCode !== 0 && stderr.trim() ? { error: stderr.trim() } : {}
+  };
+}
+var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000, LaneTimeoutError;
+var init_types = __esm(() => {
+  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
+  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneDependencyMissingError";
     }
-    if (!GRAPH_NODE_TYPES.includes(node.type))
-      issue(issues, `nodes.${index}.type`, "type must be start, step, decision, while, or end");
-    for (const key of ["next", "then", "else", "prompt", "command"]) {
-      const value = node[key];
-      if (value !== undefined && (typeof value !== "string" || value.trim() === ""))
-        issue(issues, `nodes.${index}.${key}`, `${key} must be a non-empty string`);
+  };
+  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneAdapterShapeError";
     }
-    if (node.type === "while" && (!Array.isArray(node.body) || node.body.some((id) => typeof id !== "string")))
-      issue(issues, `nodes.${index}.body`, "body must be an array of node ids");
-  }
-  if (issues.length)
-    return { ok: false, issues };
-  const starts = graph.nodes.filter((n) => n.type === "start");
-  if (starts.length === 0)
-    issue(issues, "nodes", "graph requires exactly one start node (found none)");
-  if (starts.length > 1)
-    issue(issues, "nodes", "graph requires exactly one start node (found multiple)");
-  const ends = graph.nodes.filter((n) => n.type === "end");
-  if (ends.length === 0)
-    issue(issues, "nodes", "graph requires at least one end node");
-  const seenIds = new Map;
-  for (const node of graph.nodes) {
-    if (typeof node.id !== "string" || !NODE_ID_RE.test(node.id)) {
-      issue(issues, "nodes", `node id ${JSON.stringify(node.id)} must match ${String(NODE_ID_RE)}`);
-      continue;
+  };
+  LaneTimeoutError = class LaneTimeoutError extends Error {
+    constructor(what, timeoutMs) {
+      super(`${what} exceeded the ${timeoutMs}ms budget`);
+      this.name = "LaneTimeoutError";
     }
-    if (seenIds.has(node.id)) {
-      issue(issues, `nodes.${node.id}`, `duplicate node id ${node.id}`);
-      continue;
+  };
+});
+
+// src/lanes/claude.ts
+function createClaudeAdapter(deps = {}) {
+  return {
+    kind: "claude",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      try {
+        await loader();
+        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "claude")) {
+          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "claude",
+          sdk: "@anthropic-ai/claude-agent-sdk",
+          wired: false,
+          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch (err) {
+        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
+      }
+      const query = sdk.query;
+      if (typeof query !== "function") {
+        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
+      }
+      const prompt = job.prompt;
+      const abortController = new AbortController;
+      try {
+        const { output, isError } = await withTimeout((async () => {
+          const generator = await query({
+            prompt,
+            options: { model: job.model, cwd: job.cwd, maxTurns: 32, abortController, env: subscriptionSdkEnvironment(job.env) }
+          });
+          let output2 = "";
+          let isError2 = false;
+          for await (const message of generator) {
+            if (message.type === "assistant") {
+              const content = message.message?.content;
+              if (Array.isArray(content)) {
+                for (const block of content) {
+                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
+                    output2 += block.text;
+                  }
+                }
+              }
+            }
+            if (message.type === "error")
+              isError2 = true;
+          }
+          return { output: output2, isError: isError2 };
+        })(), timeoutMs, "claude lane", () => abortController.abort());
+        const durationMs = Date.now() - started;
+        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
+      }
     }
-    seenIds.set(node.id, node);
-    if (!GRAPH_NODE_TYPES.includes(node.type)) {
-      issue(issues, `nodes.${node.id}`, `unknown node type ${JSON.stringify(node.type)}`);
-      continue;
+  };
+}
+async function runClaudeCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = await spawnCli([cliPath, "-p", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
     }
-    validateNode(graph, node, issues);
+    throw err;
   }
-  for (const node of graph.nodes) {
-    const edges = nodeEdges(node);
-    for (const { kind, target } of edges) {
-      if (!seenIds.has(target)) {
-        issue(issues, `nodes.${node.id}`, `${kind} edge targets nonexistent node ${target}`);
+}
+var init_claude = __esm(() => {
+  init_types();
+});
+
+// src/lanes/codex.ts
+function createCodexAdapter(deps = {}) {
+  return {
+    kind: "codex",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      try {
+        await loader();
+        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "codex")) {
+          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "codex",
+          sdk: "@openai/codex-sdk",
+          wired: false,
+          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
+        };
       }
-    }
-  }
-  if (starts.length === 1) {
-    const reachable = new Set(reachableNodes(graph));
-    for (const node of graph.nodes) {
-      if (!reachable.has(node.id)) {
-        issue(issues, `nodes.${node.id}`, `node ${node.id} is unreachable from start`);
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
+      }
+      if (job.codexMode !== undefined && (!CODEX_EXECUTION_MODES.includes(job.codexMode) || job.lane !== "codex" || job.command !== undefined)) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codexMode must be repository or read-only on a codex prompt without command", retryable: false };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
+      }
+      const CodexClass = sdk.Codex;
+      if (typeof CodexClass !== "function") {
+        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
+      }
+      const abortController = new AbortController;
+      try {
+        const client = await withTimeout(Promise.resolve(new CodexClass({
+          config: { model: job.model },
+          env: subscriptionEnvironment(job.env)
+        })), timeoutMs, "codex lane");
+        const thread = client.startThread?.({
+          model: job.model,
+          workingDirectory: job.cwd,
+          ...job.codexMode === "read-only" ? { sandboxMode: "read-only", skipGitRepoCheck: true, approvalPolicy: "never" } : {}
+        });
+        if (!thread || typeof thread.run !== "function") {
+          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
+        }
+        const turn = await withTimeout(thread.run(job.prompt, { signal: abortController.signal }), timeoutMs, "codex lane", () => abortController.abort());
+        const durationMs = Date.now() - started;
+        const output = turn?.finalResponse;
+        if (typeof output !== "string" || !output.trim()) {
+          return missingResponse(durationMs);
+        }
+        return { ok: true, exitCode: 0, output, durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
-  }
-  const cycles = findCycles(graph);
-  for (const cycle of cycles) {
-    issue(issues, "nodes", `explicit cycle detected: ${cycle.join(" -> ")} (loop only via a while node)`);
-  }
-  return { ok: issues.length === 0, issues };
+  };
 }
-function nodeEdges(node) {
-  switch (node.type) {
-    case "start":
-    case "step":
-      return node.next ? [{ kind: "next", target: node.next }] : [];
-    case "decision":
-      return [
-        ...node.then ? [{ kind: "then", target: node.then }] : [],
-        ...node.else ? [{ kind: "else", target: node.else }] : []
-      ];
-    case "while":
-      return node.next ? [{ kind: "next", target: node.next }] : [];
-    case "end":
-      return [];
-    default:
-      return [];
+async function runCodexCli(job, cliPath, started, timeoutMs) {
+  try {
+    const controls = job.codexMode === "read-only" ? ["--sandbox", "read-only", "--skip-git-repo-check", "--config", 'approval_policy="never"'] : [];
+    const result = await spawnCli([cliPath, "exec", ...controls, "--", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@openai/codex-sdk or the codex CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd,
+      stdoutOnly: true
+    });
+    const durationMs = Date.now() - started;
+    return result.ok && !result.output.trim() ? missingResponse(durationMs) : { ...result, durationMs };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
   }
 }
-function validateNode(graph, node, issues) {
-  switch (node.type) {
-    case "start":
-      if (!node.next)
-        issue(issues, `nodes.${node.id}`, "start node requires a next edge");
-      break;
-    case "step": {
-      if (!node.prompt && !node.command) {
-        issue(issues, `nodes.${node.id}`, "step node requires prompt or command");
+function missingResponse(durationMs) {
+  return { ok: false, exitCode: 1, output: "", durationMs, error: "Codex completed without an agent response; verify the native subscription and model route", retryable: false };
+}
+var init_codex = __esm(() => {
+  init_graph();
+  init_types();
+});
+
+// src/lanes/cursor.ts
+function createCursorAdapter(deps = {}) {
+  return {
+    kind: "cursor",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      try {
+        await loader();
+        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
+          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "cursor",
+          sdk: "@cursor/sdk",
+          wired: false,
+          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
+        };
       }
-      if (node.lane !== undefined && !LANE_KINDS.includes(node.lane)) {
-        issue(issues, `nodes.${node.id}`, `unknown lane ${JSON.stringify(node.lane)} (expected one of ${LANE_KINDS.join(", ")})`);
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
       }
-      if (node.maxRetries !== undefined && (!Number.isInteger(node.maxRetries) || node.maxRetries < 0)) {
-        issue(issues, `nodes.${node.id}`, "maxRetries must be a non-negative integer");
+      if (!deps.sdkLoader && binaryOnPath(deps.cliPath ?? "cursor-agent"))
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", Date.now(), job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS);
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
       }
-      if (node.timeoutMs !== undefined && (!Number.isInteger(node.timeoutMs) || node.timeoutMs < 1)) {
-        issue(issues, `nodes.${node.id}`, "timeoutMs must be a positive integer");
+      let cancel;
+      try {
+        subscriptionEnvironment(job.env);
+        if (!deps.sdkLoader && process.env.CURSOR_API_KEY)
+          throw new Error("cursor lane refuses ambient API billing; use the native subscription CLI");
+        const run2 = await withTimeout(runLocalAgent(sdk, job, (callback) => {
+          cancel = callback;
+        }), timeoutMs, "cursor lane", () => cancel?.());
+        const durationMs = Date.now() - started;
+        const status = run2.status;
+        const ok = status === "finished";
+        return { ok, exitCode: ok ? 0 : 1, output: run2.result, durationMs };
+      } catch (err) {
+        if (err instanceof LaneAdapterShapeError)
+          throw err;
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
-      break;
     }
-    case "decision": {
-      if (typeof node.condition !== "string" || node.condition.trim() === "") {
-        issue(issues, `nodes.${node.id}`, "decision node requires a condition expression");
-      } else {
-        try {
-          parseExpr(node.condition);
-        } catch (err) {
-          if (err instanceof ExprSyntaxError) {
-            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
-          } else {
-            throw err;
-          }
-        }
-      }
-      if (!node.then && !node.else) {
-        issue(issues, `nodes.${node.id}`, "decision node requires then and/or else edge");
-      }
-      break;
+  };
+}
+async function runLocalAgent(sdk, job, onCancel) {
+  const AgentClass = sdk.Agent;
+  const CursorClass = sdk.Cursor;
+  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
+  }
+  const create = AgentClass.create;
+  const agent = typeof create === "function" ? await create.call(AgentClass, { local: { cwd: job.cwd, enableAgentRetries: false } }) : typeof AgentClass === "function" ? new AgentClass : undefined;
+  if (!agent || typeof agent.send !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
+  }
+  let run2 = await agent.send(job.prompt, { model: job.model });
+  if (run2 && typeof run2 === "object") {
+    const handle = run2;
+    if (typeof handle.cancel === "function")
+      onCancel(() => {
+        handle.cancel().catch(() => {});
+      });
+    if (typeof handle.wait === "function")
+      run2 = await handle.wait();
+  }
+  if (!run2 || typeof run2 !== "object") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
+  }
+  const candidate = run2;
+  if (typeof candidate.status !== "string" || !["finished", "error", "cancelled"].includes(candidate.status)) {
+    throw new LaneAdapterShapeError(`@cursor/sdk Agent.send() returned a Run without a terminal status (got ${JSON.stringify(candidate.status)}; expected finished|error|cancelled)`);
+  }
+  if (typeof candidate.result !== "string") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned a Run without a string result");
+  }
+  return { status: candidate.status, result: candidate.result };
+}
+async function runCursorCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = await spawnCli([cliPath, "--print", job.prompt, ...job.model ? ["--model", job.model] : []], {
+      binaryName: cliPath,
+      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
     }
-    case "while": {
-      if (typeof node.condition !== "string" || node.condition.trim() === "") {
-        issue(issues, `nodes.${node.id}`, "while node requires a condition expression");
-      } else {
-        try {
-          parseExpr(node.condition);
-        } catch (err) {
-          if (err instanceof ExprSyntaxError) {
-            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
-          } else {
-            throw err;
-          }
-        }
+    throw err;
+  }
+}
+var init_cursor = __esm(() => {
+  init_types();
+});
+
+// src/lanes/grok.ts
+function createGrokAdapter(deps = {}) {
+  return {
+    kind: "grok",
+    async probe() {
+      const cliPath = deps.cliPath ?? "grok";
+      if (binaryOnPath(cliPath)) {
+        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
       }
-      if (node.maxIterations === undefined) {
-        issue(issues, `nodes.${node.id}`, "while node requires maxIterations (finite loop bound)");
-      } else if (!Number.isInteger(node.maxIterations) || node.maxIterations < 1) {
-        issue(issues, `nodes.${node.id}`, "maxIterations must be a positive integer");
+      return {
+        kind: "grok",
+        sdk: "no npm SDK (measured 2026-08-25)",
+        wired: false,
+        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
+      };
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
       }
-      if (!Array.isArray(node.body) || node.body.length === 0) {
-        issue(issues, `nodes.${node.id}`, "while node requires a non-empty body");
-      } else {
-        for (const bodyId of node.body) {
-          const bodyNode = findNode(graph, bodyId);
-          if (!bodyNode) {
-            issue(issues, `nodes.${node.id}`, `while body references nonexistent node ${bodyId}`);
-            continue;
-          }
-          if (bodyNode.type === "start" || bodyNode.type === "end" || bodyNode.type === "while") {
-            issue(issues, `nodes.${node.id}`, `while body may only contain step/decision nodes in v1 (found ${bodyNode.type})`);
-          }
-        }
-        const bodySet = new Set(node.body);
-        for (const bodyId of node.body) {
-          const bodyNode = findNode(graph, bodyId);
-          if (!bodyNode)
-            continue;
-          for (const { kind, target } of nodeEdges(bodyNode)) {
-            if (!bodySet.has(target)) {
-              issue(issues, `nodes.${node.id}`, `while body node ${bodyId} ${kind}-edge leaves the body (target ${target})`);
-            }
-          }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const cliPath = deps.cliPath ?? "grok";
+      try {
+        const result = await spawnCli([cliPath, job.prompt], {
+          binaryName: cliPath,
+          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
+          timeoutMs,
+          env: job.env,
+          cwd: job.cwd
+        });
+        return { ...result, durationMs: Date.now() - started };
+      } catch (err) {
+        if (err instanceof LaneDependencyMissingError) {
+          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
         }
+        throw err;
       }
-      break;
     }
-    case "end":
-      break;
+  };
+}
+var init_grok = __esm(() => {
+  init_types();
+});
+
+// src/lanes/index.ts
+var exports_lanes = {};
+__export(exports_lanes, {
+  runLaneJob: () => runLaneJob,
+  resolveLane: () => resolveLane,
+  probeLane: () => probeLane,
+  laneInventory: () => laneInventory,
+  createGrokAdapter: () => createGrokAdapter,
+  createCursorAdapter: () => createCursorAdapter,
+  createCodexAdapter: () => createCodexAdapter,
+  createClaudeAdapter: () => createClaudeAdapter,
+  binaryOnPath: () => binaryOnPath,
+  LaneDependencyMissingError: () => LaneDependencyMissingError,
+  LaneAdapterShapeError: () => LaneAdapterShapeError,
+  LANE_KINDS: () => LANE_KINDS2
+});
+function resolveLane(kind) {
+  const adapter = adapters.get(kind);
+  if (!adapter)
+    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
+  return adapter;
+}
+async function runLaneJob(job) {
+  return resolveLane(job.lane).run(job);
+}
+async function probeLane(kind) {
+  return resolveLane(kind).probe();
+}
+async function laneInventory() {
+  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
+}
+var adapters;
+var init_lanes = __esm(() => {
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  init_types();
+  init_types();
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  adapters = new Map([
+    ["claude", createClaudeAdapter()],
+    ["codex", createCodexAdapter()],
+    ["cursor", createCursorAdapter()],
+    ["grok", createGrokAdapter()]
+  ]);
+});
+
+// src/service.ts
+import { createHash as createHash3 } from "crypto";
+// package.json
+var package_default = {
+  name: "@hasna/workflows",
+  version: "0.2.1",
+  description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
+  type: "module",
+  main: "./dist/index.js",
+  types: "./types/index.d.ts",
+  bin: {
+    workflows: "dist/cli/index.js",
+    "workflows-mcp": "dist/mcp/index.js",
+    "workflows-serve": "dist/serve/index.js"
+  },
+  exports: {
+    ".": {
+      types: "./types/index.d.ts",
+      import: "./dist/index.js"
+    },
+    "./sdk": {
+      types: "./types/sdk.d.ts",
+      import: "./dist/sdk.js"
+    },
+    "./cli": {
+      types: "./types/cli/index.d.ts",
+      import: "./dist/cli/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "types",
+    "README.md",
+    "LICENSE",
+    "hasna.contract.json"
+  ],
+  scripts: {
+    build: "bun run check:sdk && bun run build:runtime && bun run build:types",
+    "generate:sdk": "bun scripts/generate-sdk.ts --write",
+    "check:sdk": "bun scripts/generate-sdk.ts",
+    "test:artifacts": "bun scripts/artifact-acceptance.ts",
+    "build:runtime": "bun build src/cli/index.ts --outdir dist/cli --target bun && bun build src/mcp/index.ts --outdir dist/mcp --target bun && bun build src/serve/index.ts src/serve/admin.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external && bun build src/sdk.ts --outdir dist --target node",
+    "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
+    "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
+    "contract:check": "bun scripts/contracts-cli.mjs repo-conformance .",
+    typecheck: "tsc --noEmit",
+    test: "bun test",
+    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a fresh test Postgres database}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/postgres-store.test.ts src/db/postgres-http.test.ts src/db/postgres-fencing.test.ts',
+    prepack: "bun run build && bun run artifact-scan",
+    prepublishOnly: "bun run test && bun run build"
+  },
+  keywords: [
+    "workflows",
+    "graph",
+    "automation",
+    "cli",
+    "typescript",
+    "bun",
+    "hasna"
+  ],
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/hasna/apps.git",
+    directory: "apps/workflows"
+  },
+  homepage: "https://github.com/hasna/apps/tree/main/apps/workflows",
+  bugs: {
+    url: "https://github.com/hasna/apps/issues"
+  },
+  engines: {
+    bun: ">=1.0.0"
+  },
+  author: "Hasna",
+  license: "Apache-2.0",
+  dependencies: {
+    "@anthropic-ai/claude-agent-sdk": "0.3.234",
+    "@cursor/sdk": "^1.0.28",
+    "@hasna/contracts": "1.3.3",
+    "@openai/codex-sdk": "0.160.0",
+    commander: "^13.1.0",
+    pg: "^8.16.3"
+  },
+  devDependencies: {
+    "@types/bun": "1.3.14",
+    "@types/pg": "^8.15.6",
+    typescript: "^5.7.3"
   }
+};
+
+// src/version.ts
+function packageVersion() {
+  return package_default.version;
 }
 
+// src/daemon.ts
+init_expr();
+init_graph();
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/secrets.ts
 class SecretsGateError extends Error {
   constructor(message) {
@@ -2034,7 +2076,14 @@ class WorkflowsDaemon {
     const isLoopBody = graph.nodes.some((candidate) => candidate.type === "while" && candidate.body.includes(nodeId));
     const nodeRow = latest === undefined || isLoopBody && latest.status === "completed" ? await this.store.createRunNode({ runId: run2.id, nodeId, lane: node2.lane ?? "claude" }) : latest;
     const memoWatch = node2.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
-    const memoSource = { command: node2.command, prompt: node2.prompt, context: stripRunState(context) };
+    const memoSource = {
+      command: node2.command,
+      prompt: node2.prompt,
+      context: stripRunState(context),
+      lane: node2.lane ?? "claude",
+      cwd: node2.cwd,
+      codexMode: node2.lane === "codex" ? node2.codexMode ?? "repository" : undefined
+    };
     const memoInput = node2.memo ? memoWatch !== undefined ? { ...memoSource, memoWatch } : memoSource : undefined;
     if (memoInput !== undefined) {
       const hit = await tryMemoHit(this.store, run2.graphName, nodeId, memoInput);
@@ -2059,6 +2108,8 @@ class WorkflowsDaemon {
       lane: node2.lane ?? "claude",
       prompt: node2.prompt,
       command: node2.command,
+      cwd: node2.cwd,
+      codexMode: node2.codexMode,
       timeoutMs: node2.timeoutMs,
       env: this.env
     };