@hasna/workflows 0.2.0 → 0.2.2

package/dist/handlers.js

@@ -16,1154 +16,1196 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
-// src/lanes/types.ts
-import { statSync as statSync2 } from "fs";
-function binaryOnPath(binary) {
-  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
-  for (const entry of pathEntries) {
-    try {
-      const stat = statSync2(`${entry}/${binary}`);
-      if (stat.isFile())
-        return true;
-    } catch {}
-  }
-  return false;
-}
-function subscriptionEnvironment(overrides = {}) {
-  const paid = /^(OPENAI_API_KEY|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CODEX_API_KEY|CURSOR_API_KEY)$/;
-  const sensitive = /(?:API[_-]?KEY|SECRET|PASSWORD|TOKEN|DATABASE_URL|CREDENTIAL)/i;
-  const env = {};
-  for (const [name, value] of Object.entries(process.env)) {
-    if (value !== undefined && !paid.test(name) && (!sensitive.test(name) || name === "CLAUDE_CODE_OAUTH_TOKEN"))
-      env[name] = value;
-  }
-  for (const [name, value] of Object.entries(overrides)) {
-    if (paid.test(name) || sensitive.test(name))
-      throw new Error(`lane environment field ${name} requires a supported scoped credential consumer`);
-    env[name] = value;
-  }
-  return env;
-}
-function subscriptionSdkEnvironment(overrides = {}) {
-  const safe = subscriptionEnvironment(overrides);
-  return { ...Object.fromEntries(Object.keys(process.env).map((name) => [name, undefined])), ...safe };
-}
-function withTimeout(promise, timeoutMs, what, cancel) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      cancel?.();
-      reject(new LaneTimeoutError(what, timeoutMs));
-    }, timeoutMs);
-    promise.then((value) => {
-      clearTimeout(timer);
-      resolve(value);
-    }, (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-  });
-}
-async function spawnCli(cmd, opts) {
-  const started = Date.now();
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-  let proc;
-  try {
-    proc = Bun.spawn({
-      cmd,
-      cwd: opts.cwd,
-      env: subscriptionEnvironment(opts.env),
-      stdin: "ignore",
-      stdout: "pipe",
-      stderr: "pipe",
-      timeout: timeoutMs
-    });
-  } catch (err) {
-    const message = String(err instanceof Error ? err.message : err);
-    if (message.includes("ENOENT") || /not found/i.test(message)) {
-      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
-    }
-    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
-  }
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-    proc.exited
-  ]);
-  const output = stderr ? `${stdout}
-${stderr}`.trim() : stdout.trim();
-  return { ok: exitCode === 0, exitCode, output, durationMs: Date.now() - started };
-}
-var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000, LaneTimeoutError;
-var init_types = __esm(() => {
-  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
-  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "LaneDependencyMissingError";
-    }
-  };
-  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
-    constructor(message) {
-      super(message);
-      this.name = "LaneAdapterShapeError";
-    }
-  };
-  LaneTimeoutError = class LaneTimeoutError extends Error {
-    constructor(what, timeoutMs) {
-      super(`${what} exceeded the ${timeoutMs}ms budget`);
-      this.name = "LaneTimeoutError";
-    }
-  };
-});
-
-// src/lanes/claude.ts
-function createClaudeAdapter(deps = {}) {
-  return {
-    kind: "claude",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
-      try {
-        await loader();
-        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "claude")) {
-          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "claude",
-          sdk: "@anthropic-ai/claude-agent-sdk",
-          wired: false,
-          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch (err) {
-        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
-      }
-      const query = sdk.query;
-      if (typeof query !== "function") {
-        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
-      }
-      const prompt = job.prompt;
-      const abortController = new AbortController;
-      try {
-        const { output, isError } = await withTimeout((async () => {
-          const generator = await query({
-            prompt,
-            options: { model: job.model, cwd: job.cwd, maxTurns: 32, abortController, env: subscriptionSdkEnvironment(job.env) }
-          });
-          let output2 = "";
-          let isError2 = false;
-          for await (const message of generator) {
-            if (message.type === "assistant") {
-              const content = message.message?.content;
-              if (Array.isArray(content)) {
-                for (const block of content) {
-                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
-                    output2 += block.text;
-                  }
-                }
-              }
-            }
-            if (message.type === "error")
-              isError2 = true;
-          }
-          return { output: output2, isError: isError2 };
-        })(), timeoutMs, "claude lane", () => abortController.abort());
-        const durationMs = Date.now() - started;
-        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
-      } catch (err) {
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
-      }
-    }
-  };
-}
-async function runClaudeCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = await spawnCli([cliPath, "-p", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+// src/expr.ts
+function tokenize(input) {
+  const tokens = [];
+  let i = 0;
+  while (i < input.length) {
+    const ch = input[i];
+    if (ch === " " || ch === "\t" || ch === `
+` || ch === "\r") {
+      i++;
+      continue;
     }
-    throw err;
-  }
-}
-var init_claude = __esm(() => {
-  init_types();
-});
-
-// src/lanes/codex.ts
-function createCodexAdapter(deps = {}) {
-  return {
-    kind: "codex",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
-      try {
-        await loader();
-        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "codex")) {
-          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
-        }
-        return {
-          kind: "codex",
-          sdk: "@openai/codex-sdk",
-          wired: false,
-          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
-      }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch {
-        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
-      }
-      const CodexClass = sdk.Codex;
-      if (typeof CodexClass !== "function") {
-        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
-      }
-      const abortController = new AbortController;
-      try {
-        const client = await withTimeout(Promise.resolve(new CodexClass({
-          config: { model: job.model },
-          env: subscriptionEnvironment(job.env)
-        })), timeoutMs, "codex lane");
-        const thread = client.startThread?.({ model: job.model, workingDirectory: job.cwd });
-        if (!thread || typeof thread.run !== "function") {
-          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
-        }
-        const turn = await withTimeout(thread.run(job.prompt, { signal: abortController.signal }), timeoutMs, "codex lane", () => abortController.abort());
-        const output = turn?.finalResponse ?? "";
-        const durationMs = Date.now() - started;
-        return { ok: true, exitCode: 0, output, durationMs };
-      } catch (err) {
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
-      }
+    if (ch === "(") {
+      tokens.push({ kind: "lparen", value: "(" });
+      i++;
+      continue;
     }
-  };
-}
-async function runCodexCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = await spawnCli([cliPath, "exec", "--", job.prompt], {
-      binaryName: cliPath,
-      packageHint: "@openai/codex-sdk or the codex CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    if (ch === ")") {
+      tokens.push({ kind: "rparen", value: ")" });
+      i++;
+      continue;
     }
-    throw err;
-  }
-}
-var init_codex = __esm(() => {
-  init_types();
-});
-
-// src/lanes/cursor.ts
-function createCursorAdapter(deps = {}) {
-  return {
-    kind: "cursor",
-    async probe() {
-      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
-      try {
-        await loader();
-        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
-      } catch {
-        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
-          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
+    if (ch === '"' || ch === "'") {
+      const quote = ch;
+      let j = i + 1;
+      let out = "";
+      let closed = false;
+      while (j < input.length) {
+        if (input[j] === quote) {
+          closed = true;
+          break;
         }
-        return {
-          kind: "cursor",
-          sdk: "@cursor/sdk",
-          wired: false,
-          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
-        };
-      }
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
-      }
-      if (!deps.sdkLoader && binaryOnPath(deps.cliPath ?? "cursor-agent"))
-        return runCursorCli(job, deps.cliPath ?? "cursor-agent", Date.now(), job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS);
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
-      let sdk;
-      try {
-        sdk = await loader();
-      } catch {
-        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
-      }
-      let cancel;
-      try {
-        subscriptionEnvironment(job.env);
-        if (!deps.sdkLoader && process.env.CURSOR_API_KEY)
-          throw new Error("cursor lane refuses ambient API billing; use the native subscription CLI");
-        const run2 = await withTimeout(runLocalAgent(sdk, job, (callback) => {
-          cancel = callback;
-        }), timeoutMs, "cursor lane", () => cancel?.());
-        const durationMs = Date.now() - started;
-        const status = run2.status;
-        const ok = status === "finished";
-        return { ok, exitCode: ok ? 0 : 1, output: run2.result, durationMs };
-      } catch (err) {
-        if (err instanceof LaneAdapterShapeError)
-          throw err;
-        const durationMs = Date.now() - started;
-        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
+        out += input[j];
+        j++;
       }
+      if (!closed)
+        throw new ExprSyntaxError(`unterminated string literal at offset ${i}`);
+      tokens.push({ kind: "string", value: out });
+      i = j + 1;
+      continue;
     }
-  };
+    const two = input.slice(i, i + 2);
+    if (COMPARISON_OPS.has(two)) {
+      tokens.push({ kind: "op", value: two });
+      i += 2;
+      continue;
+    }
+    if (ch === "<" || ch === ">" || ch === "=" || ch === "!") {
+      tokens.push({ kind: "op", value: ch });
+      i++;
+      continue;
+    }
+    if (/[0-9]/.test(ch)) {
+      let j = i;
+      while (j < input.length && /[0-9.]/.test(input[j]))
+        j++;
+      tokens.push({ kind: "number", value: input.slice(i, j) });
+      i = j;
+      continue;
+    }
+    if (/[A-Za-z_]/.test(ch)) {
+      let j = i;
+      while (j < input.length && /[A-Za-z0-9_.]/.test(input[j]))
+        j++;
+      tokens.push({ kind: "ident", value: input.slice(i, j) });
+      i = j;
+      continue;
+    }
+    throw new ExprSyntaxError(`unexpected character ${JSON.stringify(ch)} at offset ${i}`);
+  }
+  return tokens;
 }
-async function runLocalAgent(sdk, job, onCancel) {
-  const AgentClass = sdk.Agent;
-  const CursorClass = sdk.Cursor;
-  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
-    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
+
+class Parser {
+  tokens;
+  pos = 0;
+  constructor(tokens) {
+    this.tokens = tokens;
   }
-  const create = AgentClass.create;
-  const agent = typeof create === "function" ? await create.call(AgentClass, { local: { cwd: job.cwd, enableAgentRetries: false } }) : typeof AgentClass === "function" ? new AgentClass : undefined;
-  if (!agent || typeof agent.send !== "function") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
+  peek() {
+    return this.tokens[this.pos];
   }
-  let run2 = await agent.send(job.prompt, { model: job.model });
-  if (run2 && typeof run2 === "object") {
-    const handle = run2;
-    if (typeof handle.cancel === "function")
-      onCancel(() => {
-        handle.cancel().catch(() => {});
-      });
-    if (typeof handle.wait === "function")
-      run2 = await handle.wait();
+  next() {
+    return this.tokens[this.pos++];
   }
-  if (!run2 || typeof run2 !== "object") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
+  expectOp(value) {
+    const t = this.next();
+    if (!t || t.kind !== "op" || t.value !== value) {
+      throw new ExprSyntaxError(`expected ${JSON.stringify(value)}`);
+    }
   }
-  const candidate = run2;
-  if (typeof candidate.status !== "string" || !["finished", "error", "cancelled"].includes(candidate.status)) {
-    throw new LaneAdapterShapeError(`@cursor/sdk Agent.send() returned a Run without a terminal status (got ${JSON.stringify(candidate.status)}; expected finished|error|cancelled)`);
+  parse() {
+    if (this.tokens.length === 0)
+      throw new ExprSyntaxError("empty expression");
+    const node = this.parseOr();
+    if (this.pos < this.tokens.length) {
+      throw new ExprSyntaxError(`unexpected trailing token ${JSON.stringify(this.peek().value)}`);
+    }
+    return node;
   }
-  if (typeof candidate.result !== "string") {
-    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned a Run without a string result");
+  parseOr() {
+    let left = this.parseAnd();
+    while (this.peek()?.kind === "ident" && this.peek().value === "or") {
+      this.next();
+      const right = this.parseAnd();
+      left = { kind: "or", left, right };
+    }
+    return left;
   }
-  return { status: candidate.status, result: candidate.result };
-}
-async function runCursorCli(job, cliPath, started, timeoutMs) {
-  try {
-    const result = await spawnCli([cliPath, "--print", job.prompt, ...job.model ? ["--model", job.model] : []], {
-      binaryName: cliPath,
-      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
-      timeoutMs,
-      env: job.env,
-      cwd: job.cwd
-    });
-    return { ...result, durationMs: Date.now() - started };
-  } catch (err) {
-    if (err instanceof LaneDependencyMissingError) {
-      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+  parseAnd() {
+    let left = this.parseNot();
+    while (this.peek()?.kind === "ident" && this.peek().value === "and") {
+      this.next();
+      const right = this.parseNot();
+      left = { kind: "and", left, right };
     }
-    throw err;
+    return left;
+  }
+  parseNot() {
+    if (this.peek()?.kind === "ident" && this.peek().value === "not") {
+      this.next();
+      return { kind: "not", operand: this.parseNot() };
+    }
+    return this.parseComparison();
+  }
+  parseComparison() {
+    const left = this.parsePrimary();
+    const t = this.peek();
+    if (t && t.kind === "op" && COMPARISON_OPS.has(t.value)) {
+      this.next();
+      const right = this.parsePrimary();
+      return { kind: "comparison", op: t.value, left, right };
+    }
+    return left;
+  }
+  parsePrimary() {
+    const t = this.next();
+    if (!t)
+      throw new ExprSyntaxError("unexpected end of expression");
+    if (t.kind === "lparen") {
+      const inner = this.parseOr();
+      this.expectCloseParen();
+      return inner;
+    }
+    if (t.kind === "number") {
+      const value = Number(t.value);
+      if (!Number.isFinite(value))
+        throw new ExprSyntaxError(`invalid number ${JSON.stringify(t.value)}`);
+      return { kind: "literal", value };
+    }
+    if (t.kind === "string")
+      return { kind: "literal", value: t.value };
+    if (t.kind === "ident") {
+      if (t.value === "true")
+        return { kind: "literal", value: true };
+      if (t.value === "false")
+        return { kind: "literal", value: false };
+      return { kind: "path", segments: t.value.split(".") };
+    }
+    throw new ExprSyntaxError(`unexpected token ${JSON.stringify(t.value)}`);
+  }
+  expectCloseParen() {
+    const t = this.next();
+    if (!t || t.kind !== "rparen")
+      throw new ExprSyntaxError("expected )");
   }
 }
-var init_cursor = __esm(() => {
-  init_types();
-});
-
-// src/lanes/grok.ts
-function createGrokAdapter(deps = {}) {
-  return {
-    kind: "grok",
-    async probe() {
-      const cliPath = deps.cliPath ?? "grok";
-      if (binaryOnPath(cliPath)) {
-        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
+function parseExpr(input) {
+  return new Parser(tokenize(input)).parse();
+}
+function resolvePath(segments, context) {
+  let current = context;
+  for (const segment of segments) {
+    if (current === null || typeof current !== "object")
+      return;
+    const record = current;
+    if (!(segment in record))
+      return;
+    current = record[segment];
+  }
+  if (typeof current === "number" || typeof current === "string" || typeof current === "boolean") {
+    return current;
+  }
+  return;
+}
+function evalNode(node, context) {
+  switch (node.kind) {
+    case "literal":
+      return node.value;
+    case "path":
+      return resolvePath(node.segments, context);
+    case "comparison": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (left === undefined || right === undefined) {
+        if (node.op === "==")
+          return left === undefined && right === undefined;
+        if (node.op === "!=")
+          return left !== right;
+        throw new ExprEvalError("cannot order-compare an unknown path");
       }
-      return {
-        kind: "grok",
-        sdk: "no npm SDK (measured 2026-08-25)",
-        wired: false,
-        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
-      };
-    },
-    async run(job) {
-      if (!job.prompt) {
-        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
+      if (typeof left !== typeof right) {
+        throw new ExprEvalError(`cannot compare ${JSON.stringify(left)} (${typeof left}) with ${JSON.stringify(right)} (${typeof right})`);
       }
-      const started = Date.now();
-      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
-      const cliPath = deps.cliPath ?? "grok";
-      try {
-        const result = await spawnCli([cliPath, job.prompt], {
-          binaryName: cliPath,
-          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
-          timeoutMs,
-          env: job.env,
-          cwd: job.cwd
-        });
-        return { ...result, durationMs: Date.now() - started };
-      } catch (err) {
-        if (err instanceof LaneDependencyMissingError) {
-          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
-        }
-        throw err;
+      switch (node.op) {
+        case "==":
+          return left === right;
+        case "!=":
+          return left !== right;
+        case "<":
+          return left < right;
+        case "<=":
+          return left <= right;
+        case ">":
+          return left > right;
+        case ">=":
+          return left >= right;
+        default:
+          throw new ExprEvalError(`unknown operator ${node.op}`);
+      }
+    }
+    case "and": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (typeof left !== "boolean" || typeof right !== "boolean") {
+        throw new ExprEvalError("and requires boolean operands");
       }
+      return left && right;
     }
-  };
+    case "or": {
+      const left = evalNode(node.left, context);
+      const right = evalNode(node.right, context);
+      if (typeof left !== "boolean" || typeof right !== "boolean") {
+        throw new ExprEvalError("or requires boolean operands");
+      }
+      return left || right;
+    }
+    case "not": {
+      const operand = evalNode(node.operand, context);
+      if (typeof operand !== "boolean")
+        throw new ExprEvalError("not requires a boolean operand");
+      return !operand;
+    }
+  }
 }
-var init_grok = __esm(() => {
-  init_types();
+function evaluateExpr(input, context) {
+  const ast = parseExpr(input);
+  const value = evalNode(ast, context);
+  if (typeof value !== "boolean") {
+    throw new ExprEvalError(`condition must evaluate to a boolean, got ${typeof value}`);
+  }
+  return value;
+}
+var ExprSyntaxError, ExprEvalError, COMPARISON_OPS;
+var init_expr = __esm(() => {
+  ExprSyntaxError = class ExprSyntaxError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ExprSyntaxError";
+    }
+  };
+  ExprEvalError = class ExprEvalError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "ExprEvalError";
+    }
+  };
+  COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
 });
 
-// src/lanes/index.ts
-var exports_lanes = {};
-__export(exports_lanes, {
-  runLaneJob: () => runLaneJob,
-  resolveLane: () => resolveLane,
-  probeLane: () => probeLane,
-  laneInventory: () => laneInventory,
-  createGrokAdapter: () => createGrokAdapter,
-  createCursorAdapter: () => createCursorAdapter,
-  createCodexAdapter: () => createCodexAdapter,
-  createClaudeAdapter: () => createClaudeAdapter,
-  binaryOnPath: () => binaryOnPath,
-  LaneDependencyMissingError: () => LaneDependencyMissingError,
-  LaneAdapterShapeError: () => LaneAdapterShapeError,
-  LANE_KINDS: () => LANE_KINDS2
-});
-function resolveLane(kind) {
-  const adapter = adapters.get(kind);
-  if (!adapter)
-    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
-  return adapter;
-}
-async function runLaneJob(job) {
-  return resolveLane(job.lane).run(job);
+// src/graph.ts
+function issue(issues, path, message) {
+  issues.push({ path, message });
 }
-async function probeLane(kind) {
-  return resolveLane(kind).probe();
+function findNode(graph, id) {
+  return graph.nodes.find((n) => n.id === id);
 }
-async function laneInventory() {
-  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
+function collectEdges(graph) {
+  const edges = [];
+  for (const node of graph.nodes) {
+    switch (node.type) {
+      case "start":
+      case "step":
+        if (node.next)
+          edges.push({ from: node.id, to: node.next });
+        break;
+      case "decision":
+        if (node.then)
+          edges.push({ from: node.id, to: node.then });
+        if (node.else)
+          edges.push({ from: node.id, to: node.else });
+        break;
+      case "while":
+        if (node.next)
+          edges.push({ from: node.id, to: node.next });
+        break;
+      case "end":
+        break;
+    }
+  }
+  return edges;
 }
-var adapters;
-var init_lanes = __esm(() => {
-  init_claude();
-  init_codex();
-  init_cursor();
-  init_grok();
-  init_types();
-  init_types();
-  init_claude();
-  init_codex();
-  init_cursor();
-  init_grok();
-  adapters = new Map([
-    ["claude", createClaudeAdapter()],
-    ["codex", createCodexAdapter()],
-    ["cursor", createCursorAdapter()],
-    ["grok", createGrokAdapter()]
-  ]);
-});
-
-// src/service.ts
-import { createHash as createHash3 } from "crypto";
-// package.json
-var package_default = {
-  name: "@hasna/workflows",
-  version: "0.2.0",
-  description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
-  type: "module",
-  main: "./dist/index.js",
-  types: "./types/index.d.ts",
-  bin: {
-    workflows: "dist/cli/index.js",
-    "workflows-mcp": "dist/mcp/index.js",
-    "workflows-serve": "dist/serve/index.js"
-  },
-  exports: {
-    ".": {
-      types: "./types/index.d.ts",
-      import: "./dist/index.js"
-    },
-    "./sdk": {
-      types: "./types/sdk.d.ts",
-      import: "./dist/sdk.js"
-    },
-    "./cli": {
-      types: "./types/cli/index.d.ts",
-      import: "./dist/cli/index.js"
+function reachableNodes(graph) {
+  const start = graph.nodes.find((n) => n.type === "start");
+  if (!start)
+    return [];
+  const seen = new Set;
+  const stack = [start.id];
+  while (stack.length > 0) {
+    const id = stack.pop();
+    if (seen.has(id))
+      continue;
+    seen.add(id);
+    const node = findNode(graph, id);
+    if (!node)
+      continue;
+    if (node.type === "start" || node.type === "step") {
+      if (node.next)
+        stack.push(node.next);
+    } else if (node.type === "decision") {
+      if (node.then)
+        stack.push(node.then);
+      if (node.else)
+        stack.push(node.else);
+    } else if (node.type === "while") {
+      for (const bodyId of node.body)
+        stack.push(bodyId);
+      if (node.next)
+        stack.push(node.next);
     }
-  },
-  files: [
-    "dist",
-    "types",
-    "README.md",
-    "LICENSE",
-    "hasna.contract.json"
-  ],
-  scripts: {
-    build: "bun run check:sdk && bun run build:runtime && bun run build:types",
-    "generate:sdk": "bun scripts/generate-sdk.ts --write",
-    "check:sdk": "bun scripts/generate-sdk.ts",
-    "test:artifacts": "bun scripts/artifact-acceptance.ts",
-    "build:runtime": "bun build src/cli/index.ts --outdir dist/cli --target bun && bun build src/mcp/index.ts --outdir dist/mcp --target bun && bun build src/serve/index.ts src/serve/admin.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external && bun build src/sdk.ts --outdir dist --target node",
-    "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
-    "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
-    "contract:check": "bun scripts/contracts-cli.mjs repo-conformance .",
-    typecheck: "tsc --noEmit",
-    test: "bun test",
-    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a fresh test Postgres database}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/postgres-store.test.ts src/db/postgres-http.test.ts src/db/postgres-fencing.test.ts',
-    prepack: "bun run build && bun run artifact-scan",
-    prepublishOnly: "bun run test && bun run build"
-  },
-  keywords: [
-    "workflows",
-    "graph",
-    "automation",
-    "cli",
-    "typescript",
-    "bun",
-    "hasna"
-  ],
-  publishConfig: {
-    registry: "https://registry.npmjs.org",
-    access: "public"
-  },
-  repository: {
-    type: "git",
-    url: "https://github.com/hasna/apps.git",
-    directory: "apps/workflows"
-  },
-  homepage: "https://github.com/hasna/apps/tree/main/apps/workflows",
-  bugs: {
-    url: "https://github.com/hasna/apps/issues"
-  },
-  engines: {
-    bun: ">=1.0.0"
-  },
-  author: "Hasna",
-  license: "Apache-2.0",
-  dependencies: {
-    "@anthropic-ai/claude-agent-sdk": "0.3.234",
-    "@cursor/sdk": "^1.0.28",
-    "@openai/codex-sdk": "0.147.0",
-    commander: "^13.1.0",
-    "@hasna/contracts": "1.3.3",
-    pg: "^8.16.3"
-  },
-  devDependencies: {
-    "@types/bun": "1.3.14",
-    "@types/pg": "^8.15.6",
-    typescript: "^5.7.3"
   }
-};
-
-// src/version.ts
-function packageVersion() {
-  return package_default.version;
+  return [...seen];
 }
-
-// src/daemon.ts
-import { randomUUID as randomUUID2 } from "crypto";
-
-// src/expr.ts
-class ExprSyntaxError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ExprSyntaxError";
+function findCycles(graph) {
+  const edges = collectEdges(graph);
+  const adj = new Map;
+  for (const e of edges) {
+    const list = adj.get(e.from) ?? [];
+    list.push(e.to);
+    adj.set(e.from, list);
+  }
+  const color = new Map;
+  const stack = [];
+  const cycles = [];
+  function visit(id) {
+    color.set(id, "grey");
+    stack.push(id);
+    for (const to of adj.get(id) ?? []) {
+      const c = color.get(to);
+      if (c === "grey") {
+        const idx = stack.indexOf(to);
+        cycles.push([...stack.slice(idx), to]);
+      } else if (c === undefined) {
+        visit(to);
+      }
+    }
+    stack.pop();
+    color.set(id, "black");
   }
-}
-
-class ExprEvalError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ExprEvalError";
+  for (const node of graph.nodes) {
+    if (color.get(node.id) === undefined)
+      visit(node.id);
   }
+  return cycles;
 }
-var COMPARISON_OPS = new Set(["==", "!=", "<", "<=", ">", ">="]);
-function tokenize(input) {
-  const tokens = [];
-  let i = 0;
-  while (i < input.length) {
-    const ch = input[i];
-    if (ch === " " || ch === "\t" || ch === `
-` || ch === "\r") {
-      i++;
-      continue;
-    }
-    if (ch === "(") {
-      tokens.push({ kind: "lparen", value: "(" });
-      i++;
-      continue;
-    }
-    if (ch === ")") {
-      tokens.push({ kind: "rparen", value: ")" });
-      i++;
-      continue;
-    }
-    if (ch === '"' || ch === "'") {
-      const quote = ch;
-      let j = i + 1;
-      let out = "";
-      let closed = false;
-      while (j < input.length) {
-        if (input[j] === quote) {
-          closed = true;
+function validateGraph(graph) {
+  const issues = [];
+  if (graph === null || typeof graph !== "object" || Array.isArray(graph)) {
+    return { ok: false, issues: [{ path: "graph", message: "graph must be an object" }] };
+  }
+  if (typeof graph.name !== "string" || graph.name.trim() === "") {
+    issue(issues, "name", "graph requires a non-empty name");
+  }
+  if (typeof graph.version !== "string" || graph.version.trim() === "") {
+    issue(issues, "version", "graph requires a version string");
+  }
+  if (graph.memoWatch !== undefined) {
+    if (!Array.isArray(graph.memoWatch) || graph.memoWatch.length === 0) {
+      issue(issues, "memoWatch", "memoWatch must be a non-empty array of file paths or globs");
+    } else {
+      for (const entry of graph.memoWatch) {
+        if (typeof entry !== "string" || entry.trim() === "") {
+          issue(issues, "memoWatch", "each memoWatch entry must be a non-empty path or glob string");
           break;
         }
-        out += input[j];
-        j++;
       }
-      if (!closed)
-        throw new ExprSyntaxError(`unterminated string literal at offset ${i}`);
-      tokens.push({ kind: "string", value: out });
-      i = j + 1;
-      continue;
     }
-    const two = input.slice(i, i + 2);
-    if (COMPARISON_OPS.has(two)) {
-      tokens.push({ kind: "op", value: two });
-      i += 2;
+  }
+  if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) {
+    issue(issues, "nodes", "graph requires at least one node");
+    return { ok: false, issues };
+  }
+  for (let index = 0;index < graph.nodes.length; index++) {
+    const node = graph.nodes[index];
+    if (node === null || typeof node !== "object" || Array.isArray(node)) {
+      issue(issues, `nodes.${index}`, "node must be an object");
       continue;
     }
-    if (ch === "<" || ch === ">" || ch === "=" || ch === "!") {
-      tokens.push({ kind: "op", value: ch });
-      i++;
+    if (!GRAPH_NODE_TYPES.includes(node.type))
+      issue(issues, `nodes.${index}.type`, "type must be start, step, decision, while, or end");
+    for (const key of ["next", "then", "else", "prompt", "command"]) {
+      const value = node[key];
+      if (value !== undefined && (typeof value !== "string" || value.trim() === ""))
+        issue(issues, `nodes.${index}.${key}`, `${key} must be a non-empty string`);
+    }
+    if (node.type === "while" && (!Array.isArray(node.body) || node.body.some((id) => typeof id !== "string")))
+      issue(issues, `nodes.${index}.body`, "body must be an array of node ids");
+  }
+  if (issues.length)
+    return { ok: false, issues };
+  const starts = graph.nodes.filter((n) => n.type === "start");
+  if (starts.length === 0)
+    issue(issues, "nodes", "graph requires exactly one start node (found none)");
+  if (starts.length > 1)
+    issue(issues, "nodes", "graph requires exactly one start node (found multiple)");
+  const ends = graph.nodes.filter((n) => n.type === "end");
+  if (ends.length === 0)
+    issue(issues, "nodes", "graph requires at least one end node");
+  const seenIds = new Map;
+  for (const node of graph.nodes) {
+    if (typeof node.id !== "string" || !NODE_ID_RE.test(node.id)) {
+      issue(issues, "nodes", `node id ${JSON.stringify(node.id)} must match ${String(NODE_ID_RE)}`);
       continue;
     }
-    if (/[0-9]/.test(ch)) {
-      let j = i;
-      while (j < input.length && /[0-9.]/.test(input[j]))
-        j++;
-      tokens.push({ kind: "number", value: input.slice(i, j) });
-      i = j;
+    if (seenIds.has(node.id)) {
+      issue(issues, `nodes.${node.id}`, `duplicate node id ${node.id}`);
       continue;
     }
-    if (/[A-Za-z_]/.test(ch)) {
-      let j = i;
-      while (j < input.length && /[A-Za-z0-9_.]/.test(input[j]))
-        j++;
-      tokens.push({ kind: "ident", value: input.slice(i, j) });
-      i = j;
+    seenIds.set(node.id, node);
+    if (!GRAPH_NODE_TYPES.includes(node.type)) {
+      issue(issues, `nodes.${node.id}`, `unknown node type ${JSON.stringify(node.type)}`);
       continue;
     }
-    throw new ExprSyntaxError(`unexpected character ${JSON.stringify(ch)} at offset ${i}`);
+    validateNode(graph, node, issues);
+  }
+  for (const node of graph.nodes) {
+    const edges = nodeEdges(node);
+    for (const { kind, target } of edges) {
+      if (!seenIds.has(target)) {
+        issue(issues, `nodes.${node.id}`, `${kind} edge targets nonexistent node ${target}`);
+      }
+    }
+  }
+  if (starts.length === 1) {
+    const reachable = new Set(reachableNodes(graph));
+    for (const node of graph.nodes) {
+      if (!reachable.has(node.id)) {
+        issue(issues, `nodes.${node.id}`, `node ${node.id} is unreachable from start`);
+      }
+    }
+  }
+  const cycles = findCycles(graph);
+  for (const cycle of cycles) {
+    issue(issues, "nodes", `explicit cycle detected: ${cycle.join(" -> ")} (loop only via a while node)`);
+  }
+  return { ok: issues.length === 0, issues };
+}
+function nodeEdges(node) {
+  switch (node.type) {
+    case "start":
+    case "step":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "decision":
+      return [
+        ...node.then ? [{ kind: "then", target: node.then }] : [],
+        ...node.else ? [{ kind: "else", target: node.else }] : []
+      ];
+    case "while":
+      return node.next ? [{ kind: "next", target: node.next }] : [];
+    case "end":
+      return [];
+    default:
+      return [];
+  }
+}
+function validateNode(graph, node, issues) {
+  switch (node.type) {
+    case "start":
+      if (!node.next)
+        issue(issues, `nodes.${node.id}`, "start node requires a next edge");
+      break;
+    case "step": {
+      if (!node.prompt && !node.command) {
+        issue(issues, `nodes.${node.id}`, "step node requires prompt or command");
+      }
+      if (node.lane !== undefined && !LANE_KINDS.includes(node.lane)) {
+        issue(issues, `nodes.${node.id}`, `unknown lane ${JSON.stringify(node.lane)} (expected one of ${LANE_KINDS.join(", ")})`);
+      }
+      if (node.cwd !== undefined && (typeof node.cwd !== "string" || !node.cwd.trim() || node.cwd.includes("\x00"))) {
+        issue(issues, `nodes.${node.id}.cwd`, "cwd must be a non-empty path string without NUL characters on the executor");
+      }
+      if (node.codexMode !== undefined) {
+        if (!CODEX_EXECUTION_MODES.includes(node.codexMode)) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode must be repository or read-only");
+        } else if (node.lane !== "codex" || !node.prompt || node.command !== undefined) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode is supported only for a codex prompt step without command");
+        }
+      }
+      if (node.maxRetries !== undefined && (!Number.isInteger(node.maxRetries) || node.maxRetries < 0)) {
+        issue(issues, `nodes.${node.id}`, "maxRetries must be a non-negative integer");
+      }
+      if (node.timeoutMs !== undefined && (!Number.isInteger(node.timeoutMs) || node.timeoutMs < 1)) {
+        issue(issues, `nodes.${node.id}`, "timeoutMs must be a positive integer");
+      }
+      break;
+    }
+    case "decision": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "decision node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (!node.then && !node.else) {
+        issue(issues, `nodes.${node.id}`, "decision node requires then and/or else edge");
+      }
+      break;
+    }
+    case "while": {
+      if (typeof node.condition !== "string" || node.condition.trim() === "") {
+        issue(issues, `nodes.${node.id}`, "while node requires a condition expression");
+      } else {
+        try {
+          parseExpr(node.condition);
+        } catch (err) {
+          if (err instanceof ExprSyntaxError) {
+            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
+          } else {
+            throw err;
+          }
+        }
+      }
+      if (node.maxIterations === undefined) {
+        issue(issues, `nodes.${node.id}`, "while node requires maxIterations (finite loop bound)");
+      } else if (!Number.isInteger(node.maxIterations) || node.maxIterations < 1) {
+        issue(issues, `nodes.${node.id}`, "maxIterations must be a positive integer");
+      }
+      if (!Array.isArray(node.body) || node.body.length === 0) {
+        issue(issues, `nodes.${node.id}`, "while node requires a non-empty body");
+      } else {
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode) {
+            issue(issues, `nodes.${node.id}`, `while body references nonexistent node ${bodyId}`);
+            continue;
+          }
+          if (bodyNode.type === "start" || bodyNode.type === "end" || bodyNode.type === "while") {
+            issue(issues, `nodes.${node.id}`, `while body may only contain step/decision nodes in v1 (found ${bodyNode.type})`);
+          }
+        }
+        const bodySet = new Set(node.body);
+        for (const bodyId of node.body) {
+          const bodyNode = findNode(graph, bodyId);
+          if (!bodyNode)
+            continue;
+          for (const { kind, target } of nodeEdges(bodyNode)) {
+            if (!bodySet.has(target)) {
+              issue(issues, `nodes.${node.id}`, `while body node ${bodyId} ${kind}-edge leaves the body (target ${target})`);
+            }
+          }
+        }
+      }
+      break;
+    }
+    case "end":
+      break;
   }
-  return tokens;
 }
+var GRAPH_NODE_TYPES, LANE_KINDS, CODEX_EXECUTION_MODES, NODE_ID_RE;
+var init_graph = __esm(() => {
+  init_expr();
+  GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
+  LANE_KINDS = ["claude", "codex", "cursor", "grok"];
+  CODEX_EXECUTION_MODES = ["repository", "read-only"];
+  NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+});
 
-class Parser {
-  tokens;
-  pos = 0;
-  constructor(tokens) {
-    this.tokens = tokens;
-  }
-  peek() {
-    return this.tokens[this.pos];
-  }
-  next() {
-    return this.tokens[this.pos++];
-  }
-  expectOp(value) {
-    const t = this.next();
-    if (!t || t.kind !== "op" || t.value !== value) {
-      throw new ExprSyntaxError(`expected ${JSON.stringify(value)}`);
-    }
-  }
-  parse() {
-    if (this.tokens.length === 0)
-      throw new ExprSyntaxError("empty expression");
-    const node = this.parseOr();
-    if (this.pos < this.tokens.length) {
-      throw new ExprSyntaxError(`unexpected trailing token ${JSON.stringify(this.peek().value)}`);
-    }
-    return node;
-  }
-  parseOr() {
-    let left = this.parseAnd();
-    while (this.peek()?.kind === "ident" && this.peek().value === "or") {
-      this.next();
-      const right = this.parseAnd();
-      left = { kind: "or", left, right };
-    }
-    return left;
+// src/lanes/types.ts
+import { statSync as statSync2 } from "fs";
+function binaryOnPath(binary) {
+  const pathEntries = (process.env.PATH ?? "").split(":").filter(Boolean);
+  for (const entry of pathEntries) {
+    try {
+      const stat = statSync2(`${entry}/${binary}`);
+      if (stat.isFile())
+        return true;
+    } catch {}
   }
-  parseAnd() {
-    let left = this.parseNot();
-    while (this.peek()?.kind === "ident" && this.peek().value === "and") {
-      this.next();
-      const right = this.parseNot();
-      left = { kind: "and", left, right };
-    }
-    return left;
+  return false;
+}
+function subscriptionEnvironment(overrides = {}) {
+  const paid = /^(OPENAI_API_KEY|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|CODEX_API_KEY|CURSOR_API_KEY)$/;
+  const sensitive = /(?:API[_-]?KEY|SECRET|PASSWORD|TOKEN|DATABASE_URL|CREDENTIAL)/i;
+  const env = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (value !== undefined && !paid.test(name) && (!sensitive.test(name) || name === "CLAUDE_CODE_OAUTH_TOKEN"))
+      env[name] = value;
   }
-  parseNot() {
-    if (this.peek()?.kind === "ident" && this.peek().value === "not") {
-      this.next();
-      return { kind: "not", operand: this.parseNot() };
-    }
-    return this.parseComparison();
+  for (const [name, value] of Object.entries(overrides)) {
+    if (paid.test(name) || sensitive.test(name))
+      throw new Error(`lane environment field ${name} requires a supported scoped credential consumer`);
+    env[name] = value;
   }
-  parseComparison() {
-    const left = this.parsePrimary();
-    const t = this.peek();
-    if (t && t.kind === "op" && COMPARISON_OPS.has(t.value)) {
-      this.next();
-      const right = this.parsePrimary();
-      return { kind: "comparison", op: t.value, left, right };
+  return env;
+}
+function subscriptionSdkEnvironment(overrides = {}) {
+  const safe = subscriptionEnvironment(overrides);
+  return { ...Object.fromEntries(Object.keys(process.env).map((name) => [name, undefined])), ...safe };
+}
+function withTimeout(promise, timeoutMs, what, cancel) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      cancel?.();
+      reject(new LaneTimeoutError(what, timeoutMs));
+    }, timeoutMs);
+    promise.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+async function spawnCli(cmd, opts) {
+  const started = Date.now();
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+  let proc;
+  try {
+    proc = Bun.spawn({
+      cmd,
+      cwd: opts.cwd,
+      env: subscriptionEnvironment(opts.env),
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
+      timeout: timeoutMs
+    });
+  } catch (err) {
+    const message = String(err instanceof Error ? err.message : err);
+    if (message.includes("ENOENT") || /not found/i.test(message)) {
+      throw new LaneDependencyMissingError(`lane binary ${JSON.stringify(opts.binaryName)} not found on PATH; install it or provide ${opts.packageHint}`);
     }
-    return left;
+    return { ok: false, exitCode: 1, output: "", durationMs: Date.now() - started, error: message };
   }
-  parsePrimary() {
-    const t = this.next();
-    if (!t)
-      throw new ExprSyntaxError("unexpected end of expression");
-    if (t.kind === "lparen") {
-      const inner = this.parseOr();
-      this.expectCloseParen();
-      return inner;
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  const output = opts.stdoutOnly ? stdout.trim() : stderr ? `${stdout}
+${stderr}`.trim() : stdout.trim();
+  return {
+    ok: exitCode === 0,
+    exitCode,
+    output,
+    durationMs: Date.now() - started,
+    ...opts.stdoutOnly && exitCode !== 0 && stderr.trim() ? { error: stderr.trim() } : {}
+  };
+}
+var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000, LaneTimeoutError;
+var init_types = __esm(() => {
+  LANE_KINDS2 = ["claude", "codex", "cursor", "grok"];
+  LaneDependencyMissingError = class LaneDependencyMissingError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneDependencyMissingError";
     }
-    if (t.kind === "number") {
-      const value = Number(t.value);
-      if (!Number.isFinite(value))
-        throw new ExprSyntaxError(`invalid number ${JSON.stringify(t.value)}`);
-      return { kind: "literal", value };
+  };
+  LaneAdapterShapeError = class LaneAdapterShapeError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "LaneAdapterShapeError";
     }
-    if (t.kind === "string")
-      return { kind: "literal", value: t.value };
-    if (t.kind === "ident") {
-      if (t.value === "true")
-        return { kind: "literal", value: true };
-      if (t.value === "false")
-        return { kind: "literal", value: false };
-      return { kind: "path", segments: t.value.split(".") };
+  };
+  LaneTimeoutError = class LaneTimeoutError extends Error {
+    constructor(what, timeoutMs) {
+      super(`${what} exceeded the ${timeoutMs}ms budget`);
+      this.name = "LaneTimeoutError";
     }
-    throw new ExprSyntaxError(`unexpected token ${JSON.stringify(t.value)}`);
-  }
-  expectCloseParen() {
-    const t = this.next();
-    if (!t || t.kind !== "rparen")
-      throw new ExprSyntaxError("expected )");
-  }
-}
-function parseExpr(input) {
-  return new Parser(tokenize(input)).parse();
-}
-function resolvePath(segments, context) {
-  let current = context;
-  for (const segment of segments) {
-    if (current === null || typeof current !== "object")
-      return;
-    const record = current;
-    if (!(segment in record))
-      return;
-    current = record[segment];
-  }
-  if (typeof current === "number" || typeof current === "string" || typeof current === "boolean") {
-    return current;
-  }
-  return;
-}
-function evalNode(node, context) {
-  switch (node.kind) {
-    case "literal":
-      return node.value;
-    case "path":
-      return resolvePath(node.segments, context);
-    case "comparison": {
-      const left = evalNode(node.left, context);
-      const right = evalNode(node.right, context);
-      if (left === undefined || right === undefined) {
-        if (node.op === "==")
-          return left === undefined && right === undefined;
-        if (node.op === "!=")
-          return left !== right;
-        throw new ExprEvalError("cannot order-compare an unknown path");
+  };
+});
+
+// src/lanes/claude.ts
+function createClaudeAdapter(deps = {}) {
+  return {
+    kind: "claude",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      try {
+        await loader();
+        return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "claude")) {
+          return { kind: "claude", sdk: "@anthropic-ai/claude-agent-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "claude",
+          sdk: "@anthropic-ai/claude-agent-sdk",
+          wired: false,
+          reason: "neither @anthropic-ai/claude-agent-sdk nor the claude CLI is available on this machine"
+        };
       }
-      if (typeof left !== typeof right) {
-        throw new ExprEvalError(`cannot compare ${JSON.stringify(left)} (${typeof left}) with ${JSON.stringify(right)} (${typeof right})`);
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "claude lane requires a prompt" };
       }
-      switch (node.op) {
-        case "==":
-          return left === right;
-        case "!=":
-          return left !== right;
-        case "<":
-          return left < right;
-        case "<=":
-          return left <= right;
-        case ">":
-          return left > right;
-        case ">=":
-          return left >= right;
-        default:
-          throw new ExprEvalError(`unknown operator ${node.op}`);
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@anthropic-ai/claude-agent-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch (err) {
+        return runClaudeCli(job, deps.cliPath ?? "claude", started, timeoutMs);
       }
-    }
-    case "and": {
-      const left = evalNode(node.left, context);
-      const right = evalNode(node.right, context);
-      if (typeof left !== "boolean" || typeof right !== "boolean") {
-        throw new ExprEvalError("and requires boolean operands");
+      const query = sdk.query;
+      if (typeof query !== "function") {
+        throw new LaneAdapterShapeError("@anthropic-ai/claude-agent-sdk exports no query() function");
       }
-      return left && right;
-    }
-    case "or": {
-      const left = evalNode(node.left, context);
-      const right = evalNode(node.right, context);
-      if (typeof left !== "boolean" || typeof right !== "boolean") {
-        throw new ExprEvalError("or requires boolean operands");
+      const prompt = job.prompt;
+      const abortController = new AbortController;
+      try {
+        const { output, isError } = await withTimeout((async () => {
+          const generator = await query({
+            prompt,
+            options: { model: job.model, cwd: job.cwd, maxTurns: 32, abortController, env: subscriptionSdkEnvironment(job.env) }
+          });
+          let output2 = "";
+          let isError2 = false;
+          for await (const message of generator) {
+            if (message.type === "assistant") {
+              const content = message.message?.content;
+              if (Array.isArray(content)) {
+                for (const block of content) {
+                  if (block && typeof block === "object" && "text" in block && typeof block.text === "string") {
+                    output2 += block.text;
+                  }
+                }
+              }
+            }
+            if (message.type === "error")
+              isError2 = true;
+          }
+          return { output: output2, isError: isError2 };
+        })(), timeoutMs, "claude lane", () => abortController.abort());
+        const durationMs = Date.now() - started;
+        return { ok: !isError, exitCode: isError ? 1 : 0, output: output.trim(), durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
-      return left || right;
-    }
-    case "not": {
-      const operand = evalNode(node.operand, context);
-      if (typeof operand !== "boolean")
-        throw new ExprEvalError("not requires a boolean operand");
-      return !operand;
-    }
-  }
-}
-function evaluateExpr(input, context) {
-  const ast = parseExpr(input);
-  const value = evalNode(ast, context);
-  if (typeof value !== "boolean") {
-    throw new ExprEvalError(`condition must evaluate to a boolean, got ${typeof value}`);
-  }
-  return value;
-}
-
-// src/graph.ts
-var GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
-var LANE_KINDS = ["claude", "codex", "cursor", "grok"];
-var NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
-function issue(issues, path, message) {
-  issues.push({ path, message });
-}
-function findNode(graph, id) {
-  return graph.nodes.find((n) => n.id === id);
-}
-function collectEdges(graph) {
-  const edges = [];
-  for (const node of graph.nodes) {
-    switch (node.type) {
-      case "start":
-      case "step":
-        if (node.next)
-          edges.push({ from: node.id, to: node.next });
-        break;
-      case "decision":
-        if (node.then)
-          edges.push({ from: node.id, to: node.then });
-        if (node.else)
-          edges.push({ from: node.id, to: node.else });
-        break;
-      case "while":
-        if (node.next)
-          edges.push({ from: node.id, to: node.next });
-        break;
-      case "end":
-        break;
     }
-  }
-  return edges;
+  };
 }
-function reachableNodes(graph) {
-  const start = graph.nodes.find((n) => n.type === "start");
-  if (!start)
-    return [];
-  const seen = new Set;
-  const stack = [start.id];
-  while (stack.length > 0) {
-    const id = stack.pop();
-    if (seen.has(id))
-      continue;
-    seen.add(id);
-    const node = findNode(graph, id);
-    if (!node)
-      continue;
-    if (node.type === "start" || node.type === "step") {
-      if (node.next)
-        stack.push(node.next);
-    } else if (node.type === "decision") {
-      if (node.then)
-        stack.push(node.then);
-      if (node.else)
-        stack.push(node.else);
-    } else if (node.type === "while") {
-      for (const bodyId of node.body)
-        stack.push(bodyId);
-      if (node.next)
-        stack.push(node.next);
+async function runClaudeCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = await spawnCli([cliPath, "-p", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@anthropic-ai/claude-agent-sdk or the claude CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
     }
+    throw err;
   }
-  return [...seen];
 }
-function findCycles(graph) {
-  const edges = collectEdges(graph);
-  const adj = new Map;
-  for (const e of edges) {
-    const list = adj.get(e.from) ?? [];
-    list.push(e.to);
-    adj.set(e.from, list);
-  }
-  const color = new Map;
-  const stack = [];
-  const cycles = [];
-  function visit(id) {
-    color.set(id, "grey");
-    stack.push(id);
-    for (const to of adj.get(id) ?? []) {
-      const c = color.get(to);
-      if (c === "grey") {
-        const idx = stack.indexOf(to);
-        cycles.push([...stack.slice(idx), to]);
-      } else if (c === undefined) {
-        visit(to);
+var init_claude = __esm(() => {
+  init_types();
+});
+
+// src/lanes/codex.ts
+function createCodexAdapter(deps = {}) {
+  return {
+    kind: "codex",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      try {
+        await loader();
+        return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "sdk" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "codex")) {
+          return { kind: "codex", sdk: "@openai/codex-sdk", wired: true, via: "cli" };
+        }
+        return {
+          kind: "codex",
+          sdk: "@openai/codex-sdk",
+          wired: false,
+          reason: "neither @openai/codex-sdk nor the codex CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
+      }
+      if (job.codexMode !== undefined && (!CODEX_EXECUTION_MODES.includes(job.codexMode) || job.lane !== "codex" || job.command !== undefined)) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codexMode must be repository or read-only on a codex prompt without command", retryable: false };
+      }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCodexCli(job, deps.cliPath ?? "codex", started, timeoutMs);
+      }
+      const CodexClass = sdk.Codex;
+      if (typeof CodexClass !== "function") {
+        throw new LaneAdapterShapeError("@openai/codex-sdk exports no Codex class");
+      }
+      const abortController = new AbortController;
+      try {
+        const client = await withTimeout(Promise.resolve(new CodexClass({
+          config: { model: job.model },
+          env: subscriptionEnvironment(job.env)
+        })), timeoutMs, "codex lane");
+        const thread = client.startThread?.({
+          model: job.model,
+          workingDirectory: job.cwd,
+          ...job.codexMode === "read-only" ? { sandboxMode: "read-only", skipGitRepoCheck: true, approvalPolicy: "never" } : {}
+        });
+        if (!thread || typeof thread.run !== "function") {
+          throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
+        }
+        const turn = await withTimeout(thread.run(job.prompt, { signal: abortController.signal }), timeoutMs, "codex lane", () => abortController.abort());
+        const durationMs = Date.now() - started;
+        const output = turn?.finalResponse;
+        if (typeof output !== "string" || !output.trim()) {
+          return missingResponse(durationMs);
+        }
+        return { ok: true, exitCode: 0, output, durationMs };
+      } catch (err) {
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
-    stack.pop();
-    color.set(id, "black");
-  }
-  for (const node of graph.nodes) {
-    if (color.get(node.id) === undefined)
-      visit(node.id);
-  }
-  return cycles;
+  };
 }
-function validateGraph(graph) {
-  const issues = [];
-  if (graph === null || typeof graph !== "object" || Array.isArray(graph)) {
-    return { ok: false, issues: [{ path: "graph", message: "graph must be an object" }] };
-  }
-  if (typeof graph.name !== "string" || graph.name.trim() === "") {
-    issue(issues, "name", "graph requires a non-empty name");
-  }
-  if (typeof graph.version !== "string" || graph.version.trim() === "") {
-    issue(issues, "version", "graph requires a version string");
+async function runCodexCli(job, cliPath, started, timeoutMs) {
+  try {
+    const controls = job.codexMode === "read-only" ? ["--sandbox", "read-only", "--skip-git-repo-check", "--config", 'approval_policy="never"'] : [];
+    const result = await spawnCli([cliPath, "exec", ...controls, "--", job.prompt], {
+      binaryName: cliPath,
+      packageHint: "@openai/codex-sdk or the codex CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd,
+      stdoutOnly: true
+    });
+    const durationMs = Date.now() - started;
+    return result.ok && !result.output.trim() ? missingResponse(durationMs) : { ...result, durationMs };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
   }
-  if (graph.memoWatch !== undefined) {
-    if (!Array.isArray(graph.memoWatch) || graph.memoWatch.length === 0) {
-      issue(issues, "memoWatch", "memoWatch must be a non-empty array of file paths or globs");
-    } else {
-      for (const entry of graph.memoWatch) {
-        if (typeof entry !== "string" || entry.trim() === "") {
-          issue(issues, "memoWatch", "each memoWatch entry must be a non-empty path or glob string");
-          break;
+}
+function missingResponse(durationMs) {
+  return { ok: false, exitCode: 1, output: "", durationMs, error: "Codex completed without an agent response; verify the native subscription and model route", retryable: false };
+}
+var init_codex = __esm(() => {
+  init_graph();
+  init_types();
+});
+
+// src/lanes/cursor.ts
+function createCursorAdapter(deps = {}) {
+  return {
+    kind: "cursor",
+    async probe() {
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      try {
+        await loader();
+        return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "sdk (local mode)" };
+      } catch {
+        if (binaryOnPath(deps.cliPath ?? "cursor-agent")) {
+          return { kind: "cursor", sdk: "@cursor/sdk", wired: true, via: "cli" };
         }
+        return {
+          kind: "cursor",
+          sdk: "@cursor/sdk",
+          wired: false,
+          reason: "neither @cursor/sdk nor the cursor-agent CLI is available on this machine"
+        };
+      }
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "cursor lane requires a prompt" };
+      }
+      if (!deps.sdkLoader && binaryOnPath(deps.cliPath ?? "cursor-agent"))
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", Date.now(), job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS);
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const loader = deps.sdkLoader ?? (async () => await import("@cursor/sdk"));
+      let sdk;
+      try {
+        sdk = await loader();
+      } catch {
+        return runCursorCli(job, deps.cliPath ?? "cursor-agent", started, timeoutMs);
+      }
+      let cancel;
+      try {
+        subscriptionEnvironment(job.env);
+        if (!deps.sdkLoader && process.env.CURSOR_API_KEY)
+          throw new Error("cursor lane refuses ambient API billing; use the native subscription CLI");
+        const run2 = await withTimeout(runLocalAgent(sdk, job, (callback) => {
+          cancel = callback;
+        }), timeoutMs, "cursor lane", () => cancel?.());
+        const durationMs = Date.now() - started;
+        const status = run2.status;
+        const ok = status === "finished";
+        return { ok, exitCode: ok ? 0 : 1, output: run2.result, durationMs };
+      } catch (err) {
+        if (err instanceof LaneAdapterShapeError)
+          throw err;
+        const durationMs = Date.now() - started;
+        return { ok: false, exitCode: 1, output: "", durationMs, error: String(err instanceof Error ? err.message : err), retryable: !(err instanceof LaneTimeoutError) };
       }
     }
+  };
+}
+async function runLocalAgent(sdk, job, onCancel) {
+  const AgentClass = sdk.Agent;
+  const CursorClass = sdk.Cursor;
+  if (typeof AgentClass !== "function" && typeof CursorClass !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk exports no Agent/Cursor class");
   }
-  if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) {
-    issue(issues, "nodes", "graph requires at least one node");
-    return { ok: false, issues };
-  }
-  for (let index = 0;index < graph.nodes.length; index++) {
-    const node = graph.nodes[index];
-    if (node === null || typeof node !== "object" || Array.isArray(node)) {
-      issue(issues, `nodes.${index}`, "node must be an object");
-      continue;
-    }
-    if (!GRAPH_NODE_TYPES.includes(node.type))
-      issue(issues, `nodes.${index}.type`, "type must be start, step, decision, while, or end");
-    for (const key of ["next", "then", "else", "prompt", "command"]) {
-      const value = node[key];
-      if (value !== undefined && (typeof value !== "string" || value.trim() === ""))
-        issue(issues, `nodes.${index}.${key}`, `${key} must be a non-empty string`);
-    }
-    if (node.type === "while" && (!Array.isArray(node.body) || node.body.some((id) => typeof id !== "string")))
-      issue(issues, `nodes.${index}.body`, "body must be an array of node ids");
+  const create = AgentClass.create;
+  const agent = typeof create === "function" ? await create.call(AgentClass, { local: { cwd: job.cwd, enableAgentRetries: false } }) : typeof AgentClass === "function" ? new AgentClass : undefined;
+  if (!agent || typeof agent.send !== "function") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent has no send()");
   }
-  if (issues.length)
-    return { ok: false, issues };
-  const starts = graph.nodes.filter((n) => n.type === "start");
-  if (starts.length === 0)
-    issue(issues, "nodes", "graph requires exactly one start node (found none)");
-  if (starts.length > 1)
-    issue(issues, "nodes", "graph requires exactly one start node (found multiple)");
-  const ends = graph.nodes.filter((n) => n.type === "end");
-  if (ends.length === 0)
-    issue(issues, "nodes", "graph requires at least one end node");
-  const seenIds = new Map;
-  for (const node of graph.nodes) {
-    if (typeof node.id !== "string" || !NODE_ID_RE.test(node.id)) {
-      issue(issues, "nodes", `node id ${JSON.stringify(node.id)} must match ${String(NODE_ID_RE)}`);
-      continue;
-    }
-    if (seenIds.has(node.id)) {
-      issue(issues, `nodes.${node.id}`, `duplicate node id ${node.id}`);
-      continue;
-    }
-    seenIds.set(node.id, node);
-    if (!GRAPH_NODE_TYPES.includes(node.type)) {
-      issue(issues, `nodes.${node.id}`, `unknown node type ${JSON.stringify(node.type)}`);
-      continue;
-    }
-    validateNode(graph, node, issues);
+  let run2 = await agent.send(job.prompt, { model: job.model });
+  if (run2 && typeof run2 === "object") {
+    const handle = run2;
+    if (typeof handle.cancel === "function")
+      onCancel(() => {
+        handle.cancel().catch(() => {});
+      });
+    if (typeof handle.wait === "function")
+      run2 = await handle.wait();
   }
-  for (const node of graph.nodes) {
-    const edges = nodeEdges(node);
-    for (const { kind, target } of edges) {
-      if (!seenIds.has(target)) {
-        issue(issues, `nodes.${node.id}`, `${kind} edge targets nonexistent node ${target}`);
-      }
-    }
+  if (!run2 || typeof run2 !== "object") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned no Run");
   }
-  if (starts.length === 1) {
-    const reachable = new Set(reachableNodes(graph));
-    for (const node of graph.nodes) {
-      if (!reachable.has(node.id)) {
-        issue(issues, `nodes.${node.id}`, `node ${node.id} is unreachable from start`);
-      }
-    }
+  const candidate = run2;
+  if (typeof candidate.status !== "string" || !["finished", "error", "cancelled"].includes(candidate.status)) {
+    throw new LaneAdapterShapeError(`@cursor/sdk Agent.send() returned a Run without a terminal status (got ${JSON.stringify(candidate.status)}; expected finished|error|cancelled)`);
   }
-  const cycles = findCycles(graph);
-  for (const cycle of cycles) {
-    issue(issues, "nodes", `explicit cycle detected: ${cycle.join(" -> ")} (loop only via a while node)`);
+  if (typeof candidate.result !== "string") {
+    throw new LaneAdapterShapeError("@cursor/sdk Agent.send() returned a Run without a string result");
   }
-  return { ok: issues.length === 0, issues };
+  return { status: candidate.status, result: candidate.result };
 }
-function nodeEdges(node) {
-  switch (node.type) {
-    case "start":
-    case "step":
-      return node.next ? [{ kind: "next", target: node.next }] : [];
-    case "decision":
-      return [
-        ...node.then ? [{ kind: "then", target: node.then }] : [],
-        ...node.else ? [{ kind: "else", target: node.else }] : []
-      ];
-    case "while":
-      return node.next ? [{ kind: "next", target: node.next }] : [];
-    case "end":
-      return [];
-    default:
-      return [];
+async function runCursorCli(job, cliPath, started, timeoutMs) {
+  try {
+    const result = await spawnCli([cliPath, "--print", job.prompt, ...job.model ? ["--model", job.model] : []], {
+      binaryName: cliPath,
+      packageHint: "@cursor/sdk (local mode) or the cursor-agent CLI",
+      timeoutMs,
+      env: job.env,
+      cwd: job.cwd
+    });
+    return { ...result, durationMs: Date.now() - started };
+  } catch (err) {
+    if (err instanceof LaneDependencyMissingError) {
+      return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
+    }
+    throw err;
   }
 }
-function validateNode(graph, node, issues) {
-  switch (node.type) {
-    case "start":
-      if (!node.next)
-        issue(issues, `nodes.${node.id}`, "start node requires a next edge");
-      break;
-    case "step": {
-      if (!node.prompt && !node.command) {
-        issue(issues, `nodes.${node.id}`, "step node requires prompt or command");
-      }
-      if (node.lane !== undefined && !LANE_KINDS.includes(node.lane)) {
-        issue(issues, `nodes.${node.id}`, `unknown lane ${JSON.stringify(node.lane)} (expected one of ${LANE_KINDS.join(", ")})`);
-      }
-      if (node.maxRetries !== undefined && (!Number.isInteger(node.maxRetries) || node.maxRetries < 0)) {
-        issue(issues, `nodes.${node.id}`, "maxRetries must be a non-negative integer");
-      }
-      if (node.timeoutMs !== undefined && (!Number.isInteger(node.timeoutMs) || node.timeoutMs < 1)) {
-        issue(issues, `nodes.${node.id}`, "timeoutMs must be a positive integer");
-      }
-      break;
-    }
-    case "decision": {
-      if (typeof node.condition !== "string" || node.condition.trim() === "") {
-        issue(issues, `nodes.${node.id}`, "decision node requires a condition expression");
-      } else {
-        try {
-          parseExpr(node.condition);
-        } catch (err) {
-          if (err instanceof ExprSyntaxError) {
-            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
-          } else {
-            throw err;
-          }
-        }
-      }
-      if (!node.then && !node.else) {
-        issue(issues, `nodes.${node.id}`, "decision node requires then and/or else edge");
-      }
-      break;
-    }
-    case "while": {
-      if (typeof node.condition !== "string" || node.condition.trim() === "") {
-        issue(issues, `nodes.${node.id}`, "while node requires a condition expression");
-      } else {
-        try {
-          parseExpr(node.condition);
-        } catch (err) {
-          if (err instanceof ExprSyntaxError) {
-            issue(issues, `nodes.${node.id}.condition`, `invalid condition expression: ${err.message}`);
-          } else {
-            throw err;
-          }
-        }
+var init_cursor = __esm(() => {
+  init_types();
+});
+
+// src/lanes/grok.ts
+function createGrokAdapter(deps = {}) {
+  return {
+    kind: "grok",
+    async probe() {
+      const cliPath = deps.cliPath ?? "grok";
+      if (binaryOnPath(cliPath)) {
+        return { kind: "grok", sdk: "no npm SDK (measured 2026-08-25)", wired: true, via: "cli" };
       }
-      if (node.maxIterations === undefined) {
-        issue(issues, `nodes.${node.id}`, "while node requires maxIterations (finite loop bound)");
-      } else if (!Number.isInteger(node.maxIterations) || node.maxIterations < 1) {
-        issue(issues, `nodes.${node.id}`, "maxIterations must be a positive integer");
+      return {
+        kind: "grok",
+        sdk: "no npm SDK (measured 2026-08-25)",
+        wired: false,
+        reason: `no xAI Grok SDK exists on npm (measured 2026-08-25) and the grok CLI is not on PATH`
+      };
+    },
+    async run(job) {
+      if (!job.prompt) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "grok lane requires a prompt" };
       }
-      if (!Array.isArray(node.body) || node.body.length === 0) {
-        issue(issues, `nodes.${node.id}`, "while node requires a non-empty body");
-      } else {
-        for (const bodyId of node.body) {
-          const bodyNode = findNode(graph, bodyId);
-          if (!bodyNode) {
-            issue(issues, `nodes.${node.id}`, `while body references nonexistent node ${bodyId}`);
-            continue;
-          }
-          if (bodyNode.type === "start" || bodyNode.type === "end" || bodyNode.type === "while") {
-            issue(issues, `nodes.${node.id}`, `while body may only contain step/decision nodes in v1 (found ${bodyNode.type})`);
-          }
-        }
-        const bodySet = new Set(node.body);
-        for (const bodyId of node.body) {
-          const bodyNode = findNode(graph, bodyId);
-          if (!bodyNode)
-            continue;
-          for (const { kind, target } of nodeEdges(bodyNode)) {
-            if (!bodySet.has(target)) {
-              issue(issues, `nodes.${node.id}`, `while body node ${bodyId} ${kind}-edge leaves the body (target ${target})`);
-            }
-          }
+      const started = Date.now();
+      const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
+      const cliPath = deps.cliPath ?? "grok";
+      try {
+        const result = await spawnCli([cliPath, job.prompt], {
+          binaryName: cliPath,
+          packageHint: "the grok CLI (no xAI Grok SDK exists on npm \u2014 measured 2026-08-25)",
+          timeoutMs,
+          env: job.env,
+          cwd: job.cwd
+        });
+        return { ...result, durationMs: Date.now() - started };
+      } catch (err) {
+        if (err instanceof LaneDependencyMissingError) {
+          return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
         }
+        throw err;
       }
-      break;
     }
-    case "end":
-      break;
+  };
+}
+var init_grok = __esm(() => {
+  init_types();
+});
+
+// src/lanes/index.ts
+var exports_lanes = {};
+__export(exports_lanes, {
+  runLaneJob: () => runLaneJob,
+  resolveLane: () => resolveLane,
+  probeLane: () => probeLane,
+  laneInventory: () => laneInventory,
+  createGrokAdapter: () => createGrokAdapter,
+  createCursorAdapter: () => createCursorAdapter,
+  createCodexAdapter: () => createCodexAdapter,
+  createClaudeAdapter: () => createClaudeAdapter,
+  binaryOnPath: () => binaryOnPath,
+  LaneDependencyMissingError: () => LaneDependencyMissingError,
+  LaneAdapterShapeError: () => LaneAdapterShapeError,
+  LANE_KINDS: () => LANE_KINDS2
+});
+function resolveLane(kind) {
+  const adapter = adapters.get(kind);
+  if (!adapter)
+    throw new Error(`unknown lane ${kind} (expected one of ${LANE_KINDS2.join(", ")})`);
+  return adapter;
+}
+async function runLaneJob(job) {
+  return resolveLane(job.lane).run(job);
+}
+async function probeLane(kind) {
+  return resolveLane(kind).probe();
+}
+async function laneInventory() {
+  return Promise.all(LANE_KINDS2.map((kind) => probeLane(kind)));
+}
+var adapters;
+var init_lanes = __esm(() => {
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  init_types();
+  init_types();
+  init_claude();
+  init_codex();
+  init_cursor();
+  init_grok();
+  adapters = new Map([
+    ["claude", createClaudeAdapter()],
+    ["codex", createCodexAdapter()],
+    ["cursor", createCursorAdapter()],
+    ["grok", createGrokAdapter()]
+  ]);
+});
+
+// src/service.ts
+import { createHash as createHash3 } from "crypto";
+// package.json
+var package_default = {
+  name: "@hasna/workflows",
+  version: "0.2.2",
+  description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
+  type: "module",
+  main: "./dist/index.js",
+  types: "./types/index.d.ts",
+  bin: {
+    workflows: "dist/cli/index.js",
+    "workflows-mcp": "dist/mcp/index.js",
+    "workflows-serve": "dist/serve/index.js"
+  },
+  exports: {
+    ".": {
+      types: "./types/index.d.ts",
+      import: "./dist/index.js"
+    },
+    "./sdk": {
+      types: "./types/sdk.d.ts",
+      import: "./dist/sdk.js"
+    },
+    "./cli": {
+      types: "./types/cli/index.d.ts",
+      import: "./dist/cli/index.js"
+    }
+  },
+  files: [
+    "dist",
+    "types",
+    "README.md",
+    "LICENSE",
+    "hasna.contract.json"
+  ],
+  scripts: {
+    build: "bun run check:sdk && bun run build:runtime && bun run build:types",
+    "generate:sdk": "bun scripts/generate-sdk.ts --write",
+    "check:sdk": "bun scripts/generate-sdk.ts",
+    "test:artifacts": "bun scripts/artifact-acceptance.ts",
+    "build:runtime": "bun build src/cli/index.ts --outdir dist/cli --target bun && bun build src/mcp/index.ts --outdir dist/mcp --target bun && bun build src/serve/index.ts src/serve/admin.ts --outdir dist/serve --target bun --packages external && bun build src/index.ts src/service.ts src/handlers.ts src/agent-tools.ts src/types.ts --root src --outdir dist --target bun --packages external && bun build src/sdk.ts --outdir dist --target node",
+    "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly --outDir types",
+    "artifact-scan": "bun scripts/contracts-cli.mjs artifact-scan dist",
+    "contract:check": "bun scripts/contracts-cli.mjs repo-conformance .",
+    typecheck: "tsc --noEmit",
+    test: "bun test",
+    "test:pg": 'WORKFLOWS_TEST_DATABASE_URL="${WORKFLOWS_TEST_DATABASE_URL:?point it at a fresh test Postgres database}" WORKFLOWS_REQUIRE_POSTGRES=1 bun test src/db/postgres-store.test.ts src/db/postgres-http.test.ts src/db/postgres-fencing.test.ts',
+    prepack: "bun run build && bun run artifact-scan",
+    prepublishOnly: "bun run test && bun run build"
+  },
+  keywords: [
+    "workflows",
+    "graph",
+    "automation",
+    "cli",
+    "typescript",
+    "bun",
+    "hasna"
+  ],
+  publishConfig: {
+    registry: "https://registry.npmjs.org",
+    access: "public"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/hasna/apps.git",
+    directory: "apps/workflows"
+  },
+  homepage: "https://github.com/hasna/apps/tree/main/apps/workflows",
+  bugs: {
+    url: "https://github.com/hasna/apps/issues"
+  },
+  engines: {
+    bun: ">=1.0.0"
+  },
+  author: "Hasna",
+  license: "Apache-2.0",
+  dependencies: {
+    "@anthropic-ai/claude-agent-sdk": "0.3.234",
+    "@cursor/sdk": "^1.0.28",
+    "@hasna/contracts": "1.3.5",
+    "@openai/codex-sdk": "0.160.0",
+    commander: "^13.1.0",
+    pg: "^8.16.3"
+  },
+  devDependencies: {
+    "@types/bun": "1.3.14",
+    "@types/pg": "^8.15.6",
+    typescript: "^5.7.3"
   }
+};
+
+// src/version.ts
+function packageVersion() {
+  return package_default.version;
 }
 
+// src/daemon.ts
+init_expr();
+init_graph();
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/secrets.ts
 class SecretsGateError extends Error {
   constructor(message) {
@@ -2034,7 +2076,14 @@ class WorkflowsDaemon {
     const isLoopBody = graph.nodes.some((candidate) => candidate.type === "while" && candidate.body.includes(nodeId));
     const nodeRow = latest === undefined || isLoopBody && latest.status === "completed" ? await this.store.createRunNode({ runId: run2.id, nodeId, lane: node2.lane ?? "claude" }) : latest;
     const memoWatch = node2.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
-    const memoSource = { command: node2.command, prompt: node2.prompt, context: stripRunState(context) };
+    const memoSource = {
+      command: node2.command,
+      prompt: node2.prompt,
+      context: stripRunState(context),
+      lane: node2.lane ?? "claude",
+      cwd: node2.cwd,
+      codexMode: node2.lane === "codex" ? node2.codexMode ?? "repository" : undefined
+    };
     const memoInput = node2.memo ? memoWatch !== undefined ? { ...memoSource, memoWatch } : memoSource : undefined;
     if (memoInput !== undefined) {
       const hit = await tryMemoHit(this.store, run2.graphName, nodeId, memoInput);
@@ -2059,6 +2108,8 @@ class WorkflowsDaemon {
       lane: node2.lane ?? "claude",
       prompt: node2.prompt,
       command: node2.command,
+      cwd: node2.cwd,
+      codexMode: node2.codexMode,
       timeoutMs: node2.timeoutMs,
       env: this.env
     };
@@ -2644,7 +2695,7 @@ function openStore(dataDir2) {
 // src/wal.ts
 import { Database as Database2 } from "bun:sqlite";
 import { createHash as createHash2 } from "crypto";
-import { appendFileSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
+import { closeSync, copyFileSync, existsSync as existsSync2, fsyncSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
 import { basename, dirname, join as join4 } from "path";
 var WAL_FILE_NAME = "session.wal";
 var SESSIONS_DIR_NAME = "sessions";
@@ -2714,8 +2765,20 @@ class SessionWAL {
     const full = { ...op, at };
     const nextSeq = this.nextSeq();
     const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
-    appendFileSync(this.filePath, JSON.stringify(entry) + `
-`, { encoding: "utf8", mode: 384 });
+    const fd = openSync(this.filePath, "a", 384);
+    try {
+      writeFileSync(fd, JSON.stringify(entry) + `
+`, "utf8");
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    const parent = openSync(dirname(this.filePath), "r");
+    try {
+      fsyncSync(parent);
+    } finally {
+      closeSync(parent);
+    }
     return entry;
   }
   nextSeq() {
@@ -2732,7 +2795,9 @@ class SessionWAL {
     let content;
     try {
       content = readFileSync2(this.filePath, "utf8");
-    } catch {
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
       return { entries, torn, repaired, liveClaims: () => new Map };
     }
     if (content.length > MAX_WAL_BYTES) {
@@ -2822,7 +2887,42 @@ function preserveOriginal(filePath) {
   return backup;
 }
 
+// src/journal-directory.ts
+import { accessSync, closeSync as closeSync2, constants as constants2, fstatSync, lstatSync, openSync as openSync2, readFileSync as readFileSync3, readSync } from "fs";
+import { join as join5 } from "path";
+function assertJournalDirectory(dataDir2, identity) {
+  try {
+    if (!lstatSync(dataDir2).isDirectory() || !lstatSync(join5(dataDir2, "sessions")).isDirectory())
+      throw new Error;
+    accessSync(dataDir2, constants2.R_OK | constants2.W_OK | constants2.X_OK);
+    accessSync(join5(dataDir2, "sessions"), constants2.R_OK | constants2.W_OK | constants2.X_OK);
+    const marker = openSync2(join5(dataDir2, ".workflows-data-identity"), constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    try {
+      const stat = fstatSync(marker);
+      if (!stat.isFile() || stat.size > 256 || readFileSync3(marker, "utf8") !== identity + `
+`)
+        throw new Error;
+    } finally {
+      closeSync2(marker);
+    }
+    for (const file of ["workflows.db", "sessions/session.wal"]) {
+      const fd = openSync2(join5(dataDir2, file), constants2.O_RDWR | constants2.O_NOFOLLOW);
+      try {
+        if (!fstatSync(fd).isFile())
+          throw new Error;
+        readSync(fd, Buffer.alloc(1), 0, 1, 0);
+      } finally {
+        closeSync2(fd);
+      }
+    }
+  } catch {
+    throw new Error("configured execution journal identity or accessibility check failed");
+  }
+}
+
 // src/service.ts
+init_graph();
+init_lanes();
 import { hostname } from "os";
 import { resolveDatabaseUrl } from "@hasna/contracts";
 var DEFAULT_PORT = 8790;
@@ -2843,6 +2943,14 @@ function envInt(names, fallback) {
   return Number.isFinite(parsed) ? parsed : fallback;
 }
 function resolveWorkflowsConfig(overrides = {}) {
+  const rawLanes = process.env.HASNA_WORKFLOWS_ENABLED_LANES;
+  const enabledLanes = overrides.enabledLanes ?? (rawLanes === undefined ? LANE_KINDS : rawLanes.trim() === "" ? [] : rawLanes.split(",").map((value) => value.trim()));
+  if (!Array.isArray(enabledLanes) || enabledLanes.some((lane) => !LANE_KINDS.includes(lane)) || new Set(enabledLanes).size !== enabledLanes.length) {
+    throw new Error("HASNA_WORKFLOWS_ENABLED_LANES must be a unique comma-separated subset of claude,codex,cursor,grok; an empty value disables model lanes");
+  }
+  const dataIdentity = overrides.dataIdentity ?? process.env.HASNA_WORKFLOWS_DATA_IDENTITY;
+  if (dataIdentity !== undefined && !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(dataIdentity))
+    throw new Error("HASNA_WORKFLOWS_DATA_IDENTITY must be a nonempty data identity of at most 128 characters");
   const originAuth = overrides.originAuth ?? process.env.HASNA_WORKFLOWS_ORIGIN_AUTH;
   if (originAuth !== undefined && !/^[A-Za-z0-9_-]{32,256}$/.test(originAuth))
     throw new Error("HASNA_WORKFLOWS_ORIGIN_AUTH must be a valid gateway origin identity");
@@ -2853,9 +2961,11 @@ function resolveWorkflowsConfig(overrides = {}) {
     apiUrl: overrides.apiUrl ?? envString(["HASNA_WORKFLOWS_API_URL", "WORKFLOWS_API_URL"]),
     apiKey: overrides.apiKey ?? envString(["HASNA_WORKFLOWS_API_KEY", "WORKFLOWS_API_KEY"]),
     originAuth,
+    dataIdentity,
     storageBackend: overrides.storageBackend ?? "postgresql",
     databaseUrl: overrides.databaseUrl ?? envString(["HASNA_WORKFLOWS_DATABASE_URL", "WORKFLOWS_DATABASE_URL"]),
-    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"])
+    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"]),
+    enabledLanes: Object.freeze([...enabledLanes])
   };
 }
 
@@ -2888,16 +2998,52 @@ class WorkflowsService {
   }
   async ready() {
     const checks = { version: "ok", auth: this.config.apiKey ? "ok" : "missing", storage: "not-checked" };
-    if (this.config.apiKey) {
+    if (this.config.dataIdentity !== undefined) {
+      try {
+        this.verifyJournalDirectory();
+        checks.journal = "ok";
+      } catch {
+        checks.journal = "unavailable";
+      }
+    }
+    if (this.config.apiKey && checks.journal !== "unavailable") {
       try {
         checks.storage = await this.withStore(async (store) => (store instanceof PostgresWorkflowsStore ? await store.checkSchema() : (await store.listTables()).sort().join(",") === "memos,run_nodes,runs") ? "ok" : "invalid-schema");
       } catch (error) {
         checks.storage = error instanceof WorkflowRequestError && error.code === "invalid_schema" ? "invalid-schema" : "unavailable";
       }
     }
-    return { ok: checks.auth === "ok" && checks.storage === "ok", service: this.name, version: this.version, checks };
+    return { ok: checks.auth === "ok" && checks.storage === "ok" && checks.journal !== "unavailable", service: this.name, version: this.version, checks };
+  }
+  verifyJournalDirectory() {
+    if (this.config.dataIdentity !== undefined) {
+      try {
+        assertJournalDirectory(this.config.dataDir, this.config.dataIdentity);
+      } catch {
+        throw new WorkflowRequestError("journal_unavailable", "configured execution journal identity or accessibility check failed", 503);
+      }
+    }
+  }
+  assertEnabledGraphLanes(graph) {
+    if (!Array.isArray(graph?.nodes))
+      return;
+    for (const node2 of graph.nodes) {
+      if (node2.type === "step" && !node2.command && !this.config.enabledLanes.includes(node2.lane ?? "claude")) {
+        throw new WorkflowRequestError("lane_disabled", "the workflow contains a model lane disabled by server configuration", 403);
+      }
+    }
+  }
+  async probeLane(kind) {
+    if (this.config.enabledLanes.includes(kind))
+      return probeLane(kind);
+    const sdk = { claude: "@anthropic-ai/claude-agent-sdk", codex: "@openai/codex-sdk", cursor: "@cursor/sdk", grok: "no npm SDK (measured 2026-08-25)" };
+    return { kind, sdk: sdk[kind], wired: false, reason: "disabled by server configuration" };
+  }
+  laneInventory() {
+    return Promise.all(LANE_KINDS.map((kind) => this.probeLane(kind)));
   }
   async openEngineStore(verifySchema = true) {
+    this.verifyJournalDirectory();
     if (this.config.storageBackend === "sqlite")
       return openStore(this.config.dataDir);
     if (this.config.storageBackend !== "postgresql")
@@ -2951,6 +3097,7 @@ class WorkflowsService {
     return this.withStore((store) => store.listRunNodes(id));
   }
   events(id) {
+    this.verifyJournalDirectory();
     return SessionWAL.open(this.config.dataDir).replay({ repair: false }).entries.filter((entry) => ("runId" in entry.op) && entry.op.runId === id);
   }
   cancelRun(id) {
@@ -2967,7 +3114,6 @@ class WorkflowsService {
   }
   async resumeRun(id) {
     const store = await this.openEngineStore();
-    const wal = SessionWAL.open(this.config.dataDir);
     try {
       const run2 = await store.getRun(id);
       if (!run2)
@@ -2975,13 +3121,15 @@ class WorkflowsService {
       if (!["failed", "cancelled", "interrupted"].includes(run2.status))
         throw new WorkflowRequestError("invalid_run_status", "resume requires a failed, cancelled, or interrupted run", 409);
       const context = JSON.parse(run2.contextJson);
+      const graph = context.__wf?.graph;
+      if (!graph)
+        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
+      this.assertEnabledGraphLanes(graph);
+      const wal = SessionWAL.open(this.config.dataDir);
       if (context.__wf?.resumeBlocked || context.__wf?.executionMayBeActive || wal.replay({ repair: false }).liveClaims().has(id))
         throw new WorkflowRequestError("execution_active", "previous execution must finish before resume", 409);
       if (store instanceof PostgresWorkflowsStore && !await store.acquireExecution(id))
         throw new WorkflowRequestError("execution_active", "another executor still owns this run", 409);
-      const graph = context.__wf?.graph;
-      if (!graph)
-        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
       if (!await store.compareRunStatus(id, ["failed", "cancelled", "interrupted"], "pending", { error: null }))
         throw new WorkflowRequestError("run_status_conflict", "run changed before resume", 409);
       for (const node2 of await store.listRunNodes(id)) {
@@ -2995,6 +3143,7 @@ class WorkflowsService {
     }
   }
   sessions(action) {
+    this.verifyJournalDirectory();
     const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
     if (action === "list")
       return replay.entries.slice(-100).map(({ seq, at, op }) => ({ seq, at, operation: op.op }));
@@ -3012,6 +3161,7 @@ class WorkflowsService {
     return { ...local, health: this.health(), sessions: this.sessions("pull") };
   }
   daemonStatus() {
+    this.verifyJournalDirectory();
     const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
     return { activeClaims: replay.liveClaims().size, mode: "bounded-trigger", continuousDaemon: false };
   }
@@ -3019,6 +3169,7 @@ class WorkflowsService {
     return this.withStore(async (store) => (await store.memoList()).slice(0, 100));
   }
   async triggerRun(graph, context = {}, opts = {}) {
+    this.assertEnabledGraphLanes(graph);
     const store = await this.openEngineStore();
     const wal = SessionWAL.open(this.config.dataDir);
     try {
@@ -3150,7 +3301,7 @@ function buildOpenApi(version) {
         ReadinessReport: object({ ok: { type: "boolean" }, service: string, version: string, checks: { type: "object", additionalProperties: string } }),
         GraphValidation: object({ ok: { type: "boolean" }, issues: { type: "array", items: object({ path: string, message: string }) } }),
         StartNode: object({ id: string, type: { type: "string", enum: ["start"] }, next: string }, ["id", "type"]),
-        StepNode: object({ id: string, type: { type: "string", enum: ["step"] }, next: string, lane: { type: "string", enum: ["claude", "codex", "cursor", "grok"] }, prompt: string, command: string, maxRetries: { type: "integer", minimum: 0 }, memo: { type: "boolean" }, timeoutMs: { type: "integer", minimum: 1 } }, ["id", "type"]),
+        StepNode: object({ id: string, type: { type: "string", enum: ["step"] }, next: string, lane: { type: "string", enum: ["claude", "codex", "cursor", "grok"] }, prompt: string, command: string, cwd: { type: "string", minLength: 1 }, codexMode: { type: "string", enum: ["repository", "read-only"], default: "repository", description: "Codex prompt steps only. Read-only permits nonrepository execution with a read-only sandbox and no approvals. Repository retains native trust, sandbox and approval defaults." }, maxRetries: { type: "integer", minimum: 0 }, memo: { type: "boolean" }, timeoutMs: { type: "integer", minimum: 1 } }, ["id", "type"]),
         DecisionNode: object({ id: string, type: { type: "string", enum: ["decision"] }, condition: string, then: string, else: string }, ["id", "type", "condition"]),
         WhileNode: object({ id: string, type: { type: "string", enum: ["while"] }, condition: string, body: { type: "array", items: string }, maxIterations: { type: "integer", minimum: 1 }, next: string }, ["id", "type", "condition", "body", "maxIterations"]),
         EndNode: object({ id: string, type: { type: "string", enum: ["end"] } }),
@@ -3166,6 +3317,7 @@ function buildOpenApi(version) {
 }
 
 // src/handlers.ts
+init_graph();
 init_lanes();
 function jsonResponse(body, status = 200) {
   return new Response(JSON.stringify(body), {
@@ -3310,12 +3462,12 @@ function createRequestHandler(service) {
         return jsonResponse(await service.listRuns({ limit, status }));
       }
       if (path === "/lanes")
-        return jsonResponse(await laneInventory());
+        return jsonResponse(await service.laneInventory());
       if (path.startsWith("/lanes/")) {
         const lane = path.slice("/lanes/".length);
         if (!LANE_KINDS2.includes(lane))
           return jsonResponse({ error: "invalid_lane" }, 400);
-        return jsonResponse(await probeLane(lane));
+        return jsonResponse(await service.probeLane(lane));
       }
       if (path === "/sessions/list")
         return jsonResponse(service.sessions("list"));