@hasna/workflows 0.2.0 → 0.2.2

package/dist/serve/index.js

@@ -22,7 +22,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/workflows",
-    version: "0.2.0",
+    version: "0.2.2",
     description: "Universal graph workflow app \u2014 graph language (start/step/decision/while/end), three-table store, session WAL, daemon with claims/leases, four lane adapters (claude/codex/cursor/grok), and a full CLI on four surfaces",
     type: "module",
     main: "./dist/index.js",
@@ -98,9 +98,9 @@ var init_package = __esm(() => {
     dependencies: {
       "@anthropic-ai/claude-agent-sdk": "0.3.234",
       "@cursor/sdk": "^1.0.28",
-      "@openai/codex-sdk": "0.147.0",
+      "@hasna/contracts": "1.3.5",
+      "@openai/codex-sdk": "0.160.0",
       commander: "^13.1.0",
-      "@hasna/contracts": "1.3.3",
       pg: "^8.16.3"
     },
     devDependencies: {
@@ -606,6 +606,16 @@ function validateNode(graph, node, issues) {
       if (node.lane !== undefined && !LANE_KINDS.includes(node.lane)) {
         issue(issues, `nodes.${node.id}`, `unknown lane ${JSON.stringify(node.lane)} (expected one of ${LANE_KINDS.join(", ")})`);
       }
+      if (node.cwd !== undefined && (typeof node.cwd !== "string" || !node.cwd.trim() || node.cwd.includes("\x00"))) {
+        issue(issues, `nodes.${node.id}.cwd`, "cwd must be a non-empty path string without NUL characters on the executor");
+      }
+      if (node.codexMode !== undefined) {
+        if (!CODEX_EXECUTION_MODES.includes(node.codexMode)) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode must be repository or read-only");
+        } else if (node.lane !== "codex" || !node.prompt || node.command !== undefined) {
+          issue(issues, `nodes.${node.id}.codexMode`, "codexMode is supported only for a codex prompt step without command");
+        }
+      }
       if (node.maxRetries !== undefined && (!Number.isInteger(node.maxRetries) || node.maxRetries < 0)) {
         issue(issues, `nodes.${node.id}`, "maxRetries must be a non-negative integer");
       }
@@ -683,11 +693,12 @@ function validateNode(graph, node, issues) {
       break;
   }
 }
-var GRAPH_NODE_TYPES, LANE_KINDS, NODE_ID_RE;
+var GRAPH_NODE_TYPES, LANE_KINDS, CODEX_EXECUTION_MODES, NODE_ID_RE;
 var init_graph = __esm(() => {
   init_expr();
   GRAPH_NODE_TYPES = ["start", "step", "decision", "while", "end"];
   LANE_KINDS = ["claude", "codex", "cursor", "grok"];
+  CODEX_EXECUTION_MODES = ["repository", "read-only"];
   NODE_ID_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
 });
 
@@ -1355,9 +1366,15 @@ async function spawnCli(cmd, opts) {
     new Response(proc.stderr).text(),
     proc.exited
   ]);
-  const output = stderr ? `${stdout}
+  const output = opts.stdoutOnly ? stdout.trim() : stderr ? `${stdout}
 ${stderr}`.trim() : stdout.trim();
-  return { ok: exitCode === 0, exitCode, output, durationMs: Date.now() - started };
+  return {
+    ok: exitCode === 0,
+    exitCode,
+    output,
+    durationMs: Date.now() - started,
+    ...opts.stdoutOnly && exitCode !== 0 && stderr.trim() ? { error: stderr.trim() } : {}
+  };
 }
 var LANE_KINDS2, LaneDependencyMissingError, LaneAdapterShapeError, DEFAULT_LANE_TIMEOUT_MS = 120000, LaneTimeoutError;
 var init_types = __esm(() => {
@@ -1501,6 +1518,9 @@ function createCodexAdapter(deps = {}) {
       if (!job.prompt) {
         return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codex lane requires a prompt" };
       }
+      if (job.codexMode !== undefined && (!CODEX_EXECUTION_MODES.includes(job.codexMode) || job.lane !== "codex" || job.command !== undefined)) {
+        return { ok: false, exitCode: 2, output: "", durationMs: 0, error: "codexMode must be repository or read-only on a codex prompt without command", retryable: false };
+      }
       const started = Date.now();
       const timeoutMs = job.timeoutMs ?? DEFAULT_LANE_TIMEOUT_MS;
       const loader = deps.sdkLoader ?? (async () => await import("@openai/codex-sdk"));
@@ -1520,13 +1540,20 @@ function createCodexAdapter(deps = {}) {
           config: { model: job.model },
           env: subscriptionEnvironment(job.env)
         })), timeoutMs, "codex lane");
-        const thread = client.startThread?.({ model: job.model, workingDirectory: job.cwd });
+        const thread = client.startThread?.({
+          model: job.model,
+          workingDirectory: job.cwd,
+          ...job.codexMode === "read-only" ? { sandboxMode: "read-only", skipGitRepoCheck: true, approvalPolicy: "never" } : {}
+        });
         if (!thread || typeof thread.run !== "function") {
           throw new LaneAdapterShapeError("@openai/codex-sdk Codex.startThread() returned no run()");
         }
         const turn = await withTimeout(thread.run(job.prompt, { signal: abortController.signal }), timeoutMs, "codex lane", () => abortController.abort());
-        const output = turn?.finalResponse ?? "";
         const durationMs = Date.now() - started;
+        const output = turn?.finalResponse;
+        if (typeof output !== "string" || !output.trim()) {
+          return missingResponse(durationMs);
+        }
         return { ok: true, exitCode: 0, output, durationMs };
       } catch (err) {
         const durationMs = Date.now() - started;
@@ -1537,14 +1564,17 @@ function createCodexAdapter(deps = {}) {
 }
 async function runCodexCli(job, cliPath, started, timeoutMs) {
   try {
-    const result = await spawnCli([cliPath, "exec", "--", job.prompt], {
+    const controls = job.codexMode === "read-only" ? ["--sandbox", "read-only", "--skip-git-repo-check", "--config", 'approval_policy="never"'] : [];
+    const result = await spawnCli([cliPath, "exec", ...controls, "--", job.prompt], {
       binaryName: cliPath,
       packageHint: "@openai/codex-sdk or the codex CLI",
       timeoutMs,
       env: job.env,
-      cwd: job.cwd
+      cwd: job.cwd,
+      stdoutOnly: true
     });
-    return { ...result, durationMs: Date.now() - started };
+    const durationMs = Date.now() - started;
+    return result.ok && !result.output.trim() ? missingResponse(durationMs) : { ...result, durationMs };
   } catch (err) {
     if (err instanceof LaneDependencyMissingError) {
       return { ok: false, exitCode: 127, output: "", durationMs: Date.now() - started, error: err.message };
@@ -1552,7 +1582,11 @@ async function runCodexCli(job, cliPath, started, timeoutMs) {
     throw err;
   }
 }
+function missingResponse(durationMs) {
+  return { ok: false, exitCode: 1, output: "", durationMs, error: "Codex completed without an agent response; verify the native subscription and model route", retryable: false };
+}
 var init_codex = __esm(() => {
+  init_graph();
   init_types();
 });
 
@@ -2069,7 +2103,14 @@ class WorkflowsDaemon {
     const isLoopBody = graph.nodes.some((candidate) => candidate.type === "while" && candidate.body.includes(nodeId));
     const nodeRow = latest === undefined || isLoopBody && latest.status === "completed" ? await this.store.createRunNode({ runId: run2.id, nodeId, lane: node2.lane ?? "claude" }) : latest;
     const memoWatch = node2.memo ? memoWatchFingerprint(graph, this.store.dataDir) : undefined;
-    const memoSource = { command: node2.command, prompt: node2.prompt, context: stripRunState(context) };
+    const memoSource = {
+      command: node2.command,
+      prompt: node2.prompt,
+      context: stripRunState(context),
+      lane: node2.lane ?? "claude",
+      cwd: node2.cwd,
+      codexMode: node2.lane === "codex" ? node2.codexMode ?? "repository" : undefined
+    };
     const memoInput = node2.memo ? memoWatch !== undefined ? { ...memoSource, memoWatch } : memoSource : undefined;
     if (memoInput !== undefined) {
       const hit = await tryMemoHit(this.store, run2.graphName, nodeId, memoInput);
@@ -2094,6 +2135,8 @@ class WorkflowsDaemon {
       lane: node2.lane ?? "claude",
       prompt: node2.prompt,
       command: node2.command,
+      cwd: node2.cwd,
+      codexMode: node2.codexMode,
       timeoutMs: node2.timeoutMs,
       env: this.env
     };
@@ -2689,7 +2732,7 @@ var init_store = __esm(() => {
 // src/wal.ts
 import { Database as Database2 } from "bun:sqlite";
 import { createHash as createHash2 } from "crypto";
-import { appendFileSync, copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
+import { closeSync, copyFileSync, existsSync as existsSync2, fsyncSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync2, renameSync, truncateSync, writeFileSync, constants } from "fs";
 import { basename, dirname, join as join4 } from "path";
 function checksumOf(op) {
   if (op === undefined || op === null)
@@ -2756,8 +2799,20 @@ class SessionWAL {
     const full = { ...op, at };
     const nextSeq = this.nextSeq();
     const entry = { seq: nextSeq, at, checksum: checksumOf(full), op: full };
-    appendFileSync(this.filePath, JSON.stringify(entry) + `
-`, { encoding: "utf8", mode: 384 });
+    const fd = openSync(this.filePath, "a", 384);
+    try {
+      writeFileSync(fd, JSON.stringify(entry) + `
+`, "utf8");
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    const parent = openSync(dirname(this.filePath), "r");
+    try {
+      fsyncSync(parent);
+    } finally {
+      closeSync(parent);
+    }
     return entry;
   }
   nextSeq() {
@@ -2774,7 +2829,9 @@ class SessionWAL {
     let content;
     try {
       content = readFileSync2(this.filePath, "utf8");
-    } catch {
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
       return { entries, torn, repaired, liveClaims: () => new Map };
     }
     if (content.length > MAX_WAL_BYTES) {
@@ -2868,6 +2925,40 @@ var init_wal = __esm(() => {
   MAX_WAL_BYTES = 256 * 1024 * 1024;
 });
 
+// src/journal-directory.ts
+import { accessSync, closeSync as closeSync2, constants as constants2, fstatSync, lstatSync, openSync as openSync2, readFileSync as readFileSync3, readSync } from "fs";
+import { join as join5 } from "path";
+function assertJournalDirectory(dataDir2, identity) {
+  try {
+    if (!lstatSync(dataDir2).isDirectory() || !lstatSync(join5(dataDir2, "sessions")).isDirectory())
+      throw new Error;
+    accessSync(dataDir2, constants2.R_OK | constants2.W_OK | constants2.X_OK);
+    accessSync(join5(dataDir2, "sessions"), constants2.R_OK | constants2.W_OK | constants2.X_OK);
+    const marker = openSync2(join5(dataDir2, ".workflows-data-identity"), constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    try {
+      const stat = fstatSync(marker);
+      if (!stat.isFile() || stat.size > 256 || readFileSync3(marker, "utf8") !== identity + `
+`)
+        throw new Error;
+    } finally {
+      closeSync2(marker);
+    }
+    for (const file of ["workflows.db", "sessions/session.wal"]) {
+      const fd = openSync2(join5(dataDir2, file), constants2.O_RDWR | constants2.O_NOFOLLOW);
+      try {
+        if (!fstatSync(fd).isFile())
+          throw new Error;
+        readSync(fd, Buffer.alloc(1), 0, 1, 0);
+      } finally {
+        closeSync2(fd);
+      }
+    }
+  } catch {
+    throw new Error("configured execution journal identity or accessibility check failed");
+  }
+}
+var init_journal_directory = () => {};
+
 // src/service.ts
 import { createHash as createHash3 } from "crypto";
 import { hostname } from "os";
@@ -2888,6 +2979,14 @@ function envInt(names, fallback) {
   return Number.isFinite(parsed) ? parsed : fallback;
 }
 function resolveWorkflowsConfig(overrides = {}) {
+  const rawLanes = process.env.HASNA_WORKFLOWS_ENABLED_LANES;
+  const enabledLanes = overrides.enabledLanes ?? (rawLanes === undefined ? LANE_KINDS : rawLanes.trim() === "" ? [] : rawLanes.split(",").map((value) => value.trim()));
+  if (!Array.isArray(enabledLanes) || enabledLanes.some((lane) => !LANE_KINDS.includes(lane)) || new Set(enabledLanes).size !== enabledLanes.length) {
+    throw new Error("HASNA_WORKFLOWS_ENABLED_LANES must be a unique comma-separated subset of claude,codex,cursor,grok; an empty value disables model lanes");
+  }
+  const dataIdentity = overrides.dataIdentity ?? process.env.HASNA_WORKFLOWS_DATA_IDENTITY;
+  if (dataIdentity !== undefined && !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(dataIdentity))
+    throw new Error("HASNA_WORKFLOWS_DATA_IDENTITY must be a nonempty data identity of at most 128 characters");
   const originAuth = overrides.originAuth ?? process.env.HASNA_WORKFLOWS_ORIGIN_AUTH;
   if (originAuth !== undefined && !/^[A-Za-z0-9_-]{32,256}$/.test(originAuth))
     throw new Error("HASNA_WORKFLOWS_ORIGIN_AUTH must be a valid gateway origin identity");
@@ -2898,9 +2997,11 @@ function resolveWorkflowsConfig(overrides = {}) {
     apiUrl: overrides.apiUrl ?? envString(["HASNA_WORKFLOWS_API_URL", "WORKFLOWS_API_URL"]),
     apiKey: overrides.apiKey ?? envString(["HASNA_WORKFLOWS_API_KEY", "WORKFLOWS_API_KEY"]),
     originAuth,
+    dataIdentity,
     storageBackend: overrides.storageBackend ?? "postgresql",
     databaseUrl: overrides.databaseUrl ?? envString(["HASNA_WORKFLOWS_DATABASE_URL", "WORKFLOWS_DATABASE_URL"]),
-    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"])
+    databaseSchema: overrides.databaseSchema ?? envString(["HASNA_WORKFLOWS_DATABASE_SCHEMA", "WORKFLOWS_DATABASE_SCHEMA"]),
+    enabledLanes: Object.freeze([...enabledLanes])
   };
 }
 
@@ -2933,16 +3034,52 @@ class WorkflowsService {
   }
   async ready() {
     const checks = { version: "ok", auth: this.config.apiKey ? "ok" : "missing", storage: "not-checked" };
-    if (this.config.apiKey) {
+    if (this.config.dataIdentity !== undefined) {
+      try {
+        this.verifyJournalDirectory();
+        checks.journal = "ok";
+      } catch {
+        checks.journal = "unavailable";
+      }
+    }
+    if (this.config.apiKey && checks.journal !== "unavailable") {
       try {
         checks.storage = await this.withStore(async (store) => (store instanceof PostgresWorkflowsStore ? await store.checkSchema() : (await store.listTables()).sort().join(",") === "memos,run_nodes,runs") ? "ok" : "invalid-schema");
       } catch (error) {
         checks.storage = error instanceof WorkflowRequestError && error.code === "invalid_schema" ? "invalid-schema" : "unavailable";
       }
     }
-    return { ok: checks.auth === "ok" && checks.storage === "ok", service: this.name, version: this.version, checks };
+    return { ok: checks.auth === "ok" && checks.storage === "ok" && checks.journal !== "unavailable", service: this.name, version: this.version, checks };
+  }
+  verifyJournalDirectory() {
+    if (this.config.dataIdentity !== undefined) {
+      try {
+        assertJournalDirectory(this.config.dataDir, this.config.dataIdentity);
+      } catch {
+        throw new WorkflowRequestError("journal_unavailable", "configured execution journal identity or accessibility check failed", 503);
+      }
+    }
+  }
+  assertEnabledGraphLanes(graph) {
+    if (!Array.isArray(graph?.nodes))
+      return;
+    for (const node2 of graph.nodes) {
+      if (node2.type === "step" && !node2.command && !this.config.enabledLanes.includes(node2.lane ?? "claude")) {
+        throw new WorkflowRequestError("lane_disabled", "the workflow contains a model lane disabled by server configuration", 403);
+      }
+    }
+  }
+  async probeLane(kind) {
+    if (this.config.enabledLanes.includes(kind))
+      return probeLane(kind);
+    const sdk = { claude: "@anthropic-ai/claude-agent-sdk", codex: "@openai/codex-sdk", cursor: "@cursor/sdk", grok: "no npm SDK (measured 2026-08-25)" };
+    return { kind, sdk: sdk[kind], wired: false, reason: "disabled by server configuration" };
+  }
+  laneInventory() {
+    return Promise.all(LANE_KINDS.map((kind) => this.probeLane(kind)));
   }
   async openEngineStore(verifySchema = true) {
+    this.verifyJournalDirectory();
     if (this.config.storageBackend === "sqlite")
       return openStore(this.config.dataDir);
     if (this.config.storageBackend !== "postgresql")
@@ -2996,6 +3133,7 @@ class WorkflowsService {
     return this.withStore((store) => store.listRunNodes(id));
   }
   events(id) {
+    this.verifyJournalDirectory();
     return SessionWAL.open(this.config.dataDir).replay({ repair: false }).entries.filter((entry) => ("runId" in entry.op) && entry.op.runId === id);
   }
   cancelRun(id) {
@@ -3012,7 +3150,6 @@ class WorkflowsService {
   }
   async resumeRun(id) {
     const store = await this.openEngineStore();
-    const wal = SessionWAL.open(this.config.dataDir);
     try {
       const run2 = await store.getRun(id);
       if (!run2)
@@ -3020,13 +3157,15 @@ class WorkflowsService {
       if (!["failed", "cancelled", "interrupted"].includes(run2.status))
         throw new WorkflowRequestError("invalid_run_status", "resume requires a failed, cancelled, or interrupted run", 409);
       const context = JSON.parse(run2.contextJson);
+      const graph = context.__wf?.graph;
+      if (!graph)
+        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
+      this.assertEnabledGraphLanes(graph);
+      const wal = SessionWAL.open(this.config.dataDir);
       if (context.__wf?.resumeBlocked || context.__wf?.executionMayBeActive || wal.replay({ repair: false }).liveClaims().has(id))
         throw new WorkflowRequestError("execution_active", "previous execution must finish before resume", 409);
       if (store instanceof PostgresWorkflowsStore && !await store.acquireExecution(id))
         throw new WorkflowRequestError("execution_active", "another executor still owns this run", 409);
-      const graph = context.__wf?.graph;
-      if (!graph)
-        throw new WorkflowRequestError("graph_unavailable", "legacy run needs its original graph registered by the server operator", 409);
       if (!await store.compareRunStatus(id, ["failed", "cancelled", "interrupted"], "pending", { error: null }))
         throw new WorkflowRequestError("run_status_conflict", "run changed before resume", 409);
       for (const node2 of await store.listRunNodes(id)) {
@@ -3040,6 +3179,7 @@ class WorkflowsService {
     }
   }
   sessions(action) {
+    this.verifyJournalDirectory();
     const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
     if (action === "list")
       return replay.entries.slice(-100).map(({ seq, at, op }) => ({ seq, at, operation: op.op }));
@@ -3057,6 +3197,7 @@ class WorkflowsService {
     return { ...local, health: this.health(), sessions: this.sessions("pull") };
   }
   daemonStatus() {
+    this.verifyJournalDirectory();
     const replay = SessionWAL.open(this.config.dataDir).replay({ repair: false });
     return { activeClaims: replay.liveClaims().size, mode: "bounded-trigger", continuousDaemon: false };
   }
@@ -3064,6 +3205,7 @@ class WorkflowsService {
     return this.withStore(async (store) => (await store.memoList()).slice(0, 100));
   }
   async triggerRun(graph, context = {}, opts = {}) {
+    this.assertEnabledGraphLanes(graph);
     const store = await this.openEngineStore();
     const wal = SessionWAL.open(this.config.dataDir);
     try {
@@ -3133,6 +3275,9 @@ var init_service = __esm(() => {
   init_postgres_store();
   init_store();
   init_wal();
+  init_journal_directory();
+  init_graph();
+  init_lanes();
   init_version();
   WorkflowRequestError = class WorkflowRequestError extends Error {
     code;
@@ -3283,7 +3428,7 @@ function buildOpenApi(version) {
         ReadinessReport: object({ ok: { type: "boolean" }, service: string, version: string, checks: { type: "object", additionalProperties: string } }),
         GraphValidation: object({ ok: { type: "boolean" }, issues: { type: "array", items: object({ path: string, message: string }) } }),
         StartNode: object({ id: string, type: { type: "string", enum: ["start"] }, next: string }, ["id", "type"]),
-        StepNode: object({ id: string, type: { type: "string", enum: ["step"] }, next: string, lane: { type: "string", enum: ["claude", "codex", "cursor", "grok"] }, prompt: string, command: string, maxRetries: { type: "integer", minimum: 0 }, memo: { type: "boolean" }, timeoutMs: { type: "integer", minimum: 1 } }, ["id", "type"]),
+        StepNode: object({ id: string, type: { type: "string", enum: ["step"] }, next: string, lane: { type: "string", enum: ["claude", "codex", "cursor", "grok"] }, prompt: string, command: string, cwd: { type: "string", minLength: 1 }, codexMode: { type: "string", enum: ["repository", "read-only"], default: "repository", description: "Codex prompt steps only. Read-only permits nonrepository execution with a read-only sandbox and no approvals. Repository retains native trust, sandbox and approval defaults." }, maxRetries: { type: "integer", minimum: 0 }, memo: { type: "boolean" }, timeoutMs: { type: "integer", minimum: 1 } }, ["id", "type"]),
         DecisionNode: object({ id: string, type: { type: "string", enum: ["decision"] }, condition: string, then: string, else: string }, ["id", "type", "condition"]),
         WhileNode: object({ id: string, type: { type: "string", enum: ["while"] }, condition: string, body: { type: "array", items: string }, maxIterations: { type: "integer", minimum: 1 }, next: string }, ["id", "type", "condition", "body", "maxIterations"]),
         EndNode: object({ id: string, type: { type: "string", enum: ["end"] } }),
@@ -3443,12 +3588,12 @@ function createRequestHandler(service) {
         return jsonResponse(await service.listRuns({ limit, status }));
       }
       if (path === "/lanes")
-        return jsonResponse(await laneInventory());
+        return jsonResponse(await service.laneInventory());
       if (path.startsWith("/lanes/")) {
         const lane = path.slice("/lanes/".length);
         if (!LANE_KINDS2.includes(lane))
           return jsonResponse({ error: "invalid_lane" }, 400);
-        return jsonResponse(await probeLane(lane));
+        return jsonResponse(await service.probeLane(lane));
       }
       if (path === "/sessions/list")
         return jsonResponse(service.sessions("list"));
@@ -3524,13 +3669,13 @@ var init_server = __esm(() => {
 // src/serve/admin.ts
 var exports_admin = {};
 import { Command } from "commander";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync as renameSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { hostname as hostname2 } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 function loadGraph(file) {
   let raw;
   try {
-    raw = readFileSync3(file, "utf8");
+    raw = readFileSync4(file, "utf8");
   } catch {
     throw new Error(`cannot read graph file ${file}`);
   }
@@ -3623,7 +3768,7 @@ function addReapReports(left, right) {
   return total;
 }
 function writeReport(statusFile, report) {
-  mkdirSync3(join5(statusFile, ".."), { recursive: true });
+  mkdirSync3(join6(statusFile, ".."), { recursive: true });
   let previous = emptyReapReport();
   if (existsSync3(statusFile)) {
     previous = readReport(statusFile).cumulative;
@@ -3643,7 +3788,7 @@ function writeReport(statusFile, report) {
   }
 }
 function readReport(statusFile) {
-  const parsed = JSON.parse(readFileSync3(statusFile, "utf8"));
+  const parsed = JSON.parse(readFileSync4(statusFile, "utf8"));
   if (parsed !== null && typeof parsed === "object") {
     const record = parsed;
     if (record.version === 1 && record.latestCycle !== undefined && record.cumulative !== undefined) {
@@ -3697,11 +3842,11 @@ var init_admin = __esm(() => {
   });
   program.command("init").description("Create the store layout (workflows/, sessions/, workflows.db) and scaffold a sample graph").argument("[file]", "sample graph output path (default <dataDir>/workflows/demo.json)").action((file) => {
     const config = resolveWorkflowsConfig();
-    mkdirSync3(join5(config.dataDir, "workflows"), { recursive: true });
-    mkdirSync3(join5(config.dataDir, SESSIONS_DIR_NAME), { recursive: true });
+    mkdirSync3(join6(config.dataDir, "workflows"), { recursive: true });
+    mkdirSync3(join6(config.dataDir, SESSIONS_DIR_NAME), { recursive: true });
     const store = openStore(config.dataDir);
     store.close();
-    const target = file ?? join5(config.dataDir, "workflows", "demo.json");
+    const target = file ?? join6(config.dataDir, "workflows", "demo.json");
     if (existsSync3(target)) {
       console.error(`refusing to overwrite existing file ${target}`);
       process.exit(1);
@@ -4005,17 +4150,17 @@ var init_admin = __esm(() => {
         }
         case "status": {
           const replay = wal.replay();
-          const pidFile = join5(config.dataDir, "daemon.pid");
-          const pid = existsSync3(pidFile) ? readFileSync3(pidFile, "utf8").trim() : null;
+          const pidFile = join6(config.dataDir, "daemon.pid");
+          const pid = existsSync3(pidFile) ? readFileSync4(pidFile, "utf8").trim() : null;
           const running = pid !== null && processAlive(Number(pid));
           const report = {
             hostname: hostname2(),
             pid: process.pid,
             dataDir: config.dataDir,
             layout: {
-              workflows: existsSync3(join5(config.dataDir, "workflows")),
-              sessions: existsSync3(join5(config.dataDir, SESSIONS_DIR_NAME)),
-              db: existsSync3(join5(config.dataDir, "workflows.db"))
+              workflows: existsSync3(join6(config.dataDir, "workflows")),
+              sessions: existsSync3(join6(config.dataDir, SESSIONS_DIR_NAME)),
+              db: existsSync3(join6(config.dataDir, "workflows.db"))
             },
             store: {
               tables: store.listTables(),
@@ -4079,8 +4224,8 @@ var init_admin = __esm(() => {
   });
   program.command("daemon").description("Run or inspect the daemon").argument("<action>", "start | status | stop").option("--once", "run a single reap cycle and exit (start)").option("--interval-ms <n>", "reap interval (start)", "5000").option("--cycles <n>", "bound on consecutive cycles (start; default infinite until SIGINT)", "0").option("-j, --json", "JSON output").action(async (action, opts) => {
     const config = resolveWorkflowsConfig();
-    const pidFile = join5(config.dataDir, "daemon.pid");
-    const statusFile = join5(config.dataDir, "daemon.status.json");
+    const pidFile = join6(config.dataDir, "daemon.pid");
+    const statusFile = join6(config.dataDir, "daemon.status.json");
     switch (action) {
       case "start": {
         const { store, wal } = openLocal();
@@ -4137,7 +4282,7 @@ var init_admin = __esm(() => {
           return;
         }
         const envelope = readReport(statusFile);
-        const pid = existsSync3(pidFile) ? readFileSync3(pidFile, "utf8").trim() : null;
+        const pid = existsSync3(pidFile) ? readFileSync4(pidFile, "utf8").trim() : null;
         const running = pid !== null && processAlive(Number(pid));
         if (opts.json) {
           console.log(JSON.stringify({ statusVersion: 1, running, pid, lastReap: envelope.latestCycle, cumulative: envelope.cumulative }, null, 2));
@@ -4151,7 +4296,7 @@ var init_admin = __esm(() => {
           console.error("no daemon pid file \u2014 nothing to stop");
           process.exit(1);
         }
-        const pid = Number(readFileSync3(pidFile, "utf8").trim());
+        const pid = Number(readFileSync4(pidFile, "utf8").trim());
         try {
           process.kill(pid, "SIGTERM");
         } catch {
@@ -4249,6 +4394,35 @@ var init_admin = __esm(() => {
 // src/serve/index.ts
 init_service();
 init_server();
+
+// src/serve/journal-lease.ts
+init_journal_directory();
+import { Database as Database3 } from "bun:sqlite";
+import { join as join7 } from "path";
+function acquireJournalServerLease(dataDir2, identity) {
+  assertJournalDirectory(dataDir2, identity);
+  const mutex = new Database3(join7(dataDir2, ".server-lease.sqlite"));
+  try {
+    mutex.exec("PRAGMA busy_timeout = 0");
+    mutex.exec("BEGIN IMMEDIATE");
+  } catch {
+    mutex.close();
+    throw new Error("execution journal is already leased or unavailable; refusing to start another server");
+  }
+  let closed = false;
+  return { close() {
+    if (closed)
+      return;
+    closed = true;
+    try {
+      mutex.exec("ROLLBACK");
+    } finally {
+      mutex.close();
+    }
+  } };
+}
+
+// src/serve/index.ts
 var HELP_TEXT = `workflows-serve \u2014 HTTP server for @hasna/workflows
 
 Usage:
@@ -4271,6 +4445,8 @@ Configuration (env):
   HASNA_WORKFLOWS_DATABASE_URL  required PostgreSQL connection URL
   HASNA_WORKFLOWS_DATABASE_SCHEMA  SQL schema (default workflows)
   HASNA_WORKFLOWS_DATA_DIR  durable execution journal directory
+  HASNA_WORKFLOWS_DATA_IDENTITY  require a verified restored journal and one server writer
+  HASNA_WORKFLOWS_ENABLED_LANES  optional comma-separated model lanes; empty permits command steps only
   WORKFLOWS_ aliases remain supported; database URL aliases must agree`;
 var argv = process.argv.slice(2);
 if (argv[0] === "admin") {
@@ -4299,6 +4475,16 @@ if (argv[0] === "admin") {
       console.error("unknown workflows-serve argument; use --help");
       process.exit(2);
     }
+    let lease;
+    if (service.config.dataIdentity !== undefined) {
+      try {
+        lease = acquireJournalServerLease(service.config.dataDir, service.config.dataIdentity);
+      } catch {
+        console.error("execution journal identity, access or exclusive server lease refused");
+        process.exit(1);
+      }
+      process.once("exit", () => lease?.close());
+    }
     const server = createWorkflowsServer(service);
     console.log(`workflows-serve listening on http://${service.config.host}:${server.port}`);
   }