agent-relay 4.0.35 → 4.0.36

package/dist/index.cjs

@@ -20146,6 +20146,8 @@ __export(index_exports, {
   BUILT_IN_TEMPLATE_NAMES: () => BUILT_IN_TEMPLATE_NAMES,
   BarrierManager: () => BarrierManager,
   BrokerTransport: () => BrokerTransport,
+  BudgetExceededError: () => BudgetExceededError,
+  BudgetTracker: () => BudgetTracker,
   CLAUDE_MODEL_OPTIONS: () => CLAUDE_MODEL_OPTIONS,
   CLIRegistry: () => CLIRegistry,
   CLIVersions: () => CLIVersions,
@@ -20163,6 +20165,7 @@ __export(index_exports, {
   CustomStepResolutionError: () => CustomStepResolutionError,
   CustomStepsParseError: () => CustomStepsParseError,
   DEFAULT_INBOX_DIR: () => DEFAULT_INBOX_DIR,
+  DEFAULT_PROXY_ENV_REGISTRY: () => DEFAULT_PROXY_ENV_REGISTRY,
   DefaultModels: () => DefaultModels,
   ERROR_SEARCH_HINT: () => ERROR_SEARCH_HINT,
   GEMINI_MODEL_OPTIONS: () => GEMINI_MODEL_OPTIONS,
@@ -20177,6 +20180,10 @@ __export(index_exports, {
   ModelOptions: () => ModelOptions,
   Models: () => Models,
   PROTOCOL_VERSION: () => PROTOCOL_VERSION,
+  RELAY_PROXY_TOKEN_ENV: () => RELAY_PROXY_TOKEN_ENV,
+  RELAY_PROXY_TOKEN_ENV_ALIAS: () => RELAY_PROXY_TOKEN_ENV_ALIAS,
+  RELAY_PROXY_URL_ENV: () => RELAY_PROXY_URL_ENV,
+  RELAY_PROXY_URL_ENV_ALIAS: () => RELAY_PROXY_URL_ENV_ALIAS,
   ReasoningEfforts: () => ReasoningEfforts,
   RelayAdapter: () => RelayAdapter,
   RelayCast: () => RelayCast,
@@ -20201,6 +20208,8 @@ __export(index_exports, {
   buildBlockReason: () => buildBlockReason,
   buildCommand: () => buildCommand,
   buildModelSwitchCommand: () => buildModelSwitchCommand,
+  buildNormalizedProxyEnv: () => buildNormalizedProxyEnv,
+  checkCustom: () => checkCustom,
   checkExitCode: () => checkExitCode,
   checkFileExists: () => checkFileExists,
   checkForUpdates: () => checkForUpdates,
@@ -20224,6 +20233,7 @@ __export(index_exports, {
   createMemoryService: () => createMemoryService,
   createProcessBackendExecutor: () => createProcessBackendExecutor,
   createProcessSpawner: () => createProcessSpawner,
+  createProxyEnvResolver: () => createProxyEnvResolver,
   createRequestEnvelope: () => createRequestEnvelope,
   createRequestHandler: () => createRequestHandler,
   createTraceableError: () => createTraceableError,
@@ -20233,6 +20243,7 @@ __export(index_exports, {
   detectCompletion: () => detectCompletion,
   estimateContextTokens: () => estimateContextTokens,
   estimateTokens: () => estimateTokens,
+  execCustomVerification: () => execCustomVerification,
   executeApiStep: () => executeApiStep,
   findGitRoot: () => findGitRoot,
   findRelayPtyBinary: () => findRelayPtyBinary,
@@ -20266,6 +20277,7 @@ __export(index_exports, {
   getPatternMetrics: () => getPatternMetrics,
   getRepoFullName: () => getRepoFullName,
   getRepoFullNameFromPath: () => getRepoFullNameFromPath,
+  getStrippedApiKeyVars: () => getStrippedApiKeyVars,
   getSupportedPlatforms: () => getSupportedPlatforms,
   getSupportedReasoningEfforts: () => getSupportedReasoningEfforts,
   getTrajectoryHooks: () => getTrajectoryHooks,
@@ -20285,6 +20297,7 @@ __export(index_exports, {
   isModelSwitchSupported: () => isModelSwitchSupported,
   isPlaceholderTargetFast: () => isPlaceholderTargetFast,
   isPlatformSupported: () => isPlatformSupported,
+  isProxyEnabled: () => isProxyEnabled,
   isRestrictedAgent: () => isRestrictedAgent,
   isSpawnOrReleaseCommandFast: () => isSpawnOrReleaseCommandFast,
   isTrajectoryTrackingAvailable: () => isTrajectoryTrackingAvailable,
@@ -20308,6 +20321,9 @@ __export(index_exports, {
   resolveCommand: () => resolveCommand,
   resolveCustomStep: () => resolveCustomStep,
   resolveDotPath: () => resolveDotPath,
+  resolveProxyEnv: () => resolveProxyEnv,
+  resolveProxyTokenFromEnv: () => resolveProxyTokenFromEnv,
+  resolveProxyUrlFromEnv: () => resolveProxyUrlFromEnv,
   resolveSpawnPolicy: () => resolveSpawnPolicy,
   resolveStepOutputRef: () => resolveStepOutputRef,
   resolveTemplate: () => resolveTemplate,
@@ -45649,7 +45665,7 @@ function isAgentStep(step) {
 }
 
 // packages/sdk/dist/workflows/runner.js
-var import_node_child_process7 = require("node:child_process");
+var import_node_child_process8 = require("node:child_process");
 var import_node_crypto7 = require("node:crypto");
 var import_node_fs20 = require("node:fs");
 var import_promises8 = require("node:fs/promises");
@@ -45981,6 +45997,97 @@ function resolveCliSync(cli) {
   return void 0;
 }
 
+// packages/sdk/dist/workflows/proxy-env.js
+var RELAY_PROXY_URL_ENV = "RELAY_LLM_PROXY";
+var RELAY_PROXY_URL_ENV_ALIAS = "RELAY_LLM_PROXY_URL";
+var RELAY_PROXY_TOKEN_ENV = "CREDENTIAL_PROXY_TOKEN";
+var RELAY_PROXY_TOKEN_ENV_ALIAS = "RELAY_LLM_PROXY_TOKEN";
+var OPENAI_COMPATIBLE_BINDINGS = [
+  { baseUrlVar: "OPENAI_BASE_URL", apiKeyVar: "OPENAI_API_KEY" }
+];
+var ANTHROPIC_BINDINGS = [
+  { baseUrlVar: "ANTHROPIC_BASE_URL", apiKeyVar: "ANTHROPIC_API_KEY" }
+];
+var AIDER_BINDINGS = [
+  { baseUrlVar: "OPENAI_API_BASE", apiKeyVar: "OPENAI_API_KEY" }
+];
+var GEMINI_BINDINGS = [
+  { baseUrlVar: "GOOGLE_API_BASE", apiKeyVar: "GOOGLE_API_KEY" }
+];
+var GENERIC_FALLBACK_BINDINGS = [
+  ...OPENAI_COMPATIBLE_BINDINGS,
+  ...ANTHROPIC_BINDINGS
+];
+var STRIPPED_API_KEY_VARS = [
+  "OPENAI_API_KEY",
+  "ANTHROPIC_API_KEY",
+  "OPENROUTER_API_KEY",
+  "GOOGLE_API_KEY",
+  "OPENAI_BASE_URL",
+  "ANTHROPIC_BASE_URL",
+  "OPENAI_API_BASE",
+  "GOOGLE_API_BASE"
+];
+var CLI_ALIASES = {
+  agent: "cursor",
+  "cursor-agent": "cursor"
+};
+var DEFAULT_PROXY_ENV_REGISTRY = {
+  claude: ANTHROPIC_BINDINGS,
+  codex: OPENAI_COMPATIBLE_BINDINGS,
+  opencode: OPENAI_COMPATIBLE_BINDINGS,
+  aider: AIDER_BINDINGS,
+  gemini: GEMINI_BINDINGS,
+  goose: OPENAI_COMPATIBLE_BINDINGS,
+  droid: OPENAI_COMPATIBLE_BINDINGS,
+  cursor: OPENAI_COMPATIBLE_BINDINGS
+};
+function normalizeCli(cli) {
+  const baseCli = cli.includes(":") ? cli.split(":")[0] : cli;
+  return CLI_ALIASES[baseCli] ?? baseCli;
+}
+function buildProxyEnv(bindings, proxyUrl, proxyToken) {
+  return bindings.reduce((env, binding) => {
+    env[binding.baseUrlVar] = proxyUrl;
+    env[binding.apiKeyVar] = proxyToken;
+    return env;
+  }, {});
+}
+function createProxyEnvResolver(registry2 = DEFAULT_PROXY_ENV_REGISTRY) {
+  return (cli, proxyUrl, proxyToken) => {
+    const normalizedCli = normalizeCli(cli);
+    const bindings = registry2[normalizedCli];
+    if (bindings) {
+      return buildProxyEnv(bindings, proxyUrl, proxyToken);
+    }
+    const knownCli = getCliDefinition(normalizedCli);
+    const warningPrefix = knownCli ? "No proxy env registry entry" : "Unknown CLI";
+    console.warn(`[proxy-env] ${warningPrefix} for "${normalizedCli}". Falling back to generic OpenAI/Anthropic proxy env overrides.`);
+    return buildProxyEnv(GENERIC_FALLBACK_BINDINGS, proxyUrl, proxyToken);
+  };
+}
+var resolveProxyEnv = createProxyEnvResolver();
+function resolveProxyUrlFromEnv(env = process.env) {
+  return env[RELAY_PROXY_URL_ENV] ?? env[RELAY_PROXY_URL_ENV_ALIAS];
+}
+function resolveProxyTokenFromEnv(env = process.env) {
+  return env[RELAY_PROXY_TOKEN_ENV] ?? env[RELAY_PROXY_TOKEN_ENV_ALIAS];
+}
+function buildNormalizedProxyEnv(proxyUrl, proxyToken) {
+  return {
+    [RELAY_PROXY_URL_ENV]: proxyUrl,
+    [RELAY_PROXY_URL_ENV_ALIAS]: proxyUrl,
+    [RELAY_PROXY_TOKEN_ENV]: proxyToken,
+    [RELAY_PROXY_TOKEN_ENV_ALIAS]: proxyToken
+  };
+}
+function getStrippedApiKeyVars() {
+  return [...STRIPPED_API_KEY_VARS];
+}
+function isProxyEnabled(agentDef, swarmConfig) {
+  return Boolean(agentDef?.credentials?.proxy && swarmConfig?.credentialProxy);
+}
+
 // packages/sdk/dist/workflows/custom-steps.js
 var import_node_fs5 = require("node:fs");
 var import_node_path8 = __toESM(require("node:path"), 1);
@@ -52037,6 +52144,173 @@ async function executeApiStep(model, task, options = {}) {
   return response.content;
 }
 
+// packages/sdk/dist/workflows/budget-tracker.js
+function emptyUsage() {
+  return { input: 0, output: 0, cacheRead: 0, total: 0 };
+}
+function toUsage(value) {
+  if (typeof value === "number") {
+    const input2 = Number.isFinite(value) ? Math.max(0, Math.round(value)) : 0;
+    return { input: input2, output: 0, cacheRead: 0, total: input2 };
+  }
+  const input = Number.isFinite(value.input) ? Math.max(0, Math.round(value.input ?? 0)) : 0;
+  const output = Number.isFinite(value.output) ? Math.max(0, Math.round(value.output ?? 0)) : 0;
+  const cacheRead = Number.isFinite(value.cacheRead) ? Math.max(0, Math.round(value.cacheRead ?? 0)) : 0;
+  return {
+    input,
+    output,
+    cacheRead,
+    total: input + output
+  };
+}
+function addUsage(left, right) {
+  const input = left.input + right.input;
+  const output = left.output + right.output;
+  const cacheRead = left.cacheRead + right.cacheRead;
+  return {
+    input,
+    output,
+    cacheRead,
+    total: input + output
+  };
+}
+var BudgetExceededError = class extends Error {
+  stepName;
+  budgetType;
+  limit;
+  actual;
+  used;
+  constructor(stepName, budgetType, limit, actual) {
+    const qualifier = budgetType === "workflow" ? "workflow budget exhausted" : "agent budget exceeded";
+    super(`Step "${stepName}" cannot continue: ${qualifier} (${actual}/${limit})`);
+    this.name = "BudgetExceededError";
+    this.stepName = stepName;
+    this.budgetType = budgetType;
+    this.limit = limit;
+    this.actual = actual;
+    this.used = actual;
+  }
+};
+var BudgetTracker = class {
+  defaultAgentBudget;
+  workflowBudget;
+  stepLimits = /* @__PURE__ */ new Map();
+  stepUsage = /* @__PURE__ */ new Map();
+  totalUsage = emptyUsage();
+  workflowBudgetExhausted = false;
+  constructor(options) {
+    this.defaultAgentBudget = options.perAgent;
+    this.workflowBudget = options.workflowBudget ?? options.perWorkflow;
+    for (const step of options.steps ?? []) {
+      this.stepLimits.set(step.stepName, step.maxTokens);
+    }
+  }
+  recordUsage(stepName, usage) {
+    const normalized = toUsage(usage);
+    const current = this.stepUsage.get(stepName) ?? emptyUsage();
+    const next = addUsage(current, normalized);
+    this.stepUsage.set(stepName, next);
+    this.totalUsage = addUsage(this.totalUsage, normalized);
+    if (this.workflowBudget !== void 0 && this.totalUsage.total >= this.workflowBudget) {
+      this.workflowBudgetExhausted = true;
+    }
+  }
+  getStepUsage(stepName) {
+    return this.stepUsage.get(stepName) ?? emptyUsage();
+  }
+  getTotalUsage() {
+    return this.totalUsage;
+  }
+  getRemainingBudget() {
+    return {
+      agent: this.defaultAgentBudget !== void 0 ? Math.max(0, this.defaultAgentBudget - this.totalUsage.total) : void 0,
+      workflow: this.workflowBudget !== void 0 ? Math.max(0, this.workflowBudget - this.totalUsage.total) : void 0
+    };
+  }
+  checkCanSpawn(stepName) {
+    if (this.workflowBudget !== void 0 && this.totalUsage.total >= this.workflowBudget) {
+      return {
+        allowed: false,
+        reason: `Cannot spawn ${stepName}: workflow budget exceeded (${this.totalUsage.total}/${this.workflowBudget})`
+      };
+    }
+    if (this.workflowBudget !== void 0) {
+      const remainingWorkflowBudget = this.workflowBudget - this.totalUsage.total;
+      const stepLimit = this.getStepLimit(stepName);
+      const minimumHeadroom = stepLimit !== void 0 ? Math.min(stepLimit, this.workflowBudget) : this.defaultAgentBudget !== void 0 ? Math.ceil(this.defaultAgentBudget * 0.1) : Math.ceil(this.workflowBudget * 0.1);
+      if (remainingWorkflowBudget <= minimumHeadroom) {
+        return {
+          allowed: false,
+          reason: stepLimit !== void 0 ? `Cannot spawn ${stepName}: remaining workflow budget ${remainingWorkflowBudget} is below step budget ${stepLimit}` : this.defaultAgentBudget !== void 0 ? `Cannot spawn ${stepName}: remaining workflow budget ${remainingWorkflowBudget} is below 10% of per-agent budget ${this.defaultAgentBudget}` : `Cannot spawn ${stepName}: remaining workflow budget ${remainingWorkflowBudget} is below 10% headroom threshold for workflow budget ${this.workflowBudget}`
+        };
+      }
+    }
+    return { allowed: true };
+  }
+  isOverBudget(stepName) {
+    const stepUsage = this.getStepUsage(stepName);
+    const stepLimit = this.getStepLimit(stepName);
+    if (stepLimit !== void 0 && stepUsage.total > stepLimit) {
+      return {
+        over: true,
+        reason: `Step "${stepName}" exceeded per-agent budget (${stepUsage.total}/${stepLimit})`
+      };
+    }
+    if (this.workflowBudget !== void 0 && this.totalUsage.total > this.workflowBudget) {
+      return {
+        over: true,
+        reason: `Workflow exceeded total budget (${this.totalUsage.total}/${this.workflowBudget})`
+      };
+    }
+    return { over: false };
+  }
+  getBudgetStatus(stepName) {
+    const stepUsage = this.getStepUsage(stepName);
+    const stepLimit = this.getStepLimit(stepName);
+    return {
+      agentLimitExceeded: stepLimit !== void 0 && stepUsage.total > stepLimit,
+      workflowBudgetExceeded: this.workflowBudget !== void 0 && this.totalUsage.total > this.workflowBudget,
+      workflowBudgetExhausted: this.workflowBudget !== void 0 && (this.workflowBudgetExhausted || this.totalUsage.total >= this.workflowBudget)
+    };
+  }
+  getStepBudgetStatus(stepName) {
+    const usage = this.stepUsage.get(stepName);
+    const hasExplicitLimit = this.stepLimits.has(stepName);
+    const limit = this.getStepLimit(stepName);
+    if (!usage && !hasExplicitLimit && limit === void 0) {
+      return void 0;
+    }
+    return {
+      used: usage?.total,
+      limit,
+      over: limit !== void 0 && (usage?.total ?? 0) > limit
+    };
+  }
+  getRunSummaryBudgetData() {
+    const steps = /* @__PURE__ */ new Map();
+    const stepNames = /* @__PURE__ */ new Set([...this.stepLimits.keys(), ...this.stepUsage.keys()]);
+    for (const stepName of stepNames) {
+      const status = this.getStepBudgetStatus(stepName);
+      if (status) {
+        steps.set(stepName, status);
+      }
+    }
+    const workflow2 = this.workflowBudget !== void 0 || this.totalUsage.total > 0 ? {
+      used: this.totalUsage.total,
+      limit: this.workflowBudget,
+      exhausted: this.workflowBudget !== void 0 && (this.workflowBudgetExhausted || this.totalUsage.total >= this.workflowBudget)
+    } : void 0;
+    if (steps.size === 0 && !workflow2) {
+      return void 0;
+    }
+    return { steps, workflow: workflow2 };
+  }
+  getStepLimit(stepName) {
+    const limit = this.stepLimits.get(stepName);
+    return limit ?? this.defaultAgentBudget;
+  }
+};
+
 // packages/sdk/dist/workflows/channel-messenger.js
 async function sendToChannel(relay, channel, message) {
   await relay.send(channel, message);
@@ -52286,9 +52560,10 @@ var InMemoryWorkflowDb = class {
 };
 
 // packages/sdk/dist/workflows/process-spawner.js
-var import_node_child_process6 = require("node:child_process");
+var import_node_child_process7 = require("node:child_process");
 
 // packages/sdk/dist/workflows/verification.js
+var import_node_child_process6 = require("node:child_process");
 var import_node_fs19 = require("node:fs");
 var import_node_path26 = __toESM(require("node:path"), 1);
 var WorkflowCompletionError = class extends Error {
@@ -52343,8 +52618,17 @@ function runVerification(check2, output, stepName, injectedTaskText, options = {
         return fail(`Verification failed for "${stepName}": file "${check2.value}" does not exist`);
       }
       break;
-    case "custom":
-      return { passed: false };
+    case "custom": {
+      if (check2.value) {
+        const result = execCustomVerification(check2.value, cwd, check2.timeoutMs);
+        if (!result.passed) {
+          return fail('Verification failed for "' + stepName + '": custom check "' + check2.value + '" failed\n' + result.output);
+        }
+      } else {
+        return { passed: false };
+      }
+      break;
+    }
     default:
       break;
   }
@@ -52397,6 +52681,55 @@ function checkOutputContains(output, token, injectedTaskText) {
   }
   return stripInjectedTaskEcho(output, injectedTaskText).includes(token);
 }
+var DEFAULT_CUSTOM_VERIFY_TIMEOUT_MS = parseInt(process.env.CUSTOM_VERIFY_TIMEOUT_MS ?? "30000", 10);
+var REGEX_PREFIX = "regex:";
+function execCustomVerification(command, cwd, timeoutMs = DEFAULT_CUSTOM_VERIFY_TIMEOUT_MS) {
+  try {
+    const stdout = (0, import_node_child_process6.execSync)(command, {
+      cwd,
+      timeout: timeoutMs,
+      killSignal: "SIGKILL",
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf-8"
+    });
+    return { passed: true, output: stdout.trim() };
+  } catch (error48) {
+    const execError = error48;
+    const stdout = typeof execError.stdout === "string" ? execError.stdout : execError.stdout?.toString("utf-8") ?? "";
+    const stderr = typeof execError.stderr === "string" ? execError.stderr : execError.stderr?.toString("utf-8") ?? "";
+    const combinedOutput = [stdout, stderr].filter((chunk) => chunk.length > 0).join("\n").trim();
+    const truncated = combinedOutput.length > 2e3 ? combinedOutput.slice(-2e3) : combinedOutput;
+    return {
+      passed: false,
+      output: truncated || execError.message
+    };
+  }
+}
+function checkCustom(value, output, cwd = process.cwd()) {
+  if (value.startsWith(REGEX_PREFIX)) {
+    const pattern = value.slice(REGEX_PREFIX.length);
+    try {
+      const re2 = new RegExp(pattern);
+      const matched = re2.test(output);
+      return matched ? { passed: true } : { passed: false, error: `output did not match pattern /${pattern}/` };
+    } catch (err) {
+      return { passed: false, error: `invalid regex: ${err.message}` };
+    }
+  }
+  try {
+    const result = (0, import_node_child_process6.execSync)(value, {
+      cwd,
+      env: { ...process.env, STEP_OUTPUT: output },
+      timeout: DEFAULT_CUSTOM_VERIFY_TIMEOUT_MS,
+      stdio: ["pipe", "pipe", "pipe"],
+      maxBuffer: 1024 * 1024
+    });
+    return { passed: true, stdout: result.toString("utf-8").trim() };
+  } catch (err) {
+    const message = err?.stderr?.toString("utf-8")?.trim() || err.message;
+    return { passed: false, error: message };
+  }
+}
 function checkFileExists(filePath, cwd = process.cwd()) {
   const normalizedCwd = import_node_path26.default.resolve(cwd);
   const resolved = import_node_path26.default.isAbsolute(filePath) ? import_node_path26.default.resolve(filePath) : import_node_path26.default.resolve(normalizedCwd, filePath);
@@ -52427,7 +52760,7 @@ function buildCommand(cli, extraArgs = [], task) {
 }
 function spawnProcess(command, options) {
   const [bin, ...args] = command;
-  return (0, import_node_child_process6.spawn)(bin, args, options);
+  return (0, import_node_child_process7.spawn)(bin, args, options);
 }
 function collectOutput(process8) {
   return new Promise((resolve4, reject) => {
@@ -52612,6 +52945,15 @@ function formatTokens(report) {
   const total = report.tokens.input + report.tokens.output + report.tokens.cacheRead;
   return total.toLocaleString("en-US");
 }
+function formatBudgetValue(value) {
+  return typeof value === "number" ? value.toLocaleString("en-US") : "--";
+}
+function formatBudget(status) {
+  if (!status)
+    return "--";
+  const rendered = `${formatBudgetValue(status.used)}/${formatBudgetValue(status.limit)}`;
+  return status.over ? `${rendered} [OVER]` : rendered;
+}
 function formatDuration(durationMs) {
   if (typeof durationMs !== "number" || !Number.isFinite(durationMs))
     return "--";
@@ -52640,10 +52982,11 @@ function formatErrors(outcome, report) {
     return `${count} (fixed)`;
   return String(count);
 }
-function formatRunSummaryTable(outcomes, reports) {
+function formatRunSummaryTable(outcomes, reports, budgetData) {
   const hasCost = Array.from(reports.values()).some((r) => typeof r.cost === "number" && r.cost > 0);
-  const headers = hasCost ? ["Step", "Status", "Model", "Cost", "Tokens", "Duration", "Errors"] : ["Step", "Status", "Model", "Tokens", "Duration", "Errors"];
-  const widths = hasCost ? [20, 6, 16, 8, 10, 10, 10] : [20, 6, 16, 10, 10, 10];
+  const hasBudget = Boolean(budgetData);
+  const headers = hasCost ? hasBudget ? ["Step", "Status", "Model", "Cost", "Tokens", "Budget", "Duration", "Errors"] : ["Step", "Status", "Model", "Cost", "Tokens", "Duration", "Errors"] : hasBudget ? ["Step", "Status", "Model", "Tokens", "Budget", "Duration", "Errors"] : ["Step", "Status", "Model", "Tokens", "Duration", "Errors"];
+  const widths = hasCost ? hasBudget ? [20, 6, 16, 8, 10, 18, 10, 10] : [20, 6, 16, 8, 10, 10, 10] : hasBudget ? [20, 6, 16, 10, 18, 10, 10] : [20, 6, 16, 10, 10, 10];
   const lines = [];
   lines.push(headers.map((h, i) => {
     const align = i <= 2 ? "left" : "right";
@@ -52656,6 +52999,7 @@ function formatRunSummaryTable(outcomes, reports) {
     const report = reports.get(outcome.name);
     const reportDuration = report?.durationMs ?? outcome.durationMs;
     const reportTokens = report?.tokens ? report.tokens.input + report.tokens.output + report.tokens.cacheRead : 0;
+    const budgetStatus = budgetData?.steps.get(outcome.name);
     if (typeof report?.cost === "number")
       totalCost += report.cost;
     totalTokens += reportTokens;
@@ -52670,8 +53014,12 @@ function formatRunSummaryTable(outcomes, reports) {
       cols.push(pad(formatCurrency(report?.cost), widths[3], "right"));
     const tokenIdx2 = hasCost ? 4 : 3;
     cols.push(pad(formatTokens(report), widths[tokenIdx2], "right"));
-    cols.push(pad(formatDuration(reportDuration), widths[tokenIdx2 + 1], "right"));
-    cols.push(pad(formatErrors(outcome, report), widths[tokenIdx2 + 2], "right"));
+    if (hasBudget)
+      cols.push(pad(formatBudget(budgetStatus), widths[tokenIdx2 + 1], "right"));
+    const durationIdx2 = hasBudget ? tokenIdx2 + 2 : tokenIdx2 + 1;
+    const errorsIdx2 = hasBudget ? tokenIdx2 + 3 : tokenIdx2 + 2;
+    cols.push(pad(formatDuration(reportDuration), widths[durationIdx2], "right"));
+    cols.push(pad(formatErrors(outcome, report), widths[errorsIdx2], "right"));
     lines.push(cols.join("  "));
     if (outcome.status === "failed") {
       const firstError = report?.errors[0];
@@ -52687,8 +53035,15 @@ function formatRunSummaryTable(outcomes, reports) {
     totalCols.push(pad(formatCurrency(totalCost), widths[3], "right"));
   const tokenIdx = hasCost ? 4 : 3;
   totalCols.push(pad(totalTokens > 0 ? totalTokens.toLocaleString("en-US") : "--", widths[tokenIdx], "right"));
-  totalCols.push(pad(formatDuration(totalDurationMs), widths[tokenIdx + 1], "right"));
-  totalCols.push(pad("", widths[tokenIdx + 2], "right"));
+  if (hasBudget) {
+    const workflowBudget = budgetData?.workflow;
+    const budgetTotal = workflowBudget && (workflowBudget.limit !== void 0 || workflowBudget.used > 0) ? `${formatBudgetValue(workflowBudget.used)}/${formatBudgetValue(workflowBudget.limit)}` : "--";
+    totalCols.push(pad(budgetTotal, widths[tokenIdx + 1], "right"));
+  }
+  const durationIdx = hasBudget ? tokenIdx + 2 : tokenIdx + 1;
+  const errorsIdx = hasBudget ? tokenIdx + 3 : tokenIdx + 2;
+  totalCols.push(pad(formatDuration(totalDurationMs), widths[durationIdx], "right"));
+  totalCols.push(pad("", widths[errorsIdx], "right"));
   lines.push(totalCols.join("  "));
   return lines.map((line) => `  ${line}`).join("\n");
 }
@@ -54655,6 +55010,10 @@ var ENV_ALLOWLIST = /* @__PURE__ */ new Set([
   "RUST_BACKTRACE",
   "RELAY_API_KEY",
   "RELAYCAST_BASE_URL",
+  "RELAY_LLM_PROXY",
+  "RELAY_LLM_PROXY_URL",
+  "CREDENTIAL_PROXY_TOKEN",
+  "RELAY_LLM_PROXY_TOKEN",
   "AGENT_RELAY_DASHBOARD_PORT",
   "AGENT_RELAY_RUN_ID_FILE",
   "EDITOR",
@@ -54743,12 +55102,16 @@ var WorkflowRunner = class _WorkflowRunner {
   activeAgentHandles = /* @__PURE__ */ new Map();
   /** Per-agent workflow tokens for relay/relayfile auth across spawn modes. */
   agentTokens = /* @__PURE__ */ new Map();
+  /** Per-agent credential proxy tokens keyed by logical agent definition name. */
+  proxyTokens = /* @__PURE__ */ new Map();
   /** Per-agent relayfile mounts keyed by logical agent definition name. */
   agentMounts = /* @__PURE__ */ new Map();
   // PTY-based output capture: accumulate terminal output per-agent
   ptyOutputBuffers = /* @__PURE__ */ new Map();
   /** Snapshot of PTY output from the most recent failed attempt, keyed by step name. */
   lastFailedStepOutput = /* @__PURE__ */ new Map();
+  /** Most recent custom verification failure details, keyed by step name. */
+  lastCustomVerificationFailure = /* @__PURE__ */ new Map();
   ptyListeners = /* @__PURE__ */ new Map();
   ptyLogStreams = /* @__PURE__ */ new Map();
   /** Path to workers.json so `agents:kill` can find workflow-spawned agents */
@@ -54779,6 +55142,8 @@ var WorkflowRunner = class _WorkflowRunner {
   activeReviewers = /* @__PURE__ */ new Map();
   /** Structured CLI session reports captured during the current run, keyed by step name. */
   agentReports = /* @__PURE__ */ new Map();
+  /** Optional per-run token budget tracker; only created when budgets are configured. */
+  budgetTracker;
   static PTY_TASK_ARG_SIZE_LIMIT = 2 * 1024 * 1024;
   // 2 MB
   processBackend;
@@ -54839,6 +55204,45 @@ var WorkflowRunner = class _WorkflowRunner {
     }
     return { resolved, errors, warnings };
   }
+  initializeBudgetTracker(config2, workflow2) {
+    const agentMap = new Map(config2.agents.map((agent) => [agent.name, _WorkflowRunner.resolveAgentDef(agent)]));
+    const stepConfigs = workflow2.steps.flatMap((step) => {
+      if (step.type === "deterministic" || step.type === "worktree" || step.type === "integration" || !step.agent) {
+        return [];
+      }
+      const agentDef = agentMap.get(step.agent);
+      return [
+        {
+          stepName: step.name,
+          agentName: step.agent,
+          maxTokens: agentDef?.constraints?.maxTokens
+        }
+      ];
+    });
+    const hasWorkflowBudget = config2.swarm.tokenBudget !== void 0;
+    const hasAgentBudgets = stepConfigs.some((step) => step.maxTokens !== void 0);
+    this.budgetTracker = hasWorkflowBudget || hasAgentBudgets ? new BudgetTracker({
+      workflowBudget: config2.swarm.tokenBudget,
+      steps: stepConfigs
+    }) : void 0;
+  }
+  ensureBudgetAllowsSpawn(stepName, agentName) {
+    if (!this.budgetTracker)
+      return;
+    const budgetCheck = this.budgetTracker.checkCanSpawn(stepName);
+    if (budgetCheck.allowed)
+      return;
+    const workflowBudget = this.budgetTracker.getRunSummaryBudgetData()?.workflow;
+    const used = workflowBudget?.used.toLocaleString("en-US") ?? "0";
+    const limit = workflowBudget?.limit?.toLocaleString("en-US") ?? "--";
+    this.log(`[budget] Skipping step ${stepName} \u2014 workflow budget exhausted (used ${used} of ${limit})`);
+    throw new BudgetExceededError(stepName, "workflow", workflowBudget?.limit ?? 0, workflowBudget?.used ?? 0);
+  }
+  getTotalReportTokens(report) {
+    if (!report.tokens)
+      return void 0;
+    return report.tokens.input + report.tokens.output + report.tokens.cacheRead;
+  }
   validatePermissions(agents, permissionProfiles, source = "<config>") {
     const errors = [];
     const warnings = [];
@@ -55643,21 +56047,161 @@ ${next}` : next;
     }).catch(() => {
     });
   }
-  getRelayEnv() {
-    if (!this.relayApiKey && !this.relayOptions.env) {
+  async loadCredentialProxyModule() {
+    try {
+      const dynamicImport = new Function("specifier", "return import(specifier)");
+      const module2 = await dynamicImport("@agent-relay/credential-proxy");
+      return typeof module2.mintProxyToken === "function" ? module2 : null;
+    } catch (error48) {
+      if (error48?.code === "ERR_MODULE_NOT_FOUND") {
+        return null;
+      }
+      throw error48;
+    }
+  }
+  resolveCredentialProxyProvider(agentDef, config2) {
+    const configuredProviders = Object.keys(config2.swarm.credentialProxy?.providers ?? {});
+    const explicitProvider = agentDef.credentials?.provider?.trim().toLowerCase();
+    if (explicitProvider === "openai" || explicitProvider === "anthropic" || explicitProvider === "openrouter") {
+      return explicitProvider;
+    }
+    const model = agentDef.constraints?.model?.trim().toLowerCase() ?? "";
+    if (model.includes("openrouter")) {
+      return "openrouter";
+    }
+    if (model.includes("claude") || model.includes("anthropic")) {
+      return "anthropic";
+    }
+    if (model.includes("openai") || model.includes("chatgpt") || model.includes("gpt") || /\bo[134](?:\b|-)/.test(model)) {
+      return "openai";
+    }
+    if (configuredProviders.length === 1) {
+      const [onlyProvider] = configuredProviders;
+      if (onlyProvider === "openai" || onlyProvider === "anthropic" || onlyProvider === "openrouter") {
+        return onlyProvider;
+      }
+    }
+    switch (agentDef.cli) {
+      case "claude":
+        return "anthropic";
+      case "codex":
+      case "aider":
+      case "goose":
+      case "opencode":
+      case "cursor":
+      case "cursor-agent":
+        return "openai";
+      default:
+        throw new Error(`Unable to resolve credential proxy provider for agent "${agentDef.name}". Set credentials.provider or constraints.model.`);
+    }
+  }
+  resolveCredentialProxySecret(config2) {
+    const configuredSecret = config2.swarm.credentialProxy?.jwtSecret;
+    if (configuredSecret?.startsWith("$")) {
+      const envSecret = process.env[configuredSecret.slice(1)];
+      if (envSecret) {
+        return envSecret;
+      }
+    } else if (configuredSecret) {
+      return configuredSecret;
+    }
+    const defaultSecret = process.env.RELAY_PROXY_JWT_SECRET;
+    if (defaultSecret) {
+      return defaultSecret;
+    }
+    throw new Error("Credential proxy JWT secret is missing. Set swarm.credentialProxy.jwtSecret or RELAY_PROXY_JWT_SECRET.");
+  }
+  async mintAgentProxyToken(agentDef, config2) {
+    const proxyConfig = config2.swarm?.credentialProxy;
+    if (!proxyConfig?.proxyUrl || !agentDef.credentials?.proxy) {
+      return void 0;
+    }
+    const provider = this.resolveCredentialProxyProvider(agentDef, config2);
+    const providerConfig = proxyConfig.providers?.[provider];
+    const credentialId = providerConfig?.credentialId;
+    if (!credentialId) {
+      throw new Error(`Credential proxy provider "${provider}" is not configured for agent "${agentDef.name}".`);
+    }
+    const budget = agentDef.constraints?.maxTokens ?? proxyConfig.defaultBudget;
+    const cacheKey = `${agentDef.name}:${provider}:${credentialId}:${budget ?? "default"}`;
+    const cachedToken = this.proxyTokens.get(cacheKey);
+    if (cachedToken) {
+      return cachedToken;
+    }
+    const credentialProxy = await this.loadCredentialProxyModule();
+    if (!credentialProxy) {
+      throw new Error('Credential proxy mode requires the optional peer dependency "@agent-relay/credential-proxy".');
+    }
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    const token = await credentialProxy.mintProxyToken({
+      sub: this.workspaceId,
+      aud: "relay-llm-proxy",
+      provider,
+      credentialId,
+      budget,
+      exp: nowSeconds + 15 * 60
+    }, this.resolveCredentialProxySecret(config2));
+    this.proxyTokens.set(cacheKey, token);
+    return token;
+  }
+  async resolveAgentProxyMode(agentDef, config2) {
+    if (!agentDef.credentials?.proxy) {
+      return void 0;
+    }
+    const env = this.getMergedRelayEnvSource();
+    const configuredProxyUrl = config2?.swarm?.credentialProxy?.proxyUrl;
+    const proxyUrl = configuredProxyUrl ?? resolveProxyUrlFromEnv(env);
+    if (!proxyUrl) {
+      return void 0;
+    }
+    if (!configuredProxyUrl) {
+      const injectedToken = resolveProxyTokenFromEnv(env);
+      if (!injectedToken) {
+        return void 0;
+      }
+      return {
+        url: proxyUrl,
+        token: injectedToken
+      };
+    }
+    const token = await this.mintAgentProxyToken(agentDef, config2);
+    if (!token) {
       return void 0;
     }
+    return {
+      url: proxyUrl,
+      token
+    };
+  }
+  getMergedRelayEnvSource() {
     return {
       ...process.env,
       ...this.relayOptions.env ?? {},
       ...this.relayApiKey ? { RELAY_API_KEY: this.relayApiKey } : {}
     };
   }
+  getRelayEnv(proxyMode) {
+    const env = this.getMergedRelayEnvSource();
+    const inheritedProxyUrl = resolveProxyUrlFromEnv(env);
+    const inheritedProxyToken = resolveProxyTokenFromEnv(env);
+    if (!this.relayApiKey && !this.relayOptions.env && !proxyMode && !(inheritedProxyUrl && inheritedProxyToken)) {
+      return void 0;
+    }
+    const normalizedProxy = proxyMode?.url && proxyMode.token ? proxyMode : inheritedProxyUrl && inheritedProxyToken ? { url: inheritedProxyUrl, token: inheritedProxyToken } : void 0;
+    if (normalizedProxy) {
+      Object.assign(env, buildNormalizedProxyEnv(normalizedProxy.url, normalizedProxy.token));
+      for (const key of getStrippedApiKeyVars()) {
+        delete env[key];
+      }
+    }
+    return env;
+  }
   async provisionAgents(config2) {
     if (process.env.RELAY_CLOUD_PROVISIONING_DONE === "1") {
       return;
     }
     this.agentTokens.clear();
+    this.proxyTokens.clear();
     await this.stopProvisionedMounts();
     const agentsToProvision = {};
     for (const agent of config2.agents) {
@@ -56499,6 +57043,7 @@ ${err.suggestion}`);
     this.runtimeStepAgents.clear();
     this.stepCompletionEvidence.clear();
     this.agentReports.clear();
+    this.initializeBudgetTracker(config2, workflow2);
     this.log(`Starting workflow "${workflow2.name}" (${workflow2.steps.length} steps)`);
     this.trajectory = new WorkflowTrajectory(config2.trajectories, runId, this.cwd);
     try {
@@ -56786,6 +57331,7 @@ ${err.suggestion}`);
       }
     } finally {
       this.lastFailedStepOutput.clear();
+      this.lastCustomVerificationFailure.clear();
       for (const stream of this.ptyLogStreams.values())
         stream.end();
       this.ptyLogStreams.clear();
@@ -56875,7 +57421,7 @@ ${err.suggestion}`);
       this.postToChannel(`**[preflight]** ${description}`);
       try {
         const output = await new Promise((resolve4, reject) => {
-          const child = (0, import_node_child_process7.spawn)("sh", ["-c", check2.command], {
+          const child = (0, import_node_child_process8.spawn)("sh", ["-c", check2.command], {
             stdio: "pipe",
             cwd: this.cwd,
             env: filteredEnv()
@@ -57039,7 +57585,7 @@ ${executorResult.output}`);
         let commandStdout = "";
         let commandStderr = "";
         const output = await new Promise((resolve4, reject) => {
-          const child = (0, import_node_child_process7.spawn)("sh", ["-c", resolvedCommand], {
+          const child = (0, import_node_child_process8.spawn)("sh", ["-c", resolvedCommand], {
             stdio: "pipe",
             cwd: stepCwd,
             env: filteredEnv()
@@ -57179,7 +57725,7 @@ ${stderr}`);
         const absoluteWorktreePath = import_node_path28.default.resolve(stepCwd, worktreePath);
         let branchExists = false;
         await new Promise((resolve4) => {
-          const checkChild = (0, import_node_child_process7.spawn)("git", ["rev-parse", "--verify", "--quiet", branch], {
+          const checkChild = (0, import_node_child_process8.spawn)("git", ["rev-parse", "--verify", "--quiet", branch], {
             stdio: "pipe",
             cwd: stepCwd,
             env: filteredEnv()
@@ -57201,7 +57747,7 @@ ${stderr}`);
         let commandStdout = "";
         let commandStderr = "";
         const output = await new Promise((resolve4, reject) => {
-          const child = (0, import_node_child_process7.spawn)("git", worktreeArgs, {
+          const child = (0, import_node_child_process8.spawn)("git", worktreeArgs, {
             stdio: "pipe",
             cwd: stepCwd,
             env: filteredEnv()
@@ -57360,6 +57906,7 @@ ${stderr}`);
     }
     const specialistDef = _WorkflowRunner.resolveAgentDef(rawAgentDef);
     if (specialistDef.cli === "api") {
+      this.ensureBudgetAllowsSpawn(step.name, agentName);
       const stepOutputContext = this.buildStepOutputContext(stepStates, runId);
       const resolvedTask = this.interpolateStepTask(step.task ?? "", stepOutputContext);
       state.row.status = "running";
@@ -57427,10 +57974,17 @@ ${stderr}`);
     let lastAttemptStartedAt;
     let lastEffectiveAgentDef;
     let lastEffectiveCwd;
+    let lastAttemptReportCaptured = false;
+    let lastDiagnosticResult = null;
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
       this.checkAborted();
       lastExitCode = void 0;
       lastExitSignal = void 0;
+      lastAttemptStartedAt = void 0;
+      lastEffectiveAgentDef = void 0;
+      lastEffectiveCwd = void 0;
+      lastAttemptReportCaptured = false;
+      let stepOutputForDiagnostic = "";
       if (attempt > 0) {
         this.emit({ type: "step:retrying", runId, stepName: step.name, attempt });
         this.postToChannel(`**[${step.name}]** Retrying (attempt ${attempt + 1}/${maxRetries + 1})`);
@@ -57448,6 +58002,7 @@ ${stderr}`);
         await this.delay(retryDelay);
       }
       try {
+        this.ensureBudgetAllowsSpawn(step.name, agentName);
         lastAttemptStartedAt = Date.now();
         state.row.status = "running";
         state.row.error = void 0;
@@ -57482,13 +58037,31 @@ ${stderr}`);
         const stepOutputContext = this.buildStepOutputContext(stepStates, runId);
         let resolvedTask = this.interpolateStepTask(step.task ?? "", stepOutputContext);
         if (attempt > 0 && lastError) {
-          const priorOutput = (this.lastFailedStepOutput.get(step.name) ?? "").slice(-2e3);
-          resolvedTask = `[RETRY \u2014 Attempt ${attempt + 1}/${maxRetries + 1}]
+          if (lastDiagnosticResult) {
+            resolvedTask = `[RETRY \u2014 Attempt ${attempt + 1}/${maxRetries + 1}] Verification failed.
+Diagnostic analysis:
+${lastDiagnosticResult.analysis}
+
+Original error: ${lastError}
+---
+${resolvedTask}`;
+          } else {
+            const priorOutput = (this.lastFailedStepOutput.get(step.name) ?? "").slice(-2e3);
+            const customVerificationFailure = this.lastCustomVerificationFailure.get(step.name);
+            const verificationFailurePrompt = customVerificationFailure ? `[VERIFICATION FAILED] Your code did not pass the verification check.
+Command: ${customVerificationFailure.command}
+Output:
+${customVerificationFailure.output}
+
+Fix the issues above before proceeding.
+` : "";
+            resolvedTask = `[RETRY \u2014 Attempt ${attempt + 1}/${maxRetries + 1}]
 Previous attempt failed: ${lastError}
-` + (priorOutput ? `Previous output (last 2000 chars):
+` + verificationFailurePrompt + (priorOutput ? `Previous output (last 2000 chars):
 ${priorOutput}
 ` : "") + `---
 ${resolvedTask}`;
+          }
         }
         if (specialistDef.interactive !== false || ownerDef.interactive !== false) {
           const nonInteractiveInfo = this.buildNonInteractiveAwareness(agentMap, stepStates);
@@ -57526,6 +58099,7 @@ ${resolvedTask}`;
         if (usesDedicatedOwner) {
           const result = await this.executeSupervisedAgentStep(step, { specialist: effectiveSpecialist, owner: effectiveOwner, reviewer: reviewDef }, resolvedTask, timeoutMs, attempt);
           specialistOutput = result.specialistOutput;
+          stepOutputForDiagnostic = result.specialistOutput;
           ownerOutput = result.ownerOutput;
           ownerElapsed = result.ownerElapsed;
           completionReason = result.completionReason;
@@ -57573,6 +58147,7 @@ ${resolvedTask}`;
             }
           }
           specialistOutput = output;
+          stepOutputForDiagnostic = output;
           ownerOutput = output;
         }
         if (!usesOwnerFlow) {
@@ -57614,6 +58189,7 @@ ${resolvedTask}`;
           }
         }
         await this.captureAgentReport(runId, step.name, lastEffectiveAgentDef, lastEffectiveCwd, lastAttemptStartedAt, Date.now());
+        lastAttemptReportCaptured = true;
         state.row.status = "completed";
         state.row.output = combinedOutput;
         state.row.completionReason = completionReason;
@@ -57640,6 +58216,22 @@ ${resolvedTask}`;
       } catch (err) {
         lastError = err instanceof Error ? err.message : String(err);
         lastCompletionReason = err instanceof WorkflowCompletionError ? err.completionReason : void 0;
+        const diagnosticVerification = step.verification;
+        if (err instanceof WorkflowCompletionError && err.completionReason === "failed_verification" && diagnosticVerification?.diagnosticAgent && attempt < maxRetries) {
+          lastDiagnosticResult = await this.runDiagnosticAgent(step, lastError, stepOutputForDiagnostic || (this.lastFailedStepOutput.get(step.name) ?? ""), agentMap, runId);
+        } else {
+          lastDiagnosticResult = null;
+        }
+        if (lastCompletionReason !== "failed_verification") {
+          this.lastCustomVerificationFailure.delete(step.name);
+        }
+        if (!(err instanceof BudgetExceededError) && !lastAttemptReportCaptured) {
+          await this.captureAgentReport(runId, step.name, lastEffectiveAgentDef, lastEffectiveCwd, lastAttemptStartedAt, Date.now());
+          lastAttemptReportCaptured = true;
+        }
+        if (err instanceof BudgetExceededError) {
+          break;
+        }
         if (lastCompletionReason === "retry_requested_by_owner" && attempt >= maxRetries) {
           lastError = this.buildOwnerRetryBudgetExceededMessage(step.name, maxRetries, lastError);
         }
@@ -57655,7 +58247,9 @@ ${resolvedTask}`;
     }
     const nonInteractive = ownerDef.interactive === false || ["worker", "reviewer", "analyst"].includes(ownerDef.preset ?? "");
     const verificationValue = typeof step.verification === "object" && "value" in step.verification ? String(step.verification.value) : void 0;
-    await this.captureAgentReport(runId, step.name, lastEffectiveAgentDef, lastEffectiveCwd, lastAttemptStartedAt, Date.now());
+    if (!lastAttemptReportCaptured) {
+      await this.captureAgentReport(runId, step.name, lastEffectiveAgentDef, lastEffectiveCwd, lastAttemptStartedAt, Date.now());
+    }
     await this.trajectory?.stepFailed(step, lastError ?? "Unknown error", maxRetries + 1, maxRetries, {
       agent: agentName,
       nonInteractive,
@@ -57668,6 +58262,75 @@ ${resolvedTask}`;
     }, lastCompletionReason);
     throw new Error(`Step "${step.name}" failed after ${maxRetries} retries: ${lastError ?? "Unknown error"}`);
   }
+  async runDiagnosticAgent(step, verificationError, stepOutput, agentMap, runId) {
+    const verification = step.verification;
+    const diagnosticAgentName = verification?.diagnosticAgent;
+    if (!verification || !diagnosticAgentName) {
+      return null;
+    }
+    const rawDiagnosticDef = agentMap.get(diagnosticAgentName);
+    if (!rawDiagnosticDef) {
+      this.log(`[${step.name}] Diagnostic agent "${diagnosticAgentName}" not found \u2014 falling back to standard retry`);
+      return null;
+    }
+    const diagnosticAgentDef = {
+      ..._WorkflowRunner.resolveAgentDef(rawDiagnosticDef),
+      interactive: false
+    };
+    const verificationCommand = verification.type === "custom" ? verification.value : `${verification.type}: ${verification.value}`;
+    const diagnosticTimeout = verification.diagnosticTimeout ?? 6e4;
+    const diagnosticPrompt = `The following verification failed after step "${step.name}".
+
+Verification command: ${verificationCommand}
+Verification output:
+${verificationError}
+
+Step task was:
+${step.task ?? ""}
+
+Step output (last 2000 chars):
+${stepOutput.slice(-2e3)}
+
+Analyze what went wrong. Be specific. Do NOT fix the code.`;
+    const diagnosticStep = {
+      ...step,
+      name: `${step.name}-diagnostic-${runId.slice(0, 8)}`,
+      agent: diagnosticAgentName,
+      task: diagnosticPrompt,
+      verification: void 0,
+      retries: 0
+    };
+    const diagnosticCwd = this.resolveExecutionCwd(diagnosticStep, diagnosticAgentDef);
+    const startedAt = Date.now();
+    try {
+      this.ensureBudgetAllowsSpawn(step.name, diagnosticAgentName);
+      this.log(`[${step.name}] Verification failed \u2014 running diagnostic agent '${diagnosticAgentName}'...`);
+      const diagnosticResult = await this.execNonInteractive(diagnosticAgentDef, diagnosticStep, diagnosticTimeout);
+      const elapsedMs = Date.now() - startedAt;
+      await this.captureAgentReport(runId, step.name, diagnosticAgentDef, diagnosticCwd, startedAt, Date.now());
+      const analysis = diagnosticResult.output.trim();
+      const tokenCount = Math.max(1, Math.ceil(analysis.length / 4));
+      const firstLine = analysis.split(/\r?\n/).map((line) => line.trim()).find(Boolean) ?? "(no analysis returned)";
+      this.log(`[${step.name}] Diagnostic complete (${elapsedMs}ms, ${tokenCount} tokens): ${firstLine}`);
+      return {
+        analysis,
+        metadata: {
+          agentName: diagnosticAgentName,
+          elapsedMs,
+          tokenCount
+        }
+      };
+    } catch (error48) {
+      await this.captureAgentReport(runId, step.name, diagnosticAgentDef, diagnosticCwd, startedAt, Date.now());
+      const message = error48 instanceof Error ? error48.message : String(error48);
+      if (/\btimed out\b/i.test(message)) {
+        this.log(`[${step.name}] Diagnostic timed out \u2014 falling back to standard retry`);
+      } else {
+        this.log(`[${step.name}] Diagnostic failed \u2014 falling back to standard retry: ${message}`);
+      }
+      return null;
+    }
+  }
   buildOwnerRetryBudgetExceededMessage(stepName, maxRetries, ownerDecisionError) {
     const attempts = maxRetries + 1;
     const prefix = `Step "${stepName}" `;
@@ -58577,7 +59240,11 @@ DO NOT:
     this.postToChannel(`**[${step.name}]** Assigned to \`${agentName}\` (non-interactive)`);
     const stdoutChunks = [];
     const stderrChunks = [];
-    const env = { ...this.getRelayEnv() ?? filteredEnv() };
+    const proxyMode = await this.resolveAgentProxyMode(agentDef, this.currentConfig);
+    const env = { ...this.getRelayEnv(proxyMode) ?? filteredEnv() };
+    if (proxyMode?.url && proxyMode.token) {
+      Object.assign(env, resolveProxyEnv(agentDef.cli, proxyMode.url, proxyMode.token));
+    }
     const agentToken = this.agentTokens.get(agentDef.name);
     const mount = this.agentMounts.get(agentDef.name);
     if (agentToken) {
@@ -58591,7 +59258,7 @@ DO NOT:
       env.RELAY_WORKSPACE_ID = this.workspaceId;
       env.RELAY_DEFAULT_WORKSPACE = this.workspaceId;
     }
-    env.RELAYFILE_BASE_URL = env.RELAYFILE_BASE_URL ?? this.getRelayEnv()?.RELAYFILE_BASE_URL ?? process.env.RELAYFILE_BASE_URL ?? "http://127.0.0.1:8080";
+    env.RELAYFILE_BASE_URL = env.RELAYFILE_BASE_URL ?? this.getRelayEnv(proxyMode)?.RELAYFILE_BASE_URL ?? process.env.RELAYFILE_BASE_URL ?? "http://127.0.0.1:8080";
     try {
       const { stdout: output, exitCode, exitSignal } = await new Promise((resolve4, reject) => {
         const spawnEnv = agentDef.cli === "opencode" ? {
@@ -58746,6 +59413,9 @@ DO NOT:
         RELAY_API_KEY: this.relayApiKey ?? "workflow-runner",
         AGENT_CHANNELS: (agentChannels ?? []).join(",")
       });
+      const proxyMode = await this.resolveAgentProxyMode(agentDef, this.currentConfig);
+      const baseEnv = this.getRelayEnv(proxyMode);
+      const proxyEnvOverrides = proxyMode?.url && proxyMode.token ? resolveProxyEnv(agentDef.cli, proxyMode.url, proxyMode.token) : void 0;
       const spawnOptions = {
         name: agentName,
         model: agentDef.constraints?.model,
@@ -58754,7 +59424,8 @@ DO NOT:
         task: preparedTask.spawnTaskText,
         idleThresholdSecs: agentDef.constraints?.idleThresholdSecs,
         cwd: agentCwd,
-        agentToken: this.agentTokens.get(agentDef.name)
+        agentToken: this.agentTokens.get(agentDef.name),
+        env: proxyEnvOverrides ? { ...baseEnv, ...proxyEnvOverrides } : baseEnv
       };
       const sdkSpawner = getWorkflowSdkSpawner(this.relay, agentDef.cli);
       if (sdkSpawner) {
@@ -59092,10 +59763,31 @@ DO NOT:
   }
   // ── Verification ────────────────────────────────────────────────────────
   runVerification(check2, output, stepName, injectedTaskText, options) {
-    return runVerification(check2, output, stepName, injectedTaskText, { ...options, cwd: this.cwd }, {
-      recordStepToolSideEffect: (name, effect) => this.recordStepToolSideEffect(name, effect),
-      getOrCreateStepEvidenceRecord: (name) => this.getOrCreateStepEvidenceRecord(name),
-      log: (message) => this.log(message)
+    try {
+      const result = runVerification(check2, output, stepName, injectedTaskText, { ...options, cwd: this.cwd }, {
+        recordStepToolSideEffect: (name, effect) => this.recordStepToolSideEffect(name, effect),
+        getOrCreateStepEvidenceRecord: (name) => this.getOrCreateStepEvidenceRecord(name),
+        log: (message) => this.log(message)
+      });
+      this.updateCustomVerificationFailure(stepName, check2, result.error);
+      return result;
+    } catch (error48) {
+      this.updateCustomVerificationFailure(stepName, check2, error48 instanceof Error ? error48.message : String(error48));
+      throw error48;
+    }
+  }
+  updateCustomVerificationFailure(stepName, check2, errorMessage) {
+    if (check2.type !== "custom" || !check2.value || !errorMessage) {
+      this.lastCustomVerificationFailure.delete(stepName);
+      return;
+    }
+    const marker = `custom check "${check2.value}" failed
+`;
+    const markerIndex = errorMessage.indexOf(marker);
+    const output = markerIndex === -1 ? errorMessage.trim() : errorMessage.slice(markerIndex + marker.length).trim();
+    this.lastCustomVerificationFailure.set(stepName, {
+      command: check2.value,
+      output
     });
   }
   // ── State helpers ─────────────────────────────────────────────────────
@@ -59147,6 +59839,18 @@ DO NOT:
       });
       if (!report)
         return;
+      const totalTokens = this.getTotalReportTokens(report);
+      if (this.budgetTracker && report.tokens) {
+        this.budgetTracker.recordUsage(stepName, report.tokens);
+        this.budgetTracker.isOverBudget(stepName);
+        const budgetStatus = this.budgetTracker.getBudgetStatus(stepName);
+        if (budgetStatus.agentLimitExceeded) {
+          const stepBudget = this.budgetTracker.getStepBudgetStatus(stepName);
+          const used = stepBudget?.used?.toLocaleString("en-US") ?? totalTokens?.toLocaleString("en-US") ?? "0";
+          const limit = stepBudget?.limit?.toLocaleString("en-US") ?? "--";
+          this.log(`[budget] Step ${stepName} exceeded its agent budget (${used} of ${limit})`);
+        }
+      }
       this.agentReports.set(stepName, report);
       this.emit({ type: "step:agent-report", runId, stepName, report });
       await this.persistAgentReport(runId, stepName, report);
@@ -59292,7 +59996,7 @@ DO NOT:
     console.log(`  Workflow "${workflowName}" \u2014 ${failed.length === 0 ? import_chalk.default.green("COMPLETED") : import_chalk.default.red("FAILED")}`);
     console.log(`  ${import_chalk.default.green(`${completed.length} passed`)}, ${import_chalk.default.red(`${failed.length} failed`)}, ${import_chalk.default.dim(`${skipped.length} skipped`)}`);
     console.log(import_chalk.default.dim("\u2501".repeat(70)));
-    console.log(formatRunSummaryTable(outcomes, this.agentReports));
+    console.log(formatRunSummaryTable(outcomes, this.agentReports, this.budgetTracker?.getRunSummaryBudgetData()));
     for (const outcome of outcomes) {
       if (outcome.status !== "failed")
         continue;
@@ -60322,8 +61026,7 @@ var WorkflowBuilder = class {
       this._errorHandling.notifyChannel = options.notifyChannel;
     return this;
   }
-  /** Build and return the RelayYamlConfig object. */
-  toConfig() {
+  validateBuilderState() {
     const hasAgentSteps = this._steps.some((s3) => s3.type !== "deterministic" && s3.type !== "worktree");
     if (hasAgentSteps && this._agents.length === 0) {
       throw new Error("Workflow must have at least one agent when using agent steps");
@@ -60331,6 +61034,22 @@ var WorkflowBuilder = class {
     if (this._steps.length === 0) {
       throw new Error("Workflow must have at least one step");
     }
+    const agentNames = new Set(this._agents.map((agent) => agent.name));
+    for (const step of this._steps) {
+      const diagnosticAgent = step.verification?.diagnosticAgent;
+      if (!diagnosticAgent)
+        continue;
+      if (!agentNames.has(diagnosticAgent)) {
+        throw new Error(`Step "${step.name}" references unknown diagnosticAgent "${diagnosticAgent}"`);
+      }
+      if (step.retries === void 0 || step.retries === 0) {
+        console.warn(`Step "${step.name}": diagnosticAgent configured but no retries \u2014 diagnostic will never run`);
+      }
+    }
+  }
+  /** Build and return the RelayYamlConfig object. */
+  toConfig() {
+    this.validateBuilderState();
     const wfDef = {
       name: `${this._name}-workflow`,
       steps: [...this._steps]
@@ -62138,14 +62857,14 @@ function benchmarkPatterns(iterations = 1e4) {
 }
 
 // packages/utils/dist/command-resolver.js
-var import_node_child_process8 = require("node:child_process");
+var import_node_child_process9 = require("node:child_process");
 var import_node_fs24 = __toESM(require("node:fs"), 1);
 function resolveCommand(command) {
   if (command.startsWith("/")) {
     return resolveSymlinks(command);
   }
   try {
-    const output = (0, import_node_child_process8.execSync)(`which ${command}`, {
+    const output = (0, import_node_child_process9.execSync)(`which ${command}`, {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
       // Ensure we have a reasonable PATH
@@ -62179,7 +62898,7 @@ function resolveSymlinks(filePath) {
 }
 function commandExists(command) {
   try {
-    (0, import_node_child_process8.execSync)(`which ${command}`, {
+    (0, import_node_child_process9.execSync)(`which ${command}`, {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -62192,7 +62911,7 @@ function commandExists(command) {
 // packages/utils/dist/git-remote.js
 var fs8 = __toESM(require("node:fs"), 1);
 var path20 = __toESM(require("node:path"), 1);
-var import_node_child_process9 = require("node:child_process");
+var import_node_child_process10 = require("node:child_process");
 function parseGitRemoteUrl(url2) {
   if (!url2)
     return null;
@@ -62212,7 +62931,7 @@ function getGitRemoteUrl(workingDirectory, remoteName = "origin") {
     if (!fs8.existsSync(gitDir)) {
       return null;
     }
-    const result = (0, import_node_child_process9.execSync)(`git remote get-url ${remoteName}`, {
+    const result = (0, import_node_child_process10.execSync)(`git remote get-url ${remoteName}`, {
       cwd: workingDirectory,
       encoding: "utf-8",
       timeout: 5e3,
@@ -63343,7 +64062,7 @@ var HookRegistry = class {
 };
 
 // packages/trajectory/dist/integration.js
-var import_node_child_process10 = require("node:child_process");
+var import_node_child_process11 = require("node:child_process");
 
 // packages/config/dist/project-namespace.js
 var import_node_crypto15 = __toESM(require("node:crypto"), 1);
@@ -63472,7 +64191,7 @@ function getTrajectoryEnvVars(projectRoot) {
 async function runTrail(args) {
   return new Promise((resolve4) => {
     const trajectoryEnv = getTrajectoryEnvVars();
-    const proc = (0, import_node_child_process10.spawn)("trail", args, {
+    const proc = (0, import_node_child_process11.spawn)("trail", args, {
       cwd: getProjectPaths2().projectRoot,
       env: { ...process.env, ...trajectoryEnv },
       stdio: ["pipe", "pipe", "pipe"]
@@ -63743,7 +64462,7 @@ var TrajectoryIntegration = class {
    */
   isTrailInstalledSync() {
     try {
-      (0, import_node_child_process10.execSync)("which trail", { stdio: "pipe" });
+      (0, import_node_child_process11.execSync)("which trail", { stdio: "pipe" });
       return true;
     } catch {
       return false;
@@ -64178,6 +64897,8 @@ init_dist2();
   BUILT_IN_TEMPLATE_NAMES,
   BarrierManager,
   BrokerTransport,
+  BudgetExceededError,
+  BudgetTracker,
   CLAUDE_MODEL_OPTIONS,
   CLIRegistry,
   CLIVersions,
@@ -64195,6 +64916,7 @@ init_dist2();
   CustomStepResolutionError,
   CustomStepsParseError,
   DEFAULT_INBOX_DIR,
+  DEFAULT_PROXY_ENV_REGISTRY,
   DefaultModels,
   ERROR_SEARCH_HINT,
   GEMINI_MODEL_OPTIONS,
@@ -64209,6 +64931,10 @@ init_dist2();
   ModelOptions,
   Models,
   PROTOCOL_VERSION,
+  RELAY_PROXY_TOKEN_ENV,
+  RELAY_PROXY_TOKEN_ENV_ALIAS,
+  RELAY_PROXY_URL_ENV,
+  RELAY_PROXY_URL_ENV_ALIAS,
   ReasoningEfforts,
   RelayAdapter,
   RelayCast,
@@ -64233,6 +64959,8 @@ init_dist2();
   buildBlockReason,
   buildCommand,
   buildModelSwitchCommand,
+  buildNormalizedProxyEnv,
+  checkCustom,
   checkExitCode,
   checkFileExists,
   checkForUpdates,
@@ -64256,6 +64984,7 @@ init_dist2();
   createMemoryService,
   createProcessBackendExecutor,
   createProcessSpawner,
+  createProxyEnvResolver,
   createRequestEnvelope,
   createRequestHandler,
   createTraceableError,
@@ -64265,6 +64994,7 @@ init_dist2();
   detectCompletion,
   estimateContextTokens,
   estimateTokens,
+  execCustomVerification,
   executeApiStep,
   findGitRoot,
   findRelayPtyBinary,
@@ -64298,6 +65028,7 @@ init_dist2();
   getPatternMetrics,
   getRepoFullName,
   getRepoFullNameFromPath,
+  getStrippedApiKeyVars,
   getSupportedPlatforms,
   getSupportedReasoningEfforts,
   getTrajectoryHooks,
@@ -64317,6 +65048,7 @@ init_dist2();
   isModelSwitchSupported,
   isPlaceholderTargetFast,
   isPlatformSupported,
+  isProxyEnabled,
   isRestrictedAgent,
   isSpawnOrReleaseCommandFast,
   isTrajectoryTrackingAvailable,
@@ -64340,6 +65072,9 @@ init_dist2();
   resolveCommand,
   resolveCustomStep,
   resolveDotPath,
+  resolveProxyEnv,
+  resolveProxyTokenFromEnv,
+  resolveProxyUrlFromEnv,
   resolveSpawnPolicy,
   resolveStepOutputRef,
   resolveTemplate,