cursor-route 0.1.1 → 0.1.4

package/docs/demo-notes.md

@@ -3,14 +3,18 @@
 Simulated capture output for README / tweet assets — replace with a real GIF once tmux is available.
 
 ```
+$ cursor-route --version
+0.1.4
+
 $ cursor-route health
-cursor-route v0.1.0
+cursor-route v0.1.4
 health: OK
   ✓ tmux
   ✓ runtime          bun ok
   ✓ script(1)
   ✓ worker:grok
   ✓ worker:claude-ds
+  ✓ jobs_dir         ~/.local/share/cursor-route/jobs
 
 $ cursor-route start --lane mid "Add a failing test then make it pass"
 started a1b2c3d4 (claude-ds)
@@ -23,3 +27,6 @@ $ cursor-route jobs --json
 
 Verified locally (2026-08-10): headless `claude-ds` smoke returned `CURSOR_ROUTE_SMOKE_OK`.
 Grok smoke hit 402 (Build usage balance exhausted) — auth/PATH wiring works; top up Grok Build for live demos.
+
+Current commands: `health`, `start`, `jobs`, `status`, `capture`, `send`, `attach`, `kill`, `sessions`, `clean`.
+Headless demos (no tmux) use `--no-tmux` and `capture`/`status` instead of `attach`/`send`.

package/docs/fixtures/claude-ds-smoke.log

@@ -1,5 +1,5 @@
 claude-ds - DeepSeek Claude Code (model=deepseek-v4-flash)
 Install: ~/.deepseek-claude
-PromptFile: ~/.cursor-route/jobs/e7567d1f.prompt
+PromptFile: ~/.local/share/cursor-route/jobs/e7567d1f.prompt
 WorkDir: ~/Projects/cursor-route
 CURSOR_ROUTE_SMOKE_OK

package/llms.txt

@@ -0,0 +1,29 @@
+# cursor-route
+
+> Cursor stays the planner. DeepSeek (mid) and Grok CLI (hard) run parallel coding workers in tmux.
+
+MIT CLI + Cursor skill. npm: https://www.npmjs.com/package/cursor-route  
+GitHub: https://github.com/cemini23/cursor-route
+
+## FAQ
+
+### What is cursor-route?
+cursor-route is a public MIT CLI and Cursor skill that runs parallel coding workers in tmux while Cursor remains the planner. DeepSeek handles the mid lane, and Grok CLI handles the hard lane.
+
+### How is this different from Codex orchestrator?
+It uses the familiar strategist and worker-pane shape, but it is not a Codex clone. cursor-route uses Cursor as the planner and DeepSeek plus Grok CLI as workers. Codex is not required.
+
+### Does mid lane use Anthropic Claude?
+No. The mid worker is DeepSeek. Claude Code is the harness, configured with `ANTHROPIC_BASE_URL=https://api.deepseek.com/anthropic` and a DeepSeek key in `ANTHROPIC_AUTH_TOKEN`.
+
+### How do I install?
+Run `npm i -g cursor-route`, install tmux if needed, then run `cursor-route health`. The package is available at https://www.npmjs.com/package/cursor-route, and the source is at https://github.com/cemini23/cursor-route.
+
+### Is it free?
+The cursor-route code is open source under MIT. It does not make the worker services free. Your costs depend on Cursor, DeepSeek API usage, and the Grok access or balance available to you.
+
+## Install
+
+- npm: `npm i -g cursor-route`
+- Health: `cursor-route health`
+- Skill: `/route-orch` (Cursor)

package/package.json

@@ -1,31 +1,37 @@
 {
   "name": "cursor-route",
-  "version": "0.1.1",
-  "description": "Cursor stays the brain. Grok CLI + DeepSeek (claude-ds) are the parallel army — lane-aware /route orchestration in tmux.",
+  "version": "0.1.4",
+  "description": "Cursor stays the brain. Grok CLI + DeepSeek (claude-ds) are the parallel army \u2014 lane-aware /route orchestration in tmux.",
   "type": "module",
   "license": "MIT",
   "bin": {
-    "cursor-route": "./bin/cursor-route.js"
+    "cursor-route": "./bin/cursor-route"
   },
   "engines": {
     "node": ">=20"
   },
   "files": [
     "bin",
+    "dist",
     "src",
     "skills",
-    "docs",
+    "docs/DEMO_GIF.md",
+    "docs/demo-notes.md",
+    "docs/fixtures",
     "LICENSE",
     "SECURITY.md",
+    "SUPPORT.md",
     "CONTRIBUTING.md",
-    "README.md"
+    "README.md",
+    "llms.txt"
   ],
   "scripts": {
     "start": "bun run src/cli.ts",
     "health": "bun run src/cli.ts health",
     "test": "bun test",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "bun test && bun run typecheck"
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "bun test && bun run typecheck && bun run build"
   },
   "keywords": [
     "cursor",

package/src/adapters/claude-ds.ts

@@ -20,7 +20,7 @@ import { shellQuote } from "../util.ts";
 function which(cmd: string): string | null {
   try {
     return (
-      execSync(`command -v ${cmd}`, {
+      execSync(`command -v ${shellQuote(cmd)}`, {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
       }).trim() || null
@@ -30,37 +30,58 @@ function which(cmd: string): string | null {
   }
 }
 
+/** True when URL hostname is deepseek.com (or a subdomain). */
+export function isDeepSeekBaseUrl(url: string): boolean {
+  try {
+    const u = new URL(url);
+    const host = u.hostname.toLowerCase();
+    return host === "deepseek.com" || host.endsWith(".deepseek.com");
+  } catch {
+    return false;
+  }
+}
+
 function deepseekBaseFromSettings(): string | null {
-  const candidates = [
-    join(homedir(), ".claude", "settings.json"),
-    join(process.cwd(), ".claude", "settings.json"),
-  ];
-  for (const p of candidates) {
-    if (!existsSync(p)) continue;
-    try {
-      const j = JSON.parse(readFileSync(p, "utf8")) as {
-        env?: Record<string, string>;
-      };
-      const url = j.env?.ANTHROPIC_BASE_URL;
-      if (url) return url;
-    } catch {
-      /* ignore */
-    }
+  // Home settings only — do not trust cwd/.claude/settings.json (spoof / exfil risk)
+  const p = join(homedir(), ".claude", "settings.json");
+  if (!existsSync(p)) return null;
+  try {
+    const j = JSON.parse(readFileSync(p, "utf8")) as {
+      env?: Record<string, string>;
+    };
+    const url = j.env?.ANTHROPIC_BASE_URL;
+    if (url && isDeepSeekBaseUrl(url)) return url;
+  } catch {
+    /* ignore */
+  }
+  return null;
+}
+
+/** Resolved DeepSeek base URL for the mid-lane harness, or null. */
+export function resolvedDeepSeekBaseUrl(): string | null {
+  for (const candidate of [
+    process.env.ANTHROPIC_BASE_URL,
+    process.env.CURSOR_ROUTE_ANTHROPIC_BASE_URL,
+    deepseekBaseFromSettings(),
+  ]) {
+    if (candidate && isDeepSeekBaseUrl(candidate)) return candidate;
   }
   return null;
 }
 
 /** True when Claude Code harness is routed to DeepSeek (cheap path). */
 export function isDeepSeekRouted(): boolean {
-  const url =
-    process.env.ANTHROPIC_BASE_URL ||
-    process.env.CURSOR_ROUTE_ANTHROPIC_BASE_URL ||
-    deepseekBaseFromSettings() ||
-    "";
-  return /deepseek\.com/i.test(url);
+  return Boolean(resolvedDeepSeekBaseUrl());
 }
 
 function resolveClaudeDs(): { binary: string; mode: string } | null {
+  // Env override lets tests pin a fake claude-ds (and power users pick a specific binary).
+  if (process.env.CURSOR_ROUTE_CLAUDE_DS_BIN) {
+    return {
+      binary: process.env.CURSOR_ROUTE_CLAUDE_DS_BIN,
+      mode: "claude-ds (CURSOR_ROUTE_CLAUDE_DS_BIN override)",
+    };
+  }
   for (const c of [
     { cmd: "claude-ds", mode: "claude-ds (DeepSeek shim)" },
     { cmd: "deepseek-claude", mode: "deepseek-claude" },
@@ -93,6 +114,25 @@ function resolveClaudeDs(): { binary: string; mode: string } | null {
   return null;
 }
 
+/**
+ * Env that must reach stock `claude` for DeepSeek routing.
+ * Passed via process/tmux env — never interpolated into the printed command.
+ */
+function deepSeekWorkerEnv(): Record<string, string> | undefined {
+  const base = resolvedDeepSeekBaseUrl();
+  if (!base) return undefined;
+  const env: Record<string, string> = { ANTHROPIC_BASE_URL: base };
+  const token =
+    process.env.ANTHROPIC_AUTH_TOKEN ||
+    process.env.ANTHROPIC_API_KEY ||
+    process.env.DEEPSEEK_API_KEY ||
+    "";
+  if (token) env.ANTHROPIC_AUTH_TOKEN = token;
+  const model = process.env.ANTHROPIC_MODEL;
+  if (model) env.ANTHROPIC_MODEL = model;
+  return env;
+}
+
 export const claudeDsAdapter: Adapter = {
   kind: "claude-ds",
   label: "DeepSeek (via Claude Code harness)",
@@ -124,6 +164,10 @@ export const claudeDsAdapter: Adapter = {
 
     const ask = process.env.CURSOR_ROUTE_ASK === "1" || process.env.CLAUDE_DS_ASK === "1";
     const skip = alwaysApprove && !ask;
+    // Stock `claude` needs DeepSeek env injected into the worker process
+    // (tmux panes may not inherit client env from a long-lived server).
+    const env =
+      resolved.mode.startsWith("claude → DeepSeek") ? deepSeekWorkerEnv() : undefined;
 
     if (resolved.mode.startsWith("claude-ds")) {
       const parts = [
@@ -136,6 +180,7 @@ export const claudeDsAdapter: Adapter = {
         worker: "claude-ds",
         command: `cd ${shellQuote(cwd)} && ${parts.join(" ")}`,
         alwaysApprove: skip,
+        env,
       };
     }
 
@@ -149,6 +194,7 @@ export const claudeDsAdapter: Adapter = {
       worker: "claude-ds",
       command: `cd ${shellQuote(cwd)} && ${parts.join(" ")}`,
       alwaysApprove: skip,
+      env,
     };
   },
 };

package/src/adapters/grok.ts

@@ -3,11 +3,15 @@ import type { Adapter, WorkerHealth } from "./types.ts";
 import { shellQuote } from "../util.ts";
 
 function findGrok(): string | null {
+  // Env override lets tests pin a fake grok (and power users pick a specific binary).
+  if (process.env.CURSOR_ROUTE_GROK_BIN) return process.env.CURSOR_ROUTE_GROK_BIN;
   try {
-    return execSync("command -v grok", {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-    }).trim() || null;
+    return (
+      execSync("command -v grok", {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+      }).trim() || null
+    );
   } catch {
     return null;
   }
@@ -34,8 +38,9 @@ export const grokAdapter: Adapter = {
     };
   },
   buildLaunch({ promptFile, cwd, alwaysApprove }) {
+    const binary = findGrok() || "grok";
     const parts = [
-      "grok",
+      shellQuote(binary),
       "-p",
       `"$(cat ${shellQuote(promptFile)})"`,
       "--cwd",

package/src/adapters/types.ts

@@ -12,6 +12,8 @@ export interface LaunchPlan {
   /** Full shell command to run inside tmux (prompt already inlined via cat). */
   command: string;
   alwaysApprove: boolean;
+  /** Extra env for the worker process (never print secret values). */
+  env?: Record<string, string>;
 }
 
 export interface Adapter {

package/src/cli.test.ts

@@ -3,8 +3,8 @@ import { resolveWorker } from "./jobs.ts";
 import { config } from "./config.ts";
 import { shellQuote, newJobId } from "./util.ts";
 import { runHealth } from "./health.ts";
-import { looksLikeSecretMaterial } from "./secrets.ts";
-import { isDeepSeekRouted } from "./adapters/claude-ds.ts";
+import { looksLikeSecretMaterial, redactSecrets } from "./secrets.ts";
+import { isDeepSeekRouted, isDeepSeekBaseUrl } from "./adapters/claude-ds.ts";
 
 describe("resolveWorker", () => {
   test("lane mid → claude-ds", () => {
@@ -40,8 +40,24 @@ describe("secrets", () => {
   test("blocks sk- material", () => {
     expect(looksLikeSecretMaterial("token sk-abcdefghijklmnopqrstuvwxyz1234")).toBe(true);
   });
-  test("blocks ghp_ material", () => {
+  test("blocks sk-proj and sk-ant", () => {
+    expect(
+      looksLikeSecretMaterial("sk-proj-abcdefghijklmnopqrstuvwxyz123456"),
+    ).toBe(true);
+    expect(
+      looksLikeSecretMaterial("sk-ant-api03-abcdefghijklmnopqrstuvwxyz"),
+    ).toBe(true);
+  });
+  test("blocks ghp_ and github_pat", () => {
     expect(looksLikeSecretMaterial("ghp_abcdefghijklmnopqrstuvwx")).toBe(true);
+    expect(
+      looksLikeSecretMaterial("github_pat_11AAAAAAAAabcdefghijklmnopqrstuvwxyz"),
+    ).toBe(true);
+  });
+  test("redactSecrets strips material", () => {
+    const out = redactSecrets("see sk-abcdefghijklmnopqrstuvwxyz1234 end");
+    expect(out).toContain("[REDACTED]");
+    expect(out).not.toContain("sk-abcd");
   });
 });
 
@@ -51,6 +67,8 @@ describe("deepseek routing", () => {
     process.env.ANTHROPIC_BASE_URL = "https://api.deepseek.com/anthropic";
     try {
       expect(isDeepSeekRouted()).toBe(true);
+      expect(isDeepSeekBaseUrl("https://api.deepseek.com/anthropic")).toBe(true);
+      expect(isDeepSeekBaseUrl("https://evil-deepseek.com.attacker.tld")).toBe(false);
     } finally {
       if (prev === undefined) delete process.env.ANTHROPIC_BASE_URL;
       else process.env.ANTHROPIC_BASE_URL = prev;
@@ -67,16 +85,13 @@ describe("health", () => {
     expect(r.checks.some((c) => c.name === "cursor_cli")).toBe(true);
   });
 
-  test("relaxed env can pass without tmux", () => {
+  test("relaxed env can pass without workers", () => {
     const prev = process.env.CURSOR_ROUTE_RELAXED;
     process.env.CURSOR_ROUTE_RELAXED = "1";
     try {
       const r = runHealth();
-      const tmux = r.checks.find((c) => c.name === "tmux");
-      if (tmux && !tmux.ok) {
-        expect(r.ok).toBe(true);
-        expect(r.checks.some((c) => c.name === "relaxed")).toBe(true);
-      }
+      expect(r.ok).toBe(true);
+      expect(r.checks.some((c) => c.name === "relaxed")).toBe(true);
     } finally {
       if (prev === undefined) delete process.env.CURSOR_ROUTE_RELAXED;
       else process.env.CURSOR_ROUTE_RELAXED = prev;

package/src/cli.ts

@@ -2,7 +2,7 @@
 /**
  * cursor-route CLI — Cursor brain, Grok + DeepSeek workers in tmux.
  */
-import { readFileSync, existsSync } from "node:fs";
+import { readFileSync, existsSync, realpathSync, statSync } from "node:fs";
 import { resolve, basename } from "node:path";
 import { config, WORKERS, LANES, type WorkerKind, type Lane } from "./config.ts";
 import { runHealth, printHealth } from "./health.ts";
@@ -22,7 +22,7 @@ import {
   listManagedSessions,
   sessionExists,
 } from "./tmux.ts";
-import { looksLikeSecretMaterial } from "./secrets.ts";
+import { looksLikeSecretMaterial, redactSecrets } from "./secrets.ts";
 
 function usage(exitCode = 0): never {
   console.log(`cursor-route v${config.version}
@@ -55,8 +55,11 @@ Start options:
 Env:
   CURSOR_ROUTE_ASK=1                 Opt out of always-approve
   CURSOR_ROUTE_JOBS_DIR              Override jobs dir (default: ~/.local/share/cursor-route/jobs)
-  CURSOR_ROUTE_RELAXED=1             health OK without tmux (headless CI)
+  CURSOR_ROUTE_MAX_JOBS              Max active jobs (default: 50)
+  CURSOR_ROUTE_RELAXED=1             health OK without tmux/workers (CI / infra smoke)
   CURSOR_ROUTE_ALLOW_ANTHROPIC=1     Allow mid-lane on Anthropic Claude (expensive; not default)
+  CURSOR_ROUTE_GROK_BIN              Override the grok binary path (tests / power users)
+  CURSOR_ROUTE_CLAUDE_DS_BIN         Override the claude-ds binary path (tests / power users)
 `);
   process.exit(exitCode);
 }
@@ -66,6 +69,10 @@ function parseArgs(argv: string[]) {
   const positional: string[] = [];
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
+    if (a === "--") {
+      positional.push(...argv.slice(i + 1));
+      break;
+    }
     if (
       a === "--json" ||
       a === "--ask" ||
@@ -106,6 +113,30 @@ function parseArgs(argv: string[]) {
   return { flags, positional };
 }
 
+/** Require a string value for flags that must not be bare booleans. */
+function requireStringFlag(
+  flags: Record<string, string | boolean>,
+  key: string,
+): string | undefined {
+  if (!(key in flags)) return undefined;
+  const v = flags[key];
+  if (typeof v !== "string" || !v.trim()) {
+    console.error(`--${key} requires a value`);
+    process.exit(2);
+  }
+  return v;
+}
+
+function requireNonNegNumber(raw: string | undefined, label: string, fallback: number): number {
+  if (raw === undefined) return fallback;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) {
+    console.error(`${label} must be a non-negative number`);
+    process.exit(2);
+  }
+  return n;
+}
+
 function asWorker(v: unknown): WorkerKind | undefined {
   if (typeof v !== "string") return undefined;
   if ((WORKERS as string[]).includes(v)) return v as WorkerKind;
@@ -128,14 +159,31 @@ function refuseSecrets(text: string, context: string): void {
 }
 
 function refuseDangerousPromptFile(path: string): void {
-  const base = basename(path);
-  const resolved = resolve(path);
+  let resolved: string;
+  try {
+    resolved = realpathSync(path);
+  } catch {
+    resolved = resolve(path);
+  }
+  const base = basename(resolved);
+  const lower = resolved.toLowerCase();
   if (
     base.startsWith(".env") ||
-    resolved.includes("/.ssh/") ||
+    lower.includes("/.ssh/") ||
+    lower.includes("/.aws/") ||
+    lower.includes("/.kube/") ||
+    base === ".npmrc" ||
+    base === ".git-credentials" ||
+    base === ".pgpass" ||
     base === "id_rsa" ||
     base === "id_ed25519" ||
-    base.endsWith(".pem")
+    base === "id_ecdsa" ||
+    base === "id_dsa" ||
+    base === "credentials" ||
+    base.endsWith(".pem") ||
+    base.endsWith(".key") ||
+    base.endsWith(".p12") ||
+    base.endsWith(".pfx")
   ) {
     console.error(`Refusing --prompt-file path that looks credential-related: ${path}`);
     process.exit(3);
@@ -163,9 +211,14 @@ async function main() {
   }
 
   if (cmd === "start") {
+    requireStringFlag(f, "worker");
+    requireStringFlag(f, "lane");
+    const promptFile = requireStringFlag(f, "prompt-file");
+    const dirFlag = requireStringFlag(f, "dir");
+
     let prompt = "";
-    if (f["prompt-file"]) {
-      const p = resolve(String(f["prompt-file"]));
+    if (promptFile) {
+      const p = resolve(promptFile);
       refuseDangerousPromptFile(p);
       if (!existsSync(p)) {
         console.error(`prompt file not found: ${p}`);
@@ -181,11 +234,25 @@ async function main() {
     }
     refuseSecrets(prompt, "to start");
 
+    let cwd = process.cwd();
+    if (dirFlag) {
+      cwd = resolve(dirFlag);
+      try {
+        if (!statSync(cwd).isDirectory()) {
+          console.error(`--dir is not a directory: ${cwd}`);
+          process.exit(2);
+        }
+      } catch {
+        console.error(`--dir does not exist: ${cwd}`);
+        process.exit(2);
+      }
+    }
+
     const result = startJob({
       prompt,
       worker: asWorker(f.worker),
       lane: asLane(f.lane),
-      cwd: f.dir ? resolve(String(f.dir)) : process.cwd(),
+      cwd,
       alwaysApprove: !f.ask,
       dryRun: Boolean(f.dryRun),
       noTmux: Boolean(f.noTmux),
@@ -197,11 +264,20 @@ async function main() {
     }
 
     if (json) {
-      console.log(JSON.stringify({ ...result.job, command: result.command }, null, 2));
+      console.log(
+        JSON.stringify(
+          {
+            ...result.job,
+            command: result.command ? redactSecrets(result.command) : result.command,
+          },
+          null,
+          2,
+        ),
+      );
     } else if (result.dryRun) {
       console.log(`dry-run job ${result.job.id}`);
       console.log(`worker: ${result.job.worker}`);
-      console.log(`command: ${result.command}`);
+      console.log(`command: ${redactSecrets(result.command || "")}`);
     } else {
       console.log(`started ${result.job.id} (${result.job.worker})`);
       console.log(`session: ${result.job.tmuxSession}`);
@@ -217,7 +293,8 @@ async function main() {
   }
 
   if (cmd === "jobs") {
-    const limit = f.limit ? Number(f.limit) : config.jobsListLimit;
+    const limitRaw = requireStringFlag(f, "limit");
+    const limit = requireNonNegNumber(limitRaw, "--limit", config.jobsListLimit);
     const jobs = listJobs(limit);
     if (json) {
       console.log(JSON.stringify(jobs, null, 2));
@@ -267,7 +344,10 @@ async function main() {
 
   if (cmd === "capture") {
     const id = pos[0];
-    const lines = pos[1] ? Number(pos[1]) : 50;
+    const linesRaw = pos[1];
+    const lines = linesRaw
+      ? requireNonNegNumber(linesRaw, "capture lines", 50)
+      : 50;
     if (!id) {
       console.error("capture requires <jobId>");
       process.exit(2);
@@ -326,6 +406,15 @@ async function main() {
       console.error("attach requires <jobId>");
       process.exit(2);
     }
+    const job = readJob(id);
+    if (!job) {
+      console.error(`Job not found: ${id}`);
+      process.exit(1);
+    }
+    if (job.tmuxSession.startsWith("headless-")) {
+      console.error("headless job — use capture/status (no tmux attach)");
+      process.exit(1);
+    }
     console.log(attachHint(id));
     return;
   }
@@ -354,7 +443,8 @@ async function main() {
   }
 
   if (cmd === "clean") {
-    const days = f.days ? Number(f.days) : 7;
+    const daysRaw = requireStringFlag(f, "days");
+    const days = requireNonNegNumber(daysRaw, "--days", 7);
     const n = cleanJobs(days);
     console.log(`cleaned ${n} job(s) older than ${days}d`);
     return;

package/src/config.ts

@@ -8,10 +8,26 @@ export type Lane = "mid" | "hard";
 export const WORKERS: WorkerKind[] = ["grok", "claude-ds"];
 export const LANES: Lane[] = ["mid", "hard"];
 
+function maxConcurrentJobsFromEnv(): number {
+  const raw = process.env.CURSOR_ROUTE_MAX_JOBS;
+  if (raw) {
+    const n = Number(raw);
+    if (Number.isInteger(n) && n > 0) return n;
+  }
+  return 50;
+}
+
+/**
+ * Live getters for env-derived paths/limits so tests can set
+ * CURSOR_ROUTE_JOBS_DIR / CURSOR_ROUTE_MAX_JOBS before exercising jobs
+ * even if another module imported config earlier.
+ */
 export const config = {
   product: "cursor-route",
-  version: "0.1.1",
-  jobsDir: defaultJobsDir(),
+  version: "0.1.4",
+  get jobsDir(): string {
+    return defaultJobsDir();
+  },
   tmuxPrefix: "cursor-route",
   defaultWorker: "grok" as WorkerKind,
   /** Lane → default worker (Cemini /route public core). */
@@ -20,6 +36,10 @@ export const config = {
     hard: "grok" as WorkerKind,
   },
   jobsListLimit: 20,
+  /** Max simultaneously active (running|pending) jobs. Override: CURSOR_ROUTE_MAX_JOBS. */
+  get maxConcurrentJobs(): number {
+    return maxConcurrentJobsFromEnv();
+  },
 };
 
 export function sessionName(jobId: string): string {

package/src/health.ts

@@ -32,7 +32,7 @@ export function runHealth(): HealthReport {
   checks.push({
     name: "runtime",
     ok: bunOk || nodeOk,
-    detail: bunOk ? "bun ok" : nodeOk ? "node ok (tsx via npx for TS)" : "need bun or node 20+",
+    detail: bunOk ? "bun ok" : nodeOk ? "node ok (compiled dist)" : "need bun or node 20+",
   });
 
   const scriptOk = (() => {
@@ -71,18 +71,20 @@ export function runHealth(): HealthReport {
       : "optional — Cursor CLI agent not on PATH (skill-only supervisor is fine for v0)",
   });
 
-  // At least one worker must be healthy; tmux is hard-required for attach/send product path.
-  // Set CURSOR_ROUTE_RELAXED=1 to pass health without tmux (headless/--no-tmux CI).
+  // At least one worker must be healthy for a green health gate.
+  // CURSOR_ROUTE_RELAXED=1: pass without tmux and without workers (CI / infra smoke).
   const workerOk = checks.some((c) => c.name.startsWith("worker:") && c.ok);
   const relaxed = process.env.CURSOR_ROUTE_RELAXED === "1";
   const hardOk = (tmuxOk || relaxed) && (bunOk || nodeOk) && scriptOk;
-  const ok = hardOk && workerOk;
+  const ok = hardOk && (workerOk || relaxed);
 
-  if (relaxed && !tmuxOk) {
+  if (relaxed) {
     checks.push({
       name: "relaxed",
       ok: true,
-      detail: "CURSOR_ROUTE_RELAXED=1 — tmux not required (headless only)",
+      detail: workerOk
+        ? "CURSOR_ROUTE_RELAXED=1 — tmux optional (headless OK)"
+        : "CURSOR_ROUTE_RELAXED=1 — tmux/workers optional (CI / infra smoke)",
     });
   }