feat(api): accept a lane tool on create, start and binary probe

server/routes/run.js

@@ -24,6 +24,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const runs = require("../lib/pty-run");
 const tmux = require("../lib/tmux");
+const lanesLib = require("../lib/lanes");
 
 const router = Router();
 
@@ -236,20 +237,22 @@ router.get("/files", (req, res) => {
   res.json({ items: results.slice(0, MAX_RESULTS) });
 });
 
-router.get("/binary", (_req, res) => {
-  // Surface whether `claude` is on PATH so the UI can show a helpful error
-  // before the user clicks Run. We don't actually invoke it — just let the
-  // user know the spawn will work.
+router.get("/binary", (req, res) => {
+  // Surface whether the lane's CLI is on PATH so the UI can show a helpful
+  // error before the user clicks Run. We don't actually invoke it. The name is
+  // taken from a fixed allowlist, never from the query string directly — this
+  // string reaches `which`.
+  const tool = req.query.tool === undefined ? "claude" : String(req.query.tool);
+  if (tool !== "claude" && tool !== "codex") {
+    return res.status(400).json({ error: { code: "EBADTOOL", message: "unknown tool" } });
+  }
   const which = require("node:child_process").spawnSync(
     process.platform === "win32" ? "where" : "which",
-    ["claude"],
+    [tool],
     { encoding: "utf8" }
   );
   const stdout = (which.stdout || "").trim();
-  res.json({
-    found: which.status === 0 && stdout.length > 0,
-    path: stdout || null,
-  });
+  res.json({ found: which.status === 0 && stdout.length > 0, path: stdout || null });
 });
 
 router.get("/tmux", (_req, res) => {
@@ -269,9 +272,11 @@ router.post("/", (req, res) => {
     return res.status(400).json({ error: { code: err.code, message: err.message } });
   }
   try {
+    const lane = lanesLib.getLane(laneId);
     const handle = runs.spawnRun({
       laneId,
       cwd,
+      tool: lane?.tool || "claude",
       model: typeof body.model === "string" && body.model ? body.model : null,
       permissionMode:
         typeof body.permissionMode === "string" && ALLOWED_PERMISSION_MODES.has(body.permissionMode)