@hasna/loops 0.3.0 → 0.3.2

package/README.md

@@ -76,6 +76,17 @@ loops create agent supply-chain-watch \
   --prompt "Check for suspicious dependency or supply-chain changes. Report only concrete findings."
 ```
 
+Run a Codewith loop with a Codewith-native auth profile:
+
+```bash
+loops create agent supply-chain-watch \
+  --provider codewith \
+  --auth-profile account001 \
+  --every 15m \
+  --cwd /path/to/repo \
+  --prompt "Check for suspicious dependency or supply-chain changes. Report only concrete findings."
+```
+
 For `codewith` and `aicopilot` account isolation, register matching OpenAccounts tools first if they are not built in on the machine:
 
 ```bash
@@ -157,7 +168,7 @@ loops remove <id-or-name>
 loops run-now <id-or-name>
 ```
 
-Use `--json` for machine-readable output. Prompt bodies and run stdout/stderr are redacted by default in status output.
+Use `--json` for machine-readable output. Prompt bodies and run stdout/stderr are redacted by default in status output. `loops run-now` exits non-zero when the recorded run fails or times out.
 
 ## Daemon
 
@@ -203,10 +214,12 @@ On Linux this writes a user systemd service. On macOS it writes a LaunchAgent pl
 The adapters intentionally use provider command surfaces instead of pretending every agent has one SDK:
 
 - Claude uses `claude -p --output-format json` and safe-mode/local setting sources by default.
-- Codewith uses `codewith exec --json --ephemeral --ask-for-approval never`.
+- Codewith uses `codewith --ask-for-approval never exec --json --ephemeral --skip-git-repo-check`.
 - AI Copilot and OpenCode use `run --format json --pure`.
 - Cursor is CLI-first for now via `cursor-agent -p`; treat output as less stable until a stronger public SDK contract is selected.
 - Codex uses `codex exec --json --ephemeral --ask-for-approval never`.
 - When `--account` or a step `account` is set, OpenLoops resolves `accounts env <profile> --tool <tool>` before spawning the target, strips inherited tool home/API-key variables, and applies the selected profile only to that process. Missing account profiles fail before the provider binary receives the prompt.
+- `--auth-profile` and step `authProfile` are provider-native auth selectors. They currently apply to Codewith and are passed to Codewith as `--auth-profile <name>` before `exec`; they do not call OpenAccounts.
+- Daemon and scheduled runs prepend common user executable directories such as `~/.local/bin` and `~/.bun/bin` before resolving provider CLIs.
 
 For production loops that can mutate repos, prefer disposable worktrees and explicit prompts that name allowed write scope.

package/dist/cli/index.js

@@ -260,6 +260,11 @@ function validateTarget(value, label) {
     const providers = ["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"];
     if (!providers.includes(value.provider))
       throw new Error(`${label}.provider must be one of ${providers.join(", ")}`);
+    if (value.authProfile !== undefined) {
+      assertString(value.authProfile, `${label}.authProfile`);
+      if (value.provider !== "codewith")
+        throw new Error(`${label}.authProfile is currently supported only for provider codewith`);
+    }
     return value;
   }
   throw new Error(`${label}.type must be command or agent`);
@@ -1305,10 +1310,11 @@ class Store {
 }
 
 // src/cli/index.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
 import { Command } from "commander";
 
 // src/lib/format.ts
+var TEXT_OUTPUT_LIMIT = 32 * 1024;
 function redact(value, visible = 80) {
   if (!value)
     return value;
@@ -1316,6 +1322,29 @@ function redact(value, visible = 80) {
     return value;
   return `${value.slice(0, visible)}... [redacted ${value.length - visible} chars]`;
 }
+function truncateTextOutput(value) {
+  if (value.length <= TEXT_OUTPUT_LIMIT)
+    return value;
+  return `${value.slice(0, TEXT_OUTPUT_LIMIT)}
+[truncated ${value.length - TEXT_OUTPUT_LIMIT} chars]`;
+}
+function textOutputBlocks(value, opts = {}) {
+  const indent = opts.indent ?? "";
+  const nested = `${indent}  `;
+  const blocks = [];
+  for (const [label, output] of [
+    ["stdout", value.stdout],
+    ["stderr", value.stderr]
+  ]) {
+    if (!output)
+      continue;
+    blocks.push(`${indent}${label}:`);
+    for (const line of truncateTextOutput(output).replace(/\s+$/, "").split(/\r?\n/)) {
+      blocks.push(`${nested}${line}`);
+    }
+  }
+  return blocks;
+}
 function publicLoop(loop) {
   const target = loop.target.type === "command" ? { ...loop.target, env: loop.target.env ? "[redacted]" : undefined } : loop.target.type === "agent" ? { ...loop.target, prompt: redact(loop.target.prompt) } : loop.target;
   return {
@@ -1354,9 +1383,8 @@ function publicWorkflowEvent(event) {
 }
 
 // src/lib/executor.ts
-import { spawn, spawnSync as spawnSync2 } from "child_process";
+import { spawn } from "child_process";
 import { once } from "events";
-import { existsSync as existsSync2 } from "fs";
 
 // src/lib/accounts.ts
 import { spawnSync } from "child_process";
@@ -1454,6 +1482,65 @@ function resolveAccountEnv(account, toolHint, env) {
   };
 }
 
+// src/lib/env.ts
+import { accessSync, constants } from "fs";
+import { homedir as homedir2 } from "os";
+import { delimiter, join as join2 } from "path";
+function compactPathParts(parts) {
+  const seen = new Set;
+  const result = [];
+  for (const part of parts) {
+    const value = part?.trim();
+    if (!value || seen.has(value))
+      continue;
+    seen.add(value);
+    result.push(value);
+  }
+  return result;
+}
+function commonExecutableDirs(env = process.env) {
+  const home = env.HOME || homedir2();
+  return compactPathParts([
+    join2(home, ".local", "bin"),
+    join2(home, ".bun", "bin"),
+    join2(home, ".cargo", "bin"),
+    join2(home, ".npm-global", "bin"),
+    join2(home, "bin"),
+    env.BUN_INSTALL ? join2(env.BUN_INSTALL, "bin") : undefined,
+    env.PNPM_HOME,
+    env.NPM_CONFIG_PREFIX ? join2(env.NPM_CONFIG_PREFIX, "bin") : undefined,
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ]);
+}
+function normalizeExecutionPath(env = process.env) {
+  return compactPathParts([...(env.PATH ?? "").split(delimiter), ...commonExecutableDirs(env)]).join(delimiter);
+}
+function isExecutable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function executableExists(command, env = process.env) {
+  if (command.includes("/"))
+    return isExecutable(command);
+  for (const dir of (env.PATH ?? "").split(delimiter)) {
+    if (dir && isExecutable(join2(dir, command)))
+      return true;
+  }
+  return false;
+}
+function commandNotFoundMessage(command, env = process.env) {
+  return `Executable not found in PATH: ${command}. Effective PATH=${env.PATH || "(empty)"}`;
+}
+
 // src/lib/executor.ts
 var DEFAULT_TIMEOUT_MS = 30 * 60000;
 var DEFAULT_MAX_OUTPUT_BYTES = 256 * 1024;
@@ -1539,7 +1626,7 @@ function agentArgs(target) {
       args.push(...target.extraArgs ?? [], target.prompt);
       return args;
     case "codewith":
-      args.push("exec", "--json", "--ephemeral", "--ask-for-approval", "never", "--sandbox", "workspace-write");
+      args.push(...target.authProfile ? ["--auth-profile", target.authProfile] : [], "--ask-for-approval", "never", "exec", "--json", "--ephemeral", "--sandbox", "workspace-write", "--skip-git-repo-check");
       if (isolation === "safe")
         args.push("--ignore-rules");
       if (target.cwd)
@@ -1619,6 +1706,7 @@ function executionEnv(spec, metadata, opts) {
     Object.assign(env, accountEnv);
   }
   Object.assign(env, spec.env ?? {});
+  env.PATH = normalizeExecutionPath(env);
   if (metadata.loopId)
     env.LOOPS_LOOP_ID = metadata.loopId;
   if (metadata.loopName)
@@ -1637,20 +1725,11 @@ function executionEnv(spec, metadata, opts) {
     env.LOOPS_WORKFLOW_STEP_ID = metadata.workflowStepId;
   return env;
 }
-function commandExists(command, env) {
-  if (command.includes("/") && existsSync2(command))
-    return true;
-  const result = spawnSync2("sh", ["-c", 'command -v "$1" >/dev/null', "sh", command], {
-    env,
-    stdio: "ignore"
-  });
-  return (result.status ?? 1) === 0;
-}
 function preflightTarget(target, metadata = {}, opts = {}) {
   const spec = commandSpec(target);
   const env = executionEnv(spec, metadata, opts);
-  if (!spec.shell && !commandExists(spec.command, env)) {
-    throw new Error(`Executable not found in PATH: ${spec.command}`);
+  if (!spec.shell && !executableExists(spec.command, env)) {
+    throw new Error(commandNotFoundMessage(spec.command, env));
   }
   return {
     command: spec.command,
@@ -1668,12 +1747,12 @@ async function executeTarget(target, metadata = {}, opts = {}) {
   let exitCode;
   let error;
   const env = executionEnv(spec, metadata, opts);
-  if (!spec.shell && !commandExists(spec.command, env)) {
+  if (!spec.shell && !executableExists(spec.command, env)) {
     return {
       status: "failed",
       stdout: "",
       stderr: "",
-      error: `Executable not found in PATH: ${spec.command}`,
+      error: commandNotFoundMessage(spec.command, env),
       startedAt,
       finishedAt: nowIso(),
       durationMs: 0
@@ -2112,7 +2191,7 @@ async function tick(deps) {
 }
 
 // src/daemon/control.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync, rmSync, writeFileSync } from "fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync, rmSync, writeFileSync } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2 } from "path";
 
@@ -2140,7 +2219,7 @@ async function runLoop(opts) {
 
 // src/daemon/control.ts
 function readPid(path = pidFilePath()) {
-  if (!existsSync3(path))
+  if (!existsSync2(path))
     return;
   try {
     const pid = Number(readFileSync(path, "utf8").trim());
@@ -2376,10 +2455,11 @@ async function startDaemon(opts) {
 
 // src/daemon/install.ts
 import { chmodSync, mkdirSync as mkdirSync4, writeFileSync as writeFileSync2 } from "fs";
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 import { dirname as dirname3 } from "path";
 function installStartup(cliEntry, execPath = process.execPath, args = ["daemon", "run"]) {
   const command = [execPath, cliEntry, ...args].join(" ");
+  const pathEnv = normalizeExecutionPath(process.env);
   if (process.platform === "linux") {
     const path = systemdServicePath();
     mkdirSync4(dirname3(path), { recursive: true, mode: 448 });
@@ -2392,7 +2472,7 @@ Type=simple
 ExecStart=${command}
 Restart=always
 RestartSec=5
-Environment=PATH=${process.env.PATH ?? ""}
+Environment=PATH=${pathEnv}
 
 [Install]
 WantedBy=default.target
@@ -2424,6 +2504,10 @@ ${args.map((arg) => `    <string>${arg}</string>`).join(`
   </array>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key><string>${pathEnv}</string>
+  </dict>
   <key>StandardOutPath</key><string>${daemonLogPath()}</string>
   <key>StandardErrorPath</key><string>${daemonLogPath()}</string>
 </dict>
@@ -2441,7 +2525,7 @@ ${args.map((arg) => `    <string>${arg}</string>`).join(`
 function enableStartup(result) {
   const commands = result.platform === "linux" ? ["systemctl --user daemon-reload", "systemctl --user enable --now loops-daemon.service"] : result.platform === "darwin" ? [`launchctl load -w ${result.path}`] : [];
   return commands.map((command) => {
-    const run = spawnSync3("sh", ["-c", command], {
+    const run = spawnSync2("sh", ["-c", command], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -2455,8 +2539,8 @@ function enableStartup(result) {
 }
 
 // src/lib/doctor.ts
-import { spawnSync as spawnSync4 } from "child_process";
-import { accessSync, constants } from "fs";
+import { spawnSync as spawnSync3 } from "child_process";
+import { accessSync as accessSync2, constants as constants2 } from "fs";
 var PROVIDER_COMMANDS = [
   "claude",
   "cursor-agent",
@@ -2466,11 +2550,11 @@ var PROVIDER_COMMANDS = [
   "codex"
 ];
 function hasCommand(command) {
-  const result = spawnSync4("sh", ["-c", 'command -v "$1" >/dev/null', "sh", command], { stdio: "ignore" });
+  const result = spawnSync3("sh", ["-c", 'command -v "$1" >/dev/null', "sh", command], { stdio: "ignore" });
   return (result.status ?? 1) === 0;
 }
 function commandVersion(command) {
-  const result = spawnSync4(command, ["--version"], {
+  const result = spawnSync3(command, ["--version"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -2482,7 +2566,7 @@ function runDoctor(store) {
   const checks = [];
   try {
     const dir = ensureDataDir();
-    accessSync(dir, constants.R_OK | constants.W_OK);
+    accessSync2(dir, constants2.R_OK | constants2.W_OK);
     checks.push({ id: "data-dir", status: "ok", message: "data directory is writable", detail: dir });
   } catch (error) {
     checks.push({
@@ -2531,7 +2615,7 @@ function runDoctor(store) {
 
 // src/cli/index.ts
 var program = new Command;
-program.name("loops").description("Persistent local loops for commands and headless coding agents").version("0.3.0");
+program.name("loops").description("Persistent local loops for commands and headless coding agents").version("0.3.2");
 program.option("-j, --json", "print JSON");
 function isJson() {
   return Boolean(program.opts().json);
@@ -2542,6 +2626,10 @@ function print(value, human) {
   else
     console.log(human);
 }
+function printTextOutput(value) {
+  for (const line of textOutputBlocks(value, { indent: "  " }))
+    console.log(line);
+}
 function parseSchedule(opts) {
   const count = [opts.at, opts.every, opts.cron, opts.dynamic ? "dynamic" : undefined].filter(Boolean).length;
   if (count !== 1)
@@ -2621,6 +2709,13 @@ function accountFromOpts(opts) {
     throw new Error("--account-tool requires --account");
   return opts.account ? { profile: opts.account, tool: opts.accountTool } : undefined;
 }
+function providerAuthProfileFromOpts(opts, provider) {
+  if (!opts.authProfile)
+    return;
+  if (provider !== "codewith")
+    throw new Error("--auth-profile is currently supported only for --provider codewith");
+  return opts.authProfile;
+}
 var create = program.command("create").description("create loops");
 addAccountOptions(addScheduleOptions(create.command("command <name>").description("create a deterministic shell command loop").requiredOption("--cmd <command>", "command string to execute").option("--cwd <dir>", "working directory").option("--timeout <duration>", "run timeout").option("--no-shell", "execute without a shell"))).action((name, opts) => {
   const store = new Store;
@@ -2639,7 +2734,7 @@ addAccountOptions(addScheduleOptions(create.command("command <name>").descriptio
     store.close();
   }
 });
-addAccountOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").requiredOption("--prompt <prompt>", "agent prompt").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--agent <agent>", "provider-specific agent").option("--timeout <duration>", "run timeout").option("--config-isolation <mode>", "safe or none", "safe"))).action((name, opts) => {
+addAccountOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").requiredOption("--prompt <prompt>", "agent prompt").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--agent <agent>", "provider-specific agent").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--timeout <duration>", "run timeout").option("--config-isolation <mode>", "safe or none", "safe"))).action((name, opts) => {
   const provider = opts.provider;
   if (!["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"].includes(provider)) {
     throw new Error("unsupported provider");
@@ -2656,6 +2751,7 @@ addAccountOptions(addScheduleOptions(create.command("agent <name>").description(
       cwd: opts.cwd,
       model: opts.model,
       agent: opts.agent,
+      authProfile: providerAuthProfileFromOpts(opts, provider),
       timeoutMs: opts.timeout ? parseDuration(opts.timeout) : undefined,
       configIsolation: opts.configIsolation,
       account: accountFromOpts(opts)
@@ -2772,6 +2868,8 @@ workflows.command("run <idOrName>").option("--show-output", "show step stdout/st
       console.log(`${run?.id ?? workflow.id} ${result.status}`);
       for (const step of steps) {
         console.log(`  ${String(step.sequence).padStart(2, "0")}  ${step.status.padEnd(10)}  ${step.stepId}  ${step.error ?? ""}`);
+        if (opts.showOutput)
+          printTextOutput(step);
       }
     }
   } finally {
@@ -2872,6 +2970,8 @@ program.command("runs [idOrName]").option("--limit <n>", "limit", "50").option("
     else {
       for (const run of runs) {
         console.log(`${run.id}  ${run.status.padEnd(10)}  attempt=${run.attempt}  slot=${run.scheduledFor}  ${run.loopName}`);
+        if (opts.showOutput)
+          printTextOutput(run);
       }
     }
   } finally {
@@ -2916,6 +3016,10 @@ program.command("run-now <idOrName>").option("--show-output", "show stdout/stder
       advanceLoop(store, claim.loop, run, new Date(run.finishedAt ?? new Date), run.status === "succeeded");
     }
     print(publicRun(run, opts.showOutput), `${run.id} ${run.status}`);
+    if (!isJson() && opts.showOutput)
+      printTextOutput(run);
+    if (run.status !== "succeeded")
+      process.exitCode = 1;
   } finally {
     store.close();
   }
@@ -2978,7 +3082,7 @@ ${result.instructions.join(`
 });
 daemon.command("logs").option("-n, --lines <n>", "lines", "80").action((opts) => {
   const path = daemonLogPath();
-  if (!existsSync4(path)) {
+  if (!existsSync3(path)) {
     console.log("");
     return;
   }

package/dist/daemon/index.js

@@ -260,6 +260,11 @@ function validateTarget(value, label) {
     const providers = ["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"];
     if (!providers.includes(value.provider))
       throw new Error(`${label}.provider must be one of ${providers.join(", ")}`);
+    if (value.authProfile !== undefined) {
+      assertString(value.authProfile, `${label}.authProfile`);
+      if (value.provider !== "codewith")
+        throw new Error(`${label}.authProfile is currently supported only for provider codewith`);
+    }
     return value;
   }
   throw new Error(`${label}.type must be command or agent`);
@@ -1313,9 +1318,8 @@ import { hostname as hostname2 } from "os";
 import { spawn as spawn2 } from "child_process";
 
 // src/lib/executor.ts
-import { spawn, spawnSync as spawnSync2 } from "child_process";
+import { spawn } from "child_process";
 import { once } from "events";
-import { existsSync as existsSync2 } from "fs";
 
 // src/lib/accounts.ts
 import { spawnSync } from "child_process";
@@ -1413,6 +1417,65 @@ function resolveAccountEnv(account, toolHint, env) {
   };
 }
 
+// src/lib/env.ts
+import { accessSync, constants } from "fs";
+import { homedir as homedir2 } from "os";
+import { delimiter, join as join2 } from "path";
+function compactPathParts(parts) {
+  const seen = new Set;
+  const result = [];
+  for (const part of parts) {
+    const value = part?.trim();
+    if (!value || seen.has(value))
+      continue;
+    seen.add(value);
+    result.push(value);
+  }
+  return result;
+}
+function commonExecutableDirs(env = process.env) {
+  const home = env.HOME || homedir2();
+  return compactPathParts([
+    join2(home, ".local", "bin"),
+    join2(home, ".bun", "bin"),
+    join2(home, ".cargo", "bin"),
+    join2(home, ".npm-global", "bin"),
+    join2(home, "bin"),
+    env.BUN_INSTALL ? join2(env.BUN_INSTALL, "bin") : undefined,
+    env.PNPM_HOME,
+    env.NPM_CONFIG_PREFIX ? join2(env.NPM_CONFIG_PREFIX, "bin") : undefined,
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ]);
+}
+function normalizeExecutionPath(env = process.env) {
+  return compactPathParts([...(env.PATH ?? "").split(delimiter), ...commonExecutableDirs(env)]).join(delimiter);
+}
+function isExecutable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function executableExists(command, env = process.env) {
+  if (command.includes("/"))
+    return isExecutable(command);
+  for (const dir of (env.PATH ?? "").split(delimiter)) {
+    if (dir && isExecutable(join2(dir, command)))
+      return true;
+  }
+  return false;
+}
+function commandNotFoundMessage(command, env = process.env) {
+  return `Executable not found in PATH: ${command}. Effective PATH=${env.PATH || "(empty)"}`;
+}
+
 // src/lib/executor.ts
 var DEFAULT_TIMEOUT_MS = 30 * 60000;
 var DEFAULT_MAX_OUTPUT_BYTES = 256 * 1024;
@@ -1498,7 +1561,7 @@ function agentArgs(target) {
       args.push(...target.extraArgs ?? [], target.prompt);
       return args;
     case "codewith":
-      args.push("exec", "--json", "--ephemeral", "--ask-for-approval", "never", "--sandbox", "workspace-write");
+      args.push(...target.authProfile ? ["--auth-profile", target.authProfile] : [], "--ask-for-approval", "never", "exec", "--json", "--ephemeral", "--sandbox", "workspace-write", "--skip-git-repo-check");
       if (isolation === "safe")
         args.push("--ignore-rules");
       if (target.cwd)
@@ -1578,6 +1641,7 @@ function executionEnv(spec, metadata, opts) {
     Object.assign(env, accountEnv);
   }
   Object.assign(env, spec.env ?? {});
+  env.PATH = normalizeExecutionPath(env);
   if (metadata.loopId)
     env.LOOPS_LOOP_ID = metadata.loopId;
   if (metadata.loopName)
@@ -1596,20 +1660,11 @@ function executionEnv(spec, metadata, opts) {
     env.LOOPS_WORKFLOW_STEP_ID = metadata.workflowStepId;
   return env;
 }
-function commandExists(command, env) {
-  if (command.includes("/") && existsSync2(command))
-    return true;
-  const result = spawnSync2("sh", ["-c", 'command -v "$1" >/dev/null', "sh", command], {
-    env,
-    stdio: "ignore"
-  });
-  return (result.status ?? 1) === 0;
-}
 function preflightTarget(target, metadata = {}, opts = {}) {
   const spec = commandSpec(target);
   const env = executionEnv(spec, metadata, opts);
-  if (!spec.shell && !commandExists(spec.command, env)) {
-    throw new Error(`Executable not found in PATH: ${spec.command}`);
+  if (!spec.shell && !executableExists(spec.command, env)) {
+    throw new Error(commandNotFoundMessage(spec.command, env));
   }
   return {
     command: spec.command,
@@ -1627,12 +1682,12 @@ async function executeTarget(target, metadata = {}, opts = {}) {
   let exitCode;
   let error;
   const env = executionEnv(spec, metadata, opts);
-  if (!spec.shell && !commandExists(spec.command, env)) {
+  if (!spec.shell && !executableExists(spec.command, env)) {
     return {
       status: "failed",
       stdout: "",
       stderr: "",
-      error: `Executable not found in PATH: ${spec.command}`,
+      error: commandNotFoundMessage(spec.command, env),
       startedAt,
       finishedAt: nowIso(),
       durationMs: 0
@@ -2071,7 +2126,7 @@ async function tick(deps) {
 }
 
 // src/daemon/control.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync, rmSync, writeFileSync } from "fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync, rmSync, writeFileSync } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2 } from "path";
 
@@ -2099,7 +2154,7 @@ async function runLoop(opts) {
 
 // src/daemon/control.ts
 function readPid(path = pidFilePath()) {
-  if (!existsSync3(path))
+  if (!existsSync2(path))
     return;
   try {
     const pid = Number(readFileSync(path, "utf8").trim());
@@ -2332,10 +2387,11 @@ async function startDaemon(opts) {
 
 // src/daemon/install.ts
 import { chmodSync, mkdirSync as mkdirSync4, writeFileSync as writeFileSync2 } from "fs";
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 import { dirname as dirname3 } from "path";
 function installStartup(cliEntry, execPath = process.execPath, args = ["daemon", "run"]) {
   const command = [execPath, cliEntry, ...args].join(" ");
+  const pathEnv = normalizeExecutionPath(process.env);
   if (process.platform === "linux") {
     const path = systemdServicePath();
     mkdirSync4(dirname3(path), { recursive: true, mode: 448 });
@@ -2348,7 +2404,7 @@ Type=simple
 ExecStart=${command}
 Restart=always
 RestartSec=5
-Environment=PATH=${process.env.PATH ?? ""}
+Environment=PATH=${pathEnv}
 
 [Install]
 WantedBy=default.target
@@ -2380,6 +2436,10 @@ ${args.map((arg) => `    <string>${arg}</string>`).join(`
   </array>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key><string>${pathEnv}</string>
+  </dict>
   <key>StandardOutPath</key><string>${daemonLogPath()}</string>
   <key>StandardErrorPath</key><string>${daemonLogPath()}</string>
 </dict>
@@ -2397,7 +2457,7 @@ ${args.map((arg) => `    <string>${arg}</string>`).join(`
 function enableStartup(result) {
   const commands = result.platform === "linux" ? ["systemctl --user daemon-reload", "systemctl --user enable --now loops-daemon.service"] : result.platform === "darwin" ? [`launchctl load -w ${result.path}`] : [];
   return commands.map((command) => {
-    const run = spawnSync3("sh", ["-c", command], {
+    const run = spawnSync2("sh", ["-c", command], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -2412,7 +2472,7 @@ function enableStartup(result) {
 
 // src/daemon/index.ts
 var program = new Command;
-program.name("loops-daemon").description("OpenLoops daemon helper").version("0.3.0");
+program.name("loops-daemon").description("OpenLoops daemon helper").version("0.3.2");
 program.command("run").option("--interval-ms <ms>", "tick interval", (value) => Number(value)).action(async (opts) => runDaemon({ intervalMs: opts.intervalMs }));
 program.command("start").action(async () => {
   const result = await startDaemon({ cliEntry: process.argv[1] ?? "loops-daemon", args: ["run"] });

package/dist/index.js

@@ -258,6 +258,11 @@ function validateTarget(value, label) {
     const providers = ["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"];
     if (!providers.includes(value.provider))
       throw new Error(`${label}.provider must be one of ${providers.join(", ")}`);
+    if (value.authProfile !== undefined) {
+      assertString(value.authProfile, `${label}.authProfile`);
+      if (value.provider !== "codewith")
+        throw new Error(`${label}.authProfile is currently supported only for provider codewith`);
+    }
     return value;
   }
   throw new Error(`${label}.type must be command or agent`);
@@ -1303,9 +1308,8 @@ class Store {
 }
 
 // src/lib/executor.ts
-import { spawn, spawnSync as spawnSync2 } from "child_process";
+import { spawn } from "child_process";
 import { once } from "events";
-import { existsSync as existsSync2 } from "fs";
 
 // src/lib/accounts.ts
 import { spawnSync } from "child_process";
@@ -1403,6 +1407,65 @@ function resolveAccountEnv(account, toolHint, env) {
   };
 }
 
+// src/lib/env.ts
+import { accessSync, constants } from "fs";
+import { homedir as homedir2 } from "os";
+import { delimiter, join as join2 } from "path";
+function compactPathParts(parts) {
+  const seen = new Set;
+  const result = [];
+  for (const part of parts) {
+    const value = part?.trim();
+    if (!value || seen.has(value))
+      continue;
+    seen.add(value);
+    result.push(value);
+  }
+  return result;
+}
+function commonExecutableDirs(env = process.env) {
+  const home = env.HOME || homedir2();
+  return compactPathParts([
+    join2(home, ".local", "bin"),
+    join2(home, ".bun", "bin"),
+    join2(home, ".cargo", "bin"),
+    join2(home, ".npm-global", "bin"),
+    join2(home, "bin"),
+    env.BUN_INSTALL ? join2(env.BUN_INSTALL, "bin") : undefined,
+    env.PNPM_HOME,
+    env.NPM_CONFIG_PREFIX ? join2(env.NPM_CONFIG_PREFIX, "bin") : undefined,
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ]);
+}
+function normalizeExecutionPath(env = process.env) {
+  return compactPathParts([...(env.PATH ?? "").split(delimiter), ...commonExecutableDirs(env)]).join(delimiter);
+}
+function isExecutable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function executableExists(command, env = process.env) {
+  if (command.includes("/"))
+    return isExecutable(command);
+  for (const dir of (env.PATH ?? "").split(delimiter)) {
+    if (dir && isExecutable(join2(dir, command)))
+      return true;
+  }
+  return false;
+}
+function commandNotFoundMessage(command, env = process.env) {
+  return `Executable not found in PATH: ${command}. Effective PATH=${env.PATH || "(empty)"}`;
+}
+
 // src/lib/executor.ts
 var DEFAULT_TIMEOUT_MS = 30 * 60000;
 var DEFAULT_MAX_OUTPUT_BYTES = 256 * 1024;
@@ -1488,7 +1551,7 @@ function agentArgs(target) {
       args.push(...target.extraArgs ?? [], target.prompt);
       return args;
     case "codewith":
-      args.push("exec", "--json", "--ephemeral", "--ask-for-approval", "never", "--sandbox", "workspace-write");
+      args.push(...target.authProfile ? ["--auth-profile", target.authProfile] : [], "--ask-for-approval", "never", "exec", "--json", "--ephemeral", "--sandbox", "workspace-write", "--skip-git-repo-check");
       if (isolation === "safe")
         args.push("--ignore-rules");
       if (target.cwd)
@@ -1568,6 +1631,7 @@ function executionEnv(spec, metadata, opts) {
     Object.assign(env, accountEnv);
   }
   Object.assign(env, spec.env ?? {});
+  env.PATH = normalizeExecutionPath(env);
   if (metadata.loopId)
     env.LOOPS_LOOP_ID = metadata.loopId;
   if (metadata.loopName)
@@ -1586,20 +1650,11 @@ function executionEnv(spec, metadata, opts) {
     env.LOOPS_WORKFLOW_STEP_ID = metadata.workflowStepId;
   return env;
 }
-function commandExists(command, env) {
-  if (command.includes("/") && existsSync2(command))
-    return true;
-  const result = spawnSync2("sh", ["-c", 'command -v "$1" >/dev/null', "sh", command], {
-    env,
-    stdio: "ignore"
-  });
-  return (result.status ?? 1) === 0;
-}
 function preflightTarget(target, metadata = {}, opts = {}) {
   const spec = commandSpec(target);
   const env = executionEnv(spec, metadata, opts);
-  if (!spec.shell && !commandExists(spec.command, env)) {
-    throw new Error(`Executable not found in PATH: ${spec.command}`);
+  if (!spec.shell && !executableExists(spec.command, env)) {
+    throw new Error(commandNotFoundMessage(spec.command, env));
   }
   return {
     command: spec.command,
@@ -1617,12 +1672,12 @@ async function executeTarget(target, metadata = {}, opts = {}) {
   let exitCode;
   let error;
   const env = executionEnv(spec, metadata, opts);
-  if (!spec.shell && !commandExists(spec.command, env)) {
+  if (!spec.shell && !executableExists(spec.command, env)) {
     return {
       status: "failed",
       stdout: "",
       stderr: "",
-      error: `Executable not found in PATH: ${spec.command}`,
+      error: commandNotFoundMessage(spec.command, env),
       startedAt,
       finishedAt: nowIso(),
       durationMs: 0
@@ -2123,11 +2178,11 @@ function loops(opts = {}) {
   return new LoopsClient(opts);
 }
 // src/lib/doctor.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { accessSync, constants } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { accessSync as accessSync2, constants as constants2 } from "fs";
 
 // src/daemon/control.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync, rmSync, writeFileSync } from "fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync, rmSync, writeFileSync } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2 } from "path";
 
@@ -2155,7 +2210,7 @@ async function runLoop(opts) {
 
 // src/daemon/control.ts
 function readPid(path = pidFilePath()) {
-  if (!existsSync3(path))
+  if (!existsSync2(path))
     return;
   try {
     const pid = Number(readFileSync(path, "utf8").trim());
@@ -2261,11 +2316,11 @@ var PROVIDER_COMMANDS = [
   "codex"
 ];
 function hasCommand(command) {
-  const result = spawnSync3("sh", ["-c", 'command -v "$1" >/dev/null', "sh", command], { stdio: "ignore" });
+  const result = spawnSync2("sh", ["-c", 'command -v "$1" >/dev/null', "sh", command], { stdio: "ignore" });
   return (result.status ?? 1) === 0;
 }
 function commandVersion(command) {
-  const result = spawnSync3(command, ["--version"], {
+  const result = spawnSync2(command, ["--version"], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -2277,7 +2332,7 @@ function runDoctor(store) {
   const checks = [];
   try {
     const dir = ensureDataDir();
-    accessSync(dir, constants.R_OK | constants.W_OK);
+    accessSync2(dir, constants2.R_OK | constants2.W_OK);
     checks.push({ id: "data-dir", status: "ok", message: "data directory is writable", detail: dir });
   } catch (error) {
     checks.push({

package/dist/lib/env.d.ts

@@ -0,0 +1,4 @@
+export declare function commonExecutableDirs(env?: NodeJS.ProcessEnv): string[];
+export declare function normalizeExecutionPath(env?: NodeJS.ProcessEnv): string;
+export declare function executableExists(command: string, env?: NodeJS.ProcessEnv): boolean;
+export declare function commandNotFoundMessage(command: string, env?: NodeJS.ProcessEnv): string;

package/dist/lib/format.d.ts

@@ -1,5 +1,8 @@
 import type { Loop, LoopRun, WorkflowEvent, WorkflowRun, WorkflowSpec, WorkflowStepRun } from "../types.js";
 export declare function redact(value: string | undefined, visible?: number): string | undefined;
+export declare function textOutputBlocks(value: Pick<LoopRun | WorkflowStepRun, "stdout" | "stderr">, opts?: {
+    indent?: string;
+}): string[];
 export declare function publicLoop(loop: Loop): Record<string, unknown>;
 export declare function publicRun(run: LoopRun, showOutput?: boolean): Record<string, unknown>;
 export declare function publicWorkflow(workflow: WorkflowSpec): Record<string, unknown>;

package/dist/lib/store.js

@@ -258,6 +258,11 @@ function validateTarget(value, label) {
     const providers = ["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"];
     if (!providers.includes(value.provider))
       throw new Error(`${label}.provider must be one of ${providers.join(", ")}`);
+    if (value.authProfile !== undefined) {
+      assertString(value.authProfile, `${label}.authProfile`);
+      if (value.provider !== "codewith")
+        throw new Error(`${label}.authProfile is currently supported only for provider codewith`);
+    }
     return value;
   }
   throw new Error(`${label}.type must be command or agent`);

package/dist/sdk/index.js

@@ -258,6 +258,11 @@ function validateTarget(value, label) {
     const providers = ["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"];
     if (!providers.includes(value.provider))
       throw new Error(`${label}.provider must be one of ${providers.join(", ")}`);
+    if (value.authProfile !== undefined) {
+      assertString(value.authProfile, `${label}.authProfile`);
+      if (value.provider !== "codewith")
+        throw new Error(`${label}.authProfile is currently supported only for provider codewith`);
+    }
     return value;
   }
   throw new Error(`${label}.type must be command or agent`);
@@ -1303,9 +1308,8 @@ class Store {
 }
 
 // src/lib/executor.ts
-import { spawn, spawnSync as spawnSync2 } from "child_process";
+import { spawn } from "child_process";
 import { once } from "events";
-import { existsSync as existsSync2 } from "fs";
 
 // src/lib/accounts.ts
 import { spawnSync } from "child_process";
@@ -1403,6 +1407,65 @@ function resolveAccountEnv(account, toolHint, env) {
   };
 }
 
+// src/lib/env.ts
+import { accessSync, constants } from "fs";
+import { homedir as homedir2 } from "os";
+import { delimiter, join as join2 } from "path";
+function compactPathParts(parts) {
+  const seen = new Set;
+  const result = [];
+  for (const part of parts) {
+    const value = part?.trim();
+    if (!value || seen.has(value))
+      continue;
+    seen.add(value);
+    result.push(value);
+  }
+  return result;
+}
+function commonExecutableDirs(env = process.env) {
+  const home = env.HOME || homedir2();
+  return compactPathParts([
+    join2(home, ".local", "bin"),
+    join2(home, ".bun", "bin"),
+    join2(home, ".cargo", "bin"),
+    join2(home, ".npm-global", "bin"),
+    join2(home, "bin"),
+    env.BUN_INSTALL ? join2(env.BUN_INSTALL, "bin") : undefined,
+    env.PNPM_HOME,
+    env.NPM_CONFIG_PREFIX ? join2(env.NPM_CONFIG_PREFIX, "bin") : undefined,
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ]);
+}
+function normalizeExecutionPath(env = process.env) {
+  return compactPathParts([...(env.PATH ?? "").split(delimiter), ...commonExecutableDirs(env)]).join(delimiter);
+}
+function isExecutable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function executableExists(command, env = process.env) {
+  if (command.includes("/"))
+    return isExecutable(command);
+  for (const dir of (env.PATH ?? "").split(delimiter)) {
+    if (dir && isExecutable(join2(dir, command)))
+      return true;
+  }
+  return false;
+}
+function commandNotFoundMessage(command, env = process.env) {
+  return `Executable not found in PATH: ${command}. Effective PATH=${env.PATH || "(empty)"}`;
+}
+
 // src/lib/executor.ts
 var DEFAULT_TIMEOUT_MS = 30 * 60000;
 var DEFAULT_MAX_OUTPUT_BYTES = 256 * 1024;
@@ -1488,7 +1551,7 @@ function agentArgs(target) {
       args.push(...target.extraArgs ?? [], target.prompt);
       return args;
     case "codewith":
-      args.push("exec", "--json", "--ephemeral", "--ask-for-approval", "never", "--sandbox", "workspace-write");
+      args.push(...target.authProfile ? ["--auth-profile", target.authProfile] : [], "--ask-for-approval", "never", "exec", "--json", "--ephemeral", "--sandbox", "workspace-write", "--skip-git-repo-check");
       if (isolation === "safe")
         args.push("--ignore-rules");
       if (target.cwd)
@@ -1568,6 +1631,7 @@ function executionEnv(spec, metadata, opts) {
     Object.assign(env, accountEnv);
   }
   Object.assign(env, spec.env ?? {});
+  env.PATH = normalizeExecutionPath(env);
   if (metadata.loopId)
     env.LOOPS_LOOP_ID = metadata.loopId;
   if (metadata.loopName)
@@ -1586,20 +1650,11 @@ function executionEnv(spec, metadata, opts) {
     env.LOOPS_WORKFLOW_STEP_ID = metadata.workflowStepId;
   return env;
 }
-function commandExists(command, env) {
-  if (command.includes("/") && existsSync2(command))
-    return true;
-  const result = spawnSync2("sh", ["-c", 'command -v "$1" >/dev/null', "sh", command], {
-    env,
-    stdio: "ignore"
-  });
-  return (result.status ?? 1) === 0;
-}
 function preflightTarget(target, metadata = {}, opts = {}) {
   const spec = commandSpec(target);
   const env = executionEnv(spec, metadata, opts);
-  if (!spec.shell && !commandExists(spec.command, env)) {
-    throw new Error(`Executable not found in PATH: ${spec.command}`);
+  if (!spec.shell && !executableExists(spec.command, env)) {
+    throw new Error(commandNotFoundMessage(spec.command, env));
   }
   return {
     command: spec.command,
@@ -1617,12 +1672,12 @@ async function executeTarget(target, metadata = {}, opts = {}) {
   let exitCode;
   let error;
   const env = executionEnv(spec, metadata, opts);
-  if (!spec.shell && !commandExists(spec.command, env)) {
+  if (!spec.shell && !executableExists(spec.command, env)) {
     return {
       status: "failed",
       stdout: "",
       stderr: "",
-      error: `Executable not found in PATH: ${spec.command}`,
+      error: commandNotFoundMessage(spec.command, env),
       startedAt,
       finishedAt: nowIso(),
       durationMs: 0

package/dist/types.d.ts

@@ -44,6 +44,7 @@ export interface AgentTarget {
     cwd?: string;
     model?: string;
     agent?: string;
+    authProfile?: string;
     extraArgs?: string[];
     timeoutMs?: number;
     configIsolation?: AgentConfigIsolation;

package/docs/USAGE.md

@@ -76,6 +76,17 @@ loops create agent supply-chain-watch \
   --prompt "Check for suspicious dependency or supply-chain changes. Report only concrete findings."
 ```
 
+Run a Codewith loop with a Codewith-native auth profile:
+
+```bash
+loops create agent supply-chain-watch \
+  --provider codewith \
+  --auth-profile account001 \
+  --every 15m \
+  --cwd /path/to/repo \
+  --prompt "Check for suspicious dependency or supply-chain changes. Report only concrete findings."
+```
+
 For `codewith` and `aicopilot` account isolation, register matching OpenAccounts tools first if they are not built in on the machine:
 
 ```bash
@@ -157,7 +168,7 @@ loops remove <id-or-name>
 loops run-now <id-or-name>
 ```
 
-Use `--json` for machine-readable output. Prompt bodies and run stdout/stderr are redacted by default in status output.
+Use `--json` for machine-readable output. Prompt bodies and run stdout/stderr are redacted by default in status output. `loops run-now` exits non-zero when the recorded run fails or times out.
 
 ## Daemon
 
@@ -203,10 +214,12 @@ On Linux this writes a user systemd service. On macOS it writes a LaunchAgent pl
 The adapters intentionally use provider command surfaces instead of pretending every agent has one SDK:
 
 - Claude uses `claude -p --output-format json` and safe-mode/local setting sources by default.
-- Codewith uses `codewith exec --json --ephemeral --ask-for-approval never`.
+- Codewith uses `codewith --ask-for-approval never exec --json --ephemeral --skip-git-repo-check`.
 - AI Copilot and OpenCode use `run --format json --pure`.
 - Cursor is CLI-first for now via `cursor-agent -p`; treat output as less stable until a stronger public SDK contract is selected.
 - Codex uses `codex exec --json --ephemeral --ask-for-approval never`.
 - When `--account` or a step `account` is set, OpenLoops resolves `accounts env <profile> --tool <tool>` before spawning the target, strips inherited tool home/API-key variables, and applies the selected profile only to that process. Missing account profiles fail before the provider binary receives the prompt.
+- `--auth-profile` and step `authProfile` are provider-native auth selectors. They currently apply to Codewith and are passed to Codewith as `--auth-profile <name>` before `exec`; they do not call OpenAccounts.
+- Daemon and scheduled runs prepend common user executable directories such as `~/.local/bin` and `~/.bun/bin` before resolving provider CLIs.
 
 For production loops that can mutate repos, prefer disposable worktrees and explicit prompts that name allowed write scope.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/loops",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   "type": "module",
   "main": "dist/index.js",