@hasna/loops 0.3.16 → 0.3.17

package/README.md

@@ -210,7 +210,8 @@ Use `shell: true` only when you intentionally want shell parsing:
 Built-in templates turn common orchestration flows into reusable workflow JSON.
 `todos-task-worker-verifier` performs one todos task and then verifies it.
 `event-worker-verifier` handles any Hasna event envelope and then verifies the
-handling.
+handling. `bounded-agent-worker-verifier` is for recurring bounded agent work:
+one worker runs a narrow objective, then a fresh verifier audits the result.
 
 ```bash
 loops templates list
@@ -230,6 +231,12 @@ loops templates render event-worker-verifier \
   --var eventSource=knowledge \
   --var eventJson='{"id":"<event-id>"}' \
   --var projectPath=/path/to/repo
+loops templates render bounded-agent-worker-verifier \
+  --var objective="Check docs drift and queue tasks for gaps" \
+  --var projectPath=/path/to/repo \
+  --var provider=codewith \
+  --var authProfilePool=account004,account005 \
+  --var sandbox=danger-full-access
 ```
 
 For event-driven task automation, `loops events handle todos-task` reads a
@@ -293,6 +300,28 @@ loops run-now <id-or-name>
 
 Use `--json` for machine-readable output. Prompt bodies and run stdout/stderr are redacted by default in status output. `loops run-now` exits non-zero when the recorded run fails or times out.
 
+## Health And Hygiene
+
+```bash
+loops health --json
+loops expectations <loop-id-or-name> --json
+loops health route-tasks --project ~/.hasna/loops --task-list loop-error-self-heal --max-actions 5
+loops hygiene names --json
+loops hygiene duplicates --json
+loops hygiene scripts --json
+```
+
+`health` and `expectations` classify latest-run failures with stable
+fingerprints and bounded evidence. `health route-tasks` is the explicit
+mutating path: it upserts deduped Todos tasks for failed expectations and marks
+them with `no_tmux_dispatch=true` metadata. Use `--dry-run --json` before
+turning it into a production loop.
+
+`hygiene names` reports canonical `machine-*` or `repo-<name>-*` loop names and
+renames only with `--apply`. `hygiene duplicates` groups loops with the same
+normalized name, cwd, and schedule. `hygiene scripts` inventories loops whose
+command still references `~/.hasna/loops/scripts`.
+
 Archive loops when retiring old automation but preserving history:
 
 ```bash

package/dist/cli/index.js

@@ -1052,6 +1052,30 @@ class Store {
       throw new Error(`loop not found after update: ${id}`);
     return after;
   }
+  renameLoop(id, name, opts = {}) {
+    const current = this.getLoop(id);
+    if (!current)
+      throw new Error(`loop not found: ${id}`);
+    const trimmed = name.trim();
+    if (!trimmed)
+      throw new Error("loop name must not be empty");
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.query(`UPDATE loops SET name=$name, updated_at=$updated
+         WHERE id=$id
+           AND ($daemonLeaseId IS NULL OR EXISTS (
+             SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+           ))`).run({
+      $id: id,
+      $name: trimmed,
+      $updated: updated,
+      $daemonLeaseId: opts.daemonLeaseId ?? null,
+      $now: updated
+    });
+    const after = this.getLoop(id);
+    if (!after)
+      throw new Error(`loop not found after rename: ${id}`);
+    return after;
+  }
   archiveLoop(idOrName) {
     const loop = this.requireLoop(idOrName);
     if (loop.archivedAt)
@@ -2173,6 +2197,7 @@ class Store {
 // src/cli/index.ts
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { spawnSync as spawnSync5 } from "child_process";
 import { Command } from "commander";
 
 // src/lib/format.ts
@@ -4821,10 +4846,224 @@ function buildHealthReport(store, opts = {}) {
     expectations
   };
 }
+
+// src/lib/hygiene.ts
+import { basename } from "path";
+var PROVIDER_TOKENS = new Set([
+  "codewith",
+  "claude",
+  "command",
+  "tmux",
+  "codex",
+  "cursor",
+  "opencode",
+  "aicopilot",
+  "agent"
+]);
+var REPO_GENERIC_TOKENS = new Set(["repo", "repoops"]);
+function slugify(value) {
+  return value.normalize("NFKD").replace(/[^\w\s.-]/g, "-").replace(/[_\s.:/]+/g, "-").replace(/[^a-zA-Z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").toLowerCase();
+}
+function repoSlugFromCwd(cwd) {
+  if (!cwd || cwd === process.env.HOME || cwd === "/home/hasna")
+    return "";
+  if (cwd.includes("/.hasna/loops/"))
+    return "";
+  return slugify(basename(cwd));
+}
+function scopeForLoop(loop) {
+  const cwd = loop.target.type === "command" || loop.target.type === "agent" ? loop.target.cwd : undefined;
+  const repoSlug = repoSlugFromCwd(cwd);
+  if (repoSlug)
+    return { scope: "repo", prefix: `repo-${repoSlug}`, scopeSlug: repoSlug };
+  return { scope: "machine", prefix: "machine", scopeSlug: "machine" };
+}
+function taskSlug(loop, scope) {
+  const oldName = loop.name;
+  let nameForParsing = oldName;
+  if (!oldName.includes(":")) {
+    const slug = slugify(oldName);
+    if (scope.scope === "machine" && slug.startsWith("machine-"))
+      nameForParsing = slug.slice("machine-".length);
+    else if (scope.scope === "repo" && slug.startsWith(`repo-${scope.scopeSlug}-`)) {
+      nameForParsing = slug.slice(`repo-${scope.scopeSlug}-`.length);
+    } else
+      nameForParsing = slug;
+  }
+  const parts = [];
+  for (const rawPart of oldName.includes(":") ? oldName.split(":") : [nameForParsing]) {
+    const part = slugify(rawPart);
+    if (!part)
+      continue;
+    if (PROVIDER_TOKENS.has(part) || /^account\d+$/.test(part))
+      continue;
+    if (scope.scope === "repo" && REPO_GENERIC_TOKENS.has(part))
+      continue;
+    let normalized = part;
+    if (scope.scope === "repo" && normalized === scope.scopeSlug)
+      continue;
+    if (scope.scope === "repo" && normalized.startsWith(`${scope.scopeSlug}-`)) {
+      normalized = normalized.slice(scope.scopeSlug.length + 1);
+    }
+    if (normalized)
+      parts.push(normalized);
+  }
+  const deduped = [];
+  for (const token of parts.join("-").split("-").filter(Boolean)) {
+    if (deduped[deduped.length - 1] !== token)
+      deduped.push(token);
+  }
+  return deduped.join("-") || "loop";
+}
+function canonicalName(loop) {
+  const scope = scopeForLoop(loop);
+  let name = `${scope.prefix}-${taskSlug(loop, scope)}`.replace(/-+/g, "-").replace(/^-|-$/g, "");
+  if (name.length > 120)
+    name = `${name.slice(0, 111).replace(/-+$/g, "")}-${loop.id.slice(0, 8)}`;
+  return {
+    id: loop.id,
+    status: loop.status,
+    scope: scope.scope,
+    scopeSlug: scope.scopeSlug,
+    newName: name
+  };
+}
+function ensureUnique(changes) {
+  const used = new Set;
+  for (const change of changes) {
+    let candidate = change.newName;
+    if (!used.has(candidate)) {
+      used.add(candidate);
+      change.newName = candidate;
+      change.changed = change.oldName !== candidate;
+      continue;
+    }
+    const base = candidate.slice(0, 111).replace(/-+$/g, "");
+    candidate = `${base}-${change.id.slice(0, 8)}`;
+    let suffix = 2;
+    while (used.has(candidate)) {
+      const extra = `-${change.id.slice(0, 6)}-${suffix++}`;
+      candidate = `${base.slice(0, 120 - extra.length)}${extra}`;
+    }
+    used.add(candidate);
+    change.newName = candidate;
+    change.changed = change.oldName !== candidate;
+  }
+}
+function managedLoops(store, opts) {
+  const loops = store.listLoops({ includeArchived: Boolean(opts.includeInactive), limit: opts.limit ?? 1000 });
+  if (opts.includeInactive)
+    return loops;
+  if (opts.includeStopped)
+    return loops.filter((loop) => loop.status !== "expired");
+  return loops.filter((loop) => loop.status === "active" || loop.status === "paused");
+}
+function buildNameHygieneReport(store, opts = {}) {
+  const changes = managedLoops(store, opts).map((loop) => {
+    const canonical = canonicalName(loop);
+    return {
+      ...canonical,
+      oldName: loop.name,
+      changed: loop.name !== canonical.newName
+    };
+  });
+  ensureUnique(changes);
+  const changed = changes.filter((change) => change.changed);
+  if (opts.apply) {
+    for (const change of changed)
+      store.renameLoop(change.id, change.newName);
+  }
+  return {
+    ok: changed.length === 0,
+    generatedAt: new Date().toISOString(),
+    applied: Boolean(opts.apply),
+    checked: changes.length,
+    changed: changed.length,
+    changes
+  };
+}
+function baseName(name) {
+  return name.replace(/-(bounded|compact|native)?-?low(?:-\d+m)?$/g, "").replace(/-\d+[mhd]$/g, "").replace(/-(bounded|compact)$/g, "");
+}
+function scheduleKey(schedule) {
+  if (schedule.type === "cron")
+    return `cron:${schedule.expression}`;
+  if (schedule.type === "interval")
+    return `interval:${schedule.everyMs}`;
+  if (schedule.type === "once")
+    return `once:${schedule.at}`;
+  return `dynamic:${schedule.minIntervalMs ?? ""}`;
+}
+function targetCwd(loop) {
+  return loop.target.type === "command" || loop.target.type === "agent" ? loop.target.cwd ?? "" : "";
+}
+function buildDuplicateOverlapReport(store, opts = {}) {
+  const loops = managedLoops(store, { includeInactive: opts.includeInactive, includeStopped: true, limit: opts.limit });
+  const groups = new Map;
+  for (const loop of loops) {
+    const base = baseName(loop.name);
+    const cwd = targetCwd(loop) || undefined;
+    const schedule = scheduleKey(loop.schedule);
+    const key = `${base}|${cwd ?? ""}|${schedule}`;
+    const existing = groups.get(key) ?? { baseName: base, cwd, schedule, loops: [] };
+    existing.loops.push(loop);
+    groups.set(key, existing);
+  }
+  const duplicateGroups = [...groups.entries()].filter(([, group]) => group.loops.length > 1).map(([key, group]) => ({
+    key,
+    baseName: group.baseName,
+    cwd: group.cwd,
+    schedule: group.schedule,
+    loops: group.loops.map((loop) => ({
+      id: loop.id,
+      name: loop.name,
+      status: loop.status,
+      nextRunAt: loop.nextRunAt
+    }))
+  }));
+  return {
+    ok: duplicateGroups.length === 0,
+    generatedAt: new Date().toISOString(),
+    checked: loops.length,
+    groups: duplicateGroups
+  };
+}
+function commandText(loop) {
+  if (loop.target.type !== "command")
+    return "";
+  return [loop.target.command, ...loop.target.args ?? []].join(" ");
+}
+function buildScriptInventoryReport(store, opts = {}) {
+  const scriptsDir = opts.scriptsDir ?? `${process.env.HOME ?? "/home/hasna"}/.hasna/loops/scripts`;
+  const loops = managedLoops(store, { includeInactive: opts.includeInactive, includeStopped: true, limit: opts.limit });
+  const scriptBacked = loops.map((loop) => {
+    const text = commandText(loop);
+    if (!text)
+      return;
+    const matches = [scriptsDir, "/.hasna/loops/scripts/"].filter((needle) => text.includes(needle));
+    if (!matches.length)
+      return;
+    return {
+      id: loop.id,
+      name: loop.name,
+      status: loop.status,
+      cwd: targetCwd(loop) || undefined,
+      command: text.length > 500 ? `${text.slice(0, 500)}...` : text,
+      scriptMatches: [...new Set(matches)]
+    };
+  }).filter((value) => Boolean(value));
+  return {
+    ok: scriptBacked.length === 0,
+    generatedAt: new Date().toISOString(),
+    checked: loops.length,
+    scriptBacked: scriptBacked.length,
+    loops: scriptBacked
+  };
+}
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.16",
+  version: "0.3.17",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -4915,6 +5154,7 @@ function packageVersion() {
 // src/lib/templates.ts
 var TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID = "todos-task-worker-verifier";
 var EVENT_WORKER_VERIFIER_TEMPLATE_ID = "event-worker-verifier";
+var BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID = "bounded-agent-worker-verifier";
 var TEMPLATE_SUMMARIES = [
   {
     id: TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID,
@@ -4959,6 +5199,28 @@ var TEMPLATE_SUMMARIES = [
       { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
       { name: "sandbox", default: "danger-full-access", description: "Provider sandbox mode." }
     ]
+  },
+  {
+    id: BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID,
+    name: "Bounded Agent Worker + Verifier",
+    description: "Create a bounded recurring-agent workflow: one agent performs a narrow objective, then a fresh verifier audits the result with separate account/profile selection.",
+    kind: "workflow",
+    variables: [
+      { name: "objective", required: true, description: "Narrow goal-mode objective for the worker." },
+      { name: "prompt", description: "Optional extra worker prompt details." },
+      { name: "projectPath", required: true, description: "Repository or project working directory." },
+      { name: "provider", default: "codewith", description: "Agent provider: codewith, claude, cursor, opencode, aicopilot, or codex." },
+      { name: "authProfile", description: "Provider-native auth profile, currently Codewith." },
+      { name: "authProfilePool", description: "Comma-separated provider-native auth profiles; worker/verifier are selected deterministically." },
+      { name: "workerAuthProfile", description: "Provider-native auth profile for the worker step." },
+      { name: "verifierAuthProfile", description: "Provider-native auth profile for the verifier step." },
+      { name: "accountPool", description: "Comma-separated OpenAccounts profiles; worker/verifier are selected deterministically." },
+      { name: "model", description: "Provider model." },
+      { name: "variant", description: "Provider reasoning/model effort variant." },
+      { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
+      { name: "sandbox", default: "danger-full-access", description: "Provider sandbox mode." },
+      { name: "timeoutMs", default: "2700000", description: "Step timeout in milliseconds." }
+    ]
   }
 ];
 function compactJson(value) {
@@ -5145,6 +5407,54 @@ function renderEventWorkerVerifierWorkflow(input) {
     ]
   };
 }
+function renderBoundedAgentWorkerVerifierWorkflow(input) {
+  if (!input.objective?.trim())
+    throw new Error("objective is required");
+  if (!input.projectPath?.trim())
+    throw new Error("projectPath is required");
+  const seed = `${input.projectPath}:${input.objective}`;
+  const timeoutMs = input.timeoutMs && Number.isFinite(input.timeoutMs) ? input.timeoutMs : 45 * 60000;
+  const workerPrompt = [
+    `/goal ${input.objective}`,
+    "",
+    "You are the worker step for a bounded OpenLoops agent workflow.",
+    "Investigate first. Keep scope narrow, use local project/task systems as the source of truth when relevant, preserve unrelated changes, run focused validation, and record concise evidence.",
+    "Do not dispatch or paste prompts into tmux panes. If additional work is required, create or update deduped todos tasks so task-created routing can start a fresh headless workflow.",
+    input.prompt ? "" : undefined,
+    input.prompt
+  ].filter(Boolean).join(`
+`);
+  const verifierPrompt = [
+    `/goal Adversarially verify: ${input.objective}`,
+    "",
+    "You are the verifier step for a bounded OpenLoops agent workflow.",
+    "Use fresh context. Review the worker result for correctness, regressions, missing tests, safety, runaway-agent risk, output bounds, and incomplete evidence.",
+    "If valid, record verification evidence. If invalid, create precise follow-up tasks or comments and leave the original work open. Do not make broad unrelated changes."
+  ].join(`
+`);
+  return {
+    name: input.name ?? `bounded-agent-${stableIndex(seed, 65535).toString(16)}-worker-verifier`,
+    description: `Bounded worker/verifier workflow for ${input.objective.slice(0, 180)}`,
+    version: 1,
+    steps: [
+      {
+        id: "worker",
+        name: "Worker",
+        description: "Execute the bounded objective and record evidence.",
+        target: agentTarget(input, workerPrompt, "worker", seed),
+        timeoutMs
+      },
+      {
+        id: "verifier",
+        name: "Verifier",
+        description: "Adversarially verify the bounded objective result.",
+        dependsOn: ["worker"],
+        target: agentTarget(input, verifierPrompt, "verifier", seed),
+        timeoutMs: Math.min(timeoutMs, 30 * 60000)
+      }
+    ]
+  };
+}
 function renderLoopTemplate(id, values) {
   if (id === TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID) {
     return renderTodosTaskWorkerVerifierWorkflow({
@@ -5191,6 +5501,27 @@ function renderLoopTemplate(id, values) {
       sandbox: values.sandbox
     });
   }
+  if (id === BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID) {
+    return renderBoundedAgentWorkerVerifierWorkflow({
+      name: values.name,
+      objective: values.objective ?? "",
+      prompt: values.prompt,
+      projectPath: values.projectPath ?? values.cwd ?? process.cwd(),
+      provider: values.provider,
+      authProfile: values.authProfile,
+      authProfilePool: listVar(values.authProfilePool),
+      workerAuthProfile: values.workerAuthProfile,
+      verifierAuthProfile: values.verifierAuthProfile,
+      account: values.account ? { profile: values.account, tool: values.accountTool } : undefined,
+      accountPool: accountPoolVar(values.accountPool, values.accountTool),
+      model: values.model,
+      variant: values.variant,
+      agent: values.agent,
+      permissionMode: values.permissionMode,
+      sandbox: values.sandbox,
+      timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : undefined
+    });
+  }
   throw new Error(`unknown template: ${id}`);
 }
 function listVar(value) {
@@ -5355,6 +5686,36 @@ function collectValues(value, previous = []) {
   previous.push(value);
   return previous;
 }
+function defaultLoopsProject() {
+  return process.env.LOOPS_TASK_PROJECT || process.env.LOOPS_DATA_DIR || `${process.env.HOME ?? "/home/hasna"}/.hasna/loops`;
+}
+function runLocalCommand(command, args, opts = {}) {
+  const result = spawnSync5(command, args, {
+    input: opts.input,
+    encoding: "utf8",
+    timeout: opts.timeoutMs ?? 30000,
+    maxBuffer: 8 * 1024 * 1024,
+    env: process.env
+  });
+  return {
+    ok: result.status === 0,
+    status: result.status,
+    stdout: result.stdout || "",
+    stderr: result.stderr || "",
+    error: result.error ? String(result.error.message || result.error) : ""
+  };
+}
+function ensureTodosTaskList(project, slug, name, description) {
+  runLocalCommand("todos", ["--project", project, "task-lists", "--add", name, "--slug", slug, "-d", description]);
+  const list = runLocalCommand("todos", ["--project", project, "--json", "task-lists"]);
+  if (!list.ok)
+    throw new Error(list.stderr || list.error || "failed to list todos task lists");
+  const values = JSON.parse(list.stdout || "[]");
+  const found = values.find((entry) => entry.slug === slug);
+  if (!found)
+    throw new Error(`todos task list not found after ensure: ${slug}`);
+  return found.id;
+}
 function eventData(event) {
   const data = event.data;
   if (data && typeof data === "object" && !Array.isArray(data))
@@ -6089,7 +6450,7 @@ program.command("expectations [idOrName]").description("evaluate deterministic l
     store.close();
   }
 });
-program.command("health").description("summarize loop health and latest-run expectation status").option("--json", "print JSON").action((opts) => {
+var health = program.command("health").description("summarize loop health and latest-run expectation status").option("--json", "print JSON").action((opts) => {
   const store = new Store;
   try {
     const report = buildHealthReport(store);
@@ -6107,6 +6468,134 @@ program.command("health").description("summarize loop health and latest-run expe
     store.close();
   }
 });
+health.command("route-tasks").description("upsert deduped todos tasks for failed loop health expectations").option("--project <path>", "todos project path", defaultLoopsProject()).option("--task-list <slug>", "todos task-list slug", "loop-error-self-heal").option("--limit <n>", "maximum loops to inspect", "200").option("--max-actions <n>", "maximum todos tasks to upsert", "5").option("--dry-run", "print intended task upserts without mutating todos").option("--json", "print JSON").action((opts) => {
+  const store = new Store;
+  try {
+    const report = buildHealthReport(store, { limit: Number(opts.limit) });
+    const failures = report.expectations.filter((entry) => !entry.ok && entry.recommendedTask).slice(0, Number(opts.maxActions));
+    const listId = opts.dryRun ? undefined : ensureTodosTaskList(opts.project, opts.taskList, "Loop Error Self Heal", "Deduped OpenLoops health expectation failures routed by loops health route-tasks.");
+    const actions = failures.map((expectation) => {
+      const task = expectation.recommendedTask;
+      const metadata = {
+        source: "openloops.health.route-tasks",
+        loop_id: expectation.loop.id,
+        loop_name: expectation.loop.name,
+        run_id: expectation.latestRun?.id,
+        classification: expectation.failure?.classification,
+        fingerprint: task.dedupeKey,
+        no_tmux_dispatch: true
+      };
+      if (opts.dryRun) {
+        return { action: "would-upsert", title: task.title, fingerprint: task.dedupeKey, priority: task.priority, metadata };
+      }
+      const result = runLocalCommand("todos", [
+        "--project",
+        opts.project,
+        "--json",
+        "task",
+        "upsert",
+        "--fingerprint",
+        task.dedupeKey,
+        "--title",
+        task.title,
+        "-d",
+        task.description,
+        "--priority",
+        task.priority,
+        "--status",
+        "pending",
+        "--list",
+        listId,
+        "--tags",
+        task.tags.join(","),
+        "--metadata-json",
+        JSON.stringify(metadata)
+      ]);
+      if (!result.ok) {
+        return { action: "upsert-failed", fingerprint: task.dedupeKey, error: result.stderr || result.error || result.stdout };
+      }
+      return { action: "upserted", fingerprint: task.dedupeKey, task: JSON.parse(result.stdout || "{}") };
+    });
+    const routed = { ok: actions.every((action) => action.action !== "upsert-failed"), inspected: report.summary.loops, failures: failures.length, actions };
+    if (isJson() || opts.json)
+      console.log(JSON.stringify(routed, null, 2));
+    else {
+      console.log(`health_route_tasks inspected=${routed.inspected} failures=${routed.failures} actions=${actions.length}`);
+      for (const action of actions)
+        console.log(`${action.action} ${action.fingerprint}`);
+    }
+    if (!routed.ok)
+      process.exitCode = 1;
+  } finally {
+    store.close();
+  }
+});
+var hygiene = program.command("hygiene").description("deterministic OpenLoops hygiene checks and safe repairs");
+hygiene.command("names").description("check or apply canonical machine-/repo-prefixed loop names").option("--apply", "rename loops in-place").option("--include-stopped", "include stopped loops").option("--include-inactive", "include stopped, expired, and archived loops").option("--limit <n>", "maximum loops to inspect", "1000").option("--json", "print JSON").action((opts) => {
+  const store = new Store;
+  try {
+    const report = buildNameHygieneReport(store, {
+      apply: Boolean(opts.apply),
+      includeStopped: Boolean(opts.includeStopped),
+      includeInactive: Boolean(opts.includeInactive),
+      limit: Number(opts.limit)
+    });
+    if (isJson() || opts.json)
+      console.log(JSON.stringify(report, null, 2));
+    else {
+      console.log(`hygiene_names checked=${report.checked} changed=${report.changed} applied=${report.applied}`);
+      for (const change of report.changes.filter((entry) => entry.changed)) {
+        console.log(`${report.applied ? "renamed" : "would-rename"} ${change.id} ${change.oldName} -> ${change.newName}`);
+      }
+    }
+    if (!report.ok && !report.applied)
+      process.exitCode = 1;
+  } finally {
+    store.close();
+  }
+});
+hygiene.command("duplicates").description("detect duplicate/overlapping loops with the same canonical name, cwd, and schedule").option("--include-inactive", "include stopped, expired, and archived loops").option("--limit <n>", "maximum loops to inspect", "1000").option("--json", "print JSON").action((opts) => {
+  const store = new Store;
+  try {
+    const report = buildDuplicateOverlapReport(store, {
+      includeInactive: Boolean(opts.includeInactive),
+      limit: Number(opts.limit)
+    });
+    if (isJson() || opts.json)
+      console.log(JSON.stringify(report, null, 2));
+    else {
+      console.log(`hygiene_duplicates checked=${report.checked} groups=${report.groups.length}`);
+      for (const group of report.groups) {
+        console.log(`${group.key}	${group.loops.map((loop) => `${loop.id}:${loop.status}:${loop.name}`).join(",")}`);
+      }
+    }
+    if (!report.ok)
+      process.exitCode = 1;
+  } finally {
+    store.close();
+  }
+});
+hygiene.command("scripts").description("inventory loops still backed by local ~/.hasna/loops/scripts commands").option("--scripts-dir <path>", "script directory to detect").option("--include-inactive", "include stopped, expired, and archived loops").option("--limit <n>", "maximum loops to inspect", "1000").option("--json", "print JSON").action((opts) => {
+  const store = new Store;
+  try {
+    const report = buildScriptInventoryReport(store, {
+      scriptsDir: opts.scriptsDir,
+      includeInactive: Boolean(opts.includeInactive),
+      limit: Number(opts.limit)
+    });
+    if (isJson() || opts.json)
+      console.log(JSON.stringify(report, null, 2));
+    else {
+      console.log(`hygiene_scripts checked=${report.checked} script_backed=${report.scriptBacked}`);
+      for (const loop of report.loops)
+        console.log(`${loop.id}	${loop.status}	${loop.name}	${loop.command}`);
+    }
+    if (!report.ok)
+      process.exitCode = 1;
+  } finally {
+    store.close();
+  }
+});
 program.command("pause <idOrName>").action((idOrName) => updateStatus(idOrName, "paused"));
 program.command("resume <idOrName>").action((idOrName) => updateStatus(idOrName, "active"));
 program.command("stop <idOrName>").action((idOrName) => updateStatus(idOrName, "stopped"));

package/dist/daemon/index.js

@@ -1052,6 +1052,30 @@ class Store {
       throw new Error(`loop not found after update: ${id}`);
     return after;
   }
+  renameLoop(id, name, opts = {}) {
+    const current = this.getLoop(id);
+    if (!current)
+      throw new Error(`loop not found: ${id}`);
+    const trimmed = name.trim();
+    if (!trimmed)
+      throw new Error("loop name must not be empty");
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.query(`UPDATE loops SET name=$name, updated_at=$updated
+         WHERE id=$id
+           AND ($daemonLeaseId IS NULL OR EXISTS (
+             SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+           ))`).run({
+      $id: id,
+      $name: trimmed,
+      $updated: updated,
+      $daemonLeaseId: opts.daemonLeaseId ?? null,
+      $now: updated
+    });
+    const after = this.getLoop(id);
+    if (!after)
+      throw new Error(`loop not found after rename: ${id}`);
+    return after;
+  }
   archiveLoop(idOrName) {
     const loop = this.requireLoop(idOrName);
     if (loop.archivedAt)
@@ -4395,7 +4419,7 @@ function enableStartup(result) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.16",
+  version: "0.3.17",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/index.d.ts

@@ -8,9 +8,10 @@ export { listOpenMachines, refreshLoopMachine, resolveLoopMachine } from "./lib/
 export { tick } from "./lib/scheduler.js";
 export { executeWorkflow, executeLoopTarget, preflightWorkflow } from "./lib/workflow-runner.js";
 export { workflowExecutionOrder, workflowBodyFromJson } from "./lib/workflow-spec.js";
-export { EVENT_WORKER_VERIFIER_TEMPLATE_ID, TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID, getLoopTemplate, listLoopTemplates, renderEventWorkerVerifierWorkflow, renderLoopTemplate, renderTodosTaskWorkerVerifierWorkflow, } from "./lib/templates.js";
+export { BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID, EVENT_WORKER_VERIFIER_TEMPLATE_ID, TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID, getLoopTemplate, listLoopTemplates, renderBoundedAgentWorkerVerifierWorkflow, renderEventWorkerVerifierWorkflow, renderLoopTemplate, renderTodosTaskWorkerVerifierWorkflow, } from "./lib/templates.js";
 export { runDoctor } from "./lib/doctor.js";
 export { buildHealthReport, classifyRunFailure, expectationForLoop } from "./lib/health.js";
+export { buildDuplicateOverlapReport, buildNameHygieneReport, buildScriptInventoryReport } from "./lib/hygiene.js";
 export { runGoal } from "./lib/goal/runner.js";
 export { resolveGoalModel } from "./lib/goal/model-factory.js";
 export { isTerminal as isGoalTerminal, readyNodeKeys, rollupSummary } from "./lib/goal/status.js";

package/dist/index.js

@@ -1050,6 +1050,30 @@ class Store {
       throw new Error(`loop not found after update: ${id}`);
     return after;
   }
+  renameLoop(id, name, opts = {}) {
+    const current = this.getLoop(id);
+    if (!current)
+      throw new Error(`loop not found: ${id}`);
+    const trimmed = name.trim();
+    if (!trimmed)
+      throw new Error("loop name must not be empty");
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.query(`UPDATE loops SET name=$name, updated_at=$updated
+         WHERE id=$id
+           AND ($daemonLeaseId IS NULL OR EXISTS (
+             SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+           ))`).run({
+      $id: id,
+      $name: trimmed,
+      $updated: updated,
+      $daemonLeaseId: opts.daemonLeaseId ?? null,
+      $now: updated
+    });
+    const after = this.getLoop(id);
+    if (!after)
+      throw new Error(`loop not found after rename: ${id}`);
+    return after;
+  }
   archiveLoop(idOrName) {
     const loop = this.requireLoop(idOrName);
     if (loop.archivedAt)
@@ -4094,6 +4118,7 @@ function loops(opts = {}) {
 // src/lib/templates.ts
 var TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID = "todos-task-worker-verifier";
 var EVENT_WORKER_VERIFIER_TEMPLATE_ID = "event-worker-verifier";
+var BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID = "bounded-agent-worker-verifier";
 var TEMPLATE_SUMMARIES = [
   {
     id: TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID,
@@ -4138,6 +4163,28 @@ var TEMPLATE_SUMMARIES = [
       { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
       { name: "sandbox", default: "danger-full-access", description: "Provider sandbox mode." }
     ]
+  },
+  {
+    id: BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID,
+    name: "Bounded Agent Worker + Verifier",
+    description: "Create a bounded recurring-agent workflow: one agent performs a narrow objective, then a fresh verifier audits the result with separate account/profile selection.",
+    kind: "workflow",
+    variables: [
+      { name: "objective", required: true, description: "Narrow goal-mode objective for the worker." },
+      { name: "prompt", description: "Optional extra worker prompt details." },
+      { name: "projectPath", required: true, description: "Repository or project working directory." },
+      { name: "provider", default: "codewith", description: "Agent provider: codewith, claude, cursor, opencode, aicopilot, or codex." },
+      { name: "authProfile", description: "Provider-native auth profile, currently Codewith." },
+      { name: "authProfilePool", description: "Comma-separated provider-native auth profiles; worker/verifier are selected deterministically." },
+      { name: "workerAuthProfile", description: "Provider-native auth profile for the worker step." },
+      { name: "verifierAuthProfile", description: "Provider-native auth profile for the verifier step." },
+      { name: "accountPool", description: "Comma-separated OpenAccounts profiles; worker/verifier are selected deterministically." },
+      { name: "model", description: "Provider model." },
+      { name: "variant", description: "Provider reasoning/model effort variant." },
+      { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
+      { name: "sandbox", default: "danger-full-access", description: "Provider sandbox mode." },
+      { name: "timeoutMs", default: "2700000", description: "Step timeout in milliseconds." }
+    ]
   }
 ];
 function compactJson(value) {
@@ -4324,6 +4371,54 @@ function renderEventWorkerVerifierWorkflow(input) {
     ]
   };
 }
+function renderBoundedAgentWorkerVerifierWorkflow(input) {
+  if (!input.objective?.trim())
+    throw new Error("objective is required");
+  if (!input.projectPath?.trim())
+    throw new Error("projectPath is required");
+  const seed = `${input.projectPath}:${input.objective}`;
+  const timeoutMs = input.timeoutMs && Number.isFinite(input.timeoutMs) ? input.timeoutMs : 45 * 60000;
+  const workerPrompt = [
+    `/goal ${input.objective}`,
+    "",
+    "You are the worker step for a bounded OpenLoops agent workflow.",
+    "Investigate first. Keep scope narrow, use local project/task systems as the source of truth when relevant, preserve unrelated changes, run focused validation, and record concise evidence.",
+    "Do not dispatch or paste prompts into tmux panes. If additional work is required, create or update deduped todos tasks so task-created routing can start a fresh headless workflow.",
+    input.prompt ? "" : undefined,
+    input.prompt
+  ].filter(Boolean).join(`
+`);
+  const verifierPrompt = [
+    `/goal Adversarially verify: ${input.objective}`,
+    "",
+    "You are the verifier step for a bounded OpenLoops agent workflow.",
+    "Use fresh context. Review the worker result for correctness, regressions, missing tests, safety, runaway-agent risk, output bounds, and incomplete evidence.",
+    "If valid, record verification evidence. If invalid, create precise follow-up tasks or comments and leave the original work open. Do not make broad unrelated changes."
+  ].join(`
+`);
+  return {
+    name: input.name ?? `bounded-agent-${stableIndex(seed, 65535).toString(16)}-worker-verifier`,
+    description: `Bounded worker/verifier workflow for ${input.objective.slice(0, 180)}`,
+    version: 1,
+    steps: [
+      {
+        id: "worker",
+        name: "Worker",
+        description: "Execute the bounded objective and record evidence.",
+        target: agentTarget(input, workerPrompt, "worker", seed),
+        timeoutMs
+      },
+      {
+        id: "verifier",
+        name: "Verifier",
+        description: "Adversarially verify the bounded objective result.",
+        dependsOn: ["worker"],
+        target: agentTarget(input, verifierPrompt, "verifier", seed),
+        timeoutMs: Math.min(timeoutMs, 30 * 60000)
+      }
+    ]
+  };
+}
 function renderLoopTemplate(id, values) {
   if (id === TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID) {
     return renderTodosTaskWorkerVerifierWorkflow({
@@ -4370,6 +4465,27 @@ function renderLoopTemplate(id, values) {
       sandbox: values.sandbox
     });
   }
+  if (id === BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID) {
+    return renderBoundedAgentWorkerVerifierWorkflow({
+      name: values.name,
+      objective: values.objective ?? "",
+      prompt: values.prompt,
+      projectPath: values.projectPath ?? values.cwd ?? process.cwd(),
+      provider: values.provider,
+      authProfile: values.authProfile,
+      authProfilePool: listVar(values.authProfilePool),
+      workerAuthProfile: values.workerAuthProfile,
+      verifierAuthProfile: values.verifierAuthProfile,
+      account: values.account ? { profile: values.account, tool: values.accountTool } : undefined,
+      accountPool: accountPoolVar(values.accountPool, values.accountTool),
+      model: values.model,
+      variant: values.variant,
+      agent: values.agent,
+      permissionMode: values.permissionMode,
+      sandbox: values.sandbox,
+      timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : undefined
+    });
+  }
   throw new Error(`unknown template: ${id}`);
 }
 function listVar(value) {
@@ -4825,6 +4941,219 @@ function buildHealthReport(store, opts = {}) {
     expectations
   };
 }
+// src/lib/hygiene.ts
+import { basename } from "path";
+var PROVIDER_TOKENS = new Set([
+  "codewith",
+  "claude",
+  "command",
+  "tmux",
+  "codex",
+  "cursor",
+  "opencode",
+  "aicopilot",
+  "agent"
+]);
+var REPO_GENERIC_TOKENS = new Set(["repo", "repoops"]);
+function slugify(value) {
+  return value.normalize("NFKD").replace(/[^\w\s.-]/g, "-").replace(/[_\s.:/]+/g, "-").replace(/[^a-zA-Z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").toLowerCase();
+}
+function repoSlugFromCwd(cwd) {
+  if (!cwd || cwd === process.env.HOME || cwd === "/home/hasna")
+    return "";
+  if (cwd.includes("/.hasna/loops/"))
+    return "";
+  return slugify(basename(cwd));
+}
+function scopeForLoop(loop) {
+  const cwd = loop.target.type === "command" || loop.target.type === "agent" ? loop.target.cwd : undefined;
+  const repoSlug = repoSlugFromCwd(cwd);
+  if (repoSlug)
+    return { scope: "repo", prefix: `repo-${repoSlug}`, scopeSlug: repoSlug };
+  return { scope: "machine", prefix: "machine", scopeSlug: "machine" };
+}
+function taskSlug(loop, scope) {
+  const oldName = loop.name;
+  let nameForParsing = oldName;
+  if (!oldName.includes(":")) {
+    const slug = slugify(oldName);
+    if (scope.scope === "machine" && slug.startsWith("machine-"))
+      nameForParsing = slug.slice("machine-".length);
+    else if (scope.scope === "repo" && slug.startsWith(`repo-${scope.scopeSlug}-`)) {
+      nameForParsing = slug.slice(`repo-${scope.scopeSlug}-`.length);
+    } else
+      nameForParsing = slug;
+  }
+  const parts = [];
+  for (const rawPart of oldName.includes(":") ? oldName.split(":") : [nameForParsing]) {
+    const part = slugify(rawPart);
+    if (!part)
+      continue;
+    if (PROVIDER_TOKENS.has(part) || /^account\d+$/.test(part))
+      continue;
+    if (scope.scope === "repo" && REPO_GENERIC_TOKENS.has(part))
+      continue;
+    let normalized = part;
+    if (scope.scope === "repo" && normalized === scope.scopeSlug)
+      continue;
+    if (scope.scope === "repo" && normalized.startsWith(`${scope.scopeSlug}-`)) {
+      normalized = normalized.slice(scope.scopeSlug.length + 1);
+    }
+    if (normalized)
+      parts.push(normalized);
+  }
+  const deduped = [];
+  for (const token of parts.join("-").split("-").filter(Boolean)) {
+    if (deduped[deduped.length - 1] !== token)
+      deduped.push(token);
+  }
+  return deduped.join("-") || "loop";
+}
+function canonicalName(loop) {
+  const scope = scopeForLoop(loop);
+  let name = `${scope.prefix}-${taskSlug(loop, scope)}`.replace(/-+/g, "-").replace(/^-|-$/g, "");
+  if (name.length > 120)
+    name = `${name.slice(0, 111).replace(/-+$/g, "")}-${loop.id.slice(0, 8)}`;
+  return {
+    id: loop.id,
+    status: loop.status,
+    scope: scope.scope,
+    scopeSlug: scope.scopeSlug,
+    newName: name
+  };
+}
+function ensureUnique(changes) {
+  const used = new Set;
+  for (const change of changes) {
+    let candidate = change.newName;
+    if (!used.has(candidate)) {
+      used.add(candidate);
+      change.newName = candidate;
+      change.changed = change.oldName !== candidate;
+      continue;
+    }
+    const base = candidate.slice(0, 111).replace(/-+$/g, "");
+    candidate = `${base}-${change.id.slice(0, 8)}`;
+    let suffix = 2;
+    while (used.has(candidate)) {
+      const extra = `-${change.id.slice(0, 6)}-${suffix++}`;
+      candidate = `${base.slice(0, 120 - extra.length)}${extra}`;
+    }
+    used.add(candidate);
+    change.newName = candidate;
+    change.changed = change.oldName !== candidate;
+  }
+}
+function managedLoops(store, opts) {
+  const loops2 = store.listLoops({ includeArchived: Boolean(opts.includeInactive), limit: opts.limit ?? 1000 });
+  if (opts.includeInactive)
+    return loops2;
+  if (opts.includeStopped)
+    return loops2.filter((loop) => loop.status !== "expired");
+  return loops2.filter((loop) => loop.status === "active" || loop.status === "paused");
+}
+function buildNameHygieneReport(store, opts = {}) {
+  const changes = managedLoops(store, opts).map((loop) => {
+    const canonical = canonicalName(loop);
+    return {
+      ...canonical,
+      oldName: loop.name,
+      changed: loop.name !== canonical.newName
+    };
+  });
+  ensureUnique(changes);
+  const changed = changes.filter((change) => change.changed);
+  if (opts.apply) {
+    for (const change of changed)
+      store.renameLoop(change.id, change.newName);
+  }
+  return {
+    ok: changed.length === 0,
+    generatedAt: new Date().toISOString(),
+    applied: Boolean(opts.apply),
+    checked: changes.length,
+    changed: changed.length,
+    changes
+  };
+}
+function baseName(name) {
+  return name.replace(/-(bounded|compact|native)?-?low(?:-\d+m)?$/g, "").replace(/-\d+[mhd]$/g, "").replace(/-(bounded|compact)$/g, "");
+}
+function scheduleKey(schedule) {
+  if (schedule.type === "cron")
+    return `cron:${schedule.expression}`;
+  if (schedule.type === "interval")
+    return `interval:${schedule.everyMs}`;
+  if (schedule.type === "once")
+    return `once:${schedule.at}`;
+  return `dynamic:${schedule.minIntervalMs ?? ""}`;
+}
+function targetCwd(loop) {
+  return loop.target.type === "command" || loop.target.type === "agent" ? loop.target.cwd ?? "" : "";
+}
+function buildDuplicateOverlapReport(store, opts = {}) {
+  const loops2 = managedLoops(store, { includeInactive: opts.includeInactive, includeStopped: true, limit: opts.limit });
+  const groups = new Map;
+  for (const loop of loops2) {
+    const base = baseName(loop.name);
+    const cwd = targetCwd(loop) || undefined;
+    const schedule = scheduleKey(loop.schedule);
+    const key = `${base}|${cwd ?? ""}|${schedule}`;
+    const existing = groups.get(key) ?? { baseName: base, cwd, schedule, loops: [] };
+    existing.loops.push(loop);
+    groups.set(key, existing);
+  }
+  const duplicateGroups = [...groups.entries()].filter(([, group]) => group.loops.length > 1).map(([key, group]) => ({
+    key,
+    baseName: group.baseName,
+    cwd: group.cwd,
+    schedule: group.schedule,
+    loops: group.loops.map((loop) => ({
+      id: loop.id,
+      name: loop.name,
+      status: loop.status,
+      nextRunAt: loop.nextRunAt
+    }))
+  }));
+  return {
+    ok: duplicateGroups.length === 0,
+    generatedAt: new Date().toISOString(),
+    checked: loops2.length,
+    groups: duplicateGroups
+  };
+}
+function commandText(loop) {
+  if (loop.target.type !== "command")
+    return "";
+  return [loop.target.command, ...loop.target.args ?? []].join(" ");
+}
+function buildScriptInventoryReport(store, opts = {}) {
+  const scriptsDir = opts.scriptsDir ?? `${process.env.HOME ?? "/home/hasna"}/.hasna/loops/scripts`;
+  const loops2 = managedLoops(store, { includeInactive: opts.includeInactive, includeStopped: true, limit: opts.limit });
+  const scriptBacked = loops2.map((loop) => {
+    const text = commandText(loop);
+    if (!text)
+      return;
+    const matches = [scriptsDir, "/.hasna/loops/scripts/"].filter((needle) => text.includes(needle));
+    if (!matches.length)
+      return;
+    return {
+      id: loop.id,
+      name: loop.name,
+      status: loop.status,
+      cwd: targetCwd(loop) || undefined,
+      command: text.length > 500 ? `${text.slice(0, 500)}...` : text,
+      scriptMatches: [...new Set(matches)]
+    };
+  }).filter((value) => Boolean(value));
+  return {
+    ok: scriptBacked.length === 0,
+    generatedAt: new Date().toISOString(),
+    checked: loops2.length,
+    scriptBacked: scriptBacked.length,
+    loops: scriptBacked
+  };
+}
 export {
   workflowExecutionOrder,
   workflowBodyFromJson,
@@ -4837,6 +5166,7 @@ export {
   renderTodosTaskWorkerVerifierWorkflow,
   renderLoopTemplate,
   renderEventWorkerVerifierWorkflow,
+  renderBoundedAgentWorkerVerifierWorkflow,
   refreshLoopMachine,
   readyNodeKeys,
   preflightWorkflow,
@@ -4857,9 +5187,13 @@ export {
   executeLoop,
   computeNextAfter,
   classifyRunFailure,
+  buildScriptInventoryReport,
+  buildNameHygieneReport,
   buildHealthReport,
+  buildDuplicateOverlapReport,
   TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID,
   Store,
   LoopsClient,
-  EVENT_WORKER_VERIFIER_TEMPLATE_ID
+  EVENT_WORKER_VERIFIER_TEMPLATE_ID,
+  BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID
 };

package/dist/lib/hygiene.d.ts

@@ -0,0 +1,62 @@
+import type { Loop } from "../types.js";
+import type { Store } from "./store.js";
+export interface NameHygieneChange {
+    id: string;
+    status: string;
+    scope: "machine" | "repo";
+    scopeSlug: string;
+    oldName: string;
+    newName: string;
+    changed: boolean;
+}
+export interface NameHygieneReport {
+    ok: boolean;
+    generatedAt: string;
+    applied: boolean;
+    checked: number;
+    changed: number;
+    changes: NameHygieneChange[];
+}
+export interface DuplicateOverlapGroup {
+    key: string;
+    baseName: string;
+    cwd?: string;
+    schedule: string;
+    loops: Array<Pick<Loop, "id" | "name" | "status" | "nextRunAt">>;
+}
+export interface DuplicateOverlapReport {
+    ok: boolean;
+    generatedAt: string;
+    checked: number;
+    groups: DuplicateOverlapGroup[];
+}
+export interface ScriptBackedLoop {
+    id: string;
+    name: string;
+    status: string;
+    cwd?: string;
+    command: string;
+    scriptMatches: string[];
+}
+export interface ScriptInventoryReport {
+    ok: boolean;
+    generatedAt: string;
+    checked: number;
+    scriptBacked: number;
+    loops: ScriptBackedLoop[];
+}
+export declare function buildNameHygieneReport(store: Store, opts?: {
+    apply?: boolean;
+    includeStopped?: boolean;
+    includeInactive?: boolean;
+    limit?: number;
+}): NameHygieneReport;
+export declare function buildDuplicateOverlapReport(store: Store, opts?: {
+    includeInactive?: boolean;
+    limit?: number;
+}): DuplicateOverlapReport;
+export declare function buildScriptInventoryReport(store: Store, opts?: {
+    scriptsDir?: string;
+    includeInactive?: boolean;
+    limit?: number;
+}): ScriptInventoryReport;

package/dist/lib/store.d.ts

@@ -79,6 +79,7 @@ export declare class Store {
     }): Loop[];
     dueLoops(now: Date): Loop[];
     updateLoop(id: string, patch: Partial<Pick<Loop, "status" | "nextRunAt" | "retryScheduledFor" | "expiresAt">>, opts?: DaemonLeaseFence): Loop;
+    renameLoop(id: string, name: string, opts?: DaemonLeaseFence): Loop;
     archiveLoop(idOrName: string): Loop;
     unarchiveLoop(idOrName: string): Loop;
     deleteLoop(idOrName: string): boolean;

package/dist/lib/store.js

@@ -1050,6 +1050,30 @@ class Store {
       throw new Error(`loop not found after update: ${id}`);
     return after;
   }
+  renameLoop(id, name, opts = {}) {
+    const current = this.getLoop(id);
+    if (!current)
+      throw new Error(`loop not found: ${id}`);
+    const trimmed = name.trim();
+    if (!trimmed)
+      throw new Error("loop name must not be empty");
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.query(`UPDATE loops SET name=$name, updated_at=$updated
+         WHERE id=$id
+           AND ($daemonLeaseId IS NULL OR EXISTS (
+             SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+           ))`).run({
+      $id: id,
+      $name: trimmed,
+      $updated: updated,
+      $daemonLeaseId: opts.daemonLeaseId ?? null,
+      $now: updated
+    });
+    const after = this.getLoop(id);
+    if (!after)
+      throw new Error(`loop not found after rename: ${id}`);
+    return after;
+  }
   archiveLoop(idOrName) {
     const loop = this.requireLoop(idOrName);
     if (loop.archivedAt)

package/dist/lib/templates.d.ts

@@ -1,6 +1,7 @@
 import type { AccountRef, AgentPermissionMode, AgentProvider, AgentSandbox, CreateWorkflowInput, LoopTemplateSummary } from "../types.js";
 export declare const TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID = "todos-task-worker-verifier";
 export declare const EVENT_WORKER_VERIFIER_TEMPLATE_ID = "event-worker-verifier";
+export declare const BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID = "bounded-agent-worker-verifier";
 export interface TodosTaskWorkflowTemplateInput {
     taskId: string;
     taskTitle?: string;
@@ -46,8 +47,30 @@ export interface EventWorkflowTemplateInput {
     permissionMode?: AgentPermissionMode;
     sandbox?: AgentSandbox;
 }
+export interface BoundedAgentWorkflowTemplateInput {
+    name?: string;
+    objective: string;
+    prompt?: string;
+    projectPath: string;
+    provider?: AgentProvider;
+    authProfile?: string;
+    authProfilePool?: string[];
+    workerAuthProfile?: string;
+    verifierAuthProfile?: string;
+    account?: AccountRef;
+    accountPool?: AccountRef[];
+    workerAccount?: AccountRef;
+    verifierAccount?: AccountRef;
+    model?: string;
+    variant?: string;
+    agent?: string;
+    permissionMode?: AgentPermissionMode;
+    sandbox?: AgentSandbox;
+    timeoutMs?: number;
+}
 export declare function listLoopTemplates(): LoopTemplateSummary[];
 export declare function getLoopTemplate(id: string): LoopTemplateSummary | undefined;
 export declare function renderTodosTaskWorkerVerifierWorkflow(input: TodosTaskWorkflowTemplateInput): CreateWorkflowInput;
 export declare function renderEventWorkerVerifierWorkflow(input: EventWorkflowTemplateInput): CreateWorkflowInput;
+export declare function renderBoundedAgentWorkerVerifierWorkflow(input: BoundedAgentWorkflowTemplateInput): CreateWorkflowInput;
 export declare function renderLoopTemplate(id: string, values: Record<string, string | undefined>): CreateWorkflowInput;

package/dist/sdk/index.js

@@ -1050,6 +1050,30 @@ class Store {
       throw new Error(`loop not found after update: ${id}`);
     return after;
   }
+  renameLoop(id, name, opts = {}) {
+    const current = this.getLoop(id);
+    if (!current)
+      throw new Error(`loop not found: ${id}`);
+    const trimmed = name.trim();
+    if (!trimmed)
+      throw new Error("loop name must not be empty");
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.query(`UPDATE loops SET name=$name, updated_at=$updated
+         WHERE id=$id
+           AND ($daemonLeaseId IS NULL OR EXISTS (
+             SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+           ))`).run({
+      $id: id,
+      $name: trimmed,
+      $updated: updated,
+      $daemonLeaseId: opts.daemonLeaseId ?? null,
+      $now: updated
+    });
+    const after = this.getLoop(id);
+    if (!after)
+      throw new Error(`loop not found after rename: ${id}`);
+    return after;
+  }
   archiveLoop(idOrName) {
     const loop = this.requireLoop(idOrName);
     if (loop.archivedAt)

package/docs/USAGE.md

@@ -184,7 +184,8 @@ Use `shell: true` only when you intentionally want shell parsing:
 Built-in templates turn common orchestration flows into reusable workflow JSON.
 `todos-task-worker-verifier` performs one todos task and then verifies it.
 `event-worker-verifier` handles any Hasna event envelope and then verifies the
-handling.
+handling. `bounded-agent-worker-verifier` is for recurring bounded agent work:
+one worker runs a narrow objective, then a fresh verifier audits the result.
 
 ```bash
 loops templates list
@@ -204,6 +205,12 @@ loops templates render event-worker-verifier \
   --var eventSource=knowledge \
   --var eventJson='{"id":"<event-id>"}' \
   --var projectPath=/path/to/repo
+loops templates render bounded-agent-worker-verifier \
+  --var objective="Check docs drift and queue tasks for gaps" \
+  --var projectPath=/path/to/repo \
+  --var provider=codewith \
+  --var authProfilePool=account004,account005 \
+  --var sandbox=danger-full-access
 ```
 
 For event-driven task automation, `loops events handle todos-task` reads a
@@ -287,15 +294,42 @@ loops expectations <loop-id-or-name> --json
 
 The JSON contains the expectation result, bounded error/stdout/stderr evidence,
 a stable failure fingerprint, route metadata, and recommended task fields.
-OpenLoops does not mutate Todos from these commands. Until Todos has a native
-upsert command, consumers can use the included compatibility fallback:
-`todos search <dedupe-key>`, then `todos add ...` or `todos comment ...`.
-The planned native integration is represented in `futureNativeUpsert`.
+OpenLoops does not mutate Todos from `health` or `expectations`. To turn failed
+expectations into deduped tasks, use the explicit routing command:
+
+```bash
+loops health route-tasks \
+  --project ~/.hasna/loops \
+  --task-list loop-error-self-heal \
+  --max-actions 5
+```
+
+Use `--dry-run --json` first when testing a new automation path. Routed tasks
+include the stable failure fingerprint, classification, loop id/name, and
+`no_tmux_dispatch=true` metadata.
 
 Failure classifications are: `rate_limit`, `auth`, `model_not_found`,
 `context_length`, `schema_response_format`, `node_init`, `timeout`, `sigsegv`,
 `skipped_previous_active`, and `unknown`.
 
+## Hygiene
+
+OpenLoops includes deterministic hygiene checks for replacing local maintenance
+scripts with package commands:
+
+```bash
+loops hygiene names --json
+loops hygiene names --apply
+loops hygiene duplicates --json
+loops hygiene scripts --json
+```
+
+`hygiene names` reports canonical `machine-*` or `repo-<name>-*` loop names and
+only renames when `--apply` is present. `hygiene duplicates` groups loops with
+the same normalized name, cwd, and schedule. `hygiene scripts` inventories loops
+whose command still references `~/.hasna/loops/scripts`; use it as a migration
+gate before deleting local scripts.
+
 Archive loops when retiring old automation but preserving history:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/loops",
-  "version": "0.3.16",
+  "version": "0.3.17",
   "description": "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   "type": "module",
   "main": "dist/index.js",