@hasna/loops 0.3.38 → 0.3.40

package/dist/lib/store.js

@@ -1,8 +1,9 @@
 // @bun
 // src/lib/store.ts
 import { Database } from "bun:sqlite";
-import { mkdirSync as mkdirSync2 } from "fs";
-import { dirname } from "path";
+import { mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { dirname, join as join3 } from "path";
 
 // src/lib/ids.ts
 import { randomBytes } from "crypto";
@@ -363,6 +364,8 @@ function validateTarget(value, label) {
   assertObject(value, label);
   if (value.type === "command") {
     assertString(value.command, `${label}.command`);
+    optionalPositiveInteger(value.timeoutMs, `${label}.timeoutMs`);
+    optionalPositiveInteger(value.idleTimeoutMs, `${label}.idleTimeoutMs`);
     if (value.shell !== true && /\s/.test(value.command.trim())) {
       throw new Error(`${label}.command must be an executable without spaces when shell is false; put flags in args or set shell true`);
     }
@@ -374,6 +377,8 @@ function validateTarget(value, label) {
     const providers = ["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"];
     if (!providers.includes(value.provider))
       throw new Error(`${label}.provider must be one of ${providers.join(", ")}`);
+    optionalPositiveInteger(value.timeoutMs, `${label}.timeoutMs`);
+    optionalPositiveInteger(value.idleTimeoutMs, `${label}.idleTimeoutMs`);
     if (value.authProfile !== undefined) {
       assertString(value.authProfile, `${label}.authProfile`);
       if (value.provider !== "codewith")
@@ -528,6 +533,52 @@ function workflowBodyFromJson(value, fallbackName) {
   });
 }
 
+// src/lib/run-artifacts.ts
+import { createHash } from "crypto";
+import { mkdirSync as mkdirSync2, writeFileSync } from "fs";
+import { basename, join as join2 } from "path";
+function shortHash(value) {
+  return createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
+function safeRunPathSlug(value, fallback) {
+  const raw = value?.trim() || fallback;
+  const slug = raw.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 72);
+  return slug || fallback;
+}
+function workflowRunSubjectKey(kind, rawSubjectRef) {
+  const raw = rawSubjectRef?.trim() || "subject";
+  const kindSlug = safeRunPathSlug(kind, "subject").slice(0, 24);
+  const subjectSlug = safeRunPathSlug(raw, "subject").slice(0, 48);
+  return `${kindSlug}-${subjectSlug}-${shortHash(`${kindSlug}
+${raw}`)}`;
+}
+function workflowRunProjectSlug(projectKey) {
+  if (!projectKey?.trim())
+    return "global";
+  return safeRunPathSlug(projectKey.startsWith("/") ? basename(projectKey) : projectKey, "project");
+}
+function writeWorkflowRunManifest(args) {
+  const projectSlug = workflowRunProjectSlug(args.projectKey);
+  const subjectKey = workflowRunSubjectKey(args.subjectKind, args.rawSubjectRef);
+  const dir = join2(args.loopsDataDir, "runs", projectSlug, subjectKey, args.workflowRunId);
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const manifestPath = join2(dir, "manifest.json");
+  writeFileSync(manifestPath, JSON.stringify({
+    version: 1,
+    workflowRunId: args.workflowRunId,
+    workflowId: args.workflowId,
+    workflowName: args.workflowName,
+    invocationId: args.invocationId,
+    workItemId: args.workItemId,
+    projectSlug,
+    subjectKey,
+    requiredReading: [],
+    createdAt: new Date().toISOString(),
+    ...args.payload
+  }, null, 2), { mode: 384 });
+  return manifestPath;
+}
+
 // src/lib/store.ts
 function rowToLoop(row) {
   return {
@@ -597,8 +648,11 @@ function rowToWorkflowRun(row) {
     workflowName: row.workflow_name,
     loopId: row.loop_id ?? undefined,
     loopRunId: row.loop_run_id ?? undefined,
+    invocationId: row.invocation_id ?? undefined,
+    workItemId: row.work_item_id ?? undefined,
     scheduledFor: row.scheduled_for ?? undefined,
     idempotencyKey: row.idempotency_key ?? undefined,
+    manifestPath: row.manifest_path ?? undefined,
     status: row.status,
     startedAt: row.started_at ?? undefined,
     finishedAt: row.finished_at ?? undefined,
@@ -609,6 +663,44 @@ function rowToWorkflowRun(row) {
     updatedAt: row.updated_at
   };
 }
+function rowToWorkflowInvocation(row) {
+  return {
+    id: row.id,
+    workflowId: row.workflow_id ?? undefined,
+    templateId: row.template_id ?? undefined,
+    sourceRef: JSON.parse(row.source_json),
+    subjectRef: JSON.parse(row.subject_json),
+    intent: row.intent,
+    scope: row.scope_json ? JSON.parse(row.scope_json) : undefined,
+    outputPolicy: row.output_policy_json ? JSON.parse(row.output_policy_json) : undefined,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function rowToWorkflowWorkItem(row) {
+  return {
+    id: row.id,
+    routeKey: row.route_key,
+    idempotencyKey: row.idempotency_key,
+    invocationId: row.invocation_id,
+    sourceType: row.source_type,
+    sourceRef: row.source_ref,
+    subjectRef: row.subject_ref,
+    projectKey: row.project_key ?? undefined,
+    projectGroup: row.project_group ?? undefined,
+    priority: row.priority,
+    status: row.status,
+    attempts: row.attempts,
+    nextAttemptAt: row.next_attempt_at ?? undefined,
+    leaseExpiresAt: row.lease_expires_at ?? undefined,
+    workflowId: row.workflow_id ?? undefined,
+    loopId: row.loop_id ?? undefined,
+    workflowRunId: row.workflow_run_id ?? undefined,
+    lastReason: row.last_reason ?? undefined,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
 function rowToWorkflowStepRun(row) {
   return {
     id: row.id,
@@ -722,13 +814,23 @@ function rowToLease(row) {
     updatedAt: row.updated_at
   };
 }
+function workItemStatusForLoopRun(status, attempt, maxAttempts) {
+  if (status === "succeeded")
+    return "succeeded";
+  if (["failed", "timed_out", "abandoned"].includes(status)) {
+    return maxAttempts !== undefined && attempt < maxAttempts ? "admitted" : "failed";
+  }
+  return;
+}
 
 class Store {
   db;
+  rootDir;
   constructor(path) {
     const file = path ?? dbPath();
     if (file !== ":memory:")
-      mkdirSync2(dirname(file), { recursive: true, mode: 448 });
+      mkdirSync3(dirname(file), { recursive: true, mode: 448 });
+    this.rootDir = file === ":memory:" ? mkdtempSync(join3(tmpdir(), "open-loops-store-")) : dirname(file);
     this.db = new Database(file);
     this.db.exec("PRAGMA busy_timeout = 5000;");
     this.db.exec("PRAGMA journal_mode = WAL;");
@@ -823,8 +925,11 @@ class Store {
         workflow_name TEXT NOT NULL,
         loop_id TEXT REFERENCES loops(id) ON DELETE SET NULL,
         loop_run_id TEXT REFERENCES loop_runs(id) ON DELETE SET NULL,
+        invocation_id TEXT,
+        work_item_id TEXT,
         scheduled_for TEXT,
         idempotency_key TEXT,
+        manifest_path TEXT,
         status TEXT NOT NULL,
         started_at TEXT,
         finished_at TEXT,
@@ -841,6 +946,59 @@ class Store {
       CREATE INDEX IF NOT EXISTS idx_workflow_runs_loop_run ON workflow_runs(loop_run_id);
       CREATE INDEX IF NOT EXISTS idx_workflow_runs_status ON workflow_runs(status);
 
+      CREATE TABLE IF NOT EXISTS workflow_invocations (
+        id TEXT PRIMARY KEY,
+        workflow_id TEXT,
+        template_id TEXT,
+        source_kind TEXT NOT NULL,
+        source_id TEXT,
+        source_dedupe_key TEXT,
+        source_json TEXT NOT NULL,
+        subject_kind TEXT NOT NULL,
+        subject_id TEXT,
+        subject_path TEXT,
+        subject_url TEXT,
+        subject_json TEXT NOT NULL,
+        intent TEXT NOT NULL,
+        scope_json TEXT,
+        output_policy_json TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_workflow_invocations_source ON workflow_invocations(source_kind, source_id);
+      CREATE INDEX IF NOT EXISTS idx_workflow_invocations_subject ON workflow_invocations(subject_kind, subject_id, subject_path);
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_workflow_invocations_dedupe
+        ON workflow_invocations(source_kind, source_dedupe_key)
+        WHERE source_dedupe_key IS NOT NULL;
+
+      CREATE TABLE IF NOT EXISTS workflow_work_items (
+        id TEXT PRIMARY KEY,
+        route_key TEXT NOT NULL,
+        idempotency_key TEXT NOT NULL,
+        invocation_id TEXT NOT NULL REFERENCES workflow_invocations(id) ON DELETE CASCADE,
+        source_type TEXT NOT NULL,
+        source_ref TEXT NOT NULL,
+        subject_ref TEXT NOT NULL,
+        project_key TEXT,
+        project_group TEXT,
+        priority INTEGER NOT NULL,
+        status TEXT NOT NULL,
+        attempts INTEGER NOT NULL,
+        next_attempt_at TEXT,
+        lease_expires_at TEXT,
+        workflow_id TEXT REFERENCES workflow_specs(id) ON DELETE SET NULL,
+        loop_id TEXT REFERENCES loops(id) ON DELETE SET NULL,
+        workflow_run_id TEXT REFERENCES workflow_runs(id) ON DELETE SET NULL,
+        last_reason TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        UNIQUE(route_key, idempotency_key)
+      );
+      CREATE INDEX IF NOT EXISTS idx_workflow_work_items_status_next ON workflow_work_items(status, next_attempt_at, priority DESC, created_at ASC);
+      CREATE INDEX IF NOT EXISTS idx_workflow_work_items_project ON workflow_work_items(project_key, status);
+      CREATE INDEX IF NOT EXISTS idx_workflow_work_items_group ON workflow_work_items(project_group, status);
+      CREATE INDEX IF NOT EXISTS idx_workflow_work_items_invocation ON workflow_work_items(invocation_id);
+
       CREATE TABLE IF NOT EXISTS workflow_step_runs (
         id TEXT PRIMARY KEY,
         workflow_run_id TEXT NOT NULL REFERENCES workflow_runs(id) ON DELETE CASCADE,
@@ -953,12 +1111,17 @@ class Store {
     this.addColumnIfMissing("loop_runs", "goal_run_id", "TEXT");
     this.addColumnIfMissing("workflow_specs", "goal_json", "TEXT");
     this.addColumnIfMissing("workflow_runs", "goal_run_id", "TEXT");
+    this.addColumnIfMissing("workflow_runs", "invocation_id", "TEXT");
+    this.addColumnIfMissing("workflow_runs", "work_item_id", "TEXT");
+    this.addColumnIfMissing("workflow_runs", "manifest_path", "TEXT");
     this.addColumnIfMissing("workflow_step_runs", "pid", "INTEGER");
     this.addColumnIfMissing("workflow_step_runs", "goal_run_id", "TEXT");
+    this.createWorkflowRunBackfillIndexes();
     this.db.query("INSERT OR IGNORE INTO schema_migrations (id, applied_at) VALUES (?, ?)").run("0001_initial_and_workflows", nowIso());
     this.db.query("INSERT OR IGNORE INTO schema_migrations (id, applied_at) VALUES (?, ?)").run("0002_loop_machines", nowIso());
     this.db.query("INSERT OR IGNORE INTO schema_migrations (id, applied_at) VALUES (?, ?)").run("0003_goals", nowIso());
     this.db.query("INSERT OR IGNORE INTO schema_migrations (id, applied_at) VALUES (?, ?)").run("0004_loop_archive_metadata", nowIso());
+    this.db.query("INSERT OR IGNORE INTO schema_migrations (id, applied_at) VALUES (?, ?)").run("0005_workflow_invocations_and_admission", nowIso());
   }
   addColumnIfMissing(table, column, definition) {
     const columns = this.db.query(`PRAGMA table_info(${table})`).all();
@@ -966,6 +1129,12 @@ class Store {
       return;
     this.db.query(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`).run();
   }
+  createWorkflowRunBackfillIndexes() {
+    this.db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_workflow_runs_invocation ON workflow_runs(invocation_id);
+      CREATE INDEX IF NOT EXISTS idx_workflow_runs_work_item ON workflow_runs(work_item_id);
+    `);
+  }
   assertDaemonLeaseFence(opts = {}, now = nowIso()) {
     if (!opts.daemonLeaseId)
       return;
@@ -1081,6 +1250,10 @@ class Store {
       $daemonLeaseId: opts.daemonLeaseId ?? null,
       $now: updated
     });
+    if (patch.status && patch.status !== "active") {
+      const status = patch.status === "paused" ? "deferred" : "cancelled";
+      this.setWorkflowWorkItemsForLoop(id, status, `loop ${patch.status}`, updated);
+    }
     const after = this.getLoop(id);
     if (!after)
       throw new Error(`loop not found after update: ${id}`);
@@ -1125,6 +1298,7 @@ class Store {
       $archivedFromStatus: loop.status,
       $updated: updated
     });
+    this.setWorkflowWorkItemsForLoop(loop.id, "deferred", "loop archived", updated);
     const archived = this.getLoop(loop.id);
     if (!archived)
       throw new Error(`loop not found after archive: ${loop.id}`);
@@ -1150,6 +1324,7 @@ class Store {
   }
   deleteLoop(idOrName) {
     const loop = this.requireLoop(idOrName);
+    this.setWorkflowWorkItemsForLoop(loop.id, "cancelled", "loop deleted", nowIso());
     const res = this.db.query("DELETE FROM loops WHERE id = ?").run(loop.id);
     return res.changes > 0;
   }
@@ -1208,6 +1383,185 @@ class Store {
       throw new Error(`workflow not found after archive: ${workflow.id}`);
     return archived;
   }
+  createWorkflowInvocation(input) {
+    const now = nowIso();
+    const sourceDedupeKey = input.sourceRef.dedupeKey ?? undefined;
+    if (sourceDedupeKey) {
+      const existing = this.db.query("SELECT * FROM workflow_invocations WHERE source_kind = ? AND source_dedupe_key = ? LIMIT 1").get(input.sourceRef.kind, sourceDedupeKey);
+      if (existing)
+        return rowToWorkflowInvocation(existing);
+    }
+    const id = input.id ?? genId();
+    this.db.query(`INSERT INTO workflow_invocations (id, workflow_id, template_id, source_kind, source_id, source_dedupe_key,
+          source_json, subject_kind, subject_id, subject_path, subject_url, subject_json, intent, scope_json,
+          output_policy_json, created_at, updated_at)
+         VALUES ($id, $workflowId, $templateId, $sourceKind, $sourceId, $sourceDedupeKey, $sourceJson,
+          $subjectKind, $subjectId, $subjectPath, $subjectUrl, $subjectJson, $intent, $scopeJson,
+          $outputPolicyJson, $created, $updated)`).run({
+      $id: id,
+      $workflowId: input.workflowId ?? null,
+      $templateId: input.templateId ?? null,
+      $sourceKind: input.sourceRef.kind,
+      $sourceId: input.sourceRef.id ?? null,
+      $sourceDedupeKey: sourceDedupeKey ?? null,
+      $sourceJson: JSON.stringify(input.sourceRef),
+      $subjectKind: input.subjectRef.kind,
+      $subjectId: input.subjectRef.id ?? null,
+      $subjectPath: input.subjectRef.path ?? null,
+      $subjectUrl: input.subjectRef.url ?? null,
+      $subjectJson: JSON.stringify(input.subjectRef),
+      $intent: input.intent,
+      $scopeJson: input.scope ? JSON.stringify(input.scope) : null,
+      $outputPolicyJson: input.outputPolicy ? JSON.stringify(input.outputPolicy) : null,
+      $created: now,
+      $updated: now
+    });
+    const row = this.db.query("SELECT * FROM workflow_invocations WHERE id = ?").get(id);
+    if (!row)
+      throw new Error(`workflow invocation not found after create: ${id}`);
+    return rowToWorkflowInvocation(row);
+  }
+  getWorkflowInvocation(id) {
+    const row = this.db.query("SELECT * FROM workflow_invocations WHERE id = ?").get(id);
+    return row ? rowToWorkflowInvocation(row) : undefined;
+  }
+  listWorkflowInvocations(opts = {}) {
+    const rows = this.db.query("SELECT * FROM workflow_invocations ORDER BY created_at DESC LIMIT ?").all(opts.limit ?? 100);
+    return rows.map(rowToWorkflowInvocation);
+  }
+  upsertWorkflowWorkItem(input) {
+    const now = nowIso();
+    const id = genId();
+    const status = input.status ?? "queued";
+    this.db.query(`INSERT INTO workflow_work_items (id, route_key, idempotency_key, invocation_id, source_type, source_ref,
+          subject_ref, project_key, project_group, priority, status, attempts, next_attempt_at, lease_expires_at,
+          workflow_id, loop_id, workflow_run_id, last_reason, created_at, updated_at)
+         VALUES ($id, $routeKey, $idempotencyKey, $invocationId, $sourceType, $sourceRef, $subjectRef,
+          $projectKey, $projectGroup, $priority, $status, 0, $nextAttemptAt, NULL, NULL, NULL, NULL,
+          $lastReason, $created, $updated)
+         ON CONFLICT(route_key, idempotency_key) DO UPDATE SET
+          invocation_id=excluded.invocation_id,
+          source_type=excluded.source_type,
+          source_ref=excluded.source_ref,
+          subject_ref=excluded.subject_ref,
+          project_key=excluded.project_key,
+          project_group=excluded.project_group,
+          priority=excluded.priority,
+          status=CASE
+            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running')
+              THEN workflow_work_items.status
+            ELSE excluded.status
+          END,
+          workflow_id=CASE
+            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running') THEN workflow_work_items.workflow_id
+            ELSE NULL
+          END,
+          loop_id=CASE
+            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running') THEN workflow_work_items.loop_id
+            ELSE NULL
+          END,
+          workflow_run_id=CASE
+            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running') THEN workflow_work_items.workflow_run_id
+            ELSE NULL
+          END,
+          lease_expires_at=CASE
+            WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running') THEN workflow_work_items.lease_expires_at
+            ELSE NULL
+          END,
+          next_attempt_at=excluded.next_attempt_at,
+          last_reason=COALESCE(excluded.last_reason, workflow_work_items.last_reason),
+          updated_at=excluded.updated_at`).run({
+      $id: id,
+      $routeKey: input.routeKey,
+      $idempotencyKey: input.idempotencyKey,
+      $invocationId: input.invocationId,
+      $sourceType: input.sourceType,
+      $sourceRef: input.sourceRef,
+      $subjectRef: input.subjectRef,
+      $projectKey: input.projectKey ?? null,
+      $projectGroup: input.projectGroup ?? null,
+      $priority: input.priority ?? 0,
+      $status: status,
+      $nextAttemptAt: input.nextAttemptAt ?? null,
+      $lastReason: input.lastReason ?? null,
+      $created: now,
+      $updated: now
+    });
+    const row = this.db.query("SELECT * FROM workflow_work_items WHERE route_key = ? AND idempotency_key = ? LIMIT 1").get(input.routeKey, input.idempotencyKey);
+    if (!row)
+      throw new Error(`workflow work item not found after upsert: ${input.routeKey}/${input.idempotencyKey}`);
+    return rowToWorkflowWorkItem(row);
+  }
+  getWorkflowWorkItem(id) {
+    const row = this.db.query("SELECT * FROM workflow_work_items WHERE id = ?").get(id);
+    return row ? rowToWorkflowWorkItem(row) : undefined;
+  }
+  findWorkflowWorkItem(routeKey, idempotencyKey) {
+    const row = this.db.query("SELECT * FROM workflow_work_items WHERE route_key = ? AND idempotency_key = ? LIMIT 1").get(routeKey, idempotencyKey);
+    return row ? rowToWorkflowWorkItem(row) : undefined;
+  }
+  listWorkflowWorkItems(opts = {}) {
+    const limit = opts.limit ?? 100;
+    let rows;
+    if (opts.status && opts.routeKey) {
+      rows = this.db.query("SELECT * FROM workflow_work_items WHERE route_key = ? AND status = ? ORDER BY priority DESC, created_at ASC LIMIT ?").all(opts.routeKey, opts.status, limit);
+    } else if (opts.status) {
+      rows = this.db.query("SELECT * FROM workflow_work_items WHERE status = ? ORDER BY priority DESC, created_at ASC LIMIT ?").all(opts.status, limit);
+    } else if (opts.routeKey) {
+      rows = this.db.query("SELECT * FROM workflow_work_items WHERE route_key = ? ORDER BY created_at DESC LIMIT ?").all(opts.routeKey, limit);
+    } else {
+      rows = this.db.query("SELECT * FROM workflow_work_items ORDER BY created_at DESC LIMIT ?").all(limit);
+    }
+    return rows.map(rowToWorkflowWorkItem);
+  }
+  countActiveWorkflowWorkItems(args = {}) {
+    const active = ["admitted", "running"];
+    const placeholders = active.map(() => "?").join(",");
+    const global = this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders})`).get(...active)?.count ?? 0;
+    const project = args.projectKey ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND project_key = ?`).get(...active, args.projectKey)?.count ?? 0 : 0;
+    const projectGroup = args.projectGroup ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND project_group = ?`).get(...active, args.projectGroup)?.count ?? 0 : undefined;
+    return { global, project, ...projectGroup !== undefined ? { projectGroup } : {} };
+  }
+  admitWorkflowWorkItem(id, patch) {
+    const now = nowIso();
+    const res = this.db.query(`UPDATE workflow_work_items
+         SET status='admitted', attempts=attempts + 1, workflow_id=$workflowId, loop_id=$loopId,
+          next_attempt_at=NULL, lease_expires_at=NULL, last_reason=$reason, updated_at=$updated
+         WHERE id=$id AND status IN ('queued', 'deferred')`).run({
+      $id: id,
+      $workflowId: patch.workflowId,
+      $loopId: patch.loopId,
+      $reason: patch.reason ?? null,
+      $updated: now
+    });
+    const item = this.getWorkflowWorkItem(id);
+    if (!item)
+      throw new Error(`workflow work item not found after admit: ${id}`);
+    if (res.changes !== 1)
+      throw new Error(`workflow work item is not claimable: ${id} status=${item.status}`);
+    return item;
+  }
+  setWorkflowWorkItemsForLoop(loopId, status, reason, updated, statuses = ["admitted", "running"]) {
+    const placeholders = statuses.map(() => "?").join(",");
+    this.db.query(`UPDATE workflow_work_items
+         SET status=?, lease_expires_at=NULL, last_reason=COALESCE(?, last_reason), updated_at=?
+         WHERE loop_id = ? AND status IN (${placeholders})`).run(status, reason ?? null, updated, loopId, ...statuses);
+  }
+  setWorkflowWorkItemsForWorkflowRun(workflowRunId, status, reason, updated, statuses = ["admitted", "running"]) {
+    const placeholders = statuses.map(() => "?").join(",");
+    this.db.query(`UPDATE workflow_work_items
+         SET status=?, lease_expires_at=NULL, last_reason=COALESCE(?, last_reason), updated_at=?
+         WHERE workflow_run_id = ? AND status IN (${placeholders})`).run(status, reason ?? null, updated, workflowRunId, ...statuses);
+  }
+  setWorkflowWorkItemsForLoopRun(run, reason, updated) {
+    const loop = this.getLoop(run.loopId);
+    const status = workItemStatusForLoopRun(run.status, run.attempt, loop?.maxAttempts);
+    if (!status)
+      return;
+    const statuses = status === "admitted" ? ["admitted", "running", "failed"] : ["admitted", "running"];
+    const nextReason = status === "admitted" ? reason ? `attempt failed; retry pending: ${reason}` : "attempt failed; retry pending" : reason;
+    this.setWorkflowWorkItemsForLoop(run.loopId, status, nextReason, updated, statuses);
+  }
   createGoal(input, opts = {}) {
     const now = nowIso();
     this.db.exec("BEGIN IMMEDIATE");
@@ -1481,6 +1835,10 @@ class Store {
   }
   createWorkflowRun(input) {
     const now = nowIso();
+    const targetInput = input.loop?.target.type === "workflow" ? input.loop.target.input : undefined;
+    const invocationId = input.invocationId ?? targetInput?.workflowInvocationId ?? targetInput?.invocationId;
+    const workItemId = input.workItemId ?? targetInput?.workflowWorkItemId ?? targetInput?.workItemId;
+    let manifestPath;
     if (input.idempotencyKey) {
       const existing = this.db.query("SELECT * FROM workflow_runs WHERE workflow_id = ? AND idempotency_key = ? LIMIT 1").get(input.workflow.id, input.idempotencyKey);
       if (existing) {
@@ -1499,21 +1857,59 @@ class Store {
         }
       }
       const runId = genId();
-      this.db.query(`INSERT INTO workflow_runs (id, workflow_id, workflow_name, loop_id, loop_run_id, scheduled_for, idempotency_key,
-            status, started_at, finished_at, duration_ms, error, created_at, updated_at)
-           VALUES ($id, $workflowId, $workflowName, $loopId, $loopRunId, $scheduledFor, $idempotencyKey,
-            'running', $started, NULL, NULL, NULL, $created, $updated)`).run({
+      const workItem = workItemId ? this.getWorkflowWorkItem(workItemId) : undefined;
+      const invocation = invocationId ? this.getWorkflowInvocation(invocationId) : undefined;
+      manifestPath = invocation || workItem ? writeWorkflowRunManifest({
+        loopsDataDir: this.rootDir,
+        workflowRunId: runId,
+        workflowId: input.workflow.id,
+        workflowName: input.workflow.name,
+        invocationId,
+        workItemId,
+        projectKey: workItem?.projectKey ?? invocation?.scope?.projectPath,
+        subjectKind: invocation?.subjectRef.kind,
+        rawSubjectRef: workItem?.subjectRef ?? invocation?.subjectRef.path ?? invocation?.subjectRef.id ?? invocation?.subjectRef.url,
+        payload: {
+          workflowInvocation: invocation,
+          workflowWorkItem: workItem,
+          loopId: input.loop?.id,
+          loopRunId: input.loopRun?.id,
+          scheduledFor: input.scheduledFor ?? input.loopRun?.scheduledFor
+        }
+      }) : undefined;
+      this.db.query(`INSERT INTO workflow_runs (id, workflow_id, workflow_name, loop_id, loop_run_id, invocation_id, work_item_id,
+            scheduled_for, idempotency_key, manifest_path, status, started_at, finished_at, duration_ms, error,
+            created_at, updated_at)
+           VALUES ($id, $workflowId, $workflowName, $loopId, $loopRunId, $invocationId, $workItemId, $scheduledFor,
+            $idempotencyKey, $manifestPath, 'running', $started, NULL, NULL, NULL, $created, $updated)`).run({
         $id: runId,
         $workflowId: input.workflow.id,
         $workflowName: input.workflow.name,
         $loopId: input.loop?.id ?? null,
         $loopRunId: input.loopRun?.id ?? null,
+        $invocationId: invocationId ?? null,
+        $workItemId: workItemId ?? null,
         $scheduledFor: input.scheduledFor ?? input.loopRun?.scheduledFor ?? null,
         $idempotencyKey: input.idempotencyKey ?? null,
+        $manifestPath: manifestPath ?? null,
         $started: now,
         $created: now,
         $updated: now
       });
+      if (workItemId) {
+        const workItemRes = this.db.query(`UPDATE workflow_work_items
+             SET status='running', workflow_run_id=$workflowRunId, lease_expires_at=$leaseExpiresAt, updated_at=$updated
+             WHERE id=$id AND status IN ('admitted', 'queued', 'deferred', 'running')`).run({
+          $id: workItemId,
+          $workflowRunId: runId,
+          $leaseExpiresAt: input.loop ? new Date(Date.now() + input.loop.leaseMs).toISOString() : null,
+          $updated: now
+        });
+        if (workItemRes.changes !== 1) {
+          const current = this.getWorkflowWorkItem(workItemId);
+          throw new Error(`workflow work item is not runnable: ${workItemId}${current ? ` status=${current.status}` : ""}`);
+        }
+      }
       input.workflow.steps.forEach((step, sequence) => {
         const account = step.account ?? step.target.account;
         this.db.query(`INSERT INTO workflow_step_runs (id, workflow_run_id, step_id, sequence, status, started_at, finished_at,
@@ -1539,7 +1935,10 @@ class Store {
           workflowName: input.workflow.name,
           stepCount: input.workflow.steps.length,
           loopId: input.loop?.id,
-          loopRunId: input.loopRun?.id
+          loopRunId: input.loopRun?.id,
+          invocationId,
+          workItemId,
+          manifestPath
         }),
         $created: now
       });
@@ -1552,6 +1951,8 @@ class Store {
       try {
         this.db.exec("ROLLBACK");
       } catch {}
+      if (manifestPath)
+        rmSync(manifestPath, { force: true });
       throw error;
     }
   }
@@ -1764,6 +2165,10 @@ class Store {
       changed = res.changes === 1;
       if (changed)
         this.appendWorkflowEvent(workflowRunId, status, undefined, { error: patch.error });
+      if (changed) {
+        const itemStatus = status === "succeeded" ? "succeeded" : status === "cancelled" ? "cancelled" : "failed";
+        this.setWorkflowWorkItemsForWorkflowRun(workflowRunId, itemStatus, patch.error, finishedAt);
+      }
       this.db.exec("COMMIT");
     } catch (error) {
       try {
@@ -1788,6 +2193,7 @@ class Store {
         this.db.query(`UPDATE workflow_step_runs
              SET status='cancelled', finished_at=$finished, pid=NULL, error=$reason, updated_at=$updated
              WHERE workflow_run_id=$workflowRunId AND status IN ('pending', 'running')`).run({ $workflowRunId: workflowRunId, $finished: now, $reason: reason, $updated: now });
+        this.setWorkflowWorkItemsForWorkflowRun(workflowRunId, "cancelled", reason, now);
         this.appendWorkflowEvent(workflowRunId, "cancelled", undefined, { reason });
       }
       this.db.exec("COMMIT");
@@ -2041,6 +2447,8 @@ class Store {
       throw new Error(`run not found after finalize: ${id}`);
     if (opts.claimedBy && res.changes !== 1)
       return run;
+    if (res.changes === 1)
+      this.setWorkflowWorkItemsForLoopRun(run, patch.error, finishedAt);
     return run;
   }
   heartbeatRunLease(id, claimedBy, leaseMs, now = new Date, opts = {}) {
@@ -2134,6 +2542,14 @@ class Store {
             error: "parent loop run lease expired before completion",
             loopRunId: row.id
           });
+          this.setWorkflowWorkItemsForWorkflowRun(workflowRow.id, "failed", "parent loop run lease expired before completion", finished);
+        }
+        const loop = this.getLoop(row.loop_id);
+        const itemStatus = workItemStatusForLoopRun("abandoned", row.attempt, loop?.maxAttempts);
+        if (itemStatus) {
+          const statuses = itemStatus === "admitted" ? ["admitted", "running", "failed"] : ["admitted", "running"];
+          const reason = itemStatus === "admitted" ? "run lease expired before completion; retry pending" : "run lease expired before completion";
+          this.setWorkflowWorkItemsForLoop(row.loop_id, itemStatus, reason, finished, statuses);
         }
         this.db.exec("COMMIT");
       } catch (error) {

package/dist/lib/templates.d.ts

@@ -2,6 +2,13 @@ import type { AccountRef, AgentPermissionMode, AgentProvider, AgentSandbox, Agen
 export declare const TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID = "todos-task-worker-verifier";
 export declare const EVENT_WORKER_VERIFIER_TEMPLATE_ID = "event-worker-verifier";
 export declare const BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID = "bounded-agent-worker-verifier";
+export declare const TASK_LIFECYCLE_TEMPLATE_ID = "task-lifecycle";
+export declare const PR_REVIEW_TEMPLATE_ID = "pr-review";
+export declare const SCHEDULED_AUDIT_TEMPLATE_ID = "scheduled-audit";
+export declare const KNOWLEDGE_REFRESH_TEMPLATE_ID = "knowledge-refresh";
+export declare const REPORT_ONLY_TEMPLATE_ID = "report-only";
+export declare const INCIDENT_RESPONSE_TEMPLATE_ID = "incident-response";
+export declare const DETERMINISTIC_CHECK_CREATE_TASK_TEMPLATE_ID = "deterministic-check-create-task";
 export interface TodosTaskWorkflowTemplateInput {
     taskId: string;
     taskTitle?: string;
@@ -23,6 +30,7 @@ export interface TodosTaskWorkflowTemplateInput {
     agent?: string;
     permissionMode?: AgentPermissionMode;
     sandbox?: AgentSandbox;
+    manualBreakGlass?: boolean;
     worktreeMode?: AgentWorktreeMode;
     worktreeRoot?: string;
     worktreeBranchPrefix?: string;
@@ -53,6 +61,7 @@ export interface EventWorkflowTemplateInput {
     agent?: string;
     permissionMode?: AgentPermissionMode;
     sandbox?: AgentSandbox;
+    manualBreakGlass?: boolean;
     worktreeMode?: AgentWorktreeMode;
     worktreeRoot?: string;
     worktreeBranchPrefix?: string;
@@ -78,6 +87,7 @@ export interface BoundedAgentWorkflowTemplateInput {
     agent?: string;
     permissionMode?: AgentPermissionMode;
     sandbox?: AgentSandbox;
+    manualBreakGlass?: boolean;
     worktreeMode?: AgentWorktreeMode;
     worktreeRoot?: string;
     worktreeBranchPrefix?: string;

package/dist/sdk/index.d.ts

@@ -1,4 +1,4 @@
-import type { CreateLoopInput, Goal, GoalRun, Loop, LoopRun } from "../types.js";
+import type { CreateLoopInput, Goal, GoalRun, Loop, LoopRun, OpenAutomationsRuntimeBinding } from "../types.js";
 import { tick } from "../lib/scheduler.js";
 import { Store } from "../lib/store.js";
 export { runGoal } from "../lib/goal/runner.js";
@@ -30,3 +30,4 @@ export declare class LoopsClient {
     close(): void;
 }
 export declare function loops(opts?: LoopsClientOptions): LoopsClient;
+export declare function openAutomationsRuntimeBinding(overrides?: Partial<OpenAutomationsRuntimeBinding>): OpenAutomationsRuntimeBinding;