@hasna/loops 0.3.43 → 0.3.45

package/README.md

@@ -224,7 +224,9 @@ loops templates render todos-task-worker-verifier \
   --var projectPath=/path/to/repo \
   --var provider=codewith \
   --var authProfilePool=account004,account005,account006 \
-  --var sandbox=workspace-write
+  --var sandbox=workspace-write \
+  --var todosProjectPath=$HOME/.hasna/loops \
+  --var addDirs=$HOME/.hasna/todos,$HOME/.hasna/loops
 loops templates create-workflow todos-task-worker-verifier \
   --var taskId=<task-id> \
   --var projectPath=/path/to/repo
@@ -260,6 +262,8 @@ cat task-created-event.json | loops events handle todos-task \
   --auth-profile-pool account004,account005,account006 \
   --permission-mode bypass \
   --sandbox workspace-write \
+  --todos-project "$HOME/.hasna/loops" \
+  --add-dir "$HOME/.hasna/todos,$HOME/.hasna/loops" \
   --worktree-mode required
 ```
 
@@ -290,6 +294,13 @@ is requested without `manualBreakGlass=true`. Use `workspace-write` for
 unattended task/event routes. Full access is an explicit manual emergency path,
 not a default automation mode.
 
+When a sandboxed Codewith/Codex worker must update app stores outside the repo
+worktree, pass those stores explicitly with `--add-dir` or template `addDirs`.
+For task-created routes, pass `--todos-project` so worker/verifier prompts use
+the actual todos storage project while repo routing and worktree isolation still
+use the repository path. This avoids `danger-full-access` for normal todos
+comments, completion state, and loop evidence writes.
+
 Inspect route state with:
 
 ```bash
@@ -484,10 +495,10 @@ On Linux this writes a user systemd service. On macOS it writes a LaunchAgent pl
 The adapters intentionally use provider command surfaces instead of pretending every agent has one SDK:
 
 - Claude uses `claude -p --output-format json` and safe-mode/local setting sources by default.
-- Codewith uses `codewith --ask-for-approval never exec --json --ephemeral --skip-git-repo-check`.
+- Codewith uses `codewith --ask-for-approval never exec --json --ephemeral --skip-git-repo-check`, with `--add-dir` for explicit extra writable directories.
 - AI Copilot and OpenCode use `run --format json --pure`.
 - Cursor is CLI-first for now via `cursor agent -p`, with `agent -p` as the fallback launcher on machines that expose the standalone Cursor Agent binary; treat output as less stable until a stronger public SDK contract is selected.
-- Codex uses `codex exec --json --ephemeral --ask-for-approval never`.
+- Codex uses `codex exec --json --ephemeral --skip-git-repo-check`, with `--add-dir` for explicit extra writable directories where supported.
 - Agent prompts are sent through child stdin instead of argv so prompt bodies do not appear in process listings.
 - When `--account` or a step `account` is set, OpenLoops resolves `accounts env <profile> --tool <tool>` before spawning the target, strips inherited tool home/API-key variables, and applies the selected profile only to that process. Missing account profiles fail before the provider binary receives the prompt.
 - `--auth-profile` and step `authProfile` are provider-native auth selectors. They currently apply to Codewith and are passed to Codewith as `--auth-profile <name>` before `exec`; they do not call OpenAccounts.

package/dist/cli/index.js

@@ -3,7 +3,7 @@
 
 // src/lib/store.ts
 import { Database } from "bun:sqlite";
-import { mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "fs";
+import { chmodSync, existsSync, mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "fs";
 import { tmpdir } from "os";
 import { dirname, join as join3 } from "path";
 
@@ -388,6 +388,7 @@ function validateTarget(value, label) {
     }
     if (value.variant !== undefined)
       assertString(value.variant, `${label}.variant`);
+    optionalStringArray(value.addDirs, `${label}.addDirs`);
     if (value.permissionMode !== undefined) {
       assertString(value.permissionMode, `${label}.permissionMode`);
       const permissionModes = ["default", "plan", "auto", "bypass"];
@@ -824,6 +825,20 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
   }
   return;
 }
+function chmodIfExists(path, mode) {
+  try {
+    if (existsSync(path))
+      chmodSync(path, mode);
+  } catch {}
+}
+function ensurePrivateStorePath(file) {
+  const dir = dirname(file);
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  chmodIfExists(dir, 448);
+  chmodIfExists(file, 384);
+  chmodIfExists(`${file}-wal`, 384);
+  chmodIfExists(`${file}-shm`, 384);
+}
 
 class Store {
   db;
@@ -831,11 +846,13 @@ class Store {
   constructor(path) {
     const file = path ?? dbPath();
     if (file !== ":memory:")
-      mkdirSync3(dirname(file), { recursive: true, mode: 448 });
+      ensurePrivateStorePath(file);
     this.rootDir = file === ":memory:" ? mkdtempSync(join3(tmpdir(), "open-loops-store-")) : dirname(file);
     this.db = new Database(file);
     this.db.exec("PRAGMA busy_timeout = 5000;");
     this.db.exec("PRAGMA journal_mode = WAL;");
+    if (file !== ":memory:")
+      ensurePrivateStorePath(file);
     this.migrate();
   }
   migrate() {
@@ -2661,7 +2678,7 @@ class Store {
 
 // src/cli/index.ts
 import { createHash as createHash3, randomUUID } from "crypto";
-import { closeSync, existsSync as existsSync4, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync2, realpathSync, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { closeSync, existsSync as existsSync5, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync2, realpathSync, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { spawnSync as spawnSync5 } from "child_process";
 import { join as join6, resolve as resolve2 } from "path";
 import { tmpdir as tmpdir2 } from "os";
@@ -2791,7 +2808,7 @@ import { resolveMachineCommand } from "@hasna/machines/consumer";
 
 // src/lib/accounts.ts
 import { spawnSync } from "child_process";
-import { existsSync } from "fs";
+import { existsSync as existsSync2 } from "fs";
 var EXPORT_RE = /^export\s+([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
 function accountToolForProvider(provider) {
   switch (provider) {
@@ -2876,7 +2893,7 @@ function resolveAccountEnv(account, toolHint, env) {
   const profileDir = (accountDirEnvVar(tool) ? accountEnv[accountDirEnvVar(tool)] : undefined) ?? primaryAccountDir(result.stdout);
   if (!profileDir)
     throw new Error(`accounts env returned no profile directory for ${account.profile}/${tool}`);
-  if (!existsSync(profileDir))
+  if (!existsSync2(profileDir))
     throw new Error(`account profile directory does not exist for ${account.profile}/${tool}: ${profileDir}`);
   return {
     ...accountEnv,
@@ -3231,6 +3248,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       if (target.agent)
@@ -3240,11 +3259,13 @@ function agentArgs(target) {
     case "codex":
       if (target.variant)
         args.push("-c", `model_reasoning_effort=${configStringValue(target.variant)}`);
-      args.push("exec", "--json", "--ephemeral", "--ask-for-approval", "never", "--sandbox", codewithLikeSandbox(target));
+      args.push("exec", "--json", "--ephemeral", "--sandbox", codewithLikeSandbox(target), "--skip-git-repo-check");
       if (isolation === "safe")
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
@@ -4762,7 +4783,7 @@ async function tick(deps) {
 }
 
 // src/daemon/control.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync4, readFileSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2 } from "path";
 
@@ -4790,7 +4811,7 @@ async function runLoop(opts) {
 
 // src/daemon/control.ts
 function readPid(path = pidFilePath()) {
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return;
   try {
     const pid = Number(readFileSync(path, "utf8").trim());
@@ -5063,7 +5084,7 @@ async function startDaemon(opts) {
 }
 
 // src/daemon/install.ts
-import { chmodSync, mkdirSync as mkdirSync5, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync5, writeFileSync as writeFileSync3 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
 import { dirname as dirname3 } from "path";
 function installStartup(cliEntry, execPath = process.execPath, args = ["daemon", "run"]) {
@@ -5122,7 +5143,7 @@ ${args.map((arg) => `    <string>${arg}</string>`).join(`
 </dict>
 </plist>
 `);
-    chmodSync(path, 384);
+    chmodSync2(path, 384);
     return {
       platform: process.platform,
       path,
@@ -5716,7 +5737,7 @@ function buildScriptInventoryReport(store, opts = {}) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.43",
+  version: "0.3.45",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -5806,7 +5827,7 @@ function packageVersion() {
 
 // src/lib/templates.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 import { homedir as homedir3 } from "os";
 import { basename as basename3, isAbsolute, join as join5, relative, resolve } from "path";
 var TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID = "todos-task-worker-verifier";
@@ -5829,6 +5850,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "taskId", required: true, description: "Todos task id to execute." },
       { name: "taskTitle", description: "Human-readable task title." },
       { name: "projectPath", required: true, description: "Repository or project working directory." },
+      { name: "todosProjectPath", description: "Todos storage project path used in worker/verifier commands." },
       { name: "routeProjectPath", description: "Canonical project path used for scheduler concurrency limits." },
       { name: "projectGroup", description: "Optional project group used for scheduler concurrency limits." },
       { name: "provider", default: "codewith", description: "Agent provider: codewith, claude, cursor, opencode, aicopilot, or codex." },
@@ -5839,6 +5861,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles; worker/verifier are selected deterministically." },
       { name: "model", description: "Provider model." },
       { name: "variant", description: "Provider reasoning/model effort variant." },
+      { name: "addDirs", description: "Comma-separated additional writable directories for provider sandboxes." },
       { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
@@ -5868,6 +5891,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles; worker/verifier are selected deterministically." },
       { name: "model", description: "Provider model." },
       { name: "variant", description: "Provider reasoning/model effort variant." },
+      { name: "addDirs", description: "Comma-separated additional writable directories for provider sandboxes." },
       { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
@@ -6066,7 +6090,7 @@ function defaultWorktreeRoot(root) {
   return join5(homedir3(), ".hasna", "loops", "worktrees");
 }
 function gitRootFor(path) {
-  if (!existsSync3(path))
+  if (!existsSync4(path))
     return;
   try {
     return execFileSync("git", ["-C", path, "rev-parse", "--show-toplevel"], {
@@ -6248,6 +6272,7 @@ function agentTarget(input, prompt, role, seed, plan) {
     model: input.model,
     variant: input.variant,
     agent: input.agent,
+    addDirs: input.addDirs,
     authProfile: provider === "codewith" ? authProfileForRole(input, role, seed) : undefined,
     configIsolation: "safe",
     permissionMode: input.permissionMode ?? "bypass",
@@ -6291,7 +6316,7 @@ function renderTodosTaskWorkerVerifierWorkflow(input) {
     throw new Error("taskId is required");
   if (!input.projectPath?.trim())
     throw new Error("projectPath is required");
-  const todosProjectPath = input.routeProjectPath ?? input.projectPath;
+  const todosProjectPath = input.todosProjectPath ?? input.routeProjectPath ?? input.projectPath;
   const plan = worktreePlan(input, input.taskId);
   const taskContext = {
     taskId: input.taskId,
@@ -6525,8 +6550,9 @@ function renderLifecycleBoundedTemplate(id, values) {
     model: values.model,
     variant: values.variant,
     agent: values.agent,
+    addDirs: listVar(values.addDirs ?? values.addDir),
     permissionMode: values.permissionMode,
-    sandbox: values.sandbox,
+    sandbox: values.sandbox ?? (id === REPORT_ONLY_TEMPLATE_ID ? "read-only" : undefined),
     manualBreakGlass: booleanVar(values.manualBreakGlass),
     worktreeMode: values.worktreeMode ?? (id === REPORT_ONLY_TEMPLATE_ID ? "main" : "required"),
     worktreeRoot: values.worktreeRoot,
@@ -6641,6 +6667,7 @@ function renderLoopTemplate(id, values) {
       taskTitle: values.taskTitle,
       taskDescription: values.taskDescription,
       projectPath: values.projectPath ?? values.cwd ?? process.cwd(),
+      todosProjectPath: values.todosProjectPath ?? values.todosProject,
       routeProjectPath: values.routeProjectPath,
       projectGroup: values.projectGroup,
       provider: values.provider,
@@ -6653,6 +6680,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -6684,6 +6712,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -6710,6 +6739,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -6922,6 +6952,10 @@ function allowlistFromOpts(opts) {
     enforcement: "metadata_only"
   };
 }
+function listFromRepeatedOpts(value) {
+  const values = (value ?? []).flatMap((entry) => splitList(entry) ?? []);
+  return values.length ? values : undefined;
+}
 function accountPoolFromOpts(opts) {
   return splitList(opts.accountPool)?.map((profile) => ({ profile, tool: opts.accountTool }));
 }
@@ -7026,7 +7060,7 @@ function routeCursorsPath() {
 }
 function readRouteCursors() {
   const path = routeCursorsPath();
-  if (!existsSync4(path))
+  if (!existsSync5(path))
     return {};
   try {
     const parsed = JSON.parse(readFileSync2(path, "utf8"));
@@ -7525,6 +7559,7 @@ function routeTodosTaskEvent(event, opts) {
     model: opts.model,
     variant: opts.variant,
     agent: opts.agent,
+    addDirs: listFromRepeatedOpts(opts.addDir),
     permissionMode,
     sandbox,
     manualBreakGlass: Boolean(opts.manualBreakGlass),
@@ -7532,7 +7567,8 @@ function routeTodosTaskEvent(event, opts) {
     worktreeRoot: opts.worktreeRoot,
     worktreeBranchPrefix: opts.worktreeBranchPrefix ?? "openloops",
     eventId: event.id,
-    eventType: event.type
+    eventType: event.type,
+    todosProjectPath: opts.todosProject
   });
   workflowBody.name = workflowName;
   workflowBody.description = `Task-triggered worker/verifier workflow for ${taskTitle ?? taskId} from ${event.source}/${event.type}; ` + `idempotency=${idempotencyKey}; event=${event.id}; project=${projectPath}; projectGroup=${projectGroup ?? "-"}`;
@@ -7737,6 +7773,7 @@ function routeGenericEvent(event, opts) {
     model: opts.model,
     variant: opts.variant,
     agent: opts.agent,
+    addDirs: listFromRepeatedOpts(opts.addDir),
     permissionMode,
     sandbox,
     manualBreakGlass: Boolean(opts.manualBreakGlass),
@@ -8099,7 +8136,7 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
     store.close();
   }
 });
-addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").requiredOption("--prompt <prompt>", "agent prompt").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--timeout <duration>", "run timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass").option("--sandbox <mode>", "provider sandbox: codewith/codex use read-only/workspace-write/danger-full-access; cursor uses enabled/disabled").option("--allow-tool <name>", "advisory per-session tool allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--allow-command <name>", "advisory per-session command allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--config-isolation <mode>", "safe or none", "safe").option("--preflight-each-run", "check provider/account readiness before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
+addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").requiredOption("--prompt <prompt>", "agent prompt").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "run timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass").option("--sandbox <mode>", "provider sandbox: codewith/codex use read-only/workspace-write/danger-full-access; cursor uses enabled/disabled").option("--allow-tool <name>", "advisory per-session tool allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--allow-command <name>", "advisory per-session command allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--config-isolation <mode>", "safe or none", "safe").option("--preflight-each-run", "check provider/account readiness before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
   const provider = opts.provider;
   if (!["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"].includes(provider)) {
     throw new Error("unsupported provider");
@@ -8118,6 +8155,7 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
       variant: opts.variant,
       agent: opts.agent,
       authProfile: providerAuthProfileFromOpts(opts, provider),
+      addDirs: listFromRepeatedOpts(opts.addDir),
       timeoutMs: opts.timeout ? parseDuration(opts.timeout) : undefined,
       configIsolation: opts.configIsolation,
       permissionMode: permissionModeFromOpts(opts, provider),
@@ -8158,10 +8196,10 @@ var events = program.command("events").description("handle Hasna event envelopes
 var machines = program.command("machines").description("inspect OpenMachines topology for loop assignment");
 var goal = program.command("goal").description("inspect goal runs");
 function addRouteEventOptions(command) {
-  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
+  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
 }
 function addTodosDrainOptions(command) {
-  return command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing workflow loops").option("--dry-run", "preview selected tasks and generated workflow loops without storing anything");
+  return command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing workflow loops").option("--dry-run", "preview selected tasks and generated workflow loops without storing anything");
 }
 function routeEventByKind(kind, event, opts) {
   if (kind === "todos-task")
@@ -8203,6 +8241,8 @@ function routeDrainArgs(opts) {
   add("--model", opts.model);
   add("--variant", opts.variant);
   add("--agent", opts.agent);
+  for (const dir of listFromRepeatedOpts(opts.addDir) ?? [])
+    add("--add-dir", dir);
   add("--permission-mode", opts.permissionMode);
   add("--sandbox", opts.sandbox);
   addBool("--manual-break-glass", opts.manualBreakGlass);
@@ -8421,13 +8461,13 @@ addScheduleOptions(addTodosDrainOptions(routes.command("schedule <kind> <name>")
   }
 });
 var eventsHandle = events.command("handle").description("handle a Hasna event envelope");
-eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
+eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
   const event = await readEventEnvelopeFromStdin();
   const result = routeTodosTaskEvent(event, opts);
   print(result.value, result.human);
 });
 var eventsDrain = events.command("drain").description("drain durable source queues into bounded OpenLoops workflows");
-eventsDrain.command("todos-task").description("drain ready todos tasks into bounded worker/verifier workflow loops").option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing workflow loops").option("--dry-run", "preview selected tasks and generated workflow loops without storing anything").action((opts) => {
+eventsDrain.command("todos-task").description("drain ready todos tasks into bounded worker/verifier workflow loops").option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing workflow loops").option("--dry-run", "preview selected tasks and generated workflow loops without storing anything").action((opts) => {
   const maxDispatch = positiveInteger(opts.maxDispatch ?? "1", "--max-dispatch") ?? 1;
   const todosProject = opts.todosProject ?? defaultLoopsProject();
   const requiredTags = splitList(opts.tags ?? opts.tag) ?? [];
@@ -8511,7 +8551,7 @@ eventsDrain.command("todos-task").description("drain ready todos tasks into boun
   } : { ...report, evidencePath };
   print(output, `drained todos ready queue: considered=${report.considered} created=${report.created} deduped=${report.deduped} throttled=${report.throttled} skipped=${report.skipped}`);
 });
-eventsHandle.command("generic").description("create a one-shot worker/verifier workflow loop for any Hasna event").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated event worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:generic").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
+eventsHandle.command("generic").description("create a one-shot worker/verifier workflow loop for any Hasna event").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated event worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:generic").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
   const event = await readEventEnvelopeFromStdin();
   const data = eventData(event);
   const metadata = eventMetadata(event);
@@ -9538,7 +9578,7 @@ ${result.instructions.join(`
 });
 daemon.command("logs").option("-n, --lines <n>", "lines", "80").action((opts) => {
   const path = daemonLogPath();
-  if (!existsSync4(path)) {
+  if (!existsSync5(path)) {
     console.log("");
     return;
   }

package/dist/daemon/index.js

@@ -3,7 +3,7 @@
 
 // src/lib/store.ts
 import { Database } from "bun:sqlite";
-import { mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "fs";
+import { chmodSync, existsSync, mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "fs";
 import { tmpdir } from "os";
 import { dirname, join as join3 } from "path";
 
@@ -388,6 +388,7 @@ function validateTarget(value, label) {
     }
     if (value.variant !== undefined)
       assertString(value.variant, `${label}.variant`);
+    optionalStringArray(value.addDirs, `${label}.addDirs`);
     if (value.permissionMode !== undefined) {
       assertString(value.permissionMode, `${label}.permissionMode`);
       const permissionModes = ["default", "plan", "auto", "bypass"];
@@ -824,6 +825,20 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
   }
   return;
 }
+function chmodIfExists(path, mode) {
+  try {
+    if (existsSync(path))
+      chmodSync(path, mode);
+  } catch {}
+}
+function ensurePrivateStorePath(file) {
+  const dir = dirname(file);
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  chmodIfExists(dir, 448);
+  chmodIfExists(file, 384);
+  chmodIfExists(`${file}-wal`, 384);
+  chmodIfExists(`${file}-shm`, 384);
+}
 
 class Store {
   db;
@@ -831,11 +846,13 @@ class Store {
   constructor(path) {
     const file = path ?? dbPath();
     if (file !== ":memory:")
-      mkdirSync3(dirname(file), { recursive: true, mode: 448 });
+      ensurePrivateStorePath(file);
     this.rootDir = file === ":memory:" ? mkdtempSync(join3(tmpdir(), "open-loops-store-")) : dirname(file);
     this.db = new Database(file);
     this.db.exec("PRAGMA busy_timeout = 5000;");
     this.db.exec("PRAGMA journal_mode = WAL;");
+    if (file !== ":memory:")
+      ensurePrivateStorePath(file);
     this.migrate();
   }
   migrate() {
@@ -2675,7 +2692,7 @@ import { resolveMachineCommand } from "@hasna/machines/consumer";
 
 // src/lib/accounts.ts
 import { spawnSync } from "child_process";
-import { existsSync } from "fs";
+import { existsSync as existsSync2 } from "fs";
 var EXPORT_RE = /^export\s+([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
 function accountToolForProvider(provider) {
   switch (provider) {
@@ -2760,7 +2777,7 @@ function resolveAccountEnv(account, toolHint, env) {
   const profileDir = (accountDirEnvVar(tool) ? accountEnv[accountDirEnvVar(tool)] : undefined) ?? primaryAccountDir(result.stdout);
   if (!profileDir)
     throw new Error(`accounts env returned no profile directory for ${account.profile}/${tool}`);
-  if (!existsSync(profileDir))
+  if (!existsSync2(profileDir))
     throw new Error(`account profile directory does not exist for ${account.profile}/${tool}: ${profileDir}`);
   return {
     ...accountEnv,
@@ -3115,6 +3132,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       if (target.agent)
@@ -3124,11 +3143,13 @@ function agentArgs(target) {
     case "codex":
       if (target.variant)
         args.push("-c", `model_reasoning_effort=${configStringValue(target.variant)}`);
-      args.push("exec", "--json", "--ephemeral", "--ask-for-approval", "never", "--sandbox", codewithLikeSandbox(target));
+      args.push("exec", "--json", "--ephemeral", "--sandbox", codewithLikeSandbox(target), "--skip-git-repo-check");
       if (isolation === "safe")
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
@@ -4646,7 +4667,7 @@ async function tick(deps) {
 }
 
 // src/daemon/control.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync4, readFileSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2 } from "path";
 
@@ -4674,7 +4695,7 @@ async function runLoop(opts) {
 
 // src/daemon/control.ts
 function readPid(path = pidFilePath()) {
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return;
   try {
     const pid = Number(readFileSync(path, "utf8").trim());
@@ -4944,7 +4965,7 @@ async function startDaemon(opts) {
 }
 
 // src/daemon/install.ts
-import { chmodSync, mkdirSync as mkdirSync5, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync5, writeFileSync as writeFileSync3 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
 import { dirname as dirname3 } from "path";
 function installStartup(cliEntry, execPath = process.execPath, args = ["daemon", "run"]) {
@@ -5003,7 +5024,7 @@ ${args.map((arg) => `    <string>${arg}</string>`).join(`
 </dict>
 </plist>
 `);
-    chmodSync(path, 384);
+    chmodSync2(path, 384);
     return {
       platform: process.platform,
       path,
@@ -5030,7 +5051,7 @@ function enableStartup(result) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.43",
+  version: "0.3.45",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/index.js

@@ -1,7 +1,7 @@
 // @bun
 // src/lib/store.ts
 import { Database } from "bun:sqlite";
-import { mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "fs";
+import { chmodSync, existsSync, mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "fs";
 import { tmpdir } from "os";
 import { dirname, join as join3 } from "path";
 
@@ -386,6 +386,7 @@ function validateTarget(value, label) {
     }
     if (value.variant !== undefined)
       assertString(value.variant, `${label}.variant`);
+    optionalStringArray(value.addDirs, `${label}.addDirs`);
     if (value.permissionMode !== undefined) {
       assertString(value.permissionMode, `${label}.permissionMode`);
       const permissionModes = ["default", "plan", "auto", "bypass"];
@@ -822,6 +823,20 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
   }
   return;
 }
+function chmodIfExists(path, mode) {
+  try {
+    if (existsSync(path))
+      chmodSync(path, mode);
+  } catch {}
+}
+function ensurePrivateStorePath(file) {
+  const dir = dirname(file);
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  chmodIfExists(dir, 448);
+  chmodIfExists(file, 384);
+  chmodIfExists(`${file}-wal`, 384);
+  chmodIfExists(`${file}-shm`, 384);
+}
 
 class Store {
   db;
@@ -829,11 +844,13 @@ class Store {
   constructor(path) {
     const file = path ?? dbPath();
     if (file !== ":memory:")
-      mkdirSync3(dirname(file), { recursive: true, mode: 448 });
+      ensurePrivateStorePath(file);
     this.rootDir = file === ":memory:" ? mkdtempSync(join3(tmpdir(), "open-loops-store-")) : dirname(file);
     this.db = new Database(file);
     this.db.exec("PRAGMA busy_timeout = 5000;");
     this.db.exec("PRAGMA journal_mode = WAL;");
+    if (file !== ":memory:")
+      ensurePrivateStorePath(file);
     this.migrate();
   }
   migrate() {
@@ -2665,7 +2682,7 @@ import { resolveMachineCommand } from "@hasna/machines/consumer";
 
 // src/lib/accounts.ts
 import { spawnSync } from "child_process";
-import { existsSync } from "fs";
+import { existsSync as existsSync2 } from "fs";
 var EXPORT_RE = /^export\s+([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
 function accountToolForProvider(provider) {
   switch (provider) {
@@ -2750,7 +2767,7 @@ function resolveAccountEnv(account, toolHint, env) {
   const profileDir = (accountDirEnvVar(tool) ? accountEnv[accountDirEnvVar(tool)] : undefined) ?? primaryAccountDir(result.stdout);
   if (!profileDir)
     throw new Error(`accounts env returned no profile directory for ${account.profile}/${tool}`);
-  if (!existsSync(profileDir))
+  if (!existsSync2(profileDir))
     throw new Error(`account profile directory does not exist for ${account.profile}/${tool}: ${profileDir}`);
   return {
     ...accountEnv,
@@ -3105,6 +3122,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       if (target.agent)
@@ -3114,11 +3133,13 @@ function agentArgs(target) {
     case "codex":
       if (target.variant)
         args.push("-c", `model_reasoning_effort=${configStringValue(target.variant)}`);
-      args.push("exec", "--json", "--ephemeral", "--ask-for-approval", "never", "--sandbox", codewithLikeSandbox(target));
+      args.push("exec", "--json", "--ephemeral", "--sandbox", codewithLikeSandbox(target), "--skip-git-repo-check");
       if (isolation === "safe")
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
@@ -4767,7 +4788,7 @@ function openAutomationsRuntimeBinding(overrides = {}) {
 }
 // src/lib/templates.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { basename as basename2, isAbsolute, join as join5, relative, resolve } from "path";
 var TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID = "todos-task-worker-verifier";
@@ -4790,6 +4811,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "taskId", required: true, description: "Todos task id to execute." },
       { name: "taskTitle", description: "Human-readable task title." },
       { name: "projectPath", required: true, description: "Repository or project working directory." },
+      { name: "todosProjectPath", description: "Todos storage project path used in worker/verifier commands." },
       { name: "routeProjectPath", description: "Canonical project path used for scheduler concurrency limits." },
       { name: "projectGroup", description: "Optional project group used for scheduler concurrency limits." },
       { name: "provider", default: "codewith", description: "Agent provider: codewith, claude, cursor, opencode, aicopilot, or codex." },
@@ -4800,6 +4822,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles; worker/verifier are selected deterministically." },
       { name: "model", description: "Provider model." },
       { name: "variant", description: "Provider reasoning/model effort variant." },
+      { name: "addDirs", description: "Comma-separated additional writable directories for provider sandboxes." },
       { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
@@ -4829,6 +4852,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles; worker/verifier are selected deterministically." },
       { name: "model", description: "Provider model." },
       { name: "variant", description: "Provider reasoning/model effort variant." },
+      { name: "addDirs", description: "Comma-separated additional writable directories for provider sandboxes." },
       { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
@@ -5027,7 +5051,7 @@ function defaultWorktreeRoot(root) {
   return join5(homedir3(), ".hasna", "loops", "worktrees");
 }
 function gitRootFor(path) {
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return;
   try {
     return execFileSync("git", ["-C", path, "rev-parse", "--show-toplevel"], {
@@ -5209,6 +5233,7 @@ function agentTarget(input, prompt, role, seed, plan) {
     model: input.model,
     variant: input.variant,
     agent: input.agent,
+    addDirs: input.addDirs,
     authProfile: provider === "codewith" ? authProfileForRole(input, role, seed) : undefined,
     configIsolation: "safe",
     permissionMode: input.permissionMode ?? "bypass",
@@ -5252,7 +5277,7 @@ function renderTodosTaskWorkerVerifierWorkflow(input) {
     throw new Error("taskId is required");
   if (!input.projectPath?.trim())
     throw new Error("projectPath is required");
-  const todosProjectPath = input.routeProjectPath ?? input.projectPath;
+  const todosProjectPath = input.todosProjectPath ?? input.routeProjectPath ?? input.projectPath;
   const plan = worktreePlan(input, input.taskId);
   const taskContext = {
     taskId: input.taskId,
@@ -5486,8 +5511,9 @@ function renderLifecycleBoundedTemplate(id, values) {
     model: values.model,
     variant: values.variant,
     agent: values.agent,
+    addDirs: listVar(values.addDirs ?? values.addDir),
     permissionMode: values.permissionMode,
-    sandbox: values.sandbox,
+    sandbox: values.sandbox ?? (id === REPORT_ONLY_TEMPLATE_ID ? "read-only" : undefined),
     manualBreakGlass: booleanVar(values.manualBreakGlass),
     worktreeMode: values.worktreeMode ?? (id === REPORT_ONLY_TEMPLATE_ID ? "main" : "required"),
     worktreeRoot: values.worktreeRoot,
@@ -5602,6 +5628,7 @@ function renderLoopTemplate(id, values) {
       taskTitle: values.taskTitle,
       taskDescription: values.taskDescription,
       projectPath: values.projectPath ?? values.cwd ?? process.cwd(),
+      todosProjectPath: values.todosProjectPath ?? values.todosProject,
       routeProjectPath: values.routeProjectPath,
       projectGroup: values.projectGroup,
       provider: values.provider,
@@ -5614,6 +5641,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -5645,6 +5673,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -5671,6 +5700,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -5704,7 +5734,7 @@ import { spawnSync as spawnSync3 } from "child_process";
 import { accessSync as accessSync2, constants as constants2 } from "fs";
 
 // src/daemon/control.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2 } from "path";
 
@@ -5732,7 +5762,7 @@ async function runLoop(opts) {
 
 // src/daemon/control.ts
 function readPid(path = pidFilePath()) {
-  if (!existsSync3(path))
+  if (!existsSync4(path))
     return;
   try {
     const pid = Number(readFileSync(path, "utf8").trim());

package/dist/lib/store.js

@@ -1,7 +1,7 @@
 // @bun
 // src/lib/store.ts
 import { Database } from "bun:sqlite";
-import { mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "fs";
+import { chmodSync, existsSync, mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "fs";
 import { tmpdir } from "os";
 import { dirname, join as join3 } from "path";
 
@@ -386,6 +386,7 @@ function validateTarget(value, label) {
     }
     if (value.variant !== undefined)
       assertString(value.variant, `${label}.variant`);
+    optionalStringArray(value.addDirs, `${label}.addDirs`);
     if (value.permissionMode !== undefined) {
       assertString(value.permissionMode, `${label}.permissionMode`);
       const permissionModes = ["default", "plan", "auto", "bypass"];
@@ -822,6 +823,20 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
   }
   return;
 }
+function chmodIfExists(path, mode) {
+  try {
+    if (existsSync(path))
+      chmodSync(path, mode);
+  } catch {}
+}
+function ensurePrivateStorePath(file) {
+  const dir = dirname(file);
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  chmodIfExists(dir, 448);
+  chmodIfExists(file, 384);
+  chmodIfExists(`${file}-wal`, 384);
+  chmodIfExists(`${file}-shm`, 384);
+}
 
 class Store {
   db;
@@ -829,11 +844,13 @@ class Store {
   constructor(path) {
     const file = path ?? dbPath();
     if (file !== ":memory:")
-      mkdirSync3(dirname(file), { recursive: true, mode: 448 });
+      ensurePrivateStorePath(file);
     this.rootDir = file === ":memory:" ? mkdtempSync(join3(tmpdir(), "open-loops-store-")) : dirname(file);
     this.db = new Database(file);
     this.db.exec("PRAGMA busy_timeout = 5000;");
     this.db.exec("PRAGMA journal_mode = WAL;");
+    if (file !== ":memory:")
+      ensurePrivateStorePath(file);
     this.migrate();
   }
   migrate() {

package/dist/lib/templates.d.ts

@@ -14,6 +14,7 @@ export interface TodosTaskWorkflowTemplateInput {
     taskTitle?: string;
     taskDescription?: string;
     projectPath: string;
+    todosProjectPath?: string;
     routeProjectPath?: string;
     projectGroup?: string;
     provider?: AgentProvider;
@@ -28,6 +29,7 @@ export interface TodosTaskWorkflowTemplateInput {
     model?: string;
     variant?: string;
     agent?: string;
+    addDirs?: string[];
     permissionMode?: AgentPermissionMode;
     sandbox?: AgentSandbox;
     manualBreakGlass?: boolean;
@@ -59,6 +61,7 @@ export interface EventWorkflowTemplateInput {
     model?: string;
     variant?: string;
     agent?: string;
+    addDirs?: string[];
     permissionMode?: AgentPermissionMode;
     sandbox?: AgentSandbox;
     manualBreakGlass?: boolean;
@@ -85,6 +88,7 @@ export interface BoundedAgentWorkflowTemplateInput {
     model?: string;
     variant?: string;
     agent?: string;
+    addDirs?: string[];
     permissionMode?: AgentPermissionMode;
     sandbox?: AgentSandbox;
     manualBreakGlass?: boolean;

package/dist/sdk/index.js

@@ -1,7 +1,7 @@
 // @bun
 // src/lib/store.ts
 import { Database } from "bun:sqlite";
-import { mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "fs";
+import { chmodSync, existsSync, mkdirSync as mkdirSync3, mkdtempSync, rmSync } from "fs";
 import { tmpdir } from "os";
 import { dirname, join as join3 } from "path";
 
@@ -386,6 +386,7 @@ function validateTarget(value, label) {
     }
     if (value.variant !== undefined)
       assertString(value.variant, `${label}.variant`);
+    optionalStringArray(value.addDirs, `${label}.addDirs`);
     if (value.permissionMode !== undefined) {
       assertString(value.permissionMode, `${label}.permissionMode`);
       const permissionModes = ["default", "plan", "auto", "bypass"];
@@ -822,6 +823,20 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
   }
   return;
 }
+function chmodIfExists(path, mode) {
+  try {
+    if (existsSync(path))
+      chmodSync(path, mode);
+  } catch {}
+}
+function ensurePrivateStorePath(file) {
+  const dir = dirname(file);
+  mkdirSync3(dir, { recursive: true, mode: 448 });
+  chmodIfExists(dir, 448);
+  chmodIfExists(file, 384);
+  chmodIfExists(`${file}-wal`, 384);
+  chmodIfExists(`${file}-shm`, 384);
+}
 
 class Store {
   db;
@@ -829,11 +844,13 @@ class Store {
   constructor(path) {
     const file = path ?? dbPath();
     if (file !== ":memory:")
-      mkdirSync3(dirname(file), { recursive: true, mode: 448 });
+      ensurePrivateStorePath(file);
     this.rootDir = file === ":memory:" ? mkdtempSync(join3(tmpdir(), "open-loops-store-")) : dirname(file);
     this.db = new Database(file);
     this.db.exec("PRAGMA busy_timeout = 5000;");
     this.db.exec("PRAGMA journal_mode = WAL;");
+    if (file !== ":memory:")
+      ensurePrivateStorePath(file);
     this.migrate();
   }
   migrate() {
@@ -2665,7 +2682,7 @@ import { resolveMachineCommand } from "@hasna/machines/consumer";
 
 // src/lib/accounts.ts
 import { spawnSync } from "child_process";
-import { existsSync } from "fs";
+import { existsSync as existsSync2 } from "fs";
 var EXPORT_RE = /^export\s+([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
 function accountToolForProvider(provider) {
   switch (provider) {
@@ -2750,7 +2767,7 @@ function resolveAccountEnv(account, toolHint, env) {
   const profileDir = (accountDirEnvVar(tool) ? accountEnv[accountDirEnvVar(tool)] : undefined) ?? primaryAccountDir(result.stdout);
   if (!profileDir)
     throw new Error(`accounts env returned no profile directory for ${account.profile}/${tool}`);
-  if (!existsSync(profileDir))
+  if (!existsSync2(profileDir))
     throw new Error(`account profile directory does not exist for ${account.profile}/${tool}: ${profileDir}`);
   return {
     ...accountEnv,
@@ -3105,6 +3122,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       if (target.agent)
@@ -3114,11 +3133,13 @@ function agentArgs(target) {
     case "codex":
       if (target.variant)
         args.push("-c", `model_reasoning_effort=${configStringValue(target.variant)}`);
-      args.push("exec", "--json", "--ephemeral", "--ask-for-approval", "never", "--sandbox", codewithLikeSandbox(target));
+      args.push("exec", "--json", "--ephemeral", "--sandbox", codewithLikeSandbox(target), "--skip-git-repo-check");
       if (isolation === "safe")
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);

package/dist/types.d.ts

@@ -114,6 +114,7 @@ export interface AgentTarget {
     agent?: string;
     authProfile?: string;
     extraArgs?: string[];
+    addDirs?: string[];
     timeoutMs?: number;
     idleTimeoutMs?: number;
     configIsolation?: AgentConfigIsolation;

package/docs/USAGE.md

@@ -228,7 +228,9 @@ loops templates render todos-task-worker-verifier \
   --var projectPath=/path/to/repo \
   --var provider=codewith \
   --var authProfilePool=account004,account005,account006 \
-  --var sandbox=workspace-write
+  --var sandbox=workspace-write \
+  --var todosProjectPath=$HOME/.hasna/loops \
+  --var addDirs=$HOME/.hasna/todos,$HOME/.hasna/loops
 loops templates create-workflow todos-task-worker-verifier \
   --var taskId=<task-id> \
   --var projectPath=/path/to/repo
@@ -286,6 +288,8 @@ cat task-created-event.json | loops events handle todos-task \
   --auth-profile-pool account004,account005,account006 \
   --permission-mode bypass \
   --sandbox workspace-write \
+  --todos-project "$HOME/.hasna/loops" \
+  --add-dir "$HOME/.hasna/todos,$HOME/.hasna/loops" \
   --worktree-mode required
 ```
 
@@ -322,6 +326,13 @@ idempotency key before rendering worktree plans or checking route limits. In
 dry-run mode, throttle counts are not evaluated because opening the live loop
 store can create or migrate the local database.
 
+When a sandboxed Codewith/Codex worker must update app stores outside the repo
+worktree, pass those stores explicitly with `--add-dir` or template `addDirs`.
+For task-created routes, pass `--todos-project` so worker/verifier prompts use
+the actual todos storage project while route concurrency and worktree isolation
+still use the repository path. This avoids `danger-full-access` for normal
+todos comments, completion state, and loop evidence writes.
+
 Inspect route state with:
 
 ```bash
@@ -351,12 +362,13 @@ locks, or non-pending states stay queued in todos and are not routed:
 
 ```bash
 loops events drain todos-task \
-  --todos-project /home/hasna/.hasna/loops \
+  --todos-project "$HOME/.hasna/loops" \
   --task-list repoops-pr-queue \
   --tags auto:route \
-  --project-path-prefix /home/hasna/workspace/hasna/opensource \
+  --project-path-prefix "$HOME/workspace/hasna/opensource" \
   --provider codewith \
   --auth-profile-pool account004,account005,account006 \
+  --add-dir "$HOME/.hasna/todos,$HOME/.hasna/loops" \
   --project-group oss \
   --max-dispatch 2 \
   --scan-limit 500 \
@@ -364,7 +376,7 @@ loops events drain todos-task \
   --max-active-per-project-group 4 \
   --max-active 12 \
   --worktree-mode required \
-  --evidence-dir /home/hasna/.hasna/loops/reports/task-drain
+  --evidence-dir "$HOME/.hasna/loops/reports/task-drain"
 ```
 
 `--max-dispatch` caps new workflow-loop creation per drain run. `--limit` caps
@@ -562,10 +574,10 @@ On Linux this writes a user systemd service. On macOS it writes a LaunchAgent pl
 The adapters intentionally use provider command surfaces instead of pretending every agent has one SDK:
 
 - Claude uses `claude -p --output-format json` and safe-mode/local setting sources by default.
-- Codewith uses `codewith --ask-for-approval never exec --json --ephemeral --skip-git-repo-check`.
+- Codewith uses `codewith --ask-for-approval never exec --json --ephemeral --skip-git-repo-check`, with `--add-dir` for explicit extra writable directories.
 - AI Copilot and OpenCode use `run --format json --pure`.
 - Cursor is CLI-first for now via `cursor agent -p`, with `agent -p` as the fallback launcher on machines that expose the standalone Cursor Agent binary; treat output as less stable until a stronger public SDK contract is selected.
-- Codex uses `codex exec --json --ephemeral --ask-for-approval never`.
+- Codex uses `codex exec --json --ephemeral --skip-git-repo-check`, with `--add-dir` for explicit extra writable directories where supported.
 - Agent prompts are sent through child stdin instead of argv so prompt bodies do not appear in process listings.
 - When `--account` or a step `account` is set, OpenLoops resolves `accounts env <profile> --tool <tool>` before spawning the target, strips inherited tool home/API-key variables, and applies the selected profile only to that process. Missing account profiles fail before the provider binary receives the prompt.
 - `--auth-profile` and step `authProfile` are provider-native auth selectors. They currently apply to Codewith and are passed to Codewith as `--auth-profile <name>` before `exec`; they do not call OpenAccounts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/loops",
-  "version": "0.3.43",
+  "version": "0.3.45",
   "description": "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   "type": "module",
   "main": "dist/index.js",