@hasna/loops 0.3.44 → 0.3.46

package/README.md

@@ -224,7 +224,9 @@ loops templates render todos-task-worker-verifier \
   --var projectPath=/path/to/repo \
   --var provider=codewith \
   --var authProfilePool=account004,account005,account006 \
-  --var sandbox=workspace-write
+  --var sandbox=workspace-write \
+  --var todosProjectPath=$HOME/.hasna/loops \
+  --var addDirs=$HOME/.hasna/todos,$HOME/.hasna/loops
 loops templates create-workflow todos-task-worker-verifier \
   --var taskId=<task-id> \
   --var projectPath=/path/to/repo
@@ -260,6 +262,8 @@ cat task-created-event.json | loops events handle todos-task \
   --auth-profile-pool account004,account005,account006 \
   --permission-mode bypass \
   --sandbox workspace-write \
+  --todos-project "$HOME/.hasna/loops" \
+  --add-dir "$HOME/.hasna/todos,$HOME/.hasna/loops" \
   --worktree-mode required
 ```
 
@@ -290,6 +294,15 @@ is requested without `manualBreakGlass=true`. Use `workspace-write` for
 unattended task/event routes. Full access is an explicit manual emergency path,
 not a default automation mode.
 
+When a sandboxed Codewith/Codex worker must update app stores outside the repo
+worktree, pass those stores explicitly with `--add-dir` or template `addDirs`.
+For task-created routes, pass `--todos-project` so worker/verifier prompts use
+the actual todos storage project while repo routing and worktree isolation still
+use the repository path. This avoids `danger-full-access` for normal todos
+comments, completion state, and loop evidence writes. `addDirs` is intentionally
+accepted only for Codewith/Codex until other providers expose equivalent
+directory-scoped write controls.
+
 Inspect route state with:
 
 ```bash
@@ -484,10 +497,10 @@ On Linux this writes a user systemd service. On macOS it writes a LaunchAgent pl
 The adapters intentionally use provider command surfaces instead of pretending every agent has one SDK:
 
 - Claude uses `claude -p --output-format json` and safe-mode/local setting sources by default.
-- Codewith uses `codewith --ask-for-approval never exec --json --ephemeral --skip-git-repo-check`.
+- Codewith uses `codewith --ask-for-approval never exec --json --ephemeral --skip-git-repo-check`, with `--add-dir` for explicit extra writable directories.
 - AI Copilot and OpenCode use `run --format json --pure`.
-- Cursor is CLI-first for now via `cursor agent -p`, with `agent -p` as the fallback launcher on machines that expose the standalone Cursor Agent binary; treat output as less stable until a stronger public SDK contract is selected.
-- Codex uses `codex exec --json --ephemeral --ask-for-approval never`.
+- Cursor is CLI-first for now via standalone `agent -p` when available, with `cursor agent -p` as a compatibility fallback; treat output as less stable until a stronger public SDK contract is selected.
+- Codex uses `codex exec --json --ephemeral --skip-git-repo-check`, with `--add-dir` for explicit extra writable directories where supported.
 - Agent prompts are sent through child stdin instead of argv so prompt bodies do not appear in process listings.
 - When `--account` or a step `account` is set, OpenLoops resolves `accounts env <profile> --tool <tool>` before spawning the target, strips inherited tool home/API-key variables, and applies the selected profile only to that process. Missing account profiles fail before the provider binary receives the prompt.
 - `--auth-profile` and step `authProfile` are provider-native auth selectors. They currently apply to Codewith and are passed to Codewith as `--auth-profile <name>` before `exec`; they do not call OpenAccounts.

package/dist/cli/index.js

@@ -388,6 +388,10 @@ function validateTarget(value, label) {
     }
     if (value.variant !== undefined)
       assertString(value.variant, `${label}.variant`);
+    optionalStringArray(value.addDirs, `${label}.addDirs`);
+    if (Array.isArray(value.addDirs) && value.addDirs.length > 0 && !["codewith", "codex"].includes(value.provider)) {
+      throw new Error(`${label}.addDirs is currently supported only for provider codewith or codex`);
+    }
     if (value.permissionMode !== undefined) {
       assertString(value.permissionMode, `${label}.permissionMode`);
       const permissionModes = ["default", "plan", "auto", "bypass"];
@@ -3153,6 +3157,9 @@ function assertSupportedAgentOptions(target) {
   if (target.authProfile !== undefined && target.provider !== "codewith") {
     throw new Error(`${target.provider}.authProfile is supported only for codewith`);
   }
+  if (target.addDirs?.length && !["codewith", "codex"].includes(target.provider)) {
+    throw new Error(`${target.provider}.addDirs is currently supported only for codewith or codex`);
+  }
   if (target.permissionMode && !["default", "plan", "auto", "bypass"].includes(target.permissionMode)) {
     throw new Error(`${target.provider}.permissionMode must be default, plan, auto, or bypass`);
   }
@@ -3212,10 +3219,10 @@ function agentArgs(target) {
     case "cursor":
       args.push("-c", [
         "set -eu",
-        "if command -v cursor >/dev/null 2>&1; then",
-        '  exec cursor agent "$@"',
-        "elif command -v agent >/dev/null 2>&1; then",
+        "if command -v agent >/dev/null 2>&1; then",
         '  exec agent "$@"',
+        "elif command -v cursor >/dev/null 2>&1; then",
+        '  exec cursor agent "$@"',
         "else",
         "  echo 'Executable not found in PATH: cursor agent or agent' >&2",
         "  exit 127",
@@ -3247,6 +3254,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       if (target.agent)
@@ -3261,6 +3270,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
@@ -5732,7 +5743,7 @@ function buildScriptInventoryReport(store, opts = {}) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.44",
+  version: "0.3.46",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -5845,6 +5856,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "taskId", required: true, description: "Todos task id to execute." },
       { name: "taskTitle", description: "Human-readable task title." },
       { name: "projectPath", required: true, description: "Repository or project working directory." },
+      { name: "todosProjectPath", description: "Todos storage project path used in worker/verifier commands." },
       { name: "routeProjectPath", description: "Canonical project path used for scheduler concurrency limits." },
       { name: "projectGroup", description: "Optional project group used for scheduler concurrency limits." },
       { name: "provider", default: "codewith", description: "Agent provider: codewith, claude, cursor, opencode, aicopilot, or codex." },
@@ -5855,6 +5867,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles; worker/verifier are selected deterministically." },
       { name: "model", description: "Provider model." },
       { name: "variant", description: "Provider reasoning/model effort variant." },
+      { name: "addDirs", description: "Comma-separated additional writable directories for provider sandboxes." },
       { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
@@ -5884,6 +5897,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles; worker/verifier are selected deterministically." },
       { name: "model", description: "Provider model." },
       { name: "variant", description: "Provider reasoning/model effort variant." },
+      { name: "addDirs", description: "Comma-separated additional writable directories for provider sandboxes." },
       { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
@@ -6264,6 +6278,7 @@ function agentTarget(input, prompt, role, seed, plan) {
     model: input.model,
     variant: input.variant,
     agent: input.agent,
+    addDirs: input.addDirs,
     authProfile: provider === "codewith" ? authProfileForRole(input, role, seed) : undefined,
     configIsolation: "safe",
     permissionMode: input.permissionMode ?? "bypass",
@@ -6307,7 +6322,7 @@ function renderTodosTaskWorkerVerifierWorkflow(input) {
     throw new Error("taskId is required");
   if (!input.projectPath?.trim())
     throw new Error("projectPath is required");
-  const todosProjectPath = input.routeProjectPath ?? input.projectPath;
+  const todosProjectPath = input.todosProjectPath ?? input.routeProjectPath ?? input.projectPath;
   const plan = worktreePlan(input, input.taskId);
   const taskContext = {
     taskId: input.taskId,
@@ -6541,6 +6556,7 @@ function renderLifecycleBoundedTemplate(id, values) {
     model: values.model,
     variant: values.variant,
     agent: values.agent,
+    addDirs: listVar(values.addDirs ?? values.addDir),
     permissionMode: values.permissionMode,
     sandbox: values.sandbox ?? (id === REPORT_ONLY_TEMPLATE_ID ? "read-only" : undefined),
     manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -6657,6 +6673,7 @@ function renderLoopTemplate(id, values) {
       taskTitle: values.taskTitle,
       taskDescription: values.taskDescription,
       projectPath: values.projectPath ?? values.cwd ?? process.cwd(),
+      todosProjectPath: values.todosProjectPath ?? values.todosProject,
       routeProjectPath: values.routeProjectPath,
       projectGroup: values.projectGroup,
       provider: values.provider,
@@ -6669,6 +6686,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -6700,6 +6718,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -6726,6 +6745,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -6938,6 +6958,10 @@ function allowlistFromOpts(opts) {
     enforcement: "metadata_only"
   };
 }
+function listFromRepeatedOpts(value) {
+  const values = (value ?? []).flatMap((entry) => splitList(entry) ?? []);
+  return values.length ? values : undefined;
+}
 function accountPoolFromOpts(opts) {
   return splitList(opts.accountPool)?.map((profile) => ({ profile, tool: opts.accountTool }));
 }
@@ -7541,6 +7565,7 @@ function routeTodosTaskEvent(event, opts) {
     model: opts.model,
     variant: opts.variant,
     agent: opts.agent,
+    addDirs: listFromRepeatedOpts(opts.addDir),
     permissionMode,
     sandbox,
     manualBreakGlass: Boolean(opts.manualBreakGlass),
@@ -7548,7 +7573,8 @@ function routeTodosTaskEvent(event, opts) {
     worktreeRoot: opts.worktreeRoot,
     worktreeBranchPrefix: opts.worktreeBranchPrefix ?? "openloops",
     eventId: event.id,
-    eventType: event.type
+    eventType: event.type,
+    todosProjectPath: opts.todosProject
   });
   workflowBody.name = workflowName;
   workflowBody.description = `Task-triggered worker/verifier workflow for ${taskTitle ?? taskId} from ${event.source}/${event.type}; ` + `idempotency=${idempotencyKey}; event=${event.id}; project=${projectPath}; projectGroup=${projectGroup ?? "-"}`;
@@ -7753,6 +7779,7 @@ function routeGenericEvent(event, opts) {
     model: opts.model,
     variant: opts.variant,
     agent: opts.agent,
+    addDirs: listFromRepeatedOpts(opts.addDir),
     permissionMode,
     sandbox,
     manualBreakGlass: Boolean(opts.manualBreakGlass),
@@ -8115,7 +8142,7 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
     store.close();
   }
 });
-addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").requiredOption("--prompt <prompt>", "agent prompt").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--timeout <duration>", "run timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass").option("--sandbox <mode>", "provider sandbox: codewith/codex use read-only/workspace-write/danger-full-access; cursor uses enabled/disabled").option("--allow-tool <name>", "advisory per-session tool allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--allow-command <name>", "advisory per-session command allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--config-isolation <mode>", "safe or none", "safe").option("--preflight-each-run", "check provider/account readiness before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
+addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").requiredOption("--prompt <prompt>", "agent prompt").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "run timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass").option("--sandbox <mode>", "provider sandbox: codewith/codex use read-only/workspace-write/danger-full-access; cursor uses enabled/disabled").option("--allow-tool <name>", "advisory per-session tool allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--allow-command <name>", "advisory per-session command allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--config-isolation <mode>", "safe or none", "safe").option("--preflight-each-run", "check provider/account readiness before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
   const provider = opts.provider;
   if (!["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"].includes(provider)) {
     throw new Error("unsupported provider");
@@ -8134,6 +8161,7 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
       variant: opts.variant,
       agent: opts.agent,
       authProfile: providerAuthProfileFromOpts(opts, provider),
+      addDirs: listFromRepeatedOpts(opts.addDir),
       timeoutMs: opts.timeout ? parseDuration(opts.timeout) : undefined,
       configIsolation: opts.configIsolation,
       permissionMode: permissionModeFromOpts(opts, provider),
@@ -8174,10 +8202,10 @@ var events = program.command("events").description("handle Hasna event envelopes
 var machines = program.command("machines").description("inspect OpenMachines topology for loop assignment");
 var goal = program.command("goal").description("inspect goal runs");
 function addRouteEventOptions(command) {
-  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
+  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
 }
 function addTodosDrainOptions(command) {
-  return command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing workflow loops").option("--dry-run", "preview selected tasks and generated workflow loops without storing anything");
+  return command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing workflow loops").option("--dry-run", "preview selected tasks and generated workflow loops without storing anything");
 }
 function routeEventByKind(kind, event, opts) {
   if (kind === "todos-task")
@@ -8219,6 +8247,8 @@ function routeDrainArgs(opts) {
   add("--model", opts.model);
   add("--variant", opts.variant);
   add("--agent", opts.agent);
+  for (const dir of listFromRepeatedOpts(opts.addDir) ?? [])
+    add("--add-dir", dir);
   add("--permission-mode", opts.permissionMode);
   add("--sandbox", opts.sandbox);
   addBool("--manual-break-glass", opts.manualBreakGlass);
@@ -8437,13 +8467,13 @@ addScheduleOptions(addTodosDrainOptions(routes.command("schedule <kind> <name>")
   }
 });
 var eventsHandle = events.command("handle").description("handle a Hasna event envelope");
-eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
+eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
   const event = await readEventEnvelopeFromStdin();
   const result = routeTodosTaskEvent(event, opts);
   print(result.value, result.human);
 });
 var eventsDrain = events.command("drain").description("drain durable source queues into bounded OpenLoops workflows");
-eventsDrain.command("todos-task").description("drain ready todos tasks into bounded worker/verifier workflow loops").option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing workflow loops").option("--dry-run", "preview selected tasks and generated workflow loops without storing anything").action((opts) => {
+eventsDrain.command("todos-task").description("drain ready todos tasks into bounded worker/verifier workflow loops").option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing workflow loops").option("--dry-run", "preview selected tasks and generated workflow loops without storing anything").action((opts) => {
   const maxDispatch = positiveInteger(opts.maxDispatch ?? "1", "--max-dispatch") ?? 1;
   const todosProject = opts.todosProject ?? defaultLoopsProject();
   const requiredTags = splitList(opts.tags ?? opts.tag) ?? [];
@@ -8527,7 +8557,7 @@ eventsDrain.command("todos-task").description("drain ready todos tasks into boun
   } : { ...report, evidencePath };
   print(output, `drained todos ready queue: considered=${report.considered} created=${report.created} deduped=${report.deduped} throttled=${report.throttled} skipped=${report.skipped}`);
 });
-eventsHandle.command("generic").description("create a one-shot worker/verifier workflow loop for any Hasna event").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated event worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:generic").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
+eventsHandle.command("generic").description("create a one-shot worker/verifier workflow loop for any Hasna event").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated event worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:generic").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
   const event = await readEventEnvelopeFromStdin();
   const data = eventData(event);
   const metadata = eventMetadata(event);
@@ -8569,6 +8599,7 @@ eventsHandle.command("generic").description("create a one-shot worker/verifier w
     model: opts.model,
     variant: opts.variant,
     agent: opts.agent,
+    addDirs: listFromRepeatedOpts(opts.addDir),
     permissionMode,
     sandbox,
     manualBreakGlass: Boolean(opts.manualBreakGlass),

package/dist/daemon/index.js

@@ -388,6 +388,10 @@ function validateTarget(value, label) {
     }
     if (value.variant !== undefined)
       assertString(value.variant, `${label}.variant`);
+    optionalStringArray(value.addDirs, `${label}.addDirs`);
+    if (Array.isArray(value.addDirs) && value.addDirs.length > 0 && !["codewith", "codex"].includes(value.provider)) {
+      throw new Error(`${label}.addDirs is currently supported only for provider codewith or codex`);
+    }
     if (value.permissionMode !== undefined) {
       assertString(value.permissionMode, `${label}.permissionMode`);
       const permissionModes = ["default", "plan", "auto", "bypass"];
@@ -3037,6 +3041,9 @@ function assertSupportedAgentOptions(target) {
   if (target.authProfile !== undefined && target.provider !== "codewith") {
     throw new Error(`${target.provider}.authProfile is supported only for codewith`);
   }
+  if (target.addDirs?.length && !["codewith", "codex"].includes(target.provider)) {
+    throw new Error(`${target.provider}.addDirs is currently supported only for codewith or codex`);
+  }
   if (target.permissionMode && !["default", "plan", "auto", "bypass"].includes(target.permissionMode)) {
     throw new Error(`${target.provider}.permissionMode must be default, plan, auto, or bypass`);
   }
@@ -3096,10 +3103,10 @@ function agentArgs(target) {
     case "cursor":
       args.push("-c", [
         "set -eu",
-        "if command -v cursor >/dev/null 2>&1; then",
-        '  exec cursor agent "$@"',
-        "elif command -v agent >/dev/null 2>&1; then",
+        "if command -v agent >/dev/null 2>&1; then",
         '  exec agent "$@"',
+        "elif command -v cursor >/dev/null 2>&1; then",
+        '  exec cursor agent "$@"',
         "else",
         "  echo 'Executable not found in PATH: cursor agent or agent' >&2",
         "  exit 127",
@@ -3131,6 +3138,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       if (target.agent)
@@ -3145,6 +3154,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
@@ -5046,7 +5057,7 @@ function enableStartup(result) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.44",
+  version: "0.3.46",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/index.js

@@ -386,6 +386,10 @@ function validateTarget(value, label) {
     }
     if (value.variant !== undefined)
       assertString(value.variant, `${label}.variant`);
+    optionalStringArray(value.addDirs, `${label}.addDirs`);
+    if (Array.isArray(value.addDirs) && value.addDirs.length > 0 && !["codewith", "codex"].includes(value.provider)) {
+      throw new Error(`${label}.addDirs is currently supported only for provider codewith or codex`);
+    }
     if (value.permissionMode !== undefined) {
       assertString(value.permissionMode, `${label}.permissionMode`);
       const permissionModes = ["default", "plan", "auto", "bypass"];
@@ -3027,6 +3031,9 @@ function assertSupportedAgentOptions(target) {
   if (target.authProfile !== undefined && target.provider !== "codewith") {
     throw new Error(`${target.provider}.authProfile is supported only for codewith`);
   }
+  if (target.addDirs?.length && !["codewith", "codex"].includes(target.provider)) {
+    throw new Error(`${target.provider}.addDirs is currently supported only for codewith or codex`);
+  }
   if (target.permissionMode && !["default", "plan", "auto", "bypass"].includes(target.permissionMode)) {
     throw new Error(`${target.provider}.permissionMode must be default, plan, auto, or bypass`);
   }
@@ -3086,10 +3093,10 @@ function agentArgs(target) {
     case "cursor":
       args.push("-c", [
         "set -eu",
-        "if command -v cursor >/dev/null 2>&1; then",
-        '  exec cursor agent "$@"',
-        "elif command -v agent >/dev/null 2>&1; then",
+        "if command -v agent >/dev/null 2>&1; then",
         '  exec agent "$@"',
+        "elif command -v cursor >/dev/null 2>&1; then",
+        '  exec cursor agent "$@"',
         "else",
         "  echo 'Executable not found in PATH: cursor agent or agent' >&2",
         "  exit 127",
@@ -3121,6 +3128,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       if (target.agent)
@@ -3135,6 +3144,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
@@ -4806,6 +4817,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "taskId", required: true, description: "Todos task id to execute." },
       { name: "taskTitle", description: "Human-readable task title." },
       { name: "projectPath", required: true, description: "Repository or project working directory." },
+      { name: "todosProjectPath", description: "Todos storage project path used in worker/verifier commands." },
       { name: "routeProjectPath", description: "Canonical project path used for scheduler concurrency limits." },
       { name: "projectGroup", description: "Optional project group used for scheduler concurrency limits." },
       { name: "provider", default: "codewith", description: "Agent provider: codewith, claude, cursor, opencode, aicopilot, or codex." },
@@ -4816,6 +4828,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles; worker/verifier are selected deterministically." },
       { name: "model", description: "Provider model." },
       { name: "variant", description: "Provider reasoning/model effort variant." },
+      { name: "addDirs", description: "Comma-separated additional writable directories for provider sandboxes." },
       { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
@@ -4845,6 +4858,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles; worker/verifier are selected deterministically." },
       { name: "model", description: "Provider model." },
       { name: "variant", description: "Provider reasoning/model effort variant." },
+      { name: "addDirs", description: "Comma-separated additional writable directories for provider sandboxes." },
       { name: "permissionMode", default: "bypass", description: "Provider permission mode: default, plan, auto, or bypass." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
@@ -5225,6 +5239,7 @@ function agentTarget(input, prompt, role, seed, plan) {
     model: input.model,
     variant: input.variant,
     agent: input.agent,
+    addDirs: input.addDirs,
     authProfile: provider === "codewith" ? authProfileForRole(input, role, seed) : undefined,
     configIsolation: "safe",
     permissionMode: input.permissionMode ?? "bypass",
@@ -5268,7 +5283,7 @@ function renderTodosTaskWorkerVerifierWorkflow(input) {
     throw new Error("taskId is required");
   if (!input.projectPath?.trim())
     throw new Error("projectPath is required");
-  const todosProjectPath = input.routeProjectPath ?? input.projectPath;
+  const todosProjectPath = input.todosProjectPath ?? input.routeProjectPath ?? input.projectPath;
   const plan = worktreePlan(input, input.taskId);
   const taskContext = {
     taskId: input.taskId,
@@ -5502,6 +5517,7 @@ function renderLifecycleBoundedTemplate(id, values) {
     model: values.model,
     variant: values.variant,
     agent: values.agent,
+    addDirs: listVar(values.addDirs ?? values.addDir),
     permissionMode: values.permissionMode,
     sandbox: values.sandbox ?? (id === REPORT_ONLY_TEMPLATE_ID ? "read-only" : undefined),
     manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -5618,6 +5634,7 @@ function renderLoopTemplate(id, values) {
       taskTitle: values.taskTitle,
       taskDescription: values.taskDescription,
       projectPath: values.projectPath ?? values.cwd ?? process.cwd(),
+      todosProjectPath: values.todosProjectPath ?? values.todosProject,
       routeProjectPath: values.routeProjectPath,
       projectGroup: values.projectGroup,
       provider: values.provider,
@@ -5630,6 +5647,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -5661,6 +5679,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),
@@ -5687,6 +5706,7 @@ function renderLoopTemplate(id, values) {
       model: values.model,
       variant: values.variant,
       agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
       permissionMode: values.permissionMode,
       sandbox: values.sandbox,
       manualBreakGlass: booleanVar(values.manualBreakGlass),

package/dist/lib/store.js

@@ -386,6 +386,10 @@ function validateTarget(value, label) {
     }
     if (value.variant !== undefined)
       assertString(value.variant, `${label}.variant`);
+    optionalStringArray(value.addDirs, `${label}.addDirs`);
+    if (Array.isArray(value.addDirs) && value.addDirs.length > 0 && !["codewith", "codex"].includes(value.provider)) {
+      throw new Error(`${label}.addDirs is currently supported only for provider codewith or codex`);
+    }
     if (value.permissionMode !== undefined) {
       assertString(value.permissionMode, `${label}.permissionMode`);
       const permissionModes = ["default", "plan", "auto", "bypass"];

package/dist/lib/templates.d.ts

@@ -14,6 +14,7 @@ export interface TodosTaskWorkflowTemplateInput {
     taskTitle?: string;
     taskDescription?: string;
     projectPath: string;
+    todosProjectPath?: string;
     routeProjectPath?: string;
     projectGroup?: string;
     provider?: AgentProvider;
@@ -28,6 +29,7 @@ export interface TodosTaskWorkflowTemplateInput {
     model?: string;
     variant?: string;
     agent?: string;
+    addDirs?: string[];
     permissionMode?: AgentPermissionMode;
     sandbox?: AgentSandbox;
     manualBreakGlass?: boolean;
@@ -59,6 +61,7 @@ export interface EventWorkflowTemplateInput {
     model?: string;
     variant?: string;
     agent?: string;
+    addDirs?: string[];
     permissionMode?: AgentPermissionMode;
     sandbox?: AgentSandbox;
     manualBreakGlass?: boolean;
@@ -85,6 +88,7 @@ export interface BoundedAgentWorkflowTemplateInput {
     model?: string;
     variant?: string;
     agent?: string;
+    addDirs?: string[];
     permissionMode?: AgentPermissionMode;
     sandbox?: AgentSandbox;
     manualBreakGlass?: boolean;

package/dist/sdk/index.js

@@ -386,6 +386,10 @@ function validateTarget(value, label) {
     }
     if (value.variant !== undefined)
       assertString(value.variant, `${label}.variant`);
+    optionalStringArray(value.addDirs, `${label}.addDirs`);
+    if (Array.isArray(value.addDirs) && value.addDirs.length > 0 && !["codewith", "codex"].includes(value.provider)) {
+      throw new Error(`${label}.addDirs is currently supported only for provider codewith or codex`);
+    }
     if (value.permissionMode !== undefined) {
       assertString(value.permissionMode, `${label}.permissionMode`);
       const permissionModes = ["default", "plan", "auto", "bypass"];
@@ -3027,6 +3031,9 @@ function assertSupportedAgentOptions(target) {
   if (target.authProfile !== undefined && target.provider !== "codewith") {
     throw new Error(`${target.provider}.authProfile is supported only for codewith`);
   }
+  if (target.addDirs?.length && !["codewith", "codex"].includes(target.provider)) {
+    throw new Error(`${target.provider}.addDirs is currently supported only for codewith or codex`);
+  }
   if (target.permissionMode && !["default", "plan", "auto", "bypass"].includes(target.permissionMode)) {
     throw new Error(`${target.provider}.permissionMode must be default, plan, auto, or bypass`);
   }
@@ -3086,10 +3093,10 @@ function agentArgs(target) {
     case "cursor":
       args.push("-c", [
         "set -eu",
-        "if command -v cursor >/dev/null 2>&1; then",
-        '  exec cursor agent "$@"',
-        "elif command -v agent >/dev/null 2>&1; then",
+        "if command -v agent >/dev/null 2>&1; then",
         '  exec agent "$@"',
+        "elif command -v cursor >/dev/null 2>&1; then",
+        '  exec cursor agent "$@"',
         "else",
         "  echo 'Executable not found in PATH: cursor agent or agent' >&2",
         "  exit 127",
@@ -3121,6 +3128,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       if (target.agent)
@@ -3135,6 +3144,8 @@ function agentArgs(target) {
         args.push("--ignore-rules");
       if (target.cwd)
         args.push("--cd", target.cwd);
+      for (const dir of target.addDirs ?? [])
+        args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);

package/dist/types.d.ts

@@ -114,6 +114,7 @@ export interface AgentTarget {
     agent?: string;
     authProfile?: string;
     extraArgs?: string[];
+    addDirs?: string[];
     timeoutMs?: number;
     idleTimeoutMs?: number;
     configIsolation?: AgentConfigIsolation;

package/docs/USAGE.md

@@ -228,7 +228,9 @@ loops templates render todos-task-worker-verifier \
   --var projectPath=/path/to/repo \
   --var provider=codewith \
   --var authProfilePool=account004,account005,account006 \
-  --var sandbox=workspace-write
+  --var sandbox=workspace-write \
+  --var todosProjectPath=$HOME/.hasna/loops \
+  --var addDirs=$HOME/.hasna/todos,$HOME/.hasna/loops
 loops templates create-workflow todos-task-worker-verifier \
   --var taskId=<task-id> \
   --var projectPath=/path/to/repo
@@ -286,6 +288,8 @@ cat task-created-event.json | loops events handle todos-task \
   --auth-profile-pool account004,account005,account006 \
   --permission-mode bypass \
   --sandbox workspace-write \
+  --todos-project "$HOME/.hasna/loops" \
+  --add-dir "$HOME/.hasna/todos,$HOME/.hasna/loops" \
   --worktree-mode required
 ```
 
@@ -322,6 +326,15 @@ idempotency key before rendering worktree plans or checking route limits. In
 dry-run mode, throttle counts are not evaluated because opening the live loop
 store can create or migrate the local database.
 
+When a sandboxed Codewith/Codex worker must update app stores outside the repo
+worktree, pass those stores explicitly with `--add-dir` or template `addDirs`.
+For task-created routes, pass `--todos-project` so worker/verifier prompts use
+the actual todos storage project while route concurrency and worktree isolation
+still use the repository path. This avoids `danger-full-access` for normal
+todos comments, completion state, and loop evidence writes. `addDirs` is
+intentionally accepted only for Codewith/Codex until other providers expose
+equivalent directory-scoped write controls.
+
 Inspect route state with:
 
 ```bash
@@ -351,12 +364,13 @@ locks, or non-pending states stay queued in todos and are not routed:
 
 ```bash
 loops events drain todos-task \
-  --todos-project /home/hasna/.hasna/loops \
+  --todos-project "$HOME/.hasna/loops" \
   --task-list repoops-pr-queue \
   --tags auto:route \
-  --project-path-prefix /home/hasna/workspace/hasna/opensource \
+  --project-path-prefix "$HOME/workspace/hasna/opensource" \
   --provider codewith \
   --auth-profile-pool account004,account005,account006 \
+  --add-dir "$HOME/.hasna/todos,$HOME/.hasna/loops" \
   --project-group oss \
   --max-dispatch 2 \
   --scan-limit 500 \
@@ -364,7 +378,7 @@ loops events drain todos-task \
   --max-active-per-project-group 4 \
   --max-active 12 \
   --worktree-mode required \
-  --evidence-dir /home/hasna/.hasna/loops/reports/task-drain
+  --evidence-dir "$HOME/.hasna/loops/reports/task-drain"
 ```
 
 `--max-dispatch` caps new workflow-loop creation per drain run. `--limit` caps
@@ -562,10 +576,10 @@ On Linux this writes a user systemd service. On macOS it writes a LaunchAgent pl
 The adapters intentionally use provider command surfaces instead of pretending every agent has one SDK:
 
 - Claude uses `claude -p --output-format json` and safe-mode/local setting sources by default.
-- Codewith uses `codewith --ask-for-approval never exec --json --ephemeral --skip-git-repo-check`.
+- Codewith uses `codewith --ask-for-approval never exec --json --ephemeral --skip-git-repo-check`, with `--add-dir` for explicit extra writable directories.
 - AI Copilot and OpenCode use `run --format json --pure`.
-- Cursor is CLI-first for now via `cursor agent -p`, with `agent -p` as the fallback launcher on machines that expose the standalone Cursor Agent binary; treat output as less stable until a stronger public SDK contract is selected.
-- Codex uses `codex exec --json --ephemeral --ask-for-approval never`.
+- Cursor is CLI-first for now via standalone `agent -p` when available, with `cursor agent -p` as a compatibility fallback; treat output as less stable until a stronger public SDK contract is selected.
+- Codex uses `codex exec --json --ephemeral --skip-git-repo-check`, with `--add-dir` for explicit extra writable directories where supported.
 - Agent prompts are sent through child stdin instead of argv so prompt bodies do not appear in process listings.
 - When `--account` or a step `account` is set, OpenLoops resolves `accounts env <profile> --tool <tool>` before spawning the target, strips inherited tool home/API-key variables, and applies the selected profile only to that process. Missing account profiles fail before the provider binary receives the prompt.
 - `--auth-profile` and step `authProfile` are provider-native auth selectors. They currently apply to Codewith and are passed to Codewith as `--auth-profile <name>` before `exec`; they do not call OpenAccounts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/loops",
-  "version": "0.3.44",
+  "version": "0.3.46",
   "description": "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   "type": "module",
   "main": "dist/index.js",