@hasna/loops 0.3.50 → 0.3.51

package/README.md

@@ -306,9 +306,11 @@ loops templates create-workflow custom-report \
 Use `--source builtin`, `--source custom`, or `--source all` on
 `list`, `show`, `render`, and `create-workflow` when automation needs an
 explicit source. Custom template ids and names cannot override built-ins.
-Custom templates fail closed for `danger-full-access`; use built-in templates
-with explicit break-glass handling for emergency workflows that need that
-sandbox.
+Custom templates fail closed for `danger-full-access`, dangerous passthrough
+arguments, and implicit Codewith/Codex full-access defaults. If a custom
+Codewith/Codex template uses `permissionMode: "bypass"`, it must also set
+`sandbox` to `workspace-write` or `read-only`. Use built-in templates with
+explicit break-glass handling for emergency workflows that need full access.
 
 For event-driven task automation, `loops events handle todos-task` reads a
 Hasna event envelope from stdin or `HASNA_EVENT_JSON`, records a

package/dist/cli/index.js

@@ -5908,7 +5908,7 @@ function buildScriptInventoryReport(store, opts = {}) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.50",
+  version: "0.3.51",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -6204,6 +6204,11 @@ var CUSTOM_TEMPLATE_VARIABLE_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 var CUSTOM_TEMPLATE_VARIABLE_TYPES = new Set(["string", "number", "boolean", "json", "string[]"]);
 var CUSTOM_TEMPLATE_PLACEHOLDER = /\$\{([a-zA-Z_][a-zA-Z0-9_]*)\}/g;
 var CUSTOM_TEMPLATE_EXACT_PLACEHOLDER = /^\$\{([a-zA-Z_][a-zA-Z0-9_]*)\}$/;
+var CUSTOM_TEMPLATE_DANGEROUS_ARG_PATTERNS = [
+  "danger-full-access",
+  "dangerously-bypass",
+  "dangerously-skip"
+];
 function compactJson(value) {
   return JSON.stringify(value);
 }
@@ -6526,6 +6531,13 @@ function validateCustomTemplateId(id, label) {
     throw new Error(`${label} must match ${CUSTOM_TEMPLATE_ID_PATTERN.source}`);
   }
 }
+function optionalTemplateBoolean(value, label) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "boolean")
+    throw new Error(`${label} must be a boolean`);
+  return value;
+}
 function validateCustomTemplateVariables(value, label) {
   if (value === undefined)
     return [];
@@ -6548,32 +6560,57 @@ function validateCustomTemplateVariables(value, label) {
     if (type && !CUSTOM_TEMPLATE_VARIABLE_TYPES.has(type)) {
       throw new Error(`${entryLabel}.type must be one of ${[...CUSTOM_TEMPLATE_VARIABLE_TYPES].join(", ")}`);
     }
-    if (defaultValue === "danger-full-access") {
-      throw new Error(`${entryLabel}.default cannot be danger-full-access in a custom template`);
+    if (defaultValue && CUSTOM_TEMPLATE_DANGEROUS_ARG_PATTERNS.some((pattern) => defaultValue.includes(pattern))) {
+      throw new Error(`${entryLabel}.default cannot contain dangerous sandbox or bypass flags in a custom template`);
     }
     return {
       name,
       description,
-      required: entry.required === undefined ? undefined : Boolean(entry.required),
+      required: optionalTemplateBoolean(entry.required, `${entryLabel}.required`),
       default: defaultValue,
       type
     };
   });
 }
-function assertNoDangerFullAccess(value, label) {
+function hasDangerousArg(value) {
+  return CUSTOM_TEMPLATE_DANGEROUS_ARG_PATTERNS.some((pattern) => value.includes(pattern));
+}
+function assertNoDangerousCustomTemplateScalars(value, label) {
+  if (typeof value === "string") {
+    if (hasDangerousArg(value)) {
+      throw new Error(`${label} contains a dangerous sandbox or bypass flag; custom templates must not request danger-full-access`);
+    }
+    return;
+  }
   if (!value || typeof value !== "object")
     return;
   if (Array.isArray(value)) {
-    value.forEach((entry, index) => assertNoDangerFullAccess(entry, `${label}[${index}]`));
+    value.forEach((entry, index) => assertNoDangerousCustomTemplateScalars(entry, `${label}[${index}]`));
     return;
   }
   for (const [key, entry] of Object.entries(value)) {
-    if (key === "sandbox" && entry === "danger-full-access") {
-      throw new Error(`${label}.${key} uses danger-full-access; custom templates must not request danger-full-access`);
-    }
-    assertNoDangerFullAccess(entry, `${label}.${key}`);
+    assertNoDangerousCustomTemplateScalars(entry, `${label}.${key}`);
   }
 }
+function assertNoImplicitDangerFullAccess(value, label) {
+  if (!value || typeof value !== "object")
+    return;
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) => assertNoImplicitDangerFullAccess(entry, `${label}[${index}]`));
+    return;
+  }
+  const object = value;
+  if (object.type === "agent" && (object.provider === "codewith" || object.provider === "codex") && object.permissionMode === "bypass" && object.sandbox === undefined) {
+    throw new Error(`${label} uses permissionMode=bypass for ${object.provider} without an explicit sandbox; set sandbox=workspace-write or read-only`);
+  }
+  for (const [key, entry] of Object.entries(object)) {
+    assertNoImplicitDangerFullAccess(entry, `${label}.${key}`);
+  }
+}
+function assertCustomTemplateSafety(value, label) {
+  assertNoDangerousCustomTemplateScalars(value, label);
+  assertNoImplicitDangerFullAccess(value, label);
+}
 function customTemplateDefinitionFromJson(value, sourcePath) {
   assertRecord(value, sourcePath);
   const id = assertTemplateString(value.id, `${sourcePath}.id`);
@@ -6585,7 +6622,7 @@ function customTemplateDefinitionFromJson(value, sourcePath) {
   if (value.workflow === undefined)
     throw new Error(`${sourcePath}.workflow is required`);
   assertRecord(value.workflow, `${sourcePath}.workflow`);
-  assertNoDangerFullAccess(value.workflow, `${sourcePath}.workflow`);
+  assertCustomTemplateSafety(value.workflow, `${sourcePath}.workflow`);
   return { id, name, description, kind, variables, workflow: value.workflow };
 }
 function customTemplateSummary(definition, sourcePath) {
@@ -6626,11 +6663,11 @@ function assertNoTemplateCollisions(entries) {
     }
   }
 }
-function loadCustomLoopTemplates() {
+function loadCustomLoopTemplatesRaw() {
   const dir = customLoopTemplatesDir();
   if (!existsSync4(dir))
     return [];
-  const entries = readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
+  return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const file = join5(dir, entry.name);
     if (entry.isSymbolicLink())
       throw new Error(`refusing symlinked custom template file: ${file}`);
@@ -6638,6 +6675,9 @@ function loadCustomLoopTemplates() {
       throw new Error(`custom template registry entry is not a regular file: ${file}`);
     return readCustomTemplateFile(file);
   });
+}
+function loadCustomLoopTemplates() {
+  const entries = loadCustomLoopTemplatesRaw();
   assertNoTemplateCollisions(entries);
   return entries;
 }
@@ -6732,21 +6772,26 @@ function renderCustomTemplateNode(value, values, templateId) {
 function renderCustomLoopTemplate(entry, values) {
   const renderedValues = customTemplateValues(entry.definition, values);
   const rendered = renderCustomTemplateNode(entry.definition.workflow, renderedValues, entry.definition.id);
-  assertNoDangerFullAccess(rendered, `custom template ${entry.definition.id}.workflow`);
-  return workflowBodyFromJson(rendered);
+  assertCustomTemplateSafety(rendered, `custom template ${entry.definition.id}.workflow`);
+  const workflow = workflowBodyFromJson(rendered);
+  assertCustomTemplateSafety(workflow, `custom template ${entry.definition.id}.workflow`);
+  return workflow;
 }
 function validateCustomLoopTemplateFile(file) {
-  const entry = readCustomTemplateFile(resolve(file));
-  assertNoTemplateCollisions([entry]);
+  const source = resolve(file);
+  const entry = readCustomTemplateFile(source);
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== source);
+  assertNoTemplateCollisions([...existing, entry]);
   return structuredClone(entry.summary);
 }
 function importCustomLoopTemplate(file, opts = {}) {
   const source = resolve(file);
   const entry = readCustomTemplateFile(source);
-  assertNoTemplateCollisions([entry]);
   const dir = ensureCustomLoopTemplatesDir();
   const destination = join5(dir, `${entry.definition.id}.json`);
   const replaced = existsSync4(destination);
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== resolve(destination));
+  assertNoTemplateCollisions([...existing, { ...entry, path: destination, summary: customTemplateSummary(entry.definition, destination) }]);
   if (replaced) {
     const stat = lstatSync(destination);
     if (!stat.isFile() || stat.isSymbolicLink())

package/dist/daemon/index.js

@@ -5240,7 +5240,7 @@ function enableStartup(result) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.50",
+  version: "0.3.51",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/index.js

@@ -5183,6 +5183,11 @@ var CUSTOM_TEMPLATE_VARIABLE_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 var CUSTOM_TEMPLATE_VARIABLE_TYPES = new Set(["string", "number", "boolean", "json", "string[]"]);
 var CUSTOM_TEMPLATE_PLACEHOLDER = /\$\{([a-zA-Z_][a-zA-Z0-9_]*)\}/g;
 var CUSTOM_TEMPLATE_EXACT_PLACEHOLDER = /^\$\{([a-zA-Z_][a-zA-Z0-9_]*)\}$/;
+var CUSTOM_TEMPLATE_DANGEROUS_ARG_PATTERNS = [
+  "danger-full-access",
+  "dangerously-bypass",
+  "dangerously-skip"
+];
 function compactJson(value) {
   return JSON.stringify(value);
 }
@@ -5505,6 +5510,13 @@ function validateCustomTemplateId(id, label) {
     throw new Error(`${label} must match ${CUSTOM_TEMPLATE_ID_PATTERN.source}`);
   }
 }
+function optionalTemplateBoolean(value, label) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "boolean")
+    throw new Error(`${label} must be a boolean`);
+  return value;
+}
 function validateCustomTemplateVariables(value, label) {
   if (value === undefined)
     return [];
@@ -5527,32 +5539,57 @@ function validateCustomTemplateVariables(value, label) {
     if (type && !CUSTOM_TEMPLATE_VARIABLE_TYPES.has(type)) {
       throw new Error(`${entryLabel}.type must be one of ${[...CUSTOM_TEMPLATE_VARIABLE_TYPES].join(", ")}`);
     }
-    if (defaultValue === "danger-full-access") {
-      throw new Error(`${entryLabel}.default cannot be danger-full-access in a custom template`);
+    if (defaultValue && CUSTOM_TEMPLATE_DANGEROUS_ARG_PATTERNS.some((pattern) => defaultValue.includes(pattern))) {
+      throw new Error(`${entryLabel}.default cannot contain dangerous sandbox or bypass flags in a custom template`);
     }
     return {
       name,
       description,
-      required: entry.required === undefined ? undefined : Boolean(entry.required),
+      required: optionalTemplateBoolean(entry.required, `${entryLabel}.required`),
       default: defaultValue,
       type
     };
   });
 }
-function assertNoDangerFullAccess(value, label) {
+function hasDangerousArg(value) {
+  return CUSTOM_TEMPLATE_DANGEROUS_ARG_PATTERNS.some((pattern) => value.includes(pattern));
+}
+function assertNoDangerousCustomTemplateScalars(value, label) {
+  if (typeof value === "string") {
+    if (hasDangerousArg(value)) {
+      throw new Error(`${label} contains a dangerous sandbox or bypass flag; custom templates must not request danger-full-access`);
+    }
+    return;
+  }
   if (!value || typeof value !== "object")
     return;
   if (Array.isArray(value)) {
-    value.forEach((entry, index) => assertNoDangerFullAccess(entry, `${label}[${index}]`));
+    value.forEach((entry, index) => assertNoDangerousCustomTemplateScalars(entry, `${label}[${index}]`));
     return;
   }
   for (const [key, entry] of Object.entries(value)) {
-    if (key === "sandbox" && entry === "danger-full-access") {
-      throw new Error(`${label}.${key} uses danger-full-access; custom templates must not request danger-full-access`);
-    }
-    assertNoDangerFullAccess(entry, `${label}.${key}`);
+    assertNoDangerousCustomTemplateScalars(entry, `${label}.${key}`);
   }
 }
+function assertNoImplicitDangerFullAccess(value, label) {
+  if (!value || typeof value !== "object")
+    return;
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) => assertNoImplicitDangerFullAccess(entry, `${label}[${index}]`));
+    return;
+  }
+  const object = value;
+  if (object.type === "agent" && (object.provider === "codewith" || object.provider === "codex") && object.permissionMode === "bypass" && object.sandbox === undefined) {
+    throw new Error(`${label} uses permissionMode=bypass for ${object.provider} without an explicit sandbox; set sandbox=workspace-write or read-only`);
+  }
+  for (const [key, entry] of Object.entries(object)) {
+    assertNoImplicitDangerFullAccess(entry, `${label}.${key}`);
+  }
+}
+function assertCustomTemplateSafety(value, label) {
+  assertNoDangerousCustomTemplateScalars(value, label);
+  assertNoImplicitDangerFullAccess(value, label);
+}
 function customTemplateDefinitionFromJson(value, sourcePath) {
   assertRecord(value, sourcePath);
   const id = assertTemplateString(value.id, `${sourcePath}.id`);
@@ -5564,7 +5601,7 @@ function customTemplateDefinitionFromJson(value, sourcePath) {
   if (value.workflow === undefined)
     throw new Error(`${sourcePath}.workflow is required`);
   assertRecord(value.workflow, `${sourcePath}.workflow`);
-  assertNoDangerFullAccess(value.workflow, `${sourcePath}.workflow`);
+  assertCustomTemplateSafety(value.workflow, `${sourcePath}.workflow`);
   return { id, name, description, kind, variables, workflow: value.workflow };
 }
 function customTemplateSummary(definition, sourcePath) {
@@ -5605,11 +5642,11 @@ function assertNoTemplateCollisions(entries) {
     }
   }
 }
-function loadCustomLoopTemplates() {
+function loadCustomLoopTemplatesRaw() {
   const dir = customLoopTemplatesDir();
   if (!existsSync3(dir))
     return [];
-  const entries = readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
+  return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const file = join5(dir, entry.name);
     if (entry.isSymbolicLink())
       throw new Error(`refusing symlinked custom template file: ${file}`);
@@ -5617,6 +5654,9 @@ function loadCustomLoopTemplates() {
       throw new Error(`custom template registry entry is not a regular file: ${file}`);
     return readCustomTemplateFile(file);
   });
+}
+function loadCustomLoopTemplates() {
+  const entries = loadCustomLoopTemplatesRaw();
   assertNoTemplateCollisions(entries);
   return entries;
 }
@@ -5711,21 +5751,26 @@ function renderCustomTemplateNode(value, values, templateId) {
 function renderCustomLoopTemplate(entry, values) {
   const renderedValues = customTemplateValues(entry.definition, values);
   const rendered = renderCustomTemplateNode(entry.definition.workflow, renderedValues, entry.definition.id);
-  assertNoDangerFullAccess(rendered, `custom template ${entry.definition.id}.workflow`);
-  return workflowBodyFromJson(rendered);
+  assertCustomTemplateSafety(rendered, `custom template ${entry.definition.id}.workflow`);
+  const workflow = workflowBodyFromJson(rendered);
+  assertCustomTemplateSafety(workflow, `custom template ${entry.definition.id}.workflow`);
+  return workflow;
 }
 function validateCustomLoopTemplateFile(file) {
-  const entry = readCustomTemplateFile(resolve(file));
-  assertNoTemplateCollisions([entry]);
+  const source = resolve(file);
+  const entry = readCustomTemplateFile(source);
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== source);
+  assertNoTemplateCollisions([...existing, entry]);
   return structuredClone(entry.summary);
 }
 function importCustomLoopTemplate(file, opts = {}) {
   const source = resolve(file);
   const entry = readCustomTemplateFile(source);
-  assertNoTemplateCollisions([entry]);
   const dir = ensureCustomLoopTemplatesDir();
   const destination = join5(dir, `${entry.definition.id}.json`);
   const replaced = existsSync3(destination);
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== resolve(destination));
+  assertNoTemplateCollisions([...existing, { ...entry, path: destination, summary: customTemplateSummary(entry.definition, destination) }]);
   if (replaced) {
     const stat = lstatSync(destination);
     if (!stat.isFile() || stat.isSymbolicLink())

package/docs/USAGE.md

@@ -309,9 +309,11 @@ loops templates create-workflow custom-report \
 Use `--source builtin`, `--source custom`, or `--source all` on
 `list`, `show`, `render`, and `create-workflow` when automation needs an
 explicit source. Custom template ids and names cannot override built-ins.
-Custom templates fail closed for `danger-full-access`; use built-in templates
-with explicit break-glass handling for emergency workflows that need that
-sandbox.
+Custom templates fail closed for `danger-full-access`, dangerous passthrough
+arguments, and implicit Codewith/Codex full-access defaults. If a custom
+Codewith/Codex template uses `permissionMode: "bypass"`, it must also set
+`sandbox` to `workspace-write` or `read-only`. Use built-in templates with
+explicit break-glass handling for emergency workflows that need full access.
 
 Repo-mutating task/event routes should set `worktreeMode=required` so the
 workflow fails fast instead of falling back to the main checkout. When

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/loops",
-  "version": "0.3.50",
+  "version": "0.3.51",
   "description": "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   "type": "module",
   "main": "dist/index.js",