@hasna/loops 0.3.50 → 0.3.52

package/dist/cli/index.js

@@ -623,7 +623,7 @@ function writeWorkflowRunManifest(args) {
 var DEFAULT_RECOVERY_BATCH_LIMIT = 100;
 var DEFAULT_RECOVERY_SCAN_MULTIPLIER = 5;
 var LIVE_EXPIRED_RUN_GRACE_MS = 60000;
-var GENERATED_ROUTE_TEMPLATE_IDS = new Set(["todos-task-worker-verifier", "event-worker-verifier"]);
+var GENERATED_ROUTE_TEMPLATE_IDS = new Set(["todos-task-worker-verifier", "task-lifecycle", "event-worker-verifier"]);
 var GENERATED_ROUTE_KEYS = new Set(["todos-task", "generic-event"]);
 function rowToLoop(row) {
   return {
@@ -5908,7 +5908,7 @@ function buildScriptInventoryReport(store, opts = {}) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.50",
+  version: "0.3.52",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -6108,6 +6108,10 @@ var TEMPLATE_SUMMARIES = [
       { name: "taskId", required: true, description: "Todos task id." },
       { name: "projectPath", required: true, description: "Repository or project working directory." },
       { name: "authProfilePool", description: "Comma-separated Codewith profiles for worker/verifier rotation." },
+      { name: "triageAuthProfile", description: "Provider-native auth profile for the triage step." },
+      { name: "plannerAuthProfile", description: "Provider-native auth profile for the planner step." },
+      { name: "workerAuthProfile", description: "Provider-native auth profile for the worker step." },
+      { name: "verifierAuthProfile", description: "Provider-native auth profile for the verifier step." },
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles for non-Codewith providers." },
       { name: "provider", default: "codewith", description: "Agent provider." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
@@ -6204,6 +6208,11 @@ var CUSTOM_TEMPLATE_VARIABLE_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 var CUSTOM_TEMPLATE_VARIABLE_TYPES = new Set(["string", "number", "boolean", "json", "string[]"]);
 var CUSTOM_TEMPLATE_PLACEHOLDER = /\$\{([a-zA-Z_][a-zA-Z0-9_]*)\}/g;
 var CUSTOM_TEMPLATE_EXACT_PLACEHOLDER = /^\$\{([a-zA-Z_][a-zA-Z0-9_]*)\}$/;
+var CUSTOM_TEMPLATE_DANGEROUS_ARG_PATTERNS = [
+  "danger-full-access",
+  "dangerously-bypass",
+  "dangerously-skip"
+];
 function compactJson(value) {
   return JSON.stringify(value);
 }
@@ -6225,9 +6234,17 @@ function rolePoolValue(pool, seed, role) {
   const workerIndex = stableIndex(seed, pool.length);
   if (role === "worker" || pool.length === 1)
     return pool[workerIndex];
-  return pool[(workerIndex + 1) % pool.length];
+  if (role === "verifier")
+    return pool[(workerIndex + 1) % pool.length];
+  if (role === "planner")
+    return pool[(workerIndex + 2) % pool.length];
+  return pool[(workerIndex + 3) % pool.length];
 }
 function authProfileForRole(input, role, seed) {
+  if (role === "triage" && input.triageAuthProfile)
+    return input.triageAuthProfile;
+  if (role === "planner" && input.plannerAuthProfile)
+    return input.plannerAuthProfile;
   if (role === "worker" && input.workerAuthProfile)
     return input.workerAuthProfile;
   if (role === "verifier" && input.verifierAuthProfile)
@@ -6235,6 +6252,10 @@ function authProfileForRole(input, role, seed) {
   return rolePoolValue(input.authProfilePool, seed, role) ?? input.authProfile;
 }
 function accountForRole(input, role, seed) {
+  if (role === "triage" && input.triageAccount)
+    return input.triageAccount;
+  if (role === "planner" && input.plannerAccount)
+    return input.plannerAccount;
   if (role === "worker" && input.workerAccount)
     return input.workerAccount;
   if (role === "verifier" && input.verifierAccount)
@@ -6421,10 +6442,10 @@ function worktreePrompt(plan) {
 function assertNativeAuthProfileSupport(input, provider) {
   if (provider === "codewith")
     return;
-  const hasNativeAuthProfiles = Boolean(input.authProfile || input.authProfilePool?.length || input.workerAuthProfile || input.verifierAuthProfile);
+  const hasNativeAuthProfiles = Boolean(input.authProfile || input.authProfilePool?.length || input.triageAuthProfile || input.plannerAuthProfile || input.workerAuthProfile || input.verifierAuthProfile);
   if (!hasNativeAuthProfiles)
     return;
-  throw new Error(`authProfile, authProfilePool, workerAuthProfile, and verifierAuthProfile are supported only for provider codewith; use account/accountPool for ${provider} profile isolation`);
+  throw new Error(`authProfile, authProfilePool, triageAuthProfile, plannerAuthProfile, workerAuthProfile, and verifierAuthProfile are supported only for provider codewith; use account/accountPool for ${provider} profile isolation`);
 }
 function failClosedSandbox(input, provider, sandbox) {
   if (!["codewith", "codex"].includes(provider))
@@ -6476,9 +6497,10 @@ function agentTarget(input, prompt, role, seed, plan) {
 function workflowStepsWithWorktree(plan, steps) {
   if (!plan.prepareStep)
     return steps;
+  const firstStepId = steps[0]?.id;
   return [
     plan.prepareStep,
-    ...steps.map((step) => step.id === "worker" ? { ...step, dependsOn: [...new Set([...step.dependsOn ?? [], plan.prepareStep.id])] } : step)
+    ...steps.map((step) => step.id === firstStepId ? { ...step, dependsOn: [...new Set([...step.dependsOn ?? [], plan.prepareStep.id])] } : step)
   ];
 }
 function assertRecord(value, label) {
@@ -6526,6 +6548,13 @@ function validateCustomTemplateId(id, label) {
     throw new Error(`${label} must match ${CUSTOM_TEMPLATE_ID_PATTERN.source}`);
   }
 }
+function optionalTemplateBoolean(value, label) {
+  if (value === undefined)
+    return;
+  if (typeof value !== "boolean")
+    throw new Error(`${label} must be a boolean`);
+  return value;
+}
 function validateCustomTemplateVariables(value, label) {
   if (value === undefined)
     return [];
@@ -6548,32 +6577,57 @@ function validateCustomTemplateVariables(value, label) {
     if (type && !CUSTOM_TEMPLATE_VARIABLE_TYPES.has(type)) {
       throw new Error(`${entryLabel}.type must be one of ${[...CUSTOM_TEMPLATE_VARIABLE_TYPES].join(", ")}`);
     }
-    if (defaultValue === "danger-full-access") {
-      throw new Error(`${entryLabel}.default cannot be danger-full-access in a custom template`);
+    if (defaultValue && CUSTOM_TEMPLATE_DANGEROUS_ARG_PATTERNS.some((pattern) => defaultValue.includes(pattern))) {
+      throw new Error(`${entryLabel}.default cannot contain dangerous sandbox or bypass flags in a custom template`);
     }
     return {
       name,
       description,
-      required: entry.required === undefined ? undefined : Boolean(entry.required),
+      required: optionalTemplateBoolean(entry.required, `${entryLabel}.required`),
       default: defaultValue,
       type
     };
   });
 }
-function assertNoDangerFullAccess(value, label) {
+function hasDangerousArg(value) {
+  return CUSTOM_TEMPLATE_DANGEROUS_ARG_PATTERNS.some((pattern) => value.includes(pattern));
+}
+function assertNoDangerousCustomTemplateScalars(value, label) {
+  if (typeof value === "string") {
+    if (hasDangerousArg(value)) {
+      throw new Error(`${label} contains a dangerous sandbox or bypass flag; custom templates must not request danger-full-access`);
+    }
+    return;
+  }
   if (!value || typeof value !== "object")
     return;
   if (Array.isArray(value)) {
-    value.forEach((entry, index) => assertNoDangerFullAccess(entry, `${label}[${index}]`));
+    value.forEach((entry, index) => assertNoDangerousCustomTemplateScalars(entry, `${label}[${index}]`));
     return;
   }
   for (const [key, entry] of Object.entries(value)) {
-    if (key === "sandbox" && entry === "danger-full-access") {
-      throw new Error(`${label}.${key} uses danger-full-access; custom templates must not request danger-full-access`);
-    }
-    assertNoDangerFullAccess(entry, `${label}.${key}`);
+    assertNoDangerousCustomTemplateScalars(entry, `${label}.${key}`);
   }
 }
+function assertNoImplicitDangerFullAccess(value, label) {
+  if (!value || typeof value !== "object")
+    return;
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) => assertNoImplicitDangerFullAccess(entry, `${label}[${index}]`));
+    return;
+  }
+  const object = value;
+  if (object.type === "agent" && (object.provider === "codewith" || object.provider === "codex") && object.permissionMode === "bypass" && object.sandbox === undefined) {
+    throw new Error(`${label} uses permissionMode=bypass for ${object.provider} without an explicit sandbox; set sandbox=workspace-write or read-only`);
+  }
+  for (const [key, entry] of Object.entries(object)) {
+    assertNoImplicitDangerFullAccess(entry, `${label}.${key}`);
+  }
+}
+function assertCustomTemplateSafety(value, label) {
+  assertNoDangerousCustomTemplateScalars(value, label);
+  assertNoImplicitDangerFullAccess(value, label);
+}
 function customTemplateDefinitionFromJson(value, sourcePath) {
   assertRecord(value, sourcePath);
   const id = assertTemplateString(value.id, `${sourcePath}.id`);
@@ -6585,7 +6639,7 @@ function customTemplateDefinitionFromJson(value, sourcePath) {
   if (value.workflow === undefined)
     throw new Error(`${sourcePath}.workflow is required`);
   assertRecord(value.workflow, `${sourcePath}.workflow`);
-  assertNoDangerFullAccess(value.workflow, `${sourcePath}.workflow`);
+  assertCustomTemplateSafety(value.workflow, `${sourcePath}.workflow`);
   return { id, name, description, kind, variables, workflow: value.workflow };
 }
 function customTemplateSummary(definition, sourcePath) {
@@ -6626,11 +6680,11 @@ function assertNoTemplateCollisions(entries) {
     }
   }
 }
-function loadCustomLoopTemplates() {
+function loadCustomLoopTemplatesRaw() {
   const dir = customLoopTemplatesDir();
   if (!existsSync4(dir))
     return [];
-  const entries = readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
+  return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.name.endsWith(".json")).sort((left, right) => left.name.localeCompare(right.name)).map((entry) => {
     const file = join5(dir, entry.name);
     if (entry.isSymbolicLink())
       throw new Error(`refusing symlinked custom template file: ${file}`);
@@ -6638,6 +6692,9 @@ function loadCustomLoopTemplates() {
       throw new Error(`custom template registry entry is not a regular file: ${file}`);
     return readCustomTemplateFile(file);
   });
+}
+function loadCustomLoopTemplates() {
+  const entries = loadCustomLoopTemplatesRaw();
   assertNoTemplateCollisions(entries);
   return entries;
 }
@@ -6732,21 +6789,26 @@ function renderCustomTemplateNode(value, values, templateId) {
 function renderCustomLoopTemplate(entry, values) {
   const renderedValues = customTemplateValues(entry.definition, values);
   const rendered = renderCustomTemplateNode(entry.definition.workflow, renderedValues, entry.definition.id);
-  assertNoDangerFullAccess(rendered, `custom template ${entry.definition.id}.workflow`);
-  return workflowBodyFromJson(rendered);
+  assertCustomTemplateSafety(rendered, `custom template ${entry.definition.id}.workflow`);
+  const workflow = workflowBodyFromJson(rendered);
+  assertCustomTemplateSafety(workflow, `custom template ${entry.definition.id}.workflow`);
+  return workflow;
 }
 function validateCustomLoopTemplateFile(file) {
-  const entry = readCustomTemplateFile(resolve(file));
-  assertNoTemplateCollisions([entry]);
+  const source = resolve(file);
+  const entry = readCustomTemplateFile(source);
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== source);
+  assertNoTemplateCollisions([...existing, entry]);
   return structuredClone(entry.summary);
 }
 function importCustomLoopTemplate(file, opts = {}) {
   const source = resolve(file);
   const entry = readCustomTemplateFile(source);
-  assertNoTemplateCollisions([entry]);
   const dir = ensureCustomLoopTemplatesDir();
   const destination = join5(dir, `${entry.definition.id}.json`);
   const replaced = existsSync4(destination);
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== resolve(destination));
+  assertNoTemplateCollisions([...existing, { ...entry, path: destination, summary: customTemplateSummary(entry.definition, destination) }]);
   if (replaced) {
     const stat = lstatSync(destination);
     if (!stat.isFile() || stat.isSymbolicLink())
@@ -6873,6 +6935,222 @@ function renderTodosTaskWorkerVerifierWorkflow(input) {
     ])
   };
 }
+function renderTaskLifecycleWorkflow(input) {
+  if (!input.taskId?.trim())
+    throw new Error("taskId is required");
+  if (!input.projectPath?.trim())
+    throw new Error("projectPath is required");
+  const todosProjectPath = input.todosProjectPath ?? input.routeProjectPath ?? input.projectPath;
+  const plan = worktreePlan(input, input.taskId);
+  const taskContext = {
+    taskId: input.taskId,
+    taskTitle: input.taskTitle,
+    taskDescription: input.taskDescription,
+    eventId: input.eventId,
+    eventType: input.eventType,
+    projectPath: input.projectPath,
+    routeProjectPath: input.routeProjectPath,
+    projectGroup: input.projectGroup,
+    todosProjectPath,
+    worktree: {
+      mode: plan.mode,
+      enabled: plan.enabled,
+      cwd: plan.cwd,
+      path: plan.path,
+      branch: plan.branch,
+      reason: plan.reason
+    }
+  };
+  const shared = [
+    worktreePrompt(plan),
+    `Todos project path: ${todosProjectPath}`,
+    "Use these exact todos commands so worktree cwd inference cannot attach to the wrong project:",
+    `- Inspect first: todos --project ${todosProjectPath} inspect ${input.taskId}`,
+    `- Record evidence: todos --project ${todosProjectPath} comment ${input.taskId} "<concise evidence, decision, or blocker>"`,
+    "Do not dispatch or paste prompts into tmux panes. If additional work is required, create or update deduped todos tasks so task-created routing can start a fresh headless workflow.",
+    "Preserve unrelated user changes and keep scope tied to the task acceptance criteria.",
+    "",
+    `Task context JSON: ${compactJson(taskContext)}`
+  ].join(`
+`);
+  const gateMarker = (stage, state) => `openloops:${stage}=${state} task=${input.taskId}${input.eventId ? ` event=${input.eventId}` : ""}`;
+  const gateCommand = (stage) => [
+    "set -euo pipefail",
+    `task_json="$(todos --project ${shellQuote2(todosProjectPath)} --json inspect ${shellQuote2(input.taskId)})"`,
+    `TASK_JSON="$task_json" STAGE=${shellQuote2(stage)} bun - <<'BUN'`,
+    "const raw = process.env.TASK_JSON || '{}';",
+    "const payload = JSON.parse(raw);",
+    "const task = payload.task && typeof payload.task === 'object' ? payload.task : payload;",
+    "const stage = process.env.STAGE || 'lifecycle';",
+    `const goMarker = ${JSON.stringify(gateMarker(stage, "go"))};`,
+    `const blockedMarker = ${JSON.stringify(gateMarker(stage, "blocked"))};`,
+    "const status = String(task.status || '').toLowerCase().replace(/_/g, '-');",
+    "const metadata = task.metadata && typeof task.metadata === 'object' ? task.metadata : {};",
+    "const automation = metadata.automation && typeof metadata.automation === 'object' ? metadata.automation : {};",
+    "const comments = Array.isArray(task.comments) ? task.comments : [];",
+    "const blockedStatuses = new Set(['blocked', 'cancelled', 'canceled', 'failed', 'archived', 'deleted', 'done', 'completed']);",
+    "const truthy = (value) => value === true || value === 1 || value === '1' || String(value).toLowerCase() === 'true' || String(value).toLowerCase() === 'yes';",
+    "const falsey = (value) => value === false || value === 0 || value === '0' || String(value).toLowerCase() === 'false' || String(value).toLowerCase() === 'no';",
+    "const commentText = (comment) => String(comment?.content ?? comment?.text ?? comment?.body ?? comment?.comment ?? '');",
+    "const tagsFrom = (value) => Array.isArray(value) ? value.map(String) : typeof value === 'string' ? value.split(',') : [];",
+    "const records = [task, metadata, automation].filter((entry) => entry && typeof entry === 'object');",
+    "const tags = new Set(records.flatMap((entry) => [entry.tags, entry.task_tags, entry.taskTags].flatMap(tagsFrom)).map((tag) => tag.trim().toLowerCase()).filter(Boolean));",
+    "const markerState = (comment) => {",
+    "  const line = commentText(comment).trimStart().split(/\\r?\\n/, 1)[0]?.trimEnd() || '';",
+    "  if (line === goMarker) return 'go';",
+    "  if (line === blockedMarker) return 'blocked';",
+    "  if (line.startsWith(`openloops:${stage}=`)) return `invalid marker: ${line}`;",
+    "  return undefined;",
+    "};",
+    "const markerTime = (comment, index) => {",
+    "  const rawTime = comment?.created_at ?? comment?.createdAt ?? comment?.updated_at ?? comment?.updatedAt;",
+    "  const parsed = rawTime ? Date.parse(String(rawTime)) : Number.NaN;",
+    "  return Number.isFinite(parsed) ? parsed : index;",
+    "};",
+    "const markers = comments",
+    "  .map((comment, index) => ({ state: markerState(comment), order: markerTime(comment, index), index }))",
+    "  .filter((entry) => entry.state)",
+    "  .sort((a, b) => a.order - b.order || a.index - b.index);",
+    "const latestMarker = markers.at(-1)?.state;",
+    "const blockers = [];",
+    "if (blockedStatuses.has(status)) blockers.push(`task status is ${status}`);",
+    "for (const tag of ['no-auto', 'manual', 'manual-required', 'approval-required']) {",
+    "  if (tags.has(tag)) blockers.push(`task has disallowed tag ${tag}`);",
+    "}",
+    "for (const [key, source] of records.entries()) {",
+    "  if (truthy(source.no_auto) || truthy(source.noAuto)) blockers.push(`${key}.no_auto is true`);",
+    "  if (truthy(source.manual) || truthy(source.manual_required) || truthy(source.manualRequired) || String(source.mode || '').toLowerCase() === 'manual') blockers.push(`${key}.manual/mode requires manual handling`);",
+    "  if (truthy(source.requires_approval) || truthy(source.requiresApproval) || truthy(source.approval_required) || truthy(source.approvalRequired)) blockers.push(`${key}.requires_approval is true`);",
+    "  if (falsey(source.auto) || falsey(source.enabled) || falsey(source.allowed) || falsey(source.automation_allowed) || falsey(source.automationAllowed) || falsey(source.loop_allowed) || falsey(source.loopAllowed)) blockers.push(`${key} disallows loop automation`);",
+    "}",
+    "if (latestMarker !== 'go') blockers.push(latestMarker ? `latest ${stage} marker is ${latestMarker}` : `missing exact ${goMarker} comment`);",
+    "if (blockers.length) {",
+    "  console.error(`task lifecycle ${stage} gate blocked ${task.id || task.taskId || 'task'}: ${blockers.join('; ')}`);",
+    "  process.exit(12);",
+    "}",
+    "console.log(`task lifecycle ${stage} gate passed for ${task.id || task.taskId || 'task'} status=${status || 'unknown'}`);",
+    "BUN"
+  ].join(`
+`);
+  const triagePrompt = [
+    `/goal Triage todos task ${input.taskId} for safe automated execution.`,
+    "",
+    "You are the triage step for a full task-triggered OpenLoops lifecycle.",
+    shared,
+    "Decide whether the task is eligible for loop execution. Check status, dependencies, duplicate tasks, no-auto/manual/approval metadata, project path, acceptance criteria, and whether the requested work should be split before implementation.",
+    "Do not implement repo changes in this step.",
+    `If the task is eligible for automated planning, add a task comment whose first line is exactly: ${gateMarker("triage", "go")}`,
+    "Include the triage decision, duplicates/dependencies found, and any follow-up tasks created in that same comment.",
+    `If the task should not proceed automatically, run: todos --project ${todosProjectPath} update ${input.taskId} --status blocked`,
+    `Then add a task comment whose first line is exactly: ${gateMarker("triage", "blocked")}`,
+    "The deterministic triage gate will stop later steps unless the latest triage marker is the exact go marker and the task has no blocked/no-auto/manual/approval-required state."
+  ].join(`
+`);
+  const plannerPrompt = [
+    `/goal Plan todos task ${input.taskId} before implementation.`,
+    "",
+    "You are the planner step for a full task-triggered OpenLoops lifecycle.",
+    shared,
+    "Read the triage comment and current task details.",
+    `If the task is ready for implementation, add a task comment whose first line is exactly: ${gateMarker("planner", "go")}`,
+    "In that same comment, include a concise implementation plan: files/areas to inspect, validation commands, risk checks, expected commit/PR behavior, and any cross-repo tasks that should be created separately.",
+    `Do not implement repo changes in this step. If the task is too broad or unsafe for automation, run: todos --project ${todosProjectPath} update ${input.taskId} --status blocked`,
+    `Then add a task comment whose first line is exactly: ${gateMarker("planner", "blocked")}`,
+    "Create smaller deduped tasks and record evidence. The deterministic planner gate will stop the worker unless the latest planner marker is the exact go marker and the task has no blocked/no-auto/manual/approval-required state."
+  ].join(`
+`);
+  const workerPrompt = [
+    `/goal Complete todos task ${input.taskId} according to the planner evidence.`,
+    "",
+    "You are the worker step for a full task-triggered OpenLoops lifecycle.",
+    shared,
+    `- Claim/start if appropriate: todos --project ${todosProjectPath} start ${input.taskId}`,
+    "Read the triage and planner comments first. Implement only the scoped task, run focused validation, and record changed files, commits, evidence, blockers, and residual risks.",
+    "Do not mark the task complete in the worker step; the verifier step owns completion after independent validation."
+  ].join(`
+`);
+  const verifierPrompt = [
+    `/goal Verify todos task ${input.taskId} after the full lifecycle worker step.`,
+    "",
+    "You are the verifier step for a full task-triggered OpenLoops lifecycle.",
+    shared,
+    `- Record verification: todos --project ${todosProjectPath} comment ${input.taskId} "<verification evidence or blocker>"`,
+    `- If valid and complete: todos --project ${todosProjectPath} done ${input.taskId}`,
+    "Use fresh context. Inspect triage, plan, worker evidence, repo state, commits, tests, and acceptance criteria. Act as an adversarial reviewer focused on correctness, regressions, missing tests, security, and incomplete requirements.",
+    "If the work is valid, record verification evidence in todos and mark/leave the task completed according to the todos CLI. If not valid, add precise follow-up tasks or comments and leave the original task open or blocked with clear evidence.",
+    "Do not make broad unrelated changes. Only apply tiny verification fixes when they are necessary and low risk; otherwise create follow-up tasks."
+  ].join(`
+`);
+  return {
+    name: `task-lifecycle-${input.taskId.slice(0, 8)}-triage-plan-worker-verifier`,
+    description: `Full task lifecycle workflow for ${taskLabel(input)}`,
+    version: 1,
+    steps: workflowStepsWithWorktree(plan, [
+      {
+        id: "triage",
+        name: "Triage",
+        description: "Check task eligibility, duplicates, dependencies, and automation gates.",
+        target: agentTarget(input, triagePrompt, "triage", input.taskId, plan),
+        timeoutMs: 20 * 60000
+      },
+      {
+        id: "triage-gate",
+        name: "Triage Gate",
+        description: "Stop the lifecycle before planning when triage blocked or disallowed automation.",
+        dependsOn: ["triage"],
+        target: {
+          type: "command",
+          command: "bash",
+          args: ["-lc", gateCommand("triage")],
+          cwd: plan.cwd,
+          timeoutMs: 2 * 60000
+        },
+        timeoutMs: 2 * 60000
+      },
+      {
+        id: "planner",
+        name: "Planner",
+        description: "Create a concise implementation plan and split unsafe scope before work starts.",
+        dependsOn: ["triage-gate"],
+        target: agentTarget(input, plannerPrompt, "planner", input.taskId, plan),
+        timeoutMs: 25 * 60000
+      },
+      {
+        id: "planner-gate",
+        name: "Planner Gate",
+        description: "Stop the lifecycle before implementation when planning blocked or disallowed automation.",
+        dependsOn: ["planner"],
+        target: {
+          type: "command",
+          command: "bash",
+          args: ["-lc", gateCommand("planner")],
+          cwd: plan.cwd,
+          timeoutMs: 2 * 60000
+        },
+        timeoutMs: 2 * 60000
+      },
+      {
+        id: "worker",
+        name: "Worker",
+        description: "Implement the todos task according to triage and planner evidence.",
+        dependsOn: ["planner-gate"],
+        target: agentTarget(input, workerPrompt, "worker", input.taskId, plan),
+        timeoutMs: 45 * 60000
+      },
+      {
+        id: "verifier",
+        name: "Verifier",
+        description: "Adversarially verify worker output and update todos.",
+        dependsOn: ["worker"],
+        target: {
+          ...agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
+          idleTimeoutMs: 10 * 60000
+        },
+        timeoutMs: 30 * 60000
+      }
+    ])
+  };
+}
 function renderEventWorkerVerifierWorkflow(input) {
   if (!input.eventId?.trim())
     throw new Error("eventId is required");
@@ -7038,11 +7316,39 @@ function renderLifecycleBoundedTemplate(id, values) {
     const taskId = values.taskId ?? "";
     if (!taskId.trim())
       throw new Error("taskId is required");
-    return renderBoundedAgentWorkerVerifierWorkflow({
-      ...common,
-      name: values.name ?? `task-lifecycle-${slugSegment(taskId)}-worker-verifier`,
-      objective: values.objective ?? `Run the full task lifecycle for todos task ${taskId}.`,
-      prompt: values.prompt ?? "Triage and dedupe the task, verify it is eligible for loop execution, create or update a concise plan artifact/comment, execute only the allowed scope, validate, record evidence, and let the verifier decide final task state. Add follow-up tasks instead of broadening scope."
+    return renderTaskLifecycleWorkflow({
+      taskId,
+      taskTitle: values.taskTitle,
+      taskDescription: values.taskDescription,
+      projectPath,
+      todosProjectPath: values.todosProjectPath ?? values.todosProject,
+      routeProjectPath: values.routeProjectPath,
+      projectGroup: values.projectGroup,
+      provider: values.provider,
+      authProfile: values.authProfile,
+      authProfilePool: listVar(values.authProfilePool),
+      triageAuthProfile: values.triageAuthProfile,
+      plannerAuthProfile: values.plannerAuthProfile,
+      workerAuthProfile: values.workerAuthProfile,
+      verifierAuthProfile: values.verifierAuthProfile,
+      account: values.account ? { profile: values.account, tool: values.accountTool } : undefined,
+      accountPool: accountPoolVar(values.accountPool, values.accountTool),
+      triageAccount: values.triageAccount ? { profile: values.triageAccount, tool: values.accountTool } : undefined,
+      plannerAccount: values.plannerAccount ? { profile: values.plannerAccount, tool: values.accountTool } : undefined,
+      workerAccount: values.workerAccount ? { profile: values.workerAccount, tool: values.accountTool } : undefined,
+      verifierAccount: values.verifierAccount ? { profile: values.verifierAccount, tool: values.accountTool } : undefined,
+      model: values.model,
+      variant: values.variant,
+      agent: values.agent,
+      addDirs: listVar(values.addDirs ?? values.addDir),
+      permissionMode: values.permissionMode,
+      sandbox: values.sandbox,
+      manualBreakGlass: booleanVar(values.manualBreakGlass),
+      worktreeMode: values.worktreeMode ?? "required",
+      worktreeRoot: values.worktreeRoot,
+      worktreeBranchPrefix: values.worktreeBranchPrefix,
+      eventId: values.eventId,
+      eventType: values.eventType
     });
   }
   if (id === PR_REVIEW_TEMPLATE_ID) {
@@ -7461,8 +7767,8 @@ function goalFromOpts(opts) {
   }, "goal");
 }
 function accountFromOpts(opts) {
-  if (!opts.account && opts.accountTool && !opts.accountPool && !opts.workerAccount && !opts.verifierAccount) {
-    throw new Error("--account-tool requires --account, --account-pool, --worker-account, or --verifier-account");
+  if (!opts.account && opts.accountTool && !opts.accountPool && !opts.triageAccount && !opts.plannerAccount && !opts.workerAccount && !opts.verifierAccount) {
+    throw new Error("--account-tool requires --account, --account-pool, --triage-account, --planner-account, --worker-account, or --verifier-account");
   }
   return opts.account ? { profile: opts.account, tool: opts.accountTool } : undefined;
 }
@@ -8003,6 +8309,17 @@ function routeThrottleDryRunPreview(args) {
     limits: args.limits
   };
 }
+var TODOS_TASK_ROUTE_TEMPLATE_IDS = new Set([
+  TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID,
+  TASK_LIFECYCLE_TEMPLATE_ID
+]);
+function todosTaskRouteTemplateId(opts) {
+  const id = (opts.template ?? TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).trim();
+  if (!TODOS_TASK_ROUTE_TEMPLATE_IDS.has(id)) {
+    throw new Error(`--template must be ${[...TODOS_TASK_ROUTE_TEMPLATE_IDS].join(" or ")} for todos-task routes`);
+  }
+  return id;
+}
 async function readEventEnvelopeInput(opts = {}) {
   const raw = opts.eventJson ?? (opts.eventFile ? readFileSync3(opts.eventFile, "utf8") : process.env.HASNA_EVENT_JSON || await Bun.stdin.text());
   const event = JSON.parse(raw);
@@ -8086,7 +8403,8 @@ function routeTodosTaskEvent(event, opts) {
   const permissionMode = permissionModeFromOpts({ permissionMode: opts.permissionMode ?? "bypass" }, provider);
   const sandbox = sandboxFromOpts({ sandbox: opts.sandbox }, provider);
   const authProfile = providerAuthProfileFromOpts({ authProfile: opts.authProfile }, provider);
-  let workflowBody = renderTodosTaskWorkerVerifierWorkflow({
+  const templateId = todosTaskRouteTemplateId(opts);
+  const workflowInput = {
     taskId,
     taskTitle,
     taskDescription,
@@ -8096,10 +8414,14 @@ function routeTodosTaskEvent(event, opts) {
     provider,
     authProfile,
     authProfilePool: splitList(opts.authProfilePool),
+    triageAuthProfile: opts.triageAuthProfile,
+    plannerAuthProfile: opts.plannerAuthProfile,
     workerAuthProfile: opts.workerAuthProfile,
     verifierAuthProfile: opts.verifierAuthProfile,
     account: accountFromOpts(opts),
     accountPool: accountPoolFromOpts(opts),
+    triageAccount: roleAccountFromOpts(opts, opts.triageAccount),
+    plannerAccount: roleAccountFromOpts(opts, opts.plannerAccount),
     workerAccount: roleAccountFromOpts(opts, opts.workerAccount),
     verifierAccount: roleAccountFromOpts(opts, opts.verifierAccount),
     model: opts.model,
@@ -8115,17 +8437,19 @@ function routeTodosTaskEvent(event, opts) {
     eventId: event.id,
     eventType: event.type,
     todosProjectPath: opts.todosProject
-  });
+  };
+  let workflowBody = templateId === TASK_LIFECYCLE_TEMPLATE_ID ? renderTaskLifecycleWorkflow(workflowInput) : renderTodosTaskWorkerVerifierWorkflow(workflowInput);
   workflowBody.name = workflowName;
-  workflowBody.description = `Task-triggered worker/verifier workflow for ${taskTitle ?? taskId} from ${event.source}/${event.type}; ` + `idempotency=${idempotencyKey}; event=${event.id}; project=${projectPath}; projectGroup=${projectGroup ?? "-"}`;
+  workflowBody.description = `Task-triggered ${templateId} workflow for ${taskTitle ?? taskId} from ${event.source}/${event.type}; ` + `idempotency=${idempotencyKey}; event=${event.id}; project=${projectPath}; projectGroup=${projectGroup ?? "-"}`;
   workflowBody = normalizeWorkflowForStorage(workflowBody, {
     name: workflowName,
     type: "todos-task-event-workflow",
     event: event.id
   });
   const sandboxPreflight = generatedRouteSandboxPreflight(workflowBody);
+  const hasExplicitRoleAccount = Boolean(opts.triageAuthProfile || opts.plannerAuthProfile || opts.workerAuthProfile || opts.verifierAuthProfile) || Boolean(opts.triageAccount || opts.plannerAccount || opts.workerAccount || opts.verifierAccount);
   const invocationInput = {
-    templateId: "todos-task-worker-verifier",
+    templateId,
     sourceRef: {
       kind: "event",
       id: event.id,
@@ -8145,7 +8469,7 @@ function routeTodosTaskEvent(event, opts) {
       worktreePolicy: opts.worktreeMode ?? "auto",
       permissions: permissionMode,
       manualBreakGlass: Boolean(opts.manualBreakGlass),
-      accountPolicy: opts.authProfilePool || opts.accountPool ? "pool" : "single",
+      accountPolicy: opts.authProfilePool || opts.accountPool ? "pool" : hasExplicitRoleAccount ? "role-explicit" : "single",
       concurrencyGroup: projectGroup ?? routeProjectPath
     },
     outputPolicy: {
@@ -8753,10 +9077,10 @@ var events = program.command("events").description("handle Hasna event envelopes
 var machines = program.command("machines").description("inspect OpenMachines topology for loop assignment");
 var goal = program.command("goal").description("inspect goal runs");
 function addRouteEventOptions(command) {
-  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
+  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
 }
 function addTodosDrainOptions(command, opts = {}) {
-  let configured = command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", opts.preflightDescription ?? "check generated workflow steps before storing workflow loops");
+  let configured = command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", opts.preflightDescription ?? "check generated workflow steps before storing workflow loops");
   if (opts.includeDryRun ?? true) {
     configured = configured.option("--dry-run", "preview selected tasks and generated workflow loops without storing anything");
   }
@@ -8789,13 +9113,18 @@ function routeDrainArgs(opts) {
   add("--max-dispatch", opts.maxDispatch);
   add("--evidence-dir", opts.evidenceDir);
   addBool("--compact", opts.compact);
+  add("--template", opts.template);
   add("--provider", opts.provider);
   add("--auth-profile", opts.authProfile);
   add("--auth-profile-pool", opts.authProfilePool);
+  add("--triage-auth-profile", opts.triageAuthProfile);
+  add("--planner-auth-profile", opts.plannerAuthProfile);
   add("--worker-auth-profile", opts.workerAuthProfile);
   add("--verifier-auth-profile", opts.verifierAuthProfile);
   add("--account", opts.account);
   add("--account-pool", opts.accountPool);
+  add("--triage-account", opts.triageAccount);
+  add("--planner-account", opts.plannerAccount);
   add("--worker-account", opts.workerAccount);
   add("--verifier-account", opts.verifierAccount);
   add("--account-tool", opts.accountTool);
@@ -8861,6 +9190,7 @@ function drainTodosTaskRoutes(opts) {
   const report = {
     drainedAt: new Date().toISOString(),
     todosProject,
+    templateId: todosTaskRouteTemplateId(opts),
     todosProjectId: opts.todosProjectId,
     taskList: opts.taskList,
     taskListId: taskListFilter,
@@ -8887,6 +9217,7 @@ function drainTodosTaskRoutes(opts) {
   const output = opts.compact ? {
     drainedAt: report.drainedAt,
     todosProject: report.todosProject,
+    templateId: report.templateId,
     todosProjectId: report.todosProjectId,
     taskList: report.taskList,
     taskListId: report.taskListId,
@@ -9112,7 +9443,7 @@ addScheduleOptions(addTodosDrainOptions(routes.command("schedule <kind> <name>")
   }
 });
 var eventsHandle = events.command("handle").description("handle a Hasna event envelope");
-eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
+eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
   const event = await readEventEnvelopeFromStdin();
   const result = routeTodosTaskEvent(event, opts);
   print(result.value, result.human);