@hasna/loops 0.3.52 → 0.3.54

package/README.md

@@ -101,6 +101,51 @@ accounts tools add codewith --label "Codewith" --env-var CODEWITH_HOME --bin cod
 accounts tools add aicopilot --label "AI Copilot" --env-var AICOPILOT_CONFIG_DIR --bin aicopilot
 ```
 
+## Prompt Files
+
+Use prompt files for production agent prompts instead of long inline strings.
+
+```bash
+mkdir -p ~/.hasna/loops/prompts
+$EDITOR ~/.hasna/loops/prompts/repo-morning-check.md
+
+loops create agent morning-check \
+  --provider codewith \
+  --auth-profile account001 \
+  --cron "0 8 * * *" \
+  --cwd /path/to/repo \
+  --prompt-file ~/.hasna/loops/prompts/repo-morning-check.md
+```
+
+Workflow JSON also supports `promptFile` on agent targets. Relative paths
+resolve from the workflow JSON file's directory:
+
+```json
+{
+  "name": "repo-morning",
+  "steps": [
+    {
+      "id": "review",
+      "target": {
+        "type": "agent",
+        "provider": "codewith",
+        "cwd": "/path/to/repo",
+        "promptFile": "prompts/repo-morning-review.md"
+      }
+    }
+  ]
+}
+```
+
+OpenLoops records `promptSource` metadata and redacts prompt bodies in public
+CLI output by default, including `templates render`. Use
+`~/.hasna/loops/prompts/<stable-name>.md` as the default prompt store for
+production loops.
+
+Reusable custom templates cannot contain `promptFile`. Keep prompt files in
+direct workflow JSON or agent loop creation; use template variables only for
+non-secret routing/configuration data.
+
 ## Goals
 
 Add `--goal` to wrap a command, agent, or workflow loop in an AI-SDK orchestration layer. OpenLoops asks the configured model to create a flat DAG plan, executes ready nodes by calling the underlying target, then runs an adversarial achievement audit before marking the goal complete.

package/dist/cli/index.js

@@ -314,6 +314,8 @@ function updateReadyFlags(nodes, planStatus) {
 }
 
 // src/lib/workflow-spec.ts
+import { readFileSync } from "fs";
+import { isAbsolute, resolve } from "path";
 function assertObject(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error(`${label} must be an object`);
@@ -359,6 +361,38 @@ function optionalAccountRef(value, label) {
     tool: typeof value.tool === "string" ? value.tool.trim() : undefined
   };
 }
+function promptFilePath(rawPath, opts) {
+  return isAbsolute(rawPath) ? resolve(rawPath) : resolve(opts.baseDir ?? process.cwd(), rawPath);
+}
+function readPromptFile(rawPath, label, opts) {
+  assertString(rawPath, `${label}.promptFile`);
+  const path = promptFilePath(rawPath.trim(), opts);
+  let prompt;
+  try {
+    prompt = readFileSync(path, "utf8");
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error ? String(error.code) : undefined;
+    throw new Error(`${label}.promptFile could not be read${code ? `: ${code}` : ""}`);
+  }
+  if (prompt.trim() === "")
+    throw new Error(`${label}.promptFile must contain a non-empty prompt`);
+  return { prompt, promptSource: { type: "file", path } };
+}
+function matchingPromptSource(value, prompt, opts) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  if (value.type !== "file")
+    return;
+  const rawPath = value.path;
+  if (typeof rawPath !== "string" || rawPath.trim() === "")
+    return;
+  const path = promptFilePath(rawPath.trim(), opts);
+  try {
+    return readFileSync(path, "utf8") === prompt ? { type: "file", path } : undefined;
+  } catch {
+    return;
+  }
+}
 function normalizeGoalSpec(value, label = "goal") {
   if (value === undefined)
     return;
@@ -381,7 +415,7 @@ function normalizeGoalSpec(value, label = "goal") {
     autoExecute
   };
 }
-function validateTarget(value, label) {
+function validateTarget(value, label, opts) {
   assertObject(value, label);
   if (value.type === "command") {
     assertString(value.command, `${label}.command`);
@@ -394,7 +428,13 @@ function validateTarget(value, label) {
   }
   if (value.type === "agent") {
     assertString(value.provider, `${label}.provider`);
-    assertString(value.prompt, `${label}.prompt`);
+    const hasPrompt = typeof value.prompt === "string" && value.prompt.trim() !== "";
+    const hasPromptFile = typeof value.promptFile === "string" && value.promptFile.trim() !== "";
+    if (hasPrompt && hasPromptFile)
+      throw new Error(`${label} must use either prompt or promptFile, not both`);
+    if (!hasPrompt && !hasPromptFile)
+      throw new Error(`${label}.prompt must be a non-empty string or ${label}.promptFile must be set`);
+    const promptFields = hasPrompt ? { prompt: value.prompt, promptSource: matchingPromptSource(value.promptSource, value.prompt, opts) } : readPromptFile(value.promptFile, label, opts);
     const providers = ["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"];
     if (!providers.includes(value.provider))
       throw new Error(`${label}.provider must be one of ${providers.join(", ")}`);
@@ -495,11 +535,14 @@ function validateTarget(value, label) {
       if (value.routing.eventSource !== undefined)
         assertString(value.routing.eventSource, `${label}.routing.eventSource`);
     }
-    return value;
+    const target = { ...value };
+    delete target.promptFile;
+    delete target.promptSource;
+    return { ...target, ...promptFields };
   }
   throw new Error(`${label}.type must be command or agent`);
 }
-function normalizeCreateWorkflowInput(input) {
+function normalizeCreateWorkflowInput(input, opts = {}) {
   assertString(input.name, "workflow.name");
   const goal = normalizeGoalSpec(input.goal, "goal");
   if (!Array.isArray(input.steps) || input.steps.length === 0)
@@ -515,7 +558,7 @@ function normalizeCreateWorkflowInput(input) {
       ...step,
       id: step.id,
       goal: normalizeGoalSpec(step.goal, `workflow.steps[${index}].goal`),
-      target: validateTarget(step.target, `workflow.steps[${index}].target`),
+      target: validateTarget(step.target, `workflow.steps[${index}].target`, opts),
       dependsOn: optionalStringArray(step.dependsOn, `workflow.steps[${index}].dependsOn`) ?? [],
       continueOnFailure: optionalBoolean(step.continueOnFailure, `workflow.steps[${index}].continueOnFailure`) ?? false,
       timeoutMs: optionalPositiveInteger(step.timeoutMs, `workflow.steps[${index}].timeoutMs`),
@@ -558,7 +601,7 @@ function workflowExecutionOrder(workflow) {
     visit(step);
   return order;
 }
-function workflowBodyFromJson(value, fallbackName) {
+function workflowBodyFromJson(value, fallbackName, opts = {}) {
   assertObject(value, "workflow file");
   const rawName = fallbackName ?? value.name;
   assertString(rawName, "workflow.name");
@@ -570,7 +613,7 @@ function workflowBodyFromJson(value, fallbackName) {
     goal: normalizeGoalSpec(value.goal, "goal"),
     version: typeof value.version === "number" ? value.version : undefined,
     steps: value.steps
-  });
+  }, opts);
 }
 
 // src/lib/run-artifacts.ts
@@ -1207,13 +1250,17 @@ class Store {
   }
   createLoop(input, from = new Date) {
     const now = nowIso();
+    const target = input.target.type === "workflow" ? input.target : normalizeCreateWorkflowInput({
+      name: "loop-target-validation",
+      steps: [{ id: "target", target: input.target }]
+    }).steps[0].target;
     const loop = {
       id: genId(),
       name: input.name,
       description: input.description,
       status: "active",
       schedule: input.schedule,
-      target: input.target,
+      target,
       goal: input.goal,
       machine: input.machine,
       nextRunAt: initialNextRun(input.schedule, from),
@@ -1567,6 +1614,65 @@ class Store {
       throw new Error(`workflow invocation not found after create: ${id}`);
     return rowToWorkflowInvocation(row);
   }
+  refreshWorkflowInvocationForWorkItem(workItemId, input) {
+    const sourceDedupeKey = input.sourceRef.dedupeKey ?? undefined;
+    if (!sourceDedupeKey)
+      throw new Error("cannot refresh workflow invocation without sourceRef.dedupeKey");
+    const now = nowIso();
+    const claimableStatuses = ["queued", "deferred", "failed", "dead_letter", "cancelled"];
+    const statusBindings = Object.fromEntries(claimableStatuses.map((status, index) => [`$status${index}`, status]));
+    const placeholders = claimableStatuses.map((_, index) => `$status${index}`).join(",");
+    const result = this.db.query(`UPDATE workflow_invocations
+         SET workflow_id=COALESCE($workflowId, workflow_id),
+          template_id=COALESCE($templateId, template_id),
+          source_id=COALESCE($sourceId, source_id),
+          source_json=$sourceJson,
+          subject_kind=$subjectKind,
+          subject_id=COALESCE($subjectId, subject_id),
+          subject_path=COALESCE($subjectPath, subject_path),
+          subject_url=COALESCE($subjectUrl, subject_url),
+          subject_json=$subjectJson,
+          intent=$intent,
+          scope_json=COALESCE($scopeJson, scope_json),
+          output_policy_json=COALESCE($outputPolicyJson, output_policy_json),
+          updated_at=$updated
+         WHERE source_kind=$sourceKind
+          AND source_dedupe_key=$sourceDedupeKey
+          AND EXISTS (
+            SELECT 1
+            FROM workflow_work_items
+            WHERE id=$workItemId
+              AND invocation_id=workflow_invocations.id
+              AND status IN (${placeholders})
+          )`).run({
+      $workItemId: workItemId,
+      $sourceKind: input.sourceRef.kind,
+      $sourceDedupeKey: sourceDedupeKey,
+      $workflowId: input.workflowId ?? null,
+      $templateId: input.templateId ?? null,
+      $sourceId: input.sourceRef.id ?? null,
+      $sourceJson: JSON.stringify(input.sourceRef),
+      $subjectKind: input.subjectRef.kind,
+      $subjectId: input.subjectRef.id ?? null,
+      $subjectPath: input.subjectRef.path ?? null,
+      $subjectUrl: input.subjectRef.url ?? null,
+      $subjectJson: JSON.stringify(input.subjectRef),
+      $intent: input.intent,
+      $scopeJson: input.scope ? JSON.stringify(input.scope) : null,
+      $outputPolicyJson: input.outputPolicy ? JSON.stringify(input.outputPolicy) : null,
+      $updated: now,
+      ...statusBindings
+    });
+    if (result.changes !== 1)
+      throw new Error(`workflow work item is not refreshable: ${workItemId}`);
+    const updated = this.db.query(`SELECT workflow_invocations.*
+         FROM workflow_invocations
+         JOIN workflow_work_items ON workflow_work_items.invocation_id = workflow_invocations.id
+         WHERE workflow_work_items.id = ?`).get(workItemId);
+    if (!updated)
+      throw new Error(`workflow invocation not found after refresh for work item: ${workItemId}`);
+    return rowToWorkflowInvocation(updated);
+  }
   getWorkflowInvocation(id) {
     const row = this.db.query("SELECT * FROM workflow_invocations WHERE id = ?").get(id);
     return row ? rowToWorkflowInvocation(row) : undefined;
@@ -2855,9 +2961,9 @@ class Store {
 
 // src/cli/index.ts
 import { createHash as createHash3, randomUUID } from "crypto";
-import { closeSync, existsSync as existsSync5, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync3, realpathSync, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
+import { closeSync, existsSync as existsSync5, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync4, realpathSync, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
 import { spawnSync as spawnSync5 } from "child_process";
-import { join as join6, resolve as resolve2 } from "path";
+import { dirname as dirname4, join as join6, resolve as resolve3 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { Database as Database2 } from "bun:sqlite";
 import { Command } from "commander";
@@ -4972,13 +5078,13 @@ async function tick(deps) {
 }
 
 // src/daemon/control.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2 } from "path";
 
 // src/daemon/loop.ts
 function realSleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function runLoop(opts) {
   const sleep = opts.sleep ?? realSleep;
@@ -5003,7 +5109,7 @@ function readPid(path = pidFilePath()) {
   if (!existsSync3(path))
     return;
   try {
-    const pid = Number(readFileSync(path, "utf8").trim());
+    const pid = Number(readFileSync2(path, "utf8").trim());
     return Number.isInteger(pid) && pid > 0 ? pid : undefined;
   } catch {
     return;
@@ -5908,7 +6014,7 @@ function buildScriptInventoryReport(store, opts = {}) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.52",
+  version: "0.3.54",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -5998,9 +6104,9 @@ function packageVersion() {
 
 // src/lib/templates.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename3, isAbsolute, join as join5, relative, resolve } from "path";
+import { basename as basename3, isAbsolute as isAbsolute2, join as join5, relative, resolve as resolve2 } from "path";
 var TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID = "todos-task-worker-verifier";
 var EVENT_WORKER_VERIFIER_TEMPLATE_ID = "event-worker-verifier";
 var BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID = "bounded-agent-worker-verifier";
@@ -6282,7 +6388,7 @@ function normalizeWorktreeMode(mode) {
 function defaultWorktreeRoot(root) {
   if (root?.trim()) {
     const expanded = root.trim().replace(/^~(?=$|\/)/, homedir3());
-    return isAbsolute(expanded) ? expanded : resolve(expanded);
+    return isAbsolute2(expanded) ? expanded : resolve2(expanded);
   }
   return join5(homedir3(), ".hasna", "loops", "worktrees");
 }
@@ -6389,7 +6495,7 @@ function worktreePlan(input, seed) {
   const seedSlug = `${slugSegment(seed, "run").slice(0, 48)}-${stableHex(`${repoRoot}:${seed}`)}`;
   const worktreePath = join5(root, repoSlug, seedSlug);
   const relativeCwd = relative(repoRoot, originalCwd);
-  const cwd = relativeCwd && !relativeCwd.startsWith("..") && !isAbsolute(relativeCwd) ? join5(worktreePath, relativeCwd) : worktreePath;
+  const cwd = relativeCwd && !relativeCwd.startsWith("..") && !isAbsolute2(relativeCwd) ? join5(worktreePath, relativeCwd) : worktreePath;
   const branchPrefix = (input.worktreeBranchPrefix?.trim() || "openloops").replace(/^\/+|\/+$/g, "") || "openloops";
   const branch = `${branchPrefix}/${repoSlug}/${seedSlug}`;
   const prepareStep = {
@@ -6624,9 +6730,24 @@ function assertNoImplicitDangerFullAccess(value, label) {
     assertNoImplicitDangerFullAccess(entry, `${label}.${key}`);
   }
 }
+function assertNoCustomTemplatePromptFiles(value, label) {
+  if (!value || typeof value !== "object")
+    return;
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) => assertNoCustomTemplatePromptFiles(entry, `${label}[${index}]`));
+    return;
+  }
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === "promptFile") {
+      throw new Error(`${label}.${key} is not allowed in custom templates; use direct workflow JSON for prompt-file-backed workflows`);
+    }
+    assertNoCustomTemplatePromptFiles(entry, `${label}.${key}`);
+  }
+}
 function assertCustomTemplateSafety(value, label) {
   assertNoDangerousCustomTemplateScalars(value, label);
   assertNoImplicitDangerFullAccess(value, label);
+  assertNoCustomTemplatePromptFiles(value, label);
 }
 function customTemplateDefinitionFromJson(value, sourcePath) {
   assertRecord(value, sourcePath);
@@ -6656,7 +6777,7 @@ function customTemplateSummary(definition, sourcePath) {
 function readCustomTemplateFile(file) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync2(file, "utf8"));
+    parsed = JSON.parse(readFileSync3(file, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`failed to read custom template ${file}: ${message}`);
@@ -6795,19 +6916,19 @@ function renderCustomLoopTemplate(entry, values) {
   return workflow;
 }
 function validateCustomLoopTemplateFile(file) {
-  const source = resolve(file);
+  const source = resolve2(file);
   const entry = readCustomTemplateFile(source);
-  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== source);
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve2(template.path) !== source);
   assertNoTemplateCollisions([...existing, entry]);
   return structuredClone(entry.summary);
 }
 function importCustomLoopTemplate(file, opts = {}) {
-  const source = resolve(file);
+  const source = resolve2(file);
   const entry = readCustomTemplateFile(source);
   const dir = ensureCustomLoopTemplatesDir();
   const destination = join5(dir, `${entry.definition.id}.json`);
   const replaced = existsSync4(destination);
-  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== resolve(destination));
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve2(template.path) !== resolve2(destination));
   assertNoTemplateCollisions([...existing, { ...entry, path: destination, summary: customTemplateSummary(entry.definition, destination) }]);
   if (replaced) {
     const stat = lstatSync(destination);
@@ -7613,12 +7734,13 @@ function validationFailed(error, context) {
   });
   process.exit(1);
 }
-function validateLoopTargetForStorage(target, context) {
+function normalizeLoopTargetForStorage(target, context, opts = {}) {
   try {
-    workflowBodyFromJson({
+    const workflow = workflowBodyFromJson({
       name: "loop-target-validation",
       steps: [{ id: "target", target }]
-    });
+    }, undefined, opts);
+    return workflow.steps[0].target;
   } catch (error) {
     validationFailed(error, context);
   }
@@ -7630,6 +7752,14 @@ function normalizeWorkflowForStorage(body, context) {
     validationFailed(error, context);
   }
 }
+function workflowBodyFromFile(file, fallbackName, context) {
+  try {
+    const resolved = resolve3(file);
+    return workflowBodyFromJson(JSON.parse(readFileSync4(resolved, "utf8")), fallbackName, { baseDir: dirname4(resolved) });
+  } catch (error) {
+    validationFailed(error, context);
+  }
+}
 function preflightLoopTarget(target, context, metadata, opts) {
   try {
     return preflightTarget(target, metadata, opts);
@@ -7658,6 +7788,11 @@ function workflowSpecForPreflight(body, id = "validation") {
     updatedAt: now
   };
 }
+function publicWorkflowBody(body) {
+  const value = publicWorkflow(workflowSpecForPreflight(body, "render"));
+  const { id: _id, status: _status, createdAt: _createdAt, updatedAt: _updatedAt, ...bodyOnly } = value;
+  return bodyOnly;
+}
 function printTextOutput(value) {
   for (const line of textOutputBlocks(value, { indent: "  " }))
     console.log(line);
@@ -7854,7 +7989,7 @@ function runLocalCommandWithStdoutFile(command, args, opts = {}) {
     return {
       ok: result.status === 0,
       status: result.status,
-      stdout: readFileSync3(stdoutPath, "utf8"),
+      stdout: readFileSync4(stdoutPath, "utf8"),
       stderr: typeof result.stderr === "string" ? result.stderr : result.stderr?.toString() || "",
       error: result.error ? String(result.error.message || result.error) : ""
     };
@@ -7898,7 +8033,7 @@ function readRouteCursors() {
   if (!existsSync5(path))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -8253,7 +8388,7 @@ function hasThrottleLimits(limits) {
 function normalizeRoutePath(value) {
   if (!value?.trim())
     return;
-  const resolved = resolve2(value.trim());
+  const resolved = resolve3(value.trim());
   let canonical = resolved;
   try {
     canonical = realpathSync(resolved);
@@ -8265,7 +8400,7 @@ function normalizeRoutePath(value) {
     try {
       return realpathSync(gitRoot.stdout.trim());
     } catch {
-      return resolve2(gitRoot.stdout.trim());
+      return resolve3(gitRoot.stdout.trim());
     }
   }
   return canonical;
@@ -8274,7 +8409,7 @@ function routeProjectGroup(optsGroup, data, metadata) {
   return optsGroup?.trim() || taskEventField(data, ["project_group", "projectGroup", "repo_group", "repoGroup", "workspace_group", "workspaceGroup"]) || taskEventField(metadata, ["project_group", "projectGroup", "repo_group", "repoGroup", "workspace_group", "workspaceGroup"]);
 }
 function routeThrottleDecision(store, args) {
-  const projectPath = normalizeRoutePath(args.projectPath) ?? resolve2(args.projectPath);
+  const projectPath = normalizeRoutePath(args.projectPath) ?? resolve3(args.projectPath);
   const projectGroup = args.projectGroup?.trim() || undefined;
   const counts = store.countActiveWorkflowWorkItems({ projectKey: projectPath, projectGroup });
   const base = {
@@ -8299,7 +8434,7 @@ function routeThrottleDecision(store, args) {
   return { ...base, allowed: true };
 }
 function routeThrottleDryRunPreview(args) {
-  const projectPath = normalizeRoutePath(args.projectPath) ?? resolve2(args.projectPath);
+  const projectPath = normalizeRoutePath(args.projectPath) ?? resolve3(args.projectPath);
   const projectGroup = args.projectGroup?.trim() || undefined;
   return {
     evaluated: false,
@@ -8321,7 +8456,7 @@ function todosTaskRouteTemplateId(opts) {
   return id;
 }
 async function readEventEnvelopeInput(opts = {}) {
-  const raw = opts.eventJson ?? (opts.eventFile ? readFileSync3(opts.eventFile, "utf8") : process.env.HASNA_EVENT_JSON || await Bun.stdin.text());
+  const raw = opts.eventJson ?? (opts.eventFile ? readFileSync4(opts.eventFile, "utf8") : process.env.HASNA_EVENT_JSON || await Bun.stdin.text());
   const event = JSON.parse(raw);
   if (!event || typeof event !== "object" || Array.isArray(event))
     throw new Error("event JSON must be an object");
@@ -8362,7 +8497,7 @@ function routeTodosTaskEvent(event, opts) {
     "cwd"
   ]);
   const projectPath = dataProjectPath ?? metadataProjectPath ?? opts.projectPath ?? process.cwd();
-  const routeProjectPath = normalizeRoutePath(projectPath) ?? resolve2(projectPath);
+  const routeProjectPath = normalizeRoutePath(projectPath) ?? resolve3(projectPath);
   const projectGroup = routeProjectGroup(opts.projectGroup, data, metadata);
   const throttleLimits = routeThrottleLimitsFromOpts(opts);
   const idempotencyKey = `todos-task:${taskId}`;
@@ -8536,8 +8671,9 @@ function routeTodosTaskEvent(event, opts) {
         status: throttle && !throttle.allowed ? "deferred" : "queued",
         lastReason: throttle && !throttle.allowed ? throttle.reason : undefined
       });
+      const refreshedInvocation = store.refreshWorkflowInvocationForWorkItem(workItem.id, invocationInput);
       if (throttle && !throttle.allowed)
-        return { kind: "throttled", invocation, workItem, throttle };
+        return { kind: "throttled", invocation: refreshedInvocation, workItem, throttle };
       const workflow = routeWorkflowForStorage(store, workflowBody);
       const loop = store.createLoop({
         ...loopInput,
@@ -8545,13 +8681,13 @@ function routeTodosTaskEvent(event, opts) {
           type: "workflow",
           workflowId: workflow.id,
           input: {
-            workflowInvocationId: invocation.id,
+            workflowInvocationId: refreshedInvocation.id,
             workflowWorkItemId: workItem.id
           }
         }
       });
       const admitted = store.admitWorkflowWorkItem(workItem.id, { workflowId: workflow.id, loopId: loop.id, reason: "admitted by todos-task route" });
-      return { kind: "created", invocation, workItem: admitted, workflow, loop, throttle };
+      return { kind: "created", invocation: refreshedInvocation, workItem: admitted, workflow, loop, throttle };
     });
     if (outcome.kind === "deduped") {
       return {
@@ -8611,7 +8747,7 @@ function routeGenericEvent(event, opts) {
   const data = eventData(event);
   const metadata = eventMetadata(event);
   const projectPath = opts.projectPath ?? taskEventField(data, ["working_dir", "workingDir", "project_path", "projectPath", "cwd", "repo_path", "repoPath"]) ?? taskEventField(metadata, ["working_dir", "workingDir", "project_path", "projectPath", "project_canonical_path", "cwd", "repo_path", "repoPath"]) ?? process.cwd();
-  const routeProjectPath = normalizeRoutePath(projectPath) ?? resolve2(projectPath);
+  const routeProjectPath = normalizeRoutePath(projectPath) ?? resolve3(projectPath);
   const projectGroup = routeProjectGroup(opts.projectGroup, data, metadata);
   const throttleLimits = routeThrottleLimitsFromOpts(opts);
   const eventSuffix = event.id.slice(0, 8);
@@ -8752,8 +8888,9 @@ function routeGenericEvent(event, opts) {
         status: throttle && !throttle.allowed ? "deferred" : "queued",
         lastReason: throttle && !throttle.allowed ? throttle.reason : undefined
       });
+      const refreshedInvocation = store.refreshWorkflowInvocationForWorkItem(workItem.id, invocationInput);
       if (throttle && !throttle.allowed)
-        return { kind: "throttled", invocation, workItem, throttle };
+        return { kind: "throttled", invocation: refreshedInvocation, workItem, throttle };
       const workflow = routeWorkflowForStorage(store, workflowBody);
       const loop = store.createLoop({
         ...loopInput,
@@ -8761,13 +8898,13 @@ function routeGenericEvent(event, opts) {
           type: "workflow",
           workflowId: workflow.id,
           input: {
-            workflowInvocationId: invocation.id,
+            workflowInvocationId: refreshedInvocation.id,
             workflowWorkItemId: workItem.id
           }
         }
       });
       const admitted = store.admitWorkflowWorkItem(workItem.id, { workflowId: workflow.id, loopId: loop.id, reason: "admitted by generic-event route" });
-      return { kind: "created", invocation, workItem: admitted, workflow, loop, throttle };
+      return { kind: "created", invocation: refreshedInvocation, workItem: admitted, workflow, loop, throttle };
     });
     if (outcome.kind === "deduped") {
       return {
@@ -8940,8 +9077,8 @@ function taskMatchesDrainFilters(task, filters) {
     const path = taskProjectPath(task);
     if (!path)
       return false;
-    const normalizedPath = normalizeRoutePath(path) ?? resolve2(path);
-    const normalizedPrefix = normalizeRoutePath(filters.projectPathPrefix) ?? resolve2(filters.projectPathPrefix);
+    const normalizedPath = normalizeRoutePath(path) ?? resolve3(path);
+    const normalizedPrefix = normalizeRoutePath(filters.projectPathPrefix) ?? resolve3(filters.projectPathPrefix);
     if (normalizedPath !== normalizedPrefix && !normalizedPath.startsWith(`${normalizedPrefix}/`))
       return false;
   }
@@ -9016,7 +9153,7 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
     store.close();
   }
 });
-addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").requiredOption("--prompt <prompt>", "agent prompt").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "run timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass").option("--sandbox <mode>", "provider sandbox: codewith/codex use read-only/workspace-write/danger-full-access; cursor uses enabled/disabled").option("--allow-tool <name>", "advisory per-session tool allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--allow-command <name>", "advisory per-session command allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--config-isolation <mode>", "safe or none", "safe").option("--preflight-each-run", "check provider/account readiness before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
+addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").option("--prompt <prompt>", "agent prompt").option("--prompt-file <file>", "read the agent prompt from a markdown/text file").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "run timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass").option("--sandbox <mode>", "provider sandbox: codewith/codex use read-only/workspace-write/danger-full-access; cursor uses enabled/disabled").option("--allow-tool <name>", "advisory per-session tool allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--allow-command <name>", "advisory per-session command allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--config-isolation <mode>", "safe or none", "safe").option("--preflight-each-run", "check provider/account readiness before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
   const provider = opts.provider;
   if (!["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"].includes(provider)) {
     throw new Error("unsupported provider");
@@ -9026,10 +9163,11 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
   }
   const store = new Store;
   try {
-    const target = {
+    const target = normalizeLoopTargetForStorage({
       type: "agent",
       provider,
       prompt: opts.prompt,
+      promptFile: opts.promptFile,
       cwd: opts.cwd,
       model: opts.model,
       variant: opts.variant,
@@ -9043,9 +9181,8 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
       allowlist: allowlistFromOpts(opts),
       account: accountFromOpts(opts),
       preflight: runtimePreflightFromOpts(opts)
-    };
+    }, { name, type: "agent", provider }, { baseDir: process.cwd() });
     const input = baseCreateInput(name, opts, target);
-    validateLoopTargetForStorage(input.target, { name, type: "agent", provider });
     const preflight = opts.preflight ? preflightLoopTarget(input.target, { name, type: "agent", provider }, { loopName: name }, { machine: input.machine }) : undefined;
     const loop = store.createLoop(input);
     printCreatedLoop(loop, `created loop ${loop.id} (${loop.name}) next=${loop.nextRunAt}`, preflight);
@@ -9339,7 +9476,8 @@ addTemplateSourceOption(templates.command("show <id>").description("show a templ
 });
 addTemplateSourceOption(templates.command("render <id>").description("render a template as workflow JSON").option("--var <key=value>", "template variable; may be repeated", collectValues, [])).action((id, opts) => {
   const workflow = renderLoopTemplate(id, parseVars(opts.var), { source: templateSource(opts.source) });
-  print(workflow, JSON.stringify(workflow, null, 2));
+  const value = publicWorkflowBody(workflow);
+  print(value, JSON.stringify(value, null, 2));
 });
 addTemplateSourceOption(templates.command("create-workflow <id>").description("render and store a template as a workflow").option("--var <key=value>", "template variable; may be repeated", collectValues, [])).action((id, opts) => {
   const store = new Store;
@@ -9516,7 +9654,7 @@ machines.command("show <id>").description("resolve a machine assignment").action
   print(resolveLoopMachine(id));
 });
 workflows.command("validate <file>").description("validate a workflow JSON file without storing or running it").option("--name <name>", "override workflow name from the file").option("--preflight", "also check account env and target executables").action((file, opts) => {
-  const body = workflowBodyFromJson(JSON.parse(readFileSync3(file, "utf8")), opts.name);
+  const body = workflowBodyFromFile(file, opts.name, { file, type: "workflow" });
   const workflow = workflowSpecForPreflight(body);
   const preflight = opts.preflight ? preflightWorkflow(workflow) : undefined;
   print({ valid: true, workflow: publicWorkflow(workflow), preflight }, `valid workflow ${workflow.name} steps=${workflow.steps.length}`);
@@ -9524,7 +9662,7 @@ workflows.command("validate <file>").description("validate a workflow JSON file
 workflows.command("create <file>").description("validate and store a workflow JSON file").option("--name <name>", "override workflow name from the file").option("--preflight", "also check account env and target executables before storing").action((file, opts) => {
   const store = new Store;
   try {
-    const body = workflowBodyFromJson(JSON.parse(readFileSync3(file, "utf8")), opts.name);
+    const body = workflowBodyFromFile(file, opts.name, { file, type: "workflow" });
     const preflight = opts.preflight ? preflightStoredWorkflow(workflowSpecForPreflight(body, "creation-preflight"), { name: body.name, type: "workflow" }, {}) : undefined;
     const workflow = store.createWorkflow(body);
     if (preflight !== undefined)
@@ -10333,7 +10471,7 @@ daemon.command("logs").option("-n, --lines <n>", "lines", "80").action((opts) =>
     console.log("");
     return;
   }
-  const lines = readFileSync3(path, "utf8").trimEnd().split(`
+  const lines = readFileSync4(path, "utf8").trimEnd().split(`
 `);
   console.log(lines.slice(-Number(opts.lines)).join(`
 `));