@hasna/loops 0.3.53 → 0.3.55

package/dist/cli/index.js

@@ -314,6 +314,8 @@ function updateReadyFlags(nodes, planStatus) {
 }
 
 // src/lib/workflow-spec.ts
+import { readFileSync } from "fs";
+import { isAbsolute, resolve } from "path";
 function assertObject(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error(`${label} must be an object`);
@@ -329,6 +331,15 @@ function optionalPositiveInteger(value, label) {
     throw new Error(`${label} must be a positive integer`);
   return value;
 }
+function optionalTimeoutMs(value, label) {
+  if (value === undefined)
+    return;
+  if (value === null)
+    return null;
+  if (!Number.isInteger(value) || value <= 0)
+    throw new Error(`${label} must be a positive integer or null for unlimited`);
+  return value;
+}
 function optionalBoolean(value, label) {
   if (value === undefined)
     return;
@@ -359,6 +370,38 @@ function optionalAccountRef(value, label) {
     tool: typeof value.tool === "string" ? value.tool.trim() : undefined
   };
 }
+function promptFilePath(rawPath, opts) {
+  return isAbsolute(rawPath) ? resolve(rawPath) : resolve(opts.baseDir ?? process.cwd(), rawPath);
+}
+function readPromptFile(rawPath, label, opts) {
+  assertString(rawPath, `${label}.promptFile`);
+  const path = promptFilePath(rawPath.trim(), opts);
+  let prompt;
+  try {
+    prompt = readFileSync(path, "utf8");
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error ? String(error.code) : undefined;
+    throw new Error(`${label}.promptFile could not be read${code ? `: ${code}` : ""}`);
+  }
+  if (prompt.trim() === "")
+    throw new Error(`${label}.promptFile must contain a non-empty prompt`);
+  return { prompt, promptSource: { type: "file", path } };
+}
+function matchingPromptSource(value, prompt, opts) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  if (value.type !== "file")
+    return;
+  const rawPath = value.path;
+  if (typeof rawPath !== "string" || rawPath.trim() === "")
+    return;
+  const path = promptFilePath(rawPath.trim(), opts);
+  try {
+    return readFileSync(path, "utf8") === prompt ? { type: "file", path } : undefined;
+  } catch {
+    return;
+  }
+}
 function normalizeGoalSpec(value, label = "goal") {
   if (value === undefined)
     return;
@@ -381,11 +424,11 @@ function normalizeGoalSpec(value, label = "goal") {
     autoExecute
   };
 }
-function validateTarget(value, label) {
+function validateTarget(value, label, opts) {
   assertObject(value, label);
   if (value.type === "command") {
     assertString(value.command, `${label}.command`);
-    optionalPositiveInteger(value.timeoutMs, `${label}.timeoutMs`);
+    optionalTimeoutMs(value.timeoutMs, `${label}.timeoutMs`);
     optionalPositiveInteger(value.idleTimeoutMs, `${label}.idleTimeoutMs`);
     if (value.shell !== true && /\s/.test(value.command.trim())) {
       throw new Error(`${label}.command must be an executable without spaces when shell is false; put flags in args or set shell true`);
@@ -394,11 +437,17 @@ function validateTarget(value, label) {
   }
   if (value.type === "agent") {
     assertString(value.provider, `${label}.provider`);
-    assertString(value.prompt, `${label}.prompt`);
+    const hasPrompt = typeof value.prompt === "string" && value.prompt.trim() !== "";
+    const hasPromptFile = typeof value.promptFile === "string" && value.promptFile.trim() !== "";
+    if (hasPrompt && hasPromptFile)
+      throw new Error(`${label} must use either prompt or promptFile, not both`);
+    if (!hasPrompt && !hasPromptFile)
+      throw new Error(`${label}.prompt must be a non-empty string or ${label}.promptFile must be set`);
+    const promptFields = hasPrompt ? { prompt: value.prompt, promptSource: matchingPromptSource(value.promptSource, value.prompt, opts) } : readPromptFile(value.promptFile, label, opts);
     const providers = ["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"];
     if (!providers.includes(value.provider))
       throw new Error(`${label}.provider must be one of ${providers.join(", ")}`);
-    optionalPositiveInteger(value.timeoutMs, `${label}.timeoutMs`);
+    optionalTimeoutMs(value.timeoutMs, `${label}.timeoutMs`);
     optionalPositiveInteger(value.idleTimeoutMs, `${label}.idleTimeoutMs`);
     if (value.authProfile !== undefined) {
       assertString(value.authProfile, `${label}.authProfile`);
@@ -495,11 +544,14 @@ function validateTarget(value, label) {
       if (value.routing.eventSource !== undefined)
         assertString(value.routing.eventSource, `${label}.routing.eventSource`);
     }
-    return value;
+    const target = { ...value };
+    delete target.promptFile;
+    delete target.promptSource;
+    return { ...target, ...promptFields };
   }
   throw new Error(`${label}.type must be command or agent`);
 }
-function normalizeCreateWorkflowInput(input) {
+function normalizeCreateWorkflowInput(input, opts = {}) {
   assertString(input.name, "workflow.name");
   const goal = normalizeGoalSpec(input.goal, "goal");
   if (!Array.isArray(input.steps) || input.steps.length === 0)
@@ -515,10 +567,10 @@ function normalizeCreateWorkflowInput(input) {
       ...step,
       id: step.id,
       goal: normalizeGoalSpec(step.goal, `workflow.steps[${index}].goal`),
-      target: validateTarget(step.target, `workflow.steps[${index}].target`),
+      target: validateTarget(step.target, `workflow.steps[${index}].target`, opts),
       dependsOn: optionalStringArray(step.dependsOn, `workflow.steps[${index}].dependsOn`) ?? [],
       continueOnFailure: optionalBoolean(step.continueOnFailure, `workflow.steps[${index}].continueOnFailure`) ?? false,
-      timeoutMs: optionalPositiveInteger(step.timeoutMs, `workflow.steps[${index}].timeoutMs`),
+      timeoutMs: optionalTimeoutMs(step.timeoutMs, `workflow.steps[${index}].timeoutMs`),
       account: optionalAccountRef(step.account, `workflow.steps[${index}].account`)
     };
   });
@@ -558,7 +610,7 @@ function workflowExecutionOrder(workflow) {
     visit(step);
   return order;
 }
-function workflowBodyFromJson(value, fallbackName) {
+function workflowBodyFromJson(value, fallbackName, opts = {}) {
   assertObject(value, "workflow file");
   const rawName = fallbackName ?? value.name;
   assertString(rawName, "workflow.name");
@@ -570,7 +622,7 @@ function workflowBodyFromJson(value, fallbackName) {
     goal: normalizeGoalSpec(value.goal, "goal"),
     version: typeof value.version === "number" ? value.version : undefined,
     steps: value.steps
-  });
+  }, opts);
 }
 
 // src/lib/run-artifacts.ts
@@ -1207,13 +1259,17 @@ class Store {
   }
   createLoop(input, from = new Date) {
     const now = nowIso();
+    const target = input.target.type === "workflow" ? input.target : normalizeCreateWorkflowInput({
+      name: "loop-target-validation",
+      steps: [{ id: "target", target: input.target }]
+    }).steps[0].target;
     const loop = {
       id: genId(),
       name: input.name,
       description: input.description,
       status: "active",
       schedule: input.schedule,
-      target: input.target,
+      target,
       goal: input.goal,
       machine: input.machine,
       nextRunAt: initialNextRun(input.schedule, from),
@@ -1260,6 +1316,17 @@ class Store {
     const row = this.db.query("SELECT * FROM loops WHERE name = ? ORDER BY created_at DESC LIMIT 1").get(name);
     return row ? rowToLoop(row) : undefined;
   }
+  requireUniqueLoop(idOrName) {
+    const byId = this.getLoop(idOrName);
+    if (byId)
+      return byId;
+    const rows = this.db.query("SELECT * FROM loops WHERE name = ? ORDER BY created_at DESC LIMIT 2").all(idOrName);
+    if (rows.length === 0)
+      throw new Error(`loop not found: ${idOrName}`);
+    if (rows.length > 1)
+      throw new Error(`ambiguous loop name: ${idOrName}; use a loop id`);
+    return rowToLoop(rows[0]);
+  }
   requireLoop(idOrName) {
     return this.getLoop(idOrName) ?? this.findLoopByName(idOrName) ?? (() => {
       throw new Error(`loop not found: ${idOrName}`);
@@ -1334,6 +1401,130 @@ class Store {
       throw new Error(`loop not found after update: ${id}`);
     return after;
   }
+  activeLoopReferenceCount(workflowId) {
+    const rows = this.db.query("SELECT target_json FROM loops WHERE archived_at IS NULL").all();
+    let count = 0;
+    for (const row of rows) {
+      try {
+        const target = JSON.parse(row.target_json);
+        if (target.type === "workflow" && target.workflowId === workflowId)
+          count += 1;
+      } catch {}
+    }
+    return count;
+  }
+  archiveWorkflowIfUnreferenced(workflowId, updated) {
+    if (this.activeLoopReferenceCount(workflowId) > 0)
+      return;
+    const workflow = this.getWorkflow(workflowId);
+    if (!workflow || workflow.status !== "active")
+      return;
+    const res = this.db.query("UPDATE workflow_specs SET status='archived', updated_at=? WHERE id=? AND status='active'").run(updated, workflowId);
+    if (res.changes !== 1)
+      return;
+    return this.getWorkflow(workflowId);
+  }
+  retargetWorkflowLoop(idOrName, workflowId, opts = {}) {
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const current = this.requireLoop(idOrName);
+      if (current.target.type !== "workflow")
+        throw new Error(`loop is not a workflow loop: ${idOrName}`);
+      if (this.hasRunningRun(current.id))
+        throw new Error(`refusing to retarget running loop: ${current.id}`);
+      const workflow = this.requireWorkflow(workflowId);
+      const target = { ...current.target, workflowId: workflow.id };
+      if (opts.workflowTimeoutMs !== undefined)
+        target.timeoutMs = opts.workflowTimeoutMs;
+      const res = this.db.query(`UPDATE loops SET target_json=$target, updated_at=$updated
+           WHERE id=$id
+             AND ($daemonLeaseId IS NULL OR EXISTS (
+               SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+             ))`).run({
+        $id: current.id,
+        $target: JSON.stringify(target),
+        $updated: updated,
+        $daemonLeaseId: opts.daemonLeaseId ?? null,
+        $now: updated
+      });
+      if (res.changes !== 1)
+        throw new Error("daemon lease lost");
+      this.db.exec("COMMIT");
+      const after = this.getLoop(current.id);
+      if (!after)
+        throw new Error(`loop not found after retarget: ${current.id}`);
+      return after;
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  }
+  createAndRetargetWorkflowLoop(idOrName, workflowInput, opts = {}) {
+    const normalized = normalizeCreateWorkflowInput(workflowInput);
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const current = this.requireUniqueLoop(idOrName);
+      if (current.target.type !== "workflow")
+        throw new Error(`loop is not a workflow loop: ${idOrName}`);
+      if (this.hasRunningRun(current.id))
+        throw new Error(`refusing to retarget running loop: ${current.id}`);
+      const previousWorkflow = this.requireWorkflow(current.target.workflowId);
+      const workflow = {
+        id: genId(),
+        name: normalized.name,
+        description: normalized.description,
+        version: normalized.version ?? 1,
+        status: "active",
+        goal: normalized.goal,
+        steps: normalized.steps,
+        createdAt: updated,
+        updatedAt: updated
+      };
+      this.db.query(`INSERT INTO workflow_specs (id, name, description, version, status, goal_json, steps_json, created_at, updated_at)
+           VALUES ($id, $name, $description, $version, $status, $goal, $steps, $created, $updated)`).run({
+        $id: workflow.id,
+        $name: workflow.name,
+        $description: workflow.description ?? null,
+        $version: workflow.version,
+        $status: workflow.status,
+        $goal: workflow.goal ? JSON.stringify(workflow.goal) : null,
+        $steps: JSON.stringify(workflow.steps),
+        $created: workflow.createdAt,
+        $updated: workflow.updatedAt
+      });
+      const target = { ...current.target, workflowId: workflow.id };
+      if (opts.workflowTimeoutMs !== undefined)
+        target.timeoutMs = opts.workflowTimeoutMs;
+      const res = this.db.query(`UPDATE loops SET target_json=$target, updated_at=$updated
+           WHERE id=$id
+             AND ($daemonLeaseId IS NULL OR EXISTS (
+               SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+             ))`).run({
+        $id: current.id,
+        $target: JSON.stringify(target),
+        $updated: updated,
+        $daemonLeaseId: opts.daemonLeaseId ?? null,
+        $now: updated
+      });
+      if (res.changes !== 1)
+        throw new Error("daemon lease lost");
+      const archivedOld = opts.archiveOld ? this.archiveWorkflowIfUnreferenced(previousWorkflow.id, updated) : undefined;
+      this.db.exec("COMMIT");
+      const loop = this.getLoop(current.id);
+      if (!loop)
+        throw new Error(`loop not found after retarget: ${current.id}`);
+      return { loop, workflow, previousWorkflow, archivedOld };
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  }
   renameLoop(id, name, opts = {}) {
     const current = this.getLoop(id);
     if (!current)
@@ -2914,9 +3105,9 @@ class Store {
 
 // src/cli/index.ts
 import { createHash as createHash3, randomUUID } from "crypto";
-import { closeSync, existsSync as existsSync5, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync3, realpathSync, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
+import { closeSync, existsSync as existsSync5, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync2, openSync as openSync2, readFileSync as readFileSync4, realpathSync, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
 import { spawnSync as spawnSync5 } from "child_process";
-import { join as join6, resolve as resolve2 } from "path";
+import { dirname as dirname4, join as join6, resolve as resolve3 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { Database as Database2 } from "bun:sqlite";
 import { Command } from "commander";
@@ -3559,7 +3750,7 @@ function commandSpec(target) {
       cwd: commandTarget.cwd,
       shell: commandTarget.shell,
       env: commandTarget.env,
-      timeoutMs: commandTarget.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+      timeoutMs: commandTarget.timeoutMs === undefined ? DEFAULT_TIMEOUT_MS : commandTarget.timeoutMs,
       idleTimeoutMs: commandTarget.idleTimeoutMs,
       account: commandTarget.account,
       accountTool: commandTarget.account?.tool
@@ -3570,7 +3761,7 @@ function commandSpec(target) {
     command: providerCommand(agentTarget.provider),
     args: agentArgs(agentTarget),
     cwd: agentTarget.cwd,
-    timeoutMs: agentTarget.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    timeoutMs: agentTarget.timeoutMs ?? null,
     idleTimeoutMs: agentTarget.idleTimeoutMs,
     account: agentTarget.account,
     accountTool: agentTarget.account?.tool ?? accountToolForProvider(agentTarget.provider),
@@ -3758,12 +3949,12 @@ async function executeRemoteSpec(spec, machine, metadata, opts) {
   if (opts.signal?.aborted)
     abortHandler();
   opts.signal?.addEventListener("abort", abortHandler, { once: true });
-  const timer = setTimeout(() => {
+  const timer = typeof spec.timeoutMs === "number" ? setTimeout(() => {
     timedOut = true;
     if (child.pid)
       killProcessGroup(child.pid);
-  }, spec.timeoutMs);
-  timer.unref();
+  }, spec.timeoutMs) : undefined;
+  timer?.unref();
   let idleTimer;
   const resetIdleTimer = () => {
     if (!spec.idleTimeoutMs)
@@ -3795,7 +3986,8 @@ async function executeRemoteSpec(spec, machine, metadata, opts) {
   } catch (err) {
     error = err instanceof Error ? err.message : String(err);
   } finally {
-    clearTimeout(timer);
+    if (timer)
+      clearTimeout(timer);
     if (idleTimer)
       clearTimeout(idleTimer);
     opts.signal?.removeEventListener("abort", abortHandler);
@@ -3937,12 +4129,12 @@ async function executeTarget(target, metadata = {}, opts = {}) {
   if (opts.signal?.aborted)
     abortHandler();
   opts.signal?.addEventListener("abort", abortHandler, { once: true });
-  const timer = setTimeout(() => {
+  const timer = typeof spec.timeoutMs === "number" ? setTimeout(() => {
     timedOut = true;
     if (child.pid)
       killProcessGroup(child.pid);
-  }, spec.timeoutMs);
-  timer.unref();
+  }, spec.timeoutMs) : undefined;
+  timer?.unref();
   let idleTimer;
   const resetIdleTimer = () => {
     if (!spec.idleTimeoutMs)
@@ -3974,7 +4166,8 @@ async function executeTarget(target, metadata = {}, opts = {}) {
   } catch (err) {
     error = err instanceof Error ? err.message : String(err);
   } finally {
-    clearTimeout(timer);
+    if (timer)
+      clearTimeout(timer);
     if (idleTimer)
       clearTimeout(idleTimer);
     opts.signal?.removeEventListener("abort", abortHandler);
@@ -4399,7 +4592,7 @@ ${result.stderr}`);
 // src/lib/workflow-runner.ts
 function targetWithStepAccount(step) {
   const account = step.account ?? step.target.account;
-  const timeoutMs = step.timeoutMs ?? step.target.timeoutMs;
+  const timeoutMs = step.timeoutMs !== undefined ? step.timeoutMs : step.target.timeoutMs;
   if (!account && timeoutMs === step.target.timeoutMs)
     return step.target;
   return { ...step.target, account, timeoutMs };
@@ -4695,7 +4888,8 @@ async function executeLoopTarget(store, loop, run, opts = {}) {
       })
     });
   }
-  const controller = loop.target.timeoutMs ? new AbortController : undefined;
+  const workflowTimeoutMs = typeof loop.target.timeoutMs === "number" ? loop.target.timeoutMs : undefined;
+  const controller = workflowTimeoutMs !== undefined ? new AbortController : undefined;
   let workflowTimedOut = false;
   const externalAbort = () => controller?.abort();
   if (controller && opts.signal?.aborted)
@@ -4705,13 +4899,13 @@ async function executeLoopTarget(store, loop, run, opts = {}) {
   const timer = controller ? setTimeout(() => {
     workflowTimedOut = true;
     controller.abort();
-  }, loop.target.timeoutMs) : undefined;
+  }, workflowTimeoutMs) : undefined;
   timer?.unref();
   try {
     return await executeWorkflow(store, workflow, {
       ...opts,
       signal: controller?.signal ?? opts.signal,
-      signalTimeoutMessage: () => workflowTimedOut && loop.target.type === "workflow" ? `workflow timed out after ${loop.target.timeoutMs}ms` : undefined,
+      signalTimeoutMessage: () => workflowTimedOut && loop.target.type === "workflow" ? `workflow timed out after ${workflowTimeoutMs}ms` : undefined,
       loop,
       loopRun: run,
       scheduledFor: run.scheduledFor,
@@ -5031,13 +5225,13 @@ async function tick(deps) {
 }
 
 // src/daemon/control.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2 } from "path";
 
 // src/daemon/loop.ts
 function realSleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function runLoop(opts) {
   const sleep = opts.sleep ?? realSleep;
@@ -5062,7 +5256,7 @@ function readPid(path = pidFilePath()) {
   if (!existsSync3(path))
     return;
   try {
-    const pid = Number(readFileSync(path, "utf8").trim());
+    const pid = Number(readFileSync2(path, "utf8").trim());
     return Number.isInteger(pid) && pid > 0 ? pid : undefined;
   } catch {
     return;
@@ -5487,7 +5681,11 @@ function runDoctor(store) {
       if (loop.target.type === "workflow") {
         const workflow = store.requireWorkflow(loop.target.workflowId);
         for (const step of workflowExecutionOrder(workflow)) {
-          preflightTarget({ ...step.target, account: step.account ?? step.target.account, timeoutMs: step.timeoutMs ?? step.target.timeoutMs }, { loopId: loop.id, loopName: loop.name, workflowId: workflow.id, workflowName: workflow.name, workflowStepId: step.id }, { machine: loop.machine });
+          preflightTarget({
+            ...step.target,
+            account: step.account ?? step.target.account,
+            timeoutMs: step.timeoutMs !== undefined ? step.timeoutMs : step.target.timeoutMs
+          }, { loopId: loop.id, loopName: loop.name, workflowId: workflow.id, workflowName: workflow.name, workflowStepId: step.id }, { machine: loop.machine });
         }
       } else {
         preflightTarget(loop.target, { loopId: loop.id, loopName: loop.name }, { machine: loop.machine });
@@ -5967,7 +6165,7 @@ function buildScriptInventoryReport(store, opts = {}) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.53",
+  version: "0.3.55",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -6057,9 +6255,9 @@ function packageVersion() {
 
 // src/lib/templates.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync4, lstatSync, mkdirSync as mkdirSync6, readdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename3, isAbsolute, join as join5, relative, resolve } from "path";
+import { basename as basename3, isAbsolute as isAbsolute2, join as join5, relative, resolve as resolve2 } from "path";
 var TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID = "todos-task-worker-verifier";
 var EVENT_WORKER_VERIFIER_TEMPLATE_ID = "event-worker-verifier";
 var BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID = "bounded-agent-worker-verifier";
@@ -6097,7 +6295,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
-      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated task/event worktree branches." }
+      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated task/event worktree branches." },
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -6127,7 +6326,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
-      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated event worktree branches." }
+      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated event worktree branches." },
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -6155,7 +6355,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
       { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated bounded-agent worktree branches." },
-      { name: "timeoutMs", default: "2700000", description: "Step timeout in milliseconds." }
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -6174,7 +6374,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles for non-Codewith providers." },
       { name: "provider", default: "codewith", description: "Agent provider." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
-      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." }
+      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." },
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -6279,6 +6480,30 @@ function taskLabel(input) {
   const head = input.taskTitle?.trim() || input.taskId;
   return head.length > 160 ? `${head.slice(0, 157)}...` : head;
 }
+var UNLIMITED_AGENT_TIMEOUT_MS = null;
+function agentTimeoutMs(input) {
+  return input.timeoutMs === undefined ? UNLIMITED_AGENT_TIMEOUT_MS : input.timeoutMs;
+}
+function parseTemplateTimeoutMs(raw) {
+  if (raw === undefined || raw.trim() === "")
+    return;
+  const normalized = raw.trim().toLowerCase();
+  if (["unlimited", "none", "null", "never", "off", "false"].includes(normalized))
+    return null;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error("timeoutMs must be a positive integer number of milliseconds, or unlimited/none/null");
+  }
+  return value;
+}
+function parseDeterministicTimeoutMs(raw, fallbackMs, label = "timeoutMs") {
+  if (raw === undefined || raw.trim() === "")
+    return fallbackMs;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value <= 0)
+    throw new Error(`${label} must be a positive integer number of milliseconds`);
+  return value;
+}
 function stableIndex(seed, size) {
   let hash = 2166136261;
   for (let i = 0;i < seed.length; i += 1) {
@@ -6341,7 +6566,7 @@ function normalizeWorktreeMode(mode) {
 function defaultWorktreeRoot(root) {
   if (root?.trim()) {
     const expanded = root.trim().replace(/^~(?=$|\/)/, homedir3());
-    return isAbsolute(expanded) ? expanded : resolve(expanded);
+    return isAbsolute2(expanded) ? expanded : resolve2(expanded);
   }
   return join5(homedir3(), ".hasna", "loops", "worktrees");
 }
@@ -6448,7 +6673,7 @@ function worktreePlan(input, seed) {
   const seedSlug = `${slugSegment(seed, "run").slice(0, 48)}-${stableHex(`${repoRoot}:${seed}`)}`;
   const worktreePath = join5(root, repoSlug, seedSlug);
   const relativeCwd = relative(repoRoot, originalCwd);
-  const cwd = relativeCwd && !relativeCwd.startsWith("..") && !isAbsolute(relativeCwd) ? join5(worktreePath, relativeCwd) : worktreePath;
+  const cwd = relativeCwd && !relativeCwd.startsWith("..") && !isAbsolute2(relativeCwd) ? join5(worktreePath, relativeCwd) : worktreePath;
   const branchPrefix = (input.worktreeBranchPrefix?.trim() || "openloops").replace(/^\/+|\/+$/g, "") || "openloops";
   const branch = `${branchPrefix}/${repoSlug}/${seedSlug}`;
   const prepareStep = {
@@ -6550,7 +6775,7 @@ function agentTarget(input, prompt, role, seed, plan) {
       ...input.projectGroup ? { projectGroup: input.projectGroup } : {}
     },
     account: accountForRole(input, role, seed),
-    timeoutMs: 45 * 60000
+    timeoutMs: agentTimeoutMs(input)
   };
 }
 function workflowStepsWithWorktree(plan, steps) {
@@ -6683,9 +6908,24 @@ function assertNoImplicitDangerFullAccess(value, label) {
     assertNoImplicitDangerFullAccess(entry, `${label}.${key}`);
   }
 }
+function assertNoCustomTemplatePromptFiles(value, label) {
+  if (!value || typeof value !== "object")
+    return;
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) => assertNoCustomTemplatePromptFiles(entry, `${label}[${index}]`));
+    return;
+  }
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === "promptFile") {
+      throw new Error(`${label}.${key} is not allowed in custom templates; use direct workflow JSON for prompt-file-backed workflows`);
+    }
+    assertNoCustomTemplatePromptFiles(entry, `${label}.${key}`);
+  }
+}
 function assertCustomTemplateSafety(value, label) {
   assertNoDangerousCustomTemplateScalars(value, label);
   assertNoImplicitDangerFullAccess(value, label);
+  assertNoCustomTemplatePromptFiles(value, label);
 }
 function customTemplateDefinitionFromJson(value, sourcePath) {
   assertRecord(value, sourcePath);
@@ -6715,7 +6955,7 @@ function customTemplateSummary(definition, sourcePath) {
 function readCustomTemplateFile(file) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync2(file, "utf8"));
+    parsed = JSON.parse(readFileSync3(file, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`failed to read custom template ${file}: ${message}`);
@@ -6854,19 +7094,19 @@ function renderCustomLoopTemplate(entry, values) {
   return workflow;
 }
 function validateCustomLoopTemplateFile(file) {
-  const source = resolve(file);
+  const source = resolve2(file);
   const entry = readCustomTemplateFile(source);
-  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== source);
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve2(template.path) !== source);
   assertNoTemplateCollisions([...existing, entry]);
   return structuredClone(entry.summary);
 }
 function importCustomLoopTemplate(file, opts = {}) {
-  const source = resolve(file);
+  const source = resolve2(file);
   const entry = readCustomTemplateFile(source);
   const dir = ensureCustomLoopTemplatesDir();
   const destination = join5(dir, `${entry.definition.id}.json`);
   const replaced = existsSync4(destination);
-  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== resolve(destination));
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve2(template.path) !== resolve2(destination));
   assertNoTemplateCollisions([...existing, { ...entry, path: destination, summary: customTemplateSummary(entry.definition, destination) }]);
   if (replaced) {
     const stat = lstatSync(destination);
@@ -6978,18 +7218,15 @@ function renderTodosTaskWorkerVerifierWorkflow(input) {
         name: "Worker",
         description: "Implement the todos task and record evidence.",
         target: agentTarget(input, workerPrompt, "worker", input.taskId, plan),
-        timeoutMs: 45 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "verifier",
         name: "Verifier",
         description: "Adversarially verify worker output and update todos.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: 30 * 60000
+        target: agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
+        timeoutMs: agentTimeoutMs(input)
       }
     ])
   };
@@ -7150,7 +7387,7 @@ function renderTaskLifecycleWorkflow(input) {
         name: "Triage",
         description: "Check task eligibility, duplicates, dependencies, and automation gates.",
         target: agentTarget(input, triagePrompt, "triage", input.taskId, plan),
-        timeoutMs: 20 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "triage-gate",
@@ -7172,7 +7409,7 @@ function renderTaskLifecycleWorkflow(input) {
         description: "Create a concise implementation plan and split unsafe scope before work starts.",
         dependsOn: ["triage-gate"],
         target: agentTarget(input, plannerPrompt, "planner", input.taskId, plan),
-        timeoutMs: 25 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "planner-gate",
@@ -7194,18 +7431,15 @@ function renderTaskLifecycleWorkflow(input) {
         description: "Implement the todos task according to triage and planner evidence.",
         dependsOn: ["planner-gate"],
         target: agentTarget(input, workerPrompt, "worker", input.taskId, plan),
-        timeoutMs: 45 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "verifier",
         name: "Verifier",
         description: "Adversarially verify worker output and update todos.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: 30 * 60000
+        target: agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
+        timeoutMs: agentTimeoutMs(input)
       }
     ])
   };
@@ -7275,18 +7509,15 @@ function renderEventWorkerVerifierWorkflow(input) {
         name: "Worker",
         description: "Handle the Hasna event and record evidence.",
         target: agentTarget(input, workerPrompt, "worker", seed, plan),
-        timeoutMs: 45 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "verifier",
         name: "Verifier",
         description: "Adversarially verify event handling.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", seed, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: 30 * 60000
+        target: agentTarget(input, verifierPrompt, "verifier", seed, plan),
+        timeoutMs: agentTimeoutMs(input)
       }
     ])
   };
@@ -7298,7 +7529,7 @@ function renderBoundedAgentWorkerVerifierWorkflow(input) {
     throw new Error("projectPath is required");
   const seed = `${input.projectPath}:${input.objective}`;
   const plan = worktreePlan(input, seed);
-  const timeoutMs = input.timeoutMs && Number.isFinite(input.timeoutMs) ? input.timeoutMs : 45 * 60000;
+  const timeoutMs = agentTimeoutMs(input);
   const workerPrompt = [
     `/goal ${input.objective}`,
     "",
@@ -7336,11 +7567,8 @@ function renderBoundedAgentWorkerVerifierWorkflow(input) {
         name: "Verifier",
         description: "Adversarially verify the bounded objective result.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", seed, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: Math.min(timeoutMs, 30 * 60000)
+        target: agentTarget(input, verifierPrompt, "verifier", seed, plan),
+        timeoutMs
       }
     ])
   };
@@ -7369,7 +7597,7 @@ function renderLifecycleBoundedTemplate(id, values) {
     worktreeMode: values.worktreeMode ?? (id === REPORT_ONLY_TEMPLATE_ID ? "main" : "required"),
     worktreeRoot: values.worktreeRoot,
     worktreeBranchPrefix: values.worktreeBranchPrefix,
-    timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : undefined
+    timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
   };
   if (id === TASK_LIFECYCLE_TEMPLATE_ID) {
     const taskId = values.taskId ?? "";
@@ -7406,6 +7634,7 @@ function renderLifecycleBoundedTemplate(id, values) {
       worktreeMode: values.worktreeMode ?? "required",
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs),
       eventId: values.eventId,
       eventType: values.eventType
     });
@@ -7472,6 +7701,8 @@ function renderDeterministicCheckCreateTaskWorkflow(values) {
   if (!checkCommand.trim())
     throw new Error("checkCommand is required");
   const seed = `${projectPath}:${checkCommand}`;
+  const timeoutMs = parseDeterministicTimeoutMs(values.timeoutMs, 5 * 60000);
+  const idleTimeoutMs = parseDeterministicTimeoutMs(values.idleTimeoutMs, 60000, "idleTimeoutMs");
   return {
     name: values.name ?? `deterministic-check-${stableIndex(seed, 4294967295).toString(16).padStart(8, "0")}`,
     description: values.description ?? "Deterministic check that writes compact evidence and upserts one deduped todos task when the expectation is not met.",
@@ -7486,10 +7717,10 @@ function renderDeterministicCheckCreateTaskWorkflow(values) {
           command: "bash",
           args: ["-lc", checkCommand],
           cwd: projectPath,
-          timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : 5 * 60000,
-          idleTimeoutMs: values.idleTimeoutMs ? Number(values.idleTimeoutMs) : 60000
+          timeoutMs,
+          idleTimeoutMs
         },
-        timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : 5 * 60000
+        timeoutMs
       }
     ]
   };
@@ -7527,6 +7758,7 @@ function renderBuiltinLoopTemplate(id, values) {
       worktreeMode: values.worktreeMode,
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs),
       eventId: values.eventId,
       eventType: values.eventType
     });
@@ -7558,7 +7790,8 @@ function renderBuiltinLoopTemplate(id, values) {
       manualBreakGlass: booleanVar(values.manualBreakGlass),
       worktreeMode: values.worktreeMode,
       worktreeRoot: values.worktreeRoot,
-      worktreeBranchPrefix: values.worktreeBranchPrefix
+      worktreeBranchPrefix: values.worktreeBranchPrefix,
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
     });
   }
   if (id === BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID) {
@@ -7586,7 +7819,7 @@ function renderBuiltinLoopTemplate(id, values) {
       worktreeMode: values.worktreeMode,
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
-      timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : undefined
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
     });
   }
   throw new Error(`unknown template: ${id}`);
@@ -7672,12 +7905,13 @@ function validationFailed(error, context) {
   });
   process.exit(1);
 }
-function validateLoopTargetForStorage(target, context) {
+function normalizeLoopTargetForStorage(target, context, opts = {}) {
   try {
-    workflowBodyFromJson({
+    const workflow = workflowBodyFromJson({
       name: "loop-target-validation",
       steps: [{ id: "target", target }]
-    });
+    }, undefined, opts);
+    return workflow.steps[0].target;
   } catch (error) {
     validationFailed(error, context);
   }
@@ -7689,6 +7923,14 @@ function normalizeWorkflowForStorage(body, context) {
     validationFailed(error, context);
   }
 }
+function workflowBodyFromFile(file, fallbackName, context) {
+  try {
+    const resolved = resolve3(file);
+    return workflowBodyFromJson(JSON.parse(readFileSync4(resolved, "utf8")), fallbackName, { baseDir: dirname4(resolved) });
+  } catch (error) {
+    validationFailed(error, context);
+  }
+}
 function preflightLoopTarget(target, context, metadata, opts) {
   try {
     return preflightTarget(target, metadata, opts);
@@ -7717,6 +7959,48 @@ function workflowSpecForPreflight(body, id = "validation") {
     updatedAt: now
   };
 }
+function publicWorkflowBody(body) {
+  const value = publicWorkflow(workflowSpecForPreflight(body, "render"));
+  const { id: _id, status: _status, createdAt: _createdAt, updatedAt: _updatedAt, ...bodyOnly } = value;
+  return bodyOnly;
+}
+function workflowWithAgentTimeouts(workflow, timeoutMs, opts = {}) {
+  let changed = false;
+  const agentStepIds = [];
+  const steps = workflow.steps.map((step) => {
+    if (step.target.type !== "agent")
+      return step;
+    agentStepIds.push(step.id);
+    const target = { ...step.target, timeoutMs };
+    if (timeoutMs === null && target.idleTimeoutMs !== undefined) {
+      delete target.idleTimeoutMs;
+      changed = true;
+    }
+    if (step.timeoutMs !== timeoutMs || step.target.timeoutMs !== timeoutMs)
+      changed = true;
+    return {
+      ...step,
+      target,
+      timeoutMs
+    };
+  });
+  return {
+    body: {
+      name: opts.name ?? workflow.name,
+      description: workflow.description,
+      version: workflow.version,
+      goal: workflow.goal,
+      steps
+    },
+    changed,
+    agentStepIds
+  };
+}
+function workflowTimeoutMigrationName(workflow, timeoutMs) {
+  const policy = timeoutMs === null ? "agent-timeout-unlimited" : `agent-timeout-${timeoutMs}ms`;
+  const suffix = randomUUID().replace(/-/g, "").slice(0, 8);
+  return `${workflow.name}-${policy}-${suffix}`;
+}
 function printTextOutput(value) {
   for (const line of textOutputBlocks(value, { indent: "  " }))
     console.log(line);
@@ -7757,6 +8041,17 @@ function positiveDuration(raw, label) {
     throw new Error(`${label} must be greater than zero`);
   return value;
 }
+function timeoutDuration(raw, label) {
+  if (raw === undefined)
+    return;
+  const normalized = raw.trim().toLowerCase();
+  if (["none", "unlimited", "null", "never", "off", "false"].includes(normalized))
+    return null;
+  const value = parseDuration(raw);
+  if (!Number.isFinite(value) || value <= 0)
+    throw new Error(`${label} must be a duration greater than zero, or none/unlimited`);
+  return value;
+}
 function parsePolicy(opts) {
   const catchUp = opts.catchUp ?? "latest";
   if (!["none", "latest", "all"].includes(catchUp))
@@ -7913,7 +8208,7 @@ function runLocalCommandWithStdoutFile(command, args, opts = {}) {
     return {
       ok: result.status === 0,
       status: result.status,
-      stdout: readFileSync3(stdoutPath, "utf8"),
+      stdout: readFileSync4(stdoutPath, "utf8"),
       stderr: typeof result.stderr === "string" ? result.stderr : result.stderr?.toString() || "",
       error: result.error ? String(result.error.message || result.error) : ""
     };
@@ -7957,7 +8252,7 @@ function readRouteCursors() {
   if (!existsSync5(path))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -8312,7 +8607,7 @@ function hasThrottleLimits(limits) {
 function normalizeRoutePath(value) {
   if (!value?.trim())
     return;
-  const resolved = resolve2(value.trim());
+  const resolved = resolve3(value.trim());
   let canonical = resolved;
   try {
     canonical = realpathSync(resolved);
@@ -8324,7 +8619,7 @@ function normalizeRoutePath(value) {
     try {
       return realpathSync(gitRoot.stdout.trim());
     } catch {
-      return resolve2(gitRoot.stdout.trim());
+      return resolve3(gitRoot.stdout.trim());
     }
   }
   return canonical;
@@ -8333,7 +8628,7 @@ function routeProjectGroup(optsGroup, data, metadata) {
   return optsGroup?.trim() || taskEventField(data, ["project_group", "projectGroup", "repo_group", "repoGroup", "workspace_group", "workspaceGroup"]) || taskEventField(metadata, ["project_group", "projectGroup", "repo_group", "repoGroup", "workspace_group", "workspaceGroup"]);
 }
 function routeThrottleDecision(store, args) {
-  const projectPath = normalizeRoutePath(args.projectPath) ?? resolve2(args.projectPath);
+  const projectPath = normalizeRoutePath(args.projectPath) ?? resolve3(args.projectPath);
   const projectGroup = args.projectGroup?.trim() || undefined;
   const counts = store.countActiveWorkflowWorkItems({ projectKey: projectPath, projectGroup });
   const base = {
@@ -8358,7 +8653,7 @@ function routeThrottleDecision(store, args) {
   return { ...base, allowed: true };
 }
 function routeThrottleDryRunPreview(args) {
-  const projectPath = normalizeRoutePath(args.projectPath) ?? resolve2(args.projectPath);
+  const projectPath = normalizeRoutePath(args.projectPath) ?? resolve3(args.projectPath);
   const projectGroup = args.projectGroup?.trim() || undefined;
   return {
     evaluated: false,
@@ -8380,7 +8675,7 @@ function todosTaskRouteTemplateId(opts) {
   return id;
 }
 async function readEventEnvelopeInput(opts = {}) {
-  const raw = opts.eventJson ?? (opts.eventFile ? readFileSync3(opts.eventFile, "utf8") : process.env.HASNA_EVENT_JSON || await Bun.stdin.text());
+  const raw = opts.eventJson ?? (opts.eventFile ? readFileSync4(opts.eventFile, "utf8") : process.env.HASNA_EVENT_JSON || await Bun.stdin.text());
   const event = JSON.parse(raw);
   if (!event || typeof event !== "object" || Array.isArray(event))
     throw new Error("event JSON must be an object");
@@ -8421,7 +8716,7 @@ function routeTodosTaskEvent(event, opts) {
     "cwd"
   ]);
   const projectPath = dataProjectPath ?? metadataProjectPath ?? opts.projectPath ?? process.cwd();
-  const routeProjectPath = normalizeRoutePath(projectPath) ?? resolve2(projectPath);
+  const routeProjectPath = normalizeRoutePath(projectPath) ?? resolve3(projectPath);
   const projectGroup = routeProjectGroup(opts.projectGroup, data, metadata);
   const throttleLimits = routeThrottleLimitsFromOpts(opts);
   const idempotencyKey = `todos-task:${taskId}`;
@@ -8487,6 +8782,7 @@ function routeTodosTaskEvent(event, opts) {
     variant: opts.variant,
     agent: opts.agent,
     addDirs: listFromRepeatedOpts(opts.addDir),
+    timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
     permissionMode,
     sandbox,
     manualBreakGlass: Boolean(opts.manualBreakGlass),
@@ -8671,7 +8967,7 @@ function routeGenericEvent(event, opts) {
   const data = eventData(event);
   const metadata = eventMetadata(event);
   const projectPath = opts.projectPath ?? taskEventField(data, ["working_dir", "workingDir", "project_path", "projectPath", "cwd", "repo_path", "repoPath"]) ?? taskEventField(metadata, ["working_dir", "workingDir", "project_path", "projectPath", "project_canonical_path", "cwd", "repo_path", "repoPath"]) ?? process.cwd();
-  const routeProjectPath = normalizeRoutePath(projectPath) ?? resolve2(projectPath);
+  const routeProjectPath = normalizeRoutePath(projectPath) ?? resolve3(projectPath);
   const projectGroup = routeProjectGroup(opts.projectGroup, data, metadata);
   const throttleLimits = routeThrottleLimitsFromOpts(opts);
   const eventSuffix = event.id.slice(0, 8);
@@ -8709,6 +9005,7 @@ function routeGenericEvent(event, opts) {
     variant: opts.variant,
     agent: opts.agent,
     addDirs: listFromRepeatedOpts(opts.addDir),
+    timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
     permissionMode,
     sandbox,
     manualBreakGlass: Boolean(opts.manualBreakGlass),
@@ -9001,8 +9298,8 @@ function taskMatchesDrainFilters(task, filters) {
     const path = taskProjectPath(task);
     if (!path)
       return false;
-    const normalizedPath = normalizeRoutePath(path) ?? resolve2(path);
-    const normalizedPrefix = normalizeRoutePath(filters.projectPathPrefix) ?? resolve2(filters.projectPathPrefix);
+    const normalizedPath = normalizeRoutePath(path) ?? resolve3(path);
+    const normalizedPrefix = normalizeRoutePath(filters.projectPathPrefix) ?? resolve3(filters.projectPathPrefix);
     if (normalizedPath !== normalizedPrefix && !normalizedPath.startsWith(`${normalizedPrefix}/`))
       return false;
   }
@@ -9057,7 +9354,7 @@ function permissionModeFromOpts(opts, provider) {
   return mode;
 }
 var create = program.command("create").description("create loops");
-addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("command <name>").description("create a deterministic shell command loop").requiredOption("--cmd <command>", "command string to execute").option("--cwd <dir>", "working directory").option("--timeout <duration>", "run timeout").option("--no-shell", "execute without a shell").option("--preflight-each-run", "check target executables/accounts before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
+addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("command <name>").description("create a deterministic shell command loop").requiredOption("--cmd <command>", "command string to execute").option("--cwd <dir>", "working directory").option("--timeout <duration>", "run timeout; use none/unlimited for no timeout").option("--no-shell", "execute without a shell").option("--preflight-each-run", "check target executables/accounts before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
   const store = new Store;
   try {
     const target = {
@@ -9065,7 +9362,7 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
       command: opts.cmd,
       cwd: opts.cwd,
       shell: opts.shell,
-      timeoutMs: opts.timeout ? parseDuration(opts.timeout) : undefined,
+      timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
       account: accountFromOpts(opts),
       preflight: runtimePreflightFromOpts(opts)
     };
@@ -9077,7 +9374,7 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
     store.close();
   }
 });
-addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").requiredOption("--prompt <prompt>", "agent prompt").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "run timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass").option("--sandbox <mode>", "provider sandbox: codewith/codex use read-only/workspace-write/danger-full-access; cursor uses enabled/disabled").option("--allow-tool <name>", "advisory per-session tool allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--allow-command <name>", "advisory per-session command allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--config-isolation <mode>", "safe or none", "safe").option("--preflight-each-run", "check provider/account readiness before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
+addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").option("--prompt <prompt>", "agent prompt").option("--prompt-file <file>", "read the agent prompt from a markdown/text file").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "run timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass").option("--sandbox <mode>", "provider sandbox: codewith/codex use read-only/workspace-write/danger-full-access; cursor uses enabled/disabled").option("--allow-tool <name>", "advisory per-session tool allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--allow-command <name>", "advisory per-session command allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--config-isolation <mode>", "safe or none", "safe").option("--preflight-each-run", "check provider/account readiness before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
   const provider = opts.provider;
   if (!["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"].includes(provider)) {
     throw new Error("unsupported provider");
@@ -9087,26 +9384,26 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
   }
   const store = new Store;
   try {
-    const target = {
+    const target = normalizeLoopTargetForStorage({
       type: "agent",
       provider,
       prompt: opts.prompt,
+      promptFile: opts.promptFile,
       cwd: opts.cwd,
       model: opts.model,
       variant: opts.variant,
       agent: opts.agent,
       authProfile: providerAuthProfileFromOpts(opts, provider),
       addDirs: listFromRepeatedOpts(opts.addDir),
-      timeoutMs: opts.timeout ? parseDuration(opts.timeout) : undefined,
+      timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
       configIsolation: opts.configIsolation,
       permissionMode: permissionModeFromOpts(opts, provider),
       sandbox: sandboxFromOpts(opts, provider),
       allowlist: allowlistFromOpts(opts),
       account: accountFromOpts(opts),
       preflight: runtimePreflightFromOpts(opts)
-    };
+    }, { name, type: "agent", provider }, { baseDir: process.cwd() });
     const input = baseCreateInput(name, opts, target);
-    validateLoopTargetForStorage(input.target, { name, type: "agent", provider });
     const preflight = opts.preflight ? preflightLoopTarget(input.target, { name, type: "agent", provider }, { loopName: name }, { machine: input.machine }) : undefined;
     const loop = store.createLoop(input);
     printCreatedLoop(loop, `created loop ${loop.id} (${loop.name}) next=${loop.nextRunAt}`, preflight);
@@ -9114,13 +9411,14 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
     store.close();
   }
 });
-addGoalOptions(addMachineOptions(addScheduleOptions(create.command("workflow <name>").description("schedule a stored workflow").requiredOption("--workflow <idOrName>", "workflow id or name").option("--preflight-each-run", "check workflow steps before every scheduled run").option("--preflight", "check workflow step executables/accounts before storing the loop")))).action((name, opts) => {
+addGoalOptions(addMachineOptions(addScheduleOptions(create.command("workflow <name>").description("schedule a stored workflow").requiredOption("--workflow <idOrName>", "workflow id or name").option("--timeout <duration>", "workflow run timeout; use none/unlimited for no workflow-level timeout").option("--preflight-each-run", "check workflow steps before every scheduled run").option("--preflight", "check workflow step executables/accounts before storing the loop")))).action((name, opts) => {
   const store = new Store;
   try {
     const workflow = store.requireWorkflow(opts.workflow);
     const target = {
       type: "workflow",
       workflowId: workflow.id,
+      timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
       preflight: runtimePreflightFromOpts(opts)
     };
     const input = baseCreateInput(name, opts, target);
@@ -9138,10 +9436,10 @@ var events = program.command("events").description("handle Hasna event envelopes
 var machines = program.command("machines").description("inspect OpenMachines topology for loop assignment");
 var goal = program.command("goal").description("inspect goal runs");
 function addRouteEventOptions(command) {
-  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
+  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
 }
 function addTodosDrainOptions(command, opts = {}) {
-  let configured = command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", opts.preflightDescription ?? "check generated workflow steps before storing workflow loops");
+  let configured = command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", opts.preflightDescription ?? "check generated workflow steps before storing workflow loops");
   if (opts.includeDryRun ?? true) {
     configured = configured.option("--dry-run", "preview selected tasks and generated workflow loops without storing anything");
   }
@@ -9194,6 +9492,7 @@ function routeDrainArgs(opts) {
   add("--agent", opts.agent);
   for (const dir of listFromRepeatedOpts(opts.addDir) ?? [])
     add("--add-dir", dir);
+  add("--timeout", opts.timeout);
   add("--permission-mode", opts.permissionMode);
   add("--sandbox", opts.sandbox);
   addBool("--manual-break-glass", opts.manualBreakGlass);
@@ -9400,7 +9699,8 @@ addTemplateSourceOption(templates.command("show <id>").description("show a templ
 });
 addTemplateSourceOption(templates.command("render <id>").description("render a template as workflow JSON").option("--var <key=value>", "template variable; may be repeated", collectValues, [])).action((id, opts) => {
   const workflow = renderLoopTemplate(id, parseVars(opts.var), { source: templateSource(opts.source) });
-  print(workflow, JSON.stringify(workflow, null, 2));
+  const value = publicWorkflowBody(workflow);
+  print(value, JSON.stringify(value, null, 2));
 });
 addTemplateSourceOption(templates.command("create-workflow <id>").description("render and store a template as a workflow").option("--var <key=value>", "template variable; may be repeated", collectValues, [])).action((id, opts) => {
   const store = new Store;
@@ -9504,7 +9804,7 @@ addScheduleOptions(addTodosDrainOptions(routes.command("schedule <kind> <name>")
   }
 });
 var eventsHandle = events.command("handle").description("handle a Hasna event envelope");
-eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
+eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
   const event = await readEventEnvelopeFromStdin();
   const result = routeTodosTaskEvent(event, opts);
   print(result.value, result.human);
@@ -9513,7 +9813,7 @@ var eventsDrain = events.command("drain").description("drain durable source queu
 addTodosDrainOptions(eventsDrain.command("todos-task").description("drain ready todos tasks into bounded worker/verifier workflow loops")).action((opts) => {
   drainTodosTaskRoutes(opts);
 });
-eventsHandle.command("generic").description("create a one-shot worker/verifier workflow loop for any Hasna event").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated event worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:generic").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
+eventsHandle.command("generic").description("create a one-shot worker/verifier workflow loop for any Hasna event").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated event worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:generic").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
   const event = await readEventEnvelopeFromStdin();
   const result = routeGenericEvent(event, opts);
   print(result.value, result.human);
@@ -9577,7 +9877,7 @@ machines.command("show <id>").description("resolve a machine assignment").action
   print(resolveLoopMachine(id));
 });
 workflows.command("validate <file>").description("validate a workflow JSON file without storing or running it").option("--name <name>", "override workflow name from the file").option("--preflight", "also check account env and target executables").action((file, opts) => {
-  const body = workflowBodyFromJson(JSON.parse(readFileSync3(file, "utf8")), opts.name);
+  const body = workflowBodyFromFile(file, opts.name, { file, type: "workflow" });
   const workflow = workflowSpecForPreflight(body);
   const preflight = opts.preflight ? preflightWorkflow(workflow) : undefined;
   print({ valid: true, workflow: publicWorkflow(workflow), preflight }, `valid workflow ${workflow.name} steps=${workflow.steps.length}`);
@@ -9585,7 +9885,7 @@ workflows.command("validate <file>").description("validate a workflow JSON file
 workflows.command("create <file>").description("validate and store a workflow JSON file").option("--name <name>", "override workflow name from the file").option("--preflight", "also check account env and target executables before storing").action((file, opts) => {
   const store = new Store;
   try {
-    const body = workflowBodyFromJson(JSON.parse(readFileSync3(file, "utf8")), opts.name);
+    const body = workflowBodyFromFile(file, opts.name, { file, type: "workflow" });
     const preflight = opts.preflight ? preflightStoredWorkflow(workflowSpecForPreflight(body, "creation-preflight"), { name: body.name, type: "workflow" }, {}) : undefined;
     const workflow = store.createWorkflow(body);
     if (preflight !== undefined)
@@ -9729,6 +10029,75 @@ workflows.command("recover <runId>").description("reset interrupted running work
     store.close();
   }
 });
+workflows.command("migrate-agent-timeouts").description("append-only migrate active workflow loops to a new agent timeout policy").option("--loop <idOrName>", "migrate only one loop instead of all active workflow loops").option("--timeout <duration>", "agent timeout policy; use none/unlimited for no timeout", "none").option("--apply", "create new workflow specs and retarget eligible loops").option("--archive-old", "archive old workflow specs after retargeting when no active loops still reference them").action((opts) => {
+  const store = new Store;
+  try {
+    const timeoutMs = timeoutDuration(opts.timeout, "--timeout") ?? null;
+    const candidateLoops = opts.loop ? [store.requireUniqueLoop(opts.loop)] : store.listLoops({ status: "active", limit: 1e4 }).filter((loop) => loop.target.type === "workflow");
+    const rows = [];
+    for (const loop of candidateLoops) {
+      if (loop.archivedAt) {
+        rows.push({ loop: publicLoop(loop), status: "skipped", reason: "loop is archived" });
+        continue;
+      }
+      if (loop.target.type !== "workflow") {
+        rows.push({ loop: publicLoop(loop), status: "skipped", reason: "loop is not a workflow loop" });
+        continue;
+      }
+      const workflow = store.requireWorkflow(loop.target.workflowId);
+      const nextWorkflowName = workflowTimeoutMigrationName(workflow, timeoutMs);
+      const migration = workflowWithAgentTimeouts(workflow, timeoutMs, { name: nextWorkflowName });
+      if (migration.agentStepIds.length === 0) {
+        rows.push({ loop: publicLoop(loop), workflow: publicWorkflow(workflow), status: "skipped", reason: "workflow has no agent steps" });
+        continue;
+      }
+      if (!migration.changed) {
+        rows.push({ loop: publicLoop(loop), workflow: publicWorkflow(workflow), status: "skipped", reason: "agent timeout policy already matches" });
+        continue;
+      }
+      if (store.hasRunningRun(loop.id)) {
+        rows.push({ loop: publicLoop(loop), workflow: publicWorkflow(workflow), status: "blocked", reason: "loop has a running run; retry after it finishes" });
+        continue;
+      }
+      if (!opts.apply) {
+        rows.push({
+          loop: publicLoop(loop),
+          workflow: publicWorkflow(workflow),
+          status: "would_migrate",
+          agentStepIds: migration.agentStepIds,
+          nextWorkflowName,
+          timeoutMs
+        });
+        continue;
+      }
+      const migrated = store.createAndRetargetWorkflowLoop(loop.id, migration.body, {
+        workflowTimeoutMs: timeoutMs,
+        archiveOld: Boolean(opts.archiveOld)
+      });
+      rows.push({
+        loop: publicLoop(migrated.loop),
+        previousWorkflow: publicWorkflow(migrated.previousWorkflow),
+        workflow: publicWorkflow(migrated.workflow),
+        archivedOld: migrated.archivedOld ? publicWorkflow(migrated.archivedOld) : undefined,
+        status: "migrated",
+        agentStepIds: migration.agentStepIds,
+        timeoutMs
+      });
+    }
+    const summary = {
+      apply: Boolean(opts.apply),
+      timeoutMs,
+      total: rows.length,
+      migrated: rows.filter((row) => row.status === "migrated").length,
+      wouldMigrate: rows.filter((row) => row.status === "would_migrate").length,
+      blocked: rows.filter((row) => row.status === "blocked").length,
+      skipped: rows.filter((row) => row.status === "skipped").length
+    };
+    print({ summary, rows }, opts.apply ? `migrated=${summary.migrated} blocked=${summary.blocked} skipped=${summary.skipped}` : `would_migrate=${summary.wouldMigrate} blocked=${summary.blocked} skipped=${summary.skipped}`);
+  } finally {
+    store.close();
+  }
+});
 workflows.command("archive <idOrName>").action((idOrName) => {
   const store = new Store;
   try {
@@ -10394,7 +10763,7 @@ daemon.command("logs").option("-n, --lines <n>", "lines", "80").action((opts) =>
     console.log("");
     return;
   }
-  const lines = readFileSync3(path, "utf8").trimEnd().split(`
+  const lines = readFileSync4(path, "utf8").trimEnd().split(`
 `);
   console.log(lines.slice(-Number(opts.lines)).join(`
 `));