@hasna/loops 0.3.53 → 0.3.55

package/dist/index.js

@@ -312,6 +312,8 @@ function updateReadyFlags(nodes, planStatus) {
 }
 
 // src/lib/workflow-spec.ts
+import { readFileSync } from "fs";
+import { isAbsolute, resolve } from "path";
 function assertObject(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     throw new Error(`${label} must be an object`);
@@ -327,6 +329,15 @@ function optionalPositiveInteger(value, label) {
     throw new Error(`${label} must be a positive integer`);
   return value;
 }
+function optionalTimeoutMs(value, label) {
+  if (value === undefined)
+    return;
+  if (value === null)
+    return null;
+  if (!Number.isInteger(value) || value <= 0)
+    throw new Error(`${label} must be a positive integer or null for unlimited`);
+  return value;
+}
 function optionalBoolean(value, label) {
   if (value === undefined)
     return;
@@ -357,6 +368,38 @@ function optionalAccountRef(value, label) {
     tool: typeof value.tool === "string" ? value.tool.trim() : undefined
   };
 }
+function promptFilePath(rawPath, opts) {
+  return isAbsolute(rawPath) ? resolve(rawPath) : resolve(opts.baseDir ?? process.cwd(), rawPath);
+}
+function readPromptFile(rawPath, label, opts) {
+  assertString(rawPath, `${label}.promptFile`);
+  const path = promptFilePath(rawPath.trim(), opts);
+  let prompt;
+  try {
+    prompt = readFileSync(path, "utf8");
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error ? String(error.code) : undefined;
+    throw new Error(`${label}.promptFile could not be read${code ? `: ${code}` : ""}`);
+  }
+  if (prompt.trim() === "")
+    throw new Error(`${label}.promptFile must contain a non-empty prompt`);
+  return { prompt, promptSource: { type: "file", path } };
+}
+function matchingPromptSource(value, prompt, opts) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  if (value.type !== "file")
+    return;
+  const rawPath = value.path;
+  if (typeof rawPath !== "string" || rawPath.trim() === "")
+    return;
+  const path = promptFilePath(rawPath.trim(), opts);
+  try {
+    return readFileSync(path, "utf8") === prompt ? { type: "file", path } : undefined;
+  } catch {
+    return;
+  }
+}
 function normalizeGoalSpec(value, label = "goal") {
   if (value === undefined)
     return;
@@ -379,11 +422,11 @@ function normalizeGoalSpec(value, label = "goal") {
     autoExecute
   };
 }
-function validateTarget(value, label) {
+function validateTarget(value, label, opts) {
   assertObject(value, label);
   if (value.type === "command") {
     assertString(value.command, `${label}.command`);
-    optionalPositiveInteger(value.timeoutMs, `${label}.timeoutMs`);
+    optionalTimeoutMs(value.timeoutMs, `${label}.timeoutMs`);
     optionalPositiveInteger(value.idleTimeoutMs, `${label}.idleTimeoutMs`);
     if (value.shell !== true && /\s/.test(value.command.trim())) {
       throw new Error(`${label}.command must be an executable without spaces when shell is false; put flags in args or set shell true`);
@@ -392,11 +435,17 @@ function validateTarget(value, label) {
   }
   if (value.type === "agent") {
     assertString(value.provider, `${label}.provider`);
-    assertString(value.prompt, `${label}.prompt`);
+    const hasPrompt = typeof value.prompt === "string" && value.prompt.trim() !== "";
+    const hasPromptFile = typeof value.promptFile === "string" && value.promptFile.trim() !== "";
+    if (hasPrompt && hasPromptFile)
+      throw new Error(`${label} must use either prompt or promptFile, not both`);
+    if (!hasPrompt && !hasPromptFile)
+      throw new Error(`${label}.prompt must be a non-empty string or ${label}.promptFile must be set`);
+    const promptFields = hasPrompt ? { prompt: value.prompt, promptSource: matchingPromptSource(value.promptSource, value.prompt, opts) } : readPromptFile(value.promptFile, label, opts);
     const providers = ["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"];
     if (!providers.includes(value.provider))
       throw new Error(`${label}.provider must be one of ${providers.join(", ")}`);
-    optionalPositiveInteger(value.timeoutMs, `${label}.timeoutMs`);
+    optionalTimeoutMs(value.timeoutMs, `${label}.timeoutMs`);
     optionalPositiveInteger(value.idleTimeoutMs, `${label}.idleTimeoutMs`);
     if (value.authProfile !== undefined) {
       assertString(value.authProfile, `${label}.authProfile`);
@@ -493,11 +542,14 @@ function validateTarget(value, label) {
       if (value.routing.eventSource !== undefined)
         assertString(value.routing.eventSource, `${label}.routing.eventSource`);
     }
-    return value;
+    const target = { ...value };
+    delete target.promptFile;
+    delete target.promptSource;
+    return { ...target, ...promptFields };
   }
   throw new Error(`${label}.type must be command or agent`);
 }
-function normalizeCreateWorkflowInput(input) {
+function normalizeCreateWorkflowInput(input, opts = {}) {
   assertString(input.name, "workflow.name");
   const goal = normalizeGoalSpec(input.goal, "goal");
   if (!Array.isArray(input.steps) || input.steps.length === 0)
@@ -513,10 +565,10 @@ function normalizeCreateWorkflowInput(input) {
       ...step,
       id: step.id,
       goal: normalizeGoalSpec(step.goal, `workflow.steps[${index}].goal`),
-      target: validateTarget(step.target, `workflow.steps[${index}].target`),
+      target: validateTarget(step.target, `workflow.steps[${index}].target`, opts),
       dependsOn: optionalStringArray(step.dependsOn, `workflow.steps[${index}].dependsOn`) ?? [],
       continueOnFailure: optionalBoolean(step.continueOnFailure, `workflow.steps[${index}].continueOnFailure`) ?? false,
-      timeoutMs: optionalPositiveInteger(step.timeoutMs, `workflow.steps[${index}].timeoutMs`),
+      timeoutMs: optionalTimeoutMs(step.timeoutMs, `workflow.steps[${index}].timeoutMs`),
       account: optionalAccountRef(step.account, `workflow.steps[${index}].account`)
     };
   });
@@ -556,7 +608,7 @@ function workflowExecutionOrder(workflow) {
     visit(step);
   return order;
 }
-function workflowBodyFromJson(value, fallbackName) {
+function workflowBodyFromJson(value, fallbackName, opts = {}) {
   assertObject(value, "workflow file");
   const rawName = fallbackName ?? value.name;
   assertString(rawName, "workflow.name");
@@ -568,7 +620,7 @@ function workflowBodyFromJson(value, fallbackName) {
     goal: normalizeGoalSpec(value.goal, "goal"),
     version: typeof value.version === "number" ? value.version : undefined,
     steps: value.steps
-  });
+  }, opts);
 }
 
 // src/lib/run-artifacts.ts
@@ -1205,13 +1257,17 @@ class Store {
   }
   createLoop(input, from = new Date) {
     const now = nowIso();
+    const target = input.target.type === "workflow" ? input.target : normalizeCreateWorkflowInput({
+      name: "loop-target-validation",
+      steps: [{ id: "target", target: input.target }]
+    }).steps[0].target;
     const loop = {
       id: genId(),
       name: input.name,
       description: input.description,
       status: "active",
       schedule: input.schedule,
-      target: input.target,
+      target,
       goal: input.goal,
       machine: input.machine,
       nextRunAt: initialNextRun(input.schedule, from),
@@ -1258,6 +1314,17 @@ class Store {
     const row = this.db.query("SELECT * FROM loops WHERE name = ? ORDER BY created_at DESC LIMIT 1").get(name);
     return row ? rowToLoop(row) : undefined;
   }
+  requireUniqueLoop(idOrName) {
+    const byId = this.getLoop(idOrName);
+    if (byId)
+      return byId;
+    const rows = this.db.query("SELECT * FROM loops WHERE name = ? ORDER BY created_at DESC LIMIT 2").all(idOrName);
+    if (rows.length === 0)
+      throw new Error(`loop not found: ${idOrName}`);
+    if (rows.length > 1)
+      throw new Error(`ambiguous loop name: ${idOrName}; use a loop id`);
+    return rowToLoop(rows[0]);
+  }
   requireLoop(idOrName) {
     return this.getLoop(idOrName) ?? this.findLoopByName(idOrName) ?? (() => {
       throw new Error(`loop not found: ${idOrName}`);
@@ -1332,6 +1399,130 @@ class Store {
       throw new Error(`loop not found after update: ${id}`);
     return after;
   }
+  activeLoopReferenceCount(workflowId) {
+    const rows = this.db.query("SELECT target_json FROM loops WHERE archived_at IS NULL").all();
+    let count = 0;
+    for (const row of rows) {
+      try {
+        const target = JSON.parse(row.target_json);
+        if (target.type === "workflow" && target.workflowId === workflowId)
+          count += 1;
+      } catch {}
+    }
+    return count;
+  }
+  archiveWorkflowIfUnreferenced(workflowId, updated) {
+    if (this.activeLoopReferenceCount(workflowId) > 0)
+      return;
+    const workflow = this.getWorkflow(workflowId);
+    if (!workflow || workflow.status !== "active")
+      return;
+    const res = this.db.query("UPDATE workflow_specs SET status='archived', updated_at=? WHERE id=? AND status='active'").run(updated, workflowId);
+    if (res.changes !== 1)
+      return;
+    return this.getWorkflow(workflowId);
+  }
+  retargetWorkflowLoop(idOrName, workflowId, opts = {}) {
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const current = this.requireLoop(idOrName);
+      if (current.target.type !== "workflow")
+        throw new Error(`loop is not a workflow loop: ${idOrName}`);
+      if (this.hasRunningRun(current.id))
+        throw new Error(`refusing to retarget running loop: ${current.id}`);
+      const workflow = this.requireWorkflow(workflowId);
+      const target = { ...current.target, workflowId: workflow.id };
+      if (opts.workflowTimeoutMs !== undefined)
+        target.timeoutMs = opts.workflowTimeoutMs;
+      const res = this.db.query(`UPDATE loops SET target_json=$target, updated_at=$updated
+           WHERE id=$id
+             AND ($daemonLeaseId IS NULL OR EXISTS (
+               SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+             ))`).run({
+        $id: current.id,
+        $target: JSON.stringify(target),
+        $updated: updated,
+        $daemonLeaseId: opts.daemonLeaseId ?? null,
+        $now: updated
+      });
+      if (res.changes !== 1)
+        throw new Error("daemon lease lost");
+      this.db.exec("COMMIT");
+      const after = this.getLoop(current.id);
+      if (!after)
+        throw new Error(`loop not found after retarget: ${current.id}`);
+      return after;
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  }
+  createAndRetargetWorkflowLoop(idOrName, workflowInput, opts = {}) {
+    const normalized = normalizeCreateWorkflowInput(workflowInput);
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const current = this.requireUniqueLoop(idOrName);
+      if (current.target.type !== "workflow")
+        throw new Error(`loop is not a workflow loop: ${idOrName}`);
+      if (this.hasRunningRun(current.id))
+        throw new Error(`refusing to retarget running loop: ${current.id}`);
+      const previousWorkflow = this.requireWorkflow(current.target.workflowId);
+      const workflow = {
+        id: genId(),
+        name: normalized.name,
+        description: normalized.description,
+        version: normalized.version ?? 1,
+        status: "active",
+        goal: normalized.goal,
+        steps: normalized.steps,
+        createdAt: updated,
+        updatedAt: updated
+      };
+      this.db.query(`INSERT INTO workflow_specs (id, name, description, version, status, goal_json, steps_json, created_at, updated_at)
+           VALUES ($id, $name, $description, $version, $status, $goal, $steps, $created, $updated)`).run({
+        $id: workflow.id,
+        $name: workflow.name,
+        $description: workflow.description ?? null,
+        $version: workflow.version,
+        $status: workflow.status,
+        $goal: workflow.goal ? JSON.stringify(workflow.goal) : null,
+        $steps: JSON.stringify(workflow.steps),
+        $created: workflow.createdAt,
+        $updated: workflow.updatedAt
+      });
+      const target = { ...current.target, workflowId: workflow.id };
+      if (opts.workflowTimeoutMs !== undefined)
+        target.timeoutMs = opts.workflowTimeoutMs;
+      const res = this.db.query(`UPDATE loops SET target_json=$target, updated_at=$updated
+           WHERE id=$id
+             AND ($daemonLeaseId IS NULL OR EXISTS (
+               SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+             ))`).run({
+        $id: current.id,
+        $target: JSON.stringify(target),
+        $updated: updated,
+        $daemonLeaseId: opts.daemonLeaseId ?? null,
+        $now: updated
+      });
+      if (res.changes !== 1)
+        throw new Error("daemon lease lost");
+      const archivedOld = opts.archiveOld ? this.archiveWorkflowIfUnreferenced(previousWorkflow.id, updated) : undefined;
+      this.db.exec("COMMIT");
+      const loop = this.getLoop(current.id);
+      if (!loop)
+        throw new Error(`loop not found after retarget: ${current.id}`);
+      return { loop, workflow, previousWorkflow, archivedOld };
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  }
   renameLoop(id, name, opts = {}) {
     const current = this.getLoop(id);
     if (!current)
@@ -3433,7 +3624,7 @@ function commandSpec(target) {
       cwd: commandTarget.cwd,
       shell: commandTarget.shell,
       env: commandTarget.env,
-      timeoutMs: commandTarget.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+      timeoutMs: commandTarget.timeoutMs === undefined ? DEFAULT_TIMEOUT_MS : commandTarget.timeoutMs,
       idleTimeoutMs: commandTarget.idleTimeoutMs,
       account: commandTarget.account,
       accountTool: commandTarget.account?.tool
@@ -3444,7 +3635,7 @@ function commandSpec(target) {
     command: providerCommand(agentTarget.provider),
     args: agentArgs(agentTarget),
     cwd: agentTarget.cwd,
-    timeoutMs: agentTarget.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    timeoutMs: agentTarget.timeoutMs ?? null,
     idleTimeoutMs: agentTarget.idleTimeoutMs,
     account: agentTarget.account,
     accountTool: agentTarget.account?.tool ?? accountToolForProvider(agentTarget.provider),
@@ -3632,12 +3823,12 @@ async function executeRemoteSpec(spec, machine, metadata, opts) {
   if (opts.signal?.aborted)
     abortHandler();
   opts.signal?.addEventListener("abort", abortHandler, { once: true });
-  const timer = setTimeout(() => {
+  const timer = typeof spec.timeoutMs === "number" ? setTimeout(() => {
     timedOut = true;
     if (child.pid)
       killProcessGroup(child.pid);
-  }, spec.timeoutMs);
-  timer.unref();
+  }, spec.timeoutMs) : undefined;
+  timer?.unref();
   let idleTimer;
   const resetIdleTimer = () => {
     if (!spec.idleTimeoutMs)
@@ -3669,7 +3860,8 @@ async function executeRemoteSpec(spec, machine, metadata, opts) {
   } catch (err) {
     error = err instanceof Error ? err.message : String(err);
   } finally {
-    clearTimeout(timer);
+    if (timer)
+      clearTimeout(timer);
     if (idleTimer)
       clearTimeout(idleTimer);
     opts.signal?.removeEventListener("abort", abortHandler);
@@ -3811,12 +4003,12 @@ async function executeTarget(target, metadata = {}, opts = {}) {
   if (opts.signal?.aborted)
     abortHandler();
   opts.signal?.addEventListener("abort", abortHandler, { once: true });
-  const timer = setTimeout(() => {
+  const timer = typeof spec.timeoutMs === "number" ? setTimeout(() => {
     timedOut = true;
     if (child.pid)
       killProcessGroup(child.pid);
-  }, spec.timeoutMs);
-  timer.unref();
+  }, spec.timeoutMs) : undefined;
+  timer?.unref();
   let idleTimer;
   const resetIdleTimer = () => {
     if (!spec.idleTimeoutMs)
@@ -3848,7 +4040,8 @@ async function executeTarget(target, metadata = {}, opts = {}) {
   } catch (err) {
     error = err instanceof Error ? err.message : String(err);
   } finally {
-    clearTimeout(timer);
+    if (timer)
+      clearTimeout(timer);
     if (idleTimer)
       clearTimeout(idleTimer);
     opts.signal?.removeEventListener("abort", abortHandler);
@@ -4273,7 +4466,7 @@ ${result.stderr}`);
 // src/lib/workflow-runner.ts
 function targetWithStepAccount(step) {
   const account = step.account ?? step.target.account;
-  const timeoutMs = step.timeoutMs ?? step.target.timeoutMs;
+  const timeoutMs = step.timeoutMs !== undefined ? step.timeoutMs : step.target.timeoutMs;
   if (!account && timeoutMs === step.target.timeoutMs)
     return step.target;
   return { ...step.target, account, timeoutMs };
@@ -4569,7 +4762,8 @@ async function executeLoopTarget(store, loop, run, opts = {}) {
       })
     });
   }
-  const controller = loop.target.timeoutMs ? new AbortController : undefined;
+  const workflowTimeoutMs = typeof loop.target.timeoutMs === "number" ? loop.target.timeoutMs : undefined;
+  const controller = workflowTimeoutMs !== undefined ? new AbortController : undefined;
   let workflowTimedOut = false;
   const externalAbort = () => controller?.abort();
   if (controller && opts.signal?.aborted)
@@ -4579,13 +4773,13 @@ async function executeLoopTarget(store, loop, run, opts = {}) {
   const timer = controller ? setTimeout(() => {
     workflowTimedOut = true;
     controller.abort();
-  }, loop.target.timeoutMs) : undefined;
+  }, workflowTimeoutMs) : undefined;
   timer?.unref();
   try {
     return await executeWorkflow(store, workflow, {
       ...opts,
       signal: controller?.signal ?? opts.signal,
-      signalTimeoutMessage: () => workflowTimedOut && loop.target.type === "workflow" ? `workflow timed out after ${loop.target.timeoutMs}ms` : undefined,
+      signalTimeoutMessage: () => workflowTimedOut && loop.target.type === "workflow" ? `workflow timed out after ${workflowTimeoutMs}ms` : undefined,
       loop,
       loopRun: run,
       scheduledFor: run.scheduledFor,
@@ -5036,9 +5230,9 @@ function openAutomationsRuntimeBinding(overrides = {}) {
 }
 // src/lib/templates.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync3, lstatSync, mkdirSync as mkdirSync4, readdirSync, readFileSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, lstatSync, mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename2, isAbsolute, join as join5, relative, resolve } from "path";
+import { basename as basename2, isAbsolute as isAbsolute2, join as join5, relative, resolve as resolve2 } from "path";
 var TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID = "todos-task-worker-verifier";
 var EVENT_WORKER_VERIFIER_TEMPLATE_ID = "event-worker-verifier";
 var BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID = "bounded-agent-worker-verifier";
@@ -5076,7 +5270,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
-      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated task/event worktree branches." }
+      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated task/event worktree branches." },
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -5106,7 +5301,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
-      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated event worktree branches." }
+      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated event worktree branches." },
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -5134,7 +5330,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
       { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated bounded-agent worktree branches." },
-      { name: "timeoutMs", default: "2700000", description: "Step timeout in milliseconds." }
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -5153,7 +5349,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles for non-Codewith providers." },
       { name: "provider", default: "codewith", description: "Agent provider." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
-      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." }
+      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." },
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -5258,6 +5455,30 @@ function taskLabel(input) {
   const head = input.taskTitle?.trim() || input.taskId;
   return head.length > 160 ? `${head.slice(0, 157)}...` : head;
 }
+var UNLIMITED_AGENT_TIMEOUT_MS = null;
+function agentTimeoutMs(input) {
+  return input.timeoutMs === undefined ? UNLIMITED_AGENT_TIMEOUT_MS : input.timeoutMs;
+}
+function parseTemplateTimeoutMs(raw) {
+  if (raw === undefined || raw.trim() === "")
+    return;
+  const normalized = raw.trim().toLowerCase();
+  if (["unlimited", "none", "null", "never", "off", "false"].includes(normalized))
+    return null;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error("timeoutMs must be a positive integer number of milliseconds, or unlimited/none/null");
+  }
+  return value;
+}
+function parseDeterministicTimeoutMs(raw, fallbackMs, label = "timeoutMs") {
+  if (raw === undefined || raw.trim() === "")
+    return fallbackMs;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value <= 0)
+    throw new Error(`${label} must be a positive integer number of milliseconds`);
+  return value;
+}
 function stableIndex(seed, size) {
   let hash = 2166136261;
   for (let i = 0;i < seed.length; i += 1) {
@@ -5320,7 +5541,7 @@ function normalizeWorktreeMode(mode) {
 function defaultWorktreeRoot(root) {
   if (root?.trim()) {
     const expanded = root.trim().replace(/^~(?=$|\/)/, homedir3());
-    return isAbsolute(expanded) ? expanded : resolve(expanded);
+    return isAbsolute2(expanded) ? expanded : resolve2(expanded);
   }
   return join5(homedir3(), ".hasna", "loops", "worktrees");
 }
@@ -5427,7 +5648,7 @@ function worktreePlan(input, seed) {
   const seedSlug = `${slugSegment(seed, "run").slice(0, 48)}-${stableHex(`${repoRoot}:${seed}`)}`;
   const worktreePath = join5(root, repoSlug, seedSlug);
   const relativeCwd = relative(repoRoot, originalCwd);
-  const cwd = relativeCwd && !relativeCwd.startsWith("..") && !isAbsolute(relativeCwd) ? join5(worktreePath, relativeCwd) : worktreePath;
+  const cwd = relativeCwd && !relativeCwd.startsWith("..") && !isAbsolute2(relativeCwd) ? join5(worktreePath, relativeCwd) : worktreePath;
   const branchPrefix = (input.worktreeBranchPrefix?.trim() || "openloops").replace(/^\/+|\/+$/g, "") || "openloops";
   const branch = `${branchPrefix}/${repoSlug}/${seedSlug}`;
   const prepareStep = {
@@ -5529,7 +5750,7 @@ function agentTarget(input, prompt, role, seed, plan) {
       ...input.projectGroup ? { projectGroup: input.projectGroup } : {}
     },
     account: accountForRole(input, role, seed),
-    timeoutMs: 45 * 60000
+    timeoutMs: agentTimeoutMs(input)
   };
 }
 function workflowStepsWithWorktree(plan, steps) {
@@ -5662,9 +5883,24 @@ function assertNoImplicitDangerFullAccess(value, label) {
     assertNoImplicitDangerFullAccess(entry, `${label}.${key}`);
   }
 }
+function assertNoCustomTemplatePromptFiles(value, label) {
+  if (!value || typeof value !== "object")
+    return;
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) => assertNoCustomTemplatePromptFiles(entry, `${label}[${index}]`));
+    return;
+  }
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === "promptFile") {
+      throw new Error(`${label}.${key} is not allowed in custom templates; use direct workflow JSON for prompt-file-backed workflows`);
+    }
+    assertNoCustomTemplatePromptFiles(entry, `${label}.${key}`);
+  }
+}
 function assertCustomTemplateSafety(value, label) {
   assertNoDangerousCustomTemplateScalars(value, label);
   assertNoImplicitDangerFullAccess(value, label);
+  assertNoCustomTemplatePromptFiles(value, label);
 }
 function customTemplateDefinitionFromJson(value, sourcePath) {
   assertRecord(value, sourcePath);
@@ -5694,7 +5930,7 @@ function customTemplateSummary(definition, sourcePath) {
 function readCustomTemplateFile(file) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync(file, "utf8"));
+    parsed = JSON.parse(readFileSync2(file, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`failed to read custom template ${file}: ${message}`);
@@ -5833,19 +6069,19 @@ function renderCustomLoopTemplate(entry, values) {
   return workflow;
 }
 function validateCustomLoopTemplateFile(file) {
-  const source = resolve(file);
+  const source = resolve2(file);
   const entry = readCustomTemplateFile(source);
-  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== source);
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve2(template.path) !== source);
   assertNoTemplateCollisions([...existing, entry]);
   return structuredClone(entry.summary);
 }
 function importCustomLoopTemplate(file, opts = {}) {
-  const source = resolve(file);
+  const source = resolve2(file);
   const entry = readCustomTemplateFile(source);
   const dir = ensureCustomLoopTemplatesDir();
   const destination = join5(dir, `${entry.definition.id}.json`);
   const replaced = existsSync3(destination);
-  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve(template.path) !== resolve(destination));
+  const existing = loadCustomLoopTemplatesRaw().filter((template) => resolve2(template.path) !== resolve2(destination));
   assertNoTemplateCollisions([...existing, { ...entry, path: destination, summary: customTemplateSummary(entry.definition, destination) }]);
   if (replaced) {
     const stat = lstatSync(destination);
@@ -5957,18 +6193,15 @@ function renderTodosTaskWorkerVerifierWorkflow(input) {
         name: "Worker",
         description: "Implement the todos task and record evidence.",
         target: agentTarget(input, workerPrompt, "worker", input.taskId, plan),
-        timeoutMs: 45 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "verifier",
         name: "Verifier",
         description: "Adversarially verify worker output and update todos.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: 30 * 60000
+        target: agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
+        timeoutMs: agentTimeoutMs(input)
       }
     ])
   };
@@ -6129,7 +6362,7 @@ function renderTaskLifecycleWorkflow(input) {
         name: "Triage",
         description: "Check task eligibility, duplicates, dependencies, and automation gates.",
         target: agentTarget(input, triagePrompt, "triage", input.taskId, plan),
-        timeoutMs: 20 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "triage-gate",
@@ -6151,7 +6384,7 @@ function renderTaskLifecycleWorkflow(input) {
         description: "Create a concise implementation plan and split unsafe scope before work starts.",
         dependsOn: ["triage-gate"],
         target: agentTarget(input, plannerPrompt, "planner", input.taskId, plan),
-        timeoutMs: 25 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "planner-gate",
@@ -6173,18 +6406,15 @@ function renderTaskLifecycleWorkflow(input) {
         description: "Implement the todos task according to triage and planner evidence.",
         dependsOn: ["planner-gate"],
         target: agentTarget(input, workerPrompt, "worker", input.taskId, plan),
-        timeoutMs: 45 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "verifier",
         name: "Verifier",
         description: "Adversarially verify worker output and update todos.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: 30 * 60000
+        target: agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
+        timeoutMs: agentTimeoutMs(input)
       }
     ])
   };
@@ -6254,18 +6484,15 @@ function renderEventWorkerVerifierWorkflow(input) {
         name: "Worker",
         description: "Handle the Hasna event and record evidence.",
         target: agentTarget(input, workerPrompt, "worker", seed, plan),
-        timeoutMs: 45 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "verifier",
         name: "Verifier",
         description: "Adversarially verify event handling.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", seed, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: 30 * 60000
+        target: agentTarget(input, verifierPrompt, "verifier", seed, plan),
+        timeoutMs: agentTimeoutMs(input)
       }
     ])
   };
@@ -6277,7 +6504,7 @@ function renderBoundedAgentWorkerVerifierWorkflow(input) {
     throw new Error("projectPath is required");
   const seed = `${input.projectPath}:${input.objective}`;
   const plan = worktreePlan(input, seed);
-  const timeoutMs = input.timeoutMs && Number.isFinite(input.timeoutMs) ? input.timeoutMs : 45 * 60000;
+  const timeoutMs = agentTimeoutMs(input);
   const workerPrompt = [
     `/goal ${input.objective}`,
     "",
@@ -6315,11 +6542,8 @@ function renderBoundedAgentWorkerVerifierWorkflow(input) {
         name: "Verifier",
         description: "Adversarially verify the bounded objective result.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", seed, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: Math.min(timeoutMs, 30 * 60000)
+        target: agentTarget(input, verifierPrompt, "verifier", seed, plan),
+        timeoutMs
       }
     ])
   };
@@ -6348,7 +6572,7 @@ function renderLifecycleBoundedTemplate(id, values) {
     worktreeMode: values.worktreeMode ?? (id === REPORT_ONLY_TEMPLATE_ID ? "main" : "required"),
     worktreeRoot: values.worktreeRoot,
     worktreeBranchPrefix: values.worktreeBranchPrefix,
-    timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : undefined
+    timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
   };
   if (id === TASK_LIFECYCLE_TEMPLATE_ID) {
     const taskId = values.taskId ?? "";
@@ -6385,6 +6609,7 @@ function renderLifecycleBoundedTemplate(id, values) {
       worktreeMode: values.worktreeMode ?? "required",
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs),
       eventId: values.eventId,
       eventType: values.eventType
     });
@@ -6451,6 +6676,8 @@ function renderDeterministicCheckCreateTaskWorkflow(values) {
   if (!checkCommand.trim())
     throw new Error("checkCommand is required");
   const seed = `${projectPath}:${checkCommand}`;
+  const timeoutMs = parseDeterministicTimeoutMs(values.timeoutMs, 5 * 60000);
+  const idleTimeoutMs = parseDeterministicTimeoutMs(values.idleTimeoutMs, 60000, "idleTimeoutMs");
   return {
     name: values.name ?? `deterministic-check-${stableIndex(seed, 4294967295).toString(16).padStart(8, "0")}`,
     description: values.description ?? "Deterministic check that writes compact evidence and upserts one deduped todos task when the expectation is not met.",
@@ -6465,10 +6692,10 @@ function renderDeterministicCheckCreateTaskWorkflow(values) {
           command: "bash",
           args: ["-lc", checkCommand],
           cwd: projectPath,
-          timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : 5 * 60000,
-          idleTimeoutMs: values.idleTimeoutMs ? Number(values.idleTimeoutMs) : 60000
+          timeoutMs,
+          idleTimeoutMs
         },
-        timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : 5 * 60000
+        timeoutMs
       }
     ]
   };
@@ -6506,6 +6733,7 @@ function renderBuiltinLoopTemplate(id, values) {
       worktreeMode: values.worktreeMode,
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs),
       eventId: values.eventId,
       eventType: values.eventType
     });
@@ -6537,7 +6765,8 @@ function renderBuiltinLoopTemplate(id, values) {
       manualBreakGlass: booleanVar(values.manualBreakGlass),
       worktreeMode: values.worktreeMode,
       worktreeRoot: values.worktreeRoot,
-      worktreeBranchPrefix: values.worktreeBranchPrefix
+      worktreeBranchPrefix: values.worktreeBranchPrefix,
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
     });
   }
   if (id === BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID) {
@@ -6565,7 +6794,7 @@ function renderBuiltinLoopTemplate(id, values) {
       worktreeMode: values.worktreeMode,
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
-      timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : undefined
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
     });
   }
   throw new Error(`unknown template: ${id}`);
@@ -6606,13 +6835,13 @@ import { spawnSync as spawnSync3 } from "child_process";
 import { accessSync as accessSync2, constants as constants2 } from "fs";
 
 // src/daemon/control.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2 } from "path";
 
 // src/daemon/loop.ts
 function realSleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function runLoop(opts) {
   const sleep = opts.sleep ?? realSleep;
@@ -6637,7 +6866,7 @@ function readPid(path = pidFilePath()) {
   if (!existsSync4(path))
     return;
   try {
-    const pid = Number(readFileSync2(path, "utf8").trim());
+    const pid = Number(readFileSync3(path, "utf8").trim());
     return Number.isInteger(pid) && pid > 0 ? pid : undefined;
   } catch {
     return;
@@ -6800,7 +7029,11 @@ function runDoctor(store) {
       if (loop.target.type === "workflow") {
         const workflow = store.requireWorkflow(loop.target.workflowId);
         for (const step of workflowExecutionOrder(workflow)) {
-          preflightTarget({ ...step.target, account: step.account ?? step.target.account, timeoutMs: step.timeoutMs ?? step.target.timeoutMs }, { loopId: loop.id, loopName: loop.name, workflowId: workflow.id, workflowName: workflow.name, workflowStepId: step.id }, { machine: loop.machine });
+          preflightTarget({
+            ...step.target,
+            account: step.account ?? step.target.account,
+            timeoutMs: step.timeoutMs !== undefined ? step.timeoutMs : step.target.timeoutMs
+          }, { loopId: loop.id, loopName: loop.name, workflowId: workflow.id, workflowName: workflow.name, workflowStepId: step.id }, { machine: loop.machine });
         }
       } else {
         preflightTarget(loop.target, { loopId: loop.id, loopName: loop.name }, { machine: loop.machine });