@hasna/loops 0.3.54 → 0.3.56

package/dist/cli/index.js

@@ -331,6 +331,15 @@ function optionalPositiveInteger(value, label) {
     throw new Error(`${label} must be a positive integer`);
   return value;
 }
+function optionalTimeoutMs(value, label) {
+  if (value === undefined)
+    return;
+  if (value === null)
+    return null;
+  if (!Number.isInteger(value) || value <= 0)
+    throw new Error(`${label} must be a positive integer or null for unlimited`);
+  return value;
+}
 function optionalBoolean(value, label) {
   if (value === undefined)
     return;
@@ -419,7 +428,7 @@ function validateTarget(value, label, opts) {
   assertObject(value, label);
   if (value.type === "command") {
     assertString(value.command, `${label}.command`);
-    optionalPositiveInteger(value.timeoutMs, `${label}.timeoutMs`);
+    optionalTimeoutMs(value.timeoutMs, `${label}.timeoutMs`);
     optionalPositiveInteger(value.idleTimeoutMs, `${label}.idleTimeoutMs`);
     if (value.shell !== true && /\s/.test(value.command.trim())) {
       throw new Error(`${label}.command must be an executable without spaces when shell is false; put flags in args or set shell true`);
@@ -438,7 +447,7 @@ function validateTarget(value, label, opts) {
     const providers = ["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"];
     if (!providers.includes(value.provider))
       throw new Error(`${label}.provider must be one of ${providers.join(", ")}`);
-    optionalPositiveInteger(value.timeoutMs, `${label}.timeoutMs`);
+    optionalTimeoutMs(value.timeoutMs, `${label}.timeoutMs`);
     optionalPositiveInteger(value.idleTimeoutMs, `${label}.idleTimeoutMs`);
     if (value.authProfile !== undefined) {
       assertString(value.authProfile, `${label}.authProfile`);
@@ -561,7 +570,7 @@ function normalizeCreateWorkflowInput(input, opts = {}) {
       target: validateTarget(step.target, `workflow.steps[${index}].target`, opts),
       dependsOn: optionalStringArray(step.dependsOn, `workflow.steps[${index}].dependsOn`) ?? [],
       continueOnFailure: optionalBoolean(step.continueOnFailure, `workflow.steps[${index}].continueOnFailure`) ?? false,
-      timeoutMs: optionalPositiveInteger(step.timeoutMs, `workflow.steps[${index}].timeoutMs`),
+      timeoutMs: optionalTimeoutMs(step.timeoutMs, `workflow.steps[${index}].timeoutMs`),
       account: optionalAccountRef(step.account, `workflow.steps[${index}].account`)
     };
   });
@@ -1307,6 +1316,17 @@ class Store {
     const row = this.db.query("SELECT * FROM loops WHERE name = ? ORDER BY created_at DESC LIMIT 1").get(name);
     return row ? rowToLoop(row) : undefined;
   }
+  requireUniqueLoop(idOrName) {
+    const byId = this.getLoop(idOrName);
+    if (byId)
+      return byId;
+    const rows = this.db.query("SELECT * FROM loops WHERE name = ? ORDER BY created_at DESC LIMIT 2").all(idOrName);
+    if (rows.length === 0)
+      throw new Error(`loop not found: ${idOrName}`);
+    if (rows.length > 1)
+      throw new Error(`ambiguous loop name: ${idOrName}; use a loop id`);
+    return rowToLoop(rows[0]);
+  }
   requireLoop(idOrName) {
     return this.getLoop(idOrName) ?? this.findLoopByName(idOrName) ?? (() => {
       throw new Error(`loop not found: ${idOrName}`);
@@ -1381,6 +1401,130 @@ class Store {
       throw new Error(`loop not found after update: ${id}`);
     return after;
   }
+  activeLoopReferenceCount(workflowId) {
+    const rows = this.db.query("SELECT target_json FROM loops WHERE archived_at IS NULL").all();
+    let count = 0;
+    for (const row of rows) {
+      try {
+        const target = JSON.parse(row.target_json);
+        if (target.type === "workflow" && target.workflowId === workflowId)
+          count += 1;
+      } catch {}
+    }
+    return count;
+  }
+  archiveWorkflowIfUnreferenced(workflowId, updated) {
+    if (this.activeLoopReferenceCount(workflowId) > 0)
+      return;
+    const workflow = this.getWorkflow(workflowId);
+    if (!workflow || workflow.status !== "active")
+      return;
+    const res = this.db.query("UPDATE workflow_specs SET status='archived', updated_at=? WHERE id=? AND status='active'").run(updated, workflowId);
+    if (res.changes !== 1)
+      return;
+    return this.getWorkflow(workflowId);
+  }
+  retargetWorkflowLoop(idOrName, workflowId, opts = {}) {
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const current = this.requireLoop(idOrName);
+      if (current.target.type !== "workflow")
+        throw new Error(`loop is not a workflow loop: ${idOrName}`);
+      if (this.hasRunningRun(current.id))
+        throw new Error(`refusing to retarget running loop: ${current.id}`);
+      const workflow = this.requireWorkflow(workflowId);
+      const target = { ...current.target, workflowId: workflow.id };
+      if (opts.workflowTimeoutMs !== undefined)
+        target.timeoutMs = opts.workflowTimeoutMs;
+      const res = this.db.query(`UPDATE loops SET target_json=$target, updated_at=$updated
+           WHERE id=$id
+             AND ($daemonLeaseId IS NULL OR EXISTS (
+               SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+             ))`).run({
+        $id: current.id,
+        $target: JSON.stringify(target),
+        $updated: updated,
+        $daemonLeaseId: opts.daemonLeaseId ?? null,
+        $now: updated
+      });
+      if (res.changes !== 1)
+        throw new Error("daemon lease lost");
+      this.db.exec("COMMIT");
+      const after = this.getLoop(current.id);
+      if (!after)
+        throw new Error(`loop not found after retarget: ${current.id}`);
+      return after;
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  }
+  createAndRetargetWorkflowLoop(idOrName, workflowInput, opts = {}) {
+    const normalized = normalizeCreateWorkflowInput(workflowInput);
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const current = this.requireUniqueLoop(idOrName);
+      if (current.target.type !== "workflow")
+        throw new Error(`loop is not a workflow loop: ${idOrName}`);
+      if (this.hasRunningRun(current.id))
+        throw new Error(`refusing to retarget running loop: ${current.id}`);
+      const previousWorkflow = this.requireWorkflow(current.target.workflowId);
+      const workflow = {
+        id: genId(),
+        name: normalized.name,
+        description: normalized.description,
+        version: normalized.version ?? 1,
+        status: "active",
+        goal: normalized.goal,
+        steps: normalized.steps,
+        createdAt: updated,
+        updatedAt: updated
+      };
+      this.db.query(`INSERT INTO workflow_specs (id, name, description, version, status, goal_json, steps_json, created_at, updated_at)
+           VALUES ($id, $name, $description, $version, $status, $goal, $steps, $created, $updated)`).run({
+        $id: workflow.id,
+        $name: workflow.name,
+        $description: workflow.description ?? null,
+        $version: workflow.version,
+        $status: workflow.status,
+        $goal: workflow.goal ? JSON.stringify(workflow.goal) : null,
+        $steps: JSON.stringify(workflow.steps),
+        $created: workflow.createdAt,
+        $updated: workflow.updatedAt
+      });
+      const target = { ...current.target, workflowId: workflow.id };
+      if (opts.workflowTimeoutMs !== undefined)
+        target.timeoutMs = opts.workflowTimeoutMs;
+      const res = this.db.query(`UPDATE loops SET target_json=$target, updated_at=$updated
+           WHERE id=$id
+             AND ($daemonLeaseId IS NULL OR EXISTS (
+               SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+             ))`).run({
+        $id: current.id,
+        $target: JSON.stringify(target),
+        $updated: updated,
+        $daemonLeaseId: opts.daemonLeaseId ?? null,
+        $now: updated
+      });
+      if (res.changes !== 1)
+        throw new Error("daemon lease lost");
+      const archivedOld = opts.archiveOld ? this.archiveWorkflowIfUnreferenced(previousWorkflow.id, updated) : undefined;
+      this.db.exec("COMMIT");
+      const loop = this.getLoop(current.id);
+      if (!loop)
+        throw new Error(`loop not found after retarget: ${current.id}`);
+      return { loop, workflow, previousWorkflow, archivedOld };
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  }
   renameLoop(id, name, opts = {}) {
     const current = this.getLoop(id);
     if (!current)
@@ -3606,7 +3750,7 @@ function commandSpec(target) {
       cwd: commandTarget.cwd,
       shell: commandTarget.shell,
       env: commandTarget.env,
-      timeoutMs: commandTarget.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+      timeoutMs: commandTarget.timeoutMs === undefined ? DEFAULT_TIMEOUT_MS : commandTarget.timeoutMs,
       idleTimeoutMs: commandTarget.idleTimeoutMs,
       account: commandTarget.account,
       accountTool: commandTarget.account?.tool
@@ -3617,7 +3761,7 @@ function commandSpec(target) {
     command: providerCommand(agentTarget.provider),
     args: agentArgs(agentTarget),
     cwd: agentTarget.cwd,
-    timeoutMs: agentTarget.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    timeoutMs: agentTarget.timeoutMs ?? null,
     idleTimeoutMs: agentTarget.idleTimeoutMs,
     account: agentTarget.account,
     accountTool: agentTarget.account?.tool ?? accountToolForProvider(agentTarget.provider),
@@ -3805,12 +3949,12 @@ async function executeRemoteSpec(spec, machine, metadata, opts) {
   if (opts.signal?.aborted)
     abortHandler();
   opts.signal?.addEventListener("abort", abortHandler, { once: true });
-  const timer = setTimeout(() => {
+  const timer = typeof spec.timeoutMs === "number" ? setTimeout(() => {
     timedOut = true;
     if (child.pid)
       killProcessGroup(child.pid);
-  }, spec.timeoutMs);
-  timer.unref();
+  }, spec.timeoutMs) : undefined;
+  timer?.unref();
   let idleTimer;
   const resetIdleTimer = () => {
     if (!spec.idleTimeoutMs)
@@ -3842,7 +3986,8 @@ async function executeRemoteSpec(spec, machine, metadata, opts) {
   } catch (err) {
     error = err instanceof Error ? err.message : String(err);
   } finally {
-    clearTimeout(timer);
+    if (timer)
+      clearTimeout(timer);
     if (idleTimer)
       clearTimeout(idleTimer);
     opts.signal?.removeEventListener("abort", abortHandler);
@@ -3984,12 +4129,12 @@ async function executeTarget(target, metadata = {}, opts = {}) {
   if (opts.signal?.aborted)
     abortHandler();
   opts.signal?.addEventListener("abort", abortHandler, { once: true });
-  const timer = setTimeout(() => {
+  const timer = typeof spec.timeoutMs === "number" ? setTimeout(() => {
     timedOut = true;
     if (child.pid)
       killProcessGroup(child.pid);
-  }, spec.timeoutMs);
-  timer.unref();
+  }, spec.timeoutMs) : undefined;
+  timer?.unref();
   let idleTimer;
   const resetIdleTimer = () => {
     if (!spec.idleTimeoutMs)
@@ -4021,7 +4166,8 @@ async function executeTarget(target, metadata = {}, opts = {}) {
   } catch (err) {
     error = err instanceof Error ? err.message : String(err);
   } finally {
-    clearTimeout(timer);
+    if (timer)
+      clearTimeout(timer);
     if (idleTimer)
       clearTimeout(idleTimer);
     opts.signal?.removeEventListener("abort", abortHandler);
@@ -4446,7 +4592,7 @@ ${result.stderr}`);
 // src/lib/workflow-runner.ts
 function targetWithStepAccount(step) {
   const account = step.account ?? step.target.account;
-  const timeoutMs = step.timeoutMs ?? step.target.timeoutMs;
+  const timeoutMs = step.timeoutMs !== undefined ? step.timeoutMs : step.target.timeoutMs;
   if (!account && timeoutMs === step.target.timeoutMs)
     return step.target;
   return { ...step.target, account, timeoutMs };
@@ -4742,7 +4888,8 @@ async function executeLoopTarget(store, loop, run, opts = {}) {
       })
     });
   }
-  const controller = loop.target.timeoutMs ? new AbortController : undefined;
+  const workflowTimeoutMs = typeof loop.target.timeoutMs === "number" ? loop.target.timeoutMs : undefined;
+  const controller = workflowTimeoutMs !== undefined ? new AbortController : undefined;
   let workflowTimedOut = false;
   const externalAbort = () => controller?.abort();
   if (controller && opts.signal?.aborted)
@@ -4752,13 +4899,13 @@ async function executeLoopTarget(store, loop, run, opts = {}) {
   const timer = controller ? setTimeout(() => {
     workflowTimedOut = true;
     controller.abort();
-  }, loop.target.timeoutMs) : undefined;
+  }, workflowTimeoutMs) : undefined;
   timer?.unref();
   try {
     return await executeWorkflow(store, workflow, {
       ...opts,
       signal: controller?.signal ?? opts.signal,
-      signalTimeoutMessage: () => workflowTimedOut && loop.target.type === "workflow" ? `workflow timed out after ${loop.target.timeoutMs}ms` : undefined,
+      signalTimeoutMessage: () => workflowTimedOut && loop.target.type === "workflow" ? `workflow timed out after ${workflowTimeoutMs}ms` : undefined,
       loop,
       loopRun: run,
       scheduledFor: run.scheduledFor,
@@ -5534,7 +5681,11 @@ function runDoctor(store) {
       if (loop.target.type === "workflow") {
         const workflow = store.requireWorkflow(loop.target.workflowId);
         for (const step of workflowExecutionOrder(workflow)) {
-          preflightTarget({ ...step.target, account: step.account ?? step.target.account, timeoutMs: step.timeoutMs ?? step.target.timeoutMs }, { loopId: loop.id, loopName: loop.name, workflowId: workflow.id, workflowName: workflow.name, workflowStepId: step.id }, { machine: loop.machine });
+          preflightTarget({
+            ...step.target,
+            account: step.account ?? step.target.account,
+            timeoutMs: step.timeoutMs !== undefined ? step.timeoutMs : step.target.timeoutMs
+          }, { loopId: loop.id, loopName: loop.name, workflowId: workflow.id, workflowName: workflow.name, workflowStepId: step.id }, { machine: loop.machine });
         }
       } else {
         preflightTarget(loop.target, { loopId: loop.id, loopName: loop.name }, { machine: loop.machine });
@@ -6014,7 +6165,7 @@ function buildScriptInventoryReport(store, opts = {}) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.54",
+  version: "0.3.56",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -6144,7 +6295,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
-      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated task/event worktree branches." }
+      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated task/event worktree branches." },
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -6174,7 +6326,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "manualBreakGlass", default: "false", description: "Allow explicit danger-full-access in a generated workflow. Intended for manual emergency use only." },
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
-      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated event worktree branches." }
+      { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated event worktree branches." },
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -6202,7 +6355,7 @@ var TEMPLATE_SUMMARIES = [
       { name: "worktreeMode", default: "auto", description: "Worktree isolation mode: auto, required, off, or main." },
       { name: "worktreeRoot", default: "~/.hasna/loops/worktrees", description: "Base directory for OpenLoops-managed git worktrees." },
       { name: "worktreeBranchPrefix", default: "openloops", description: "Branch prefix for generated bounded-agent worktree branches." },
-      { name: "timeoutMs", default: "2700000", description: "Step timeout in milliseconds." }
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -6221,7 +6374,8 @@ var TEMPLATE_SUMMARIES = [
       { name: "accountPool", description: "Comma-separated OpenAccounts profiles for non-Codewith providers." },
       { name: "provider", default: "codewith", description: "Agent provider." },
       { name: "sandbox", default: "workspace-write", description: "Provider sandbox mode." },
-      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." }
+      { name: "worktreeMode", default: "required", description: "Worktree isolation mode." },
+      { name: "timeoutMs", default: "unlimited", description: "Agent step timeout in milliseconds, or unlimited/none/null for no timeout. Deterministic helper steps remain bounded." }
     ]
   },
   {
@@ -6326,6 +6480,30 @@ function taskLabel(input) {
   const head = input.taskTitle?.trim() || input.taskId;
   return head.length > 160 ? `${head.slice(0, 157)}...` : head;
 }
+var UNLIMITED_AGENT_TIMEOUT_MS = null;
+function agentTimeoutMs(input) {
+  return input.timeoutMs === undefined ? UNLIMITED_AGENT_TIMEOUT_MS : input.timeoutMs;
+}
+function parseTemplateTimeoutMs(raw) {
+  if (raw === undefined || raw.trim() === "")
+    return;
+  const normalized = raw.trim().toLowerCase();
+  if (["unlimited", "none", "null", "never", "off", "false"].includes(normalized))
+    return null;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error("timeoutMs must be a positive integer number of milliseconds, or unlimited/none/null");
+  }
+  return value;
+}
+function parseDeterministicTimeoutMs(raw, fallbackMs, label = "timeoutMs") {
+  if (raw === undefined || raw.trim() === "")
+    return fallbackMs;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value <= 0)
+    throw new Error(`${label} must be a positive integer number of milliseconds`);
+  return value;
+}
 function stableIndex(seed, size) {
   let hash = 2166136261;
   for (let i = 0;i < seed.length; i += 1) {
@@ -6404,6 +6582,21 @@ function gitRootFor(path) {
     return;
   }
 }
+function gitCommonDirFor(path) {
+  if (!existsSync4(path))
+    return;
+  try {
+    const raw = execFileSync("git", ["-C", path, "rev-parse", "--git-common-dir"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (!raw)
+      return;
+    return isAbsolute2(raw) ? raw : resolve2(path, raw);
+  } catch {
+    return;
+  }
+}
 function prepareWorktreeCommand(plan) {
   const repo = shellQuote2(plan.repoRoot);
   const path = shellQuote2(plan.path);
@@ -6520,6 +6713,7 @@ function worktreePlan(input, seed) {
     root,
     path: worktreePath,
     branch,
+    gitMetadataDir: gitCommonDirFor(repoRoot),
     prepareStep
   };
 }
@@ -6567,6 +6761,10 @@ function agentTarget(input, prompt, role, seed, plan) {
   assertNativeAuthProfileSupport(input, provider);
   const sandbox = input.sandbox ?? (provider === "codewith" || provider === "codex" ? "workspace-write" : provider === "cursor" ? "enabled" : undefined);
   failClosedSandbox(input, provider, sandbox);
+  const addDirs = [...input.addDirs ?? []];
+  if (plan.enabled && plan.gitMetadataDir && (provider === "codewith" || provider === "codex") && sandbox === "workspace-write") {
+    addDirs.push(plan.gitMetadataDir);
+  }
   return {
     type: "agent",
     provider,
@@ -6575,7 +6773,7 @@ function agentTarget(input, prompt, role, seed, plan) {
     model: input.model,
     variant: input.variant,
     agent: input.agent,
-    addDirs: input.addDirs,
+    addDirs: addDirs.length ? [...new Set(addDirs)] : undefined,
     authProfile: provider === "codewith" ? authProfileForRole(input, role, seed) : undefined,
     configIsolation: "safe",
     permissionMode: input.permissionMode ?? "bypass",
@@ -6597,7 +6795,7 @@ function agentTarget(input, prompt, role, seed, plan) {
       ...input.projectGroup ? { projectGroup: input.projectGroup } : {}
     },
     account: accountForRole(input, role, seed),
-    timeoutMs: 45 * 60000
+    timeoutMs: agentTimeoutMs(input)
   };
 }
 function workflowStepsWithWorktree(plan, steps) {
@@ -7040,18 +7238,15 @@ function renderTodosTaskWorkerVerifierWorkflow(input) {
         name: "Worker",
         description: "Implement the todos task and record evidence.",
         target: agentTarget(input, workerPrompt, "worker", input.taskId, plan),
-        timeoutMs: 45 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "verifier",
         name: "Verifier",
         description: "Adversarially verify worker output and update todos.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: 30 * 60000
+        target: agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
+        timeoutMs: agentTimeoutMs(input)
       }
     ])
   };
@@ -7212,7 +7407,7 @@ function renderTaskLifecycleWorkflow(input) {
         name: "Triage",
         description: "Check task eligibility, duplicates, dependencies, and automation gates.",
         target: agentTarget(input, triagePrompt, "triage", input.taskId, plan),
-        timeoutMs: 20 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "triage-gate",
@@ -7234,7 +7429,7 @@ function renderTaskLifecycleWorkflow(input) {
         description: "Create a concise implementation plan and split unsafe scope before work starts.",
         dependsOn: ["triage-gate"],
         target: agentTarget(input, plannerPrompt, "planner", input.taskId, plan),
-        timeoutMs: 25 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "planner-gate",
@@ -7256,18 +7451,15 @@ function renderTaskLifecycleWorkflow(input) {
         description: "Implement the todos task according to triage and planner evidence.",
         dependsOn: ["planner-gate"],
         target: agentTarget(input, workerPrompt, "worker", input.taskId, plan),
-        timeoutMs: 45 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "verifier",
         name: "Verifier",
         description: "Adversarially verify worker output and update todos.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: 30 * 60000
+        target: agentTarget(input, verifierPrompt, "verifier", input.taskId, plan),
+        timeoutMs: agentTimeoutMs(input)
       }
     ])
   };
@@ -7337,18 +7529,15 @@ function renderEventWorkerVerifierWorkflow(input) {
         name: "Worker",
         description: "Handle the Hasna event and record evidence.",
         target: agentTarget(input, workerPrompt, "worker", seed, plan),
-        timeoutMs: 45 * 60000
+        timeoutMs: agentTimeoutMs(input)
       },
       {
         id: "verifier",
         name: "Verifier",
         description: "Adversarially verify event handling.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", seed, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: 30 * 60000
+        target: agentTarget(input, verifierPrompt, "verifier", seed, plan),
+        timeoutMs: agentTimeoutMs(input)
       }
     ])
   };
@@ -7360,7 +7549,7 @@ function renderBoundedAgentWorkerVerifierWorkflow(input) {
     throw new Error("projectPath is required");
   const seed = `${input.projectPath}:${input.objective}`;
   const plan = worktreePlan(input, seed);
-  const timeoutMs = input.timeoutMs && Number.isFinite(input.timeoutMs) ? input.timeoutMs : 45 * 60000;
+  const timeoutMs = agentTimeoutMs(input);
   const workerPrompt = [
     `/goal ${input.objective}`,
     "",
@@ -7398,11 +7587,8 @@ function renderBoundedAgentWorkerVerifierWorkflow(input) {
         name: "Verifier",
         description: "Adversarially verify the bounded objective result.",
         dependsOn: ["worker"],
-        target: {
-          ...agentTarget(input, verifierPrompt, "verifier", seed, plan),
-          idleTimeoutMs: 10 * 60000
-        },
-        timeoutMs: Math.min(timeoutMs, 30 * 60000)
+        target: agentTarget(input, verifierPrompt, "verifier", seed, plan),
+        timeoutMs
       }
     ])
   };
@@ -7431,7 +7617,7 @@ function renderLifecycleBoundedTemplate(id, values) {
     worktreeMode: values.worktreeMode ?? (id === REPORT_ONLY_TEMPLATE_ID ? "main" : "required"),
     worktreeRoot: values.worktreeRoot,
     worktreeBranchPrefix: values.worktreeBranchPrefix,
-    timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : undefined
+    timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
   };
   if (id === TASK_LIFECYCLE_TEMPLATE_ID) {
     const taskId = values.taskId ?? "";
@@ -7468,6 +7654,7 @@ function renderLifecycleBoundedTemplate(id, values) {
       worktreeMode: values.worktreeMode ?? "required",
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs),
       eventId: values.eventId,
       eventType: values.eventType
     });
@@ -7534,6 +7721,8 @@ function renderDeterministicCheckCreateTaskWorkflow(values) {
   if (!checkCommand.trim())
     throw new Error("checkCommand is required");
   const seed = `${projectPath}:${checkCommand}`;
+  const timeoutMs = parseDeterministicTimeoutMs(values.timeoutMs, 5 * 60000);
+  const idleTimeoutMs = parseDeterministicTimeoutMs(values.idleTimeoutMs, 60000, "idleTimeoutMs");
   return {
     name: values.name ?? `deterministic-check-${stableIndex(seed, 4294967295).toString(16).padStart(8, "0")}`,
     description: values.description ?? "Deterministic check that writes compact evidence and upserts one deduped todos task when the expectation is not met.",
@@ -7548,10 +7737,10 @@ function renderDeterministicCheckCreateTaskWorkflow(values) {
           command: "bash",
           args: ["-lc", checkCommand],
           cwd: projectPath,
-          timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : 5 * 60000,
-          idleTimeoutMs: values.idleTimeoutMs ? Number(values.idleTimeoutMs) : 60000
+          timeoutMs,
+          idleTimeoutMs
         },
-        timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : 5 * 60000
+        timeoutMs
       }
     ]
   };
@@ -7589,6 +7778,7 @@ function renderBuiltinLoopTemplate(id, values) {
       worktreeMode: values.worktreeMode,
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs),
       eventId: values.eventId,
       eventType: values.eventType
     });
@@ -7620,7 +7810,8 @@ function renderBuiltinLoopTemplate(id, values) {
       manualBreakGlass: booleanVar(values.manualBreakGlass),
       worktreeMode: values.worktreeMode,
       worktreeRoot: values.worktreeRoot,
-      worktreeBranchPrefix: values.worktreeBranchPrefix
+      worktreeBranchPrefix: values.worktreeBranchPrefix,
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
     });
   }
   if (id === BOUNDED_AGENT_WORKER_VERIFIER_TEMPLATE_ID) {
@@ -7648,7 +7839,7 @@ function renderBuiltinLoopTemplate(id, values) {
       worktreeMode: values.worktreeMode,
       worktreeRoot: values.worktreeRoot,
       worktreeBranchPrefix: values.worktreeBranchPrefix,
-      timeoutMs: values.timeoutMs ? Number(values.timeoutMs) : undefined
+      timeoutMs: parseTemplateTimeoutMs(values.timeoutMs)
     });
   }
   throw new Error(`unknown template: ${id}`);
@@ -7793,6 +7984,43 @@ function publicWorkflowBody(body) {
   const { id: _id, status: _status, createdAt: _createdAt, updatedAt: _updatedAt, ...bodyOnly } = value;
   return bodyOnly;
 }
+function workflowWithAgentTimeouts(workflow, timeoutMs, opts = {}) {
+  let changed = false;
+  const agentStepIds = [];
+  const steps = workflow.steps.map((step) => {
+    if (step.target.type !== "agent")
+      return step;
+    agentStepIds.push(step.id);
+    const target = { ...step.target, timeoutMs };
+    if (timeoutMs === null && target.idleTimeoutMs !== undefined) {
+      delete target.idleTimeoutMs;
+      changed = true;
+    }
+    if (step.timeoutMs !== timeoutMs || step.target.timeoutMs !== timeoutMs)
+      changed = true;
+    return {
+      ...step,
+      target,
+      timeoutMs
+    };
+  });
+  return {
+    body: {
+      name: opts.name ?? workflow.name,
+      description: workflow.description,
+      version: workflow.version,
+      goal: workflow.goal,
+      steps
+    },
+    changed,
+    agentStepIds
+  };
+}
+function workflowTimeoutMigrationName(workflow, timeoutMs) {
+  const policy = timeoutMs === null ? "agent-timeout-unlimited" : `agent-timeout-${timeoutMs}ms`;
+  const suffix = randomUUID().replace(/-/g, "").slice(0, 8);
+  return `${workflow.name}-${policy}-${suffix}`;
+}
 function printTextOutput(value) {
   for (const line of textOutputBlocks(value, { indent: "  " }))
     console.log(line);
@@ -7833,6 +8061,17 @@ function positiveDuration(raw, label) {
     throw new Error(`${label} must be greater than zero`);
   return value;
 }
+function timeoutDuration(raw, label) {
+  if (raw === undefined)
+    return;
+  const normalized = raw.trim().toLowerCase();
+  if (["none", "unlimited", "null", "never", "off", "false"].includes(normalized))
+    return null;
+  const value = parseDuration(raw);
+  if (!Number.isFinite(value) || value <= 0)
+    throw new Error(`${label} must be a duration greater than zero, or none/unlimited`);
+  return value;
+}
 function parsePolicy(opts) {
   const catchUp = opts.catchUp ?? "latest";
   if (!["none", "latest", "all"].includes(catchUp))
@@ -8563,6 +8802,7 @@ function routeTodosTaskEvent(event, opts) {
     variant: opts.variant,
     agent: opts.agent,
     addDirs: listFromRepeatedOpts(opts.addDir),
+    timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
     permissionMode,
     sandbox,
     manualBreakGlass: Boolean(opts.manualBreakGlass),
@@ -8785,6 +9025,7 @@ function routeGenericEvent(event, opts) {
     variant: opts.variant,
     agent: opts.agent,
     addDirs: listFromRepeatedOpts(opts.addDir),
+    timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
     permissionMode,
     sandbox,
     manualBreakGlass: Boolean(opts.manualBreakGlass),
@@ -9133,7 +9374,7 @@ function permissionModeFromOpts(opts, provider) {
   return mode;
 }
 var create = program.command("create").description("create loops");
-addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("command <name>").description("create a deterministic shell command loop").requiredOption("--cmd <command>", "command string to execute").option("--cwd <dir>", "working directory").option("--timeout <duration>", "run timeout").option("--no-shell", "execute without a shell").option("--preflight-each-run", "check target executables/accounts before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
+addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("command <name>").description("create a deterministic shell command loop").requiredOption("--cmd <command>", "command string to execute").option("--cwd <dir>", "working directory").option("--timeout <duration>", "run timeout; use none/unlimited for no timeout").option("--no-shell", "execute without a shell").option("--preflight-each-run", "check target executables/accounts before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
   const store = new Store;
   try {
     const target = {
@@ -9141,7 +9382,7 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
       command: opts.cmd,
       cwd: opts.cwd,
       shell: opts.shell,
-      timeoutMs: opts.timeout ? parseDuration(opts.timeout) : undefined,
+      timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
       account: accountFromOpts(opts),
       preflight: runtimePreflightFromOpts(opts)
     };
@@ -9153,7 +9394,7 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
     store.close();
   }
 });
-addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").option("--prompt <prompt>", "agent prompt").option("--prompt-file <file>", "read the agent prompt from a markdown/text file").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "run timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass").option("--sandbox <mode>", "provider sandbox: codewith/codex use read-only/workspace-write/danger-full-access; cursor uses enabled/disabled").option("--allow-tool <name>", "advisory per-session tool allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--allow-command <name>", "advisory per-session command allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--config-isolation <mode>", "safe or none", "safe").option("--preflight-each-run", "check provider/account readiness before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
+addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.command("agent <name>").description("create a headless coding-agent loop").requiredOption("--provider <provider>", "claude, cursor, codewith, aicopilot, opencode, or codex").option("--prompt <prompt>", "agent prompt").option("--prompt-file <file>", "read the agent prompt from a markdown/text file").option("--cwd <dir>", "working directory").option("--model <model>", "model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "run timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass").option("--sandbox <mode>", "provider sandbox: codewith/codex use read-only/workspace-write/danger-full-access; cursor uses enabled/disabled").option("--allow-tool <name>", "advisory per-session tool allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--allow-command <name>", "advisory per-session command allowlist metadata; may be repeated or comma-separated", collectValues, []).option("--config-isolation <mode>", "safe or none", "safe").option("--preflight-each-run", "check provider/account readiness before every scheduled run").option("--preflight", "check target executables/accounts before storing the loop"))))).action((name, opts) => {
   const provider = opts.provider;
   if (!["claude", "cursor", "codewith", "aicopilot", "opencode", "codex"].includes(provider)) {
     throw new Error("unsupported provider");
@@ -9174,7 +9415,7 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
       agent: opts.agent,
       authProfile: providerAuthProfileFromOpts(opts, provider),
       addDirs: listFromRepeatedOpts(opts.addDir),
-      timeoutMs: opts.timeout ? parseDuration(opts.timeout) : undefined,
+      timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
       configIsolation: opts.configIsolation,
       permissionMode: permissionModeFromOpts(opts, provider),
       sandbox: sandboxFromOpts(opts, provider),
@@ -9190,13 +9431,14 @@ addGoalOptions(addAccountOptions(addMachineOptions(addScheduleOptions(create.com
     store.close();
   }
 });
-addGoalOptions(addMachineOptions(addScheduleOptions(create.command("workflow <name>").description("schedule a stored workflow").requiredOption("--workflow <idOrName>", "workflow id or name").option("--preflight-each-run", "check workflow steps before every scheduled run").option("--preflight", "check workflow step executables/accounts before storing the loop")))).action((name, opts) => {
+addGoalOptions(addMachineOptions(addScheduleOptions(create.command("workflow <name>").description("schedule a stored workflow").requiredOption("--workflow <idOrName>", "workflow id or name").option("--timeout <duration>", "workflow run timeout; use none/unlimited for no workflow-level timeout").option("--preflight-each-run", "check workflow steps before every scheduled run").option("--preflight", "check workflow step executables/accounts before storing the loop")))).action((name, opts) => {
   const store = new Store;
   try {
     const workflow = store.requireWorkflow(opts.workflow);
     const target = {
       type: "workflow",
       workflowId: workflow.id,
+      timeoutMs: timeoutDuration(opts.timeout, "--timeout"),
       preflight: runtimePreflightFromOpts(opts)
     };
     const input = baseCreateInput(name, opts, target);
@@ -9214,10 +9456,10 @@ var events = program.command("events").description("handle Hasna event envelopes
 var machines = program.command("machines").description("inspect OpenMachines topology for loop assignment");
 var goal = program.command("goal").description("inspect goal runs");
 function addRouteEventOptions(command) {
-  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
+  return command.option("--event-file <file>", "read event envelope JSON from a file instead of stdin/HASNA_EVENT_JSON").option("--event-json <json>", "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix").option("--preflight", "check generated workflow steps before storing the workflow loop");
 }
 function addTodosDrainOptions(command, opts = {}) {
-  let configured = command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", opts.preflightDescription ?? "check generated workflow steps before storing workflow loops");
+  let configured = command.option("--todos-project <path>", "todos storage project path", defaultLoopsProject()).option("--todos-project-id <id>", "filter todos ready output to one todos project id").option("--task-list <id-or-slug>", "filter ready tasks to one task-list id, slug, or name").option("--project-path-prefix <path>", "filter ready tasks to a project/repo path prefix").option("--tags <tags>", "require all comma-separated tags before routing").option("--tag <tags>", "alias for --tags").option("--limit <n>", "maximum filtered ready-task candidates to consider", "50").option("--scan-limit <n>", "maximum raw todos ready rows to fetch before filters; defaults to 500 when filters are used").option("--max-dispatch <n>", "maximum new workflow loops to create in this drain run", "1").option("--evidence-dir <path>", "write a JSON drain report to this directory").option("--compact", "print compact JSON to stdout while preserving the full evidence file").option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", opts.preflightDescription ?? "check generated workflow steps before storing workflow loops");
   if (opts.includeDryRun ?? true) {
     configured = configured.option("--dry-run", "preview selected tasks and generated workflow loops without storing anything");
   }
@@ -9270,6 +9512,7 @@ function routeDrainArgs(opts) {
   add("--agent", opts.agent);
   for (const dir of listFromRepeatedOpts(opts.addDir) ?? [])
     add("--add-dir", dir);
+  add("--timeout", opts.timeout);
   add("--permission-mode", opts.permissionMode);
   add("--sandbox", opts.sandbox);
   addBool("--manual-break-glass", opts.manualBreakGlass);
@@ -9581,7 +9824,7 @@ addScheduleOptions(addTodosDrainOptions(routes.command("schedule <kind> <name>")
   }
 });
 var eventsHandle = events.command("handle").description("handle a Hasna event envelope");
-eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
+eventsHandle.command("todos-task").description("create a one-shot worker/verifier workflow loop for a todos task event").option("--todos-project <path>", "todos storage project path for generated task commands", defaultLoopsProject()).option("--template <id>", "todos-task route workflow template: todos-task-worker-verifier or task-lifecycle", TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--triage-auth-profile <profile>", "provider-native auth profile for triage step").option("--planner-auth-profile <profile>", "provider-native auth profile for planner step").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--triage-account <profile>", "OpenAccounts profile for triage step").option("--planner-account <profile>", "OpenAccounts profile for planner step").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated task worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:todos-task").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
   const event = await readEventEnvelopeFromStdin();
   const result = routeTodosTaskEvent(event, opts);
   print(result.value, result.human);
@@ -9590,7 +9833,7 @@ var eventsDrain = events.command("drain").description("drain durable source queu
 addTodosDrainOptions(eventsDrain.command("todos-task").description("drain ready todos tasks into bounded worker/verifier workflow loops")).action((opts) => {
   drainTodosTaskRoutes(opts);
 });
-eventsHandle.command("generic").description("create a one-shot worker/verifier workflow loop for any Hasna event").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated event worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:generic").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
+eventsHandle.command("generic").description("create a one-shot worker/verifier workflow loop for any Hasna event").option("--provider <provider>", "agent provider", "codewith").option("--auth-profile <profile>", "provider-native auth profile; currently supported for codewith").option("--auth-profile-pool <profiles>", "comma-separated provider-native auth profile pool").option("--worker-auth-profile <profile>", "provider-native auth profile for worker step").option("--verifier-auth-profile <profile>", "provider-native auth profile for verifier step").option("--account <profile>", "OpenAccounts profile name").option("--account-pool <profiles>", "comma-separated OpenAccounts profile pool").option("--worker-account <profile>", "OpenAccounts profile for worker step").option("--verifier-account <profile>", "OpenAccounts profile for verifier step").option("--account-tool <tool>", "OpenAccounts tool id").option("--model <model>", "provider model").option("--variant <variant>", "provider-specific model variant or reasoning effort").option("--agent <agent>", "provider-specific agent").option("--add-dir <dir>", "additional writable directory for provider sandboxes; may be repeated or comma-separated", collectValues, []).option("--timeout <duration>", "agent step timeout; use none/unlimited for no timeout").option("--permission-mode <mode>", "provider permission mode: default, plan, auto, or bypass", "bypass").option("--sandbox <mode>", "provider sandbox").option("--manual-break-glass", "allow danger-full-access in generated worker/verifier workflow metadata; for explicit operator emergency use only").option("--project-path <path>", "fallback project/repo working directory").option("--project-group <name>", "optional project group for concurrency limits").option("--max-active <n>", "skip creating a workflow when this many active routed workflows already exist globally").option("--max-active-per-project <n>", "skip creating a workflow when this many active routed workflows already exist for the project").option("--max-active-per-project-group <n>", "skip creating a workflow when this many active routed workflows already exist for the project group").option("--worktree-mode <mode>", "worktree isolation mode: auto, required, off, or main", "auto").option("--worktree-root <path>", "base directory for OpenLoops-managed git worktrees").option("--worktree-branch-prefix <prefix>", "branch prefix for generated event worktrees", "openloops").option("--name-prefix <prefix>", "workflow/loop name prefix", "event:generic").option("--preflight", "check generated workflow steps before storing the workflow loop").option("--dry-run", "print the workflow and loop input without storing anything").action(async (opts) => {
   const event = await readEventEnvelopeFromStdin();
   const result = routeGenericEvent(event, opts);
   print(result.value, result.human);
@@ -9806,6 +10049,75 @@ workflows.command("recover <runId>").description("reset interrupted running work
     store.close();
   }
 });
+workflows.command("migrate-agent-timeouts").description("append-only migrate active workflow loops to a new agent timeout policy").option("--loop <idOrName>", "migrate only one loop instead of all active workflow loops").option("--timeout <duration>", "agent timeout policy; use none/unlimited for no timeout", "none").option("--apply", "create new workflow specs and retarget eligible loops").option("--archive-old", "archive old workflow specs after retargeting when no active loops still reference them").action((opts) => {
+  const store = new Store;
+  try {
+    const timeoutMs = timeoutDuration(opts.timeout, "--timeout") ?? null;
+    const candidateLoops = opts.loop ? [store.requireUniqueLoop(opts.loop)] : store.listLoops({ status: "active", limit: 1e4 }).filter((loop) => loop.target.type === "workflow");
+    const rows = [];
+    for (const loop of candidateLoops) {
+      if (loop.archivedAt) {
+        rows.push({ loop: publicLoop(loop), status: "skipped", reason: "loop is archived" });
+        continue;
+      }
+      if (loop.target.type !== "workflow") {
+        rows.push({ loop: publicLoop(loop), status: "skipped", reason: "loop is not a workflow loop" });
+        continue;
+      }
+      const workflow = store.requireWorkflow(loop.target.workflowId);
+      const nextWorkflowName = workflowTimeoutMigrationName(workflow, timeoutMs);
+      const migration = workflowWithAgentTimeouts(workflow, timeoutMs, { name: nextWorkflowName });
+      if (migration.agentStepIds.length === 0) {
+        rows.push({ loop: publicLoop(loop), workflow: publicWorkflow(workflow), status: "skipped", reason: "workflow has no agent steps" });
+        continue;
+      }
+      if (!migration.changed) {
+        rows.push({ loop: publicLoop(loop), workflow: publicWorkflow(workflow), status: "skipped", reason: "agent timeout policy already matches" });
+        continue;
+      }
+      if (store.hasRunningRun(loop.id)) {
+        rows.push({ loop: publicLoop(loop), workflow: publicWorkflow(workflow), status: "blocked", reason: "loop has a running run; retry after it finishes" });
+        continue;
+      }
+      if (!opts.apply) {
+        rows.push({
+          loop: publicLoop(loop),
+          workflow: publicWorkflow(workflow),
+          status: "would_migrate",
+          agentStepIds: migration.agentStepIds,
+          nextWorkflowName,
+          timeoutMs
+        });
+        continue;
+      }
+      const migrated = store.createAndRetargetWorkflowLoop(loop.id, migration.body, {
+        workflowTimeoutMs: timeoutMs,
+        archiveOld: Boolean(opts.archiveOld)
+      });
+      rows.push({
+        loop: publicLoop(migrated.loop),
+        previousWorkflow: publicWorkflow(migrated.previousWorkflow),
+        workflow: publicWorkflow(migrated.workflow),
+        archivedOld: migrated.archivedOld ? publicWorkflow(migrated.archivedOld) : undefined,
+        status: "migrated",
+        agentStepIds: migration.agentStepIds,
+        timeoutMs
+      });
+    }
+    const summary = {
+      apply: Boolean(opts.apply),
+      timeoutMs,
+      total: rows.length,
+      migrated: rows.filter((row) => row.status === "migrated").length,
+      wouldMigrate: rows.filter((row) => row.status === "would_migrate").length,
+      blocked: rows.filter((row) => row.status === "blocked").length,
+      skipped: rows.filter((row) => row.status === "skipped").length
+    };
+    print({ summary, rows }, opts.apply ? `migrated=${summary.migrated} blocked=${summary.blocked} skipped=${summary.skipped}` : `would_migrate=${summary.wouldMigrate} blocked=${summary.blocked} skipped=${summary.skipped}`);
+  } finally {
+    store.close();
+  }
+});
 workflows.command("archive <idOrName>").action((idOrName) => {
   const store = new Store;
   try {