@hasna/loops 0.3.58 → 0.3.60

package/dist/cli/index.js

@@ -358,6 +358,20 @@ function optionalStringArray(value, label) {
   }).filter(Boolean);
   return values.length ? values : undefined;
 }
+var UNSAFE_CODEWITH_DURABLE_EXTRA_ARGS = new Set([
+  "e",
+  "exec",
+  "agent",
+  "start",
+  "--ephemeral",
+  "--ignore-rules",
+  "--skip-git-repo-check",
+  "--json",
+  "--output-last-message",
+  "-o",
+  "--output-schema",
+  "--dangerously-bypass-approvals-and-sandbox"
+]);
 function optionalAccountRef(value, label) {
   if (value === undefined)
     return;
@@ -472,6 +486,15 @@ function validateTarget(value, label, opts) {
       throw new Error(`${label}.variant is not supported for provider cursor`);
     if (value.provider === "codex" && value.agent !== undefined)
       throw new Error(`${label}.agent is not supported for provider codex`);
+    if (value.provider === "codewith" && value.agent !== undefined) {
+      throw new Error(`${label}.agent is not supported for provider codewith durable background-agent execution`);
+    }
+    const extraArgs = optionalStringArray(value.extraArgs, `${label}.extraArgs`);
+    if (value.provider === "codewith") {
+      const unsafe = extraArgs?.find((arg) => UNSAFE_CODEWITH_DURABLE_EXTRA_ARGS.has(arg));
+      if (unsafe)
+        throw new Error(`${label}.extraArgs cannot include ${unsafe}; codewith agent steps use durable agent start, not exec/ephemeral flags`);
+    }
     optionalStringArray(value.addDirs, `${label}.addDirs`);
     if (Array.isArray(value.addDirs) && value.addDirs.length > 0 && !["codewith", "codex"].includes(value.provider)) {
       throw new Error(`${label}.addDirs is currently supported only for provider codewith or codex`);
@@ -547,7 +570,9 @@ function validateTarget(value, label, opts) {
       if (value.routing.eventSource !== undefined)
         assertString(value.routing.eventSource, `${label}.routing.eventSource`);
     }
-    const target = { ...value };
+    const target = { ...value, extraArgs };
+    if (!extraArgs)
+      delete target.extraArgs;
     delete target.promptFile;
     delete target.promptSource;
     return { ...target, ...promptFields };
@@ -1543,6 +1568,70 @@ class Store {
       throw error;
     }
   }
+  cloneWorkflowWithoutGoalAndRetargetLoop(idOrName, opts) {
+    const updated = (opts.now ?? new Date).toISOString();
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const current = this.requireUniqueLoop(idOrName);
+      if (current.target.type !== "workflow")
+        throw new Error(`loop is not a workflow loop: ${idOrName}`);
+      if (this.hasRunningRun(current.id))
+        throw new Error(`refusing to retarget running loop: ${current.id}`);
+      if (!current.goal)
+        throw new Error(`workflow loop ${current.name} has no loop-level goal wrapper`);
+      const previousWorkflow = this.requireWorkflow(current.target.workflowId);
+      if (!previousWorkflow.goal)
+        throw new Error(`workflow ${previousWorkflow.name} has no top-level goal wrapper`);
+      const workflow = {
+        id: genId(),
+        name: opts.workflowName,
+        description: previousWorkflow.description,
+        version: previousWorkflow.version,
+        status: "active",
+        steps: previousWorkflow.steps,
+        createdAt: updated,
+        updatedAt: updated
+      };
+      this.db.query(`INSERT INTO workflow_specs (id, name, description, version, status, goal_json, steps_json, created_at, updated_at)
+           VALUES ($id, $name, $description, $version, $status, NULL, $steps, $created, $updated)`).run({
+        $id: workflow.id,
+        $name: workflow.name,
+        $description: workflow.description ?? null,
+        $version: workflow.version,
+        $status: workflow.status,
+        $steps: JSON.stringify(workflow.steps),
+        $created: workflow.createdAt,
+        $updated: workflow.updatedAt
+      });
+      const target = { ...current.target, workflowId: workflow.id };
+      if (opts.workflowTimeoutMs !== undefined)
+        target.timeoutMs = opts.workflowTimeoutMs;
+      const res = this.db.query(`UPDATE loops SET target_json=$target, updated_at=$updated
+           WHERE id=$id
+             AND ($daemonLeaseId IS NULL OR EXISTS (
+               SELECT 1 FROM daemon_lease WHERE id=$daemonLeaseId AND expires_at > $now
+             ))`).run({
+        $id: current.id,
+        $target: JSON.stringify(target),
+        $updated: updated,
+        $daemonLeaseId: opts.daemonLeaseId ?? null,
+        $now: updated
+      });
+      if (res.changes !== 1)
+        throw new Error("daemon lease lost");
+      const archivedOld = opts.archiveOld ? this.archiveWorkflowIfUnreferenced(previousWorkflow.id, updated) : undefined;
+      this.db.exec("COMMIT");
+      const loop = this.getLoop(current.id);
+      if (!loop)
+        throw new Error(`loop not found after retarget: ${current.id}`);
+      return { loop, workflow, previousWorkflow, archivedOld };
+    } catch (error) {
+      try {
+        this.db.exec("ROLLBACK");
+      } catch {}
+      throw error;
+    }
+  }
   renameLoop(id, name, opts = {}) {
     const current = this.getLoop(id);
     if (!current)
@@ -3540,6 +3629,9 @@ function appendBounded(current, chunk, maxBytes) {
   return `[truncated ${overflow} bytes]
 ${next.slice(-maxBytes)}`;
 }
+function appendBoundedText(current, chunk, maxBytes) {
+  return appendBounded(current, Buffer.from(chunk, "utf8"), maxBytes);
+}
 function killProcessGroup(pid) {
   try {
     process.kill(-pid, "SIGTERM");
@@ -3587,6 +3679,21 @@ function metadataEnv(metadata) {
     env.LOOPS_GOAL_NODE_KEY = metadata.goalNodeKey;
   return env;
 }
+function codewithAgentIdempotencyKey(metadata) {
+  const parts = [
+    "openloops",
+    metadata.workflowRunId ? `workflow-run:${metadata.workflowRunId}` : undefined,
+    metadata.workflowStepId ? `step:${metadata.workflowStepId}` : undefined,
+    metadata.runId ? `loop-run:${metadata.runId}` : undefined,
+    metadata.loopId ? `loop:${metadata.loopId}` : undefined,
+    metadata.scheduledFor ? `scheduled:${metadata.scheduledFor}` : undefined,
+    metadata.goalId ? `goal:${metadata.goalId}` : undefined,
+    metadata.goalNodeKey ? `node:${metadata.goalNodeKey}` : undefined
+  ].filter(Boolean);
+  if (parts.length > 1)
+    return parts.join(":");
+  return `openloops:adhoc:${randomBytes2(16).toString("hex")}`;
+}
 function allowlistEnv(allowlist) {
   const env = {};
   if (allowlist?.tools?.length)
@@ -3623,6 +3730,20 @@ function codewithLikeSandbox(target) {
 function configStringValue(value) {
   return JSON.stringify(value);
 }
+var UNSAFE_CODEWITH_DURABLE_EXTRA_ARGS2 = new Set([
+  "e",
+  "exec",
+  "agent",
+  "start",
+  "--ephemeral",
+  "--ignore-rules",
+  "--skip-git-repo-check",
+  "--json",
+  "--output-last-message",
+  "-o",
+  "--output-schema",
+  "--dangerously-bypass-approvals-and-sandbox"
+]);
 function assertStringOption(value, label) {
   if (value !== undefined && typeof value !== "string")
     throw new Error(`${label} must be a string`);
@@ -3653,6 +3774,14 @@ function assertSupportedAgentOptions(target) {
   }
   if (target.provider === "codex" && target.agent !== undefined)
     throw new Error("codex.agent is not supported");
+  if (target.provider === "codewith" && target.agent !== undefined) {
+    throw new Error("codewith.agent is not supported by the durable background-agent adapter");
+  }
+  if (target.provider === "codewith") {
+    const unsafe = target.extraArgs?.find((arg) => UNSAFE_CODEWITH_DURABLE_EXTRA_ARGS2.has(arg));
+    if (unsafe)
+      throw new Error(`codewith.extraArgs cannot include ${unsafe}; durable agent steps use codewith agent start, not exec/ephemeral flags`);
+  }
   if (["codewith", "codex"].includes(target.provider)) {
     if (target.permissionMode && !["default", "bypass"].includes(target.permissionMode)) {
       throw new Error(`${target.provider}.permissionMode supports only default or bypass`);
@@ -3736,18 +3865,18 @@ function agentArgs(target) {
       args.push(...target.authProfile ? ["--auth-profile", target.authProfile] : []);
       if (target.variant)
         args.push("-c", `model_reasoning_effort=${configStringValue(target.variant)}`);
-      args.push("--ask-for-approval", "never", "exec", "--json", "--ephemeral", "--sandbox", codewithLikeSandbox(target), "--skip-git-repo-check");
-      if (isolation === "safe")
-        args.push("--ignore-rules");
+      args.push("--ask-for-approval", "never", "--sandbox", codewithLikeSandbox(target));
       if (target.cwd)
         args.push("--cd", target.cwd);
       for (const dir of target.addDirs ?? [])
         args.push("--add-dir", dir);
       if (target.model)
         args.push("--model", target.model);
-      if (target.agent)
-        args.push("--agent", target.agent);
       args.push(...target.extraArgs ?? []);
+      args.push("agent", "start");
+      if (target.cwd)
+        args.push("--cwd", target.cwd);
+      args.push(target.prompt);
       return args;
     case "codex":
       if (target.variant)
@@ -3823,8 +3952,9 @@ function commandSpec(target) {
     accountTool: agentTarget.account?.tool ?? accountToolForProvider(agentTarget.provider),
     nativeAuthProfile: agentTarget.authProfile ? { provider: agentTarget.provider, profile: agentTarget.authProfile } : undefined,
     preflightAnyOf: agentTarget.provider === "cursor" ? ["agent"] : undefined,
-    stdin: agentTarget.prompt,
-    allowlist: agentTarget.allowlist
+    stdin: agentTarget.provider === "codewith" ? undefined : agentTarget.prompt,
+    allowlist: agentTarget.allowlist,
+    codewithDurableAgent: agentTarget.provider === "codewith" ? { target: agentTarget } : undefined
   };
 }
 function executionEnv(spec, metadata, opts) {
@@ -3944,6 +4074,238 @@ function preflightNativeAuthProfile(spec, env) {
     throw new Error(`codewith auth profile not found: ${spec.nativeAuthProfile.profile}`);
   }
 }
+function codewithAgentStartArgs(target, idempotencyKey) {
+  const args = agentArgs(target);
+  const startIndex = args.findIndex((arg, index) => arg === "start" && args[index - 1] === "agent");
+  if (startIndex === -1)
+    throw new Error("internal error: codewith durable agent args missing agent start");
+  args.splice(startIndex + 1, 0, "--idempotency-key", idempotencyKey);
+  return args;
+}
+function codewithAgentControlArgs(target, command, agentId) {
+  return [
+    ...target.authProfile ? ["--auth-profile", target.authProfile] : [],
+    "agent",
+    command,
+    ...command === "logs" ? ["--limit", "20"] : [],
+    agentId
+  ];
+}
+function parseJsonOutput(stdout, label) {
+  try {
+    const value = JSON.parse(stdout || "{}");
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error("not an object");
+    return value;
+  } catch (error) {
+    throw new Error(`${label} did not return JSON${error instanceof Error ? `: ${error.message}` : ""}`);
+  }
+}
+function recordField(value, key) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  const field = value[key];
+  return field && typeof field === "object" && !Array.isArray(field) ? field : undefined;
+}
+function stringField(value, key) {
+  const field = value?.[key];
+  return typeof field === "string" ? field : undefined;
+}
+function numberField(value, key) {
+  const field = value?.[key];
+  return typeof field === "number" && Number.isFinite(field) ? field : undefined;
+}
+function codewithAgentStatus(readJson) {
+  return stringField(recordField(readJson, "agent"), "status") ?? stringField(recordField(readJson, "statusSnapshot"), "status");
+}
+function codewithAgentEvidence(startJson, readJson, logsJson) {
+  const agent = recordField(readJson, "agent") ?? recordField(startJson, "agent");
+  const statusSnapshot = recordField(readJson, "statusSnapshot");
+  const events = Array.isArray(logsJson?.data) ? logsJson.data.filter((event) => Boolean(event) && typeof event === "object" && !Array.isArray(event)).map((event) => ({
+    seq: numberField(event, "seq"),
+    eventType: stringField(event, "eventType"),
+    createdAt: numberField(event, "createdAt")
+  })) : undefined;
+  return JSON.stringify({
+    codewithAgent: {
+      agentId: stringField(agent, "agentId"),
+      status: stringField(agent, "status"),
+      desiredState: stringField(agent, "desiredState"),
+      statusReason: stringField(agent, "statusReason"),
+      threadId: stringField(agent, "threadId"),
+      rolloutPath: stringField(agent, "rolloutPath"),
+      pid: numberField(agent, "pid"),
+      exitCode: numberField(agent, "exitCode"),
+      created: typeof startJson.created === "boolean" ? startJson.created : undefined
+    },
+    statusSnapshot: statusSnapshot ? {
+      seq: numberField(statusSnapshot, "seq"),
+      status: stringField(statusSnapshot, "status"),
+      summary: stringField(statusSnapshot, "summary"),
+      pendingInteractionCount: numberField(statusSnapshot, "pendingInteractionCount"),
+      lastEventSeq: numberField(statusSnapshot, "lastEventSeq")
+    } : undefined,
+    events
+  }, null, 2);
+}
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+async function executeCodewithDurableAgent(spec, metadata, opts, env, startedAt) {
+  const target = spec.codewithDurableAgent?.target;
+  if (!target)
+    throw new Error("internal error: missing codewith durable target");
+  const maxOutputBytes = opts.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
+  const idempotencyKey = codewithAgentIdempotencyKey(metadata);
+  const start = spawnSync2(spec.command, codewithAgentStartArgs(target, idempotencyKey), {
+    cwd: spec.cwd,
+    env,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 30000
+  });
+  let stderr = start.stderr || "";
+  if (start.error || (start.status ?? 1) !== 0) {
+    const finishedAt = nowIso();
+    return {
+      status: "failed",
+      exitCode: start.status ?? undefined,
+      stdout: start.stdout || "",
+      stderr,
+      error: start.error?.message ?? `codewith agent start exited with code ${start.status ?? "unknown"}`,
+      startedAt,
+      finishedAt,
+      durationMs: new Date(finishedAt).getTime() - new Date(startedAt).getTime()
+    };
+  }
+  let startJson;
+  try {
+    startJson = parseJsonOutput(start.stdout || "{}", "codewith agent start");
+  } catch (error) {
+    const finishedAt = nowIso();
+    return {
+      status: "failed",
+      stdout: start.stdout || "",
+      stderr,
+      error: error instanceof Error ? error.message : String(error),
+      startedAt,
+      finishedAt,
+      durationMs: new Date(finishedAt).getTime() - new Date(startedAt).getTime()
+    };
+  }
+  const agentId = stringField(recordField(startJson, "agent"), "agentId");
+  if (!agentId) {
+    const finishedAt = nowIso();
+    return {
+      status: "failed",
+      stdout: start.stdout || "",
+      stderr,
+      error: "codewith agent start did not return agent.agentId",
+      startedAt,
+      finishedAt,
+      durationMs: new Date(finishedAt).getTime() - new Date(startedAt).getTime()
+    };
+  }
+  const pollMs = Math.max(100, Number(opts.env?.LOOPS_CODEWITH_AGENT_POLL_MS ?? process.env.LOOPS_CODEWITH_AGENT_POLL_MS ?? 2000) || 2000);
+  let lastReadJson = startJson;
+  let lastLogsJson;
+  let stdout = "";
+  while (true) {
+    if (opts.signal?.aborted) {
+      spawnSync2(spec.command, codewithAgentControlArgs(target, "stop", agentId), { cwd: spec.cwd, env, stdio: "ignore", timeout: 15000 });
+      const finishedAt = nowIso();
+      return {
+        status: "failed",
+        stdout: appendBoundedText(stdout, codewithAgentEvidence(startJson, lastReadJson, lastLogsJson), maxOutputBytes),
+        stderr,
+        error: "cancelled",
+        startedAt,
+        finishedAt,
+        durationMs: new Date(finishedAt).getTime() - new Date(startedAt).getTime()
+      };
+    }
+    const read = spawnSync2(spec.command, codewithAgentControlArgs(target, "read", agentId), {
+      cwd: spec.cwd,
+      env,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 30000
+    });
+    stderr = appendBoundedText(stderr, read.stderr || "", maxOutputBytes);
+    if (read.error || (read.status ?? 1) !== 0) {
+      const finishedAt = nowIso();
+      return {
+        status: "failed",
+        exitCode: read.status ?? undefined,
+        stdout: appendBoundedText(stdout, codewithAgentEvidence(startJson, lastReadJson, lastLogsJson), maxOutputBytes),
+        stderr,
+        error: read.error?.message ?? `codewith agent read exited with code ${read.status ?? "unknown"}`,
+        startedAt,
+        finishedAt,
+        durationMs: new Date(finishedAt).getTime() - new Date(startedAt).getTime()
+      };
+    }
+    try {
+      lastReadJson = parseJsonOutput(read.stdout || "{}", "codewith agent read");
+    } catch (error) {
+      const finishedAt = nowIso();
+      return {
+        status: "failed",
+        stdout: appendBoundedText(stdout, read.stdout || "", maxOutputBytes),
+        stderr,
+        error: error instanceof Error ? error.message : String(error),
+        startedAt,
+        finishedAt,
+        durationMs: new Date(finishedAt).getTime() - new Date(startedAt).getTime()
+      };
+    }
+    const status = codewithAgentStatus(lastReadJson);
+    if (status === "completed" || status === "failed" || status === "cancelled") {
+      const logs = spawnSync2(spec.command, codewithAgentControlArgs(target, "logs", agentId), {
+        cwd: spec.cwd,
+        env,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 30000
+      });
+      if (!logs.error && (logs.status ?? 1) === 0) {
+        try {
+          lastLogsJson = parseJsonOutput(logs.stdout || "{}", "codewith agent logs");
+        } catch {
+          lastLogsJson = undefined;
+        }
+      } else {
+        stderr = appendBoundedText(stderr, logs.stderr || logs.error?.message || "", maxOutputBytes);
+      }
+      const finishedAt = nowIso();
+      const resultStatus = status === "completed" ? "succeeded" : "failed";
+      return {
+        status: resultStatus,
+        exitCode: resultStatus === "succeeded" ? 0 : 1,
+        stdout: appendBoundedText(stdout, codewithAgentEvidence(startJson, lastReadJson, lastLogsJson), maxOutputBytes),
+        stderr,
+        error: resultStatus === "succeeded" ? undefined : stringField(recordField(lastReadJson, "agent"), "statusReason") ?? `codewith agent ${status}`,
+        startedAt,
+        finishedAt,
+        durationMs: new Date(finishedAt).getTime() - new Date(startedAt).getTime()
+      };
+    }
+    if (typeof spec.timeoutMs === "number" && new Date(nowIso()).getTime() - new Date(startedAt).getTime() >= spec.timeoutMs) {
+      spawnSync2(spec.command, codewithAgentControlArgs(target, "stop", agentId), { cwd: spec.cwd, env, stdio: "ignore", timeout: 15000 });
+      const finishedAt = nowIso();
+      return {
+        status: "timed_out",
+        stdout: appendBoundedText(stdout, codewithAgentEvidence(startJson, lastReadJson, lastLogsJson), maxOutputBytes),
+        stderr,
+        error: `timed out after ${spec.timeoutMs}ms`,
+        startedAt,
+        finishedAt,
+        durationMs: new Date(finishedAt).getTime() - new Date(startedAt).getTime()
+      };
+    }
+    await sleep(pollMs);
+  }
+}
 function preflightRemoteSpec(spec, machine, metadata, opts) {
   const plan = (opts.machineCommandResolver ?? resolveMachineCommand)(machine.id, "bash -s");
   const result = spawnSync2(plan.command, plan.args, {
@@ -4115,6 +4477,19 @@ function preflightTarget(target, metadata = {}, opts = {}) {
 async function executeTarget(target, metadata = {}, opts = {}) {
   const spec = commandSpec(target);
   const machine = resolvedMachine(opts);
+  if (machine && !machine.local && spec.codewithDurableAgent) {
+    const startedAt2 = nowIso();
+    const finishedAt2 = nowIso();
+    return {
+      status: "failed",
+      stdout: "",
+      stderr: "",
+      error: "remote Codewith durable background-agent steps require remote status polling support; run this Codewith step locally or add remote durable readback before dispatch",
+      startedAt: startedAt2,
+      finishedAt: finishedAt2,
+      durationMs: new Date(finishedAt2).getTime() - new Date(startedAt2).getTime()
+    };
+  }
   if (machine && !machine.local)
     return executeRemoteSpec(spec, machine, metadata, opts);
   const maxOutputBytes = opts.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
@@ -4161,6 +4536,9 @@ async function executeTarget(target, metadata = {}, opts = {}) {
       durationMs: 0
     };
   }
+  if (spec.codewithDurableAgent) {
+    return executeCodewithDurableAgent(spec, metadata, opts, env, startedAt);
+  }
   const child = spawn(spec.command, spec.args, {
     cwd: spec.cwd,
     env,
@@ -5372,7 +5750,7 @@ function realSleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function runLoop(opts) {
-  const sleep = opts.sleep ?? realSleep;
+  const sleep2 = opts.sleep ?? realSleep;
   const sliceMs = opts.sliceMs ?? 200;
   while (!opts.shouldStop()) {
     try {
@@ -5383,7 +5761,7 @@ async function runLoop(opts) {
     let waited = 0;
     while (waited < opts.intervalMs && !opts.shouldStop()) {
       const chunk = Math.min(sliceMs, opts.intervalMs - waited);
-      await sleep(chunk);
+      await sleep2(chunk);
       waited += chunk;
     }
   }
@@ -5465,7 +5843,7 @@ async function stopDaemon(opts = {}) {
   } finally {
     store.close();
   }
-  const sleep = opts.sleep ?? realSleep;
+  const sleep2 = opts.sleep ?? realSleep;
   try {
     process.kill(state.pid, "SIGTERM");
   } catch {
@@ -5474,7 +5852,7 @@ async function stopDaemon(opts = {}) {
   }
   const steps = Math.max(1, Math.ceil((opts.timeoutMs ?? 6000) / 100));
   for (let i = 0;i < steps; i++) {
-    await sleep(100);
+    await sleep2(100);
     if (!isAlive(state.pid)) {
       removePid(path);
       return { wasRunning: true, stopped: true, forced: false, pid: state.pid };
@@ -5483,7 +5861,7 @@ async function stopDaemon(opts = {}) {
   try {
     process.kill(state.pid, "SIGKILL");
   } catch {}
-  await sleep(150);
+  await sleep2(150);
   removePid(path);
   return { wasRunning: true, stopped: !isAlive(state.pid), forced: true, pid: state.pid };
 }
@@ -5652,10 +6030,10 @@ async function startDaemon(opts) {
     stdio: ["ignore", out, out]
   });
   child.unref();
-  const sleep = opts.sleep ?? realSleep;
+  const sleep2 = opts.sleep ?? realSleep;
   const deadline = Math.max(1, Math.ceil((opts.waitMs ?? 4000) / 100));
   for (let i = 0;i < deadline; i++) {
-    await sleep(100);
+    await sleep2(100);
     const current = isDaemonRunning();
     if (current.running)
       return { started: true, alreadyRunning: false, pid: current.pid };
@@ -6497,7 +6875,7 @@ function buildScriptInventoryReport(store, opts = {}) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.3.58",
+  version: "0.3.60",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -8637,21 +9015,47 @@ function workflowTimeoutMigrationName(workflow, timeoutMs) {
   const suffix = randomUUID().replace(/-/g, "").slice(0, 8);
   return `${workflow.name}-${policy}-${suffix}`;
 }
-function workflowWithoutGoalWrapper(workflow, opts = {}) {
-  return {
-    body: {
-      name: opts.name ?? workflow.name,
-      description: workflow.description,
-      version: workflow.version,
-      steps: workflow.steps
-    },
-    changed: workflow.goal !== undefined
-  };
-}
 function workflowGoalWrapperMigrationName(workflow) {
   const suffix = randomUUID().replace(/-/g, "").slice(0, 8);
   return `${workflow.name}-no-workflow-goal-${suffix}`;
 }
+function publicMigrationGoalSummary(goal) {
+  if (!goal)
+    return;
+  return {
+    objective: redact(goal.objective),
+    model: goal.model,
+    tokenBudget: goal.tokenBudget,
+    maxTurns: goal.maxTurns
+  };
+}
+function publicMigrationWorkflowSummary(workflow) {
+  return {
+    id: workflow.id,
+    name: workflow.name,
+    version: workflow.version,
+    status: workflow.status,
+    stepCount: workflow.steps.length,
+    hasGoal: Boolean(workflow.goal),
+    goal: publicMigrationGoalSummary(workflow.goal)
+  };
+}
+function publicMigrationLoopSummary(loop) {
+  return {
+    id: loop.id,
+    name: loop.name,
+    status: loop.status,
+    archivedAt: loop.archivedAt,
+    nextRunAt: loop.nextRunAt,
+    hasGoal: Boolean(loop.goal),
+    goal: publicMigrationGoalSummary(loop.goal),
+    target: loop.target.type === "workflow" ? { type: "workflow", workflowId: loop.target.workflowId, timeoutMs: loop.target.timeoutMs } : { type: loop.target.type }
+  };
+}
+function migrationErrorReason(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return redact(message, 240);
+}
 function printTextOutput(value) {
   for (const line of textOutputBlocks(value, { indent: "  " }))
     console.log(line);
@@ -9078,7 +9482,7 @@ function eventMetadata(event) {
     return metadata;
   return {};
 }
-function stringField(value) {
+function stringField2(value) {
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
 function slugSegment2(value, fallback = "event") {
@@ -9089,14 +9493,14 @@ function stableSuffix(value) {
 }
 function taskEventField(data, keys) {
   for (const key of keys) {
-    const direct = stringField(data[key]);
+    const direct = stringField2(data[key]);
     if (direct)
       return direct;
   }
   const task = data.task;
   if (task && typeof task === "object" && !Array.isArray(task)) {
     for (const key of keys) {
-      const direct = stringField(task[key]);
+      const direct = stringField2(task[key]);
       if (direct)
         return direct;
     }
@@ -9104,7 +9508,7 @@ function taskEventField(data, keys) {
   const payload = data.payload;
   if (payload && typeof payload === "object" && !Array.isArray(payload)) {
     for (const key of keys) {
-      const direct = stringField(payload[key]);
+      const direct = stringField2(payload[key]);
       if (direct)
         return direct;
     }
@@ -9804,11 +10208,11 @@ async function readEventEnvelopeInput(opts = {}) {
   const event = JSON.parse(raw);
   if (!event || typeof event !== "object" || Array.isArray(event))
     throw new Error("event JSON must be an object");
-  if (!stringField(event.id))
+  if (!stringField2(event.id))
     throw new Error("event.id is required");
-  if (!stringField(event.type))
+  if (!stringField2(event.type))
     throw new Error("event.type is required");
-  if (!stringField(event.source))
+  if (!stringField2(event.source))
     throw new Error("event.source is required");
   return event;
 }
@@ -10148,8 +10552,8 @@ function routeGenericEvent(event, opts) {
     eventId: event.id,
     eventType: event.type,
     eventSource: event.source,
-    eventSubject: stringField(event.subject),
-    eventMessage: stringField(event.message),
+    eventSubject: stringField2(event.subject),
+    eventMessage: stringField2(event.message),
     eventJson: JSON.stringify(event),
     projectPath,
     routeProjectPath,
@@ -10195,9 +10599,9 @@ function routeGenericEvent(event, opts) {
     },
     subjectRef: {
       kind: "event",
-      id: stringField(event.subject) ?? event.id,
+      id: stringField2(event.subject) ?? event.id,
       path: routeProjectPath,
-      raw: { message: stringField(event.message) }
+      raw: { message: stringField2(event.message) }
     },
     intent: "route",
     scope: {
@@ -10221,7 +10625,7 @@ function routeGenericEvent(event, opts) {
     invocationId: "<created-invocation-id>",
     sourceType: event.type,
     sourceRef: event.id,
-    subjectRef: stringField(event.subject) ?? event.id,
+    subjectRef: stringField2(event.subject) ?? event.id,
     projectKey: routeProjectPath,
     projectGroup,
     priority: 0,
@@ -10365,14 +10769,14 @@ function routeGenericEvent(event, opts) {
 }
 function taskField(task, keys) {
   for (const key of keys) {
-    const value = stringField(task[key]);
+    const value = stringField2(task[key]);
     if (value)
       return value;
   }
   return;
 }
 function taskListId(task) {
-  return taskField(task, ["task_list_id", "taskListId"]) ?? stringField(task.task_list?.id);
+  return taskField(task, ["task_list_id", "taskListId"]) ?? stringField2(task.task_list?.id);
 }
 function taskProjectId(task) {
   return taskField(task, ["project_id", "projectId"]);
@@ -10436,12 +10840,12 @@ function compactDrainResult(result) {
     kind: result.kind,
     taskId: event?.subject,
     eventId: event?.id,
-    idempotencyKey: stringField(value.idempotencyKey),
-    reason: stringField(value.reason) ?? throttle?.reason,
-    loopId: stringField(loop?.id),
-    loopName: stringField(loop?.name),
-    workflowId: stringField(workflow?.id),
-    workflowName: stringField(workflow?.name),
+    idempotencyKey: stringField2(value.idempotencyKey),
+    reason: stringField2(value.reason) ?? throttle?.reason,
+    loopId: stringField2(loop?.id),
+    loopName: stringField2(loop?.name),
+    workflowId: stringField2(workflow?.id),
+    workflowName: stringField2(workflow?.name),
     providerRouting,
     requeue,
     queuedAtSource: value.queuedAtSource
@@ -10946,7 +11350,7 @@ routes.command("show <id>").description("show one admission work item").action((
 routes.command("requeue <id>").description("requeue a terminal admission work item for the next task/event delivery").option("--reason <text>", "operator reason recorded on the work item").action((id, opts) => {
   const store = new Store;
   try {
-    const reason = stringField(opts.reason);
+    const reason = stringField2(opts.reason);
     if (!reason)
       throw new Error("routes requeue requires --reason <text>");
     const item = store.requeueWorkflowWorkItem(id, { reason });
@@ -11275,19 +11679,30 @@ workflows.command("migrate-agent-timeouts").description("append-only migrate act
         });
         continue;
       }
-      const migrated = store.createAndRetargetWorkflowLoop(loop.id, migration.body, {
-        workflowTimeoutMs: timeoutMs,
-        archiveOld: Boolean(opts.archiveOld)
-      });
-      rows.push({
-        loop: publicLoop(migrated.loop),
-        previousWorkflow: publicWorkflow(migrated.previousWorkflow),
-        workflow: publicWorkflow(migrated.workflow),
-        archivedOld: migrated.archivedOld ? publicWorkflow(migrated.archivedOld) : undefined,
-        status: "migrated",
-        agentStepIds: migration.agentStepIds,
-        timeoutMs
-      });
+      try {
+        const migrated = store.createAndRetargetWorkflowLoop(loop.id, migration.body, {
+          workflowTimeoutMs: timeoutMs,
+          archiveOld: Boolean(opts.archiveOld)
+        });
+        rows.push({
+          loop: publicLoop(migrated.loop),
+          previousWorkflow: publicWorkflow(migrated.previousWorkflow),
+          workflow: publicWorkflow(migrated.workflow),
+          archivedOld: migrated.archivedOld ? publicWorkflow(migrated.archivedOld) : undefined,
+          status: "migrated",
+          agentStepIds: migration.agentStepIds,
+          timeoutMs
+        });
+      } catch (error) {
+        rows.push({
+          loop: publicLoop(loop),
+          workflow: publicWorkflow(workflow),
+          status: "blocked",
+          reason: migrationErrorReason(error),
+          agentStepIds: migration.agentStepIds,
+          timeoutMs
+        });
+      }
     }
     const summary = {
       apply: Boolean(opts.apply),
@@ -11310,45 +11725,73 @@ workflows.command("migrate-goal-wrappers").description("append-only migrate acti
     const rows = [];
     for (const loop of candidateLoops) {
       if (loop.archivedAt) {
-        rows.push({ loop: publicLoop(loop), status: "skipped", reason: "loop is archived" });
+        rows.push({ loop: publicMigrationLoopSummary(loop), status: "skipped", reason: "loop is archived" });
         continue;
       }
       if (loop.target.type !== "workflow") {
-        rows.push({ loop: publicLoop(loop), status: "skipped", reason: "loop is not a workflow loop" });
+        rows.push({ loop: publicMigrationLoopSummary(loop), status: "skipped", reason: "loop is not a workflow loop" });
         continue;
       }
       const workflow = store.requireWorkflow(loop.target.workflowId);
-      const nextWorkflowName = workflowGoalWrapperMigrationName(workflow);
-      const migration = workflowWithoutGoalWrapper(workflow, { name: nextWorkflowName });
-      if (!migration.changed) {
-        rows.push({ loop: publicLoop(loop), workflow: publicWorkflow(workflow), status: "skipped", reason: "workflow has no top-level goal wrapper" });
+      if (!loop.goal) {
+        rows.push({
+          loop: publicMigrationLoopSummary(loop),
+          workflow: publicMigrationWorkflowSummary(workflow),
+          status: "skipped",
+          reason: "loop has no loop-level goal wrapper"
+        });
         continue;
       }
+      if (!workflow.goal) {
+        rows.push({
+          loop: publicMigrationLoopSummary(loop),
+          workflow: publicMigrationWorkflowSummary(workflow),
+          status: "skipped",
+          reason: "workflow has no top-level goal wrapper"
+        });
+        continue;
+      }
+      const nextWorkflowName = workflowGoalWrapperMigrationName(workflow);
       if (store.hasRunningRun(loop.id)) {
-        rows.push({ loop: publicLoop(loop), workflow: publicWorkflow(workflow), status: "blocked", reason: "loop has a running run; retry after it finishes" });
+        rows.push({
+          loop: publicMigrationLoopSummary(loop),
+          workflow: publicMigrationWorkflowSummary(workflow),
+          status: "blocked",
+          reason: "loop has a running run; retry after it finishes"
+        });
         continue;
       }
       if (!opts.apply) {
         rows.push({
-          loop: publicLoop(loop),
-          workflow: publicWorkflow(workflow),
+          loop: publicMigrationLoopSummary(loop),
+          workflow: publicMigrationWorkflowSummary(workflow),
           status: "would_migrate",
           nextWorkflowName,
-          removedGoal: workflow.goal
+          removedGoal: publicMigrationGoalSummary(workflow.goal)
         });
         continue;
       }
-      const migrated = store.createAndRetargetWorkflowLoop(loop.id, migration.body, {
-        workflowTimeoutMs: loop.target.timeoutMs,
-        archiveOld: Boolean(opts.archiveOld)
-      });
-      rows.push({
-        loop: publicLoop(migrated.loop),
-        previousWorkflow: publicWorkflow(migrated.previousWorkflow),
-        workflow: publicWorkflow(migrated.workflow),
-        archivedOld: migrated.archivedOld ? publicWorkflow(migrated.archivedOld) : undefined,
-        status: "migrated"
-      });
+      try {
+        const migrated = store.cloneWorkflowWithoutGoalAndRetargetLoop(loop.id, {
+          workflowName: nextWorkflowName,
+          workflowTimeoutMs: loop.target.timeoutMs,
+          archiveOld: Boolean(opts.archiveOld)
+        });
+        rows.push({
+          loop: publicMigrationLoopSummary(migrated.loop),
+          previousWorkflow: publicMigrationWorkflowSummary(migrated.previousWorkflow),
+          workflow: publicMigrationWorkflowSummary(migrated.workflow),
+          archivedOld: migrated.archivedOld ? publicMigrationWorkflowSummary(migrated.archivedOld) : undefined,
+          status: "migrated"
+        });
+      } catch (error) {
+        rows.push({
+          loop: publicMigrationLoopSummary(loop),
+          workflow: publicMigrationWorkflowSummary(workflow),
+          status: "blocked",
+          reason: migrationErrorReason(error)
+        });
+      }
     }
     const summary = {
       apply: Boolean(opts.apply),