@hasna/loops 0.4.11 → 0.4.12

package/CHANGELOG.md

@@ -5,6 +5,54 @@ documented in this file. Version entries are generated from the
 conventional-commit git history; one commit maps to one released patch version
 unless noted.
 
+## 0.4.12 (2026-07-05)
+
+Drain throughput: `--max-active` is now a per-route ceiling instead of a
+store-wide one, drain dispatch spreads across subscription accounts by live load,
+and every step records the account it ran on.
+
+### Fixed
+
+- **Route admission — per-route `--max-active`:** the global admission count was
+  store-wide, so the busiest router's `--max-active` became a shared ceiling that
+  throttled every other router (average concurrency ~1.9 while the agent lane
+  allowed 12; ~253 items/24h deferred as `global active workflow limit reached`).
+  The global count is now scoped to the route/drain that set the limit; scope
+  precedence is an explicit `--max-active-scope <key>` first, then the running
+  loop's `LOOPS_LOOP_NAME`, then the route key as the final fallback — so each
+  router's `--max-active` is its own ceiling.
+  Existing routers get correct scoping with no config change. `project` and
+  `project_group` counts are unchanged: they remain cross-route anti-hog caps.
+- **Per-account attribution:** Codewith agent steps carry their subscription
+  account in `authProfile`, not an `AccountRef`, so `workflow_step_runs.account_profile`
+  was NULL for every drain worker and per-account burn could not be attributed.
+  The resolved auth profile (and provider as `account_tool`) is now recorded on
+  each step at run creation, and the per-role assignment is surfaced in drain
+  reports.
+
+### Added
+
+- **Least-loaded auth-profile pool selection + `--max-per-profile`:** pooled
+  Codewith dispatch picked a member by a pure hash of the work item, which stacked
+  several concurrent workers on one account at high concurrency and tripped
+  provider-side 429/stream-drop limits. Live drains now count running steps per
+  account and place each route on the least-loaded pool member (verifier/planner
+  still land on a different account than the worker; the hash is the deterministic
+  tie-break, so a cold store reproduces the prior assignment). New
+  `--max-per-profile <K>` (default 2 for pools of two or more, `0` disables) defers
+  a route when every pool account already has `K` running steps.
+
+Schema: additive sqlite migration `0008_work_item_route_scope` (nullable
+`workflow_work_items.route_scope`; its index is created only by the migration —
+never in the baseline DDL, which re-runs on every open and would crash pre-0008
+databases). `SCHEMA_USER_VERSION` is intentionally not bumped so an older binary
+can still open a database this migration touched (rollback-safe). Postgres gets
+the equivalent additive migration `0004_work_item_route_scope`; the released,
+checksummed `0002_workflows_goals` block is untouched so existing postgres
+ledgers keep verifying. Upgrade coverage: a real pre-0008 (0.4.11 schema)
+fixture database must open cleanly, gain the column + index, and keep its data;
+released postgres migration checksums are pinned in tests.
+
 ## 0.4.11 (2026-07-05)
 
 Scheduler fairness and PR-route hygiene: fast command loops no longer starve

package/README.md

@@ -594,8 +594,15 @@ This is the intended deterministic-to-agentic path: a producer creates a todos
 task, `@hasna/events` delivers `task.created`, OpenLoops records the invocation
 and admission item, OpenLoops creates a worker/verifier workflow when admitted,
 and the workflow updates todos with evidence. Use account pools so worker and
-verifier steps do not burn the same profile; OpenLoops picks deterministically
-and uses a different verifier profile when the pool has at least two entries.
+verifier steps do not burn the same profile. For live Codewith drains, OpenLoops
+spreads each route to the **least-loaded** pool account (counting running steps
+per account) and still keeps the verifier on a different profile than the worker;
+the deterministic hash is the tie-break, so a cold store reproduces the previous
+assignment exactly. `--max-per-profile <K>` (default 2 for pools of two or more,
+`0` to disable) defers a route when every pool account already has `K` running
+steps — the guardrail that keeps higher concurrency from stacking on one
+subscription and tripping provider-side rate limits. The chosen account per role
+is recorded on each step (`account_profile`) and surfaced in drain reports.
 Use `--dry-run` to inspect the rendered invocation, work item, workflow, and
 loop input without storing anything.
 
@@ -645,11 +652,21 @@ loops routes schedule todos-task oss-task-route-drain \
   --max-active-per-project 1 \
   --max-active-per-project-group 4 \
   --max-active 12 \
+  --max-per-profile 2 \
   --worktree-mode required \
   --evidence-dir "$HOME/.hasna/loops/reports/oss-task-route-drain" \
   --compact
 ```
 
+`--max-active` counts active routed workflows **per route**. Scope precedence:
+an explicit `--max-active-scope <key>` wins, else the running loop's
+`LOOPS_LOOP_NAME`, else the route key — so each router's limit is its own
+ceiling rather than a store-wide total shared by every router.
+`--max-active-per-project` and `--max-active-per-project-group` remain cross-route
+anti-hog caps counted over all routes. Raise a router's `--max-active`
+deliberately once counting is per-route; keep `--max-per-profile` set so the
+extra concurrency spreads across subscription accounts.
+
 Only route tasks that explicitly opt in with `auto:route`, `route_enabled=true`,
 or `automation.allowed=true`. Use Codewith account pools, required worktrees,
 max-active throttles, and bounded evidence directories. Do not dispatch or paste

package/dist/api/index.js

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.11",
+  version: "0.4.12",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/cli/index.js

@@ -1323,6 +1323,7 @@ function rowToWorkflowWorkItem(row) {
     subjectRef: row.subject_ref,
     projectKey: row.project_key ?? undefined,
     projectGroup: row.project_group ?? undefined,
+    routeScope: row.route_scope ?? undefined,
     priority: row.priority,
     status: row.status,
     attempts: row.attempts,
@@ -1603,6 +1604,13 @@ class Store {
           this.addColumnIfMissing("loop_runs", "claim_token", "TEXT");
           this.db.exec("CREATE INDEX IF NOT EXISTS idx_runs_claim_token ON loop_runs(claim_token) WHERE claim_token IS NOT NULL");
         }
+      },
+      {
+        id: "0008_work_item_route_scope",
+        apply: () => {
+          this.addColumnIfMissing("workflow_work_items", "route_scope", "TEXT");
+          this.db.exec("CREATE INDEX IF NOT EXISTS idx_workflow_work_items_scope ON workflow_work_items(route_scope, status)");
+        }
       }
     ];
   }
@@ -1750,6 +1758,7 @@ class Store {
         subject_ref TEXT NOT NULL,
         project_key TEXT,
         project_group TEXT,
+        route_scope TEXT,
         priority INTEGER NOT NULL,
         status TEXT NOT NULL,
         attempts INTEGER NOT NULL,
@@ -1767,6 +1776,13 @@ class Store {
       CREATE INDEX IF NOT EXISTS idx_workflow_work_items_project ON workflow_work_items(project_key, status);
       CREATE INDEX IF NOT EXISTS idx_workflow_work_items_group ON workflow_work_items(project_group, status);
       CREATE INDEX IF NOT EXISTS idx_workflow_work_items_invocation ON workflow_work_items(invocation_id);
+      -- idx_workflow_work_items_scope (route_scope, status) is created ONLY by
+      -- migration 0008_work_item_route_scope, never here: this baseline DDL
+      -- re-runs on EVERY open (0001 is not skip-guarded), and on a pre-0008
+      -- database the CREATE TABLE above is a no-op, so an index on route_scope
+      -- here would execute before the column exists and crash the open
+      -- ("no such column: route_scope"). New columns may be folded into the
+      -- CREATE TABLE (fresh-db only); their indexes must live in the migration.
 
       CREATE TABLE IF NOT EXISTS workflow_step_runs (
         id TEXT PRIMARY KEY,
@@ -2558,10 +2574,10 @@ class Store {
     const id = genId();
     const status = input.status ?? "queued";
     this.db.query(`INSERT INTO workflow_work_items (id, route_key, idempotency_key, invocation_id, source_type, source_ref,
-          subject_ref, project_key, project_group, priority, status, attempts, next_attempt_at, lease_expires_at,
+          subject_ref, project_key, project_group, route_scope, priority, status, attempts, next_attempt_at, lease_expires_at,
           workflow_id, loop_id, workflow_run_id, last_reason, created_at, updated_at)
          VALUES ($id, $routeKey, $idempotencyKey, $invocationId, $sourceType, $sourceRef, $subjectRef,
-          $projectKey, $projectGroup, $priority, $status, 0, $nextAttemptAt, NULL, NULL, NULL, NULL,
+          $projectKey, $projectGroup, $routeScope, $priority, $status, 0, $nextAttemptAt, NULL, NULL, NULL, NULL,
           $lastReason, $created, $updated)
          ON CONFLICT(route_key, idempotency_key) DO UPDATE SET
           invocation_id=excluded.invocation_id,
@@ -2570,6 +2586,7 @@ class Store {
           subject_ref=excluded.subject_ref,
           project_key=excluded.project_key,
           project_group=excluded.project_group,
+          route_scope=excluded.route_scope,
           priority=excluded.priority,
           status=CASE
             WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running', 'failed', 'dead_letter', 'cancelled')
@@ -2611,6 +2628,7 @@ class Store {
       $subjectRef: input.subjectRef,
       $projectKey: input.projectKey ?? null,
       $projectGroup: input.projectGroup ?? null,
+      $routeScope: input.routeScope ?? null,
       $priority: input.priority ?? 0,
       $status: status,
       $nextAttemptAt: input.nextAttemptAt ?? null,
@@ -2648,11 +2666,21 @@ class Store {
   countActiveWorkflowWorkItems(args = {}) {
     const active = ["admitted", "running"];
     const placeholders = active.map(() => "?").join(",");
-    const global = this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders})`).get(...active)?.count ?? 0;
+    const routeScope = args.routeScope?.trim() || undefined;
+    const global = routeScope ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND route_scope = ?`).get(...active, routeScope)?.count ?? 0 : this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders})`).get(...active)?.count ?? 0;
     const project = args.projectKey ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND project_key = ?`).get(...active, args.projectKey)?.count ?? 0 : 0;
     const projectGroup = args.projectGroup ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND project_group = ?`).get(...active, args.projectGroup)?.count ?? 0 : undefined;
     return { global, project, ...projectGroup !== undefined ? { projectGroup } : {} };
   }
+  countRunningWorkflowStepsByAuthProfile() {
+    const rows = this.db.query("SELECT account_profile, COUNT(*) AS count FROM workflow_step_runs WHERE status = 'running' AND account_profile IS NOT NULL GROUP BY account_profile").all();
+    const counts = {};
+    for (const row of rows) {
+      if (row.account_profile)
+        counts[row.account_profile] = row.count;
+    }
+    return counts;
+  }
   requeueWorkflowWorkItem(id, patch = {}) {
     const current = this.getWorkflowWorkItem(id);
     if (!current)
@@ -3088,6 +3116,9 @@ class Store {
       }
       input.workflow.steps.forEach((step, sequence) => {
         const account = step.account ?? step.target.account;
+        const agentTarget = step.target.type === "agent" ? step.target : undefined;
+        const resolvedProfile = account?.profile ?? agentTarget?.authProfile ?? null;
+        const resolvedTool = account?.tool ?? (agentTarget?.authProfile ? agentTarget.provider : null);
         this.db.query(`INSERT INTO workflow_step_runs (id, workflow_run_id, step_id, sequence, status, started_at, finished_at,
               exit_code, pid, duration_ms, stdout, stderr, error, account_profile, account_tool, created_at, updated_at)
              VALUES ($id, $workflowRunId, $stepId, $sequence, 'pending', NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
@@ -3096,8 +3127,8 @@ class Store {
           $workflowRunId: runId,
           $stepId: step.id,
           $sequence: sequence,
-          $accountProfile: account?.profile ?? null,
-          $accountTool: account?.tool ?? null,
+          $accountProfile: resolvedProfile,
+          $accountTool: resolvedTool,
           $created: now,
           $updated: now
         });
@@ -4237,7 +4268,7 @@ class Store {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.11",
+  version: "0.4.12",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -9464,6 +9495,79 @@ function prHandoffCommand(opts) {
   ].join(`
 `);
 }
+
+// src/lib/route/profile-pool.ts
+function stableIndex(seed, size) {
+  let hash = 2166136261;
+  for (let i = 0;i < seed.length; i += 1) {
+    hash ^= seed.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return Math.abs(hash >>> 0) % size;
+}
+function poolRoleOffset(role) {
+  if (role === "worker")
+    return 0;
+  if (role === "verifier")
+    return 1;
+  if (role === "planner")
+    return 2;
+  return 3;
+}
+function selectLeastLoadedProfile(pool, loadCounts, anchor, exclude) {
+  const size = pool.length;
+  let best;
+  let bestExcluded = true;
+  let bestLoad = Number.POSITIVE_INFINITY;
+  for (let k = 0;k < size; k += 1) {
+    const profile = pool[(anchor + k) % size];
+    const excluded = exclude.has(profile);
+    const load = loadCounts[profile] ?? 0;
+    if (best === undefined) {
+      best = profile;
+      bestExcluded = excluded;
+      bestLoad = load;
+      continue;
+    }
+    const better = excluded === bestExcluded ? load < bestLoad : !excluded && bestExcluded;
+    if (better) {
+      best = profile;
+      bestExcluded = excluded;
+      bestLoad = load;
+    }
+  }
+  return best;
+}
+var ROLE_PRIORITY = ["worker", "verifier", "planner", "triage"];
+function assignPoolAuthProfiles(input) {
+  const pool = input.pool.filter((entry) => entry.trim().length > 0);
+  if (pool.length === 0)
+    return { profiles: {}, deferred: false, minLoad: 0 };
+  const minLoad = pool.reduce((min, profile) => Math.min(min, input.loadCounts[profile] ?? 0), Number.POSITIVE_INFINITY);
+  const guard = input.maxPerProfile !== undefined && input.maxPerProfile > 0;
+  if (guard && minLoad >= input.maxPerProfile) {
+    return {
+      profiles: {},
+      deferred: true,
+      minLoad,
+      reason: `per-profile active limit reached (all ${pool.length} pool members >= ${input.maxPerProfile} running; min ${minLoad})`
+    };
+  }
+  const workerIndex = stableIndex(input.seed, pool.length);
+  const rolesToAssign = ROLE_PRIORITY.filter((role) => input.roles.includes(role));
+  for (const role of input.roles)
+    if (!rolesToAssign.includes(role))
+      rolesToAssign.push(role);
+  const profiles = {};
+  const taken = new Set;
+  for (const role of rolesToAssign) {
+    const anchor = (workerIndex + poolRoleOffset(role)) % pool.length;
+    const profile = selectLeastLoadedProfile(pool, input.loadCounts, anchor, taken);
+    profiles[role] = profile;
+    taken.add(profile);
+  }
+  return { profiles, deferred: false, minLoad: Number.isFinite(minLoad) ? minLoad : 0 };
+}
 // src/lib/templates-custom.ts
 import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readdirSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { join as join6, resolve as resolve3 } from "path";
@@ -9859,25 +9963,13 @@ function parseDeterministicTimeoutMs(raw, fallbackMs, label = "timeoutMs") {
     throw new Error(`${label} must be a positive integer number of milliseconds`);
   return value;
 }
-function stableIndex(seed, size) {
-  let hash = 2166136261;
-  for (let i = 0;i < seed.length; i += 1) {
-    hash ^= seed.charCodeAt(i);
-    hash = Math.imul(hash, 16777619);
-  }
-  return Math.abs(hash >>> 0) % size;
-}
 function rolePoolValue(pool, seed, role) {
   if (!pool?.length)
     return;
   const workerIndex = stableIndex(seed, pool.length);
-  if (role === "worker" || pool.length === 1)
+  if (pool.length === 1)
     return pool[workerIndex];
-  if (role === "verifier")
-    return pool[(workerIndex + 1) % pool.length];
-  if (role === "planner")
-    return pool[(workerIndex + 2) % pool.length];
-  return pool[(workerIndex + 3) % pool.length];
+  return pool[(workerIndex + poolRoleOffset(role)) % pool.length];
 }
 function authProfileForRole(input, role, seed) {
   if (role === "triage" && input.triageAuthProfile)
@@ -10047,7 +10139,8 @@ function agentTarget(input, prompt, role, seed, plan) {
     allowlist: input.manualBreakGlass ? { enforcement: "metadata_only", commands: ["manual-break-glass"] } : undefined,
     routing: {
       projectPath: input.routeProjectPath ?? input.projectPath,
-      ...input.projectGroup ? { projectGroup: input.projectGroup } : {}
+      ...input.projectGroup ? { projectGroup: input.projectGroup } : {},
+      role
     },
     account: accountForRole(input, role, seed),
     timeoutMs: agentTimeoutMs(input),
@@ -11751,7 +11844,8 @@ function routeProjectGroup(optsGroup, data, metadata) {
 function routeThrottleDecision(store, args) {
   const projectPath = normalizeRoutePath(args.projectPath) ?? resolve6(args.projectPath);
   const projectGroup = args.projectGroup?.trim() || undefined;
-  const counts = store.countActiveWorkflowWorkItems({ projectKey: projectPath, projectGroup });
+  const routeScope = args.routeScope?.trim() || undefined;
+  const counts = store.countActiveWorkflowWorkItems({ projectKey: projectPath, projectGroup, routeScope });
   const base = {
     projectPath,
     ...projectGroup ? { projectGroup } : {},
@@ -11913,6 +12007,33 @@ async function readEventEnvelopeInput(opts = {}) {
     throw new ValidationError("event.source is required");
   return event;
 }
+function resolveRouteScope(opts, routeKey) {
+  return opts.maxActiveScope?.trim() || process.env.LOOPS_LOOP_NAME?.trim() || routeKey || undefined;
+}
+function buildPoolRoutingPlan(opts, provider, authProfilePool, workflowBody, seed) {
+  if (provider !== "codewith")
+    return;
+  const pool = (authProfilePool ?? []).filter((entry) => entry.trim().length > 0);
+  if (pool.length < 2)
+    return;
+  const pinned = Boolean(opts.triageAuthProfile || opts.plannerAuthProfile || opts.workerAuthProfile || opts.verifierAuthProfile);
+  if (pinned)
+    return;
+  const rolesByStepId = {};
+  for (const step of workflowBody.steps) {
+    const target = step.target;
+    if (target.type !== "agent" || target.provider !== "codewith")
+      continue;
+    const role = target.routing?.role;
+    if (role)
+      rolesByStepId[step.id] = role;
+  }
+  if (Object.keys(rolesByStepId).length === 0)
+    return;
+  const explicitMax = nonNegativeInteger(opts.maxPerProfile, "--max-per-profile");
+  const maxPerProfile = explicitMax ?? 2;
+  return { pool, seed, maxPerProfile: maxPerProfile > 0 ? maxPerProfile : undefined, rolesByStepId };
+}
 function dedupedRoutePrint(plan, outcome) {
   return {
     kind: "deduped",
@@ -11942,6 +12063,7 @@ function routeEvent(plan) {
     subjectRef: plan.subjectRef,
     projectKey: plan.routeProjectPath,
     projectGroup: plan.projectGroup,
+    routeScope: plan.routeScope,
     priority: 0,
     status: "queued"
   };
@@ -11981,6 +12103,7 @@ function routeEvent(plan) {
     const workflowPreflightSpec = workflowSpecForPreflight(workflowBody, "event-preflight");
     generatedRouteSandboxPreflight(workflowPreflightSpec);
     const preflight = opts.preflight ? preflightStoredWorkflow(workflowPreflightSpec, plan.workflowContext, {}) : undefined;
+    let poolAssignment;
     const outcome = store.writeTransaction(() => {
       const invocation = store.createWorkflowInvocation(plan.invocationInput);
       const existingItem = store.findWorkflowWorkItem(plan.routeKey, idempotencyKey);
@@ -11991,12 +12114,39 @@ function routeEvent(plan) {
           return { kind: "deduped", existingItem, existingLoop, existingWorkflow, invocation };
         }
       }
-      const throttle = hasThrottleLimits(plan.throttleLimits) ? routeThrottleDecision(store, { projectPath: plan.routeProjectPath, projectGroup: plan.projectGroup, limits: plan.throttleLimits }) : undefined;
+      const throttle = hasThrottleLimits(plan.throttleLimits) ? routeThrottleDecision(store, {
+        projectPath: plan.routeProjectPath,
+        projectGroup: plan.projectGroup,
+        routeScope: plan.routeScope,
+        limits: plan.throttleLimits
+      }) : undefined;
+      if (plan.poolRouting) {
+        const loadCounts = store.countRunningWorkflowStepsByAuthProfile();
+        poolAssignment = assignPoolAuthProfiles({
+          pool: plan.poolRouting.pool,
+          seed: plan.poolRouting.seed,
+          loadCounts,
+          maxPerProfile: plan.poolRouting.maxPerProfile,
+          roles: Object.values(plan.poolRouting.rolesByStepId)
+        });
+      }
+      const activeThrottled = Boolean(throttle && !throttle.allowed);
+      const poolDeferred = Boolean(poolAssignment?.deferred);
+      const deferred = activeThrottled || poolDeferred;
+      const deferReason = activeThrottled ? throttle.reason : poolAssignment?.reason;
+      const effectiveThrottle = activeThrottled ? throttle : poolDeferred ? {
+        allowed: false,
+        reason: deferReason,
+        projectPath: plan.routeProjectPath,
+        ...plan.projectGroup ? { projectGroup: plan.projectGroup } : {},
+        limits: plan.throttleLimits,
+        counts: throttle?.counts ?? { global: 0, project: 0 }
+      } : throttle;
       const workItem = store.upsertWorkflowWorkItem({
         ...workItemInput,
         invocationId: invocation.id,
-        status: throttle && !throttle.allowed ? "deferred" : "queued",
-        lastReason: throttle && !throttle.allowed ? throttle.reason : undefined
+        status: deferred ? "deferred" : "queued",
+        lastReason: deferred ? deferReason : undefined
       });
       const requeue = workItem.attempts > 0 && workItem.status === "queued" ? {
         previousWorkItemId: workItem.id,
@@ -12004,8 +12154,16 @@ function routeEvent(plan) {
         reason: workItem.lastReason
       } : undefined;
       const refreshedInvocation = store.refreshWorkflowInvocationForWorkItem(workItem.id, plan.invocationInput);
-      if (throttle && !throttle.allowed)
-        return { kind: "throttled", invocation: refreshedInvocation, workItem, throttle };
+      if (deferred)
+        return { kind: "throttled", invocation: refreshedInvocation, workItem, throttle: effectiveThrottle };
+      if (poolAssignment && !poolAssignment.deferred) {
+        for (const step of workflowBody.steps) {
+          const role = plan.poolRouting?.rolesByStepId[step.id];
+          const chosen = role ? poolAssignment.profiles[role] : undefined;
+          if (chosen && step.target.type === "agent")
+            step.target.authProfile = chosen;
+        }
+      }
       const workflow = routeWorkflowForStorage(store, workflowBody);
       const loop = store.createLoop({
         ...loopInput,
@@ -12063,6 +12221,7 @@ function routeEvent(plan) {
         loop: publicLoop(outcome.loop),
         requeue: outcome.requeue,
         throttle: outcome.throttle,
+        ...poolAssignment && !poolAssignment.deferred && Object.keys(poolAssignment.profiles).length ? { accountProfiles: poolAssignment.profiles, routeScope: plan.routeScope } : {},
         sandboxPreflight,
         preflight
       },
@@ -12246,6 +12405,8 @@ function routeTodosTaskEvent(event, opts) {
     invocationInput,
     routeProjectPath,
     projectGroup,
+    routeScope: resolveRouteScope(opts, "todos-task"),
+    poolRouting: buildPoolRoutingPlan(opts, provider, providerRouting.authProfilePool, workflowBody, taskId),
     subjectRef: taskId,
     loopName,
     loopDescription: `Run ${workflowBody.name} once for task ${taskId}; idempotency=${idempotencyKey}; event=${event.id}`,
@@ -12359,6 +12520,8 @@ function routeGenericEvent(event, opts) {
     invocationInput,
     routeProjectPath,
     projectGroup,
+    routeScope: resolveRouteScope(opts, "generic-event"),
+    poolRouting: buildPoolRoutingPlan(opts, provider, providerRouting.authProfilePool, workflowBody, `${event.source}:${event.type}:${event.id}`),
     subjectRef: stringField(event.subject) ?? event.id,
     loopName,
     loopDescription: `Run ${workflowBody.name} once for event ${event.id}; idempotency=${idempotencyKey}`,
@@ -12562,6 +12725,8 @@ function compactDrainResult(result) {
     workflowId: stringField(workflow?.id),
     workflowName: stringField(workflow?.name),
     providerRouting,
+    accountProfiles: objectField2(value.accountProfiles),
+    routeScope: stringField(value.routeScope),
     requeue,
     queuedAtSource: value.queuedAtSource,
     fatal: value.fatal === true ? true : undefined
@@ -13227,6 +13392,18 @@ var AGENT_ROUTING_OPTION_SPECS = [
     kind: "value",
     description: "skip creating a workflow when this many active routed workflows already exist for the project group"
   },
+  {
+    flags: "--max-active-scope <key>",
+    key: "maxActiveScope",
+    kind: "value",
+    description: "scope --max-active counting to this route/drain identity (defaults to the LOOPS_LOOP_NAME of the running loop, else the route key) so each drain's --max-active is its own ceiling instead of a store-wide one"
+  },
+  {
+    flags: "--max-per-profile <n>",
+    key: "maxPerProfile",
+    kind: "value",
+    description: "for codewith auth-profile pools, spread dispatch to the least-loaded account and defer when every pool member already has this many running steps (default 2 for pools of 2+; 0 disables the guard)"
+  },
   { flags: "--worktree-mode <mode>", key: "worktreeMode", kind: "value", description: "worktree isolation mode: auto, required, off, or main", defaultValue: "auto" },
   { flags: "--worktree-root <path>", key: "worktreeRoot", kind: "value", description: "base directory for OpenLoops-managed git worktrees" },
   { flags: "--worktree-branch-prefix <prefix>", key: "worktreeBranchPrefix", kind: "value", description: "branch prefix for generated worktrees", defaultValue: "openloops" },

package/dist/daemon/index.js

@@ -1323,6 +1323,7 @@ function rowToWorkflowWorkItem(row) {
     subjectRef: row.subject_ref,
     projectKey: row.project_key ?? undefined,
     projectGroup: row.project_group ?? undefined,
+    routeScope: row.route_scope ?? undefined,
     priority: row.priority,
     status: row.status,
     attempts: row.attempts,
@@ -1603,6 +1604,13 @@ class Store {
           this.addColumnIfMissing("loop_runs", "claim_token", "TEXT");
           this.db.exec("CREATE INDEX IF NOT EXISTS idx_runs_claim_token ON loop_runs(claim_token) WHERE claim_token IS NOT NULL");
         }
+      },
+      {
+        id: "0008_work_item_route_scope",
+        apply: () => {
+          this.addColumnIfMissing("workflow_work_items", "route_scope", "TEXT");
+          this.db.exec("CREATE INDEX IF NOT EXISTS idx_workflow_work_items_scope ON workflow_work_items(route_scope, status)");
+        }
       }
     ];
   }
@@ -1750,6 +1758,7 @@ class Store {
         subject_ref TEXT NOT NULL,
         project_key TEXT,
         project_group TEXT,
+        route_scope TEXT,
         priority INTEGER NOT NULL,
         status TEXT NOT NULL,
         attempts INTEGER NOT NULL,
@@ -1767,6 +1776,13 @@ class Store {
       CREATE INDEX IF NOT EXISTS idx_workflow_work_items_project ON workflow_work_items(project_key, status);
       CREATE INDEX IF NOT EXISTS idx_workflow_work_items_group ON workflow_work_items(project_group, status);
       CREATE INDEX IF NOT EXISTS idx_workflow_work_items_invocation ON workflow_work_items(invocation_id);
+      -- idx_workflow_work_items_scope (route_scope, status) is created ONLY by
+      -- migration 0008_work_item_route_scope, never here: this baseline DDL
+      -- re-runs on EVERY open (0001 is not skip-guarded), and on a pre-0008
+      -- database the CREATE TABLE above is a no-op, so an index on route_scope
+      -- here would execute before the column exists and crash the open
+      -- ("no such column: route_scope"). New columns may be folded into the
+      -- CREATE TABLE (fresh-db only); their indexes must live in the migration.
 
       CREATE TABLE IF NOT EXISTS workflow_step_runs (
         id TEXT PRIMARY KEY,
@@ -2558,10 +2574,10 @@ class Store {
     const id = genId();
     const status = input.status ?? "queued";
     this.db.query(`INSERT INTO workflow_work_items (id, route_key, idempotency_key, invocation_id, source_type, source_ref,
-          subject_ref, project_key, project_group, priority, status, attempts, next_attempt_at, lease_expires_at,
+          subject_ref, project_key, project_group, route_scope, priority, status, attempts, next_attempt_at, lease_expires_at,
           workflow_id, loop_id, workflow_run_id, last_reason, created_at, updated_at)
          VALUES ($id, $routeKey, $idempotencyKey, $invocationId, $sourceType, $sourceRef, $subjectRef,
-          $projectKey, $projectGroup, $priority, $status, 0, $nextAttemptAt, NULL, NULL, NULL, NULL,
+          $projectKey, $projectGroup, $routeScope, $priority, $status, 0, $nextAttemptAt, NULL, NULL, NULL, NULL,
           $lastReason, $created, $updated)
          ON CONFLICT(route_key, idempotency_key) DO UPDATE SET
           invocation_id=excluded.invocation_id,
@@ -2570,6 +2586,7 @@ class Store {
           subject_ref=excluded.subject_ref,
           project_key=excluded.project_key,
           project_group=excluded.project_group,
+          route_scope=excluded.route_scope,
           priority=excluded.priority,
           status=CASE
             WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running', 'failed', 'dead_letter', 'cancelled')
@@ -2611,6 +2628,7 @@ class Store {
       $subjectRef: input.subjectRef,
       $projectKey: input.projectKey ?? null,
       $projectGroup: input.projectGroup ?? null,
+      $routeScope: input.routeScope ?? null,
       $priority: input.priority ?? 0,
       $status: status,
       $nextAttemptAt: input.nextAttemptAt ?? null,
@@ -2648,11 +2666,21 @@ class Store {
   countActiveWorkflowWorkItems(args = {}) {
     const active = ["admitted", "running"];
     const placeholders = active.map(() => "?").join(",");
-    const global = this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders})`).get(...active)?.count ?? 0;
+    const routeScope = args.routeScope?.trim() || undefined;
+    const global = routeScope ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND route_scope = ?`).get(...active, routeScope)?.count ?? 0 : this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders})`).get(...active)?.count ?? 0;
     const project = args.projectKey ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND project_key = ?`).get(...active, args.projectKey)?.count ?? 0 : 0;
     const projectGroup = args.projectGroup ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND project_group = ?`).get(...active, args.projectGroup)?.count ?? 0 : undefined;
     return { global, project, ...projectGroup !== undefined ? { projectGroup } : {} };
   }
+  countRunningWorkflowStepsByAuthProfile() {
+    const rows = this.db.query("SELECT account_profile, COUNT(*) AS count FROM workflow_step_runs WHERE status = 'running' AND account_profile IS NOT NULL GROUP BY account_profile").all();
+    const counts = {};
+    for (const row of rows) {
+      if (row.account_profile)
+        counts[row.account_profile] = row.count;
+    }
+    return counts;
+  }
   requeueWorkflowWorkItem(id, patch = {}) {
     const current = this.getWorkflowWorkItem(id);
     if (!current)
@@ -3088,6 +3116,9 @@ class Store {
       }
       input.workflow.steps.forEach((step, sequence) => {
         const account = step.account ?? step.target.account;
+        const agentTarget = step.target.type === "agent" ? step.target : undefined;
+        const resolvedProfile = account?.profile ?? agentTarget?.authProfile ?? null;
+        const resolvedTool = account?.tool ?? (agentTarget?.authProfile ? agentTarget.provider : null);
         this.db.query(`INSERT INTO workflow_step_runs (id, workflow_run_id, step_id, sequence, status, started_at, finished_at,
               exit_code, pid, duration_ms, stdout, stderr, error, account_profile, account_tool, created_at, updated_at)
              VALUES ($id, $workflowRunId, $stepId, $sequence, 'pending', NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
@@ -3096,8 +3127,8 @@ class Store {
           $workflowRunId: runId,
           $stepId: step.id,
           $sequence: sequence,
-          $accountProfile: account?.profile ?? null,
-          $accountTool: account?.tool ?? null,
+          $accountProfile: resolvedProfile,
+          $accountTool: resolvedTool,
           $created: now,
           $updated: now
         });
@@ -7785,7 +7816,7 @@ function enableStartup(result) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.11",
+  version: "0.4.12",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",