@hasna/loops 0.4.11 → 0.4.13

package/dist/cli/index.js

@@ -1323,6 +1323,7 @@ function rowToWorkflowWorkItem(row) {
     subjectRef: row.subject_ref,
     projectKey: row.project_key ?? undefined,
     projectGroup: row.project_group ?? undefined,
+    routeScope: row.route_scope ?? undefined,
     priority: row.priority,
     status: row.status,
     attempts: row.attempts,
@@ -1603,6 +1604,13 @@ class Store {
           this.addColumnIfMissing("loop_runs", "claim_token", "TEXT");
           this.db.exec("CREATE INDEX IF NOT EXISTS idx_runs_claim_token ON loop_runs(claim_token) WHERE claim_token IS NOT NULL");
         }
+      },
+      {
+        id: "0008_work_item_route_scope",
+        apply: () => {
+          this.addColumnIfMissing("workflow_work_items", "route_scope", "TEXT");
+          this.db.exec("CREATE INDEX IF NOT EXISTS idx_workflow_work_items_scope ON workflow_work_items(route_scope, status)");
+        }
       }
     ];
   }
@@ -1750,6 +1758,7 @@ class Store {
         subject_ref TEXT NOT NULL,
         project_key TEXT,
         project_group TEXT,
+        route_scope TEXT,
         priority INTEGER NOT NULL,
         status TEXT NOT NULL,
         attempts INTEGER NOT NULL,
@@ -1767,6 +1776,13 @@ class Store {
       CREATE INDEX IF NOT EXISTS idx_workflow_work_items_project ON workflow_work_items(project_key, status);
       CREATE INDEX IF NOT EXISTS idx_workflow_work_items_group ON workflow_work_items(project_group, status);
       CREATE INDEX IF NOT EXISTS idx_workflow_work_items_invocation ON workflow_work_items(invocation_id);
+      -- idx_workflow_work_items_scope (route_scope, status) is created ONLY by
+      -- migration 0008_work_item_route_scope, never here: this baseline DDL
+      -- re-runs on EVERY open (0001 is not skip-guarded), and on a pre-0008
+      -- database the CREATE TABLE above is a no-op, so an index on route_scope
+      -- here would execute before the column exists and crash the open
+      -- ("no such column: route_scope"). New columns may be folded into the
+      -- CREATE TABLE (fresh-db only); their indexes must live in the migration.
 
       CREATE TABLE IF NOT EXISTS workflow_step_runs (
         id TEXT PRIMARY KEY,
@@ -2558,10 +2574,10 @@ class Store {
     const id = genId();
     const status = input.status ?? "queued";
     this.db.query(`INSERT INTO workflow_work_items (id, route_key, idempotency_key, invocation_id, source_type, source_ref,
-          subject_ref, project_key, project_group, priority, status, attempts, next_attempt_at, lease_expires_at,
+          subject_ref, project_key, project_group, route_scope, priority, status, attempts, next_attempt_at, lease_expires_at,
           workflow_id, loop_id, workflow_run_id, last_reason, created_at, updated_at)
          VALUES ($id, $routeKey, $idempotencyKey, $invocationId, $sourceType, $sourceRef, $subjectRef,
-          $projectKey, $projectGroup, $priority, $status, 0, $nextAttemptAt, NULL, NULL, NULL, NULL,
+          $projectKey, $projectGroup, $routeScope, $priority, $status, 0, $nextAttemptAt, NULL, NULL, NULL, NULL,
           $lastReason, $created, $updated)
          ON CONFLICT(route_key, idempotency_key) DO UPDATE SET
           invocation_id=excluded.invocation_id,
@@ -2570,6 +2586,7 @@ class Store {
           subject_ref=excluded.subject_ref,
           project_key=excluded.project_key,
           project_group=excluded.project_group,
+          route_scope=excluded.route_scope,
           priority=excluded.priority,
           status=CASE
             WHEN workflow_work_items.status IN ('succeeded', 'admitted', 'running', 'failed', 'dead_letter', 'cancelled')
@@ -2611,6 +2628,7 @@ class Store {
       $subjectRef: input.subjectRef,
       $projectKey: input.projectKey ?? null,
       $projectGroup: input.projectGroup ?? null,
+      $routeScope: input.routeScope ?? null,
       $priority: input.priority ?? 0,
       $status: status,
       $nextAttemptAt: input.nextAttemptAt ?? null,
@@ -2648,11 +2666,21 @@ class Store {
   countActiveWorkflowWorkItems(args = {}) {
     const active = ["admitted", "running"];
     const placeholders = active.map(() => "?").join(",");
-    const global = this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders})`).get(...active)?.count ?? 0;
+    const routeScope = args.routeScope?.trim() || undefined;
+    const global = routeScope ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND route_scope = ?`).get(...active, routeScope)?.count ?? 0 : this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders})`).get(...active)?.count ?? 0;
     const project = args.projectKey ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND project_key = ?`).get(...active, args.projectKey)?.count ?? 0 : 0;
     const projectGroup = args.projectGroup ? this.db.query(`SELECT COUNT(*) AS count FROM workflow_work_items WHERE status IN (${placeholders}) AND project_group = ?`).get(...active, args.projectGroup)?.count ?? 0 : undefined;
     return { global, project, ...projectGroup !== undefined ? { projectGroup } : {} };
   }
+  countRunningWorkflowStepsByAuthProfile() {
+    const rows = this.db.query("SELECT account_profile, COUNT(*) AS count FROM workflow_step_runs WHERE status = 'running' AND account_profile IS NOT NULL GROUP BY account_profile").all();
+    const counts = {};
+    for (const row of rows) {
+      if (row.account_profile)
+        counts[row.account_profile] = row.count;
+    }
+    return counts;
+  }
   requeueWorkflowWorkItem(id, patch = {}) {
     const current = this.getWorkflowWorkItem(id);
     if (!current)
@@ -3088,6 +3116,9 @@ class Store {
       }
       input.workflow.steps.forEach((step, sequence) => {
         const account = step.account ?? step.target.account;
+        const agentTarget = step.target.type === "agent" ? step.target : undefined;
+        const resolvedProfile = account?.profile ?? agentTarget?.authProfile ?? null;
+        const resolvedTool = account?.tool ?? (agentTarget?.authProfile ? agentTarget.provider : null);
         this.db.query(`INSERT INTO workflow_step_runs (id, workflow_run_id, step_id, sequence, status, started_at, finished_at,
               exit_code, pid, duration_ms, stdout, stderr, error, account_profile, account_tool, created_at, updated_at)
              VALUES ($id, $workflowRunId, $stepId, $sequence, 'pending', NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
@@ -3096,8 +3127,8 @@ class Store {
           $workflowRunId: runId,
           $stepId: step.id,
           $sequence: sequence,
-          $accountProfile: account?.profile ?? null,
-          $accountTool: account?.tool ?? null,
+          $accountProfile: resolvedProfile,
+          $accountTool: resolvedTool,
           $created: now,
           $updated: now
         });
@@ -4237,7 +4268,7 @@ class Store {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.11",
+  version: "0.4.13",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -4428,6 +4459,50 @@ function sourceOfTruthForMode(mode) {
     return "self_hosted_control_plane";
   return "cloud_control_plane";
 }
+var ROUTE_ADMISSION_GATES = [
+  "max_dispatch",
+  "max_active",
+  "max_active_per_project",
+  "max_active_per_project_group",
+  "max_active_scope",
+  "max_per_profile"
+];
+function remoteSchedulerBackendForMode(mode, config) {
+  if (mode === "local")
+    return "none";
+  if (mode === "cloud")
+    return config.cloudApiUrl ? "hosted_control_plane_contract" : "unconfigured";
+  if (config.databaseUrlPresent)
+    return "postgres_contract";
+  if (config.apiUrl)
+    return "api_control_plane_contract";
+  return "unconfigured";
+}
+function schedulerStateForMode(args) {
+  const nonLocal = args.deploymentMode !== "local";
+  return {
+    authority: args.sourceOfTruth,
+    localStore: {
+      backend: "sqlite",
+      role: args.localRole,
+      runArtifacts: "local_files",
+      routeAdmissionState: "workflow_work_items"
+    },
+    remoteStore: {
+      backend: remoteSchedulerBackendForMode(args.deploymentMode, args.config),
+      configured: nonLocal && args.controlPlaneConfigured,
+      applySupported: false,
+      objectArtifacts: nonLocal ? "object_store_contract" : "none",
+      mutatesAws: false
+    },
+    routeAdmission: {
+      stateStore: nonLocal ? "control_plane_contract" : "local_sqlite",
+      activeStatuses: ["admitted", "running"],
+      gates: ROUTE_ADMISSION_GATES,
+      dryRunEvaluatesLiveCounts: false
+    }
+  };
+}
 function displayControlPlaneUrl(value) {
   if (!value)
     return;
@@ -4453,6 +4528,9 @@ function buildDeploymentStatus(opts = {}) {
   if (deploymentMode === "self_hosted" && !controlPlaneConfigured) {
     warnings.push("self_hosted mode needs LOOPS_API_URL or LOOPS_DATABASE_URL before it can become authoritative");
   }
+  if (deploymentMode === "self_hosted" && config.databaseUrlPresent && !config.apiUrl) {
+    warnings.push("LOOPS_DATABASE_URL selects the self_hosted storage contract; loops-runner still needs LOOPS_API_URL to claim remote work");
+  }
   if (deploymentMode === "cloud" && config.apiUrl && !config.cloudApiUrl) {
     warnings.push("LOOPS_API_URL selects self_hosted; cloud mode uses LOOPS_CLOUD_API_URL");
   }
@@ -4486,6 +4564,13 @@ function buildDeploymentStatus(opts = {}) {
       required: deploymentMode !== "local",
       role: deploymentMode === "local" ? "daemon" : "control_plane_worker"
     },
+    schedulerState: schedulerStateForMode({
+      deploymentMode,
+      sourceOfTruth: sourceOfTruthForMode(deploymentMode),
+      localRole: deploymentMode === "local" ? "authoritative" : "cache_and_spool",
+      controlPlaneConfigured,
+      config
+    }),
     warnings
   };
 }
@@ -4498,6 +4583,7 @@ function deploymentStatusLine(status) {
     `source=${status.deploymentModeSource}`,
     `truth=${status.sourceOfTruth}`,
     `local=${status.localStore.role}`,
+    `scheduler=${status.schedulerState.routeAdmission.stateStore}`,
     `control_plane=${configured}`
   ].join(" ");
 }
@@ -8116,6 +8202,21 @@ function runDoctor(store) {
   checks.push(status.running ? { id: "daemon", status: "ok", message: `daemon is running pid=${status.pid}` } : { id: "daemon", status: status.stale ? "warn" : "ok", message: status.stale ? "daemon pid file is stale" : "daemon is not running" });
   const failedRuns = store.countRuns("failed");
   checks.push(failedRuns === 0 ? { id: "loop-runs", status: "ok", message: "no failed loop runs recorded" } : { id: "loop-runs", status: "warn", message: `${failedRuns} failed loop run(s) recorded` });
+  const deployment = buildDeploymentStatus();
+  const schedulerState = deployment.schedulerState;
+  checks.push({
+    id: "scheduler-state",
+    status: deployment.deploymentMode === "local" || deployment.controlPlane.configured ? "ok" : "warn",
+    message: `scheduler state authority=${schedulerState.authority} local=${schedulerState.localStore.role} remote=${schedulerState.remoteStore.backend}`,
+    detail: [
+      `route_state=${schedulerState.routeAdmission.stateStore}`,
+      `active_statuses=${schedulerState.routeAdmission.activeStatuses.join(",")}`,
+      `gates=${schedulerState.routeAdmission.gates.join(",")}`,
+      `artifacts=${schedulerState.localStore.runArtifacts}`,
+      `remote_artifacts=${schedulerState.remoteStore.objectArtifacts}`,
+      `remote_apply=${String(schedulerState.remoteStore.applySupported)}`
+    ].join(" ")
+  });
   for (const loop of store.listLoops({ status: "active" })) {
     try {
       if (loop.target.type === "workflow") {
@@ -9445,6 +9546,50 @@ var PR_HANDOFF_SCRIPT = [
   "console.log(`PR handoff complete: ${finalPrUrl}`);"
 ].join(`
 `);
+var PR_HANDOFF_NO_ARTIFACT_SCRIPT = [
+  "const { spawnSync } = await import('node:child_process');",
+  "const artifactPath = process.env.OPENLOOPS_PR_HANDOFF_ARTIFACT || '';",
+  "const taskId = process.env.OPENLOOPS_PR_HANDOFF_TASK_ID || '';",
+  "const todosProject = process.env.OPENLOOPS_PR_HANDOFF_TODOS_PROJECT || '';",
+  "const worktree = process.env.OPENLOOPS_PR_HANDOFF_WORKTREE || process.cwd();",
+  "const expectedBranch = process.env.OPENLOOPS_PR_HANDOFF_EXPECTED_BRANCH || '';",
+  "const todosBin = process.env.OPENLOOPS_PR_HANDOFF_TODOS_BIN || 'todos';",
+  "const gitBin = process.env.OPENLOOPS_PR_HANDOFF_GIT_BIN || 'git';",
+  "const ghBin = process.env.OPENLOOPS_PR_HANDOFF_GH_BIN || 'gh';",
+  "process.stdout.write(`no PR handoff artifact at ${artifactPath}\\n`);",
+  "const run = (command, args, options = {}) => {",
+  "  try { return spawnSync(command, args, { encoding: 'utf8', ...options }); }",
+  "  catch (error) { return { status: 1, stdout: '', stderr: String((error && error.message) || error) }; }",
+  "};",
+  "const todosArgs = (...args) => todosProject ? ['--project', todosProject, ...args] : args;",
+  "const comment = (text) => {",
+  "  const result = run(todosBin, todosArgs('comment', taskId, text));",
+  "  if (result.status !== 0) console.error(`failed to comment original task: ${result.stderr || result.stdout || result.status}`);",
+  "};",
+  "const main = () => {",
+  "  let branch = expectedBranch;",
+  "  if (!branch) {",
+  "    const shown = run(gitBin, ['-C', worktree, 'branch', '--show-current']);",
+  "    branch = String((shown.status === 0 ? shown.stdout : '') || '').trim();",
+  "  }",
+  "  if (!branch) { console.log('pr-handoff: no artifact and no resolvable branch; nothing to hand off'); return; }",
+  "  const listed = run(ghBin, ['pr', 'list', '--head', branch, '--state', 'open', '--json', 'url,number,headRefName,headRefOid'], { cwd: worktree });",
+  "  if (listed.status !== 0) { console.log(`pr-handoff: no artifact; PR lookup failed for branch ${branch}: ${String(listed.stderr || listed.stdout || listed.status).slice(0, 300)}`); return; }",
+  "  let prs = [];",
+  "  try { prs = JSON.parse(String(listed.stdout || '[]')); } catch { prs = []; }",
+  "  const pr = Array.isArray(prs) ? prs.find((entry) => entry && entry.headRefName === branch && typeof entry.url === 'string' && entry.url) : undefined;",
+  "  if (!pr) { console.log(`pr-handoff: no artifact and no open PR for branch ${branch}; worker completed without opening a PR`); return; }",
+  "  let commit = String(pr.headRefOid || '').trim();",
+  "  if (!commit) {",
+  "    const head = run(gitBin, ['-C', worktree, 'rev-parse', 'HEAD']);",
+  "    commit = String((head.status === 0 ? head.stdout : '') || '').trim();",
+  "  }",
+  "  comment(`openloops:pr-handoff=done task=${taskId} pr=${pr.url} commit=${commit || 'unknown'} branch=${branch}`);",
+  "  console.log(`PR handoff complete (worker-opened PR): ${pr.url}`);",
+  "};",
+  "try { main(); } catch (error) { console.error(`pr-handoff no-artifact detection error (ignored): ${String((error && error.message) || error)}`); }"
+].join(`
+`);
 function prHandoffCommand(opts) {
   return [
     "set -euo pipefail",
@@ -9455,15 +9600,90 @@ function prHandoffCommand(opts) {
     `export OPENLOOPS_PR_HANDOFF_WORKTREE_ROOT=${shellQuote3(opts.worktreeRoot)}`,
     `export OPENLOOPS_PR_HANDOFF_EXPECTED_BRANCH=${shellQuote3(opts.expectedBranch)}`,
     'if [ ! -s "$OPENLOOPS_PR_HANDOFF_ARTIFACT" ]; then',
-    `  printf 'no PR handoff artifact at %s\\n' "$OPENLOOPS_PR_HANDOFF_ARTIFACT"`,
-    "  exit 0",
-    "fi",
+    "bun - <<'OPENLOOPS_PR_HANDOFF_NOARTIFACT'",
+    PR_HANDOFF_NO_ARTIFACT_SCRIPT,
+    "OPENLOOPS_PR_HANDOFF_NOARTIFACT",
+    "else",
     "bun - <<'BUN'",
     PR_HANDOFF_SCRIPT,
-    "BUN"
+    "BUN",
+    "fi"
   ].join(`
 `);
 }
+
+// src/lib/route/profile-pool.ts
+function stableIndex(seed, size) {
+  let hash = 2166136261;
+  for (let i = 0;i < seed.length; i += 1) {
+    hash ^= seed.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return Math.abs(hash >>> 0) % size;
+}
+function poolRoleOffset(role) {
+  if (role === "worker")
+    return 0;
+  if (role === "verifier")
+    return 1;
+  if (role === "planner")
+    return 2;
+  return 3;
+}
+function selectLeastLoadedProfile(pool, loadCounts, anchor, exclude) {
+  const size = pool.length;
+  let best;
+  let bestExcluded = true;
+  let bestLoad = Number.POSITIVE_INFINITY;
+  for (let k = 0;k < size; k += 1) {
+    const profile = pool[(anchor + k) % size];
+    const excluded = exclude.has(profile);
+    const load = loadCounts[profile] ?? 0;
+    if (best === undefined) {
+      best = profile;
+      bestExcluded = excluded;
+      bestLoad = load;
+      continue;
+    }
+    const better = excluded === bestExcluded ? load < bestLoad : !excluded && bestExcluded;
+    if (better) {
+      best = profile;
+      bestExcluded = excluded;
+      bestLoad = load;
+    }
+  }
+  return best;
+}
+var ROLE_PRIORITY = ["worker", "verifier", "planner", "triage"];
+function assignPoolAuthProfiles(input) {
+  const pool = input.pool.filter((entry) => entry.trim().length > 0);
+  if (pool.length === 0)
+    return { profiles: {}, deferred: false, minLoad: 0 };
+  const minLoad = pool.reduce((min, profile) => Math.min(min, input.loadCounts[profile] ?? 0), Number.POSITIVE_INFINITY);
+  const guard = input.maxPerProfile !== undefined && input.maxPerProfile > 0;
+  if (guard && minLoad >= input.maxPerProfile) {
+    return {
+      profiles: {},
+      deferred: true,
+      minLoad,
+      reason: `per-profile active limit reached (all ${pool.length} pool members >= ${input.maxPerProfile} running; min ${minLoad})`
+    };
+  }
+  const workerIndex = stableIndex(input.seed, pool.length);
+  const rolesToAssign = ROLE_PRIORITY.filter((role) => input.roles.includes(role));
+  for (const role of input.roles)
+    if (!rolesToAssign.includes(role))
+      rolesToAssign.push(role);
+  const profiles = {};
+  const taken = new Set;
+  for (const role of rolesToAssign) {
+    const anchor = (workerIndex + poolRoleOffset(role)) % pool.length;
+    const profile = selectLeastLoadedProfile(pool, input.loadCounts, anchor, taken);
+    profiles[role] = profile;
+    taken.add(profile);
+  }
+  return { profiles, deferred: false, minLoad: Number.isFinite(minLoad) ? minLoad : 0 };
+}
 // src/lib/templates-custom.ts
 import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync7, readdirSync, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { join as join6, resolve as resolve3 } from "path";
@@ -9859,25 +10079,13 @@ function parseDeterministicTimeoutMs(raw, fallbackMs, label = "timeoutMs") {
     throw new Error(`${label} must be a positive integer number of milliseconds`);
   return value;
 }
-function stableIndex(seed, size) {
-  let hash = 2166136261;
-  for (let i = 0;i < seed.length; i += 1) {
-    hash ^= seed.charCodeAt(i);
-    hash = Math.imul(hash, 16777619);
-  }
-  return Math.abs(hash >>> 0) % size;
-}
 function rolePoolValue(pool, seed, role) {
   if (!pool?.length)
     return;
   const workerIndex = stableIndex(seed, pool.length);
-  if (role === "worker" || pool.length === 1)
+  if (pool.length === 1)
     return pool[workerIndex];
-  if (role === "verifier")
-    return pool[(workerIndex + 1) % pool.length];
-  if (role === "planner")
-    return pool[(workerIndex + 2) % pool.length];
-  return pool[(workerIndex + 3) % pool.length];
+  return pool[(workerIndex + poolRoleOffset(role)) % pool.length];
 }
 function authProfileForRole(input, role, seed) {
   if (role === "triage" && input.triageAuthProfile)
@@ -10047,7 +10255,8 @@ function agentTarget(input, prompt, role, seed, plan) {
     allowlist: input.manualBreakGlass ? { enforcement: "metadata_only", commands: ["manual-break-glass"] } : undefined,
     routing: {
       projectPath: input.routeProjectPath ?? input.projectPath,
-      ...input.projectGroup ? { projectGroup: input.projectGroup } : {}
+      ...input.projectGroup ? { projectGroup: input.projectGroup } : {},
+      role
     },
     account: accountForRole(input, role, seed),
     timeoutMs: agentTimeoutMs(input),
@@ -11751,7 +11960,8 @@ function routeProjectGroup(optsGroup, data, metadata) {
 function routeThrottleDecision(store, args) {
   const projectPath = normalizeRoutePath(args.projectPath) ?? resolve6(args.projectPath);
   const projectGroup = args.projectGroup?.trim() || undefined;
-  const counts = store.countActiveWorkflowWorkItems({ projectKey: projectPath, projectGroup });
+  const routeScope = args.routeScope?.trim() || undefined;
+  const counts = store.countActiveWorkflowWorkItems({ projectKey: projectPath, projectGroup, routeScope });
   const base = {
     projectPath,
     ...projectGroup ? { projectGroup } : {},
@@ -11913,6 +12123,33 @@ async function readEventEnvelopeInput(opts = {}) {
     throw new ValidationError("event.source is required");
   return event;
 }
+function resolveRouteScope(opts, routeKey) {
+  return opts.maxActiveScope?.trim() || process.env.LOOPS_LOOP_NAME?.trim() || routeKey || undefined;
+}
+function buildPoolRoutingPlan(opts, provider, authProfilePool, workflowBody, seed) {
+  if (provider !== "codewith")
+    return;
+  const pool = (authProfilePool ?? []).filter((entry) => entry.trim().length > 0);
+  if (pool.length < 2)
+    return;
+  const pinned = Boolean(opts.triageAuthProfile || opts.plannerAuthProfile || opts.workerAuthProfile || opts.verifierAuthProfile);
+  if (pinned)
+    return;
+  const rolesByStepId = {};
+  for (const step of workflowBody.steps) {
+    const target = step.target;
+    if (target.type !== "agent" || target.provider !== "codewith")
+      continue;
+    const role = target.routing?.role;
+    if (role)
+      rolesByStepId[step.id] = role;
+  }
+  if (Object.keys(rolesByStepId).length === 0)
+    return;
+  const explicitMax = nonNegativeInteger(opts.maxPerProfile, "--max-per-profile");
+  const maxPerProfile = explicitMax ?? 2;
+  return { pool, seed, maxPerProfile: maxPerProfile > 0 ? maxPerProfile : undefined, rolesByStepId };
+}
 function dedupedRoutePrint(plan, outcome) {
   return {
     kind: "deduped",
@@ -11942,6 +12179,7 @@ function routeEvent(plan) {
     subjectRef: plan.subjectRef,
     projectKey: plan.routeProjectPath,
     projectGroup: plan.projectGroup,
+    routeScope: plan.routeScope,
     priority: 0,
     status: "queued"
   };
@@ -11981,6 +12219,7 @@ function routeEvent(plan) {
     const workflowPreflightSpec = workflowSpecForPreflight(workflowBody, "event-preflight");
     generatedRouteSandboxPreflight(workflowPreflightSpec);
     const preflight = opts.preflight ? preflightStoredWorkflow(workflowPreflightSpec, plan.workflowContext, {}) : undefined;
+    let poolAssignment;
     const outcome = store.writeTransaction(() => {
       const invocation = store.createWorkflowInvocation(plan.invocationInput);
       const existingItem = store.findWorkflowWorkItem(plan.routeKey, idempotencyKey);
@@ -11991,12 +12230,39 @@ function routeEvent(plan) {
           return { kind: "deduped", existingItem, existingLoop, existingWorkflow, invocation };
         }
       }
-      const throttle = hasThrottleLimits(plan.throttleLimits) ? routeThrottleDecision(store, { projectPath: plan.routeProjectPath, projectGroup: plan.projectGroup, limits: plan.throttleLimits }) : undefined;
+      const throttle = hasThrottleLimits(plan.throttleLimits) ? routeThrottleDecision(store, {
+        projectPath: plan.routeProjectPath,
+        projectGroup: plan.projectGroup,
+        routeScope: plan.routeScope,
+        limits: plan.throttleLimits
+      }) : undefined;
+      if (plan.poolRouting) {
+        const loadCounts = store.countRunningWorkflowStepsByAuthProfile();
+        poolAssignment = assignPoolAuthProfiles({
+          pool: plan.poolRouting.pool,
+          seed: plan.poolRouting.seed,
+          loadCounts,
+          maxPerProfile: plan.poolRouting.maxPerProfile,
+          roles: Object.values(plan.poolRouting.rolesByStepId)
+        });
+      }
+      const activeThrottled = Boolean(throttle && !throttle.allowed);
+      const poolDeferred = Boolean(poolAssignment?.deferred);
+      const deferred = activeThrottled || poolDeferred;
+      const deferReason = activeThrottled ? throttle.reason : poolAssignment?.reason;
+      const effectiveThrottle = activeThrottled ? throttle : poolDeferred ? {
+        allowed: false,
+        reason: deferReason,
+        projectPath: plan.routeProjectPath,
+        ...plan.projectGroup ? { projectGroup: plan.projectGroup } : {},
+        limits: plan.throttleLimits,
+        counts: throttle?.counts ?? { global: 0, project: 0 }
+      } : throttle;
       const workItem = store.upsertWorkflowWorkItem({
         ...workItemInput,
         invocationId: invocation.id,
-        status: throttle && !throttle.allowed ? "deferred" : "queued",
-        lastReason: throttle && !throttle.allowed ? throttle.reason : undefined
+        status: deferred ? "deferred" : "queued",
+        lastReason: deferred ? deferReason : undefined
       });
       const requeue = workItem.attempts > 0 && workItem.status === "queued" ? {
         previousWorkItemId: workItem.id,
@@ -12004,8 +12270,16 @@ function routeEvent(plan) {
         reason: workItem.lastReason
       } : undefined;
       const refreshedInvocation = store.refreshWorkflowInvocationForWorkItem(workItem.id, plan.invocationInput);
-      if (throttle && !throttle.allowed)
-        return { kind: "throttled", invocation: refreshedInvocation, workItem, throttle };
+      if (deferred)
+        return { kind: "throttled", invocation: refreshedInvocation, workItem, throttle: effectiveThrottle };
+      if (poolAssignment && !poolAssignment.deferred) {
+        for (const step of workflowBody.steps) {
+          const role = plan.poolRouting?.rolesByStepId[step.id];
+          const chosen = role ? poolAssignment.profiles[role] : undefined;
+          if (chosen && step.target.type === "agent")
+            step.target.authProfile = chosen;
+        }
+      }
       const workflow = routeWorkflowForStorage(store, workflowBody);
       const loop = store.createLoop({
         ...loopInput,
@@ -12063,6 +12337,7 @@ function routeEvent(plan) {
         loop: publicLoop(outcome.loop),
         requeue: outcome.requeue,
         throttle: outcome.throttle,
+        ...poolAssignment && !poolAssignment.deferred && Object.keys(poolAssignment.profiles).length ? { accountProfiles: poolAssignment.profiles, routeScope: plan.routeScope } : {},
         sandboxPreflight,
         preflight
       },
@@ -12246,6 +12521,8 @@ function routeTodosTaskEvent(event, opts) {
     invocationInput,
     routeProjectPath,
     projectGroup,
+    routeScope: resolveRouteScope(opts, "todos-task"),
+    poolRouting: buildPoolRoutingPlan(opts, provider, providerRouting.authProfilePool, workflowBody, taskId),
     subjectRef: taskId,
     loopName,
     loopDescription: `Run ${workflowBody.name} once for task ${taskId}; idempotency=${idempotencyKey}; event=${event.id}`,
@@ -12359,6 +12636,8 @@ function routeGenericEvent(event, opts) {
     invocationInput,
     routeProjectPath,
     projectGroup,
+    routeScope: resolveRouteScope(opts, "generic-event"),
+    poolRouting: buildPoolRoutingPlan(opts, provider, providerRouting.authProfilePool, workflowBody, `${event.source}:${event.type}:${event.id}`),
     subjectRef: stringField(event.subject) ?? event.id,
     loopName,
     loopDescription: `Run ${workflowBody.name} once for event ${event.id}; idempotency=${idempotencyKey}`,
@@ -12562,6 +12841,8 @@ function compactDrainResult(result) {
     workflowId: stringField(workflow?.id),
     workflowName: stringField(workflow?.name),
     providerRouting,
+    accountProfiles: objectField2(value.accountProfiles),
+    routeScope: stringField(value.routeScope),
     requeue,
     queuedAtSource: value.queuedAtSource,
     fatal: value.fatal === true ? true : undefined
@@ -13227,6 +13508,18 @@ var AGENT_ROUTING_OPTION_SPECS = [
     kind: "value",
     description: "skip creating a workflow when this many active routed workflows already exist for the project group"
   },
+  {
+    flags: "--max-active-scope <key>",
+    key: "maxActiveScope",
+    kind: "value",
+    description: "scope --max-active counting to this route/drain identity (defaults to the LOOPS_LOOP_NAME of the running loop, else the route key) so each drain's --max-active is its own ceiling instead of a store-wide one"
+  },
+  {
+    flags: "--max-per-profile <n>",
+    key: "maxPerProfile",
+    kind: "value",
+    description: "for codewith auth-profile pools, spread dispatch to the least-loaded account and defer when every pool member already has this many running steps (default 2 for pools of 2+; 0 disables the guard)"
+  },
   { flags: "--worktree-mode <mode>", key: "worktreeMode", kind: "value", description: "worktree isolation mode: auto, required, off, or main", defaultValue: "auto" },
   { flags: "--worktree-root <path>", key: "worktreeRoot", kind: "value", description: "base directory for OpenLoops-managed git worktrees" },
   { flags: "--worktree-branch-prefix <prefix>", key: "worktreeBranchPrefix", kind: "value", description: "branch prefix for generated worktrees", defaultValue: "openloops" },