@hasna/loops 0.4.6 → 0.4.7

package/CHANGELOG.md

@@ -5,6 +5,19 @@ documented in this file. Version entries are generated from the
 conventional-commit git history; one commit maps to one released patch version
 unless noted.
 
+## 0.4.7 (2026-07-04)
+
+Routing hardening for PR merge/drain automation.
+
+### Fixed
+
+- **Todos drain:** admit registered repo-project task sources while pinning
+  routed work to the scanned source project, preventing task-controlled nested
+  route paths from moving worker execution into another repository.
+- **PR lifecycle routing:** propagate PR author and reviewer evidence into
+  reviewer and merger lifecycle prompts so merge routing can select a valid
+  non-author reviewer and keep reviewer/merger steps separate.
+
 ## 0.4.6 (2026-07-03)
 
 Reliability hardening from a full audit of the runtime, control surfaces, and

package/dist/api/index.js

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.6",
+  version: "0.4.7",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/cli/index.js

@@ -726,7 +726,7 @@ function buildAgentInvocation(target) {
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
-      args.push("agent", "start");
+      args.push("agent", "start", "--json");
       if (target.cwd)
         args.push("--cwd", target.cwd);
       args.push(target.prompt);
@@ -4219,7 +4219,7 @@ class Store {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.6",
+  version: "0.4.7",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -5264,18 +5264,60 @@ function codewithAgentControlArgs(target, command, agentId) {
     "agent",
     command,
     ...command === "logs" ? ["--limit", "20"] : [],
+    "--json",
     agentId
   ];
 }
+function extractFirstJsonObject(text) {
+  let depth = 0;
+  let start = -1;
+  let inString = false;
+  let escaped = false;
+  for (let i = 0;i < text.length; i += 1) {
+    const ch = text[i];
+    if (inString) {
+      if (escaped)
+        escaped = false;
+      else if (ch === "\\")
+        escaped = true;
+      else if (ch === '"')
+        inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    } else if (ch === "{") {
+      if (depth === 0)
+        start = i;
+      depth += 1;
+    } else if (ch === "}") {
+      if (depth > 0) {
+        depth -= 1;
+        if (depth === 0 && start !== -1)
+          return text.slice(start, i + 1);
+      }
+    }
+  }
+  return;
+}
 function parseJsonOutput(stdout, label) {
-  try {
-    const value = JSON.parse(stdout || "{}");
-    if (!value || typeof value !== "object" || Array.isArray(value))
-      throw new Error("not an object");
-    return value;
-  } catch (error) {
-    throw new Error(`${label} did not return JSON${error instanceof Error ? `: ${error.message}` : ""}`);
+  const raw = stdout || "{}";
+  const candidates = [raw.trim()];
+  const scanned = extractFirstJsonObject(raw);
+  if (scanned && scanned !== raw.trim())
+    candidates.push(scanned);
+  let lastError;
+  for (const candidate of candidates) {
+    try {
+      const value = JSON.parse(candidate);
+      if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("not an object");
+      return value;
+    } catch (error) {
+      lastError = error;
+    }
   }
+  throw new Error(`${label} did not return JSON${lastError instanceof Error ? `: ${lastError.message}` : ""}`);
 }
 function recordField(value, key) {
   if (!value || typeof value !== "object" || Array.isArray(value))
@@ -9973,6 +10015,28 @@ function importCustomLoopTemplate(file, reservedKeys, opts = {}) {
 function compactJson(value) {
   return JSON.stringify(value);
 }
+function prReviewRoutingContext(input) {
+  return input.prReviewRouting?.required ? input.prReviewRouting : undefined;
+}
+function prReviewFollowUpFragment(input) {
+  const routing = prReviewRoutingContext(input);
+  const author = routing?.author?.trim();
+  const reviewers = routing?.reviewers?.map((reviewer) => reviewer.trim()).filter(Boolean) ?? [];
+  const evidenceLines = [
+    author ? `- Source PR author evidence: GitHub author is ${author}` : undefined,
+    reviewers.length ? `- Source PR reviewer evidence: GitHub reviewer pool: ${reviewers.join(", ")}` : undefined,
+    routing?.selectedReviewer ? `- Selected non-author reviewer: ${routing.selectedReviewer}` : undefined
+  ].filter(Boolean);
+  return [
+    "PR-derived follow-up todos: If any lifecycle step creates a follow-up todo that references a GitHub PR, PR approval, PR review, or PR merge work, the todo description must include parser-compatible routing evidence so downstream drains can select a non-author reviewer.",
+    ...evidenceLines,
+    "Copy these exact evidence lines from the source task when present, or derive them from the referenced PR before creating the follow-up todo:",
+    "GitHub author is <login>",
+    "GitHub reviewer pool: <login>, <login>",
+    "When the source PR author or reviewer pool cannot be determined, do not create an auto-routable PR-derived follow-up todo; comment the source task with the blocker instead."
+  ].join(`
+`);
+}
 function taskLabel(input) {
   const head = input.taskTitle?.trim() || input.taskId;
   return head.length > 160 ? `${head.slice(0, 157)}...` : head;
@@ -10428,6 +10492,7 @@ function renderTaskLifecycleWorkflow(input) {
     routeProjectPath: input.routeProjectPath,
     projectGroup: input.projectGroup,
     todosProjectPath,
+    prReviewRouting: prReviewRoutingContext(input),
     worktree: worktreeContextFragment(plan)
   };
   const handoffArtifactPath = prHandoffArtifactPath(plan, input.taskId);
@@ -10445,6 +10510,7 @@ function renderTaskLifecycleWorkflow(input) {
     ]),
     NO_TMUX_DISPATCH_FRAGMENT,
     "Preserve unrelated user changes and keep scope tied to the task acceptance criteria.",
+    prReviewFollowUpFragment(input),
     "",
     `Task context JSON: ${compactJson(taskContext)}`,
     prHandoffGuidance
@@ -11630,12 +11696,30 @@ function routeEvidenceText(records) {
   const values = [];
   for (const record of records) {
     for (const field of fields)
-      values.push(...recordFieldValues(record, field));
+      values.push(...routeTextFieldValues(record, field));
     values.push(...tagsFromValue2(record.tags ?? record.task_tags ?? record.taskTags));
   }
   return values.join(`
 `);
 }
+function textValuesFromUnknown(value) {
+  if (Array.isArray(value))
+    return value.flatMap((entry) => textValuesFromUnknown(entry));
+  if (typeof value === "string" && value.trim())
+    return [value.trim()];
+  if (typeof value === "number" || typeof value === "boolean")
+    return [String(value)];
+  return [];
+}
+function routeTextFieldValues(record, field) {
+  const expected = canonicalRouteField(field);
+  const values = [];
+  for (const [key, value] of Object.entries(record)) {
+    if (canonicalRouteField(key) === expected)
+      values.push(...textValuesFromUnknown(value));
+  }
+  return values;
+}
 function authorFromPrText(text) {
   const patterns = [
     /\bauthor\s+(?:is\s+also|is|=|:)\s+@?([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))/i,
@@ -11650,6 +11734,18 @@ function authorFromPrText(text) {
   }
   return;
 }
+function reviewersFromPrText(text) {
+  const reviewers = [];
+  const patterns = [
+    /\bgithub\s+reviewer\s+pool\s*(?:is|=|:)\s*([^\r\n]+)/gi,
+    /\bgithub\s+reviewers?\s*(?:are|is|=|:)\s*([^\r\n]+)/gi
+  ];
+  for (const pattern of patterns) {
+    for (const match of text.matchAll(pattern))
+      reviewers.push(...splitList(match[1]) ?? []);
+  }
+  return githubLogins(reviewers);
+}
 function prReviewRoutingDecision(data, metadata, opts) {
   const records = [...taskEventRecords(data, metadata), ...automationRecords(data, metadata)];
   const text = routeEvidenceText(records);
@@ -11675,7 +11771,8 @@ function prReviewRoutingDecision(data, metadata, opts) {
     opts.githubReviewer,
     ...splitList(opts.githubReviewerPool) ?? [],
     ...PR_REVIEWER_FIELDS.flatMap((field) => routeFieldValues(records, field)),
-    ...PR_REVIEWER_POOL_FIELDS.flatMap((field) => routeFieldValues(records, field))
+    ...PR_REVIEWER_POOL_FIELDS.flatMap((field) => routeFieldValues(records, field)),
+    ...reviewersFromPrText(text)
   ]);
   const selectedReviewer = author ? reviewers.find((reviewer) => reviewer.toLowerCase() !== author.toLowerCase()) : undefined;
   if (!author) {
@@ -12063,7 +12160,16 @@ function routeTodosTaskEvent(event, opts) {
   }
   const taskTitle = taskEventField(data, ["title", "task_title", "taskTitle"]);
   const taskDescription = taskEventField(data, ["description", "body"]);
-  const dataProjectPath = taskEventField(data, ["working_dir", "workingDir", "project_path", "projectPath", "cwd"]);
+  const sourceTodosProjectPath = opts.sourceTodosProjectPath?.trim();
+  const dataProjectPath = taskEventField(data, [
+    "route_project_path",
+    "routeProjectPath",
+    "project_path",
+    "projectPath",
+    "working_dir",
+    "workingDir",
+    "cwd"
+  ]);
   const metadataProjectPath = taskEventField(metadata, [
     "working_dir",
     "workingDir",
@@ -12076,7 +12182,8 @@ function routeTodosTaskEvent(event, opts) {
   const routeProjectPath = normalizeRoutePath(projectPath) ?? resolve7(projectPath);
   const projectGroup = routeProjectGroup(opts.projectGroup, data, metadata);
   const throttleLimits = routeThrottleLimitsFromOpts(opts);
-  const idempotencyKey = `todos-task:${taskId}`;
+  const sourceProjectIdempotencyPrefix = sourceTodosProjectPath ? normalizeRoutePath(sourceTodosProjectPath) ?? resolve7(sourceTodosProjectPath) : undefined;
+  const idempotencyKey = sourceProjectIdempotencyPrefix ? `todos-task:${sourceProjectIdempotencyPrefix}:${taskId}` : `todos-task:${taskId}`;
   const idempotencySuffix = stableSuffix(idempotencyKey);
   const namePrefix = opts.namePrefix ?? "event:todos-task";
   const workflowName = `${namePrefix}:${taskId.slice(0, 8)}:${idempotencySuffix}:workflow`;
@@ -12150,9 +12257,10 @@ function routeTodosTaskEvent(event, opts) {
     worktreeRoot: opts.worktreeRoot,
     worktreeBranchPrefix: opts.worktreeBranchPrefix ?? "openloops",
     prHandoff: templateId === TASK_LIFECYCLE_TEMPLATE_ID ? Boolean(opts.prHandoff) : false,
+    prReviewRouting: prReviewRouting.required ? prReviewRouting : undefined,
     eventId: event.id,
     eventType: event.type,
-    todosProjectPath: opts.todosProject
+    todosProjectPath: sourceTodosProjectPath || opts.todosProject
   };
   const workflowContext = {
     name: workflowName,
@@ -12420,8 +12528,8 @@ function taskField(task, keys) {
   }
   return;
 }
-function taskListId(task) {
-  return taskField(task, ["task_list_id", "taskListId"]) ?? stringField2(task.task_list?.id);
+function taskRoutePathFromRegistry(sourceProjectPath) {
+  return normalizeRoutePath(sourceProjectPath) ?? resolve8(sourceProjectPath);
 }
 function taskProjectId(task) {
   return taskField(task, ["project_id", "projectId"]);
@@ -12435,12 +12543,28 @@ function taskProjectPath(task) {
   const metadata = objectField2(task.metadata) ?? {};
   return taskField(task, ["project_path", "projectPath"]) ?? taskEventField(metadata, ["project_path", "projectPath", "project_canonical_path"]) ?? taskDescriptionProjectPath(task) ?? taskField(task, ["working_dir", "workingDir", "cwd"]) ?? taskEventField(metadata, ["working_dir", "workingDir", "cwd"]);
 }
-function taskDrainEvent(task) {
+function taskListValues(task) {
+  const taskList = objectField2(task.task_list);
+  return [
+    taskField(task, ["task_list_id", "taskListId"]),
+    stringField2(task.task_list?.id),
+    stringField2(task.task_list?.slug),
+    stringField2(taskList?.name),
+    taskField(task, ["task_list", "taskList"])
+  ].filter((value) => Boolean(value));
+}
+function taskDrainEvent(task, sourceProjectPath) {
   const taskId = taskField(task, ["id", "task_id", "taskId"]);
   if (!taskId)
     throw new Error("todos ready returned a task without an id");
-  const metadata = objectField2(task.metadata) ?? {};
+  const metadata = { ...objectField2(task.metadata) ?? {} };
   const workingDir = taskProjectPath(task);
+  const routeWorkingDir = taskField(task, ["project_path", "projectPath"]) ?? workingDir;
+  const sourceProject = sourceProjectPath?.trim();
+  if (!sourceProject) {
+    delete metadata.source_project_path;
+    delete metadata.sourceProjectPath;
+  }
   const data = {
     ...task,
     id: taskId,
@@ -12450,10 +12574,23 @@ function taskDrainEvent(task) {
     tags: tagsFromValue2(task.tags),
     metadata
   };
+  if (!sourceProject) {
+    delete data.source_project_path;
+    delete data.sourceProjectPath;
+  }
   if (workingDir) {
-    data.working_dir = workingDir;
-    data.project_path = taskField(task, ["project_path", "projectPath"]) ?? workingDir;
-    data.cwd = taskField(task, ["cwd"]) ?? workingDir;
+    data.working_dir = routeWorkingDir;
+    data.project_path = routeWorkingDir;
+    data.cwd = taskField(task, ["cwd"]) ?? routeWorkingDir;
+  }
+  if (sourceProject) {
+    data.source_project_path = sourceProject;
+    if (!data.project_path)
+      data.project_path = sourceProject;
+    data.route_project_path = data.project_path;
+    data.routeProjectPath = data.project_path;
+    metadata.route_project_path = data.project_path;
+    metadata.routeProjectPath = data.project_path;
   }
   const time = new Date().toISOString();
   return {
@@ -12467,6 +12604,7 @@ function taskDrainEvent(task) {
     schemaVersion: "1.0",
     metadata: {
       ...metadata,
+      ...sourceProject ? { source_project_path: sourceProject } : {},
       ...workingDir ? { working_dir: workingDir, project_path: data.project_path, cwd: data.cwd } : {},
       drained_by: "@hasna/loops",
       drained_from: "todos ready"
@@ -12497,23 +12635,74 @@ function compactDrainResult(result) {
     fatal: value.fatal === true ? true : undefined
   };
 }
-function loadReadyTodosTasks(opts, scanLimit) {
-  const todosProject = opts.todosProject ?? defaultLoopsProject();
-  const args = ["--project", todosProject, "--json", "ready", "--limit", String(scanLimit)];
-  const result = runLocalCommandWithStdoutFile("todos", args, { timeoutMs: 60000, maxBuffer: 64 * 1024 * 1024 });
-  if (!result.ok)
-    throw new Error(result.stderr || result.error || "todos ready failed");
-  let parsed;
+function parseTodosReadyJson(stdout) {
   try {
-    parsed = JSON.parse(result.stdout || "[]");
+    return JSON.parse(stdout || "[]");
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`failed to parse todos ready --json output (${result.stdout.length} bytes): ${message}`);
+    throw new Error(`failed to parse todos ready --json output (${stdout.length} bytes): ${message}`);
   }
+}
+function parseTodoProjectsJson(stdout) {
+  try {
+    return JSON.parse(stdout || "[]");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`failed to parse todos projects --json output (${stdout.length} bytes): ${message}`);
+  }
+}
+function loadTodoProjectPathsFromRegistry(opts) {
+  const result = runLocalCommand("todos", ["projects", "--json"], { timeoutMs: 60000 });
+  if (!result.ok)
+    throw new Error(result.stderr || result.error || "todos projects failed");
+  const payload = parseTodoProjectsJson(result.stdout);
+  const projectsPayload = Array.isArray(payload) ? payload : objectField2(payload)?.projects;
+  if (!Array.isArray(projectsPayload))
+    throw new Error("todos projects --json returned a non-array value");
+  const includeFilters = listFromRepeatedOpts(opts.todosProjectInclude)?.map((entry) => normalizeRoutePath(entry) ?? resolve8(entry)) ?? [];
+  const includesPrefix = normalizeRoutePath(opts.projectPathPrefix) ?? (opts.projectPathPrefix ? resolve8(opts.projectPathPrefix) : undefined);
+  const fromProjects = projectsPayload.map((entry) => objectField2(entry)).filter((project) => Boolean(project)).map((project) => {
+    const path = stringField2(project.path) ?? stringField2(project.projectPath) ?? stringField2(project.project_path) ?? stringField2(project.dir) ?? stringField2(project.root) ?? stringField2(project.cwd);
+    if (!path)
+      return;
+    return { path };
+  }).filter((project) => Boolean(project));
+  const paths = fromProjects.map((project) => project.path).filter(Boolean).filter((path) => {
+    const normalizedPath = normalizeRoutePath(path) ?? resolve8(path);
+    if (includesPrefix && !(normalizedPath === includesPrefix || normalizedPath.startsWith(`${includesPrefix}/`)))
+      return false;
+    if (includeFilters.length === 0)
+      return true;
+    return includeFilters.some((prefix) => normalizedPath === prefix || normalizedPath.startsWith(`${prefix}/`));
+  });
+  return [...new Set(paths)];
+}
+function loadReadyTodosTasksForProject(projectPath, scanLimit) {
+  const args = ["--project", projectPath, "--json", "ready", "--limit", String(scanLimit)];
+  const result = runLocalCommandWithStdoutFile("todos", args, { timeoutMs: 60000, maxBuffer: 64 * 1024 * 1024 });
+  if (!result.ok)
+    throw new Error(result.stderr || result.error || "todos ready failed");
+  const parsed = parseTodosReadyJson(result.stdout);
   if (!Array.isArray(parsed))
     throw new Error("todos ready --json returned a non-array value");
   return parsed;
 }
+function loadReadyTodosTasks(opts, scanLimit) {
+  if (!opts.todosProjectsFromRegistry) {
+    const todosProject = opts.todosProject ?? defaultLoopsProject();
+    return loadReadyTodosTasksForProject(todosProject, scanLimit);
+  }
+  const projectPaths = loadTodoProjectPathsFromRegistry(opts);
+  const ready = projectPaths.flatMap((projectPath) => loadReadyTodosTasksForProject(projectPath, scanLimit).map((task) => {
+    const sourceProject = projectPath;
+    return {
+      ...task,
+      source_project_path: sourceProject,
+      project_path: taskRoutePathFromRegistry(sourceProject)
+    };
+  }));
+  return ready;
+}
 function resolveTaskListFilter(todosProject, filter) {
   const wanted = filter?.trim();
   if (!wanted)
@@ -12528,7 +12717,7 @@ function resolveTaskListFilter(todosProject, filter) {
 function taskMatchesDrainFilters(task, filters) {
   if (filters.projectId && taskProjectId(task) !== filters.projectId)
     return false;
-  if (filters.taskListId && taskListId(task) !== filters.taskListId)
+  if (filters.taskList && !taskListValues(task).includes(filters.taskList))
     return false;
   if (filters.projectPathPrefix) {
     const path = taskProjectPath(task);
@@ -12566,14 +12755,14 @@ function skippedDrainTask(task, event, reason, extra = {}) {
 function isSkippableDrainRouteError(message) {
   return message.startsWith("worktreeMode=required but projectPath is not an existing git repository:");
 }
-function markInvalidDrainTaskNonRouteable(todosProject, task, reason) {
+function markInvalidDrainTaskNonRouteable(sourceTodosProject, task, reason) {
   const taskId = taskField(task, ["id", "task_id", "taskId"]);
   if (!taskId)
     return { attempted: false, reason: "task id missing" };
   const comment = `OpenLoops route blocked for task ${taskId}: ${reason}. Added no-auto and removed auto:route so route drains do not repeatedly route this task until its project path is fixed.`;
-  const commentResult = runLocalCommand("todos", ["--project", todosProject, "comment", taskId, comment], { timeoutMs: 30000 });
-  const tagResult = runLocalCommand("todos", ["--project", todosProject, "tag", taskId, "no-auto"], { timeoutMs: 30000 });
-  const untagResult = runLocalCommand("todos", ["--project", todosProject, "untag", taskId, "auto:route"], { timeoutMs: 30000 });
+  const commentResult = runLocalCommand("todos", ["--project", sourceTodosProject, "comment", taskId, comment], { timeoutMs: 30000 });
+  const tagResult = runLocalCommand("todos", ["--project", sourceTodosProject, "tag", taskId, "no-auto"], { timeoutMs: 30000 });
+  const untagResult = runLocalCommand("todos", ["--project", sourceTodosProject, "untag", taskId, "auto:route"], { timeoutMs: 30000 });
   const ok = commentResult.ok && tagResult.ok && untagResult.ok;
   return {
     ok,
@@ -12589,7 +12778,7 @@ function drainTodosTaskRoutes(opts) {
   const maxDispatch = positiveInteger(opts.maxDispatch ?? "1", "--max-dispatch") ?? 1;
   const todosProject = opts.todosProject ?? defaultLoopsProject();
   const requiredTags = splitList(opts.tags ?? opts.tag) ?? [];
-  const taskListFilter = resolveTaskListFilter(todosProject, opts.taskList);
+  const taskListFilter = opts.todosProjectsFromRegistry ? opts.taskList?.trim() : resolveTaskListFilter(todosProject, opts.taskList);
   const candidateLimit = positiveInteger(opts.limit ?? "50", "--limit") ?? 50;
   const hasPostFilters = Boolean(opts.todosProjectId || taskListFilter || opts.projectPathPrefix || requiredTags.length);
   const defaultScanLimit = hasPostFilters ? Math.max(candidateLimit, 500) : candidateLimit;
@@ -12597,7 +12786,7 @@ function drainTodosTaskRoutes(opts) {
   const ready = loadReadyTodosTasks(opts, scanLimit);
   const filteredCandidates = ready.filter((task) => taskMatchesDrainFilters(task, {
     projectId: opts.todosProjectId,
-    taskListId: taskListFilter,
+    taskList: taskListFilter,
     projectPathPrefix: opts.projectPathPrefix,
     tags: requiredTags
   }));
@@ -12610,12 +12799,17 @@ function drainTodosTaskRoutes(opts) {
     let event;
     let result;
     try {
-      event = taskDrainEvent(task);
-      result = routeTodosTaskEvent(event, opts);
+      const sourceProject = opts.todosProjectsFromRegistry ? taskField(task, ["source_project_path", "sourceProjectPath"]) : undefined;
+      event = taskDrainEvent(task, sourceProject);
+      result = routeTodosTaskEvent(event, {
+        ...opts,
+        ...sourceProject ? { sourceTodosProjectPath: sourceProject } : {}
+      });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       if (isSkippableDrainRouteError(message)) {
-        const sourceTaskUpdate = opts.dryRun ? { attempted: false, reason: "dry-run" } : markInvalidDrainTaskNonRouteable(todosProject, task, message);
+        const sourceTaskProject = opts.todosProjectsFromRegistry ? taskField(task, ["source_project_path", "sourceProjectPath"]) ?? todosProject : todosProject;
+        const sourceTaskUpdate = opts.dryRun ? { attempted: false, reason: "dry-run" } : markInvalidDrainTaskNonRouteable(sourceTaskProject, task, message);
         result = skippedDrainTask(task, event, redact(message, 640) ?? "route task failed", { sourceTaskUpdate });
       } else {
         result = skippedDrainTask(task, event, redact(message, 640) ?? "route task failed", { fatal: true });
@@ -12960,6 +13154,19 @@ var EVENT_INPUT_OPTION_SPECS = [
   { flags: "--event-json <json>", key: "eventJson", kind: "value", description: "read event envelope JSON from this string instead of stdin/HASNA_EVENT_JSON" }
 ];
 var DRAIN_FILTER_OPTION_SPECS = [
+  {
+    flags: "--todos-projects-from-registry",
+    key: "todosProjectsFromRegistry",
+    kind: "boolean",
+    description: "scan registered todos projects from `todos projects --json` instead of one --todos-project"
+  },
+  {
+    flags: "--todos-project-include <path>",
+    key: "todosProjectInclude",
+    kind: "repeat",
+    description: "include additional registered project path prefixes when scanning via --todos-projects-from-registry",
+    serializeValue: (opts) => listFromRepeatedOpts(opts.todosProjectInclude)
+  },
   { flags: "--todos-project-id <id>", key: "todosProjectId", kind: "value", description: "filter todos ready output to one todos project id" },
   { flags: "--task-list <id-or-slug>", key: "taskList", kind: "value", description: "filter ready tasks to one task-list id, slug, or name" },
   { flags: "--project-path-prefix <path>", key: "projectPathPrefix", kind: "value", description: "filter ready tasks to a project/repo path prefix" },

package/dist/daemon/index.js

@@ -726,7 +726,7 @@ function buildAgentInvocation(target) {
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
-      args.push("agent", "start");
+      args.push("agent", "start", "--json");
       if (target.cwd)
         args.push("--cwd", target.cwd);
       args.push(target.prompt);
@@ -5425,18 +5425,60 @@ function codewithAgentControlArgs(target, command, agentId) {
     "agent",
     command,
     ...command === "logs" ? ["--limit", "20"] : [],
+    "--json",
     agentId
   ];
 }
+function extractFirstJsonObject(text) {
+  let depth = 0;
+  let start = -1;
+  let inString = false;
+  let escaped = false;
+  for (let i = 0;i < text.length; i += 1) {
+    const ch = text[i];
+    if (inString) {
+      if (escaped)
+        escaped = false;
+      else if (ch === "\\")
+        escaped = true;
+      else if (ch === '"')
+        inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    } else if (ch === "{") {
+      if (depth === 0)
+        start = i;
+      depth += 1;
+    } else if (ch === "}") {
+      if (depth > 0) {
+        depth -= 1;
+        if (depth === 0 && start !== -1)
+          return text.slice(start, i + 1);
+      }
+    }
+  }
+  return;
+}
 function parseJsonOutput(stdout, label) {
-  try {
-    const value = JSON.parse(stdout || "{}");
-    if (!value || typeof value !== "object" || Array.isArray(value))
-      throw new Error("not an object");
-    return value;
-  } catch (error) {
-    throw new Error(`${label} did not return JSON${error instanceof Error ? `: ${error.message}` : ""}`);
+  const raw = stdout || "{}";
+  const candidates = [raw.trim()];
+  const scanned = extractFirstJsonObject(raw);
+  if (scanned && scanned !== raw.trim())
+    candidates.push(scanned);
+  let lastError;
+  for (const candidate of candidates) {
+    try {
+      const value = JSON.parse(candidate);
+      if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("not an object");
+      return value;
+    } catch (error) {
+      lastError = error;
+    }
   }
+  throw new Error(`${label} did not return JSON${lastError instanceof Error ? `: ${lastError.message}` : ""}`);
 }
 function recordField(value, key) {
   if (!value || typeof value !== "object" || Array.isArray(value))
@@ -7961,7 +8003,7 @@ function enableStartup(result) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.6",
+  version: "0.4.7",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/index.js

@@ -724,7 +724,7 @@ function buildAgentInvocation(target) {
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
-      args.push("agent", "start");
+      args.push("agent", "start", "--json");
       if (target.cwd)
         args.push("--cwd", target.cwd);
       args.push(target.prompt);
@@ -4217,7 +4217,7 @@ class Store {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.6",
+  version: "0.4.7",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -5371,18 +5371,60 @@ function codewithAgentControlArgs(target, command, agentId) {
     "agent",
     command,
     ...command === "logs" ? ["--limit", "20"] : [],
+    "--json",
     agentId
   ];
 }
+function extractFirstJsonObject(text) {
+  let depth = 0;
+  let start = -1;
+  let inString = false;
+  let escaped = false;
+  for (let i = 0;i < text.length; i += 1) {
+    const ch = text[i];
+    if (inString) {
+      if (escaped)
+        escaped = false;
+      else if (ch === "\\")
+        escaped = true;
+      else if (ch === '"')
+        inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    } else if (ch === "{") {
+      if (depth === 0)
+        start = i;
+      depth += 1;
+    } else if (ch === "}") {
+      if (depth > 0) {
+        depth -= 1;
+        if (depth === 0 && start !== -1)
+          return text.slice(start, i + 1);
+      }
+    }
+  }
+  return;
+}
 function parseJsonOutput(stdout, label) {
-  try {
-    const value = JSON.parse(stdout || "{}");
-    if (!value || typeof value !== "object" || Array.isArray(value))
-      throw new Error("not an object");
-    return value;
-  } catch (error) {
-    throw new Error(`${label} did not return JSON${error instanceof Error ? `: ${error.message}` : ""}`);
+  const raw = stdout || "{}";
+  const candidates = [raw.trim()];
+  const scanned = extractFirstJsonObject(raw);
+  if (scanned && scanned !== raw.trim())
+    candidates.push(scanned);
+  let lastError;
+  for (const candidate of candidates) {
+    try {
+      const value = JSON.parse(candidate);
+      if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("not an object");
+      return value;
+    } catch (error) {
+      lastError = error;
+    }
   }
+  throw new Error(`${label} did not return JSON${lastError instanceof Error ? `: ${lastError.message}` : ""}`);
 }
 function recordField(value, key) {
   if (!value || typeof value !== "object" || Array.isArray(value))
@@ -10729,6 +10771,28 @@ function importCustomLoopTemplate(file, reservedKeys, opts = {}) {
 function compactJson(value) {
   return JSON.stringify(value);
 }
+function prReviewRoutingContext(input) {
+  return input.prReviewRouting?.required ? input.prReviewRouting : undefined;
+}
+function prReviewFollowUpFragment(input) {
+  const routing = prReviewRoutingContext(input);
+  const author = routing?.author?.trim();
+  const reviewers = routing?.reviewers?.map((reviewer) => reviewer.trim()).filter(Boolean) ?? [];
+  const evidenceLines = [
+    author ? `- Source PR author evidence: GitHub author is ${author}` : undefined,
+    reviewers.length ? `- Source PR reviewer evidence: GitHub reviewer pool: ${reviewers.join(", ")}` : undefined,
+    routing?.selectedReviewer ? `- Selected non-author reviewer: ${routing.selectedReviewer}` : undefined
+  ].filter(Boolean);
+  return [
+    "PR-derived follow-up todos: If any lifecycle step creates a follow-up todo that references a GitHub PR, PR approval, PR review, or PR merge work, the todo description must include parser-compatible routing evidence so downstream drains can select a non-author reviewer.",
+    ...evidenceLines,
+    "Copy these exact evidence lines from the source task when present, or derive them from the referenced PR before creating the follow-up todo:",
+    "GitHub author is <login>",
+    "GitHub reviewer pool: <login>, <login>",
+    "When the source PR author or reviewer pool cannot be determined, do not create an auto-routable PR-derived follow-up todo; comment the source task with the blocker instead."
+  ].join(`
+`);
+}
 function taskLabel(input) {
   const head = input.taskTitle?.trim() || input.taskId;
   return head.length > 160 ? `${head.slice(0, 157)}...` : head;
@@ -11184,6 +11248,7 @@ function renderTaskLifecycleWorkflow(input) {
     routeProjectPath: input.routeProjectPath,
     projectGroup: input.projectGroup,
     todosProjectPath,
+    prReviewRouting: prReviewRoutingContext(input),
     worktree: worktreeContextFragment(plan)
   };
   const handoffArtifactPath = prHandoffArtifactPath(plan, input.taskId);
@@ -11201,6 +11266,7 @@ function renderTaskLifecycleWorkflow(input) {
     ]),
     NO_TMUX_DISPATCH_FRAGMENT,
     "Preserve unrelated user changes and keep scope tied to the task acceptance criteria.",
+    prReviewFollowUpFragment(input),
     "",
     `Task context JSON: ${compactJson(taskContext)}`,
     prHandoffGuidance

package/dist/lib/mode.js

@@ -2,7 +2,7 @@
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.6",
+  version: "0.4.7",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/lib/route/types.d.ts

@@ -42,11 +42,15 @@ export interface TodosTaskRouteOptions {
     preflight?: boolean;
     dryRun?: boolean;
     todosProject?: string;
+    /** Internal drain context; never derived from CLI/event fields. */
+    sourceTodosProjectPath?: string;
 }
 export interface TodosReadyTask {
     id?: string;
     task_id?: string;
     taskId?: string;
+    source_project_path?: string;
+    sourceProjectPath?: string;
     title?: string;
     description?: string;
     body?: string;
@@ -70,6 +74,8 @@ export interface TodosReadyTask {
 }
 export interface TodosDrainOptions extends TodosTaskRouteOptions {
     todosProject?: string;
+    todosProjectsFromRegistry?: boolean;
+    todosProjectInclude?: string[];
     todosProjectId?: string;
     taskList?: string;
     tags?: string;

package/dist/lib/storage/index.js

@@ -724,7 +724,7 @@ function buildAgentInvocation(target) {
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
-      args.push("agent", "start");
+      args.push("agent", "start", "--json");
       if (target.cwd)
         args.push("--cwd", target.cwd);
       args.push(target.prompt);

package/dist/lib/storage/sqlite.js

@@ -724,7 +724,7 @@ function buildAgentInvocation(target) {
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
-      args.push("agent", "start");
+      args.push("agent", "start", "--json");
       if (target.cwd)
         args.push("--cwd", target.cwd);
       args.push(target.prompt);

package/dist/lib/store.js

@@ -724,7 +724,7 @@ function buildAgentInvocation(target) {
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
-      args.push("agent", "start");
+      args.push("agent", "start", "--json");
       if (target.cwd)
         args.push("--cwd", target.cwd);
       args.push(target.prompt);

package/dist/lib/templates.d.ts

@@ -39,9 +39,19 @@ export interface TodosTaskWorkflowTemplateInput extends AgentWorkflowTemplateBas
     taskDescription?: string;
     todosProjectPath?: string;
     prHandoff?: boolean;
+    prReviewRouting?: PrReviewRoutingTemplateContext;
     eventId?: string;
     eventType?: string;
 }
+export interface PrReviewRoutingTemplateContext {
+    required?: boolean;
+    allowed?: boolean;
+    reason?: string;
+    author?: string;
+    reviewers?: string[];
+    selectedReviewer?: string;
+    signals?: string[];
+}
 export interface EventWorkflowTemplateInput extends AgentWorkflowTemplateBaseInput {
     eventId: string;
     eventType: string;

package/dist/mcp/index.js

@@ -726,7 +726,7 @@ function buildAgentInvocation(target) {
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
-      args.push("agent", "start");
+      args.push("agent", "start", "--json");
       if (target.cwd)
         args.push("--cwd", target.cwd);
       args.push(target.prompt);
@@ -5106,18 +5106,60 @@ function codewithAgentControlArgs(target, command, agentId) {
     "agent",
     command,
     ...command === "logs" ? ["--limit", "20"] : [],
+    "--json",
     agentId
   ];
 }
+function extractFirstJsonObject(text) {
+  let depth = 0;
+  let start = -1;
+  let inString = false;
+  let escaped = false;
+  for (let i = 0;i < text.length; i += 1) {
+    const ch = text[i];
+    if (inString) {
+      if (escaped)
+        escaped = false;
+      else if (ch === "\\")
+        escaped = true;
+      else if (ch === '"')
+        inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    } else if (ch === "{") {
+      if (depth === 0)
+        start = i;
+      depth += 1;
+    } else if (ch === "}") {
+      if (depth > 0) {
+        depth -= 1;
+        if (depth === 0 && start !== -1)
+          return text.slice(start, i + 1);
+      }
+    }
+  }
+  return;
+}
 function parseJsonOutput(stdout, label) {
-  try {
-    const value = JSON.parse(stdout || "{}");
-    if (!value || typeof value !== "object" || Array.isArray(value))
-      throw new Error("not an object");
-    return value;
-  } catch (error) {
-    throw new Error(`${label} did not return JSON${error instanceof Error ? `: ${error.message}` : ""}`);
+  const raw = stdout || "{}";
+  const candidates = [raw.trim()];
+  const scanned = extractFirstJsonObject(raw);
+  if (scanned && scanned !== raw.trim())
+    candidates.push(scanned);
+  let lastError;
+  for (const candidate of candidates) {
+    try {
+      const value = JSON.parse(candidate);
+      if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("not an object");
+      return value;
+    } catch (error) {
+      lastError = error;
+    }
   }
+  throw new Error(`${label} did not return JSON${lastError instanceof Error ? `: ${lastError.message}` : ""}`);
 }
 function recordField(value, key) {
   if (!value || typeof value !== "object" || Array.isArray(value))
@@ -7677,7 +7719,7 @@ async function tick(deps) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.6",
+  version: "0.4.7",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/runner/index.js

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.6",
+  version: "0.4.7",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -510,7 +510,7 @@ function buildAgentInvocation(target) {
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
-      args.push("agent", "start");
+      args.push("agent", "start", "--json");
       if (target.cwd)
         args.push("--cwd", target.cwd);
       args.push(target.prompt);
@@ -1403,18 +1403,60 @@ function codewithAgentControlArgs(target, command, agentId) {
     "agent",
     command,
     ...command === "logs" ? ["--limit", "20"] : [],
+    "--json",
     agentId
   ];
 }
+function extractFirstJsonObject(text) {
+  let depth = 0;
+  let start = -1;
+  let inString = false;
+  let escaped = false;
+  for (let i = 0;i < text.length; i += 1) {
+    const ch = text[i];
+    if (inString) {
+      if (escaped)
+        escaped = false;
+      else if (ch === "\\")
+        escaped = true;
+      else if (ch === '"')
+        inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    } else if (ch === "{") {
+      if (depth === 0)
+        start = i;
+      depth += 1;
+    } else if (ch === "}") {
+      if (depth > 0) {
+        depth -= 1;
+        if (depth === 0 && start !== -1)
+          return text.slice(start, i + 1);
+      }
+    }
+  }
+  return;
+}
 function parseJsonOutput(stdout, label) {
-  try {
-    const value = JSON.parse(stdout || "{}");
-    if (!value || typeof value !== "object" || Array.isArray(value))
-      throw new Error("not an object");
-    return value;
-  } catch (error) {
-    throw new Error(`${label} did not return JSON${error instanceof Error ? `: ${error.message}` : ""}`);
+  const raw = stdout || "{}";
+  const candidates = [raw.trim()];
+  const scanned = extractFirstJsonObject(raw);
+  if (scanned && scanned !== raw.trim())
+    candidates.push(scanned);
+  let lastError;
+  for (const candidate of candidates) {
+    try {
+      const value = JSON.parse(candidate);
+      if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("not an object");
+      return value;
+    } catch (error) {
+      lastError = error;
+    }
   }
+  throw new Error(`${label} did not return JSON${lastError instanceof Error ? `: ${lastError.message}` : ""}`);
 }
 function recordField(value, key) {
   if (!value || typeof value !== "object" || Array.isArray(value))

package/dist/sdk/index.js

@@ -724,7 +724,7 @@ function buildAgentInvocation(target) {
       if (target.model)
         args.push("--model", target.model);
       args.push(...target.extraArgs ?? []);
-      args.push("agent", "start");
+      args.push("agent", "start", "--json");
       if (target.cwd)
         args.push("--cwd", target.cwd);
       args.push(target.prompt);
@@ -4217,7 +4217,7 @@ class Store {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.6",
+  version: "0.4.7",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -5366,18 +5366,60 @@ function codewithAgentControlArgs(target, command, agentId) {
     "agent",
     command,
     ...command === "logs" ? ["--limit", "20"] : [],
+    "--json",
     agentId
   ];
 }
+function extractFirstJsonObject(text) {
+  let depth = 0;
+  let start = -1;
+  let inString = false;
+  let escaped = false;
+  for (let i = 0;i < text.length; i += 1) {
+    const ch = text[i];
+    if (inString) {
+      if (escaped)
+        escaped = false;
+      else if (ch === "\\")
+        escaped = true;
+      else if (ch === '"')
+        inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    } else if (ch === "{") {
+      if (depth === 0)
+        start = i;
+      depth += 1;
+    } else if (ch === "}") {
+      if (depth > 0) {
+        depth -= 1;
+        if (depth === 0 && start !== -1)
+          return text.slice(start, i + 1);
+      }
+    }
+  }
+  return;
+}
 function parseJsonOutput(stdout, label) {
-  try {
-    const value = JSON.parse(stdout || "{}");
-    if (!value || typeof value !== "object" || Array.isArray(value))
-      throw new Error("not an object");
-    return value;
-  } catch (error) {
-    throw new Error(`${label} did not return JSON${error instanceof Error ? `: ${error.message}` : ""}`);
+  const raw = stdout || "{}";
+  const candidates = [raw.trim()];
+  const scanned = extractFirstJsonObject(raw);
+  if (scanned && scanned !== raw.trim())
+    candidates.push(scanned);
+  let lastError;
+  for (const candidate of candidates) {
+    try {
+      const value = JSON.parse(candidate);
+      if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("not an object");
+      return value;
+    } catch (error) {
+      lastError = error;
+    }
   }
+  throw new Error(`${label} did not return JSON${lastError instanceof Error ? `: ${lastError.message}` : ""}`);
 }
 function recordField(value, key) {
   if (!value || typeof value !== "object" || Array.isArray(value))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/loops",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   "type": "module",
   "main": "dist/index.js",