@hasna/loops 0.4.9 → 0.4.10

package/dist/api/index.js

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.9",
+  version: "0.4.10",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/cli/index.js

@@ -56,8 +56,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -74,10 +78,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1474,6 +1478,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3220,8 +3239,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3282,8 +3301,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3661,8 +3680,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4059,8 +4078,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,
@@ -4218,7 +4237,7 @@ class Store {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.9",
+  version: "0.4.10",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -4938,6 +4957,20 @@ function notifySpawn(pid, opts) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function codewithProfileCandidateFromLine(line) {
+  const cols = line.trim().split(/\s+/);
+  if (cols[0] === "*")
+    return cols[1];
+  return cols[0];
+}
+function codewithProfileForError(profile) {
+  return /[\u0000-\u001F\u007F]/.test(profile) ? JSON.stringify(profile) ?? profile : profile;
+}
+function assertCodewithAuthProfileSupported(profile) {
+  if (profile.includes("\x00")) {
+    throw new Error(`codewith auth profile contains unsupported NUL byte: ${codewithProfileForError(profile)}`);
+  }
+}
 function metadataEnv(metadata) {
   const env = {};
   if (metadata.loopId)
@@ -5004,6 +5037,9 @@ function commandSpec(target, opts) {
     };
   }
   const agentTarget = target;
+  if (agentTarget.provider === "codewith" && agentTarget.authProfile) {
+    assertCodewithAuthProfileSupported(agentTarget.authProfile);
+  }
   const adapter = providerAdapter(agentTarget.provider);
   const invocation = adapter.buildInvocation(agentTarget);
   return {
@@ -5176,7 +5212,8 @@ function remotePreflightScript(spec, metadata) {
     lines.push(`if ! ${spec.preflightAnyOf.map((command) => `command -v ${shellQuote(command)} >/dev/null 2>&1`).join(" && ! ")}; then`, `  echo 'none of required executables found: ${spec.preflightAnyOf.join(", ")}' >&2`, "  exit 127", "fi");
   }
   if (spec.nativeAuthProfile?.provider === "codewith") {
-    lines.push(`__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { print $1 }' | grep -Fx ${shellQuote(spec.nativeAuthProfile.profile)} >/dev/null; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${spec.nativeAuthProfile.profile}`)} >&2`, "  exit 1", "fi");
+    const profileForError = codewithProfileForError(spec.nativeAuthProfile.profile);
+    lines.push(`__OPENLOOPS_CODEWITH_PROFILE=${shellQuote(spec.nativeAuthProfile.profile)}`, "export __OPENLOOPS_CODEWITH_PROFILE", `__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { candidate = ($1 == "*" ? $2 : $1); if (candidate == ENVIRON["__OPENLOOPS_CODEWITH_PROFILE"]) found = 1 } END { exit(found ? 0 : 1) }'; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${profileForError}`)} >&2`, "  exit 1", "fi");
   }
   return lines.join(`
 `);
@@ -5201,9 +5238,9 @@ function assertCodewithProfileListed(profile, result) {
     const detail = (result.stderr || result.stdout || `exit ${result.status ?? "unknown"}`).trim();
     throw new Error(`codewith auth profile preflight failed${detail ? `: ${detail}` : ""}`);
   }
-  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map((line) => line.trim().split(/\s+/)[0]).filter(Boolean));
+  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map(codewithProfileCandidateFromLine).filter(Boolean));
   if (!profiles.has(profile)) {
-    throw new Error(`codewith auth profile not found: ${profile}`);
+    throw new Error(`codewith auth profile not found: ${codewithProfileForError(profile)}`);
   }
 }
 function preflightNativeAuthProfileSync(spec, env) {
@@ -11376,11 +11413,18 @@ var PR_REVIEW_REQUIRED_FIELDS = [
   "branch_protection_review_required",
   "branchProtectionReviewRequired"
 ];
+var GITHUB_USER_LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
 function githubLogin(value) {
   if (!value?.trim())
     return;
-  const login = value.trim().replace(/^@/, "");
-  return /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(login) ? login : undefined;
+  let login = value.trim().replace(/^@/, "");
+  const appActor = /^app\/([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))$/.exec(login);
+  if (appActor)
+    login = `${appActor[1]}[bot]`;
+  const bot = /^([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))\[bot\]$/.exec(login);
+  if (bot)
+    return `${bot[1]}[bot]`;
+  return GITHUB_USER_LOGIN.test(login) ? login : undefined;
 }
 function githubLogins(values) {
   const seen = new Set;
@@ -11439,6 +11483,27 @@ function routeTextFieldValues(record, field) {
   }
   return values;
 }
+var PR_STATE_FIELDS = [
+  "pr_state",
+  "prState",
+  "pull_request_state",
+  "pullRequestState",
+  "state",
+  "pr_status",
+  "prStatus"
+];
+var CLOSED_PR_STATES = new Set(["MERGED", "CLOSED"]);
+function normalizePrState(value) {
+  const trimmed = value?.trim().toUpperCase();
+  return trimmed ? trimmed : undefined;
+}
+function prStateFromEvidence(records, text) {
+  const field = normalizePrState(firstRouteField(records, PR_STATE_FIELDS));
+  if (field)
+    return field;
+  const match = /\b(?:pr[_\s-]?state|pull[_\s-]?request[_\s-]?state|state)\s*[:=]\s*(MERGED|CLOSED|OPEN)\b/i.exec(text);
+  return match ? match[1].toUpperCase() : undefined;
+}
 function prReferenceFrom(text) {
   const url = /github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/pull\/(\d+)/i.exec(text);
   if (url)
@@ -11454,6 +11519,17 @@ function ghAuthorResolver(ref) {
     return;
   return githubLogin((result.stdout ?? "").trim());
 }
+function ghStateResolver(ref) {
+  const result = spawnSync7("gh", ["pr", "view", String(ref.number), "--repo", `${ref.owner}/${ref.repo}`, "--json", "state,mergeStateStatus"], { encoding: "utf8", timeout: 20000 });
+  if (result.error || result.status !== 0)
+    return;
+  try {
+    const parsed = JSON.parse(result.stdout ?? "{}");
+    return { state: parsed.state, mergeStateStatus: parsed.mergeStateStatus };
+  } catch {
+    return;
+  }
+}
 function authorFromPrText(text) {
   const patterns = [
     /\bauthor\s+(?:is\s+also|is|=|:)\s+@?([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))/i,
@@ -11480,7 +11556,7 @@ function reviewersFromPrText(text) {
   }
   return githubLogins(reviewers);
 }
-function prReviewRoutingDecision(data, metadata, opts, resolveAuthor = ghAuthorResolver) {
+function prReviewRoutingDecision(data, metadata, opts, resolveAuthor = ghAuthorResolver, resolveState = ghStateResolver) {
   const records = [...taskEventRecords(data, metadata), ...automationRecords(data, metadata)];
   const text = routeEvidenceText(records);
   const signals = [];
@@ -11500,6 +11576,21 @@ function prReviewRoutingDecision(data, metadata, opts, resolveAuthor = ghAuthorR
   const required = hasPrReference && (reviewRequiredByField || reviewRequiredByText || mergeBlockedByText || approvalIntent);
   if (!required)
     return { required: false, allowed: true, reviewers: [], signals };
+  const prRef = prReferenceFrom(text);
+  let prState = prStateFromEvidence(records, text);
+  if (!prState && prRef) {
+    const live = resolveState(prRef);
+    prState = normalizePrState(live?.state);
+  }
+  if (prState && CLOSED_PR_STATES.has(prState)) {
+    return {
+      required: true,
+      allowed: false,
+      reason: `PR is already ${prState.toLowerCase()}; skipping merge/review route (freshness gate)`,
+      reviewers: [],
+      signals: [...signals, "pr-not-open"]
+    };
+  }
   const reviewers = githubLogins([
     opts.githubReviewer,
     ...splitList(opts.githubReviewerPool) ?? [],
@@ -11508,14 +11599,11 @@ function prReviewRoutingDecision(data, metadata, opts, resolveAuthor = ghAuthorR
     ...reviewersFromPrText(text)
   ]);
   let author = githubLogin(firstRouteField(records, PR_AUTHOR_FIELDS)) ?? authorFromPrText(text);
-  if (!author) {
-    const ref = prReferenceFrom(text);
-    if (ref) {
-      const derived = githubLogin(resolveAuthor(ref));
-      if (derived) {
-        author = derived;
-        signals.push("author-derived-gh");
-      }
+  if (!author && prRef) {
+    const derived = githubLogin(resolveAuthor(prRef));
+    if (derived) {
+      author = derived;
+      signals.push("author-derived-gh");
     }
   }
   const selectedReviewer = author ? reviewers.find((reviewer) => reviewer.toLowerCase() !== author.toLowerCase()) : undefined;
@@ -11711,6 +11799,34 @@ var UNCLEARED_ROUTE_WORK_ITEM_STATUSES = new Set([
 function isUnclearedRouteWorkItem(item) {
   return UNCLEARED_ROUTE_WORK_ITEM_STATUSES.has(item.status);
 }
+var REACTIVATABLE_TERMINAL_STATUSES = new Set([
+  "succeeded",
+  "failed",
+  "dead_letter",
+  "cancelled"
+]);
+var MAX_TODOS_TASK_ROUTE_REDISPATCHES = 8;
+function todosTaskRouteRedispatchBackoffMs(attempts) {
+  const base = 2 * 60000;
+  const cap = 30 * 60000;
+  const exp = Math.max(0, Math.min(attempts - 1, 10));
+  return Math.min(cap, base * 2 ** exp);
+}
+function reactivateStaleTodosTaskWorkItem(store, routeKey, item, now = Date.now()) {
+  if (routeKey !== "todos-task")
+    return;
+  if (!REACTIVATABLE_TERMINAL_STATUSES.has(item.status))
+    return;
+  if (item.attempts >= MAX_TODOS_TASK_ROUTE_REDISPATCHES)
+    return;
+  const finishedAt = Date.parse(item.updatedAt);
+  if (Number.isFinite(finishedAt) && now - finishedAt < todosTaskRouteRedispatchBackoffMs(item.attempts)) {
+    return;
+  }
+  return store.requeueWorkflowWorkItem(item.id, {
+    reason: `re-admitted from ${item.status}: todos task still actionable after prior run (attempt ${item.attempts + 1}/${MAX_TODOS_TASK_ROUTE_REDISPATCHES})`
+  });
+}
 function todosTaskRouteTemplateId(opts) {
   const id = (opts.template ?? TODOS_TASK_WORKER_VERIFIER_TEMPLATE_ID).trim();
   if (!TODOS_TASK_ROUTE_TEMPLATE_IDS.has(id)) {
@@ -11803,9 +11919,11 @@ function routeEvent(plan) {
       const invocation = store.createWorkflowInvocation(plan.invocationInput);
       const existingItem = store.findWorkflowWorkItem(plan.routeKey, idempotencyKey);
       if (existingItem && isUnclearedRouteWorkItem(existingItem)) {
-        const existingLoop = existingItem.loopId ? store.getLoop(existingItem.loopId) : undefined;
-        const existingWorkflow = existingItem.workflowId ? store.getWorkflow(existingItem.workflowId) : undefined;
-        return { kind: "deduped", existingItem, existingLoop, existingWorkflow, invocation };
+        if (!reactivateStaleTodosTaskWorkItem(store, plan.routeKey, existingItem)) {
+          const existingLoop = existingItem.loopId ? store.getLoop(existingItem.loopId) : undefined;
+          const existingWorkflow = existingItem.workflowId ? store.getWorkflow(existingItem.workflowId) : undefined;
+          return { kind: "deduped", existingItem, existingLoop, existingWorkflow, invocation };
+        }
       }
       const throttle = hasThrottleLimits(plan.throttleLimits) ? routeThrottleDecision(store, { projectPath: plan.routeProjectPath, projectGroup: plan.projectGroup, limits: plan.throttleLimits }) : undefined;
       const workItem = store.upsertWorkflowWorkItem({
@@ -11937,10 +12055,12 @@ function routeTodosTaskEvent(event, opts) {
     try {
       const existingItem = store.findWorkflowWorkItem("todos-task", idempotencyKey);
       if (existingItem && isUnclearedRouteWorkItem(existingItem)) {
-        const existingLoop = existingItem.loopId ? store.getLoop(existingItem.loopId) : undefined;
-        const existingWorkflow = existingItem.workflowId ? store.getWorkflow(existingItem.workflowId) : undefined;
-        const existingInvocation = store.getWorkflowInvocation(existingItem.invocationId);
-        return dedupedRoutePrint({ event, idempotencyKey, dedupeValueExtras: {} }, { existingItem, existingLoop, existingWorkflow, invocation: existingInvocation });
+        if (!reactivateStaleTodosTaskWorkItem(store, "todos-task", existingItem)) {
+          const existingLoop = existingItem.loopId ? store.getLoop(existingItem.loopId) : undefined;
+          const existingWorkflow = existingItem.workflowId ? store.getWorkflow(existingItem.workflowId) : undefined;
+          const existingInvocation = store.getWorkflowInvocation(existingItem.invocationId);
+          return dedupedRoutePrint({ event, idempotencyKey, dedupeValueExtras: {} }, { existingItem, existingLoop, existingWorkflow, invocation: existingInvocation });
+        }
       }
     } finally {
       store.close();

package/dist/daemon/index.js

@@ -56,8 +56,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -74,10 +78,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1474,6 +1478,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3220,8 +3239,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3282,8 +3301,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3661,8 +3680,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4059,8 +4078,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,
@@ -5099,6 +5118,20 @@ function notifySpawn(pid, opts) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function codewithProfileCandidateFromLine(line) {
+  const cols = line.trim().split(/\s+/);
+  if (cols[0] === "*")
+    return cols[1];
+  return cols[0];
+}
+function codewithProfileForError(profile) {
+  return /[\u0000-\u001F\u007F]/.test(profile) ? JSON.stringify(profile) ?? profile : profile;
+}
+function assertCodewithAuthProfileSupported(profile) {
+  if (profile.includes("\x00")) {
+    throw new Error(`codewith auth profile contains unsupported NUL byte: ${codewithProfileForError(profile)}`);
+  }
+}
 function metadataEnv(metadata) {
   const env = {};
   if (metadata.loopId)
@@ -5165,6 +5198,9 @@ function commandSpec(target, opts) {
     };
   }
   const agentTarget = target;
+  if (agentTarget.provider === "codewith" && agentTarget.authProfile) {
+    assertCodewithAuthProfileSupported(agentTarget.authProfile);
+  }
   const adapter = providerAdapter(agentTarget.provider);
   const invocation = adapter.buildInvocation(agentTarget);
   return {
@@ -5337,7 +5373,8 @@ function remotePreflightScript(spec, metadata) {
     lines.push(`if ! ${spec.preflightAnyOf.map((command) => `command -v ${shellQuote(command)} >/dev/null 2>&1`).join(" && ! ")}; then`, `  echo 'none of required executables found: ${spec.preflightAnyOf.join(", ")}' >&2`, "  exit 127", "fi");
   }
   if (spec.nativeAuthProfile?.provider === "codewith") {
-    lines.push(`__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { print $1 }' | grep -Fx ${shellQuote(spec.nativeAuthProfile.profile)} >/dev/null; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${spec.nativeAuthProfile.profile}`)} >&2`, "  exit 1", "fi");
+    const profileForError = codewithProfileForError(spec.nativeAuthProfile.profile);
+    lines.push(`__OPENLOOPS_CODEWITH_PROFILE=${shellQuote(spec.nativeAuthProfile.profile)}`, "export __OPENLOOPS_CODEWITH_PROFILE", `__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { candidate = ($1 == "*" ? $2 : $1); if (candidate == ENVIRON["__OPENLOOPS_CODEWITH_PROFILE"]) found = 1 } END { exit(found ? 0 : 1) }'; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${profileForError}`)} >&2`, "  exit 1", "fi");
   }
   return lines.join(`
 `);
@@ -5362,9 +5399,9 @@ function assertCodewithProfileListed(profile, result) {
     const detail = (result.stderr || result.stdout || `exit ${result.status ?? "unknown"}`).trim();
     throw new Error(`codewith auth profile preflight failed${detail ? `: ${detail}` : ""}`);
   }
-  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map((line) => line.trim().split(/\s+/)[0]).filter(Boolean));
+  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map(codewithProfileCandidateFromLine).filter(Boolean));
   if (!profiles.has(profile)) {
-    throw new Error(`codewith auth profile not found: ${profile}`);
+    throw new Error(`codewith auth profile not found: ${codewithProfileForError(profile)}`);
   }
 }
 function preflightNativeAuthProfileSync(spec, env) {
@@ -7715,7 +7752,7 @@ function enableStartup(result) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.9",
+  version: "0.4.10",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/index.js

@@ -54,8 +54,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -72,10 +76,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1472,6 +1476,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3218,8 +3237,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3280,8 +3299,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3659,8 +3678,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4057,8 +4076,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,
@@ -4216,7 +4235,7 @@ class Store {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.9",
+  version: "0.4.10",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -5045,6 +5064,20 @@ function notifySpawn(pid, opts) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function codewithProfileCandidateFromLine(line) {
+  const cols = line.trim().split(/\s+/);
+  if (cols[0] === "*")
+    return cols[1];
+  return cols[0];
+}
+function codewithProfileForError(profile) {
+  return /[\u0000-\u001F\u007F]/.test(profile) ? JSON.stringify(profile) ?? profile : profile;
+}
+function assertCodewithAuthProfileSupported(profile) {
+  if (profile.includes("\x00")) {
+    throw new Error(`codewith auth profile contains unsupported NUL byte: ${codewithProfileForError(profile)}`);
+  }
+}
 function metadataEnv(metadata) {
   const env = {};
   if (metadata.loopId)
@@ -5111,6 +5144,9 @@ function commandSpec(target, opts) {
     };
   }
   const agentTarget = target;
+  if (agentTarget.provider === "codewith" && agentTarget.authProfile) {
+    assertCodewithAuthProfileSupported(agentTarget.authProfile);
+  }
   const adapter = providerAdapter(agentTarget.provider);
   const invocation = adapter.buildInvocation(agentTarget);
   return {
@@ -5283,7 +5319,8 @@ function remotePreflightScript(spec, metadata) {
     lines.push(`if ! ${spec.preflightAnyOf.map((command) => `command -v ${shellQuote(command)} >/dev/null 2>&1`).join(" && ! ")}; then`, `  echo 'none of required executables found: ${spec.preflightAnyOf.join(", ")}' >&2`, "  exit 127", "fi");
   }
   if (spec.nativeAuthProfile?.provider === "codewith") {
-    lines.push(`__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { print $1 }' | grep -Fx ${shellQuote(spec.nativeAuthProfile.profile)} >/dev/null; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${spec.nativeAuthProfile.profile}`)} >&2`, "  exit 1", "fi");
+    const profileForError = codewithProfileForError(spec.nativeAuthProfile.profile);
+    lines.push(`__OPENLOOPS_CODEWITH_PROFILE=${shellQuote(spec.nativeAuthProfile.profile)}`, "export __OPENLOOPS_CODEWITH_PROFILE", `__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { candidate = ($1 == "*" ? $2 : $1); if (candidate == ENVIRON["__OPENLOOPS_CODEWITH_PROFILE"]) found = 1 } END { exit(found ? 0 : 1) }'; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${profileForError}`)} >&2`, "  exit 1", "fi");
   }
   return lines.join(`
 `);
@@ -5308,9 +5345,9 @@ function assertCodewithProfileListed(profile, result) {
     const detail = (result.stderr || result.stdout || `exit ${result.status ?? "unknown"}`).trim();
     throw new Error(`codewith auth profile preflight failed${detail ? `: ${detail}` : ""}`);
   }
-  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map((line) => line.trim().split(/\s+/)[0]).filter(Boolean));
+  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map(codewithProfileCandidateFromLine).filter(Boolean));
   if (!profiles.has(profile)) {
-    throw new Error(`codewith auth profile not found: ${profile}`);
+    throw new Error(`codewith auth profile not found: ${codewithProfileForError(profile)}`);
   }
 }
 function preflightNativeAuthProfileSync(spec, env) {

package/dist/lib/mode.js

@@ -2,7 +2,7 @@
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.9",
+  version: "0.4.10",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",