@hasna/loops 0.4.9 → 0.4.10

package/dist/lib/route/pr-review.d.ts

@@ -16,6 +16,13 @@ export interface PrReference {
 }
 /** Resolves a PR author login from a concrete `owner/repo#number` reference. */
 export type PrAuthorResolver = (ref: PrReference) => string | undefined;
+/** Live PR lifecycle state from a concrete `owner/repo#number` reference. */
+export interface PrLiveState {
+    state?: string;
+    mergeStateStatus?: string;
+}
+/** Resolves live PR state; returns undefined when it cannot be determined. */
+export type PrStateResolver = (ref: PrReference) => PrLiveState | undefined;
 /** Extracts a concrete owner/repo/number PR reference from route evidence text. */
 export declare function prReferenceFrom(text: string): PrReference | undefined;
-export declare function prReviewRoutingDecision(data: Record<string, unknown>, metadata: Record<string, unknown>, opts: TodosTaskRouteOptions, resolveAuthor?: PrAuthorResolver): PrReviewRoutingDecision;
+export declare function prReviewRoutingDecision(data: Record<string, unknown>, metadata: Record<string, unknown>, opts: TodosTaskRouteOptions, resolveAuthor?: PrAuthorResolver, resolveState?: PrStateResolver): PrReviewRoutingDecision;

package/dist/lib/storage/index.js

@@ -54,8 +54,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -72,10 +76,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1472,6 +1476,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3218,8 +3237,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3280,8 +3299,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3659,8 +3678,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4057,8 +4076,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,

package/dist/lib/storage/sqlite.js

@@ -54,8 +54,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -72,10 +76,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1472,6 +1476,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3218,8 +3237,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3280,8 +3299,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3659,8 +3678,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4057,8 +4076,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,

package/dist/lib/store.js

@@ -54,8 +54,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -72,10 +76,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1472,6 +1476,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3218,8 +3237,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3280,8 +3299,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3659,8 +3678,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4057,8 +4076,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,

package/dist/mcp/index.js

@@ -56,8 +56,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -74,10 +78,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1474,6 +1478,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3220,8 +3239,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3282,8 +3301,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3661,8 +3680,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4059,8 +4078,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,
@@ -4780,6 +4799,20 @@ function notifySpawn(pid, opts) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function codewithProfileCandidateFromLine(line) {
+  const cols = line.trim().split(/\s+/);
+  if (cols[0] === "*")
+    return cols[1];
+  return cols[0];
+}
+function codewithProfileForError(profile) {
+  return /[\u0000-\u001F\u007F]/.test(profile) ? JSON.stringify(profile) ?? profile : profile;
+}
+function assertCodewithAuthProfileSupported(profile) {
+  if (profile.includes("\x00")) {
+    throw new Error(`codewith auth profile contains unsupported NUL byte: ${codewithProfileForError(profile)}`);
+  }
+}
 function metadataEnv(metadata) {
   const env = {};
   if (metadata.loopId)
@@ -4846,6 +4879,9 @@ function commandSpec(target, opts) {
     };
   }
   const agentTarget = target;
+  if (agentTarget.provider === "codewith" && agentTarget.authProfile) {
+    assertCodewithAuthProfileSupported(agentTarget.authProfile);
+  }
   const adapter = providerAdapter(agentTarget.provider);
   const invocation = adapter.buildInvocation(agentTarget);
   return {
@@ -5018,7 +5054,8 @@ function remotePreflightScript(spec, metadata) {
     lines.push(`if ! ${spec.preflightAnyOf.map((command) => `command -v ${shellQuote(command)} >/dev/null 2>&1`).join(" && ! ")}; then`, `  echo 'none of required executables found: ${spec.preflightAnyOf.join(", ")}' >&2`, "  exit 127", "fi");
   }
   if (spec.nativeAuthProfile?.provider === "codewith") {
-    lines.push(`__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { print $1 }' | grep -Fx ${shellQuote(spec.nativeAuthProfile.profile)} >/dev/null; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${spec.nativeAuthProfile.profile}`)} >&2`, "  exit 1", "fi");
+    const profileForError = codewithProfileForError(spec.nativeAuthProfile.profile);
+    lines.push(`__OPENLOOPS_CODEWITH_PROFILE=${shellQuote(spec.nativeAuthProfile.profile)}`, "export __OPENLOOPS_CODEWITH_PROFILE", `__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { candidate = ($1 == "*" ? $2 : $1); if (candidate == ENVIRON["__OPENLOOPS_CODEWITH_PROFILE"]) found = 1 } END { exit(found ? 0 : 1) }'; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${profileForError}`)} >&2`, "  exit 1", "fi");
   }
   return lines.join(`
 `);
@@ -5043,9 +5080,9 @@ function assertCodewithProfileListed(profile, result) {
     const detail = (result.stderr || result.stdout || `exit ${result.status ?? "unknown"}`).trim();
     throw new Error(`codewith auth profile preflight failed${detail ? `: ${detail}` : ""}`);
   }
-  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map((line) => line.trim().split(/\s+/)[0]).filter(Boolean));
+  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map(codewithProfileCandidateFromLine).filter(Boolean));
   if (!profiles.has(profile)) {
-    throw new Error(`codewith auth profile not found: ${profile}`);
+    throw new Error(`codewith auth profile not found: ${codewithProfileForError(profile)}`);
   }
 }
 function preflightNativeAuthProfileSync(spec, env) {
@@ -7431,7 +7468,7 @@ async function tick(deps) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.9",
+  version: "0.4.10",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/runner/index.js

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.9",
+  version: "0.4.10",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -1077,6 +1077,20 @@ function notifySpawn(pid, opts) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function codewithProfileCandidateFromLine(line) {
+  const cols = line.trim().split(/\s+/);
+  if (cols[0] === "*")
+    return cols[1];
+  return cols[0];
+}
+function codewithProfileForError(profile) {
+  return /[\u0000-\u001F\u007F]/.test(profile) ? JSON.stringify(profile) ?? profile : profile;
+}
+function assertCodewithAuthProfileSupported(profile) {
+  if (profile.includes("\x00")) {
+    throw new Error(`codewith auth profile contains unsupported NUL byte: ${codewithProfileForError(profile)}`);
+  }
+}
 function metadataEnv(metadata) {
   const env = {};
   if (metadata.loopId)
@@ -1143,6 +1157,9 @@ function commandSpec(target, opts) {
     };
   }
   const agentTarget = target;
+  if (agentTarget.provider === "codewith" && agentTarget.authProfile) {
+    assertCodewithAuthProfileSupported(agentTarget.authProfile);
+  }
   const adapter = providerAdapter(agentTarget.provider);
   const invocation = adapter.buildInvocation(agentTarget);
   return {
@@ -1315,7 +1332,8 @@ function remotePreflightScript(spec, metadata) {
     lines.push(`if ! ${spec.preflightAnyOf.map((command) => `command -v ${shellQuote(command)} >/dev/null 2>&1`).join(" && ! ")}; then`, `  echo 'none of required executables found: ${spec.preflightAnyOf.join(", ")}' >&2`, "  exit 127", "fi");
   }
   if (spec.nativeAuthProfile?.provider === "codewith") {
-    lines.push(`__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { print $1 }' | grep -Fx ${shellQuote(spec.nativeAuthProfile.profile)} >/dev/null; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${spec.nativeAuthProfile.profile}`)} >&2`, "  exit 1", "fi");
+    const profileForError = codewithProfileForError(spec.nativeAuthProfile.profile);
+    lines.push(`__OPENLOOPS_CODEWITH_PROFILE=${shellQuote(spec.nativeAuthProfile.profile)}`, "export __OPENLOOPS_CODEWITH_PROFILE", `__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { candidate = ($1 == "*" ? $2 : $1); if (candidate == ENVIRON["__OPENLOOPS_CODEWITH_PROFILE"]) found = 1 } END { exit(found ? 0 : 1) }'; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${profileForError}`)} >&2`, "  exit 1", "fi");
   }
   return lines.join(`
 `);
@@ -1340,9 +1358,9 @@ function assertCodewithProfileListed(profile, result) {
     const detail = (result.stderr || result.stdout || `exit ${result.status ?? "unknown"}`).trim();
     throw new Error(`codewith auth profile preflight failed${detail ? `: ${detail}` : ""}`);
   }
-  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map((line) => line.trim().split(/\s+/)[0]).filter(Boolean));
+  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map(codewithProfileCandidateFromLine).filter(Boolean));
   if (!profiles.has(profile)) {
-    throw new Error(`codewith auth profile not found: ${profile}`);
+    throw new Error(`codewith auth profile not found: ${codewithProfileForError(profile)}`);
   }
 }
 function preflightNativeAuthProfileSync(spec, env) {

package/dist/sdk/index.js

@@ -54,8 +54,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -72,10 +76,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1472,6 +1476,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3218,8 +3237,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3280,8 +3299,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3659,8 +3678,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4057,8 +4076,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,
@@ -4216,7 +4235,7 @@ class Store {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.9",
+  version: "0.4.10",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -5040,6 +5059,20 @@ function notifySpawn(pid, opts) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function codewithProfileCandidateFromLine(line) {
+  const cols = line.trim().split(/\s+/);
+  if (cols[0] === "*")
+    return cols[1];
+  return cols[0];
+}
+function codewithProfileForError(profile) {
+  return /[\u0000-\u001F\u007F]/.test(profile) ? JSON.stringify(profile) ?? profile : profile;
+}
+function assertCodewithAuthProfileSupported(profile) {
+  if (profile.includes("\x00")) {
+    throw new Error(`codewith auth profile contains unsupported NUL byte: ${codewithProfileForError(profile)}`);
+  }
+}
 function metadataEnv(metadata) {
   const env = {};
   if (metadata.loopId)
@@ -5106,6 +5139,9 @@ function commandSpec(target, opts) {
     };
   }
   const agentTarget = target;
+  if (agentTarget.provider === "codewith" && agentTarget.authProfile) {
+    assertCodewithAuthProfileSupported(agentTarget.authProfile);
+  }
   const adapter = providerAdapter(agentTarget.provider);
   const invocation = adapter.buildInvocation(agentTarget);
   return {
@@ -5278,7 +5314,8 @@ function remotePreflightScript(spec, metadata) {
     lines.push(`if ! ${spec.preflightAnyOf.map((command) => `command -v ${shellQuote(command)} >/dev/null 2>&1`).join(" && ! ")}; then`, `  echo 'none of required executables found: ${spec.preflightAnyOf.join(", ")}' >&2`, "  exit 127", "fi");
   }
   if (spec.nativeAuthProfile?.provider === "codewith") {
-    lines.push(`__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { print $1 }' | grep -Fx ${shellQuote(spec.nativeAuthProfile.profile)} >/dev/null; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${spec.nativeAuthProfile.profile}`)} >&2`, "  exit 1", "fi");
+    const profileForError = codewithProfileForError(spec.nativeAuthProfile.profile);
+    lines.push(`__OPENLOOPS_CODEWITH_PROFILE=${shellQuote(spec.nativeAuthProfile.profile)}`, "export __OPENLOOPS_CODEWITH_PROFILE", `__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { candidate = ($1 == "*" ? $2 : $1); if (candidate == ENVIRON["__OPENLOOPS_CODEWITH_PROFILE"]) found = 1 } END { exit(found ? 0 : 1) }'; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${profileForError}`)} >&2`, "  exit 1", "fi");
   }
   return lines.join(`
 `);
@@ -5303,9 +5340,9 @@ function assertCodewithProfileListed(profile, result) {
     const detail = (result.stderr || result.stdout || `exit ${result.status ?? "unknown"}`).trim();
     throw new Error(`codewith auth profile preflight failed${detail ? `: ${detail}` : ""}`);
   }
-  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map((line) => line.trim().split(/\s+/)[0]).filter(Boolean));
+  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map(codewithProfileCandidateFromLine).filter(Boolean));
   if (!profiles.has(profile)) {
-    throw new Error(`codewith auth profile not found: ${profile}`);
+    throw new Error(`codewith auth profile not found: ${codewithProfileForError(profile)}`);
   }
 }
 function preflightNativeAuthProfileSync(spec, env) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/loops",
-  "version": "0.4.9",
+  "version": "0.4.10",
   "description": "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   "type": "module",
   "main": "dist/index.js",