@hasna/loops 0.4.9 → 0.4.11

package/dist/lib/storage/index.js

@@ -54,8 +54,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -72,10 +76,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1472,6 +1476,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3218,8 +3237,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3280,8 +3299,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3659,8 +3678,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4057,8 +4076,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,

package/dist/lib/storage/sqlite.js

@@ -54,8 +54,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -72,10 +76,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1472,6 +1476,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3218,8 +3237,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3280,8 +3299,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3659,8 +3678,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4057,8 +4076,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,

package/dist/lib/store.js

@@ -54,8 +54,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -72,10 +76,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1472,6 +1476,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3218,8 +3237,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3280,8 +3299,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3659,8 +3678,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4057,8 +4076,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,

package/dist/mcp/index.js

@@ -56,8 +56,12 @@ function nowIso() {
 import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+function homeDir() {
+  const home = process.env.HOME?.trim();
+  return home ? home : homedir();
+}
 function dataDir() {
-  return process.env.LOOPS_DATA_DIR || join(homedir(), ".hasna", "loops");
+  return process.env.LOOPS_DATA_DIR || join(homeDir(), ".hasna", "loops");
 }
 function ensureDataDir() {
   const dir = dataDir();
@@ -74,10 +78,10 @@ function daemonLogPath() {
   return join(dataDir(), "daemon.log");
 }
 function systemdServicePath() {
-  return join(homedir(), ".config", "systemd", "user", "loops-daemon.service");
+  return join(homeDir(), ".config", "systemd", "user", "loops-daemon.service");
 }
 function launchdPlistPath() {
-  return join(homedir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
+  return join(homeDir(), "Library", "LaunchAgents", "com.hasna.loops.daemon.plist");
 }
 
 // src/lib/process-identity.ts
@@ -1474,6 +1478,21 @@ function workItemStatusForLoopRun(status, attempt, maxAttempts) {
 function scrubbedOrNull(value) {
   return value == null ? null : scrubSecrets(value);
 }
+var MAX_PERSISTED_RUN_OUTPUT_CHARS = 64 * 1024;
+function clampPersistedRunOutput(value) {
+  if (value == null || value.length <= MAX_PERSISTED_RUN_OUTPUT_CHARS)
+    return value;
+  const half = Math.floor(MAX_PERSISTED_RUN_OUTPUT_CHARS / 2);
+  const head = value.slice(0, half);
+  const tail = value.slice(value.length - half);
+  const omitted = value.length - head.length - tail.length;
+  return `${head}
+\u2026[${omitted} chars truncated by loops run-output retention]\u2026
+${tail}`;
+}
+function persistedRunOutput(value) {
+  return clampPersistedRunOutput(scrubbedOrNull(value));
+}
 function chmodIfExists(path, mode) {
   try {
     if (existsSync(path))
@@ -3220,8 +3239,8 @@ class Store {
              ))`).run({
         $workflowRunId: workflowRunId,
         $stepId: stepId,
-        $stdout: progress.stdout === undefined ? null : scrubbedOrNull(progress.stdout),
-        $stderr: progress.stderr === undefined ? null : scrubbedOrNull(progress.stderr),
+        $stdout: progress.stdout === undefined ? null : persistedRunOutput(progress.stdout),
+        $stderr: progress.stderr === undefined ? null : persistedRunOutput(progress.stderr),
         $updated: now,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
         $now: now
@@ -3282,8 +3301,8 @@ class Store {
         $finished: finishedAt,
         $exitCode: patch.exitCode ?? null,
         $durationMs: patch.durationMs ?? null,
-        $stdout: scrubbedOrNull(patch.stdout),
-        $stderr: scrubbedOrNull(patch.stderr),
+        $stdout: persistedRunOutput(patch.stdout),
+        $stderr: persistedRunOutput(patch.stderr),
         $error: error ?? null,
         $updated: finishedAt,
         $daemonLeaseId: opts.daemonLeaseId ?? null,
@@ -3661,8 +3680,8 @@ class Store {
       $pid: patch.pid ?? null,
       $exitCode: patch.exitCode ?? null,
       $durationMs: patch.durationMs ?? null,
-      $stdout: scrubbedOrNull(patch.stdout),
-      $stderr: scrubbedOrNull(patch.stderr),
+      $stdout: persistedRunOutput(patch.stdout),
+      $stderr: persistedRunOutput(patch.stderr),
       $error: error ?? null,
       $updated: finishedAt,
       $claimedBy: opts.claimedBy ?? null,
@@ -4059,8 +4078,8 @@ class Store {
       $processStartedAt: run.processStartedAt ?? null,
       $exitCode: run.exitCode ?? null,
       $durationMs: run.durationMs ?? null,
-      $stdout: scrubbedOrNull(run.stdout),
-      $stderr: scrubbedOrNull(run.stderr),
+      $stdout: persistedRunOutput(run.stdout),
+      $stderr: persistedRunOutput(run.stderr),
       $error: scrubbedOrNull(run.error),
       $goalRunId: run.goalRunId ?? null,
       $created: run.createdAt,
@@ -4780,6 +4799,20 @@ function notifySpawn(pid, opts) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function codewithProfileCandidateFromLine(line) {
+  const cols = line.trim().split(/\s+/);
+  if (cols[0] === "*")
+    return cols[1];
+  return cols[0];
+}
+function codewithProfileForError(profile) {
+  return /[\u0000-\u001F\u007F]/.test(profile) ? JSON.stringify(profile) ?? profile : profile;
+}
+function assertCodewithAuthProfileSupported(profile) {
+  if (profile.includes("\x00")) {
+    throw new Error(`codewith auth profile contains unsupported NUL byte: ${codewithProfileForError(profile)}`);
+  }
+}
 function metadataEnv(metadata) {
   const env = {};
   if (metadata.loopId)
@@ -4846,6 +4879,9 @@ function commandSpec(target, opts) {
     };
   }
   const agentTarget = target;
+  if (agentTarget.provider === "codewith" && agentTarget.authProfile) {
+    assertCodewithAuthProfileSupported(agentTarget.authProfile);
+  }
   const adapter = providerAdapter(agentTarget.provider);
   const invocation = adapter.buildInvocation(agentTarget);
   return {
@@ -5018,7 +5054,8 @@ function remotePreflightScript(spec, metadata) {
     lines.push(`if ! ${spec.preflightAnyOf.map((command) => `command -v ${shellQuote(command)} >/dev/null 2>&1`).join(" && ! ")}; then`, `  echo 'none of required executables found: ${spec.preflightAnyOf.join(", ")}' >&2`, "  exit 127", "fi");
   }
   if (spec.nativeAuthProfile?.provider === "codewith") {
-    lines.push(`__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { print $1 }' | grep -Fx ${shellQuote(spec.nativeAuthProfile.profile)} >/dev/null; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${spec.nativeAuthProfile.profile}`)} >&2`, "  exit 1", "fi");
+    const profileForError = codewithProfileForError(spec.nativeAuthProfile.profile);
+    lines.push(`__OPENLOOPS_CODEWITH_PROFILE=${shellQuote(spec.nativeAuthProfile.profile)}`, "export __OPENLOOPS_CODEWITH_PROFILE", `__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { candidate = ($1 == "*" ? $2 : $1); if (candidate == ENVIRON["__OPENLOOPS_CODEWITH_PROFILE"]) found = 1 } END { exit(found ? 0 : 1) }'; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${profileForError}`)} >&2`, "  exit 1", "fi");
   }
   return lines.join(`
 `);
@@ -5043,9 +5080,9 @@ function assertCodewithProfileListed(profile, result) {
     const detail = (result.stderr || result.stdout || `exit ${result.status ?? "unknown"}`).trim();
     throw new Error(`codewith auth profile preflight failed${detail ? `: ${detail}` : ""}`);
   }
-  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map((line) => line.trim().split(/\s+/)[0]).filter(Boolean));
+  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map(codewithProfileCandidateFromLine).filter(Boolean));
   if (!profiles.has(profile)) {
-    throw new Error(`codewith auth profile not found: ${profile}`);
+    throw new Error(`codewith auth profile not found: ${codewithProfileForError(profile)}`);
   }
 }
 function preflightNativeAuthProfileSync(spec, env) {
@@ -6984,6 +7021,9 @@ async function executeLoopTarget(store, loop, run, opts = {}) {
 }
 
 // src/lib/scheduler.ts
+function loopLane(loop) {
+  return loop.target.type === "command" ? "command" : "agent";
+}
 function manualRunScheduledFor(loop, now = new Date) {
   if (loop.archivedAt)
     return now.toISOString();
@@ -7376,14 +7416,23 @@ function claimDueRuns(deps) {
   const maxClaims = Math.max(0, deps.maxClaims ?? Number.POSITIVE_INFINITY);
   if (maxClaims === 0)
     return { claims, claimed, completed: [], skipped, recovered, expired };
+  const laneLimits = deps.laneLimits;
+  const laneClaims = { command: 0, agent: 0 };
+  const laneCap = (lane) => laneLimits === undefined ? Number.POSITIVE_INFINITY : Math.max(0, laneLimits[lane] ?? Number.POSITIVE_INFINITY);
+  const laneFull = (lane) => laneClaims[lane] >= laneCap(lane);
   for (const loop of deps.store.dueLoops(now)) {
     if (claims.length >= maxClaims)
       break;
+    const lane = loopLane(loop);
+    if (laneFull(lane))
+      continue;
     const plan = dueSlots(loop, now);
     let loopSkips = 0;
     for (const slot of plan.slots) {
       if (claims.length >= maxClaims)
         break;
+      if (laneFull(lane))
+        break;
       if (loopSkips >= MAX_SKIPS_PER_LOOP_PER_TICK)
         break;
       const run = claimSlot(deps, loop, slot);
@@ -7392,6 +7441,7 @@ function claimDueRuns(deps) {
       if ("loop" in run) {
         claims.push(run);
         claimed.push(run.run);
+        laneClaims[lane] += 1;
       } else if (run.status === "skipped") {
         skipped.push(run);
         loopSkips += 1;
@@ -7431,7 +7481,7 @@ async function tick(deps) {
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.9",
+  version: "0.4.11",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",

package/dist/runner/index.js

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@hasna/loops",
-  version: "0.4.9",
+  version: "0.4.11",
   description: "Persistent local loop and workflow runner for deterministic commands and headless AI coding agents",
   type: "module",
   main: "dist/index.js",
@@ -1077,6 +1077,20 @@ function notifySpawn(pid, opts) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function codewithProfileCandidateFromLine(line) {
+  const cols = line.trim().split(/\s+/);
+  if (cols[0] === "*")
+    return cols[1];
+  return cols[0];
+}
+function codewithProfileForError(profile) {
+  return /[\u0000-\u001F\u007F]/.test(profile) ? JSON.stringify(profile) ?? profile : profile;
+}
+function assertCodewithAuthProfileSupported(profile) {
+  if (profile.includes("\x00")) {
+    throw new Error(`codewith auth profile contains unsupported NUL byte: ${codewithProfileForError(profile)}`);
+  }
+}
 function metadataEnv(metadata) {
   const env = {};
   if (metadata.loopId)
@@ -1143,6 +1157,9 @@ function commandSpec(target, opts) {
     };
   }
   const agentTarget = target;
+  if (agentTarget.provider === "codewith" && agentTarget.authProfile) {
+    assertCodewithAuthProfileSupported(agentTarget.authProfile);
+  }
   const adapter = providerAdapter(agentTarget.provider);
   const invocation = adapter.buildInvocation(agentTarget);
   return {
@@ -1315,7 +1332,8 @@ function remotePreflightScript(spec, metadata) {
     lines.push(`if ! ${spec.preflightAnyOf.map((command) => `command -v ${shellQuote(command)} >/dev/null 2>&1`).join(" && ! ")}; then`, `  echo 'none of required executables found: ${spec.preflightAnyOf.join(", ")}' >&2`, "  exit 127", "fi");
   }
   if (spec.nativeAuthProfile?.provider === "codewith") {
-    lines.push(`__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { print $1 }' | grep -Fx ${shellQuote(spec.nativeAuthProfile.profile)} >/dev/null; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${spec.nativeAuthProfile.profile}`)} >&2`, "  exit 1", "fi");
+    const profileForError = codewithProfileForError(spec.nativeAuthProfile.profile);
+    lines.push(`__OPENLOOPS_CODEWITH_PROFILE=${shellQuote(spec.nativeAuthProfile.profile)}`, "export __OPENLOOPS_CODEWITH_PROFILE", `__OPENLOOPS_CODEWITH_PROFILES="$(${shellQuote(spec.command)} profile list)" || {`, `  printf '%s\\n' ${shellQuote("codewith auth profile preflight failed")} >&2`, "  exit 1", "}", `if ! printf '%s\\n' "$__OPENLOOPS_CODEWITH_PROFILES" | awk 'NR > 1 { candidate = ($1 == "*" ? $2 : $1); if (candidate == ENVIRON["__OPENLOOPS_CODEWITH_PROFILE"]) found = 1 } END { exit(found ? 0 : 1) }'; then`, `  printf '%s\\n' ${shellQuote(`codewith auth profile not found: ${profileForError}`)} >&2`, "  exit 1", "fi");
   }
   return lines.join(`
 `);
@@ -1340,9 +1358,9 @@ function assertCodewithProfileListed(profile, result) {
     const detail = (result.stderr || result.stdout || `exit ${result.status ?? "unknown"}`).trim();
     throw new Error(`codewith auth profile preflight failed${detail ? `: ${detail}` : ""}`);
   }
-  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map((line) => line.trim().split(/\s+/)[0]).filter(Boolean));
+  const profiles = new Set((result.stdout || "").split(/\r?\n/).slice(1).map(codewithProfileCandidateFromLine).filter(Boolean));
   if (!profiles.has(profile)) {
-    throw new Error(`codewith auth profile not found: ${profile}`);
+    throw new Error(`codewith auth profile not found: ${codewithProfileForError(profile)}`);
   }
 }
 function preflightNativeAuthProfileSync(spec, env) {