@kylecheng3146/agent-ops 0.1.5 → 0.1.6

package/README.md

@@ -35,7 +35,7 @@ installation plan.
 
 The interactive multi-select screens start with no harness or profile selected.
 Choose at least one of `codex`, `claude`, and `opencode`, and at least one of
-the `core`, `advisory`, and `guardrails` profiles before confirming. For
+the `core`, `advisory`, `guardrails`, and `loop` profiles before confirming. For
 scripted use, `--harness all` selects all three harnesses; comma-separated
 selections such as `codex,opencode` are also supported. The legacy `both` value
 remains an alias for `codex,claude`.
@@ -64,6 +64,54 @@ agent-ops update --yes --json
 agent-ops uninstall --dry-run --json
 ```
 
+### Project-local loop
+
+`loop` is an explicit, project-only profile for Codex, Claude Code, or both.
+It requires a POSIX-compatible `bash`; the generated native launchers are
+`.sh` files, so Windows is not currently a supported loop host. Preview it
+first, then install only after reviewing the plan. `loop` also implies the
+`core` baseline, so the project retains the managed rules and routing files:
+
+```bash
+agent-ops init --dry-run --scope project --harness codex,claude --profile loop --json
+agent-ops init --scope project --harness codex,claude --profile loop --yes
+```
+
+It creates one small managed launcher per selected native host:
+
+- Codex: `.codex/hooks/agent-ops-loop.sh`, `.codex/config.toml` when absent,
+  `.codex/loop-goal.md`, `.codex/loop-state.md`, and
+  `.codex/loop-telemetry.jsonl`.
+- Claude Code: `.claude/hooks/agent-ops-loop.sh`, `.claude/loop-goal.md`,
+  `.claude/loop-state.md`, and `.claude/loop-telemetry.jsonl`.
+
+The launchers delegate to one installed Node runtime; agent-ops does not copy
+project-specific policy code into either hook directory. It adds an exact,
+hash-commented `.gitignore` block for the goal, state, and telemetry files.
+Those files and `.codex/config.toml` remain user-owned: update never overwrites
+them, and uninstall keeps them while removing only launchers, hook handlers,
+and the managed ignore block.
+
+The loop registers `SessionStart`, `UserPromptSubmit`, `PreToolUse`,
+`PermissionRequest`, `PostToolUse`, `PreCompact`, `PostCompact`,
+`SubagentStart`, and `SubagentStop`; it intentionally does not register
+`Stop`. On high-confidence matches, it blocks literal credential-shaped user
+prompts or Bash commands, plus dangerous Bash commands such as broad recursive
+deletion or `git reset --hard`. Codex uses its documented exit-code denial path; Claude Code
+uses its documented native JSON denial shapes. Permission and escalation
+requests are never auto-approved or denied by the loop, so the harness's normal
+approval prompt remains authoritative.
+
+Session context is bounded and derives from the redacted goal plus a telemetry
+count. Telemetry records only timestamp, event, outcome, and rule code; it
+never stores raw prompts, Bash commands, or credentials and is byte-rotated.
+Before compaction, the loop writes a bounded, redacted Git-status snapshot into
+its own block inside `loop-state.md`, preserving surrounding user text. This is
+a guardrail, not a complete sandbox or a replacement for each harness's own
+permissions. Review and trust the generated hook configuration in Codex and
+Claude Code before use. An existing Codex `.codex/config.toml` with an explicit
+`[features]` / `hooks = false` setting stops installation before any write.
+
 Use `--scope user` with user-home installations. Keep `--dry-run` for any
 operation you want to inspect before applying; non-interactive automation should
 pass `--yes` only after reviewing the plan. Add `--json` when another tool will
@@ -121,6 +169,12 @@ The commands after `init --yes` are post-apply operations. `doctor` reports
 `trust grant` runs, and `smoke-availability` until the configuration declares a
 verification command.
 
+`artifact-staleness` reports `DEGRADED` with `UPDATE_REQUIRED` when a toolkit
+upgrade or effective profile or capability change makes intact managed rules
+differ from the current baseline. Run `agent-ops update` to regenerate them.
+Missing, altered, or hash-mismatched managed artifacts remain `FAIL` under
+`artifacts`.
+
 Installing the `advisory` or `guardrails` profile registers the lifecycle and
 command-policy hooks implied by those profiles for the selected harnesses.
 Claude Code and Codex use their native JSON settings files; opencode uses the agent-ops-owned
@@ -132,11 +186,24 @@ scope, the opencode plugin is placed under
 `$XDG_CONFIG_HOME/opencode/` or `$OPENCODE_CONFIG_DIR/` when that location is
 inside the managed user root. The shims call `agent-ops hook <harness> <event>`
 through the installed absolute runtime path. Advisory failures remain
-fail-open; command-policy failures are fail-closed only where the native
-harness can block the tool. Claude and Codex lifecycle summaries are
-`supported`; OpenCode's app-scoped initialization is `degraded` rather than
-per-session coverage. Codex command denial remains `unknown` until native
-blocking is confirmed.
+fail-open. Runtime-failure enforcement is deliberately narrow: Claude Code can
+emit its documented `PreToolUse` denial shape for a classified invalid installed
+configuration, and the managed OpenCode `tool.execute.before` plugin throws
+its documented command-policy denial or unavailable-runtime error for its
+supported Bash surface. Codex command policy is `unknown` and explicitly
+non-enforcing for the ordinary `guardrails` profile. The project-local `loop`
+profile uses its separate native hook policy described above. These are output
+and plugin contracts, not proof that a host
+honors a denial. Claude and Codex lifecycle summaries are `supported`; OpenCode's
+app-scoped initialization is `degraded` rather than per-session coverage.
+
+Claude's invalid-config fallback has four safeguards: only an invalid (not
+absent) `.agent-ops/config.json` can reach it; a safely read manifest must list
+the current harness; `AGENT_OPS_DISABLE=1` must not be set; and Claude's denial
+reason names the config file with a repair or temporary shell-disable remedy.
+`AGENT_OPS_DISABLE=1` is a human-shell recovery variable only. Agent-ops never
+reads it from configuration, a manifest, or another file it writes. Every
+`SessionStart` and `Stop` failure path remains fail-open.
 
 `guardrails` enables command policy only; it does not imply Stop verification.
 Stop verification is an explicit, disabled-by-default config feature. Enable it
@@ -173,6 +240,15 @@ files authoritative. Existing installations with the previous canonical
 wording are migrated by `agent-ops update`; changed managed blocks still fail
 closed.
 
+### Rejected proposals and deliberate boundaries
+
+The following proposals are deliberately rejected: emitting a model-visible
+`SessionStart` advisory summary, inspecting user-authored Markdown link
+integrity in `doctor`, and creating backups for agent-authored rule edits.
+Transactional backups remain limited to agent-ops apply operations. Agent-ops
+also does not add a git-workflow instruction to the generated baseline, which
+stays project-neutral.
+
 Dry-run plans keep harness settings writes opaque: human and JSON output expose
 only the expected hash, content hash, and a safe summary. Use
 `--hook-target <harness>=<surface-id>` when selecting a non-default discovered

package/dist/packages/cli/src/args.js

@@ -12,7 +12,7 @@ export const COMMAND_NAMES = [
 ];
 const COMMAND_SET = new Set(COMMAND_NAMES);
 const SCOPES = new Set(["project", "user"]);
-const PROFILES = new Set(["advisory", "core", "guardrails"]);
+const PROFILES = new Set(["advisory", "core", "guardrails", "loop"]);
 export class CliArgumentError extends Error {
     code;
     option;

package/dist/packages/cli/src/bin.js

@@ -131,6 +131,7 @@ else {
                     const config = (await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config;
                     return await runDoctorCommand({
                         root,
+                        toolkitVersion: CLI_VERSION,
                         probes: {
                             hookRegistration: async () => hookRegistrationSatisfied({
                                 harness: await installedHarness(root),
@@ -157,6 +158,7 @@ else {
                         adapters: commonHarnessAdapters(),
                         registry: new NpmRegistryClient(),
                         isTTY,
+                        toolkitVersion: CLI_VERSION,
                         hookRuntimePath: HOOK_RUNTIME_PATH,
                         ...(args.hookTargets === undefined
                             ? {}

package/dist/packages/cli/src/cli.js

@@ -31,7 +31,7 @@ Options:
   --scope <project|user>
   --harness <all|both|claude|codex|opencode|comma-separated>  Init/update
   --hook-target <harness=surface-id>  Repeatable advanced init/update option
-  --profile <core|advisory|guardrails>  Repeatable
+  --profile <core|advisory|guardrails|loop>  Repeatable
   --task <id>
   --target-version <version>          Update target version (offline-capable)
   --title <text>

package/dist/packages/cli/src/codex-loop-process.js

@@ -0,0 +1,70 @@
+import { PROJECT_LOOP_EVENTS, runProjectLoop } from "../../../runtime/src/hooks/codex-loop.js";
+const MAX_LOOP_INPUT_BYTES = 64 * 1024;
+function isLoopHarness(value) {
+    return value === "claude" || value === "codex";
+}
+function isLoopEvent(value) {
+    return (value !== undefined &&
+        PROJECT_LOOP_EVENTS.includes(value));
+}
+async function readStdin(stream) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of stream) {
+        const buffer = Buffer.isBuffer(chunk)
+            ? chunk
+            : Buffer.from(String(chunk), "utf8");
+        total += buffer.byteLength;
+        if (total > MAX_LOOP_INPUT_BYTES) {
+            return null;
+        }
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks, total).toString("utf8");
+}
+function parseInput(source) {
+    if (source === null) {
+        return null;
+    }
+    try {
+        return JSON.parse(source);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Process boundary for the generated Bash launchers. Invalid input stays
+ * fail-open; the runtime owns every policy decision and output shape.
+ */
+export async function runLoopProcess(argv, io, dependencies = {}) {
+    const [harness, event] = argv;
+    if (!isLoopHarness(harness) || !isLoopEvent(event)) {
+        return 0;
+    }
+    try {
+        const result = await runProjectLoop({
+            harness,
+            event,
+            input: parseInput(await readStdin(io.stdin)),
+            root: dependencies.root ?? process.cwd(),
+            ...(dependencies.now === undefined ? {} : { now: dependencies.now }),
+            ...(dependencies.gitStatus === undefined
+                ? {}
+                : { gitStatus: dependencies.gitStatus }),
+            ...(dependencies.telemetryMaxBytes === undefined
+                ? {}
+                : { telemetryMaxBytes: dependencies.telemetryMaxBytes })
+        });
+        if (result.stdout.length > 0) {
+            io.writeStdout(result.stdout);
+        }
+        if (result.stderr.length > 0) {
+            io.writeStderr(result.stderr);
+        }
+        return result.exitCode;
+    }
+    catch {
+        return 0;
+    }
+}

package/dist/packages/cli/src/commands/hook.js

@@ -7,6 +7,18 @@ export const HOOK_EVENTS = [
     "PreToolUse",
     "Stop"
 ];
+/**
+ * Keep adapter normalization at the command boundary so exceptional hook
+ * paths use the same native-event interpretation as normal dispatch.
+ */
+export function normalizeHookInput(harness, input) {
+    try {
+        return harnessDescriptor(harness).runtime.normalizeInput(input);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Hooks are advisory infrastructure: every failure path stays fail-open with
  * exit code 0 so a broken toolkit can never wedge the harness.
@@ -24,7 +36,10 @@ export async function runHookCommand(options) {
             return { exitCode: 0, stdout: "", stderr: "" };
         }
         const descriptor = harnessDescriptor(options.harness);
-        const normalized = descriptor.runtime.normalizeInput(input);
+        const normalized = normalizeHookInput(options.harness, input);
+        if (normalized === null) {
+            return { exitCode: 0, stdout: "", stderr: "" };
+        }
         const stopRegistration = descriptor.control.registrations.find(({ capability }) => capability === "optional-stop-verify");
         const stopVerification = options.stopVerification !== undefined &&
             stopRegistration?.support !== "unsupported"

package/dist/packages/cli/src/commands/update.js

@@ -38,6 +38,9 @@ export async function runUpdateCommand(options) {
         ...(options.targetVersion === undefined
             ? {}
             : { targetVersion: options.targetVersion }),
+        ...(options.toolkitVersion === undefined
+            ? {}
+            : { toolkitVersion: options.toolkitVersion }),
         ...(options.hookRuntimePath === undefined
             ? {}
             : { hookRuntimePath: options.hookRuntimePath }),

package/dist/packages/cli/src/context.js

@@ -79,6 +79,66 @@ export async function loadEffectiveConfig(root, scope) {
     }
     return mergeConfigLayers(layers);
 }
+/**
+ * Classifies only configuration that can participate in a project hook. The
+ * regular command loader intentionally keeps its throwing contract so CLI
+ * commands continue to surface configuration errors to the human.
+ */
+export async function loadProjectHookConfig(root) {
+    const home = process.env.AGENT_OPS_HOME ?? homedir();
+    const userPath = join(home, ".agent-ops", "config.json");
+    const projectPath = join(root, ".agent-ops", "config.json");
+    const layers = [defaultConfigLayer()];
+    let project;
+    try {
+        project = await loadOptionalConfig(projectPath);
+    }
+    catch {
+        return { kind: "invalid", path: projectPath };
+    }
+    if (project === null && projectPath === userPath) {
+        return { kind: "absent", config: DEFAULT_CONFIG };
+    }
+    if (projectPath !== userPath) {
+        try {
+            const user = await loadOptionalConfig(userPath);
+            if (user !== null) {
+                layers.push({
+                    source: "user",
+                    sourcePath: user.sourcePath,
+                    config: user.config
+                });
+            }
+        }
+        catch {
+            // A user-level error cannot make a project with no own config deny a
+            // tool call, but it remains a classified failure for an installed
+            // project that does own a config.
+            return project === null
+                ? { kind: "absent", config: DEFAULT_CONFIG }
+                : { kind: "invalid", path: userPath };
+        }
+    }
+    if (project === null) {
+        try {
+            return { kind: "absent", config: mergeConfigLayers(layers).config };
+        }
+        catch {
+            return { kind: "absent", config: DEFAULT_CONFIG };
+        }
+    }
+    layers.push({
+        source: "project",
+        sourcePath: project.sourcePath,
+        config: project.config
+    });
+    try {
+        return { kind: "loaded", config: mergeConfigLayers(layers).config };
+    }
+    catch {
+        return { kind: "invalid", path: projectPath };
+    }
+}
 export function repositoryRemoteUrl(root) {
     try {
         return execFileSync("git", ["config", "--get", "remote.origin.url"], {

package/dist/packages/cli/src/hook-process.js

@@ -1,14 +1,21 @@
 import { execFile as execFileCallback } from "node:child_process";
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { join } from "node:path";
 import { promisify } from "node:util";
 import { calculateConfigHash } from "../../../runtime/src/config/hash.js";
+import { parseInstallManifest, PROJECT_MANIFEST_PATH } from "../../../runtime/src/fs/manifest.js";
+import { resolveContainedPath } from "../../../runtime/src/fs/paths.js";
+import { redactSecrets } from "../../../runtime/src/security/redact.js";
 import { claudeStopRecursionMarker } from "../../../runtime/src/adapters/claude/input.js";
 import { HARNESS_IDS, harnessDescriptor } from "../../../runtime/src/install/harness.js";
 import { STOP_VERIFICATION_ENV, StopVerificationService } from "../../../runtime/src/hooks/stop-service.js";
 import { NodeVerificationProcessRunner } from "../../../runtime/src/verify/spawn.js";
-import { runHookCommand, HOOK_EVENTS } from "./commands/hook.js";
-import { loadEffectiveConfig, repositoryTrust } from "./context.js";
+import { normalizeHookInput, runHookCommand, HOOK_EVENTS } from "./commands/hook.js";
+import { loadProjectHookConfig, repositoryTrust } from "./context.js";
 const HARNESSES = new Set(HARNESS_IDS);
 const MAX_HOOK_INPUT_BYTES = 1024 * 1024;
+const MAX_HOOK_MANIFEST_BYTES = 1024 * 1024;
 const execFile = promisify(execFileCallback);
 async function readStdin(stream) {
     const chunks = [];
@@ -33,6 +40,99 @@ function parseInput(source) {
         return null;
     }
 }
+function writeHookOutput(io, output) {
+    if (output.stdout.length > 0) {
+        io.writeStdout(output.stdout);
+    }
+    if (output.stderr.length > 0) {
+        io.writeStderr(output.stderr);
+    }
+}
+function failOpenOutput(harness, event) {
+    return harnessDescriptor(harness).runtime.formatOutput(event, {
+        action: "continue",
+        status: "PASS",
+        code: "HOOK_FAIL_OPEN"
+    });
+}
+async function readInstalledManifestForHarness(root, harness) {
+    try {
+        const path = await resolveContainedPath(root, PROJECT_MANIFEST_PATH);
+        const before = await lstat(path, { bigint: true });
+        if (!before.isFile() ||
+            before.size > BigInt(MAX_HOOK_MANIFEST_BYTES)) {
+            return false;
+        }
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const opened = await handle.stat({ bigint: true });
+            const resolvedAgain = await resolveContainedPath(root, PROJECT_MANIFEST_PATH);
+            const after = await lstat(resolvedAgain, { bigint: true });
+            if (!opened.isFile() ||
+                opened.size > BigInt(MAX_HOOK_MANIFEST_BYTES) ||
+                after.dev !== before.dev ||
+                after.ino !== before.ino) {
+                return false;
+            }
+            const chunks = [];
+            let totalBytes = 0;
+            while (totalBytes <= MAX_HOOK_MANIFEST_BYTES) {
+                const chunk = Buffer.alloc(Math.min(64 * 1024, MAX_HOOK_MANIFEST_BYTES + 1 - totalBytes));
+                const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+                if (bytesRead === 0) {
+                    return parseInstallManifest(Buffer.concat(chunks, totalBytes).toString("utf8")).harness.includes(harness);
+                }
+                chunks.push(chunk.subarray(0, bytesRead));
+                totalBytes += bytesRead;
+            }
+            return false;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return false;
+    }
+}
+async function hookConfigOutcome(root, loadConfig) {
+    if (loadConfig === undefined) {
+        return await loadProjectHookConfig(root);
+    }
+    try {
+        return { kind: "loaded", config: await loadConfig(root) };
+    }
+    catch {
+        return {
+            kind: "invalid",
+            path: join(root, ".agent-ops", "config.json")
+        };
+    }
+}
+async function invalidConfigOutput(options) {
+    const descriptor = harnessDescriptor(options.harness);
+    const normalized = normalizeHookInput(options.harness, options.input);
+    if (normalized === null) {
+        return failOpenOutput(options.harness, options.event);
+    }
+    if (options.event !== "PreToolUse" ||
+        normalized.event !== "command" ||
+        !(await readInstalledManifestForHarness(options.root, options.harness))) {
+        return failOpenOutput(options.harness, options.event);
+    }
+    const registration = descriptor.control.registrations.find(({ nativeEvent, normalizedEvent }) => nativeEvent === options.event && normalizedEvent === normalized.event);
+    if (registration === undefined || registration.runtimeFailure === "fail-open") {
+        return failOpenOutput(options.harness, options.event);
+    }
+    if (options.harness === "opencode" &&
+        registration.runtimeFailure === "fail-closed") {
+        // The generated OpenCode plugin already turns an unavailable runtime into
+        // its documented blocking error. Keep that contract in the shim.
+        return undefined;
+    }
+    const remedy = `Fix ${redactSecrets(options.configPath)}, or set AGENT_OPS_DISABLE=1 in your shell to temporarily disable agent-ops.`;
+    return descriptor.runtime.formatRuntimeFailure(options.event, registration.capability, remedy);
+}
 function defaultGitRunner(root) {
     return {
         run: async (args) => {
@@ -109,18 +209,36 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
     }
     try {
         const root = dependencies.root ?? process.cwd();
-        const config = dependencies.loadConfig === undefined
-            ? (await loadEffectiveConfig(root, "project")).config
-            : await dependencies.loadConfig(root);
+        const harnessId = harness;
+        const hookEvent = event;
+        if (process.env.AGENT_OPS_DISABLE === "1") {
+            writeHookOutput(io, failOpenOutput(harnessId, hookEvent));
+            return 0;
+        }
+        const rawInput = await readStdin(io.stdin);
+        const parsedInput = parseInput(rawInput);
+        const configOutcome = await hookConfigOutcome(root, dependencies.loadConfig);
+        if (configOutcome.kind === "invalid") {
+            const output = await invalidConfigOutput({
+                root,
+                harness: harnessId,
+                event: hookEvent,
+                input: parsedInput,
+                configPath: configOutcome.path
+            });
+            if (output !== undefined) {
+                writeHookOutput(io, output);
+            }
+            return 0;
+        }
+        const config = configOutcome.config;
         const trustStatus = dependencies.trust === undefined
             ? await repositoryTrust(root, config, cliVersion)
             : await dependencies.trust(root, config, cliVersion);
-        const rawInput = await readStdin(io.stdin);
-        const parsedInput = parseInput(rawInput);
         const trusted = trustStatus === "TRUSTED";
         const gitRunner = dependencies.gitRunner ?? defaultGitRunner(root);
         const processRunner = dependencies.processRunner ?? new NodeVerificationProcessRunner();
-        const stopVerification = shouldBuildStopVerification(harness, event, config, parsedInput)
+        const stopVerification = shouldBuildStopVerification(harnessId, event, config, parsedInput)
             ? stopVerificationOptions({
                 harness: harness,
                 rawInput: parsedInput,
@@ -133,7 +251,7 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
             : undefined;
         const output = await runHookCommand({
             harness: harness,
-            event: event,
+            event: hookEvent,
             stdin: rawInput,
             config,
             trusted,
@@ -142,12 +260,7 @@ export async function runHookProcess(argv, io, cliVersion, dependencies = {}) {
                 : { advisory: dependencies.advisory }),
             ...(stopVerification === undefined ? {} : { stopVerification })
         });
-        if (output.stdout.length > 0) {
-            io.writeStdout(output.stdout);
-        }
-        if (output.stderr.length > 0) {
-            io.writeStderr(output.stderr);
-        }
+        writeHookOutput(io, output);
     }
     catch {
         // ponytail: fail-open by design; hook failures stay invisible to the harness.

package/dist/packages/cli/src/loop-entry.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// Entry point used only by the generated project-local loop launchers.
+import { runLoopProcess } from "./codex-loop-process.js";
+process.exitCode = await runLoopProcess(process.argv.slice(2), {
+    stdin: process.stdin,
+    writeStdout: (value) => process.stdout.write(value),
+    writeStderr: (value) => process.stderr.write(value)
+});

package/dist/packages/cli/src/version.js

@@ -1,3 +1,3 @@
 // Single source of the published CLI version. Release preparation updates
 // this constant; bin.ts and the hook entry both read it from here.
-export const CLI_VERSION = "0.1.5";
+export const CLI_VERSION = "0.1.6";

package/dist/packages/cli/src/wizard.js

@@ -2,7 +2,7 @@ import { CliArgumentError } from "./args.js";
 import { HARNESS_IDS, resolveHarnessSelection } from "../../../runtime/src/install/harness.js";
 import { selectOption, selectOptions } from "./ui.js";
 const SCOPES = new Set(["project", "user"]);
-const PROFILES = new Set(["advisory", "core", "guardrails"]);
+const PROFILES = new Set(["advisory", "core", "guardrails", "loop"]);
 const DEFAULT_HARNESS = [];
 const SCOPE_CHOICES = [
     { label: "project", value: "project" },
@@ -24,6 +24,11 @@ const PROFILE_CHOICES = [
         label: "guardrails",
         value: "guardrails",
         description: "Blocks high-confidence unsafe commands; Stop verification is a separate opt-in feature."
+    },
+    {
+        label: "loop",
+        value: "loop",
+        description: "Installs the shared Codex and Claude Code local loop with secret and destructive-command interception."
     }
 ];
 const WIZARD_SUBTITLE = "Safe setup for Codex, Claude Code, and opencode with profile-driven rules, verification, and hooks.";
@@ -74,7 +79,7 @@ function selectProfiles(raw) {
     if (values.length === 0 ||
         values.some((value) => !PROFILES.has(value)) ||
         new Set(values).size !== values.length) {
-        throw new CliArgumentError("CLI_INVALID_VALUE", "Profiles must be a unique comma-separated list of core, advisory, or guardrails.");
+        throw new CliArgumentError("CLI_INVALID_VALUE", "Profiles must be a unique comma-separated list of core, advisory, guardrails, or loop.");
     }
     return values;
 }
@@ -110,7 +115,7 @@ export async function completeInitChoices(args, io) {
             : await selectOptions("Profiles (multi-select: ↑↓ move, Space toggle, Enter confirm)", PROFILE_CHOICES, selectorIo, [], {
                 selectAll: true,
                 selectAllLabel: "Select all",
-                selectAllDescription: "Enable core, advisory, and guardrails together."
+                selectAllDescription: "Enable core, advisory, guardrails, and loop together."
             });
         return {
             ...args,
@@ -127,7 +132,7 @@ export async function completeInitChoices(args, io) {
             selectHarness(await session.question(`Harness (${HARNESS_IDS.join(",")}): `));
         const profiles = args.profiles.length > 0
             ? args.profiles
-            : selectProfiles(await session.question("Profiles (core,advisory,guardrails) [core]: "));
+            : selectProfiles(await session.question("Profiles (core,advisory,guardrails,loop) [core]: "));
         return {
             ...args,
             scope,