loki-mode 10.10.2 → 10.10.3

package/packages/control-plane/dist/server.js

@@ -3696,10 +3696,10 @@ var require_resolve_block_map = __commonJS((exports) => {
     let offset = bm.offset;
     let commentEnd = null;
     for (const collItem of bm.items) {
-      const { start, key, sep: sep4, value } = collItem;
+      const { start, key, sep: sep5, value } = collItem;
       const keyProps = resolveProps.resolveProps(start, {
         indicator: "explicit-key-ind",
-        next: key ?? sep4?.[0],
+        next: key ?? sep5?.[0],
         offset,
         onError,
         parentIndent: bm.indent,
@@ -3713,7 +3713,7 @@ var require_resolve_block_map = __commonJS((exports) => {
           else if ("indent" in key && key.indent !== bm.indent)
             onError(offset, "BAD_INDENT", startColMsg);
         }
-        if (!keyProps.anchor && !keyProps.tag && !sep4) {
+        if (!keyProps.anchor && !keyProps.tag && !sep5) {
           commentEnd = keyProps.end;
           if (keyProps.comment) {
             if (map.comment)
@@ -3738,7 +3738,7 @@ var require_resolve_block_map = __commonJS((exports) => {
       ctx.atKey = false;
       if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
         onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-      const valueProps = resolveProps.resolveProps(sep4 ?? [], {
+      const valueProps = resolveProps.resolveProps(sep5 ?? [], {
         indicator: "map-value-ind",
         next: value,
         offset: keyNode.range[2],
@@ -3754,7 +3754,7 @@ var require_resolve_block_map = __commonJS((exports) => {
           if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
             onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
         }
-        const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep4, null, valueProps, onError);
+        const valueNode = value ? composeNode(ctx, value, valueProps, onError) : composeEmptyNode(ctx, offset, sep5, null, valueProps, onError);
         if (ctx.schema.compat)
           utilFlowIndentCheck.flowIndentCheck(bm.indent, value, onError);
         offset = valueNode.range[2];
@@ -3840,7 +3840,7 @@ var require_resolve_end = __commonJS((exports) => {
     let comment = "";
     if (end) {
       let hasSpace = false;
-      let sep4 = "";
+      let sep5 = "";
       for (const token of end) {
         const { source, type } = token;
         switch (type) {
@@ -3854,13 +3854,13 @@ var require_resolve_end = __commonJS((exports) => {
             if (!comment)
               comment = cb;
             else
-              comment += sep4 + cb;
-            sep4 = "";
+              comment += sep5 + cb;
+            sep5 = "";
             break;
           }
           case "newline":
             if (comment)
-              sep4 += source;
+              sep5 += source;
             hasSpace = true;
             break;
           default:
@@ -3900,18 +3900,18 @@ var require_resolve_flow_collection = __commonJS((exports) => {
     let offset = fc.offset + fc.start.source.length;
     for (let i = 0;i < fc.items.length; ++i) {
       const collItem = fc.items[i];
-      const { start, key, sep: sep4, value } = collItem;
+      const { start, key, sep: sep5, value } = collItem;
       const props = resolveProps.resolveProps(start, {
         flow: fcName,
         indicator: "explicit-key-ind",
-        next: key ?? sep4?.[0],
+        next: key ?? sep5?.[0],
         offset,
         onError,
         parentIndent: fc.indent,
         startOnNewline: false
       });
       if (!props.found) {
-        if (!props.anchor && !props.tag && !sep4 && !value) {
+        if (!props.anchor && !props.tag && !sep5 && !value) {
           if (i === 0 && props.comma)
             onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
           else if (i < fc.items.length - 1)
@@ -3963,8 +3963,8 @@ var require_resolve_flow_collection = __commonJS((exports) => {
           }
         }
       }
-      if (!isMap && !sep4 && !props.found) {
-        const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep4, null, props, onError);
+      if (!isMap && !sep5 && !props.found) {
+        const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep5, null, props, onError);
         coll.items.push(valueNode);
         offset = valueNode.range[2];
         if (isBlock(value))
@@ -3976,7 +3976,7 @@ var require_resolve_flow_collection = __commonJS((exports) => {
         if (isBlock(key))
           onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
         ctx.atKey = false;
-        const valueProps = resolveProps.resolveProps(sep4 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep5 ?? [], {
           flow: fcName,
           indicator: "map-value-ind",
           next: value,
@@ -3987,8 +3987,8 @@ var require_resolve_flow_collection = __commonJS((exports) => {
         });
         if (valueProps.found) {
           if (!isMap && !props.found && ctx.options.strict) {
-            if (sep4)
-              for (const st of sep4) {
+            if (sep5)
+              for (const st of sep5) {
                 if (st === valueProps.found)
                   break;
                 if (st.type === "newline") {
@@ -4005,7 +4005,7 @@ var require_resolve_flow_collection = __commonJS((exports) => {
           else
             onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
         }
-        const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep4, null, valueProps, onError) : null;
+        const valueNode = value ? composeNode(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep5, null, valueProps, onError) : null;
         if (valueNode) {
           if (isBlock(value))
             onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -4182,7 +4182,7 @@ var require_resolve_block_scalar = __commonJS((exports) => {
         chompStart = i + 1;
     }
     let value = "";
-    let sep4 = "";
+    let sep5 = "";
     let prevMoreIndented = false;
     for (let i = 0;i < contentStart; ++i)
       value += lines[i][0].slice(trimIndent) + `
@@ -4200,33 +4200,33 @@ var require_resolve_block_scalar = __commonJS((exports) => {
         indent = "";
       }
       if (type === Scalar.Scalar.BLOCK_LITERAL) {
-        value += sep4 + indent.slice(trimIndent) + content;
-        sep4 = `
+        value += sep5 + indent.slice(trimIndent) + content;
+        sep5 = `
 `;
       } else if (indent.length > trimIndent || content[0] === "\t") {
-        if (sep4 === " ")
-          sep4 = `
+        if (sep5 === " ")
+          sep5 = `
 `;
-        else if (!prevMoreIndented && sep4 === `
+        else if (!prevMoreIndented && sep5 === `
 `)
-          sep4 = `
+          sep5 = `
 
 `;
-        value += sep4 + indent.slice(trimIndent) + content;
-        sep4 = `
+        value += sep5 + indent.slice(trimIndent) + content;
+        sep5 = `
 `;
         prevMoreIndented = true;
       } else if (content === "") {
-        if (sep4 === `
+        if (sep5 === `
 `)
           value += `
 `;
         else
-          sep4 = `
+          sep5 = `
 `;
       } else {
-        value += sep4 + content;
-        sep4 = " ";
+        value += sep5 + content;
+        sep5 = " ";
         prevMoreIndented = false;
       }
     }
@@ -4406,27 +4406,27 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
       trimBoth = /^[ \t]+|[ \t]+$/g;
     }
     let res = match2[1].replace(trimEnd, "");
-    let sep4 = " ";
+    let sep5 = " ";
     let pos = line2.lastIndex;
     while (match2 = line2.exec(source)) {
       const lm = match2[1].replace(trimBoth, "");
       if (lm === "") {
-        if (sep4 === `
+        if (sep5 === `
 `)
-          res += sep4;
+          res += sep5;
         else
-          sep4 = `
+          sep5 = `
 `;
       } else {
-        res += sep4 + lm;
-        sep4 = " ";
+        res += sep5 + lm;
+        sep5 = " ";
       }
       pos = line2.lastIndex;
     }
     const last = /[ \t]*(.*)/sy;
     last.lastIndex = pos;
     match2 = last.exec(source);
-    return res + sep4 + (match2?.[1] ?? "");
+    return res + sep5 + (match2?.[1] ?? "");
   }
   function doubleQuotedValue(source, onError) {
     let res = "";
@@ -5207,14 +5207,14 @@ var require_cst_stringify = __commonJS((exports) => {
       }
     }
   }
-  function stringifyItem({ start, key, sep: sep4, value }) {
+  function stringifyItem({ start, key, sep: sep5, value }) {
     let res = "";
     for (const st of start)
       res += st.source;
     if (key)
       res += stringifyToken(key);
-    if (sep4)
-      for (const st of sep4)
+    if (sep5)
+      for (const st of sep5)
         res += st.source;
     if (value)
       res += stringifyToken(value);
@@ -6362,18 +6362,18 @@ var require_parser = __commonJS((exports) => {
       if (this.type === "map-value-ind") {
         const prev = getPrevProps(this.peek(2));
         const start = getFirstKeyStartProps(prev);
-        let sep4;
+        let sep5;
         if (scalar.end) {
-          sep4 = scalar.end;
-          sep4.push(this.sourceToken);
+          sep5 = scalar.end;
+          sep5.push(this.sourceToken);
           delete scalar.end;
         } else
-          sep4 = [this.sourceToken];
+          sep5 = [this.sourceToken];
         const map = {
           type: "block-map",
           offset: scalar.offset,
           indent: scalar.indent,
-          items: [{ start, key: scalar, sep: sep4 }]
+          items: [{ start, key: scalar, sep: sep5 }]
         };
         this.onKeyLine = true;
         this.stack[this.stack.length - 1] = map;
@@ -6527,15 +6527,15 @@ var require_parser = __commonJS((exports) => {
               } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
                 const start2 = getFirstKeyStartProps(it.start);
                 const key = it.key;
-                const sep4 = it.sep;
-                sep4.push(this.sourceToken);
+                const sep5 = it.sep;
+                sep5.push(this.sourceToken);
                 delete it.key;
                 delete it.sep;
                 this.stack.push({
                   type: "block-map",
                   offset: this.offset,
                   indent: this.indent,
-                  items: [{ start: start2, key, sep: sep4 }]
+                  items: [{ start: start2, key, sep: sep5 }]
                 });
               } else if (start.length > 0) {
                 it.sep = it.sep.concat(start, this.sourceToken);
@@ -6729,13 +6729,13 @@ var require_parser = __commonJS((exports) => {
           const prev = getPrevProps(parent);
           const start = getFirstKeyStartProps(prev);
           fixFlowSeqItems(fc);
-          const sep4 = fc.end.splice(1, fc.end.length);
-          sep4.push(this.sourceToken);
+          const sep5 = fc.end.splice(1, fc.end.length);
+          sep5.push(this.sourceToken);
           const map = {
             type: "block-map",
             offset: fc.offset,
             indent: fc.indent,
-            items: [{ start, key: fc, sep: sep4 }]
+            items: [{ start, key: fc, sep: sep5 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
@@ -6960,7 +6960,7 @@ var require_public_api = __commonJS((exports) => {
 
 // src/server/app.ts
 import { existsSync as existsSync21, statSync as statSync14 } from "fs";
-import { join as join33, resolve as resolve6, sep as sep12 } from "path";
+import { join as join34, resolve as resolve7, sep as sep13 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -12779,12 +12779,89 @@ function writeAnswer(dir, source, run, answer) {
   return { status: 200, body: { ok: true, path, resume: `loki answer ${run}` } };
 }
 
+// src/server/diffstat.ts
+import { execFileSync } from "child_process";
+import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readSync as readSync2, realpathSync as realpathSync2 } from "fs";
+import { join as join3, sep as sep2 } from "path";
+var ID2 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var SHA = /^[0-9a-f]{40,64}$/;
+var MAX_RECEIPT_BYTES = 1024 * 1024;
+var GIT_TIMEOUT_MS = 5000;
+var cache = new Map;
+var gitEnv = () => ({ PATH: process.env.PATH ?? "", HOME: process.env.HOME ?? "", LC_ALL: "C", GIT_TERMINAL_PROMPT: "0", GIT_OPTIONAL_LOCKS: "0" });
+function parseNumstat(out) {
+  const files = [];
+  for (const line of out.split(`
+`)) {
+    const m = /^(\d+|-)\t(\d+|-)\t(.+)$/.exec(line);
+    if (!m)
+      continue;
+    files.push({ path: m[3], added: m[1] === "-" ? null : Number(m[1]), removed: m[2] === "-" ? null : Number(m[2]) });
+  }
+  return files;
+}
+function readReceipt(runDir) {
+  let fd;
+  try {
+    fd = openSync2(join3(runDir, "receipt.json"), "r");
+  } catch {
+    return null;
+  }
+  try {
+    const st = fstatSync2(fd);
+    if (!st.isFile() || st.size > MAX_RECEIPT_BYTES)
+      return null;
+    const buf = Buffer.alloc(st.size);
+    readSync2(fd, buf, 0, st.size, 0);
+    const j = JSON.parse(buf.toString("utf8"));
+    return j && typeof j === "object" ? j : null;
+  } catch {
+    return null;
+  } finally {
+    closeSync2(fd);
+  }
+}
+function diffStatFor(db, source, run) {
+  if (!ID2.test(source) || !ID2.test(run) || source.includes("..") || run.includes(".."))
+    return null;
+  const key = `${source}/${run}`;
+  const hit = cache.get(key);
+  if (hit)
+    return hit;
+  const repo = db.select({ p: localRepos.realpath }).from(localRepos).where(and(eq(localRepos.sourceId, source))).get();
+  if (!repo)
+    return null;
+  let repoReal, runsRoot, runDir;
+  try {
+    repoReal = realpathSync2(repo.p);
+    runsRoot = realpathSync2(join3(repoReal, ".loki", "runs"));
+    runDir = realpathSync2(join3(runsRoot, run));
+  } catch {
+    return null;
+  }
+  if (runDir !== join3(runsRoot, run) || !runDir.startsWith(runsRoot + sep2))
+    return null;
+  const r = readReceipt(runDir);
+  const base = typeof r?.base_sha === "string" ? r.base_sha : "", head = typeof r?.head_sha === "string" ? r.head_sha : "";
+  if (!SHA.test(base) || !SHA.test(head))
+    return null;
+  try {
+    const out = execFileSync("git", ["-C", repoReal, "-c", "core.quotePath=false", "diff", "--numstat", "--no-renames", `${base}..${head}`, "--"], { env: gitEnv(), timeout: GIT_TIMEOUT_MS, maxBuffer: 8 * 1024 * 1024, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const files = parseNumstat(out);
+    const stat = { base, head, files, added: files.reduce((n2, f) => n2 + (f.added ?? 0), 0), removed: files.reduce((n2, f) => n2 + (f.removed ?? 0), 0), source: "git" };
+    cache.set(key, stat);
+    return stat;
+  } catch {
+    return null;
+  }
+}
+
 // src/server/integrity.ts
 import { createHash, createPublicKey, verify } from "crypto";
 import { readFileSync as readFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
-var SHA = /^[0-9a-f]{64}$/;
+import { join as join4 } from "path";
+var SHA2 = /^[0-9a-f]{64}$/;
 var SEAL_LINE = "log.sealed";
 var REDACTED = /\[REDACTED(?::[A-Z_]+)?\]/;
 var REDACTED_NOTE = "log redacted before ingest; seal not checkable";
@@ -12801,7 +12878,7 @@ function localKeyInfo(env = process.env) {
     if (inline)
       pub = createPublicKey(inline);
     else {
-      const file = given || join3(env["HOME"] || homedir2(), ".loki", "keys", "receipt-ed25519.pem");
+      const file = given || join4(env["HOME"] || homedir2(), ".loki", "keys", "receipt-ed25519.pem");
       try {
         pub = createPublicKey(readFileSync2(file));
       } catch (e) {
@@ -12866,7 +12943,7 @@ function verifyRunIntegrity(evs, opts = {}) {
   const redacted = REDACTED.test(JSON.stringify(doneAt >= 0 ? evs.slice(0, doneAt + 2).map((e) => e.data) : evs.map((e) => e.data)));
   for (const i of sealedAt) {
     const d = evs[i].data;
-    if (typeof d["receipt_sha256"] !== "string" || !SHA.test(d["receipt_sha256"]))
+    if (typeof d["receipt_sha256"] !== "string" || !SHA2.test(d["receipt_sha256"]))
       hashBad.push(`receipt.sealed at seq ${evs[i].seq} has no valid receipt_sha256`);
     const bound = d["events_sha256"];
     if (typeof bound === "string") {
@@ -13054,7 +13131,7 @@ function taskTitle(db, sourceId, runId) {
 }
 var withLive = (db, r) => {
   const p = { ...parseRun(r), title: taskTitle(db, r.sourceId, r.runId) };
-  return r.endedAt ? { ...p, current_stage: null, files_touched: [] } : { ...p, ...liveInfo(loadEvents(db, r.sourceId, r.runId)) };
+  return r.endedAt ? { ...p, current_stage: null, files_touched: [], diff_stat: diffStatFor(db, r.sourceId, r.runId) } : { ...p, ...liveInfo(loadEvents(db, r.sourceId, r.runId)), diff_stat: null };
 };
 function liveInfo(evs) {
   const open = [];
@@ -13261,19 +13338,19 @@ function tokenGuard(token) {
 
 // src/shipper/backfill.ts
 import { readdirSync } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/shipper/ship.ts
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync3, realpathSync as realpathSync2, renameSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, realpathSync as realpathSync3, renameSync, writeFileSync as writeFileSync2 } from "fs";
 import { hostname } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var BATCH = 200;
 var MAX_BYTES = 800000;
 function sourceId(repoDir) {
   let real2 = repoDir;
   try {
-    real2 = realpathSync2(repoDir);
+    real2 = realpathSync3(repoDir);
   } catch {}
   return createHash4("sha256").update(`${hostname()}\x00${real2}`).digest("hex").slice(0, 16);
 }
@@ -13282,24 +13359,24 @@ var redactEvent = (e) => ({ ...e, data: redactDeep(e.data) });
 var backoffMs = (failures, rnd = Math.random) => Math.min(60000, 1000 * 2 ** Math.max(0, failures - 1)) * (1 + 0.25 * rnd());
 function readShip(runDir, url) {
   try {
-    const s = JSON.parse(readFileSync3(join4(runDir, "ship.json"), "utf8"));
+    const s = JSON.parse(readFileSync3(join5(runDir, "ship.json"), "utf8"));
     if (s.url === url && Number.isInteger(s.acked_seq))
       return { acked_seq: s.acked_seq, url };
   } catch {}
   return { acked_seq: -1, url };
 }
 function writeShip(runDir, s) {
-  const tmp = join4(runDir, `ship.json.${process.pid}.tmp`);
+  const tmp = join5(runDir, `ship.json.${process.pid}.tmp`);
   writeFileSync2(tmp, JSON.stringify(s) + `
 `);
-  renameSync(tmp, join4(runDir, "ship.json"));
+  renameSync(tmp, join5(runDir, "ship.json"));
 }
 async function shipRun(o) {
   const st = readShip(o.runDir, o.url);
-  const all = readEvents(join4(o.runDir, "events.jsonl"));
+  const all = readEvents(join5(o.runDir, "events.jsonl"));
   let lines = 0;
   try {
-    lines = readFileSync3(join4(o.runDir, "events.jsonl"), "utf8").split(`
+    lines = readFileSync3(join5(o.runDir, "events.jsonl"), "utf8").split(`
 `).filter((l) => l.trim() !== "").length;
   } catch {}
   const skipped = lines - all.length;
@@ -13342,7 +13419,7 @@ async function shipRun(o) {
   return { ok: true, sent, acked_seq: st.acked_seq, pending: 0 };
 }
 var shipEnabled = (env) => env.LOKI_CONTROL_URL || null;
-var hasSpool = (runDir) => existsSync3(join4(runDir, "events.jsonl"));
+var hasSpool = (runDir) => existsSync3(join5(runDir, "events.jsonl"));
 
 // src/shipper/backfill.ts
 async function backfill(o) {
@@ -13352,7 +13429,7 @@ async function backfill(o) {
     return { runs: 0, sent: 0, failed: [] };
   const sleep = o.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const attempts = o.attempts ?? 3;
-  const root = join5(o.repoDir, ".loki", "runs");
+  const root = join6(o.repoDir, ".loki", "runs");
   let ids = [];
   try {
     ids = readdirSync(root).sort();
@@ -13363,7 +13440,7 @@ async function backfill(o) {
   let runs2 = 0, sent = 0;
   const failed = [];
   for (const id of ids) {
-    const runDir = join5(root, id);
+    const runDir = join6(root, id);
     if (!hasSpool(runDir))
       continue;
     runs2++;
@@ -13382,17 +13459,20 @@ async function backfill(o) {
   return { runs: runs2, sent, failed };
 }
 
+// src/server/repos.ts
+import { basename as basename2, resolve as resolve2 } from "path";
+
 // src/shipper/discover.ts
-import { readFileSync as readFileSync5, realpathSync as realpathSync3, statSync as statSync2 } from "fs";
-import { basename, dirname, join as join7, resolve } from "path";
+import { readFileSync as readFileSync5, realpathSync as realpathSync4, statSync as statSync2 } from "fs";
+import { basename, dirname, join as join8, resolve } from "path";
 
 // src/shipper/watch.ts
 import { readFileSync as readFileSync4, readdirSync as readdirSync2, statSync } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 function registryRepos(env) {
   try {
-    const reg = JSON.parse(readFileSync4(join6(env.HOME || homedir3(), ".loki", "dashboard", "projects.json"), "utf8"));
+    const reg = JSON.parse(readFileSync4(join7(env.HOME || homedir3(), ".loki", "dashboard", "projects.json"), "utf8"));
     return Object.values(reg.projects ?? {}).map((p) => p.path).filter((p) => typeof p === "string" && p.startsWith("/"));
   } catch {
     return [];
@@ -13404,7 +13484,7 @@ function discoverLocalRepos(repoDir, env = process.env) {
   const out = new Map;
   for (const dir of [repoDir, ...registryRepos(env)]) {
     try {
-      const real2 = realpathSync3(dir);
+      const real2 = realpathSync4(dir);
       if (!statSync2(real2).isDirectory())
         continue;
       const id = sourceId(real2);
@@ -13427,17 +13507,18 @@ function syncLocalRepos(db, repoDir, env = process.env) {
 function repoNames(db) {
   return [...new Set(db.select({ name: localRepos.name }).from(localRepos).all().map((r) => r.name))].sort();
 }
-function mountRepos(act, db, peerIsLoopback2) {
-  act.get("/v1/repos", (c) => peerIsLoopback2(c) ? c.json({ repos: repoNames(db) }) : c.json({ error: "loopback only" }, 403));
+function mountRepos(act, db, peerIsLoopback2, repoDir) {
+  const defaultRepo = repoDir ? basename2(resolve2(repoDir)) || null : null;
+  act.get("/v1/repos", (c) => peerIsLoopback2(c) ? c.json({ repos: repoNames(db), default_repo: defaultRepo }) : c.json({ error: "loopback only" }, 403));
 }
 
 // src/server/routes/artifacts.ts
-import { closeSync as closeSync2, fstatSync as fstatSync2, openSync as openSync2, readSync as readSync2, realpathSync as realpathSync4 } from "fs";
-import { join as join8, sep as sep2 } from "path";
+import { closeSync as closeSync3, fstatSync as fstatSync3, openSync as openSync3, readSync as readSync3, realpathSync as realpathSync5 } from "fs";
+import { join as join9, sep as sep3 } from "path";
 var MAX_ARTIFACT_BYTES = 5 * 1024 * 1024;
 var EVENTS_DEFAULT = 500;
 var EVENTS_MAX = 1000;
-var ID2 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var ID3 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 var NAME = /^(?:issue\.json|plan\.json|receipt\.json|receipt\.md|report\.md|task\.md|diff\.patch|evidence\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}\.png)$/;
 var TYPES = {
   json: "application/json; charset=utf-8",
@@ -13445,16 +13526,16 @@ var TYPES = {
   patch: "text/plain; charset=utf-8",
   png: "image/png"
 };
-var safeId = (s) => ID2.test(s) && !s.includes("..");
+var safeId = (s) => ID3.test(s) && !s.includes("..");
 function readCapped(path) {
   let fd;
   try {
-    fd = openSync2(path, "r");
+    fd = openSync3(path, "r");
   } catch {
     return { status: 404 };
   }
   try {
-    const st = fstatSync2(fd);
+    const st = fstatSync3(fd);
     if (!st.isFile())
       return { status: 404 };
     if (st.size > MAX_ARTIFACT_BYTES)
@@ -13462,14 +13543,14 @@ function readCapped(path) {
     const buf = Buffer.alloc(st.size);
     let off = 0;
     while (off < st.size) {
-      const n2 = readSync2(fd, buf, off, st.size - off, off);
+      const n2 = readSync3(fd, buf, off, st.size - off, off);
       if (n2 <= 0)
         break;
       off += n2;
     }
     return { status: 200, body: buf.subarray(0, off) };
   } finally {
-    closeSync2(fd);
+    closeSync3(fd);
   }
 }
 function mount(ctx) {
@@ -13514,19 +13595,19 @@ function mount(ctx) {
       return c.json({ error: "artifact not available" }, 404);
     let runsRoot, runDir, file;
     try {
-      runsRoot = realpathSync4(join8(repo.p, ".loki", "runs"));
-      runDir = realpathSync4(join8(runsRoot, run));
+      runsRoot = realpathSync5(join9(repo.p, ".loki", "runs"));
+      runDir = realpathSync5(join9(runsRoot, run));
     } catch {
       return c.json({ error: "artifact not found" }, 404);
     }
-    if (runDir !== join8(runsRoot, run))
+    if (runDir !== join9(runsRoot, run))
       return c.json({ error: "artifact not found" }, 404);
     try {
-      file = realpathSync4(join8(runDir, name));
+      file = realpathSync5(join9(runDir, name));
     } catch {
       return c.json({ error: "artifact not found" }, 404);
     }
-    if (!file.startsWith(runDir + sep2))
+    if (!file.startsWith(runDir + sep3))
       return c.json({ error: "artifact not found" }, 404);
     const r = readCapped(file);
     if (r.status === 413)
@@ -13563,9 +13644,9 @@ function mount2(ctx) {
 }
 
 // src/server/routes/checkpoints.ts
-import { execFileSync } from "child_process";
-import { appendFileSync, copyFileSync, cpSync, existsSync as existsSync5, lstatSync, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync7, realpathSync as realpathSync5, rmSync, statSync as statSync4, writeFileSync as writeFileSync3 } from "fs";
-import { join as join10, sep as sep3 } from "path";
+import { execFileSync as execFileSync2 } from "child_process";
+import { appendFileSync, copyFileSync, cpSync, existsSync as existsSync5, lstatSync, mkdirSync as mkdirSync3, readdirSync as readdirSync4, readFileSync as readFileSync7, realpathSync as realpathSync6, rmSync, statSync as statSync4, writeFileSync as writeFileSync3 } from "fs";
+import { join as join11, sep as sep4 } from "path";
 
 // src/server/audit.ts
 var clip = (s, n2) => s === undefined ? null : s.slice(0, n2);
@@ -13580,7 +13661,7 @@ function audit3(db, e) {
 
 // src/server/routes/cost_ledger.ts
 import { existsSync as existsSync4, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync3 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 var isNum = (v) => typeof v === "number" && Number.isFinite(v);
 var isObj2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var r6 = (n2) => Math.round(n2 * 1e6) / 1e6;
@@ -13611,7 +13692,7 @@ var DEFAULT_PRICING = {
   "gpt-5.6-luna": { input: 0.5, output: 4 }
 };
 function pricing(lokiDir) {
-  const d = readJson(join9(lokiDir, "pricing.json"));
+  const d = readJson(join10(lokiDir, "pricing.json"));
   const models = isObj2(d) && isObj2(d.models) ? d.models : {};
   return { ...DEFAULT_PRICING, ...models };
 }
@@ -13624,7 +13705,7 @@ function modelCost(table, model, inp, out, cr = 0, cw = 0) {
   return r6((inp * ir + out * or2 + cr * crr + cw * cwr) / 1e6);
 }
 function iterationRecords(lokiDir) {
-  const dir = join9(lokiDir, "metrics", "efficiency");
+  const dir = join10(lokiDir, "metrics", "efficiency");
   let names = [];
   try {
     names = readdirSync3(dir).filter((n2) => /^iteration-.*\.json$/.test(n2)).sort();
@@ -13633,7 +13714,7 @@ function iterationRecords(lokiDir) {
   }
   const out = [];
   for (const n2 of names) {
-    const d = readJson(join9(dir, n2));
+    const d = readJson(join10(dir, n2));
     if (isObj2(d))
       out.push(d);
   }
@@ -13670,7 +13751,7 @@ function costSnapshot(lokiDir) {
     }
   }
   if (tIn === 0 && tOut === 0) {
-    const ctx = readJson(join9(lokiDir, "context", "tracking.json"));
+    const ctx = readJson(join10(lokiDir, "context", "tracking.json"));
     const totals = isObj2(ctx) && isObj2(ctx.totals) ? ctx.totals : {};
     tIn = num0(totals.total_input);
     tOut = num0(totals.total_output);
@@ -13696,7 +13777,7 @@ function costSnapshot(lokiDir) {
     }
   }
   let limit = null, used = null, remaining = null;
-  const bd = readJson(join9(lokiDir, "metrics", "budget.json"));
+  const bd = readJson(join10(lokiDir, "metrics", "budget.json"));
   if (isObj2(bd) && isNum(bd.limit)) {
     limit = bd.limit;
     if (recorded && !unknownUsd) {
@@ -13747,7 +13828,7 @@ function budgetSnapshot(lokiDir) {
     total += priced(table, d);
   }
   let limit = null;
-  const bd = readJson(join9(lokiDir, "metrics", "budget.json"));
+  const bd = readJson(join10(lokiDir, "metrics", "budget.json"));
   if (isObj2(bd)) {
     const l = bd.limit || bd.budget_limit;
     limit = isNum(l) ? l : null;
@@ -13798,19 +13879,19 @@ function costTimeline(lokiDir) {
   }
   const runs2 = [];
   let projectTotal = 0, runsMeasured = 0;
-  const proofs = join9(lokiDir, "proofs");
+  const proofs = join10(lokiDir, "proofs");
   let entries = [];
   try {
     entries = readdirSync3(proofs).sort();
   } catch {}
   for (const e of entries) {
     try {
-      if (!statSync3(join9(proofs, e)).isDirectory())
+      if (!statSync3(join10(proofs, e)).isDirectory())
         continue;
     } catch {
       continue;
     }
-    const p = readJson(join9(proofs, e, "proof.json"));
+    const p = readJson(join10(proofs, e, "proof.json"));
     if (!isObj2(p))
       continue;
     const cost = isObj2(p.cost) ? p.cost : {};
@@ -13840,7 +13921,7 @@ function costTimeline(lokiDir) {
     ...recorded || runsMeasured ? {} : { not_measured: NOT_MEASURED }
   };
 }
-var lokiDirOf = (repoDir) => join9(repoDir, ".loki");
+var lokiDirOf = (repoDir) => join10(repoDir, ".loki");
 var lokiDirExists = (repoDir) => existsSync4(lokiDirOf(repoDir));
 function mount3(ctx) {
   const deny = { error: "loopback only without a token" };
@@ -13854,8 +13935,8 @@ var str2 = (v) => typeof v === "string" && v !== "" ? v : null;
 var SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
 var MAX_CHECKPOINTS = 50;
 var validCheckpointId = (id) => SAFE_ID.test(id);
-var storeOf = (repoDir) => join10(repoDir, ".loki", "state", "checkpoints");
-var lokiOf = (repoDir) => join10(repoDir, ".loki");
+var storeOf = (repoDir) => join11(repoDir, ".loki", "state", "checkpoints");
+var lokiOf = (repoDir) => join11(repoDir, ".loki");
 var readObj = (f) => {
   try {
     const d = JSON.parse(readFileSync7(f, "utf8"));
@@ -13869,7 +13950,7 @@ function listCheckpoints(repoDir, limit = 20) {
   const store = storeOf(repoDir);
   let lines = [];
   try {
-    lines = readFileSync7(join10(store, "index.jsonl"), "utf8").split(`
+    lines = readFileSync7(join11(store, "index.jsonl"), "utf8").split(`
 `);
   } catch {
     return [];
@@ -13897,7 +13978,7 @@ function listCheckpoints(repoDir, limit = 20) {
       message: str2(raw2.task) ?? str2(raw2.message) ?? str2(raw2.task_description),
       iteration: Number.isInteger(it) ? it : null
     };
-    const meta = readObj(join10(store, id, "metadata.json"));
+    const meta = readObj(join11(store, id, "metadata.json"));
     if (meta) {
       cp.git_branch = str2(meta.git_branch);
       cp.provider = str2(meta.provider);
@@ -13905,7 +13986,7 @@ function listCheckpoints(repoDir, limit = 20) {
       cp.message ??= str2(meta.task_description);
       cp.git_sha ??= str2(meta.git_sha);
       cp.created_at ??= str2(meta.timestamp);
-      cp.files_count = countFiles(join10(store, id));
+      cp.files_count = countFiles(join11(store, id));
     }
     out.push(cp);
   }
@@ -13916,7 +13997,7 @@ function countFiles(dir) {
   const walk = (d, top) => {
     for (const e of readdirSync4(d, { withFileTypes: true })) {
       if (e.isDirectory())
-        walk(join10(d, e.name), false);
+        walk(join11(d, e.name), false);
       else if (e.isFile() && !(top && e.name === "metadata.json"))
         n2++;
     }
@@ -13927,11 +14008,11 @@ function countFiles(dir) {
   return n2;
 }
 function getCheckpoint(repoDir, id) {
-  return validCheckpointId(id) ? readObj(join10(storeOf(repoDir), id, "metadata.json")) : null;
+  return validCheckpointId(id) ? readObj(join11(storeOf(repoDir), id, "metadata.json")) : null;
 }
 var gitHead = (repoDir) => {
   try {
-    return execFileSync("git", ["rev-parse", "HEAD"], { cwd: repoDir, timeout: 5000, stdio: ["ignore", "pipe", "ignore"] }).toString().trim() || null;
+    return execFileSync2("git", ["rev-parse", "HEAD"], { cwd: repoDir, timeout: 5000, stdio: ["ignore", "pipe", "ignore"] }).toString().trim() || null;
   } catch {
     return null;
   }
@@ -13939,69 +14020,69 @@ var gitHead = (repoDir) => {
 function createCheckpoint(repoDir, message, now = new Date) {
   const store = storeOf(repoDir), loki = lokiOf(repoDir);
   mkdirSync3(store, { recursive: true });
-  const id = `chk-${stamp(now)}`, dir = join10(store, id);
+  const id = `chk-${stamp(now)}`, dir = join11(store, id);
   mkdirSync3(dir, { recursive: true });
   for (const f of ["dashboard-state.json", "session.json"]) {
     try {
-      if (existsSync5(join10(loki, f)))
-        copyFileSync(join10(loki, f), join10(dir, f));
+      if (existsSync5(join11(loki, f)))
+        copyFileSync(join11(loki, f), join11(dir, f));
     } catch {}
   }
   try {
-    if (existsSync5(join10(loki, "queue")))
-      cpSync(join10(loki, "queue"), join10(dir, "queue"), { recursive: true });
+    if (existsSync5(join11(loki, "queue")))
+      cpSync(join11(loki, "queue"), join11(dir, "queue"), { recursive: true });
   } catch {}
   const meta = { id, created_at: now.toISOString(), git_sha: gitHead(repoDir), message: message || null, files: readdirSync4(dir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name) };
-  writeFileSync3(join10(dir, "metadata.json"), JSON.stringify(meta, null, 2));
-  appendFileSync(join10(store, "index.jsonl"), `${JSON.stringify(meta)}
+  writeFileSync3(join11(dir, "metadata.json"), JSON.stringify(meta, null, 2));
+  appendFileSync(join11(store, "index.jsonl"), `${JSON.stringify(meta)}
 `);
   const mine = readdirSync4(store, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("chk-")).map((e) => e.name).sort();
   while (mine.length > MAX_CHECKPOINTS)
-    rmSync(join10(store, mine.shift()), { recursive: true, force: true });
+    rmSync(join11(store, mine.shift()), { recursive: true, force: true });
   return meta;
 }
 function rollbackCheckpoint(repoDir, id, now = new Date) {
   const store = storeOf(repoDir), loki = lokiOf(repoDir);
   let real2 = "", realStore = "";
   try {
-    real2 = realpathSync5(join10(store, id));
-    realStore = realpathSync5(store);
+    real2 = realpathSync6(join11(store, id));
+    realStore = realpathSync6(store);
   } catch {
     return null;
   }
-  if (!real2.startsWith(`${realStore}${sep3}`) || !statSync4(real2).isDirectory())
+  if (!real2.startsWith(`${realStore}${sep4}`) || !statSync4(real2).isDirectory())
     return null;
-  const preId = `rb-pre-${stamp(now)}`, pre = join10(store, preId);
+  const preId = `rb-pre-${stamp(now)}`, pre = join11(store, preId);
   mkdirSync3(pre, { recursive: true });
   const notStore = (src) => src !== store;
   for (const n2 of ["session.json", "dashboard-state.json", "CONTINUITY.md", "autonomy-state.json"]) {
     try {
-      if (existsSync5(join10(loki, n2)))
-        copyFileSync(join10(loki, n2), join10(pre, n2));
+      if (existsSync5(join11(loki, n2)))
+        copyFileSync(join11(loki, n2), join11(pre, n2));
     } catch {}
   }
   for (const d of ["state", "queue"]) {
     try {
-      if (existsSync5(join10(loki, d)))
-        cpSync(join10(loki, d), join10(pre, d), { recursive: true, filter: notStore });
+      if (existsSync5(join11(loki, d)))
+        cpSync(join11(loki, d), join11(pre, d), { recursive: true, filter: notStore });
     } catch {}
   }
   const preMeta = { id: preId, created_at: now.toISOString(), message: `pre-rollback snapshot (before restoring ${id})`, created_by: "control plane rollback" };
-  writeFileSync3(join10(pre, "metadata.json"), JSON.stringify(preMeta, null, 2));
-  appendFileSync(join10(store, "index.jsonl"), `${JSON.stringify(preMeta)}
+  writeFileSync3(join11(pre, "metadata.json"), JSON.stringify(preMeta, null, 2));
+  appendFileSync(join11(store, "index.jsonl"), `${JSON.stringify(preMeta)}
 `);
   let restored = 0;
   const errors = [];
   for (const e of readdirSync4(real2, { withFileTypes: true })) {
     if (e.name === "metadata.json" || e.name === "worktree-snapshot.txt")
       continue;
-    const src = join10(real2, e.name);
+    const src = join11(real2, e.name);
     try {
       if (lstatSync(src).isSymbolicLink()) {
         errors.push(`${e.name}: symlink skipped`);
         continue;
       }
-      cpSync(src, join10(loki, e.name), { recursive: true, filter: (s) => s !== join10(real2, "state", "checkpoints") });
+      cpSync(src, join11(loki, e.name), { recursive: true, filter: (s) => s !== join11(real2, "state", "checkpoints") });
       restored++;
     } catch (err) {
       errors.push(`${e.name}: ${err.message}`);
@@ -14084,8 +14165,8 @@ function mount4(ctx) {
 
 // src/server/routes/config.ts
 import { createHash as createHash5, randomBytes } from "crypto";
-import { closeSync as closeSync3, fchmodSync, fsyncSync, lstatSync as lstatSync2, openSync as openSync3, readFileSync as readFileSync9, realpathSync as realpathSync6, renameSync as renameSync2, statSync as statSync6, unlinkSync, writeSync as writeSync2 } from "fs";
-import { basename as basename3, dirname as dirname2, join as join12, sep as sep4 } from "path";
+import { closeSync as closeSync4, fchmodSync, fsyncSync, lstatSync as lstatSync2, openSync as openSync4, readFileSync as readFileSync9, realpathSync as realpathSync7, renameSync as renameSync2, statSync as statSync6, unlinkSync, writeSync as writeSync2 } from "fs";
+import { basename as basename4, dirname as dirname2, join as join13, sep as sep5 } from "path";
 
 // node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -14137,7 +14218,7 @@ var $visitAsync = visit.visitAsync;
 import { spawn } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync8, statSync as statSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename2, join as join11, resolve as resolve2 } from "path";
+import { basename as basename3, join as join12, resolve as resolve3 } from "path";
 var ISSUE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}\/[A-Za-z0-9._-]{1,100}#[1-9][0-9]{0,8}$/;
 var TASK = /^[A-Za-z0-9][A-Za-z0-9 .,_/#@+=-]{0,499}$/;
 var hasDotDot = (t) => t.split(/[\\/ ]/).some((seg) => seg.startsWith(".."));
@@ -14153,7 +14234,7 @@ var BUDGET = /^(?:[1-9][0-9]{0,5}|0)(?:\.[0-9]{1,2})?$/;
 var WORKSPACE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 function registryRepos2(env = process.env) {
   try {
-    const j = JSON.parse(readFileSync8(join11(env.HOME || homedir4(), ".loki", "dashboard", "projects.json"), "utf8"));
+    const j = JSON.parse(readFileSync8(join12(env.HOME || homedir4(), ".loki", "dashboard", "projects.json"), "utf8"));
     return Object.values(j.projects ?? {}).map((p) => typeof p?.path === "string" ? p.path : "").filter((p) => p && existsSync6(p) && statSync5(p).isDirectory());
   } catch {
     return [];
@@ -14173,9 +14254,9 @@ function planStart(body, known, bin = "loki") {
   if (b.repo !== undefined && b.repo !== "") {
     if (typeof b.repo !== "string" || b.repo.includes("\x00"))
       return { ok: false, error: "repo must be a path string" };
-    const want = resolve2(b.repo);
-    const paths = known.map((k) => resolve2(k));
-    const named = paths.filter((k) => basename2(k) === b.repo);
+    const want = resolve3(b.repo);
+    const paths = known.map((k) => resolve3(k));
+    const named = paths.filter((k) => basename3(k) === b.repo);
     const hit = paths.find((k) => k === want) ?? (named.length === 1 ? named[0] : undefined);
     if (!hit)
       return { ok: false, error: named.length > 1 ? "repo name is ambiguous" : "repo is not a known project" };
@@ -14598,11 +14679,11 @@ function renderVerified(doc, next, quote = needsQuote) {
 function resolveConfigFile(repoDir) {
   let root;
   try {
-    root = realpathSync6(repoDir);
+    root = realpathSync7(repoDir);
   } catch {
     return { ok: false, status: 400, error: "repo directory not found" };
   }
-  const p = join12(root, "loki.yaml");
+  const p = join13(root, "loki.yaml");
   let st;
   try {
     st = lstatSync2(p);
@@ -14612,11 +14693,11 @@ function resolveConfigFile(repoDir) {
   if (st.isSymbolicLink()) {
     let real2;
     try {
-      real2 = realpathSync6(p);
+      real2 = realpathSync7(p);
     } catch {
       return { ok: false, status: 400, error: "loki.yaml is a broken symlink" };
     }
-    if (!real2.startsWith(root + sep4))
+    if (!real2.startsWith(root + sep5))
       return { ok: false, status: 400, error: "loki.yaml is a symlink that resolves outside the repo" };
     if (!statSync6(real2).isFile())
       return { ok: false, status: 422, error: "loki.yaml is not a regular file" };
@@ -14627,20 +14708,20 @@ function resolveConfigFile(repoDir) {
   return { ok: true, file: p, exists: true };
 }
 function atomicWrite(file, text2, mode) {
-  const tmp = join12(dirname2(file), `.${basename3(file)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
-  const fd = openSync3(tmp, "wx", mode);
+  const tmp = join13(dirname2(file), `.${basename4(file)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`);
+  const fd = openSync4(tmp, "wx", mode);
   try {
     writeSync2(fd, text2);
     fchmodSync(fd, mode);
     fsyncSync(fd);
   } catch (e) {
-    closeSync3(fd);
+    closeSync4(fd);
     try {
       unlinkSync(tmp);
     } catch {}
     throw e;
   }
-  closeSync3(fd);
+  closeSync4(fd);
   try {
     renameSync2(tmp, file);
   } catch (e) {
@@ -14777,19 +14858,19 @@ function mount6(ctx) {
 }
 
 // src/server/routes/control.ts
-import { existsSync as existsSync7, realpathSync as realpathSync7 } from "fs";
-import { join as join14, resolve as resolve3, sep as sep5 } from "path";
+import { existsSync as existsSync7, realpathSync as realpathSync8 } from "fs";
+import { join as join15, resolve as resolve4, sep as sep6 } from "path";
 
 // ../../loki-ts/src/util/run_pid.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import { chmodSync as chmodSync2, readFileSync as readFileSync10, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
-import { join as join13 } from "path";
-var runPidPath = (runDir) => join13(runDir, "run.pid");
+import { join as join14 } from "path";
+var runPidPath = (runDir) => join14(runDir, "run.pid");
 function processStartTime(pid) {
   if (!Number.isInteger(pid) || pid <= 1)
     return null;
   try {
-    const out = execFileSync2("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8", timeout: 5000, env: { ...process.env, LC_ALL: "C" }, stdio: ["ignore", "pipe", "ignore"] });
+    const out = execFileSync3("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8", timeout: 5000, env: { ...process.env, LC_ALL: "C" }, stdio: ["ignore", "pipe", "ignore"] });
     return out.trim().replace(/\s+/g, " ") || null;
   } catch {
     return null;
@@ -14822,7 +14903,7 @@ function verifyRunPid(runDir, runId, startOf = processStartTime) {
 }
 
 // src/server/routes/control.ts
-var ID3 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var ID4 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 var busy = new Set;
 function mount7(ctx) {
   const { act, db } = ctx;
@@ -14835,19 +14916,19 @@ function mount7(ctx) {
       audit3(db, { kind: `run.${kind}`, target, result, detail });
       return c.json(body, status);
     };
-    if (!ID3.test(source) || !ID3.test(id) || source.includes("..") || id.includes(".."))
+    if (!ID4.test(source) || !ID4.test(id) || source.includes("..") || id.includes(".."))
       return done(400, "refused", { error: "invalid run id" }, "invalid id");
     const repoRow = db.select().from(localRepos).where(eq(localRepos.sourceId, source)).get();
     let repo = "";
     try {
-      repo = repoRow ? realpathSync7(repoRow.realpath) : "";
+      repo = repoRow ? realpathSync8(repoRow.realpath) : "";
     } catch {
       repo = "";
     }
     if (!repo)
       return done(404, "refused", { error: "this run's repo is not known on this machine" });
-    const runsRoot = join14(repo, ".loki", "runs"), runDir = resolve3(runsRoot, id);
-    if (!runDir.startsWith(runsRoot + sep5))
+    const runsRoot = join15(repo, ".loki", "runs"), runDir = resolve4(runsRoot, id);
+    if (!runDir.startsWith(runsRoot + sep6))
       return done(400, "refused", { error: "invalid run id" }, "path escape");
     return handler({ source, run: id, repo, runDir }, done);
   });
@@ -14894,7 +14975,7 @@ function mount7(ctx) {
       return done(404, "refused", { error: "run not found" });
     if (!blockedQuestion(loadEvents(db, a.source, a.run), row.verdict))
       return done(409, "refused", { error: "run is not BLOCKED, so there is nothing to resume" });
-    if (!existsSync7(join14(answerDir, a.source, `${a.run}.answer.txt`)))
+    if (!existsSync7(join15(answerDir, a.source, `${a.run}.answer.txt`)))
       return done(409, "refused", { error: "no answer recorded for this run; answer it first" });
     return launch(a, [bin, "answer", a.run], done);
   });
@@ -14974,10 +15055,10 @@ function mount8(ctx) {
 // src/server/routes/fleet.ts
 import { readdirSync as readdirSync5, readFileSync as readFileSync11 } from "fs";
 import { homedir as homedir5 } from "os";
-import { basename as basename4, join as join15 } from "path";
+import { basename as basename5, join as join16 } from "path";
 var isNum2 = (v) => typeof v === "number" && Number.isFinite(v);
 var isObj5 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-var registryFile = () => join15(process.env.HOME ?? homedir5(), ".loki", "dashboard", "projects.json");
+var registryFile = () => join16(process.env.HOME ?? homedir5(), ".loki", "dashboard", "projects.json");
 function pidAlive(pid) {
   if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0)
     return false;
@@ -14992,33 +15073,33 @@ function projectSnapshot(path) {
   const snap = { phase: "", iteration: null, cost_usd: null, started_at: null, ended_at: null };
   if (!path)
     return snap;
-  const loki = join15(path, ".loki");
-  const st = readJson(join15(loki, "dashboard-state.json"));
+  const loki = join16(path, ".loki");
+  const st = readJson(join16(loki, "dashboard-state.json"));
   if (isObj5(st)) {
     snap.phase = typeof st.phase === "string" ? st.phase : "";
     snap.iteration = Number.isInteger(st.iteration) ? st.iteration : null;
   }
-  const ss = readJson(join15(loki, "session.json"));
+  const ss = readJson(join16(loki, "session.json"));
   if (isObj5(ss)) {
     const a = ss.startedAt || ss.started_at, b = ss.endedAt || ss.ended_at;
     snap.started_at = typeof a === "string" ? a : null;
     snap.ended_at = typeof b === "string" ? b : null;
   }
   let cost = 0, found = false;
-  const eff = join15(loki, "metrics", "efficiency");
+  const eff = join16(loki, "metrics", "efficiency");
   let names = [];
   try {
     names = readdirSync5(eff).filter((n2) => n2.endsWith(".json"));
   } catch {}
   for (const n2 of names) {
-    const d = readJson(join15(eff, n2));
+    const d = readJson(join16(eff, n2));
     if (isObj5(d) && isNum2(d.cost_usd) && recordIsMeasured(d)) {
       cost += d.cost_usd;
       found = true;
     }
   }
   if (!found) {
-    const t = readJson(join15(loki, "context", "tracking.json"));
+    const t = readJson(join16(loki, "context", "tracking.json"));
     const totals = isObj5(t) && isObj5(t.totals) ? t.totals : null;
     if (totals && isNum2(totals.total_cost_usd) && recordIsMeasured({ cost_usd: totals.total_cost_usd, input_tokens: totals.total_input, output_tokens: totals.total_output })) {
       cost = totals.total_cost_usd;
@@ -15055,7 +15136,7 @@ function fleetRuns(includeInactive = true, file = registryFile()) {
     }
     return {
       id: p.id ?? null,
-      name: p.name || (path ? basename4(path) : "project"),
+      name: p.name || (path ? basename5(path) : "project"),
       path,
       status,
       running,
@@ -15091,8 +15172,8 @@ function mount9(ctx) {
 }
 
 // src/server/routes/memory.ts
-import { existsSync as existsSync8, readFileSync as readFileSync12, readdirSync as readdirSync6, realpathSync as realpathSync8, statSync as statSync7 } from "fs";
-import { join as join16, sep as sep6 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync12, readdirSync as readdirSync6, realpathSync as realpathSync9, statSync as statSync7 } from "fs";
+import { join as join17, sep as sep7 } from "path";
 var isObj6 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var nonEmpty = (v) => !(v === undefined || v === null || v === "" || Array.isArray(v) && v.length === 0 || isObj6(v) && Object.keys(v).length === 0);
 var focus = { dir: null };
@@ -15123,7 +15204,7 @@ function jsonFiles(dir, cap = Infinity) {
     for (const e of ents.sort((a, b) => a.name < b.name ? -1 : 1)) {
       if (out2.length >= cap)
         return;
-      const p = join16(d, e.name);
+      const p = join17(d, e.name);
       if (e.isDirectory())
         walk(p);
       else if (e.isFile() && e.name.endsWith(".json"))
@@ -15144,24 +15225,24 @@ function setFocus(repoDir, raw2, registry = registryFile()) {
     return { ok: false, error: "project_dir must be an absolute path without .. segments" };
   let real2 = "";
   try {
-    real2 = realpathSync8(s);
+    real2 = realpathSync9(s);
     if (!statSync7(real2).isDirectory())
       throw new Error("not a dir");
   } catch {
     return { ok: false, error: `Directory does not exist: ${s}` };
   }
-  if (!existsSync8(join16(real2, ".loki")) || !statSync7(join16(real2, ".loki")).isDirectory())
+  if (!existsSync8(join17(real2, ".loki")) || !statSync7(join17(real2, ".loki")).isDirectory())
     return { ok: false, error: `Directory does not contain a .loki/ subdirectory: ${s}` };
   const allowed = new Set;
   try {
-    allowed.add(realpathSync8(repoDir));
+    allowed.add(realpathSync9(repoDir));
   } catch {}
   const reg = readJson(registry);
   if (isObj6(reg) && isObj6(reg.projects))
     for (const p of Object.values(reg.projects)) {
       if (isObj6(p) && typeof p.path === "string") {
         try {
-          allowed.add(realpathSync8(p.path));
+          allowed.add(realpathSync9(p.path));
         } catch {}
       }
     }
@@ -15175,7 +15256,7 @@ var QUEUES = [["pending.json", "pending"], ["in-progress.json", "in_progress"],
 var RANK = { done: 3, in_progress: 2, review: 1, pending: 0 };
 function tasksList(loki, status) {
   const all = [];
-  const st = readJson(join16(loki, "dashboard-state.json"));
+  const st = readJson(join17(loki, "dashboard-state.json"));
   const groups = isObj6(st) && isObj6(st.tasks) ? st.tasks : {};
   for (const [key, mapped] of GROUPS) {
     const g = groups[key];
@@ -15197,7 +15278,7 @@ function tasksList(loki, status) {
     });
   }
   for (const [file, qs] of QUEUES) {
-    const raw2 = readJson(join16(loki, "queue", file));
+    const raw2 = readJson(join17(loki, "queue", file));
     const items = isObj6(raw2) ? raw2.tasks : raw2;
     if (!Array.isArray(items))
       continue;
@@ -15251,7 +15332,7 @@ function tasksList(loki, status) {
   }
   return status ? out2.filter((t) => t.status === status) : out2;
 }
-var memDir = (loki, sub) => join16(loki, "memory", sub);
+var memDir = (loki, sub) => join17(loki, "memory", sub);
 function memoryEpisodes(loki, limit = 50) {
   const eps = jsonFiles(memDir(loki, "episodic")).map(readJson).filter(isObj6);
   eps.sort((a, b) => String(b.timestamp ?? "").localeCompare(String(a.timestamp ?? "")));
@@ -15260,19 +15341,19 @@ function memoryEpisodes(loki, limit = 50) {
 function memoryEpisode(loki, id) {
   for (const f of jsonFiles(memDir(loki, "episodic"))) {
     const d = readJson(f);
-    if (isObj6(d) && (d.id === id || f.split(sep6).pop() === `${id}.json`))
+    if (isObj6(d) && (d.id === id || f.split(sep7).pop() === `${id}.json`))
       return d;
   }
   return null;
 }
 function memoryPatterns(loki) {
-  const d = readJson(join16(memDir(loki, "semantic"), "patterns.json"));
+  const d = readJson(join17(memDir(loki, "semantic"), "patterns.json"));
   const list = Array.isArray(d) ? d : isObj6(d) && Array.isArray(d.patterns) ? d.patterns : [];
   return list.filter(isObj6);
 }
 var memorySkills = (loki) => jsonFiles(memDir(loki, "skills")).map(readJson).filter(isObj6);
 function memoryEconomics(loki) {
-  const rawV = readJson(join16(loki, "memory", "token_economics.json"));
+  const rawV = readJson(join17(loki, "memory", "token_economics.json"));
   const raw2 = isObj6(rawV) ? rawV : {};
   const m = isObj6(raw2.metrics) ? raw2.metrics : {};
   const n2 = (v) => typeof v === "number" && Number.isFinite(v) ? Math.trunc(v) : 0;
@@ -15308,7 +15389,7 @@ function memoryEconomics(loki) {
   };
 }
 function contextTracking(loki) {
-  const f = join16(loki, "context", "tracking.json");
+  const f = join17(loki, "context", "tracking.json");
   if (!existsSync8(f)) {
     return { status: 200, body: {
       session_id: null,
@@ -15370,7 +15451,7 @@ function mount10(ctx) {
 
 // src/server/routes/metrics.ts
 import { readdirSync as readdirSync7, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var isObj7 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var arr = (v) => Array.isArray(v) ? v : [];
 function buildMetricsText(repoDir, now = Date.now()) {
@@ -15387,7 +15468,7 @@ function buildMetricsText(repoDir, now = Date.now()) {
       L.push(...samples);
     L.push("");
   };
-  const stRaw = readJson(join17(loki, "dashboard-state.json"));
+  const stRaw = readJson(join18(loki, "dashboard-state.json"));
   const state = isObj7(stRaw) ? stRaw : null;
   let status = 0;
   if (state?.mode === "paused")
@@ -15396,7 +15477,7 @@ function buildMetricsText(repoDir, now = Date.now()) {
     status = 1;
   else {
     try {
-      if (pidAlive(parseInt(readFileSync13(join17(loki, "loki.pid"), "utf8").trim(), 10)))
+      if (pidAlive(parseInt(readFileSync13(join18(loki, "loki.pid"), "utf8").trim(), 10)))
         status = 1;
     } catch {}
   }
@@ -15412,7 +15493,7 @@ function buildMetricsText(repoDir, now = Date.now()) {
     `loki_tasks_total{status="failed"} ${arr(tasks.failed).length}`
   ] : null);
   let agents = null;
-  const af = readJson(join17(loki, "state", "agents.json"));
+  const af = readJson(join18(loki, "state", "agents.json"));
   if (Array.isArray(af) && af.length)
     agents = af;
   else if (state && Array.isArray(state.agents) && state.agents.length)
@@ -15424,7 +15505,7 @@ function buildMetricsText(repoDir, now = Date.now()) {
   gauge("loki_cost_usd", "Estimated total cost in USD", "gauge", cost.estimated_cost_usd !== null ? [`loki_cost_usd ${cost.estimated_cost_usd}`] : null);
   let events2 = null;
   try {
-    events2 = readFileSync13(join17(loki, "events.jsonl"), "utf8").split(`
+    events2 = readFileSync13(join18(loki, "events.jsonl"), "utf8").split(`
 `).filter((l) => l.trim()).length;
   } catch {}
   gauge("loki_events_total", "Total number of events recorded", "counter", events2 !== null ? [`loki_events_total ${events2}`] : null);
@@ -15436,19 +15517,19 @@ function buildMetricsText(repoDir, now = Date.now()) {
   }
   gauge("loki_uptime_seconds", "Seconds since session started", "gauge", uptime !== null ? [`loki_uptime_seconds ${uptime}`] : null);
   let total = 0, ver = 0, gaps = 0, notver = 0, unk = 0, att = 0, sig = 0;
-  const pdir = join17(loki, "proofs");
+  const pdir = join18(loki, "proofs");
   let entries = [];
   try {
     entries = readdirSync7(pdir).sort();
   } catch {}
   for (const e of entries) {
     try {
-      if (!statSync8(join17(pdir, e)).isDirectory())
+      if (!statSync8(join18(pdir, e)).isDirectory())
         continue;
     } catch {
       continue;
     }
-    const d = readJson(join17(pdir, e, "proof.json"));
+    const d = readJson(join18(pdir, e, "proof.json"));
     if (!isObj7(d))
       continue;
     total++;
@@ -15493,7 +15574,7 @@ function mount11(ctx) {
 
 // src/server/routes/session_control.ts
 import { existsSync as existsSync9, mkdirSync as mkdirSync4, readdirSync as readdirSync8, readFileSync as readFileSync14, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname3, join as join18 } from "path";
+import { dirname as dirname3, join as join19 } from "path";
 var isObj8 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var ACTIONS = ["pause", "resume", "stop", "council-review"];
 var isAction = (v) => ACTIONS.includes(v);
@@ -15518,7 +15599,7 @@ var readJson2 = (p) => {
 };
 function runnerPid(loki) {
   try {
-    const pid = parseInt(readFileSync14(join18(loki, "loki.pid"), "utf8").trim(), 10);
+    const pid = parseInt(readFileSync14(join19(loki, "loki.pid"), "utf8").trim(), 10);
     return pidAlive(pid) ? pid : null;
   } catch {
     return null;
@@ -15528,18 +15609,18 @@ function applyControl(repoDir, action) {
   const loki = lokiDirOf(repoDir);
   const running = runnerPid(loki) !== null;
   const put = (rel) => {
-    const f = join18(loki, rel);
+    const f = join19(loki, rel);
     mkdirSync4(dirname3(f), { recursive: true });
     writeFileSync5(f, new Date().toISOString());
   };
   if (action === "council-review") {
-    put(join18("signals", "COUNCIL_REVIEW_REQUESTED"));
+    put(join19("signals", "COUNCIL_REVIEW_REQUESTED"));
     return { status: 200, body: { success: true, message: "Council review requested" } };
   }
   if (action === "resume") {
     for (const n2 of ["PAUSE", "STOP"]) {
       try {
-        unlinkSync2(join18(loki, n2));
+        unlinkSync2(join19(loki, n2));
       } catch {}
     }
     return running ? { status: 200, body: { success: true, message: "Session resumed", process_verified: true } } : { status: 503, body: { success: false, message: "Session process is not running; the signal files were cleared" } };
@@ -15559,16 +15640,16 @@ function runControl(db, repoDir, action, c, via) {
   return c.json(r.body, r.status);
 }
 function councilState(loki) {
-  const f = join18(loki, "council", "state.json");
+  const f = join19(loki, "council", "state.json");
   if (!existsSync9(f))
     return { enabled: false, total_votes: 0, verdicts: [] };
   const d = readJson2(f);
   return isObj8(d) ? d : { enabled: null, total_votes: null, verdicts: null, error: "unreadable_state" };
 }
 function councilVerdicts(loki, limit = 20) {
-  const st = readJson2(join18(loki, "council", "state.json"));
+  const st = readJson2(join19(loki, "council", "state.json"));
   const verdicts = isObj8(st) && Array.isArray(st.verdicts) ? st.verdicts : [];
-  const votes = join18(loki, "council", "votes");
+  const votes = join19(loki, "council", "votes");
   const details = [];
   let names = [];
   try {
@@ -15582,8 +15663,8 @@ function councilVerdicts(loki, limit = 20) {
     }
   };
   for (const n2 of names.slice(0, limit)) {
-    const dir = join18(votes, n2), d = { iteration: n2 };
-    const ev = text2(join18(dir, "evidence.md"));
+    const dir = join19(votes, n2), d = { iteration: n2 };
+    const ev = text2(join19(dir, "evidence.md"));
     if (ev !== null)
       d.evidence_preview = ev.slice(0, 500);
     let files = [];
@@ -15591,10 +15672,10 @@ function councilVerdicts(loki, limit = 20) {
       files = readdirSync8(dir).filter((f) => /^member-.*\.txt$/.test(f)).sort();
     } catch {}
     d.members = files.flatMap((f) => {
-      const t = text2(join18(dir, f));
+      const t = text2(join19(dir, f));
       return t === null ? [] : [{ member: f.replace(/\.txt$/, ""), content: t.trim() }];
     });
-    const con = text2(join18(dir, "contrarian.txt"));
+    const con = text2(join19(dir, "contrarian.txt"));
     if (con !== null)
       d.contrarian = con.trim();
     details.push(d);
@@ -15605,7 +15686,7 @@ function councilConvergence(loki) {
   const dataPoints = [];
   let raw2 = "";
   try {
-    raw2 = readFileSync14(join18(loki, "council", "convergence.log"), "utf8");
+    raw2 = readFileSync14(join19(loki, "council", "convergence.log"), "utf8");
   } catch {}
   for (const line2 of raw2.trim().split(`
 `)) {
@@ -15621,7 +15702,7 @@ function councilConvergence(loki) {
 }
 function councilReport(loki) {
   try {
-    return { report: readFileSync14(join18(loki, "council", "report.md"), "utf8") };
+    return { report: readFileSync14(join19(loki, "council", "report.md"), "utf8") };
   } catch {
     return { report: null };
   }
@@ -15634,7 +15715,7 @@ function councilTranscripts(loki, q) {
     if (Number.isNaN(since))
       return { error: "Invalid 'since' timestamp format; expected ISO8601" };
   }
-  const dir = join18(loki, "council", "transcripts");
+  const dir = join19(loki, "council", "transcripts");
   let names = [];
   try {
     names = readdirSync8(dir).filter((f) => /^iter-.*\.json$/.test(f)).sort().reverse();
@@ -15643,7 +15724,7 @@ function councilTranscripts(loki, q) {
   }
   const out2 = [];
   for (const n2 of names) {
-    const rec = readJson2(join18(dir, n2));
+    const rec = readJson2(join19(dir, n2));
     if (!isObj8(rec) || typeof rec.iteration_id !== "string")
       continue;
     if (since !== null) {
@@ -15696,28 +15777,28 @@ function mount12(ctx) {
 // src/server/routes/integrations.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync10, readFileSync as readFileSync15, statSync as statSync9 } from "fs";
-import { delimiter, join as join19 } from "path";
+import { delimiter, join as join20 } from "path";
 var GH_TIMEOUT_MS = 3000;
 var isSet = (n2) => !!n2 && (process.env[n2] ?? "") !== "";
 function ghAuthed(pathVar = process.env.PATH ?? "", timeoutMs = GH_TIMEOUT_MS) {
-  const exe = pathVar.split(delimiter).filter(Boolean).map((d) => join19(d, "gh")).find((p) => existsSync10(p));
+  const exe = pathVar.split(delimiter).filter(Boolean).map((d) => join20(d, "gh")).find((p) => existsSync10(p));
   if (!exe)
     return Promise.resolve(null);
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let done = false;
     let timer;
     const finish = (v) => {
       if (!done) {
         done = true;
         clearTimeout(timer);
-        resolve4(v);
+        resolve5(v);
       }
     };
     let child;
     try {
       child = spawn2(exe, ["auth", "status"], { stdio: "ignore", env: { ...process.env, NO_COLOR: "1" } });
     } catch {
-      return resolve4(null);
+      return resolve5(null);
     }
     timer = setTimeout(() => {
       try {
@@ -15745,7 +15826,7 @@ function configuredName(repoDir, path) {
 }
 function mcpServers(repoDir) {
   try {
-    const p = join19(repoDir, ".mcp.json");
+    const p = join20(repoDir, ".mcp.json");
     if (!existsSync10(p) || statSync9(p).size > 1e6)
       return null;
     const j = JSON.parse(readFileSync15(p, "utf8"));
@@ -15775,18 +15856,18 @@ function conv(s) {
 }
 async function listIntegrations(repoDir, gh = () => ghAuthed()) {
   const rows = [];
-  const gitEnv = configuredName(repoDir, ["git", "token_env"]);
+  const gitEnv2 = configuredName(repoDir, ["git", "token_env"]);
   const ghOk = await gh();
-  const gitEnvSet = isSet(gitEnv);
+  const gitEnvSet = isSet(gitEnv2);
   rows.push({
     id: "github",
     label: "GitHub",
-    status: gitEnvSet || ghOk === true ? "connected" : ghOk === null && !gitEnv ? "not_measured" : "not_connected",
+    status: gitEnvSet || ghOk === true ? "connected" : ghOk === null && !gitEnv2 ? "not_measured" : "not_connected",
     method: gitEnvSet ? "env" : ghOk !== null ? "gh_cli" : "none",
-    env_name: gitEnv,
+    env_name: gitEnv2,
     env_set: gitEnvSet,
     config_path: "git.token_env",
-    detail: gitEnvSet ? "git.token_env is set in the environment" : ghOk === true ? "gh auth status succeeded" : ghOk === false ? "gh is installed but not authenticated" : gitEnv ? "git.token_env names a variable that is not set" : "gh not found and git.token_env is not configured"
+    detail: gitEnvSet ? "git.token_env is set in the environment" : ghOk === true ? "gh auth status succeeded" : ghOk === false ? "gh is installed but not authenticated" : gitEnv2 ? "git.token_env names a variable that is not set" : "gh not found and git.token_env is not configured"
   });
   rows.push(conv(CONVENTIONAL[0]));
   const slackEnv = configuredName(repoDir, ["notifications", "slack_webhook_env"]);
@@ -15826,8 +15907,8 @@ function mount13(ctx) {
 
 // src/server/routes/merge_risk.ts
 import { spawn as spawn3 } from "child_process";
-import { realpathSync as realpathSync9 } from "fs";
-import { basename as basename5, resolve as resolve4 } from "path";
+import { realpathSync as realpathSync10 } from "fs";
+import { basename as basename6, resolve as resolve5 } from "path";
 var PR = /^[0-9]{1,7}$/;
 var REF = /^[A-Za-z0-9._/][A-Za-z0-9._/-]{0,99}$/;
 var MAX_OUT = 256 * 1024;
@@ -15925,7 +16006,7 @@ function mount14(ctx) {
   const active = { run: 0, queue: 0, risk: 0 };
   const real2 = (p) => {
     try {
-      return realpathSync9(p);
+      return realpathSync10(p);
     } catch {
       return null;
     }
@@ -15939,12 +16020,12 @@ function mount14(ctx) {
     for (const k of [ctx.repoDir, ...registryRepos2()]) {
       const r = real2(k);
       if (r)
-        known.set(r, basename5(resolve4(k)));
+        known.set(r, basename6(resolve5(k)));
     }
     const wantReal = real2(want);
     if (wantReal && known.has(wantReal))
       return wantReal;
-    const named = [...known].filter(([r, label]) => label === want || basename5(r) === want).map(([r]) => r);
+    const named = [...known].filter(([r, label]) => label === want || basename6(r) === want).map(([r]) => r);
     return named.length === 1 ? named[0] : null;
   };
   const slot = async (c, kind, auditKind, fn) => {
@@ -16137,7 +16218,7 @@ function mount15(ctx) {
 // src/server/routes/providers.ts
 import { spawn as spawn4 } from "child_process";
 import { existsSync as existsSync11, readFileSync as readFileSync16 } from "fs";
-import { delimiter as delimiter2, join as join20 } from "path";
+import { delimiter as delimiter2, join as join21 } from "path";
 var ORDER = ["claude", "codex", "cline", "aider", "opencode"];
 var DEPRECATED = ["gemini"];
 var AUTH_ENV = {
@@ -16153,7 +16234,7 @@ function findOnPath(bin, pathVar) {
   for (const d of pathVar.split(delimiter2)) {
     if (!d)
       continue;
-    const p = join20(d, bin);
+    const p = join21(d, bin);
     if (existsSync11(p))
       return p;
   }
@@ -16163,7 +16244,7 @@ function probeCli(bin, timeoutMs, pathVar = process.env.PATH ?? "") {
   const exe = findOnPath(bin, pathVar);
   if (!exe)
     return Promise.resolve({ installed: false, version: null, probe: "not_found" });
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let out2 = "";
     let done = false;
     let timer;
@@ -16171,14 +16252,14 @@ function probeCli(bin, timeoutMs, pathVar = process.env.PATH ?? "") {
       if (!done) {
         done = true;
         clearTimeout(timer);
-        resolve5(r);
+        resolve6(r);
       }
     };
     let child;
     try {
       child = spawn4(exe, ["--version"], { stdio: ["ignore", "pipe", "ignore"], env: { ...process.env, NO_COLOR: "1" } });
     } catch {
-      return resolve5({ installed: true, version: null, probe: "error" });
+      return resolve6({ installed: true, version: null, probe: "error" });
     }
     timer = setTimeout(() => {
       try {
@@ -16198,14 +16279,14 @@ function probeCli(bin, timeoutMs, pathVar = process.env.PATH ?? "") {
   });
 }
 function providersDir() {
-  const cands = [process.env.LOKI_PROVIDERS_DIR, join20(import.meta.dir, "../../../../../providers"), join20(import.meta.dir, "../../../providers")];
-  return cands.find((d) => !!d && existsSync11(join20(d, "model_catalog.json"))) ?? null;
+  const cands = [process.env.LOKI_PROVIDERS_DIR, join21(import.meta.dir, "../../../../../providers"), join21(import.meta.dir, "../../../providers")];
+  return cands.find((d) => !!d && existsSync11(join21(d, "model_catalog.json"))) ?? null;
 }
 function loadCatalog(dir) {
   if (!dir)
     return { providers: {}, updated: null };
   try {
-    const j = JSON.parse(readFileSync16(join20(dir, "model_catalog.json"), "utf8"));
+    const j = JSON.parse(readFileSync16(join21(dir, "model_catalog.json"), "utf8"));
     return { providers: j.providers ?? {}, updated: typeof j.updated === "string" ? j.updated : null };
   } catch {
     return { providers: {}, updated: null };
@@ -16448,24 +16529,24 @@ data: ${JSON.stringify({ source: k.slice(0, i), run: k.slice(i + 1) })}
 }
 
 // src/server/routes/verify.ts
-import { readFileSync as readFileSync26, realpathSync as realpathSync13 } from "fs";
+import { readFileSync as readFileSync26, realpathSync as realpathSync14 } from "fs";
 import { createPublicKey as createPublicKey5 } from "crypto";
-import { join as join31, sep as sep11 } from "path";
+import { join as join32, sep as sep12 } from "path";
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
 import { existsSync as existsSync19, readdirSync as readdirSync12, readFileSync as readFileSync25, statSync as statSync13 } from "fs";
-import { dirname as dirname12, join as join30 } from "path";
+import { dirname as dirname12, join as join31 } from "path";
 import { createHash as createHash10, createPublicKey as createPublicKey4, verify as verify3 } from "crypto";
 
 // ../../loki-ts/src/util/paths.ts
-import { resolve as resolve5, dirname as dirname4 } from "path";
+import { resolve as resolve6, dirname as dirname4 } from "path";
 import { fileURLToPath } from "url";
 import { existsSync as existsSync12 } from "fs";
 var HERE = dirname4(fileURLToPath(import.meta.url));
 function findRepoRoot() {
   let dir = HERE;
   for (let i = 0;i < 6; i++) {
-    if (existsSync12(resolve5(dir, "VERSION")) && existsSync12(resolve5(dir, "autonomy/run.sh"))) {
+    if (existsSync12(resolve6(dir, "VERSION")) && existsSync12(resolve6(dir, "autonomy/run.sh"))) {
       return dir;
     }
     const parent = dirname4(dir);
@@ -16473,7 +16554,7 @@ function findRepoRoot() {
       break;
     dir = parent;
   }
-  return resolve5(HERE, "..", "..", "..");
+  return resolve6(HERE, "..", "..", "..");
 }
 var REPO_ROOT = findRepoRoot();
 
@@ -16481,14 +16562,14 @@ var REPO_ROOT = findRepoRoot();
 import { createHash as createHash9, randomBytes as randomBytes3, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, sign } from "crypto";
 import { chmodSync as chmodSync4, existsSync as existsSync18, readdirSync as readdirSync11, linkSync, mkdirSync as mkdirSync9, readFileSync as readFileSync23, statSync as statSync12, unlinkSync as unlinkSync4, writeFileSync as writeFileSync10 } from "fs";
 import { homedir as homedir6 } from "os";
-import { basename as basename9, dirname as dirname11, join as join29 } from "path";
+import { basename as basename10, dirname as dirname11, join as join30 } from "path";
 
 // ../../loki-ts/src/e10ext/assert_delta.ts
-import { execFileSync as execFileSync3 } from "child_process";
+import { execFileSync as execFileSync4 } from "child_process";
 import { mkdtempSync, readFileSync as readFileSync17, rmSync as rmSync3 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join21 } from "path";
-import { basename as basename6 } from "path";
+import { join as join22 } from "path";
+import { basename as basename7 } from "path";
 var WEAKENED = { verdict: "weakened", changes: [] };
 var PY = String.raw`
 import ast, copy, io, json, re, sys, tokenize
@@ -16639,15 +16720,15 @@ out("value-change" if ok and items else "weakened", items if ok else [])
 `;
 var okStr = (v) => typeof v === "string" && v.length <= 200 && !/[\x00-\x1f\x7f]/.test(v);
 function classifyAssertDelta(inp) {
-  const f = basename6(inp.path);
+  const f = basename7(inp.path);
   if (!/^(test_.*|.*_test)\.py$/.test(f))
     return WEAKENED;
   if (inp.headCounts.run !== inp.baseCounts.run || inp.headCounts.skipped !== inp.baseCounts.skipped)
     return WEAKENED;
   let cwd = "";
   try {
-    cwd = mkdtempSync(join21(tmpdir2(), "loki-ad-"));
-    const raw2 = execFileSync3("python3", ["-I", "-c", PY], {
+    cwd = mkdtempSync(join22(tmpdir2(), "loki-ad-"));
+    const raw2 = execFileSync4("python3", ["-I", "-c", PY], {
       input: JSON.stringify({ path: inp.path, base: inp.base, head: inp.head, task: inp.task }),
       cwd,
       env: process.env,
@@ -16676,8 +16757,8 @@ function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, hea
   if (!baseCounts || !headCounts)
     return null;
   try {
-    const show = (ref) => execFileSync3("git", ["show", `${ref}:${path}`], { cwd: repoDir, encoding: "utf8", env: process.env, stdio: ["ignore", "pipe", "ignore"] });
-    const head = headRef ? show(headRef) : readFileSync17(join21(repoDir, path), "utf8");
+    const show = (ref) => execFileSync4("git", ["show", `${ref}:${path}`], { cwd: repoDir, encoding: "utf8", env: process.env, stdio: ["ignore", "pipe", "ignore"] });
+    const head = headRef ? show(headRef) : readFileSync17(join22(repoDir, path), "utf8");
     const r = classifyTestEdit(path, show(baseSha), head, task, baseCounts, headCounts);
     return r[0]?.kind === "literal-only" ? r.map((e) => `assertion value changed (not shown to be required by the task): ${e.file}:${e.line} ${e.old} -> ${e.new}`) : null;
   } catch {
@@ -16693,16 +16774,16 @@ function classifyTestEdit(file, oldText, newText, taskText, baseCounts, headCoun
 }
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { execFileSync as execFileSync4 } from "child_process";
-import { chmodSync as chmodSync3, closeSync as closeSync4, lstatSync as lstatSync3, mkdirSync as mkdirSync5, openSync as openSync4, readFileSync as readFileSync18, realpathSync as realpathSync10, rmdirSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, join as join22, relative, sep as sep7 } from "path";
+import { execFileSync as execFileSync5 } from "child_process";
+import { chmodSync as chmodSync3, closeSync as closeSync5, lstatSync as lstatSync3, mkdirSync as mkdirSync5, openSync as openSync5, readFileSync as readFileSync18, realpathSync as realpathSync11, rmdirSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname5, join as join23, relative, sep as sep8 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync10(repoDir), fp = join22(root, f), rel = relative(root, dirname5(fp));
+  const root = realpathSync11(repoDir), fp = join23(root, f), rel = relative(root, dirname5(fp));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
-  for (const part of rel === "" ? [] : rel.split(sep7)) {
-    cur = join22(cur, part);
+  for (const part of rel === "" ? [] : rel.split(sep8)) {
+    cur = join23(cur, part);
     let st2;
     try {
       st2 = lstatSync3(cur);
@@ -16729,11 +16810,11 @@ function safeRestore(repoDir, f, want, mode) {
     else
       unlinkSync3(fp);
   }
-  const fd = openSync4(fp, "wx", mode);
+  const fd = openSync5(fp, "wx", mode);
   try {
     writeFileSync6(fd, want);
   } finally {
-    closeSync4(fd);
+    closeSync5(fd);
   }
   chmodSync3(fp, mode);
 }
@@ -16751,7 +16832,7 @@ async function discardIfSatisfied(git, base, o, staged, keep, repoDir) {
     return { status: "failed", data: {}, reason: "already-satisfied discard failed" };
   const notProven = [];
   for (const [f, v] of Object.entries(o.intake?.preexisting_untracked_blobs ?? {})) {
-    const fp = join22(repoDir, f);
+    const fp = join23(repoDir, f);
     try {
       if (v.startsWith("!")) {
         const st = lstatSync3(fp);
@@ -16759,7 +16840,7 @@ async function discardIfSatisfied(git, base, o, staged, keep, repoDir) {
           throw new Error("changed, not snapshotted");
         continue;
       }
-      const [sha2, mode] = v.split(" "), want = execFileSync4("git", ["cat-file", "blob", sha2], { cwd: repoDir, env: process.env, maxBuffer: 1 << 28 });
+      const [sha2, mode] = v.split(" "), want = execFileSync5("git", ["cat-file", "blob", sha2], { cwd: repoDir, env: process.env, maxBuffer: 1 << 28 });
       safeRestore(repoDir, f, want, parseInt(mode ?? "644", 8));
     } catch {
       notProven.push(f);
@@ -16770,11 +16851,11 @@ async function discardIfSatisfied(git, base, o, staged, keep, repoDir) {
       try {
         let m = 420;
         try {
-          const l = lstatSync3(join22(repoDir, f));
+          const l = lstatSync3(join23(repoDir, f));
           if (l.isFile())
             m = l.mode & 511;
         } catch {}
-        safeRestore(repoDir, f, execFileSync4("git", ["cat-file", "blob", pre[f]], { cwd: repoDir, env: process.env, maxBuffer: 1 << 28 }), m);
+        safeRestore(repoDir, f, execFileSync5("git", ["cat-file", "blob", pre[f]], { cwd: repoDir, env: process.env, maxBuffer: 1 << 28 }), m);
       } catch {
         notProven.push(f);
       }
@@ -16786,8 +16867,8 @@ async function discardIfSatisfied(git, base, o, staged, keep, repoDir) {
 import { dirname as dirname6 } from "path";
 
 // ../../loki-ts/src/e10ext/preexisting_dirty.ts
-import { execFileSync as execFileSync5 } from "child_process";
-var blob2 = (repoDir, path, env = process.env) => execFileSync5("git", ["hash-object", "-w", "--no-filters", "--", path], { cwd: repoDir, encoding: "utf8", env, stdio: ["ignore", "pipe", "ignore"] }).trim();
+import { execFileSync as execFileSync6 } from "child_process";
+var blob2 = (repoDir, path, env = process.env) => execFileSync6("git", ["hash-object", "-w", "--no-filters", "--", path], { cwd: repoDir, encoding: "utf8", env, stdio: ["ignore", "pipe", "ignore"] }).trim();
 function untouchedSinceIntake(repoDir, recorded, env = process.env) {
   if (!recorded || typeof recorded !== "object")
     return [];
@@ -16807,10 +16888,10 @@ function dropSet(repoDir, staged, preexistingDirty, env = process.env) {
 }
 
 // ../../loki-ts/src/e10ext/scope.ts
-import { basename as basename8, dirname as dirname7 } from "path";
+import { basename as basename9, dirname as dirname7 } from "path";
 
 // ../../loki-ts/src/engine10/testmap.ts
-import { basename as basename7, extname, join as join23, relative as relative2, sep as sep8 } from "path";
+import { basename as basename8, extname, join as join24, relative as relative2, sep as sep9 } from "path";
 var SKIP_DIRS = new Set([
   ".git",
   "node_modules",
@@ -16830,12 +16911,12 @@ var JS_TEST_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
 var PY_TEST_RE = /^(test_.+|.+_test)\.py$/;
 var GO_TEST_RE = /_test\.go$/;
 function isTestFile(rel) {
-  const name = basename7(rel);
+  const name = basename8(rel);
   return JS_TEST_RE.test(name) || PY_TEST_RE.test(name) || GO_TEST_RE.test(name);
 }
 
 // ../../loki-ts/src/features/speed/unit_mode.ts
-import { closeSync as closeSync5, constants, fstatSync as fstatSync3, lstatSync as lstatSync4, openSync as openSync5, readSync as readSync3, realpathSync as realpathSync11 } from "fs";
+import { closeSync as closeSync6, constants, fstatSync as fstatSync4, lstatSync as lstatSync4, openSync as openSync6, readSync as readSync4, realpathSync as realpathSync12 } from "fs";
 var MAX_SPEC_BYTES = 1024 * 1024;
 var MAX_TOKEN_BUDGET = 1e9;
 var norm2 = (p) => p.replace(/^\.\//, "");
@@ -16845,15 +16926,15 @@ function readBounded(path) {
   const l = lstatSync4(path);
   if (l.isSymbolicLink() || !l.isFile() || l.size > MAX_SPEC_BYTES)
     return null;
-  const fd = openSync5(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  const fd = openSync6(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
   try {
-    const st = fstatSync3(fd);
+    const st = fstatSync4(fd);
     if (!st.isFile() || st.size > MAX_SPEC_BYTES)
       return null;
     const buf = Buffer.alloc(st.size + 1);
     let n2 = 0;
     for (;; ) {
-      const r = readSync3(fd, buf, n2, buf.length - n2, null);
+      const r = readSync4(fd, buf, n2, buf.length - n2, null);
       if (r <= 0)
         break;
       n2 += r;
@@ -16862,7 +16943,7 @@ function readBounded(path) {
     }
     return buf.subarray(0, n2).toString("utf8");
   } finally {
-    closeSync5(fd);
+    closeSync6(fd);
   }
 }
 function parseText(txt) {
@@ -16923,7 +17004,7 @@ function outsideScope(o, staged) {
 ${typeof o.intake?.task === "string" ? o.intake.task : ""}
 ${contractText(o)}`, pre = o.intake?.preexisting_dirty ?? {};
   const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname7(r)).filter((d) => d !== "."));
-  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename8(f)) && !plannedDirs.has(dirname7(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
+  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename9(f)) && !plannedDirs.has(dirname7(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
 }
 function flagOutsideScope(o, staged) {
   const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
@@ -17007,7 +17088,7 @@ import { spawn as spawn5 } from "child_process";
 
 // ../../loki-ts/src/project_model/discover.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync6, readFileSync as readFileSync19, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 
 // ../../loki-ts/src/engine10/types.ts
 var STAGE_BUDGETS = {
@@ -17024,23 +17105,23 @@ var STAGE_BUDGETS = {
 };
 
 // ../../loki-ts/src/project_model/schema.ts
-import { existsSync as existsSync13, lstatSync as lstatSync5, realpathSync as realpathSync12, statSync as statSync10 } from "fs";
-import { isAbsolute, join as join24, normalize, sep as sep9 } from "path";
+import { existsSync as existsSync13, lstatSync as lstatSync5, realpathSync as realpathSync13, statSync as statSync10 } from "fs";
+import { isAbsolute, join as join25, normalize, sep as sep10 } from "path";
 var PROJECT_MODEL_SCHEMA = "loki.v10.project/1";
 var COMMAND_KINDS = ["test", "lint", "build", "start"];
 var isRec = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var isStr = (v) => typeof v === "string" && v.trim() !== "";
 function safeRel(p) {
-  const n2 = normalize(p.trim()).split(sep9).join("/").replace(/\/$/, "");
+  const n2 = normalize(p.trim()).split(sep10).join("/").replace(/\/$/, "");
   if (n2 === "" || isAbsolute(n2) || n2 === ".." || n2.startsWith("../"))
     return null;
   return n2;
 }
 function insideRepo(repoDir, rel) {
   try {
-    const real2 = realpathSync12(join24(repoDir, rel));
-    const base = realpathSync12(repoDir);
-    return real2 === base || real2.startsWith(base + sep9);
+    const real2 = realpathSync13(join25(repoDir, rel));
+    const base = realpathSync13(repoDir);
+    return real2 === base || real2.startsWith(base + sep10);
   } catch {
     return false;
   }
@@ -17051,7 +17132,7 @@ function checkCitation(repoDir, raw2) {
   const rel = safeRel(raw2.replace(/:\d+(?:-\d+)?$/, ""));
   if (rel === null)
     return `citation "${raw2}" is not a repo-relative path`;
-  const abs = join24(repoDir, rel);
+  const abs = join25(repoDir, rel);
   if (!existsSync13(abs) || !statSync10(abs).isFile() || !insideRepo(repoDir, rel))
     return `citation "${raw2}" names a file that does not exist`;
   return null;
@@ -17063,7 +17144,7 @@ function checkFingerprint(repoDir, raw2) {
   if (rel === null)
     return `fingerprint "${raw2}" is not a repo-relative path`;
   try {
-    if (!lstatSync5(join24(repoDir, rel)).isFile() || !insideRepo(repoDir, rel))
+    if (!lstatSync5(join25(repoDir, rel)).isFile() || !insideRepo(repoDir, rel))
       return `fingerprint "${raw2}" is not a regular file inside the repo`;
   } catch {
     return `fingerprint "${raw2}" names a file that does not exist`;
@@ -17091,7 +17172,7 @@ function checkDir(repoDir, v, where, errs) {
     errs.push(`${where}: must be a repo-relative directory ("." for the repo root)`);
     return ".";
   }
-  const abs = join24(repoDir, rel);
+  const abs = join25(repoDir, rel);
   if (!existsSync13(abs) || !statSync10(abs).isDirectory() || !insideRepo(repoDir, rel))
     errs.push(`${where}: directory "${rel}" does not exist`);
   return rel;
@@ -17186,7 +17267,7 @@ var PROJECT_FILE = ".loki/project.json";
 var UNKNOWN_TTL_MS = 60 * 60 * 1000;
 function loadCached(repoDir, now = Date.now()) {
   try {
-    return parseCached(repoDir, JSON.parse(readFileSync19(join25(repoDir, PROJECT_FILE), "utf8")), now);
+    return parseCached(repoDir, JSON.parse(readFileSync19(join26(repoDir, PROJECT_FILE), "utf8")), now);
   } catch {
     return null;
   }
@@ -17254,7 +17335,7 @@ function isMultiRoot(api) {
 import { createHash as createHash6, randomBytes as randomBytes2 } from "crypto";
 import { existsSync as existsSync15, lstatSync as lstatSync6, mkdirSync as mkdirSync7, readdirSync as readdirSync9, readFileSync as readFileSync20, writeFileSync as writeFileSync8 } from "fs";
 import { createServer } from "net";
-import { dirname as dirname8, isAbsolute as isAbsolute2, join as join26, normalize as normalize2, relative as relative3, sep as sep10 } from "path";
+import { dirname as dirname8, isAbsolute as isAbsolute2, join as join27, normalize as normalize2, relative as relative3, sep as sep11 } from "path";
 var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0";
 var PAGE_RE = /^(?:.*\/)?(?:app|pages|src|public)\/.*\.(?:html|jsx|tsx|vue|svelte)$/;
 var isPageFile = (p) => PAGE_RE.test(p);
@@ -17269,7 +17350,7 @@ function hashScreens(runDir, rels) {
   const out2 = [];
   for (const rel of rels) {
     try {
-      out2.push({ path: rel, sha256: sha256File(join26(runDir, rel)) });
+      out2.push({ path: rel, sha256: sha256File(join27(runDir, rel)) });
     } catch {}
   }
   return out2;
@@ -17282,10 +17363,10 @@ function checkScreens(runDir, screens) {
       return "evidence_screens entry is malformed";
     if (isAbsolute2(s.path) || normalize2(s.path).startsWith(".."))
       return `evidence screenshot path escapes the evidence dir: ${s.path}`;
-    const file = join26(runDir, s.path);
+    const file = join27(runDir, s.path);
     let cur = runDir;
-    for (const seg of normalize2(s.path).split(sep10)) {
-      cur = join26(cur, seg);
+    for (const seg of normalize2(s.path).split(sep11)) {
+      cur = join27(cur, seg);
       if (isSymlink(cur))
         return `evidence screenshot path is a symlink: ${s.path}`;
     }
@@ -17331,12 +17412,12 @@ async function waitUp(url, ms, signal) {
   return false;
 }
 var playwrightBin = (repoDir) => {
-  const bin = join26(repoDir, "node_modules", ".bin", "playwright");
+  const bin = join27(repoDir, "node_modules", ".bin", "playwright");
   return existsSync15(bin) ? bin : null;
 };
 function openapiPaths(repoDir) {
   for (const f of ["openapi.json", "openapi.yaml", "openapi.yml", "swagger.json"]) {
-    const p = join26(repoDir, f);
+    const p = join27(repoDir, f);
     if (!existsSync15(p))
       continue;
     try {
@@ -17350,8 +17431,8 @@ function openapiPaths(repoDir) {
   return [];
 }
 var playwrightTestPkg = (repoDir) => {
-  const d = join26(repoDir, "node_modules", "@playwright", "test");
-  return existsSync15(join26(d, "package.json")) ? d : null;
+  const d = join27(repoDir, "node_modules", "@playwright", "test");
+  return existsSync15(join27(d, "package.json")) ? d : null;
 };
 var e2eSpecSource = (pkgDir, base, routes) => `const { test } = require(${JSON.stringify(pkgDir)});
 test("loki e2e walkthrough", async ({ page }) => {
@@ -17363,24 +17444,24 @@ async function recordE2eMedia(repoDir, runDir, relDir, base, routes, ms, signal)
   if (!pw || !pkg)
     return { rels: [], skipped: "playwright e2e video and trace skipped: @playwright/test is not installed in the repo" };
   try {
-    const dir = join26(runDir, relDir, "e2e");
+    const dir = join27(runDir, relDir, "e2e");
     mkdirSync7(dir, { recursive: true });
-    writeFileSync8(join26(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
-    writeFileSync8(join26(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
+    writeFileSync8(join27(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
+    writeFileSync8(join27(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
 `);
-    if (!await shoot(pw, ["test", "--config", join26(dir, "playwright.config.cjs")], repoDir, ms, signal))
+    if (!await shoot(pw, ["test", "--config", join27(dir, "playwright.config.cjs")], repoDir, ms, signal))
       return { rels: [], skipped: "playwright e2e video and trace skipped: the run failed or timed out" };
     const rels = [];
     const walk = (d) => {
       for (const e of readdirSync9(d, { withFileTypes: true })) {
-        const full = join26(d, e.name);
+        const full = join27(d, e.name);
         if (e.isDirectory())
           walk(full);
         else if (e.isFile() && /\.(webm|zip)$/.test(e.name))
-          rels.push(join26(relDir, "e2e", relative3(dir, full)));
+          rels.push(join27(relDir, "e2e", relative3(dir, full)));
       }
     };
-    walk(join26(dir, "out"));
+    walk(join27(dir, "out"));
     return rels.length > 0 ? { rels, skipped: null } : { rels, skipped: "playwright e2e video and trace skipped: no video or trace was produced" };
   } catch (e) {
     return { rels: [], skipped: `playwright e2e video and trace skipped: ${String(e?.message ?? e).slice(0, 120)}` };
@@ -17474,8 +17555,8 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     if (!visualEvidenceEnabled(opts.env))
       return skip("LOKI_VISUAL_EVIDENCE is 0");
     const api = loadProjectApi(repoDir), boot = isMultiRoot(api) ? api.uiBoot() : null;
-    const appDir = boot ? join26(repoDir, boot.boot.cwd) : repoDir;
-    const pkgPath = join26(appDir, "package.json");
+    const appDir = boot ? join27(repoDir, boot.boot.cwd) : repoDir;
+    const pkgPath = join27(appDir, "package.json");
     let script = null;
     if (!boot) {
       if (!existsSync15(pkgPath))
@@ -17507,20 +17588,20 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (!await waitUp(base, left(), signal))
       return skip(aborted() ? "aborted" : `${script} server did not answer within ${Math.round(budget / 1000)}s`);
-    const evRoot = join26(runDir, "evidence");
+    const evRoot = join27(runDir, "evidence");
     if (isSymlink(evRoot))
       return skip("evidence dir is a symlink");
     mkdirSync7(evRoot, { recursive: true });
     if (pages.length > 0) {
-      const rel0 = join26("evidence", randomBytes2(6).toString("hex"));
-      mkdirSync7(join26(runDir, rel0));
+      const rel0 = join27("evidence", randomBytes2(6).toString("hex"));
+      mkdirSync7(join27(runDir, rel0));
       const rels = [];
       for (const route of [...new Set(pages.map(routeFor))].slice(0, opts.maxRoutes ?? MAX_ROUTES)) {
         if (aborted() || left() <= 0)
           break;
-        const rel = join26(rel0, `${screenName(route)}.png`);
-        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join26(runDir, rel)], appDir, left(), signal);
-        if (ok && !aborted() && !isSymlink(join26(runDir, rel)) && existsSync15(join26(runDir, rel)))
+        const rel = join27(rel0, `${screenName(route)}.png`);
+        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join27(runDir, rel)], appDir, left(), signal);
+        if (ok && !aborted() && !isSymlink(join27(runDir, rel)) && existsSync15(join27(runDir, rel)))
           rels.push(rel);
       }
       if (aborted())
@@ -17545,9 +17626,9 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (aborted())
       return skip("aborted");
-    const hdir = join26(evRoot, randomBytes2(6).toString("hex"));
+    const hdir = join27(evRoot, randomBytes2(6).toString("hex"));
     mkdirSync7(hdir);
-    writeFileSync8(join26(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
+    writeFileSync8(join27(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
 `);
     return { screens: [], http: true, skipped: null };
   } catch (e) {
@@ -17575,7 +17656,7 @@ function receiptScreensProblem(receiptPath, receipt) {
 
 // ../../loki-ts/src/features/contract.ts
 import { existsSync as existsSync16, lstatSync as lstatSync7, mkdirSync as mkdirSync8, readFileSync as readFileSync21, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname9, join as join27 } from "path";
+import { dirname as dirname9, join as join28 } from "path";
 import { createHash as createHash7 } from "crypto";
 var MAX_CRITERIA = 50;
 var MAX_TEXT = 500;
@@ -17610,7 +17691,7 @@ function untracedLines(trace) {
   return trace.criteria.filter((c) => c.status === "no_match").map((c) => `contract ${sanitizeCriterion(c.id)} untraced (no keyword match in changed files): ${sanitizeCriterion(c.text)}`);
 }
 function contractPath(repoDir) {
-  return join27(repoDir, ".loki", "contract.json");
+  return join28(repoDir, ".loki", "contract.json");
 }
 var MAX_CONTRACT_BYTES = 1024 * 1024;
 function readContract(repoDir) {
@@ -17692,14 +17773,14 @@ function sealContract(repoDir, body, rawDiff, checks, env = process.env, snap) {
 // ../../loki-ts/src/features/speed/seal_group.ts
 import { createHash as createHash8 } from "crypto";
 import { existsSync as existsSync17, readdirSync as readdirSync10, readFileSync as readFileSync22, statSync as statSync11 } from "fs";
-import { dirname as dirname10, join as join28 } from "path";
+import { dirname as dirname10, join as join29 } from "path";
 var ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 var PASSING = new Set(["VERIFIED", "ALREADY_SATISFIED"]);
 var sha2 = (b) => createHash8("sha256").update(b).digest("hex");
 var isObj9 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 var text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "";
 var num2 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0;
-var unitsDir = (runDir) => join28(runDir, "group", "units");
+var unitsDir = (runDir) => join29(runDir, "group", "units");
 var readJson3 = (p) => {
   try {
     return JSON.parse(readFileSync22(p, "utf8"));
@@ -17715,7 +17796,7 @@ var dirNames = (d) => {
   }
 };
 function sealGroup(runDir, rh) {
-  const manifestPath = join28(runDir, "group", "manifest.json");
+  const manifestPath = join29(runDir, "group", "manifest.json");
   if (!existsSync17(manifestPath))
     return { section: undefined, notProven: [], problems: 0, allUnitsPass: true };
   const notProven = [];
@@ -17740,7 +17821,7 @@ function sealGroup(runDir, rh) {
       return fail(`unit ${index2} has an invalid, duplicate or case-colliding id`);
     seen.add(id);
     seenLower.add(id.toLowerCase());
-    const dir = join28(unitsDir(runDir), id), rp = join28(dir, "receipt.json"), ep = join28(dir, "events.jsonl");
+    const dir = join29(unitsDir(runDir), id), rp = join29(dir, "receipt.json"), ep = join29(dir, "events.jsonl");
     let bytes;
     try {
       bytes = readFileSync22(rp);
@@ -17785,7 +17866,7 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
   const bad = (reason) => ({ verdict: "TAMPERED", reason: `group: ${reason}` });
   const g = receipt["group"];
   if (g === undefined)
-    return existsSync17(join28(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
+    return existsSync17(join29(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
   if (!isObj9(g) || !ID_RE.test(String(g["group_id"] ?? "")) || !Array.isArray(g["units"]) || g["units"].length === 0)
     return bad("group section malformed");
   const entries = g["units"];
@@ -17797,7 +17878,7 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("unit directories do not match the receipt (missing or extra unit)");
   let unchecked = null;
   for (let i = 0;i < entries.length; i++) {
-    const e = entries[i], id = ids[i], dir = join28(unitsDir(runDir), id), rp = join28(dir, "receipt.json"), ep = join28(dir, "events.jsonl");
+    const e = entries[i], id = ids[i], dir = join29(unitsDir(runDir), id), rp = join29(dir, "receipt.json"), ep = join29(dir, "events.jsonl");
     if (e["index"] !== i)
       return bad(`unit ${id} is out of order (index ${String(e["index"])} at position ${i})`);
     let bytes;
@@ -17865,7 +17946,7 @@ function loadSigningKey(generate = true) {
     let pem = inline ?? "";
     if (!inline) {
       const given = process.env["LOKI_RECEIPT_SIGNING_KEY_FILE"]?.trim();
-      const file = given || join29(process.env["HOME"] || homedir6(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
+      const file = given || join30(process.env["HOME"] || homedir6(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
       try {
         pem = readFileSync23(file);
         if (!given) {
@@ -18014,8 +18095,8 @@ var sealStage = {
       notProven.add(`wall base run not_run: ${wallNotRun}`);
     if (wallNotRun > 0) {
       try {
-        const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename9(String(f.path))));
-        for (const n2 of readdirSync11(join29(ctx.runDir, "wall")).sort())
+        const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename10(String(f.path))));
+        for (const n2 of readdirSync11(join30(ctx.runDir, "wall")).sort())
           if (!kept.has(n2))
             notProven.add(`wall test discarded: ${n2} (not_run)`);
       } catch {}
@@ -18075,7 +18156,7 @@ var sealStage = {
     const cost = ctx.cost.read(ctx.repoDir, iterIds);
     if (cost.unmetered)
       notProven.add("cost unmetered (CLI invoker; recorded as 0)");
-    const eventsPath = join29(ctx.runDir, "events.jsonl");
+    const eventsPath = join30(ctx.runDir, "events.jsonl");
     const wallFiles = Array.isArray(o.wall?.files) ? o.wall.files : [];
     const wallPassed = typeof o.verify?.wall_passed === "boolean" ? o.verify.wall_passed : null;
     if (wallFiles.length > 0 && wallPassed === null)
@@ -18126,10 +18207,10 @@ var sealStage = {
     }
     const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
     mkdirSync9(ctx.runDir, { recursive: true });
-    const path = join29(ctx.runDir, "receipt.json");
+    const path = join30(ctx.runDir, "receipt.json");
     writeFileSync10(path, JSON.stringify(receipt, null, 2) + `
 `);
-    writeFileSync10(join29(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
+    writeFileSync10(join30(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
     const signed = sig.jwt !== null;
     const data = { receipt_path: path, receipt_sha256: hash, signed, kid: sig.kid, verdict, not_proven: receipt.not_proven };
     ctx.emit("receipt.sealed", "seal", { path, receipt_sha256: hash, signed, kid: sig.kid, verdict, not_proven: receipt.not_proven });
@@ -18266,7 +18347,7 @@ function checkEventLog(receiptPath, receipt) {
   const bound = receipt["events_sha256"];
   if (typeof bound !== "string" || bound === createHash10("sha256").digest("hex"))
     return null;
-  const path = join30(dirname12(receiptPath), "events.jsonl");
+  const path = join31(dirname12(receiptPath), "events.jsonl");
   if (!existsSync19(path))
     return "events.jsonl is missing";
   const raw2 = readFileSync25(path, "utf8"), events2 = readEvents(path), lines = raw2.split(`
@@ -18285,7 +18366,7 @@ function checkEventLog(receiptPath, receipt) {
   return h.digest("hex") === bound ? null : "events.jsonl does not match the hash recorded at seal";
 }
 function checkLogSeal(receiptPath, hash, kid, given) {
-  const path = join30(dirname12(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
+  const path = join31(dirname12(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
   if (!events2.some((e) => e.type === "receipt.sealed" && e.data["receipt_sha256"] === hash))
     return { verdict: "TAMPERED", reason: "events.jsonl has no receipt.sealed event for this receipt" };
   if (done < 0)
@@ -18352,8 +18433,8 @@ async function verifyReceipt(receiptPath, deps = {}) {
 }
 
 // src/server/routes/verify.ts
-var ID4 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-var safeId2 = (s) => ID4.test(s) && !s.includes("..");
+var ID5 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var safeId2 = (s) => ID5.test(s) && !s.includes("..");
 function mount19(ctx) {
   const { act, db } = ctx;
   act.post("/v1/runs/:source/:run/verify", async (c) => {
@@ -18375,15 +18456,15 @@ function mount19(ctx) {
       return done(404, "receipt not available", "not_found");
     let runDir, file;
     try {
-      const root = realpathSync13(join31(repo.p, ".loki", "runs"));
-      runDir = realpathSync13(join31(root, run2));
-      if (runDir !== join31(root, run2))
+      const root = realpathSync14(join32(repo.p, ".loki", "runs"));
+      runDir = realpathSync14(join32(root, run2));
+      if (runDir !== join32(root, run2))
         return done(404, "receipt not found", "not_found");
-      file = realpathSync13(join31(runDir, "receipt.json"));
+      file = realpathSync14(join32(runDir, "receipt.json"));
     } catch {
       return done(404, "receipt not found", "not_found");
     }
-    if (!file.startsWith(runDir + sep11))
+    if (!file.startsWith(runDir + sep12))
       return done(404, "receipt not found", "not_found");
     let integrity, reasons, sha3 = null, outcome = "UNREADABLE";
     try {
@@ -18435,7 +18516,7 @@ function mount19(ctx) {
 // src/server/routes/index.ts
 var routeModules = [mount, mount18, mount5, mount7, mount17, mount8, mount3, mount9, mount11, mount4, mount10, mount12, mount6, mount16, mount19, mount13, mount15, mount2, mount14];
 function registerRoutes(ctx) {
-  mountRepos(ctx.act, ctx.db, ctx.peerIsLoopback);
+  mountRepos(ctx.act, ctx.db, ctx.peerIsLoopback, ctx.repoDir);
   for (const m of routeModules)
     m(ctx);
 }
@@ -18461,7 +18542,7 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now = Date.now) {
 
 // src/server/legacy/shim.ts
 import { existsSync as existsSync20, readFileSync as readFileSync27 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 
 // src/server/legacy/routes.ts
 var LEGACY_ROUTES = [
@@ -18833,7 +18914,7 @@ var logged = new Set;
 var toHono = (p) => p.replace(/\{([A-Za-z_]+):path\}/g, ":$1{.+}").replace(/\{([A-Za-z_]+)\}/g, ":$1");
 var NOT_SUPPORTED = "not yet supported by the Control Plane";
 var repoVersion = () => {
-  for (const f of [join32(import.meta.dir, "../../../../../VERSION")]) {
+  for (const f of [join33(import.meta.dir, "../../../../../VERSION")]) {
     try {
       if (existsSync20(f))
         return readFileSync27(f, "utf8").trim();
@@ -19018,7 +19099,7 @@ function legacyShim(opts) {
 
 // src/server/app.ts
 var MAX_BODY2 = 1e6;
-var defaultUiDir = () => [join33(import.meta.dir, "../../ui/dist"), join33(import.meta.dir, "../ui/dist")].find((d) => existsSync21(join33(d, "index.html")));
+var defaultUiDir = () => [join34(import.meta.dir, "../../ui/dist"), join34(import.meta.dir, "../ui/dist")].find((d) => existsSync21(join34(d, "index.html")));
 function createApp(opts) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
@@ -19142,13 +19223,13 @@ function createApp(opts) {
     }
     if (!uiDir || p.startsWith("/v1/"))
       return c.json({ error: "not found" }, 404);
-    const root = resolve6(uiDir);
-    const f = resolve6(root, `.${p}`);
-    if (f.startsWith(root + sep12) && existsSync21(f) && statSync14(f).isFile())
+    const root = resolve7(uiDir);
+    const f = resolve7(root, `.${p}`);
+    if (f.startsWith(root + sep13) && existsSync21(f) && statSync14(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))
       return c.json({ error: "not found" }, 404);
-    return new Response(Bun.file(join33(root, "index.html")));
+    return new Response(Bun.file(join34(root, "index.html")));
   });
   return { app, db, close: () => sqlite.close() };
 }