loki-mode 10.11.0 → 10.11.2

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '10.11.0'
+__version__ = '10.11.2'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "10.11.0",
+  "version": "10.11.2",
   "description": "An autonomous software factory that knows what it is supposed to deliver, and proves it did.",
   "keywords": [
     "agent",

package/packages/control-plane/dist/server.js

@@ -16933,204 +16933,11 @@ function dropSet(repoDir, staged, preexistingDirty, env = process.env) {
 import { basename as basename9, dirname as dirname7 } from "path";
 
 // ../../loki-ts/src/engine10/testmap.ts
-import { basename as basename8, extname, join as join24, relative as relative2, sep as sep9 } from "path";
-var SKIP_DIRS = new Set([
-  ".git",
-  "node_modules",
-  "dist",
-  "build",
-  "target",
-  "coverage",
-  ".venv",
-  "venv",
-  "__pycache__",
-  ".tox",
-  ".pytest_cache",
-  ".loki",
-  ".next"
-]);
-var JS_TEST_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
-var PY_TEST_RE = /^(test_.+|.+_test)\.py$/;
-var GO_TEST_RE = /_test\.go$/;
-function isTestFile(rel) {
-  const name = basename8(rel);
-  return JS_TEST_RE.test(name) || PY_TEST_RE.test(name) || GO_TEST_RE.test(name);
-}
-
-// ../../loki-ts/src/features/speed/unit_mode.ts
-import { closeSync as closeSync6, constants, fstatSync as fstatSync4, lstatSync as lstatSync4, openSync as openSync6, readSync as readSync4, realpathSync as realpathSync12 } from "fs";
-var MAX_SPEC_BYTES = 1024 * 1024;
-var MAX_TOKEN_BUDGET = 1e9;
-var norm2 = (p) => p.replace(/^\.\//, "");
-var CTRL = /[\x00-\x1f\x7f]/;
-var strs = (v) => Array.isArray(v) && v.every((x) => typeof x === "string" && !CTRL.test(x)) ? v.map(norm2) : null;
-function readBounded(path) {
-  const l = lstatSync4(path);
-  if (l.isSymbolicLink() || !l.isFile() || l.size > MAX_SPEC_BYTES)
-    return null;
-  const fd = openSync6(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-  try {
-    const st = fstatSync4(fd);
-    if (!st.isFile() || st.size > MAX_SPEC_BYTES)
-      return null;
-    const buf = Buffer.alloc(st.size + 1);
-    let n2 = 0;
-    for (;; ) {
-      const r = readSync4(fd, buf, n2, buf.length - n2, null);
-      if (r <= 0)
-        break;
-      n2 += r;
-      if (n2 >= buf.length)
-        return null;
-    }
-    return buf.subarray(0, n2).toString("utf8");
-  } finally {
-    closeSync6(fd);
-  }
-}
-function parseText(txt) {
-  try {
-    const j = JSON.parse(txt), ws = strs(j.writeSet), pack = strs(j.pack), tb = j.tokenBudget;
-    if (typeof j.id !== "string" || !j.id || !ws || ws.length === 0 || !pack || typeof tb !== "number" || !Number.isFinite(tb) || !(tb > 0) || tb > MAX_TOKEN_BUDGET)
-      return null;
-    return { id: j.id, writeSet: ws, pack, tokenBudget: tb };
-  } catch {
-    return null;
-  }
-}
-function parseSpec(path) {
-  try {
-    const txt = readBounded(path);
-    return txt === null ? null : parseText(txt);
-  } catch {
-    return null;
-  }
-}
-var memo = new Map;
-function unitSpec(env = process.env) {
-  const path = env["LOKI_UNIT_SPEC"], frozen = env["LOKI_UNIT_SPEC_FROZEN"];
-  if (env["LOKI_SPEED"] === "0" || !path)
-    return null;
-  if (frozen !== undefined)
-    return frozen.length <= MAX_SPEC_BYTES ? parseText(frozen) : null;
-  if (!memo.has(path))
-    memo.set(path, parseSpec(path));
-  return memo.get(path) ?? null;
-}
-var inWriteSet = (spec, f) => spec.writeSet.some((w) => w.endsWith("/") ? f.startsWith(w) : f === w);
-function unitFlags(staged, env = process.env, pre = {}) {
-  const s = unitSpec(env);
-  return s ? staged.filter(({ f }) => !inWriteSet(s, f) && !Object.hasOwn(pre, f)).map(({ f }) => f) : null;
-}
-
-// ../../loki-ts/src/e10ext/scope.ts
-var SCOPE_UNDETERMINED = "scope not determined; all edits committed";
-var outsideNote = (f) => `outside stated scope: ${f}`;
-var esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-var mentions = (text2, name) => new RegExp(`(?<![\\w./-])${esc(name)}(?![\\w-]|\\.\\w)`).test(text2);
-var STOP = new Set(["the", "and", "for", "with", "that", "this", "all", "any", "src", "from", "into", "each", "across", "apply", "add", "use", "make"]);
-var stem = (w) => w.length > 3 && w.endsWith("s") ? w.slice(0, -1) : w;
-var surfaceTokens = (text2) => new Set((text2.toLowerCase().match(/[a-z][a-z0-9_-]{2,}/g) ?? []).filter((w) => !STOP.has(w)).map(stem));
-var dirSegs = (f) => f.split("/").slice(0, -1).map((d) => stem(d.toLowerCase()));
-function contractText(o) {
-  const c = o.intake?.contract_snapshot?.contract;
-  return Array.isArray(c?.criteria) ? c.criteria.map((x) => typeof x?.text === "string" ? x.text : "").join(`
-`) : "";
-}
-function outsideScope(o, staged) {
-  const rel = Array.isArray(o.plan?.relevant_files) ? o.plan.relevant_files.filter((x) => typeof x === "string") : [];
-  const plan = typeof o.plan?.plan === "string" ? o.plan.plan : "";
-  if (rel.length === 0 && plan.trim() === "")
-    return null;
-  const text2 = `${plan}
-${typeof o.intake?.task === "string" ? o.intake.task : ""}
-${contractText(o)}`, pre = o.intake?.preexisting_dirty ?? {};
-  const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname7(r)).filter((d) => d !== "."));
-  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename9(f)) && !plannedDirs.has(dirname7(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
-}
-function flagOutsideScope(o, staged) {
-  const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
-  const un = outsideScope(o, staged), seen = new Set((unit ?? []).map(outsideNote));
-  return [...(unit ?? []).map(outsideNote), ...un ? un.map(outsideNote).filter((n2) => !seen.has(n2)) : staged.length > 0 ? [SCOPE_UNDETERMINED] : []];
-}
-
-// ../../loki-ts/src/util/receipt_signer.ts
-var RECEIPT_SIGNER_BASENAME = "receipt-ed25519.pem";
-
-// ../../loki-ts/src/util/shell.ts
-var MAX_STDOUT_BYTES = 16 * 1024 * 1024;
-async function readStreamCapped(stream, maxBytes = MAX_STDOUT_BYTES) {
-  const reader = stream.getReader();
-  const decoder = new TextDecoder;
-  let out2 = "";
-  let total = 0;
-  try {
-    while (total < maxBytes) {
-      const { done, value } = await reader.read();
-      if (done)
-        break;
-      if (!value)
-        continue;
-      total += value.byteLength;
-      if (total > maxBytes) {
-        const keep = value.byteLength - (total - maxBytes);
-        out2 += decoder.decode(value.subarray(0, keep), { stream: true });
-        break;
-      }
-      out2 += decoder.decode(value, { stream: true });
-    }
-    out2 += decoder.decode();
-  } finally {
-    try {
-      await reader.cancel();
-    } catch {}
-    reader.releaseLock();
-  }
-  return out2;
-}
-async function run(argv, opts = {}) {
-  const proc = Bun.spawn({
-    cmd: [...argv],
-    stdout: "pipe",
-    stderr: "pipe",
-    env: opts.env ? { ...process.env, ...opts.env } : process.env,
-    cwd: opts.cwd
-  });
-  let timer;
-  let killTimer;
-  if (opts.timeoutMs && opts.timeoutMs > 0) {
-    timer = setTimeout(() => {
-      try {
-        proc.kill("SIGTERM");
-      } catch {}
-      killTimer = setTimeout(() => {
-        try {
-          proc.kill("SIGKILL");
-        } catch {}
-      }, 2000);
-    }, opts.timeoutMs);
-  }
-  try {
-    const [stdout, stderr, exitCode] = await Promise.all([
-      readStreamCapped(proc.stdout),
-      new Response(proc.stderr).text(),
-      proc.exited
-    ]);
-    return { stdout, stderr, exitCode };
-  } finally {
-    if (timer)
-      clearTimeout(timer);
-    if (killTimer)
-      clearTimeout(killTimer);
-  }
-}
-
-// ../../loki-ts/src/features/visual_evidence.ts
-import { spawn as spawn5 } from "child_process";
+import { basename as basename8, extname, join as join26, relative as relative2, sep as sep10 } from "path";
 
 // ../../loki-ts/src/project_model/discover.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync6, readFileSync as readFileSync19, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "fs";
-import { join as join26 } from "path";
+import { join as join25 } from "path";
 
 // ../../loki-ts/src/engine10/types.ts
 var STAGE_BUDGETS = {
@@ -17147,23 +16954,23 @@ var STAGE_BUDGETS = {
 };
 
 // ../../loki-ts/src/project_model/schema.ts
-import { existsSync as existsSync13, lstatSync as lstatSync5, realpathSync as realpathSync13, statSync as statSync10 } from "fs";
-import { isAbsolute, join as join25, normalize, sep as sep10 } from "path";
+import { existsSync as existsSync13, lstatSync as lstatSync4, realpathSync as realpathSync12, statSync as statSync10 } from "fs";
+import { isAbsolute, join as join24, normalize, sep as sep9 } from "path";
 var PROJECT_MODEL_SCHEMA = "loki.v10.project/1";
 var COMMAND_KINDS = ["test", "lint", "build", "start"];
 var isRec = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var isStr = (v) => typeof v === "string" && v.trim() !== "";
 function safeRel(p) {
-  const n2 = normalize(p.trim()).split(sep10).join("/").replace(/\/$/, "");
+  const n2 = normalize(p.trim()).split(sep9).join("/").replace(/\/$/, "");
   if (n2 === "" || isAbsolute(n2) || n2 === ".." || n2.startsWith("../"))
     return null;
   return n2;
 }
 function insideRepo(repoDir, rel) {
   try {
-    const real2 = realpathSync13(join25(repoDir, rel));
-    const base = realpathSync13(repoDir);
-    return real2 === base || real2.startsWith(base + sep10);
+    const real2 = realpathSync12(join24(repoDir, rel));
+    const base = realpathSync12(repoDir);
+    return real2 === base || real2.startsWith(base + sep9);
   } catch {
     return false;
   }
@@ -17174,7 +16981,7 @@ function checkCitation(repoDir, raw2) {
   const rel = safeRel(raw2.replace(/:\d+(?:-\d+)?$/, ""));
   if (rel === null)
     return `citation "${raw2}" is not a repo-relative path`;
-  const abs = join25(repoDir, rel);
+  const abs = join24(repoDir, rel);
   if (!existsSync13(abs) || !statSync10(abs).isFile() || !insideRepo(repoDir, rel))
     return `citation "${raw2}" names a file that does not exist`;
   return null;
@@ -17186,7 +16993,7 @@ function checkFingerprint(repoDir, raw2) {
   if (rel === null)
     return `fingerprint "${raw2}" is not a repo-relative path`;
   try {
-    if (!lstatSync5(join25(repoDir, rel)).isFile() || !insideRepo(repoDir, rel))
+    if (!lstatSync4(join24(repoDir, rel)).isFile() || !insideRepo(repoDir, rel))
       return `fingerprint "${raw2}" is not a regular file inside the repo`;
   } catch {
     return `fingerprint "${raw2}" names a file that does not exist`;
@@ -17214,7 +17021,7 @@ function checkDir(repoDir, v, where, errs) {
     errs.push(`${where}: must be a repo-relative directory ("." for the repo root)`);
     return ".";
   }
-  const abs = join25(repoDir, rel);
+  const abs = join24(repoDir, rel);
   if (!existsSync13(abs) || !statSync10(abs).isDirectory() || !insideRepo(repoDir, rel))
     errs.push(`${where}: directory "${rel}" does not exist`);
   return rel;
@@ -17331,7 +17138,7 @@ var PROJECT_FILE = ".loki/project.json";
 var UNKNOWN_TTL_MS = 60 * 60 * 1000;
 function loadCached(repoDir, now = Date.now()) {
   try {
-    return parseCached(repoDir, JSON.parse(readFileSync19(join26(repoDir, PROJECT_FILE), "utf8")), now);
+    return parseCached(repoDir, JSON.parse(readFileSync19(join25(repoDir, PROJECT_FILE), "utf8")), now);
   } catch {
     return null;
   }
@@ -17403,7 +17210,205 @@ function isMultiRoot(api) {
   return !!api && api.known() && api.packages().some((p) => p.root !== ".");
 }
 
+// ../../loki-ts/src/project_model/scope.ts
+var apis = new WeakMap;
+var imports = new WeakMap;
+var dropped = new WeakMap;
+
+// ../../loki-ts/src/engine10/testmap.ts
+var SKIP_DIRS = new Set([
+  ".git",
+  "node_modules",
+  "dist",
+  "build",
+  "target",
+  "coverage",
+  ".venv",
+  "venv",
+  "__pycache__",
+  ".tox",
+  ".pytest_cache",
+  ".loki",
+  ".next"
+]);
+var JS_TEST_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
+var PY_TEST_RE = /^(test_.+|.+_test)\.py$/;
+var GO_TEST_RE = /_test\.go$/;
+function isTestFile(rel) {
+  const name = basename8(rel);
+  return JS_TEST_RE.test(name) || PY_TEST_RE.test(name) || GO_TEST_RE.test(name);
+}
+
+// ../../loki-ts/src/features/speed/unit_mode.ts
+import { closeSync as closeSync6, constants, fstatSync as fstatSync4, lstatSync as lstatSync5, openSync as openSync6, readSync as readSync4, realpathSync as realpathSync13 } from "fs";
+var MAX_SPEC_BYTES = 1024 * 1024;
+var MAX_TOKEN_BUDGET = 1e9;
+var norm2 = (p) => p.replace(/^\.\//, "");
+var CTRL = /[\x00-\x1f\x7f]/;
+var strs = (v) => Array.isArray(v) && v.every((x) => typeof x === "string" && !CTRL.test(x)) ? v.map(norm2) : null;
+function readBounded(path) {
+  const l = lstatSync5(path);
+  if (l.isSymbolicLink() || !l.isFile() || l.size > MAX_SPEC_BYTES)
+    return null;
+  const fd = openSync6(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const st = fstatSync4(fd);
+    if (!st.isFile() || st.size > MAX_SPEC_BYTES)
+      return null;
+    const buf = Buffer.alloc(st.size + 1);
+    let n2 = 0;
+    for (;; ) {
+      const r = readSync4(fd, buf, n2, buf.length - n2, null);
+      if (r <= 0)
+        break;
+      n2 += r;
+      if (n2 >= buf.length)
+        return null;
+    }
+    return buf.subarray(0, n2).toString("utf8");
+  } finally {
+    closeSync6(fd);
+  }
+}
+function parseText(txt) {
+  try {
+    const j = JSON.parse(txt), ws = strs(j.writeSet), pack = strs(j.pack), tb = j.tokenBudget;
+    if (typeof j.id !== "string" || !j.id || !ws || ws.length === 0 || !pack || typeof tb !== "number" || !Number.isFinite(tb) || !(tb > 0) || tb > MAX_TOKEN_BUDGET)
+      return null;
+    return { id: j.id, writeSet: ws, pack, tokenBudget: tb };
+  } catch {
+    return null;
+  }
+}
+function parseSpec(path) {
+  try {
+    const txt = readBounded(path);
+    return txt === null ? null : parseText(txt);
+  } catch {
+    return null;
+  }
+}
+var memo = new Map;
+function unitSpec(env = process.env) {
+  const path = env["LOKI_UNIT_SPEC"], frozen = env["LOKI_UNIT_SPEC_FROZEN"];
+  if (env["LOKI_SPEED"] === "0" || !path)
+    return null;
+  if (frozen !== undefined)
+    return frozen.length <= MAX_SPEC_BYTES ? parseText(frozen) : null;
+  if (!memo.has(path))
+    memo.set(path, parseSpec(path));
+  return memo.get(path) ?? null;
+}
+var inWriteSet = (spec, f) => spec.writeSet.some((w) => w.endsWith("/") ? f.startsWith(w) : f === w);
+function unitFlags(staged, env = process.env, pre = {}) {
+  const s = unitSpec(env);
+  return s ? staged.filter(({ f }) => !inWriteSet(s, f) && !Object.hasOwn(pre, f)).map(({ f }) => f) : null;
+}
+
+// ../../loki-ts/src/e10ext/scope.ts
+var SCOPE_UNDETERMINED = "scope not determined; all edits committed";
+var outsideNote = (f) => `outside stated scope: ${f}`;
+var esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var mentions = (text2, name) => new RegExp(`(?<![\\w./-])${esc(name)}(?![\\w-]|\\.\\w)`).test(text2);
+var STOP = new Set(["the", "and", "for", "with", "that", "this", "all", "any", "src", "from", "into", "each", "across", "apply", "add", "use", "make"]);
+var stem = (w) => w.length > 3 && w.endsWith("s") ? w.slice(0, -1) : w;
+var surfaceTokens = (text2) => new Set((text2.toLowerCase().match(/[a-z][a-z0-9_-]{2,}/g) ?? []).filter((w) => !STOP.has(w)).map(stem));
+var dirSegs = (f) => f.split("/").slice(0, -1).map((d) => stem(d.toLowerCase()));
+function contractText(o) {
+  const c = o.intake?.contract_snapshot?.contract;
+  return Array.isArray(c?.criteria) ? c.criteria.map((x) => typeof x?.text === "string" ? x.text : "").join(`
+`) : "";
+}
+function outsideScope(o, staged) {
+  const rel = Array.isArray(o.plan?.relevant_files) ? o.plan.relevant_files.filter((x) => typeof x === "string") : [];
+  const plan = typeof o.plan?.plan === "string" ? o.plan.plan : "";
+  if (rel.length === 0 && plan.trim() === "")
+    return null;
+  const text2 = `${plan}
+${typeof o.intake?.task === "string" ? o.intake.task : ""}
+${contractText(o)}`, pre = o.intake?.preexisting_dirty ?? {};
+  const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname7(r)).filter((d) => d !== "."));
+  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename9(f)) && !plannedDirs.has(dirname7(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
+}
+function flagOutsideScope(o, staged) {
+  const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
+  const un = outsideScope(o, staged), seen = new Set((unit ?? []).map(outsideNote));
+  return [...(unit ?? []).map(outsideNote), ...un ? un.map(outsideNote).filter((n2) => !seen.has(n2)) : staged.length > 0 ? [SCOPE_UNDETERMINED] : []];
+}
+
+// ../../loki-ts/src/util/receipt_signer.ts
+var RECEIPT_SIGNER_BASENAME = "receipt-ed25519.pem";
+
+// ../../loki-ts/src/util/shell.ts
+var MAX_STDOUT_BYTES = 16 * 1024 * 1024;
+async function readStreamCapped(stream, maxBytes = MAX_STDOUT_BYTES) {
+  const reader = stream.getReader();
+  const decoder = new TextDecoder;
+  let out2 = "";
+  let total = 0;
+  try {
+    while (total < maxBytes) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      if (!value)
+        continue;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        const keep = value.byteLength - (total - maxBytes);
+        out2 += decoder.decode(value.subarray(0, keep), { stream: true });
+        break;
+      }
+      out2 += decoder.decode(value, { stream: true });
+    }
+    out2 += decoder.decode();
+  } finally {
+    try {
+      await reader.cancel();
+    } catch {}
+    reader.releaseLock();
+  }
+  return out2;
+}
+async function run(argv, opts = {}) {
+  const proc = Bun.spawn({
+    cmd: [...argv],
+    stdout: "pipe",
+    stderr: "pipe",
+    env: opts.env ? { ...process.env, ...opts.env } : process.env,
+    cwd: opts.cwd
+  });
+  let timer;
+  let killTimer;
+  if (opts.timeoutMs && opts.timeoutMs > 0) {
+    timer = setTimeout(() => {
+      try {
+        proc.kill("SIGTERM");
+      } catch {}
+      killTimer = setTimeout(() => {
+        try {
+          proc.kill("SIGKILL");
+        } catch {}
+      }, 2000);
+    }, opts.timeoutMs);
+  }
+  try {
+    const [stdout, stderr, exitCode] = await Promise.all([
+      readStreamCapped(proc.stdout),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]);
+    return { stdout, stderr, exitCode };
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+    if (killTimer)
+      clearTimeout(killTimer);
+  }
+}
+
 // ../../loki-ts/src/features/visual_evidence.ts
+import { spawn as spawn5 } from "child_process";
 import { createHash as createHash6, randomBytes as randomBytes2 } from "crypto";
 import { existsSync as existsSync15, lstatSync as lstatSync6, mkdirSync as mkdirSync7, readdirSync as readdirSync9, readFileSync as readFileSync20, writeFileSync as writeFileSync8 } from "fs";
 import { createServer } from "net";
@@ -18087,7 +18092,7 @@ var commitStage = {
       return sat;
     if (drop.length > 0 && (await git(ctx, ["--literal-pathspecs", "reset", "-q", ctx.baseSha, "--", ...drop.map(({ f }) => f)])).code !== 0)
       return { status: "failed", data: {}, reason: "git reset failed" };
-    const dropped = new Set(drop.map(({ f }) => f)), notes = flagOutsideScope(ctx.outputs(), staged.filter(({ f }) => !dropped.has(f)));
+    const dropped2 = new Set(drop.map(({ f }) => f)), notes = flagOutsideScope(ctx.outputs(), staged.filter(({ f }) => !dropped2.has(f)));
     if ((await git(ctx, ["diff", "--cached", "--quiet"])).code === 0)
       return { status: "completed", data: { committed: false, scope_notes: notes } };
     const title = (str3(ctx.outputs().intake?.title) ?? `run ${ctx.runId}`).split(`
@@ -18189,7 +18194,7 @@ var sealStage = {
     }
     if (!diffOk)
       notProven.add("diff not computed (git diff-tree failed)");
-    const dropped = new Set;
+    const dropped2 = new Set;
     const tcs = o.verify?.["test_counts"];
     const cnt = (x) => {
       const c = x;
@@ -18204,7 +18209,7 @@ var sealStage = {
       const mine = assertDeltaNotes(ctx.repoDir, ctx.baseSha, head, t, str3(o.intake?.task) ?? "", cnt(tc?.b), cnt(tc?.h));
       if (!mine || mine.length !== vl.length || mine.some((n2) => !vl.includes(n2)))
         for (const v of vl)
-          dropped.add(v);
+          dropped2.add(v);
     }
     for (const c of checks)
       if (c.result === "not_run")
@@ -18212,7 +18217,7 @@ var sealStage = {
     for (const f of strs2(o.verify?.flaky))
       notProven.add(`flaky test: ${f}`);
     for (const n2 of verifyNotProven)
-      if (!dropped.has(n2))
+      if (!dropped2.has(n2))
         notProven.add(n2);
     for (const n2 of [...strs2(o.commit?.not_proven), ...strs2(o.commit?.scope_notes)])
       notProven.add(n2);

package/packages/control-plane/package.json

@@ -11,9 +11,11 @@
     "db:generate": "drizzle-kit generate --dialect sqlite --schema ./src/db/schema.ts --out ./drizzle"
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "drizzle-orm": "^0.45.3",
     "hono": "^4.13.12",
-    "yaml": "^2.9.1"
+    "yaml": "^2.9.1",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@playwright/test": "1.58.1",

package/packages/control-plane/src/ask/tools.ts

@@ -0,0 +1,111 @@
+// CP-ASK slice 2: read-only data tools for Ask Loki, as pure functions over the CP database.
+// Nothing here writes, spawns a build, or returns a path, URL or token. Run, event and artifact text is untrusted data.
+// Cost and events reuse the route handlers through an in-process Hono (no HTTP, no duplicated logic); the artifact
+// allowlist and read cap come from routes/artifacts.ts.
+import { realpathSync } from "node:fs";
+import { join, sep } from "node:path";
+import { eq } from "drizzle-orm";
+import { Hono } from "hono";
+import type { Db } from "../db/migrate.ts";
+import { localRepos } from "../db/schema.ts";
+import { mount as mountArtifacts, NAME, readCapped, safeId } from "../server/routes/artifacts.ts";
+import { mount as mountCost } from "../server/routes/cost.ts";
+import { computeStats } from "../server/routes/stats.ts";
+import type { RouteCtx } from "../server/routes/index.ts";
+import { repoNames } from "../server/repos.ts";
+import { listRuns, runDetail } from "../server/runs.ts";
+
+export type ToolResult = Record<string, unknown>;
+export const TOOL_NAMES = ["runs_search", "run_get", "run_events", "run_artifact", "runs_compare", "stats", "cost", "repos_list"] as const;
+
+const err = (error: string): ToolResult => ({ error });
+const isoOk = (s: string | undefined) => s === undefined || (!Number.isNaN(Date.parse(s)) && /^\d{4}-\d{2}-\d{2}/.test(s));
+
+function internal(db: Db): Hono {
+  const app = new Hono();
+  const ctx = { app, act: new Hono(), db } as unknown as RouteCtx;
+  mountCost(ctx);
+  mountArtifacts(ctx);
+  return app;
+}
+
+async function internalGet(db: Db, path: string): Promise<ToolResult> {
+  const r = await internal(db).request(path);
+  const body = (await r.json().catch(() => ({ error: "unreadable response" }))) as ToolResult;
+  return r.status === 200 ? body : err(typeof body.error === "string" ? body.error : `request failed (${r.status})`);
+}
+
+export function runsSearch(db: Db, a: { verdict?: string; repo?: string; since?: string; until?: string; group_id?: string; limit?: number; cursor?: string }): ToolResult {
+  if (!isoOk(a.since) || !isoOk(a.until)) return err("since and until must be ISO dates");
+  if (a.limit !== undefined && (!Number.isInteger(a.limit) || a.limit < 1 || a.limit > 200)) return err("limit must be 1..200");
+  return listRuns(db, a);
+}
+
+export function runGet(db: Db, a: { source_id: string; run_id: string }): ToolResult {
+  if (!safeId(a.source_id) || !safeId(a.run_id)) return err("invalid source_id or run_id");
+  return runDetail(db, a.source_id, a.run_id) ?? err("run not found");
+}
+
+export async function runEvents(db: Db, a: { source_id: string; run_id: string; after?: number; limit?: number }): Promise<ToolResult> {
+  if (!safeId(a.source_id) || !safeId(a.run_id)) return err("invalid source_id or run_id");
+  if (a.after !== undefined && (!Number.isInteger(a.after) || a.after < 0)) return err("after must be a non-negative integer");
+  if (a.limit !== undefined && (!Number.isInteger(a.limit) || a.limit < 1)) return err("limit must be a positive integer");
+  const q = new URLSearchParams();
+  if (a.after !== undefined) q.set("after", String(a.after));
+  if (a.limit !== undefined) q.set("limit", String(a.limit));
+  return internalGet(db, `/v1/runs/${a.source_id}/${a.run_id}/events?${q}`);
+}
+
+/** One allowlisted artifact of a run, read through the same containment the HTTP route uses. Binary (png) is refused. */
+export function runArtifact(db: Db, a: { source_id: string; run_id: string; name: string }): ToolResult {
+  if (!safeId(a.source_id) || !safeId(a.run_id)) return err("invalid source_id or run_id");
+  if (typeof a.name !== "string" || !NAME.test(a.name)) return err("artifact is not on the allowlist");
+  if (a.name.endsWith(".png")) return err("binary artifacts are not readable through this tool");
+  if (!runDetail(db, a.source_id, a.run_id)) return err("run not found");
+  const repo = db.select({ p: localRepos.realpath }).from(localRepos).where(eq(localRepos.sourceId, a.source_id)).get();
+  if (!repo) return err("artifact not available");
+  try {
+    const runsRoot = realpathSync(join(repo.p, ".loki", "runs"));
+    const runDir = realpathSync(join(runsRoot, a.run_id));
+    if (runDir !== join(runsRoot, a.run_id)) return err("artifact not found");
+    const file = realpathSync(join(runDir, a.name));
+    if (!file.startsWith(runDir + sep)) return err("artifact not found");
+    const r = readCapped(file);
+    if (r.status !== 200) return err(r.status === 413 ? "artifact too large" : "artifact not found");
+    return { name: a.name, content: r.body.toString("utf8") };
+  } catch { return err("artifact not found"); }
+}
+
+/** Both runs side by side: ids, verdicts, costs, tokens and the cost delta (b minus a). */
+export function runsCompare(db: Db, a: { source_a: string; run_a: string; source_b: string; run_b: string }): ToolResult {
+  const out: Record<string, unknown>[] = [];
+  for (const [s, r] of [[a.source_a, a.run_a], [a.source_b, a.run_b]] as const) {
+    const d = runGet(db, { source_id: s, run_id: r }) as Record<string, any>;
+    if (d.error) return err(`${s}/${r}: ${d.error}`);
+    out.push({
+      source_id: d.source_id, run_id: d.run_id, origin_repo: d.origin_repo, verdict: d.verdict, effective_verdict: d.effective_verdict,
+      status: d.status, provider: d.provider, model: d.model, cost_usd: d.cost_usd, partial_usd: d.partial_usd,
+      input_tokens: d.input_tokens, output_tokens: d.output_tokens, wall_s: d.wall_s, pr_url: d.pr_url, tampered: d.tampered,
+    });
+  }
+  const ca = out[0]?.cost_usd, cb = out[1]?.cost_usd;
+  const delta = typeof ca === "number" && typeof cb === "number" ? Math.round((cb - ca) * 1e6) / 1e6 : null;
+  return { runs: out, cost_delta_usd: delta };
+}
+
+export function stats(db: Db, a: { since?: string }): ToolResult {
+  if (!isoOk(a.since)) return err("since must be an ISO date");
+  return computeStats(db, a.since === undefined ? null : new Date(a.since).toISOString()) as unknown as ToolResult;
+}
+
+export function cost(db: Db, a: { group?: string; since?: string }): Promise<ToolResult> | ToolResult {
+  if (!isoOk(a.since)) return err("since must be an ISO date");
+  const q = new URLSearchParams({ group: a.group ?? "day" });
+  if (a.since) q.set("since", a.since);
+  return internalGet(db, `/v1/stats/cost?${q}`);
+}
+
+/** Display names only, never paths. */
+export function reposList(db: Db): ToolResult {
+  return { repos: repoNames(db) };
+}