loki-mode 10.11.0 → 11.0.0

package/packages/control-plane/src/server/app.ts

@@ -1,4 +1,4 @@
-import { existsSync, statSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
 import { Hono, type Context } from "hono";
 import { cleanupLeakedFixtures } from "../db/fixture-cleanup.ts";
@@ -10,7 +10,8 @@ import { hostGuard, isLoopbackHost, peerIsLoopback, tokenGuard } from "./auth.ts
 import { backfill } from "../shipper/backfill.ts";
 import { removeRun } from "../db/prune.ts";
 import type { spawnStart } from "./spawn.ts";
-import { syncLocalRepos } from "./repos.ts";
+import { reconcileDeadRuns } from "./reconcile.ts";
+import { syncLocalRepos, type GhRunner } from "./repos.ts";
 import { registerRoutes } from "./routes/index.ts";
 import { legacyShim } from "./legacy/shim.ts";
 
@@ -20,11 +21,14 @@ const MAX_BODY = 1_000_000;
 const defaultUiDir = () => [join(import.meta.dir, "../../ui/dist"), join(import.meta.dir, "../ui/dist")].find((d) => existsSync(join(d, "index.html")));
 
 /** dbPath ":memory:" for tests. Migrations run here, so /ready is true as soon as this returns. uiDir overrides the built-UI location. */
-export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: string; token?: string; loopbackOnly?: boolean; repoDir?: string; startBin?: string; spawnImpl?: typeof spawnStart }) {
+export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: string; token?: string; loopbackOnly?: boolean; repoDir?: string; startBin?: string; spawnImpl?: typeof spawnStart; ghImpl?: GhRunner }) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
   cleanupLeakedFixtures(sqlite);
   recomputeLegacy(db);
+  reconcileDeadRuns(db);
+  const reconciler = setInterval(() => { try { reconcileDeadRuns(db); } catch { /* best effort */ } }, 60_000);
+  reconciler.unref();
   let ready = true;
   const answerDir = opts.answerDir ?? defaultAnswerDir();
   const app = new Hono();
@@ -37,7 +41,10 @@ export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: st
     await next();
   });
 
-  app.get("/health", (c) => c.json({ service: "loki-control", pid: process.pid, install_path: import.meta.dir }));
+  // version = what this process started as; installed_version = what is on disk now. They differ after an upgrade while the CP kept running.
+  const readInstalled = (): string => { for (const f of [process.env.LOKI_VERSION_FILE, join(import.meta.dir, "../../../../VERSION")]) { try { if (f) return readFileSync(f, "utf8").trim() || "unknown"; } catch { /* next */ } } return "unknown"; };
+  const startVersion = process.env.LOKI_CONTROL_VERSION || readInstalled();
+  app.get("/health", (c) => c.json({ service: "loki-control", pid: process.pid, install_path: import.meta.dir, version: startVersion, installed_version: readInstalled() }));
   app.get("/ready", (c) => {
     try { sqlite.query("select 1").get(); } catch { ready = false; }
     return ready ? c.json({ ready: true }) : c.json({ ready: false }, 503);
@@ -108,7 +115,7 @@ export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: st
   });
   // Local discovery fills local_repos (never /v1/ingest). GET /v1/repos (names only, loopback guard) is mounted by routes/index.ts.
   syncLocalRepos(db, repoDir);
-  registerRoutes({ app, act, db, repoDir, token: opts.token, peerIsLoopback, local, startBin: opts.startBin, spawnImpl: opts.spawnImpl, answerDir });
+  registerRoutes({ app, act, db, repoDir, token: opts.token, peerIsLoopback, local, startBin: opts.startBin, spawnImpl: opts.spawnImpl, ghImpl: opts.ghImpl, answerDir });
   // :id is `source:run` (run ids never contain a colon)
   app.get("/v1/runs/:id", (c) => {
     const id = c.req.param("id");
@@ -131,5 +138,5 @@ export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: st
     return new Response(Bun.file(join(root, "index.html")));
   });
 
-  return { app, db, close: () => sqlite.close() };
+  return { app, db, close: () => { clearInterval(reconciler); sqlite.close(); } };
 }

package/packages/control-plane/src/server/ingest.ts

@@ -4,7 +4,8 @@ import { validateEnvelope } from "../../../../loki-ts/src/engine10/events.ts";
 import type { EventEnvelope } from "../../../../loki-ts/src/engine10/types.ts";
 import { redactSecrets } from "../../../../loki-ts/src/util/redact.ts";
 import type { Db } from "../db/migrate.ts";
-import { events, runs, sources } from "../db/schema.ts";
+import { events, localRepos, runs, sources } from "../db/schema.ts";
+import { TEST_RUN_ID, tempRoots, underTemp } from "../db/fixture-cleanup.ts";
 import { rebuildRun } from "./runs.ts";
 
 export const MAX_EVENTS = 500;
@@ -20,6 +21,10 @@ export function ingest(db: Db, body: unknown): IngestResult {
   const sourceId = b?.source ?? b?.source_id;
   if (typeof sourceId !== "string" || !sourceId || typeof b?.run_id !== "string" || !b.run_id) return { status: 400, body: { error: "source and run_id required" } };
   const runId = b.run_id;
+  // A3b: test suites once leaked fixture runs into a real control.db. A source rooted under a temp dir, or a test run-id prefix, is never real history.
+  if (TEST_RUN_ID.test(runId)) return { status: 400, body: { error: `run_id ${runId} looks like a test fixture (e37-, e10-sig, e10-sg); refusing to ingest it` } };
+  const repoPath = db.select({ p: localRepos.realpath }).from(localRepos).where(eq(localRepos.sourceId, sourceId)).get()?.p;
+  if (repoPath && process.env.LOKI_CONTROL_ALLOW_TEMP_SOURCES !== "1" && underTemp(repoPath, tempRoots())) return { status: 400, body: { error: "source is a repo under a temp directory (a test fixture); refusing to ingest it" } };
   if (!Array.isArray(b.events) || b.events.length > MAX_EVENTS) return { status: 400, body: { error: `events must be an array of at most ${MAX_EVENTS}` } };
 
   const rows: { e: EventEnvelope; json: string; sha: string }[] = [];

package/packages/control-plane/src/server/reconcile.ts

@@ -0,0 +1,33 @@
+// A3e (L6): a local run with no live worker PID, no terminal event and no new event for a grace period is shown as stopped, not "Running" forever.
+// The worker PID is the one the supervisor recorded in <run dir>/run.pid (verified by start time, never matched by name). A run whose repo is not on
+// this machine cannot be checked and is left alone. The runs row is a projection: a later event for the run rebuilds it, so a revived run recovers.
+import { realpathSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
+import { and, eq, isNull } from "drizzle-orm";
+import { verifyRunPid } from "../../../../loki-ts/src/util/run_pid.ts";
+import type { Db } from "../db/migrate.ts";
+import { localRepos, runs } from "../db/schema.ts";
+
+export const STOPPED_VERDICT = "STOPPED";
+export const STOPPED_REASON = "stopped (no longer running)";
+export const STALE_GRACE_MS = 120_000;
+
+export function reconcileDeadRuns(db: Db, o: { now?: number; graceMs?: number; verify?: typeof verifyRunPid } = {}): number {
+  const now = o.now ?? Date.now(), grace = o.graceMs ?? STALE_GRACE_MS, verify = o.verify ?? verifyRunPid;
+  let n = 0;
+  for (const r of db.select().from(runs).where(isNull(runs.endedAt)).all()) {
+    const last = Date.parse(r.lastEventAt ?? r.startedAt ?? "");
+    if (Number.isNaN(last) || now - last < grace) continue;
+    const repoRow = db.select().from(localRepos).where(eq(localRepos.sourceId, r.sourceId)).get();
+    if (!repoRow) continue;
+    let repo: string;
+    try { repo = realpathSync(repoRow.realpath); } catch { continue; }
+    const root = join(repo, ".loki", "runs"), dir = resolve(root, r.runId);
+    if (!dir.startsWith(root + sep)) continue;
+    if (verify(dir, r.runId).ok) continue;
+    db.update(runs).set({ endedAt: r.lastEventAt ?? new Date(last).toISOString(), verdict: r.verdict ?? STOPPED_VERDICT })
+      .where(and(eq(runs.sourceId, r.sourceId), eq(runs.runId, r.runId), isNull(runs.endedAt))).run();
+    n++;
+  }
+  return n;
+}

package/packages/control-plane/src/server/repos.ts

@@ -1,9 +1,11 @@
 // local_repos: the server-side map from source_id to a real repo path. Filled only by local discovery (never by /v1/ingest);
 // the path never leaves the server. The API exposes display names only.
+import { execFile } from "node:child_process";
 import { basename, resolve } from "node:path";
-import type { Hono } from "hono";
+import { eq } from "drizzle-orm";
+import type { Context, Hono } from "hono";
 import type { Db } from "../db/migrate.ts";
-import { localRepos } from "../db/schema.ts";
+import { localRepos, runs } from "../db/schema.ts";
 import { discoverLocalRepos } from "../shipper/discover.ts";
 
 /** Upsert every locally discovered repo. Returns the number of repos known. */
@@ -23,7 +25,39 @@ export function repoNames(db: Db): string[] {
 }
 
 /** GET /v1/repos. `act` is the loopback-only router; `peerIsLoopback` checks the real socket address. */
-export function mountRepos(act: Hono, db: Db, peerIsLoopback: (c: Parameters<Parameters<Hono["get"]>[1]>[0]) => boolean, repoDir?: string): void {
+export type GhRunner = (argv: string[]) => Promise<{ code: number; stdout: string; stderr: string }>;
+const defaultGh: GhRunner = (argv) => new Promise((done) => {
+  execFile("gh", argv, { timeout: 15000, maxBuffer: 2_000_000, shell: false }, (err, stdout, stderr) => {
+    done({ code: err ? (typeof (err as { code?: unknown }).code === "number" ? (err as { code: number }).code : 1) : 0, stdout: String(stdout), stderr: String(stderr || (err?.message ?? "")) });
+  });
+});
+const OWNER_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}\/[A-Za-z0-9._-]{1,100}$/;
+
+/** owner/name of a registered repo (by display name), from the origin_repo its runs recorded. Null when the name is not registered or has no known origin. */
+export function registeredOwnerName(db: Db, name: string): string | null {
+  for (const r of db.select().from(localRepos).where(eq(localRepos.name, name)).all()) {
+    const o = db.select({ o: runs.originRepo }).from(runs).where(eq(runs.sourceId, r.sourceId)).all().map((x) => x.o).find((x): x is string => !!x && OWNER_NAME.test(x));
+    if (o) return o;
+  }
+  return null;
+}
+
+export function mountRepos(act: Hono, db: Db, peerIsLoopback: (c: Context) => boolean, repoDir?: string, gh: GhRunner = defaultGh): void {
+  act.get("/v1/repos/issues", async (c) => {
+    if (!peerIsLoopback(c)) return c.json({ error: "loopback only" }, 403);
+    const repo = c.req.query("repo") ?? "";
+    const ownerName = repo ? registeredOwnerName(db, repo) : null;
+    if (!ownerName) return c.json({ error: "repo is not a registered repo with a known owner/name" }, 400);
+    const r = await gh(["issue", "list", "--repo", ownerName, "--state", "open", "--json", "number,title,url", "--limit", "50"]);
+    if (r.code !== 0) return c.json({ error: `gh issue list failed: ${r.stderr.trim().slice(0, 300) || `exit ${r.code}`}` }, 502);
+    try {
+      const j = JSON.parse(r.stdout) as unknown;
+      if (!Array.isArray(j)) throw new Error("not an array");
+      const issues = j.filter((i): i is { number: number; title: string; url: string } => !!i && Number.isInteger((i as { number?: unknown }).number) && typeof (i as { title?: unknown }).title === "string" && typeof (i as { url?: unknown }).url === "string")
+        .map((i) => ({ number: i.number, title: i.title, url: i.url }));
+      return c.json({ issues });
+    } catch (e) { return c.json({ error: `gh returned unreadable output: ${(e as Error).message}` }, 502); }
+  });
   // default_repo is the folder name of the directory the service was launched from (what a run with no repo chip uses); the path itself is never sent.
   const defaultRepo = repoDir ? basename(resolve(repoDir)) || null : null;
   act.get("/v1/repos", (c) => peerIsLoopback(c) ? c.json({ repos: repoNames(db), default_repo: defaultRepo }) : c.json({ error: "loopback only" }, 403));

package/packages/control-plane/src/server/routes/artifacts.ts

@@ -14,7 +14,7 @@ export const EVENTS_DEFAULT = 500;
 export const EVENTS_MAX = 1000;
 
 const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-const NAME = /^(?:issue\.json|plan\.json|receipt\.json|receipt\.md|report\.md|task\.md|diff\.patch|evidence\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}\.png)$/;
+export const NAME = /^(?:issue\.json|plan\.json|receipt\.json|receipt\.md|report\.md|task\.md|diff\.patch|evidence\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}\.png)$/;
 
 const TYPES: Record<string, string> = {
   json: "application/json; charset=utf-8",
@@ -23,10 +23,10 @@ const TYPES: Record<string, string> = {
   png: "image/png",
 };
 
-const safeId = (s: string) => ID.test(s) && !s.includes("..");
+export const safeId = (s: string) => ID.test(s) && !s.includes("..");
 
 /** Reads a regular file up to the cap through one descriptor (the size check and the read see the same file). */
-function readCapped(path: string): { status: 200; body: Buffer } | { status: 404 | 413 } {
+export function readCapped(path: string): { status: 200; body: Buffer } | { status: 404 | 413 } {
   let fd: number;
   try { fd = openSync(path, "r"); } catch { return { status: 404 }; }
   try {

package/packages/control-plane/src/server/routes/ask.ts

@@ -0,0 +1,139 @@
+// CP-ASK slice 10: Ask Loki HTTP surface, behind LOKI_CP_ASK=1 (flag off: every /v1/ask* route is 404).
+// Free text goes ONLY to the read-only Ask worker; it never reaches the run-start path (this file has no import from the run-start module).
+// Gate: a bearer token (enforced by tokenGuard on /v1/*) or, without one, a loopback peer and Host. POST needs JSON, a same-host Origin and questions up to 4000 chars.
+import { basename } from "node:path";
+import type { Context } from "hono";
+import { localRepos } from "../../db/schema.ts";
+import { buildInvocation, MODEL_RE } from "../../ask/invoke.ts";
+import { activeCount, addTurn, citations, createThread, getMessage, getThread, listEvents, listMessages, listThreads, markInterrupted, pidAlive, TERMINAL, threadBusy } from "../../ask/store.ts";
+import { cancelJob, runAskJob } from "../../ask/worker.ts";
+import { isLoopbackHost } from "../auth.ts";
+import { audit } from "../audit.ts";
+import type { RouteCtx } from "./index.ts";
+import { createSse } from "./stream.ts";
+
+export const MAX_QUESTION = 4000;
+const PROVIDERS = new Set(["claude", "codex", "cline", "aider", "opencode"]); // opencode and cline and aider are refused by buildInvocation
+const num = (v: string | undefined, d: number) => { const n = Number(v); return Number.isFinite(n) && n > 0 ? n : d; };
+export const askEnabled = (): boolean => process.env.LOKI_CP_ASK === "1";
+
+
+export function mount(ctx: RouteCtx): void {
+  const { app, db } = ctx;
+  // A restart leaves running rows with dead worker pids; flip them so the UI offers a retry.
+  markInterrupted(db, pidAlive);
+  const sse = createSse({ pollMs: num(process.env.LOKI_ASK_STREAM_POLL_MS, 300), heartbeatMs: num(process.env.LOKI_CONTROL_STREAM_HEARTBEAT_MS, 15000), maxStreams: num(process.env.LOKI_CONTROL_STREAM_MAX, 32) });
+  const off = (c: Context) => c.json({ error: "not found" }, 404);
+  const allowed = (c: Context) => !!ctx.token || (ctx.peerIsLoopback(c) && isLoopbackHost(c.req.header("host")));
+  const sameOrigin = (c: Context): boolean => {
+    const origin = c.req.header("origin");
+    if (origin === undefined) return true;
+    try { return new URL(origin).host.toLowerCase() === (c.req.header("host") ?? "").toLowerCase(); } catch { return false; }
+  };
+  const dbPath = (): string => {
+    const f = (db as unknown as { $client?: { filename?: string } }).$client?.filename;
+    return f && f !== ":memory:" ? f : process.env.LOKI_CONTROL_DB ?? "";
+  };
+  const knownRepo = (name: string): boolean =>
+    name === basename(ctx.repoDir) || db.select({ n: localRepos.name }).from(localRepos).all().some((r) => r.n === name);
+
+  // Every route: flag first (404), then the access gate (403).
+  const guard = (c: Context): Response | null => (!askEnabled() ? off(c) : !allowed(c) ? c.json({ error: "loopback or bearer token required" }, 403) : null);
+
+  app.post("/v1/ask", async (c) => {
+    const g = guard(c);
+    if (g) return g;
+    if (!(c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json")) return c.json({ error: "content-type must be application/json" }, 415);
+    if (!sameOrigin(c)) return c.json({ error: "origin not allowed" }, 403);
+    const text = await c.req.text();
+    if (text.length > 20_000) return c.json({ error: "body too large" }, 413);
+    let body: Record<string, unknown>;
+    try { const j = JSON.parse(text); if (!j || typeof j !== "object" || Array.isArray(j)) throw new Error(); body = j as Record<string, unknown>; } catch { return c.json({ error: "invalid JSON" }, 400); }
+    const question = typeof body.question === "string" ? body.question.trim() : "";
+    if (!question) return c.json({ error: "question must be a non-empty string" }, 400);
+    if (question.length > MAX_QUESTION) return c.json({ error: `question must be at most ${MAX_QUESTION} characters` }, 400);
+
+    let threadId: string;
+    let provider: string, model: string | null, repo: string | null;
+    if (body.thread_id !== undefined && body.thread_id !== null && body.thread_id !== "") {
+      const t = typeof body.thread_id === "string" ? getThread(db, body.thread_id) : undefined;
+      if (!t) return c.json({ error: "thread not found" }, 404);
+      if (threadBusy(db, t.id)) return c.json({ error: "this thread is still answering" }, 409);
+      threadId = t.id; provider = t.provider; model = t.model; repo = t.repo;
+    } else {
+      provider = typeof body.provider === "string" && body.provider ? body.provider : process.env.LOKI_ASK_PROVIDER || "claude";
+      if (!PROVIDERS.has(provider)) return c.json({ error: "provider must be one of: claude, codex" }, 400);
+      model = typeof body.model === "string" && body.model ? body.model : null;
+      if (model !== null && !MODEL_RE.test(model)) return c.json({ error: "model must match [A-Za-z0-9][A-Za-z0-9._/-]{0,79}" }, 400);
+      repo = typeof body.repo === "string" && body.repo ? body.repo : null;
+      if (repo !== null && !knownRepo(repo)) return c.json({ error: "repo is not a known project" }, 400);
+      threadId = "";
+    }
+    const dry = buildInvocation({ provider, model, mcpConfigPath: "", jobDir: "", maxUsd: 1 });
+    if (!dry.ok) return c.json({ error: dry.error }, 400);
+    if (activeCount(db) >= num(process.env.LOKI_ASK_MAX_JOBS, 2)) return c.json({ error: "too many Ask jobs running; try again shortly" }, 429, { "retry-after": "10" });
+
+    if (!threadId) threadId = createThread(db, { provider, model, repo });
+    const { assistantId } = addTurn(db, threadId, question);
+    audit(db, { kind: "ask.start", target: threadId, result: "queued", detail: `provider ${provider}; ${question.length} chars` });
+    void runAskJob(db, assistantId, {
+      toolsServer: process.env.LOKI_ASK_TOOLS_SERVER || undefined, dbPath: dbPath(), bin: process.env.LOKI_ASK_BIN || undefined,
+      timeoutMs: num(process.env.LOKI_ASK_TIMEOUT_S, 600) * 1000, maxUsd: num(process.env.LOKI_ASK_MAX_USD, 1),
+    }).catch(() => { /* runAskJob records its own failures on the row */ });
+    return c.json({ thread_id: threadId, message_id: assistantId }, 202);
+  });
+
+  app.get("/v1/ask/threads", (c) => {
+    const g = guard(c);
+    if (g) return g;
+    return c.json({ threads: listThreads(db).map((t) => ({ id: t.id, title: t.title, updated_at: t.updatedAt })) });
+  });
+
+  app.get("/v1/ask/threads/:id", (c) => {
+    const g = guard(c);
+    if (g) return g;
+    const t = getThread(db, c.req.param("id"));
+    if (!t) return c.json({ error: "thread not found" }, 404);
+    const messages = listMessages(db, t.id).map((m) => ({
+      id: m.id, seq: m.seq, role: m.role, text: m.text, status: m.status, error: m.error, cost_usd: m.costUsd,
+      ...(m.role === "assistant" ? { citations: citations(db, m.id) } : {}),
+    }));
+    return c.json({ thread: { id: t.id, title: t.title, repo: t.repo }, messages });
+  });
+
+  app.get("/v1/ask/messages/:id/stream", (c) => {
+    const g = guard(c);
+    if (g) return g;
+    const id = c.req.param("id");
+    if (!getMessage(db, id)) return c.json({ error: "message not found" }, 404);
+    const given = c.req.header("last-event-id") ?? c.req.query("after");
+    const parsed = given === undefined || given === "" ? NaN : Number(given);
+    let cursor = Number.isInteger(parsed) ? parsed : -1; // a fresh client replays the whole answer
+    const tick = (): string[] | { frames: string[]; end: true } => {
+      const m = getMessage(db, id)!;
+      const terminal = TERMINAL.has(m.status); // read status BEFORE events so no event is missed
+      const rows = listEvents(db, id, cursor);
+      if (rows.length) cursor = rows[rows.length - 1]!.seq;
+      const frames = rows.map((e) => `id: ${e.seq}\nevent: ${e.kind}\ndata: ${e.payload}\n\n`);
+      if (!terminal) return frames;
+      return { frames: [...frames, `event: done\ndata: ${JSON.stringify({ status: m.status, error: m.error })}\n\n`], end: true };
+    };
+    const first = tick();
+    if (!Array.isArray(first)) {
+      return new Response(`retry: 3000\n: connected\n\n${first.frames.join("")}`, { headers: { "content-type": "text/event-stream", "cache-control": "no-cache, no-transform", "x-accel-buffering": "no" } });
+    }
+    return sse(c.req.raw.signal, `retry: 3000\n: connected\n\n${first.join("")}`, tick);
+  });
+
+  app.post("/v1/ask/messages/:id/cancel", async (c) => {
+    const g = guard(c);
+    if (g) return g;
+    if (!(c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json")) return c.json({ error: "content-type must be application/json" }, 415);
+    if (!sameOrigin(c)) return c.json({ error: "origin not allowed" }, 403);
+    const id = c.req.param("id");
+    if (!getMessage(db, id)) return c.json({ error: "message not found" }, 404);
+    if (!cancelJob(db, id)) return c.json({ error: "message is not running" }, 409);
+    audit(db, { kind: "ask.cancel", target: id, result: "cancelled", detail: "" });
+    return c.json({ ok: true });
+  });
+}

package/packages/control-plane/src/server/routes/cost.ts

@@ -3,6 +3,7 @@
 // Unmeasured = no priced session (subscription or local provider): never summed as 0.
 import { gte } from "drizzle-orm";
 import { runs } from "../../db/schema.ts";
+import { effectiveVerdict, SUCCESS_VERDICTS } from "../integrity.ts";
 import type { RouteCtx } from "./index.ts";
 
 export const COST_DIMS = ["day", "model", "repo", "provider"] as const;
@@ -29,6 +30,24 @@ const round = (n: number) => Math.round(n * 1e6) / 1e6;
 const out = (a: Acc) => ({ ...a.key, runs: a.runs, measured_runs: a.measured_runs, partial_runs: a.partial_runs, unmeasured_runs: a.unmeasured_runs, measured_usd: round(a.measured_usd), partial_usd: round(a.partial_usd), input_tokens: a.input_tokens, output_tokens: a.output_tokens });
 
 export function mount(ctx: RouteCtx): void {
+  // B8: per-repo breakdown. total_usd sums measured runs only (never invents a zero); avg_usd is over measured runs; verified = plain attested success display verdict.
+  ctx.app.get("/v1/cost/repos", (c) => {
+    const g = new Map<string, { runs: number; priced: number; usd: number; verified: number }>();
+    for (const r of ctx.db.select().from(runs).all()) {
+      const k = r.originRepo ?? "(unknown)";
+      const a = g.get(k) ?? { runs: 0, priced: 0, usd: 0, verified: 0 };
+      a.runs++;
+      if (r.costUsd !== null) { a.priced++; a.usd += r.costUsd; }
+      const ev = effectiveVerdict({ verdict: r.verdict, tampered: r.tampered === 1, attested: r.attested === 1, sig_checked: r.sigChecked === 1 });
+      if (ev !== null && SUCCESS_VERDICTS.has(ev)) a.verified++;
+      g.set(k, a);
+    }
+    const rows = [...g.entries()].sort((x, y) => x[0].localeCompare(y[0])).map(([repo, a]) => ({
+      repo, runs: a.runs, total_usd: round(a.usd), avg_usd: a.priced ? round(a.usd / a.priced) : null,
+      verified_runs: a.verified, usd_per_verified: a.verified ? round(a.usd / a.verified) : null,
+    }));
+    return c.json({ rows });
+  });
   ctx.app.get("/v1/stats/cost", (c) => {
     const dims = (c.req.query("group") ?? "day").split(",").map((s) => s.trim()).filter(Boolean) as CostDim[];
     if (dims.length === 0 || dims.some((d) => !COST_DIMS.includes(d))) {

package/packages/control-plane/src/server/routes/doctor.ts

@@ -0,0 +1,67 @@
+// GET /v1/doctor (A5): the real `loki doctor --json` checks, mapped to {name,status,detail}. Fixed argv, no shell, 25s timeout,
+// the same scrubbed child env as spawned runs, cached for 60s. Unusable output is an error (502), never an invented pass.
+import { spawn } from "node:child_process";
+import { childEnv } from "../spawn.ts";
+import { probeAllowed, ttlCache, type RouteCtx } from "./index.ts";
+
+export const DOCTOR_TIMEOUT_MS = 25_000;
+const MAX_OUT = 1_000_000;
+
+export type DoctorStatus = "pass" | "warn" | "fail";
+export interface DoctorCheck { name: string; status: DoctorStatus; detail: string }
+
+const isStatus = (s: unknown): s is DoctorStatus => s === "pass" || s === "warn" || s === "fail";
+
+/** Run `<bin> doctor --json` and return stdout. doctor exits 1 when a check fails, so the exit code is not the signal; the JSON is. */
+export function runDoctor(bin: string, timeoutMs = DOCTOR_TIMEOUT_MS): Promise<string> {
+  return new Promise((resolve, reject) => {
+    let out = "";
+    let done = false;
+    let child: ReturnType<typeof spawn>;
+    const finish = (f: () => void): void => { if (!done) { done = true; clearTimeout(timer); f(); } };
+    try {
+      child = spawn(bin, ["doctor", "--json"], { stdio: ["ignore", "pipe", "ignore"], shell: false, env: childEnv() });
+    } catch (e) { return reject(new Error(`could not run loki doctor: ${(e as Error).message}`)); }
+    const timer = setTimeout(() => {
+      try { child.kill("SIGKILL"); } catch { /* already gone */ }
+      finish(() => reject(new Error(`loki doctor timed out after ${Math.round(timeoutMs / 1000)}s`)));
+    }, timeoutMs);
+    child.stdout?.on("data", (d: Buffer) => { if (out.length < MAX_OUT) out += d.toString("utf8"); });
+    child.on("error", (e) => finish(() => reject(new Error(`could not run loki doctor: ${e.message}`))));
+    child.on("close", () => finish(() => resolve(out)));
+  });
+}
+
+/** Map the doctor JSON (tool checks plus disk and AI provider) to the flat checklist shape. */
+export function mapDoctor(raw: string): DoctorCheck[] {
+  let j: { checks?: unknown; disk?: unknown; ai_provider?: unknown };
+  try { j = JSON.parse(raw); } catch { throw new Error("loki doctor did not return JSON"); }
+  if (!j || !Array.isArray(j.checks)) throw new Error("loki doctor JSON has no checks");
+  const out: DoctorCheck[] = [];
+  for (const c of j.checks as Record<string, unknown>[]) {
+    if (typeof c?.name !== "string" || !isStatus(c.status)) continue;
+    const sev = typeof c.required === "string" ? c.required : "";
+    const detail = c.found === false
+      ? `not found${sev ? ` (${sev})` : ""}`
+      : `${typeof c.version === "string" ? c.version : "found"}${c.status === "warn" && typeof c.min_version === "string" ? `, needs ${c.min_version} or newer` : ""}`;
+    out.push({ name: c.name, status: c.status, detail });
+  }
+  const d = j.disk as { available_gb?: unknown; status?: unknown } | undefined;
+  if (d && isStatus(d.status)) out.push({ name: "Disk space", status: d.status, detail: typeof d.available_gb === "number" ? `${d.available_gb} GB available` : "unknown" });
+  const a = j.ai_provider as { found?: unknown; status?: unknown; detail?: unknown } | undefined;
+  if (a && isStatus(a.status)) out.push({ name: "AI provider", status: a.status, detail: typeof a.detail === "string" && a.detail ? a.detail : a.found ? "found" : "not found" });
+  if (out.length === 0) throw new Error("loki doctor returned no usable checks");
+  return out;
+}
+
+export function mount(ctx: RouteCtx): void {
+  const cached = ttlCache<{ checks: DoctorCheck[] }>();
+  ctx.app.get("/v1/doctor", async (c) => {
+    if (!probeAllowed(ctx, c)) return c.json({ error: "loopback only without a token" }, 403);
+    try {
+      return c.json(await cached("doctor", async () => ({ checks: mapDoctor(await runDoctor(ctx.startBin ?? "loki")) })));
+    } catch (e) {
+      return c.json({ error: (e as Error).message }, 502);
+    }
+  });
+}

package/packages/control-plane/src/server/routes/index.ts

@@ -4,14 +4,16 @@ import type { Context, Hono } from "hono";
 import type { Db } from "../../db/migrate.ts";
 import type { spawnStart } from "../spawn.ts";
 import { isLoopbackHost } from "../auth.ts";
-import { mountRepos } from "../repos.ts";
+import { mountRepos, type GhRunner } from "../repos.ts";
 import { mount as artifacts } from "./artifacts.ts";
+import { mount as ask } from "./ask.ts";
 import { mount as audit } from "./audit.ts";
 import { mount as checkpoints } from "./checkpoints.ts";
 import { mount as config } from "./config.ts";
 import { mount as control } from "./control.ts";
 import { mount as cost } from "./cost.ts";
 import { mount as costLedger } from "./cost_ledger.ts";
+import { mount as doctor } from "./doctor.ts";
 import { mount as fleet } from "./fleet.ts";
 import { mount as memory } from "./memory.ts";
 import { mount as metrics } from "./metrics.ts";
@@ -41,12 +43,14 @@ export interface RouteCtx {
   spawnImpl?: typeof spawnStart;
   /** Where BLOCKED answers are written (createApp answerDir). */
   answerDir?: string;
+  /** gh seam for GET /v1/repos/issues (tests stub it). */
+  ghImpl?: GhRunner;
 }
 
-export const routeModules: ReadonlyArray<(ctx: RouteCtx) => void> = [artifacts, stream, start, control, stats, cost, costLedger, fleet, metrics, checkpoints, memory, sessionControl, config, providers, verify, integrations, notify, audit, mergeRisk];
+export const routeModules: ReadonlyArray<(ctx: RouteCtx) => void> = [artifacts, ask, stream, start, control, stats, cost, costLedger, doctor, fleet, metrics, checkpoints, memory, sessionControl, config, providers, verify, integrations, notify, audit, mergeRisk];
 
 export function registerRoutes(ctx: RouteCtx): void {
-  mountRepos(ctx.act, ctx.db, ctx.peerIsLoopback, ctx.repoDir);
+  mountRepos(ctx.act, ctx.db, ctx.peerIsLoopback, ctx.repoDir, ctx.ghImpl);
   for (const m of routeModules) m(ctx);
 }
 

package/packages/control-plane/src/server/routes/stream.ts

@@ -7,19 +7,17 @@ import type { RouteCtx } from "./index.ts";
 
 const num = (v: string | undefined, d: number) => { const n = Number(v); return Number.isFinite(n) && n > 0 ? n : d; };
 
-export function mount(ctx: RouteCtx): void {
-  const pollMs = num(process.env.LOKI_CONTROL_STREAM_POLL_MS, 1000);
-  const heartbeatMs = num(process.env.LOKI_CONTROL_STREAM_HEARTBEAT_MS, 15000);
-  const maxStreams = num(process.env.LOKI_CONTROL_STREAM_MAX, 32);
-  const { db } = ctx;
+/** A tick returns frames to send, or frames plus end:true to send them and close the stream. */
+export type SseTick = () => string[] | { frames: string[]; end: true };
+
+/** Bounded SSE responder (shared by the run streams and the Ask stream). Each instance has its own slot count; a slot is freed exactly once on abort, cancel, end or error. */
+export function createSse(opts: { pollMs: number; heartbeatMs: number; maxStreams: number }) {
   const enc = new TextEncoder();
   let open = 0;
-
   const headers = { "content-type": "text/event-stream", "cache-control": "no-cache, no-transform", connection: "keep-alive", "x-accel-buffering": "no" };
 
-  /** Open one SSE response. tick() runs each poll and returns frames to send; the slot is freed exactly once on abort, cancel or error. */
-  const sse = (signal: AbortSignal, hello: string, tick: () => string[]): Response => {
-    if (open >= maxStreams) return Response.json({ error: "too many streams" }, { status: 429, headers: { "retry-after": "5" } });
+  return (signal: AbortSignal, hello: string, tick: SseTick): Response => {
+    if (open >= opts.maxStreams) return Response.json({ error: "too many streams" }, { status: 429, headers: { "retry-after": "5" } });
     open++;
     let freed = false;
     let poll: ReturnType<typeof setInterval> | undefined;
@@ -30,14 +28,27 @@ export function mount(ctx: RouteCtx): void {
         const send = (s: string) => { try { ctrl.enqueue(enc.encode(s)); } catch { free(); } };
         const close = () => { free(); try { ctrl.close(); } catch { /* already closed */ } };
         send(hello);
-        poll = setInterval(() => { try { for (const f of tick()) send(f); } catch { close(); } }, pollMs);
-        beat = setInterval(() => send(": heartbeat\n\n"), heartbeatMs);
+        poll = setInterval(() => {
+          try {
+            const r = tick();
+            if (Array.isArray(r)) { for (const f of r) send(f); } else { for (const f of r.frames) send(f); close(); }
+          } catch { close(); }
+        }, opts.pollMs);
+        beat = setInterval(() => send(": heartbeat\n\n"), opts.heartbeatMs);
         if (signal.aborted) close(); else signal.addEventListener("abort", close, { once: true });
       },
       cancel: free,
     });
     return new Response(body, { headers });
   };
+}
+
+export function mount(ctx: RouteCtx): void {
+  const pollMs = num(process.env.LOKI_CONTROL_STREAM_POLL_MS, 1000);
+  const heartbeatMs = num(process.env.LOKI_CONTROL_STREAM_HEARTBEAT_MS, 15000);
+  const maxStreams = num(process.env.LOKI_CONTROL_STREAM_MAX, 32);
+  const { db } = ctx;
+  const sse = createSse({ pollMs, heartbeatMs, maxStreams });
 
   const maxSeq = (source: string, run: string): number =>
     db.select({ m: sql<number | null>`max(${events.seq})` }).from(events).where(and(eq(events.sourceId, source), eq(events.runId, run))).get()?.m ?? -1;

package/packages/control-plane/src/server/runs.ts

@@ -143,6 +143,30 @@ export function listRuns(db: Db, q: ListQuery) {
   return { runs: rows.map((r) => withLive(db, r)), total, next_cursor: offset + rows.length < total ? String(offset + rows.length) : null };
 }
 
+const ANSI = /\u001b\[[0-9;?]*[ -/]*[@-~]|\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)|\u001b[@-Z\\-_]|\[\d{1,3}(?:;\d{1,3})*m/g;
+const oneLine = (s: string, max: number) => s.replace(ANSI, "").replace(/[\x00-\x1f\x7f\s]+/g, " ").trim().slice(0, max);
+// FC-19: Loki's own stage rules talked the model into a false spec conflict. The engine records no version or classifier, so this reads the model's own words.
+const OWN_RULES = /\bstage rules\b|\bstage-rules\b/i;
+
+/** The terminal stop reason as one ANSI-free sentence, from the run's own end (never from verify output); null when the run did not stop short. */
+export function stopReason(evs: EventEnvelope[], verdict: string | null): { reason: string | null; ownRules: boolean } {
+  if (verdict === "SPEC_CONFLICT") {
+    const why = evs.find((e) => e.type === "stage.completed" && e.stage === "implement")?.data.spec_conflict_reason;
+    const text = typeof why === "string" ? oneLine(why, 4000) : "";
+    const first = text.split(/(?<=[.!?])\s+(?=[A-Z])/)[0] ?? "";
+    const reason = `The run stopped on a spec conflict: ${first ? first.slice(0, 240) : "the task and the repository disagree"}`;
+    return { reason: /[.!?]$/.test(reason) ? reason : `${reason}.`, ownRules: OWN_RULES.test(text) };
+  }
+  if (verdict === "FAILED") {
+    const failed = [...evs].reverse().find((e) => e.type === "stage.failed");
+    const why = typeof failed?.data?.reason === "string" ? oneLine(failed.data.reason as string, 240) : "";
+    if (failed && failed.stage) return { reason: `The run failed in the ${failed.stage} stage${why ? `: ${why}` : ""}.`, ownRules: false };
+    const bad = evs.filter((e) => e.type === "test.result" && (e.data as Record<string, unknown>).result === "fail").length;
+    return { reason: bad ? `The run failed: ${bad} check${bad === 1 ? "" : "s"} did not pass.` : "The run failed and did not record a reason.", ownRules: false };
+  }
+  return { reason: null, ownRules: false };
+}
+
 /** Summary row plus the folded detail: stage timeline, receipt, not_proven. Null when the run is unknown. */
 export function runDetail(db: Db, sourceId: string, runId: string) {
   const r = db.select().from(runs).where(and(eq(runs.sourceId, sourceId), eq(runs.runId, runId))).get();
@@ -164,9 +188,12 @@ export function runDetail(db: Db, sourceId: string, runId: string) {
   const f = fold(evs);
   const done = f.run.completed?.data;
   const sealed = evs.find((e) => e.type === "receipt.sealed")?.data;
+  const stop = stopReason(evs, r.verdict);
   return {
     ...withLive(db, r),
     blocked_question: blockedQuestion(evs, r.verdict),
+    stop_reason: stop.reason,
+    own_rules_block: stop.ownRules,
     stages,
     stages_completed: f.completed,
     receipt: sealed ? { sha256: str(sealed.receipt_sha256), signed: sealed.signed === true, verdict: str(sealed.verdict), path: str(sealed.path) } : null,