loki-mode 10.6.14 → 10.7.1

package/packages/control-plane/src/server/app.ts

@@ -1,11 +1,14 @@
 import { existsSync, statSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
-import { Hono } from "hono";
+import { Hono, type Context } from "hono";
 import { openDb } from "../db/migrate.ts";
 import { ingest } from "./ingest.ts";
 import { defaultAnswerDir, writeAnswer } from "./answer.ts";
-import { listRuns, runDetail } from "./runs.ts";
-import { hostGuard, tokenGuard } from "./auth.ts";
+import { listRuns, recomputeLegacy, runDetail } from "./runs.ts";
+import { hostGuard, isLoopbackHost, tokenGuard } from "./auth.ts";
+import { backfill } from "../shipper/backfill.ts";
+import { removeRun } from "../db/prune.ts";
+import { planStart, registryRepos, spawnStart } from "./actions.ts";
 
 const MAX_BODY = 1_000_000;
 
@@ -13,9 +16,10 @@ const MAX_BODY = 1_000_000;
 const defaultUiDir = () => [join(import.meta.dir, "../../ui/dist"), join(import.meta.dir, "../ui/dist")].find((d) => existsSync(join(d, "index.html")));
 
 /** dbPath ":memory:" for tests. Migrations run here, so /ready is true as soon as this returns. uiDir overrides the built-UI location. */
-export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: string; token?: string; loopbackOnly?: boolean }) {
+export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: string; token?: string; loopbackOnly?: boolean; repoDir?: string; startBin?: string; spawnImpl?: typeof spawnStart }) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
+  recomputeLegacy(db);
   let ready = true;
   const answerDir = opts.answerDir ?? defaultAnswerDir();
   const app = new Hono();
@@ -66,6 +70,57 @@ export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: st
     const r = writeAnswer(answerDir, source, run, body?.answer);
     return c.json(r.body, r.status);
   });
+  // Machine-touching actions exist ONLY on a loopback-bound server (otherwise they are never registered: 404).
+  // Each request must also come from a loopback peer (the real socket address, not the spoofable Host header; unknown peer fails closed) and carry JSON (blocks cross-site form posts).
+  const act = opts.loopbackOnly ? app : new Hono();
+  const peerIsLoopback = (c: Context): boolean => {
+    const ip = (c.env as { requestIP?: (r: Request) => { address?: string } | null } | undefined)?.requestIP?.(c.req.raw)?.address;
+    return typeof ip === "string" && /^(127\.\d+\.\d+\.\d+|::1|::ffff:127\.\d+\.\d+\.\d+)$/.test(ip);
+  };
+  const local = (c: Context) => peerIsLoopback(c) && isLoopbackHost(c.req.header("host")) && (c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json");
+  const repoDir = opts.repoDir ?? process.cwd();
+  const inflight = new Set<string>();
+  act.post("/v1/import", async (c) => {
+    if (!local(c)) return c.json({ error: "loopback JSON requests only" }, 403);
+    const r = await backfill({
+      repoDir,
+      env: { LOKI_CONTROL_URL: "http://127.0.0.1", LOKI_CONTROL_TOKEN: opts.token },
+      fetchImpl: ((u: string, init: RequestInit) => app.fetch(new Request(u, { ...init, headers: { ...(init.headers as Record<string, string>), host: "127.0.0.1" } }))) as unknown as typeof fetch,
+    });
+    return c.json({ runs: r.runs, sent: r.sent, failed: r.failed });
+  });
+  // Remove one run (and its events). Loopback-only like /v1/start (never registered on a non-loopback server); bearer via tokenGuard when a token is set. JSON content type blocks cross-site form posts;
+  // a browser Origin must match the host this server is served on. Absent Origin (curl, the CLI) is allowed. The audit row is written inside the delete transaction, before the rows go.
+  act.delete("/v1/runs/:source/:run", async (c) => {
+    if (!peerIsLoopback(c) || !isLoopbackHost(c.req.header("host"))) return c.json({ error: "loopback only" }, 403);
+    if (!(c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json")) return c.json({ error: "content-type must be application/json" }, 400);
+    const origin = c.req.header("origin");
+    if (origin !== undefined) {
+      let oh = "";
+      try { oh = new URL(origin).host.toLowerCase(); } catch { /* refused below */ }
+      if (!oh || oh !== (c.req.header("host") ?? "").toLowerCase()) return c.json({ error: "origin not allowed" }, 403);
+    }
+    const source = c.req.param("source"), run = c.req.param("run");
+    const r = removeRun(sqlite, source, run);
+    if (!r) return c.json({ error: "run not found" }, 404);
+    const left = (sqlite.query("select count(*) n from runs").get() as { n: number }).n;
+    return c.json({ ok: true, removed: r, remaining_runs: left });
+  });
+  act.get("/v1/repos", (c) => peerIsLoopback(c) ? c.json({ repos: [...new Set<string>([repoDir, ...registryRepos()])] }) : c.json({ error: "loopback only" }, 403));
+  act.post("/v1/start", async (c) => {
+    if (!local(c)) return c.json({ error: "loopback JSON requests only" }, 403);
+    const text = await c.req.text();
+    if (text.length > 20_000) return c.json({ error: "body too large" }, 413);
+    let body: unknown;
+    try { body = JSON.parse(text); } catch { return c.json({ error: "invalid JSON" }, 400); }
+    const plan = planStart(body, [repoDir, ...registryRepos()], opts.startBin);
+    if (!plan.ok) return c.json({ error: plan.error }, 400);
+    if (inflight.has(plan.cwd)) return c.json({ error: "a run is already starting or running in this repo" }, 409);
+    inflight.add(plan.cwd);
+    const r = await (opts.spawnImpl ?? spawnStart)(plan.argv, plan.cwd, () => inflight.delete(plan.cwd));
+    if ("error" in r) { inflight.delete(plan.cwd); return c.json({ error: r.error }, 500); }
+    return c.json({ ok: true, pid: r.pid, command: plan.argv.slice(1).join(" ") });
+  });
   // :id is `source:run` (run ids never contain a colon)
   app.get("/v1/runs/:id", (c) => {
     const id = c.req.param("id");

package/packages/control-plane/src/server/integrity.ts

@@ -0,0 +1,147 @@
+// EL-FC08b (D86, FC-08, L2): integrity of an INGESTED event log, run on every rebuild of a run's projection.
+// Pure: no db. The same checks `loki verify` makes on events.jsonl (loki-ts/src/engine10/verify_cmd.ts: checkEventLog, checkLogSeal),
+// restated over stored envelopes. Option taken for sharing: a CP-local module plus test/server/integrity-parity.test.ts, which runs both
+// implementations over the same fixtures, including signed ones (unknown kid, mismatched kid, appended run.completed), so they cannot drift.
+// TAMPERED means positive evidence of forgery. A log the CP cannot check (redacted before ingest) is UNVERIFIED, never TAMPERED and never VERIFIED.
+import { createHash, createPublicKey, verify, type KeyObject } from "node:crypto";
+import { readFileSync } from "node:fs";
+import type { EventEnvelope } from "../../../../loki-ts/src/engine10/types.ts";
+
+export interface RunIntegrity {
+  /** Positive evidence of forgery, loss or edit. Always shown as TAMPERED. */
+  tampered: boolean;
+  /** A VERIFIED claim backed by a signed receipt.sealed and a sealing line, with a log that could be checked. False means unattested (shown UNVERIFIED). */
+  attested: boolean;
+  /** The sealing line's signature was verified against a configured public key. False: shape and hash chain only. */
+  sig_checked: boolean;
+  reasons: string[];
+}
+export type KeyResolver = ((kid: string) => KeyObject | undefined) & { configured?: boolean; fingerprint?: string };
+export interface IntegrityOpts {
+  pubkeyFor?: KeyResolver;
+  /** At least one key is configured: an unknown kid is then TAMPERED, as in the engine's checkLogSeal. Defaults to pubkeyFor.configured. */
+  keysConfigured?: boolean;
+}
+
+const SHA = /^[0-9a-f]{64}$/;
+const SEAL_LINE = "log.sealed";
+const REDACTED = /\[REDACTED(?::[A-Z_]+)?\]/;
+export const REDACTED_NOTE = "log redacted before ingest; seal not checkable";
+export const UNCHECKED_SIG = "VERIFIED (signature not checked)";
+export const UNATTESTED_SUFFIX = " (unattested)";
+/** Outcomes that claim success: each needs a signed seal, exactly like VERIFIED. */
+export const SUCCESS_VERDICTS: ReadonlySet<string> = new Set(["VERIFIED", "ALREADY_SATISFIED"]);
+const normVerdict = (v: string | null | undefined): string | null => (typeof v === "string" ? v.trim().toUpperCase() : null);
+
+/** Same derivation as loki-ts/src/engine10/stages/seal.ts kidOf (parity-tested). */
+export const kidOf = (pub: KeyObject): string => createHash("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${pub.export({ format: "jwk" }).x}"}`).digest("base64url");
+
+/** Public keys from LOKI_CP_RECEIPT_PUBKEYS (colon-separated PEM files, like `loki verify` retired keys), by kid. Unreadable files are skipped. */
+export function pubkeysFromEnv(env: Record<string, string | undefined> = process.env): KeyResolver {
+  const keys = (env["LOKI_CP_RECEIPT_PUBKEYS"] ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
+    try { return [createPublicKey(readFileSync(f))]; } catch { return []; }
+  });
+  const fn: KeyResolver = (kid) => keys.find((k) => kidOf(k) === kid);
+  fn.configured = keys.length > 0;
+  fn.fingerprint = createHash("sha256").update(keys.map(kidOf).sort().join(",")).digest("hex").slice(0, 16); // identifies the key set a row was judged under
+  return fn;
+}
+
+// The engine writes JSON.stringify(envelope) in this key order, so a stored envelope re-serialises to the bytes it was hashed as.
+const line = (e: EventEnvelope): string => JSON.stringify({ v: e.v, seq: e.seq, ts: e.ts, run: e.run, type: e.type, stage: e.stage, data: e.data });
+const verdictOf = (e: EventEnvelope | undefined): string | null => (typeof e?.data["verdict"] === "string" ? e.data["verdict"].trim().toUpperCase() : null);
+
+/** Events up to and including the sealing line (the authenticated prefix); everything when the run has none. Lines after it are unauthenticated. */
+export function sealedPrefix<T extends { type: string }>(evs: readonly T[]): T[] {
+  const i = evs.findIndex((e) => e.type === SEAL_LINE);
+  return i < 0 ? [...evs] : evs.slice(0, i + 1);
+}
+
+export function verifyRunIntegrity(evs: readonly EventEnvelope[], opts: IntegrityOpts = {}): RunIntegrity {
+  const bad: string[] = [], notes: string[] = [];
+  const doneAt = evs.findIndex((e) => e.type === "run.completed");
+  const sealedAt = evs.map((e, i) => (e.type === "receipt.sealed" ? i : -1)).filter((i) => i >= 0);
+  const finalised = doneAt >= 0 || sealedAt.length > 0;
+  const lines = evs.map(line);
+  const keysConfigured = opts.keysConfigured ?? opts.pubkeyFor?.configured ?? false;
+  let sigChecked = false;
+
+  if (finalised) { // a live run may still be missing a batch; once it claims an end, every seq must be present
+    const gap = evs.findIndex((e, i) => e.seq !== i);
+    if (gap >= 0) bad.push(`event log has a seq gap, duplicate or missing start at position ${gap} (seq ${evs[gap]!.seq})`);
+  }
+  if (evs.some((e) => e.type === "tamper.detected")) bad.push("the supervisor detected events.jsonl being modified during the run");
+  const firstSeal = evs.findIndex((e) => e.type === SEAL_LINE);
+  if (firstSeal >= 0 && evs.slice(firstSeal + 1).some((e) => e.type === "run.completed" || e.type === "receipt.sealed" || typeof e.data["verdict"] === "string")) bad.push("a verdict-bearing event after log.sealed is unauthenticated");
+  if (evs.filter((e) => e.type === "run.completed").length > 1) bad.push("more than one run.completed (a verdict appended after the seal is unauthenticated)");
+
+  // Hash problems are tamper evidence unless a redaction placeholder explains the changed bytes.
+  const hashBad: string[] = [];
+  const redacted = REDACTED.test(JSON.stringify(doneAt >= 0 ? evs.slice(0, doneAt + 2).map((e) => e.data) : evs.map((e) => e.data)));
+
+  for (const i of sealedAt) {
+    const d = evs[i]!.data;
+    if (typeof d["receipt_sha256"] !== "string" || !SHA.test(d["receipt_sha256"])) hashBad.push(`receipt.sealed at seq ${evs[i]!.seq} has no valid receipt_sha256`);
+    const bound = d["events_sha256"]; // optional on the event: the engine keeps it in receipt.json, which the CP never sees
+    if (typeof bound === "string") {
+      const h = createHash("sha256");
+      let ok = false;
+      for (const l of lines) { if (h.copy().digest("hex") === bound) { ok = true; break; } h.update(l + "\n"); }
+      if (!ok && h.digest("hex") === bound) ok = true;
+      if (!ok) hashBad.push("receipt.sealed events_sha256 does not match any prefix of the ingested log");
+    }
+  }
+
+  const sealLines = evs.map((e, i) => (e.type === SEAL_LINE ? i : -1)).filter((i) => i >= 0);
+  if (sealLines.some((i) => i !== doneAt + 1)) bad.push(`${SEAL_LINE} is not the line right after run.completed`);
+  const ls = doneAt >= 0 && evs[doneAt + 1]?.type === SEAL_LINE ? evs[doneAt + 1]!.data : null;
+  const signedSeals = sealedAt.map((i) => evs[i]!.data).filter((d) => d["signed"] === true);
+  const signedReceipt = signedSeals.length > 0;
+  if (ls) {
+    const sha = createHash("sha256").update(lines.slice(0, doneAt + 1).join("\n") + "\n").digest("hex");
+    const sig = typeof ls["sig"] === "string" ? Buffer.from(ls["sig"], "base64url") : null;
+    const kid = ls["kid"];
+    if (ls["tampered"] !== false) bad.push(`${SEAL_LINE} line records a tamper or is malformed`);
+    else if (typeof kid !== "string" || !sig || sig.length !== 64) hashBad.push(`${SEAL_LINE} line is malformed or records a tamper`);
+    else {
+      if (signedSeals.some((d) => typeof d["kid"] === "string" && d["kid"] !== kid)) hashBad.push(`${SEAL_LINE} kid differs from the receipt kid`);
+      if (ls["events_sha256"] !== sha) hashBad.push(`${SEAL_LINE} events_sha256 does not match the ingested log`);
+      else {
+        const pub = opts.pubkeyFor?.(kid);
+        if (pub) { sigChecked = true; if (!verify(null, Buffer.from(`${sha}:false`), pub, sig)) bad.push(`${SEAL_LINE} signature does not verify`); }
+        else if (keysConfigured) bad.push(`${SEAL_LINE} kid ${kid} has no configured public key`);
+      }
+    }
+  } else if (signedReceipt && doneAt >= 0) bad.push(`signed receipt but no ${SEAL_LINE} line after run.completed`);
+
+  let unverifiable = false;
+  if (hashBad.length > 0) {
+    if (redacted) { unverifiable = true; sigChecked = false; notes.push(REDACTED_NOTE); } else bad.push(...hashBad);
+  }
+
+  // A VERIFIED claim (first run.completed only) needs a receipt sealed before it, for the same verdict.
+  let claimsVerified = false;
+  const claimed = doneAt >= 0 ? verdictOf(evs[doneAt]) : null;
+  if (claimed !== null && SUCCESS_VERDICTS.has(claimed)) {
+    claimsVerified = true;
+    const before = sealedAt.filter((i) => i < doneAt);
+    if (before.length === 0) bad.push(`run.completed claims ${claimed} but no receipt.sealed precedes it`);
+    else if (!before.some((i) => verdictOf(evs[i]) === claimed)) bad.push(`run.completed claims ${claimed} but the sealed receipt does not`);
+  }
+
+  const tampered = bad.length > 0;
+  const attested = !tampered && !unverifiable && (!claimsVerified || (signedReceipt && ls !== null));
+  return { tampered, attested, sig_checked: sigChecked && !tampered, reasons: [...bad, ...notes] };
+}
+
+/** The one display verdict (FC-08). TAMPERED when the log failed integrity. When it is not attested, a success claim shows UNVERIFIED and any other verdict carries an
+ *  "(unattested)" marker. An attested success whose seal no key checked shows "<verdict> (signature not checked)"; plain VERIFIED only for a signature-checked run.
+ *  sig_checked undefined (older captures) reads as checked. */
+export function effectiveVerdict(r: { verdict: string | null; tampered: boolean; attested?: boolean; sig_checked?: boolean }): string | null {
+  if (r.tampered) return "TAMPERED";
+  const v = normVerdict(r.verdict);
+  if (v === null) return r.verdict;
+  if (r.attested === false) return SUCCESS_VERDICTS.has(v) ? "UNVERIFIED" : `${r.verdict}${UNATTESTED_SUFFIX}`;
+  if (SUCCESS_VERDICTS.has(v)) return r.sig_checked === false ? `${v} (signature not checked)` : v;
+  return r.verdict;
+}

package/packages/control-plane/src/server/runs.ts

@@ -4,6 +4,7 @@ import type { EventEnvelope } from "../../../../loki-ts/src/engine10/types.ts";
 import type { Db } from "../db/migrate.ts";
 import { events, runs } from "../db/schema.ts";
 import { blockedQuestion } from "./answer.ts";
+import { effectiveVerdict, pubkeysFromEnv, sealedPrefix, SUCCESS_VERDICTS, verifyRunIntegrity } from "./integrity.ts";
 
 const str = (x: unknown): string | null => (typeof x === "string" ? x : null);
 
@@ -16,8 +17,11 @@ export function loadEvents(db: Db, sourceId: string, runId: string): EventEnvelo
 export function rebuildRun(db: Db, sourceId: string, runId: string): void {
   const evs = loadEvents(db, sourceId, runId);
   if (evs.length === 0) return;
-  const f = fold(evs);
-  const pc = partialCost(evs, f.run.tampered);
+  const f = fold(sealedPrefix(evs)); // the verdict comes from the authenticated prefix; lines after the sealing line are unauthenticated
+  const keys = pubkeysFromEnv();
+  const integ = verifyRunIntegrity(evs, { pubkeyFor: keys }); // EL-FC08b: tampered is the supervisor flag OR any ingest-side integrity failure
+  const tampered = f.run.tampered || integ.tampered;
+  const pc = partialCost(evs, tampered);
   const sd = f.run.started?.data ?? {};
   const done = f.run.completed?.data ?? {};
   const pr = evs.find((e) => e.type === "pr.opened")?.data;
@@ -31,12 +35,15 @@ export function rebuildRun(db: Db, sourceId: string, runId: string): void {
     costUsd: f.cost.usd, partialUsd: pc.usd, measuredSessions: pc.measured, totalSessions: pc.total,
     inputTokens: f.cost.inputTokens, outputTokens: f.cost.outputTokens,
     wallS: typeof done.wall_s === "number" ? done.wall_s : null,
-    lastSeq: f.lastSeq, lastEventAt: evs[evs.length - 1]?.ts ?? null, tampered: Number(f.run.tampered),
+    lastSeq: f.lastSeq, lastEventAt: evs[evs.length - 1]?.ts ?? null, tampered: Number(tampered),
+    attested: Number(integ.attested), sigChecked: Number(integ.sig_checked), integrityKeyFp: keys.fingerprint ?? "", integrityReasons: JSON.stringify(integ.reasons),
   };
   // conflict is owned by ingest, so it is left out of the update set and survives a rebuild
   db.insert(runs).values(row).onConflictDoUpdate({ target: [runs.sourceId, runs.runId], set: row }).run();
 }
 
+const reasonsOf = (j: string | null): string[] => { try { const x = JSON.parse(j ?? "[]"); return Array.isArray(x) ? x.filter((s): s is string => typeof s === "string") : []; } catch { return []; } };
+
 const parseRun = (r: typeof runs.$inferSelect) => ({
   source_id: r.sourceId, run_id: r.runId, origin_repo: r.originRepo, issue_ref: r.issueRef, task_source: r.taskSource,
   group_id: r.groupId, unit_id: r.unitId, provider: r.provider, model: r.model, started_at: r.startedAt, ended_at: r.endedAt, verdict: r.verdict,
@@ -44,6 +51,8 @@ const parseRun = (r: typeof runs.$inferSelect) => ({
   cost_usd: r.costUsd, partial_usd: r.partialUsd, measured_sessions: r.measuredSessions, total_sessions: r.totalSessions,
   input_tokens: r.inputTokens, output_tokens: r.outputTokens, wall_s: r.wallS, last_seq: r.lastSeq,
   last_event_at: r.lastEventAt, tampered: r.tampered === 1, conflict: r.conflict === 1,
+  attested: r.attested === 1, sig_checked: r.sigChecked === 1, integrity_reasons: reasonsOf(r.integrityReasons),
+  effective_verdict: effectiveVerdict({ verdict: r.verdict, tampered: r.tampered === 1, attested: r.attested === 1, sig_checked: r.sigChecked === 1 }),
   status: r.endedAt ? "completed" : "running", elapsed_s: elapsedS(r),
 });
 // A run with no run.completed yet is running: add its live fields (stage, files) from the stored events.
@@ -75,13 +84,46 @@ const elapsedS = (r: typeof runs.$inferSelect): number | null => {
   return Math.max(0, (end - Date.parse(r.startedAt)) / 1000);
 };
 
+/** FC-08: filters match the DISPLAY verdict. Plain VERIFIED (and ALREADY_SATISFIED) lists only attested, signature-checked runs; "<verdict> (signature not checked)" the attested
+ *  rest; UNVERIFIED every non-tampered run that is not attested. */
+const SIG_SUFFIX = " (signature not checked)";
+const verdictFilter = (v: string | undefined) => {
+  if (!v) return undefined;
+  if (v === "TAMPERED") return eq(runs.tampered, 1);
+  if (v === "UNVERIFIED") return and(eq(runs.tampered, 0), sql`${runs.verdict} is not null`, sql`coalesce(${runs.attested}, 0) != 1`);
+  if (SUCCESS_VERDICTS.has(v)) return and(eq(runs.verdict, v), eq(runs.tampered, 0), eq(runs.attested, 1), eq(runs.sigChecked, 1));
+  if (v.endsWith(SIG_SUFFIX) && SUCCESS_VERDICTS.has(v.slice(0, -SIG_SUFFIX.length))) return and(eq(runs.verdict, v.slice(0, -SIG_SUFFIX.length)), eq(runs.tampered, 0), eq(runs.attested, 1), sql`coalesce(${runs.sigChecked}, 0) != 1`);
+  return and(eq(runs.verdict, v), eq(runs.tampered, 0), eq(runs.attested, 1));
+};
+
+const RECOMPUTE_CHUNK = 200;
+/** Boot-time recompute. Rows are re-judged when their integrity was never evaluated (attested IS NULL) or was evaluated under a different key set (stored fingerprint differs).
+ *  Chunked, one transaction per chunk. A row whose events are gone is marked unattested with a reason and the current fingerprint, so it is not retried on every boot. */
+export function recomputeLegacy(db: Db): number {
+  const fp = pubkeysFromEnv().fingerprint ?? "";
+  let n = 0;
+  for (;;) {
+    const rows = db.select({ s: runs.sourceId, r: runs.runId }).from(runs).where(sql`${runs.attested} is null or ${runs.integrityKeyFp} is not ${fp}`).limit(RECOMPUTE_CHUNK).all();
+    if (rows.length === 0) return n;
+    db.transaction((tx) => {
+      const t = tx as unknown as Db;
+      for (const x of rows) {
+        if (loadEvents(t, x.s, x.r).length === 0) {
+          t.update(runs).set({ attested: 0, sigChecked: 0, integrityKeyFp: fp, integrityReasons: JSON.stringify(["stored events are missing; integrity cannot be evaluated"]) }).where(and(eq(runs.sourceId, x.s), eq(runs.runId, x.r))).run();
+        } else rebuildRun(t, x.s, x.r);
+      }
+    });
+    n += rows.length;
+  }
+}
+
 export interface ListQuery { verdict?: string; repo?: string; since?: string; until?: string; group_id?: string; limit?: number; cursor?: string }
 
 export function listRuns(db: Db, q: ListQuery) {
   const limit = Math.min(Math.max(q.limit ?? 50, 1), 200);
   const offset = Math.max(Number.parseInt(q.cursor ?? "0", 10) || 0, 0); // ponytail: cursor is an opaque offset, keyset when write rate makes pages shift
   const where = and(
-    q.verdict ? eq(runs.verdict, q.verdict) : undefined,
+    verdictFilter(q.verdict),
     q.repo ? eq(runs.originRepo, q.repo) : undefined,
     q.group_id ? eq(runs.groupId, q.group_id) : undefined,
     q.since ? gte(runs.startedAt, q.since) : undefined,

package/packages/control-plane/src/shipper/discover.ts

@@ -1,9 +1,10 @@
 // C2 CP-DEFAULT: find a running local Control Plane (docs/v10/CONTROL-PLANE.md section 6). Reads
 // ~/.loki/control/instance.json; returns its url only when the pid is alive and /health answers service=loki-control
 // within 300 ms. Never starts a server, never throws. LOKI_CONTROL=0 disables discovery.
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
+import { execFileSync } from "node:child_process";
+import { readFileSync, realpathSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
 
 export const instancePath = (env: NodeJS.ProcessEnv): string => join(env.HOME || homedir(), ".loki", "control", "instance.json");
 
@@ -27,3 +28,31 @@ export async function discoverControlUrl(env: NodeJS.ProcessEnv, o: DiscoverOpts
     return h.service === "loki-control" ? url : null;
   } catch { return null; }
 }
+
+// P0 guard: auto-discovery must never ship a throwaway or fixture repo to a developer's live Control Plane. An explicit
+// LOKI_CONTROL_URL is an operator decision and is never filtered. LOKI_CONTROL_ALLOW_TMP=1 lets a sandboxed harness
+// (its own HOME and its own server, repos under the temp dir) exercise discovery on purpose.
+const FIXTURE_REPO = /(^|[/:])acme\/widget(\.git)?\/?$/i;
+const FIXED_TMP_ROOTS = ["/tmp", "/private/tmp", "/var/folders", "/private/var/folders"];
+
+const real = (p: string): string => { try { return realpathSync(p); } catch { return resolve(p); } };
+const under = (p: string, root: string): boolean => p === root || p.startsWith(root.endsWith("/") ? root : `${root}/`);
+
+export function isThrowawayPath(repoDir: string, tmpRoots: string[] = [real(tmpdir()), ...FIXED_TMP_ROOTS]): boolean {
+  const p = real(repoDir), raw = resolve(repoDir);
+  return tmpRoots.some((r) => under(p, r) || under(raw, r) || under(p, real(r)));
+}
+
+/** A reason when a discovered (non-explicit) Control Plane must not receive this repo's events, else null. */
+export function discoveryRefusal(repoDir: string, originUrl: string | null, env: NodeJS.ProcessEnv = process.env, tmpRoots?: string[]): string | null {
+  if (env.LOKI_CONTROL_ALLOW_TMP === "1") return null;
+  if (isThrowawayPath(repoDir, tmpRoots)) return "repo is under the OS temp dir";
+  if (originUrl && FIXTURE_REPO.test(originUrl.trim())) return "origin is the fixture repo acme/widget";
+  if (FIXTURE_REPO.test(`${basename(dirname(repoDir))}/${basename(repoDir)}`)) return "repo name is the fixture acme/widget";
+  return null;
+}
+
+/** The repo's origin url (env is threaded so the spawn never inherits ambient state), or null. */
+export function gitOrigin(repoDir: string, env: NodeJS.ProcessEnv): string | null {
+  try { return execFileSync("git", ["-C", repoDir, "config", "--get", "remote.origin.url"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], env }).trim() || null; } catch { return null; }
+}

package/packages/control-plane/src/shipper/ship.ts

@@ -93,3 +93,18 @@ export async function shipRun(o: ShipOpts): Promise<ShipResult> {
 
 export const shipEnabled = (env: NodeJS.ProcessEnv): string | null => env.LOKI_CONTROL_URL || null;
 export const hasSpool = (runDir: string): boolean => existsSync(join(runDir, "events.jsonl"));
+
+/** Fire-and-forget ship loop: an unref'd timer with backoff; never throws. */
+export function startShipLoop(o: Omit<ShipOpts, "timeoutMs">): void {
+  let failures = 0, nextAt = 0, busy = false;
+  const tick = async (): Promise<void> => {
+    if (busy || Date.now() < nextAt) return;
+    busy = true;
+    try {
+      const r = await shipRun({ ...o, timeoutMs: 5000 });
+      failures = r.ok ? 0 : failures + 1;
+      nextAt = r.ok ? 0 : Date.now() + backoffMs(failures);
+    } catch { failures++; } finally { busy = false; }
+  };
+  setInterval(() => void tick(), 300).unref();
+}

package/packages/control-plane/src/shipper/watch.ts

@@ -0,0 +1,66 @@
+// CP-INGEST: zero-homework ingest. On Control Plane start, backfill the current repo plus every repo in the project
+// registry (~/.loki/dashboard/projects.json), then poll each repo's .loki/runs and ship appended events.jsonl lines
+// through the same shipRun path as the live hook (idempotent: ship.json holds the acked seq, the server dedupes).
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { backfill } from "./backfill.ts";
+import { discoveryRefusal } from "./discover.ts";
+import { shipRun, sourceId } from "./ship.ts";
+
+/** Repo dirs from the dashboard project registry; never throws, a missing or corrupt registry means none. */
+export function registryRepos(env: NodeJS.ProcessEnv): string[] {
+  try {
+    const reg = JSON.parse(readFileSync(join(env.HOME || homedir(), ".loki", "dashboard", "projects.json"), "utf8")) as { projects?: Record<string, { path?: unknown }> };
+    return Object.values(reg.projects ?? {}).map((p) => p.path).filter((p): p is string => typeof p === "string" && p.startsWith("/"));
+  } catch { return []; }
+}
+
+export interface WatchOpts {
+  repoDir: string;
+  url: string;
+  env?: NodeJS.ProcessEnv;
+  intervalMs?: number;
+  fetchImpl?: typeof fetch;
+}
+export interface Watcher { stop: () => void; tick: () => Promise<number> }
+
+const sig = (f: string): string => { try { const s = statSync(f); return `${s.size}:${s.mtimeMs}`; } catch { return ""; } };
+
+/** Backfill every repo, then watch. Resolves once the backfill is done; the watcher keeps polling until stop(). */
+export async function ingestAndWatch(o: WatchOpts): Promise<Watcher> {
+  const env: NodeJS.ProcessEnv = { ...(o.env ?? process.env), LOKI_CONTROL_URL: o.url };
+  // P0: registry entries are third-party-registered paths; skip temp and fixture repos (the explicit repoDir is always kept).
+  const repos = [...new Set([o.repoDir, ...registryRepos(env).filter((r) => discoveryRefusal(r, null, env) === null)])];
+  const seen = new Map<string, string>(); // events.jsonl path -> size:mtime last shipped OK
+  for (const repoDir of repos) {
+    try { await backfill({ repoDir, env, attempts: 1, fetchImpl: o.fetchImpl }); } catch { /* one bad repo must not block the rest */ }
+  }
+  let busy = false;
+  const tick = async (): Promise<number> => {
+    if (busy) return 0;
+    busy = true;
+    let sent = 0;
+    try {
+      for (const repoDir of repos) {
+        const root = join(repoDir, ".loki", "runs");
+        let ids: string[] = [];
+        try { ids = readdirSync(root); } catch { continue; }
+        const source = sourceId(repoDir);
+        for (const id of ids) {
+          const runDir = join(root, id), f = join(runDir, "events.jsonl"), s = sig(f);
+          if (s === "" || seen.get(f) === s) continue;
+          try {
+            const r = await shipRun({ runDir, url: o.url, source, token: env.LOKI_CONTROL_TOKEN, fetchImpl: o.fetchImpl });
+            sent += r.sent;
+            if (r.ok) seen.set(f, s);
+          } catch { /* retry next tick */ }
+        }
+      }
+    } finally { busy = false; }
+    return sent;
+  };
+  const timer = setInterval(() => { void tick(); }, o.intervalMs ?? 1000);
+  (timer as { unref?: () => void }).unref?.();
+  return { stop: () => clearInterval(timer), tick };
+}

package/packages/control-plane/ui/dist/assets/index-DHDI_dHM.css

@@ -0,0 +1 @@
+*,:before,:after{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }::backdrop{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }*,:before,:after{box-sizing:border-box;border-width:0;border-style:solid;border-color:#e5e7eb}:before,:after{--tw-content: ""}html,:host{line-height:1.5;-webkit-text-size-adjust:100%;-moz-tab-size:4;-o-tab-size:4;tab-size:4;font-family:ui-sans-serif,system-ui,sans-serif,"Apple Color Emoji","Segoe UI Emoji",Segoe UI Symbol,"Noto Color Emoji";font-feature-settings:normal;font-variation-settings:normal;-webkit-tap-highlight-color:transparent}body{margin:0;line-height:inherit}hr{height:0;color:inherit;border-top-width:1px}abbr:where([title]){-webkit-text-decoration:underline dotted;text-decoration:underline dotted}h1,h2,h3,h4,h5,h6{font-size:inherit;font-weight:inherit}a{color:inherit;text-decoration:inherit}b,strong{font-weight:bolder}code,kbd,samp,pre{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace;font-feature-settings:normal;font-variation-settings:normal;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}table{text-indent:0;border-color:inherit;border-collapse:collapse}button,input,optgroup,select,textarea{font-family:inherit;font-feature-settings:inherit;font-variation-settings:inherit;font-size:100%;font-weight:inherit;line-height:inherit;letter-spacing:inherit;color:inherit;margin:0;padding:0}button,select{text-transform:none}button,input:where([type=button]),input:where([type=reset]),input:where([type=submit]){-webkit-appearance:button;background-color:transparent;background-image:none}:-moz-focusring{outline:auto}:-moz-ui-invalid{box-shadow:none}progress{vertical-align:baseline}::-webkit-inner-spin-button,::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}summary{display:list-item}blockquote,dl,dd,h1,h2,h3,h4,h5,h6,hr,figure,p,pre{margin:0}fieldset{margin:0;padding:0}legend{padding:0}ol,ul,menu{list-style:none;margin:0;padding:0}dialog{padding:0}textarea{resize:vertical}input::-moz-placeholder,textarea::-moz-placeholder{opacity:1;color:#9ca3af}input::placeholder,textarea::placeholder{opacity:1;color:#9ca3af}button,[role=button]{cursor:pointer}:disabled{cursor:default}img,svg,video,canvas,audio,iframe,embed,object{display:block;vertical-align:middle}img,video{max-width:100%;height:auto}[hidden]:where(:not([hidden=until-found])){display:none}.mb-1{margin-bottom:.25rem}.mb-2{margin-bottom:.5rem}.mb-4{margin-bottom:1rem}.mb-6{margin-bottom:1.5rem}.ml-2{margin-left:.5rem}.ml-auto{margin-left:auto}.mt-1{margin-top:.25rem}.mt-2{margin-top:.5rem}.mt-4{margin-top:1rem}.mt-6{margin-top:1.5rem}.inline-block{display:inline-block}.flex{display:flex}.inline-flex{display:inline-flex}.table{display:table}.grid{display:grid}.hidden{display:none}.min-h-11{min-height:2.75rem}.min-h-screen{min-height:100vh}.w-full{width:100%}.min-w-0{min-width:0px}.flex-1{flex:1 1 0%}.shrink-0{flex-shrink:0}.list-disc{list-style-type:disc}.grid-cols-1{grid-template-columns:repeat(1,minmax(0,1fr))}.grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.grid-cols-\[auto_1fr\]{grid-template-columns:auto 1fr}.flex-col{flex-direction:column}.flex-wrap{flex-wrap:wrap}.items-center{align-items:center}.justify-center{justify-content:center}.justify-between{justify-content:space-between}.gap-1{gap:.25rem}.gap-2{gap:.5rem}.gap-3{gap:.75rem}.gap-4{gap:1rem}.gap-x-4{-moz-column-gap:1rem;column-gap:1rem}.gap-y-1{row-gap:.25rem}.space-y-1>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.25rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.25rem * var(--tw-space-y-reverse))}.space-y-2>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.5rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.5rem * var(--tw-space-y-reverse))}.space-y-3>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.75rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.75rem * var(--tw-space-y-reverse))}.space-y-4>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(1rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(1rem * var(--tw-space-y-reverse))}.overflow-x-auto{overflow-x:auto}.break-all{word-break:break-all}.rounded{border-radius:.25rem}.border{border-width:1px}.border-b{border-bottom-width:1px}.border-t{border-top-width:1px}.border-dashed{border-style:dashed}.border-red-500\/50{border-color:#ef444480}.border-slate-200{--tw-border-opacity: 1;border-color:rgb(226 232 240 / var(--tw-border-opacity, 1))}.border-slate-300{--tw-border-opacity: 1;border-color:rgb(203 213 225 / var(--tw-border-opacity, 1))}.bg-amber-500\/15{background-color:#f59e0b26}.bg-emerald-500\/15{background-color:#10b98126}.bg-red-500\/15{background-color:#ef444426}.bg-red-600{--tw-bg-opacity: 1;background-color:rgb(220 38 38 / var(--tw-bg-opacity, 1))}.bg-red-600\/20{background-color:#dc262633}.bg-sky-500\/15{background-color:#0ea5e926}.bg-sky-600{--tw-bg-opacity: 1;background-color:rgb(2 132 199 / var(--tw-bg-opacity, 1))}.bg-slate-100{--tw-bg-opacity: 1;background-color:rgb(241 245 249 / var(--tw-bg-opacity, 1))}.bg-slate-200{--tw-bg-opacity: 1;background-color:rgb(226 232 240 / var(--tw-bg-opacity, 1))}.bg-slate-500\/15{background-color:#64748b26}.bg-violet-500\/15{background-color:#8b5cf626}.bg-white{--tw-bg-opacity: 1;background-color:rgb(255 255 255 / var(--tw-bg-opacity, 1))}.p-2{padding:.5rem}.p-3{padding:.75rem}.p-4{padding:1rem}.p-8{padding:2rem}.px-2{padding-left:.5rem;padding-right:.5rem}.px-3{padding-left:.75rem;padding-right:.75rem}.px-4{padding-left:1rem;padding-right:1rem}.py-0\.5{padding-top:.125rem;padding-bottom:.125rem}.py-1{padding-top:.25rem;padding-bottom:.25rem}.py-2{padding-top:.5rem;padding-bottom:.5rem}.pl-5{padding-left:1.25rem}.text-left{text-align:left}.text-center{text-align:center}.font-mono{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace}.text-lg{font-size:1.125rem;line-height:1.75rem}.text-sm{font-size:.875rem;line-height:1.25rem}.text-xl{font-size:1.25rem;line-height:1.75rem}.text-xs{font-size:.75rem;line-height:1rem}.font-medium{font-weight:500}.font-semibold{font-weight:600}.uppercase{text-transform:uppercase}.text-amber-600{--tw-text-opacity: 1;color:rgb(217 119 6 / var(--tw-text-opacity, 1))}.text-amber-700{--tw-text-opacity: 1;color:rgb(180 83 9 / var(--tw-text-opacity, 1))}.text-emerald-600{--tw-text-opacity: 1;color:rgb(5 150 105 / var(--tw-text-opacity, 1))}.text-emerald-700{--tw-text-opacity: 1;color:rgb(4 120 87 / var(--tw-text-opacity, 1))}.text-red-600{--tw-text-opacity: 1;color:rgb(220 38 38 / var(--tw-text-opacity, 1))}.text-red-700{--tw-text-opacity: 1;color:rgb(185 28 28 / var(--tw-text-opacity, 1))}.text-sky-600{--tw-text-opacity: 1;color:rgb(2 132 199 / var(--tw-text-opacity, 1))}.text-sky-700{--tw-text-opacity: 1;color:rgb(3 105 161 / var(--tw-text-opacity, 1))}.text-slate-400{--tw-text-opacity: 1;color:rgb(148 163 184 / var(--tw-text-opacity, 1))}.text-slate-500{--tw-text-opacity: 1;color:rgb(100 116 139 / var(--tw-text-opacity, 1))}.text-slate-600{--tw-text-opacity: 1;color:rgb(71 85 105 / var(--tw-text-opacity, 1))}.text-slate-900{--tw-text-opacity: 1;color:rgb(15 23 42 / var(--tw-text-opacity, 1))}.text-violet-700{--tw-text-opacity: 1;color:rgb(109 40 217 / var(--tw-text-opacity, 1))}.text-white{--tw-text-opacity: 1;color:rgb(255 255 255 / var(--tw-text-opacity, 1))}.ring-1{--tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow, 0 0 #0000)}.ring-amber-500\/30{--tw-ring-color: rgb(245 158 11 / .3)}.ring-emerald-500\/30{--tw-ring-color: rgb(16 185 129 / .3)}.ring-red-500\/30{--tw-ring-color: rgb(239 68 68 / .3)}.ring-red-600\/50{--tw-ring-color: rgb(220 38 38 / .5)}.ring-sky-500\/30{--tw-ring-color: rgb(14 165 233 / .3)}.ring-slate-500\/30{--tw-ring-color: rgb(100 116 139 / .3)}.ring-violet-500\/30{--tw-ring-color: rgb(139 92 246 / .3)}.filter{filter:var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow)}.hover\:underline:hover{text-decoration-line:underline}.disabled\:opacity-50:disabled{opacity:.5}.dark\:border-slate-700:is(.dark *){--tw-border-opacity: 1;border-color:rgb(51 65 85 / var(--tw-border-opacity, 1))}.dark\:border-slate-800:is(.dark *){--tw-border-opacity: 1;border-color:rgb(30 41 59 / var(--tw-border-opacity, 1))}.dark\:bg-slate-800:is(.dark *){--tw-bg-opacity: 1;background-color:rgb(30 41 59 / var(--tw-bg-opacity, 1))}.dark\:bg-slate-900:is(.dark *){--tw-bg-opacity: 1;background-color:rgb(15 23 42 / var(--tw-bg-opacity, 1))}.dark\:bg-slate-950:is(.dark *){--tw-bg-opacity: 1;background-color:rgb(2 6 23 / var(--tw-bg-opacity, 1))}.dark\:text-amber-300:is(.dark *){--tw-text-opacity: 1;color:rgb(252 211 77 / var(--tw-text-opacity, 1))}.dark\:text-emerald-300:is(.dark *){--tw-text-opacity: 1;color:rgb(110 231 183 / var(--tw-text-opacity, 1))}.dark\:text-emerald-400:is(.dark *){--tw-text-opacity: 1;color:rgb(52 211 153 / var(--tw-text-opacity, 1))}.dark\:text-red-300:is(.dark *){--tw-text-opacity: 1;color:rgb(252 165 165 / var(--tw-text-opacity, 1))}.dark\:text-sky-300:is(.dark *){--tw-text-opacity: 1;color:rgb(125 211 252 / var(--tw-text-opacity, 1))}.dark\:text-sky-400:is(.dark *){--tw-text-opacity: 1;color:rgb(56 189 248 / var(--tw-text-opacity, 1))}.dark\:text-slate-100:is(.dark *){--tw-text-opacity: 1;color:rgb(241 245 249 / var(--tw-text-opacity, 1))}.dark\:text-slate-300:is(.dark *){--tw-text-opacity: 1;color:rgb(203 213 225 / var(--tw-text-opacity, 1))}.dark\:text-slate-400:is(.dark *){--tw-text-opacity: 1;color:rgb(148 163 184 / var(--tw-text-opacity, 1))}.dark\:text-violet-300:is(.dark *){--tw-text-opacity: 1;color:rgb(196 181 253 / var(--tw-text-opacity, 1))}@media(min-width:640px){.sm\:flex{display:flex}.sm\:flex-row{flex-direction:row}.sm\:flex-wrap{flex-wrap:wrap}.sm\:items-end{align-items:flex-end}}@media(min-width:768px){.md\:mb-6{margin-bottom:1.5rem}.md\:ml-0{margin-left:0}.md\:mt-6{margin-top:1.5rem}.md\:block{display:block}.md\:table-cell{display:table-cell}.md\:min-h-0{min-height:0px}.md\:w-48{width:12rem}.md\:grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}.md\:grid-cols-3{grid-template-columns:repeat(3,minmax(0,1fr))}.md\:grid-cols-4{grid-template-columns:repeat(4,minmax(0,1fr))}.md\:flex-row{flex-direction:row}.md\:border-b-0{border-bottom-width:0px}.md\:border-r{border-right-width:1px}.md\:p-4{padding:1rem}.md\:p-6{padding:1.5rem}.md\:px-2{padding-left:.5rem;padding-right:.5rem}.md\:px-3{padding-left:.75rem;padding-right:.75rem}.md\:py-0{padding-top:0;padding-bottom:0}.md\:py-1{padding-top:.25rem;padding-bottom:.25rem}}