loki-mode 10.6.7 → 10.6.9

package/packages/control-plane/dist/server.js

@@ -16,7 +16,7 @@ var __export = (target, all) => {
 
 // src/server/app.ts
 import { existsSync as existsSync2, statSync } from "fs";
-import { join as join2, resolve, sep } from "path";
+import { join as join3, resolve, sep } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -5535,11 +5535,14 @@ var runs = sqliteTable("runs", {
   lastSeq: integer("last_seq").notNull(),
   lastEventAt: text("last_event_at"),
   tampered: integer("tampered").notNull(),
-  conflict: integer("conflict").notNull().default(0)
+  conflict: integer("conflict").notNull().default(0),
+  groupId: text("group_id"),
+  unitId: text("unit_id")
 }, (t) => [
   primaryKey({ columns: [t.sourceId, t.runId] }),
   index("runs_started").on(t.startedAt),
-  index("runs_verdict").on(t.verdict)
+  index("runs_verdict").on(t.verdict),
+  index("runs_group").on(t.groupId)
 ]);
 
 // src/db/migrate.ts
@@ -5581,6 +5584,11 @@ function validateEnvelope(x) {
     return "stage must be a string or null";
   if (!isObj(x.data))
     return "data must be an object";
+  for (const k of ["group_id", "unit_id"])
+    if (k in x.data && (typeof x.data[k] !== "string" || x.data[k] === ""))
+      return `${k} must be a non-empty string`;
+  if ("deps" in x.data && (!Array.isArray(x.data.deps) || x.data.deps.some((d) => typeof d !== "string")))
+    return "deps must be a string array";
   return null;
 }
 function fold(events2) {
@@ -5658,6 +5666,35 @@ var RULES = [
 ];
 var redactSecrets = (s) => RULES.reduce((a, [re, to]) => a.replace(re, to), s);
 
+// src/server/answer.ts
+import { chmodSync, mkdirSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+var MAX_ANSWER = 4000;
+var ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var defaultAnswerDir = (env = process.env) => env.LOKI_CONTROL_ANSWER_DIR || join2(env.HOME || homedir(), ".loki", "control", "answers");
+function blockedQuestion(evs, verdict) {
+  if (verdict !== "SPEC_CONFLICT")
+    return null;
+  const why = evs.find((e) => e.type === "stage.completed" && e.stage === "implement")?.data.spec_conflict_reason;
+  return (typeof why === "string" && why ? why : "the run is blocked on a spec conflict").replace(/[\x00-\x1f\x7f]+/g, " ").slice(0, 500);
+}
+function writeAnswer(dir, source, run, answer) {
+  if (!ID.test(source) || !ID.test(run) || source.includes("..") || run.includes(".."))
+    return { status: 400, body: { error: "invalid run id" } };
+  if (typeof answer !== "string" || answer.trim() === "")
+    return { status: 400, body: { error: "answer must be a non-empty string" } };
+  if (answer.length > MAX_ANSWER)
+    return { status: 413, body: { error: `answer over ${MAX_ANSWER} characters` } };
+  const d = join2(dir, source);
+  mkdirSync(d, { recursive: true, mode: 448 });
+  const path = join2(d, `${run}.answer.txt`);
+  writeFileSync(path, `${answer.trim()}
+`, { mode: 384 });
+  chmodSync(path, 384);
+  return { status: 200, body: { ok: true, path, resume: `loki answer ${run}` } };
+}
+
 // src/server/runs.ts
 var str = (x) => typeof x === "string" ? x : null;
 function loadEvents(db, sourceId, runId) {
@@ -5680,6 +5717,8 @@ function rebuildRun(db, sourceId, runId) {
     taskSource: str(sd.task_source),
     provider: str(sd.provider),
     model: str(sd.model),
+    groupId: str(sd.group_id),
+    unitId: str(sd.unit_id),
     startedAt: f.run.started?.ts ?? evs[0]?.ts ?? null,
     endedAt: f.run.completed?.ts ?? null,
     verdict: f.run.verdict,
@@ -5704,6 +5743,8 @@ var parseRun = (r) => ({
   origin_repo: r.originRepo,
   issue_ref: r.issueRef,
   task_source: r.taskSource,
+  group_id: r.groupId,
+  unit_id: r.unitId,
   provider: r.provider,
   model: r.model,
   started_at: r.startedAt,
@@ -5763,7 +5804,7 @@ var elapsedS = (r) => {
 function listRuns(db, q) {
   const limit = Math.min(Math.max(q.limit ?? 50, 1), 200);
   const offset = Math.max(Number.parseInt(q.cursor ?? "0", 10) || 0, 0);
-  const where = and(q.verdict ? eq(runs.verdict, q.verdict) : undefined, q.repo ? eq(runs.originRepo, q.repo) : undefined, q.since ? gte(runs.startedAt, q.since) : undefined, q.until ? lt(runs.startedAt, q.until) : undefined);
+  const where = and(q.verdict ? eq(runs.verdict, q.verdict) : undefined, q.repo ? eq(runs.originRepo, q.repo) : undefined, q.group_id ? eq(runs.groupId, q.group_id) : undefined, q.since ? gte(runs.startedAt, q.since) : undefined, q.until ? lt(runs.startedAt, q.until) : undefined);
   const total = db.select({ n: sql`count(*)` }).from(runs).where(where).get()?.n ?? 0;
   const rows = db.select().from(runs).where(where).orderBy(desc(runs.startedAt), asc(runs.runId)).limit(limit).offset(offset).all();
   return { runs: rows.map((r) => withLive(db, r)), total, next_cursor: offset + rows.length < total ? String(offset + rows.length) : null };
@@ -5792,6 +5833,7 @@ function runDetail(db, sourceId, runId) {
   const sealed = evs.find((e) => e.type === "receipt.sealed")?.data;
   return {
     ...withLive(db, r),
+    blocked_question: blockedQuestion(evs, r.verdict),
     stages,
     stages_completed: f.completed,
     receipt: sealed ? { sha256: str(sealed.receipt_sha256), signed: sealed.signed === true, verdict: str(sealed.verdict), path: str(sealed.path) } : null,
@@ -5846,14 +5888,64 @@ function ingest(db, body) {
   return conflict > 0 ? { status: 409, body: { ...out, error: "conflicting content for an existing event id" } } : { status: 200, body: out };
 }
 
+// src/server/auth.ts
+import { createHash as createHash2, timingSafeEqual } from "crypto";
+var LOOPBACK_BINDS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+function isLoopbackHost(host) {
+  return !!host && /^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/i.test(host);
+}
+function tokenMatches(header, token) {
+  const m = /^Bearer (.+)$/i.exec(header ?? "");
+  if (!m)
+    return false;
+  const a = createHash2("sha256").update(m[1] ?? "").digest();
+  const b = createHash2("sha256").update(token).digest();
+  return timingSafeEqual(a, b);
+}
+function bindRefusal(env) {
+  const host = env.LOKI_CONTROL_HOST;
+  if (!host || LOOPBACK_BINDS.has(host.toLowerCase()))
+    return null;
+  if (env.LOKI_CONTROL_TOKEN || env.LOKI_CONTROL_ALLOW_INSECURE_BIND === "1")
+    return null;
+  return `loki-control: refusing to listen on ${host} without LOKI_CONTROL_TOKEN. Set LOKI_CONTROL_TOKEN, or LOKI_CONTROL_ALLOW_INSECURE_BIND=1 to accept an unauthenticated non-loopback bind.`;
+}
+function insecureBindWarning(env) {
+  const host = env.LOKI_CONTROL_HOST;
+  if (!host || LOOPBACK_BINDS.has(host.toLowerCase()))
+    return null;
+  if (env.LOKI_CONTROL_TOKEN || env.LOKI_CONTROL_ALLOW_INSECURE_BIND !== "1")
+    return null;
+  return `loki-control: WARNING listening on ${host} with no LOKI_CONTROL_TOKEN (LOKI_CONTROL_ALLOW_INSECURE_BIND=1). Anyone who can reach this port can read and write runs.`;
+}
+function hostGuard() {
+  return async (c, next) => {
+    if (!isLoopbackHost(c.req.header("host")))
+      return c.json({ error: "host not allowed" }, 403);
+    await next();
+  };
+}
+function tokenGuard(token) {
+  return async (c, next) => {
+    if (!tokenMatches(c.req.header("authorization"), token))
+      return c.json({ error: "unauthorized" }, 401, { "www-authenticate": "Bearer" });
+    await next();
+  };
+}
+
 // src/server/app.ts
 var MAX_BODY = 1e6;
-var defaultUiDir = () => [join2(import.meta.dir, "../../ui/dist"), join2(import.meta.dir, "../ui/dist")].find((d) => existsSync2(join2(d, "index.html")));
+var defaultUiDir = () => [join3(import.meta.dir, "../../ui/dist"), join3(import.meta.dir, "../ui/dist")].find((d) => existsSync2(join3(d, "index.html")));
 function createApp(opts) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
   let ready = true;
+  const answerDir = opts.answerDir ?? defaultAnswerDir();
   const app = new Hono3;
+  if (opts.loopbackOnly)
+    app.use("*", hostGuard());
+  if (opts.token)
+    app.use("/v1/*", tokenGuard(opts.token));
   app.get("/health", (c) => c.json({ service: "loki-control", pid: process.pid, install_path: import.meta.dir }));
   app.get("/ready", (c) => {
     try {
@@ -5878,13 +5970,34 @@ function createApp(opts) {
   });
   app.get("/v1/runs", (c) => {
     const q = c.req.query();
-    return c.json(listRuns(db, { verdict: q.verdict, repo: q.repo, since: q.since, until: q.until, limit: q.limit ? Number(q.limit) : undefined, cursor: q.cursor }));
+    return c.json(listRuns(db, { verdict: q.verdict, repo: q.repo, since: q.since, until: q.until, group_id: q.group_id, limit: q.limit ? Number(q.limit) : undefined, cursor: q.cursor }));
   });
   const detail = (c, source, run) => {
     const d = runDetail(db, source, run);
     return d ? c.json(d) : c.json({ error: "run not found" }, 404);
   };
   app.get("/v1/runs/:source/:run", (c) => detail(c, c.req.param("source"), c.req.param("run")));
+  app.post("/v1/runs/:source/:run/answer", async (c) => {
+    const source = c.req.param("source"), run = c.req.param("run");
+    if (!(c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json"))
+      return c.json({ error: "content-type must be application/json" }, 400);
+    const text2 = await c.req.text();
+    if (text2.length > 20000)
+      return c.json({ error: "body too large" }, 413);
+    let body;
+    try {
+      body = JSON.parse(text2);
+    } catch {
+      return c.json({ error: "invalid JSON" }, 400);
+    }
+    const d = runDetail(db, source, run);
+    if (!d)
+      return c.json({ error: "run not found" }, 404);
+    if (!d.blocked_question)
+      return c.json({ error: "run is not blocked on a question" }, 409);
+    const r = writeAnswer(answerDir, source, run, body?.answer);
+    return c.json(r.body, r.status);
+  });
   app.get("/v1/runs/:id", (c) => {
     const id = c.req.param("id");
     const i = id.indexOf(":");
@@ -5900,14 +6013,23 @@ function createApp(opts) {
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))
       return c.json({ error: "not found" }, 404);
-    return new Response(Bun.file(join2(root, "index.html")));
+    return new Response(Bun.file(join3(root, "index.html")));
   });
   return { app, db, close: () => sqlite.close() };
 }
 
 // src/server/serve.ts
-var { app } = createApp({ dbPath: process.env.LOKI_CONTROL_DB ?? "control.db" });
-var serve = (port) => Bun.serve({ port, hostname: "127.0.0.1", fetch: app.fetch });
+var refusal = bindRefusal(process.env);
+if (refusal) {
+  console.error(refusal);
+  process.exit(2);
+}
+var warning = insecureBindWarning(process.env);
+if (warning)
+  console.error(warning);
+var bindHost = process.env.LOKI_CONTROL_HOST || "127.0.0.1";
+var { app } = createApp({ dbPath: process.env.LOKI_CONTROL_DB ?? "control.db", token: process.env.LOKI_CONTROL_TOKEN || undefined, loopbackOnly: isLoopbackHost(bindHost.includes(":") && !bindHost.startsWith("[") ? `[${bindHost}]` : bindHost) });
+var serve = (port) => Bun.serve({ port, hostname: process.env.LOKI_CONTROL_HOST || "127.0.0.1", fetch: app.fetch });
 var s;
 try {
   s = serve(Number(process.env.PORT ?? 0));

package/packages/control-plane/drizzle/0001_group_id.sql

@@ -0,0 +1,3 @@
+ALTER TABLE `runs` ADD `group_id` text;--> statement-breakpoint
+ALTER TABLE `runs` ADD `unit_id` text;--> statement-breakpoint
+CREATE INDEX `runs_group` ON `runs` (`group_id`);

package/packages/control-plane/drizzle/meta/_journal.json

@@ -8,6 +8,13 @@
       "when": 1790870373167,
       "tag": "0000_new_maelstrom",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "6",
+      "when": 1790956800000,
+      "tag": "0001_group_id",
+      "breakpoints": true
     }
   ]
-}
+}

package/packages/control-plane/src/db/schema.ts

@@ -47,8 +47,11 @@ export const runs = sqliteTable("runs", {
   lastEventAt: text("last_event_at"),
   tampered: integer("tampered").notNull(),
   conflict: integer("conflict").notNull().default(0),
+  groupId: text("group_id"),
+  unitId: text("unit_id"),
 }, (t) => [
   primaryKey({ columns: [t.sourceId, t.runId] }),
   index("runs_started").on(t.startedAt),
   index("runs_verdict").on(t.verdict),
+  index("runs_group").on(t.groupId),
 ]);

package/packages/control-plane/src/server/answer.ts

@@ -0,0 +1,33 @@
+// BLOCKED answer: a human reply to a run's one question, written to a file the operator resumes from.
+// File: <answerDir>/<source>/<run>.answer.txt (default ~/.loki/control/answers, override LOKI_CONTROL_ANSWER_DIR).
+import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import type { EventEnvelope } from "../../../../loki-ts/src/engine10/types.ts";
+
+export const MAX_ANSWER = 4000;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+
+export const defaultAnswerDir = (env: NodeJS.ProcessEnv = process.env): string =>
+  env.LOKI_CONTROL_ANSWER_DIR || join(env.HOME || homedir(), ".loki", "control", "answers");
+
+/** The question a BLOCKED (spec conflict) run is waiting on, or null when it is not blocked. */
+export function blockedQuestion(evs: EventEnvelope[], verdict: string | null): string | null {
+  if (verdict !== "SPEC_CONFLICT") return null;
+  const why = evs.find((e) => e.type === "stage.completed" && e.stage === "implement")?.data.spec_conflict_reason;
+  return (typeof why === "string" && why ? why : "the run is blocked on a spec conflict").replace(/[\x00-\x1f\x7f]+/g, " ").slice(0, 500);
+}
+
+export type AnswerResult = { status: 200; body: { ok: true; path: string; resume: string } } | { status: 400 | 413; body: { error: string } };
+
+export function writeAnswer(dir: string, source: string, run: string, answer: unknown): AnswerResult {
+  if (!ID.test(source) || !ID.test(run) || source.includes("..") || run.includes("..")) return { status: 400, body: { error: "invalid run id" } };
+  if (typeof answer !== "string" || answer.trim() === "") return { status: 400, body: { error: "answer must be a non-empty string" } };
+  if (answer.length > MAX_ANSWER) return { status: 413, body: { error: `answer over ${MAX_ANSWER} characters` } };
+  const d = join(dir, source);
+  mkdirSync(d, { recursive: true, mode: 0o700 });
+  const path = join(d, `${run}.answer.txt`);
+  writeFileSync(path, `${answer.trim()}\n`, { mode: 0o600 });
+  chmodSync(path, 0o600);
+  return { status: 200, body: { ok: true, path, resume: `loki answer ${run}` } };
+}

package/packages/control-plane/src/server/app.ts

@@ -3,7 +3,9 @@ import { join, resolve, sep } from "node:path";
 import { Hono } from "hono";
 import { openDb } from "../db/migrate.ts";
 import { ingest } from "./ingest.ts";
+import { defaultAnswerDir, writeAnswer } from "./answer.ts";
 import { listRuns, runDetail } from "./runs.ts";
+import { hostGuard, tokenGuard } from "./auth.ts";
 
 const MAX_BODY = 1_000_000;
 
@@ -11,11 +13,15 @@ const MAX_BODY = 1_000_000;
 const defaultUiDir = () => [join(import.meta.dir, "../../ui/dist"), join(import.meta.dir, "../ui/dist")].find((d) => existsSync(join(d, "index.html")));
 
 /** dbPath ":memory:" for tests. Migrations run here, so /ready is true as soon as this returns. uiDir overrides the built-UI location. */
-export function createApp(opts: { dbPath: string; uiDir?: string }) {
+export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: string; token?: string; loopbackOnly?: boolean }) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
   let ready = true;
+  const answerDir = opts.answerDir ?? defaultAnswerDir();
   const app = new Hono();
+  // token: bearer required on /v1/*. loopbackOnly: reject a non-loopback Host (DNS rebinding). Both off by default; serve.ts sets them from env.
+  if (opts.loopbackOnly) app.use("*", hostGuard());
+  if (opts.token) app.use("/v1/*", tokenGuard(opts.token));
 
   app.get("/health", (c) => c.json({ service: "loki-control", pid: process.pid, install_path: import.meta.dir }));
   app.get("/ready", (c) => {
@@ -34,13 +40,27 @@ export function createApp(opts: { dbPath: string; uiDir?: string }) {
 
   app.get("/v1/runs", (c) => {
     const q = c.req.query();
-    return c.json(listRuns(db, { verdict: q.verdict, repo: q.repo, since: q.since, until: q.until, limit: q.limit ? Number(q.limit) : undefined, cursor: q.cursor }));
+    return c.json(listRuns(db, { verdict: q.verdict, repo: q.repo, since: q.since, until: q.until, group_id: q.group_id, limit: q.limit ? Number(q.limit) : undefined, cursor: q.cursor }));
   });
   const detail = (c: { json: (b: unknown, s?: 404) => Response }, source: string, run: string) => {
     const d = runDetail(db, source, run);
     return d ? c.json(d) : c.json({ error: "run not found" }, 404);
   };
   app.get("/v1/runs/:source/:run", (c) => detail(c, c.req.param("source"), c.req.param("run")));
+  // BLOCKED answer: only for a run blocked on a question; JSON content type required (blocks cross-site form posts).
+  app.post("/v1/runs/:source/:run/answer", async (c) => {
+    const source = c.req.param("source"), run = c.req.param("run");
+    if (!(c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json")) return c.json({ error: "content-type must be application/json" }, 400);
+    const text = await c.req.text();
+    if (text.length > 20_000) return c.json({ error: "body too large" }, 413);
+    let body: { answer?: unknown } | null;
+    try { body = JSON.parse(text) as { answer?: unknown } | null; } catch { return c.json({ error: "invalid JSON" }, 400); }
+    const d = runDetail(db, source, run);
+    if (!d) return c.json({ error: "run not found" }, 404);
+    if (!d.blocked_question) return c.json({ error: "run is not blocked on a question" }, 409);
+    const r = writeAnswer(answerDir, source, run, body?.answer);
+    return c.json(r.body, r.status);
+  });
   // :id is `source:run` (run ids never contain a colon)
   app.get("/v1/runs/:id", (c) => {
     const id = c.req.param("id");

package/packages/control-plane/src/server/auth.ts

@@ -0,0 +1,51 @@
+// Control Plane auth: bearer token on /v1, Host allowlist on loopback (DNS rebinding), bind refusal without a token.
+import { createHash, timingSafeEqual } from "node:crypto";
+import type { MiddlewareHandler } from "hono";
+
+const LOOPBACK_BINDS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+
+/** True when a Host header value (optional port) names this machine's loopback. Strict: nothing may follow the name or port. */
+export function isLoopbackHost(host: string | undefined | null): boolean {
+  return !!host && /^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/i.test(host);
+}
+
+/** Constant-time check of an Authorization header against the token. Hashing first makes the compare length-safe. */
+export function tokenMatches(header: string | undefined | null, token: string): boolean {
+  const m = /^Bearer (.+)$/i.exec(header ?? "");
+  if (!m) return false;
+  const a = createHash("sha256").update(m[1] ?? "").digest();
+  const b = createHash("sha256").update(token).digest();
+  return timingSafeEqual(a, b);
+}
+
+/** Message to print before exiting 2 when the env asks for a non-loopback bind with no token, else null. */
+export function bindRefusal(env: Record<string, string | undefined>): string | null {
+  const host = env.LOKI_CONTROL_HOST;
+  if (!host || LOOPBACK_BINDS.has(host.toLowerCase())) return null;
+  if (env.LOKI_CONTROL_TOKEN || env.LOKI_CONTROL_ALLOW_INSECURE_BIND === "1") return null;
+  return `loki-control: refusing to listen on ${host} without LOKI_CONTROL_TOKEN. Set LOKI_CONTROL_TOKEN, or LOKI_CONTROL_ALLOW_INSECURE_BIND=1 to accept an unauthenticated non-loopback bind.`;
+}
+
+/** Stderr warning when ALLOW_INSECURE_BIND is what permits a non-loopback bind with no token, else null. Never includes a token. */
+export function insecureBindWarning(env: Record<string, string | undefined>): string | null {
+  const host = env.LOKI_CONTROL_HOST;
+  if (!host || LOOPBACK_BINDS.has(host.toLowerCase())) return null;
+  if (env.LOKI_CONTROL_TOKEN || env.LOKI_CONTROL_ALLOW_INSECURE_BIND !== "1") return null;
+  return `loki-control: WARNING listening on ${host} with no LOKI_CONTROL_TOKEN (LOKI_CONTROL_ALLOW_INSECURE_BIND=1). Anyone who can reach this port can read and write runs.`;
+}
+
+/** Host allowlist guard (apply on "*"; /health and /ready still need the Host check on loopback). */
+export function hostGuard(): MiddlewareHandler {
+  return async (c, next) => {
+    if (!isLoopbackHost(c.req.header("host"))) return c.json({ error: "host not allowed" }, 403);
+    await next();
+  };
+}
+
+/** Bearer guard. Register it with app.use("/v1/*", ...) so Hono's decoded route matching decides coverage, never the raw URL. */
+export function tokenGuard(token: string): MiddlewareHandler {
+  return async (c, next) => {
+    if (!tokenMatches(c.req.header("authorization"), token)) return c.json({ error: "unauthorized" }, 401, { "www-authenticate": "Bearer" });
+    await next();
+  };
+}

package/packages/control-plane/src/server/runs.ts

@@ -3,6 +3,7 @@ import { fold, partialCost } from "../../../../loki-ts/src/engine10/events.ts";
 import type { EventEnvelope } from "../../../../loki-ts/src/engine10/types.ts";
 import type { Db } from "../db/migrate.ts";
 import { events, runs } from "../db/schema.ts";
+import { blockedQuestion } from "./answer.ts";
 
 const str = (x: unknown): string | null => (typeof x === "string" ? x : null);
 
@@ -23,7 +24,7 @@ export function rebuildRun(db: Db, sourceId: string, runId: string): void {
   const row = {
     sourceId, runId,
     originRepo: str(sd.origin_repo), issueRef: str(sd.issue_ref), taskSource: str(sd.task_source),
-    provider: str(sd.provider), model: str(sd.model),
+    provider: str(sd.provider), model: str(sd.model), groupId: str(sd.group_id), unitId: str(sd.unit_id),
     startedAt: f.run.started?.ts ?? evs[0]?.ts ?? null, endedAt: f.run.completed?.ts ?? null,
     verdict: f.run.verdict,
     prUrl: str(done.pr_url) ?? str(pr?.url), prDraft: typeof pr?.draft === "boolean" ? Number(pr.draft) : null,
@@ -38,7 +39,7 @@ export function rebuildRun(db: Db, sourceId: string, runId: string): void {
 
 const parseRun = (r: typeof runs.$inferSelect) => ({
   source_id: r.sourceId, run_id: r.runId, origin_repo: r.originRepo, issue_ref: r.issueRef, task_source: r.taskSource,
-  provider: r.provider, model: r.model, started_at: r.startedAt, ended_at: r.endedAt, verdict: r.verdict,
+  group_id: r.groupId, unit_id: r.unitId, provider: r.provider, model: r.model, started_at: r.startedAt, ended_at: r.endedAt, verdict: r.verdict,
   pr_url: r.prUrl, pr_draft: r.prDraft === null ? null : r.prDraft === 1,
   cost_usd: r.costUsd, partial_usd: r.partialUsd, measured_sessions: r.measuredSessions, total_sessions: r.totalSessions,
   input_tokens: r.inputTokens, output_tokens: r.outputTokens, wall_s: r.wallS, last_seq: r.lastSeq,
@@ -74,7 +75,7 @@ const elapsedS = (r: typeof runs.$inferSelect): number | null => {
   return Math.max(0, (end - Date.parse(r.startedAt)) / 1000);
 };
 
-export interface ListQuery { verdict?: string; repo?: string; since?: string; until?: string; limit?: number; cursor?: string }
+export interface ListQuery { verdict?: string; repo?: string; since?: string; until?: string; group_id?: string; limit?: number; cursor?: string }
 
 export function listRuns(db: Db, q: ListQuery) {
   const limit = Math.min(Math.max(q.limit ?? 50, 1), 200);
@@ -82,6 +83,7 @@ export function listRuns(db: Db, q: ListQuery) {
   const where = and(
     q.verdict ? eq(runs.verdict, q.verdict) : undefined,
     q.repo ? eq(runs.originRepo, q.repo) : undefined,
+    q.group_id ? eq(runs.groupId, q.group_id) : undefined,
     q.since ? gte(runs.startedAt, q.since) : undefined,
     q.until ? lt(runs.startedAt, q.until) : undefined,
   );
@@ -108,6 +110,7 @@ export function runDetail(db: Db, sourceId: string, runId: string) {
   const sealed = evs.find((e) => e.type === "receipt.sealed")?.data;
   return {
     ...withLive(db, r),
+    blocked_question: blockedQuestion(evs, r.verdict),
     stages,
     stages_completed: f.completed,
     receipt: sealed ? { sha256: str(sealed.receipt_sha256), signed: sealed.signed === true, verdict: str(sealed.verdict), path: str(sealed.path) } : null,

package/packages/control-plane/src/server/serve.ts

@@ -1,10 +1,20 @@
 // Entry for `loki control serve` (bundled to dist/server.js). Config comes from env: PORT, LOKI_CONTROL_DB.
-// Binds loopback only. LOKI_CONTROL_PORT_FALLBACK=1 (set for the default port, never for an explicit --port)
+// Binds loopback unless LOKI_CONTROL_HOST is set (the container image sets 0.0.0.0). LOKI_CONTROL_PORT_FALLBACK=1 (set for the default port, never for an explicit --port)
 // retries on any free port when PORT is taken; the URL printed below is always the real one.
 import { createApp } from "./app.ts";
+import { bindRefusal, insecureBindWarning, isLoopbackHost } from "./auth.ts";
 
-const { app } = createApp({ dbPath: process.env.LOKI_CONTROL_DB ?? "control.db" });
-const serve = (port: number) => Bun.serve({ port, hostname: "127.0.0.1", fetch: app.fetch });
+// A non-loopback bind needs LOKI_CONTROL_TOKEN (or LOKI_CONTROL_ALLOW_INSECURE_BIND=1). Refuse before opening the DB or binding.
+const refusal = bindRefusal(process.env);
+if (refusal) {
+  console.error(refusal);
+  process.exit(2);
+}
+const warning = insecureBindWarning(process.env);
+if (warning) console.error(warning);
+const bindHost = process.env.LOKI_CONTROL_HOST || "127.0.0.1";
+const { app } = createApp({ dbPath: process.env.LOKI_CONTROL_DB ?? "control.db", token: process.env.LOKI_CONTROL_TOKEN || undefined, loopbackOnly: isLoopbackHost(bindHost.includes(":") && !bindHost.startsWith("[") ? `[${bindHost}]` : bindHost) });
+const serve = (port: number) => Bun.serve({ port, hostname: process.env.LOKI_CONTROL_HOST || "127.0.0.1", fetch: app.fetch });
 let s: ReturnType<typeof serve>;
 try {
   s = serve(Number(process.env.PORT ?? 0));

package/packages/control-plane/src/shipper/discover.ts

@@ -0,0 +1,29 @@
+// C2 CP-DEFAULT: find a running local Control Plane (docs/v10/CONTROL-PLANE.md section 6). Reads
+// ~/.loki/control/instance.json; returns its url only when the pid is alive and /health answers service=loki-control
+// within 300 ms. Never starts a server, never throws. LOKI_CONTROL=0 disables discovery.
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export const instancePath = (env: NodeJS.ProcessEnv): string => join(env.HOME || homedir(), ".loki", "control", "instance.json");
+
+export interface DiscoverOpts { fetchImpl?: typeof fetch | undefined; alive?: ((pid: number) => boolean) | undefined }
+
+const isAlive = (pid: number): boolean => { try { process.kill(pid, 0); return true; } catch { return false; } };
+
+export function isLoopbackHttp(u: string): boolean {
+  try { const p = new URL(u); return p.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(p.hostname); } catch { return false; }
+}
+
+export async function discoverControlUrl(env: NodeJS.ProcessEnv, o: DiscoverOpts = {}): Promise<string | null> {
+  if (env.LOKI_CONTROL === "0") return null;
+  if (env.LOKI_CONTROL_URL) return env.LOKI_CONTROL_URL;
+  try {
+    const inst = JSON.parse(readFileSync(instancePath(env), "utf8")) as { pid?: unknown; url?: unknown };
+    if (!Number.isInteger(inst.pid) || typeof inst.url !== "string" || !(o.alive ?? isAlive)(inst.pid as number)) return null;
+    if (!isLoopbackHttp(inst.url)) return null; // a planted instance.json must never redirect events off this machine
+    const url = inst.url.replace(/\/+$/, "");
+    const h = (await (await (o.fetchImpl ?? fetch)(`${url}/health`, { signal: AbortSignal.timeout(300) })).json()) as { service?: string };
+    return h.service === "loki-control" ? url : null;
+  } catch { return null; }
+}

package/packages/control-plane/ui/dist/assets/{index-BH3LtKcG.css → index-CFfrqCx2.css}

@@ -1 +1 @@
-*,:before,:after{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }::backdrop{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }*,:before,:after{box-sizing:border-box;border-width:0;border-style:solid;border-color:#e5e7eb}:before,:after{--tw-content: ""}html,:host{line-height:1.5;-webkit-text-size-adjust:100%;-moz-tab-size:4;-o-tab-size:4;tab-size:4;font-family:ui-sans-serif,system-ui,sans-serif,"Apple Color Emoji","Segoe UI Emoji",Segoe UI Symbol,"Noto Color Emoji";font-feature-settings:normal;font-variation-settings:normal;-webkit-tap-highlight-color:transparent}body{margin:0;line-height:inherit}hr{height:0;color:inherit;border-top-width:1px}abbr:where([title]){-webkit-text-decoration:underline dotted;text-decoration:underline dotted}h1,h2,h3,h4,h5,h6{font-size:inherit;font-weight:inherit}a{color:inherit;text-decoration:inherit}b,strong{font-weight:bolder}code,kbd,samp,pre{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace;font-feature-settings:normal;font-variation-settings:normal;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}table{text-indent:0;border-color:inherit;border-collapse:collapse}button,input,optgroup,select,textarea{font-family:inherit;font-feature-settings:inherit;font-variation-settings:inherit;font-size:100%;font-weight:inherit;line-height:inherit;letter-spacing:inherit;color:inherit;margin:0;padding:0}button,select{text-transform:none}button,input:where([type=button]),input:where([type=reset]),input:where([type=submit]){-webkit-appearance:button;background-color:transparent;background-image:none}:-moz-focusring{outline:auto}:-moz-ui-invalid{box-shadow:none}progress{vertical-align:baseline}::-webkit-inner-spin-button,::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}summary{display:list-item}blockquote,dl,dd,h1,h2,h3,h4,h5,h6,hr,figure,p,pre{margin:0}fieldset{margin:0;padding:0}legend{padding:0}ol,ul,menu{list-style:none;margin:0;padding:0}dialog{padding:0}textarea{resize:vertical}input::-moz-placeholder,textarea::-moz-placeholder{opacity:1;color:#9ca3af}input::placeholder,textarea::placeholder{opacity:1;color:#9ca3af}button,[role=button]{cursor:pointer}:disabled{cursor:default}img,svg,video,canvas,audio,iframe,embed,object{display:block;vertical-align:middle}img,video{max-width:100%;height:auto}[hidden]:where(:not([hidden=until-found])){display:none}.mx-auto{margin-left:auto;margin-right:auto}.mb-2{margin-bottom:.5rem}.mb-4{margin-bottom:1rem}.mb-6{margin-bottom:1.5rem}.ml-1{margin-left:.25rem}.ml-2{margin-left:.5rem}.mt-2{margin-top:.5rem}.mt-3{margin-top:.75rem}.mt-6{margin-top:1.5rem}.inline-block{display:inline-block}.flex{display:flex}.inline-flex{display:inline-flex}.table{display:table}.grid{display:grid}.min-h-screen{min-height:100vh}.w-48{width:12rem}.w-full{width:100%}.max-w-xl{max-width:36rem}.flex-1{flex:1 1 0%}.shrink-0{flex-shrink:0}.list-disc{list-style-type:disc}.grid-cols-\[auto_1fr\]{grid-template-columns:auto 1fr}.flex-col{flex-direction:column}.flex-wrap{flex-wrap:wrap}.items-end{align-items:flex-end}.items-center{align-items:center}.justify-between{justify-content:space-between}.gap-1{gap:.25rem}.gap-2{gap:.5rem}.gap-3{gap:.75rem}.gap-4{gap:1rem}.gap-x-4{-moz-column-gap:1rem;column-gap:1rem}.gap-y-1{row-gap:.25rem}.space-y-1>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.25rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.25rem * var(--tw-space-y-reverse))}.space-y-2>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.5rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.5rem * var(--tw-space-y-reverse))}.space-y-3>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.75rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.75rem * var(--tw-space-y-reverse))}.space-y-4>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(1rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(1rem * var(--tw-space-y-reverse))}.overflow-x-auto{overflow-x:auto}.break-all{word-break:break-all}.rounded{border-radius:.25rem}.border{border-width:1px}.border-r{border-right-width:1px}.border-t{border-top-width:1px}.border-dashed{border-style:dashed}.border-slate-200{--tw-border-opacity: 1;border-color:rgb(226 232 240 / var(--tw-border-opacity, 1))}.border-slate-300{--tw-border-opacity: 1;border-color:rgb(203 213 225 / var(--tw-border-opacity, 1))}.bg-amber-500\/15{background-color:#f59e0b26}.bg-emerald-500\/15{background-color:#10b98126}.bg-red-500\/15{background-color:#ef444426}.bg-slate-100{--tw-bg-opacity: 1;background-color:rgb(241 245 249 / var(--tw-bg-opacity, 1))}.bg-slate-200{--tw-bg-opacity: 1;background-color:rgb(226 232 240 / var(--tw-bg-opacity, 1))}.bg-slate-500\/15{background-color:#64748b26}.bg-violet-500\/15{background-color:#8b5cf626}.bg-white{--tw-bg-opacity: 1;background-color:rgb(255 255 255 / var(--tw-bg-opacity, 1))}.p-2{padding:.5rem}.p-4{padding:1rem}.p-6{padding:1.5rem}.p-8{padding:2rem}.px-1{padding-left:.25rem;padding-right:.25rem}.px-2{padding-left:.5rem;padding-right:.5rem}.py-0\.5{padding-top:.125rem;padding-bottom:.125rem}.py-1{padding-top:.25rem;padding-bottom:.25rem}.pl-5{padding-left:1.25rem}.text-left{text-align:left}.text-center{text-align:center}.font-mono{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace}.text-lg{font-size:1.125rem;line-height:1.75rem}.text-sm{font-size:.875rem;line-height:1.25rem}.text-xl{font-size:1.25rem;line-height:1.75rem}.text-xs{font-size:.75rem;line-height:1rem}.font-medium{font-weight:500}.font-semibold{font-weight:600}.uppercase{text-transform:uppercase}.text-amber-600{--tw-text-opacity: 1;color:rgb(217 119 6 / var(--tw-text-opacity, 1))}.text-amber-700{--tw-text-opacity: 1;color:rgb(180 83 9 / var(--tw-text-opacity, 1))}.text-emerald-700{--tw-text-opacity: 1;color:rgb(4 120 87 / var(--tw-text-opacity, 1))}.text-red-600{--tw-text-opacity: 1;color:rgb(220 38 38 / var(--tw-text-opacity, 1))}.text-red-700{--tw-text-opacity: 1;color:rgb(185 28 28 / var(--tw-text-opacity, 1))}.text-sky-600{--tw-text-opacity: 1;color:rgb(2 132 199 / var(--tw-text-opacity, 1))}.text-slate-500{--tw-text-opacity: 1;color:rgb(100 116 139 / var(--tw-text-opacity, 1))}.text-slate-600{--tw-text-opacity: 1;color:rgb(71 85 105 / var(--tw-text-opacity, 1))}.text-slate-900{--tw-text-opacity: 1;color:rgb(15 23 42 / var(--tw-text-opacity, 1))}.text-violet-700{--tw-text-opacity: 1;color:rgb(109 40 217 / var(--tw-text-opacity, 1))}.ring-1{--tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow, 0 0 #0000)}.ring-amber-500\/30{--tw-ring-color: rgb(245 158 11 / .3)}.ring-emerald-500\/30{--tw-ring-color: rgb(16 185 129 / .3)}.ring-red-500\/30{--tw-ring-color: rgb(239 68 68 / .3)}.ring-slate-500\/30{--tw-ring-color: rgb(100 116 139 / .3)}.ring-violet-500\/30{--tw-ring-color: rgb(139 92 246 / .3)}.hover\:underline:hover{text-decoration-line:underline}.dark\:border-slate-700:is(.dark *){--tw-border-opacity: 1;border-color:rgb(51 65 85 / var(--tw-border-opacity, 1))}.dark\:border-slate-800:is(.dark *){--tw-border-opacity: 1;border-color:rgb(30 41 59 / var(--tw-border-opacity, 1))}.dark\:bg-slate-800:is(.dark *){--tw-bg-opacity: 1;background-color:rgb(30 41 59 / var(--tw-bg-opacity, 1))}.dark\:bg-slate-900:is(.dark *){--tw-bg-opacity: 1;background-color:rgb(15 23 42 / var(--tw-bg-opacity, 1))}.dark\:bg-slate-950:is(.dark *){--tw-bg-opacity: 1;background-color:rgb(2 6 23 / var(--tw-bg-opacity, 1))}.dark\:text-amber-300:is(.dark *){--tw-text-opacity: 1;color:rgb(252 211 77 / var(--tw-text-opacity, 1))}.dark\:text-emerald-300:is(.dark *){--tw-text-opacity: 1;color:rgb(110 231 183 / var(--tw-text-opacity, 1))}.dark\:text-red-300:is(.dark *){--tw-text-opacity: 1;color:rgb(252 165 165 / var(--tw-text-opacity, 1))}.dark\:text-sky-400:is(.dark *){--tw-text-opacity: 1;color:rgb(56 189 248 / var(--tw-text-opacity, 1))}.dark\:text-slate-100:is(.dark *){--tw-text-opacity: 1;color:rgb(241 245 249 / var(--tw-text-opacity, 1))}.dark\:text-slate-300:is(.dark *){--tw-text-opacity: 1;color:rgb(203 213 225 / var(--tw-text-opacity, 1))}.dark\:text-slate-400:is(.dark *){--tw-text-opacity: 1;color:rgb(148 163 184 / var(--tw-text-opacity, 1))}.dark\:text-violet-300:is(.dark *){--tw-text-opacity: 1;color:rgb(196 181 253 / var(--tw-text-opacity, 1))}@media(min-width:768px){.md\:grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}}
+*,:before,:after{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }::backdrop{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }*,:before,:after{box-sizing:border-box;border-width:0;border-style:solid;border-color:#e5e7eb}:before,:after{--tw-content: ""}html,:host{line-height:1.5;-webkit-text-size-adjust:100%;-moz-tab-size:4;-o-tab-size:4;tab-size:4;font-family:ui-sans-serif,system-ui,sans-serif,"Apple Color Emoji","Segoe UI Emoji",Segoe UI Symbol,"Noto Color Emoji";font-feature-settings:normal;font-variation-settings:normal;-webkit-tap-highlight-color:transparent}body{margin:0;line-height:inherit}hr{height:0;color:inherit;border-top-width:1px}abbr:where([title]){-webkit-text-decoration:underline dotted;text-decoration:underline dotted}h1,h2,h3,h4,h5,h6{font-size:inherit;font-weight:inherit}a{color:inherit;text-decoration:inherit}b,strong{font-weight:bolder}code,kbd,samp,pre{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace;font-feature-settings:normal;font-variation-settings:normal;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}table{text-indent:0;border-color:inherit;border-collapse:collapse}button,input,optgroup,select,textarea{font-family:inherit;font-feature-settings:inherit;font-variation-settings:inherit;font-size:100%;font-weight:inherit;line-height:inherit;letter-spacing:inherit;color:inherit;margin:0;padding:0}button,select{text-transform:none}button,input:where([type=button]),input:where([type=reset]),input:where([type=submit]){-webkit-appearance:button;background-color:transparent;background-image:none}:-moz-focusring{outline:auto}:-moz-ui-invalid{box-shadow:none}progress{vertical-align:baseline}::-webkit-inner-spin-button,::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}summary{display:list-item}blockquote,dl,dd,h1,h2,h3,h4,h5,h6,hr,figure,p,pre{margin:0}fieldset{margin:0;padding:0}legend{padding:0}ol,ul,menu{list-style:none;margin:0;padding:0}dialog{padding:0}textarea{resize:vertical}input::-moz-placeholder,textarea::-moz-placeholder{opacity:1;color:#9ca3af}input::placeholder,textarea::placeholder{opacity:1;color:#9ca3af}button,[role=button]{cursor:pointer}:disabled{cursor:default}img,svg,video,canvas,audio,iframe,embed,object{display:block;vertical-align:middle}img,video{max-width:100%;height:auto}[hidden]:where(:not([hidden=until-found])){display:none}.mx-auto{margin-left:auto;margin-right:auto}.mb-2{margin-bottom:.5rem}.mb-4{margin-bottom:1rem}.mb-6{margin-bottom:1.5rem}.ml-1{margin-left:.25rem}.ml-2{margin-left:.5rem}.mt-2{margin-top:.5rem}.mt-3{margin-top:.75rem}.mt-6{margin-top:1.5rem}.inline-block{display:inline-block}.flex{display:flex}.inline-flex{display:inline-flex}.table{display:table}.grid{display:grid}.min-h-screen{min-height:100vh}.w-48{width:12rem}.w-full{width:100%}.max-w-xl{max-width:36rem}.flex-1{flex:1 1 0%}.shrink-0{flex-shrink:0}.list-disc{list-style-type:disc}.grid-cols-\[auto_1fr\]{grid-template-columns:auto 1fr}.flex-col{flex-direction:column}.flex-wrap{flex-wrap:wrap}.items-end{align-items:flex-end}.items-center{align-items:center}.justify-between{justify-content:space-between}.gap-1{gap:.25rem}.gap-2{gap:.5rem}.gap-3{gap:.75rem}.gap-4{gap:1rem}.gap-x-4{-moz-column-gap:1rem;column-gap:1rem}.gap-y-1{row-gap:.25rem}.space-y-1>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.25rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.25rem * var(--tw-space-y-reverse))}.space-y-2>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.5rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.5rem * var(--tw-space-y-reverse))}.space-y-3>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(.75rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(.75rem * var(--tw-space-y-reverse))}.space-y-4>:not([hidden])~:not([hidden]){--tw-space-y-reverse: 0;margin-top:calc(1rem * calc(1 - var(--tw-space-y-reverse)));margin-bottom:calc(1rem * var(--tw-space-y-reverse))}.overflow-x-auto{overflow-x:auto}.break-all{word-break:break-all}.rounded{border-radius:.25rem}.border{border-width:1px}.border-r{border-right-width:1px}.border-t{border-top-width:1px}.border-dashed{border-style:dashed}.border-slate-200{--tw-border-opacity: 1;border-color:rgb(226 232 240 / var(--tw-border-opacity, 1))}.border-slate-300{--tw-border-opacity: 1;border-color:rgb(203 213 225 / var(--tw-border-opacity, 1))}.bg-amber-500\/15{background-color:#f59e0b26}.bg-emerald-500\/15{background-color:#10b98126}.bg-red-500\/15{background-color:#ef444426}.bg-sky-600{--tw-bg-opacity: 1;background-color:rgb(2 132 199 / var(--tw-bg-opacity, 1))}.bg-slate-100{--tw-bg-opacity: 1;background-color:rgb(241 245 249 / var(--tw-bg-opacity, 1))}.bg-slate-200{--tw-bg-opacity: 1;background-color:rgb(226 232 240 / var(--tw-bg-opacity, 1))}.bg-slate-500\/15{background-color:#64748b26}.bg-violet-500\/15{background-color:#8b5cf626}.bg-white{--tw-bg-opacity: 1;background-color:rgb(255 255 255 / var(--tw-bg-opacity, 1))}.p-2{padding:.5rem}.p-4{padding:1rem}.p-6{padding:1.5rem}.p-8{padding:2rem}.px-1{padding-left:.25rem;padding-right:.25rem}.px-2{padding-left:.5rem;padding-right:.5rem}.px-3{padding-left:.75rem;padding-right:.75rem}.py-0\.5{padding-top:.125rem;padding-bottom:.125rem}.py-1{padding-top:.25rem;padding-bottom:.25rem}.pl-5{padding-left:1.25rem}.text-left{text-align:left}.text-center{text-align:center}.font-mono{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace}.text-lg{font-size:1.125rem;line-height:1.75rem}.text-sm{font-size:.875rem;line-height:1.25rem}.text-xl{font-size:1.25rem;line-height:1.75rem}.text-xs{font-size:.75rem;line-height:1rem}.font-medium{font-weight:500}.font-semibold{font-weight:600}.uppercase{text-transform:uppercase}.text-amber-600{--tw-text-opacity: 1;color:rgb(217 119 6 / var(--tw-text-opacity, 1))}.text-amber-700{--tw-text-opacity: 1;color:rgb(180 83 9 / var(--tw-text-opacity, 1))}.text-emerald-600{--tw-text-opacity: 1;color:rgb(5 150 105 / var(--tw-text-opacity, 1))}.text-emerald-700{--tw-text-opacity: 1;color:rgb(4 120 87 / var(--tw-text-opacity, 1))}.text-red-600{--tw-text-opacity: 1;color:rgb(220 38 38 / var(--tw-text-opacity, 1))}.text-red-700{--tw-text-opacity: 1;color:rgb(185 28 28 / var(--tw-text-opacity, 1))}.text-sky-600{--tw-text-opacity: 1;color:rgb(2 132 199 / var(--tw-text-opacity, 1))}.text-slate-500{--tw-text-opacity: 1;color:rgb(100 116 139 / var(--tw-text-opacity, 1))}.text-slate-600{--tw-text-opacity: 1;color:rgb(71 85 105 / var(--tw-text-opacity, 1))}.text-slate-900{--tw-text-opacity: 1;color:rgb(15 23 42 / var(--tw-text-opacity, 1))}.text-violet-700{--tw-text-opacity: 1;color:rgb(109 40 217 / var(--tw-text-opacity, 1))}.text-white{--tw-text-opacity: 1;color:rgb(255 255 255 / var(--tw-text-opacity, 1))}.ring-1{--tw-ring-offset-shadow: var(--tw-ring-inset) 0 0 0 var(--tw-ring-offset-width) var(--tw-ring-offset-color);--tw-ring-shadow: var(--tw-ring-inset) 0 0 0 calc(1px + var(--tw-ring-offset-width)) var(--tw-ring-color);box-shadow:var(--tw-ring-offset-shadow),var(--tw-ring-shadow),var(--tw-shadow, 0 0 #0000)}.ring-amber-500\/30{--tw-ring-color: rgb(245 158 11 / .3)}.ring-emerald-500\/30{--tw-ring-color: rgb(16 185 129 / .3)}.ring-red-500\/30{--tw-ring-color: rgb(239 68 68 / .3)}.ring-slate-500\/30{--tw-ring-color: rgb(100 116 139 / .3)}.ring-violet-500\/30{--tw-ring-color: rgb(139 92 246 / .3)}.hover\:underline:hover{text-decoration-line:underline}.disabled\:opacity-50:disabled{opacity:.5}.dark\:border-slate-700:is(.dark *){--tw-border-opacity: 1;border-color:rgb(51 65 85 / var(--tw-border-opacity, 1))}.dark\:border-slate-800:is(.dark *){--tw-border-opacity: 1;border-color:rgb(30 41 59 / var(--tw-border-opacity, 1))}.dark\:bg-slate-800:is(.dark *){--tw-bg-opacity: 1;background-color:rgb(30 41 59 / var(--tw-bg-opacity, 1))}.dark\:bg-slate-900:is(.dark *){--tw-bg-opacity: 1;background-color:rgb(15 23 42 / var(--tw-bg-opacity, 1))}.dark\:bg-slate-950:is(.dark *){--tw-bg-opacity: 1;background-color:rgb(2 6 23 / var(--tw-bg-opacity, 1))}.dark\:text-amber-300:is(.dark *){--tw-text-opacity: 1;color:rgb(252 211 77 / var(--tw-text-opacity, 1))}.dark\:text-emerald-300:is(.dark *){--tw-text-opacity: 1;color:rgb(110 231 183 / var(--tw-text-opacity, 1))}.dark\:text-red-300:is(.dark *){--tw-text-opacity: 1;color:rgb(252 165 165 / var(--tw-text-opacity, 1))}.dark\:text-sky-400:is(.dark *){--tw-text-opacity: 1;color:rgb(56 189 248 / var(--tw-text-opacity, 1))}.dark\:text-slate-100:is(.dark *){--tw-text-opacity: 1;color:rgb(241 245 249 / var(--tw-text-opacity, 1))}.dark\:text-slate-300:is(.dark *){--tw-text-opacity: 1;color:rgb(203 213 225 / var(--tw-text-opacity, 1))}.dark\:text-slate-400:is(.dark *){--tw-text-opacity: 1;color:rgb(148 163 184 / var(--tw-text-opacity, 1))}.dark\:text-violet-300:is(.dark *){--tw-text-opacity: 1;color:rgb(196 181 253 / var(--tw-text-opacity, 1))}@media(min-width:768px){.md\:grid-cols-2{grid-template-columns:repeat(2,minmax(0,1fr))}}