loki-mode 10.6.8 → 10.6.9

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '10.6.8'
+__version__ = '10.6.9'

package/mcp/tests/test_v10_tools.py

@@ -61,7 +61,63 @@ class RunTests(unittest.TestCase):
             self.assertTrue(r["log_path"].startswith(os.path.realpath(repo)))
 
 
+class EnvTests(unittest.TestCase):
+    def test_env_forces_headless_and_drops_secrets(self):
+        secrets = {"LOKI_CONTROL_TOKEN": "t", "SLACK_BOT_TOKEN": "xoxb-1", "SLACK_SIGNING_SECRET": "s",
+                   "SLACK_WEBHOOK_URL": "https://hooks.slack.com/x", "LOKI_NO_BROWSER": "0"}
+        with mock.patch.dict(os.environ, secrets):
+            env = v10_tools._env()
+        self.assertEqual(env["LOKI_NO_BROWSER"], "1")
+        self.assertEqual(env["LOKI_ENGINE"], "v10")
+        for k in ("LOKI_CONTROL_TOKEN", "SLACK_BOT_TOKEN", "SLACK_SIGNING_SECRET", "SLACK_WEBHOOK_URL"):
+            self.assertNotIn(k, env)
+
+    def test_run_child_env_has_no_secrets(self):
+        with tempfile.TemporaryDirectory() as repo, \
+                mock.patch.dict(os.environ, {"SLACK_BOT_TOKEN": "xoxb-1"}), \
+                mock.patch.object(v10_tools, "V10_RUN_ID_WAIT_S", 0), \
+                mock.patch("subprocess.Popen") as popen:
+            popen.return_value.pid = 1
+            v10_tools.v10_run("fix it", repo, _ok)
+            self.assertNotIn("SLACK_BOT_TOKEN", popen.call_args[1]["env"])
+
+
+class RefPassThroughTests(unittest.TestCase):
+    def test_jira_and_linear_refs_pass_through(self):
+        for ref in ("jira:PROJ-123", "linear:ENG-45"):
+            with tempfile.TemporaryDirectory() as repo, \
+                    mock.patch.object(v10_tools, "V10_RUN_ID_WAIT_S", 0), \
+                    mock.patch("subprocess.Popen") as popen:
+                popen.return_value.pid = 7
+                r = v10_tools.v10_run(ref, repo, _ok)
+                self.assertNotIn("error", r)
+                self.assertEqual(popen.call_args[0][0][1], ref)
+
+    def test_leading_dash_still_rejected(self):
+        with mock.patch("subprocess.Popen") as popen:
+            self.assertIn("error", v10_tools.v10_run("-jira:X", "/x", _ok))
+            popen.assert_not_called()
+
+
 class StatusTests(unittest.TestCase):
+    def test_blocked_returns_question(self):
+        ev = [
+            {"seq": 0, "type": "stage.completed", "stage": "implement",
+             "data": {"spec_conflict_reason": "spec says A\nbut tests say B"}},
+            {"seq": 1, "type": "run.completed", "stage": None, "data": {"verdict": "BLOCKED"}},
+        ]
+        with tempfile.TemporaryDirectory() as repo:
+            _write_events(repo, "e10-blk", ev)
+            r = v10_tools.v10_status("e10-blk", repo, _ok)
+        self.assertEqual(r["verdict"], "BLOCKED")
+        self.assertEqual(r["blocked_question"], "spec says A but tests say B")
+
+    def test_verified_has_no_blocked_question(self):
+        ev = [{"seq": 0, "type": "run.completed", "stage": None, "data": {"verdict": "VERIFIED"}}]
+        with tempfile.TemporaryDirectory() as repo:
+            _write_events(repo, "e10-ok", ev)
+            self.assertNotIn("blocked_question", v10_tools.v10_status("e10-ok", repo, _ok))
+
     def test_done_run(self):
         ev = [
             {"seq": 0, "type": "run.started", "stage": None, "data": {}},

package/mcp/v10_tools.py

@@ -8,6 +8,7 @@ validator before use.
 
 import json
 import os
+import re
 import subprocess
 import time
 from pathlib import Path
@@ -20,10 +21,13 @@ V10_VERIFY_TIMEOUT_S = 120
 _TERMINAL = {"stage.completed", "stage.failed", "stage.skipped"}
 
 
+_DROPPED_ENV = ("LOKI_CONTROL_TOKEN", "SLACK_BOT_TOKEN", "SLACK_SIGNING_SECRET", "SLACK_WEBHOOK_URL")
+
+
 def _env() -> Dict[str, str]:
-    env = dict(os.environ)
+    env = {k: v for k, v in os.environ.items() if k not in _DROPPED_ENV}
     env["LOKI_ENGINE"] = "v10"
-    env["LOKI_NO_BROWSER"] = env.get("LOKI_NO_BROWSER", "1")
+    env["LOKI_NO_BROWSER"] = "1"
     return env
 
 
@@ -110,6 +114,7 @@ def v10_status(run_id: str, repo_path: str, validate: Callable[[str], str]) -> d
     events = _read_events(events_path)
     open_stages: Dict[str, bool] = {}
     verdict = None
+    question = None
     done = False
     usd = 0.0
     saw_cost = False
@@ -122,6 +127,8 @@ def v10_status(run_id: str, repo_path: str, validate: Callable[[str], str]) -> d
                 open_stages[stage] = True
             elif t in _TERMINAL:
                 open_stages.pop(stage, None)
+        if t == "stage.completed" and stage == "implement" and isinstance(data.get("spec_conflict_reason"), str):
+            question = re.sub(r"[\x00-\x1f\x7f]+", " ", data["spec_conflict_reason"])[:500]
         if t == "run.completed":
             done = True
             verdict = data.get("verdict") if isinstance(data.get("verdict"), str) else None
@@ -132,7 +139,7 @@ def v10_status(run_id: str, repo_path: str, validate: Callable[[str], str]) -> d
             else:
                 unmeasured = True
     phase = "done" if done else ("+".join(sorted(open_stages)) or "starting")
-    return {
+    result = {
         "run_id": run_id,
         "phase": phase,
         "done": done,
@@ -140,6 +147,9 @@ def v10_status(run_id: str, repo_path: str, validate: Callable[[str], str]) -> d
         "cost_usd": usd if saw_cost and not unmeasured else None,
         "events": len(events),
     }
+    if verdict == "BLOCKED":
+        result["blocked_question"] = question or "see the receipt"
+    return result
 
 
 def v10_verify(receipt_path: str, repo_path: str, validate: Callable[[str], str]) -> dict:

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "10.6.8",
+  "version": "10.6.9",
   "description": "An autonomous software factory that knows what it is supposed to deliver, and proves it did.",
   "keywords": [
     "agent",

package/packages/control-plane/dist/server.js

@@ -5535,11 +5535,14 @@ var runs = sqliteTable("runs", {
   lastSeq: integer("last_seq").notNull(),
   lastEventAt: text("last_event_at"),
   tampered: integer("tampered").notNull(),
-  conflict: integer("conflict").notNull().default(0)
+  conflict: integer("conflict").notNull().default(0),
+  groupId: text("group_id"),
+  unitId: text("unit_id")
 }, (t) => [
   primaryKey({ columns: [t.sourceId, t.runId] }),
   index("runs_started").on(t.startedAt),
-  index("runs_verdict").on(t.verdict)
+  index("runs_verdict").on(t.verdict),
+  index("runs_group").on(t.groupId)
 ]);
 
 // src/db/migrate.ts
@@ -5581,6 +5584,11 @@ function validateEnvelope(x) {
     return "stage must be a string or null";
   if (!isObj(x.data))
     return "data must be an object";
+  for (const k of ["group_id", "unit_id"])
+    if (k in x.data && (typeof x.data[k] !== "string" || x.data[k] === ""))
+      return `${k} must be a non-empty string`;
+  if ("deps" in x.data && (!Array.isArray(x.data.deps) || x.data.deps.some((d) => typeof d !== "string")))
+    return "deps must be a string array";
   return null;
 }
 function fold(events2) {
@@ -5684,7 +5692,7 @@ function writeAnswer(dir, source, run, answer) {
   writeFileSync(path, `${answer.trim()}
 `, { mode: 384 });
   chmodSync(path, 384);
-  return { status: 200, body: { ok: true, path, resume: `loki "$(cat '${path}')"  # re-run the task with the answer, or paste it into the issue` } };
+  return { status: 200, body: { ok: true, path, resume: `loki answer ${run}` } };
 }
 
 // src/server/runs.ts
@@ -5709,6 +5717,8 @@ function rebuildRun(db, sourceId, runId) {
     taskSource: str(sd.task_source),
     provider: str(sd.provider),
     model: str(sd.model),
+    groupId: str(sd.group_id),
+    unitId: str(sd.unit_id),
     startedAt: f.run.started?.ts ?? evs[0]?.ts ?? null,
     endedAt: f.run.completed?.ts ?? null,
     verdict: f.run.verdict,
@@ -5733,6 +5743,8 @@ var parseRun = (r) => ({
   origin_repo: r.originRepo,
   issue_ref: r.issueRef,
   task_source: r.taskSource,
+  group_id: r.groupId,
+  unit_id: r.unitId,
   provider: r.provider,
   model: r.model,
   started_at: r.startedAt,
@@ -5792,7 +5804,7 @@ var elapsedS = (r) => {
 function listRuns(db, q) {
   const limit = Math.min(Math.max(q.limit ?? 50, 1), 200);
   const offset = Math.max(Number.parseInt(q.cursor ?? "0", 10) || 0, 0);
-  const where = and(q.verdict ? eq(runs.verdict, q.verdict) : undefined, q.repo ? eq(runs.originRepo, q.repo) : undefined, q.since ? gte(runs.startedAt, q.since) : undefined, q.until ? lt(runs.startedAt, q.until) : undefined);
+  const where = and(q.verdict ? eq(runs.verdict, q.verdict) : undefined, q.repo ? eq(runs.originRepo, q.repo) : undefined, q.group_id ? eq(runs.groupId, q.group_id) : undefined, q.since ? gte(runs.startedAt, q.since) : undefined, q.until ? lt(runs.startedAt, q.until) : undefined);
   const total = db.select({ n: sql`count(*)` }).from(runs).where(where).get()?.n ?? 0;
   const rows = db.select().from(runs).where(where).orderBy(desc(runs.startedAt), asc(runs.runId)).limit(limit).offset(offset).all();
   return { runs: rows.map((r) => withLive(db, r)), total, next_cursor: offset + rows.length < total ? String(offset + rows.length) : null };
@@ -5876,6 +5888,51 @@ function ingest(db, body) {
   return conflict > 0 ? { status: 409, body: { ...out, error: "conflicting content for an existing event id" } } : { status: 200, body: out };
 }
 
+// src/server/auth.ts
+import { createHash as createHash2, timingSafeEqual } from "crypto";
+var LOOPBACK_BINDS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+function isLoopbackHost(host) {
+  return !!host && /^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/i.test(host);
+}
+function tokenMatches(header, token) {
+  const m = /^Bearer (.+)$/i.exec(header ?? "");
+  if (!m)
+    return false;
+  const a = createHash2("sha256").update(m[1] ?? "").digest();
+  const b = createHash2("sha256").update(token).digest();
+  return timingSafeEqual(a, b);
+}
+function bindRefusal(env) {
+  const host = env.LOKI_CONTROL_HOST;
+  if (!host || LOOPBACK_BINDS.has(host.toLowerCase()))
+    return null;
+  if (env.LOKI_CONTROL_TOKEN || env.LOKI_CONTROL_ALLOW_INSECURE_BIND === "1")
+    return null;
+  return `loki-control: refusing to listen on ${host} without LOKI_CONTROL_TOKEN. Set LOKI_CONTROL_TOKEN, or LOKI_CONTROL_ALLOW_INSECURE_BIND=1 to accept an unauthenticated non-loopback bind.`;
+}
+function insecureBindWarning(env) {
+  const host = env.LOKI_CONTROL_HOST;
+  if (!host || LOOPBACK_BINDS.has(host.toLowerCase()))
+    return null;
+  if (env.LOKI_CONTROL_TOKEN || env.LOKI_CONTROL_ALLOW_INSECURE_BIND !== "1")
+    return null;
+  return `loki-control: WARNING listening on ${host} with no LOKI_CONTROL_TOKEN (LOKI_CONTROL_ALLOW_INSECURE_BIND=1). Anyone who can reach this port can read and write runs.`;
+}
+function hostGuard() {
+  return async (c, next) => {
+    if (!isLoopbackHost(c.req.header("host")))
+      return c.json({ error: "host not allowed" }, 403);
+    await next();
+  };
+}
+function tokenGuard(token) {
+  return async (c, next) => {
+    if (!tokenMatches(c.req.header("authorization"), token))
+      return c.json({ error: "unauthorized" }, 401, { "www-authenticate": "Bearer" });
+    await next();
+  };
+}
+
 // src/server/app.ts
 var MAX_BODY = 1e6;
 var defaultUiDir = () => [join3(import.meta.dir, "../../ui/dist"), join3(import.meta.dir, "../ui/dist")].find((d) => existsSync2(join3(d, "index.html")));
@@ -5885,6 +5942,10 @@ function createApp(opts) {
   let ready = true;
   const answerDir = opts.answerDir ?? defaultAnswerDir();
   const app = new Hono3;
+  if (opts.loopbackOnly)
+    app.use("*", hostGuard());
+  if (opts.token)
+    app.use("/v1/*", tokenGuard(opts.token));
   app.get("/health", (c) => c.json({ service: "loki-control", pid: process.pid, install_path: import.meta.dir }));
   app.get("/ready", (c) => {
     try {
@@ -5909,7 +5970,7 @@ function createApp(opts) {
   });
   app.get("/v1/runs", (c) => {
     const q = c.req.query();
-    return c.json(listRuns(db, { verdict: q.verdict, repo: q.repo, since: q.since, until: q.until, limit: q.limit ? Number(q.limit) : undefined, cursor: q.cursor }));
+    return c.json(listRuns(db, { verdict: q.verdict, repo: q.repo, since: q.since, until: q.until, group_id: q.group_id, limit: q.limit ? Number(q.limit) : undefined, cursor: q.cursor }));
   });
   const detail = (c, source, run) => {
     const d = runDetail(db, source, run);
@@ -5958,7 +6019,16 @@ function createApp(opts) {
 }
 
 // src/server/serve.ts
-var { app } = createApp({ dbPath: process.env.LOKI_CONTROL_DB ?? "control.db" });
+var refusal = bindRefusal(process.env);
+if (refusal) {
+  console.error(refusal);
+  process.exit(2);
+}
+var warning = insecureBindWarning(process.env);
+if (warning)
+  console.error(warning);
+var bindHost = process.env.LOKI_CONTROL_HOST || "127.0.0.1";
+var { app } = createApp({ dbPath: process.env.LOKI_CONTROL_DB ?? "control.db", token: process.env.LOKI_CONTROL_TOKEN || undefined, loopbackOnly: isLoopbackHost(bindHost.includes(":") && !bindHost.startsWith("[") ? `[${bindHost}]` : bindHost) });
 var serve = (port) => Bun.serve({ port, hostname: process.env.LOKI_CONTROL_HOST || "127.0.0.1", fetch: app.fetch });
 var s;
 try {

package/packages/control-plane/drizzle/0001_group_id.sql

@@ -0,0 +1,3 @@
+ALTER TABLE `runs` ADD `group_id` text;--> statement-breakpoint
+ALTER TABLE `runs` ADD `unit_id` text;--> statement-breakpoint
+CREATE INDEX `runs_group` ON `runs` (`group_id`);

package/packages/control-plane/drizzle/meta/_journal.json

@@ -8,6 +8,13 @@
       "when": 1790870373167,
       "tag": "0000_new_maelstrom",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "6",
+      "when": 1790956800000,
+      "tag": "0001_group_id",
+      "breakpoints": true
     }
   ]
-}
+}

package/packages/control-plane/src/db/schema.ts

@@ -47,8 +47,11 @@ export const runs = sqliteTable("runs", {
   lastEventAt: text("last_event_at"),
   tampered: integer("tampered").notNull(),
   conflict: integer("conflict").notNull().default(0),
+  groupId: text("group_id"),
+  unitId: text("unit_id"),
 }, (t) => [
   primaryKey({ columns: [t.sourceId, t.runId] }),
   index("runs_started").on(t.startedAt),
   index("runs_verdict").on(t.verdict),
+  index("runs_group").on(t.groupId),
 ]);

package/packages/control-plane/src/server/answer.ts

@@ -29,5 +29,5 @@ export function writeAnswer(dir: string, source: string, run: string, answer: un
   const path = join(d, `${run}.answer.txt`);
   writeFileSync(path, `${answer.trim()}\n`, { mode: 0o600 });
   chmodSync(path, 0o600);
-  return { status: 200, body: { ok: true, path, resume: `loki "$(cat '${path}')"  # re-run the task with the answer, or paste it into the issue` } };
+  return { status: 200, body: { ok: true, path, resume: `loki answer ${run}` } };
 }

package/packages/control-plane/src/server/app.ts

@@ -5,6 +5,7 @@ import { openDb } from "../db/migrate.ts";
 import { ingest } from "./ingest.ts";
 import { defaultAnswerDir, writeAnswer } from "./answer.ts";
 import { listRuns, runDetail } from "./runs.ts";
+import { hostGuard, tokenGuard } from "./auth.ts";
 
 const MAX_BODY = 1_000_000;
 
@@ -12,12 +13,15 @@ const MAX_BODY = 1_000_000;
 const defaultUiDir = () => [join(import.meta.dir, "../../ui/dist"), join(import.meta.dir, "../ui/dist")].find((d) => existsSync(join(d, "index.html")));
 
 /** dbPath ":memory:" for tests. Migrations run here, so /ready is true as soon as this returns. uiDir overrides the built-UI location. */
-export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: string }) {
+export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: string; token?: string; loopbackOnly?: boolean }) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
   let ready = true;
   const answerDir = opts.answerDir ?? defaultAnswerDir();
   const app = new Hono();
+  // token: bearer required on /v1/*. loopbackOnly: reject a non-loopback Host (DNS rebinding). Both off by default; serve.ts sets them from env.
+  if (opts.loopbackOnly) app.use("*", hostGuard());
+  if (opts.token) app.use("/v1/*", tokenGuard(opts.token));
 
   app.get("/health", (c) => c.json({ service: "loki-control", pid: process.pid, install_path: import.meta.dir }));
   app.get("/ready", (c) => {
@@ -36,7 +40,7 @@ export function createApp(opts: { dbPath: string; uiDir?: string; answerDir?: st
 
   app.get("/v1/runs", (c) => {
     const q = c.req.query();
-    return c.json(listRuns(db, { verdict: q.verdict, repo: q.repo, since: q.since, until: q.until, limit: q.limit ? Number(q.limit) : undefined, cursor: q.cursor }));
+    return c.json(listRuns(db, { verdict: q.verdict, repo: q.repo, since: q.since, until: q.until, group_id: q.group_id, limit: q.limit ? Number(q.limit) : undefined, cursor: q.cursor }));
   });
   const detail = (c: { json: (b: unknown, s?: 404) => Response }, source: string, run: string) => {
     const d = runDetail(db, source, run);

package/packages/control-plane/src/server/auth.ts

@@ -0,0 +1,51 @@
+// Control Plane auth: bearer token on /v1, Host allowlist on loopback (DNS rebinding), bind refusal without a token.
+import { createHash, timingSafeEqual } from "node:crypto";
+import type { MiddlewareHandler } from "hono";
+
+const LOOPBACK_BINDS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+
+/** True when a Host header value (optional port) names this machine's loopback. Strict: nothing may follow the name or port. */
+export function isLoopbackHost(host: string | undefined | null): boolean {
+  return !!host && /^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/i.test(host);
+}
+
+/** Constant-time check of an Authorization header against the token. Hashing first makes the compare length-safe. */
+export function tokenMatches(header: string | undefined | null, token: string): boolean {
+  const m = /^Bearer (.+)$/i.exec(header ?? "");
+  if (!m) return false;
+  const a = createHash("sha256").update(m[1] ?? "").digest();
+  const b = createHash("sha256").update(token).digest();
+  return timingSafeEqual(a, b);
+}
+
+/** Message to print before exiting 2 when the env asks for a non-loopback bind with no token, else null. */
+export function bindRefusal(env: Record<string, string | undefined>): string | null {
+  const host = env.LOKI_CONTROL_HOST;
+  if (!host || LOOPBACK_BINDS.has(host.toLowerCase())) return null;
+  if (env.LOKI_CONTROL_TOKEN || env.LOKI_CONTROL_ALLOW_INSECURE_BIND === "1") return null;
+  return `loki-control: refusing to listen on ${host} without LOKI_CONTROL_TOKEN. Set LOKI_CONTROL_TOKEN, or LOKI_CONTROL_ALLOW_INSECURE_BIND=1 to accept an unauthenticated non-loopback bind.`;
+}
+
+/** Stderr warning when ALLOW_INSECURE_BIND is what permits a non-loopback bind with no token, else null. Never includes a token. */
+export function insecureBindWarning(env: Record<string, string | undefined>): string | null {
+  const host = env.LOKI_CONTROL_HOST;
+  if (!host || LOOPBACK_BINDS.has(host.toLowerCase())) return null;
+  if (env.LOKI_CONTROL_TOKEN || env.LOKI_CONTROL_ALLOW_INSECURE_BIND !== "1") return null;
+  return `loki-control: WARNING listening on ${host} with no LOKI_CONTROL_TOKEN (LOKI_CONTROL_ALLOW_INSECURE_BIND=1). Anyone who can reach this port can read and write runs.`;
+}
+
+/** Host allowlist guard (apply on "*"; /health and /ready still need the Host check on loopback). */
+export function hostGuard(): MiddlewareHandler {
+  return async (c, next) => {
+    if (!isLoopbackHost(c.req.header("host"))) return c.json({ error: "host not allowed" }, 403);
+    await next();
+  };
+}
+
+/** Bearer guard. Register it with app.use("/v1/*", ...) so Hono's decoded route matching decides coverage, never the raw URL. */
+export function tokenGuard(token: string): MiddlewareHandler {
+  return async (c, next) => {
+    if (!tokenMatches(c.req.header("authorization"), token)) return c.json({ error: "unauthorized" }, 401, { "www-authenticate": "Bearer" });
+    await next();
+  };
+}

package/packages/control-plane/src/server/runs.ts

@@ -24,7 +24,7 @@ export function rebuildRun(db: Db, sourceId: string, runId: string): void {
   const row = {
     sourceId, runId,
     originRepo: str(sd.origin_repo), issueRef: str(sd.issue_ref), taskSource: str(sd.task_source),
-    provider: str(sd.provider), model: str(sd.model),
+    provider: str(sd.provider), model: str(sd.model), groupId: str(sd.group_id), unitId: str(sd.unit_id),
     startedAt: f.run.started?.ts ?? evs[0]?.ts ?? null, endedAt: f.run.completed?.ts ?? null,
     verdict: f.run.verdict,
     prUrl: str(done.pr_url) ?? str(pr?.url), prDraft: typeof pr?.draft === "boolean" ? Number(pr.draft) : null,
@@ -39,7 +39,7 @@ export function rebuildRun(db: Db, sourceId: string, runId: string): void {
 
 const parseRun = (r: typeof runs.$inferSelect) => ({
   source_id: r.sourceId, run_id: r.runId, origin_repo: r.originRepo, issue_ref: r.issueRef, task_source: r.taskSource,
-  provider: r.provider, model: r.model, started_at: r.startedAt, ended_at: r.endedAt, verdict: r.verdict,
+  group_id: r.groupId, unit_id: r.unitId, provider: r.provider, model: r.model, started_at: r.startedAt, ended_at: r.endedAt, verdict: r.verdict,
   pr_url: r.prUrl, pr_draft: r.prDraft === null ? null : r.prDraft === 1,
   cost_usd: r.costUsd, partial_usd: r.partialUsd, measured_sessions: r.measuredSessions, total_sessions: r.totalSessions,
   input_tokens: r.inputTokens, output_tokens: r.outputTokens, wall_s: r.wallS, last_seq: r.lastSeq,
@@ -75,7 +75,7 @@ const elapsedS = (r: typeof runs.$inferSelect): number | null => {
   return Math.max(0, (end - Date.parse(r.startedAt)) / 1000);
 };
 
-export interface ListQuery { verdict?: string; repo?: string; since?: string; until?: string; limit?: number; cursor?: string }
+export interface ListQuery { verdict?: string; repo?: string; since?: string; until?: string; group_id?: string; limit?: number; cursor?: string }
 
 export function listRuns(db: Db, q: ListQuery) {
   const limit = Math.min(Math.max(q.limit ?? 50, 1), 200);
@@ -83,6 +83,7 @@ export function listRuns(db: Db, q: ListQuery) {
   const where = and(
     q.verdict ? eq(runs.verdict, q.verdict) : undefined,
     q.repo ? eq(runs.originRepo, q.repo) : undefined,
+    q.group_id ? eq(runs.groupId, q.group_id) : undefined,
     q.since ? gte(runs.startedAt, q.since) : undefined,
     q.until ? lt(runs.startedAt, q.until) : undefined,
   );

package/packages/control-plane/src/server/serve.ts

@@ -2,8 +2,18 @@
 // Binds loopback unless LOKI_CONTROL_HOST is set (the container image sets 0.0.0.0). LOKI_CONTROL_PORT_FALLBACK=1 (set for the default port, never for an explicit --port)
 // retries on any free port when PORT is taken; the URL printed below is always the real one.
 import { createApp } from "./app.ts";
+import { bindRefusal, insecureBindWarning, isLoopbackHost } from "./auth.ts";
 
-const { app } = createApp({ dbPath: process.env.LOKI_CONTROL_DB ?? "control.db" });
+// A non-loopback bind needs LOKI_CONTROL_TOKEN (or LOKI_CONTROL_ALLOW_INSECURE_BIND=1). Refuse before opening the DB or binding.
+const refusal = bindRefusal(process.env);
+if (refusal) {
+  console.error(refusal);
+  process.exit(2);
+}
+const warning = insecureBindWarning(process.env);
+if (warning) console.error(warning);
+const bindHost = process.env.LOKI_CONTROL_HOST || "127.0.0.1";
+const { app } = createApp({ dbPath: process.env.LOKI_CONTROL_DB ?? "control.db", token: process.env.LOKI_CONTROL_TOKEN || undefined, loopbackOnly: isLoopbackHost(bindHost.includes(":") && !bindHost.startsWith("[") ? `[${bindHost}]` : bindHost) });
 const serve = (port: number) => Bun.serve({ port, hostname: process.env.LOKI_CONTROL_HOST || "127.0.0.1", fetch: app.fetch });
 let s: ReturnType<typeof serve>;
 try {

package/packages/control-plane/src/shipper/discover.ts

@@ -0,0 +1,29 @@
+// C2 CP-DEFAULT: find a running local Control Plane (docs/v10/CONTROL-PLANE.md section 6). Reads
+// ~/.loki/control/instance.json; returns its url only when the pid is alive and /health answers service=loki-control
+// within 300 ms. Never starts a server, never throws. LOKI_CONTROL=0 disables discovery.
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export const instancePath = (env: NodeJS.ProcessEnv): string => join(env.HOME || homedir(), ".loki", "control", "instance.json");
+
+export interface DiscoverOpts { fetchImpl?: typeof fetch | undefined; alive?: ((pid: number) => boolean) | undefined }
+
+const isAlive = (pid: number): boolean => { try { process.kill(pid, 0); return true; } catch { return false; } };
+
+export function isLoopbackHttp(u: string): boolean {
+  try { const p = new URL(u); return p.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(p.hostname); } catch { return false; }
+}
+
+export async function discoverControlUrl(env: NodeJS.ProcessEnv, o: DiscoverOpts = {}): Promise<string | null> {
+  if (env.LOKI_CONTROL === "0") return null;
+  if (env.LOKI_CONTROL_URL) return env.LOKI_CONTROL_URL;
+  try {
+    const inst = JSON.parse(readFileSync(instancePath(env), "utf8")) as { pid?: unknown; url?: unknown };
+    if (!Number.isInteger(inst.pid) || typeof inst.url !== "string" || !(o.alive ?? isAlive)(inst.pid as number)) return null;
+    if (!isLoopbackHttp(inst.url)) return null; // a planted instance.json must never redirect events off this machine
+    const url = inst.url.replace(/\/+$/, "");
+    const h = (await (await (o.fetchImpl ?? fetch)(`${url}/health`, { signal: AbortSignal.timeout(300) })).json()) as { service?: string };
+    return h.service === "loki-control" ? url : null;
+  } catch { return null; }
+}