loki-mode 10.7.0 → 10.8.0

package/packages/control-plane/src/server/legacy/shim.ts

@@ -0,0 +1,195 @@
+// Legacy dashboard shim (CPE-24, docs/v10/CP-ENTERPRISE-UI.md section 5). A Hono router, mounted on the CP app before the SPA fallback, that answers every route
+// dashboard/server.py served: map onto CP data, 308 the HTML pages, 501 what the CP cannot back yet (never a faked success), 410 what nothing consumes.
+// It binds no port and adds no machine-touching action. Auth is never looser than legacy (see legacyGuard).
+import { and, desc, eq, gte, isNotNull, isNull, lt, sql } from "drizzle-orm";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { Hono, type Context } from "hono";
+import type { Db } from "../../db/migrate.ts";
+import { audit, runs } from "../../db/schema.ts";
+import { peerIsLoopback, tokenMatches } from "../auth.ts";
+import { liveInfo, listRuns, loadEvents, runDetail } from "../runs.ts";
+import { LEGACY_ROUTES, type LegacyRoute } from "./routes.ts";
+import { metricsMapped } from "./routes-metrics.ts";
+
+export interface LegacyShimOpts {
+  db: Db;
+  /** Checkout whose .loki/ the metrics and cost mappings read (CPE24-P1); defaults to the process cwd like createApp. */
+  repoDir?: string;
+  /** The CP bearer token (LOKI_CONTROL_TOKEN). */
+  token?: string;
+  /** Environment used to read the legacy auth flags; defaults to process.env. */
+  env?: Record<string, string | undefined>;
+  /** Origin of the CP UI for 308 targets. Empty (default) means the shim is mounted on the CP app itself, where "/" is already the UI. */
+  uiBase?: string;
+  log?: (line: string) => void;
+  version?: string;
+}
+
+const flagOn = (v: string | undefined) => ["true", "1", "yes"].includes((v ?? "").toLowerCase());
+/** The legacy dashboard enforced scopes when LOKI_ENTERPRISE_AUTH was on or OIDC was configured (dashboard/auth.py). */
+export const legacyAuthEnabled = (env: Record<string, string | undefined>) => flagOn(env.LOKI_ENTERPRISE_AUTH) || !!(env.LOKI_OIDC_ISSUER && env.LOKI_OIDC_CLIENT_ID);
+
+const logged = new Set<string>();
+/** Test hook: forget which routes already logged their first hit. */
+export const resetLegacyLog = () => logged.clear();
+
+const toHono = (p: string) => p.replace(/\{([A-Za-z_]+):path\}/g, ":$1{.+}").replace(/\{([A-Za-z_]+)\}/g, ":$1");
+const NOT_SUPPORTED = "not yet supported by the Control Plane";
+
+const repoVersion = (): string => {
+  for (const f of [join(import.meta.dir, "../../../../../VERSION")]) {
+    try { if (existsSync(f)) return readFileSync(f, "utf8").trim(); } catch { /* fall through */ }
+  }
+  return "unknown";
+};
+
+const intParam = (v: string | undefined, def: number, min: number, max: number): number | null => {
+  if (v === undefined) return def;
+  if (!/^\d+$/.test(v)) return null;
+  const n = Number(v);
+  return n >= min && n <= max ? n : null;
+};
+
+export function queryAudit(db: Db, q: { start_date?: string; end_date?: string; action?: string; limit: number; offset: number }) {
+  const where = and(
+    q.action ? eq(audit.action, q.action) : undefined,
+    q.start_date ? gte(audit.ts, q.start_date) : undefined,
+    q.end_date ? lt(audit.ts, `${q.end_date}￿`) : undefined,
+  );
+  return db.select().from(audit).where(where).orderBy(desc(audit.id)).limit(q.limit).offset(q.offset).all()
+    .map((r) => ({ id: r.id, timestamp: r.ts, action: r.action, actor: r.actor, details: r.detail }));
+}
+
+export function legacyShim(opts: LegacyShimOpts) {
+  const { db } = opts;
+  const env = opts.env ?? process.env;
+  const log = opts.log ?? ((l: string) => console.warn(l));
+  const version = opts.version ?? repoVersion();
+  const bootedAt = Date.now();
+  const uiBase = (opts.uiBase ?? "").replace(/\/+$/, "");
+  const authOn = legacyAuthEnabled(env);
+  const app = new Hono();
+
+  /** Never looser than legacy: a CP token, when set, is always required; with none set, legacy enterprise auth or OIDC being on fails closed (the CP cannot check loki_* tokens); with neither, only a loopback socket peer is served (legacy 403s any other peer, whatever Host says; unknown peer fails closed). */
+  const denied = (c: Context): Response | null => {
+    if (opts.token) return tokenMatches(c.req.header("authorization"), opts.token) ? null : c.json({ detail: "Not authenticated" }, 401, { "www-authenticate": "Bearer" });
+    if (authOn) return c.json({ detail: "Not authenticated" }, 401, { "www-authenticate": "Bearer" });
+    return peerIsLoopback(c) ? null : c.json({ detail: "Forbidden" }, 403);
+  };
+  const once = (r: Pick<LegacyRoute, "method" | "path" | "action" | "migrate">) => {
+    const key = `${r.method} ${r.path}`;
+    if (logged.has(key)) return;
+    logged.add(key);
+    if (r.action === "501") log(`legacy dashboard route ${r.path} is not served by the Control Plane (501); no /v1 equivalent yet`);
+    else if (r.action === "410") log(`legacy dashboard route ${r.path} is retired (410); nothing consumes it`);
+    else log(`legacy dashboard route ${r.path} is served by the Control Plane; migrate to ${r.migrate}`);
+  };
+
+  const runKey = (id: string): { source: string; run: string } | null => {
+    const i = id.indexOf(":");
+    if (i > 0) return { source: id.slice(0, i), run: id.slice(i + 1) };
+    const row = db.select({ s: runs.sourceId, r: runs.runId }).from(runs).where(eq(runs.runId, id)).orderBy(desc(runs.startedAt)).get();
+    return row ? { source: row.s, run: row.r } : null;
+  };
+  const withId = <T extends { source_id: string; run_id: string; started_at: string | null }>(r: T) => ({ ...r, id: `${r.source_id}:${r.run_id}`, created_at: r.started_at });
+
+  const auditList = (c: Context) => {
+    const q = c.req.query();
+    const limit = intParam(q.limit, 100, 1, 10000), offset = intParam(q.offset, 0, 0, Number.MAX_SAFE_INTEGER);
+    if (limit === null || offset === null) return { err: c.json({ detail: "limit must be 1..10000 and offset a non-negative integer" }, 422) };
+    if (q.resource_type) return { err: c.json({ detail: "resource_type filter is not supported by the Control Plane audit log" }, 400) };
+    return { rows: queryAudit(db, { start_date: q.start_date, end_date: q.end_date, action: q.action, limit, offset }), limit, offset };
+  };
+
+  const mapped: Record<string, (c: Context) => Response> = {
+    "GET /.well-known/agent.json": (c) => c.json({
+      name: "Loki Mode", version, url: "https://www.autonomi.dev/",
+      description: "Multi-agent autonomous system by Autonomi. Served by the Loki Control Plane.",
+      capabilities: { streaming: false, pushNotifications: false, stateTransitionHistory: true },
+      protocols: { a2a: "0.1" },
+      endpoints: { health: "/health", status: "/api/status", runs: "/v1/runs" },
+      enterprise: { multi_tenant: false, rbac: false, audit_log: true, sso: false },
+      authentication: { schemes: ["bearer"] },
+      defaultInputModes: ["text/plain", "application/json"], defaultOutputModes: ["text/plain", "application/json"],
+    }),
+    "GET /api/status": (c) => {
+      const running = db.select({ n: sql<number>`count(*)` }).from(runs).where(isNull(runs.endedAt)).get()?.n ?? 0;
+      const latest = db.select().from(runs).where(isNull(runs.endedAt)).orderBy(desc(runs.startedAt)).get();
+      const live = latest ? liveInfo(loadEvents(db, latest.sourceId, latest.runId)) : null;
+      return c.json({
+        status: running > 0 ? "running" : "idle", version, uptime_seconds: (Date.now() - bootedAt) / 1000,
+        active_sessions: running, database_connected: true,
+        phase: live?.current_stage ?? "", provider: latest?.provider ?? "",
+      });
+    },
+    "GET /api/v2/runs": (c) => {
+      const q = c.req.query();
+      const limit = intParam(q.limit, 50, 1, 1000), offset = intParam(q.offset, 0, 0, Number.MAX_SAFE_INTEGER);
+      if (limit === null || offset === null) return c.json({ detail: "limit must be 1..1000 and offset a non-negative integer" }, 422);
+      if (q.project_id !== undefined) return c.json({ detail: "project_id filter is not supported by the Control Plane (runs are not grouped into legacy projects)" }, 400);
+      if (q.status !== undefined && q.status !== "running" && q.status !== "completed") return c.json({ detail: "status must be running or completed" }, 400);
+      if (q.status === undefined) return c.json(listRuns(db, { limit, cursor: String(offset) }).runs.map(withId));
+      const keys = db.select({ s: runs.sourceId, r: runs.runId }).from(runs).where(q.status === "running" ? isNull(runs.endedAt) : isNotNull(runs.endedAt))
+        .orderBy(desc(runs.startedAt)).limit(Math.min(limit, 200)).offset(offset).all();
+      return c.json(keys.flatMap((k) => { const d = runDetail(db, k.s, k.r); return d ? [withId(d)] : []; }));
+    },
+    "GET /api/v2/runs/{run_id}": (c) => {
+      const k = runKey(c.req.param("run_id") ?? "");
+      const d = k ? runDetail(db, k.source, k.run) : null;
+      return d ? c.json(withId(d)) : c.json({ detail: "Run not found" }, 404);
+    },
+    "GET /api/v2/runs/{run_id}/timeline": (c) => {
+      const k = runKey(c.req.param("run_id") ?? "");
+      const d = k ? runDetail(db, k.source, k.run) : null;
+      if (!k || !d) return c.json({ detail: "Run not found" }, 404);
+      return c.json({
+        run_id: `${k.source}:${k.run}`,
+        phases: d.stages.map((s) => ({ name: s.stage, status: s.status, started_at: s.started_at, ended_at: s.ended_at })),
+        current_phase: d.current_stage,
+        events: loadEvents(db, k.source, k.run).map((e) => ({ seq: e.seq, ts: e.ts, type: e.type, stage: e.stage })),
+      });
+    },
+    "GET /api/v2/audit": (c) => { const r = auditList(c); return r.err ?? c.json(r.rows); },
+    ...metricsMapped(opts.repoDir ?? process.cwd()),
+  };
+
+  // /lab/api/* is data, not a page: 501 JSON on every method (a 308 to the SPA would hand a client HTML). Registered before the /lab mount.
+  app.all("/lab/api/*", (c) => {
+    const d = denied(c);
+    if (d) return d;
+    return c.json({ error: NOT_SUPPORTED, detail: "The legacy dashboard route exists, but the Control Plane has no data or mechanism for it yet.", legacy_route: "/lab/api/*", method: c.req.method }, 501);
+  });
+
+  for (const r of LEGACY_ROUTES) {
+    // On the CP app itself "/" is the UI already; redirecting it would loop. Only a separately mounted shim (uiBase set) redirects it.
+    if (r.action === "308" && uiBase === "" && r.path === "/") continue;
+    const hp = toHono(r.path);
+    const handle = (c: Context): Response => {
+      if (!r.open) { const d = denied(c); if (d) return d; }
+      once(r);
+      const body = { legacy_route: r.path, method: r.method };
+      if (r.action === "map") return (mapped[`${r.method} ${r.path}`] as (c: Context) => Response)(c);
+      if (r.action === "308") return c.redirect(`${uiBase}/`, 308);
+      if (r.action === "410") return c.json({ error: "gone", detail: "This legacy dashboard route was retired; nothing consumes it.", ...body }, 410);
+      return c.json({ error: NOT_SUPPORTED, detail: "The legacy dashboard route exists, but the Control Plane has no data or mechanism for it yet.", ...body }, 501);
+    };
+    const m = r.method === "WS" || r.method === "MOUNT" ? "GET" : r.method;
+    app.on(m, hp, handle);
+    if (hp !== "/" && !hp.endsWith("}")) app.on(m, `${hp}/`, handle); // legacy stripped a trailing slash
+    if (r.method === "MOUNT") app.on(m, `${hp}/*`, handle);
+  }
+
+  // /v1/audit: the CP already stores the operator-action log; this exposes it (guarded by the /v1 bearer middleware and by the shim guard).
+  app.get("/v1/audit", (c) => {
+    const d = denied(c);
+    if (d) return d;
+    const r = auditList(c);
+    return r.err ?? c.json({ entries: r.rows, limit: r.limit, offset: r.offset });
+  });
+
+  // Unknown /api/* is a JSON 404 like legacy, never the SPA shell.
+  app.all("/api/*", (c) => { const d = denied(c); return d ?? c.json({ detail: "Not Found" }, 404); });
+
+  return app;
+}

package/packages/control-plane/src/server/repos.ts

@@ -0,0 +1,27 @@
+// local_repos: the server-side map from source_id to a real repo path. Filled only by local discovery (never by /v1/ingest);
+// the path never leaves the server. The API exposes display names only.
+import type { Hono } from "hono";
+import type { Db } from "../db/migrate.ts";
+import { localRepos } from "../db/schema.ts";
+import { discoverLocalRepos } from "../shipper/discover.ts";
+
+/** Upsert every locally discovered repo. Returns the number of repos known. */
+export function syncLocalRepos(db: Db, repoDir: string, env: NodeJS.ProcessEnv = process.env): number {
+  const now = new Date().toISOString();
+  const found = discoverLocalRepos(repoDir, env);
+  for (const r of found) {
+    db.insert(localRepos).values({ sourceId: r.sourceId, realpath: r.realpath, name: r.name, discoveredAt: now })
+      .onConflictDoUpdate({ target: localRepos.sourceId, set: { realpath: r.realpath, name: r.name } }).run();
+  }
+  return found.length;
+}
+
+/** Display names only, sorted and de-duplicated. */
+export function repoNames(db: Db): string[] {
+  return [...new Set(db.select({ name: localRepos.name }).from(localRepos).all().map((r) => r.name))].sort();
+}
+
+/** GET /v1/repos. `act` is the loopback-only router; `peerIsLoopback` checks the real socket address. */
+export function mountRepos(act: Hono, db: Db, peerIsLoopback: (c: Parameters<Parameters<Hono["get"]>[1]>[0]) => boolean): void {
+  act.get("/v1/repos", (c) => peerIsLoopback(c) ? c.json({ repos: repoNames(db) }) : c.json({ error: "loopback only" }, 403));
+}

package/packages/control-plane/src/server/routes/artifacts.ts

@@ -0,0 +1,104 @@
+// Run artifacts read API (CPE-04): a run's events (paged) and an allowlist of files from <repo>/.loki/runs/<run>/.
+// Events come from the store. Files are read from disk, so that route is loopback-only (on `act`) and every path is contained:
+// the run id must be a known ingested run with a discovered local repo, the name must match a fixed allowlist, and the
+// realpath of the file must stay under the realpath of <repo>/.loki/runs/<run>. The repo path never appears in a response.
+import { closeSync, fstatSync, openSync, readSync, realpathSync } from "node:fs";
+import { join, sep } from "node:path";
+import { and, asc, eq, gt } from "drizzle-orm";
+import type { Context } from "hono";
+import { events, localRepos, runs } from "../../db/schema.ts";
+import type { RouteCtx } from "./index.ts";
+
+export const MAX_ARTIFACT_BYTES = 5 * 1024 * 1024;
+export const EVENTS_DEFAULT = 500;
+export const EVENTS_MAX = 1000;
+
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const NAME = /^(?:issue\.json|plan\.json|receipt\.json|receipt\.md|report\.md|task\.md|diff\.patch|evidence\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}\.png)$/;
+
+const TYPES: Record<string, string> = {
+  json: "application/json; charset=utf-8",
+  md: "text/plain; charset=utf-8",
+  patch: "text/plain; charset=utf-8",
+  png: "image/png",
+};
+
+const safeId = (s: string) => ID.test(s) && !s.includes("..");
+
+/** Reads a regular file up to the cap through one descriptor (the size check and the read see the same file). */
+function readCapped(path: string): { status: 200; body: Buffer } | { status: 404 | 413 } {
+  let fd: number;
+  try { fd = openSync(path, "r"); } catch { return { status: 404 }; }
+  try {
+    const st = fstatSync(fd);
+    if (!st.isFile()) return { status: 404 };
+    if (st.size > MAX_ARTIFACT_BYTES) return { status: 413 };
+    const buf = Buffer.alloc(st.size);
+    let off = 0;
+    while (off < st.size) {
+      const n = readSync(fd, buf, off, st.size - off, off);
+      if (n <= 0) break;
+      off += n;
+    }
+    return { status: 200, body: buf.subarray(0, off) };
+  } finally { closeSync(fd); }
+}
+
+export function mount(ctx: RouteCtx): void {
+  const { app, act, db } = ctx;
+  const known = (source: string, run: string) =>
+    safeId(source) && safeId(run) && !!db.select({ r: runs.runId }).from(runs).where(and(eq(runs.sourceId, source), eq(runs.runId, run))).get();
+
+  // Paged events for the log: seq > after, ascending. DB only, so it serves on `app` behind the normal guards.
+  app.get("/v1/runs/:source/:run/events", (c) => {
+    const source = c.req.param("source"), run = c.req.param("run");
+    if (!known(source, run)) return c.json({ error: "run not found" }, 404);
+    const rawAfter = c.req.query("after"), rawLimit = c.req.query("limit");
+    if (rawAfter !== undefined && !/^\d{1,15}$/.test(rawAfter)) return c.json({ error: "after must be a non-negative integer" }, 400);
+    if (rawLimit !== undefined && !/^\d{1,6}$/.test(rawLimit)) return c.json({ error: "limit must be a positive integer" }, 400);
+    const after = rawAfter === undefined ? -1 : Number(rawAfter);
+    const limit = Math.min(rawLimit === undefined ? EVENTS_DEFAULT : Number(rawLimit), EVENTS_MAX);
+    if (limit < 1) return c.json({ error: "limit must be a positive integer" }, 400);
+    const rows = db.select().from(events).where(and(eq(events.sourceId, source), eq(events.runId, run), gt(events.seq, after))).orderBy(asc(events.seq)).limit(limit + 1).all();
+    const out = rows.slice(0, limit).map((r) => ({ v: 1, seq: r.seq, ts: r.ts, run: r.runId, type: r.type, stage: r.stage, data: r.data }));
+    return c.json({ events: out, next_after: out.length ? out[out.length - 1]?.seq ?? null : null, has_more: rows.length > limit });
+  });
+
+  // One allowlisted artifact file. Loopback peer only; a non-loopback bind never registers this route (act is detached).
+  act.get("/v1/runs/:source/:run/artifact/*", (c: Context) => {
+    if (!ctx.peerIsLoopback(c)) return c.json({ error: "loopback only" }, 403);
+    const source = c.req.param("source"), run = c.req.param("run");
+    const path = new URL(c.req.url).pathname;
+    const at = path.indexOf("/artifact/");
+    const raw = at < 0 ? "" : path.slice(at + "/artifact/".length);
+    let name: string;
+    try { name = decodeURIComponent(raw); } catch { return c.json({ error: "malformed URL encoding" }, 400); }
+    // Traversal, absolute names, backslashes, NUL and anything off the allowlist all fail this one exact match.
+    if (!NAME.test(name)) return c.json({ error: "artifact not on the allowlist" }, 404);
+    if (!known(source, run)) return c.json({ error: "run not found" }, 404);
+    const repo = db.select({ p: localRepos.realpath }).from(localRepos).where(eq(localRepos.sourceId, source)).get();
+    if (!repo) return c.json({ error: "artifact not available" }, 404);
+    let runsRoot: string, runDir: string, file: string;
+    try {
+      runsRoot = realpathSync(join(repo.p, ".loki", "runs"));
+      runDir = realpathSync(join(runsRoot, run));
+    } catch { return c.json({ error: "artifact not found" }, 404); }
+    if (runDir !== join(runsRoot, run)) return c.json({ error: "artifact not found" }, 404);
+    try { file = realpathSync(join(runDir, name)); } catch { return c.json({ error: "artifact not found" }, 404); }
+    if (!file.startsWith(runDir + sep)) return c.json({ error: "artifact not found" }, 404);
+    const r = readCapped(file);
+    if (r.status === 413) return c.json({ error: `artifact over ${MAX_ARTIFACT_BYTES} bytes` }, 413);
+    if (r.status !== 200) return c.json({ error: "artifact not found" }, 404);
+    const ext = name.slice(name.lastIndexOf(".") + 1);
+    return new Response(new Uint8Array(r.body), {
+      status: 200,
+      headers: {
+        "content-type": TYPES[ext] ?? "application/octet-stream",
+        "content-length": String(r.body.length),
+        "x-content-type-options": "nosniff",
+        "content-security-policy": "default-src 'none'; sandbox",
+        "cache-control": "no-store",
+      },
+    });
+  });
+}

package/packages/control-plane/src/server/routes/audit.ts

@@ -0,0 +1,17 @@
+// GET /v1/audit: the actions table written by src/server/audit.ts, newest first, paged. The helper never stores secrets.
+import { desc, sql } from "drizzle-orm";
+import { actions } from "../../db/schema.ts";
+import type { RouteCtx } from "./index.ts";
+
+export function mount(ctx: RouteCtx): void {
+  ctx.app.get("/v1/audit", (c) => {
+    const limit = Math.min(Math.max(Number.parseInt(c.req.query("limit") ?? "50", 10) || 50, 1), 200);
+    const offset = Math.max(Number.parseInt(c.req.query("cursor") ?? "0", 10) || 0, 0);
+    const total = ctx.db.select({ n: sql<number>`count(*)` }).from(actions).get()?.n ?? 0;
+    const rows = ctx.db.select().from(actions).orderBy(desc(actions.ts), desc(actions.id)).limit(limit).offset(offset).all();
+    return c.json({
+      actions: rows.map((r) => ({ id: r.id, ts: r.ts, actor: r.actor, kind: r.kind, target: r.target, result: r.result, detail: r.detail })),
+      total, next_cursor: offset + rows.length < total ? String(offset + rows.length) : null,
+    });
+  });
+}