loki-mode 10.7.1 → 10.8.0

package/packages/control-plane/src/server/audit.ts

@@ -0,0 +1,15 @@
+// Audit helper: one row per UI-initiated action. Never throws (an audit failure must not break the action) and never stores secrets.
+import type { Db } from "../db/migrate.ts";
+import { actions } from "../db/schema.ts";
+
+export type AuditEntry = { actor?: string; kind: string; target?: string; result: string; detail?: string };
+
+const clip = (s: string | undefined, n: number): string | null => (s === undefined ? null : s.slice(0, n));
+
+/** Records an action. Returns true when the row was written. */
+export function audit(db: Db, e: AuditEntry): boolean {
+  try {
+    db.insert(actions).values({ ts: new Date().toISOString(), actor: e.actor ?? "local", kind: e.kind, target: clip(e.target, 500), result: e.result, detail: clip(e.detail, 2000) }).run();
+    return true;
+  } catch { return false; }
+}

package/packages/control-plane/src/server/auth.ts

@@ -1,6 +1,6 @@
 // Control Plane auth: bearer token on /v1, Host allowlist on loopback (DNS rebinding), bind refusal without a token.
 import { createHash, timingSafeEqual } from "node:crypto";
-import type { MiddlewareHandler } from "hono";
+import type { Context, MiddlewareHandler } from "hono";
 
 const LOOPBACK_BINDS = new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
 
@@ -9,6 +9,12 @@ export function isLoopbackHost(host: string | undefined | null): boolean {
   return !!host && /^(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/i.test(host);
 }
 
+/** True when the real socket peer (not the spoofable Host header) is loopback. An unknown peer fails closed. */
+export function peerIsLoopback(c: Context): boolean {
+  const ip = (c.env as { requestIP?: (r: Request) => { address?: string } | null } | undefined)?.requestIP?.(c.req.raw)?.address;
+  return typeof ip === "string" && /^(127\.\d+\.\d+\.\d+|::1|::ffff:127\.\d+\.\d+\.\d+)$/.test(ip);
+}
+
 /** Constant-time check of an Authorization header against the token. Hashing first makes the compare length-safe. */
 export function tokenMatches(header: string | undefined | null, token: string): boolean {
   const m = /^Bearer (.+)$/i.exec(header ?? "");

package/packages/control-plane/src/server/legacy/routes-metrics.ts

@@ -0,0 +1,18 @@
+// CPE24-P1: legacy (port 57374) mappings for metrics, cost and fleet spend. Each reads the same source as its /v1 route (routes/metrics.ts,
+// routes/cost_ledger.ts, routes/fleet.ts) and keeps the legacy response shape. The shim's guard (legacyGuard) has already run.
+import type { Context } from "hono";
+import { costSnapshot, costTimeline, lokiDirOf } from "../routes/cost_ledger.ts";
+import { fleetRuns, fleetSummary, parseInactive } from "../routes/fleet.ts";
+import { buildMetricsText } from "../routes/metrics.ts";
+
+export function metricsMapped(repoDir: string): Record<string, (c: Context) => Response> {
+  const inactive = (c: Context) => parseInactive(c.req.query("include_inactive"));
+  return {
+    "GET /api/cost": (c) => c.json(costSnapshot(lokiDirOf(repoDir))),
+    "GET /api/cost/timeline": (c) => c.json(costTimeline(lokiDirOf(repoDir))),
+    "GET /metrics": (c) => c.text(buildMetricsText(repoDir), 200, { "content-type": "text/plain; charset=utf-8" }),
+    // Legacy rows carry the project path; the guarded shim serves only authenticated or loopback callers, like legacy.
+    "GET /api/fleet/runs": (c) => c.json(fleetRuns(inactive(c))),
+    "GET /api/fleet/summary": (c) => c.json(fleetSummary(inactive(c))),
+  };
+}

package/packages/control-plane/src/server/legacy/routes.ts

@@ -0,0 +1,237 @@
+// GENERATED from docs/v10/CP-ENTERPRISE-UI.md section 5.2 (one row per legacy dashboard route that the shim answers).
+// test/server/legacy-shim.test.ts asserts this table and the doc table agree. Regenerate both together, never one alone.
+export type LegacyAction = "map" | "308" | "410" | "501";
+export interface LegacyRoute { method: string; path: string; action: LegacyAction; open: boolean; migrate: string }
+
+export const LEGACY_ROUTES: readonly LegacyRoute[] = [
+  { method: "GET", path: "/openapi.json", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/docs", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/docs/oauth2-redirect", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/redoc", action: "410", open: true, migrate: "" },
+  { method: "POST", path: "/api/v2/tenants", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/tenants", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/tenants/{tenant_id}", action: "501", open: false, migrate: "" },
+  { method: "PUT", path: "/api/v2/tenants/{tenant_id}", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/v2/tenants/{tenant_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/tenants/{tenant_id}/projects", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v2/runs", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/runs", action: "map", open: false, migrate: "/v1/runs" },
+  { method: "GET", path: "/api/v2/runs/{run_id}", action: "map", open: false, migrate: "/v1/runs/:id" },
+  { method: "POST", path: "/api/v2/runs/{run_id}/cancel", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/v2/runs/{run_id}/replay", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/runs/{run_id}/timeline", action: "map", open: false, migrate: "/v1/runs/:id" },
+  { method: "POST", path: "/api/v2/api-keys", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/api-keys", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/api-keys/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "PUT", path: "/api/v2/api-keys/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/v2/api-keys/{identifier}", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/v2/api-keys/{identifier}/rotate", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/policies", action: "410", open: false, migrate: "" },
+  { method: "PUT", path: "/api/v2/policies", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v2/policies/evaluate", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/audit", action: "map", open: false, migrate: "/v1/audit" },
+  { method: "GET", path: "/api/v2/audit/verify", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/v2/audit/export", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/runs/{run_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/tests", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/receipts", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/releases", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/phases", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/workspaces/runs", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/operator/workspaces/runs/{ws}/{run_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/onboarding/state", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/onboarding/provider", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/onboarding/github", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/onboarding/repos", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/onboarding/repo", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/backlog/issues", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/backlog/run", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/backlog/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/v1/runs", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/v1/runs/{run_id}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v1/runs", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/v1/runs/{run_id}/stop", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/start", action: "308", open: false, migrate: "/" },
+  { method: "MOUNT", path: "/lab", action: "308", open: true, migrate: "/" },
+  { method: "GET", path: "/api/providers/models", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/.well-known/agent.json", action: "map", open: true, migrate: "/v1/runs" },
+  { method: "GET", path: "/api/status", action: "map", open: false, migrate: "/v1/runs" },
+  { method: "GET", path: "/api/projects", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/projects", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/projects/{project_id}", action: "501", open: false, migrate: "" },
+  { method: "PUT", path: "/api/projects/{project_id}", action: "501", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/projects/{project_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/tasks", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/tasks", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/tasks/{task_id}", action: "501", open: false, migrate: "" },
+  { method: "PUT", path: "/api/tasks/{task_id}", action: "501", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/tasks/{task_id}", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/tasks/{task_id}/move", action: "501", open: false, migrate: "" },
+  { method: "WS", path: "/ws", action: "501", open: true, migrate: "" },
+  { method: "GET", path: "/api/registry/projects", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/registry/projects", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/projects/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/registry/projects/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/projects/{identifier}/health", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/registry/projects/{identifier}/access", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/discover", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/registry/sync", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/tasks", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/registry/learnings", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/fleet/runs", action: "map", open: false, migrate: "/v1/fleet/runs" },
+  { method: "GET", path: "/api/fleet/summary", action: "map", open: false, migrate: "/v1/fleet/summary" },
+  { method: "GET", path: "/api/fleet/runs/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/focus", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/focus", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/focus", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/session/model", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/session/model", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/running-projects", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/start", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/control/builds/{execution_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/control/builds/{execution_id}/proof", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/builds/{execution_id}/stop", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/running-projects/stop", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/fleet/runs/{identifier}/retry", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/fleet/runs/{identifier}/cancel", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/enterprise/status", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/api/auth/info", action: "410", open: true, migrate: "" },
+  { method: "POST", path: "/api/enterprise/tokens", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/enterprise/tokens", action: "410", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/enterprise/tokens/{identifier}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/enterprise/audit", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/enterprise/audit/summary", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/compliance", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/summary", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/episodes", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/episodes/{episode_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/patterns", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/patterns/{pattern_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/skills", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/skills/{skill_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/economics", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/memory/consolidate", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/memory/retrieve", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/index", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/timeline", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/files", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/file", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/search", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/memory/stats", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/metrics", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/trends", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/signals", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/aggregation", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/learning/aggregate", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/preferences", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/errors", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/success", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learning/tools", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/pause", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/resume", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/stop", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/cost", action: "map", open: false, migrate: "/v1/cost/snapshot" },
+  { method: "GET", path: "/api/budget", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/cost/timeline", action: "map", open: false, migrate: "/v1/cost/timeline" },
+  { method: "GET", path: "/api/trust/trajectory", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/gate-policy", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/pricing", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/state", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/verdicts", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/convergence", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/report", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/council/force-review", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/transcripts", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/transcripts/{iteration_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/context", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/notifications", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/notifications/triggers", action: "410", open: false, migrate: "" },
+  { method: "PUT", path: "/api/notifications/triggers", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/notifications/{notification_id}/acknowledge", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/notifications/{notification_id}/unacknowledge", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/checkpoints", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/checkpoints/{checkpoint_id}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/checkpoints", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/checkpoints/{checkpoint_id}/rollback", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/agents", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/agents/{agent_id}/kill", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/agents/{agent_id}/pause", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/agents/{agent_id}/resume", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/logs", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/join", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/leave", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/users", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/users/{user_id}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/users/{user_id}/heartbeat", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/users/{user_id}/cursor", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/users/{user_id}/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/presence", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/file/{file_path:path}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/state", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/state/value", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/operation", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/collab/sync", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/collab/history", action: "410", open: false, migrate: "" },
+  { method: "WS", path: "/ws/collab", action: "410", open: true, migrate: "" },
+  { method: "GET", path: "/api/collab/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/secrets/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/github/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/github/tasks", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/github/sync-log", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/health/processes", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/metrics", action: "map", open: false, migrate: "/v1/metrics" },
+  { method: "GET", path: "/api/checklist", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/usage", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/checklist/summary", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/prd-observations", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/checklist/waivers", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/checklist/waivers", action: "501", open: false, migrate: "" },
+  { method: "DELETE", path: "/api/checklist/waivers/{item_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/council/gate", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/app-runner/status", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/app-runner/logs", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/app-runner/errors", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/app-restart", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/control/app-stop", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/playwright/results", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/playwright/screenshot", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/failures", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/prompt-versions", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/prompt-optimize", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/activity", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/session-diff", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/activity", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/cost", action: "308", open: false, migrate: "/" },
+  { method: "GET", path: "/trust", action: "308", open: false, migrate: "/" },
+  { method: "GET", path: "/", action: "308", open: false, migrate: "/" },
+  { method: "GET", path: "/api/quality-score", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/quality-score/history", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/quality-scan", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/quality-report", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/list", action: "501", open: false, migrate: "" },
+  { method: "POST", path: "/api/migration/start", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/status", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/plan", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/features", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/migration/{migration_id}/seams", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/migration/{migration_id}/advance", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/migration/{migration_id}/start-phase", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/managed/events", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/managed/status", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/managed/memory_versions/{memory_id}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/findings/{iteration}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/quality/architecture", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/learnings", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/escalations", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/escalations/{filename}", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/phases", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs/summary", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs/{run_id}", action: "501", open: false, migrate: "" },
+  { method: "GET", path: "/api/proofs/{run_id}/html", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/spec", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/spec/history", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/wiki", action: "410", open: false, migrate: "" },
+  { method: "GET", path: "/api/wiki/{section}", action: "410", open: false, migrate: "" },
+  { method: "POST", path: "/api/wiki/ask", action: "501", open: false, migrate: "" },
+];

package/packages/control-plane/src/server/legacy/shim.ts

@@ -0,0 +1,195 @@
+// Legacy dashboard shim (CPE-24, docs/v10/CP-ENTERPRISE-UI.md section 5). A Hono router, mounted on the CP app before the SPA fallback, that answers every route
+// dashboard/server.py served: map onto CP data, 308 the HTML pages, 501 what the CP cannot back yet (never a faked success), 410 what nothing consumes.
+// It binds no port and adds no machine-touching action. Auth is never looser than legacy (see legacyGuard).
+import { and, desc, eq, gte, isNotNull, isNull, lt, sql } from "drizzle-orm";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { Hono, type Context } from "hono";
+import type { Db } from "../../db/migrate.ts";
+import { audit, runs } from "../../db/schema.ts";
+import { peerIsLoopback, tokenMatches } from "../auth.ts";
+import { liveInfo, listRuns, loadEvents, runDetail } from "../runs.ts";
+import { LEGACY_ROUTES, type LegacyRoute } from "./routes.ts";
+import { metricsMapped } from "./routes-metrics.ts";
+
+export interface LegacyShimOpts {
+  db: Db;
+  /** Checkout whose .loki/ the metrics and cost mappings read (CPE24-P1); defaults to the process cwd like createApp. */
+  repoDir?: string;
+  /** The CP bearer token (LOKI_CONTROL_TOKEN). */
+  token?: string;
+  /** Environment used to read the legacy auth flags; defaults to process.env. */
+  env?: Record<string, string | undefined>;
+  /** Origin of the CP UI for 308 targets. Empty (default) means the shim is mounted on the CP app itself, where "/" is already the UI. */
+  uiBase?: string;
+  log?: (line: string) => void;
+  version?: string;
+}
+
+const flagOn = (v: string | undefined) => ["true", "1", "yes"].includes((v ?? "").toLowerCase());
+/** The legacy dashboard enforced scopes when LOKI_ENTERPRISE_AUTH was on or OIDC was configured (dashboard/auth.py). */
+export const legacyAuthEnabled = (env: Record<string, string | undefined>) => flagOn(env.LOKI_ENTERPRISE_AUTH) || !!(env.LOKI_OIDC_ISSUER && env.LOKI_OIDC_CLIENT_ID);
+
+const logged = new Set<string>();
+/** Test hook: forget which routes already logged their first hit. */
+export const resetLegacyLog = () => logged.clear();
+
+const toHono = (p: string) => p.replace(/\{([A-Za-z_]+):path\}/g, ":$1{.+}").replace(/\{([A-Za-z_]+)\}/g, ":$1");
+const NOT_SUPPORTED = "not yet supported by the Control Plane";
+
+const repoVersion = (): string => {
+  for (const f of [join(import.meta.dir, "../../../../../VERSION")]) {
+    try { if (existsSync(f)) return readFileSync(f, "utf8").trim(); } catch { /* fall through */ }
+  }
+  return "unknown";
+};
+
+const intParam = (v: string | undefined, def: number, min: number, max: number): number | null => {
+  if (v === undefined) return def;
+  if (!/^\d+$/.test(v)) return null;
+  const n = Number(v);
+  return n >= min && n <= max ? n : null;
+};
+
+export function queryAudit(db: Db, q: { start_date?: string; end_date?: string; action?: string; limit: number; offset: number }) {
+  const where = and(
+    q.action ? eq(audit.action, q.action) : undefined,
+    q.start_date ? gte(audit.ts, q.start_date) : undefined,
+    q.end_date ? lt(audit.ts, `${q.end_date}￿`) : undefined,
+  );
+  return db.select().from(audit).where(where).orderBy(desc(audit.id)).limit(q.limit).offset(q.offset).all()
+    .map((r) => ({ id: r.id, timestamp: r.ts, action: r.action, actor: r.actor, details: r.detail }));
+}
+
+export function legacyShim(opts: LegacyShimOpts) {
+  const { db } = opts;
+  const env = opts.env ?? process.env;
+  const log = opts.log ?? ((l: string) => console.warn(l));
+  const version = opts.version ?? repoVersion();
+  const bootedAt = Date.now();
+  const uiBase = (opts.uiBase ?? "").replace(/\/+$/, "");
+  const authOn = legacyAuthEnabled(env);
+  const app = new Hono();
+
+  /** Never looser than legacy: a CP token, when set, is always required; with none set, legacy enterprise auth or OIDC being on fails closed (the CP cannot check loki_* tokens); with neither, only a loopback socket peer is served (legacy 403s any other peer, whatever Host says; unknown peer fails closed). */
+  const denied = (c: Context): Response | null => {
+    if (opts.token) return tokenMatches(c.req.header("authorization"), opts.token) ? null : c.json({ detail: "Not authenticated" }, 401, { "www-authenticate": "Bearer" });
+    if (authOn) return c.json({ detail: "Not authenticated" }, 401, { "www-authenticate": "Bearer" });
+    return peerIsLoopback(c) ? null : c.json({ detail: "Forbidden" }, 403);
+  };
+  const once = (r: Pick<LegacyRoute, "method" | "path" | "action" | "migrate">) => {
+    const key = `${r.method} ${r.path}`;
+    if (logged.has(key)) return;
+    logged.add(key);
+    if (r.action === "501") log(`legacy dashboard route ${r.path} is not served by the Control Plane (501); no /v1 equivalent yet`);
+    else if (r.action === "410") log(`legacy dashboard route ${r.path} is retired (410); nothing consumes it`);
+    else log(`legacy dashboard route ${r.path} is served by the Control Plane; migrate to ${r.migrate}`);
+  };
+
+  const runKey = (id: string): { source: string; run: string } | null => {
+    const i = id.indexOf(":");
+    if (i > 0) return { source: id.slice(0, i), run: id.slice(i + 1) };
+    const row = db.select({ s: runs.sourceId, r: runs.runId }).from(runs).where(eq(runs.runId, id)).orderBy(desc(runs.startedAt)).get();
+    return row ? { source: row.s, run: row.r } : null;
+  };
+  const withId = <T extends { source_id: string; run_id: string; started_at: string | null }>(r: T) => ({ ...r, id: `${r.source_id}:${r.run_id}`, created_at: r.started_at });
+
+  const auditList = (c: Context) => {
+    const q = c.req.query();
+    const limit = intParam(q.limit, 100, 1, 10000), offset = intParam(q.offset, 0, 0, Number.MAX_SAFE_INTEGER);
+    if (limit === null || offset === null) return { err: c.json({ detail: "limit must be 1..10000 and offset a non-negative integer" }, 422) };
+    if (q.resource_type) return { err: c.json({ detail: "resource_type filter is not supported by the Control Plane audit log" }, 400) };
+    return { rows: queryAudit(db, { start_date: q.start_date, end_date: q.end_date, action: q.action, limit, offset }), limit, offset };
+  };
+
+  const mapped: Record<string, (c: Context) => Response> = {
+    "GET /.well-known/agent.json": (c) => c.json({
+      name: "Loki Mode", version, url: "https://www.autonomi.dev/",
+      description: "Multi-agent autonomous system by Autonomi. Served by the Loki Control Plane.",
+      capabilities: { streaming: false, pushNotifications: false, stateTransitionHistory: true },
+      protocols: { a2a: "0.1" },
+      endpoints: { health: "/health", status: "/api/status", runs: "/v1/runs" },
+      enterprise: { multi_tenant: false, rbac: false, audit_log: true, sso: false },
+      authentication: { schemes: ["bearer"] },
+      defaultInputModes: ["text/plain", "application/json"], defaultOutputModes: ["text/plain", "application/json"],
+    }),
+    "GET /api/status": (c) => {
+      const running = db.select({ n: sql<number>`count(*)` }).from(runs).where(isNull(runs.endedAt)).get()?.n ?? 0;
+      const latest = db.select().from(runs).where(isNull(runs.endedAt)).orderBy(desc(runs.startedAt)).get();
+      const live = latest ? liveInfo(loadEvents(db, latest.sourceId, latest.runId)) : null;
+      return c.json({
+        status: running > 0 ? "running" : "idle", version, uptime_seconds: (Date.now() - bootedAt) / 1000,
+        active_sessions: running, database_connected: true,
+        phase: live?.current_stage ?? "", provider: latest?.provider ?? "",
+      });
+    },
+    "GET /api/v2/runs": (c) => {
+      const q = c.req.query();
+      const limit = intParam(q.limit, 50, 1, 1000), offset = intParam(q.offset, 0, 0, Number.MAX_SAFE_INTEGER);
+      if (limit === null || offset === null) return c.json({ detail: "limit must be 1..1000 and offset a non-negative integer" }, 422);
+      if (q.project_id !== undefined) return c.json({ detail: "project_id filter is not supported by the Control Plane (runs are not grouped into legacy projects)" }, 400);
+      if (q.status !== undefined && q.status !== "running" && q.status !== "completed") return c.json({ detail: "status must be running or completed" }, 400);
+      if (q.status === undefined) return c.json(listRuns(db, { limit, cursor: String(offset) }).runs.map(withId));
+      const keys = db.select({ s: runs.sourceId, r: runs.runId }).from(runs).where(q.status === "running" ? isNull(runs.endedAt) : isNotNull(runs.endedAt))
+        .orderBy(desc(runs.startedAt)).limit(Math.min(limit, 200)).offset(offset).all();
+      return c.json(keys.flatMap((k) => { const d = runDetail(db, k.s, k.r); return d ? [withId(d)] : []; }));
+    },
+    "GET /api/v2/runs/{run_id}": (c) => {
+      const k = runKey(c.req.param("run_id") ?? "");
+      const d = k ? runDetail(db, k.source, k.run) : null;
+      return d ? c.json(withId(d)) : c.json({ detail: "Run not found" }, 404);
+    },
+    "GET /api/v2/runs/{run_id}/timeline": (c) => {
+      const k = runKey(c.req.param("run_id") ?? "");
+      const d = k ? runDetail(db, k.source, k.run) : null;
+      if (!k || !d) return c.json({ detail: "Run not found" }, 404);
+      return c.json({
+        run_id: `${k.source}:${k.run}`,
+        phases: d.stages.map((s) => ({ name: s.stage, status: s.status, started_at: s.started_at, ended_at: s.ended_at })),
+        current_phase: d.current_stage,
+        events: loadEvents(db, k.source, k.run).map((e) => ({ seq: e.seq, ts: e.ts, type: e.type, stage: e.stage })),
+      });
+    },
+    "GET /api/v2/audit": (c) => { const r = auditList(c); return r.err ?? c.json(r.rows); },
+    ...metricsMapped(opts.repoDir ?? process.cwd()),
+  };
+
+  // /lab/api/* is data, not a page: 501 JSON on every method (a 308 to the SPA would hand a client HTML). Registered before the /lab mount.
+  app.all("/lab/api/*", (c) => {
+    const d = denied(c);
+    if (d) return d;
+    return c.json({ error: NOT_SUPPORTED, detail: "The legacy dashboard route exists, but the Control Plane has no data or mechanism for it yet.", legacy_route: "/lab/api/*", method: c.req.method }, 501);
+  });
+
+  for (const r of LEGACY_ROUTES) {
+    // On the CP app itself "/" is the UI already; redirecting it would loop. Only a separately mounted shim (uiBase set) redirects it.
+    if (r.action === "308" && uiBase === "" && r.path === "/") continue;
+    const hp = toHono(r.path);
+    const handle = (c: Context): Response => {
+      if (!r.open) { const d = denied(c); if (d) return d; }
+      once(r);
+      const body = { legacy_route: r.path, method: r.method };
+      if (r.action === "map") return (mapped[`${r.method} ${r.path}`] as (c: Context) => Response)(c);
+      if (r.action === "308") return c.redirect(`${uiBase}/`, 308);
+      if (r.action === "410") return c.json({ error: "gone", detail: "This legacy dashboard route was retired; nothing consumes it.", ...body }, 410);
+      return c.json({ error: NOT_SUPPORTED, detail: "The legacy dashboard route exists, but the Control Plane has no data or mechanism for it yet.", ...body }, 501);
+    };
+    const m = r.method === "WS" || r.method === "MOUNT" ? "GET" : r.method;
+    app.on(m, hp, handle);
+    if (hp !== "/" && !hp.endsWith("}")) app.on(m, `${hp}/`, handle); // legacy stripped a trailing slash
+    if (r.method === "MOUNT") app.on(m, `${hp}/*`, handle);
+  }
+
+  // /v1/audit: the CP already stores the operator-action log; this exposes it (guarded by the /v1 bearer middleware and by the shim guard).
+  app.get("/v1/audit", (c) => {
+    const d = denied(c);
+    if (d) return d;
+    const r = auditList(c);
+    return r.err ?? c.json({ entries: r.rows, limit: r.limit, offset: r.offset });
+  });
+
+  // Unknown /api/* is a JSON 404 like legacy, never the SPA shell.
+  app.all("/api/*", (c) => { const d = denied(c); return d ?? c.json({ detail: "Not Found" }, 404); });
+
+  return app;
+}

package/packages/control-plane/src/server/repos.ts

@@ -0,0 +1,27 @@
+// local_repos: the server-side map from source_id to a real repo path. Filled only by local discovery (never by /v1/ingest);
+// the path never leaves the server. The API exposes display names only.
+import type { Hono } from "hono";
+import type { Db } from "../db/migrate.ts";
+import { localRepos } from "../db/schema.ts";
+import { discoverLocalRepos } from "../shipper/discover.ts";
+
+/** Upsert every locally discovered repo. Returns the number of repos known. */
+export function syncLocalRepos(db: Db, repoDir: string, env: NodeJS.ProcessEnv = process.env): number {
+  const now = new Date().toISOString();
+  const found = discoverLocalRepos(repoDir, env);
+  for (const r of found) {
+    db.insert(localRepos).values({ sourceId: r.sourceId, realpath: r.realpath, name: r.name, discoveredAt: now })
+      .onConflictDoUpdate({ target: localRepos.sourceId, set: { realpath: r.realpath, name: r.name } }).run();
+  }
+  return found.length;
+}
+
+/** Display names only, sorted and de-duplicated. */
+export function repoNames(db: Db): string[] {
+  return [...new Set(db.select({ name: localRepos.name }).from(localRepos).all().map((r) => r.name))].sort();
+}
+
+/** GET /v1/repos. `act` is the loopback-only router; `peerIsLoopback` checks the real socket address. */
+export function mountRepos(act: Hono, db: Db, peerIsLoopback: (c: Parameters<Parameters<Hono["get"]>[1]>[0]) => boolean): void {
+  act.get("/v1/repos", (c) => peerIsLoopback(c) ? c.json({ repos: repoNames(db) }) : c.json({ error: "loopback only" }, 403));
+}