loki-mode 11.12.1 → 11.17.1

package/autonomy/trigger-server.py

@@ -53,6 +53,7 @@ import signal
 import socket
 import socketserver
 import subprocess
+import tempfile
 import sys
 import threading
 import time
@@ -187,6 +188,74 @@ def valid_spec(spec):
     return True
 
 
+# M-23: POST /jobs kind "unit" (remote modernize unit). The schema is closed:
+# any field outside UNIT_JOB_FIELDS is rejected, so no credential, env var or
+# command can ride the payload. Credentials come from the worker's own secret
+# mount, never from the job. Every value is bounded and dash-leading values are
+# refused so none can be parsed as a CLI flag.
+UNIT_JOB_KIND = "unit"
+UNIT_JOB_FIELDS = frozenset(("kind", "repo", "ref", "unit", "mid", "target"))
+UNIT_JOB_REQUIRED = ("repo", "ref", "unit")
+UNIT_JOB_TARGETS = ("python3", "java21")
+MAX_UNIT_REPO_LEN = 140
+MAX_UNIT_REF_LEN = 200
+# fullmatch + explicit ASCII classes: "$" would accept a trailing newline and
+# "\d" would accept Unicode digits. Mirrors the TS REPO_RE/REF_RE/UNIT_RE/MID_RE.
+UNIT_REPO_RE = re.compile(r"[A-Za-z0-9._][A-Za-z0-9._-]*/[A-Za-z0-9._-]+", re.ASCII)
+UNIT_REF_RE = re.compile(r"[A-Za-z0-9._][A-Za-z0-9._/-]*", re.ASCII)
+UNIT_ID_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.-]{0,127}", re.ASCII)
+UNIT_MID_RE = re.compile(r"mod-[0-9]{8}T[0-9]{6}Z-[0-9a-f]{6}", re.ASCII)
+
+
+def validate_unit_job(payload):
+    """Strictly validate a kind "unit" payload.
+
+    Returns (clean_dict, None) or (None, error). The clean dict holds only
+    known string fields, so downstream code never sees anything else.
+    """
+    if not isinstance(payload, dict):
+        return None, "payload must be a JSON object"
+    unknown = sorted(str(k) for k in payload if k not in UNIT_JOB_FIELDS)
+    if unknown:
+        return None, "unknown field(s): %s" % ", ".join(k[:40] for k in unknown[:5])
+    for key in UNIT_JOB_REQUIRED:
+        if key not in payload:
+            return None, "missing field: %s" % key
+    for key, value in payload.items():
+        if not isinstance(value, str):
+            return None, "field %s must be a string" % key
+    repo, ref, unit = payload["repo"], payload["ref"], payload["unit"]
+    if (len(repo) > MAX_UNIT_REPO_LEN or not UNIT_REPO_RE.fullmatch(repo)
+            or any(seg in (".", "..") for seg in repo.split("/"))):
+        return None, "invalid repo"
+    if (not ref or len(ref) > MAX_UNIT_REF_LEN or not UNIT_REF_RE.fullmatch(ref)
+            or ".." in ref or ref.endswith((".lock", "/", "."))):
+        return None, "invalid ref"
+    if not UNIT_ID_RE.fullmatch(unit):
+        return None, "invalid unit"
+    clean = {"kind": UNIT_JOB_KIND, "repo": repo, "ref": ref, "unit": unit}
+    if "mid" in payload:
+        if not UNIT_MID_RE.fullmatch(payload["mid"]):
+            return None, "invalid mid"
+        clean["mid"] = payload["mid"]
+    if "target" in payload:
+        if payload["target"] not in UNIT_JOB_TARGETS:
+            return None, "invalid target"
+        clean["target"] = payload["target"]
+    return clean, None
+
+
+def unit_start_args(unit_job):
+    """argv for the modernize unit worker. One list, never a shell string."""
+    args = ["modernize", "unit", "--repo", unit_job["repo"],
+            "--ref", unit_job["ref"], "--unit", unit_job["unit"]]
+    if "mid" in unit_job:
+        args += ["--mid", unit_job["mid"]]
+    if "target" in unit_job:
+        args += ["--target", unit_job["target"]]
+    return args
+
+
 def constant_time_equals(a, b):
     """Constant-time string compare that never raises on odd input.
 
@@ -420,19 +489,25 @@ CHILD_ENV_DENYLIST = (
     "LINEAR_WEBHOOK_SECRET",
     "LINEAR_API_KEY",
     "JIRA_WEBHOOK_SECRET",
+    "JIRA_API_TOKEN",
     "TEAMS_SECURITY_TOKEN",
 )
 
 
-def _scoped_child_env():
-    return {k: v for k, v in os.environ.items() if k not in CHILD_ENV_DENYLIST}
+def _scoped_child_env(extra_env=None):
+    env = {k: v for k, v in os.environ.items() if k not in CHILD_ENV_DENYLIST}
+    # Caller values override inherited ones but can never restore a denied secret.
+    env.update({k: v for k, v in (extra_env or {}).items() if k not in CHILD_ENV_DENYLIST})
+    return env
 
 
-def run_loki_outcome(args, dry_run=False):
+def run_loki_outcome(args, dry_run=False, stdout_sink=None, extra_env=None):
     """Run a loki command and report WHICH of the three outcomes occurred.
 
     Returns one of OUTCOME_PASSED / OUTCOME_FAILED / OUTCOME_UNKNOWN. This is
     the honest version of run_loki_command, which answers only "did it launch".
+    When stdout_sink is a list, the decoded stdout is appended to it on completion.
+    extra_env adds child env vars (e.g. LOKI_STEER_SOURCE) on top of the scoped env.
     """
     cmd = ["loki"] + args
     if dry_run:
@@ -444,14 +519,16 @@ def run_loki_outcome(args, dry_run=False):
             cmd,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
-            env=_scoped_child_env(),
+            env=_scoped_child_env(extra_env),
         )
     except (FileNotFoundError, OSError) as e:
         logging.error("Failed to launch %s: %s", " ".join(cmd), e)
         return OUTCOME_FAILED
 
     try:
-        _, stderr = proc.communicate(timeout=DISPATCH_WAIT_SECONDS)
+        stdout, stderr = proc.communicate(timeout=DISPATCH_WAIT_SECONDS)
+        if stdout_sink is not None:
+            stdout_sink.append((stdout or b"").decode("utf-8", errors="replace"))
     except subprocess.TimeoutExpired:
         # Detached past the wait window. The reaper collects the child, but we
         # never see its exit code, so the outcome is genuinely UNKNOWN -- NOT a
@@ -485,7 +562,7 @@ def run_loki_outcome(args, dry_run=False):
     return OUTCOME_FAILED
 
 
-def run_loki_command(args, dry_run=False):
+def run_loki_command(args, dry_run=False, stdout_sink=None):
     """Run a loki command synchronously and reap it; or print it if dry_run.
 
     Returns True if the command was launched and exited 0 (or backgrounded
@@ -501,17 +578,163 @@ def run_loki_command(args, dry_run=False):
     passed wants run_loki_outcome instead. Behaviour is unchanged: a detached
     dispatch (UNKNOWN) still reads as True here, exactly as before.
     """
-    return run_loki_outcome(args, dry_run=dry_run) in (
+    return run_loki_outcome(args, dry_run=dry_run, stdout_sink=stdout_sink) in (
         OUTCOME_PASSED, OUTCOME_UNKNOWN,
     )
 
 
+TRUSTED_ASSOCIATIONS = ("OWNER", "MEMBER", "COLLABORATOR")  # same set as verify_pr.ts
+STEER_NOTE_MAX = 1000
+
+
+def _process_start_time(pid):
+    """`ps -o lstart=` for pid, whitespace-normalized like run_pid.ts processStartTime; None if gone."""
+    if not isinstance(pid, int) or pid <= 1:
+        return None
+    try:
+        out = subprocess.run(["ps", "-o", "lstart=", "-p", str(pid)], capture_output=True,
+                             text=True, timeout=5, env={**os.environ, "LC_ALL": "C"}).stdout
+    except (OSError, subprocess.SubprocessError):
+        return None
+    return " ".join(out.split()) or None
+
+
+def find_live_run(ref):
+    """Return the id of a live run for issue ref "owner/repo#N", else None.
+
+    Scans $LOKI_DIR (default .loki)/runs/*/events.jsonl for a run.started whose issue_ref matches and
+    whose run.pid names a live process. Mirrors runOwnerAlive: the recorded
+    start time and run_id must match, so a recycled pid does not read as live.
+    """
+    runs = Path(os.environ.get("LOKI_DIR") or ".loki") / "runs"
+    try:
+        dirs = sorted(runs.iterdir())
+    except OSError:
+        return None
+    for d in dirs:
+        try:
+            with open(d / "events.jsonl", "r", encoding="utf-8", errors="replace") as fh:
+                first = json.loads(fh.readline() or "{}")
+            if first.get("type") != "run.started" or (first.get("data") or {}).get("issue_ref") != ref:
+                continue
+            rec = json.loads((d / "run.pid").read_text())
+            pid = int(rec.get("pid", 0))
+            start = rec.get("start")
+            if pid > 1 and isinstance(start, str) and rec.get("run_id") == d.name \
+                    and _process_start_time(pid) == " ".join(start.split()):
+                return d.name
+        except (OSError, ValueError, TypeError, AttributeError):
+            continue
+    return None
+
+
+def steer_ack_text(rev):
+    """Ack line for a steer; byte-identical to the line `loki steer` prints (cmd_steer)."""
+    if rev is None:
+        return "Steer received: applies at next plan/implement stage."
+    return "Steer rev %s received: applies at next plan/implement stage." % rev
+
+
+STEER_ACK_MARKER = "<!-- loki-steer-ack -->"
+LOKI_COMMENT_MARKER = "<!-- loki-"  # any Loki-authored comment (status projector, steer ack) never steers
+
+
+def parse_steer_rev(stdout):
+    """Revision number from `loki steer` stdout (its ack line), else None. Never guesses."""
+    m = re.search(r"Steer rev (\d+) received", stdout or "") \
+        or re.search(r"Steering note \(rev (\d+)\)", stdout or "")
+    return int(m.group(1)) if m else None
+
+
+def post_steer_ack(ref, repo_full_name, rev, dry_run=False):
+    """Post one ack comment on the issue through engine10-push.sh issue-comment. Best effort."""
+    text = steer_ack_text(rev)
+    if dry_run:
+        logging.info("[DRY-RUN] Would ack %s: %s", ref, text)
+        return True
+    script = Path(__file__).resolve().parent / "lib" / "engine10-push.sh"
+    body = None
+    try:
+        fd, body = tempfile.mkstemp(prefix="loki-steer-ack.", suffix=".md")
+        with os.fdopen(fd, "w", encoding="utf-8") as fh:
+            fh.write(STEER_ACK_MARKER + "\n" + text + "\n")
+        env = _scoped_child_env()
+        env["_LOKI_ORIGIN_PINNED"] = "1"
+        env["_LOKI_PINNED_ORIGIN"] = "https://github.com/%s.git" % repo_full_name
+        proc = subprocess.run(["bash", str(script), "issue-comment", ref, body],
+                              capture_output=True, text=True, timeout=60, env=env)
+        if proc.returncode != 0:
+            logging.error("steer ack failed (%d): %s", proc.returncode, proc.stderr.strip())
+        return proc.returncode == 0
+    except (OSError, subprocess.SubprocessError) as e:
+        logging.error("steer ack failed: %s", e)
+        return False
+    finally:
+        if body:
+            try:
+                os.unlink(body)
+            except OSError:
+                pass
+
+
+def handle_issue_comment_event(payload, dry_run=False):
+    """Handle issue_comment: an authorized new comment steers the issue's live run."""
+    action = payload.get("action", "")
+    if action != "created":
+        return None, "skipped (action=%s)" % action
+    comment = payload.get("comment") or {}
+    if comment.get("author_association") not in TRUSTED_ASSOCIATIONS:
+        return None, "skipped (comment author not authorized)"
+    user = comment.get("user") or {}
+    login = str(user.get("login", ""))
+    if user.get("type") == "Bot" or login.endswith("[bot]"):
+        return None, "skipped (bot comment)"
+    if LOKI_COMMENT_MARKER in str(comment.get("body", "")):
+        return None, "skipped (loki-authored comment)"
+    number = (payload.get("issue") or {}).get("number")
+    repo_full_name = (payload.get("repository") or {}).get("full_name", "")
+    if number is None or not valid_issue_number(number):
+        return None, "rejected (invalid issue number)"
+    if not valid_repo_full_name(repo_full_name):
+        return None, "rejected (invalid repository full_name)"
+    ref = "%s#%s" % (repo_full_name, number)
+    if find_live_run(ref) is None:
+        return None, "skipped (no live run for %s)" % ref
+    body = re.sub(r"[\x00-\x1f\x7f\s]+", " ", str(comment.get("body", ""))).strip()[:STEER_NOTE_MAX]
+    if not body:
+        return None, "skipped (empty comment)"
+    login = re.sub(r"[^A-Za-z0-9-]", "", login)[:39]
+    note = "GitHub comment from %s: %s" % (login or "unknown", body)
+    summary = "steer %s from comment" % ref
+    sink = []
+    # Provenance for the revision log: loki steer records actor= and source= per revision.
+    steer_env = {"LOKI_STEER_SOURCE": "github", "LOKI_STEER_ACTOR": login or "unknown"}
+    outcome = run_loki_outcome(["steer", note], dry_run=dry_run, stdout_sink=sink, extra_env=steer_env)
+    # Only a confirmed exit 0 proves the steer was written. A detached child
+    # (UNKNOWN) never reports its exit code, so acking would claim an unverified
+    # steer; report it as launched but post nothing.
+    if outcome == OUTCOME_UNKNOWN:
+        send_notification("Trigger fired: %s" % summary)
+        return summary, OUTCOME_UNKNOWN
+    success = outcome == OUTCOME_PASSED
+    if success:
+        send_notification("Trigger fired: %s" % summary)
+        rev = parse_steer_rev("".join(sink))
+        injection_off = os.environ.get("LOKI_PROMPT_INJECTION", "").lower() in ("0", "false")
+        if not injection_off:
+            post_steer_ack(ref, repo_full_name, rev, dry_run=dry_run)
+    return summary, "fired" if success else "error"
+
+
 def handle_issues_event(payload, dry_run=False):
     """Handle issues event: opened -> loki start <issue-ref> --pr --detach."""
     action = payload.get("action", "")
     if action != "opened":
         return None, "skipped (action=%s)" % action
     issue = payload.get("issue", {})
+    if (issue.get("author_association") not in TRUSTED_ASSOCIATIONS
+            and os.environ.get("LOKI_TRIGGER_ALLOW_ANY_ISSUE_AUTHOR", "") not in ("1", "true")):
+        return None, "skipped (issue author not authorized)"
     issue_number = issue.get("number")
     repo = payload.get("repository", {})
     repo_full_name = repo.get("full_name", "")
@@ -605,8 +828,15 @@ def handle_job_event(payload, dry_run=False):
     spec = payload.get("spec")
     if not valid_spec(spec):
         return None, "rejected (invalid spec)"
+    unit_job = payload.get("unit_job")
+    if unit_job is not None:
+        # Re-validated here so the handler is safe no matter who calls it.
+        clean, _err = validate_unit_job(unit_job)
+        if clean is None:
+            return None, "rejected (invalid unit job)"
+        args = unit_start_args(clean)
     # Jira/Teams delegation sets pr=True: receipt-gated PR run, never a deploy.
-    if payload.get("pr") is True:
+    elif payload.get("pr") is True:
         args = brief_start_args(spec.strip())
     else:
         args = ["start", spec.strip(), "--detach"]
@@ -878,32 +1108,61 @@ def _post_json(url, data, headers):
         resp.read()
 
 
+def _notify_slack(target, text):
+    url = target.get("response_url", "")
+    if not (isinstance(url, str) and url.startswith(SLACK_REPLY_PREFIX)):
+        return
+    _post_json(url, {"response_type": "in_channel", "text": text}, {})
+
+
+def _notify_linear(target, text):
+    key = os.environ.get("LINEAR_API_KEY", "")
+    issue_id = target.get("issue_id", "")
+    if not key or not isinstance(issue_id, str) or not issue_id:
+        return
+    _post_json(LINEAR_API_URL, {
+        "query": "mutation($i:String!,$b:String!){commentCreate(input:"
+                 "{issueId:$i,body:$b}){success}}",
+        "variables": {"i": issue_id, "b": text},
+    }, {"Authorization": key})
+
+
+def _notify_jira(target, text):
+    """ADF comment on the issue. Site and credentials come from the operator's
+    env only (never the payload); a non-https base URL is never contacted."""
+    base = os.environ.get("JIRA_BASE_URL", "").rstrip("/")
+    email = os.environ.get("JIRA_EMAIL", "")
+    token = os.environ.get("JIRA_API_TOKEN", "")
+    key = target.get("key", "")
+    if not (base.startswith("https://") and email and token
+            and isinstance(key, str) and JIRA_KEY_RE.match(key)):
+        return
+    auth = base64.b64encode(("%s:%s" % (email, token)).encode("utf-8")).decode("ascii")
+    _post_json("%s/rest/api/3/issue/%s/comment" % (base, key), {
+        "body": {"type": "doc", "version": 1, "content": [
+            {"type": "paragraph", "content": [{"type": "text", "text": text}]}]},
+    }, {"Authorization": "Basic " + auth})
+
+
+# Reply-target kind -> notifier. Sentry has no entry on purpose: it never replies.
+NOTIFIERS = {"slack": _notify_slack, "linear": _notify_linear, "jira": _notify_jira}
+
+
 def notify_job_complete(target, job_id, status, summary):
     """Send a completion summary to a reply target captured after verification.
 
-    Never raises: a notifier failure must not fail the job. The Slack URL is
-    re-checked here as defense in depth.
+    Never raises: a notifier failure must not fail the job. Each notifier
+    re-checks its own destination as defense in depth.
     """
     if not isinstance(target, dict):
         return
+    notifier = NOTIFIERS.get(target.get("kind"))
+    if notifier is None:
+        return
     text = ("loki job %s finished: %s. %s" % (job_id, status, summary or "")).strip()
     text = CONTROL_CHARS_RE.sub(" ", text)[:NOTIFY_TEXT_MAX]
     try:
-        if target.get("kind") == "slack":
-            url = target.get("response_url", "")
-            if not (isinstance(url, str) and url.startswith(SLACK_REPLY_PREFIX)):
-                return
-            _post_json(url, {"response_type": "in_channel", "text": text}, {})
-        elif target.get("kind") == "linear":
-            key = os.environ.get("LINEAR_API_KEY", "")
-            issue_id = target.get("issue_id", "")
-            if not key or not isinstance(issue_id, str) or not issue_id:
-                return
-            _post_json(LINEAR_API_URL, {
-                "query": "mutation($i:String!,$b:String!){commentCreate(input:"
-                         "{issueId:$i,body:$b}){success}}",
-                "variables": {"i": issue_id, "b": text},
-            }, {"Authorization": key})
+        notifier(target, text)
     except Exception as e:  # notifier errors never fail a job
         logging.warning("Completion notify for job %s failed: %s", job_id, e)
 
@@ -941,7 +1200,64 @@ def normalize_sentry_payload(payload):
     return out if isinstance(out, dict) else None
 
 
-def build_sentry_brief(norm):
+def _clip(value, limit=80):
+    """Single-line, control-char-free, length-capped untrusted text."""
+    text = " ".join(CONTROL_CHARS_RE.sub(" ", str(value or "")).split())
+    return text.encode("utf-8")[:limit].decode("utf-8", errors="ignore")
+
+
+def _sentry_release_env(payload):
+    ev = ((payload or {}).get("data") or {}).get("event")
+    ev = ev if isinstance(ev, dict) else {}
+    release = ev.get("release")
+    if isinstance(release, dict):
+        release = release.get("version")
+    return _clip(release), _clip(ev.get("environment"), 40)
+
+
+def _last_deploy_context():
+    """'last deploy <sha7> <finished_at> health=<status>' from the newest
+    .loki/deploys record in the server's project dir, or ''."""
+    try:
+        ddir = os.path.join(os.getcwd(), ".loki", "deploys")
+        names = sorted(n for n in os.listdir(ddir) if n.endswith(".json"))
+        if not names:
+            return ""
+        with open(os.path.join(ddir, names[-1]), "r", encoding="utf-8") as fh:
+            rec = json.load(fh)
+    except (OSError, ValueError):
+        return ""
+    if not isinstance(rec, dict) or not rec.get("head_sha"):
+        return ""
+    return "last deploy %s %s health=%s" % (
+        _clip(rec.get("head_sha"), 7), _clip(rec.get("finished_at"), 30),
+        _clip(rec.get("health_status") or "unchecked", 20))
+
+
+def _culprit_owner(culprit):
+    """'last change to <file> by <author> <sha7>' via read-only git log -1, or ''."""
+    token = culprit.split(" ", 1)[0] if culprit else ""
+    if not token or token.startswith("-") or ".." in token:
+        return ""
+    root = os.path.realpath(os.getcwd())
+    full = os.path.realpath(os.path.join(root, token))
+    if not full.startswith(root + os.sep) or not os.path.isfile(full):
+        return ""
+    try:
+        proc = subprocess.run(
+            ["git", "-C", root, "log", "-1", "--format=%an|%h", "--", full],
+            capture_output=True, timeout=5,
+            env={"PATH": os.environ.get("PATH", "/usr/bin:/bin")})
+    except (OSError, subprocess.SubprocessError):
+        return ""
+    out = proc.stdout.decode("utf-8", errors="replace").strip()
+    if proc.returncode != 0 or "|" not in out:
+        return ""
+    author, sha = out.rsplit("|", 1)
+    return "last change to %s by %s %s" % (_clip(token, 60), _clip(author, 40), _clip(sha, 12))
+
+
+def build_sentry_brief(norm, payload=None):
     """One-line, control-char-free brief that can never parse as a CLI flag."""
     culprit = ""
     for line in str(norm.get("body", "")).splitlines():
@@ -951,6 +1267,17 @@ def build_sentry_brief(norm):
     parts = ["Fix Sentry issue %s: %s" % (norm.get("number", "?"), norm.get("title", ""))]
     if culprit:
         parts.append("(culprit %s)" % culprit)
+    release, env_name = _sentry_release_env(payload)
+    ctx = []
+    if release:
+        ctx.append("release %s" % release)
+    if env_name:
+        ctx.append("env %s" % env_name)
+    for extra in (_last_deploy_context(), _culprit_owner(culprit)):
+        if extra:
+            ctx.append(extra)
+    if ctx:
+        parts.append("[%s]" % "; ".join(ctx))
     if norm.get("url"):
         parts.append("See %s." % norm["url"])
     parts.append("Reproduce with a regression test, then fix the root cause.")
@@ -971,7 +1298,7 @@ def handle_sentry_event(payload, dry_run=False):
     norm = normalize_sentry_payload(payload)
     if norm is None:
         return None, "rejected (unparseable sentry payload)"
-    brief = build_sentry_brief(norm)
+    brief = build_sentry_brief(norm, payload)
     if not valid_spec(brief):
         return None, "rejected (invalid brief)"
     args = brief_start_args(brief)
@@ -988,6 +1315,7 @@ def handle_sentry_event(payload, dry_run=False):
 # explicitly refused on the /webhook path.
 EVENT_HANDLERS = {
     "issues": handle_issues_event,
+    "issue_comment": handle_issue_comment_event,
     "pull_request": handle_pull_request_event,
     "workflow_run": handle_workflow_run_event,
     JOB_EVENT: handle_job_event,
@@ -1053,6 +1381,8 @@ class Dispatcher:
         self._dedup_max = max(1, dedup_size)
         self._seen_deliveries = collections.OrderedDict()
         self._dedup_lock = threading.Lock()
+        self._seen_path = get_loki_dir() / "seen-deliveries.jsonl"
+        self._load_seen()
         self._threads = []
         self._stop = threading.Event()
         for i in range(max(1, workers)):
@@ -1064,6 +1394,64 @@ class Dispatcher:
             t.start()
             self._threads.append(t)
 
+    def _load_seen(self):
+        """Reload the last dedup_max accepted keys so a restart keeps dedup."""
+        try:
+            lines = self._seen_path.read_text(encoding="utf-8").splitlines()
+        except OSError:
+            return
+        keys = []
+        for line in lines:
+            try:
+                k = json.loads(line).get("k")
+            except (ValueError, AttributeError):
+                continue
+            if isinstance(k, str) and k:
+                keys.append(k)
+        keys = keys[-self._dedup_max:]
+        for k in keys:
+            self._seen_deliveries[k] = True
+        if len(lines) > 2 * self._dedup_max:
+            try:
+                self._seen_path.write_text(
+                    "".join(json.dumps({"k": k}) + "\n" for k in keys), encoding="utf-8")
+            except OSError:
+                pass
+
+    def _remember(self, key):
+        """Record key (caller holds _dedup_lock); append to the JSONL, best effort."""
+        self._seen_deliveries[key] = True
+        while len(self._seen_deliveries) > self._dedup_max:
+            self._seen_deliveries.popitem(last=False)
+        try:
+            with open(self._seen_path, "a", encoding="utf-8") as fh:
+                fh.write(json.dumps({"k": key}) + "\n")
+        except OSError:
+            pass
+
+    def seen_intake(self, event_type, payload):
+        """True if the same repo#N + action + head sha was accepted and its run is live.
+
+        Catches a redelivery under a new delivery id or after a restart. Once the
+        run is no longer live the same key may dispatch again. Only issues and
+        pull_request events carry an intake key.
+        """
+        if event_type not in ("issues", "pull_request"):
+            return False
+        number = (payload.get("issue") or payload.get("pull_request") or {}).get("number")
+        repo = (payload.get("repository") or {}).get("full_name", "")
+        if number is None or not repo:
+            return False
+        sha = ((payload.get("pull_request") or {}).get("head") or {}).get("sha", "")
+        key = "intake:%s:%s#%s:%s:%s" % (event_type, repo, number, payload.get("action", ""), sha)
+        ref = "%s#%s" % (repo, number)
+        with self._dedup_lock:
+            if key in self._seen_deliveries and find_live_run(ref) is not None:
+                return True
+            if key not in self._seen_deliveries:
+                self._remember(key)
+            return False
+
     def seen_delivery(self, delivery_id):
         """Return True if this delivery_id was already accepted (idempotency).
 
@@ -1082,9 +1470,7 @@ class Dispatcher:
                 # Insertion order is the eviction policy; duplicates leave it
                 # unchanged.
                 return True
-            self._seen_deliveries[delivery_id] = True
-            while len(self._seen_deliveries) > self._dedup_max:
-                self._seen_deliveries.popitem(last=False)
+            self._remember(delivery_id)
             return False
 
     def _begin_proof_window(self, job_id=None):
@@ -1585,6 +1971,10 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
             self._send_json(400, {"error": "payload must be a JSON object"})
             return
 
+        if payload.get("kind") == UNIT_JOB_KIND:
+            self._handle_unit_submit(payload)
+            return
+
         spec = payload.get("spec")
         if not valid_spec(spec):
             log_event(JOB_EVENT, "", "", "rejected (invalid spec)")
@@ -1596,7 +1986,24 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
             return
         self._send_json(202, {"id": job_id, "status": "queued"})
 
-    def _enqueue_job(self, spec, reply_target=None, pr=False):
+    def _handle_unit_submit(self, payload):
+        """POST /jobs {"kind": "unit", ...}; caller already authenticated."""
+        clean, err = validate_unit_job(payload)
+        if clean is None:
+            log_event(JOB_EVENT, "", "", "rejected (invalid unit job)")
+            self._send_json(400, {"error": err})
+            return
+        summary = "unit:%s@%s:%s" % (clean["repo"], clean["ref"], clean["unit"])
+        if not valid_spec(summary):
+            log_event(JOB_EVENT, "", "", "rejected (invalid unit job)")
+            self._send_json(400, {"error": "invalid unit job"})
+            return
+        job_id = self._enqueue_job(summary, unit_job=clean)
+        if job_id is None:
+            return
+        self._send_json(202, {"id": job_id, "status": "queued"})
+
+    def _enqueue_job(self, spec, reply_target=None, pr=False, unit_job=None):
         """Record and enqueue one validated job; shared by /jobs, /slack, /linear.
 
         Returns the job id, or None after sending 429 when the queue is full.
@@ -1606,6 +2013,8 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
         job = {"spec": spec, "job_id": job_id}
         if pr:
             job["pr"] = True
+        if unit_job is not None:
+            job["unit_job"] = unit_job
 
         # Record BEFORE enqueueing. A worker can pick the job up the instant
         # submit() returns and write "running"/"fired"; record_job is
@@ -1662,6 +2071,13 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
             self._send_json(400, {"error": "unsupported slack payload"})
             return
         form = urllib.parse.parse_qs(body.decode("utf-8", errors="replace"))
+        allowed = {u.strip() for u in os.environ.get("LOKI_SLACK_ALLOWED_USERS", "").split(",") if u.strip()}
+        user_id = (form.get("user_id") or [""])[0]
+        if "*" not in allowed and user_id not in allowed:
+            log_event(JOB_EVENT, "", "", "rejected (slack user not allowed)")
+            self._send_json(200, {"response_type": "ephemeral",
+                                  "text": "You are not allowed to start runs from Slack."})
+            return
         text = (form.get("text") or [""])[0]
         if not valid_spec(text):
             log_event(JOB_EVENT, "", "", "rejected (invalid slack spec)")
@@ -1777,7 +2193,7 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
         if dup_id or dup_body:
             self._send_json(200, {"status": "duplicate"})
             return
-        job_id = self._enqueue_job(brief, pr=True)
+        job_id = self._enqueue_job(brief, {"kind": "jira", "key": key}, pr=True)
         if job_id is None:
             return
         self._send_json(202, {"id": job_id, "status": "queued"})
@@ -1962,6 +2378,14 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
             )
             return
 
+        if self.dispatcher.seen_intake(event_type, payload):
+            log_event(event_type, action, "", "duplicate (live run for same intake key)")
+            self._send_json(
+                200,
+                {"event": event_type, "action": action, "status": "duplicate"},
+            )
+            return
+
         # Hand off to the bounded worker queue so the listener never blocks.
         accepted = self.dispatcher.submit(event_type, payload)
         if not accepted:
@@ -2139,6 +2563,11 @@ def main():
             "No Slack signing secret configured: POST /slack is rejected with "
             "503. Set SLACK_SIGNING_SECRET."
         )
+    elif not os.environ.get("LOKI_SLACK_ALLOWED_USERS", "").strip():
+        logging.warning(
+            "LOKI_SLACK_ALLOWED_USERS is not set: every /slack command is "
+            "rejected. Set Slack user IDs, or * to allow anyone."
+        )
     if not linear_secret:
         logging.warning(
             "No Linear webhook secret configured: POST /linear is rejected with "