loki-mode 11.17.39 → 11.17.41

package/packages/control-plane/dist/server.js

@@ -135,7 +135,7 @@ var init_events = __esm(() => {
 });
 
 // ../../loki-ts/src/util/redact.ts
-var RULES, redactSecrets = (s) => RULES.reduce((a, [re, to]) => a.replace(re, to), s);
+var RULES, QUERY_SEGMENT, SECRET_PARAM, redactQuery = (s) => s.replace(QUERY_SEGMENT, (q) => q.replace(SECRET_PARAM, "$1[REDACTED]")), redactSecrets = (s) => redactQuery(RULES.reduce((a, [re, to]) => a.replace(re, to), s));
 var init_redact = __esm(() => {
   RULES = [
     [/sk-ant-[A-Za-z0-9_-]{20,}/g, "[REDACTED:ANTHROPIC_KEY]"],
@@ -145,11 +145,18 @@ var init_redact = __esm(() => {
     [/AKIA[0-9A-Z]{16}/g, "[REDACTED:AWS_KEY]"],
     [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[REDACTED:JWT]"],
     [/AI[a-zA-Z0-9_-]{30,}/g, "[REDACTED:GOOGLE_KEY]"],
+    [/glpat-[A-Za-z0-9_-]{20,}/g, "[REDACTED:GITLAB_TOKEN]"],
+    [/npm_[A-Za-z0-9]{36}/g, "[REDACTED:NPM_TOKEN]"],
+    [/hf_[A-Za-z0-9]{30,}/g, "[REDACTED:HF_TOKEN]"],
+    [/[sr]k_live_[A-Za-z0-9]{16,}/g, "[REDACTED:STRIPE_KEY]"],
+    [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, "[REDACTED:PRIVATE_KEY]"],
     [/sk-[A-Za-z0-9_-]{20,}/g, "[REDACTED:OPENAI_KEY]"],
     [/(Bearer\s+)[A-Za-z0-9._~+/=-]{20,}/g, "$1[REDACTED]"],
     [/(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/?#@]+@/gi, "$1[REDACTED]@"],
     [/(\bAuthorization\s*[:=]\s*)(?:Basic|Bearer|Token|Digest)?\s*[^\s,;"']+/gi, "$1[REDACTED]"]
   ];
+  QUERY_SEGMENT = /\?[^\s#"'<>]+/g;
+  SECRET_PARAM = /([?&](?:access_token|token|api_key|apikey|password|secret|sig)=)[^&\s#"']*/gi;
 });
 
 // ../../loki-ts/src/util/credential_env.ts
@@ -10018,7 +10025,41 @@ function summaryOf(a) {
 }
 function markExecuted(a, executed) {
   const checks_deferred = deferredOf(a.tier, a.checks_selected, executed);
-  return { ...a, checks_deferred, summary: summaryOf({ ...a, checks_deferred }) };
+  return { ...a, checks_deferred, summary: summaryOf({ ...a, checks_deferred }) + (a.advisories?.length ? `; advisory: ${a.advisories.join(", ")}` : "") };
+}
+function manifestDepsChanged(path, oldText, newText, patch) {
+  if (/(^|\/)package\.json$/.test(path)) {
+    try {
+      const o = oldText.trim() ? JSON.parse(oldText) : {}, n2 = newText.trim() ? JSON.parse(newText) : {};
+      return PKG_DEP_KEYS.some((k) => JSON.stringify(o?.[k] ?? {}) !== JSON.stringify(n2?.[k] ?? {}));
+    } catch {
+      return true;
+    }
+  }
+  const changed = patch.split(`
+`).filter((l) => /^[+-]/.test(l) && !/^(\+\+\+|---)/.test(l));
+  if (/(^|\/)go\.mod$/.test(path))
+    return changed.some((l) => {
+      const b = l.slice(1).trim();
+      return b !== "" && !b.startsWith("//") && !/^(module|go|toolchain)\b/.test(b);
+    });
+  return changed.some((l) => {
+    const b = l.slice(1).trim();
+    if (/^"[A-Za-z][\w.-]*(\[[\w,.-]+\])?\s*([<>=~!]|;|@|"\s*,?\s*$)/.test(b))
+      return true;
+    const m = /^([A-Za-z][\w.-]*)\s*=\s*("[\^~<>=!*\d]|\{[^}]*version)/.exec(b);
+    return !!m && !PYPROJECT_NONDEP.test(m[1]);
+  });
+}
+function manifestsWithoutLock(files) {
+  return files.filter((f) => f.deps && f.status !== "deleted").flatMap((f) => {
+    const pair = MANIFEST_LOCKS.find(([m]) => m.test(f.path));
+    if (!pair)
+      return [];
+    const d = dirOf(f.path);
+    const locked = files.some((g) => pair[1].test(g.path) && (dirOf(g.path) === "" || d === dirOf(g.path) || d.startsWith(dirOf(g.path) + "/")));
+    return locked ? [] : [f.path];
+  });
 }
 function classifyRisk(files, env = process.env) {
   const lines = files.reduce((n2, f) => n2 + f.added + f.deleted, 0);
@@ -10063,7 +10104,8 @@ function classifyRisk(files, env = process.env) {
       ignored = `LOKI_RISK_TIER=${asked} ignored: lowering from ${computed} needs LOKI_RISK_OVERRIDE_REASON`;
   }
   const plan = PLAN[tier], checks_deferred = deferredOf(tier, plan.selected, []);
-  const summary = summaryOf({ tier, computed, reasons, ...override ? { override } : {}, checks_deferred });
+  const advisories = manifestsWithoutLock(files).map((p) => `manifest changed without lockfile: ${p}`);
+  const summary = summaryOf({ tier, computed, reasons, ...override ? { override } : {}, checks_deferred }) + (advisories.length ? `; advisory: ${advisories.join(", ")}` : "");
   return {
     version: 1,
     tier,
@@ -10074,6 +10116,7 @@ function classifyRisk(files, env = process.env) {
     checks_deferred,
     ...override ? { override } : {},
     ...ignored ? { override_ignored: ignored } : {},
+    ...advisories.length ? { advisories } : {},
     summary
   };
 }
@@ -10098,7 +10141,7 @@ function diffFiles(repoDir, baseSha) {
     if (f)
       f.status = s?.startsWith("A") ? "added" : s?.startsWith("D") ? "deleted" : "modified";
   }
-  return paths.map((path) => {
+  const out2 = paths.map((path) => {
     const f = stat.get(path);
     if (f)
       return f;
@@ -10109,6 +10152,20 @@ function diffFiles(repoDir, baseSha) {
     } catch {}
     return { path, added: n2, deleted: 0, status: "added" };
   });
+  for (const f of out2) {
+    if (f.status === "deleted" || !MANIFEST_LOCKS.some(([m]) => m.test(f.path)))
+      continue;
+    try {
+      const oldText = f.status === "added" ? "" : safeGit(repoDir, ["show", `${baseSha}:${f.path}`]);
+      const newText = readFileSync29(join38(repoDir, f.path), "utf8");
+      const patch = f.status === "added" ? newText.split(`
+`).map((l) => `+${l}`).join(`
+`) : safeGit(repoDir, ["diff", "-U0", baseSha, "--", f.path]);
+      if (manifestDepsChanged(f.path, oldText, newText, patch))
+        f.deps = true;
+    } catch {}
+  }
+  return out2;
 }
 function recordRisk(repoDir, a) {
   try {
@@ -10251,7 +10308,7 @@ function classify(f, status, output, repoDir, interpreter) {
 }
 var NO_TESTS_REASON = "no tests executed", GO_EXIT0_REASON = "test count could not be confirmed: go test output is produced by the code under test and cannot confirm execution (a Go exit 0 is never a pass)", UNCONFIRMED_REASON = "test count could not be confirmed", FAIL_EVIDENCE, GO_FAIL_EVIDENCE, UNMEASURED_REASON = "executed count unmeasured (Loki could not parse the runner summary, harness-owned)", stripAnsi = (s) => s.replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, "").replace(/(?:\u001b\[|\u009b)[0-9;?]*[ -\/]*[@-~]/g, "").replace(/\r\n?/g, `
 `), tailLines = (out2) => out2.split(`
-`).filter((x) => x.trim()).slice(-12), GO_PKG_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, normPath = (p) => p.replace(/^(?:\.\/)+/, ""), hasExogenousProof = (checks, ctx) => checks.some((c) => isExecutedProof(c) && ((p) => p !== "agent_authored" && p !== "llm_judge")(checkProvenance(c.name ?? "", ctx))), SENSITIVE, API, TEST_CFG, RANK2, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), EXCERPT_GROUP_CAP = 1500, EXCERPT_TOTAL_CAP = 6144;
+`).filter((x) => x.trim()).slice(-12), GO_PKG_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, normPath = (p) => p.replace(/^(?:\.\/)+/, ""), hasExogenousProof = (checks, ctx) => checks.some((c) => isExecutedProof(c) && ((p) => p !== "agent_authored" && p !== "llm_judge")(checkProvenance(c.name ?? "", ctx))), SENSITIVE, API, TEST_CFG, RANK2, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), MANIFEST_LOCKS, dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", PKG_DEP_KEYS, PYPROJECT_NONDEP, EXCERPT_GROUP_CAP = 1500, EXCERPT_TOTAL_CAP = 6144;
 var init_check_result = __esm(() => {
   init_testmap();
   init_safe_git();
@@ -10281,6 +10338,13 @@ var init_check_result = __esm(() => {
     high: { selected: [...RAN_ALWAYS, "full test command", "full suite", "council", "security scan"] }
   };
   LOW_SKIPPED = ["full test command", "reviewer", "council", "security scan"];
+  MANIFEST_LOCKS = [
+    [/(^|\/)package\.json$/, /(^|\/)(package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?)$/],
+    [/(^|\/)pyproject\.toml$/, /(^|\/)(poetry\.lock|uv\.lock|pdm\.lock|Pipfile\.lock)$/],
+    [/(^|\/)go\.mod$/, /(^|\/)go\.sum$/]
+  ];
+  PKG_DEP_KEYS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
+  PYPROJECT_NONDEP = /^(name|version|description|readme|license|requires-python|python|authors|maintainers|keywords|classifiers|homepage|repository|documentation|packages|include|exclude)$/;
 });
 
 // ../../loki-ts/src/runner/state.ts
@@ -10301,8 +10365,45 @@ var init_state = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/repo_profile.ts
-import { existsSync as existsSync24, readFileSync as readFileSync30, mkdirSync as mkdirSync14, readdirSync as readdirSync14, renameSync as renameSync9, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync24, lstatSync as lstatSync9, readFileSync as readFileSync30, mkdirSync as mkdirSync14, readdirSync as readdirSync14, renameSync as renameSync9, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "fs";
 import { basename as basename12, join as join39, resolve as resolve13, isAbsolute as isAbsolute4 } from "path";
+function detectFormatters(repoDir) {
+  const out2 = [];
+  const has = (...fs2) => fs2.some((f) => existsSync24(join39(repoDir, f)));
+  const pp = read(join39(repoDir, "pyproject.toml")), pj = read(join39(repoDir, "package.json"));
+  if (/\[tool\.ruff/.test(pp) || has("ruff.toml", ".ruff.toml"))
+    out2.push({ tool: "ruff", argv: ["ruff", "format"], exts: /\.pyi?$/ });
+  let prettierKey = false;
+  try {
+    prettierKey = pj !== "" && "prettier" in JSON.parse(pj);
+  } catch {}
+  const local = join39(repoDir, "node_modules", ".bin", "prettier");
+  if ((prettierKey || readdirSync14(repoDir).some((f) => /^(\.prettierrc(\.[a-z0-9]+)?|prettier\.config\.[cm]?[jt]s)$/.test(f))) && existsSync24(local))
+    out2.push({ tool: "prettier", argv: [local, "--write"], exts: /\.(?:[cm]?[jt]sx?|json|css|scss|md|ya?ml|html)$/ });
+  if (has("go.mod"))
+    out2.push({ tool: "gofmt", argv: ["gofmt", "-w"], exts: /\.go$/ });
+  if (has("rustfmt.toml", ".rustfmt.toml")) {
+    const ed = /^\s*edition\s*=\s*"(\d+)"/m.exec(read(join39(repoDir, "Cargo.toml")))?.[1];
+    out2.push({ tool: "rustfmt", argv: ["rustfmt", ...ed ? ["--edition", ed] : []], exts: /\.rs$/ });
+  }
+  return out2;
+}
+function runFormatters(repoDir, files, env) {
+  const fmts = detectFormatters(repoDir);
+  const mine = fmts.length ? files.filter((f) => {
+    try {
+      return lstatSync9(join39(repoDir, f)).isFile();
+    } catch {
+      return false;
+    }
+  }) : [];
+  return fmts.flatMap((fm) => {
+    const own = mine.filter((f) => fm.exts.test(f));
+    const r = own.length ? spawnSync2(fm.argv[0], [...fm.argv.slice(1), ...own.map((f) => `./${f}`)], { cwd: repoDir, env, stdio: "ignore", timeout: 30000 }) : null;
+    return r && !r.error && r.status === 0 ? own : [];
+  });
+}
 function loadProfile(repoDir) {
   try {
     const p = JSON.parse(readFileSync30(commandProfilePath(repoDir), "utf8"));
@@ -10396,7 +10497,13 @@ async function staticPreExisting(tool, prefix, files, io) {
   }
   return attributeStatic(tool, head.out, baseOut, 1).preExisting;
 }
-var commandProfilePath = (repoDir) => join39(repoDir, ".loki", "state", "repo-profile.json"), STATIC_DIAG, STATIC_NOISE, STATIC_SUMMARY;
+var commandProfilePath = (repoDir) => join39(repoDir, ".loki", "state", "repo-profile.json"), read = (p) => {
+  try {
+    return readFileSync30(p, "utf8");
+  } catch {
+    return "";
+  }
+}, STATIC_DIAG, STATIC_NOISE, STATIC_SUMMARY;
 var init_repo_profile = __esm(() => {
   init_failures();
   init_check_result();
@@ -10438,7 +10545,7 @@ var init_context = __esm(() => {
 });
 
 // ../../loki-ts/src/util/steer.ts
-import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync15, lstatSync as lstatSync9, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync31, readSync as readSync7, renameSync as renameSync10, statSync as statSync15, lutimesSync, rmSync as rmSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync18, existsSync as existsSync25 } from "fs";
+import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync15, lstatSync as lstatSync10, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync31, readSync as readSync7, renameSync as renameSync10, statSync as statSync15, lutimesSync, rmSync as rmSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync18, existsSync as existsSync25 } from "fs";
 import { createHash as createHash9, randomBytes as randomBytes4 } from "crypto";
 import { basename as basename13, join as join40 } from "path";
 function archiveTo(logs, prefix, src, link = linkSync2, onLinked) {
@@ -10465,7 +10572,7 @@ function archiveTo(logs, prefix, src, link = linkSync2, onLinked) {
   }
 }
 function orphanAlreadyArchived(logs, claim) {
-  const c = lstatSync9(claim);
+  const c = lstatSync10(claim);
   if (!c.isFile())
     return false;
   for (const a of readdirSync15(logs)) {
@@ -10567,7 +10674,7 @@ function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, h
       hooks2?.beforeRestore?.();
       let restored = false;
       try {
-        if (lstatSync9(claimed).isDirectory())
+        if (lstatSync10(claimed).isDirectory())
           renameSync10(claimed, f);
         else
           (hooks2?.link ?? linkSync2)(claimed, f);
@@ -10576,7 +10683,7 @@ function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, h
       if (!restored)
         return reject("NOTFILE", "not a regular file");
       try {
-        if (!lstatSync9(claimed, { throwIfNoEntry: false })?.isDirectory())
+        if (!lstatSync10(claimed, { throwIfNoEntry: false })?.isDirectory())
           unlinkSync5(claimed);
       } catch {}
       claimed = "";
@@ -10586,7 +10693,7 @@ function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, h
     try {
       fd = openSync8(claimed, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
     } catch (e) {
-      const l = lstatSync9(claimed, { throwIfNoEntry: false });
+      const l = lstatSync10(claimed, { throwIfNoEntry: false });
       if (!l)
         throw e;
       if (l.isSymbolicLink() || e.code === "ELOOP") {
@@ -10641,7 +10748,7 @@ function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, h
       }
     } else
       try {
-        if (lstatSync9(f, { throwIfNoEntry: false }))
+        if (lstatSync10(f, { throwIfNoEntry: false }))
           unapplied("logs dir unwritable or file unreadable");
       } catch {}
     return null;
@@ -10991,7 +11098,7 @@ var init_shell = __esm(() => {
 
 // ../../loki-ts/src/util/python.ts
 import { accessSync, constants as constants3, existsSync as existsSync27, mkdtempSync as mkdtempSync4, readFileSync as readFileSync33, realpathSync as realpathSync18, rmSync as rmSync11, statSync as statSync16 } from "fs";
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import { tmpdir as tmpdir5 } from "os";
 async function findPython3() {
   if (_pythonCache !== undefined)
@@ -11028,7 +11135,7 @@ function pySignatures(src) {
     const py = resolvePython3();
     if (!py)
       return [];
-    const r = spawnSync2(py, ["-I", "-S", "-c", PY_SCRIPT], {
+    const r = spawnSync3(py, ["-I", "-S", "-c", PY_SCRIPT], {
       input: src.replace(/\r\n?/g, `
 `),
       cwd: tmpdir5(),
@@ -11248,14 +11355,14 @@ function importsNamed(path, raw2, stems, importStems = stems, hits = () => false
     for (const m of py.matchAll(/(?:^|:)[ \t\f]*import[ \t\f]+([^\n#;]+?)[ \t\f]*(?:#.*)?$/gm))
       specs.push(...names(m[1]));
   }
-  const dir = dirOf(path);
+  const dir = dirOf2(path);
   if (specs.some((s) => s.trim().startsWith(".") && hits(resolveRel(dir, s.trim()))))
     return true;
   for (const py of views)
     for (const m of py.matchAll(/(?:^|:)[ \t\f]*from[ \t\f]+(\.+)([\w.]*?)[ \t\f]*\bimport\b[ \t\f]*(?:\(([^)]*)\)|([^\n]*))/gm)) {
       let base = dir;
       for (let i = 1;i < m[1].length; i++)
-        base = dirOf(base);
+        base = dirOf2(base);
       const r = resolveRel(base, (m[2] ?? "").replace(/\./g, "/"));
       if (hits(r) || names(m[3] ?? m[4] ?? "").some((n2) => hits(resolveRel(r, n2))))
         return true;
@@ -11293,13 +11400,13 @@ function buildWallManifest(files, taskModules, alsoNamed = []) {
     const s = stemsOfTarget(m);
     return s.length > 1 ? s.slice(1) : s;
   }));
-  const info = excl.map((m) => ({ noext: m.replace(/\.[^./]*$/, "").toLowerCase(), dir: dirOf(m).toLowerCase(), mod: !!dirOf(m) && ["index", "__init__", "mod", "main"].includes(stemOf(m).toLowerCase()), src: !TEST_FILE.test(m) }));
+  const info = excl.map((m) => ({ noext: m.replace(/\.[^./]*$/, "").toLowerCase(), dir: dirOf2(m).toLowerCase(), mod: !!dirOf2(m) && ["index", "__init__", "mod", "main"].includes(stemOf(m).toLowerCase()), src: !TEST_FILE.test(m) }));
   const hits = (r) => {
     const low = r.toLowerCase().replace(/\.(?:[cm]?[jt]sx?|py)$/, "");
     return [low, low.replace(/\/(?:index|__init__|mod|main)$/, "")].some((v) => info.some((t) => v === t.noext || t.mod && v === t.dir || v === "" || t.noext.startsWith(`${v}/`)));
   };
   const inTargetArea = (p) => {
-    const d = dirOf(p).toLowerCase();
+    const d = dirOf2(p).toLowerCase();
     return info.some((t) => t.src && (d === t.dir || t.mod && d.startsWith(`${t.dir}/`)));
   };
   const backstop = [...stems].filter((s) => !GENERIC_STEMS.includes(s));
@@ -11321,7 +11428,7 @@ function buildWallManifest(files, taskModules, alsoNamed = []) {
 var MANIFEST_MAX_LINES = 400, MAX_EXAMPLES = 2, EXAMPLE_LINES = 40, MAX_LAYOUT = 60, TEST_PATH, TEST_FILE, EXAMPLE_EXT, baseOf = (p) => p.split("/").pop() ?? p, normStem = (s) => s.toLowerCase().replace(/[._-]+/g, ".").replace(/^\.|\.$/g, ""), GENERIC_STEMS, mentionsStem = (content, stems) => {
   const c = content.toLowerCase().replace(/[._-]+/g, ".");
   return stems.some((s) => new RegExp(`(?<![a-z0-9])${s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![a-z0-9])`).test(c));
-}, dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", resolveRel = (dir, spec) => {
+}, dirOf2 = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", resolveRel = (dir, spec) => {
   const out2 = dir ? dir.split("/") : [];
   for (const seg of spec.split("/")) {
     if (seg === "" || seg === ".")
@@ -12125,6 +12232,21 @@ out("value-change" if ok and items else "weakened", items if ok else [])
 `;
 });
 
+// ../../loki-ts/src/e10ext/select.ts
+function refName(t) {
+  return `${t.runner}:${t.path}`;
+}
+function failedFirst(tests, prior) {
+  const red = new Set((prior ?? []).filter((c) => c.result === "fail" && typeof c.name === "string").map((c) => c.name));
+  if (red.size === 0)
+    return tests;
+  return [...tests.filter((t) => red.has(refName(t))), ...tests.filter((t) => !red.has(refName(t)))];
+}
+var PYTEST_COLLECTION_EXITS;
+var init_select = __esm(() => {
+  PYTEST_COLLECTION_EXITS = new Set([2, 3, 4, 5]);
+});
+
 // ../../loki-ts/src/runner/runner_errors.ts
 function hasRealTestFailure(out2) {
   return /^\s*Tests:?\s+.*\b[1-9]\d* failed\b/m.test(out2) || /^(?:=+ )?.*\b[1-9]\d* failed\b.* in [\d.]+s/m.test(out2) || /^FAILED \S+::/m.test(out2) || /^(?:#|\u2139) fail [1-9]/m.test(out2) || /^\s*[1-9]\d*\s+fail\s*$/m.test(out2) || /^\s*(?:FAIL|\u00D7)\s+\S.*\s>\s/m.test(out2) || /\bAssertionError\b/.test(out2);
@@ -12164,7 +12286,7 @@ var init_runner_errors = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/load_owner.ts
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 import { mkdtempSync as mkdtempSync6, realpathSync as realpathSync19, rmSync as rmSync14 } from "fs";
 import { tmpdir as tmpdir8 } from "os";
 import { basename as basename18, extname as extname2, join as join46 } from "path";
@@ -12209,7 +12331,7 @@ function sameLoadError(head, base, headRoots, baseRoots) {
 function killTree(pid) {
   const all = [pid];
   for (let k = 0;k < all.length; k++) {
-    const kids = spawnSync3("pgrep", ["-P", String(all[k])], { encoding: "utf8", env: process.env }).stdout.split(/\s+/).filter(Boolean).map(Number);
+    const kids = spawnSync4("pgrep", ["-P", String(all[k])], { encoding: "utf8", env: process.env }).stdout.split(/\s+/).filter(Boolean).map(Number);
     all.push(...kids.filter((x) => Number.isInteger(x) && !all.includes(x)));
   }
   try {
@@ -12357,7 +12479,7 @@ var init_wall_owned = __esm(() => {
 });
 
 // ../../loki-ts/src/util/app_probe.ts
-import { spawnSync as spawnSync4 } from "child_process";
+import { spawnSync as spawnSync5 } from "child_process";
 import { existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync37, renameSync as renameSync11, writeFileSync as writeFileSync21 } from "fs";
 import { join as join48 } from "path";
 function readJson4(p) {
@@ -12372,7 +12494,7 @@ function stopApp(repoDir, opts = {}) {
   const runner = opts.runnerPath ?? join48(REPO_ROOT, "autonomy", "app-runner.sh");
   if (!existsSync29(runner) || !existsSync29(join48(repoDir, ".loki", "app-runner", "app.pid")))
     return;
-  spawnSync4("bash", ["-c", STOP, "app-probe", repoDir, runner], { cwd: repoDir, env: plainTestEnv(), timeout: opts.timeoutMs ?? 60000, killSignal: "SIGKILL", stdio: "ignore" });
+  spawnSync5("bash", ["-c", STOP, "app-probe", repoDir, runner], { cwd: repoDir, env: plainTestEnv(), timeout: opts.timeoutMs ?? 60000, killSignal: "SIGKILL", stdio: "ignore" });
 }
 async function appProbe(repoDir, lokiDir2, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 60000, runner = opts.runnerPath ?? join48(REPO_ROOT, "autonomy", "app-runner.sh");
@@ -12380,7 +12502,7 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
   const t0 = Date.now();
   const mk2 = (name, result, reason) => ({ name, cmd: "autonomy/app-runner.sh", result, duration_s: (Date.now() - t0) / 1000, reason });
   const sh = (script) => {
-    const r = spawnSync4("bash", ["-c", script, "app-probe", repoDir, runner], { cwd: repoDir, env: { ...plainTestEnv(), ...opts.env ?? {} }, encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
+    const r = spawnSync5("bash", ["-c", script, "app-probe", repoDir, runner], { cwd: repoDir, env: { ...plainTestEnv(), ...opts.env ?? {} }, encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
     return { out: r.stdout ?? "", status: r.error ? null : r.status };
   };
   let pid = null, url = null;
@@ -12425,7 +12547,7 @@ async function functionalVerify(opts, url, dir, lokiDir2, timeoutMs) {
     return res("not_run", "python3 or functional-verify.py unavailable");
   const specFile = join48(dir, "spec.txt");
   writeFileSync21(specFile, opts.specText ?? "");
-  const r = spawnSync4(py, ["-I", script, specFile, url], { env: plainTestEnv(), encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
+  const r = spawnSync5(py, ["-I", script, specFile, url], { env: plainTestEnv(), encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
   let out2 = null;
   try {
     const v = JSON.parse(r.stdout ?? "");
@@ -12497,13 +12619,18 @@ async function runSecureScan(targetDir, opts = {}) {
     const findings = obj.findings;
     if (res.exitCode === 1 !== findings.length > 0)
       return fail(`secure-scan exit ${res.exitCode} disagrees with ${findings.length} findings`);
+    const summary = obj.summary && typeof obj.summary === "object" ? obj.summary : undefined;
+    const filesScanned = typeof summary?.["files_scanned"] === "number" ? summary["files_scanned"] : undefined;
+    if (filesScanned === 0 && findings.length === 0)
+      return { ok: false, findings: [], error: "secure-scan scanned 0 files (not_run)", filesScanned: 0, notRun: true };
+    const meta = filesScanned === undefined ? {} : { filesScanned };
     if (opts.secretsEverywhere || opts.diffBase === false)
-      return { ok: true, findings };
+      return { ok: true, findings, ...meta };
     const added = await scanAddedLines(targetDir, { ...opts, scriptPath: script, timeoutMs });
     if (!added.ok)
       return added;
     const seen = new Set(findings.map((f) => `${f.file}|${f.line}`));
-    return { ok: true, findings: [...findings, ...added.findings.filter((f) => !seen.has(`${f.file}|${f.line}`))] };
+    return { ok: true, findings: [...findings, ...added.findings.filter((f) => !seen.has(`${f.file}|${f.line}`))], ...meta };
   }
   if (res.exitCode !== 0 && res.exitCode !== 1 && res.exitCode !== 2 && elapsed >= timeoutMs) {
     return fail(`secure-scan timed out after ${timeoutMs}ms`);
@@ -12811,7 +12938,7 @@ var init_route_block = __esm(() => {
 // ../../loki-ts/src/features/visual_evidence.ts
 import { spawn as spawn7 } from "child_process";
 import { createHash as createHash13, randomBytes as randomBytes5 } from "crypto";
-import { existsSync as existsSync31, lstatSync as lstatSync10, mkdirSync as mkdirSync20, readdirSync as readdirSync16, readFileSync as readFileSync39, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync31, lstatSync as lstatSync11, mkdirSync as mkdirSync20, readdirSync as readdirSync16, readFileSync as readFileSync39, writeFileSync as writeFileSync23 } from "fs";
 import { createServer } from "net";
 import { dirname as dirname17, isAbsolute as isAbsolute8, join as join50, normalize as normalize3, relative as relative6, sep as sep12 } from "path";
 function routeFor(file) {
@@ -13123,13 +13250,13 @@ test("loki e2e walkthrough", async ({ page }) => {
 });
 `, DEFAULT_BUDGET_MS = 25000, MAX_ROUTES = 5, isSymlink = (p) => {
   try {
-    return lstatSync10(p).isSymbolicLink();
+    return lstatSync11(p).isSymbolicLink();
   } catch {
     return false;
   }
 }, isRegularFile = (p) => {
   try {
-    return lstatSync10(p).isFile();
+    return lstatSync11(p).isFile();
   } catch {
     return false;
   }
@@ -13240,12 +13367,6 @@ var init_pr_lessons = __esm(() => {
   KINDS = new Set(["pr", "receipt", "ticket", "rejected"]);
 });
 
-// ../../loki-ts/src/e10ext/select.ts
-var PYTEST_COLLECTION_EXITS;
-var init_select = __esm(() => {
-  PYTEST_COLLECTION_EXITS = new Set([2, 3, 4, 5]);
-});
-
 // ../../loki-ts/src/e10ext/treeswap.ts
 var init_treeswap = __esm(() => {
   init_safe_git();
@@ -13402,12 +13523,12 @@ var init_providers = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync34, lstatSync as lstatSync11, mkdirSync as mkdirSync22, readFileSync as readFileSync42, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync34, lstatSync as lstatSync12, mkdirSync as mkdirSync22, readFileSync as readFileSync42, writeFileSync as writeFileSync25 } from "fs";
 import { join as join53 } from "path";
 function loadRouteRecord(runDir) {
   try {
     const p = join53(runDir, ROUTE_RECORD_FILE);
-    if (!existsSync34(p) || !lstatSync11(p).isFile())
+    if (!existsSync34(p) || !lstatSync12(p).isFile())
       return;
     const v = JSON.parse(readFileSync42(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
@@ -13592,7 +13713,7 @@ __export(exports_deep, {
   DEFAULT_SECRET_SCAN_SH: () => DEFAULT_SECRET_SCAN_SH,
   DEFAULT_PUSH_SH: () => DEFAULT_PUSH_SH2
 });
-import { copyFileSync as copyFileSync3, existsSync as existsSync35, lstatSync as lstatSync12, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync9, rmSync as rmSync17, writeFileSync as writeFileSync26 } from "fs";
+import { copyFileSync as copyFileSync3, existsSync as existsSync35, lstatSync as lstatSync13, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync9, rmSync as rmSync17, writeFileSync as writeFileSync26 } from "fs";
 import { tmpdir as tmpdir10 } from "os";
 import { dirname as dirname20, join as join55 } from "path";
 function sessionCouncil(sessions) {
@@ -13714,7 +13835,7 @@ async function secureScanChanged(repoDir, changed, opts) {
   const dir = mkdtempSync9(join55(tmpdir10(), "loki-deep-secure-"));
   try {
     for (const f of changed)
-      if (existsSync35(join55(repoDir, f)) && lstatSync12(join55(repoDir, f)).isFile()) {
+      if (existsSync35(join55(repoDir, f)) && lstatSync13(join55(repoDir, f)).isFile()) {
         mkdirSync23(dirname20(join55(dir, f)), { recursive: true });
         copyFileSync3(join55(repoDir, f), join55(dir, f));
       }
@@ -14091,6 +14212,7 @@ var init_verify = __esm(() => {
   init_runner_config();
   init_assert_delta();
   init_failures();
+  init_select();
   init_load_owner();
   init_sizing();
   init_testmap();
@@ -14143,7 +14265,7 @@ var init_verify = __esm(() => {
       const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute9(f.path) ? relative7(ctx.repoDir, f.path) : f.path));
       const wallTests = map.tests.filter((t) => wallPaths.has(t.path));
       const intake = ctx.outputs().intake, relevant2 = ctx.tests.impacted(map, namedFiles(intake?.task ?? "", loadRepoMap(intake?.repomap_ref)));
-      const tests = dedupeTests([...impacted, ...changedTestFiles, ...wallTests, ...relevant2]);
+      const tests = failedFirst(dedupeTests([...impacted, ...changedTestFiles, ...wallTests, ...relevant2]), ctx.outputs().verify?.checks);
       const scopedOut = scopedOutOf(map);
       if (scopedOut.length)
         ctx.emit("test.scoped_out", "verify", { tests: scopedOut });
@@ -14331,7 +14453,7 @@ var readJson5 = (p) => {
 var init_conventions = () => {};
 
 // ../../loki-ts/src/engine10/stages/wall.ts
-import { spawnSync as spawnSync5 } from "child_process";
+import { spawnSync as spawnSync6 } from "child_process";
 import { existsSync as existsSync38, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync11, readFileSync as readFileSync44, readdirSync as readdirSync18, rmSync as rmSync19, writeFileSync as writeFileSync27 } from "fs";
 import { tmpdir as tmpdir12 } from "os";
 import { dirname as dirname23, join as join58, relative as relative8 } from "path";
@@ -14351,7 +14473,7 @@ class RealBaseTestRunner {
     const api = this.api === undefined ? loadProjectApi(repoDir) : this.api;
     for (const f of files) {
       const { cmd, args, interpreter, cwd } = commandFor(f, repoDir, api);
-      const r = spawnSync5(cmd, f.runner === "pytest" ? [...args, "-rfE"] : args, { cwd, encoding: "utf8", timeout: Math.max(1000, this.timeoutMs), env: plainTestEnv() });
+      const r = spawnSync6(cmd, f.runner === "pytest" ? [...args, "-rfE"] : args, { cwd, encoding: "utf8", timeout: Math.max(1000, this.timeoutMs), env: plainTestEnv() });
       const status = r.error ? null : r.status;
       const result = classify(f, status, stripAnsi(`${r.stdout ?? ""}
 ${r.stderr ?? ""}`), repoDir, interpreter);
@@ -14573,7 +14695,7 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync13, mkdirSync as mkdirSync25, openSync as openSync9, readFileSync as readFileSync45, realpathSync as realpathSync23, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync28 } from "fs";
+import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync14, mkdirSync as mkdirSync25, openSync as openSync9, readFileSync as readFileSync45, realpathSync as realpathSync23, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync28 } from "fs";
 import { dirname as dirname24, join as join59, relative as relative9, sep as sep13 } from "path";
 function safeRestore(repoDir, f, want, mode) {
   const root = realpathSync23(repoDir), fp = join59(root, f), rel = relative9(root, dirname24(fp));
@@ -14584,7 +14706,7 @@ function safeRestore(repoDir, f, want, mode) {
     cur = join59(cur, part);
     let st2;
     try {
-      st2 = lstatSync13(cur);
+      st2 = lstatSync14(cur);
     } catch {
       mkdirSync25(cur);
       continue;
@@ -14594,7 +14716,7 @@ function safeRestore(repoDir, f, want, mode) {
   }
   let st;
   try {
-    st = lstatSync13(fp);
+    st = lstatSync14(fp);
   } catch {
     st = null;
   }
@@ -14639,7 +14761,7 @@ async function discardIfSatisfied(git4, base, o, staged, keep, repoDir) {
     const fp = join59(repoDir, f);
     try {
       if (v.startsWith("!")) {
-        const st = lstatSync13(fp);
+        const st = lstatSync14(fp);
         if (`!${st.size}:${st.mtimeMs}:${st.ctimeMs}` !== v)
           throw new Error("changed, not snapshotted");
         continue;
@@ -14655,7 +14777,7 @@ async function discardIfSatisfied(git4, base, o, staged, keep, repoDir) {
       try {
         let m = 420;
         try {
-          const l = lstatSync13(join59(repoDir, f));
+          const l = lstatSync14(join59(repoDir, f));
           if (l.isFile())
             m = l.mode & 511;
         } catch {}
@@ -14692,9 +14814,10 @@ import { dirname as dirname25 } from "path";
 function dropSet(repoDir, staged, preexistingDirty, env = process.env) {
   return staged.concat(untouchedSinceIntake(repoDir, preexistingDirty, env).map((f) => ({ st: "L", f }))).filter(({ st, f }) => f.startsWith(".loki/") || st === "L" || /(^|\/)loki_wall_[^/]*$/.test(f) || st === "A" && !staged.some(({ f: m }) => /(^|\/)(package\.json|pyproject\.toml|requirements\.txt|Cargo\.toml|go\.mod)$/.test(m) && dirname25(m) === dirname25(f)) && /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|poetry\.lock|Cargo\.lock|go\.sum)$/.test(f));
 }
-var parseStaged = (out2) => out2.split("\x00").reduce((a, t, i, all) => i % 2 === 0 && t ? [...a, { st: t, f: all[i + 1] }] : a, []);
+var parseStaged = (out2) => out2.split("\x00").reduce((a, t, i, all) => i % 2 === 0 && t ? [...a, { st: t, f: all[i + 1] }] : a, []), formatChanged = (repoDir, staged, dropped2, env = process.env) => runFormatters(repoDir, staged.filter(({ st, f }) => (st === "A" || st === "M") && !dropped2.has(f) && !f.startsWith(".loki/")).map(({ f }) => f), tokenFreeEnv(env));
 var init_commit_filter = __esm(() => {
   init_preexisting_dirty();
+  init_repo_profile();
   init_safe_git();
 });
 
@@ -15053,7 +15176,7 @@ See also: loki cost --detail (what a run ALREADY spent)
 });
 
 // ../../loki-ts/src/features/contract.ts
-import { existsSync as existsSync42, lstatSync as lstatSync14, mkdirSync as mkdirSync28, readFileSync as readFileSync49, rmSync as rmSync20, writeFileSync as writeFileSync30 } from "fs";
+import { existsSync as existsSync42, lstatSync as lstatSync15, mkdirSync as mkdirSync28, readFileSync as readFileSync49, rmSync as rmSync20, writeFileSync as writeFileSync30 } from "fs";
 import { dirname as dirname27, join as join64 } from "path";
 import { createHash as createHash15 } from "crypto";
 function contractEnabled(env = process.env) {
@@ -15092,7 +15215,7 @@ function readContract(repoDir) {
   const p = contractPath(repoDir);
   let st;
   try {
-    st = lstatSync14(p);
+    st = lstatSync15(p);
   } catch {
     return { contract: null, notes: [], sha256: null };
   }
@@ -15137,7 +15260,7 @@ function sealContract(repoDir, body, rawDiff, checks, env = process.env, snap) {
     const live2 = readContract(repoDir);
     let exists2 = true;
     try {
-      lstatSync14(contractPath(repoDir));
+      lstatSync15(contractPath(repoDir));
     } catch {
       exists2 = false;
     }
@@ -15692,7 +15815,10 @@ var init_seal = __esm(() => {
         return sat;
       if (drop.length > 0 && (await git4(ctx, ["--literal-pathspecs", "reset", "-q", ctx.baseSha, "--", ...drop.map(({ f }) => f)])).code !== 0)
         return { status: "failed", data: {}, reason: "git reset failed" };
-      const dropped2 = new Set(drop.map(({ f }) => f)), notes = flagOutsideScope(ctx.outputs(), staged.filter(({ f }) => !dropped2.has(f)));
+      const dropped2 = new Set(drop.map(({ f }) => f)), fmt = formatChanged(ctx.repoDir, staged, dropped2);
+      if (fmt.length > 0)
+        await git4(ctx, ["--literal-pathspecs", "add", "--", ...fmt], { repoDrivers: true });
+      const notes = flagOutsideScope(ctx.outputs(), staged.filter(({ f }) => !dropped2.has(f)));
       if ((await git4(ctx, ["diff", "--cached", "--quiet"])).code === 0)
         return { status: "completed", data: { committed: false, scope_notes: notes } };
       const title = (str3(ctx.outputs().intake?.title) ?? `run ${ctx.runId}`).split(`
@@ -16052,6 +16178,11 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
   const lprob = logProblem(runDir, integ);
   if (lprob)
     return bad(lprob);
+  if (receipt["toolchain"] !== undefined) {
+    const tp = toolchainProblem(receipt["toolchain"]);
+    if (tp)
+      return bad(tp);
+  }
   const heads = isObj10(integ["heads"]) ? integ["heads"] : {}, outcomes = integ["outcomes"];
   const stated = receipt["integration"];
   if (stated !== undefined) {
@@ -16113,10 +16244,12 @@ function compositeHash(r) {
   const { composite_sha256: _c, verification: _v, ...body } = r;
   return sha3(canonicalJson(body));
 }
-var COMPOSITE_SCHEMA = "loki.v10.composite/1", slugOf = (repo) => repo.replace(/\//g, "__"), isComposite = (r) => r["schema"] === COMPOSITE_SCHEMA, relOk = (p) => p !== "" && !p.startsWith("/") && !p.split("/").includes("..");
+var COMPOSITE_SCHEMA = "loki.v10.composite/1", TOOLCHAIN_KEYS, toolchainProblem = (t) => isObj10(t) && Object.keys(t).length === TOOLCHAIN_KEYS.length && TOOLCHAIN_KEYS.every((k) => t[k] === null || typeof t[k] === "string") ? null : "toolchain section is malformed", slugOf = (repo) => repo.replace(/\//g, "__"), isComposite = (r) => r["schema"] === COMPOSITE_SCHEMA, relOk = (p) => p !== "" && !p.startsWith("/") && !p.split("/").includes("..");
 var init_composite_seal = __esm(() => {
   init_receipt_signer();
+  init_check_result();
   init_seal_group();
+  TOOLCHAIN_KEYS = ["bun", "node", "python3", "git"];
 });
 
 // ../../loki-ts/src/engine10/keys_cmd.ts

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "11.17.39",
+  "version": "11.17.41",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",