loki-mode 11.17.43 → 11.17.44

package/packages/control-plane/dist/server.js

@@ -144,6 +144,11 @@ var init_redact = __esm(() => {
     [/xox[baprs]-[A-Za-z0-9-]{10,}/g, "[REDACTED:SLACK_TOKEN]"],
     [/AKIA[0-9A-Z]{16}/g, "[REDACTED:AWS_KEY]"],
     [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[REDACTED:JWT]"],
+    [/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g, "[REDACTED:SENDGRID_KEY]"],
+    [/\bSK[0-9a-f]{32}\b/g, "[REDACTED:TWILIO_KEY]"],
+    [/\bdckr_pat_[A-Za-z0-9_-]{20,}/g, "[REDACTED:DOCKER_TOKEN]"],
+    [/\bdop_v1_[a-f0-9]{64}\b/g, "[REDACTED:DIGITALOCEAN_TOKEN]"],
+    [/\bya29\.[A-Za-z0-9_-]{20,}/g, "[REDACTED:GOOGLE_OAUTH_TOKEN]"],
     [/AI[a-zA-Z0-9_-]{30,}/g, "[REDACTED:GOOGLE_KEY]"],
     [/glpat-[A-Za-z0-9_-]{20,}/g, "[REDACTED:GITLAB_TOKEN]"],
     [/npm_[A-Za-z0-9]{36}/g, "[REDACTED:NPM_TOKEN]"],
@@ -10853,6 +10858,114 @@ var init_run_control = __esm(() => {
   PARENT_PID = process.ppid;
 });
 
+// ../../loki-ts/src/features/receipt_dsse.ts
+import { createPublicKey as createPublicKey3, sign as sign2, verify as verify3 } from "crypto";
+import { readFileSync as readFileSync32 } from "fs";
+function pae(payloadType, body) {
+  const t = Buffer.from(payloadType, "utf8");
+  return Buffer.concat([Buffer.from(`DSSEv1 ${t.length} `), t, Buffer.from(` ${body.length} `), body]);
+}
+function verifyEnvelope(env, pubFor) {
+  if (env.payloadType !== DSSE_PAYLOAD_TYPE)
+    return { ok: false, reason: `unexpected payloadType: ${env.payloadType}` };
+  const body = Buffer.from(env.payload, "base64");
+  let unknown = "", kid = "", known = 0;
+  for (const s of env.signatures) {
+    if (!s || typeof s.keyid !== "string" || typeof s.sig !== "string")
+      continue;
+    const pub = pubFor(s.keyid);
+    if (!pub) {
+      unknown ||= s.keyid;
+      continue;
+    }
+    known++;
+    if (verify3(null, pae(env.payloadType, body), pub, Buffer.from(s.sig, "base64"))) {
+      kid = s.keyid;
+      break;
+    }
+  }
+  if (!kid)
+    return unknown && known === 0 ? { ok: false, unchecked: true, reason: `no key for keyid ${unknown} on this machine (use --pubkey FILE)` } : { ok: false, reason: "DSSE signature does not verify" };
+  let st;
+  try {
+    st = JSON.parse(body.toString("utf8"));
+  } catch {
+    return { ok: false, reason: "payload is not JSON" };
+  }
+  if (st["_type"] !== STATEMENT_TYPE)
+    return { ok: false, reason: "payload is not an in-toto Statement v1" };
+  if (st["predicateType"] !== PREDICATE_TYPE)
+    return { ok: false, reason: `unexpected predicateType: ${String(st["predicateType"])}` };
+  const receipt = st["predicate"];
+  if (!receipt || typeof receipt !== "object")
+    return { ok: false, reason: "statement has no predicate" };
+  const dig = st["subject"]?.[0]?.digest ?? {};
+  if (dig["gitCommit"] !== receipt["head_sha"] || dig["gitTree"] !== undefined && dig["gitTree"] !== receipt["tree"])
+    return { ok: false, reason: "subject digest does not match the receipt head_sha/tree" };
+  return { ok: true, receipt, kid };
+}
+function outcomeOf(j) {
+  try {
+    return String(isEnvelope(j) ? JSON.parse(Buffer.from(j.payload, "base64").toString()).predicate.verdict : j["verdict"]);
+  } catch {
+    return "UNREADABLE";
+  }
+}
+function envelopeRunIdProblem(j, runId) {
+  if (!isEnvelope(j))
+    return null;
+  let id;
+  try {
+    id = JSON.parse(Buffer.from(j.payload, "base64").toString()).predicate?.run_id;
+  } catch {
+    return "envelope payload is not readable";
+  }
+  return id === runId ? null : `envelope predicate.run_id ${JSON.stringify(id)} does not match run id ${JSON.stringify(runId)}`;
+}
+function verifyDsseReceipt(env, d) {
+  const c = verifyEnvelope(env, d.pubFor);
+  if (!c.ok)
+    return { verdict: c.unchecked ? "UNCHECKED" : "TAMPERED", reasons: [c.reason] };
+  const computed = d.hash(c.receipt);
+  if (c.receipt["receipt_sha256"] !== computed)
+    return { verdict: "TAMPERED", reasons: [`receipt_sha256 mismatch: recorded ${JSON.stringify(c.receipt["receipt_sha256"])}, computed ${computed}`] };
+  const jwt = c.receipt["verification"]?.jwt;
+  const o = typeof jwt === "string" ? d.attest(jwt, computed) : { status: "tampered", reason: "receipt carries no attestation" };
+  if (o.status !== "verified")
+    return { verdict: o.status === "tampered" ? "TAMPERED" : "UNCHECKED", reasons: [o.reason ?? "attestation invalid"] };
+  return { verdict: "VERIFIED", reasons: [], receiptSha256: computed };
+}
+function runIdGuard(receiptPath, runId) {
+  try {
+    return envelopeRunIdProblem(JSON.parse(readFileSync32(receiptPath, "utf8")), runId);
+  } catch {
+    return null;
+  }
+}
+var DSSE_PAYLOAD_TYPE = "application/vnd.in-toto+json", STATEMENT_TYPE = "https://in-toto.io/Statement/v1", PREDICATE_TYPE = "https://autonomi.dev/loki/receipt/v10", isEnvelope = (x) => !!x && typeof x === "object" && typeof x.payloadType === "string" && typeof x.payload === "string" && Array.isArray(x.signatures);
+var init_receipt_dsse = () => {};
+// ../../loki-ts/src/contrib/forecast.ts
+var init_forecast = () => {};
+
+// ../../loki-ts/src/commands/queue.ts
+var init_queue = __esm(() => {
+  init_atomic();
+  init_paths();
+  init_forecast();
+});
+
+// ../../loki-ts/src/commands/undo.ts
+var READ_ONLY_GIT;
+var init_undo = __esm(() => {
+  init_paths();
+  init_safe_git();
+  init_verify_cmd();
+  init_events();
+  init_receipt_dsse();
+  init_queue();
+  READ_ONLY_GIT = new Set(["rev-parse", "log", "merge-base", "for-each-ref", "symbolic-ref", "rev-list", "cat-file", "show"]);
+});
+
 // ../../loki-ts/src/util/intent_card.ts
 function acceptanceLines(plan) {
   const card = plan?.intent_card;
@@ -10871,6 +10984,8 @@ var init_run_status = __esm(() => {
   init_output();
   init_run_outputs();
   init_run_control();
+  init_run_pid();
+  init_undo();
   init_intent_card();
   TERMINAL2 = new Set(["stage.completed", "stage.failed", "stage.skipped"]);
 });
@@ -10915,7 +11030,7 @@ var init_run_cap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/mutation_proof.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync3, readFileSync as readFileSync32, rmSync as rmSync10, symlinkSync, writeFileSync as writeFileSync19 } from "fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync3, readFileSync as readFileSync33, rmSync as rmSync10, symlinkSync, writeFileSync as writeFileSync19 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { basename as basename14, dirname as dirname13, isAbsolute as isAbsolute6, join as join42, relative as relative3 } from "path";
 function mutationProof(i) {
@@ -10946,7 +11061,7 @@ function mutationProof(i) {
       if (!existsSync26(src))
         return np(`Wall file missing: ${rel}`);
       mkdirSync16(dirname13(join42(wt, rel)), { recursive: true });
-      writeFileSync19(join42(wt, rel), readFileSync32(src));
+      writeFileSync19(join42(wt, rel), readFileSync33(src));
     }
     for (const rel of rels) {
       const parts = rel.split("/").slice(0, -1);
@@ -11097,7 +11212,7 @@ var init_shell = __esm(() => {
 });
 
 // ../../loki-ts/src/util/python.ts
-import { accessSync, constants as constants3, existsSync as existsSync27, mkdtempSync as mkdtempSync4, readFileSync as readFileSync33, realpathSync as realpathSync18, rmSync as rmSync11, statSync as statSync16 } from "fs";
+import { accessSync, constants as constants3, existsSync as existsSync27, mkdtempSync as mkdtempSync4, readFileSync as readFileSync34, realpathSync as realpathSync18, rmSync as rmSync11, statSync as statSync16 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
 import { tmpdir as tmpdir5 } from "os";
 async function findPython3() {
@@ -11547,7 +11662,7 @@ Example: test('name', () => { assert.strictEqual(fn(1), 2); });  Run: node --tes
 
 // ../../loki-ts/src/util/holdout.ts
 import { createHash as createHash12 } from "crypto";
-import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync28, mkdirSync as mkdirSync17, readFileSync as readFileSync34, rmSync as rmSync12, writeFileSync as writeFileSync20 } from "fs";
+import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync28, mkdirSync as mkdirSync17, readFileSync as readFileSync35, rmSync as rmSync12, writeFileSync as writeFileSync20 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
 import { basename as basename16, join as join43, relative as relative4 } from "path";
 function wallHoldoutRatio(env = process.env) {
@@ -11582,7 +11697,7 @@ function stashHoldout(o) {
   const files = held.map((name) => {
     copyFileSync2(join43(o.srcDir, name), join43(dir, name));
     rmSync12(join43(o.srcDir, name), { force: true });
-    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync34(join43(dir, name), "utf8")) };
+    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync35(join43(dir, name), "utf8")) };
   });
   writeFileSync20(join43(dir, MANIFEST), JSON.stringify({ targetDir: o.targetDir, files }));
   return { dir, names: new Set(held) };
@@ -11591,14 +11706,14 @@ function stageHoldout(dir, repoDir) {
   const put = [], tests = [], missing = [];
   let man = null;
   try {
-    man = JSON.parse(readFileSync34(join43(dir, MANIFEST), "utf8"));
+    man = JSON.parse(readFileSync35(join43(dir, MANIFEST), "utf8"));
   } catch {}
   if (!man)
     return { tests, missing: [`holdout store unreadable: ${basename16(dir)}`], cleanup: () => {} };
   mkdirSync17(man.targetDir, { recursive: true });
   man.files.forEach((f, i) => {
     const src = join43(dir, f.name);
-    if (!existsSync28(src) || sha2(readFileSync34(src, "utf8")) !== f.sha256) {
+    if (!existsSync28(src) || sha2(readFileSync35(src, "utf8")) !== f.sha256) {
       missing.push(`holdout ${i + 1} missing or altered`);
       return;
     }
@@ -11623,7 +11738,7 @@ var sha2 = (s) => createHash12("sha256").update(s).digest("hex"), WALL_HOLDOUT_D
 var init_holdout = () => {};
 
 // ../../loki-ts/src/features/runner_config.ts
-import { readFileSync as readFileSync35 } from "fs";
+import { readFileSync as readFileSync36 } from "fs";
 import { dirname as dirname15, join as join44, normalize as normalize2 } from "path";
 function tomlKey2(s, i = 0, eq2 = true) {
   const parts = [], ws = () => {
@@ -11982,7 +12097,7 @@ var PKG_KEYS, RAW_CONFIGS, RUNNER_CONFIGS, DEP_MAPS, RUNNER_DEP, LOCAL_SPEC, dep
   }
 }, headText = (dir, f) => {
   try {
-    return readFileSync35(join44(dir, f), "utf8");
+    return readFileSync36(join44(dir, f), "utf8");
   } catch {
     return "";
   }
@@ -12022,7 +12137,7 @@ var init_runner_config = __esm(() => {
 
 // ../../loki-ts/src/e10ext/assert_delta.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync36, rmSync as rmSync13 } from "fs";
+import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync37, rmSync as rmSync13 } from "fs";
 import { tmpdir as tmpdir7 } from "os";
 import { join as join45 } from "path";
 import { basename as basename17 } from "path";
@@ -12065,7 +12180,7 @@ function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, hea
     return null;
   try {
     const show = (ref) => safeGit(repoDir, ["show", `${ref}:${path}`]);
-    const head = headRef ? show(headRef) : readFileSync36(join45(repoDir, path), "utf8");
+    const head = headRef ? show(headRef) : readFileSync37(join45(repoDir, path), "utf8");
     const r = classifyTestEdit(path, show(baseSha), head, task, baseCounts, headCounts);
     return r[0]?.kind === "literal-only" ? r.map((e) => `assertion value changed (not shown to be required by the task): ${e.file}:${e.line} ${e.old} -> ${e.new}`) : null;
   } catch {
@@ -12277,6 +12392,7 @@ var init_runner_errors = __esm(() => {
     [/Interrupted: \d+ errors? during collection/, "collection error"],
     [/^_+ ERROR collecting /m, "collection error"],
     [/ImportError while importing test module/, "test module import error"],
+    [/ImportError: Failed to import test module/, "unittest test module import error"],
     [/^ERROR: (?:file or directory not found|not found:)/m, "test path not found by the runner"],
     [/No test files found, exiting with code [1-9]/, "runner found no test files (wrong cwd or path)"],
     [/\[setup failed\]|cannot find package|no required module provides package/, "go package could not be set up"],
@@ -12480,11 +12596,11 @@ var init_wall_owned = __esm(() => {
 
 // ../../loki-ts/src/util/app_probe.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync37, renameSync as renameSync11, writeFileSync as writeFileSync21 } from "fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync38, renameSync as renameSync11, writeFileSync as writeFileSync21 } from "fs";
 import { join as join48 } from "path";
 function readJson4(p) {
   try {
-    const v = JSON.parse(readFileSync37(p, "utf8"));
+    const v = JSON.parse(readFileSync38(p, "utf8"));
     return v && typeof v === "object" ? v : null;
   } catch {
     return null;
@@ -12516,7 +12632,7 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
       return { checks, pid, url };
     }
     const ir = Number(m[1]), sr = Number(m[2]), hr = Number(m[3]);
-    const pidTxt = existsSync29(join48(dir, "app.pid")) ? readFileSync37(join48(dir, "app.pid"), "utf8").trim() : "";
+    const pidTxt = existsSync29(join48(dir, "app.pid")) ? readFileSync38(join48(dir, "app.pid"), "utf8").trim() : "";
     pid = /^\d+$/.test(pidTxt) && sr >= 0 ? Number(pidTxt) : null;
     const st = readJson4(join48(dir, "state.json"));
     url = typeof st?.["url"] === "string" ? st["url"] : null;
@@ -12591,7 +12707,7 @@ app_runner_stop >/dev/null 2>&1
 });
 
 // ../../loki-ts/src/util/secure_scan.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync19, mkdtempSync as mkdtempSync7, readFileSync as readFileSync38, realpathSync as realpathSync20, rmSync as rmSync15, statSync as statSync17, writeFileSync as writeFileSync22 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync19, mkdtempSync as mkdtempSync7, readFileSync as readFileSync39, realpathSync as realpathSync20, rmSync as rmSync15, statSync as statSync17, writeFileSync as writeFileSync22 } from "fs";
 import { tmpdir as tmpdir9 } from "os";
 import { dirname as dirname16, join as join49, resolve as resolve14, sep as sep11 } from "path";
 function fail(error) {
@@ -12771,7 +12887,7 @@ async function scanAddedLines(repoDir, opts = {}) {
       if (!st.isFile() || st.size > MAX_ADDED_FILE_BYTES)
         continue;
       const lines2 = new Map;
-      readFileSync38(join49(repoDir, p), "utf8").split(`
+      readFileSync39(join49(repoDir, p), "utf8").split(`
 `).forEach((t, i) => lines2.set(i + 1, t));
       added.set(p, lines2);
     } catch {}
@@ -12938,7 +13054,7 @@ var init_route_block = __esm(() => {
 // ../../loki-ts/src/features/visual_evidence.ts
 import { spawn as spawn7 } from "child_process";
 import { createHash as createHash13, randomBytes as randomBytes5 } from "crypto";
-import { existsSync as existsSync31, lstatSync as lstatSync11, mkdirSync as mkdirSync20, readdirSync as readdirSync16, readFileSync as readFileSync39, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync31, lstatSync as lstatSync11, mkdirSync as mkdirSync20, readdirSync as readdirSync16, readFileSync as readFileSync40, writeFileSync as writeFileSync23 } from "fs";
 import { createServer } from "net";
 import { dirname as dirname17, isAbsolute as isAbsolute8, join as join50, normalize as normalize3, relative as relative6, sep as sep12 } from "path";
 function routeFor(file) {
@@ -13017,7 +13133,7 @@ function openapiPaths(repoDir) {
     if (!existsSync31(p))
       continue;
     try {
-      const txt = readFileSync39(p, "utf8");
+      const txt = readFileSync40(p, "utf8");
       const paths = f.endsWith(".json") ? Object.keys(JSON.parse(txt).paths ?? {}) : [...txt.matchAll(/^ {2}(\/[^\s:]*):\s*$/gm)].map((m) => m[1]);
       return paths.filter((x) => !x.includes("{")).slice(0, 10);
     } catch {
@@ -13135,14 +13251,14 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
         const subs = ["backend", "frontend"].filter((d) => existsSync31(join50(repoDir, d, "package.json")));
         const has = (d) => {
           try {
-            return pickScript(JSON.parse(readFileSync39(join50(repoDir, d, "package.json"), "utf8"))) !== null;
+            return pickScript(JSON.parse(readFileSync40(join50(repoDir, d, "package.json"), "utf8"))) !== null;
           } catch {
             return false;
           }
         };
         return skip(noRootReason(subs, subs.filter((d) => !has(d))));
       }
-      script = pickScript(JSON.parse(readFileSync39(pkgPath, "utf8")));
+      script = pickScript(JSON.parse(readFileSync40(pkgPath, "utf8")));
       if (!script)
         return skip("no dev, preview or start script");
     }
@@ -13238,7 +13354,7 @@ function receiptScreensProblem(receiptPath, receipt) {
     return `visual evidence failed (LOKI_VISUAL_GATE=1): ${receipt["evidence_failed"]}`;
   return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname17(receiptPath), receipt["evidence_screens"]);
 }
-var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash13("sha256").update(readFileSync39(p)).digest("hex"), playwrightBin = (repoDir) => {
+var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash13("sha256").update(readFileSync40(p)).digest("hex"), playwrightBin = (repoDir) => {
   const bin = join50(repoDir, "node_modules", ".bin", "playwright");
   return existsSync31(bin) ? bin : null;
 }, playwrightTestPkg = (repoDir) => {
@@ -13308,7 +13424,7 @@ var init_pr = __esm(() => {
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync21, mkdtempSync as mkdtempSync8, readFileSync as readFileSync40, rmSync as rmSync16, writeFileSync as writeFileSync24 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync21, mkdtempSync as mkdtempSync8, readFileSync as readFileSync41, rmSync as rmSync16, writeFileSync as writeFileSync24 } from "fs";
 import { dirname as dirname18, join as join52 } from "path";
 import { createHash as createHash14 } from "crypto";
 function loadLessons(repoDir) {
@@ -13316,7 +13432,7 @@ function loadLessons(repoDir) {
   if (!existsSync32(p))
     return [];
   try {
-    const j = JSON.parse(readFileSync40(p, "utf-8"));
+    const j = JSON.parse(readFileSync41(p, "utf-8"));
     return Array.isArray(j.lessons) ? j.lessons : [];
   } catch {
     return [];
@@ -13384,7 +13500,7 @@ var init_attempts = __esm(() => {
 var init_mcp_config = () => {};
 
 // ../../loki-ts/src/providers/claude_flags.ts
-import { existsSync as existsSync33, readFileSync as readFileSync41 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync42 } from "fs";
 import { resolve as resolvePath, dirname as dirname19 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function claudeFlagSupported(flag, helpText) {
@@ -13439,7 +13555,7 @@ function designArchetypesText() {
     ]) {
       const p = resolvePath(moduleDir, ...rel);
       if (existsSync33(p))
-        return readFileSync41(p, "utf8");
+        return readFileSync42(p, "utf8");
     }
   } catch {}
   return "";
@@ -13523,14 +13639,14 @@ var init_providers = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync34, lstatSync as lstatSync12, mkdirSync as mkdirSync22, readFileSync as readFileSync42, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync34, lstatSync as lstatSync12, mkdirSync as mkdirSync22, readFileSync as readFileSync43, writeFileSync as writeFileSync25 } from "fs";
 import { join as join53 } from "path";
 function loadRouteRecord(runDir) {
   try {
     const p = join53(runDir, ROUTE_RECORD_FILE);
     if (!existsSync34(p) || !lstatSync12(p).isFile())
       return;
-    const v = JSON.parse(readFileSync42(p, "utf8"));
+    const v = JSON.parse(readFileSync43(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
   } catch {
     return;
@@ -14368,7 +14484,7 @@ ${x}` : c.cmd };
 });
 
 // ../../loki-ts/src/project_model/conventions.ts
-import { existsSync as existsSync37, readdirSync as readdirSync17, readFileSync as readFileSync43 } from "fs";
+import { existsSync as existsSync37, readdirSync as readdirSync17, readFileSync as readFileSync44 } from "fs";
 import { dirname as dirname22, join as join57 } from "path";
 function parseJsonc(text2) {
   let out2 = "", i = 0;
@@ -14444,7 +14560,7 @@ function conventionViolation(c, fileName, content) {
 }
 var readJson5 = (p) => {
   try {
-    const v = parseJsonc(readFileSync43(p, "utf8"));
+    const v = parseJsonc(readFileSync44(p, "utf8"));
     return v && typeof v === "object" && !Array.isArray(v) ? v : null;
   } catch {
     return null;
@@ -14454,7 +14570,7 @@ var init_conventions = () => {};
 
 // ../../loki-ts/src/engine10/stages/wall.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { existsSync as existsSync38, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync11, readFileSync as readFileSync44, readdirSync as readdirSync18, rmSync as rmSync19, writeFileSync as writeFileSync27 } from "fs";
+import { existsSync as existsSync38, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync11, readFileSync as readFileSync45, readdirSync as readdirSync18, rmSync as rmSync19, writeFileSync as writeFileSync27 } from "fs";
 import { tmpdir as tmpdir12 } from "os";
 import { dirname as dirname23, join as join58, relative as relative8 } from "path";
 
@@ -14515,7 +14631,7 @@ function loadTaskText(ctx, fromPrior) {
   const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join58(ctx.runDir, "issue.json");
   if (existsSync38(issueJsonPath)) {
     try {
-      const issue = JSON.parse(readFileSync44(issueJsonPath, "utf8"));
+      const issue = JSON.parse(readFileSync45(issueJsonPath, "utf8"));
       const text2 = [issue.title, issue.body].filter((s) => typeof s === "string" && s.length > 0).join(`
 
 `);
@@ -14580,14 +14696,14 @@ async function wallAuthor(ctx, signal, retry) {
     rmSync19(cwd, { recursive: true, force: true });
     return done({ status: "failed", data: { iteration_ids: [iterationId], model }, reason: "wall session aborted, killed, or timed out", killed: true });
   }
-  const all = readdirSync18(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync44(join58(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
+  const all = readdirSync18(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync45(join58(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
   const sealedDir = join58(ctx.runDir, "wall");
   if (generated.length > 0)
     mkdirSync24(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync44(join58(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
+    const content = readFileSync45(join58(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
     writeFileSync27(join58(sealedDir, name), content, "utf8");
     if (bad)
       discarded.push({ file: name, reason: `${bad}; wall test did not compile under the package config` });
@@ -14695,7 +14811,7 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync14, mkdirSync as mkdirSync25, openSync as openSync9, readFileSync as readFileSync45, realpathSync as realpathSync23, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync28 } from "fs";
+import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync14, mkdirSync as mkdirSync25, openSync as openSync9, readFileSync as readFileSync46, realpathSync as realpathSync23, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync28 } from "fs";
 import { dirname as dirname24, join as join59, relative as relative9, sep as sep13 } from "path";
 function safeRestore(repoDir, f, want, mode) {
   const root = realpathSync23(repoDir), fp = join59(root, f), rel = relative9(root, dirname24(fp));
@@ -14720,7 +14836,7 @@ function safeRestore(repoDir, f, want, mode) {
   } catch {
     st = null;
   }
-  if (st?.isFile() && readFileSync45(fp).equals(want)) {
+  if (st?.isFile() && readFileSync46(fp).equals(want)) {
     chmodSync5(fp, mode);
     return;
   }
@@ -14852,14 +14968,14 @@ var init_scope2 = __esm(() => {
 });
 
 // ../../loki-ts/src/council/role_agents.ts
-import { existsSync as existsSync39, readdirSync as readdirSync19, readFileSync as readFileSync46 } from "fs";
+import { existsSync as existsSync39, readdirSync as readdirSync19, readFileSync as readFileSync47 } from "fs";
 import { homedir as homedir9 } from "os";
 import { join as join60 } from "path";
 function agentDirs(repoDir, env = process.env) {
   return [env["LOKI_AGENTS_PROJECT_DIR"] || join60(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join60(env["XDG_CONFIG_HOME"] || join60(homedir9(), ".config"), "loki", "agents")];
 }
 function parseAgent(file, stem2) {
-  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync46(file, "utf8"));
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync47(file, "utf8"));
   if (!m)
     return null;
   const body = m[2].trim();
@@ -14958,15 +15074,35 @@ var init_child_ledger = __esm(() => {
   init_budget();
 });
 
+// ../../loki-ts/src/util/colors.ts
+function colorDisabled(env = process.env) {
+  return (env["NO_COLOR"] ?? "").length > 0 || env["TERM"] === "dumb";
+}
+function color(code) {
+  return NO_COLOR ? "" : code;
+}
+var NO_COLOR, RED, GREEN, YELLOW, BLUE, CYAN, BOLD, DIM, NC;
+var init_colors = __esm(() => {
+  NO_COLOR = colorDisabled();
+  RED = color("\x1B[0;31m");
+  GREEN = color("\x1B[0;32m");
+  YELLOW = color("\x1B[1;33m");
+  BLUE = color("\x1B[0;34m");
+  CYAN = color("\x1B[0;36m");
+  BOLD = color("\x1B[1m");
+  DIM = color("\x1B[2m");
+  NC = color("\x1B[0m");
+});
+
 // ../../loki-ts/src/util/run_summary.ts
-import { existsSync as existsSync40, mkdirSync as mkdirSync27, readFileSync as readFileSync47, renameSync as renameSync12, statSync as statSync18, writeFileSync as writeFileSync29 } from "fs";
+import { existsSync as existsSync40, mkdirSync as mkdirSync27, readFileSync as readFileSync48, renameSync as renameSync12, statSync as statSync18, writeFileSync as writeFileSync29 } from "fs";
 import { join as join62 } from "path";
 function readRiskRecord(repoDir, sinceMs = 0) {
   try {
     const p = join62(repoDir, ".loki", "state", "risk-tier.json");
     if (statSync18(p).mtimeMs < sinceMs)
       return null;
-    const r = JSON.parse(readFileSync47(p, "utf8"));
+    const r = JSON.parse(readFileSync48(p, "utf8"));
     return r && typeof r === "object" ? r : null;
   } catch {
     return null;
@@ -14977,10 +15113,11 @@ var init_run_summary = __esm(() => {
   init_redact();
   init_output();
   init_run_outputs();
+  init_colors();
 });
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
-import { existsSync as existsSync41, readFileSync as readFileSync48 } from "fs";
+import { existsSync as existsSync41, readFileSync as readFileSync49 } from "fs";
 import { join as join63 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
@@ -14998,7 +15135,7 @@ function explicitReview(repoDir, env) {
     if (!existsSync41(p))
       continue;
     try {
-      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync48(p, "utf8"));
+      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync49(p, "utf8"));
       const v = asProvider(m?.[1]);
       if (v)
         return v;
@@ -15176,7 +15313,7 @@ See also: loki cost --detail (what a run ALREADY spent)
 });
 
 // ../../loki-ts/src/features/contract.ts
-import { existsSync as existsSync42, lstatSync as lstatSync15, mkdirSync as mkdirSync28, readFileSync as readFileSync49, rmSync as rmSync20, writeFileSync as writeFileSync30 } from "fs";
+import { existsSync as existsSync42, lstatSync as lstatSync15, mkdirSync as mkdirSync28, readFileSync as readFileSync50, rmSync as rmSync20, writeFileSync as writeFileSync30 } from "fs";
 import { dirname as dirname27, join as join64 } from "path";
 import { createHash as createHash15 } from "crypto";
 function contractEnabled(env = process.env) {
@@ -15225,7 +15362,7 @@ function readContract(repoDir) {
     return { contract: null, notes: ["contract unreadable: too large"], sha256: null };
   let raw2;
   try {
-    raw2 = readFileSync49(p);
+    raw2 = readFileSync50(p);
   } catch {
     return { contract: null, notes: ["contract unreadable: read failed"], sha256: null };
   }
@@ -15300,7 +15437,7 @@ var init_contract = __esm(() => {
 
 // ../../loki-ts/src/features/speed/seal_group.ts
 import { createHash as createHash16 } from "crypto";
-import { existsSync as existsSync43, mkdirSync as mkdirSync29, readdirSync as readdirSync20, readFileSync as readFileSync50, renameSync as renameSync13, statSync as statSync19, writeFileSync as writeFileSync31 } from "fs";
+import { existsSync as existsSync43, mkdirSync as mkdirSync29, readdirSync as readdirSync20, readFileSync as readFileSync51, renameSync as renameSync13, statSync as statSync19, writeFileSync as writeFileSync31 } from "fs";
 import { dirname as dirname28, join as join65 } from "path";
 function sealGroup(runDir, rh) {
   const manifestPath = join65(runDir, "group", "manifest.json");
@@ -15331,7 +15468,7 @@ function sealGroup(runDir, rh) {
     const dir = join65(unitsDir(runDir), id), rp = join65(dir, "receipt.json"), ep = join65(dir, "events.jsonl");
     let bytes;
     try {
-      bytes = readFileSync50(rp);
+      bytes = readFileSync51(rp);
     } catch {
       return fail2(`unit ${id} sub-receipt missing`);
     }
@@ -15348,7 +15485,7 @@ function sealGroup(runDir, rh) {
       unit_id: id,
       sub_receipt_sha256: sha3(bytes),
       receipt_sha256: sub["receipt_sha256"],
-      events_file_sha256: existsSync43(ep) ? sha3(readFileSync50(ep)) : null,
+      events_file_sha256: existsSync43(ep) ? sha3(readFileSync51(ep)) : null,
       verdict,
       goal: text2(u["goal"], 200),
       files: (Array.isArray(u["files"]) ? u["files"] : []).map((f) => text2(f, 200)).filter(Boolean).slice(0, 50),
@@ -15392,13 +15529,13 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     try {
       if (!statSync19(dir).isDirectory())
         return bad(`unit ${id} is not a directory`);
-      bytes = readFileSync50(rp);
+      bytes = readFileSync51(rp);
     } catch {
       return bad(`unit ${id} sub-receipt missing`);
     }
     if (sha3(bytes) !== e["sub_receipt_sha256"])
       return bad(`unit ${id} sub-receipt does not match its recorded hash`);
-    const evSha = existsSync43(ep) ? sha3(readFileSync50(ep)) : null;
+    const evSha = existsSync43(ep) ? sha3(readFileSync51(ep)) : null;
     if (evSha !== (e["events_file_sha256"] ?? null))
       return bad(`unit ${id} events.jsonl does not match its recorded hash`);
     const sub = readJson6(rp);
@@ -15423,7 +15560,7 @@ function compositeVerdict(childVerdicts) {
 }
 var ID_RE, PASSING, sha3 = (b) => createHash16("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join65(runDir, "group", "units"), readJson6 = (p) => {
   try {
-    return JSON.parse(readFileSync50(p, "utf8"));
+    return JSON.parse(readFileSync51(p, "utf8"));
   } catch {
     return;
   }
@@ -15441,7 +15578,7 @@ var init_seal_group = __esm(() => {
 });
 
 // ../../loki-ts/src/supply/supply_guard.ts
-import { existsSync as existsSync44, readFileSync as readFileSync51, statSync as statSync20 } from "fs";
+import { existsSync as existsSync44, readFileSync as readFileSync52, statSync as statSync20 } from "fs";
 import { basename as basename21, join as join66 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
@@ -15463,7 +15600,7 @@ function readDeclared(repoDir) {
   try {
     if (statSync20(p).size > MAX_FILE_BYTES)
       return { deps: [], problem: "declaration file too large" };
-    const j = JSON.parse(readFileSync51(p, "utf8"));
+    const j = JSON.parse(readFileSync52(p, "utf8"));
     if (!Array.isArray(j))
       return { deps: [], problem: "declaration is not a JSON array" };
     const deps = [];
@@ -15487,7 +15624,7 @@ function readAllowlist(repoDir) {
   if (!existsSync44(p))
     return new Set;
   try {
-    return new Set(readFileSync51(p, "utf8").split(`
+    return new Set(readFileSync52(p, "utf8").split(`
 `).map((l) => l.replace(/#.*$/, "").trim()).filter(Boolean));
   } catch {
     return new Set;
@@ -15670,7 +15807,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
   }
 }, PUBLIC_HOSTS, hostOf = (u) => u.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^www\./, "").split(/[/?#\s]/)[0].replace(/^[^@]*@/, "").replace(/:\d+$/, ""), privateUrl = (u) => /[a-z0-9]/i.test(u) && !PUBLIC_HOSTS.has(hostOf(u)), readSmall = (p) => {
   try {
-    return statSync20(p).size <= MAX_FILE_BYTES ? readFileSync51(p, "utf8") : "";
+    return statSync20(p).size <= MAX_FILE_BYTES ? readFileSync52(p, "utf8") : "";
   } catch {
     return "";
   }
@@ -15686,7 +15823,7 @@ var init_supply_guard = __esm(() => {
 
 // ../../loki-ts/src/engine10/stages/seal.ts
 import { createHash as createHash17 } from "crypto";
-import { existsSync as existsSync45, readdirSync as readdirSync21, mkdirSync as mkdirSync30, readFileSync as readFileSync52, writeFileSync as writeFileSync32 } from "fs";
+import { existsSync as existsSync45, readdirSync as readdirSync21, mkdirSync as mkdirSync30, readFileSync as readFileSync53, writeFileSync as writeFileSync32 } from "fs";
 import { basename as basename22, isAbsolute as isAbsolute11, join as join67, relative as relative10 } from "path";
 function sanitizeReason(s) {
   const collapsed = s.replace(/[\x00-\x1f\x7f]+/g, " ").trim();
@@ -15996,7 +16133,7 @@ var init_seal = __esm(() => {
         provider: ctx.provider,
         model: ctx.model,
         resumed: o.intake?.resumed === true,
-        events_sha256: sha2562(existsSync45(eventsPath) ? readFileSync52(eventsPath) : ""),
+        events_sha256: sha2562(existsSync45(eventsPath) ? readFileSync53(eventsPath) : ""),
         ...await sealEvidence(ctx.repoDir, ctx.runDir, o, notProven, signal, ctx.emit),
         log_seal: true,
         ...receiptBlock(process.env, cost.usd, cost.unmetered === true, totalS),
@@ -16045,93 +16182,6 @@ var init_seal = __esm(() => {
   };
 });
 
-// ../../loki-ts/src/features/receipt_dsse.ts
-import { createPublicKey as createPublicKey3, sign as sign2, verify as verify3 } from "crypto";
-import { readFileSync as readFileSync53 } from "fs";
-function pae(payloadType, body) {
-  const t = Buffer.from(payloadType, "utf8");
-  return Buffer.concat([Buffer.from(`DSSEv1 ${t.length} `), t, Buffer.from(` ${body.length} `), body]);
-}
-function verifyEnvelope(env, pubFor) {
-  if (env.payloadType !== DSSE_PAYLOAD_TYPE)
-    return { ok: false, reason: `unexpected payloadType: ${env.payloadType}` };
-  const body = Buffer.from(env.payload, "base64");
-  let unknown = "", kid = "", known = 0;
-  for (const s of env.signatures) {
-    if (!s || typeof s.keyid !== "string" || typeof s.sig !== "string")
-      continue;
-    const pub = pubFor(s.keyid);
-    if (!pub) {
-      unknown ||= s.keyid;
-      continue;
-    }
-    known++;
-    if (verify3(null, pae(env.payloadType, body), pub, Buffer.from(s.sig, "base64"))) {
-      kid = s.keyid;
-      break;
-    }
-  }
-  if (!kid)
-    return unknown && known === 0 ? { ok: false, unchecked: true, reason: `no key for keyid ${unknown} on this machine (use --pubkey FILE)` } : { ok: false, reason: "DSSE signature does not verify" };
-  let st;
-  try {
-    st = JSON.parse(body.toString("utf8"));
-  } catch {
-    return { ok: false, reason: "payload is not JSON" };
-  }
-  if (st["_type"] !== STATEMENT_TYPE)
-    return { ok: false, reason: "payload is not an in-toto Statement v1" };
-  if (st["predicateType"] !== PREDICATE_TYPE)
-    return { ok: false, reason: `unexpected predicateType: ${String(st["predicateType"])}` };
-  const receipt = st["predicate"];
-  if (!receipt || typeof receipt !== "object")
-    return { ok: false, reason: "statement has no predicate" };
-  const dig = st["subject"]?.[0]?.digest ?? {};
-  if (dig["gitCommit"] !== receipt["head_sha"] || dig["gitTree"] !== undefined && dig["gitTree"] !== receipt["tree"])
-    return { ok: false, reason: "subject digest does not match the receipt head_sha/tree" };
-  return { ok: true, receipt, kid };
-}
-function outcomeOf(j) {
-  try {
-    return String(isEnvelope(j) ? JSON.parse(Buffer.from(j.payload, "base64").toString()).predicate.verdict : j["verdict"]);
-  } catch {
-    return "UNREADABLE";
-  }
-}
-function envelopeRunIdProblem(j, runId) {
-  if (!isEnvelope(j))
-    return null;
-  let id;
-  try {
-    id = JSON.parse(Buffer.from(j.payload, "base64").toString()).predicate?.run_id;
-  } catch {
-    return "envelope payload is not readable";
-  }
-  return id === runId ? null : `envelope predicate.run_id ${JSON.stringify(id)} does not match run id ${JSON.stringify(runId)}`;
-}
-function verifyDsseReceipt(env, d) {
-  const c = verifyEnvelope(env, d.pubFor);
-  if (!c.ok)
-    return { verdict: c.unchecked ? "UNCHECKED" : "TAMPERED", reasons: [c.reason] };
-  const computed = d.hash(c.receipt);
-  if (c.receipt["receipt_sha256"] !== computed)
-    return { verdict: "TAMPERED", reasons: [`receipt_sha256 mismatch: recorded ${JSON.stringify(c.receipt["receipt_sha256"])}, computed ${computed}`] };
-  const jwt = c.receipt["verification"]?.jwt;
-  const o = typeof jwt === "string" ? d.attest(jwt, computed) : { status: "tampered", reason: "receipt carries no attestation" };
-  if (o.status !== "verified")
-    return { verdict: o.status === "tampered" ? "TAMPERED" : "UNCHECKED", reasons: [o.reason ?? "attestation invalid"] };
-  return { verdict: "VERIFIED", reasons: [], receiptSha256: computed };
-}
-function runIdGuard(receiptPath, runId) {
-  try {
-    return envelopeRunIdProblem(JSON.parse(readFileSync53(receiptPath, "utf8")), runId);
-  } catch {
-    return null;
-  }
-}
-var DSSE_PAYLOAD_TYPE = "application/vnd.in-toto+json", STATEMENT_TYPE = "https://in-toto.io/Statement/v1", PREDICATE_TYPE = "https://autonomi.dev/loki/receipt/v10", isEnvelope = (x) => !!x && typeof x === "object" && typeof x.payloadType === "string" && typeof x.payload === "string" && Array.isArray(x.signatures);
-var init_receipt_dsse = () => {};
-
 // ../../loki-ts/src/util/composite_seal.ts
 import { existsSync as existsSync46, readFileSync as readFileSync54 } from "fs";
 import { basename as basename23, dirname as dirname30, join as join68 } from "path";