loki-mode 11.17.52 → 11.17.53

package/packages/control-plane/dist/server.js

@@ -156,7 +156,8 @@ var init_redact = __esm(() => {
     [/github_pat_[A-Za-z0-9_]{20,}/g, "[REDACTED:GITHUB_TOKEN]"],
     [/gh[pousr]_[A-Za-z0-9]{20,}/g, "[REDACTED:GITHUB_TOKEN]"],
     [/xox[baprs]-[A-Za-z0-9-]{10,}/g, "[REDACTED:SLACK_TOKEN]"],
-    [/AKIA[0-9A-Z]{16}/g, "[REDACTED:AWS_KEY]"],
+    [/(?:AKIA|ASIA)[0-9A-Z]{16}/g, "[REDACTED:AWS_KEY]"],
+    [/(AccountKey=)[A-Za-z0-9+/]{40,}={0,2}/g, "$1[REDACTED:AZURE_KEY]"],
     [/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[REDACTED:JWT]"],
     [/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g, "[REDACTED:SENDGRID_KEY]"],
     [/\bSK[0-9a-f]{32}\b/g, "[REDACTED:TWILIO_KEY]"],
@@ -270,7 +271,7 @@ function tokenFreeEnv(env = process.env) {
   return out;
 }
 function driverKeys(repoDir) {
-  const r = spawnSync("git", [...SAFE_GIT_CONFIG, "config", "--includes", "--show-scope", "-z", "--get-regexp", DRIVER_KEY_RE], { cwd: repoDir, env: safeGitEnv(), encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+  const r = spawnSync("git", [...SAFE_GIT_CONFIG, "config", "--includes", "--show-scope", "-z", "--get-regexp", DRIVER_KEY_RE], { cwd: repoDir, env: safeGitEnv(), encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: configEnumTimeoutMs(), killSignal: "SIGKILL" });
   if (r.error)
     throw r.error;
   if (r.status === 1)
@@ -287,7 +288,7 @@ function driverKeys(repoDir) {
   return [...new Set(keys)];
 }
 function netCommandOverrides(repoDir, env) {
-  const r = spawnSync("git", [...CREDENTIAL_CONFIG, "config", "--includes", "--show-scope", "-z", "--get-regexp", NET_CMD_KEY_RE], { cwd: repoDir, env: safeGitEnv(env, true), encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+  const r = spawnSync("git", [...CREDENTIAL_CONFIG, "config", "--includes", "--show-scope", "-z", "--get-regexp", NET_CMD_KEY_RE], { cwd: repoDir, env: safeGitEnv(env, true), encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: configEnumTimeoutMs(), killSignal: "SIGKILL" });
   if (r.error)
     throw r.error;
   if (r.status === 1)
@@ -422,6 +423,9 @@ var SAFE_GIT_CONFIG, CREDENTIAL_CONFIG, DRIVER_CONFIG, ATTRS_OFF = "core.attribu
   delete env.GIT_ATTR_SOURCE;
   delete env.GIT_EXTERNAL_DIFF;
   return env;
+}, configEnumTimeoutMs = () => {
+  const n2 = Number(process.env.LOKI_SAFE_GIT_CONFIG_TIMEOUT_MS);
+  return Number.isFinite(n2) && n2 > 0 ? n2 : 30000;
 }, NET_CMD_KEY_RE = "^(core\\.(sshcommand|gitproxy|askpass)|remote\\..*\\.(uploadpack|receivepack|proxy)|credential(\\..*)?\\.helper|https?\\.(.*\\.)?(proxy|sslverify|sslcainfo|sslcapath|curloptresolve))$", BOOL_SAFE_DEFAULT, LOCAL_SCOPES, PUSH_CMD, PACK_OPTS, TRANSPORT_OR_LOCAL;
 var init_safe_git = __esm(() => {
   init_credential_env();
@@ -11001,6 +11005,249 @@ var init_run_control = __esm(() => {
   PARENT_PID = process.ppid;
 });
 
+// ../../loki-ts/src/cli/registry.ts
+function cmd(name, cls, where, desc2, reason, extra = {}) {
+  return { name, cls, where, desc: desc2, reason, ...extra };
+}
+var bool = (name, desc2, excludes) => ({ name, type: "bool", desc: desc2, ...excludes ? { excludes } : {} }), json, str3 = (name, placeholder, desc2) => ({ name, type: "string", placeholder, desc: desc2 }), dyn = (name, dynamic, desc2) => ({ name, type: "dynamic", dynamic, desc: desc2 }), sub = (name, desc2, extra = {}) => ({ name, desc: desc2, ...extra }), port, dbFlag, runId, legacy = (name, desc2, reason, aliases) => cmd(name, "DROP-LEGACY", "bash", desc2, reason, aliases ? { aliases } : {}), startFlags, REGISTRY;
+var init_registry2 = __esm(() => {
+  json = bool("--json", "Machine-readable JSON output");
+  port = { name: "--port", type: "int", placeholder: "<port>", desc: "Port" };
+  dbFlag = { name: "--db", type: "path", desc: "Database path" };
+  runId = { name: "id", type: "dynamic", dynamic: "runs" };
+  startFlags = [
+    dyn("--provider", "providers", "AI provider"),
+    bool("--parallel", "Parallel mode with git worktrees"),
+    str3("--workspace", "<name>", "Run a loki.yaml workspace (multi-repo) for the brief"),
+    bool("--deploy", "After a VERIFIED run, deploy through the gated loki deploy --execute"),
+    str3("--health-url", "<url>", "With --deploy: probe this URL after the deploy"),
+    bool("--auto-rollback", "With --deploy: roll back automatically when the health probe fails"),
+    bool("--bg", "Run in background mode"),
+    bool("--simple", "Force simple complexity tier", ["--complex"]),
+    bool("--complex", "Force complex complexity tier", ["--simple"]),
+    bool("--github", "Enable GitHub issue import"),
+    bool("--no-dashboard", "Disable the web dashboard"),
+    bool("--sandbox", "Run in a Docker sandbox"),
+    { name: "--isolation", type: "enum", values: ["none", "worktree", "docker"], desc: "Per-run isolation level" },
+    bool("--skip-memory", "Skip loading memory context at startup"),
+    bool("--fresh-prd", "Regenerate the PRD from the codebase"),
+    { name: "--compliance", type: "enum", values: ["default", "healthcare", "fintech", "government"], desc: "Compliance preset" },
+    str3("--budget", "<usd>", "Cost budget limit in USD"),
+    { name: "--cost", type: "enum", values: ["lean", "off"], desc: "Cost profile (also LOKI_COST_PROFILE)" },
+    { name: "--bmad-project", type: "path", desc: "BMAD Method project artifacts as input" },
+    { name: "--openspec", type: "path", desc: "OpenSpec change directory as input" },
+    { name: "--config", type: "path", desc: "Load settings from a config file" }
+  ];
+  REGISTRY = [
+    cmd("version", "KEEP-MODERN", "bun", "Show version", "Bun-native, no legacy dependency", { aliases: ["--version", "-v"] }),
+    cmd("status", "UPDATE", "both", "Show current run status", "Reads both engines; fold legacy fields into the v10 view", { flags: [json, bool("--badge", "Print the verified deploy badge"), bool("--probe", "Re-probe the last deploy health URL; exit 1 on regression")], example: "loki status --json" }),
+    cmd("stats", "DELETE", "bun", "Session statistics (alias of report session)", "Deprecated alias; use report session", { flags: [json, bool("--efficiency", "Token and cost efficiency")] }),
+    cmd("doctor", "KEEP-MODERN", "both", "System prerequisites health check; --json, --fix, --requirements, --repo (repo profile with a 0-100 readiness score and fixes)", "Core onboarding gate", { flags: [json, bool("--fix", "Apply safe fixes; with --repo, build or refresh the repo profile"), bool("--yes", "With --fix: run the claude install and login without asking"), bool("--airgap", "Air-gapped check"), bool("--repo", "Print the repo profile and readiness score"), bool("--requirements", "Requirements per execution path")], example: "loki doctor --json" }),
+    cmd("provider", "KEEP-MODERN", "both", "Show, list or set the AI provider", "Provider-agnostic core", {
+      subcommands: [
+        sub("show", "Show current provider", { positionals: [{ name: "name", type: "dynamic", dynamic: "providers" }] }),
+        sub("list", "List providers and install status"),
+        sub("set", "Switch the active provider", { positionals: [{ name: "name", type: "dynamic", dynamic: "providers" }] }),
+        sub("info", "Provider details; --json prints the capability contract", { positionals: [{ name: "name", type: "dynamic", dynamic: "providers" }] }),
+        sub("matrix", "Capability matrix per provider and engine")
+      ]
+    }),
+    cmd("memory", "UPDATE", "both", "Cross-project learnings", "Memory still carries legacy store paths", {
+      subcommands: [
+        sub("list", "All learnings", { flags: [bool("--json", "Print the learnings summary as JSON")] }),
+        sub("index", "Show or rebuild the memory index", { positionals: [{ name: "action", type: "enum", values: ["rebuild"] }] }),
+        sub("learn", "Learn lessons from a merged PR's review comments", { positionals: [{ name: "pr", type: "string" }] }),
+        sub("lessons", "List PR review lessons with uses and outcomes", { flags: [bool("--json", "Print the lessons as JSON")] }),
+        sub("brief", "Print the lessons and learnings block an engine10 run injects", { flags: [str3("--task", "text", "Task text used to pick relevant lessons")] }),
+        sub("show", "Show one learning"),
+        sub("search", "Search learnings"),
+        sub("stats", "Memory statistics"),
+        sub("consolidate", "Episodic-to-semantic pipeline"),
+        sub("compound", "Compound learnings")
+      ]
+    }),
+    cmd("rollback", "KEEP-MODERN", "both", "Restore .loki/ state from a checkpoint", "Checkpoint restore is engine-neutral", {
+      subcommands: [
+        sub("list", "List checkpoints", { flags: [bool("--json", "Print the checkpoints as a JSON array")] }),
+        sub("show", "Show a checkpoint", { positionals: [runId] }),
+        sub("to", "Restore a checkpoint", { positionals: [runId] }),
+        sub("latest", "Restore the latest checkpoint"),
+        sub("deploy", "Print the provider rollback command for the last deploy (read-only)")
+      ]
+    }),
+    cmd("backup", "KEEP-MODERN", "bash", "Back up dashboard state (audit log, checkpoint) with a sha256 manifest", "Enterprise retention and backup (D99 item 7)", { flags: [str3("--dir", "<path>", "State directory (default ~/.loki/dashboard)"), str3("--out", "<archive>", "Archive path (default ./loki-backup-<timestamp>.tar.gz)")] }),
+    cmd("restore", "KEEP-MODERN", "bash", "Restore dashboard state from a verified backup archive", "Enterprise retention and backup (D99 item 7)", { flags: [str3("--dir", "<path>", "State directory (default ~/.loki/dashboard)"), bool("--force", "Replace a non-empty state directory (old one is kept aside)"), str3("--sha256", "<hex>", "Expected archive digest when no .sha256 sidecar exists")], positionals: [{ name: "archive", type: "path" }] }),
+    cmd("proof", "KEEP-MODERN", "both", "Inspect and share proof-of-run receipts", "The Evidence Receipt moat", {
+      aliases: ["receipt"],
+      subcommands: [
+        sub("list", "List receipts"),
+        sub("show", "Show a receipt", { positionals: [runId] }),
+        sub("open", "Open a receipt", { positionals: [runId] }),
+        sub("share", "Share a receipt", { positionals: [runId] }),
+        sub("badge", "Print the Verified by Loki badge", { positionals: [runId] }),
+        sub("md", "Print badge markdown for a README", { positionals: [runId] }),
+        sub("bundle", "Write a self-verifying receipt bundle", { positionals: [runId] })
+      ]
+    }),
+    cmd("wiki", "KEEP-MODERN", "both", "Cited codebase wiki and Q&A", "Bun-native knowledge feature", {
+      subcommands: [
+        sub("generate", "Generate the wiki"),
+        sub("show", "Show a section", { positionals: [{ name: "section", type: "string" }] }),
+        sub("ask", "Ask a question", { positionals: [{ name: "question", type: "string" }] })
+      ]
+    }),
+    cmd("control", "KEEP-MODERN", "both", "Control Plane (serve, backfill, prune, stop, status)", "D56 control plane, on by default", {
+      subcommands: [
+        sub("serve", "Run the control plane and UI", { flags: [port, dbFlag] }),
+        sub("backfill", "Ship DIR/.loki/runs to the control plane", { positionals: [{ name: "dir", type: "path" }] }),
+        sub("prune", "Delete matching runs", { flags: [str3("--repo", "<owner/name>", "Repository to prune"), str3("--before", "<iso-date>", "Prune runs before this date"), bool("--dry-run", "Report only"), dbFlag] }),
+        sub("stop", "Stop the running control plane"),
+        sub("status", "Show control plane reachability", { flags: [bool("--json", "Print one JSON object")] })
+      ]
+    }),
+    cmd("intent", "KEEP-MODERN", "bun", "Show a past run's intent card", "Read-only intent view", { subcommands: [sub("show", "Print the intent card and answer", { positionals: [runId] })] }),
+    cmd("kpis", "KEEP-MODERN", "bun", "KPI snapshot (alias of report kpis)", "Bun-native KPI report", { flags: [json, str3("--since", "<Nd|YYYY-MM-DD>", "Limit iteration totals to a window")] }),
+    cmd("report", "UPDATE", "both", "Reporting: kpis, session, metrics, cost, export, share, dogfood", "Mixed route; only kpis is Bun", {
+      subcommands: [
+        sub("kpis", "Canonical KPI snapshot", { flags: [json, str3("--since", "<Nd|YYYY-MM-DD>", "Limit iteration totals to a window")] }),
+        sub("session", "Session report", { flags: [bool("--efficiency", "Token and cost stats")] }),
+        sub("metrics", "Metrics report"),
+        sub("cost", "Cost report"),
+        sub("export", "Export session", { positionals: [{ name: "format", type: "enum", values: ["json", "markdown", "csv", "timeline", "vibe-kanban"] }] }),
+        sub("share", "Share a report"),
+        sub("dogfood", "Dogfood report")
+      ]
+    }),
+    cmd("trust", "KEEP-MODERN", "both", "Trust trajectory from proof history", "Trust moat surface", { flags: [bool("--json", "Print the trust trajectory as JSON")], subcommands: [sub("detail", "Trust metrics detail")] }),
+    cmd("crash", "KEEP-MODERN", "both", "Inspect or submit scrubbed crash reports", "Local-only crash plumbing", {
+      subcommands: [sub("list", "List stored crash reports"), sub("show", "Show one scrubbed crash report"), sub("submit", "Submit a scrubbed crash report"), sub("help", "Show crash usage")]
+    }),
+    cmd("contract", "KEEP-MODERN", "bun", "Print the spec delivery contract", "v10 delivery contract", { positionals: [{ name: "spec", type: "path" }] }),
+    cmd("start", "UPDATE", "both", "Run the autonomous build (a `jira:KEY` or `linear:KEY` ref also writes the outcome back to that ticket, see docs/trackers.md)", "Forks between v10 and the SDK loop; flags still legacy-shaped", { flags: startFlags, positionals: [{ name: "spec", type: "path" }], example: "loki start ./prd.md --provider claude" }),
+    cmd("slack", "KEEP-MODERN", "bun", "Slack inbound handler", "Bun-native integration", { subcommands: [sub("serve", "Serve the Slack handler", { flags: [port, str3("--host", "<host>", "Bind host")] })] }),
+    cmd("queue", "KEEP-MODERN", "bun", "Overnight issue queue with a morning digest", "Governor-aware batch of issue-mode runs", { subcommands: [sub("add", "Queue issue refs", { positionals: [{ name: "issue", type: "string" }] }), sub("list", "Show the queue", { flags: [bool("--json", "Print the queued refs as a JSON array")] }), sub("remove", "Take issue refs out of the queue", { positionals: [{ name: "issue", type: "string" }] }), sub("clear", "Empty the queue"), sub("run", "Process the queue", { flags: [bool("--no-pr", "Do not open pull requests"), str3("--max-total-cost", "<usd>", "Stop before the next item once cumulative spend reaches this cap")] })] }),
+    cmd("issues", "KEEP-MODERN", "bun", "Run every open issue in a repo and open PRs", "Mass issue pickup on the T7 queue", {
+      subcommands: [sub("run", "Triage and run open issues; split too-large ones into stacked PRs", {
+        example: "loki issues run owner/repo --label bug --limit 10",
+        positionals: [{ name: "repo", type: "string" }],
+        flags: [str3("--label", "<label>", "Only issues with this label"), { name: "--limit", type: "int", placeholder: "<n>", desc: "At most this many issues" }, { name: "--parallel", type: "int", placeholder: "<k>", desc: "Runs at once, at most 4 (separate worktrees)" }, bool("--draft", "Open every PR as a draft"), bool("--dry-run", "List, dedupe and show the plan; no model calls"), bool("--json", "With --dry-run: print the plan as JSON (number, decision, reason, covered_by_pr)"), bool("--yes", "Skip the cost confirmation (CI)"), bool("--comment", "Comment the triage reason on skipped issues and the slice plan on split ones"), bool("--no-split", "Skip too-large issues instead of splitting them into stacked PRs")]
+      })]
+    }),
+    cmd("undo", "KEEP-MODERN", "bun", "Plan or apply an undo of a run", "UNDO-1/2: --plan is read-only, apply behind LOKI_UNDO=1", { flags: [bool("--plan", "Read-only plan"), bool("--list", "List runs that can be undone"), bool("--dry-run", "Report what would be undone; change nothing"), bool("--json", "JSON plan (with --plan)"), bool("--allow-unsigned", "Accept an unsigned receipt (with --plan)"), bool("--yes", "Skip the confirm prompt"), bool("--close-pr", "Also close the PR")], positionals: [{ name: "run", type: "dynamic", dynamic: "runs" }] }),
+    cmd("verify-pr", "KEEP-MODERN", "bun", "Verify a PR against its linked issue in a sandbox", "VPR-2: fail-to-pass check, LOKI_VERIFY_PR=1", { flags: [{ name: "--out", type: "path", desc: "Result directory" }, bool("--json", "Print the verdict object on stdout")], positionals: [{ name: "pr", type: "string" }], subcommands: [sub("respond", "Fix open review comments on the PR branch, one commit each, reply with the sha", { positionals: [{ name: "pr", type: "string" }] })] }),
+    cmd("answer", "KEEP-MODERN", "bun", "Start a follow-up run from a BLOCKED run with your answer", "v10 blocked-run flow", { flags: [bool("--text", "Answer text inline")], positionals: [{ name: "run", type: "dynamic", dynamic: "runs" }] }),
+    cmd("engine10", "KEEP-MODERN", "bun", "v10 engine router", "The v10 engine", {
+      subcommands: [sub("run", "Run the v10 engine"), sub("status", "v10 status"), sub("verify", "v10 verify"), sub("keys", "v10 keys"), sub("dashboard", "v10 dashboard"), sub("modernize", "v10 modernize")]
+    }),
+    cmd("internal", "KEEP-MODERN", "bun", "Internal plumbing for the bash CLI", "Hidden plumbing", { hidden: true }),
+    cmd("completion", "KEEP-MODERN", "bun", "Generate shell completions", "Hidden plumbing; completions install themselves", { hidden: true, positionals: [{ name: "shell", type: "enum", values: ["bash", "zsh", "fish"] }] }),
+    cmd("__complete", "KEEP-MODERN", "bun", "Dynamic completion values", "Hidden plumbing for generated completions", { hidden: true, positionals: [{ name: "kind", type: "enum", values: ["providers", "models", "branches", "runs", "issues", "workspaces"] }] }),
+    cmd("help", "KEEP-MODERN", "bash", "Show help", "Core", { aliases: ["--help", "-h"], positionals: [{ name: "command", type: "string" }] }),
+    cmd("chat", "KEEP-MODERN", "bash", "Interactive chat with the active provider", "Provider-neutral conversational verb", { positionals: [{ name: "message", type: "string" }] }),
+    cmd("edit", "KEEP-MODERN", "bash", "Make one small scoped edit", "Provider-neutral single-edit verb", { positionals: [{ name: "task", type: "string" }] }),
+    cmd("diff", "KEEP-MODERN", "bash", "Show what the last run changed", "Passes extra args to git diff"),
+    cmd("models", "KEEP-MODERN", "bash", "Show per-provider model routes", "Provider-neutral model tiers"),
+    cmd("setup", "KEEP-MODERN", "bash", "Guided first-run setup wizard", "Onboarding gate"),
+    cmd("quick", "UPDATE", "bash", "One small task", "Routes to the v10 lean path by default", { positionals: [{ name: "task", type: "string" }] }),
+    cmd("quickstart", "KEEP-MODERN", "bash", "Guided first build", "Onboarding path", { positionals: [{ name: "idea", type: "string" }] }),
+    cmd("init", "UPDATE", "bash", "Scaffold from a template", "Templates predate v10", { flags: [str3("-t", "<template>", "Template name")] }),
+    cmd("template", "KEEP-MODERN", "bash", "Manage PRD templates", "Engine-neutral"),
+    cmd("verify", "UPDATE", "bash", "Deterministic PR verification", "Legacy proof vs v10 verify split", { flags: [bool("--fast", "PR-scoped fast verify"), bool("--pr", "PR mode"), json, dyn("--base", "branches", "Base branch")], positionals: [{ name: "base", type: "dynamic", dynamic: "branches" }] }),
+    cmd("keys", "KEEP-MODERN", "bash", "Receipt-signing keys", "Trust moat", { subcommands: [sub("export", "Print the public signing key (JWK)")] }),
+    cmd("review", "UPDATE", "bash", "Standalone code review with quality gates", "Gates are legacy-shaped"),
+    cmd("dashboard", "UPDATE", "bash", "Operations UI server", "Overlaps Control Plane", { subcommands: [sub("start", "Start"), sub("stop", "Stop"), sub("status", "Status"), sub("url", "Print URL"), sub("open", "Open in browser")] }),
+    cmd("config", "UPDATE", "bash", "Manage configuration", "Mixed legacy keys", { subcommands: [sub("show", "Show config"), sub("list", "List config (alias of show)"), sub("init", "Create config"), sub("edit", "Edit config"), sub("path", "Print config path"), sub("set", "Set a value"), sub("get", "Get a value")] }),
+    cmd("mcp", "KEEP-MODERN", "bash", "Launch the MCP server (stdio)", "Engine-neutral", { subcommands: [sub("install", "Register loki-mode in an MCP client config", { flags: [str3("--client", "<name>", "claude, cursor, vscode or windsurf"), bool("--project", "Project-level config"), bool("--global", "User-level config"), bool("--print", "Print, write nothing")] })] }),
+    cmd("acp", "KEEP-MODERN", "bash", "Run Loki as an ACP agent", "Engine-neutral"),
+    cmd("stop", "KEEP-MODERN", "bash", "Stop execution immediately", "Session control"),
+    cmd("pause", "KEEP-MODERN", "both", "Pause after the current session", "Session control; Bun writes the Loki 10 run request, bash keeps the legacy PAUSE file"),
+    cmd("resume", "KEEP-MODERN", "both", "Resume a paused or interrupted run", "Session control; Bun clears a Loki 10 pause, bash keeps the legacy resume"),
+    cmd("cancel", "KEEP-MODERN", "both", "Cancel the active Loki 10 run at the next stage boundary", "Session control; Loki 10 only"),
+    cmd("why", "KEEP-MODERN", "bash", "Explain how the last run ended", "Outcome explainer"),
+    cmd("next", "KEEP-MODERN", "bash", "Run the right next step", "Guided flow"),
+    cmd("logs", "KEEP-MODERN", "bash", "Tail recent log output", "Engine-neutral"),
+    cmd("ship", "KEEP-MODERN", "bash", "Ship the verified result", "Delivery"),
+    cmd("deploy", "KEEP-MODERN", "bash", "Deploy the built product", "Delivery"),
+    cmd("import", "KEEP-MODERN", "bash", "Import issues or specs", "Spec intake"),
+    cmd("github", "KEEP-MODERN", "bash", "GitHub integration", "Integration"),
+    cmd("issue", "KEEP-MODERN", "bash", "Work an issue", "Issue-mode", { positionals: [{ name: "ref", type: "dynamic", dynamic: "issues" }] }),
+    cmd("ci", "KEEP-MODERN", "bash", "CI helpers", "Engine-neutral"),
+    cmd("modernize", "KEEP-MODERN", "both", "Code modernization", "Routed to engine10 modernize"),
+    cmd("share", "KEEP-MODERN", "bash", "Share a run", "Engine-neutral"),
+    cmd("assets", "KEEP-MODERN", "bash", "Export team assets", "Engine-neutral", { subcommands: [sub("export", "Export shareable assets", { positionals: [{ name: "file", type: "path" }] })] }),
+    cmd("export", "UPDATE", "bash", "Export session data", "Duplicates report export", { flags: [bool("--sarif", "Write findings.sarif for a run (SARIF 2.1.0)")] }),
+    cmd("notify", "KEEP-MODERN", "bash", "Notifications", "Engine-neutral"),
+    cmd("tour", "KEEP-MODERN", "bash", "See a sample result", "Onboarding"),
+    cmd("welcome", "KEEP-MODERN", "bash", "First-run opener", "Onboarding"),
+    cmd("onboard", "UPDATE", "bash", "Onboard to a codebase", "Overlaps wiki"),
+    cmd("setup-skill", "KEEP-MODERN", "bash", "Install the skill symlinks", "Setup"),
+    cmd("self-update", "KEEP-MODERN", "bash", "Update Loki", "Maintenance", { aliases: ["self_update", "update"] }),
+    cmd("remote", "KEEP-MODERN", "bash", "Remote session", "Engine-neutral", { aliases: ["rc"] }),
+    cmd("cockpit", "KEEP-MODERN", "bash", "Live multi-repo cockpit", "Engine-neutral"),
+    cmd("code", "UPDATE", "bash", "Code intelligence", "Overlaps wiki"),
+    cmd("context", "KEEP-MODERN", "bash", "Cross-project context", "Engine-neutral", { aliases: ["ctx"] }),
+    cmd("secrets", "KEEP-MODERN", "bash", "Secrets handling", "Security"),
+    cmd("api", "KEEP-MODERN", "bash", "Dashboard HTTP API", "Engine-neutral"),
+    cmd("sandbox", "KEEP-MODERN", "bash", "Docker sandbox", "Isolation"),
+    cmd("docker", "KEEP-MODERN", "bash", "Docker helpers", "Isolation"),
+    cmd("web", "UPDATE", "bash", "Web UI", "Overlaps Control Plane UI"),
+    cmd("preview", "KEEP-MODERN", "bash", "Preview the built app", "Delivery"),
+    cmd("telemetry", "KEEP-MODERN", "bash", "Telemetry controls", "Privacy surface", { aliases: ["otel"] }),
+    cmd("syslog", "UPDATE", "bash", "System log forwarding", "Legacy log paths"),
+    cmd("explain", "KEEP-MODERN", "bash", "Explain code", "Knowledge"),
+    cmd("docs", "KEEP-MODERN", "bash", "Open docs", "Core"),
+    cmd("test", "UPDATE", "bash", "Run project tests", "Legacy runner"),
+    cmd("bench", "KEEP-MODERN", "bash", "Benchmarks", "Engine-neutral"),
+    cmd("voice", "UPDATE", "bash", "Voice input", "Experimental"),
+    cmd("own", "UPDATE", "bash", "Hand off ownership", "Legacy handoff", { aliases: ["handoff"] }),
+    cmd("secure", "KEEP-MODERN", "bash", "Security scan", "Security"),
+    cmd("compliance", "KEEP-MODERN", "bash", "Compliance reports", "Enterprise"),
+    cmd("enterprise", "KEEP-MODERN", "bash", "Enterprise features", "Enterprise"),
+    cmd("projects", "KEEP-MODERN", "bash", "Project registry", "Engine-neutral"),
+    cmd("audit", "KEEP-MODERN", "bash", "Audit log", "Enterprise"),
+    cmd("cost", "UPDATE", "bash", "Cost report", "Duplicates report cost"),
+    cmd("metrics", "UPDATE", "bash", "Metrics", "Duplicates report metrics"),
+    cmd("sentrux", "UPDATE", "bash", "Architecture sensor", "Legacy gate input"),
+    cmd("magic", "UPDATE", "bash", "Magic modules", "Legacy UI generator"),
+    legacy("estimate", "Cost estimate for a PRD", "Estimates the legacy PRD flow"),
+    legacy("plan", "Dry-run PRD analysis", "Legacy PRD flow"),
+    legacy("grill", "Spec interrogation", "Legacy PRD flow"),
+    legacy("spec", "Living-spec drift", "Legacy PRD flow"),
+    legacy("intent", "Intent capture", "Legacy PRD flow"),
+    legacy("backlog", "Run matching issues in parallel", "Drives legacy RARV per issue"),
+    legacy("workspace", "Multi-repo workspace runs", "Drives legacy RARV"),
+    legacy("council", "Completion council", "Legacy RARV gate"),
+    legacy("compound", "Compound-learning pipeline", "Legacy memory pipeline"),
+    legacy("cluster", "Cluster mode", "Legacy RARV"),
+    legacy("optimize", "Optimize loop", "Legacy RARV"),
+    legacy("ultracode", "Claude Dynamic Workflow run", "Legacy Claude-only"),
+    legacy("monitor", "Monitor a legacy run", "Legacy engine state"),
+    legacy("watch", "Rerun on PRD change", "PRD flow"),
+    legacy("watchdog", "Legacy run watchdog", "Legacy engine"),
+    legacy("cleanup", "Kill orphaned processes", "Legacy run.sh orphans"),
+    legacy("state", "Legacy state store", "Legacy engine"),
+    legacy("agent", "Legacy agent types", "Legacy engine"),
+    legacy("agents", "User-configurable child agents (.loki/agents)", "Legacy engine"),
+    legacy("trigger", "Event triggers", "Legacy engine"),
+    legacy("failover", "Provider failover", "Legacy engine"),
+    legacy("reset", "Reset legacy state", "Legacy engine"),
+    legacy("merge", "Gated PR merge queue (pr, watch, run); also merges parallel worktrees", "Bash PR merge gate"),
+    legacy("heal", "Legacy healing", "Legacy engine"),
+    legacy("migrate", "Legacy migration", "Superseded by modernize"),
+    legacy("dogfood", "Dogfood run", "Legacy engine"),
+    cmd("steer", "KEEP-MODERN", "bash", "Nudge a running build", "Session control"),
+    legacy("outcomes", "Outcome analytics", "Legacy outcome store"),
+    legacy("worktree", "Worktree management", "Legacy parallel mode", ["wt"]),
+    legacy("checkpoint", "Legacy checkpoints", "Legacy engine", ["cp"]),
+    legacy("analyze", "Codebase analysis", "Legacy analyze flow"),
+    legacy("demo", "Build the sample todo app", "Legacy engine demo"),
+    cmd("run", "DELETE", "bash", "Deprecated alias of start", "Alias; use start"),
+    cmd("trust-metrics", "DELETE", "bash", "Deprecated alias of trust detail", "Alias; use trust detail"),
+    cmd("serve", "DELETE", "bash", "Deprecated alias of api start", "Alias; use api start"),
+    cmd("open", "DELETE", "bash", "Deprecated alias of dashboard open", "Alias; use dashboard open")
+  ];
+});
+
 // ../../loki-ts/src/features/receipt_dsse.ts
 import { createPublicKey as createPublicKey3, sign as sign2, verify as verify3 } from "crypto";
 import { readFileSync as readFileSync33 } from "fs";
@@ -11054,7 +11301,7 @@ function outcomeOf(j) {
     return "UNREADABLE";
   }
 }
-function envelopeRunIdProblem(j, runId) {
+function envelopeRunIdProblem(j, runId2) {
   if (!isEnvelope(j))
     return null;
   let id;
@@ -11063,7 +11310,7 @@ function envelopeRunIdProblem(j, runId) {
   } catch {
     return "envelope payload is not readable";
   }
-  return id === runId ? null : `envelope predicate.run_id ${JSON.stringify(id)} does not match run id ${JSON.stringify(runId)}`;
+  return id === runId2 ? null : `envelope predicate.run_id ${JSON.stringify(id)} does not match run id ${JSON.stringify(runId2)}`;
 }
 function verifyDsseReceipt(env, d) {
   const c = verifyEnvelope(env, d.pubFor);
@@ -11078,9 +11325,9 @@ function verifyDsseReceipt(env, d) {
     return { verdict: o.status === "tampered" ? "TAMPERED" : "UNCHECKED", reasons: [o.reason ?? "attestation invalid"] };
   return { verdict: "VERIFIED", reasons: [], receiptSha256: computed };
 }
-function runIdGuard(receiptPath, runId) {
+function runIdGuard(receiptPath, runId2) {
   try {
-    return envelopeRunIdProblem(JSON.parse(readFileSync33(receiptPath, "utf8")), runId);
+    return envelopeRunIdProblem(JSON.parse(readFileSync33(receiptPath, "utf8")), runId2);
   } catch {
     return null;
   }
@@ -11094,12 +11341,14 @@ var init_forecast = () => {};
 var init_queue = __esm(() => {
   init_atomic();
   init_paths();
+  init_registry2();
   init_forecast();
 });
 
 // ../../loki-ts/src/commands/undo.ts
 var READ_ONLY_GIT;
 var init_undo = __esm(() => {
+  init_registry2();
   init_paths();
   init_safe_git();
   init_verify_cmd();
@@ -11199,7 +11448,7 @@ function mutationProof(i) {
     return np("no recorded Wall test command");
   if (tests.length !== rels.length)
     return np("a Wall file has no recorded test command");
-  const budgetS = Math.min(i.timeoutS ?? (Number((i.env ?? process.env)["LOKI_MUTATION_PROOF_TIMEOUT_S"] ?? 30) || 30), MAX_TOTAL_S);
+  const budgetS = Math.min(i.timeoutS ?? envTimeoutS((i.env ?? process.env)["LOKI_MUTATION_PROOF_TIMEOUT_S"]), MAX_TOTAL_S);
   const deadline = Date.now() + budgetS * 1000, remaining = () => deadline - Date.now();
   let parent = null, wt = null, added = false;
   try {
@@ -11255,7 +11504,10 @@ function mutationProof(i) {
       rmSync10(parent, { recursive: true, force: true });
   }
 }
-var mutationStrict = (env = process.env) => (env["LOKI_MUTATION_STRICT"] ?? "").trim() === "1", mutationEnabled = (env = process.env) => (env["LOKI_MUTATION_PROOF"] ?? "").trim() !== "0", LABEL = "test fails without the fix: ", np = (reason) => ({ outcome: "inconclusive", line: `${LABEL}inconclusive (${reason})` }), MAX_TOTAL_S = 40, DEP_DIRS, git = (cwd, args, timeout = 30000) => {
+var mutationStrict = (env = process.env) => (env["LOKI_MUTATION_STRICT"] ?? "").trim() === "1", mutationEnabled = (env = process.env) => (env["LOKI_MUTATION_PROOF"] ?? "").trim() !== "0", LABEL = "test fails without the fix: ", np = (reason) => ({ outcome: "inconclusive", line: `${LABEL}inconclusive (${reason})` }), MAX_TOTAL_S = 40, envTimeoutS = (raw2) => {
+  const n2 = Number(raw2 ?? 30);
+  return Number.isFinite(n2) && n2 > 0 ? n2 : 30;
+}, DEP_DIRS, git = (cwd, args, timeout = 30000) => {
   try {
     safeGit(cwd, args, { timeout });
     return { status: 0 };
@@ -11836,8 +12088,8 @@ function holdoutSplit(seed, ids, opts) {
   const held = new Set(ranked.slice(0, Math.max(1, Math.round(opts.ratio * ids.length))).map((r) => r.id));
   return ids.filter((id) => held.has(id));
 }
-function removeHoldout(runId, repoDir) {
-  rmSync12(holdoutDirFor(runId, repoDir), { recursive: true, force: true });
+function removeHoldout(runId2, repoDir) {
+  rmSync12(holdoutDirFor(runId2, repoDir), { recursive: true, force: true });
 }
 function stashHoldout(o) {
   const eligible = o.names.filter((n2) => o.runnerOf(n2) !== null);
@@ -11887,7 +12139,7 @@ function recordHoldoutTriage(runDir, entry) {
 `, { mode: 384 });
   } catch {}
 }
-var sha2 = (s) => createHash13("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId, repoDir) => join44(tmpdir6(), `loki-e10-holdout-${sha2(`${runId}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
+var sha2 = (s) => createHash13("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId2, repoDir) => join44(tmpdir6(), `loki-e10-holdout-${sha2(`${runId2}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
 var init_holdout = () => {};
 
 // ../../loki-ts/src/features/runner_config.ts
@@ -12614,11 +12866,11 @@ function killTree(pid) {
   }
 }
 async function runOnBase(i, dir) {
-  const sub = (s) => s.split(i.repoDir).join(dir);
+  const sub2 = (s) => s.split(i.repoDir).join(dir);
   const stop = AbortSignal.any([i.signal, AbortSignal.timeout(i.timeoutMs ?? 60000)]);
   try {
-    const proc = Bun.spawn([sub(i.cmd), ...i.args.map(sub)], {
-      cwd: sub(i.cwd ?? i.repoDir),
+    const proc = Bun.spawn([sub2(i.cmd), ...i.args.map(sub2)], {
+      cwd: sub2(i.cwd ?? i.repoDir),
       stdin: "ignore",
       stdout: "pipe",
       stderr: "pipe",
@@ -13418,9 +13670,9 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
       return skip("playwright not resolvable in the repo");
     const budget = opts.budgetMs ?? DEFAULT_BUDGET_MS, end = Date.now() + budget, left = () => end - Date.now();
     const aborted = () => signal?.aborted === true;
-    const port = await freePort(), base = `http://127.0.0.1:${port}`;
+    const port2 = await freePort(), base = `http://127.0.0.1:${port2}`;
     const [bc, ba] = boot ? ["bash", ["-c", boot.boot.cmd]] : ["npm", ["run", script, "--silent"]];
-    child = spawn7(bc, [...ba], { cwd: appDir, detached: true, env: { ...opts.env ?? process.env, PORT: String(port), HOST: "127.0.0.1", BROWSER: "none" }, stdio: "ignore" });
+    child = spawn7(bc, [...ba], { cwd: appDir, detached: true, env: { ...opts.env ?? process.env, PORT: String(port2), HOST: "127.0.0.1", BROWSER: "none" }, stdio: "ignore" });
     child.on("error", () => {
       return;
     });
@@ -13609,12 +13861,12 @@ function appendReceiptFact(repoDir, f, now2 = () => new Date) {
   save(repoDir, lessons);
   return true;
 }
-function recordRunVerdict(repoDir, runId, verdict) {
+function recordRunVerdict(repoDir, runId2, verdict) {
   const lessons = loadLessons(repoDir);
   let dirty = false;
   for (const l of lessons)
     for (const u of l.uses)
-      if (u.run_id === runId && u.verdict === null) {
+      if (u.run_id === runId2 && u.verdict === null) {
         u.verdict = verdict;
         dirty = true;
       }
@@ -13931,12 +14183,12 @@ async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
   if (withTests.length === 0)
     return false;
   for (const pkg of withTests) {
-    const tc = pkg.commands.test, name = `full suite: ${pkg.name}`, cmd = `(cd ${tc.cwd} && ${tc.cmd})`;
+    const tc = pkg.commands.test, name = `full suite: ${pkg.name}`, cmd2 = `(cd ${tc.cwd} && ${tc.cmd})`;
     const started = Date.now();
     const r = await run(["bash", "-c", tc.cmd], { cwd: join55(repoDir, tc.cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
     const duration_s = (Date.now() - started) / 1000;
     if (signal.aborted) {
-      checks.push({ name, cmd, result: "not_run", duration_s });
+      checks.push({ name, cmd: cmd2, result: "not_run", duration_s });
       notProven.add(`not run: ${name} (aborted)`);
       continue;
     }
@@ -13944,12 +14196,12 @@ async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
 ${r.stderr}`;
     const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, out: out2, cmd: "bash", args: ["-c", tc.cmd], signal, cwd: join55(repoDir, tc.cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
     if (lr) {
-      checks.push({ name, cmd, result: "not_run", duration_s });
+      checks.push({ name, cmd: cmd2, result: "not_run", duration_s });
       notProven.add(`${lr} (${name}; harness-owned)`);
       continue;
     }
     const cls = classifyCheck({ kind: "test", ok: r.exitCode === 0, out: out2, ...goRunner(tc.cmd) });
-    checks.push({ name, cmd, result: cls.result, duration_s, ...cls.result === "fail" ? { ids: failIds(out2) } : {} });
+    checks.push({ name, cmd: cmd2, result: cls.result, duration_s, ...cls.result === "fail" ? { ids: failIds(out2) } : {} });
     if (cls.result === "not_run")
       notProven.add(`not run: ${name} (${cls.reason ?? NO_TESTS_REASON})`);
   }
@@ -14108,14 +14360,14 @@ async function secureScanChanged(repoDir, changed, opts) {
   }
 }
 async function runSecretScan(ctx, changed, opts, checks, notProven) {
-  const scriptPath = opts.secretScanShPath ?? DEFAULT_SECRET_SCAN_SH, name = "security scan", cmd = "secret-scan.sh + secure-scan.py";
+  const scriptPath = opts.secretScanShPath ?? DEFAULT_SECRET_SCAN_SH, name = "security scan", cmd2 = "secret-scan.sh + secure-scan.py";
   if (!existsSync36(scriptPath)) {
-    checks.push({ name, cmd, result: "not_run", duration_s: 0 });
+    checks.push({ name, cmd: cmd2, result: "not_run", duration_s: 0 });
     notProven.add(`not run: ${name} (secret-scan.sh not found)`);
     return;
   }
   if (changed.length === 0) {
-    checks.push({ name, cmd, result: "pass", duration_s: 0 });
+    checks.push({ name, cmd: cmd2, result: "pass", duration_s: 0 });
     return;
   }
   const inline = 'script="$1"; shift; . "$script" || exit 3; hit=0; for f in "$@"; do if _commit_scan_secret_file "$f" || _commit_path_looks_secret "$f"; then printf "%s\\n" "$f"; hit=1; fi; done; exit "$hit"';
@@ -14133,7 +14385,7 @@ async function runSecretScan(ctx, changed, opts, checks, notProven) {
   if (high.length > 0)
     reasons.push(`secure-scan: ${high.map((f) => `${f.rule}: ${f.file}:${f.line}`).join(", ")}`);
   const result = reasons.length > 0 ? "fail" : gaps.length > 0 ? "not_run" : "pass";
-  checks.push({ name, cmd, result, duration_s: (Date.now() - started) / 1000, ...result === "pass" ? {} : { reason: (result === "fail" ? reasons : gaps).join("; ") } });
+  checks.push({ name, cmd: cmd2, result, duration_s: (Date.now() - started) / 1000, ...result === "pass" ? {} : { reason: (result === "fail" ? reasons : gaps).join("; ") } });
   if (result === "not_run")
     notProven.add(`not run: ${name} (${gaps.join("; ")})`);
 }
@@ -14279,8 +14531,8 @@ function resolveTool(repoDir, bin, fallback, lastResort = fallback) {
 function runnerCmd(t, repoDir) {
   switch (t.runner) {
     case "pytest": {
-      const [cmd, interpreter, pre] = resolveTool(repoDir, "python", "python3", "python");
-      return [cmd, [...pre, "-m", "pytest", "-q", t.path], interpreter];
+      const [cmd2, interpreter, pre] = resolveTool(repoDir, "python", "python3", "python");
+      return [cmd2, [...pre, "-m", "pytest", "-q", t.path], interpreter];
     }
     case "vitest":
       return ["npx", ["--no-install", "vitest", "run", t.path]];
@@ -14300,14 +14552,14 @@ function runnerCmd(t, repoDir) {
 }
 function commandFor(t, repoDir, api) {
   const site = siteFor(api, repoDir, t.path);
-  const [cmd, args, interpreter] = runnerCmd(site ? { runner: t.runner, path: site.file } : t, repoDir);
-  return { cwd: site?.cwd ?? repoDir, cmd, args, argv: [cmd, ...args], ...interpreter ? { interpreter } : {}, pkgRoot: site?.root ?? "." };
+  const [cmd2, args, interpreter] = runnerCmd(site ? { runner: t.runner, path: site.file } : t, repoDir);
+  return { cwd: site?.cwd ?? repoDir, cmd: cmd2, args, argv: [cmd2, ...args], ...interpreter ? { interpreter } : {}, pkgRoot: site?.root ?? "." };
 }
-async function runOnce2(cmd, args, cwd, signal, opts) {
-  if (!Bun.which(cmd, { PATH: opts.path ?? process.env["PATH"] ?? "" }))
+async function runOnce2(cmd2, args, cwd, signal, opts) {
+  if (!Bun.which(cmd2, { PATH: opts.path ?? process.env["PATH"] ?? "" }))
     return { ok: false, missing: true, cut: false, out: "" };
   const timeout = AbortSignal.timeout(opts.timeoutMs ?? CHECK_TIMEOUT_MS);
-  const proc = Bun.spawn([cmd, ...args], {
+  const proc = Bun.spawn([cmd2, ...args], {
     cwd,
     stdin: opts.stdin !== undefined ? Buffer.from(opts.stdin) : "ignore",
     stdout: "pipe",
@@ -14345,26 +14597,26 @@ function firstError(out2) {
 `).map((l2) => (l2.startsWith("{") ? goOut(l2) : l2).trim()).filter(Boolean), l = lines2.find((x) => /^(FAILED\s|\u25cf\s.*\u203a|not ok\s|_{3,}\s.+\s_{3,}$)/.test(x)) ?? lines2.find((x) => /^[\w./-]+\.go:\d+:\d+: \S/.test(x)) ?? lines2.find((x) => /fail|error/i.test(x) && !/^(=|\u2713|ok\b|PASS)/.test(x)) ?? "";
   return l.replace(/\d{4}-\d\d-\d\dT[\d:.]+Z?/g, "").replace(/(^|\s)\/(?:[\w.@-]+\/)*[\w.@-]+/g, "$1<path>").replace(/:\d+(?::\d+)?/g, "").replace(/\[?\d+(?:\.\d+)?m?s\]?/g, "").replace(/\s+/g, " ").slice(0, 160);
 }
-async function runCheck(ctx, name, cmd, args, signal, checks, opts = {}) {
+async function runCheck(ctx, name, cmd2, args, signal, checks, opts = {}) {
   const started = Date.now();
-  const cmdStr = [cmd, ...args].join(" ");
+  const cmdStr = [cmd2, ...args].join(" ");
   const kind = opts.kind ?? "test";
   const cwd = opts.cwd ?? ctx.repoDir;
   const one = async (a) => {
-    let c2 = classifyCheck({ kind, ok: a.ok, cut: a.cut, missing: a.missing, out: a.out, ...goRunner(cmd, args), path: /\.[cm]?[jt]s$/.test(args[args.length - 1] ?? "") ? args[args.length - 1] : undefined });
-    const lr = kind === "test" && !a.ok && !a.cut && !a.missing ? await harnessLoadReason({ repoDir: ctx.repoDir, baseSha: ctx.baseSha, out: a.out, cmd, args, signal, cwd, protect: opts.protect, ...opts.path ? { env: { PATH: opts.path } } : {} }) : undefined;
+    let c2 = classifyCheck({ kind, ok: a.ok, cut: a.cut, missing: a.missing, out: a.out, ...goRunner(cmd2, args), path: /\.[cm]?[jt]s$/.test(args[args.length - 1] ?? "") ? args[args.length - 1] : undefined });
+    const lr = kind === "test" && !a.ok && !a.cut && !a.missing ? await harnessLoadReason({ repoDir: ctx.repoDir, baseSha: ctx.baseSha, out: a.out, cmd: cmd2, args, signal, cwd, protect: opts.protect, ...opts.path ? { env: { PATH: opts.path } } : {} }) : undefined;
     if (lr)
       c2 = { result: "not_run", reason: lr, owner: "harness" };
     if (!lr && kind === "static" && !a.ok && !a.cut && !a.missing && opts.wall?.size && wallOwnedFailure(a.out, cwd, ctx.repoDir, opts.wall))
       c2 = { result: "not_run", reason: WALL_COMPILE_REASON, owner: "harness" };
-    const reason2 = a.missing ? `${cmd} not found on PATH` : a.cut ? signal.aborted ? "aborted" : `timed out after ${(opts.timeoutMs ?? CHECK_TIMEOUT_MS) / 1000}s` : c2.reason;
+    const reason2 = a.missing ? `${cmd2} not found on PATH` : a.cut ? signal.aborted ? "aborted" : `timed out after ${(opts.timeoutMs ?? CHECK_TIMEOUT_MS) / 1000}s` : c2.reason;
     return { ...c2, ...reason2 ? { reason: reason2 } : {} };
   };
-  let attempt = await runOnce2(cmd, args, cwd, signal, opts);
+  let attempt = await runOnce2(cmd2, args, cwd, signal, opts);
   let c = await one(attempt);
   let result = c.result;
   if (c.result === "fail") {
-    attempt = await runOnce2(cmd, args, cwd, signal, opts);
+    attempt = await runOnce2(cmd2, args, cwd, signal, opts);
     c = await one(attempt);
     result = c.result === "not_run" ? "not_run" : c.result === "pass" ? "flaky" : "fail";
   }
@@ -14458,10 +14710,10 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   return pre;
 }
-var CHECK_TIMEOUT_MS = 60000, excerpts, isHold = (c) => isHoldoutCheck(c.name), pubHold = (c) => ({ name: "holdout", cmd: "holdout", result: c.result, duration_s: c.duration_s, ...c.n !== undefined ? { n: c.n } : {}, ...c.sk !== undefined ? { sk: c.sk } : {}, ...c.owner ? { owner: c.owner, reason: "holdout infrastructure failure" } : {} }), testCheckName = (t) => `${t.runner}:${t.path}`, dedupeTests = (tests) => [...new Map(tests.map((t) => [`${t.runner}:${t.path}`, t])).values()], CODE_EXT, ESLINT_CONFIGS, excuseLint = (ctx, signal, c, tool, cmd, prefix, cwd, rel, opts) => c.result !== "fail" || signal.aborted ? Promise.resolve(false) : staticPreExisting(tool, prefix, rel, { run: async (a, stdin) => {
+var CHECK_TIMEOUT_MS = 60000, excerpts, isHold = (c) => isHoldoutCheck(c.name), pubHold = (c) => ({ name: "holdout", cmd: "holdout", result: c.result, duration_s: c.duration_s, ...c.n !== undefined ? { n: c.n } : {}, ...c.sk !== undefined ? { sk: c.sk } : {}, ...c.owner ? { owner: c.owner, reason: "holdout infrastructure failure" } : {} }), testCheckName = (t) => `${t.runner}:${t.path}`, dedupeTests = (tests) => [...new Map(tests.map((t) => [`${t.runner}:${t.path}`, t])).values()], CODE_EXT, ESLINT_CONFIGS, excuseLint = (ctx, signal, c, tool, cmd2, prefix, cwd, rel, opts) => c.result !== "fail" || signal.aborted ? Promise.resolve(false) : staticPreExisting(tool, prefix, rel, { run: async (a, stdin) => {
   if (signal.aborted)
     return null;
-  const r = await runOnce2(cmd, a, cwd, AbortSignal.any([signal, AbortSignal.timeout(opts.timeoutMs ?? CHECK_TIMEOUT_MS)]), { ...opts, ...stdin !== undefined ? { stdin } : {} });
+  const r = await runOnce2(cmd2, a, cwd, AbortSignal.any([signal, AbortSignal.timeout(opts.timeoutMs ?? CHECK_TIMEOUT_MS)]), { ...opts, ...stdin !== undefined ? { stdin } : {} });
   return r.missing || r.cut ? null : r;
 }, base: (f) => {
   try {
@@ -14735,8 +14987,8 @@ class RealBaseTestRunner {
     const not_run_files = [];
     const api = this.api === undefined ? loadProjectApi(repoDir) : this.api;
     for (const f of files) {
-      const { cmd, args, interpreter, cwd } = commandFor(f, repoDir, api);
-      const r = spawnSync7(cmd, f.runner === "pytest" ? [...args, "-rfE"] : args, { cwd, encoding: "utf8", timeout: Math.max(1000, this.timeoutMs), env: plainTestEnv() });
+      const { cmd: cmd2, args, interpreter, cwd } = commandFor(f, repoDir, api);
+      const r = spawnSync7(cmd2, f.runner === "pytest" ? [...args, "-rfE"] : args, { cwd, encoding: "utf8", timeout: Math.max(1000, this.timeoutMs), env: plainTestEnv() });
       const status = r.error ? null : r.status;
       const result = classify(f, status, stripAnsi(`${r.stdout ?? ""}
 ${r.stderr ?? ""}`), repoDir, interpreter);
@@ -15620,10 +15872,10 @@ function sealGroup(runDir, rh) {
     } catch {
       return fail2(`unit ${id} sub-receipt missing`);
     }
-    const sub = readJson6(rp);
-    if (!isObj10(sub) || typeof sub["receipt_sha256"] !== "string" || rh(sub) !== sub["receipt_sha256"])
+    const sub2 = readJson6(rp);
+    if (!isObj10(sub2) || typeof sub2["receipt_sha256"] !== "string" || rh(sub2) !== sub2["receipt_sha256"])
       return fail2(`unit ${id} sub-receipt unreadable or its hash does not recompute`);
-    const verdict = String(sub["verdict"] ?? "");
+    const verdict = String(sub2["verdict"] ?? "");
     if (!PASSING.has(verdict)) {
       allUnitsPass = false;
       notProven.push(`group: unit ${id} verdict ${verdict || "unknown"}`);
@@ -15632,7 +15884,7 @@ function sealGroup(runDir, rh) {
       index: index2,
       unit_id: id,
       sub_receipt_sha256: sha3(bytes),
-      receipt_sha256: sub["receipt_sha256"],
+      receipt_sha256: sub2["receipt_sha256"],
       events_file_sha256: existsSync44(ep) ? sha3(readFileSync52(ep)) : null,
       verdict,
       goal: text2(u["goal"], 200),
@@ -15686,10 +15938,10 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     const evSha = existsSync44(ep) ? sha3(readFileSync52(ep)) : null;
     if (evSha !== (e["events_file_sha256"] ?? null))
       return bad(`unit ${id} events.jsonl does not match its recorded hash`);
-    const sub = readJson6(rp);
-    if (!isObj10(sub) || sub["receipt_sha256"] !== e["receipt_sha256"] || rh(sub) !== e["receipt_sha256"])
+    const sub2 = readJson6(rp);
+    if (!isObj10(sub2) || sub2["receipt_sha256"] !== e["receipt_sha256"] || rh(sub2) !== e["receipt_sha256"])
       return bad(`unit ${id} sub-receipt hash does not recompute`);
-    if (String(sub["verdict"] ?? "") !== e["verdict"])
+    if (String(sub2["verdict"] ?? "") !== e["verdict"])
       return bad(`unit ${id} verdict differs from the combined receipt`);
     const r = await verifyOne(rp, deps);
     if (r.verdict === "UNSIGNED" && signed)
@@ -15944,11 +16196,11 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
     cargo: ["cargo", "search", dep.name, "--limit", "5"],
     go: ["go", "list", "-m", "-json", `${dep.name}@latest`]
   };
-  const cmd = argv[dep.ecosystem];
-  if (!cmd || dep.name.startsWith("-"))
+  const cmd2 = argv[dep.ecosystem];
+  if (!cmd2 || dep.name.startsWith("-"))
     return { status: "unproven" };
   try {
-    const r = await run(cmd, { cwd, timeoutMs: 1e4 });
+    const r = await run(cmd2, { cwd, timeoutMs: 1e4 });
     return classify2(dep.ecosystem, dep.name, r.exitCode, r.stdout, r.stderr);
   } catch {
     return { status: "unproven" };
@@ -16047,7 +16299,7 @@ function renderReceiptMd(r) {
   ].join(`
 `);
 }
-var DEEP_NOT_PROVEN, SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash18("sha256").update(s).digest("hex"), str3 = (v) => typeof v === "string" && v !== "" ? v : null, strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], receiptRel = (ctx) => {
+var DEEP_NOT_PROVEN, SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash18("sha256").update(s).digest("hex"), str4 = (v) => typeof v === "string" && v !== "" ? v : null, strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], receiptRel = (ctx) => {
   const r = relative10(ctx.repoDir, join68(ctx.runDir, "receipt.json"));
   return r.startsWith("..") || isAbsolute11(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, wallGreenOnBaseOf = (o) => {
@@ -16108,7 +16360,7 @@ var init_seal = __esm(() => {
       const notes = flagOutsideScope(ctx.outputs(), staged.filter(({ f }) => !dropped2.has(f)));
       if ((await git4(ctx, ["diff", "--cached", "--quiet"])).code === 0)
         return { status: "completed", data: { committed: false, scope_notes: notes } };
-      const title = (str3(ctx.outputs().intake?.title) ?? `run ${ctx.runId}`).split(`
+      const title = (str4(ctx.outputs().intake?.title) ?? `run ${ctx.runId}`).split(`
 `)[0].slice(0, 72);
       const c = await git4(ctx, ["commit", "-q", "-m", `loki: ${title}`, "-m", [`Loki-Run: ${ctx.runId}`, ...aiTrailers({ runId: ctx.runId, provider: ctx.provider, model: ctx.model, receiptRel: receiptRel(ctx) })].join(`
 `)], { repoDrivers: true, userHooks: true });
@@ -16185,7 +16437,7 @@ var init_seal = __esm(() => {
         if (!vl.length)
           continue;
         const tc = tcs?.[t];
-        const mine = assertDeltaNotes(ctx.repoDir, ctx.baseSha, head, t, str3(o.intake?.task) ?? "", cnt(tc?.b), cnt(tc?.h));
+        const mine = assertDeltaNotes(ctx.repoDir, ctx.baseSha, head, t, str4(o.intake?.task) ?? "", cnt(tc?.b), cnt(tc?.h));
         if (!mine || mine.length !== vl.length || mine.some((n3) => !vl.includes(n3)))
           for (const v of vl)
             dropped2.add(v);
@@ -16218,7 +16470,7 @@ var init_seal = __esm(() => {
       const source = o.intake?.source;
       if (source !== "text" && source !== "issue")
         notProven.add("task source not recorded by intake");
-      const repo = str3(o.intake?.repo);
+      const repo = str4(o.intake?.repo);
       if (mp?.outcome === "no")
         notProven.add(`Wall tests passed without the fix (mutation proof)${verdict !== verdict2 ? "; verdict downgraded to PARTIAL (LOKI_MUTATION_STRICT=1, declared behavior change)" : ""}`);
       if (repo === null)
@@ -16248,7 +16500,7 @@ var init_seal = __esm(() => {
       const body = {
         schema: "loki.v10.receipt/1",
         run_id: ctx.runId,
-        task: { source: source === "issue" ? "issue" : "text", sha256: str3(o.intake?.task_sha256) ?? "" },
+        task: { source: source === "issue" ? "issue" : "text", sha256: str4(o.intake?.task_sha256) ?? "" },
         repo: repo ?? "",
         base_sha: ctx.baseSha,
         head_sha: head,
@@ -16261,7 +16513,7 @@ var init_seal = __esm(() => {
         ...typeof o.implement?.limit_s === "number" ? { implement_limit: { limit_s: o.implement.limit_s, elapsed_s: typeof o.implement.elapsed_s === "number" ? o.implement.elapsed_s : 0 } } : {},
         ...grp.section ? { group: grp.section } : {},
         ...ctx.failovers && ctx.failovers().length > 0 ? { failover: ctx.failovers() } : {},
-        ...str3(o.implement?.spec_conflict_reason) !== null ? { spec_conflict_reason: sanitizeReason(str3(o.implement?.spec_conflict_reason)) } : {},
+        ...str4(o.implement?.spec_conflict_reason) !== null ? { spec_conflict_reason: sanitizeReason(str4(o.implement?.spec_conflict_reason)) } : {},
         evidence: strs2(o.intake?.evidence),
         ...o.intake?.preexisting_dirty ? { pre_existing_dirty: Object.keys(o.intake.preexisting_dirty) } : {},
         cost: {
@@ -16325,7 +16577,7 @@ var init_seal = __esm(() => {
       } catch {}
       if (process.env["LOKI_AUTO_LEARN_PR"] !== "0") {
         try {
-          appendReceiptFact(ctx.repoDir, { runId: ctx.runId, verdict, receiptSha256: signed ? hash : null, title: str3(ctx.outputs().intake?.title) ?? `run ${ctx.runId}`, headSha: receipt.head_sha });
+          appendReceiptFact(ctx.repoDir, { runId: ctx.runId, verdict, receiptSha256: signed ? hash : null, title: str4(ctx.outputs().intake?.title) ?? `run ${ctx.runId}`, headSha: receipt.head_sha });
         } catch {}
       }
       ctx.emit("receipt.sealed", "seal", { path, receipt_sha256: hash, signed, kid: sig.kid, verdict, not_proven: receipt.not_proven, ...routeBlock ? { route_line: routePrLine(routeBlock) } : {} });
@@ -16415,12 +16667,12 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     }
     if (sha3(bytes) !== c["receipt_file_sha256"])
       return bad(`child ${repo} receipt does not match its recorded hash (swapped or edited)`);
-    const sub = readJson6(rp);
-    if (!isObj10(sub) || sub["receipt_sha256"] !== c["receipt_sha256"] || rh(sub) !== c["receipt_sha256"])
+    const sub2 = readJson6(rp);
+    if (!isObj10(sub2) || sub2["receipt_sha256"] !== c["receipt_sha256"] || rh(sub2) !== c["receipt_sha256"])
       return bad(`child ${repo} receipt hash does not recompute`);
-    if (String(sub["verdict"] ?? "") !== c["verdict"])
+    if (String(sub2["verdict"] ?? "") !== c["verdict"])
       return bad(`child ${repo} verdict differs from the composite`);
-    if (String(sub["head_sha"] ?? "") !== c["head_sha"] || !c["head_sha"])
+    if (String(sub2["head_sha"] ?? "") !== c["head_sha"] || !c["head_sha"])
       return bad(`child ${repo} head_sha differs from the composite`);
     verdicts.push(String(c["verdict"]));
     if (typeof heads[repo] !== "string" || heads[repo] === "") {
@@ -27757,7 +28009,7 @@ if (warning)
   console.error(warning);
 var bindHost = process.env.LOKI_CONTROL_HOST || "127.0.0.1";
 var { app } = createApp({ dbPath: process.env.LOKI_CONTROL_DB ?? "control.db", token: process.env.LOKI_CONTROL_TOKEN || undefined, loopbackOnly: isLoopbackHost(bindHost.includes(":") && !bindHost.startsWith("[") ? `[${bindHost}]` : bindHost) });
-var serve = (port) => Bun.serve({ port, hostname: process.env.LOKI_CONTROL_HOST || "127.0.0.1", fetch: app.fetch });
+var serve = (port2) => Bun.serve({ port: port2, hostname: process.env.LOKI_CONTROL_HOST || "127.0.0.1", fetch: app.fetch });
 var s;
 try {
   s = serve(Number(process.env.PORT ?? 0));