loki-mode 11.3.0 → 11.3.2

package/docs/v11/VERIFY-PR-SANDBOX.md

@@ -0,0 +1,41 @@
+# VERIFY-PR sandbox: spec, threat model, runner contract (VPR-1)
+
+Runner: `scripts/verify-pr-sandbox.sh`. Test: `tests/test-verify-pr-sandbox.sh`. Consumer: VPR-2 (`loki verify-pr`).
+
+## Rule of Two
+The verify job holds untrusted input (the PR code). It holds NO token and has NO network. A separate job that never executes PR code holds `checks: write`, reads only the result file, and posts. This runner is the first job's execution boundary.
+
+## Contract
+```
+verify-pr-sandbox.sh --repo DIR --out DIR --cmd 'SHELL CMD' --image IMG [--timeout S] [--max-output B] [--print-argv]
+```
+- Exit 0: the check ran; read `result.json` (`status` COMPLETED, TIMEOUT or ERROR, plus `exit_code`).
+- Exit 2: input refused. Exit 3: BLOCKED (docker absent, daemon down, image not local, resource exhaustion). BLOCKED says nothing about the PR and VPR-2 must never map it to a verdict.
+- `OUT/result.json` and `OUT/output.txt` are the only files written, both by the host. `output.txt` is the check's captured output, capped at `--max-output` bytes, with the sentinel line removed; treat it as untrusted data. result.json fields: status, exit_code, output_truncated, detail, image, timeout_s.
+- The image is never pulled (`--pull never`); dependencies must already be in the image or the caller reports NOT PROVEN.
+
+## Controls
+| Control | Mechanism |
+|---|---|
+| No network | `--network none` |
+| Read-only root | `--read-only`; `/work` (exec), `/cap`, `/tmp` are size-capped tmpfs |
+| Non-root | `--user 65534:65534`, `--cap-drop ALL`, `no-new-privileges` |
+| Caps | `--pids-limit 256`, `--memory 512m` (swap equal), `--cpus 1`, `--init` |
+| Wall timeout | in-container `timeout -s KILL`, plus a host watchdog that runs `docker kill <exact name>` (never by pattern) |
+| Env scrub | `docker run` inherits no host env; only PATH, HOME=/work, CI=1 are passed. GH_TOKEN, GITHUB_TOKEN, SSH_AUTH_SOCK never reach argv |
+| Mounts | exactly one: the repo, read-only. No HOME, no docker socket, no output mount |
+| Output | stdout is captured by the host, capped in-container (`--max-output`); the host writes result.json and output.txt |
+
+Deviation from the card: there is no mounted output dir. A writable host mount would let the checked code fill the host disk, so the result travels on stdout and only the host writes `OUT`. Numeric flags are forced to base 10 (a leading zero is not octal) and every value flag requires a value. `--image` is restricted to `[A-Za-z0-9._/:@-]`.
+
+## Threat model
+- Malicious package.json scripts / test code: run only inside the container, as nobody, no network.
+- Git hooks: the repo is mounted read-only and the runner never runs git; checkout of base/head is VPR-2's job and must use `util/safe_git.ts`.
+- Symlinks out of the repo: refused on the host before launch (absolute target, or relative target resolving outside the repo). The copy to `/work` happens inside the container, so a link resolves against the container filesystem only.
+- Oversized output: capped by `--max-output`; `output_truncated` is set.
+- Fork bomb: `--pids-limit 256`. Memory bomb: `--memory`. Disk fill: tmpfs size caps.
+- Forged result: the checked code can print a fake `LOKI_VPR_END` line. A per-run 128-bit nonce is sent to the wrapper on stdin and the checked command runs with stdin from /dev/null; the host accepts only the last line carrying that nonce. Docker's default seccomp profile does NOT block ptrace or process_vm_readv on kernels >= 4.8, and the checked command runs as the same uid as the wrapper inside the container, so a hostile process can read the wrapper's memory and recover the nonce. The nonce therefore only stops accidental or naive forgery; it is not a security boundary. One cross-check is added: the wrapper exits with the check's code and the host rejects (status ERROR) a sentinel that disagrees with docker's own exit code. The PR code can still make its own check report success, which is why `result.json` is a signal about the check and not the final verdict (VPR-2 owns that, and it must not treat a bare COMPLETED exit 0 as proof). A custom seccomp profile denying ptrace is a possible hardening and is not shipped here.
+- Docker pool exhaustion: reported as BLOCKED, never as a failing check.
+
+## Not covered (residual, tracked for VPR-2 review)
+Kernel or runtime escapes (use gVisor or a microVM runtime for a hosted deployment); Docker Desktop shares the VM across containers; the hostile-container part of the test needs a daemon and a local image and SKIPs loudly otherwise.

package/loki-ts/data/model-pricing.json

@@ -1,32 +1,56 @@
 {
   "$schema_version": 1,
   "_comment": "Rolling pricing table consumed by loki-ts/src/runner/budget.ts. Update this file when Anthropic / OpenAI / others publish new prices; no code change required. Pricing is USD per 1 million tokens. Aliases (opus/sonnet/haiku) point to the latest model of that family per providers/model_catalog.json.",
-  "_updated": "2026-10-07",
-  "_source": "https://www.anthropic.com/pricing + provider docs. sonnet=claude-sonnet-5 and claude-sonnet-5-5, both $2/$10 per MTok (the Sonnet 5 intro price became the standard price; the 2026-09-01 increase to $3/$15 will not occur), cache write 5m $2.50, cache read $0.20, 1M context at standard pricing (platform.claude.com/docs/en/about-claude/pricing, read 2026-10-03). claude-haiku-5-5 (exact-id key; the haiku alias stays Haiku 4.5 at $1/$5): $0.10 in / $0.50 out / cache write 5m $0.125 / cache read $0.01 for prompts up to 100,000 tokens, and $0.50 / $2.50 / $0.625 / $0.05 over 100,000 tokens in over_100k (https://platform.claude.com/docs/en/about-claude/pricing, read 2026-10-07). opus=claude-opus-5. codex=gpt-5.3-codex standard tier. Cache tiers: read 0.1x input, write 1.25x input (Anthropic + OpenAI published multipliers).",
+  "_updated": "2026-10-08",
+  "_source": "https://platform.claude.com/docs/en/about-claude/pricing (docs.anthropic.com/en/docs/about-claude/pricing 301-redirects there), read 2026-10-08. Per MTok. fable=Claude Fable 5.1 $10/$50, cache read $0.25 (0.025x), 5m write $12.50, 1h write $20. opus=Claude Opus 5.5 $4/$20, cache read $0.20 (0.05x), 5m write $5, 1h write $8. sonnet=Claude Sonnet 5.5 $2/$10, cache read $0.10 (0.05x), 5m write $2.50, 1h write $4. haiku alias row prices as its catalog target claude-haiku-5-5 (providers/model_catalog.json cli_aliases), so it equals that row including over_100k; Haiku 4.5 ($1/$5) is no longer an alias target. claude-haiku-5-5 (exact id, same as the haiku alias): $0.10/$0.50, read $0.01, 5m $0.125, 1h $0.20 up to 100,000 prompt tokens; over_100k $0.50/$2.50, read $0.05, 5m $0.625, 1h $1. Fields: cache_write is the 5m write rate (legacy readers); cache_write_5m and cache_write_1h are the explicit tiers. Multipliers: 5m write 1.25x, 1h write 2x, read 0.1x (0.05x on Opus 5.5 and Sonnet 5.5, 0.025x on Fable 5.1). OpenAI rows (gpt-5.3-codex, gpt-5.6-sol/terra/luna): https://developers.openai.com/api/docs/pricing, read 2026-10-08, Standard tier, short context (up to 272K); cached input is the cache_read field; OpenAI bills no cache write, cache_write is a 1.25x placeholder.",
   "pricing": {
     "fable": {
       "input": 10.0,
       "output": 50.0,
-      "cache_read": 1.0,
-      "cache_write": 12.5
+      "cache_read": 0.25,
+      "cache_write": 12.5,
+      "cache_write_5m": 12.5,
+      "cache_write_1h": 20.0
     },
     "opus": {
-      "input": 5.0,
-      "output": 25.0,
-      "cache_read": 0.5,
-      "cache_write": 6.25
+      "input": 4.0,
+      "output": 20.0,
+      "cache_read": 0.2,
+      "cache_write": 5,
+      "cache_write_5m": 5,
+      "cache_write_1h": 8.0
     },
     "sonnet": {
       "input": 2.0,
       "output": 10.0,
-      "cache_read": 0.2,
-      "cache_write": 2.5
+      "cache_read": 0.1,
+      "cache_write": 2.5,
+      "cache_write_5m": 2.5,
+      "cache_write_1h": 4.0
     },
     "haiku": {
+      "input": 0.1,
+      "output": 0.5,
+      "cache_read": 0.01,
+      "cache_write": 0.125,
+      "over_100k": {
+        "input": 0.5,
+        "output": 2.5,
+        "cache_read": 0.05,
+        "cache_write": 0.625,
+        "cache_write_5m": 0.625,
+        "cache_write_1h": 1.0
+      },
+      "cache_write_5m": 0.125,
+      "cache_write_1h": 0.2
+    },
+    "claude-haiku-4-5": {
       "input": 1.0,
       "output": 5.0,
       "cache_read": 0.1,
-      "cache_write": 1.25
+      "cache_write": 1.25,
+      "cache_write_5m": 1.25,
+      "cache_write_1h": 2.0
     },
     "claude-haiku-5-5": {
       "input": 0.1,
@@ -37,8 +61,12 @@
         "input": 0.5,
         "output": 2.5,
         "cache_read": 0.05,
-        "cache_write": 0.625
-      }
+        "cache_write": 0.625,
+        "cache_write_5m": 0.625,
+        "cache_write_1h": 1.0
+      },
+      "cache_write_5m": 0.125,
+      "cache_write_1h": 0.2
     },
     "gpt-5.3-codex": {
       "input": 1.75,
@@ -47,22 +75,22 @@
       "cache_write": 2.1875
     },
     "gpt-5.6-sol": {
-      "input": 1.75,
-      "output": 14.0,
-      "cache_read": 0.175,
-      "cache_write": 2.1875
+      "input": 4.0,
+      "output": 20.0,
+      "cache_read": 0.4,
+      "cache_write": 5.0
     },
     "gpt-5.6-terra": {
-      "input": 0.6,
-      "output": 4.8,
-      "cache_read": 0.06,
-      "cache_write": 0.75
+      "input": 2.0,
+      "output": 12.0,
+      "cache_read": 0.2,
+      "cache_write": 2.5
     },
     "gpt-5.6-luna": {
-      "input": 0.15,
+      "input": 0.2,
       "output": 1.2,
-      "cache_read": 0.015,
-      "cache_write": 0.1875
+      "cache_read": 0.02,
+      "cache_write": 0.25
     }
   }
 }