loki-mode 11.3.1 → 11.3.4

package/packages/control-plane/ui/dist/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Loki Mode</title>
-    <script type="module" crossorigin src="./assets/index-DcBJXjCJ.js"></script>
+    <script type="module" crossorigin src="./assets/index-DbLzr87u.js"></script>
     <link rel="stylesheet" crossorigin href="./assets/index-CxZWgwie.css">
   </head>
   <body>

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "11.3.1",
+  "version": "11.3.4",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/providers/opencode.sh

@@ -21,9 +21,8 @@
 #       v0.86.0 from 2025-08-09, and Roo Code is archived, Continue read-only --
 #       so opencode, not aider, is the durable cheap-model route.)
 #
-#   Cost context (SWE-bench uniform scaffold, mini-swe-agent v2.0.0, 2026-02-17):
-#   MiniMax M2.5 resolved 75.8 at $36.64 total vs Claude Opus 4.6 at 75.6 for
-#   $275.76 -- an open model matching frontier accuracy at ~7.5x lower cost.
+#   Cost context: see docs/ROUTING-EVIDENCE.md (measurement source, date and
+#   caveats for the MiniMax M2.5 vs Claude Opus 4.6 cost-parity figures).
 #
 # CLI SURFACE (verified against the installed binary, v1.17.9, not assumed):
 #   opencode run [message..]     non-interactive run

package/src/observability/genai-spans.js

@@ -0,0 +1,104 @@
+'use strict';
+
+/**
+ * Pure mapper: engine10 events.jsonl envelopes -> gen_ai span descriptors.
+ * No I/O, no network, no clock. Attributes are built from a fixed whitelist of
+ * event fields, so prompt or completion content and secrets can never reach a span.
+ */
+
+// OpenTelemetry GenAI semantic conventions version these attribute names follow.
+const GENAI_SEMCONV_VERSION = '1.37.0';
+
+const AGENT_NAME = 'loki';
+
+function toNs(ts) {
+  const ms = Date.parse(ts);
+  return Number.isFinite(ms) ? BigInt(ms) * 1000000n : null;
+}
+
+function isNum(x) {
+  return typeof x === 'number' && Number.isFinite(x);
+}
+
+// Unknown usage is absent, never 0 (mirrors engine10/cost.ts): an unmetered or
+// unmeasured cost event, or an all-zero usage record, carries no token attributes.
+function usageAttrs(d) {
+  if (d.source === 'cli-invoker-unmetered' || d.source === 'not measured') return {};
+  if (!isNum(d.input_tokens) || !isNum(d.output_tokens)) return {};
+  if (d.input_tokens === 0 && d.output_tokens === 0) return {};
+  return { 'gen_ai.usage.input_tokens': d.input_tokens, 'gen_ai.usage.output_tokens': d.output_tokens };
+}
+
+/**
+ * @param {Array<{seq:number,ts:string,run:string,type:string,stage:string|null,data:object}>} events
+ * @returns {Array<{key:string,parentKey:string|null,name:string,startNs:bigint,endNs:bigint,status:'ok'|'error'|'unset',attributes:object}>}
+ */
+function mapRunEvents(events) {
+  const list = (Array.isArray(events) ? events : []).filter((e) => e && typeof e.type === 'string' && toNs(e.ts) !== null);
+  if (list.length === 0) return [];
+  const started = list.find((e) => e.type === 'run.started');
+  const root = started || list[0];
+  const last = list[list.length - 1];
+  const done = list.find((e) => e.type === 'run.completed');
+  const provider = started && typeof started.data.provider === 'string' ? started.data.provider : null;
+  const runModel = started && typeof started.data.model === 'string' ? started.data.model : null;
+
+  const base = { 'gen_ai.agent.name': AGENT_NAME };
+  if (provider) base['gen_ai.provider.name'] = provider;
+  const rootKey = 'run:' + root.run;
+  const spans = [{
+    key: rootKey, parentKey: null, name: 'invoke_agent ' + AGENT_NAME,
+    startNs: toNs(root.ts), endNs: toNs((done || last).ts),
+    status: done ? (done.data.verdict === 'FAILED' ? 'error' : 'ok') : 'unset',
+    attributes: Object.assign({ 'gen_ai.operation.name': 'invoke_agent' }, base, runModel ? { 'gen_ai.request.model': runModel } : {}),
+  }];
+
+  const open = new Map();
+  const costs = [];
+  for (const e of list) {
+    const d = e.data || {};
+    if (e.type === 'stage.started' && e.stage) {
+      open.set(e.stage, e);
+    } else if ((e.type === 'stage.completed' || e.type === 'stage.failed' || e.type === 'stage.skipped') && e.stage) {
+      const s = open.get(e.stage);
+      open.delete(e.stage);
+      spans.push({
+        key: 'stage:' + e.stage, parentKey: rootKey, name: 'stage ' + e.stage,
+        startNs: toNs((s || e).ts), endNs: toNs(e.ts), status: e.type === 'stage.failed' ? 'error' : 'ok',
+        attributes: { 'gen_ai.operation.name': 'invoke_agent', 'loki.stage': e.stage },
+      });
+    } else if (e.type === 'cost') {
+      costs.push(e);
+    } else if (e.type.indexOf('tool.') === 0 && typeof d.name === 'string' && d.name) {
+      const t = toNs(e.ts);
+      spans.push({
+        key: 'tool:' + e.seq, parentKey: e.stage ? 'stage:' + e.stage : rootKey, name: 'execute_tool ' + d.name,
+        startNs: t, endNs: t, status: e.type === 'tool.failed' ? 'error' : 'ok',
+        attributes: { 'gen_ai.operation.name': 'execute_tool', 'gen_ai.tool.name': d.name },
+      });
+    }
+  }
+  // Stages still open at the end of the log end at the last event.
+  for (const [stage, s] of open) {
+    spans.push({
+      key: 'stage:' + stage, parentKey: rootKey, name: 'stage ' + stage,
+      startNs: toNs(s.ts), endNs: toNs(last.ts), status: 'unset',
+      attributes: { 'gen_ai.operation.name': 'invoke_agent', 'loki.stage': stage },
+    });
+  }
+  for (const e of costs) {
+    const attrs = usageAttrs(e.data || {});
+    const stageSpan = spans.find((s) => s.key === 'stage:' + e.stage);
+    const targets = stageSpan ? [stageSpan, spans[0]] : [spans[0]];
+    for (const t of targets) {
+      if (t === spans[0] && typeof e.data.model === 'string' && e.data.model) t.attributes['gen_ai.request.model'] = e.data.model;
+      for (const [k, v] of Object.entries(attrs)) t.attributes[k] = (t.attributes[k] || 0) + v;
+    }
+    if (stageSpan && typeof e.data.model === 'string' && e.data.model) stageSpan.attributes['gen_ai.request.model'] = e.data.model;
+  }
+  // Parents before children so a replaying exporter can link them.
+  const rank = (x) => (x.parentKey === null ? 0 : x.key.indexOf('stage:') === 0 ? 1 : 2);
+  return spans.map((x, i) => ({ x, i })).sort((p, q) => rank(p.x) - rank(q.x) || p.i - q.i).map((o) => o.x);
+}
+
+module.exports = { GENAI_SEMCONV_VERSION, mapRunEvents };

package/src/observability/otel-bridge.js

@@ -195,6 +195,52 @@ function processEventFile(filepath, tracer, traceId, otelRef) {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Engine10 gen_ai spans (LOKI_OTEL_GENAI=1): completed runs under .loki/runs/<id>/events.jsonl
+// ---------------------------------------------------------------------------
+
+const exportedRuns = new Set();
+
+function genaiEnabled() {
+  return /^(1|true|yes|on)$/i.test(String(process.env.LOKI_OTEL_GENAI || '').trim());
+}
+
+/** Emit the span tree for one run's envelopes. Returns the number of spans ended. */
+function exportEngine10Run(events, tracer, traceId, otelRef, rootParentSpanId) {
+  const spans = require('./genai-spans').mapRunEvents(events);
+  const live = new Map();
+  for (const d of spans) {
+    const parent = d.parentKey ? live.get(d.parentKey) : null;
+    const span = tracer.startSpan(d.name, { traceId: traceId, parentSpanId: parent ? parent.spanId : (d.parentKey ? undefined : rootParentSpanId), attributes: Object.assign({}, d.attributes) });
+    span.startTimeUnixNano = String(d.startNs);
+    live.set(d.key, span);
+    if (d.status === 'ok') span.setStatus(otelRef.SpanStatusCode.OK);
+    else if (d.status === 'error') span.setStatus(otelRef.SpanStatusCode.ERROR);
+    span.end(d.endNs);
+  }
+  return spans.length;
+}
+
+function scanEngine10Runs(tracer, traceId, otelRef) {
+  if (!genaiEnabled()) return;
+  const runsDir = path.join(process.cwd(), lokiDir, 'runs');
+  try {
+    for (const id of fs.readdirSync(runsDir)) {
+      if (exportedRuns.has(id)) continue;
+      const f = path.join(runsDir, id, 'events.jsonl');
+      if (!fs.existsSync(f)) continue;
+      const events = [];
+      for (const line of fs.readFileSync(f, 'utf8').split('\n')) {
+        try { if (line.trim()) events.push(JSON.parse(line)); } catch (e) { /* torn line */ }
+      }
+      if (!events.some((e) => e && e.type === 'run.completed')) continue; // export complete trees only
+      exportedRuns.add(id);
+      const envParent = /^[0-9a-f]{16}$/.test(process.env.LOKI_PARENT_SPAN_ID || '') ? process.env.LOKI_PARENT_SPAN_ID : undefined; // MCP-D: parent from an MCP task's traceparent
+      exportEngine10Run(events, tracer, traceId, otelRef, envParent);
+    }
+  } catch (e) { /* no runs dir */ }
+}
+
 // ---------------------------------------------------------------------------
 // Polling loop
 // ---------------------------------------------------------------------------
@@ -229,7 +275,7 @@ function start() {
 
   // Bound versions that close over initialized dependencies
   const boundProcessEventFile = (filepath) => processEventFile(filepath, tracer, traceId, otelMod);
-  const boundScanPendingEvents = () => scanPendingEvents(tracer, traceId, otelMod);
+  const boundScanPendingEvents = () => { scanPendingEvents(tracer, traceId, otelMod); scanEngine10Runs(tracer, traceId, otelMod); };
 
   pollInterval = setInterval(boundScanPendingEvents, POLL_INTERVAL_MS);
 
@@ -275,6 +321,8 @@ function start() {
 module.exports = {
   start,
   processEventFile,
+  exportEngine10Run,
+  scanEngine10Runs,
   activeSpans,
   _getLastProcessedFile: function() { return lastProcessedFile; },
   _resetState: function() { lastProcessedFile = ''; },

package/src/observability/otel.js

@@ -95,10 +95,10 @@ class Span {
     return this;
   }
 
-  end() {
+  end(endNanos) {
     if (this._ended) return;
     this._ended = true;
-    this.endTimeUnixNano = nowNanos();
+    this.endTimeUnixNano = endNanos !== undefined ? String(endNanos) : nowNanos(); // endNanos: replayed spans (gen_ai bridge) keep event time
     // Register with the exporter
     if (_activeExporter) {
       _activeExporter.addSpan(this);

package/src/protocols/mcp-server.js

@@ -20,6 +20,8 @@
 
 const path = require('path');
 const fs = require('fs');
+const crypto = require('crypto');
+const { spawn } = require('child_process');
 
 // ---------------------------------------------------------------------------
 // Lazy tool/resource loading
@@ -100,12 +102,151 @@ function getServerInfo() {
 // Oldest to newest; the last entry is the fallback offered to unknown clients.
 const SUPPORTED_PROTOCOL_VERSIONS = ['2024-11-05', '2025-03-26', '2025-06-18', '2025-11-25'];
 
+// MCP-C: 2026-07-28 (stateless profile) is advertised only with LOKI_MCP_2026_07=1. It is never the initialize fallback,
+// because that profile removes the handshake and a legacy client must keep getting a stateful version.
+const STATELESS_VERSION = '2026-07-28';
+const META_PROTOCOL_VERSION = 'io.modelcontextprotocol/protocolVersion';
+
+function advertisedProtocolVersions() {
+  return process.env.LOKI_MCP_2026_07 === '1' ? SUPPORTED_PROTOCOL_VERSIONS.concat(STATELESS_VERSION) : SUPPORTED_PROTOCOL_VERSIONS.slice();
+}
+
 function negotiateProtocolVersion(params) {
   const requested = params && typeof params.protocolVersion === 'string' ? params.protocolVersion : null;
-  if (requested && SUPPORTED_PROTOCOL_VERSIONS.includes(requested)) return requested;
+  if (requested && advertisedProtocolVersions().includes(requested)) return requested;
   return SUPPORTED_PROTOCOL_VERSIONS[SUPPORTED_PROTOCOL_VERSIONS.length - 1];
 }
 
+// ---------------------------------------------------------------------------
+// MCP-D: Tasks extension (io.modelcontextprotocol/tasks), LOKI_MCP_TASKS=1
+// ---------------------------------------------------------------------------
+// A task wraps exactly two existing tools, loki_v10_verify and loki_v10_run, by running the read-only adapter in
+// mcp/v10_tools.py (argument list, no shell). It never computes or edits a verdict: the task result is the adapter's
+// stdout, byte for byte. Cancel kills only the child this server spawned, by its recorded pid. State is in memory.
+
+const TASK_TOOLS = {
+  loki_v10_verify: { cmd: 'verify', keys: ['receipt_path', 'repo_path'], required: [['receipt_path', 'repo_path']] },
+  loki_v10_run: { cmd: 'run', keys: ['ref', 'repo_path'], required: [['ref'], ['repo_path']] }
+};
+const TASK_MAX = 64;
+const TASK_TIMEOUT_MS = 300000;
+const TRACEPARENT_RE = /^00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$/;
+// Same list the adapter's _env() drops for the direct tool (mcp/v10_tools.py _DROPPED_ENV): one mechanism, so a task
+// sees the same environment as the direct call. MCP_AUTH_TOKEN is the server's own bearer and is never forwarded.
+const TASK_DROPPED_ENV = ['LOKI_CONTROL_TOKEN', 'SLACK_BOT_TOKEN', 'SLACK_SIGNING_SECRET', 'SLACK_WEBHOOK_URL', 'MCP_AUTH_TOKEN'];
+
+const tasks = new Map();
+let _taskSpawner = null;
+
+function tasksEnabled() {
+  return process.env.LOKI_MCP_TASKS === '1';
+}
+
+function _setTaskSpawnerForTests(fn) {
+  _taskSpawner = fn;
+}
+
+function _taskPidForTests(taskId) {
+  const t = tasks.get(taskId);
+  return t ? t.pid : undefined;
+}
+
+/** W3C traceparent -> { traceId, parentSpanId }, or null for anything malformed or all-zero. */
+function parseTraceparent(value) {
+  if (typeof value !== 'string') return null;
+  const m = TRACEPARENT_RE.exec(value);
+  if (!m || /^0+$/.test(m[1]) || /^0+$/.test(m[2])) return null;
+  return { traceId: m[1], parentSpanId: m[2] };
+}
+
+function taskChildEnv(trace) {
+  const env = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (typeof v === 'string' && !TASK_DROPPED_ENV.includes(k)) env[k] = v;
+  }
+  delete env.LOKI_PARENT_SPAN_ID;
+  env.LOKI_NO_BROWSER = '1';
+  if (trace) {
+    env.LOKI_TRACE_ID = trace.traceId;
+    env.LOKI_PARENT_SPAN_ID = trace.parentSpanId;
+  }
+  return env;
+}
+
+function taskArgs(tool, args) {
+  const spec = TASK_TOOLS[Object.prototype.hasOwnProperty.call(TASK_TOOLS, tool) ? tool : ''];
+  if (!spec) return { error: 'tool cannot run as a task: ' + String(tool) };
+  if (!args || typeof args !== 'object' || Array.isArray(args)) return { error: 'arguments must be an object' };
+  for (const k of Object.keys(args)) {
+    if (!spec.keys.includes(k)) return { error: 'unknown argument: ' + k };
+  }
+  for (const k of spec.keys) {
+    const v = args[k];
+    if (v === undefined) continue;
+    if (typeof v !== 'string' || v.length > 4096 || v.includes('\0') || v.startsWith('-')) return { error: 'invalid ' + k };
+  }
+  for (const anyOf of spec.required) {
+    if (!anyOf.some((k) => typeof args[k] === 'string' && args[k] !== '')) return { error: anyOf.join(' or ') + ' is required' };
+  }
+  return { spec, argv: spec.keys.map((k) => (typeof args[k] === 'string' ? args[k] : '')) };
+}
+
+function taskView(t) {
+  return { taskId: t.id, status: t.status, tool: t.tool };
+}
+
+function taskCreate(params, id) {
+  const p = params || {};
+  const a = taskArgs(p.tool, p.arguments);
+  if (a.error) return makeError(-32602, a.error, id);
+  const trace = parseTraceparent(p._meta && p._meta.traceparent);
+  while (tasks.size >= TASK_MAX) {
+    const old = Array.from(tasks.values()).find((t) => t.status !== 'working');
+    if (!old) return makeError(-32603, 'too many running tasks', id);
+    tasks.delete(old.id);
+  }
+  const adapter = path.resolve(__dirname, '..', '..', 'mcp', 'v10_tools.py');
+  const cmd = process.env.LOKI_PYTHON || 'python3';
+  const args = ['-I', adapter, a.spec.cmd].concat(a.argv);
+  const spawner = _taskSpawner || ((c, av, o) => spawn(c, av, { env: o.env, stdio: ['ignore', 'pipe', 'pipe'] }));
+  let child;
+  try {
+    child = spawner(cmd, args, { env: taskChildEnv(trace) });
+  } catch (err) {
+    return makeError(-32603, 'could not start task', id);
+  }
+  const t = { id: crypto.randomUUID(), tool: p.tool, status: 'working', pid: child.pid, stdout: '', text: null, child: child };
+  tasks.set(t.id, t);
+  if (child.stdout) child.stdout.on('data', (d) => { if (t.stdout.length < 1048576) t.stdout += d; });
+  const timer = setTimeout(() => { if (t.status === 'working') { t.status = 'failed'; t.text = 'task timed out'; try { child.kill('SIGTERM'); } catch (e) { /* gone */ } } }, TASK_TIMEOUT_MS);
+  timer.unref();
+  child.on('error', () => { clearTimeout(timer); if (t.status === 'working') { t.status = 'failed'; t.text = 'adapter could not run'; } });
+  child.on('close', (code) => {
+    clearTimeout(timer);
+    if (t.status !== 'working') return;
+    if (code === 0 && t.stdout.trim()) { t.status = 'completed'; t.text = t.stdout.replace(/\n$/, ''); } else { t.status = 'failed'; t.text = 'adapter exited ' + String(code); }
+  });
+  return makeResult({ task: taskView(t) }, id);
+}
+
+function taskDispatch(method, params, id) {
+  if (method === 'tasks/create') return taskCreate(params, id);
+  const t = params && typeof params.taskId === 'string' ? tasks.get(params.taskId) : undefined;
+  if (!t) return makeError(-32602, 'Unknown taskId', id);
+  if (method === 'tasks/get') return makeResult({ task: taskView(t) }, id);
+  if (method === 'tasks/result') {
+    if (t.status === 'working') return makeError(-32602, 'Task not finished', id);
+    if (t.status === 'cancelled') return makeError(-32602, 'Task was cancelled', id);
+    return makeResult({ content: [{ type: 'text', text: t.text }], isError: t.status === 'failed' }, id);
+  }
+  // tasks/cancel: signal only the child this server recorded
+  if (t.status === 'working') {
+    t.status = 'cancelled';
+    try { t.child.kill('SIGTERM'); } catch (e) { /* already gone */ }
+  }
+  return makeResult({ task: taskView(t) }, id);
+}
+
 function getCapabilities() {
   return {
     tools: {},
@@ -117,7 +258,7 @@ function getCapabilities() {
 // JSON-RPC 2.0 request handler
 // ---------------------------------------------------------------------------
 
-function handleRequest(request) {
+function handleRequest(request, ctx) {
   // Validate basic JSON-RPC structure
   if (!request || typeof request !== 'object') {
     return makeError(-32600, 'Invalid request', null);
@@ -137,10 +278,17 @@ function handleRequest(request) {
   const isNotification = id === undefined || id === null;
 
   // Auth check for tool/resource calls
-  if (method === 'tools/call' || method === 'resources/read') {
+  if (method === 'tools/call' || method === 'resources/read' || (tasksEnabled() && method.startsWith('tasks/'))) {
     const auth = getAuth();
+    const overHttp = !!(ctx && ctx.transport === 'http') && method.startsWith('tasks/');
+    // Tasks spawn processes: over HTTP a token is mandatory even when general auth is off (fail closed).
+    if (overHttp && !auth.enabled) {
+      if (isNotification) return null;
+      return makeError(-32001, 'Tasks over HTTP require an auth token (set MCP_AUTH_TOKEN)', id);
+    }
     if (auth.enabled) {
-      const validation = auth.validate(request);
+      let validation = auth.validate(request);
+      if (overHttp && !validation.valid && ctx.authorization) validation = auth.validateHeader(ctx.authorization);
       if (!validation.valid) {
         if (isNotification) return null;
         return makeError(-32001, validation.error || 'Unauthorized', id);
@@ -148,6 +296,15 @@ function handleRequest(request) {
     }
   }
 
+  // Stateless profile: a request may carry its protocol version in _meta. No session is created or stored.
+  const metaVersion = params && params._meta && typeof params._meta === 'object' ? params._meta[META_PROTOCOL_VERSION] : undefined;
+  if (metaVersion !== undefined && !advertisedProtocolVersions().includes(metaVersion)) {
+    if (isNotification) return null;
+    const err = makeError(-32022, 'Unsupported protocol version: ' + String(metaVersion), id);
+    err.error.data = { supported: advertisedProtocolVersions() };
+    return err;
+  }
+
   let result;
 
   switch (method) {
@@ -159,6 +316,24 @@ function handleRequest(request) {
       };
       break;
 
+    case 'tasks/create':
+    case 'tasks/get':
+    case 'tasks/result':
+    case 'tasks/cancel':
+      if (!tasksEnabled()) {
+        if (isNotification) return null;
+        return makeError(-32601, 'Method not found: ' + method, id);
+      }
+      return taskDispatch(method, params, id);
+
+    case 'server/discover':
+      result = {
+        supportedVersions: advertisedProtocolVersions(),
+        serverInfo: getServerInfo(),
+        capabilities: getCapabilities()
+      };
+      break;
+
     case 'initialized':
     case 'notifications/initialized':
       // Client acknowledgment -- no response needed
@@ -369,7 +544,7 @@ function main() {
 }
 
 // Export for testing
-module.exports = { SUPPORTED_PROTOCOL_VERSIONS, handleRequest, getTools, getResources, getAuth, getServerInfo, main };
+module.exports = { parseTraceparent, _setTaskSpawnerForTests, _taskPidForTests, SUPPORTED_PROTOCOL_VERSIONS, handleRequest, getTools, getResources, getAuth, getServerInfo, main };
 
 // Run if executed directly
 if (require.main === module) {

package/src/protocols/transport/sse.js

@@ -14,6 +14,12 @@ const http = require('http');
 // Maximum allowed POST body size (10 MB)
 const MAX_BODY_BYTES = 10 * 1024 * 1024;
 
+const LOOPBACK_ORIGIN_RE = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/i;
+
+function _isTaskMethod(r) {
+  return !!r && typeof r === 'object' && typeof r.method === 'string' && r.method.startsWith('tasks/');
+}
+
 class SSETransport {
   constructor(handler, options) {
     this._handler = handler;
@@ -151,9 +157,24 @@ class SSETransport {
         return;
       }
 
+      // Task methods spawn processes. A text/plain cross-origin POST is a CORS simple request (no preflight), so
+      // require a JSON Content-Type and a loopback (or absent) Origin before the handler ever sees them.
+      const ctx = { transport: 'http', authorization: req.headers.authorization };
+      const touchesTasks = Array.isArray(request) ? request.some(_isTaskMethod) : _isTaskMethod(request);
+      if (touchesTasks) {
+        const ctype = String(req.headers['content-type'] || '').split(';')[0].trim().toLowerCase();
+        const origin = req.headers.origin;
+        const reject = (status, message) => {
+          res.writeHead(status, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ jsonrpc: '2.0', error: { code: -32600, message: message }, id: null }));
+        };
+        if (ctype !== 'application/json') { reject(415, 'Task requests require Content-Type: application/json'); return; }
+        if (origin !== undefined && !LOOPBACK_ORIGIN_RE.test(String(origin))) { reject(403, 'Task requests require a loopback Origin'); return; }
+      }
+
       // Handle batch
       if (Array.isArray(request)) {
-        const promises = request.map((r) => Promise.resolve().then(() => this._handler(r)));
+        const promises = request.map((r) => Promise.resolve().then(() => this._handler(r, ctx)));
         Promise.all(promises).then((results) => {
           const responses = results.filter((r) => r !== null);
           res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -171,7 +192,7 @@ class SSETransport {
         return;
       }
 
-      Promise.resolve().then(() => this._handler(request)).then((response) => {
+      Promise.resolve().then(() => this._handler(request, ctx)).then((response) => {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify(response));
       }).catch(() => {

package/web-app/dist/assets/{AdminPage-CMkHNJbF.js → AdminPage-CKj0pDt0.js}

@@ -1,4 +1,4 @@
-import{c as L,r as x,j as e,w as re,Z as ne,m as le,h as ie,p as P,F as ye,U as I,X as ce,L as de,x as oe,M as Ae,T as Z,S as we,l as xe,k as me,y as Ce,E as Fe,a0 as Se,a as U,a2 as he}from"./index-CooHd7I-.js";import{B as C}from"./Button-T4BnOZgl.js";import{T as $e}from"./trending-up-DST7I6M2.js";import{C as z}from"./clock-D7Uas3oL.js";import{A as Be,U as ue,M as De}from"./Avatar-BJyjV7Zi.js";import{A as J}from"./activity-D2C0VagO.js";import{R as pe}from"./refresh-cw-C9cBJEAT.js";import{G as ze}from"./globe-CQ-GL485.js";import{C as Le}from"./chevron-left-emu6r49E.js";import{C as je}from"./check-B13xkXed.js";import{D as Y}from"./dollar-sign-qHmnNYsU.js";import{U as Te}from"./user-BRBohA6J.js";import{D as Me}from"./database-BQFkd7t1.js";import{L as Ue}from"./lock-BeXLebuJ.js";import{S as Re}from"./scroll-text-DZCoXQjo.js";import{S as Ie}from"./shield-alert-oVhmf1_h.js";/**
+import{c as L,r as x,j as e,w as re,Z as ne,m as le,h as ie,p as P,F as ye,U as I,X as ce,L as de,x as oe,M as Ae,T as Z,S as we,l as xe,k as me,y as Ce,E as Fe,a0 as Se,a as U,a2 as he}from"./index-DnCsWpCh.js";import{B as C}from"./Button-B3GM7oxm.js";import{T as $e}from"./trending-up-DpUJzIrV.js";import{C as z}from"./clock-XdFXoaJi.js";import{A as Be,U as ue,M as De}from"./Avatar-BOV__pMM.js";import{A as J}from"./activity-BZ77CO72.js";import{R as pe}from"./refresh-cw-9DSznasU.js";import{G as ze}from"./globe-tbpeHRPV.js";import{C as Le}from"./chevron-left-CqTRVUB5.js";import{C as je}from"./check-BSxGjsta.js";import{D as Y}from"./dollar-sign-VC2UX2UE.js";import{U as Te}from"./user-CxHrowEP.js";import{D as Me}from"./database-BpvOmzij.js";import{L as Ue}from"./lock-CTtO6vc8.js";import{S as Re}from"./scroll-text-BWLthSw-.js";import{S as Ie}from"./shield-alert-XRJYD_6c.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{Avatar-BJyjV7Zi.js → Avatar-BOV__pMM.js}

@@ -1,4 +1,4 @@
-import{c as l,j as s}from"./index-CooHd7I-.js";/**
+import{c as l,j as s}from"./index-DnCsWpCh.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{Badge-D572l0uq.js → Badge-4a6mAYjU.js}

@@ -1 +1 @@
-import{j as e}from"./index-CooHd7I-.js";import{C as r}from"./clock-D7Uas3oL.js";import{C as a}from"./circle-alert-CExlwjuy.js";import{C as l}from"./check-B13xkXed.js";const i={completed:"bg-[#1FC5A8]/10 text-[#1FC5A8]",running:"bg-[#553DE9]/10 text-[#553DE9]",failed:"bg-[#C45B5B]/10 text-[#C45B5B]",started:"bg-[#D4A03C]/10 text-[#D4A03C]",empty:"bg-[#F8F4F0] text-[#6B6960]",version:"bg-[#553DE9]/10 text-[#553DE9]"};function o({status:t}){switch(t){case"completed":return e.jsx(l,{size:12});case"running":return e.jsxs("span",{className:"relative flex h-2 w-2",children:[e.jsx("span",{className:"animate-ping motion-reduce:animate-none absolute inline-flex h-full w-full rounded-full bg-current opacity-75"}),e.jsx("span",{className:"relative inline-flex rounded-full h-2 w-2 bg-current"})]});case"failed":return e.jsx(a,{size:12});case"started":return e.jsx(r,{size:12});default:return null}}function f({status:t,children:n,className:s=""}){return e.jsxs("span",{className:["inline-flex items-center gap-1 rounded-btn px-2.5 py-0.5 text-xs font-semibold",i[t],s].filter(Boolean).join(" "),children:[e.jsx(o,{status:t}),n]})}export{f as B};
+import{j as e}from"./index-DnCsWpCh.js";import{C as r}from"./clock-XdFXoaJi.js";import{C as a}from"./circle-alert-88gdjY71.js";import{C as l}from"./check-BSxGjsta.js";const i={completed:"bg-[#1FC5A8]/10 text-[#1FC5A8]",running:"bg-[#553DE9]/10 text-[#553DE9]",failed:"bg-[#C45B5B]/10 text-[#C45B5B]",started:"bg-[#D4A03C]/10 text-[#D4A03C]",empty:"bg-[#F8F4F0] text-[#6B6960]",version:"bg-[#553DE9]/10 text-[#553DE9]"};function o({status:t}){switch(t){case"completed":return e.jsx(l,{size:12});case"running":return e.jsxs("span",{className:"relative flex h-2 w-2",children:[e.jsx("span",{className:"animate-ping motion-reduce:animate-none absolute inline-flex h-full w-full rounded-full bg-current opacity-75"}),e.jsx("span",{className:"relative inline-flex rounded-full h-2 w-2 bg-current"})]});case"failed":return e.jsx(a,{size:12});case"started":return e.jsx(r,{size:12});default:return null}}function f({status:t,children:n,className:s=""}){return e.jsxs("span",{className:["inline-flex items-center gap-1 rounded-btn px-2.5 py-0.5 text-xs font-semibold",i[t],s].filter(Boolean).join(" "),children:[e.jsx(o,{status:t}),n]})}export{f as B};

package/web-app/dist/assets/{Button-T4BnOZgl.js → Button-B3GM7oxm.js}

@@ -1 +1 @@
-import{r as p,j as t}from"./index-CooHd7I-.js";const m={primary:"bg-[#553DE9] text-white hover:bg-[#4432c4] shadow-button rounded-btn",secondary:"border border-[#553DE9] text-[#553DE9] hover:bg-[#E8E4FD] bg-transparent rounded-btn",ghost:"text-[#36342E] hover:bg-[#F8F4F0] rounded-btn",danger:"bg-[#C45B5B]/10 text-[#C45B5B] border border-[#C45B5B]/20 hover:bg-[#C45B5B]/20 rounded-btn"},b={sm:"px-3 py-1.5 text-xs",md:"px-4 py-2 text-sm",lg:"px-6 py-3 text-base"},u={sm:14,md:16,lg:18};function h({size:e}){return t.jsxs("svg",{className:"animate-spin",width:e,height:e,viewBox:"0 0 24 24",fill:"none",children:[t.jsx("circle",{className:"opacity-25",cx:"12",cy:"12",r:"10",stroke:"currentColor",strokeWidth:"4"}),t.jsx("path",{className:"opacity-75",fill:"currentColor",d:"M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"})]})}const B=p.forwardRef(({variant:e="primary",size:o="md",icon:n,iconRight:i,loading:r=!1,disabled:a,className:c="",children:l,...x},d)=>{const s=u[o];return t.jsxs("button",{ref:d,disabled:a||r,className:["inline-flex items-center justify-center gap-2 font-medium transition-colors",m[e],b[o],(a||r)&&"opacity-60 cursor-not-allowed",c].filter(Boolean).join(" "),...x,children:[r?t.jsx(h,{size:s}):n?t.jsx(n,{size:s}):null,l,i&&!r&&t.jsx(i,{size:s})]})});B.displayName="Button";export{B};
+import{r as p,j as t}from"./index-DnCsWpCh.js";const m={primary:"bg-[#553DE9] text-white hover:bg-[#4432c4] shadow-button rounded-btn",secondary:"border border-[#553DE9] text-[#553DE9] hover:bg-[#E8E4FD] bg-transparent rounded-btn",ghost:"text-[#36342E] hover:bg-[#F8F4F0] rounded-btn",danger:"bg-[#C45B5B]/10 text-[#C45B5B] border border-[#C45B5B]/20 hover:bg-[#C45B5B]/20 rounded-btn"},b={sm:"px-3 py-1.5 text-xs",md:"px-4 py-2 text-sm",lg:"px-6 py-3 text-base"},u={sm:14,md:16,lg:18};function h({size:e}){return t.jsxs("svg",{className:"animate-spin",width:e,height:e,viewBox:"0 0 24 24",fill:"none",children:[t.jsx("circle",{className:"opacity-25",cx:"12",cy:"12",r:"10",stroke:"currentColor",strokeWidth:"4"}),t.jsx("path",{className:"opacity-75",fill:"currentColor",d:"M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"})]})}const B=p.forwardRef(({variant:e="primary",size:o="md",icon:n,iconRight:i,loading:r=!1,disabled:a,className:c="",children:l,...x},d)=>{const s=u[o];return t.jsxs("button",{ref:d,disabled:a||r,className:["inline-flex items-center justify-center gap-2 font-medium transition-colors",m[e],b[o],(a||r)&&"opacity-60 cursor-not-allowed",c].filter(Boolean).join(" "),...x,children:[r?t.jsx(h,{size:s}):n?t.jsx(n,{size:s}):null,l,i&&!r&&t.jsx(i,{size:s})]})});B.displayName="Button";export{B};

package/web-app/dist/assets/{CockpitPage-Cj_GFsNn.js → CockpitPage-Cwge3_kH.js}

@@ -1,4 +1,4 @@
-import{c as $,r as l,j as e,G as we,Q as Se,F as Ce,h as Re,T as U,Z as Ee,a as S,V as Me,S as $e,Y as Te,X as Pe,P as ie,i as Ae,g as ze,C as Ie,l as Le,N as I,J as _e,K as De,O as Fe,u as Oe}from"./index-CooHd7I-.js";import{P as K,S as He,E as Be}from"./ErrorBoundary-hugCg5yg.js";import{C as qe,F as Ge,M as Ue,H as Ke,a as We,G as Ve,T as Qe}from"./thumbs-up-B-kbX4vN.js";import{C as oe}from"./check-B13xkXed.js";import{C as Ye}from"./clock-D7Uas3oL.js";import{D as Xe}from"./dollar-sign-qHmnNYsU.js";import{U as Ze}from"./upload-CUOT780G.js";import{L as V}from"./loader-circle-15vK3oV1.js";/**
+import{c as $,r as l,j as e,G as we,Q as Se,F as Ce,h as Re,T as U,Z as Ee,a as S,V as Me,S as $e,Y as Te,X as Pe,P as ie,i as Ae,g as ze,C as Ie,l as Le,N as I,J as _e,K as De,O as Fe,u as Oe}from"./index-DnCsWpCh.js";import{P as K,S as He,E as Be}from"./ErrorBoundary-TM7lDjUJ.js";import{C as qe,F as Ge,M as Ue,H as Ke,a as We,G as Ve,T as Qe}from"./thumbs-up-CxuTD3eO.js";import{C as oe}from"./check-BSxGjsta.js";import{C as Ye}from"./clock-XdFXoaJi.js";import{D as Xe}from"./dollar-sign-VC2UX2UE.js";import{U as Ze}from"./upload-Db7YZ4zR.js";import{L as V}from"./loader-circle-czscMzmQ.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{ComparePage-A8m4ZXak.js → ComparePage-CBQUGKsm.js}

@@ -1 +1 @@
-import{r as o,j as e}from"./index-CooHd7I-.js";function f({value:r,prefix:t="",suffix:s=""}){const[u,n]=o.useState(0),c=o.useRef(0);return o.useEffect(()=>{const a=c.current,h=r-a;if(h===0)return;const i=600,d=performance.now();function l(b){const v=b-d,m=Math.min(v/i,1),N=1-Math.pow(1-m,3),p=Math.round(a+h*N);n(p),c.current=p,m<1&&requestAnimationFrame(l)}requestAnimationFrame(l)},[r]),e.jsxs("span",{className:"tabular-nums",children:[t,u.toLocaleString(),s]})}function g(){const[r,t]=o.useState(5),[s,u]=o.useState(30),[n,c]=o.useState(75),a=.4,i=Math.round(r*s*a*4.33),d=Math.round(i*n);return e.jsxs("div",{className:"bg-white border border-[#ECEAE3] rounded-xl p-6 shadow-sm",children:[e.jsx("h3",{className:"text-lg font-bold text-[#36342E] mb-1",children:"ROI Calculator"}),e.jsx("p",{className:"text-sm text-[#6B6960] mb-6",children:"Estimate how much your team could save with autonomous development."}),e.jsxs("div",{className:"space-y-5",children:[e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Team size"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:[r," developers"]})]}),e.jsx("input",{type:"range",min:1,max:50,value:r,onChange:l=>t(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"1"}),e.jsx("span",{children:"50"})]})]}),e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Hours coding per week"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:[s,"h"]})]}),e.jsx("input",{type:"range",min:5,max:60,value:s,onChange:l=>u(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"5h"}),e.jsx("span",{children:"60h"})]})]}),e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Average hourly rate"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:["$",n,"/hr"]})]}),e.jsx("input",{type:"range",min:25,max:250,step:5,value:n,onChange:l=>c(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"$25"}),e.jsx("span",{children:"$250"})]})]})]}),e.jsxs("div",{className:"mt-6 pt-6 border-t border-[#ECEAE3]",children:[e.jsxs("div",{className:"grid grid-cols-2 gap-4 text-center",children:[e.jsxs("div",{children:[e.jsx("div",{className:"text-2xl font-bold text-[#553DE9]",children:e.jsx(f,{value:i,suffix:"h"})}),e.jsx("div",{className:"text-xs text-[#6B6960] mt-1",children:"Est. hours saved / month"})]}),e.jsxs("div",{children:[e.jsx("div",{className:"text-2xl font-bold text-[#1FC5A8]",children:e.jsx(f,{value:d,prefix:"$"})}),e.jsx("div",{className:"text-xs text-[#6B6960] mt-1",children:"Est. cost saved / month"})]})]}),e.jsxs("div",{className:"mt-4 p-3 rounded-lg bg-[#553DE9]/5 border border-[#553DE9]/10",children:[e.jsxs("p",{className:"text-sm text-[#36342E] text-center",children:["If Loki Mode saved ",Math.round(a*100),"% of coding time, your team could save"," ",e.jsxs("span",{className:"font-bold text-[#553DE9]",children:[i.toLocaleString()," hours"]})," ","and"," ",e.jsxs("span",{className:"font-bold text-[#1FC5A8]",children:["$",d.toLocaleString()]})," ","per month."]}),e.jsxs("p",{className:"mt-2 text-xs text-[#6B6960] text-center",children:["The ",Math.round(a*100),"% is an assumption, not a measurement. Model and API spend is not included."]})]})]})]})}const j=[{feature:"Claude (Opus/Sonnet/Haiku)",category:"AI Models",lokiMode:!0,boltNew:!1,replit:!1,lovable:!0},{feature:"GPT-4o / Codex",category:"AI Models",lokiMode:!0,boltNew:!0,replit:!0,lovable:!1},{feature:"5-provider auto-failover",category:"AI Models",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"8 automated quality gates",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Blind 3-reviewer code review",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Anti-sycophancy checks",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Automated test generation",category:"Quality",lokiMode:!0,boltNew:!1,replit:"Partial",lovable:!1},{feature:"Docker container generation",category:"Deployment",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"CI/CD pipeline generation",category:"Deployment",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"One-click cloud deploy",category:"Deployment",lokiMode:"Planned",boltNew:!0,replit:!0,lovable:!0},{feature:"Self-hosted (your keys)",category:"Cost",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Free tier available",category:"Cost",lokiMode:"Source-available (BUSL-1.1)",boltNew:!0,replit:!0,lovable:!0},{feature:"No vendor lock-in",category:"Cost",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"SSO / OIDC authentication",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"RBAC access control",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"Audit logging",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"Air-gapped deployment",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1}];function y(){return e.jsx("svg",{width:"18",height:"18",viewBox:"0 0 24 24",fill:"none",className:"text-[#1FC5A8]",children:e.jsx("path",{d:"M20 6L9 17l-5-5",stroke:"currentColor",strokeWidth:"2.5",strokeLinecap:"round",strokeLinejoin:"round"})})}function w(){return e.jsx("svg",{width:"18",height:"18",viewBox:"0 0 24 24",fill:"none",className:"text-[#C45B5B]/40",children:e.jsx("path",{d:"M18 6L6 18M6 6l12 12",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})}function x({value:r}){return typeof r=="string"?e.jsx("span",{className:"text-xs text-[#6B6960] font-medium",children:r}):r?e.jsx(y,{}):e.jsx(w,{})}const k=[{title:"Full Autonomy",description:"Describe what you want. Loki Mode handles planning, coding, testing, and verification automatically.",icon:e.jsx("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#553DE9]",children:e.jsx("path",{d:"M13 2L3 14h9l-1 8 10-12h-9l1-8z",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})},{title:"Production Quality",description:"8 quality gates, blind code review, and anti-sycophancy checks ensure code that actually works.",icon:e.jsx("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#1FC5A8]",children:e.jsx("path",{d:"M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})},{title:"Your Infrastructure",description:"Self-hosted, source-available (BUSL-1.1), no data leaves your network. Use your own API keys across 5 providers.",icon:e.jsxs("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#2F71E3]",children:[e.jsx("rect",{x:"2",y:"2",width:"20",height:"8",rx:"2",stroke:"currentColor",strokeWidth:"2"}),e.jsx("rect",{x:"2",y:"14",width:"20",height:"8",rx:"2",stroke:"currentColor",strokeWidth:"2"}),e.jsx("circle",{cx:"6",cy:"6",r:"1",fill:"currentColor"}),e.jsx("circle",{cx:"6",cy:"18",r:"1",fill:"currentColor"})]})},{title:"Built for Teams",description:"Enterprise auth, RBAC, audit logs, and parallel workflows for teams of any size.",icon:e.jsxs("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#E93D82]",children:[e.jsx("path",{d:"M17 21v-2a4 4 0 00-4-4H5a4 4 0 00-4 4v2",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"}),e.jsx("circle",{cx:"9",cy:"7",r:"4",stroke:"currentColor",strokeWidth:"2"}),e.jsx("path",{d:"M23 21v-2a4 4 0 00-3-3.87M16 3.13a4 4 0 010 7.75",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})]})}];function C(){const r=[...new Set(j.map(t=>t.category))];return e.jsx("div",{className:"min-h-screen bg-[#FAF9F6]",children:e.jsxs("div",{className:"max-w-6xl mx-auto px-6 py-8",children:[e.jsxs("div",{className:"mb-8",children:[e.jsx("h1",{className:"text-2xl font-bold text-[#36342E]",children:"Compare"}),e.jsx("p",{className:"text-[#6B6960] mt-1",children:"See how Loki Mode stacks up against other AI development platforms."})]}),e.jsx("div",{className:"bg-white border border-[#ECEAE3] rounded-xl overflow-hidden shadow-sm",children:e.jsx("div",{className:"overflow-x-auto",children:e.jsxs("table",{className:"w-full text-sm",children:[e.jsx("thead",{children:e.jsxs("tr",{className:"border-b border-[#ECEAE3]",children:[e.jsx("th",{className:"text-left px-4 py-3 font-medium text-[#6B6960] w-[240px]",children:"Feature"}),e.jsx("th",{className:"text-center px-4 py-3 font-bold text-[#553DE9] bg-[#553DE9]/5 w-[130px]",children:"Loki Mode"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"bolt.new"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"Replit"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"Lovable"})]})}),e.jsx("tbody",{children:r.map(t=>e.jsxs(e.Fragment,{children:[e.jsx("tr",{className:"bg-[#FAF9F6]",children:e.jsx("td",{colSpan:5,className:"px-4 py-2 text-xs font-bold text-[#939084] uppercase tracking-wider",children:t})},`cat-${t}`),j.filter(s=>s.category===t).map(s=>e.jsxs("tr",{className:"border-b border-[#ECEAE3] last:border-b-0",children:[e.jsx("td",{className:"px-4 py-2.5 text-[#36342E]",children:s.feature}),e.jsx("td",{className:"px-4 py-2.5 text-center bg-[#553DE9]/5",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.lokiMode})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.boltNew})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.replit})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.lovable})})})]},s.feature))]}))})]})})}),e.jsxs("div",{className:"mt-12",children:[e.jsx("h2",{className:"text-xl font-bold text-[#36342E] mb-6",children:"Why developers choose Loki Mode"}),e.jsx("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-5",children:k.map(t=>e.jsxs("div",{className:"bg-white border border-[#ECEAE3] rounded-xl p-5 shadow-sm hover:shadow-md transition-shadow",children:[e.jsx("div",{className:"mb-3",children:t.icon}),e.jsx("h3",{className:"text-base font-bold text-[#36342E] mb-1",children:t.title}),e.jsx("p",{className:"text-sm text-[#6B6960]",children:t.description})]},t.title))})]}),e.jsx("div",{className:"mt-12 max-w-xl mx-auto",children:e.jsx(g,{})})]})})}export{C as default};
+import{r as o,j as e}from"./index-DnCsWpCh.js";function f({value:r,prefix:t="",suffix:s=""}){const[u,n]=o.useState(0),c=o.useRef(0);return o.useEffect(()=>{const a=c.current,h=r-a;if(h===0)return;const i=600,d=performance.now();function l(b){const v=b-d,m=Math.min(v/i,1),N=1-Math.pow(1-m,3),p=Math.round(a+h*N);n(p),c.current=p,m<1&&requestAnimationFrame(l)}requestAnimationFrame(l)},[r]),e.jsxs("span",{className:"tabular-nums",children:[t,u.toLocaleString(),s]})}function g(){const[r,t]=o.useState(5),[s,u]=o.useState(30),[n,c]=o.useState(75),a=.4,i=Math.round(r*s*a*4.33),d=Math.round(i*n);return e.jsxs("div",{className:"bg-white border border-[#ECEAE3] rounded-xl p-6 shadow-sm",children:[e.jsx("h3",{className:"text-lg font-bold text-[#36342E] mb-1",children:"ROI Calculator"}),e.jsx("p",{className:"text-sm text-[#6B6960] mb-6",children:"Estimate how much your team could save with autonomous development."}),e.jsxs("div",{className:"space-y-5",children:[e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Team size"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:[r," developers"]})]}),e.jsx("input",{type:"range",min:1,max:50,value:r,onChange:l=>t(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"1"}),e.jsx("span",{children:"50"})]})]}),e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Hours coding per week"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:[s,"h"]})]}),e.jsx("input",{type:"range",min:5,max:60,value:s,onChange:l=>u(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"5h"}),e.jsx("span",{children:"60h"})]})]}),e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center justify-between mb-2",children:[e.jsx("label",{className:"text-sm font-medium text-[#36342E]",children:"Average hourly rate"}),e.jsxs("span",{className:"text-sm font-semibold text-[#553DE9] tabular-nums",children:["$",n,"/hr"]})]}),e.jsx("input",{type:"range",min:25,max:250,step:5,value:n,onChange:l=>c(Number(l.target.value)),className:"w-full h-2 bg-[#ECEAE3] rounded-full appearance-none cursor-pointer accent-[#553DE9]"}),e.jsxs("div",{className:"flex justify-between text-xs text-[#939084] mt-1",children:[e.jsx("span",{children:"$25"}),e.jsx("span",{children:"$250"})]})]})]}),e.jsxs("div",{className:"mt-6 pt-6 border-t border-[#ECEAE3]",children:[e.jsxs("div",{className:"grid grid-cols-2 gap-4 text-center",children:[e.jsxs("div",{children:[e.jsx("div",{className:"text-2xl font-bold text-[#553DE9]",children:e.jsx(f,{value:i,suffix:"h"})}),e.jsx("div",{className:"text-xs text-[#6B6960] mt-1",children:"Est. hours saved / month"})]}),e.jsxs("div",{children:[e.jsx("div",{className:"text-2xl font-bold text-[#1FC5A8]",children:e.jsx(f,{value:d,prefix:"$"})}),e.jsx("div",{className:"text-xs text-[#6B6960] mt-1",children:"Est. cost saved / month"})]})]}),e.jsxs("div",{className:"mt-4 p-3 rounded-lg bg-[#553DE9]/5 border border-[#553DE9]/10",children:[e.jsxs("p",{className:"text-sm text-[#36342E] text-center",children:["If Loki Mode saved ",Math.round(a*100),"% of coding time, your team could save"," ",e.jsxs("span",{className:"font-bold text-[#553DE9]",children:[i.toLocaleString()," hours"]})," ","and"," ",e.jsxs("span",{className:"font-bold text-[#1FC5A8]",children:["$",d.toLocaleString()]})," ","per month."]}),e.jsxs("p",{className:"mt-2 text-xs text-[#6B6960] text-center",children:["The ",Math.round(a*100),"% is an assumption, not a measurement. Model and API spend is not included."]})]})]})]})}const j=[{feature:"Claude (Opus/Sonnet/Haiku)",category:"AI Models",lokiMode:!0,boltNew:!1,replit:!1,lovable:!0},{feature:"GPT-4o / Codex",category:"AI Models",lokiMode:!0,boltNew:!0,replit:!0,lovable:!1},{feature:"5-provider auto-failover",category:"AI Models",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"8 automated quality gates",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Blind 3-reviewer code review",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Anti-sycophancy checks",category:"Quality",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Automated test generation",category:"Quality",lokiMode:!0,boltNew:!1,replit:"Partial",lovable:!1},{feature:"Docker container generation",category:"Deployment",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"CI/CD pipeline generation",category:"Deployment",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"One-click cloud deploy",category:"Deployment",lokiMode:"Planned",boltNew:!0,replit:!0,lovable:!0},{feature:"Self-hosted (your keys)",category:"Cost",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"Free tier available",category:"Cost",lokiMode:"Source-available (BUSL-1.1)",boltNew:!0,replit:!0,lovable:!0},{feature:"No vendor lock-in",category:"Cost",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1},{feature:"SSO / OIDC authentication",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"RBAC access control",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"Audit logging",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!0,lovable:!1},{feature:"Air-gapped deployment",category:"Enterprise",lokiMode:!0,boltNew:!1,replit:!1,lovable:!1}];function y(){return e.jsx("svg",{width:"18",height:"18",viewBox:"0 0 24 24",fill:"none",className:"text-[#1FC5A8]",children:e.jsx("path",{d:"M20 6L9 17l-5-5",stroke:"currentColor",strokeWidth:"2.5",strokeLinecap:"round",strokeLinejoin:"round"})})}function w(){return e.jsx("svg",{width:"18",height:"18",viewBox:"0 0 24 24",fill:"none",className:"text-[#C45B5B]/40",children:e.jsx("path",{d:"M18 6L6 18M6 6l12 12",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})}function x({value:r}){return typeof r=="string"?e.jsx("span",{className:"text-xs text-[#6B6960] font-medium",children:r}):r?e.jsx(y,{}):e.jsx(w,{})}const k=[{title:"Full Autonomy",description:"Describe what you want. Loki Mode handles planning, coding, testing, and verification automatically.",icon:e.jsx("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#553DE9]",children:e.jsx("path",{d:"M13 2L3 14h9l-1 8 10-12h-9l1-8z",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})},{title:"Production Quality",description:"8 quality gates, blind code review, and anti-sycophancy checks ensure code that actually works.",icon:e.jsx("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#1FC5A8]",children:e.jsx("path",{d:"M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})})},{title:"Your Infrastructure",description:"Self-hosted, source-available (BUSL-1.1), no data leaves your network. Use your own API keys across 5 providers.",icon:e.jsxs("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#2F71E3]",children:[e.jsx("rect",{x:"2",y:"2",width:"20",height:"8",rx:"2",stroke:"currentColor",strokeWidth:"2"}),e.jsx("rect",{x:"2",y:"14",width:"20",height:"8",rx:"2",stroke:"currentColor",strokeWidth:"2"}),e.jsx("circle",{cx:"6",cy:"6",r:"1",fill:"currentColor"}),e.jsx("circle",{cx:"6",cy:"18",r:"1",fill:"currentColor"})]})},{title:"Built for Teams",description:"Enterprise auth, RBAC, audit logs, and parallel workflows for teams of any size.",icon:e.jsxs("svg",{width:"24",height:"24",viewBox:"0 0 24 24",fill:"none",className:"text-[#E93D82]",children:[e.jsx("path",{d:"M17 21v-2a4 4 0 00-4-4H5a4 4 0 00-4 4v2",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"}),e.jsx("circle",{cx:"9",cy:"7",r:"4",stroke:"currentColor",strokeWidth:"2"}),e.jsx("path",{d:"M23 21v-2a4 4 0 00-3-3.87M16 3.13a4 4 0 010 7.75",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round"})]})}];function C(){const r=[...new Set(j.map(t=>t.category))];return e.jsx("div",{className:"min-h-screen bg-[#FAF9F6]",children:e.jsxs("div",{className:"max-w-6xl mx-auto px-6 py-8",children:[e.jsxs("div",{className:"mb-8",children:[e.jsx("h1",{className:"text-2xl font-bold text-[#36342E]",children:"Compare"}),e.jsx("p",{className:"text-[#6B6960] mt-1",children:"See how Loki Mode stacks up against other AI development platforms."})]}),e.jsx("div",{className:"bg-white border border-[#ECEAE3] rounded-xl overflow-hidden shadow-sm",children:e.jsx("div",{className:"overflow-x-auto",children:e.jsxs("table",{className:"w-full text-sm",children:[e.jsx("thead",{children:e.jsxs("tr",{className:"border-b border-[#ECEAE3]",children:[e.jsx("th",{className:"text-left px-4 py-3 font-medium text-[#6B6960] w-[240px]",children:"Feature"}),e.jsx("th",{className:"text-center px-4 py-3 font-bold text-[#553DE9] bg-[#553DE9]/5 w-[130px]",children:"Loki Mode"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"bolt.new"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"Replit"}),e.jsx("th",{className:"text-center px-4 py-3 font-medium text-[#6B6960] w-[130px]",children:"Lovable"})]})}),e.jsx("tbody",{children:r.map(t=>e.jsxs(e.Fragment,{children:[e.jsx("tr",{className:"bg-[#FAF9F6]",children:e.jsx("td",{colSpan:5,className:"px-4 py-2 text-xs font-bold text-[#939084] uppercase tracking-wider",children:t})},`cat-${t}`),j.filter(s=>s.category===t).map(s=>e.jsxs("tr",{className:"border-b border-[#ECEAE3] last:border-b-0",children:[e.jsx("td",{className:"px-4 py-2.5 text-[#36342E]",children:s.feature}),e.jsx("td",{className:"px-4 py-2.5 text-center bg-[#553DE9]/5",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.lokiMode})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.boltNew})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.replit})})}),e.jsx("td",{className:"px-4 py-2.5 text-center",children:e.jsx("div",{className:"flex justify-center",children:e.jsx(x,{value:s.lovable})})})]},s.feature))]}))})]})})}),e.jsxs("div",{className:"mt-12",children:[e.jsx("h2",{className:"text-xl font-bold text-[#36342E] mb-6",children:"Why developers choose Loki Mode"}),e.jsx("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-5",children:k.map(t=>e.jsxs("div",{className:"bg-white border border-[#ECEAE3] rounded-xl p-5 shadow-sm hover:shadow-md transition-shadow",children:[e.jsx("div",{className:"mb-3",children:t.icon}),e.jsx("h3",{className:"text-base font-bold text-[#36342E] mb-1",children:t.title}),e.jsx("p",{className:"text-sm text-[#6B6960]",children:t.description})]},t.title))})]}),e.jsx("div",{className:"mt-12 max-w-xl mx-auto",children:e.jsx(g,{})})]})})}export{C as default};

package/web-app/dist/assets/{ErrorBoundary-hugCg5yg.js → ErrorBoundary-TM7lDjUJ.js}

@@ -1,4 +1,4 @@
-import{c as o,r as a,j as e,T as n,h as i,p as c}from"./index-CooHd7I-.js";/**
+import{c as o,r as a,j as e,T as n,h as i,p as c}from"./index-DnCsWpCh.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.