loki-mode 11.3.8 → 11.4.2

package/packages/control-plane/dist/server.js

@@ -7618,6 +7618,12 @@ function withheldSentinel(fresh = false) {
     sentinel = null;
   return sentinel ??= `${SENTINEL_PREFIX}${process.pid}${randomBytes2(8).toString("hex")}INVALID`;
 }
+function removeConfigDir() {
+  if (configDir)
+    try {
+      rmSync4(configDir, { recursive: true, force: true });
+    } catch {}
+}
 function emptyGhConfigDir(env = process.env) {
   if (configDir && isDir(configDir))
     return configDir;
@@ -7630,11 +7636,14 @@ function emptyGhConfigDir(env = process.env) {
   }
   if (!exitHooked) {
     exitHooked = true;
-    process.once("exit", () => {
-      if (configDir)
-        try {
-          rmSync4(configDir, { recursive: true, force: true });
-        } catch {}
+    process.once("exit", removeConfigDir);
+  }
+  if (!sigtermHooked) {
+    sigtermHooked = true;
+    process.prependListener("SIGTERM", () => {
+      removeConfigDir();
+      if (process.listenerCount("SIGTERM") === 1)
+        process.exit(143);
     });
   }
   return configDir;
@@ -7654,10 +7663,13 @@ function hardenCredentialEnv(env, fresh = false) {
     env[`GIT_CONFIG_VALUE_${n2}`] = "";
     env["GIT_CONFIG_COUNT"] = String(n2 + 1);
   }
+  const params = env["GIT_CONFIG_PARAMETERS"];
+  if (params && !params.trimEnd().endsWith("'credential.helper'=''"))
+    env["GIT_CONFIG_PARAMETERS"] = `${params} 'credential.helper'=''`;
   env["GIT_TERMINAL_PROMPT"] = "0";
   env["GCM_INTERACTIVE"] = "never";
 }
-var GITHUB_TOKEN_VARS, SENTINEL_PREFIX = "ghp_LOKIWITHHELDsentinel", sentinel = null, configDir = null, exitHooked = false, isDir = (p) => {
+var GITHUB_TOKEN_VARS, SENTINEL_PREFIX = "ghp_LOKIWITHHELDsentinel", sentinel = null, configDir = null, exitHooked = false, sigtermHooked = false, isDir = (p) => {
   try {
     return !lstatSync4(p).isSymbolicLink() && statSync12(p).isDirectory();
   } catch {
@@ -9110,6 +9122,37 @@ var init_claude_model = __esm(() => {
   FAMILY_ALIASES = new Set(["haiku", "sonnet", "opus", "fable"]);
 });
 
+// ../../loki-ts/src/providers/price_table.ts
+var PRICE_TABLE;
+var init_price_table = __esm(() => {
+  PRICE_TABLE = Object.freeze({
+    "gpt-5.3-codex": { input: 1.75, output: 14, cachedInput: 0.175 },
+    "gpt-5-codex": { input: 1.25, output: 10, cachedInput: 0.125 },
+    "gpt-5": { input: 1.25, output: 10, cachedInput: 0.125 },
+    "gpt-4.1": { input: 2, output: 8, cachedInput: 0.5 },
+    "gpt-4o": { input: 2.5, output: 10, cachedInput: 1.25 },
+    "o4-mini": { input: 1.1, output: 4.4, cachedInput: 0.275 },
+    o3: { input: 2, output: 8, cachedInput: 0.5 },
+    "claude-opus": { input: 4, output: 20, cachedInput: 0.2 },
+    "claude-sonnet": { input: 2, output: 10, cachedInput: 0.1 },
+    "claude-haiku": { input: 0.1, output: 0.5, cachedInput: 0.01 },
+    "gemini-2.5-pro": { input: 1.25, output: 10 },
+    gemini: { input: 1.25, output: 10 },
+    deepseek: { input: 0.28, output: 0.42 },
+    minimax: { input: 0.3, output: 1.2 }
+  });
+});
+
+// ../../loki-ts/src/providers/provider_cost.ts
+var ESTIMATED_PROVIDERS;
+var init_provider_cost = __esm(() => {
+  init_price_table();
+  ESTIMATED_PROVIDERS = new Set(["codex", "cline", "aider"]);
+});
+
+// ../../loki-ts/src/providers/model_routes.ts
+var init_model_routes = () => {};
+
 // ../../loki-ts/src/engine10/hooks.ts
 var hooks;
 var init_hooks = __esm(() => {
@@ -9222,6 +9265,8 @@ function sumResultCosts(lokiRoot, iterations, context = []) {
     const unmetered = rec2["source"] === UNMETERED;
     if (unmetered)
       out2.unmetered = true;
+    if (rec2["estimated"] === true)
+      out2.estimated = true;
     const noUsage = !unmetered && inTok === 0 && outTok === 0 && cacheR === 0 && cacheC === 0;
     if (typeof c !== "number" || !Number.isFinite(c) || noUsage) {
       out2.missing.push(iter);
@@ -9347,14 +9392,23 @@ var init_session_route = __esm(() => {
   init_unit_model();
 });
 
+// ../../loki-ts/src/providers/provider_guard.ts
+var init_provider_guard = __esm(() => {
+  init_safe_git();
+});
+
 // ../../loki-ts/src/engine10/session.ts
 var STDERR_TAIL_BYTES, ADVISOR_MARKED_STAGES;
 var init_session = __esm(() => {
+  init_provider_cost();
+  init_model_routes();
   init_cost();
   init_budget();
   init_hooks();
   init_session_route();
   init_safe_git();
+  init_provider_guard();
+  init_budget();
   STDERR_TAIL_BYTES = 64 * 1024;
   ADVISOR_MARKED_STAGES = new Set(["plan", "fix"]);
 });
@@ -11807,6 +11861,55 @@ var init_visual_evidence = __esm(() => {
   PAGE_RE = /^(?:.*\/)?(?:app|pages|src|public)\/.*\.(?:html|jsx|tsx|vue|svelte)$/;
 });
 
+// ../../loki-ts/src/council/role_agents.ts
+import { existsSync as existsSync27, readdirSync as readdirSync15, readFileSync as readFileSync33 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join47 } from "path";
+function agentDirs(repoDir, env = process.env) {
+  return [env["LOKI_AGENTS_PROJECT_DIR"] || join47(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join47(env["XDG_CONFIG_HOME"] || join47(homedir8(), ".config"), "loki", "agents")];
+}
+function parseAgent(file, stem2) {
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync33(file, "utf8"));
+  if (!m)
+    return null;
+  const body = m[2].trim();
+  if (!body)
+    return null;
+  const kv = (k) => new RegExp(`^${k}:[ \\t]*["']?([^"'\\r\\n#]*?)["']?[ \\t]*$`, "m").exec(m[1])?.[1]?.trim() ?? "";
+  const role = (kv("role") || stem2).toLowerCase();
+  if (!ROLES.includes(role))
+    return null;
+  return { name: kv("name") || stem2, role, provider: (kv("provider") || "claude").toLowerCase(), model: kv("model"), prompt: body.slice(0, 4000) };
+}
+function loadRoleAgent(repoDir, role, env = process.env) {
+  for (const d of agentDirs(repoDir, env)) {
+    if (!existsSync27(d))
+      continue;
+    let names;
+    try {
+      names = readdirSync15(d).filter((n2) => n2.endsWith(".md") && !n2.startsWith(".")).sort();
+    } catch {
+      continue;
+    }
+    const ordered = [...names.filter((n2) => n2 === `${role}.md`), ...names.filter((n2) => n2 !== `${role}.md`)];
+    for (const n2 of ordered) {
+      try {
+        const a = parseAgent(join47(d, n2), n2.slice(0, -3));
+        if (a && a.role === role)
+          return a;
+      } catch {}
+    }
+  }
+  return null;
+}
+function loadReviewStageAgent(repoDir, env = process.env) {
+  return loadRoleAgent(repoDir, "reviewer", env) ?? loadRoleAgent(repoDir, "council", env);
+}
+var ROLES;
+var init_role_agents = __esm(() => {
+  ROLES = ["council", "reviewer"];
+});
+
 // ../../loki-ts/src/util/shell.ts
 async function readStreamCapped(stream, maxBytes = MAX_STDOUT_BYTES) {
   const reader = stream.getReader();
@@ -11879,8 +11982,8 @@ var init_shell = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
-import { existsSync as existsSync27, readFileSync as readFileSync33 } from "fs";
-import { join as join47 } from "path";
+import { existsSync as existsSync28, readFileSync as readFileSync34 } from "fs";
+import { join as join48 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
   return RANK2[ceiling] < RANK2[verdict] ? ceiling : verdict;
@@ -11893,11 +11996,11 @@ function explicitReview(repoDir, env) {
   if (flag && isOff(ev))
     return "off";
   for (const f of ["loki.yaml", "loki.yml"]) {
-    const p = join47(repoDir, f);
-    if (!existsSync27(p))
+    const p = join48(repoDir, f);
+    if (!existsSync28(p))
       continue;
     try {
-      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync33(p, "utf8"));
+      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync34(p, "utf8"));
       const v = asProvider(m?.[1]);
       if (v)
         return v;
@@ -11926,9 +12029,15 @@ function reviewReceipt(builder, xr, env = process.env) {
   const differs = !!xr && xr.level !== "not_run" && xr.provider !== builder && (builder === "claude" || builder === "codex");
   return { review: { provider: xr?.provider ?? null, vendor_differs: differs }, notProven: differs ? [] : ["judge shares builder vendor or none configured"] };
 }
-function reviewArgv(p, prompt, env = process.env) {
+function reviewArgv(p, prompt, env = process.env, model) {
   const cli = reviewCli(p, env);
-  return p === "codex" ? [cli, "exec", "--sandbox", "read-only", prompt] : [cli, "-p", prompt, "--allowedTools", "Read,Grep,Glob", "--disallowedTools", "Write,Edit,NotebookEdit,Bash"];
+  return p === "codex" ? [cli, "exec", "--sandbox", "read-only", prompt] : [cli, "-p", prompt, ...model ? ["--model", model] : [], "--allowedTools", "Read,Grep,Glob", "--disallowedTools", "Write,Edit,NotebookEdit,Bash"];
+}
+function configuredReviewer(repoDir, env = process.env) {
+  const a = loadReviewStageAgent(repoDir, env);
+  if (!a)
+    return null;
+  return { prompt: a.prompt, model: a.provider === "claude" ? a.model : "", provider: asProvider(a.provider) };
 }
 function parseReview(p, out2) {
   const m = /^\s*VERDICT:\s*(PASS|FLAG|BLOCK)\b/im.exec(out2);
@@ -11941,7 +12050,8 @@ function parseReview(p, out2) {
   return { provider: p, level, notes };
 }
 async function crossReview(ctx, verdict, head) {
-  const p = reviewProvider(ctx.repoDir, process.env, ctx.provider);
+  const agent = configuredReviewer(ctx.repoDir);
+  const p = reviewProvider(ctx.repoDir, process.env, ctx.provider) ?? agent?.provider ?? null;
   if (!p)
     return null;
   if (verdict !== "VERIFIED" && verdict !== "ALREADY_SATISFIED")
@@ -11950,7 +12060,8 @@ async function crossReview(ctx, verdict, head) {
   if (!d || d.exitCode !== 0)
     return { provider: p, level: "not_run", notes: [`cross-review not run: diff unavailable for ${p}`] };
   const prompt = [
-    "You are an independent code reviewer. Review ONLY the diff below for correctness bugs, spec violations and missing tests. Do not modify files.",
+    agent ? `${agent.prompt}
+Review ONLY the diff below. Do not modify files.` : "You are an independent code reviewer. Review ONLY the diff below for correctness bugs, spec violations and missing tests. Do not modify files.",
     "Reply with a first line exactly `VERDICT: PASS`, `VERDICT: FLAG` (concerns) or `VERDICT: BLOCK` (a reproduced defect), then one `- reason` line per concern.",
     "",
     "```diff",
@@ -11959,7 +12070,7 @@ async function crossReview(ctx, verdict, head) {
   ].join(`
 `);
   try {
-    const r = await run(reviewArgv(p, prompt), { cwd: ctx.repoDir, timeoutMs: TIMEOUT_MS });
+    const r = await run(reviewArgv(p, prompt, process.env, p === "claude" ? agent?.model : undefined), { cwd: ctx.repoDir, timeoutMs: TIMEOUT_MS });
     if (r.exitCode !== 0)
       return { provider: p, level: "not_run", notes: [`cross-review not run: ${p} exited ${r.exitCode}`] };
     return parseReview(p, r.stdout);
@@ -11972,20 +12083,21 @@ var RANK2, TIMEOUT_MS = 300000, MAX_DIFF = 60000, MAX_NOTES = 5, asProvider = (v
   return s === "codex" || s === "claude" ? s : null;
 }, isOff = (v) => /^(off|none|false|0)$/i.test(v?.trim() ?? ""), xvendorDefault = (env = process.env) => /^(1|true|yes|on)$/i.test(env["LOKI_XVENDOR_DEFAULT"]?.trim() ?? ""), reviewCli = (p, env = process.env) => env[`LOKI_${p.toUpperCase()}_CLI`]?.trim() || p, clean3 = (s) => s.replace(/[\x00-\x1f\x7f`]+/g, " ").trim().slice(0, 300);
 var init_xreview = __esm(() => {
+  init_role_agents();
   init_shell();
   init_safe_git();
   RANK2 = { FAILED: 0, SPEC_CONFLICT: 0, PARTIAL: 1, ALREADY_SATISFIED: 2, VERIFIED: 2 };
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync28, lstatSync as lstatSync11, mkdirSync as mkdirSync15, readFileSync as readFileSync34, writeFileSync as writeFileSync16 } from "fs";
-import { join as join48 } from "path";
+import { existsSync as existsSync29, lstatSync as lstatSync11, mkdirSync as mkdirSync15, readFileSync as readFileSync35, writeFileSync as writeFileSync16 } from "fs";
+import { join as join49 } from "path";
 function loadRouteRecord(runDir) {
   try {
-    const p = join48(runDir, ROUTE_RECORD_FILE);
-    if (!existsSync28(p) || !lstatSync11(p).isFile())
+    const p = join49(runDir, ROUTE_RECORD_FILE);
+    if (!existsSync29(p) || !lstatSync11(p).isFile())
       return;
-    const v = JSON.parse(readFileSync34(p, "utf8"));
+    const v = JSON.parse(readFileSync35(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
   } catch {
     return;
@@ -11995,7 +12107,7 @@ var ROUTE_RECORD_FILE = "route.json";
 var init_route_record = () => {};
 
 // ../../loki-ts/src/runner/router/history_store.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync16, readFileSync as readFileSync35, renameSync as renameSync6, rmSync as rmSync12, writeFileSync as writeFileSync17 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync16, readFileSync as readFileSync36, renameSync as renameSync6, rmSync as rmSync12, writeFileSync as writeFileSync17 } from "fs";
 import { resolve as resolve11 } from "path";
 function validRun(v) {
   if (typeof v !== "object" || v === null)
@@ -12008,10 +12120,10 @@ function historyPath(key, cacheRoot) {
 }
 function readRunHistory(key, cacheRoot) {
   const path = historyPath(key, cacheRoot);
-  if (!existsSync29(path))
+  if (!existsSync30(path))
     return [];
   try {
-    const parsed = JSON.parse(readFileSync35(path, "utf8"));
+    const parsed = JSON.parse(readFileSync36(path, "utf8"));
     const runs2 = parsed?.runs;
     return Array.isArray(runs2) ? runs2.filter(validRun) : [];
   } catch {
@@ -12045,7 +12157,7 @@ var init_history_store = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/history.ts
-import { dirname as dirname21, join as join49, resolve as resolve12 } from "path";
+import { dirname as dirname21, join as join50, resolve as resolve12 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function shapeKey(model) {
   if (!model || model.status !== "ok")
@@ -12123,8 +12235,8 @@ var init_cost_preview = __esm(() => {
 });
 
 // ../../loki-ts/src/features/contract.ts
-import { existsSync as existsSync30, lstatSync as lstatSync12, mkdirSync as mkdirSync17, readFileSync as readFileSync36, writeFileSync as writeFileSync18 } from "fs";
-import { dirname as dirname22, join as join50 } from "path";
+import { existsSync as existsSync31, lstatSync as lstatSync12, mkdirSync as mkdirSync17, readFileSync as readFileSync37, writeFileSync as writeFileSync18 } from "fs";
+import { dirname as dirname22, join as join51 } from "path";
 import { createHash as createHash11 } from "crypto";
 function contractEnabled(env = process.env) {
   return env["LOKI_CONTRACT"] !== "0";
@@ -12156,7 +12268,7 @@ function untracedLines(trace) {
   return trace.criteria.filter((c) => c.status === "no_match").map((c) => `contract ${sanitizeCriterion(c.id)} untraced (no keyword match in changed files): ${sanitizeCriterion(c.text)}`);
 }
 function contractPath(repoDir) {
-  return join50(repoDir, ".loki", "contract.json");
+  return join51(repoDir, ".loki", "contract.json");
 }
 function readContract(repoDir) {
   const p = contractPath(repoDir);
@@ -12172,7 +12284,7 @@ function readContract(repoDir) {
     return { contract: null, notes: ["contract unreadable: too large"], sha256: null };
   let raw2;
   try {
-    raw2 = readFileSync36(p);
+    raw2 = readFileSync37(p);
   } catch {
     return { contract: null, notes: ["contract unreadable: read failed"], sha256: null };
   }
@@ -12241,8 +12353,8 @@ var init_contract = __esm(() => {
 });
 
 // ../../loki-ts/src/supply/supply_guard.ts
-import { existsSync as existsSync31, readFileSync as readFileSync37, statSync as statSync16 } from "fs";
-import { basename as basename17, join as join51 } from "path";
+import { existsSync as existsSync32, readFileSync as readFileSync38, statSync as statSync16 } from "fs";
+import { basename as basename17, join as join52 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
 }
@@ -12257,13 +12369,13 @@ function isManifestPath(path) {
   return MANIFESTS.test(basename17(path));
 }
 function readDeclared(repoDir) {
-  const p = join51(repoDir, ".loki", DECLARED_FILE);
-  if (!existsSync31(p))
+  const p = join52(repoDir, ".loki", DECLARED_FILE);
+  if (!existsSync32(p))
     return { deps: [], problem: null };
   try {
     if (statSync16(p).size > MAX_FILE_BYTES)
       return { deps: [], problem: "declaration file too large" };
-    const j = JSON.parse(readFileSync37(p, "utf8"));
+    const j = JSON.parse(readFileSync38(p, "utf8"));
     if (!Array.isArray(j))
       return { deps: [], problem: "declaration is not a JSON array" };
     const deps = [];
@@ -12283,11 +12395,11 @@ function readDeclared(repoDir) {
   }
 }
 function readAllowlist(repoDir) {
-  const p = join51(repoDir, ".loki", "supply-allowlist");
-  if (!existsSync31(p))
+  const p = join52(repoDir, ".loki", "supply-allowlist");
+  if (!existsSync32(p))
     return new Set;
   try {
-    return new Set(readFileSync37(p, "utf8").split(`
+    return new Set(readFileSync38(p, "utf8").split(`
 `).map((l) => l.replace(/#.*$/, "").trim()).filter(Boolean));
   } catch {
     return new Set;
@@ -12328,7 +12440,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "npm") {
     if (privateUrlList([env["npm_config_registry"] ?? "", env["NPM_CONFIG_REGISTRY"] ?? ""]))
       return true;
-    return files(join51(repoDir, ".npmrc"), home ? join51(home, ".npmrc") : "").some((t) => t.split(`
+    return files(join52(repoDir, ".npmrc"), home ? join52(home, ".npmrc") : "").some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:(@[^:\s]+):)?registry\s*=\s*(\S+)/.exec(l);
       return !!m && privateUrl(m[2]) && (m[1] === undefined || name.startsWith(`${m[1]}/`));
@@ -12337,7 +12449,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "pypi") {
     if (privateUrlList([env["PIP_INDEX_URL"] ?? "", env["PIP_EXTRA_INDEX_URL"] ?? ""]))
       return true;
-    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join51(home, ".config", "pip", "pip.conf") : "", home ? join51(home, ".pip", "pip.conf") : "", join51(repoDir, "pip.conf")];
+    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join52(home, ".config", "pip", "pip.conf") : "", home ? join52(home, ".pip", "pip.conf") : "", join52(repoDir, "pip.conf")];
     return files(...cfg).some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:extra-)?index-url\s*[=:]\s*(.+)$/.exec(l);
@@ -12347,7 +12459,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "cargo") {
     if (Object.keys(env).some((k) => /^CARGO_REGISTRIES_.+_INDEX$/.test(k) || /^CARGO_SOURCE_/.test(k)))
       return true;
-    return files(join51(repoDir, ".cargo", "config.toml"), join51(repoDir, ".cargo", "config"), home ? join51(home, ".cargo", "config.toml") : "", home ? join51(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
+    return files(join52(repoDir, ".cargo", "config.toml"), join52(repoDir, ".cargo", "config"), home ? join52(home, ".cargo", "config.toml") : "", home ? join52(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
   }
   if (eco === "go") {
     const gp = goEnv["GOPROXY"] ?? env["GOPROXY"] ?? "";
@@ -12470,7 +12582,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
   }
 }, PUBLIC_HOSTS, hostOf = (u) => u.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^www\./, "").split(/[/?#\s]/)[0].replace(/^[^@]*@/, "").replace(/:\d+$/, ""), privateUrl = (u) => /[a-z0-9]/i.test(u) && !PUBLIC_HOSTS.has(hostOf(u)), readSmall = (p) => {
   try {
-    return statSync16(p).size <= MAX_FILE_BYTES ? readFileSync37(p, "utf8") : "";
+    return statSync16(p).size <= MAX_FILE_BYTES ? readFileSync38(p, "utf8") : "";
   } catch {
     return "";
   }
@@ -12486,9 +12598,9 @@ var init_supply_guard = __esm(() => {
 
 // ../../loki-ts/src/engine10/stages/seal.ts
 import { createHash as createHash12, randomBytes as randomBytes4, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, sign } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync32, readdirSync as readdirSync15, linkSync, mkdirSync as mkdirSync18, readFileSync as readFileSync38, statSync as statSync17, unlinkSync as unlinkSync5, writeFileSync as writeFileSync19 } from "fs";
-import { homedir as homedir8 } from "os";
-import { basename as basename18, dirname as dirname23, isAbsolute as isAbsolute8, join as join52, relative as relative9 } from "path";
+import { chmodSync as chmodSync5, existsSync as existsSync33, readdirSync as readdirSync16, linkSync, mkdirSync as mkdirSync18, readFileSync as readFileSync39, statSync as statSync17, unlinkSync as unlinkSync5, writeFileSync as writeFileSync19 } from "fs";
+import { homedir as homedir9 } from "os";
+import { basename as basename18, dirname as dirname23, isAbsolute as isAbsolute8, join as join53, relative as relative9 } from "path";
 function sanitizeReason(s) {
   const collapsed = s.replace(/[\x00-\x1f\x7f]+/g, " ").trim();
   const capped = collapsed.length > 500 ? `${collapsed.slice(0, 500)}...` : collapsed;
@@ -12516,9 +12628,9 @@ function loadSigningKey(generate = true) {
     let pem = inline ?? "";
     if (!inline) {
       const given = process.env["LOKI_RECEIPT_SIGNING_KEY_FILE"]?.trim();
-      const file = given || join52(process.env["HOME"] || homedir8(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
+      const file = given || join53(process.env["HOME"] || homedir9(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
       try {
-        pem = readFileSync38(file);
+        pem = readFileSync39(file);
         if (!given) {
           for (const [f, m] of [[file, 384], [dirname23(file), 448]])
             if (statSync17(f).mode & 63)
@@ -12539,7 +12651,7 @@ function loadSigningKey(generate = true) {
         } finally {
           unlinkSync5(tmp);
         }
-        pem = readFileSync38(file);
+        pem = readFileSync39(file);
       }
     }
     const k = createPrivateKey(pem);
@@ -12621,7 +12733,7 @@ function renderReceiptMd(r) {
 `);
 }
 var DEEP_NOT_PROVEN, SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash12("sha256").update(s).digest("hex"), str3 = (v) => typeof v === "string" && v !== "" ? v : null, strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], b64u = (b) => Buffer.from(b).toString("base64url"), kidOf2 = (pub) => b64u(createHash12("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${pub.export({ format: "jwk" }).x}"}`).digest()), receiptRel = (ctx) => {
-  const r = relative9(ctx.repoDir, join52(ctx.runDir, "receipt.json"));
+  const r = relative9(ctx.repoDir, join53(ctx.runDir, "receipt.json"));
   return r.startsWith("..") || isAbsolute8(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, sealStage;
 var init_seal = __esm(() => {
@@ -12724,7 +12836,7 @@ var init_seal = __esm(() => {
       if (wallNotRun > 0) {
         try {
           const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename18(String(f.path))));
-          for (const n2 of readdirSync15(join52(ctx.runDir, "wall")).sort())
+          for (const n2 of readdirSync16(join53(ctx.runDir, "wall")).sort())
             if (!kept.has(n2))
               notProven.add(`wall test discarded: ${n2} (not_run)`);
         } catch {}
@@ -12783,19 +12895,19 @@ var init_seal = __esm(() => {
       for (const [s, d] of Object.entries(o))
         if (typeof d?.duration_s === "number")
           stages[s] = d.duration_s;
-      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join52(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
+      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join53(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
       const iterIds = Object.values(o).flatMap((d) => [...strs2(d?.iteration_ids), ...strs2([d?.iteration_id])]);
       if (iterIds.length === 0)
         notProven.add("cost not measured (no iteration ids recorded)");
       const cost = ctx.cost.read(ctx.repoDir, iterIds);
       if (cost.unmetered)
         notProven.add("cost unmetered (CLI invoker; recorded as 0)");
-      const eventsPath = join52(ctx.runDir, "events.jsonl");
+      const eventsPath = join53(ctx.runDir, "events.jsonl");
       const wallFiles = Array.isArray(o.wall?.files) ? o.wall.files : [];
       const wallPassed = typeof o.verify?.wall_passed === "boolean" ? o.verify.wall_passed : null;
       if (wallFiles.length > 0 && wallPassed === null)
         notProven.add("wall result not recorded by verify");
-      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join52(ctx.repoDir, ".loki"), iterIds).router : undefined), ctx.model);
+      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join53(ctx.repoDir, ".loki"), iterIds).router : undefined), ctx.model);
       if (routeBlock)
         for (const l of routeNotProven(routeBlock))
           notProven.add(l);
@@ -12837,7 +12949,7 @@ var init_seal = __esm(() => {
         provider: ctx.provider,
         model: ctx.model,
         resumed: o.intake?.resumed === true,
-        events_sha256: sha2562(existsSync32(eventsPath) ? readFileSync38(eventsPath) : ""),
+        events_sha256: sha2562(existsSync33(eventsPath) ? readFileSync39(eventsPath) : ""),
         ...await sealEvidence(ctx.repoDir, ctx.runDir, o, notProven, signal, ctx.emit),
         log_seal: true,
         ...receiptBlock(process.env, cost.usd, cost.unmetered === true, totalS),
@@ -12858,10 +12970,10 @@ var init_seal = __esm(() => {
       }
       const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
       mkdirSync18(ctx.runDir, { recursive: true });
-      const path = join52(ctx.runDir, "receipt.json");
+      const path = join53(ctx.runDir, "receipt.json");
       writeFileSync19(path, JSON.stringify(receipt, null, 2) + `
 `);
-      writeFileSync19(join52(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
+      writeFileSync19(join53(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
       recordRun(process.env, ctx.repoDir, ctx.model, verdict, cost.usd, cost.unmetered === true, totalS);
       const signed = sig.jwt !== null;
       const data = { receipt_path: path, receipt_sha256: hash, signed, kid: sig.kid, verdict, not_proven: receipt.not_proven, ...mp ? { mutation_line: mp.line } : {}, ...routeBlock ? { route_line: routePrLine(routeBlock) } : {} };
@@ -12876,7 +12988,7 @@ var init_seal = __esm(() => {
 
 // ../../loki-ts/src/features/receipt_dsse.ts
 import { createPublicKey as createPublicKey3, sign as sign2, verify as verify2 } from "crypto";
-import { readFileSync as readFileSync39 } from "fs";
+import { readFileSync as readFileSync40 } from "fs";
 function pae(payloadType, body) {
   const t = Buffer.from(payloadType, "utf8");
   return Buffer.concat([Buffer.from(`DSSEv1 ${t.length} `), t, Buffer.from(` ${body.length} `), body]);
@@ -12953,7 +13065,7 @@ function verifyDsseReceipt(env, d) {
 }
 function runIdGuard(receiptPath, runId) {
   try {
-    return envelopeRunIdProblem(JSON.parse(readFileSync39(receiptPath, "utf8")), runId);
+    return envelopeRunIdProblem(JSON.parse(readFileSync40(receiptPath, "utf8")), runId);
   } catch {
     return null;
   }
@@ -12967,8 +13079,8 @@ var init_keys_cmd = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
-import { existsSync as existsSync33, readdirSync as readdirSync16, readFileSync as readFileSync40, statSync as statSync18 } from "fs";
-import { dirname as dirname24, join as join53 } from "path";
+import { existsSync as existsSync34, readdirSync as readdirSync17, readFileSync as readFileSync41, statSync as statSync18 } from "fs";
+import { dirname as dirname24, join as join54 } from "path";
 import { createHash as createHash13, createPublicKey as createPublicKey4, verify as verify3 } from "crypto";
 function pubFor(kid, given) {
   if (given)
@@ -12976,7 +13088,7 @@ function pubFor(kid, given) {
   const active = loadSigningKey(false);
   const pubs = (process.env["LOKI_RECEIPT_RETIRED_PUBKEYS"] ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
     try {
-      return [createPublicKey4(readFileSync40(f))];
+      return [createPublicKey4(readFileSync41(f))];
     } catch {
       return [];
     }
@@ -13008,10 +13120,10 @@ function checkEventLog(receiptPath, receipt) {
   const bound = receipt["events_sha256"];
   if (typeof bound !== "string" || bound === createHash13("sha256").digest("hex"))
     return null;
-  const path = join53(dirname24(receiptPath), "events.jsonl");
-  if (!existsSync33(path))
+  const path = join54(dirname24(receiptPath), "events.jsonl");
+  if (!existsSync34(path))
     return "events.jsonl is missing";
-  const raw2 = readFileSync40(path, "utf8"), events2 = readEvents(path), lines = raw2.split(`
+  const raw2 = readFileSync41(path, "utf8"), events2 = readEvents(path), lines = raw2.split(`
 `).filter((l) => l.trim() !== "");
   if (events2.length !== lines.length || events2.some((e, i) => e.seq !== i))
     return "events.jsonl has a forged, edited or missing line";
@@ -13027,7 +13139,7 @@ function checkEventLog(receiptPath, receipt) {
   return h.digest("hex") === bound ? null : "events.jsonl does not match the hash recorded at seal";
 }
 function checkLogSeal(receiptPath, hash, kid, given) {
-  const path = join53(dirname24(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
+  const path = join54(dirname24(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
   if (!events2.some((e) => e.type === "receipt.sealed" && e.data["receipt_sha256"] === hash))
     return { verdict: "TAMPERED", reason: "events.jsonl has no receipt.sealed event for this receipt" };
   if (done < 0)
@@ -13035,7 +13147,7 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   const seal = events2[done + 1], d = seal?.type === "log.sealed" ? seal.data : null;
   if (!d)
     return { verdict: "TAMPERED", reason: "events.jsonl has no signed log.sealed line after run.completed" };
-  const lines = readFileSync40(path, "utf8").split(`
+  const lines = readFileSync41(path, "utf8").split(`
 `).filter((l) => l.trim() !== ""), sha3 = createHash13("sha256").update(lines.slice(0, done + 1).join(`
 `) + `
 `).digest("hex");
@@ -13045,11 +13157,11 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   return null;
 }
 async function verifyReceipt(receiptPath, deps = {}) {
-  if (!existsSync33(receiptPath))
+  if (!existsSync34(receiptPath))
     return { verdict: "UNCHECKED", reasons: [`receipt not found: ${receiptPath}`] };
   let receipt;
   try {
-    receipt = JSON.parse((deps.read ?? ((p) => readFileSync40(p, "utf8")))(receiptPath));
+    receipt = JSON.parse((deps.read ?? ((p) => readFileSync41(p, "utf8")))(receiptPath));
   } catch {
     return { verdict: "UNCHECKED", reasons: ["receipt.json is not valid JSON"] };
   }
@@ -13104,8 +13216,8 @@ var init_verify_cmd = __esm(() => {
 });
 
 // src/server/app.ts
-import { existsSync as existsSync35, readFileSync as readFileSync43, statSync as statSync19 } from "fs";
-import { join as join56, resolve as resolve13, sep as sep14 } from "path";
+import { existsSync as existsSync36, readFileSync as readFileSync44, statSync as statSync19 } from "fs";
+import { join as join57, resolve as resolve13, sep as sep14 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -23352,9 +23464,9 @@ function mount20(ctx) {
 }
 
 // src/server/routes/verify.ts
-import { readFileSync as readFileSync41, realpathSync as realpathSync20 } from "fs";
+import { readFileSync as readFileSync42, realpathSync as realpathSync20 } from "fs";
 import { createPublicKey as createPublicKey5 } from "crypto";
-import { join as join54, sep as sep13 } from "path";
+import { join as join55, sep as sep13 } from "path";
 init_verify_cmd();
 init_seal();
 init_receipt_dsse();
@@ -23381,11 +23493,11 @@ function mount21(ctx) {
       return done(404, "receipt not available", "not_found");
     let runDir, file;
     try {
-      const root = realpathSync20(join54(repo.p, ".loki", "runs"));
-      runDir = realpathSync20(join54(root, run2));
-      if (runDir !== join54(root, run2))
+      const root = realpathSync20(join55(repo.p, ".loki", "runs"));
+      runDir = realpathSync20(join55(root, run2));
+      if (runDir !== join55(root, run2))
         return done(404, "receipt not found", "not_found");
-      file = realpathSync20(join54(runDir, "receipt.json"));
+      file = realpathSync20(join55(runDir, "receipt.json"));
     } catch {
       return done(404, "receipt not found", "not_found");
     }
@@ -23404,7 +23516,7 @@ function mount21(ctx) {
         sha3 = r.receiptSha256 ?? null;
       }
       try {
-        outcome = outcomeOf(JSON.parse(readFileSync41(file, "utf8")));
+        outcome = outcomeOf(JSON.parse(readFileSync42(file, "utf8")));
       } catch {
         outcome = "UNREADABLE";
       }
@@ -23466,8 +23578,8 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now2 = Date.now) {
 }
 
 // src/server/legacy/shim.ts
-import { existsSync as existsSync34, readFileSync as readFileSync42 } from "fs";
-import { join as join55 } from "path";
+import { existsSync as existsSync35, readFileSync as readFileSync43 } from "fs";
+import { join as join56 } from "path";
 
 // src/server/legacy/routes.ts
 var LEGACY_ROUTES = [
@@ -23839,10 +23951,10 @@ var logged = new Set;
 var toHono = (p) => p.replace(/\{([A-Za-z_]+):path\}/g, ":$1{.+}").replace(/\{([A-Za-z_]+)\}/g, ":$1");
 var NOT_SUPPORTED = "not yet supported by the Control Plane";
 var repoVersion = () => {
-  for (const f of [join55(import.meta.dir, "../../../../../VERSION")]) {
+  for (const f of [join56(import.meta.dir, "../../../../../VERSION")]) {
     try {
-      if (existsSync34(f))
-        return readFileSync42(f, "utf8").trim();
+      if (existsSync35(f))
+        return readFileSync43(f, "utf8").trim();
     } catch {}
   }
   return "unknown";
@@ -24024,7 +24136,7 @@ function legacyShim(opts) {
 
 // src/server/app.ts
 var MAX_BODY2 = 1e6;
-var defaultUiDir = () => [join56(import.meta.dir, "../../ui/dist"), join56(import.meta.dir, "../ui/dist")].find((d) => existsSync35(join56(d, "index.html")));
+var defaultUiDir = () => [join57(import.meta.dir, "../../ui/dist"), join57(import.meta.dir, "../ui/dist")].find((d) => existsSync36(join57(d, "index.html")));
 function createApp(opts) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
@@ -24053,10 +24165,10 @@ function createApp(opts) {
     await next();
   });
   const readInstalled = () => {
-    for (const f of [process.env.LOKI_VERSION_FILE, join56(import.meta.dir, "../../../../VERSION")]) {
+    for (const f of [process.env.LOKI_VERSION_FILE, join57(import.meta.dir, "../../../../VERSION")]) {
       try {
         if (f)
-          return readFileSync43(f, "utf8").trim() || "unknown";
+          return readFileSync44(f, "utf8").trim() || "unknown";
       } catch {}
     }
     return "unknown";
@@ -24167,11 +24279,11 @@ function createApp(opts) {
       return c.json({ error: "not found" }, 404);
     const root = resolve13(uiDir);
     const f = resolve13(root, `.${p}`);
-    if (f.startsWith(root + sep14) && existsSync35(f) && statSync19(f).isFile())
+    if (f.startsWith(root + sep14) && existsSync36(f) && statSync19(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))
       return c.json({ error: "not found" }, 404);
-    return new Response(Bun.file(join56(root, "index.html")));
+    return new Response(Bun.file(join57(root, "index.html")));
   });
   return { app, db, close: () => {
     clearInterval(reconciler);