loki-mode 11.6.0 → 11.8.1

package/autonomy/trigger-server.py

@@ -26,6 +26,12 @@ GitHub, the bearer token authenticates a human operator -- so holding one must
 never grant the other. If no API token is configured the server still starts but
 every /jobs request is rejected with 503 and an audit log line.
 
+Self-healing entry point: POST /sentry accepts a Sentry integration webhook
+authenticated by Sentry's own HMAC (sentry-hook-signature) under a THIRD,
+separate secret (LOKI_SENTRY_WEBHOOK_SECRET or SENTRY_CLIENT_SECRET). A valid
+alert enqueues `loki start "<normalized brief>" --pr --detach`: the output is a
+receipt-gated PR only, never a deploy. No secret means the route answers 503.
+
 Usage:
     python3 autonomy/trigger-server.py [--port PORT] [--secret SECRET] [--dry-run]
                                        [--workers N] [--queue-size N]
@@ -49,8 +55,10 @@ import subprocess
 import sys
 import threading
 import time
+import urllib.parse
 from datetime import datetime
 from pathlib import Path
+from urllib.request import Request, urlopen
 
 # Receipt attestation. Imported by path because trigger-server.py runs as a
 # script from an arbitrary cwd, so a bare `import receipt_jwt` would depend on
@@ -398,6 +406,25 @@ OUTCOME_FAILED = JOB_STATUS_FAILED    # launch failed, or exited non-zero
 OUTCOME_UNKNOWN = JOB_STATUS_UNKNOWN  # detached; exit code never observed
 
 
+# Secrets this server holds that a spawned `loki start` must never inherit: a
+# prompt-injected run could otherwise forge /sentry, /webhook or /jobs requests.
+CHILD_ENV_DENYLIST = (
+    "GITHUB_WEBHOOK_SECRET",
+    "LOKI_API_TOKEN",
+    "LOKI_API_TOKEN_FILE",
+    "LOKI_SENTRY_WEBHOOK_SECRET",
+    "SENTRY_CLIENT_SECRET",
+    "SLACK_SIGNING_SECRET",
+    "SLACK_BOT_TOKEN",
+    "LINEAR_WEBHOOK_SECRET",
+    "LINEAR_API_KEY",
+)
+
+
+def _scoped_child_env():
+    return {k: v for k, v in os.environ.items() if k not in CHILD_ENV_DENYLIST}
+
+
 def run_loki_outcome(args, dry_run=False):
     """Run a loki command and report WHICH of the three outcomes occurred.
 
@@ -414,6 +441,7 @@ def run_loki_outcome(args, dry_run=False):
             cmd,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
+            env=_scoped_child_env(),
         )
     except (FileNotFoundError, OSError) as e:
         logging.error("Failed to launch %s: %s", " ".join(cmd), e)
@@ -577,6 +605,208 @@ def handle_job_event(payload, dry_run=False):
     return summary, status
 
 
+# Pseudo-event for a Sentry alert. Like JOB_EVENT it is NOT a GitHub event and is
+# refused on /webhook: only /sentry, under its own HMAC secret, may enqueue it.
+SENTRY_EVENT = "sentry_issue"
+INTERNAL_EVENTS = (JOB_EVENT, SENTRY_EVENT)
+
+# Sentry actions that mean "a new problem needs a fix". resolved/assigned/etc.
+# are skipped so a state change never starts a build.
+SENTRY_ACTIONS = ("triggered", "created")
+SENTRY_BRIEF_MAX = 1500
+ISSUE_PROVIDERS_SH = Path(__file__).resolve().parent / "issue-providers.sh"
+
+
+def validate_sentry_signature(secret, body, signature_header):
+    """Validate Sentry's `sentry-hook-signature` (hex HMAC-SHA256, no prefix).
+
+    Fails closed: no secret or no header is never valid.
+    """
+    if not secret or not signature_header:
+        return False
+    expected = hmac.new(secret.encode("utf-8"), body, hashlib.sha256).hexdigest()
+    return constant_time_equals(expected, signature_header.strip().lower())
+
+
+# Slack and Linear delegation. Same signed-body contract as
+# loki-ts/src/contrib/slack_inbound.ts (signSlackBody/verifySlackSignature).
+SIGNATURE_MAX_SKEW_S = 300
+SLACK_REPLY_PREFIX = "https://hooks.slack.com/"
+LINEAR_API_URL = "https://api.linear.app/graphql"
+LINEAR_IDENTIFIER_RE = re.compile(r"^[A-Za-z][A-Za-z0-9]*-\d+$")
+NOTIFY_TIMEOUT_SECONDS = 10
+NOTIFY_TEXT_MAX = 1000
+
+
+def sign_slack_body(secret, timestamp, body):
+    """`v0=` + hex HMAC-SHA256 over `v0:<timestamp>:<raw body>` (bytes)."""
+    base = b"v0:" + str(timestamp).encode("utf-8") + b":" + body
+    return "v0=" + hmac.new(secret.encode("utf-8"), base, hashlib.sha256).hexdigest()
+
+
+def verify_slack_signature(secret, timestamp, body, signature, now=None):
+    """Fail closed: no secret, header, numeric timestamp or fresh window -> False."""
+    if not secret or not timestamp or not signature:
+        return False
+    if not re.fullmatch(r"[0-9]+", timestamp):
+        return False
+    now = time.time() if now is None else now
+    if abs(now - int(timestamp)) > SIGNATURE_MAX_SKEW_S:
+        return False
+    return constant_time_equals(sign_slack_body(secret, timestamp, body), signature)
+
+
+def verify_linear_signature(secret, body, signature):
+    """Linear-Signature: hex HMAC-SHA256 of the raw body. Freshness is checked
+    separately against the signed body's webhookTimestamp (linear_fresh)."""
+    if not secret or not signature:
+        return False
+    expected = hmac.new(secret.encode("utf-8"), body, hashlib.sha256).hexdigest()
+    return constant_time_equals(expected, signature.strip().lower())
+
+
+def linear_fresh(payload, now=None):
+    ts_val = payload.get("webhookTimestamp")
+    if isinstance(ts_val, bool) or not isinstance(ts_val, (int, float)):
+        return False
+    secs = ts_val / 1000.0 if ts_val > 1e11 else float(ts_val)
+    now = time.time() if now is None else now
+    return abs(now - secs) <= SIGNATURE_MAX_SKEW_S
+
+
+def resolve_chat_secrets(env, secret, api_token, sentry_secret):
+    """Return (slack_secret, linear_secret), blanking any that equals another
+    credential: each authenticates a different party and MUST differ."""
+    slack = env.get("SLACK_SIGNING_SECRET", "")
+    linear = env.get("LINEAR_WEBHOOK_SECRET", "")
+    others = [x for x in (secret, api_token, sentry_secret) if x]
+    slack_bad = bool(slack) and any(
+        constant_time_equals(slack, o) for o in others + ([linear] if linear else []))
+    linear_bad = bool(linear) and any(
+        constant_time_equals(linear, o) for o in others + ([slack] if slack else []))
+    if slack_bad:
+        logging.error("The Slack secret is identical to another credential. "
+                      "They MUST differ; disabling /slack.")
+    if linear_bad:
+        logging.error("The Linear secret is identical to another credential. "
+                      "They MUST differ; disabling /linear.")
+    return ("" if slack_bad else slack), ("" if linear_bad else linear)
+
+
+def _post_json(url, data, headers):
+    """POST JSON with a bounded timeout. Raises on any failure; callers log."""
+    req = Request(url, data=json.dumps(data).encode("utf-8"),
+                  headers=dict(headers, **{"Content-Type": "application/json"}),
+                  method="POST")
+    with urlopen(req, timeout=NOTIFY_TIMEOUT_SECONDS) as resp:
+        resp.read()
+
+
+def notify_job_complete(target, job_id, status, summary):
+    """Send a completion summary to a reply target captured after verification.
+
+    Never raises: a notifier failure must not fail the job. The Slack URL is
+    re-checked here as defense in depth.
+    """
+    if not isinstance(target, dict):
+        return
+    text = ("loki job %s finished: %s. %s" % (job_id, status, summary or "")).strip()
+    text = CONTROL_CHARS_RE.sub(" ", text)[:NOTIFY_TEXT_MAX]
+    try:
+        if target.get("kind") == "slack":
+            url = target.get("response_url", "")
+            if not (isinstance(url, str) and url.startswith(SLACK_REPLY_PREFIX)):
+                return
+            _post_json(url, {"response_type": "in_channel", "text": text}, {})
+        elif target.get("kind") == "linear":
+            key = os.environ.get("LINEAR_API_KEY", "")
+            issue_id = target.get("issue_id", "")
+            if not key or not isinstance(issue_id, str) or not issue_id:
+                return
+            _post_json(LINEAR_API_URL, {
+                "query": "mutation($i:String!,$b:String!){commentCreate(input:"
+                         "{issueId:$i,body:$b}){success}}",
+                "variables": {"i": issue_id, "b": text},
+            }, {"Authorization": key})
+    except Exception as e:  # notifier errors never fail a job
+        logging.warning("Completion notify for job %s failed: %s", job_id, e)
+
+
+def normalize_sentry_payload(payload):
+    """Run the existing normalize_sentry_json over a Sentry webhook payload.
+
+    Reuses autonomy/issue-providers.sh (single owner of the Sentry shape) via a
+    scoped-env bash call. Returns the normalized dict or None.
+    """
+    data = payload.get("data")
+    if not isinstance(data, dict):
+        return None
+    raw = {k: data[k] for k in ("issue", "event") if isinstance(data.get(k), dict)}
+    if not raw:
+        return None
+    env = {"PATH": os.environ.get("PATH", "/usr/bin:/bin")}
+    ev = raw.get("event") or {}
+    env["_LOKI_SENTRY_URL"] = str(ev.get("web_url") or ev.get("url") or "")
+    try:
+        proc = subprocess.run(
+            ["bash", "-c", 'source "$1" && normalize_sentry_json', "_",
+             str(ISSUE_PROVIDERS_SH)],
+            input=json.dumps(raw).encode("utf-8"), capture_output=True,
+            env=env, timeout=20,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if proc.returncode != 0:
+        return None
+    try:
+        out = json.loads(proc.stdout.decode("utf-8", errors="replace").strip().splitlines()[-1])
+    except (ValueError, IndexError):
+        return None
+    return out if isinstance(out, dict) else None
+
+
+def build_sentry_brief(norm):
+    """One-line, control-char-free brief that can never parse as a CLI flag."""
+    culprit = ""
+    for line in str(norm.get("body", "")).splitlines():
+        if line.startswith("- Culprit: "):
+            culprit = line[len("- Culprit: "):].strip()
+            break
+    parts = ["Fix Sentry issue %s: %s" % (norm.get("number", "?"), norm.get("title", ""))]
+    if culprit:
+        parts.append("(culprit %s)" % culprit)
+    if norm.get("url"):
+        parts.append("See %s." % norm["url"])
+    parts.append("Reproduce with a regression test, then fix the root cause.")
+    brief = CONTROL_CHARS_RE.sub(" ", " ".join(parts))
+    brief = " ".join(brief.split())
+    return brief.encode("utf-8")[:SENTRY_BRIEF_MAX].decode("utf-8", errors="ignore")
+
+
+def handle_sentry_event(payload, dry_run=False):
+    """Handle a verified Sentry alert: loki start <brief> --pr --detach.
+
+    PR only. Never passes a deploy argument: a fix still has to earn a VERIFIED
+    receipt, and shipping it stays a separate, gated human step.
+    """
+    action = payload.get("action", "")
+    if action not in SENTRY_ACTIONS:
+        return None, "skipped (action=%s)" % action
+    norm = normalize_sentry_payload(payload)
+    if norm is None:
+        return None, "rejected (unparseable sentry payload)"
+    brief = build_sentry_brief(norm)
+    if not valid_spec(brief):
+        return None, "rejected (invalid brief)"
+    args = ["start", brief, "--pr", "--detach"]
+    summary = "sentry issue %s" % norm.get("number", "?")
+    success = run_loki_command(args, dry_run=dry_run)
+    status = "fired" if success else "error"
+    if success:
+        send_notification("Trigger fired: %s" % summary)
+    return summary, status
+
+
 # Map event name -> handler. Keeps do_POST routing declarative. JOB_EVENT rides
 # the same table (and therefore the same bounded queue and worker pool) but is
 # explicitly refused on the /webhook path.
@@ -585,6 +815,7 @@ EVENT_HANDLERS = {
     "pull_request": handle_pull_request_event,
     "workflow_run": handle_workflow_run_event,
     JOB_EVENT: handle_job_event,
+    SENTRY_EVENT: handle_sentry_event,
 }
 
 
@@ -629,6 +860,9 @@ class Dispatcher:
         self._job_max = max(1, job_history)
         self._jobs = collections.OrderedDict()
         self._jobs_lock = threading.Lock()
+        # Reply targets (Slack response_url / Linear issue) keyed by job_id,
+        # written only by the verified /slack and /linear handlers.
+        self._reply_targets = collections.OrderedDict()
         # Proof-attribution bookkeeping. The proof pointer is global to the
         # working directory, so a receipt only identifies a job when that job
         # was the only build that could have written it. All three are updated
@@ -766,6 +1000,17 @@ class Dispatcher:
             if summary:
                 entry["summary"] = summary
 
+    def set_reply_target(self, job_id, target):
+        """Store a verified reply target server side, bounded like _jobs."""
+        with self._jobs_lock:
+            self._reply_targets[job_id] = target
+            while len(self._reply_targets) > self._job_max:
+                self._reply_targets.popitem(last=False)
+
+    def pop_reply_target(self, job_id):
+        with self._jobs_lock:
+            return self._reply_targets.pop(job_id, None)
+
     def get_job(self, job_id):
         """Return a copy of the job record, or None if unknown/evicted.
 
@@ -859,6 +1104,9 @@ class Dispatcher:
                 )
                 if job_id:
                     self.record_job(job_id, status, summary or "")
+                    target = self.pop_reply_target(job_id)
+                    if target is not None:
+                        notify_job_complete(target, job_id, status, summary)
             finally:
                 self.queue.task_done()
 
@@ -875,6 +1123,12 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
     # Bearer token for the /jobs API. MUST be a different secret from `secret`
     # above: one authenticates GitHub, the other authenticates a human.
     api_token = ""
+    # Sentry integration client secret for /sentry. Distinct from both above.
+    sentry_secret = ""
+    # Slack signing secret (/slack) and Linear webhook secret (/linear), each
+    # distinct from every other credential.
+    slack_secret = ""
+    linear_secret = ""
     dispatcher = None
     # Ed25519 key that attests receipts, and the retired public keys that keep
     # pre-rotation receipts verifiable. Both default to unconfigured, which
@@ -1155,8 +1409,19 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
             self._send_json(400, {"error": "invalid spec"})
             return
 
+        job_id = self._enqueue_job(spec.strip())
+        if job_id is None:
+            return
+        self._send_json(202, {"id": job_id, "status": "queued"})
+
+    def _enqueue_job(self, spec, reply_target=None):
+        """Record and enqueue one validated job; shared by /jobs, /slack, /linear.
+
+        Returns the job id, or None after sending 429 when the queue is full.
+        reply_target must come from an already-verified request.
+        """
         job_id = secrets.token_urlsafe(12)
-        job = {"spec": spec.strip(), "job_id": job_id}
+        job = {"spec": spec, "job_id": job_id}
 
         # Record BEFORE enqueueing. A worker can pick the job up the instant
         # submit() returns and write "running"/"fired"; record_job is
@@ -1165,6 +1430,8 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
         # forever. On the 429 path below the record is unreachable (no id is
         # handed out) and the store is bounded, so nothing leaks.
         self.dispatcher.record_job(job_id, "queued", job["spec"])
+        if reply_target is not None:
+            self.dispatcher.set_reply_target(job_id, reply_target)
 
         # Enforce the existing queue bound so a submit storm cannot fork
         # unbounded builds. 429 (not a silent drop) tells the client to retry.
@@ -1172,18 +1439,164 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
             logging.warning(
                 "Queue full; shedding job submit from %s", self.address_string()
             )
+            self.dispatcher.pop_reply_target(job_id)
             log_event(JOB_EVENT, "", "", "rejected (queue full)")
             self._send_json(429, {"error": "server busy, retry later"})
-            return
+            return None
 
         log_event(JOB_EVENT, "", job["spec"], "queued")
+        return job_id
+
+    def _handle_slack(self):
+        """POST /slack -- signed slash command; enqueues a job, ephemeral reply."""
+        body = self._read_body()
+        if body is None:
+            return
+        if not self.slack_secret:
+            log_event(JOB_EVENT, "", "", "rejected (no slack signing secret configured)")
+            self._send_json(503, {"error": "SLACK_SIGNING_SECRET not configured"})
+            return
+        if not verify_slack_signature(
+                self.slack_secret,
+                self.headers.get("X-Slack-Request-Timestamp", ""),
+                body, self.headers.get("X-Slack-Signature", "")):
+            logging.warning("Invalid Slack signature from %s", self.address_string())
+            log_event(JOB_EVENT, "", "", "rejected (invalid slack signature)")
+            self._send_json(401, {"error": "invalid signature"})
+            return
+        # Verified from here on.
+        ctype = (self.headers.get("Content-Type", "") or "").lower()
+        if "json" in ctype:
+            try:
+                data = json.loads(body)
+            except ValueError:
+                self._send_json(400, {"error": "invalid JSON"})
+                return
+            if isinstance(data, dict) and data.get("type") == "url_verification":
+                self._send_json(200, {"challenge": str(data.get("challenge", ""))})
+                return
+            self._send_json(400, {"error": "unsupported slack payload"})
+            return
+        form = urllib.parse.parse_qs(body.decode("utf-8", errors="replace"))
+        text = (form.get("text") or [""])[0]
+        if not valid_spec(text):
+            log_event(JOB_EVENT, "", "", "rejected (invalid slack spec)")
+            self._send_json(200, {"response_type": "ephemeral",
+                                  "text": "Usage: /loki <spec>. Spec must be a "
+                                          "one-line brief or ref, not starting with '-'."})
+            return
+        response_url = (form.get("response_url") or [""])[0]
+        target = {"kind": "slack"}
+        if response_url.startswith(SLACK_REPLY_PREFIX):
+            target["response_url"] = response_url
+        job_id = self._enqueue_job(text.strip(), target)
+        if job_id is None:
+            return
+        self._send_json(200, {"response_type": "ephemeral",
+                              "text": "Queued loki job %s" % job_id})
+
+    def _handle_linear(self):
+        """POST /linear -- signed Linear issue webhook; enqueues linear:<identifier>."""
+        body = self._read_body()
+        if body is None:
+            return
+        if not self.linear_secret:
+            log_event(JOB_EVENT, "", "", "rejected (no linear webhook secret configured)")
+            self._send_json(503, {"error": "LINEAR_WEBHOOK_SECRET not configured"})
+            return
+        if not verify_linear_signature(
+                self.linear_secret, body, self.headers.get("Linear-Signature", "")):
+            logging.warning("Invalid Linear signature from %s", self.address_string())
+            log_event(JOB_EVENT, "", "", "rejected (invalid linear signature)")
+            self._send_json(401, {"error": "invalid signature"})
+            return
+        try:
+            payload = json.loads(body)
+        except ValueError:
+            self._send_json(400, {"error": "invalid JSON"})
+            return
+        if not isinstance(payload, dict):
+            self._send_json(400, {"error": "payload must be a JSON object"})
+            return
+        if not linear_fresh(payload):
+            log_event(JOB_EVENT, "", "", "rejected (stale linear timestamp)")
+            self._send_json(401, {"error": "stale or missing webhookTimestamp"})
+            return
+        data = payload.get("data")
+        if (payload.get("type") != "Issue" or payload.get("action") != "create"
+                or not isinstance(data, dict)):
+            self._send_json(200, {"status": "skipped"})
+            return
+        ident = data.get("identifier")
+        if not isinstance(ident, str) or not LINEAR_IDENTIFIER_RE.match(ident):
+            self._send_json(400, {"error": "invalid issue identifier"})
+            return
+        if self.dispatcher.seen_delivery(self.headers.get("Linear-Delivery", "")):
+            self._send_json(200, {"status": "duplicate"})
+            return
+        spec = "linear:%s" % ident
+        if not valid_spec(spec):
+            self._send_json(400, {"error": "invalid spec"})
+            return
+        issue_id = data.get("id")
+        target = {"kind": "linear",
+                  "issue_id": issue_id if isinstance(issue_id, str) else ""}
+        job_id = self._enqueue_job(spec, target)
+        if job_id is None:
+            return
         self._send_json(202, {"id": job_id, "status": "queued"})
 
+    def _handle_sentry(self):
+        """POST /sentry -- Sentry alert, HMAC-verified, enqueues a fix run."""
+        body = self._read_body()
+        if body is None:
+            return
+        event_type = SENTRY_EVENT
+        if not self.sentry_secret:
+            logging.warning("Rejecting /sentry from %s: no Sentry secret configured",
+                            self.address_string())
+            log_event(event_type, "", "", "rejected (no sentry secret configured)")
+            self._send_json(503, {"error": "sentry webhook secret not configured"})
+            return
+        sig = self.headers.get("sentry-hook-signature", "")
+        if not validate_sentry_signature(self.sentry_secret, body, sig):
+            logging.warning("Invalid Sentry signature from %s", self.address_string())
+            log_event(event_type, "", "", "rejected (invalid signature)")
+            self._send_json(401, {"error": "invalid signature"})
+            return
+        try:
+            payload = json.loads(body)
+        except json.JSONDecodeError:
+            self._send_json(400, {"error": "invalid JSON"})
+            return
+        if not isinstance(payload, dict):
+            self._send_json(400, {"error": "payload must be a JSON object"})
+            return
+        action = payload.get("action", "")
+        if self.dispatcher.seen_delivery(self.headers.get("Request-ID", "")):
+            log_event(event_type, action, "", "duplicate")
+            self._send_json(200, {"event": event_type, "status": "duplicate"})
+            return
+        if not self.dispatcher.submit(event_type, payload):
+            log_event(event_type, action, "", "rejected (queue full)")
+            self._send_json(503, {"error": "server busy, retry later"})
+            return
+        self._send_json(202, {"event": event_type, "action": action, "status": "queued"})
+
     def do_POST(self):
         path = self.path.split("?", 1)[0]
         if path == "/jobs":
             self._handle_job_submit()
             return
+        if path == "/sentry":
+            self._handle_sentry()
+            return
+        if path == "/slack":
+            self._handle_slack()
+            return
+        if path == "/linear":
+            self._handle_linear()
+            return
         if path != "/webhook":
             self._send_json(404, {"error": "not found"})
             return
@@ -1201,10 +1614,10 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
         # never be reachable with the webhook HMAC. Without this, a holder of
         # the webhook secret could POST X-GitHub-Event: loki_job and submit an
         # arbitrary spec, defeating the separate-credential requirement.
-        if event_type == JOB_EVENT:
+        if event_type in INTERNAL_EVENTS:
             logging.warning(
                 "Rejecting %s on /webhook from %s: submits require the /jobs "
-                "API and its own bearer token",
+                "API and its own bearer token (Sentry uses /sentry)",
                 JOB_EVENT,
                 self.address_string(),
             )
@@ -1350,6 +1763,25 @@ def main():
         )
         api_token = ""
 
+    # Sentry secret: env only (never argv). Must differ from the other two
+    # credentials, since each authenticates a different party.
+    sentry_secret = (os.environ.get("LOKI_SENTRY_WEBHOOK_SECRET")
+                     or os.environ.get("SENTRY_CLIENT_SECRET") or "")
+    if sentry_secret and (
+        (secret and constant_time_equals(sentry_secret, secret))
+        or (api_token and constant_time_equals(sentry_secret, api_token))
+    ):
+        logging.error(
+            "The Sentry secret is identical to the webhook secret or API "
+            "token. They MUST differ; disabling /sentry."
+        )
+        sentry_secret = ""
+
+    # Slack/Linear secrets: env only. Each must differ from every other
+    # credential, since each authenticates a different party.
+    slack_secret, linear_secret = resolve_chat_secrets(
+        os.environ, secret, api_token, sentry_secret)
+
     # Persist resolved values, but never write the secret to disk.
     config["port"] = port
     config["dry_run"] = dry_run
@@ -1363,6 +1795,9 @@ def main():
     WebhookHandler.dry_run = dry_run
     WebhookHandler.secret = secret
     WebhookHandler.api_token = api_token
+    WebhookHandler.sentry_secret = sentry_secret
+    WebhookHandler.slack_secret = slack_secret
+    WebhookHandler.linear_secret = linear_secret
     WebhookHandler.dispatcher = dispatcher
 
     signing_key, signing_kid = load_signing_key(auto_generate=False)
@@ -1404,6 +1839,21 @@ def main():
             "503. Set LOKI_API_TOKEN or LOKI_API_TOKEN_FILE to enable remote "
             "submits."
         )
+    if not sentry_secret:
+        logging.warning(
+            "No Sentry secret configured: POST /sentry is rejected with 503. "
+            "Set LOKI_SENTRY_WEBHOOK_SECRET or SENTRY_CLIENT_SECRET."
+        )
+    if not slack_secret:
+        logging.warning(
+            "No Slack signing secret configured: POST /slack is rejected with "
+            "503. Set SLACK_SIGNING_SECRET."
+        )
+    if not linear_secret:
+        logging.warning(
+            "No Linear webhook secret configured: POST /linear is rejected with "
+            "503. Set LINEAR_WEBHOOK_SECRET."
+        )
     if not secret:
         logging.warning(
             "No webhook secret configured: ALL webhooks will be rejected with "

package/autonomy/verify.sh

@@ -2584,6 +2584,15 @@ OPTIONS:
                        is exactly as without --hosted (fail-open, never a silent
                        pass). Without --hosted, output is byte-identical to prior
                        releases.
+    --seal-composite <run-dir>
+                       Seal a workspace run into one signed composite receipt
+                       (composite.json). `loki verify <composite.json>` then
+                       re-checks it offline. Routed to the engine10 verifier.
+    --max-age <DUR>    With a receipt path: refuse a receipt whose signed issue
+                       time is older than DUR (Ns, Nm, Nh, Nd or seconds), has
+                       no signed issue time, or is more than 300s in the
+                       future. Exits 2 (UNCHECKED). Routed to the engine10
+                       verifier.
     -h, --help         Show this help.
 
 GATES (deterministic, reproducible by construction):

package/completions/_loki

@@ -313,6 +313,10 @@ function _loki_start {
     _arguments \
         '--provider[AI provider]:provider name:(claude cline codex aider opencode)' \
         '--parallel[Parallel mode]' \
+        '--workspace[Run a loki.yaml workspace for the brief]:workspace name:' \
+        '--deploy[Deploy after a VERIFIED run via loki deploy --execute]' \
+        '--health-url[With --deploy: health probe URL]:url:' \
+        '--auto-rollback[With --deploy: roll back on a failed health probe]' \
         '--background[Background mode]' \
         '--bg[Background mode]' \
         '--simple[Force simple complexity]' \

package/completions/loki.bash

@@ -27,7 +27,7 @@ _loki_completion() {
 
             # If the word starts with a dash, show flags
             if [[ "$cur" == -* ]]; then
-                local flags="--provider --max-iterations --parallel --background --bg --simple --complex --github --no-dashboard --sandbox --skip-memory --spec --spec-first --yes --budget --attempts --model --isolation --max-cost --no-pr --explain-route --help"
+                local flags="--provider --max-iterations --parallel --background --bg --simple --complex --github --no-dashboard --sandbox --skip-memory --spec --spec-first --yes --budget --attempts --model --isolation --max-cost --no-pr --explain-route --workspace --deploy --health-url --auto-rollback --help"
                 COMPREPLY=( $(compgen -W "${flags}" -- "$cur") )
                 return 0
             fi
@@ -57,7 +57,11 @@ _loki_completion() {
             ;;
 
         memory)
-            local memory_cmds="list show search stats export clear dedupe index timeline consolidate economics retrieve lessons learn forget episode pattern skill vectors help"
+            local memory_cmds="list show search stats export clear dedupe index timeline consolidate economics retrieve lessons learn forget episode pattern skill vectors brief help"
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--task --help" -- "$cur") )
+                return 0
+            fi
             COMPREPLY=( $(compgen -W "${memory_cmds}" -- "$cur") )
             ;;
 
@@ -136,6 +140,20 @@ _loki_completion() {
             fi
             ;;
 
+        deploy)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--execute --health-url --auto-rollback --dir --no-clip --allow-unanchored --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
+        verify)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--base --out --block-on --no-llm --json --explain --check-fresh --max-age --hosted --seal-composite --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
         chat)
             if [[ "$cur" == -* ]]; then
                 COMPREPLY=( $(compgen -W "--attach --tui --help" -- "$cur") )

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.6.0"
+__version__ = "11.8.1"
 
 __all__ = ["__version__"]