loki-mode 11.8.1 → 11.10.1

package/packages/control-plane/src/server/diffstat.ts

@@ -22,6 +22,10 @@ const SHA = /^[0-9a-f]{40,64}$/;
 const MAX_RECEIPT_BYTES = 1024 * 1024;
 const GIT_TIMEOUT_MS = 5000;
 const cache = new Map<string, DiffStat>();
+// A git failure (timeout, unknown object) is remembered per run and range for a short while so a list refresh does not respawn git for every row.
+const FAIL_TTL_MS = 60_000;
+const failed = new Map<string, number>();
+export const diffStatGitRuns = { n: 0 };
 
 const gitEnv = (): NodeJS.ProcessEnv => ({ PATH: process.env.PATH ?? "", HOME: process.env.HOME ?? "", LC_ALL: "C", GIT_TERMINAL_PROMPT: "0", GIT_OPTIONAL_LOCKS: "0" });
 
@@ -49,7 +53,7 @@ function readReceipt(runDir: string): { base_sha?: unknown; head_sha?: unknown }
   } catch { return null; } finally { closeSync(fd); }
 }
 
-/** Null when the run is unknown, has no local repo or receipt, has no valid shas, or git cannot answer. Only successes are cached (a finished run's range never changes). */
+/** Null when the run is unknown, has no local repo or receipt, has no valid shas, or git cannot answer. Successes are cached for good (a finished run's range never changes); git failures are cached for FAIL_TTL_MS. */
 export function diffStatFor(db: Db, source: string, run: string): DiffStat | null {
   if (!ID.test(source) || !ID.test(run) || source.includes("..") || run.includes("..")) return null;
   const key = `${source}/${run}`;
@@ -67,11 +71,15 @@ export function diffStatFor(db: Db, source: string, run: string): DiffStat | nul
   const r = readReceipt(runDir);
   const base = typeof r?.base_sha === "string" ? r.base_sha : "", head = typeof r?.head_sha === "string" ? r.head_sha : "";
   if (!SHA.test(base) || !SHA.test(head)) return null;
+  const failKey = `${key}:${base}:${head}`;
+  const failedAt = failed.get(failKey);
+  if (failedAt !== undefined && Date.now() - failedAt < FAIL_TTL_MS) return null;
   try {
+    diffStatGitRuns.n++;
     const out = execFileSync("git", ["-C", repoReal, "-c", "core.quotePath=false", "diff", "--numstat", "--no-renames", `${base}..${head}`, "--"], { env: gitEnv(), timeout: GIT_TIMEOUT_MS, maxBuffer: 8 * 1024 * 1024, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     const files = parseNumstat(out);
     const stat: DiffStat = { base, head, files, added: files.reduce((n, f) => n + (f.added ?? 0), 0), removed: files.reduce((n, f) => n + (f.removed ?? 0), 0), source: "git" };
     cache.set(key, stat);
     return stat;
-  } catch { return null; }
+  } catch { failed.set(failKey, Date.now()); return null; }
 }

package/packages/control-plane/src/server/legacy/routes-control.ts

@@ -1,17 +1,21 @@
 // CPE24-P4: legacy (port 57374) mappings for session control and the Completion Council. They share the /v1 implementation in
 // routes/session_control.ts (fixed action enum, signal files only, same-origin check, audit row). The shim guard (CP token or loopback peer) has already run.
 import type { Context } from "hono";
+import { isLoopbackHost, peerIsLoopback } from "../auth.ts";
 import type { Db } from "../../db/migrate.ts";
 import { councilConvergence, councilReport, councilState, councilTranscripts, councilVerdicts, intQ, runControl } from "../routes/session_control.ts";
 import { lokiDirOf } from "../routes/cost_ledger.ts";
 
 export function controlMapped(db: Db, repoDir: string): Record<string, (c: Context) => Response> {
   const loki = () => lokiDirOf(repoDir);
+  // State-changing legacy calls need a loopback peer AND a loopback Host, like /v1 (no JSON requirement: legacy callers send none).
+  const ctl = (action: Parameters<typeof runControl>[2]) => (c: Context) => (peerIsLoopback(c) && isLoopbackHost(c.req.header("host"))
+    ? runControl(db, repoDir, action, c, "legacy") : c.json({ error: "loopback only" }, 403));
   return {
-    "POST /api/control/pause": (c) => runControl(db, repoDir, "pause", c, "legacy"),
-    "POST /api/control/resume": (c) => runControl(db, repoDir, "resume", c, "legacy"),
-    "POST /api/control/stop": (c) => runControl(db, repoDir, "stop", c, "legacy"),
-    "POST /api/council/force-review": (c) => runControl(db, repoDir, "council-review", c, "legacy"),
+    "POST /api/control/pause": ctl("pause"),
+    "POST /api/control/resume": ctl("resume"),
+    "POST /api/control/stop": ctl("stop"),
+    "POST /api/council/force-review": ctl("council-review"),
     "GET /api/council/state": (c) => c.json(councilState(loki())),
     "GET /api/council/verdicts": (c) => { const n = intQ(c.req.query("limit"), 1000); return n === null || n === 0 ? c.json({ detail: "limit must be 1..1000" }, 422) : c.json(councilVerdicts(loki(), n)); },
     "GET /api/council/convergence": (c) => c.json(councilConvergence(loki())),

package/packages/control-plane/src/server/routes/checkpoints.ts

@@ -17,6 +17,7 @@ const isObj = (v: unknown): v is Rec => typeof v === "object" && v !== null && !
 const str = (v: unknown): string | null => (typeof v === "string" && v !== "" ? v : null);
 const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
 const MAX_CHECKPOINTS = 50;
+const ROLLBACK_ALLOW = new Set(["session.json", "dashboard-state.json", "CONTINUITY.md", "autonomy-state.json", "state", "queue"]);
 
 export const validCheckpointId = (id: string) => SAFE_ID.test(id);
 const storeOf = (repoDir: string) => join(repoDir, ".loki", "state", "checkpoints");
@@ -104,12 +105,20 @@ export function rollbackCheckpoint(repoDir: string, id: string, now = new Date()
   appendFileSync(join(store, "index.jsonl"), `${JSON.stringify(preMeta)}\n`);
   let restored = 0;
   const errors: string[] = [];
+  // Only the allowlisted names are restored; anything else in the checkpoint (a planted audit/, say) is ignored and reported.
+  const skipped = (src: string) => src === join(real, "state", "checkpoints");
   for (const e of readdirSync(real, { withFileTypes: true })) {
     if (e.name === "metadata.json" || e.name === "worktree-snapshot.txt") continue;
-    const src = join(real, e.name);
+    if (!ROLLBACK_ALLOW.has(e.name)) { errors.push(`${e.name}: not in the rollback allowlist, skipped`); continue; }
+    const src = join(real, e.name), dst = join(loki, e.name);
     try {
       if (lstatSync(src).isSymbolicLink()) { errors.push(`${e.name}: symlink skipped`); continue; }
-      cpSync(src, join(loki, e.name), { recursive: true, filter: (s) => s !== join(real, "state", "checkpoints") });
+      if (existsSync(dst) && lstatSync(dst).isSymbolicLink()) { errors.push(`${e.name}: destination is a symlink, skipped`); continue; }
+      cpSync(src, dst, { recursive: true, filter: (s) => {
+        if (skipped(s)) return false;
+        if (lstatSync(s).isSymbolicLink()) { errors.push(`${s.slice(real.length + 1)}: nested symlink skipped`); return false; }
+        return true;
+      } });
       restored++;
     } catch (err) { errors.push(`${e.name}: ${(err as Error).message}`); }
   }