loki-mode 5.32.2 → 5.33.0

package/autonomy/loki

@@ -873,8 +873,8 @@ cmd_status() {
     # Check budget
     if [ -f "$LOKI_DIR/metrics/budget.json" ]; then
         local budget_limit budget_used budget_remaining
-        budget_limit=$(python3 -c "import json; d=json.load(open('$LOKI_DIR/metrics/budget.json')); print(d.get('budget_limit', 0))" 2>/dev/null || echo "0")
-        budget_used=$(python3 -c "import json; d=json.load(open('$LOKI_DIR/metrics/budget.json')); print(round(d.get('budget_used', 0), 2))" 2>/dev/null || echo "0")
+        budget_limit=$(LOKI_BUDGET_FILE="$LOKI_DIR/metrics/budget.json" python3 -c "import json,os; d=json.load(open(os.environ['LOKI_BUDGET_FILE'])); print(d.get('budget_limit', 0))" 2>/dev/null || echo "0")
+        budget_used=$(LOKI_BUDGET_FILE="$LOKI_DIR/metrics/budget.json" python3 -c "import json,os; d=json.load(open(os.environ['LOKI_BUDGET_FILE'])); print(round(d.get('budget_used', 0), 2))" 2>/dev/null || echo "0")
         if [ "$budget_limit" != "0" ]; then
             echo -e "${CYAN}Budget:${NC} \$$budget_used / \$$budget_limit"
         fi
@@ -3109,8 +3109,10 @@ send_slack_notification() {
     project_name=$(basename "$(pwd)")
     local timestamp
     timestamp=$(date '+%Y-%m-%d %H:%M:%S')
-    local message_escaped
+    local message_escaped event_escaped project_escaped
     message_escaped=$(printf '%s' "$message" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g')
+    event_escaped=$(printf '%s' "$event_type" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g')
+    project_escaped=$(printf '%s' "$project_name" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g')
 
     # Build Slack payload with blocks for better formatting
     local payload
@@ -3121,7 +3123,7 @@ send_slack_notification() {
             "type": "header",
             "text": {
                 "type": "plain_text",
-                "text": "Loki Mode: $event_type"
+                "text": "Loki Mode: $event_escaped"
             }
         },
         {
@@ -3136,7 +3138,7 @@ send_slack_notification() {
             "elements": [
                 {
                     "type": "mrkdwn",
-                    "text": "*Project:* $project_name | *Time:* $timestamp"
+                    "text": "*Project:* $project_escaped | *Time:* $timestamp"
                 }
             ]
         }
@@ -3165,8 +3167,10 @@ send_discord_notification() {
     project_name=$(basename "$(pwd)")
     local timestamp
     timestamp=$(date '+%Y-%m-%d %H:%M:%S')
-    local message_escaped
+    local message_escaped event_escaped project_escaped
     message_escaped=$(printf '%s' "$message" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g')
+    event_escaped=$(printf '%s' "$event_type" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g')
+    project_escaped=$(printf '%s' "$project_name" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g')
 
     # Build Discord embed payload
     local payload
@@ -3174,11 +3178,11 @@ send_discord_notification() {
 {
     "embeds": [
         {
-            "title": "Loki Mode: $event_type",
+            "title": "Loki Mode: $event_escaped",
             "description": "$message_escaped",
             "color": 5814783,
             "footer": {
-                "text": "Project: $project_name | $timestamp"
+                "text": "Project: $project_escaped | $timestamp"
             }
         }
     ]
@@ -3206,19 +3210,22 @@ send_webhook_notification() {
     project_name=$(basename "$(pwd)")
     local timestamp
     timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-    local message_escaped
+    local message_escaped event_escaped project_escaped cwd_escaped
     message_escaped=$(printf '%s' "$message" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g')
+    event_escaped=$(printf '%s' "$event_type" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g')
+    project_escaped=$(printf '%s' "$project_name" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g')
+    cwd_escaped=$(printf '%s' "$(pwd)" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g')
 
     # Build generic JSON payload
     local payload
     payload=$(cat <<EOF
 {
     "source": "loki-mode",
-    "event": "$event_type",
+    "event": "$event_escaped",
     "message": "$message_escaped",
-    "project": "$project_name",
+    "project": "$project_escaped",
     "timestamp": "$timestamp",
-    "cwd": "$(pwd)"
+    "cwd": "$cwd_escaped"
 }
 EOF
 )
@@ -3405,12 +3412,13 @@ SESSEOF
 
         # Mark session stopped
         if [ -f "$LOKI_DIR/session.json" ]; then
-            python3 -c "
-import json
-with open('$LOKI_DIR/session.json', 'r') as f:
+            LOKI_SESSION_FILE="$LOKI_DIR/session.json" python3 -c "
+import json, os
+p = os.environ['LOKI_SESSION_FILE']
+with open(p, 'r') as f:
     d = json.load(f)
 d['status'] = 'stopped'
-with open('$LOKI_DIR/session.json', 'w') as f:
+with open(p, 'w') as f:
     json.dump(d, f, indent=2)
 " 2>/dev/null || true
         fi
@@ -4169,11 +4177,11 @@ cmd_memory() {
                 case "$1" in
                     --limit|-l)
                         limit="${2:-20}"
-                        shift 2
+                        if [ $# -ge 2 ]; then shift 2; else shift; fi
                         ;;
                     --project|-p)
                         project="${2:-}"
-                        shift 2
+                        if [ $# -ge 2 ]; then shift 2; else shift; fi
                         ;;
                     *)
                         shift
@@ -4364,11 +4372,11 @@ for filename in ['patterns.jsonl', 'mistakes.jsonl', 'successes.jsonl']:
         export)
             local output="${2:-learnings-export.json}"
 
-            python3 -c "
+            LOKI_LEARNINGS_DIR="$learnings_dir" python3 -c "
 import json
 import os
 
-learnings_dir = '$learnings_dir'
+learnings_dir = os.environ['LOKI_LEARNINGS_DIR']
 result = {'patterns': [], 'mistakes': [], 'successes': []}
 
 for category in ['patterns', 'mistakes', 'successes']:
@@ -4392,12 +4400,12 @@ print(f'Exported to $output')
             echo -e "${BOLD}Learning Statistics${NC}"
             echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
-            python3 -c "
+            LOKI_LEARNINGS_DIR="$learnings_dir" python3 -c "
 import json
 import os
 from collections import Counter
 
-learnings_dir = '$learnings_dir'
+learnings_dir = os.environ['LOKI_LEARNINGS_DIR']
 projects = Counter()
 categories = Counter()
 
@@ -4431,13 +4439,13 @@ for proj, count in projects.most_common(10):
             echo -e "${BOLD}Deduplicating Learnings${NC}"
             echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
-            python3 -c "
+            LOKI_LEARNINGS_DIR="$learnings_dir" python3 -c "
 import json
 import os
 import hashlib
 from datetime import datetime, timezone
 
-learnings_dir = '$learnings_dir'
+learnings_dir = os.environ['LOKI_LEARNINGS_DIR']
 
 def dedupe_file(filepath):
     '''Deduplicate a JSONL file, keeping first occurrence of each unique description'''
@@ -4526,13 +4534,14 @@ except Exception as e:
         consolidate)
             # Run consolidation pipeline
             local hours="${2:-24}"
-            python3 -c "
+            LOKI_HOURS="$hours" python3 -c "
+import os
 try:
     from memory.consolidation import ConsolidationPipeline
     from memory.storage import MemoryStorage
     storage = MemoryStorage('.loki/memory')
     pipeline = ConsolidationPipeline(storage)
-    result = pipeline.consolidate(since_hours=$hours)
+    result = pipeline.consolidate(since_hours=int(os.environ.get('LOKI_HOURS', '24')))
     print('Consolidation complete:')
     print(f'  Patterns created: {result.patterns_created}')
     print(f'  Patterns merged: {result.patterns_merged}')
@@ -5326,9 +5335,9 @@ cmd_council() {
             fi
 
             if [ -f "$council_dir/state.json" ]; then
-                python3 -c "
-import json
-with open('$council_dir/state.json') as f:
+                LOKI_COUNCIL_STATE="$council_dir/state.json" python3 -c "
+import json, os
+with open(os.environ['LOKI_COUNCIL_STATE']) as f:
     state = json.load(f)
 print(f\"Enabled: {state.get('initialized', False)}\")
 print(f\"Total votes: {state.get('total_votes', 0)}\")
@@ -5354,9 +5363,9 @@ else:
             echo -e "${CYAN}=== Council Decision Log ===${NC}"
 
             if [ -f "$council_dir/state.json" ]; then
-                python3 -c "
-import json
-with open('$council_dir/state.json') as f:
+                LOKI_COUNCIL_STATE="$council_dir/state.json" python3 -c "
+import json, os
+with open(os.environ['LOKI_COUNCIL_STATE']) as f:
     state = json.load(f)
 verdicts = state.get('verdicts', [])
 if not verdicts:

package/autonomy/run.sh

@@ -1067,14 +1067,16 @@ import_github_issues() {
     local pending_file=".loki/queue/pending.json"
     local task_count=0
 
-    # Ensure pending.json exists with correct format for GitHub import
+    # BUG #14 fix: Normalize to bare [] format (consistent with init_loki_dir
+    # and all other queue consumers). Previously used {"tasks":[]} wrapper here
+    # but bare [] everywhere else, causing format mismatch.
     if [ ! -f "$pending_file" ]; then
-        echo '{"tasks":[]}' > "$pending_file"
-    elif jq -e 'type == "array"' "$pending_file" &>/dev/null; then
-        # Normalize bare array format to {"tasks":[...]} for GitHub import compatibility
+        echo '[]' > "$pending_file"
+    elif jq -e 'type == "object"' "$pending_file" &>/dev/null; then
+        # Normalize {"tasks":[...]} wrapper to bare array
         local _tmp_normalize
         _tmp_normalize=$(mktemp)
-        jq '{tasks: .}' "$pending_file" > "$_tmp_normalize" && mv "$_tmp_normalize" "$pending_file"
+        jq 'if type == "object" then .tasks // [] else . end' "$pending_file" > "$_tmp_normalize" && mv "$_tmp_normalize" "$pending_file"
         rm -f "$_tmp_normalize"
     fi
 
@@ -1094,8 +1096,8 @@ import_github_issues() {
         url=$(echo "$issue" | jq -r '.url')
         labels=$(echo "$issue" | jq -c '[.labels[].name]')
 
-        # Check if task already exists
-        if jq -e ".tasks[] | select(.github_issue == $number)" "$pending_file" &>/dev/null; then
+        # Check if task already exists (bare array format)
+        if jq -e ".[] | select(.github_issue == $number)" "$pending_file" &>/dev/null; then
             log_info "Issue #$number already imported, skipping"
             continue
         fi
@@ -1137,10 +1139,10 @@ import_github_issues() {
                 created_at: $created
             }')
 
-        # Append to pending.json with temp file cleanup on error
+        # Append to pending.json (bare array format) with temp file cleanup on error
         local temp_file
         temp_file=$(mktemp)
-        if jq ".tasks += [$task_json]" "$pending_file" > "$temp_file" && mv "$temp_file" "$pending_file"; then
+        if jq ". += [$task_json]" "$pending_file" > "$temp_file" && mv "$temp_file" "$pending_file"; then
             log_info "Imported issue #$number: $title"
             task_count=$((task_count + 1))
         else
@@ -1293,8 +1295,8 @@ export_tasks_to_github() {
         return 0
     fi
 
-    # Export non-GitHub tasks as issues
-    jq -c '.tasks[] | select(.source != "github")' "$pending_file" 2>/dev/null | while read -r task; do
+    # Export non-GitHub tasks as issues (handles both bare array and wrapper formats)
+    jq -c 'if type == "object" then .tasks // [] else . end | .[] | select(.source != "github")' "$pending_file" 2>/dev/null | while read -r task; do
         local title desc
         title=$(echo "$task" | jq -r '.title')
         desc=$(echo "$task" | jq -r '.description // ""')
@@ -2415,13 +2417,20 @@ write_dashboard_state() {
     local project_path=$(pwd)
     local _tmp_state="${output_file}.tmp"
 
+    # BUG #49 fix: Escape project path/name for JSON to handle special chars
+    # (spaces, quotes, backslashes in directory names)
+    local project_name_escaped
+    local project_path_escaped
+    project_name_escaped=$(printf '%s' "$project_name" | sed 's/\\/\\\\/g; s/"/\\"/g')
+    project_path_escaped=$(printf '%s' "$project_path" | sed 's/\\/\\\\/g; s/"/\\"/g')
+
     cat > "$_tmp_state" << EOF
 {
   "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
   "version": "$version",
   "project": {
-    "name": "$project_name",
-    "path": "$project_path"
+    "name": "$project_name_escaped",
+    "path": "$project_path_escaped"
   },
   "mode": "$mode",
   "provider": "${PROVIDER_NAME:-claude}",
@@ -4665,12 +4674,12 @@ build_prompt() {
     fi
 
     # Human directive injection (from HUMAN_INPUT.md)
+    # NOTE: Do NOT unset LOKI_HUMAN_INPUT here - build_prompt runs in a subshell
+    # (command substitution) so unset would not affect the parent shell.
+    # The caller (run_autonomous) clears it after consuming the prompt.
     local human_directive=""
     if [ -n "${LOKI_HUMAN_INPUT:-}" ]; then
         human_directive="HUMAN_DIRECTIVE (PRIORITY): $LOKI_HUMAN_INPUT Execute this directive BEFORE continuing normal tasks."
-        # Clear after consumption so it doesn't repeat every iteration
-        unset LOKI_HUMAN_INPUT
-        rm -f "${TARGET_DIR:-.}/.loki/HUMAN_INPUT.md"
     fi
 
     # Queue task injection (from dashboard or API)
@@ -4795,6 +4804,15 @@ run_autonomous() {
 
         local prompt=$(build_prompt $retry "$prd_path" $ITERATION_COUNT)
 
+        # BUG #5 fix: Clear LOKI_HUMAN_INPUT in the parent shell after build_prompt
+        # consumed it. build_prompt runs in a subshell (command substitution), so
+        # any unset inside it does not affect the parent. Clear here to prevent
+        # the same directive from repeating every iteration.
+        if [ -n "${LOKI_HUMAN_INPUT:-}" ]; then
+            unset LOKI_HUMAN_INPUT
+            rm -f "${TARGET_DIR:-.}/.loki/HUMAN_INPUT.md"
+        fi
+
         echo ""
         log_header "Attempt $((retry + 1)) of $MAX_RETRIES"
         log_info "Prompt: $prompt"
@@ -5234,11 +5252,19 @@ check_human_intervention() {
     local loki_dir="${TARGET_DIR:-.}/.loki"
 
     # Check for PAUSE file
+    # BUG #4 fix: Check handle_pause return value before deleting PAUSE file.
+    # handle_pause returns 1 if STOP was requested during the pause, so we must
+    # propagate that as return 2 (stop) instead of always returning 1 (continue).
     if [ -f "$loki_dir/PAUSE" ]; then
         log_warn "PAUSE file detected - pausing execution"
         notify_intervention_needed "Execution paused via PAUSE file"
         handle_pause
+        local pause_result=$?
         rm -f "$loki_dir/PAUSE"
+        if [ "$pause_result" -eq 1 ]; then
+            # STOP was requested during pause
+            return 2
+        fi
         return 1
     fi
 
@@ -5287,8 +5313,13 @@ check_human_intervention() {
         rm -f "$loki_dir/signals/COUNCIL_REVIEW_REQUESTED"
         if type council_vote &>/dev/null && council_vote; then
             log_header "COMPLETION COUNCIL: FORCE REVIEW - PROJECT COMPLETE"
-            # Complete the missing steps: COMPLETED marker, memory consolidation, report
-            touch "$loki_dir/COMPLETED"
+            # BUG #17 fix: Write COMPLETED marker, generate council report, and
+            # run memory consolidation (matching the normal council approval path
+            # in council_should_stop).
+            echo "Council force-review approved at iteration $ITERATION_COUNT on $(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$loki_dir/COMPLETED"
+            if type council_write_report &>/dev/null; then
+                council_write_report
+            fi
             log_info "Running memory consolidation..."
             run_memory_consolidation
             notify_all_complete

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "5.32.2"
+__version__ = "5.33.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/control.py

@@ -56,10 +56,13 @@ app = FastAPI(
     version="1.0.0"
 )
 
-# CORS middleware for dashboard frontend
+# CORS middleware for dashboard frontend - restricted to localhost by default.
+# Set LOKI_DASHBOARD_CORS to override (comma-separated origins).
+_cors_default = "http://localhost:57374,http://127.0.0.1:57374"
+_cors_origins = os.environ.get("LOKI_DASHBOARD_CORS", _cors_default).split(",")
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=[o.strip() for o in _cors_origins if o.strip()],
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
@@ -511,4 +514,5 @@ async def asyncio_sleep(seconds: float):
 if __name__ == "__main__":
     import uvicorn
     port = int(os.environ.get("LOKI_DASHBOARD_PORT", "57374"))
-    uvicorn.run(app, host="0.0.0.0", port=port)
+    host = os.environ.get("LOKI_DASHBOARD_HOST", "127.0.0.1")
+    uvicorn.run(app, host=host, port=port)

package/dashboard/server.py

@@ -209,9 +209,10 @@ app = FastAPI(
     lifespan=lifespan,
 )
 
-# Add CORS middleware - allow_origins=* is safe because server binds to
-# 127.0.0.1 by default. Set LOKI_DASHBOARD_HOST to override if LAN access needed.
-_cors_origins = os.environ.get("CORS_ALLOWED_ORIGINS", "*").split(",")
+# Add CORS middleware - restricted to localhost by default.
+# Set LOKI_DASHBOARD_CORS to override (comma-separated origins).
+_cors_default = "http://localhost:57374,http://127.0.0.1:57374"
+_cors_origins = os.environ.get("LOKI_DASHBOARD_CORS", _cors_default).split(",")
 app.add_middleware(
     CORSMiddleware,
     allow_origins=[o.strip() for o in _cors_origins if o.strip()],
@@ -2046,6 +2047,7 @@ async def get_agents():
 @app.post("/api/agents/{agent_id}/kill")
 async def kill_agent(agent_id: str):
     """Kill a specific agent by ID."""
+    agent_id = _sanitize_agent_id(agent_id)
     agents_file = _get_loki_dir() / "state" / "agents.json"
     if not agents_file.exists():
         raise HTTPException(404, "No agents file found")
@@ -2296,7 +2298,7 @@ def run_server(host: str = None, port: int = None) -> None:
     """Run the dashboard server."""
     import uvicorn
     if host is None:
-        # Default to localhost-only; CORS * is safe since not exposed to LAN
+        # Default to localhost-only for security
         host = os.environ.get("LOKI_DASHBOARD_HOST", "127.0.0.1")
     if port is None:
         port = int(os.environ.get("LOKI_DASHBOARD_PORT", "57374"))

package/dashboard/static/index.html

@@ -3750,7 +3750,7 @@ var LokiDashboard=(()=>{var N=Object.defineProperty;var se=Object.getOwnProperty
           ${t}
         </div>
       </div>
-    `,this._attachEventListeners()}_attachEventListeners(){let e=this.shadowRoot.getElementById("time-range-select");e&&e.addEventListener("change",r=>this._setFilter("timeRange",r.target.value));let t=this.shadowRoot.getElementById("signal-type-select");t&&t.addEventListener("change",r=>this._setFilter("signalType",r.target.value));let a=this.shadowRoot.getElementById("source-select");a&&a.addEventListener("change",r=>this._setFilter("source",r.target.value));let i=this.shadowRoot.getElementById("refresh-btn");i&&i.addEventListener("click",()=>this._loadData());let s=this.shadowRoot.getElementById("close-detail");s&&s.addEventListener("click",()=>this._closeDetail()),this.shadowRoot.querySelectorAll(".list-item").forEach(r=>{r.addEventListener("click",()=>{let n=r.dataset.type,d=r.dataset.id,p=this._findItemData(n,d);p&&this._selectMetric(n,p)}),r.addEventListener("keydown",n=>{(n.key==="Enter"||n.key===" ")&&(n.preventDefault(),r.click())})})}_findItemData(e,t){if(!this._metrics?.aggregation)return null;switch(e){case"preference":return this._metrics.aggregation.preferences?.find(a=>a.preference_key===t);case"error_pattern":return this._metrics.aggregation.error_patterns?.find(a=>a.error_type===t);case"success_pattern":return this._metrics.aggregation.success_patterns?.find(a=>a.pattern_name===t);case"tool_efficiency":return this._metrics.aggregation.tool_efficiencies?.find(a=>a.tool_name===t);default:return null}}};customElements.get("loki-learning-dashboard")||customElements.define("loki-learning-dashboard",H);var me=[{id:"overview",label:"Overview"},{id:"decisions",label:"Decision Log"},{id:"convergence",label:"Convergence"},{id:"agents",label:"Agents"}],O=class extends c{static get observedAttributes(){return["api-url","theme"]}constructor(){super(),this._loading=!1,this._error=null,this._api=null,this._activeTab="overview",this._pollInterval=null,this._councilState=null,this._verdicts=[],this._convergence=[],this._agents=[],this._selectedAgent=null,this._lastDataHash=null}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadData(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling()}attributeChangedCallback(e,t,a){t!==a&&(e==="api-url"&&this._api&&(this._api.baseUrl=a,this._loadData()),e==="theme"&&this._applyTheme())}_setupApi(){let e=this.getAttribute("api-url")||window.location.origin;this._api=g({baseUrl:e})}_startPolling(){this._pollInterval=setInterval(()=>this._loadData(),3e3),this._visibilityHandler=()=>{document.hidden?this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null):this._pollInterval||(this._loadData(),this._pollInterval=setInterval(()=>this._loadData(),3e3))},document.addEventListener("visibilitychange",this._visibilityHandler)}_stopPolling(){this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null),this._visibilityHandler&&(document.removeEventListener("visibilitychange",this._visibilityHandler),this._visibilityHandler=null)}async _loadData(){try{let[t,a,i,s]=await Promise.allSettled([this._api._get("/api/council/state"),this._api._get("/api/council/verdicts"),this._api._get("/api/council/convergence"),this._api._get("/api/agents")]);t.status==="fulfilled"&&(this._councilState=t.value),a.status==="fulfilled"&&(this._verdicts=a.value.verdicts||[]),i.status==="fulfilled"&&(this._convergence=i.value.dataPoints||[]),s.status==="fulfilled"&&(this._agents=Array.isArray(s.value)?s.value:[]),this._error=null}catch(t){this._error=t.message}let e=JSON.stringify({s:this._councilState,v:this._verdicts,c:this._convergence,a:this._agents,e:this._error});e!==this._lastDataHash&&(this._lastDataHash=e,this.render())}async _forceReview(){try{await this._api._post("/api/council/force-review"),this.dispatchEvent(new CustomEvent("council-action",{detail:{action:"force-review"},bubbles:!0}))}catch(e){this._error=`Failed to force review: ${e.message}`,this.render()}}async _killAgent(e){if(confirm(`Kill agent ${e}?`))try{await this._api._post(`/api/agents/${e}/kill`),this.dispatchEvent(new CustomEvent("council-action",{detail:{action:"kill-agent",agentId:e},bubbles:!0})),await this._loadData()}catch(t){this._error=`Failed to kill agent: ${t.message}`,this.render()}}async _pauseAgent(e){try{await this._api._post(`/api/agents/${e}/pause`),await this._loadData()}catch(t){this._error=`Failed to pause agent: ${t.message}`,this.render()}}async _resumeAgent(e){try{await this._api._post(`/api/agents/${e}/resume`),await this._loadData()}catch(t){this._error=`Failed to resume agent: ${t.message}`,this.render()}}_setTab(e){this._activeTab=e,this.render()}_selectAgent(e){this._selectedAgent=this._selectedAgent?.id===e.id?null:e,this.render()}render(){let e=this.shadowRoot;e&&(e.innerHTML=`
+    `,this._attachEventListeners()}_attachEventListeners(){let e=this.shadowRoot.getElementById("time-range-select");e&&e.addEventListener("change",r=>this._setFilter("timeRange",r.target.value));let t=this.shadowRoot.getElementById("signal-type-select");t&&t.addEventListener("change",r=>this._setFilter("signalType",r.target.value));let a=this.shadowRoot.getElementById("source-select");a&&a.addEventListener("change",r=>this._setFilter("source",r.target.value));let i=this.shadowRoot.getElementById("refresh-btn");i&&i.addEventListener("click",()=>this._loadData());let s=this.shadowRoot.getElementById("close-detail");s&&s.addEventListener("click",()=>this._closeDetail()),this.shadowRoot.querySelectorAll(".list-item").forEach(r=>{r.addEventListener("click",()=>{let n=r.dataset.type,d=r.dataset.id,p=this._findItemData(n,d);p&&this._selectMetric(n,p)}),r.addEventListener("keydown",n=>{(n.key==="Enter"||n.key===" ")&&(n.preventDefault(),r.click())})})}_findItemData(e,t){if(!this._metrics?.aggregation)return null;switch(e){case"preference":return this._metrics.aggregation.preferences?.find(a=>a.preference_key===t);case"error_pattern":return this._metrics.aggregation.error_patterns?.find(a=>a.error_type===t);case"success_pattern":return this._metrics.aggregation.success_patterns?.find(a=>a.pattern_name===t);case"tool_efficiency":return this._metrics.aggregation.tool_efficiencies?.find(a=>a.tool_name===t);default:return null}}};customElements.get("loki-learning-dashboard")||customElements.define("loki-learning-dashboard",H);var me=[{id:"overview",label:"Overview"},{id:"decisions",label:"Decision Log"},{id:"convergence",label:"Convergence"},{id:"agents",label:"Agents"}],O=class extends c{static get observedAttributes(){return["api-url","theme"]}constructor(){super(),this._loading=!1,this._error=null,this._api=null,this._activeTab="overview",this._pollInterval=null,this._councilState=null,this._verdicts=[],this._convergence=[],this._agents=[],this._selectedAgent=null,this._lastDataHash=null}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadData(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling()}attributeChangedCallback(e,t,a){t!==a&&(e==="api-url"&&this._api&&(this._api.baseUrl=a,this._loadData()),e==="theme"&&this._applyTheme())}_setupApi(){let e=this.getAttribute("api-url")||window.location.origin;this._api=g({baseUrl:e})}_startPolling(){this._pollInterval=setInterval(()=>this._loadData(),3e3),this._visibilityHandler=()=>{document.hidden?this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null):this._pollInterval||(this._loadData(),this._pollInterval=setInterval(()=>this._loadData(),3e3))},document.addEventListener("visibilitychange",this._visibilityHandler)}_stopPolling(){this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null),this._visibilityHandler&&(document.removeEventListener("visibilitychange",this._visibilityHandler),this._visibilityHandler=null),this._pendingRaf&&(cancelAnimationFrame(this._pendingRaf),this._pendingRaf=null)}async _loadData(){try{let[t,a,i,s]=await Promise.allSettled([this._api._get("/api/council/state"),this._api._get("/api/council/verdicts"),this._api._get("/api/council/convergence"),this._api._get("/api/agents")]);t.status==="fulfilled"&&(this._councilState=t.value),a.status==="fulfilled"&&(this._verdicts=a.value.verdicts||[]),i.status==="fulfilled"&&(this._convergence=i.value.dataPoints||[]),s.status==="fulfilled"&&(this._agents=Array.isArray(s.value)?s.value:[]),this._error=null}catch(t){this._error=t.message}let e=JSON.stringify({s:this._councilState,v:this._verdicts,c:this._convergence,a:this._agents,e:this._error});e!==this._lastDataHash&&(this._lastDataHash=e,this.render())}async _forceReview(){try{await this._api._post("/api/council/force-review"),this.dispatchEvent(new CustomEvent("council-action",{detail:{action:"force-review"},bubbles:!0}))}catch(e){this._error=`Failed to force review: ${e.message}`,this.render()}}async _killAgent(e){if(confirm(`Kill agent ${e}?`))try{await this._api._post(`/api/agents/${e}/kill`),this.dispatchEvent(new CustomEvent("council-action",{detail:{action:"kill-agent",agentId:e},bubbles:!0})),await this._loadData()}catch(t){this._error=`Failed to kill agent: ${t.message}`,this.render()}}async _pauseAgent(e){try{await this._api._post(`/api/agents/${e}/pause`),await this._loadData()}catch(t){this._error=`Failed to pause agent: ${t.message}`,this.render()}}async _resumeAgent(e){try{await this._api._post(`/api/agents/${e}/resume`),await this._loadData()}catch(t){this._error=`Failed to resume agent: ${t.message}`,this.render()}}_setTab(e){this._activeTab=e,this.render()}_selectAgent(e){this._selectedAgent=this._selectedAgent?.id===e.id?null:e,this.render()}render(){let e=this.shadowRoot;e&&(this._pendingRaf&&(cancelAnimationFrame(this._pendingRaf),this._pendingRaf=null),e.innerHTML=`
       <style>${this.getBaseStyles()}${this._getStyles()}</style>
       <div class="council-dashboard">
         <div class="council-header">
@@ -3758,7 +3758,7 @@ var LokiDashboard=(()=>{var N=Object.defineProperty;var se=Object.getOwnProperty
             <h2 class="title">Completion Council</h2>
             ${this._councilState?.enabled!==!1?'<span class="badge badge-active">Active</span>':'<span class="badge badge-inactive">Disabled</span>'}
           </div>
-          <button class="btn btn-primary" onclick="this.getRootNode().host._forceReview()">
+          <button class="btn btn-primary" id="force-review-btn">
             Force Review
           </button>
         </div>
@@ -3767,7 +3767,7 @@ var LokiDashboard=(()=>{var N=Object.defineProperty;var se=Object.getOwnProperty
           ${me.map(t=>`
             <button
               class="tab ${this._activeTab===t.id?"active":""}"
-              onclick="this.getRootNode().host._setTab('${t.id}')"
+              data-tab="${t.id}"
             >${t.label}</button>
           `).join("")}
         </div>
@@ -3778,7 +3778,7 @@ var LokiDashboard=(()=>{var N=Object.defineProperty;var se=Object.getOwnProperty
 
         ${this._error?`<div class="error-banner">${this._error}</div>`:""}
       </div>
-    `)}_renderTabContent(){switch(this._activeTab){case"overview":return this._renderOverview();case"decisions":return this._renderDecisions();case"convergence":return this._renderConvergence();case"agents":return this._renderAgents();default:return""}}_renderOverview(){let e=this._councilState||{},t=e.consecutive_no_change||0,a=e.done_signals||0,i=e.total_votes||0,s=e.approve_votes||0,r=this._verdicts.length>0?this._verdicts[this._verdicts.length-1]:null,n=this._agents.filter(d=>d.alive).length;return`
+    `,this._attachEventListeners())}_attachEventListeners(){let e=this.shadowRoot;if(!e)return;let t=e.getElementById("force-review-btn");t&&t.addEventListener("click",()=>this._forceReview()),e.querySelectorAll(".tab[data-tab]").forEach(a=>{a.addEventListener("click",()=>this._setTab(a.dataset.tab))})}_renderTabContent(){switch(this._activeTab){case"overview":return this._renderOverview();case"decisions":return this._renderDecisions();case"convergence":return this._renderConvergence();case"agents":return this._renderAgents();default:return""}}_renderOverview(){let e=this._councilState||{},t=e.consecutive_no_change||0,a=e.done_signals||0,i=e.total_votes||0,s=e.approve_votes||0,r=this._verdicts.length>0?this._verdicts[this._verdicts.length-1]:null,n=this._agents.filter(d=>d.alive).length;return`
       <div class="overview-grid">
         <div class="stat-card">
           <div class="stat-label">Council Status</div>
@@ -3918,7 +3918,7 @@ var LokiDashboard=(()=>{var N=Object.defineProperty;var se=Object.getOwnProperty
           </div>
         `).join("")}
       </div>
-    `;return requestAnimationFrame(()=>{let t=this.shadowRoot;t&&t.querySelectorAll(".agent-card[data-agent-index]").forEach(a=>{let i=parseInt(a.dataset.agentIndex,10),s=this._agents[i];s&&(a.addEventListener("click",()=>this._selectAgent(s)),a.querySelectorAll("[data-action]").forEach(r=>{r.addEventListener("click",n=>{n.stopPropagation();let d=r.dataset.action,p=r.dataset.agentId;d==="pause"?this._pauseAgent(p):d==="kill"?this._killAgent(p):d==="resume"&&this._resumeAgent(p)})}))})}),e}_formatTime(e){if(!e)return"";try{return new Date(e).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"})}catch{return e}}_getStyles(){return`
+    `;return this._pendingRaf=requestAnimationFrame(()=>{this._pendingRaf=null;let t=this.shadowRoot;t&&t.querySelectorAll(".agent-card[data-agent-index]").forEach(a=>{let i=parseInt(a.dataset.agentIndex,10),s=this._agents[i];s&&(a.addEventListener("click",()=>this._selectAgent(s)),a.querySelectorAll("[data-action]").forEach(r=>{r.addEventListener("click",n=>{n.stopPropagation();let d=r.dataset.action,p=r.dataset.agentId;d==="pause"?this._pauseAgent(p):d==="kill"?this._killAgent(p):d==="resume"&&this._resumeAgent(p)})}))})}),e}_formatTime(e){if(!e)return"";try{return new Date(e).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"})}catch{return e}}_getStyles(){return`
       :host {
         display: block;
         font-family: 'Inter', -apple-system, BlinkMacSystemFont, sans-serif;

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Complete installation instructions for all platforms and use cases.
 
-**Version:** v5.32.2
+**Version:** v5.33.0
 
 ---
 

package/events/emit.sh

@@ -25,30 +25,37 @@ mkdir -p "$EVENTS_DIR"
 TYPE="${1:-state}"
 SOURCE="${2:-cli}"
 ACTION="${3:-unknown}"
-if [ $# -ge 3 ]; then shift 3; else shift $#; fi
+if [ "$#" -ge 3 ]; then shift 3; else shift "$#"; fi
 
 # Generate event ID and timestamp
 EVENT_ID=$(head -c 4 /dev/urandom | od -An -tx1 | tr -d ' \n')
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")
 
+# JSON escape helper: handles \, ", and control characters
+json_escape() {
+    printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g; s/\r/\\r/g' | tr -d '\n'
+}
+
 # Build payload JSON
-PAYLOAD="{\"action\":\"$ACTION\""
+ACTION_ESC=$(json_escape "$ACTION")
+PAYLOAD="{\"action\":\"$ACTION_ESC\""
 for arg in "$@"; do
     key="${arg%%=*}"
     value="${arg#*=}"
-    # Escape special characters for JSON
-    key_escaped=$(printf '%s' "$key" | sed 's/\\/\\\\/g; s/"/\\"/g')
-    value=$(printf '%s' "$value" | sed 's/\\/\\\\/g; s/"/\\"/g')
-    PAYLOAD="$PAYLOAD,\"$key_escaped\":\"$value\""
+    key_escaped=$(json_escape "$key")
+    value_escaped=$(json_escape "$value")
+    PAYLOAD="$PAYLOAD,\"$key_escaped\":\"$value_escaped\""
 done
 PAYLOAD="$PAYLOAD}"
 
-# Build full event JSON
+# Build full event JSON (escape type/source for safe embedding)
+TYPE_ESC=$(json_escape "$TYPE")
+SOURCE_ESC=$(json_escape "$SOURCE")
 EVENT=$(cat <<EOF
 {
   "id": "$EVENT_ID",
-  "type": "$TYPE",
-  "source": "$SOURCE",
+  "type": "$TYPE_ESC",
+  "source": "$SOURCE_ESC",
   "timestamp": "$TIMESTAMP",
   "payload": $PAYLOAD,
   "version": "1.0"