loki-mode 5.34.0 → 5.36.0

package/autonomy/sandbox.sh

@@ -56,7 +56,7 @@ SANDBOX_MEMORY="${LOKI_SANDBOX_MEMORY:-4g}"
 SANDBOX_READONLY="${LOKI_SANDBOX_READONLY:-false}"
 
 # API ports
-API_PORT="${LOKI_API_PORT:-9898}"
+API_PORT="${LOKI_DASHBOARD_PORT:-57374}"
 DASHBOARD_PORT="${LOKI_DASHBOARD_PORT:-57374}"
 
 # Security: Prompt injection disabled by default for enterprise security
@@ -727,7 +727,7 @@ docker_desktop_sandbox_prompt() {
     docker sandbox exec -w "$PROJECT_DIR" \
         ${DESKTOP_ENV_ARGS[@]+"${DESKTOP_ENV_ARGS[@]}"} \
         "$DESKTOP_SANDBOX_NAME" \
-        bash -c "echo '$message' > ${PROJECT_DIR}/.loki/HUMAN_INPUT.md"
+        bash -c "printf '%s\n' \"\$1\" > ${PROJECT_DIR}/.loki/HUMAN_INPUT.md" -- "$message"
 
     log_success "Prompt sent to sandbox"
 }
@@ -766,12 +766,7 @@ start_sandbox() {
     validate_project_dir || return 1
     ensure_image
 
-    # Check port availability
-    if ! check_port_available "$API_PORT"; then
-        log_error "Port $API_PORT is already in use"
-        log_info "Set LOKI_API_PORT to use a different port"
-        return 1
-    fi
+    # Check port availability (unified dashboard/API port)
     if ! check_port_available "$DASHBOARD_PORT"; then
         log_error "Port $DASHBOARD_PORT is already in use"
         log_info "Set LOKI_DASHBOARD_PORT to use a different port"
@@ -898,8 +893,7 @@ start_sandbox() {
 
     # Expose ports
     docker_args+=(
-        "--publish" "$API_PORT:9898"
-        "--publish" "$DASHBOARD_PORT:57374"
+        "--publish" "$API_PORT:57374"
     )
 
     # Expose additional ports for testing (e.g., LOKI_EXTRA_PORTS="3000:3000,8080:8080")

package/autonomy/serve.sh

@@ -9,15 +9,15 @@
 #   loki serve [OPTIONS]
 #
 # Options:
-#   --port, -p <port>   Port to listen on (default: 8420)
+#   --port, -p <port>   Port to listen on (default: 57374)
 #   --host, -h <host>   Host to bind to (default: localhost)
 #   --no-cors           Disable CORS
 #   --no-auth           Disable authentication
 #   --help              Show help message
 #
 # Environment Variables:
-#   LOKI_API_PORT       Port (default: 8420)
-#   LOKI_API_HOST       Host (default: localhost)
+#   LOKI_DASHBOARD_PORT Port (default: 57374)
+#   LOKI_DASHBOARD_HOST Host (default: localhost)
 #   LOKI_API_TOKEN      API token for remote access
 #===============================================================================
 
@@ -28,8 +28,8 @@ PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 API_DIR="$PROJECT_DIR/api"
 
 # Default configuration
-PORT="${LOKI_API_PORT:-8420}"
-HOST="${LOKI_API_HOST:-localhost}"
+PORT="${LOKI_DASHBOARD_PORT:-57374}"
+HOST="${LOKI_DASHBOARD_HOST:-localhost}"
 CORS="true"
 AUTH="true"
 
@@ -63,7 +63,7 @@ Usage:
   loki serve [OPTIONS]
 
 Options:
-  --port, -p <port>   Port to listen on (default: 8420)
+  --port, -p <port>   Port to listen on (default: 57374)
   --host <host>       Host to bind to (default: localhost)
   --no-cors           Disable CORS
   --no-auth           Disable authentication
@@ -71,14 +71,14 @@ Options:
   --help              Show this help message
 
 Environment Variables:
-  LOKI_API_PORT       Port (overridden by --port)
-  LOKI_API_HOST       Host (overridden by --host)
+  LOKI_DASHBOARD_PORT Port (overridden by --port)
+  LOKI_DASHBOARD_HOST Host (overridden by --host)
   LOKI_API_TOKEN      API token for remote access
   LOKI_DIR            Loki installation directory
   LOKI_DEBUG          Enable debug output
 
 Examples:
-  # Start with defaults (localhost:8420)
+  # Start with defaults (localhost:57374)
   loki serve
 
   # Custom port
@@ -89,7 +89,7 @@ Examples:
   loki serve --host 0.0.0.0
 
   # Connect from another machine
-  curl -H "Authorization: Bearer \$TOKEN" http://server:8420/health
+  curl -H "Authorization: Bearer \$TOKEN" http://server:57374/health
 
 EOF
 }

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "5.34.0"
+__version__ = "5.36.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/auth.py

@@ -53,9 +53,20 @@ def _save_tokens(tokens: dict) -> None:
         json.dump(tokens, f, indent=2, default=str)
 
 
-def _hash_token(token: str) -> str:
-    """Hash a token for storage."""
-    return hashlib.sha256(token.encode()).hexdigest()
+def _hash_token(token: str, salt: str = None) -> tuple[str, str]:
+    """Hash a token for storage with a per-token random salt.
+
+    Args:
+        token: The raw token string to hash.
+        salt: Optional salt. If None, a new random salt is generated.
+
+    Returns:
+        Tuple of (hex_digest, salt).
+    """
+    if salt is None:
+        salt = secrets.token_hex(16)
+    digest = hashlib.sha256((salt + token).encode()).hexdigest()
+    return digest, salt
 
 
 def _constant_time_compare(a: str, b: str) -> bool:
@@ -94,7 +105,7 @@ def generate_token(
 
     # Generate secure random token
     raw_token = f"loki_{secrets.token_urlsafe(32)}"
-    token_hash = _hash_token(raw_token)
+    token_hash, token_salt = _hash_token(raw_token)
     token_id = token_hash[:12]
 
     tokens = _load_tokens()
@@ -114,6 +125,7 @@ def generate_token(
         "id": token_id,
         "name": name,
         "hash": token_hash,
+        "salt": token_salt,
         "scopes": scopes or ["*"],
         "created_at": datetime.now(timezone.utc).isoformat(),
         "expires_at": expires_at,
@@ -229,11 +241,12 @@ def validate_token(raw_token: str) -> Optional[dict]:
     if not raw_token or not raw_token.startswith("loki_"):
         return None
 
-    token_hash = _hash_token(raw_token)
     tokens = _load_tokens()
 
     # Find matching token (using constant-time comparison to prevent timing attacks)
     for token in tokens["tokens"].values():
+        stored_salt = token.get("salt", "")
+        token_hash, _ = _hash_token(raw_token, salt=stored_salt)
         if _constant_time_compare(token["hash"], token_hash):
             # Check if revoked
             if token.get("revoked"):

package/dashboard/requirements.txt

@@ -1,8 +1,8 @@
 # Loki Mode Dashboard Dependencies
-fastapi>=0.109.0
-uvicorn[standard]>=0.27.0
-sqlalchemy>=2.0.0
-aiosqlite>=0.19.0
-greenlet>=3.0.0
-pydantic>=2.0.0
-websockets>=12.0
+fastapi==0.115.6
+uvicorn[standard]==0.34.0
+sqlalchemy==2.0.36
+aiosqlite==0.20.0
+greenlet==3.1.1
+pydantic==2.10.4
+websockets==14.1

package/dashboard/server.py

@@ -8,6 +8,8 @@ import asyncio
 import json
 import logging
 import os
+import time
+from collections import defaultdict
 from contextlib import asynccontextmanager
 from datetime import datetime, timedelta, timezone
 from pathlib import Path as _Path
@@ -43,6 +45,29 @@ from . import registry
 from . import auth
 from . import audit
 
+# ---------------------------------------------------------------------------
+# Simple in-memory rate limiter for control endpoints
+# ---------------------------------------------------------------------------
+
+class _RateLimiter:
+    """Simple in-memory rate limiter for control endpoints."""
+
+    def __init__(self, max_calls: int = 10, window_seconds: int = 60):
+        self._max_calls = max_calls
+        self._window = window_seconds
+        self._calls: dict[str, list[float]] = defaultdict(list)
+
+    def check(self, key: str) -> bool:
+        now = time.time()
+        self._calls[key] = [t for t in self._calls[key] if now - t < self._window]
+        if len(self._calls[key]) >= self._max_calls:
+            return False
+        self._calls[key].append(now)
+        return True
+
+
+_control_limiter = _RateLimiter(max_calls=10, window_seconds=60)
+
 # Set up logging
 logger = logging.getLogger(__name__)
 
@@ -188,7 +213,7 @@ class ConnectionManager:
 
 
 manager = ConnectionManager()
-start_time = datetime.now()
+start_time = datetime.now(timezone.utc)
 
 
 @asynccontextmanager
@@ -217,8 +242,8 @@ app.add_middleware(
     CORSMiddleware,
     allow_origins=[o.strip() for o in _cors_origins if o.strip()],
     allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
+    allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+    allow_headers=["Content-Type", "Authorization", "X-Requested-With"],
 )
 
 # Static file serving is configured at the end of the file (after all API routes)
@@ -236,7 +261,7 @@ async def health_check() -> dict[str, str]:
 async def get_status() -> StatusResponse:
     """Get system status from .loki/ session files."""
     loki_dir = _get_loki_dir()
-    uptime = (datetime.now() - start_time).total_seconds()
+    uptime = (datetime.now(timezone.utc) - start_time).total_seconds()
 
     # Read dashboard-state.json (written by run.sh every 2 seconds)
     state_file = loki_dir / "dashboard-state.json"
@@ -440,7 +465,7 @@ async def get_project(
     )
 
 
-@app.put("/api/projects/{project_id}", response_model=ProjectResponse)
+@app.put("/api/projects/{project_id}", response_model=ProjectResponse, dependencies=[Depends(auth.require_scope("control"))])
 async def update_project(
     project_id: int,
     project_update: ProjectUpdate,
@@ -486,7 +511,7 @@ async def update_project(
     )
 
 
-@app.delete("/api/projects/{project_id}", status_code=204)
+@app.delete("/api/projects/{project_id}", status_code=204, dependencies=[Depends(auth.require_scope("control"))])
 async def delete_project(
     project_id: int,
     db: AsyncSession = Depends(get_db),
@@ -662,7 +687,7 @@ async def get_task(
     return TaskResponse.model_validate(task)
 
 
-@app.put("/api/tasks/{task_id}", response_model=TaskResponse)
+@app.put("/api/tasks/{task_id}", response_model=TaskResponse, dependencies=[Depends(auth.require_scope("control"))])
 async def update_task(
     task_id: int,
     task_update: TaskUpdate,
@@ -681,7 +706,7 @@ async def update_task(
 
     # Handle status change to completed
     if "status" in update_data and update_data["status"] == TaskStatus.DONE:
-        update_data["completed_at"] = datetime.now()
+        update_data["completed_at"] = datetime.now(timezone.utc)
 
     for field, value in update_data.items():
         setattr(task, field, value)
@@ -703,7 +728,7 @@ async def update_task(
     return TaskResponse.model_validate(task)
 
 
-@app.delete("/api/tasks/{task_id}", status_code=204)
+@app.delete("/api/tasks/{task_id}", status_code=204, dependencies=[Depends(auth.require_scope("control"))])
 async def delete_task(
     task_id: int,
     db: AsyncSession = Depends(get_db),
@@ -748,7 +773,7 @@ async def move_task(
 
     # Set completed_at if moving to completed
     if move.status == TaskStatus.DONE and old_status != TaskStatus.DONE:
-        task.completed_at = datetime.now()
+        task.completed_at = datetime.now(timezone.utc)
     elif move.status != TaskStatus.DONE:
         task.completed_at = None
 
@@ -890,7 +915,7 @@ async def get_registered_project(identifier: str):
     return project
 
 
-@app.delete("/api/registry/projects/{identifier}", status_code=204)
+@app.delete("/api/registry/projects/{identifier}", status_code=204, dependencies=[Depends(auth.require_scope("control"))])
 async def unregister_project(identifier: str):
     """Remove a project from the registry."""
     if not registry.unregister_project(identifier):
@@ -1028,7 +1053,7 @@ async def list_tokens(include_revoked: bool = False):
     return auth.list_tokens(include_revoked=include_revoked)
 
 
-@app.delete("/api/enterprise/tokens/{identifier}")
+@app.delete("/api/enterprise/tokens/{identifier}", dependencies=[Depends(auth.require_scope("admin"))])
 async def revoke_token(identifier: str, permanent: bool = False):
     """
     Revoke or delete a token (enterprise only).
@@ -1135,10 +1160,10 @@ _SAFE_ID_RE = re.compile(r'^[a-zA-Z0-9_-]+$')
 
 def _sanitize_agent_id(agent_id: str) -> str:
     """Validate agent_id contains only safe characters for file paths."""
-    if not agent_id or ".." in agent_id or not _SAFE_ID_RE.match(agent_id):
+    if not agent_id or len(agent_id) > 128 or ".." in agent_id or not _SAFE_ID_RE.match(agent_id):
         raise HTTPException(
             status_code=400,
-            detail="Invalid agent_id: must contain only alphanumeric characters, hyphens, and underscores",
+            detail="Invalid agent_id: must be 1-128 chars of alphanumeric, hyphens, and underscores",
         )
     return agent_id
 
@@ -1606,18 +1631,22 @@ def _read_events(time_range: str = "7d") -> list:
 
 
 # Session control endpoints (proxy to control.py functions)
-@app.post("/api/control/pause")
+@app.post("/api/control/pause", dependencies=[Depends(auth.require_scope("control"))])
 async def pause_session():
     """Pause the current session by creating PAUSE file."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     pause_file = _get_loki_dir() / "PAUSE"
     pause_file.parent.mkdir(parents=True, exist_ok=True)
-    pause_file.write_text(datetime.now().isoformat())
+    pause_file.write_text(datetime.now(timezone.utc).isoformat())
     return {"success": True, "message": "Session paused"}
 
 
-@app.post("/api/control/resume")
+@app.post("/api/control/resume", dependencies=[Depends(auth.require_scope("control"))])
 async def resume_session():
     """Resume a paused session by removing PAUSE/STOP files."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     for fname in ["PAUSE", "STOP"]:
         fpath = _get_loki_dir() / fname
         try:
@@ -1627,12 +1656,14 @@ async def resume_session():
     return {"success": True, "message": "Session resumed"}
 
 
-@app.post("/api/control/stop")
+@app.post("/api/control/stop", dependencies=[Depends(auth.require_scope("control"))])
 async def stop_session():
     """Stop the session by creating STOP file and sending SIGTERM."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     stop_file = _get_loki_dir() / "STOP"
     stop_file.parent.mkdir(parents=True, exist_ok=True)
-    stop_file.write_text(datetime.now().isoformat())
+    stop_file.write_text(datetime.now(timezone.utc).isoformat())
 
     # Try to kill the process
     pid_file = _get_loki_dir() / "loki.pid"
@@ -1979,7 +2010,7 @@ async def force_council_review():
     signal_dir = _get_loki_dir() / "signals"
     signal_dir.mkdir(parents=True, exist_ok=True)
     (signal_dir / "COUNCIL_REVIEW_REQUESTED").write_text(
-        datetime.now().isoformat()
+        datetime.now(timezone.utc).isoformat()
     )
     return {"success": True, "message": "Council review requested"}
 
@@ -1990,15 +2021,15 @@ async def force_council_review():
 
 class CheckpointCreate(BaseModel):
     """Schema for creating a checkpoint."""
-    message: Optional[str] = Field(None, description="Optional description for the checkpoint")
+    message: Optional[str] = Field(None, max_length=500, description="Optional description for the checkpoint")
 
 
 def _sanitize_checkpoint_id(checkpoint_id: str) -> str:
     """Validate checkpoint_id contains only safe characters for file paths."""
-    if not checkpoint_id or ".." in checkpoint_id or not _SAFE_ID_RE.match(checkpoint_id):
+    if not checkpoint_id or len(checkpoint_id) > 128 or ".." in checkpoint_id or not _SAFE_ID_RE.match(checkpoint_id):
         raise HTTPException(
             status_code=400,
-            detail="Invalid checkpoint_id: must contain only alphanumeric characters, hyphens, and underscores",
+            detail="Invalid checkpoint_id: must be 1-128 chars of alphanumeric, hyphens, and underscores",
         )
     return checkpoint_id
 
@@ -2132,7 +2163,7 @@ async def create_checkpoint(body: CheckpointCreate = None):
 # =============================================================================
 
 @app.get("/api/agents")
-async def get_agents():
+async def get_agents(token: Optional[dict] = Depends(auth.get_current_token)):
     """Get all active and recent agents."""
     agents_file = _get_loki_dir() / "state" / "agents.json"
     agents = []
@@ -2187,9 +2218,11 @@ async def get_agents():
     return agents
 
 
-@app.post("/api/agents/{agent_id}/kill")
+@app.post("/api/agents/{agent_id}/kill", dependencies=[Depends(auth.require_scope("control"))])
 async def kill_agent(agent_id: str):
     """Kill a specific agent by ID."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     agent_id = _sanitize_agent_id(agent_id)
     agents_file = _get_loki_dir() / "state" / "agents.json"
     if not agents_file.exists():
@@ -2234,21 +2267,25 @@ async def kill_agent(agent_id: str):
         )
 
 
-@app.post("/api/agents/{agent_id}/pause")
+@app.post("/api/agents/{agent_id}/pause", dependencies=[Depends(auth.require_scope("control"))])
 async def pause_agent(agent_id: str):
     """Pause a specific agent by writing a pause signal."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     agent_id = _sanitize_agent_id(agent_id)
     signal_dir = _get_loki_dir() / "signals"
     signal_dir.mkdir(parents=True, exist_ok=True)
     (signal_dir / f"PAUSE_AGENT_{agent_id}").write_text(
-        datetime.now().isoformat()
+        datetime.now(timezone.utc).isoformat()
     )
     return {"success": True, "message": f"Pause signal sent to agent {agent_id}"}
 
 
-@app.post("/api/agents/{agent_id}/resume")
+@app.post("/api/agents/{agent_id}/resume", dependencies=[Depends(auth.require_scope("control"))])
 async def resume_agent(agent_id: str):
     """Resume a paused agent."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     agent_id = _sanitize_agent_id(agent_id)
     signal_file = _get_loki_dir() / "signals" / f"PAUSE_AGENT_{agent_id}"
     try:
@@ -2259,7 +2296,7 @@ async def resume_agent(agent_id: str):
 
 
 @app.get("/api/logs")
-async def get_logs(lines: int = 100):
+async def get_logs(lines: int = 100, token: Optional[dict] = Depends(auth.get_current_token)):
     """Get recent log entries from session log files."""
     log_dir = _get_loki_dir() / "logs"
     entries = []
@@ -2290,7 +2327,7 @@ async def get_logs(lines: int = 100):
         for log_file in log_files[:1]:
             try:
                 # Use file mtime as fallback timestamp
-                file_mtime = datetime.fromtimestamp(log_file.stat().st_mtime).strftime(
+                file_mtime = datetime.fromtimestamp(log_file.stat().st_mtime, tz=timezone.utc).strftime(
                     "%Y-%m-%dT%H:%M:%S"
                 )
                 content = log_file.read_text()