loki-mode 5.35.0 → 5.37.0

package/dashboard/server.py

@@ -8,6 +8,8 @@ import asyncio
 import json
 import logging
 import os
+import time
+from collections import defaultdict
 from contextlib import asynccontextmanager
 from datetime import datetime, timedelta, timezone
 from pathlib import Path as _Path
@@ -19,6 +21,7 @@ from fastapi import (
     FastAPI,
     HTTPException,
     Query,
+    Request,
     WebSocket,
     WebSocketDisconnect,
 )
@@ -42,6 +45,37 @@ from .models import (
 from . import registry
 from . import auth
 from . import audit
+from . import secrets as secrets_mod
+
+# ---------------------------------------------------------------------------
+# TLS Configuration (optional - disabled by default)
+# Set both LOKI_TLS_CERT and LOKI_TLS_KEY to enable HTTPS
+# ---------------------------------------------------------------------------
+LOKI_TLS_CERT = os.environ.get("LOKI_TLS_CERT", "")  # Path to PEM certificate
+LOKI_TLS_KEY = os.environ.get("LOKI_TLS_KEY", "")    # Path to PEM private key
+
+# ---------------------------------------------------------------------------
+# Simple in-memory rate limiter for control endpoints
+# ---------------------------------------------------------------------------
+
+class _RateLimiter:
+    """Simple in-memory rate limiter for control endpoints."""
+
+    def __init__(self, max_calls: int = 10, window_seconds: int = 60):
+        self._max_calls = max_calls
+        self._window = window_seconds
+        self._calls: dict[str, list[float]] = defaultdict(list)
+
+    def check(self, key: str) -> bool:
+        now = time.time()
+        self._calls[key] = [t for t in self._calls[key] if now - t < self._window]
+        if len(self._calls[key]) >= self._max_calls:
+            return False
+        self._calls[key].append(now)
+        return True
+
+
+_control_limiter = _RateLimiter(max_calls=10, window_seconds=60)
 
 # Set up logging
 logger = logging.getLogger(__name__)
@@ -440,7 +474,7 @@ async def get_project(
     )
 
 
-@app.put("/api/projects/{project_id}", response_model=ProjectResponse)
+@app.put("/api/projects/{project_id}", response_model=ProjectResponse, dependencies=[Depends(auth.require_scope("control"))])
 async def update_project(
     project_id: int,
     project_update: ProjectUpdate,
@@ -486,9 +520,10 @@ async def update_project(
     )
 
 
-@app.delete("/api/projects/{project_id}", status_code=204)
+@app.delete("/api/projects/{project_id}", status_code=204, dependencies=[Depends(auth.require_scope("control"))])
 async def delete_project(
     project_id: int,
+    request: Request,
     db: AsyncSession = Depends(get_db),
 ) -> None:
     """Delete a project."""
@@ -500,6 +535,14 @@ async def delete_project(
     if not project:
         raise HTTPException(status_code=404, detail="Project not found")
 
+    audit.log_event(
+        action="delete",
+        resource_type="project",
+        resource_id=str(project_id),
+        details={"name": project.name},
+        ip_address=request.client.host if request.client else None,
+    )
+
     await db.delete(project)
 
     # Broadcast update
@@ -662,7 +705,7 @@ async def get_task(
     return TaskResponse.model_validate(task)
 
 
-@app.put("/api/tasks/{task_id}", response_model=TaskResponse)
+@app.put("/api/tasks/{task_id}", response_model=TaskResponse, dependencies=[Depends(auth.require_scope("control"))])
 async def update_task(
     task_id: int,
     task_update: TaskUpdate,
@@ -703,9 +746,10 @@ async def update_task(
     return TaskResponse.model_validate(task)
 
 
-@app.delete("/api/tasks/{task_id}", status_code=204)
+@app.delete("/api/tasks/{task_id}", status_code=204, dependencies=[Depends(auth.require_scope("control"))])
 async def delete_task(
     task_id: int,
+    request: Request,
     db: AsyncSession = Depends(get_db),
 ) -> None:
     """Delete a task."""
@@ -718,6 +762,15 @@ async def delete_task(
         raise HTTPException(status_code=404, detail="Task not found")
 
     project_id = task.project_id
+
+    audit.log_event(
+        action="delete",
+        resource_type="task",
+        resource_id=str(task_id),
+        details={"project_id": project_id, "title": task.title},
+        ip_address=request.client.host if request.client else None,
+    )
+
     await db.delete(task)
 
     # Broadcast update
@@ -890,12 +943,19 @@ async def get_registered_project(identifier: str):
     return project
 
 
-@app.delete("/api/registry/projects/{identifier}", status_code=204)
-async def unregister_project(identifier: str):
+@app.delete("/api/registry/projects/{identifier}", status_code=204, dependencies=[Depends(auth.require_scope("control"))])
+async def unregister_project(identifier: str, request: Request):
     """Remove a project from the registry."""
     if not registry.unregister_project(identifier):
         raise HTTPException(status_code=404, detail="Project not found in registry")
 
+    audit.log_event(
+        action="delete",
+        resource_type="registry_project",
+        resource_id=identifier,
+        ip_address=request.client.host if request.client else None,
+    )
+
 
 @app.get("/api/registry/projects/{identifier}/health", response_model=HealthResponse)
 async def get_project_health(identifier: str):
@@ -958,8 +1018,24 @@ async def get_enterprise_status():
     """Check which enterprise features are enabled."""
     return {
         "auth_enabled": auth.is_enterprise_mode(),
+        "oidc_enabled": auth.is_oidc_mode(),
         "audit_enabled": audit.is_audit_enabled(),
-        "enterprise_mode": auth.is_enterprise_mode() or audit.is_audit_enabled(),
+        "enterprise_mode": auth.is_enterprise_mode() or auth.is_oidc_mode() or audit.is_audit_enabled(),
+    }
+
+
+@app.get("/api/auth/info")
+async def get_auth_info():
+    """Get authentication configuration info (public endpoint).
+
+    Returns which auth methods are available so clients can determine
+    how to authenticate (token-based, OIDC/SSO, or anonymous).
+    """
+    return {
+        "token_auth_enabled": auth.ENTERPRISE_AUTH_ENABLED,
+        "oidc_enabled": auth.OIDC_ENABLED,
+        "oidc_issuer": auth.OIDC_ISSUER if auth.OIDC_ENABLED else None,
+        "oidc_client_id": auth.OIDC_CLIENT_ID if auth.OIDC_ENABLED else None,
     }
 
 
@@ -1028,7 +1104,7 @@ async def list_tokens(include_revoked: bool = False):
     return auth.list_tokens(include_revoked=include_revoked)
 
 
-@app.delete("/api/enterprise/tokens/{identifier}")
+@app.delete("/api/enterprise/tokens/{identifier}", dependencies=[Depends(auth.require_scope("admin"))])
 async def revoke_token(identifier: str, permanent: bool = False):
     """
     Revoke or delete a token (enterprise only).
@@ -1063,7 +1139,7 @@ async def revoke_token(identifier: str, permanent: bool = False):
     return {"status": "ok", "action": action, "identifier": identifier}
 
 
-# Audit log endpoints (only active when LOKI_ENTERPRISE_AUDIT=true)
+# Audit log endpoints (enabled by default, disable with LOKI_AUDIT_DISABLED=true)
 class AuditQueryParams(BaseModel):
     """Query parameters for audit logs."""
     start_date: Optional[str] = None
@@ -1095,7 +1171,7 @@ async def query_audit_logs(
     if not audit.is_audit_enabled():
         raise HTTPException(
             status_code=403,
-            detail="Enterprise audit logging not enabled. Set LOKI_ENTERPRISE_AUDIT=true"
+            detail="Audit logging is disabled. Remove LOKI_AUDIT_DISABLED or set LOKI_ENTERPRISE_AUDIT=true"
         )
 
     return audit.query_logs(
@@ -1111,11 +1187,11 @@ async def query_audit_logs(
 
 @app.get("/api/enterprise/audit/summary")
 async def get_audit_summary(days: int = 7):
-    """Get audit activity summary (enterprise only)."""
+    """Get audit activity summary."""
     if not audit.is_audit_enabled():
         raise HTTPException(
             status_code=403,
-            detail="Enterprise audit logging not enabled"
+            detail="Audit logging is disabled. Remove LOKI_AUDIT_DISABLED or set LOKI_ENTERPRISE_AUDIT=true"
         )
 
     return audit.get_audit_summary(days=days)
@@ -1606,18 +1682,22 @@ def _read_events(time_range: str = "7d") -> list:
 
 
 # Session control endpoints (proxy to control.py functions)
-@app.post("/api/control/pause")
+@app.post("/api/control/pause", dependencies=[Depends(auth.require_scope("control"))])
 async def pause_session():
     """Pause the current session by creating PAUSE file."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     pause_file = _get_loki_dir() / "PAUSE"
     pause_file.parent.mkdir(parents=True, exist_ok=True)
     pause_file.write_text(datetime.now(timezone.utc).isoformat())
     return {"success": True, "message": "Session paused"}
 
 
-@app.post("/api/control/resume")
+@app.post("/api/control/resume", dependencies=[Depends(auth.require_scope("control"))])
 async def resume_session():
     """Resume a paused session by removing PAUSE/STOP files."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     for fname in ["PAUSE", "STOP"]:
         fpath = _get_loki_dir() / fname
         try:
@@ -1627,9 +1707,19 @@ async def resume_session():
     return {"success": True, "message": "Session resumed"}
 
 
-@app.post("/api/control/stop")
-async def stop_session():
+@app.post("/api/control/stop", dependencies=[Depends(auth.require_scope("control"))])
+async def stop_session(request: Request):
     """Stop the session by creating STOP file and sending SIGTERM."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
+
+    audit.log_event(
+        action="stop",
+        resource_type="session",
+        details={"source": "api"},
+        ip_address=request.client.host if request.client else None,
+    )
+
     stop_file = _get_loki_dir() / "STOP"
     stop_file.parent.mkdir(parents=True, exist_ok=True)
     stop_file.write_text(datetime.now(timezone.utc).isoformat())
@@ -1811,6 +1901,62 @@ async def get_cost():
     }
 
 
+@app.get("/api/budget")
+async def get_budget():
+    """Get current budget status from .loki/metrics/budget.json and cost data."""
+    loki_dir = _get_loki_dir()
+    budget_file = loki_dir / "metrics" / "budget.json"
+    signals_dir = loki_dir / "signals"
+
+    # Read budget configuration
+    budget_limit = None
+    budget_used = 0.0
+    exceeded = False
+    exceeded_at = None
+
+    if budget_file.exists():
+        try:
+            budget_data = json.loads(budget_file.read_text())
+            budget_limit = budget_data.get("limit") or budget_data.get("budget_limit")
+            budget_used = budget_data.get("budget_used", 0.0)
+            exceeded = budget_data.get("exceeded", False)
+            exceeded_at = budget_data.get("exceeded_at")
+        except (json.JSONDecodeError, KeyError):
+            pass
+
+    # Also check env var for limit if not in file
+    if budget_limit is None:
+        env_limit = os.environ.get("LOKI_BUDGET_LIMIT", "")
+        if env_limit:
+            try:
+                budget_limit = float(env_limit)
+            except ValueError:
+                pass
+
+    # Check for budget exceeded signal
+    signal_file = signals_dir / "BUDGET_EXCEEDED"
+    if signal_file.exists():
+        exceeded = True
+        if exceeded_at is None:
+            try:
+                sig_data = json.loads(signal_file.read_text())
+                exceeded_at = sig_data.get("timestamp")
+            except (json.JSONDecodeError, KeyError):
+                pass
+
+    remaining = None
+    if budget_limit is not None:
+        remaining = max(0.0, float(budget_limit) - float(budget_used))
+
+    return {
+        "budget_limit": float(budget_limit) if budget_limit is not None else None,
+        "current_cost": round(float(budget_used), 4),
+        "exceeded": exceeded,
+        "exceeded_at": exceeded_at,
+        "remaining": round(remaining, 4) if remaining is not None else None,
+    }
+
+
 # =============================================================================
 # Pricing API
 # =============================================================================
@@ -2132,7 +2278,7 @@ async def create_checkpoint(body: CheckpointCreate = None):
 # =============================================================================
 
 @app.get("/api/agents")
-async def get_agents():
+async def get_agents(token: Optional[dict] = Depends(auth.get_current_token)):
     """Get all active and recent agents."""
     agents_file = _get_loki_dir() / "state" / "agents.json"
     agents = []
@@ -2187,10 +2333,20 @@ async def get_agents():
     return agents
 
 
-@app.post("/api/agents/{agent_id}/kill")
-async def kill_agent(agent_id: str):
+@app.post("/api/agents/{agent_id}/kill", dependencies=[Depends(auth.require_scope("control"))])
+async def kill_agent(agent_id: str, request: Request):
     """Kill a specific agent by ID."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     agent_id = _sanitize_agent_id(agent_id)
+
+    audit.log_event(
+        action="kill",
+        resource_type="agent",
+        resource_id=agent_id,
+        details={"source": "api"},
+        ip_address=request.client.host if request.client else None,
+    )
     agents_file = _get_loki_dir() / "state" / "agents.json"
     if not agents_file.exists():
         raise HTTPException(404, "No agents file found")
@@ -2234,9 +2390,11 @@ async def kill_agent(agent_id: str):
         )
 
 
-@app.post("/api/agents/{agent_id}/pause")
+@app.post("/api/agents/{agent_id}/pause", dependencies=[Depends(auth.require_scope("control"))])
 async def pause_agent(agent_id: str):
     """Pause a specific agent by writing a pause signal."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     agent_id = _sanitize_agent_id(agent_id)
     signal_dir = _get_loki_dir() / "signals"
     signal_dir.mkdir(parents=True, exist_ok=True)
@@ -2246,9 +2404,11 @@ async def pause_agent(agent_id: str):
     return {"success": True, "message": f"Pause signal sent to agent {agent_id}"}
 
 
-@app.post("/api/agents/{agent_id}/resume")
+@app.post("/api/agents/{agent_id}/resume", dependencies=[Depends(auth.require_scope("control"))])
 async def resume_agent(agent_id: str):
     """Resume a paused agent."""
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     agent_id = _sanitize_agent_id(agent_id)
     signal_file = _get_loki_dir() / "signals" / f"PAUSE_AGENT_{agent_id}"
     try:
@@ -2259,7 +2419,7 @@ async def resume_agent(agent_id: str):
 
 
 @app.get("/api/logs")
-async def get_logs(lines: int = 100):
+async def get_logs(lines: int = 100, token: Optional[dict] = Depends(auth.get_current_token)):
     """Get recent log entries from session log files."""
     log_dir = _get_loki_dir() / "logs"
     entries = []
@@ -2340,6 +2500,90 @@ except ImportError as e:
     logger.debug(f"Collaboration module not available: {e}")
 
 
+# =============================================================================
+# Secrets / Credential Status
+# =============================================================================
+
+@app.get("/api/secrets/status", dependencies=[Depends(auth.require_scope("admin"))])
+async def get_secrets_status():
+    """Get API key status (masked, validation, source). Admin only."""
+    result = secrets_mod.load_secrets()
+    rotated = secrets_mod.check_rotation(
+        str(_get_loki_dir() / "state" / "key-fingerprints.json")
+    )
+    return {
+        "keys": result,
+        "rotated_since_last_check": rotated,
+    }
+
+
+# =============================================================================
+# Process Health / Watchdog API
+# =============================================================================
+
+
+@app.get("/api/health/processes")
+async def get_process_health(token: Optional[dict] = Depends(auth.get_current_token)):
+    """Get health status of all loki processes (dashboard, session, agents)."""
+    result: dict[str, Any] = {"dashboard": None, "session": None, "agents": []}
+
+    loki_dir = _get_loki_dir()
+
+    # Dashboard PID
+    dpid_file = loki_dir / "dashboard" / "dashboard.pid"
+    if dpid_file.exists():
+        try:
+            dpid = int(dpid_file.read_text().strip())
+            try:
+                os.kill(dpid, 0)
+                result["dashboard"] = {"pid": dpid, "status": "alive"}
+            except OSError:
+                result["dashboard"] = {"pid": dpid, "status": "dead"}
+        except (ValueError, OSError):
+            pass
+
+    # Session PID
+    spid_file = loki_dir / "loki.pid"
+    if spid_file.exists():
+        try:
+            spid = int(spid_file.read_text().strip())
+            try:
+                os.kill(spid, 0)
+                result["session"] = {"pid": spid, "status": "alive"}
+            except OSError:
+                result["session"] = {"pid": spid, "status": "dead"}
+        except (ValueError, OSError):
+            pass
+
+    # Agent PIDs
+    agents_file = loki_dir / "state" / "agents.json"
+    if agents_file.exists():
+        try:
+            agents = json.loads(agents_file.read_text())
+            for agent in agents:
+                pid = agent.get("pid")
+                status = "unknown"
+                if pid:
+                    try:
+                        os.kill(int(pid), 0)
+                        status = "alive"
+                    except (OSError, ValueError):
+                        status = "dead"
+                result["agents"].append({
+                    "id": agent.get("id", ""),
+                    "name": agent.get("name", ""),
+                    "pid": pid,
+                    "status": status,
+                })
+        except Exception:
+            pass
+
+    watchdog_enabled = os.environ.get("LOKI_WATCHDOG", "false").lower() == "true"
+    result["watchdog_enabled"] = watchdog_enabled
+
+    return result
+
+
 # =============================================================================
 # Static File Serving (Production/Docker)
 # =============================================================================
@@ -2445,7 +2689,20 @@ def run_server(host: str = None, port: int = None) -> None:
         host = os.environ.get("LOKI_DASHBOARD_HOST", "127.0.0.1")
     if port is None:
         port = int(os.environ.get("LOKI_DASHBOARD_PORT", "57374"))
-    uvicorn.run(app, host=host, port=port)
+
+    uvicorn_kwargs = {
+        "host": host,
+        "port": port,
+        "log_level": "info",
+    }
+
+    # Enable TLS if both cert and key are provided
+    if LOKI_TLS_CERT and LOKI_TLS_KEY:
+        uvicorn_kwargs["ssl_certfile"] = LOKI_TLS_CERT
+        uvicorn_kwargs["ssl_keyfile"] = LOKI_TLS_KEY
+        logger.info("TLS enabled: cert=%s key=%s", LOKI_TLS_CERT, LOKI_TLS_KEY)
+
+    uvicorn.run(app, **uvicorn_kwargs)
 
 
 if __name__ == "__main__":

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Complete installation instructions for all platforms and use cases.
 
-**Version:** v5.35.0
+**Version:** v5.37.0
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loki-mode",
-  "version": "5.35.0",
+  "version": "5.37.0",
   "description": "Multi-agent autonomous startup system for Claude Code, Codex CLI, and Gemini CLI",
   "keywords": [
     "claude",