loki-mode 6.37.2 → 6.37.4

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Multi-agent autonomous startup system. Triggers on "Loki Mode". Takes PRD to deployed product with minimal human intervention. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v6.37.2
+# Loki Mode v6.37.4
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -267,4 +267,4 @@ The following features are documented in skill modules but not yet fully automat
 | Quality gates 3-reviewer system | Implemented (v5.35.0) | 5 specialist reviewers in `skills/quality-gates.md`; execution in run.sh |
 | Benchmarks (HumanEval, SWE-bench) | Infrastructure only | Runner scripts and datasets exist in `benchmarks/`; no published results |
 
-**v6.37.2 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v6.37.4 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-6.37.2
+6.37.4

package/autonomy/loki

@@ -7788,6 +7788,36 @@ print(json.dumps({'id': manifest.id, 'dir': str(pipeline.migration_dir)}))
         phases_to_run=("understand" "guardrail" "migrate" "verify")
     fi
 
+    # Validate prerequisite artifacts exist before running phases (#81)
+    for p in "${phases_to_run[@]}"; do
+        case "$p" in
+            guardrail)
+                if [ ! -f "${migration_dir}/docs/analysis.md" ] || [ ! -f "${migration_dir}/seams.json" ]; then
+                    echo -e "${RED}Error: Phase 'guardrail' requires artifacts from 'understand' phase${NC}"
+                    echo -e "${DIM}  Missing: analysis.md or seams.json in ${migration_dir}${NC}"
+                    echo "Run: loki migrate ${codebase_path} --target ${target} --phase understand"
+                    return 1
+                fi
+                ;;
+            migrate)
+                if [ ! -f "${migration_dir}/features.json" ]; then
+                    echo -e "${RED}Error: Phase 'migrate' requires artifacts from 'guardrail' phase${NC}"
+                    echo -e "${DIM}  Missing: features.json in ${migration_dir}${NC}"
+                    echo "Run: loki migrate ${codebase_path} --target ${target} --phase guardrail"
+                    return 1
+                fi
+                ;;
+            verify)
+                if [ ! -f "${migration_dir}/migration-plan.json" ]; then
+                    echo -e "${RED}Error: Phase 'verify' requires migration-plan.json from 'migrate' phase${NC}"
+                    echo -e "${DIM}  Missing: migration-plan.json in ${migration_dir}${NC}"
+                    echo "Run: loki migrate ${codebase_path} --target ${target} --phase migrate"
+                    return 1
+                fi
+                ;;
+        esac
+    done
+
     # Execute phases
     for p in "${phases_to_run[@]}"; do
         echo -e "${CYAN}[Phase: ${p}]${NC} Starting..."
@@ -12595,24 +12625,32 @@ cmd_council() {
 
             if [ -f "$council_dir/state.json" ]; then
                 LOKI_COUNCIL_STATE="$council_dir/state.json" python3 -c "
-import json, os
-with open(os.environ['LOKI_COUNCIL_STATE']) as f:
-    state = json.load(f)
-print(f\"Enabled: {state.get('initialized', False)}\")
-print(f\"Total votes: {state.get('total_votes', 0)}\")
-print(f\"Approve votes: {state.get('approve_votes', 0)}\")
-print(f\"Reject votes: {state.get('reject_votes', 0)}\")
-print(f\"Stagnation streak: {state.get('consecutive_no_change', 0)}\")
-print(f\"Done signals: {state.get('done_signals', 0)}\")
-print(f\"Last check: iteration {state.get('last_check_iteration', 'none')}\")
-verdicts = state.get('verdicts', [])
-if verdicts:
-    print(f\"\nRecent verdicts:\")
-    for v in verdicts[-5:]:
-        print(f\"  Iteration {v['iteration']}: {v['result']} ({v['approve']} approve / {v['reject']} reject)\")
-else:
-    print(f\"\nNo verdicts yet\")
-" 2>/dev/null
+import json, os, sys
+try:
+    with open(os.environ['LOKI_COUNCIL_STATE']) as f:
+        state = json.load(f)
+    print(f\"Enabled: {state.get('initialized', False)}\")
+    print(f\"Total votes: {state.get('total_votes', 0)}\")
+    print(f\"Approve votes: {state.get('approve_votes', 0)}\")
+    print(f\"Reject votes: {state.get('reject_votes', 0)}\")
+    print(f\"Stagnation streak: {state.get('consecutive_no_change', 0)}\")
+    print(f\"Done signals: {state.get('done_signals', 0)}\")
+    print(f\"Last check: iteration {state.get('last_check_iteration', 'none')}\")
+    verdicts = state.get('verdicts', [])
+    if verdicts:
+        print(f\"\nRecent verdicts:\")
+        for v in verdicts[-5:]:
+            print(f\"  Iteration {v['iteration']}: {v['result']} ({v['approve']} approve / {v['reject']} reject)\")
+    else:
+        print(f\"\nNo verdicts yet\")
+except (json.JSONDecodeError, KeyError, TypeError) as e:
+    print(f'Error: Council state file is corrupted or invalid: {e}', file=sys.stderr)
+    print('Delete .loki/council/state.json and restart the session to reset.')
+    sys.exit(1)
+except Exception as e:
+    print(f'Error reading council state: {e}', file=sys.stderr)
+    sys.exit(1)
+" 2>&1
             else
                 echo "Council state file not found"
             fi
@@ -12623,9 +12661,14 @@ else:
 
             if [ -f "$council_dir/state.json" ]; then
                 LOKI_COUNCIL_STATE="$council_dir/state.json" python3 -c "
-import json, os
-with open(os.environ['LOKI_COUNCIL_STATE']) as f:
-    state = json.load(f)
+import json, os, sys
+try:
+    with open(os.environ['LOKI_COUNCIL_STATE']) as f:
+        state = json.load(f)
+except (json.JSONDecodeError, KeyError, TypeError) as e:
+    print(f'Error: Council state file is corrupted: {e}', file=sys.stderr)
+    print('Delete .loki/council/state.json and restart the session to reset.')
+    sys.exit(1)
 verdicts = state.get('verdicts', [])
 if not verdicts:
     print('No decisions recorded yet')

package/autonomy/run.sh

@@ -5502,10 +5502,11 @@ run_code_review() {
     log_info "Selecting 3 specialist reviewers from pool..."
 
     # Write diff/files to temp files for python to read (avoid env var size limits)
+    # Use printf to prevent shell variable expansion in diff content (#78)
     local diff_file="$review_dir/$review_id/diff.txt"
     local files_file="$review_dir/$review_id/files.txt"
-    echo "$diff_content" > "$diff_file"
-    echo "$changed_files" > "$files_file"
+    printf '%s\n' "$diff_content" > "$diff_file"
+    printf '%s\n' "$changed_files" > "$files_file"
 
     # Select specialists via keyword scoring (python3 reads files, not env vars)
     # Loads from agents/types.json when available, falls back to hardcoded pool (v6.7.0)
@@ -5881,11 +5882,11 @@ run_adversarial_testing() {
     local changed_files
     changed_files=$(git -C "${TARGET_DIR:-.}" diff --name-only HEAD~1 2>/dev/null || git -C "${TARGET_DIR:-.}" diff --name-only --cached 2>/dev/null || echo "")
 
-    # Write analysis files
+    # Write analysis files -- use printf to prevent shell variable expansion (#78)
     local diff_file="$adversarial_dir/$test_id/diff.txt"
     local files_file="$adversarial_dir/$test_id/files.txt"
-    echo "$diff_content" > "$diff_file"
-    echo "$changed_files" > "$files_file"
+    printf '%s\n' "$diff_content" > "$diff_file"
+    printf '%s\n' "$changed_files" > "$files_file"
 
     # Build adversarial prompt -- use heredoc with quoted delimiter to prevent
     # shell variable expansion in diff content (fixes #78)

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "6.37.2"
+__version__ = "6.37.4"
 
 # Expose the control app for easy import
 try:

package/dashboard/auth.py

@@ -14,6 +14,7 @@ from __future__ import annotations
 
 import base64
 import hashlib
+import hmac
 import json
 import os
 import secrets
@@ -58,17 +59,29 @@ _SCOPE_HIERARCHY = {
 if OIDC_ENABLED:
     import logging as _logging
     _logger = _logging.getLogger("loki.auth")
+    _pyjwt_available = False
+    try:
+        import jwt as _pyjwt_check  # noqa: F401
+        from jwt import PyJWKClient as _PyJWKClient_check  # noqa: F401
+        _pyjwt_available = True
+    except ImportError:
+        _pyjwt_available = False
+
     if OIDC_SKIP_SIGNATURE_VERIFY:
         _logger.critical(
             "OIDC/SSO signature verification DISABLED (LOKI_OIDC_SKIP_SIGNATURE_VERIFY=true). "
             "This is INSECURE and allows forged JWTs. Only use for local testing. "
             "For production, install PyJWT + cryptography and remove this env var."
         )
+    elif _pyjwt_available:
+        _logger.info(
+            "OIDC/SSO enabled with PyJWT cryptographic signature verification (RS256/RS384/RS512)."
+        )
     else:
-        _logger.warning(
-            "OIDC/SSO enabled (EXPERIMENTAL). Claims-based validation only -- "
-            "JWT signatures are NOT cryptographically verified. Install PyJWT + "
-            "cryptography for production signature verification."
+        _logger.critical(
+            "OIDC/SSO enabled but PyJWT is NOT installed. Tokens will be REJECTED "
+            "unless LOKI_OIDC_SKIP_SIGNATURE_VERIFY=true is set. "
+            "Install PyJWT + cryptography: pip install PyJWT cryptography"
         )
 
 # OIDC JWKS cache (issuer URL -> (keys_dict, fetch_timestamp))
@@ -103,6 +116,9 @@ def _save_tokens(tokens: dict) -> None:
     TOKEN_FILE.touch(mode=0o600, exist_ok=True)
     with open(TOKEN_FILE, "w") as f:
         json.dump(tokens, f, indent=2, default=str)
+    # Enforce 0600 on every write, not just creation -- touch(mode=) only
+    # applies when the file is new, so an external chmod would persist.
+    os.chmod(TOKEN_FILE, 0o600)
 
 
 def _hash_token(token: str, salt: str = None) -> tuple[str, str]:
@@ -123,7 +139,7 @@ def _hash_token(token: str, salt: str = None) -> tuple[str, str]:
 
 def _constant_time_compare(a: str, b: str) -> bool:
     """Constant-time string comparison to prevent timing attacks."""
-    return secrets.compare_digest(a.encode(), b.encode())
+    return hmac.compare_digest(a.encode(), b.encode())
 
 
 def resolve_scopes(role_or_scopes) -> list[str]:
@@ -342,30 +358,35 @@ def validate_token(raw_token: str) -> Optional[dict]:
 
     tokens = _load_tokens()
 
-    # Find matching token (using constant-time comparison to prevent timing attacks)
+    # Iterate ALL tokens to prevent timing side-channel that leaks token count.
+    # Do not short-circuit on match -- always hash and compare every entry.
+    matched_token: Optional[dict] = None
     for token in tokens["tokens"].values():
         stored_salt = token.get("salt", "")
         token_hash, _ = _hash_token(raw_token, salt=stored_salt)
         if _constant_time_compare(token["hash"], token_hash):
-            # Check if revoked
-            if token.get("revoked"):
-                return None
+            matched_token = token
+
+    if matched_token is not None:
+        # Check if revoked
+        if matched_token.get("revoked"):
+            return None
 
-            # Check expiration
-            if token.get("expires_at"):
-                expires = datetime.fromisoformat(token["expires_at"])
-                if datetime.now(timezone.utc) > expires:
-                    return None
+        # Check expiration
+        if matched_token.get("expires_at"):
+            expires = datetime.fromisoformat(matched_token["expires_at"])
+            if datetime.now(timezone.utc) > expires:
+                return None
 
-            # Update last used
-            token["last_used"] = datetime.now(timezone.utc).isoformat()
-            _save_tokens(tokens)
+        # Update last used
+        matched_token["last_used"] = datetime.now(timezone.utc).isoformat()
+        _save_tokens(tokens)
 
-            return {
-                "id": token["id"],
-                "name": token["name"],
-                "scopes": token["scopes"],
-            }
+        return {
+            "id": matched_token["id"],
+            "name": matched_token["name"],
+            "scopes": matched_token["scopes"],
+        }
 
     return None
 
@@ -517,14 +538,18 @@ def validate_oidc_token(token_str: str) -> Optional[dict]:
             "issuer": decoded.get("iss"),
         }
     except ImportError:
-        # PyJWT not installed -- fall through to claims-only path with loud warning
-        _warning_msg = (
-            "WARNING: OIDC JWT signatures are NOT cryptographically verified. "
-            "Install PyJWT with 'pip install PyJWT cryptography' for production use."
+        # PyJWT not installed -- only allow claims-only path if explicitly opted in
+        if not OIDC_SKIP_SIGNATURE_VERIFY:
+            _auth_logger.error(
+                "OIDC token rejected: PyJWT not installed and "
+                "LOKI_OIDC_SKIP_SIGNATURE_VERIFY is not set. "
+                "Install PyJWT: pip install PyJWT cryptography"
+            )
+            return None
+        _auth_logger.warning(
+            "PyJWT not installed -- using claims-only validation "
+            "(LOKI_OIDC_SKIP_SIGNATURE_VERIFY=true). This is INSECURE."
         )
-        _auth_logger.warning(_warning_msg)
-        # Also print to stderr so operators notice even without log config
-        print(_warning_msg, file=sys.stderr)
     except Exception as exc:
         _auth_logger.error("PyJWT signature verification failed: %s", exc)
         return None

package/dashboard/server.py

@@ -30,7 +30,7 @@ from fastapi import (
 )
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse, PlainTextResponse
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 from sqlalchemy import select, update, delete
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
@@ -75,6 +75,27 @@ def _safe_int_env(name: str, default: int) -> int:
         return default
 
 
+def _safe_json_read(path: _Path, default: Any = None) -> Any:
+    """Read a JSON file with retry on partial/corrupt data from concurrent writes."""
+    for attempt in range(2):
+        try:
+            text = path.read_text(encoding="utf-8", errors="replace")
+            return json.loads(text)
+        except json.JSONDecodeError:
+            if attempt == 0:
+                time.sleep(0.1)
+                continue
+            return default
+        except (OSError, IOError):
+            return default
+    return default
+
+
+def _safe_read_text(path: _Path) -> str:
+    """Read a text file with UTF-8 encoding, replacing non-UTF-8 bytes."""
+    return open(path, encoding="utf-8", errors="replace").read()
+
+
 # ---------------------------------------------------------------------------
 # Simple in-memory rate limiter for control endpoints
 # ---------------------------------------------------------------------------
@@ -98,12 +119,12 @@ class _RateLimiter:
         for k in empty_keys:
             del self._calls[k]
 
-        # Evict oldest keys if max_keys exceeded
+        # Evict least-recently-accessed keys if max_keys exceeded
         if len(self._calls) > self._max_keys:
-            # Sort by oldest timestamp, remove oldest keys
+            # Sort by last-access time (most recent timestamp), evict least recent
             sorted_keys = sorted(
                 self._calls.items(),
-                key=lambda x: min(x[1]) if x[1] else 0
+                key=lambda x: max(x[1]) if x[1] else 0
             )
             keys_to_remove = len(self._calls) - self._max_keys
             for k, _ in sorted_keys[:keys_to_remove]:
@@ -123,12 +144,30 @@ logger = logging.getLogger(__name__)
 
 
 # Pydantic schemas for API
+def _sanitize_text_field(value: str) -> str:
+    """Strip/reject control characters from text fields."""
+    import unicodedata
+    # Remove control characters (except common whitespace like space)
+    cleaned = "".join(
+        ch for ch in value if unicodedata.category(ch)[0] != "C" or ch in (" ",)
+    )
+    cleaned = cleaned.strip()
+    if not cleaned:
+        raise ValueError("Field must not be empty after removing control characters")
+    return cleaned
+
+
 class ProjectCreate(BaseModel):
     """Schema for creating a project."""
     name: str = Field(..., min_length=1, max_length=255)
     description: Optional[str] = None
     prd_path: Optional[str] = None
 
+    @field_validator("name")
+    @classmethod
+    def validate_name(cls, v: str) -> str:
+        return _sanitize_text_field(v)
+
 
 class ProjectUpdate(BaseModel):
     """Schema for updating a project."""
@@ -165,6 +204,11 @@ class TaskCreate(BaseModel):
     parent_task_id: Optional[int] = None
     estimated_duration: Optional[int] = None
 
+    @field_validator("title")
+    @classmethod
+    def validate_title(cls, v: str) -> str:
+        return _sanitize_text_field(v)
+
 
 class TaskUpdate(BaseModel):
     """Schema for updating a task."""
@@ -315,7 +359,7 @@ async def _push_loki_state_loop() -> None:
                 if mtime != last_mtime:
                     last_mtime = mtime
                     try:
-                        raw = json.loads(state_file.read_text())
+                        raw = _safe_json_read(state_file, {})
                         # Transform to StatusResponse-compatible format
                         agents_list = raw.get("agents", [])
                         running_agents = len(agents_list) if isinstance(agents_list, list) else 0
@@ -515,10 +559,10 @@ async def get_status() -> StatusResponse:
     pending_tasks = 0
     running_agents = 0
 
-    # Read dashboard state
+    # Read dashboard state (with retry for concurrent writes)
     if state_file.exists():
         try:
-            state = json.loads(state_file.read_text())
+            state = _safe_json_read(state_file, {})
             phase = state.get("phase", "")
             iteration = state.get("iteration", 0)
             complexity = state.get("complexity", "standard")
@@ -561,7 +605,7 @@ async def get_status() -> StatusResponse:
     # Also check session.json for skill-invoked sessions
     if not running and session_file.exists():
         try:
-            sd = json.loads(session_file.read_text())
+            sd = _safe_json_read(session_file, {})
             if sd.get("status") == "running":
                 running = True
         except (json.JSONDecodeError, KeyError):
@@ -673,21 +717,41 @@ async def get_status() -> StatusResponse:
 @app.get("/api/projects", response_model=list[ProjectResponse])
 async def list_projects(
     status: Optional[str] = Query(None),
+    limit: int = Query(default=50, ge=1, le=500),
+    offset: int = Query(default=0, ge=0),
     db: AsyncSession = Depends(get_db),
 ) -> list[ProjectResponse]:
-    """List all projects."""
-    query = select(Project).options(selectinload(Project.tasks))
+    """List projects with pagination. Does not eager-load tasks for efficiency."""
+    from sqlalchemy import func as sa_func
+
+    query = select(Project)
     if status:
         query = query.where(Project.status == status)
-    query = query.order_by(Project.created_at.desc())
+    query = query.order_by(Project.created_at.desc()).offset(offset).limit(limit)
 
     result = await db.execute(query)
     projects = result.scalars().all()
 
+    # Batch-fetch task counts instead of N+1 eager loading
+    project_ids = [p.id for p in projects]
     response = []
+    if project_ids:
+        count_query = (
+            select(
+                Task.project_id,
+                sa_func.count().label("total"),
+                sa_func.count().filter(Task.status == TaskStatus.DONE).label("done"),
+            )
+            .where(Task.project_id.in_(project_ids))
+            .group_by(Task.project_id)
+        )
+        count_result = await db.execute(count_query)
+        counts = {row.project_id: (row.total, row.done) for row in count_result}
+    else:
+        counts = {}
+
     for project in projects:
-        task_count = len(project.tasks)
-        completed_count = len([t for t in project.tasks if t.status == TaskStatus.DONE])
+        total, done = counts.get(project.id, (0, 0))
         response.append(
             ProjectResponse(
                 id=project.id,
@@ -697,8 +761,8 @@ async def list_projects(
                 status=project.status,
                 created_at=project.created_at,
                 updated_at=project.updated_at,
-                task_count=task_count,
-                completed_task_count=completed_count,
+                task_count=total,
+                completed_task_count=done,
             )
         )
     return response
@@ -1066,12 +1130,29 @@ async def create_task(
                 Task.project_id == task.project_id
             )
         )
-        if not result.scalar_one_or_none():
+        parent = result.scalar_one_or_none()
+        if not parent:
             raise HTTPException(
                 status_code=400,
                 detail="Parent task not found or belongs to different project"
             )
 
+        # Detect circular reference: walk parent chain
+        visited = set()
+        current_parent_id = task.parent_task_id
+        while current_parent_id is not None:
+            if current_parent_id in visited:
+                raise HTTPException(
+                    status_code=422,
+                    detail="Circular reference detected in parent task chain"
+                )
+            visited.add(current_parent_id)
+            parent_result = await db.execute(
+                select(Task.parent_task_id).where(Task.id == current_parent_id)
+            )
+            row = parent_result.scalar_one_or_none()
+            current_parent_id = row if row else None
+
     db_task = Task(
         project_id=task.project_id,
         title=task.title,
@@ -1192,6 +1273,15 @@ async def delete_task(
     })
 
 
+# Valid status transitions for task state machine
+_TASK_STATE_MACHINE: dict[TaskStatus, set[TaskStatus]] = {
+    TaskStatus.BACKLOG: {TaskStatus.PENDING},
+    TaskStatus.PENDING: {TaskStatus.IN_PROGRESS},
+    TaskStatus.IN_PROGRESS: {TaskStatus.REVIEW, TaskStatus.DONE},
+    TaskStatus.REVIEW: {TaskStatus.DONE, TaskStatus.IN_PROGRESS},
+}
+
+
 @app.post("/api/tasks/{task_id}/move", response_model=TaskResponse, dependencies=[Depends(auth.require_scope("control"))])
 async def move_task(
     task_id: int,
@@ -1208,6 +1298,18 @@ async def move_task(
         raise HTTPException(status_code=404, detail="Task not found")
 
     old_status = task.status
+
+    # Validate status transition
+    if move.status != old_status:
+        allowed = _TASK_STATE_MACHINE.get(old_status, set())
+        if move.status not in allowed:
+            raise HTTPException(
+                status_code=422,
+                detail=f"Invalid status transition: {old_status.value} -> {move.status.value}. "
+                       f"Allowed transitions from {old_status.value}: "
+                       f"{', '.join(s.value for s in allowed) if allowed else 'none'}",
+            )
+
     task.status = move.status
     task.position = move.position
 
@@ -1252,8 +1354,9 @@ async def websocket_endpoint(websocket: WebSocket) -> None:
     # proxy access logs -- configure log sanitization for /ws in production.
     # FastAPI Depends() is not supported on @app.websocket() routes.
 
-    # Rate limit WebSocket connections by IP
-    client_ip = websocket.client.host if websocket.client else "unknown"
+    # Rate limit WebSocket connections by IP (use unique key when client info unavailable)
+    import uuid as _uuid
+    client_ip = websocket.client.host if websocket.client else f"ws-{_uuid.uuid4().hex}"
     if not _read_limiter.check(f"ws_{client_ip}"):
         await websocket.close(code=1008)  # Policy Violation
         return
@@ -1284,20 +1387,23 @@ async def websocket_endpoint(websocket: WebSocket) -> None:
             "data": {"message": "Connected to Loki Dashboard"},
         })
 
-        # Keep connection alive and handle incoming messages
+        # Keep connection alive and handle incoming messages.
+        # Close idle connections after ~60s of no response to pings.
+        missed_pongs = 0
         while True:
             try:
                 data = await asyncio.wait_for(
                     websocket.receive_text(),
-                    timeout=30.0  # Ping every 30 seconds
+                    timeout=30.0  # Ping every 30 seconds of silence
                 )
-                # Handle incoming messages (e.g., subscriptions)
+                missed_pongs = 0  # any message resets idle counter
                 try:
                     message = json.loads(data)
                     if message.get("type") == "ping":
                         await manager.send_personal(websocket, {"type": "pong"})
+                    elif message.get("type") == "pong":
+                        pass  # client responded to our ping
                     elif message.get("type") == "subscribe":
-                        # Could implement channel subscriptions here
                         await manager.send_personal(websocket, {
                             "type": "subscribed",
                             "data": message.get("data", {}),
@@ -1305,8 +1411,15 @@ async def websocket_endpoint(websocket: WebSocket) -> None:
                 except json.JSONDecodeError as e:
                     logger.debug(f"WebSocket received invalid JSON: {e}")
             except asyncio.TimeoutError:
-                # Send keepalive ping
-                await manager.send_personal(websocket, {"type": "ping"})
+                missed_pongs += 1
+                if missed_pongs >= 2:
+                    # Two consecutive pings with no reply -- close idle connection
+                    logger.info("Closing idle WebSocket (no pong response)")
+                    break
+                try:
+                    await manager.send_personal(websocket, {"type": "ping"})
+                except Exception:
+                    break
 
     except WebSocketDisconnect:
         manager.disconnect(websocket)
@@ -1437,7 +1550,13 @@ async def sync_registry():
     if not _read_limiter.check("registry_sync"):
         raise HTTPException(status_code=429, detail="Rate limit exceeded")
 
-    result = registry.sync_registry_with_discovery()
+    try:
+        result = await asyncio.wait_for(
+            asyncio.get_event_loop().run_in_executor(None, registry.sync_registry_with_discovery),
+            timeout=30.0,
+        )
+    except asyncio.TimeoutError:
+        raise HTTPException(status_code=504, detail="Registry sync timed out after 30 seconds")
     return {
         "added": result["added"],
         "updated": result["updated"],
@@ -1608,7 +1727,7 @@ class AuditQueryParams(BaseModel):
     offset: int = 0
 
 
-@app.get("/api/enterprise/audit")
+@app.get("/api/enterprise/audit", dependencies=[Depends(auth.require_scope("audit"))])
 async def query_audit_logs(
     start_date: Optional[str] = None,
     end_date: Optional[str] = None,
@@ -1640,7 +1759,7 @@ async def query_audit_logs(
     )
 
 
-@app.get("/api/enterprise/audit/summary")
+@app.get("/api/enterprise/audit/summary", dependencies=[Depends(auth.require_scope("audit"))])
 async def get_audit_summary(days: int = 7):
     """Get audit activity summary."""
     if not audit.is_audit_enabled():
@@ -1805,11 +1924,14 @@ async def list_episodes(limit: int = Query(default=50, ge=1, le=1000)):
         except Exception:
             pass
 
-    # Fallback to JSON files
+    # Fallback to JSON files -- use heapq to avoid sorting all files
+    import heapq
     ep_dir = _get_loki_dir() / "memory" / "episodic"
     episodes = []
     if ep_dir.exists():
-        files = sorted(ep_dir.glob("*.json"), reverse=True)[:limit]
+        all_files = ep_dir.glob("*.json")
+        # nlargest by filename (timestamps sort lexicographically) avoids full sort
+        files = heapq.nlargest(limit, all_files, key=lambda f: f.name)
         for f in files:
             try:
                 episodes.append(json.loads(f.read_text()))
@@ -3515,7 +3637,7 @@ async def get_logs(lines: int = 100, token: Optional[dict] = Depends(auth.get_cu
                 file_mtime = datetime.fromtimestamp(log_file.stat().st_mtime, tz=timezone.utc).strftime(
                     "%Y-%m-%dT%H:%M:%S"
                 )
-                content = log_file.read_text()
+                content = _safe_read_text(log_file)
                 for raw_line in content.strip().split("\n")[-lines:]:
                     timestamp = ""
                     level = "info"
@@ -4300,7 +4422,7 @@ async def get_app_runner_logs(lines: int = Query(default=100, ge=1, le=1000)):
     if not log_file.exists():
         return {"lines": []}
     try:
-        all_lines = log_file.read_text().splitlines()
+        all_lines = _safe_read_text(log_file).splitlines()
         return {"lines": all_lines[-lines:]}
     except OSError:
         return {"lines": []}
@@ -4563,25 +4685,16 @@ async def serve_index():
         if os.path.isfile(index_path):
             return FileResponse(index_path, media_type="text/html")
 
-    # Return helpful error message
-    return HTMLResponse(
-        content="""
-        <html>
-        <head><title>Loki Dashboard</title></head>
-        <body style="font-family: system-ui; padding: 40px; max-width: 600px; margin: 0 auto;">
-            <h1>Dashboard Frontend Not Found</h1>
-            <p>The dashboard API is running, but the frontend files were not found.</p>
-            <p>To fix this, run:</p>
-            <pre style="background: #f5f5f5; padding: 15px; border-radius: 5px;">cd dashboard-ui && npm run build</pre>
-            <p><strong>API Endpoints:</strong></p>
-            <ul>
-                <li><a href="/health">/health</a> - Health check</li>
-                <li><a href="/docs">/docs</a> - API documentation</li>
-            </ul>
-        </body>
-        </html>
-        """,
-        status_code=200
+    # Return 503 when frontend files are not found
+    return JSONResponse(
+        content={
+            "error": "dashboard_frontend_not_found",
+            "detail": "The dashboard API is running, but the frontend files were not found. "
+                      "Run: cd dashboard-ui && npm run build",
+            "api_docs": "/docs",
+            "health": "/health",
+        },
+        status_code=503,
     )
 
 

package/dashboard/static/index.html

@@ -1237,7 +1237,7 @@ var LokiDashboard=(()=>{var pt=Object.defineProperty;var Pt=Object.getOwnPropert
       }
 
       ${B}
-    `}getAriaPattern(t){return gt[t]||{}}applyAriaPattern(t,e){let i=this.getAriaPattern(e);for(let[a,s]of Object.entries(i))if(a==="role")t.setAttribute("role",s);else{let r=a.replace(/([A-Z])/g,"-$1").toLowerCase();t.setAttribute(r,s)}}render(){}};var L={realtime:1e3,normal:2e3,background:5e3,offline:1e4},_t={vscode:L.normal,browser:L.realtime,cli:L.background},yt={baseUrl:typeof window<"u"?window.location.origin:"http://localhost:57374",wsUrl:typeof window<"u"?`${window.location.protocol==="https:"?"wss:":"ws:"}//${window.location.host}/ws`:"ws://localhost:57374/ws",pollInterval:2e3,timeout:1e4,retryAttempts:3,retryDelay:1e3},u={CONNECTED:"api:connected",DISCONNECTED:"api:disconnected",ERROR:"api:error",STATUS_UPDATE:"api:status-update",TASK_CREATED:"api:task-created",TASK_UPDATED:"api:task-updated",TASK_DELETED:"api:task-deleted",PROJECT_CREATED:"api:project-created",PROJECT_UPDATED:"api:project-updated",AGENT_UPDATE:"api:agent-update",LOG_MESSAGE:"api:log-message",MEMORY_UPDATE:"api:memory-update",CHECKLIST_UPDATE:"api:checklist-update"},C=class C extends EventTarget{static getInstance(t={}){let e=t.baseUrl||yt.baseUrl;return C._instances.has(e)||C._instances.set(e,new C(t)),C._instances.get(e)}static clearInstances(){C._instances.forEach(t=>t.disconnect()),C._instances.clear()}constructor(t={}){super(),this.config={...yt,...t},this._ws=null,this._connected=!1,this._pollInterval=null,this._reconnectTimeout=null,this._reconnectAttempts=0,this._maxReconnectAttempts=20,this._cache=new Map,this._cacheTimeout=5e3,this._vscodeApi=null,this._context=this._detectContext(),this._currentPollInterval=_t[this._context]||L.normal,this._visibilityChangeHandler=null,this._messageHandler=null,this._setupAdaptivePolling(),this._setupVSCodeBridge()}_detectContext(){return typeof acquireVsCodeApi<"u"?"vscode":typeof window<"u"&&window.location?"browser":"cli"}get context(){return this._context}static get POLL_INTERVALS(){return L}_setupAdaptivePolling(){typeof document>"u"||(this._visibilityChangeHandler=()=>{document.hidden?this._setPollInterval(L.background):this._setPollInterval(_t[this._context]||L.normal)},document.addEventListener("visibilitychange",this._visibilityChangeHandler))}_setPollInterval(t){this._currentPollInterval=t,this._pollInterval&&(this.stopPolling(),this.startPolling(null,t))}setPollMode(t){let e=L[t];e&&this._setPollInterval(e)}_setupVSCodeBridge(){if(!(typeof acquireVsCodeApi>"u")){try{this._vscodeApi=acquireVsCodeApi()}catch{console.warn("VS Code API already acquired or unavailable");return}this._messageHandler=t=>{let e=t.data;if(!(!e||!e.type))switch(e.type){case"updateStatus":this._emit(u.STATUS_UPDATE,e.data);break;case"updateTasks":this._emit(u.TASK_UPDATED,e.data);break;case"taskCreated":this._emit(u.TASK_CREATED,e.data);break;case"taskDeleted":this._emit(u.TASK_DELETED,e.data);break;case"projectCreated":this._emit(u.PROJECT_CREATED,e.data);break;case"projectUpdated":this._emit(u.PROJECT_UPDATED,e.data);break;case"agentUpdate":this._emit(u.AGENT_UPDATE,e.data);break;case"logMessage":this._emit(u.LOG_MESSAGE,e.data);break;case"memoryUpdate":this._emit(u.MEMORY_UPDATE,e.data);break;case"connected":this._connected=!0,this._emit(u.CONNECTED,e.data);break;case"disconnected":this._connected=!1,this._emit(u.DISCONNECTED,e.data);break;case"error":this._emit(u.ERROR,e.data);break;case"setPollMode":this.setPollMode(e.data.mode);break;default:this._emit(`api:${e.type}`,e.data)}},window.addEventListener("message",this._messageHandler)}}get isVSCode(){return this._context==="vscode"}postToVSCode(t,e={}){this._vscodeApi&&this._vscodeApi.postMessage({type:t,data:e})}requestRefresh(){this.postToVSCode("requestRefresh")}notifyVSCode(t,e={}){this.postToVSCode("userAction",{action:t,...e})}get baseUrl(){return this.config.baseUrl}set baseUrl(t){this.config.baseUrl=t,this.config.wsUrl=t.replace(/^http/,"ws")+"/ws"}get isConnected(){return this._connected}async connect(){if(!(this._ws&&this._ws.readyState===WebSocket.OPEN))return new Promise((t,e)=>{try{this._ws=new WebSocket(this.config.wsUrl),this._ws.onopen=()=>{this._connected=!0,this._reconnectAttempts=0,this._emit(u.CONNECTED),t()},this._ws.onclose=()=>{this._connected=!1,this._emit(u.DISCONNECTED),this._scheduleReconnect()},this._ws.onerror=i=>{this._emit(u.ERROR,{error:i}),e(i)},this._ws.onmessage=i=>{try{let a=JSON.parse(i.data);this._handleMessage(a)}catch(a){console.error("Failed to parse WebSocket message:",a)}}}catch(i){e(i)}})}disconnect(){this._ws&&(this._ws.close(),this._ws=null),this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null),this._reconnectTimeout&&(clearTimeout(this._reconnectTimeout),this._reconnectTimeout=null),this._connected=!1,this._cleanupGlobalListeners()}_cleanupGlobalListeners(){this._visibilityChangeHandler&&typeof document<"u"&&(document.removeEventListener("visibilitychange",this._visibilityChangeHandler),this._visibilityChangeHandler=null),this._messageHandler&&typeof window<"u"&&(window.removeEventListener("message",this._messageHandler),this._messageHandler=null)}destroy(){this.disconnect()}_scheduleReconnect(){if(this._reconnectTimeout)return;if(this._reconnectAttempts>=this._maxReconnectAttempts){console.warn("WebSocket max reconnect attempts reached, giving up"),this._emit(u.ERROR,{error:"Max reconnect attempts reached"});return}let t=Math.min(this.config.retryDelay*Math.pow(2,this._reconnectAttempts),3e4);this._reconnectAttempts++,this._reconnectTimeout=setTimeout(()=>{this._reconnectTimeout=null,this.connect().catch(()=>{})},t)}_handleMessage(t){let i={connected:u.CONNECTED,status_update:u.STATUS_UPDATE,task_created:u.TASK_CREATED,task_updated:u.TASK_UPDATED,task_deleted:u.TASK_DELETED,task_moved:u.TASK_UPDATED,project_created:u.PROJECT_CREATED,project_updated:u.PROJECT_UPDATED,agent_update:u.AGENT_UPDATE,log:u.LOG_MESSAGE}[t.type]||`api:${t.type}`;this._emit(i,t.data)}_emit(t,e={}){this.dispatchEvent(new CustomEvent(t,{detail:e}))}async _request(t,e={}){let i=`${this.config.baseUrl}${t}`,a=new AbortController,s=setTimeout(()=>a.abort(),this.config.timeout);try{let r=await fetch(i,{...e,signal:a.signal,headers:{"Content-Type":"application/json",...e.headers}});if(clearTimeout(s),!r.ok){let o=await r.text().catch(()=>""),n=r.statusText||`HTTP ${r.status}`;if(o)try{let l=JSON.parse(o);n=l.detail||l.error||l.message||n}catch{n=o.length>200?o.slice(0,200)+"...":o}throw new Error(n)}return r.status===204?null:await r.json()}catch(r){throw clearTimeout(s),r.name==="AbortError"?new Error("Request timeout"):r}}async _get(t,e=!1){if(e&&this._cache.has(t)){let a=this._cache.get(t);if(Date.now()-a.timestamp<this._cacheTimeout)return a.data}let i=await this._request(t);return e&&this._cache.set(t,{data:i,timestamp:Date.now()}),i}async _post(t,e){return this._request(t,{method:"POST",body:JSON.stringify(e)})}async _put(t,e){return this._request(t,{method:"PUT",body:JSON.stringify(e)})}async _delete(t){return this._request(t,{method:"DELETE"})}async getStatus(){return this._get("/api/status")}async healthCheck(){return this._get("/health")}async listProjects(t=null){let e=t?`?status=${t}`:"";return this._get(`/api/projects${e}`)}async getProject(t){return this._get(`/api/projects/${t}`)}async createProject(t){return this._post("/api/projects",t)}async updateProject(t,e){return this._put(`/api/projects/${t}`,e)}async deleteProject(t){return this._delete(`/api/projects/${t}`)}async listTasks(t={}){let e=new URLSearchParams;t.projectId&&e.append("project_id",t.projectId),t.status&&e.append("status",t.status),t.priority&&e.append("priority",t.priority);let i=e.toString()?`?${e}`:"";return this._get(`/api/tasks${i}`)}async getTask(t){return this._get(`/api/tasks/${t}`)}async createTask(t){return this._post("/api/tasks",t)}async updateTask(t,e){return this._put(`/api/tasks/${t}`,e)}async moveTask(t,e,i){return this._post(`/api/tasks/${t}/move`,{status:e,position:i})}async deleteTask(t){return this._delete(`/api/tasks/${t}`)}async getMemorySummary(){return this._get("/api/memory/summary",!0)}async getMemoryIndex(){return this._get("/api/memory/index",!0)}async getMemoryTimeline(){return this._get("/api/memory/timeline")}async listEpisodes(t={}){let e=new URLSearchParams(t).toString();return this._get(`/api/memory/episodes${e?"?"+e:""}`)}async getEpisode(t){return this._get(`/api/memory/episodes/${t}`)}async listPatterns(t={}){let e=new URLSearchParams(t).toString();return this._get(`/api/memory/patterns${e?"?"+e:""}`)}async getPattern(t){return this._get(`/api/memory/patterns/${t}`)}async listSkills(){return this._get("/api/memory/skills")}async getSkill(t){return this._get(`/api/memory/skills/${t}`)}async retrieveMemories(t,e=null,i=5){return this._post("/api/memory/retrieve",{query:t,taskType:e,topK:i})}async consolidateMemory(t=24){return this._post("/api/memory/consolidate",{sinceHours:t})}async getTokenEconomics(){return this._get("/api/memory/economics")}async searchMemory(t,e="all",i=20){let a=new URLSearchParams({q:t,collection:e,limit:String(i)});return this._get(`/api/memory/search?${a}`)}async getMemoryStats(){return this._get("/api/memory/stats",!0)}async listRegisteredProjects(t=!1){return this._get(`/api/registry/projects?include_inactive=${t}`)}async registerProject(t,e=null,i=null){return this._post("/api/registry/projects",{path:t,name:e,alias:i})}async discoverProjects(t=3){return this._get(`/api/registry/discover?max_depth=${t}`)}async syncRegistry(){return this._post("/api/registry/sync",{})}async getCrossProjectTasks(t=null){let e=t?`?project_ids=${t.join(",")}`:"";return this._get(`/api/registry/tasks${e}`)}async getLearningMetrics(t={}){let e=new URLSearchParams;t.timeRange&&e.append("timeRange",t.timeRange),t.signalType&&e.append("signalType",t.signalType),t.source&&e.append("source",t.source);let i=e.toString()?`?${e}`:"";return this._get(`/api/learning/metrics${i}`)}async getLearningTrends(t={}){let e=new URLSearchParams;t.timeRange&&e.append("timeRange",t.timeRange),t.signalType&&e.append("signalType",t.signalType),t.source&&e.append("source",t.source);let i=e.toString()?`?${e}`:"";return this._get(`/api/learning/trends${i}`)}async getLearningSignals(t={}){let e=new URLSearchParams;t.timeRange&&e.append("timeRange",t.timeRange),t.signalType&&e.append("signalType",t.signalType),t.source&&e.append("source",t.source),t.limit&&e.append("limit",String(t.limit)),t.offset&&e.append("offset",String(t.offset));let i=e.toString()?`?${e}`:"";return this._get(`/api/learning/signals${i}`)}async getLatestAggregation(){return this._get("/api/learning/aggregation")}async triggerAggregation(t={}){return this._post("/api/learning/aggregate",t)}async getAggregatedPreferences(t=20){return this._get(`/api/learning/preferences?limit=${t}`)}async getAggregatedErrors(t=20){return this._get(`/api/learning/errors?limit=${t}`)}async getAggregatedSuccessPatterns(t=20){return this._get(`/api/learning/success?limit=${t}`)}async getToolEfficiency(t=20){return this._get(`/api/learning/tools?limit=${t}`)}async getCost(){return this._get("/api/cost")}async getPricing(){return this._get("/api/pricing")}async getCouncilState(){return this._get("/api/council/state")}async getCouncilVerdicts(t=20){return this._get(`/api/council/verdicts?limit=${t}`)}async getCouncilConvergence(){return this._get("/api/council/convergence")}async getCouncilReport(){return this._get("/api/council/report")}async forceCouncilReview(){return this._post("/api/council/force-review",{})}async getContext(){return this._get("/api/context")}async getNotifications(t,e){let i=new URLSearchParams;t&&i.set("severity",t),e&&i.set("unread_only","true");let a=i.toString();return this._get("/api/notifications"+(a?"?"+a:""))}async getNotificationTriggers(){return this._get("/api/notifications/triggers")}async updateNotificationTriggers(t){return this._put("/api/notifications/triggers",{triggers:t})}async acknowledgeNotification(t){return this._post("/api/notifications/"+encodeURIComponent(t)+"/acknowledge",{})}async pauseSession(){return this._post("/api/control/pause",{})}async resumeSession(){return this._post("/api/control/resume",{})}async stopSession(){return this._post("/api/control/stop",{})}async getLogs(t=100){return this._get(`/api/logs?lines=${t}`)}async getChecklist(){return this._get("/api/checklist")}async getChecklistSummary(){return this._get("/api/checklist/summary")}async getPrdObservations(){let t=await fetch(`${this.baseUrl}/api/prd-observations`);if(!t.ok)throw new Error(`HTTP ${t.status}`);return t.text()}async getChecklistWaivers(){return this._get("/api/checklist/waivers")}async addChecklistWaiver(t,e,i="dashboard"){return this._post("/api/checklist/waivers",{item_id:t,reason:e,waived_by:i})}async removeChecklistWaiver(t){return this._delete(`/api/checklist/waivers/${encodeURIComponent(t)}`)}async getCouncilGate(){return this._get("/api/council/gate")}async getAppRunnerStatus(){return this._get("/api/app-runner/status")}async getAppRunnerLogs(t=100){return this._get(`/api/app-runner/logs?lines=${t}`)}async restartApp(){return this._post("/api/control/app-restart",{})}async stopApp(){return this._post("/api/control/app-stop",{})}async getPlaywrightResults(){return this._get("/api/playwright/results")}async getPlaywrightScreenshot(){return this._get("/api/playwright/screenshot")}startPolling(t,e=null){if(this._pollInterval)return;this._pollCallback=t;let i=async()=>{try{let s=await this.getStatus();this._connected=!0,this._pollCallback&&this._pollCallback(s),this._emit(u.STATUS_UPDATE,s),this._vscodeApi&&this.postToVSCode("pollSuccess",{timestamp:Date.now()})}catch(s){this._connected=!1,this._emit(u.ERROR,{error:s}),this._vscodeApi&&this.postToVSCode("pollError",{error:s.message})}};i();let a=e||this._currentPollInterval||this.config.pollInterval;this._pollInterval=setInterval(i,a)}stopPolling(){this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null)}};w(C,"_instances",new Map);var R=C;function wt(d={}){return new R(d)}function g(d={}){return R.getInstance(d)}var bt="loki-state-change",mt={ui:{theme:"light",sidebarCollapsed:!1,activeSection:"kanban",terminalAutoScroll:!0},session:{connected:!1,lastSync:null,mode:"offline",phase:null,iteration:null},localTasks:[],cache:{projects:[],tasks:[],agents:[],memory:null,lastFetch:null},preferences:{pollInterval:2e3,notifications:!0,soundEnabled:!1}},$=class $ extends EventTarget{static getInstance(){return $._instance||($._instance=new $),$._instance}constructor(){super(),this._state=this._loadState(),this._subscribers=new Map,this._batchUpdates=[],this._batchTimeout=null}_loadState(){try{let t=localStorage.getItem($.STORAGE_KEY);if(t){let e=JSON.parse(t);return this._mergeState(mt,e)}}catch(t){console.warn("Failed to load state from localStorage:",t)}return{...mt}}_mergeState(t,e){let i={...t};for(let a of Object.keys(e))a in t&&typeof t[a]=="object"&&!Array.isArray(t[a])?i[a]=this._mergeState(t[a],e[a]):i[a]=e[a];return i}_saveState(){try{let t={ui:this._state.ui,localTasks:this._state.localTasks,preferences:this._state.preferences};localStorage.setItem($.STORAGE_KEY,JSON.stringify(t))}catch(t){console.warn("Failed to save state to localStorage:",t)}}get(t=null){if(!t)return{...this._state};let e=t.split("."),i=this._state;for(let a of e){if(i==null)return;i=i[a]}return i}set(t,e,i=!0){let a=t.split("."),s=a.pop(),r=this._state;for(let n of a)n in r||(r[n]={}),r=r[n];let o=r[s];r[s]=e,i&&this._saveState(),this._notifyChange(t,e,o)}update(t,e=!0){let i=[];for(let[a,s]of Object.entries(t)){let r=this.get(a);this.set(a,s,!1),i.push({path:a,value:s,oldValue:r})}e&&this._saveState();for(let a of i)this._notifyChange(a.path,a.value,a.oldValue)}_notifyChange(t,e,i){this.dispatchEvent(new CustomEvent(bt,{detail:{path:t,value:e,oldValue:i}}));let a=this._subscribers.get(t)||[];for(let r of a)try{r(e,i,t)}catch(o){console.error("State subscriber error:",o)}let s=t.split(".");for(;s.length>1;){s.pop();let r=s.join("."),o=this._subscribers.get(r)||[];for(let n of o)try{n(this.get(r),null,r)}catch(l){console.error("State subscriber error:",l)}}}subscribe(t,e){return this._subscribers.has(t)||this._subscribers.set(t,[]),this._subscribers.get(t).push(e),()=>{let i=this._subscribers.get(t),a=i.indexOf(e);a>-1&&i.splice(a,1)}}reset(t=null){if(t){let e=t.split("."),i=mt;for(let a of e)i=i?.[a];this.set(t,i)}else this._state={...mt},this._saveState(),this.dispatchEvent(new CustomEvent(bt,{detail:{path:null,value:this._state,oldValue:null}}))}addLocalTask(t){let e=this.get("localTasks")||[],i={id:`local-${Date.now()}-${Math.random().toString(36).substr(2,9)}`,createdAt:new Date().toISOString(),status:"pending",...t};return this.set("localTasks",[...e,i]),i}updateLocalTask(t,e){let i=this.get("localTasks")||[],a=i.findIndex(r=>r.id===t);if(a===-1)return null;let s={...i[a],...e,updatedAt:new Date().toISOString()};return i[a]=s,this.set("localTasks",[...i]),s}deleteLocalTask(t){let e=this.get("localTasks")||[];this.set("localTasks",e.filter(i=>i.id!==t))}moveLocalTask(t,e,i=null){let s=(this.get("localTasks")||[]).find(r=>r.id===t);return s?this.updateLocalTask(t,{status:e,position:i??s.position}):null}updateSession(t){this.update(Object.fromEntries(Object.entries(t).map(([e,i])=>[`session.${e}`,i])),!1)}updateCache(t){this.update({"cache.projects":t.projects??this.get("cache.projects"),"cache.tasks":t.tasks??this.get("cache.tasks"),"cache.agents":t.agents??this.get("cache.agents"),"cache.memory":t.memory??this.get("cache.memory"),"cache.lastFetch":new Date().toISOString()},!1)}getMergedTasks(){let t=this.get("cache.tasks")||[],i=(this.get("localTasks")||[]).map(a=>({...a,isLocal:!0}));return[...t,...i]}getTasksByStatus(t){return this.getMergedTasks().filter(e=>e.status===t)}};w($,"STORAGE_KEY","loki-dashboard-state"),w($,"_instance",null);var F=$;function z(){return F.getInstance()}function $t(d){let t=z();return{get:()=>t.get(d),set:e=>t.set(d,e),subscribe:e=>t.subscribe(d,e)}}var j=class extends h{static get observedAttributes(){return["api-url","theme"]}constructor(){super(),this._data={status:"offline",phase:null,iteration:null,provider:null,running_agents:0,pending_tasks:null,uptime_seconds:0,complexity:null,connected:!1},this._api=null,this._pollInterval=null,this._statusUpdateHandler=null,this._connectedHandler=null,this._disconnectedHandler=null,this._checklistSummary=null,this._appRunnerStatus=null,this._playwrightResults=null,this._gateStatus=null}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadStatus(),this._startPolling(),this._api.connect().catch(()=>{})}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling(),this._loadAbortController&&(this._loadAbortController.abort(),this._loadAbortController=null),this._api&&(this._statusUpdateHandler&&this._api.removeEventListener(u.STATUS_UPDATE,this._statusUpdateHandler),this._connectedHandler&&this._api.removeEventListener(u.CONNECTED,this._connectedHandler),this._disconnectedHandler&&this._api.removeEventListener(u.DISCONNECTED,this._disconnectedHandler))}attributeChangedCallback(t,e,i){e!==i&&(t==="api-url"&&this._api&&(this._api.baseUrl=i,this._loadStatus()),t==="theme"&&this._applyTheme())}_setupApi(){let t=this.getAttribute("api-url")||window.location.origin;this._api=g({baseUrl:t}),this._statusUpdateHandler=e=>this._updateFromStatus(e.detail),this._connectedHandler=()=>{this._data.connected=!0,this.render()},this._disconnectedHandler=()=>{this._data.connected=!1,this._data.status="offline",this.render()},this._api.addEventListener(u.STATUS_UPDATE,this._statusUpdateHandler),this._api.addEventListener(u.CONNECTED,this._connectedHandler),this._api.addEventListener(u.DISCONNECTED,this._disconnectedHandler)}async _loadStatus(){this._loadAbortController&&this._loadAbortController.abort(),this._loadAbortController=new AbortController;let{signal:t}=this._loadAbortController;try{let[e,i,a,s,r]=await Promise.allSettled([this._api.getStatus(),this._api.getChecklistSummary(),this._api.getAppRunnerStatus(),this._api.getPlaywrightResults(),this._api.getCouncilGate()]);if(t.aborted)return;e.status==="fulfilled"?this._updateFromStatus(e.value):(this._data.connected=!1,this._data.status="offline"),i.status==="fulfilled"&&(this._checklistSummary=i.value?.summary||null),a.status==="fulfilled"&&(this._appRunnerStatus=a.value),s.status==="fulfilled"&&(this._playwrightResults=s.value),r.status==="fulfilled"&&(this._gateStatus=r.value),this.render()}catch{if(t.aborted)return;this._data.connected=!1,this._data.status="offline",this.render()}}_updateFromStatus(t){t&&(this._data={...this._data,connected:!0,status:t.status||"offline",phase:t.phase||null,iteration:t.iteration!=null?t.iteration:null,provider:t.provider||null,running_agents:t.running_agents||0,pending_tasks:t.pending_tasks!=null?t.pending_tasks:null,uptime_seconds:t.uptime_seconds||0,complexity:t.complexity||null})}_startPolling(){this._pollInterval=setInterval(async()=>{try{await this._loadStatus()}catch{this._data.connected=!1,this._data.status="offline",this.render()}},5e3)}_stopPolling(){this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null)}_formatUptime(t){if(!t||t<0)return"--";let e=Math.floor(t/3600),i=Math.floor(t%3600/60),a=Math.floor(t%60);return e>0?`${e}h ${i}m`:i>0?`${i}m ${a}s`:`${a}s`}_getStatusDotClass(){switch(this._data.status){case"running":case"autonomous":return"active";case"paused":return"paused";case"stopped":return"stopped";case"error":return"error";default:return"offline"}}_escapeHtml(t){return t?String(t).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;"):""}_renderAppRunnerCard(){let t=this._appRunnerStatus;if(!t||t.status==="not_initialized")return`
+    `}getAriaPattern(t){return gt[t]||{}}applyAriaPattern(t,e){let i=this.getAriaPattern(e);for(let[a,s]of Object.entries(i))if(a==="role")t.setAttribute("role",s);else{let r=a.replace(/([A-Z])/g,"-$1").toLowerCase();t.setAttribute(r,s)}}render(){}};var L={realtime:1e3,normal:2e3,background:5e3,offline:1e4},_t={vscode:L.normal,browser:L.realtime,cli:L.background},yt={baseUrl:typeof window<"u"?window.location.origin:"http://localhost:57374",wsUrl:typeof window<"u"?`${window.location.protocol==="https:"?"wss:":"ws:"}//${window.location.host}/ws`:"ws://localhost:57374/ws",pollInterval:2e3,timeout:1e4,retryAttempts:3,retryDelay:1e3},u={CONNECTED:"api:connected",DISCONNECTED:"api:disconnected",ERROR:"api:error",STATUS_UPDATE:"api:status-update",TASK_CREATED:"api:task-created",TASK_UPDATED:"api:task-updated",TASK_DELETED:"api:task-deleted",PROJECT_CREATED:"api:project-created",PROJECT_UPDATED:"api:project-updated",AGENT_UPDATE:"api:agent-update",LOG_MESSAGE:"api:log-message",MEMORY_UPDATE:"api:memory-update",CHECKLIST_UPDATE:"api:checklist-update"},C=class C extends EventTarget{static getInstance(t={}){let e=t.baseUrl||yt.baseUrl;return C._instances.has(e)||C._instances.set(e,new C(t)),C._instances.get(e)}static clearInstances(){C._instances.forEach(t=>t.disconnect()),C._instances.clear()}constructor(t={}){super(),this.config={...yt,...t},this._ws=null,this._connected=!1,this._pollInterval=null,this._reconnectTimeout=null,this._reconnectAttempts=0,this._maxReconnectAttempts=20,this._cache=new Map,this._cacheTimeout=5e3,this._vscodeApi=null,this._context=this._detectContext(),this._currentPollInterval=_t[this._context]||L.normal,this._visibilityChangeHandler=null,this._messageHandler=null,this._setupAdaptivePolling(),this._setupVSCodeBridge()}_detectContext(){return typeof acquireVsCodeApi<"u"?"vscode":typeof window<"u"&&window.location?"browser":"cli"}get context(){return this._context}static get POLL_INTERVALS(){return L}_setupAdaptivePolling(){typeof document>"u"||(this._visibilityChangeHandler=()=>{document.hidden?this._setPollInterval(L.background):this._setPollInterval(_t[this._context]||L.normal)},document.addEventListener("visibilitychange",this._visibilityChangeHandler))}_setPollInterval(t){this._currentPollInterval=t,this._pollInterval&&(this.stopPolling(),this.startPolling(null,t))}setPollMode(t){let e=L[t];e&&this._setPollInterval(e)}_setupVSCodeBridge(){if(!(typeof acquireVsCodeApi>"u")){try{this._vscodeApi=acquireVsCodeApi()}catch{console.warn("VS Code API already acquired or unavailable");return}this._messageHandler=t=>{let e=t.data;if(!(!e||!e.type))switch(e.type){case"updateStatus":this._emit(u.STATUS_UPDATE,e.data);break;case"updateTasks":this._emit(u.TASK_UPDATED,e.data);break;case"taskCreated":this._emit(u.TASK_CREATED,e.data);break;case"taskDeleted":this._emit(u.TASK_DELETED,e.data);break;case"projectCreated":this._emit(u.PROJECT_CREATED,e.data);break;case"projectUpdated":this._emit(u.PROJECT_UPDATED,e.data);break;case"agentUpdate":this._emit(u.AGENT_UPDATE,e.data);break;case"logMessage":this._emit(u.LOG_MESSAGE,e.data);break;case"memoryUpdate":this._emit(u.MEMORY_UPDATE,e.data);break;case"connected":this._connected=!0,this._emit(u.CONNECTED,e.data);break;case"disconnected":this._connected=!1,this._emit(u.DISCONNECTED,e.data);break;case"error":this._emit(u.ERROR,e.data);break;case"setPollMode":this.setPollMode(e.data.mode);break;default:this._emit(`api:${e.type}`,e.data)}},window.addEventListener("message",this._messageHandler)}}get isVSCode(){return this._context==="vscode"}postToVSCode(t,e={}){this._vscodeApi&&this._vscodeApi.postMessage({type:t,data:e})}requestRefresh(){this.postToVSCode("requestRefresh")}notifyVSCode(t,e={}){this.postToVSCode("userAction",{action:t,...e})}get baseUrl(){return this.config.baseUrl}set baseUrl(t){this.config.baseUrl=t,this.config.wsUrl=t.replace(/^http/,"ws")+"/ws"}get isConnected(){return this._connected}async connect(){if(!(this._ws&&this._ws.readyState===WebSocket.OPEN))return new Promise((t,e)=>{try{this._ws=new WebSocket(this.config.wsUrl),this._ws.onopen=()=>{this._connected=!0,this._reconnectAttempts=0,this._emit(u.CONNECTED),t()},this._ws.onclose=()=>{this._connected=!1,this._emit(u.DISCONNECTED),this._scheduleReconnect()},this._ws.onerror=i=>{this._emit(u.ERROR,{error:i}),e(i)},this._ws.onmessage=i=>{try{let a=JSON.parse(i.data);this._handleMessage(a)}catch(a){console.error("Failed to parse WebSocket message:",a)}}}catch(i){e(i)}})}disconnect(){this._ws&&(this._ws.close(),this._ws=null),this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null),this._reconnectTimeout&&(clearTimeout(this._reconnectTimeout),this._reconnectTimeout=null),this._connected=!1,this._cleanupGlobalListeners()}_cleanupGlobalListeners(){this._visibilityChangeHandler&&typeof document<"u"&&(document.removeEventListener("visibilitychange",this._visibilityChangeHandler),this._visibilityChangeHandler=null),this._messageHandler&&typeof window<"u"&&(window.removeEventListener("message",this._messageHandler),this._messageHandler=null)}destroy(){this.disconnect()}_scheduleReconnect(){if(this._reconnectTimeout)return;if(this._reconnectAttempts>=this._maxReconnectAttempts){console.warn("WebSocket max reconnect attempts reached, giving up"),this._emit(u.ERROR,{error:"Max reconnect attempts reached"});return}let t=Math.min(this.config.retryDelay*Math.pow(2,this._reconnectAttempts),3e4);this._reconnectAttempts++,this._reconnectTimeout=setTimeout(()=>{this._reconnectTimeout=null,this.connect().catch(()=>{})},t)}_handleMessage(t){if(t.type==="ping"){this._ws&&this._ws.readyState===WebSocket.OPEN&&this._ws.send(JSON.stringify({type:"pong"}));return}let i={connected:u.CONNECTED,status_update:u.STATUS_UPDATE,task_created:u.TASK_CREATED,task_updated:u.TASK_UPDATED,task_deleted:u.TASK_DELETED,task_moved:u.TASK_UPDATED,project_created:u.PROJECT_CREATED,project_updated:u.PROJECT_UPDATED,agent_update:u.AGENT_UPDATE,log:u.LOG_MESSAGE}[t.type]||`api:${t.type}`;this._emit(i,t.data)}_emit(t,e={}){this.dispatchEvent(new CustomEvent(t,{detail:e}))}async _request(t,e={}){let i=`${this.config.baseUrl}${t}`,a=new AbortController,s=setTimeout(()=>a.abort(),this.config.timeout);try{let r=await fetch(i,{...e,signal:a.signal,credentials:"include",headers:{"Content-Type":"application/json",...e.headers}});if(clearTimeout(s),!r.ok){let o=await r.text().catch(()=>""),n=r.statusText||`HTTP ${r.status}`;if(o)try{let l=JSON.parse(o);n=l.detail||l.error||l.message||n}catch{n=o.length>200?o.slice(0,200)+"...":o}throw new Error(n)}return r.status===204?null:await r.json()}catch(r){throw clearTimeout(s),r.name==="AbortError"?new Error("Request timeout"):r}}async _get(t,e=!1){if(e&&this._cache.has(t)){let a=this._cache.get(t);if(Date.now()-a.timestamp<this._cacheTimeout)return a.data}let i=await this._request(t);return e&&this._cache.set(t,{data:i,timestamp:Date.now()}),i}async _post(t,e){return this._request(t,{method:"POST",body:JSON.stringify(e)})}async _put(t,e){return this._request(t,{method:"PUT",body:JSON.stringify(e)})}async _delete(t){return this._request(t,{method:"DELETE"})}async getStatus(){return this._get("/api/status")}async healthCheck(){return this._get("/health")}async listProjects(t=null){let e=t?`?status=${t}`:"";return this._get(`/api/projects${e}`)}async getProject(t){return this._get(`/api/projects/${t}`)}async createProject(t){return this._post("/api/projects",t)}async updateProject(t,e){return this._put(`/api/projects/${t}`,e)}async deleteProject(t){return this._delete(`/api/projects/${t}`)}async listTasks(t={}){let e=new URLSearchParams;t.projectId&&e.append("project_id",t.projectId),t.status&&e.append("status",t.status),t.priority&&e.append("priority",t.priority);let i=e.toString()?`?${e}`:"";return this._get(`/api/tasks${i}`)}async getTask(t){return this._get(`/api/tasks/${t}`)}async createTask(t){return this._post("/api/tasks",t)}async updateTask(t,e){return this._put(`/api/tasks/${t}`,e)}async moveTask(t,e,i){return this._post(`/api/tasks/${t}/move`,{status:e,position:i})}async deleteTask(t){return this._delete(`/api/tasks/${t}`)}async getMemorySummary(){return this._get("/api/memory/summary",!0)}async getMemoryIndex(){return this._get("/api/memory/index",!0)}async getMemoryTimeline(){return this._get("/api/memory/timeline")}async listEpisodes(t={}){let e=new URLSearchParams(t).toString();return this._get(`/api/memory/episodes${e?"?"+e:""}`)}async getEpisode(t){return this._get(`/api/memory/episodes/${t}`)}async listPatterns(t={}){let e=new URLSearchParams(t).toString();return this._get(`/api/memory/patterns${e?"?"+e:""}`)}async getPattern(t){return this._get(`/api/memory/patterns/${t}`)}async listSkills(){return this._get("/api/memory/skills")}async getSkill(t){return this._get(`/api/memory/skills/${t}`)}async retrieveMemories(t,e=null,i=5){return this._post("/api/memory/retrieve",{query:t,taskType:e,topK:i})}async consolidateMemory(t=24){return this._post("/api/memory/consolidate",{sinceHours:t})}async getTokenEconomics(){return this._get("/api/memory/economics")}async searchMemory(t,e="all",i=20){let a=new URLSearchParams({q:t,collection:e,limit:String(i)});return this._get(`/api/memory/search?${a}`)}async getMemoryStats(){return this._get("/api/memory/stats",!0)}async listRegisteredProjects(t=!1){return this._get(`/api/registry/projects?include_inactive=${t}`)}async registerProject(t,e=null,i=null){return this._post("/api/registry/projects",{path:t,name:e,alias:i})}async discoverProjects(t=3){return this._get(`/api/registry/discover?max_depth=${t}`)}async syncRegistry(){return this._post("/api/registry/sync",{})}async getCrossProjectTasks(t=null){let e=t?`?project_ids=${t.join(",")}`:"";return this._get(`/api/registry/tasks${e}`)}async getLearningMetrics(t={}){let e=new URLSearchParams;t.timeRange&&e.append("timeRange",t.timeRange),t.signalType&&e.append("signalType",t.signalType),t.source&&e.append("source",t.source);let i=e.toString()?`?${e}`:"";return this._get(`/api/learning/metrics${i}`)}async getLearningTrends(t={}){let e=new URLSearchParams;t.timeRange&&e.append("timeRange",t.timeRange),t.signalType&&e.append("signalType",t.signalType),t.source&&e.append("source",t.source);let i=e.toString()?`?${e}`:"";return this._get(`/api/learning/trends${i}`)}async getLearningSignals(t={}){let e=new URLSearchParams;t.timeRange&&e.append("timeRange",t.timeRange),t.signalType&&e.append("signalType",t.signalType),t.source&&e.append("source",t.source),t.limit&&e.append("limit",String(t.limit)),t.offset&&e.append("offset",String(t.offset));let i=e.toString()?`?${e}`:"";return this._get(`/api/learning/signals${i}`)}async getLatestAggregation(){return this._get("/api/learning/aggregation")}async triggerAggregation(t={}){return this._post("/api/learning/aggregate",t)}async getAggregatedPreferences(t=20){return this._get(`/api/learning/preferences?limit=${t}`)}async getAggregatedErrors(t=20){return this._get(`/api/learning/errors?limit=${t}`)}async getAggregatedSuccessPatterns(t=20){return this._get(`/api/learning/success?limit=${t}`)}async getToolEfficiency(t=20){return this._get(`/api/learning/tools?limit=${t}`)}async getCost(){return this._get("/api/cost")}async getPricing(){return this._get("/api/pricing")}async getCouncilState(){return this._get("/api/council/state")}async getCouncilVerdicts(t=20){return this._get(`/api/council/verdicts?limit=${t}`)}async getCouncilConvergence(){return this._get("/api/council/convergence")}async getCouncilReport(){return this._get("/api/council/report")}async forceCouncilReview(){return this._post("/api/council/force-review",{})}async getContext(){return this._get("/api/context")}async getNotifications(t,e){let i=new URLSearchParams;t&&i.set("severity",t),e&&i.set("unread_only","true");let a=i.toString();return this._get("/api/notifications"+(a?"?"+a:""))}async getNotificationTriggers(){return this._get("/api/notifications/triggers")}async updateNotificationTriggers(t){return this._put("/api/notifications/triggers",{triggers:t})}async acknowledgeNotification(t){return this._post("/api/notifications/"+encodeURIComponent(t)+"/acknowledge",{})}async pauseSession(){return this._post("/api/control/pause",{})}async resumeSession(){return this._post("/api/control/resume",{})}async stopSession(){return this._post("/api/control/stop",{})}async getLogs(t=100){return this._get(`/api/logs?lines=${t}`)}async getChecklist(){return this._get("/api/checklist")}async getChecklistSummary(){return this._get("/api/checklist/summary")}async getPrdObservations(){let t=await fetch(`${this.baseUrl}/api/prd-observations`,{credentials:"include"});if(!t.ok)throw new Error(`HTTP ${t.status}`);return t.text()}async getChecklistWaivers(){return this._get("/api/checklist/waivers")}async addChecklistWaiver(t,e,i="dashboard"){return this._post("/api/checklist/waivers",{item_id:t,reason:e,waived_by:i})}async removeChecklistWaiver(t){return this._delete(`/api/checklist/waivers/${encodeURIComponent(t)}`)}async getCouncilGate(){return this._get("/api/council/gate")}async getAppRunnerStatus(){return this._get("/api/app-runner/status")}async getAppRunnerLogs(t=100){return this._get(`/api/app-runner/logs?lines=${t}`)}async restartApp(){return this._post("/api/control/app-restart",{})}async stopApp(){return this._post("/api/control/app-stop",{})}async getPlaywrightResults(){return this._get("/api/playwright/results")}async getPlaywrightScreenshot(){return this._get("/api/playwright/screenshot")}startPolling(t,e=null){if(this._pollInterval)return;this._pollCallback=t;let i=async()=>{try{let s=await this.getStatus();this._connected=!0,this._pollCallback&&this._pollCallback(s),this._emit(u.STATUS_UPDATE,s),this._vscodeApi&&this.postToVSCode("pollSuccess",{timestamp:Date.now()})}catch(s){this._connected=!1,this._emit(u.ERROR,{error:s}),this._vscodeApi&&this.postToVSCode("pollError",{error:s.message})}};i();let a=e||this._currentPollInterval||this.config.pollInterval;this._pollInterval=setInterval(i,a)}stopPolling(){this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null)}};w(C,"_instances",new Map);var R=C;function wt(d={}){return new R(d)}function g(d={}){return R.getInstance(d)}var bt="loki-state-change",mt={ui:{theme:"light",sidebarCollapsed:!1,activeSection:"kanban",terminalAutoScroll:!0},session:{connected:!1,lastSync:null,mode:"offline",phase:null,iteration:null},localTasks:[],cache:{projects:[],tasks:[],agents:[],memory:null,lastFetch:null},preferences:{pollInterval:2e3,notifications:!0,soundEnabled:!1}},$=class $ extends EventTarget{static getInstance(){return $._instance||($._instance=new $),$._instance}constructor(){super(),this._state=this._loadState(),this._subscribers=new Map,this._batchUpdates=[],this._batchTimeout=null}_loadState(){try{let t=localStorage.getItem($.STORAGE_KEY);if(t){let e=JSON.parse(t);return this._mergeState(mt,e)}}catch(t){console.warn("Failed to load state from localStorage:",t)}return{...mt}}_mergeState(t,e){let i={...t};for(let a of Object.keys(e))a in t&&typeof t[a]=="object"&&!Array.isArray(t[a])?i[a]=this._mergeState(t[a],e[a]):i[a]=e[a];return i}_saveState(){try{let t={ui:this._state.ui,localTasks:this._state.localTasks,preferences:this._state.preferences};localStorage.setItem($.STORAGE_KEY,JSON.stringify(t))}catch(t){console.warn("Failed to save state to localStorage:",t)}}get(t=null){if(!t)return{...this._state};let e=t.split("."),i=this._state;for(let a of e){if(i==null)return;i=i[a]}return i}set(t,e,i=!0){let a=t.split("."),s=a.pop(),r=this._state;for(let n of a)n in r||(r[n]={}),r=r[n];let o=r[s];r[s]=e,i&&this._saveState(),this._notifyChange(t,e,o)}update(t,e=!0){let i=[];for(let[a,s]of Object.entries(t)){let r=this.get(a);this.set(a,s,!1),i.push({path:a,value:s,oldValue:r})}e&&this._saveState();for(let a of i)this._notifyChange(a.path,a.value,a.oldValue)}_notifyChange(t,e,i){this.dispatchEvent(new CustomEvent(bt,{detail:{path:t,value:e,oldValue:i}}));let a=this._subscribers.get(t)||[];for(let r of a)try{r(e,i,t)}catch(o){console.error("State subscriber error:",o)}let s=t.split(".");for(;s.length>1;){s.pop();let r=s.join("."),o=this._subscribers.get(r)||[];for(let n of o)try{n(this.get(r),null,r)}catch(l){console.error("State subscriber error:",l)}}}subscribe(t,e){return this._subscribers.has(t)||this._subscribers.set(t,[]),this._subscribers.get(t).push(e),()=>{let i=this._subscribers.get(t),a=i.indexOf(e);a>-1&&i.splice(a,1)}}reset(t=null){if(t){let e=t.split("."),i=mt;for(let a of e)i=i?.[a];this.set(t,i)}else this._state={...mt},this._saveState(),this.dispatchEvent(new CustomEvent(bt,{detail:{path:null,value:this._state,oldValue:null}}))}addLocalTask(t){let e=this.get("localTasks")||[],i={id:`local-${Date.now()}-${Math.random().toString(36).substr(2,9)}`,createdAt:new Date().toISOString(),status:"pending",...t};return this.set("localTasks",[...e,i]),i}updateLocalTask(t,e){let i=this.get("localTasks")||[],a=i.findIndex(r=>r.id===t);if(a===-1)return null;let s={...i[a],...e,updatedAt:new Date().toISOString()};return i[a]=s,this.set("localTasks",[...i]),s}deleteLocalTask(t){let e=this.get("localTasks")||[];this.set("localTasks",e.filter(i=>i.id!==t))}moveLocalTask(t,e,i=null){let s=(this.get("localTasks")||[]).find(r=>r.id===t);return s?this.updateLocalTask(t,{status:e,position:i??s.position}):null}updateSession(t){this.update(Object.fromEntries(Object.entries(t).map(([e,i])=>[`session.${e}`,i])),!1)}updateCache(t){this.update({"cache.projects":t.projects??this.get("cache.projects"),"cache.tasks":t.tasks??this.get("cache.tasks"),"cache.agents":t.agents??this.get("cache.agents"),"cache.memory":t.memory??this.get("cache.memory"),"cache.lastFetch":new Date().toISOString()},!1)}getMergedTasks(){let t=this.get("cache.tasks")||[],i=(this.get("localTasks")||[]).map(a=>({...a,isLocal:!0}));return[...t,...i]}getTasksByStatus(t){return this.getMergedTasks().filter(e=>e.status===t)}};w($,"STORAGE_KEY","loki-dashboard-state"),w($,"_instance",null);var F=$;function z(){return F.getInstance()}function $t(d){let t=z();return{get:()=>t.get(d),set:e=>t.set(d,e),subscribe:e=>t.subscribe(d,e)}}var j=class extends h{static get observedAttributes(){return["api-url","theme"]}constructor(){super(),this._data={status:"offline",phase:null,iteration:null,provider:null,running_agents:0,pending_tasks:null,uptime_seconds:0,complexity:null,connected:!1},this._api=null,this._pollInterval=null,this._statusUpdateHandler=null,this._connectedHandler=null,this._disconnectedHandler=null,this._checklistSummary=null,this._appRunnerStatus=null,this._playwrightResults=null,this._gateStatus=null}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadStatus(),this._startPolling(),this._api.connect().catch(()=>{})}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling(),this._loadAbortController&&(this._loadAbortController.abort(),this._loadAbortController=null),this._api&&(this._statusUpdateHandler&&this._api.removeEventListener(u.STATUS_UPDATE,this._statusUpdateHandler),this._connectedHandler&&this._api.removeEventListener(u.CONNECTED,this._connectedHandler),this._disconnectedHandler&&this._api.removeEventListener(u.DISCONNECTED,this._disconnectedHandler))}attributeChangedCallback(t,e,i){e!==i&&(t==="api-url"&&this._api&&(this._api.baseUrl=i,this._loadStatus()),t==="theme"&&this._applyTheme())}_setupApi(){let t=this.getAttribute("api-url")||window.location.origin;this._api=g({baseUrl:t}),this._statusUpdateHandler=e=>this._updateFromStatus(e.detail),this._connectedHandler=()=>{this._data.connected=!0,this.render()},this._disconnectedHandler=()=>{this._data.connected=!1,this._data.status="offline",this.render()},this._api.addEventListener(u.STATUS_UPDATE,this._statusUpdateHandler),this._api.addEventListener(u.CONNECTED,this._connectedHandler),this._api.addEventListener(u.DISCONNECTED,this._disconnectedHandler)}async _loadStatus(){this._loadAbortController&&this._loadAbortController.abort(),this._loadAbortController=new AbortController;let{signal:t}=this._loadAbortController;try{let[e,i,a,s,r]=await Promise.allSettled([this._api.getStatus(),this._api.getChecklistSummary(),this._api.getAppRunnerStatus(),this._api.getPlaywrightResults(),this._api.getCouncilGate()]);if(t.aborted)return;e.status==="fulfilled"?this._updateFromStatus(e.value):(this._data.connected=!1,this._data.status="offline"),i.status==="fulfilled"&&(this._checklistSummary=i.value?.summary||null),a.status==="fulfilled"&&(this._appRunnerStatus=a.value),s.status==="fulfilled"&&(this._playwrightResults=s.value),r.status==="fulfilled"&&(this._gateStatus=r.value),this.render()}catch{if(t.aborted)return;this._data.connected=!1,this._data.status="offline",this.render()}}_updateFromStatus(t){t&&(this._data={...this._data,connected:!0,status:t.status||"offline",phase:t.phase||null,iteration:t.iteration!=null?t.iteration:null,provider:t.provider||null,running_agents:t.running_agents||0,pending_tasks:t.pending_tasks!=null?t.pending_tasks:null,uptime_seconds:t.uptime_seconds||0,complexity:t.complexity||null})}_startPolling(){this._pollInterval=setInterval(async()=>{try{await this._loadStatus()}catch{this._data.connected=!1,this._data.status="offline",this.render()}},5e3)}_stopPolling(){this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null)}_formatUptime(t){if(!t||t<0)return"--";let e=Math.floor(t/3600),i=Math.floor(t%3600/60),a=Math.floor(t%60);return e>0?`${e}h ${i}m`:i>0?`${i}m ${a}s`:`${a}s`}_getStatusDotClass(){switch(this._data.status){case"running":case"autonomous":return"active";case"paused":return"paused";case"stopped":return"stopped";case"error":return"error";default:return"offline"}}_escapeHtml(t){return t?String(t).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;"):""}_renderAppRunnerCard(){let t=this._appRunnerStatus;if(!t||t.status==="not_initialized")return`
         <div class="overview-card">
           <div class="card-label">App Runner</div>
           <div class="card-value small-text">${this._data.status==="running"||this._data.status==="autonomous"?"Waiting...":"Not started"}</div>
@@ -2028,7 +2028,7 @@ var LokiDashboard=(()=>{var pt=Object.defineProperty;var Pt=Object.getOwnPropert
         ${i}
       </div>
       ${this._selectedTask?this._renderTaskDetailModal(this._selectedTask):""}
-    `,this._attachEventListeners()}_attachEventListeners(){let t=this.shadowRoot.getElementById("refresh-btn");t&&t.addEventListener("click",()=>this._loadTasks()),this.shadowRoot.querySelectorAll(".add-task-btn").forEach(a=>{a.addEventListener("click",()=>{this._openAddTaskModal(a.dataset.status)})}),this.shadowRoot.querySelectorAll(".task-card").forEach(a=>{let s=a.dataset.taskId,r=this._tasks.find(o=>o.id.toString()===s);r&&(a.addEventListener("click",()=>this._openTaskDetail(r)),a.addEventListener("keydown",o=>{o.key==="Enter"||o.key===" "?(o.preventDefault(),this._openTaskDetail(r)):(o.key==="ArrowDown"||o.key==="ArrowUp")&&(o.preventDefault(),this._navigateTaskCards(a,o.key==="ArrowDown"?"next":"prev"))}),a.classList.contains("draggable")&&(a.addEventListener("dragstart",o=>this._handleDragStart(o,r)),a.addEventListener("dragend",o=>this._handleDragEnd(o))))}),this.shadowRoot.querySelectorAll(".kanban-tasks").forEach(a=>{a.addEventListener("dragover",s=>this._handleDragOver(s)),a.addEventListener("dragenter",s=>this._handleDragEnter(s)),a.addEventListener("dragleave",s=>this._handleDragLeave(s)),a.addEventListener("drop",s=>this._handleDrop(s,a.dataset.status))});let e=this.shadowRoot.getElementById("modal-close-btn");e&&e.addEventListener("click",()=>this._closeTaskDetail());let i=this.shadowRoot.getElementById("task-detail-overlay");i&&i.addEventListener("click",a=>{a.target===i&&this._closeTaskDetail()})}_escapeHtml(t){let e=document.createElement("div");return e.textContent=t,e.innerHTML}_navigateTaskCards(t,e){let i=Array.from(this.shadowRoot.querySelectorAll(".task-card")),a=i.indexOf(t);if(a===-1)return;let s=e==="next"?a+1:a-1;s>=0&&s<i.length&&i[s].focus()}};customElements.get("loki-task-board")||customElements.define("loki-task-board",U);var O=class extends h{static get observedAttributes(){return["api-url","theme","compact"]}constructor(){super(),this._status={mode:"offline",phase:null,iteration:null,complexity:null,connected:!1,version:null,uptime:0,activeAgents:0,pendingTasks:0},this._api=null,this._state=z(),this._statusUpdateHandler=null,this._connectedHandler=null,this._disconnectedHandler=null}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadStatus(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling(),this._api&&(this._statusUpdateHandler&&this._api.removeEventListener(u.STATUS_UPDATE,this._statusUpdateHandler),this._connectedHandler&&this._api.removeEventListener(u.CONNECTED,this._connectedHandler),this._disconnectedHandler&&this._api.removeEventListener(u.DISCONNECTED,this._disconnectedHandler))}attributeChangedCallback(t,e,i){e!==i&&(t==="api-url"&&this._api&&(this._api.baseUrl=i,this._loadStatus()),t==="theme"&&this._applyTheme(),t==="compact"&&this.render())}_setupApi(){let t=this.getAttribute("api-url")||window.location.origin;this._api=g({baseUrl:t}),this._statusUpdateHandler=e=>this._updateFromStatus(e.detail),this._connectedHandler=()=>{this._status.connected=!0,this.render()},this._disconnectedHandler=()=>{this._status.connected=!1,this._status.mode="offline",this.render()},this._api.addEventListener(u.STATUS_UPDATE,this._statusUpdateHandler),this._api.addEventListener(u.CONNECTED,this._connectedHandler),this._api.addEventListener(u.DISCONNECTED,this._disconnectedHandler)}async _loadStatus(){try{let t=await this._api.getStatus();this._updateFromStatus(t)}catch{this._status.connected=!1,this._status.mode="offline",this.render()}}_updateFromStatus(t){t&&(this._status={...this._status,connected:!0,mode:t.status||"running",version:t.version,uptime:t.uptime_seconds||0,activeAgents:t.running_agents||0,pendingTasks:t.pending_tasks||0,phase:t.phase,iteration:t.iteration,complexity:t.complexity},this._state.updateSession({connected:!0,mode:this._status.mode,lastSync:new Date().toISOString()}),this.render())}_startPolling(){this._ownPollInterval=setInterval(async()=>{try{let t=await this._api.getStatus();this._updateFromStatus(t)}catch{this._status.connected=!1,this._status.mode="offline",this.render()}},3e3)}_stopPolling(){this._ownPollInterval&&(clearInterval(this._ownPollInterval),this._ownPollInterval=null)}_formatUptime(t){if(!t||t<0)return"--";let e=Math.floor(t/3600),i=Math.floor(t%3600/60),a=Math.floor(t%60);return e>0?`${e}h ${i}m`:i>0?`${i}m ${a}s`:`${a}s`}_escapeHtml(t){let e=document.createElement("div");return e.textContent=String(t??""),e.innerHTML}_getStatusClass(){switch(this._status.mode){case"running":case"autonomous":return"active";case"paused":return"paused";case"stopped":return"stopped";case"error":return"error";default:return"offline"}}_getStatusLabel(){switch(this._status.mode){case"running":case"autonomous":return"AUTONOMOUS";case"paused":return"PAUSED";case"stopped":return"STOPPED";case"error":return"ERROR";default:return"OFFLINE"}}_triggerStart(){this.dispatchEvent(new CustomEvent("session-start",{detail:this._status}))}async _triggerPause(){try{await this._api.pauseSession(),this._status.mode="paused",this.render()}catch(t){console.error("Failed to pause session:",t)}this.dispatchEvent(new CustomEvent("session-pause",{detail:this._status}))}async _triggerResume(){try{await this._api.resumeSession(),this._status.mode="running",this.render()}catch(t){console.error("Failed to resume session:",t)}this.dispatchEvent(new CustomEvent("session-resume",{detail:this._status}))}async _triggerStop(){try{await this._api.stopSession(),this._status.mode="stopped",this.render()}catch(t){console.error("Failed to stop session:",t)}this.dispatchEvent(new CustomEvent("session-stop",{detail:this._status}))}render(){let t=this.hasAttribute("compact"),e=this._getStatusClass(),i=this._getStatusLabel(),a=["running","autonomous"].includes(this._status.mode),s=this._status.mode==="paused",r=`
+    `,this._attachEventListeners()}_attachEventListeners(){let t=this.shadowRoot.getElementById("refresh-btn");t&&t.addEventListener("click",()=>this._loadTasks()),this.shadowRoot.querySelectorAll(".add-task-btn").forEach(a=>{a.addEventListener("click",()=>{this._openAddTaskModal(a.dataset.status)})}),this.shadowRoot.querySelectorAll(".task-card").forEach(a=>{let s=a.dataset.taskId,r=this._tasks.find(o=>o.id.toString()===s);r&&(a.addEventListener("click",()=>this._openTaskDetail(r)),a.addEventListener("keydown",o=>{o.key==="Enter"||o.key===" "?(o.preventDefault(),this._openTaskDetail(r)):(o.key==="ArrowDown"||o.key==="ArrowUp")&&(o.preventDefault(),this._navigateTaskCards(a,o.key==="ArrowDown"?"next":"prev"))}),a.classList.contains("draggable")&&(a.addEventListener("dragstart",o=>this._handleDragStart(o,r)),a.addEventListener("dragend",o=>this._handleDragEnd(o))))}),this.shadowRoot.querySelectorAll(".kanban-tasks").forEach(a=>{a.addEventListener("dragover",s=>this._handleDragOver(s)),a.addEventListener("dragenter",s=>this._handleDragEnter(s)),a.addEventListener("dragleave",s=>this._handleDragLeave(s)),a.addEventListener("drop",s=>this._handleDrop(s,a.dataset.status))});let e=this.shadowRoot.getElementById("modal-close-btn");e&&e.addEventListener("click",()=>this._closeTaskDetail());let i=this.shadowRoot.getElementById("task-detail-overlay");i&&i.addEventListener("click",a=>{a.target===i&&this._closeTaskDetail()})}_escapeHtml(t){let e=document.createElement("div");return e.textContent=t,e.innerHTML}_navigateTaskCards(t,e){let i=Array.from(this.shadowRoot.querySelectorAll(".task-card")),a=i.indexOf(t);if(a===-1)return;let s=e==="next"?a+1:a-1;s>=0&&s<i.length&&i[s].focus()}};customElements.get("loki-task-board")||customElements.define("loki-task-board",U);var O=class extends h{static get observedAttributes(){return["api-url","theme","compact"]}constructor(){super(),this._status={mode:"offline",phase:null,iteration:null,complexity:null,connected:!1,version:null,uptime:0,activeAgents:0,pendingTasks:0},this._api=null,this._state=z(),this._statusUpdateHandler=null,this._connectedHandler=null,this._disconnectedHandler=null}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadStatus(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling(),this._api&&(this._statusUpdateHandler&&this._api.removeEventListener(u.STATUS_UPDATE,this._statusUpdateHandler),this._connectedHandler&&this._api.removeEventListener(u.CONNECTED,this._connectedHandler),this._disconnectedHandler&&this._api.removeEventListener(u.DISCONNECTED,this._disconnectedHandler))}attributeChangedCallback(t,e,i){e!==i&&(t==="api-url"&&this._api&&(this._api.baseUrl=i,this._loadStatus()),t==="theme"&&this._applyTheme(),t==="compact"&&this.render())}_setupApi(){let t=this.getAttribute("api-url")||window.location.origin;this._api=g({baseUrl:t}),this._statusUpdateHandler=e=>this._updateFromStatus(e.detail),this._connectedHandler=()=>{this._status.connected=!0,this.render()},this._disconnectedHandler=()=>{this._status.connected=!1,this._status.mode="offline",this.render()},this._api.addEventListener(u.STATUS_UPDATE,this._statusUpdateHandler),this._api.addEventListener(u.CONNECTED,this._connectedHandler),this._api.addEventListener(u.DISCONNECTED,this._disconnectedHandler)}async _loadStatus(){try{let t=await this._api.getStatus();this._updateFromStatus(t)}catch{this._status.connected=!1,this._status.mode="offline",this.render()}}_updateFromStatus(t){t&&(this._status={...this._status,connected:!0,mode:t.status||"running",version:t.version,uptime:t.uptime_seconds||0,activeAgents:t.running_agents||0,pendingTasks:t.pending_tasks||0,phase:t.phase,iteration:t.iteration,complexity:t.complexity},this._state.updateSession({connected:!0,mode:this._status.mode,lastSync:new Date().toISOString()}),this.render())}_startPolling(){this._ownPollInterval=setInterval(async()=>{try{let t=await this._api.getStatus();this._updateFromStatus(t)}catch{this._status.connected=!1,this._status.mode="offline",this.render()}},3e3)}_stopPolling(){this._ownPollInterval&&(clearInterval(this._ownPollInterval),this._ownPollInterval=null)}_formatUptime(t){if(!t||t<0)return"--";let e=Math.floor(t/3600),i=Math.floor(t%3600/60),a=Math.floor(t%60);return e>0?`${e}h ${i}m`:i>0?`${i}m ${a}s`:`${a}s`}_escapeHtml(t){let e=document.createElement("div");return e.textContent=String(t??""),e.innerHTML}_getStatusClass(){switch(this._status.mode){case"running":case"autonomous":return"active";case"paused":return"paused";case"stopped":return"stopped";case"error":return"error";default:return"offline"}}_getStatusLabel(){switch(this._status.mode){case"running":case"autonomous":return"AUTONOMOUS";case"paused":return"PAUSED";case"stopped":return"STOPPED";case"error":return"ERROR";default:return"OFFLINE"}}_triggerStart(){this.dispatchEvent(new CustomEvent("session-start",{detail:this._status}))}async _triggerPause(){try{let t=await this._api.pauseSession();if(t&&t.error)throw new Error(t.error);this._status.mode="paused",this.render(),this.dispatchEvent(new CustomEvent("session-pause",{detail:this._status}))}catch(t){console.error("Failed to pause session:",t),this.render()}}async _triggerResume(){try{let t=await this._api.resumeSession();if(t&&t.error)throw new Error(t.error);this._status.mode="running",this.render(),this.dispatchEvent(new CustomEvent("session-resume",{detail:this._status}))}catch(t){console.error("Failed to resume session:",t),this.render()}}async _triggerStop(){try{let t=await this._api.stopSession();if(t&&t.error)throw new Error(t.error);this._status.mode="stopped",this.render(),this.dispatchEvent(new CustomEvent("session-stop",{detail:this._status}))}catch(t){console.error("Failed to stop session:",t),this.render()}}render(){let t=this.hasAttribute("compact"),e=this._getStatusClass(),i=this._getStatusLabel(),a=["running","autonomous"].includes(this._status.mode),s=this._status.mode==="paused",r=`
       <style>
         ${this.getBaseStyles()}
 
@@ -2307,7 +2307,7 @@ var LokiDashboard=(()=>{var pt=Object.defineProperty;var Pt=Object.getOwnPropert
     `;this.shadowRoot.innerHTML=`
       ${r}
       ${t?o:n}
-    `,this._attachEventListeners()}_attachEventListeners(){let t=this.shadowRoot.getElementById("pause-btn"),e=this.shadowRoot.getElementById("resume-btn"),i=this.shadowRoot.getElementById("stop-btn"),a=this.shadowRoot.getElementById("start-btn");t&&t.addEventListener("click",()=>this._triggerPause()),e&&e.addEventListener("click",()=>this._triggerResume()),i&&i.addEventListener("click",()=>this._triggerStop()),a&&a.addEventListener("click",()=>this._triggerStart())}};customElements.get("loki-session-control")||customElements.define("loki-session-control",O);var Et={info:{color:"var(--loki-blue)",label:"INFO"},success:{color:"var(--loki-green)",label:"SUCCESS"},warning:{color:"var(--loki-yellow)",label:"WARN"},error:{color:"var(--loki-red)",label:"ERROR"},step:{color:"var(--loki-purple)",label:"STEP"},agent:{color:"var(--loki-accent)",label:"AGENT"},debug:{color:"var(--loki-text-muted)",label:"DEBUG"}},N=class extends h{static get observedAttributes(){return["api-url","max-lines","auto-scroll","theme","log-file"]}constructor(){super(),this._logs=[],this._maxLines=500,this._autoScroll=!0,this._filter="",this._levelFilter="all",this._api=null,this._pollInterval=null,this._logMessageHandler=null}connectedCallback(){super.connectedCallback(),this._maxLines=parseInt(this.getAttribute("max-lines"))||500,this._autoScroll=this.hasAttribute("auto-scroll"),this._setupApi(),this._startLogPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopLogPolling(),this._api&&this._logMessageHandler&&this._api.removeEventListener(u.LOG_MESSAGE,this._logMessageHandler)}attributeChangedCallback(t,e,i){if(e!==i)switch(t){case"api-url":this._api&&(this._api.baseUrl=i);break;case"max-lines":this._maxLines=parseInt(i)||500,this._trimLogs(),this.render();break;case"auto-scroll":this._autoScroll=this.hasAttribute("auto-scroll"),this.render();break;case"theme":this._applyTheme();break}}_setupApi(){let t=this.getAttribute("api-url")||window.location.origin;this._api=g({baseUrl:t}),this._logMessageHandler=e=>this._addLog(e.detail),this._api.addEventListener(u.LOG_MESSAGE,this._logMessageHandler)}_startLogPolling(){let t=this.getAttribute("log-file");t?this._pollLogFile(t):this._pollApiLogs()}async _pollApiLogs(){let t=0,e=async()=>{try{let i=await this._api.getLogs(200);if(Array.isArray(i)&&i.length>t){let a=i.slice(t);for(let s of a)s.message&&s.message.trim()&&this._addLog({message:s.message,level:s.level||"info",timestamp:s.timestamp||new Date().toLocaleTimeString()});t=i.length}}catch{}};e(),this._apiPollInterval=setInterval(e,2e3)}async _pollLogFile(t){let e=0,i=async()=>{try{let a=await fetch(`${t}?t=${Date.now()}`);if(!a.ok)return;let r=(await a.text()).split(`
+    `,this._attachEventListeners()}_attachEventListeners(){let t=this.shadowRoot.getElementById("pause-btn"),e=this.shadowRoot.getElementById("resume-btn"),i=this.shadowRoot.getElementById("stop-btn"),a=this.shadowRoot.getElementById("start-btn");t&&t.addEventListener("click",()=>this._triggerPause()),e&&e.addEventListener("click",()=>this._triggerResume()),i&&i.addEventListener("click",()=>this._triggerStop()),a&&a.addEventListener("click",()=>this._triggerStart())}};customElements.get("loki-session-control")||customElements.define("loki-session-control",O);var Et={info:{color:"var(--loki-blue)",label:"INFO"},success:{color:"var(--loki-green)",label:"SUCCESS"},warning:{color:"var(--loki-yellow)",label:"WARN"},error:{color:"var(--loki-red)",label:"ERROR"},step:{color:"var(--loki-purple)",label:"STEP"},agent:{color:"var(--loki-accent)",label:"AGENT"},debug:{color:"var(--loki-text-muted)",label:"DEBUG"}},N=class extends h{static get observedAttributes(){return["api-url","max-lines","auto-scroll","theme","log-file"]}constructor(){super(),this._logs=[],this._maxLines=500,this._autoScroll=!0,this._filter="",this._levelFilter="all",this._api=null,this._pollInterval=null,this._logMessageHandler=null}connectedCallback(){super.connectedCallback(),this._maxLines=parseInt(this.getAttribute("max-lines"))||500,this._autoScroll=this.hasAttribute("auto-scroll"),this._setupApi(),this._startLogPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopLogPolling(),this._api&&this._logMessageHandler&&this._api.removeEventListener(u.LOG_MESSAGE,this._logMessageHandler)}attributeChangedCallback(t,e,i){if(e!==i)switch(t){case"api-url":this._api&&(this._api.baseUrl=i);break;case"max-lines":this._maxLines=parseInt(i)||500,this._trimLogs(),this.render();break;case"auto-scroll":this._autoScroll=this.hasAttribute("auto-scroll"),this.render();break;case"theme":this._applyTheme();break}}_setupApi(){let t=this.getAttribute("api-url")||window.location.origin;this._api=g({baseUrl:t}),this._logMessageHandler=e=>this._addLog(e.detail),this._api.addEventListener(u.LOG_MESSAGE,this._logMessageHandler)}_startLogPolling(){let t=this.getAttribute("log-file");t?this._pollLogFile(t):this._pollApiLogs()}async _pollApiLogs(){let t=0,e=async()=>{try{let i=await this._api.getLogs(200);if(Array.isArray(i)&&i.length>t){let a=i.slice(t);for(let s of a)s.message&&s.message.trim()&&this._addLog({message:s.message,level:s.level||"info",timestamp:s.timestamp||new Date().toLocaleTimeString()});t=i.length}}catch{}};e(),this._apiPollInterval=setInterval(e,2e3)}async _pollLogFile(t){let e=0,i=async()=>{try{let a=await fetch(`${t}?t=${Date.now()}`,{credentials:"include"});if(!a.ok)return;let r=(await a.text()).split(`
 `);if(r.length>e){let o=r.slice(e);for(let n of o)n.trim()&&this._addLog(this._parseLine(n));e=r.length}}catch{}};i(),this._pollInterval=setInterval(i,1e3)}_stopLogPolling(){this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null),this._apiPollInterval&&(clearInterval(this._apiPollInterval),this._apiPollInterval=null)}_parseLine(t){let e=t.match(/^\[([^\]]+)\]\s*\[([^\]]+)\]\s*(.+)$/);if(e)return{timestamp:e[1],level:e[2].toLowerCase(),message:e[3]};let i=t.match(/^(\d{2}:\d{2}:\d{2})\s+(\w+)\s+(.+)$/);return i?{timestamp:i[1],level:i[2].toLowerCase(),message:i[3]}:{timestamp:new Date().toLocaleTimeString(),level:"info",message:t}}_addLog(t){if(!t)return;let e={id:Date.now()+Math.random(),timestamp:t.timestamp||new Date().toLocaleTimeString(),level:(t.level||"info").toLowerCase(),message:t.message||t};this._logs.push(e),this._trimLogs(),this.dispatchEvent(new CustomEvent("log-received",{detail:e})),this._renderLogs(),this._autoScroll&&this._scrollToBottom()}_trimLogs(){this._logs.length>this._maxLines&&(this._logs=this._logs.slice(-this._maxLines))}_clearLogs(){this._logs=[],this.dispatchEvent(new CustomEvent("logs-cleared")),this._renderLogs()}_toggleAutoScroll(){this._autoScroll=!this._autoScroll,this.render(),this._autoScroll&&this._scrollToBottom()}_scrollToBottom(){requestAnimationFrame(()=>{let t=this.shadowRoot.getElementById("log-output");t&&(t.scrollTop=t.scrollHeight)})}_downloadLogs(){let t=this._logs.map(s=>`[${s.timestamp}] [${s.level.toUpperCase()}] ${s.message}`).join(`
 `),e=new Blob([t],{type:"text/plain"}),i=URL.createObjectURL(e),a=document.createElement("a");a.href=i,a.download=`loki-logs-${new Date().toISOString().split("T")[0]}.txt`,a.click(),URL.revokeObjectURL(i)}_setFilter(t){this._filter=t.toLowerCase(),this._renderLogs()}_setLevelFilter(t){this._levelFilter=t,this._renderLogs()}_getFilteredLogs(){return this._logs.filter(t=>!(this._levelFilter!=="all"&&t.level!==this._levelFilter||this._filter&&!t.message.toLowerCase().includes(this._filter)))}_renderLogs(){let t=this.shadowRoot.getElementById("log-output");if(!t)return;let e=this._getFilteredLogs();if(e.length===0){t.innerHTML='<div class="log-empty">No log output yet. Terminal will update when Loki Mode is running.</div>';return}t.innerHTML=e.map(i=>{let a=Et[i.level]||Et.info;return`
         <div class="log-line">

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Complete installation instructions for all platforms and use cases.
 
-**Version:** v6.37.2
+**Version:** v6.37.4
 
 ---
 

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '6.37.2'
+__version__ = '6.37.4'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loki-mode",
-  "version": "6.37.2",
+  "version": "6.37.4",
   "description": "Loki Mode by Autonomi - Multi-agent autonomous startup system for Claude Code, Codex CLI, and Gemini CLI",
   "keywords": [
     "agent",

package/web-app/server.py

@@ -685,25 +685,29 @@ def _run_loki_cmd(args: list, cwd: Optional[str] = None, timeout: int = 60) -> t
     """Run a loki CLI command and return (returncode, combined output).
 
     Uses list form -- never shell=True with user input.
+    On timeout, the subprocess is explicitly killed to avoid orphaned processes.
     """
     loki = _find_loki_cli()
     if loki is None:
         return (1, "loki CLI not found")
     full_cmd = [loki] + args
     try:
-        result = subprocess.run(
+        proc = subprocess.Popen(
             full_cmd,
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,
             stdin=subprocess.DEVNULL,
             text=True,
             cwd=cwd or session.project_dir or str(Path.home()),
-            timeout=timeout,
             env={**os.environ},
         )
-        return (result.returncode, result.stdout or "")
-    except subprocess.TimeoutExpired:
-        return (1, "Command timed out")
+        try:
+            stdout, _ = proc.communicate(timeout=timeout)
+            return (proc.returncode, stdout or "")
+        except subprocess.TimeoutExpired:
+            proc.kill()
+            proc.wait()
+            return (1, "Command timed out")
     except Exception as e:
         return (1, str(e))
 
@@ -1154,7 +1158,10 @@ async def _push_state_to_client(ws: WebSocket) -> None:
     """Background task: push state snapshots to a single WebSocket client.
 
     Pushes every 2s when a session is running, every 30s when idle.
+    Sends only incremental log deltas (new lines since last push) instead
+    of the full log buffer each time.
     """
+    last_log_index = max(len(session.log_lines) - 100, 0)  # backfill handled on connect
     while True:
         is_running = (
             session.process is not None
@@ -1214,10 +1221,12 @@ async def _push_state_to_client(ws: WebSocket) -> None:
             except (json.JSONDecodeError, OSError):
                 pass
 
-        # Build logs payload (last 50 lines)
-        recent = session.log_lines[-50:] if session.log_lines else []
+        # Build incremental logs payload (only new lines since last push)
+        current_len = len(session.log_lines)
+        new_lines = session.log_lines[last_log_index:current_len] if current_len > last_log_index else []
+        last_log_index = current_len
         logs_payload = []
-        for line in recent:
+        for line in new_lines:
             level = "info"
             lower = line.lower()
             if "error" in lower or "fail" in lower:
@@ -1271,17 +1280,30 @@ async def websocket_endpoint(ws: WebSocket) -> None:
     # Start server-push state task for this connection
     push_task = asyncio.create_task(_push_state_to_client(ws))
 
+    missed_pongs = 0
     try:
         while True:
-            # Keep connection alive; handle client messages if needed
-            data = await ws.receive_text()
-            # Could handle commands here (e.g., stop session)
             try:
-                msg = json.loads(data)
-                if msg.get("type") == "ping":
-                    await ws.send_text(json.dumps({"type": "pong"}))
-            except json.JSONDecodeError:
-                pass
+                data = await asyncio.wait_for(ws.receive_text(), timeout=60.0)
+                missed_pongs = 0  # any message resets idle counter
+                try:
+                    msg = json.loads(data)
+                    if msg.get("type") == "ping":
+                        await ws.send_text(json.dumps({"type": "pong"}))
+                    elif msg.get("type") == "pong":
+                        pass  # client responded to our ping
+                except json.JSONDecodeError:
+                    pass
+            except asyncio.TimeoutError:
+                # No message for 60s -- send a ping
+                missed_pongs += 1
+                if missed_pongs >= 2:
+                    # Two consecutive pings with no reply -- close idle connection
+                    break
+                try:
+                    await ws.send_text(json.dumps({"type": "ping"}))
+                except Exception:
+                    break
     except WebSocketDisconnect:
         pass
     finally: