loki-mode 7.12.0 → 7.14.0

package/dashboard/server.py

@@ -5396,6 +5396,100 @@ async def create_checkpoint(body: CheckpointCreate = None):
     return metadata
 
 
+@app.post(
+    "/api/checkpoints/{checkpoint_id}/rollback",
+    dependencies=[Depends(auth.require_scope("control"))],
+)
+async def rollback_checkpoint(checkpoint_id: str):
+    """Restore .loki/ state from a checkpoint (R6: un-deads the dashboard
+    rollback button, which already POSTed here).
+
+    Safety:
+    - require_scope("control"): destructive, so it needs the control scope.
+    - _sanitize_checkpoint_id: blocks path traversal.
+    - Re-undoability invariant: a forced pre-rollback snapshot of current state
+      is captured BEFORE overwriting, so the human can undo the undo. The
+      pre_rollback_snapshot id is returned in the response so the caller can
+      surface it to the user.
+    - Glob-restore: copies back whatever files the checkpoint dir contains, so it
+      works regardless of which writer (run.sh / loki / dashboard) created it.
+    """
+    import shutil
+
+    checkpoint_id = _sanitize_checkpoint_id(checkpoint_id)
+    loki_dir = _get_loki_dir()
+    checkpoints_dir = loki_dir / "state" / "checkpoints"
+    cp_dir = checkpoints_dir / checkpoint_id
+
+    if not cp_dir.is_dir():
+        raise HTTPException(status_code=404, detail="Checkpoint not found")
+
+    # 1. Forced pre-rollback snapshot of current state (re-undoability).
+    now = datetime.now(timezone.utc)
+    pre_id = now.strftime("rb-pre-%Y%m%d-%H%M%S")
+    pre_dir = checkpoints_dir / pre_id
+    pre_dir.mkdir(parents=True, exist_ok=True)
+    for name in ("session.json", "dashboard-state.json", "CONTINUITY.md", "autonomy-state.json"):
+        src = loki_dir / name
+        if src.exists() and src.is_file():
+            try:
+                shutil.copy2(str(src), str(pre_dir / name))
+            except Exception:
+                pass
+    for dname in ("state", "queue"):
+        src = loki_dir / dname
+        if src.exists() and src.is_dir():
+            try:
+                shutil.copytree(str(src), str(pre_dir / dname), dirs_exist_ok=True)
+            except Exception:
+                pass
+    pre_meta = {
+        "id": pre_id,
+        "created_at": now.isoformat(),
+        "message": f"pre-rollback snapshot (before restoring {checkpoint_id})",
+        "created_by": "dashboard rollback",
+    }
+    try:
+        (pre_dir / "metadata.json").write_text(json.dumps(pre_meta, indent=2))
+        with open(str(checkpoints_dir / "index.jsonl"), "a") as f:
+            f.write(json.dumps(pre_meta) + "\n")
+    except Exception:
+        pass
+
+    # 2. Glob-restore the checkpoint contents back into .loki/.
+    # IMPORTANT: never rmtree a destination dir wholesale -- the checkpoint store
+    # itself lives under .loki/state/checkpoints/, so deleting .loki/state/ would
+    # destroy every checkpoint (including the one being restored AND the
+    # pre-rollback snapshot we just made). Merge directories with dirs_exist_ok
+    # so the checkpoints store survives.
+    restored = 0
+    errors = []
+    for item in cp_dir.iterdir():
+        if item.name in ("metadata.json", "worktree-snapshot.txt"):
+            continue
+        dest = loki_dir / item.name
+        try:
+            if item.is_dir():
+                shutil.copytree(str(item), str(dest), dirs_exist_ok=True)
+            else:
+                dest.parent.mkdir(parents=True, exist_ok=True)
+                shutil.copy2(str(item), str(dest))
+            restored += 1
+        except Exception as e:  # noqa: BLE001 -- report, do not abort other files
+            errors.append(f"{item.name}: {e}")
+
+    return {
+        "id": checkpoint_id,
+        "restored": restored,
+        "pre_rollback_snapshot": pre_id,
+        "errors": errors,
+        "message": (
+            f"Restored {restored} item(s) from {checkpoint_id}. "
+            f"Prior state saved as {pre_id} (undo this rollback by restoring it)."
+        ),
+    }
+
+
 # =============================================================================
 # Agent Management API (v5.25.0)
 # =============================================================================
@@ -7507,6 +7601,114 @@ async def get_proof_html(run_id: str):
     return FileResponse(str(index_html), media_type="text/html")
 
 
+# ---------------------------------------------------------------------------
+# R5: Auto-wiki + cited codebase Q&A (Loki's DeepWiki).
+#
+# Surfaces the per-project wiki generated by autonomy/lib/wiki-generator.py
+# (stored under <project>/.loki/wiki/) and the grounded `ask` flow
+# (autonomy/lib/wiki-ask.py). Citations are file:line and always point at real
+# code -- the generator/ask scripts validate every citation against the
+# filesystem before emitting it, so the dashboard never shows a fabricated one.
+#
+# The section param is traversal-safe, mirroring _safe_proof_run_dir: only the
+# known section ids are accepted, so no arbitrary path can be read.
+# ---------------------------------------------------------------------------
+_WIKI_SECTIONS = {"architecture", "modules", "data-flow"}
+
+
+def _wiki_dir() -> _Path:
+    return _get_loki_dir() / "wiki"
+
+
+def _project_root() -> _Path:
+    """Resolve the active project root (.loki's parent)."""
+    return _get_loki_dir().parent
+
+
+@app.get("/api/wiki", dependencies=[Depends(auth.require_scope("read"))])
+async def get_wiki():
+    """Return the wiki manifest + section list for the active project."""
+    wiki_dir = _wiki_dir()
+    wiki_json = wiki_dir / "wiki.json"
+    if not wiki_json.is_file():
+        return {"generated": False, "sections": [],
+                "message": "No wiki generated. Run 'loki wiki generate'."}
+    data = _safe_json_read(wiki_json, default=None)
+    if not isinstance(data, dict):
+        raise HTTPException(status_code=500, detail="wiki.json unreadable")
+    manifest = _safe_json_read(wiki_dir / "wiki-manifest.json", default={}) or {}
+    sections = [
+        {"id": s.get("id"), "title": s.get("title"),
+         "citation_count": len(s.get("citations") or [])}
+        for s in data.get("sections", [])
+        if isinstance(s, dict)
+    ]
+    return {
+        "generated": True,
+        "project": data.get("project"),
+        "generated_at": data.get("generated_at"),
+        "file_count": data.get("file_count"),
+        "signature": manifest.get("signature"),
+        "sections": sections,
+    }
+
+
+@app.get("/api/wiki/{section}", dependencies=[Depends(auth.require_scope("read"))])
+async def get_wiki_section(section: str):
+    """Return one wiki section (body + validated file:line citations)."""
+    if section not in _WIKI_SECTIONS:
+        raise HTTPException(status_code=400, detail=f"unknown section: {section}")
+    wiki_json = _wiki_dir() / "wiki.json"
+    if not wiki_json.is_file():
+        raise HTTPException(status_code=404, detail="wiki not generated")
+    data = _safe_json_read(wiki_json, default=None)
+    if not isinstance(data, dict):
+        raise HTTPException(status_code=500, detail="wiki.json unreadable")
+    for s in data.get("sections", []):
+        if isinstance(s, dict) and s.get("id") == section:
+            return JSONResponse(content=s)
+    raise HTTPException(status_code=404, detail=f"section not found: {section}")
+
+
+class WikiAskRequest(BaseModel):
+    question: str = Field(..., min_length=1, max_length=2000)
+    k: int = Field(default=6, ge=1, le=20)
+
+
+@app.post("/api/wiki/ask", dependencies=[Depends(auth.require_scope("read"))])
+async def post_wiki_ask(req: WikiAskRequest):
+    """Grounded, cited codebase Q&A.
+
+    Shells out to autonomy/lib/wiki-ask.py (the single source of truth for the
+    grounding + citation-validation contract) and returns its JSON. Every
+    citation in the response resolves to a real file:line.
+    """
+    project_root = _project_root()
+    repo_root = _Path(__file__).resolve().parent.parent
+    ask_script = repo_root / "autonomy" / "lib" / "wiki-ask.py"
+    if not ask_script.is_file():
+        raise HTTPException(status_code=503, detail="wiki-ask backend missing")
+    try:
+        proc = subprocess.run(
+            ["python3", str(ask_script), "--root", str(project_root),
+             "--question", req.question, "--k", str(req.k), "--json"],
+            capture_output=True, text=True, timeout=180,
+            cwd=str(project_root),
+        )
+    except (OSError, subprocess.SubprocessError) as e:
+        raise HTTPException(status_code=503, detail=f"wiki ask failed: {e}")
+    if proc.returncode == 3:
+        return {"question": req.question, "answer": "",
+                "citations": [], "note": "no relevant code found"}
+    if proc.returncode != 0:
+        raise HTTPException(status_code=500,
+                            detail=(proc.stderr or "wiki ask error").strip())
+    try:
+        return JSONResponse(content=json.loads(proc.stdout))
+    except json.JSONDecodeError:
+        raise HTTPException(status_code=500, detail="wiki ask returned bad JSON")
+
+
 # ---------------------------------------------------------------------------
 # SPA catch-all: serve index.html for any path not matched by API routes
 # or static asset mounts.  This lets the dashboard UI handle client-side routing.