loki-mode 8.6.0 → 8.8.0

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "8.6.0"
+__version__ = "8.8.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -2802,16 +2802,153 @@ _SESSION_MODEL_ALLOWLIST = ("haiku", "sonnet", "opus", "fable")
 # allowlist is unchanged) because it is an explicit live-run control.
 _START_MODEL_ALLOWLIST = ("haiku", "sonnet", "opus")
 
+# Provider-agnostic capability tiers. These are the vocabulary the picker offers
+# on a non-Claude provider, and they resolve per-provider through
+# providers/models.sh (loki_tier_alias): small -> fast, medium -> development,
+# high -> planning. Accepting them here is what makes the start-time picker work
+# on codex at all -- the Claude aliases above are meaningless there, so before
+# this every value a codex user could pick normalized to "" and was silently
+# dropped, and the run started on the provider default with no feedback.
+_START_MODEL_GENERIC_TIERS = ("small", "medium", "high")
+
 
 def _normalize_start_model(raw: str | None) -> str:
-    """Normalize a start-time model / advisor alias (haiku|sonnet|opus, no fable).
+    """Normalize a start-time model / advisor alias.
 
-    Same trim + lowercase + exact-match rule as _normalize_session_model, but on
-    the narrower _START_MODEL_ALLOWLIST. Returns "" for absent/invalid/fable so
+    Accepts the Claude aliases (haiku|sonnet|opus, no fable) and the generic
+    capability tiers (small|medium|high). Returns "" for absent/invalid/fable so
     callers can treat empty as "no selection" (engine uses its own default).
+
+    fable stays excluded: it is advisory-only and the runner collapses it to
+    opus, so offering it as a start-time execution model would be a cost
+    surprise. That reasoning is unchanged by adding the generic tiers.
     """
     val = (raw or "").strip().lower()
-    return val if val in _START_MODEL_ALLOWLIST else ""
+    if val in _START_MODEL_ALLOWLIST or val in _START_MODEL_GENERIC_TIERS:
+        return val
+    return ""
+
+
+# =============================================================================
+# Provider-aware model offer set
+# =============================================================================
+# The two allowlists above are WIRE values: what run.sh will actually honor in
+# .loki/state/model-override. They are Claude aliases because run.sh:20996 gates
+# the whole override block on PROVIDER_NAME=claude and feeds the file straight
+# into `claude --model`. They must not change.
+#
+# What the dashboard OFFERS is a separate question, and it was the bug: the
+# picker rendered those four Claude aliases on every run, so a codex session was
+# offered Haiku/Sonnet/Opus/Fable, none of which codex can dispatch. The offer
+# set below is derived from the RUNNING session's provider plus the canonical
+# providers/model_catalog.json, so the picker never names a model the active
+# provider cannot run.
+
+# Generic tier -> catalog key. These three tier names are provider-independent
+# (every catalog entry carries latest_fast/development/planning), which is what
+# makes the picker portable across providers.
+_TIER_LABELS = (
+    ("small", "fast"),
+    ("medium", "development"),
+    ("high", "planning"),
+)
+
+
+def _active_provider() -> str:
+    """The provider the CURRENT run is executing on.
+
+    Resolution order mirrors the CLI (autonomy/loki:5142): the per-project state
+    file run.sh writes at launch (run.sh:1458), then the environment, then the
+    stock default. The state file wins because it is the only source that
+    reflects the live run rather than the dashboard process's own environment.
+    """
+    try:
+        p = _get_loki_dir() / "state" / "provider"
+        if p.is_file():
+            val = p.read_text().strip().lower()
+            if val:
+                return val
+    except OSError:
+        pass
+    return (os.environ.get("LOKI_PROVIDER") or "claude").strip().lower() or "claude"
+
+
+def _load_model_catalog() -> dict:
+    """Read providers/model_catalog.json, the single source of truth for model ids.
+
+    Same candidate paths as GET /api/providers/models. Returns {} when the
+    catalog is unreadable; every caller degrades to "no model ids to show"
+    rather than inventing one.
+    """
+    for path in (
+        _Path(__file__).resolve().parent.parent / "providers" / "model_catalog.json",
+        _Path("providers/model_catalog.json"),
+    ):
+        try:
+            if path.exists():
+                with path.open("r", encoding="utf-8") as fh:
+                    return json.load(fh)
+        except (json.JSONDecodeError, OSError):
+            continue
+    return {}
+
+
+def _resolve_catalog_model(provider: str, catalog_tier: str) -> str:
+    """The model id `provider` dispatches for `catalog_tier` (fast/development/planning).
+
+    Python mirror of loki_latest_model (providers/models.sh:22), including its
+    env-override chain and its "generic" registry fallback for a provider the
+    catalog does not name. Kept in Python rather than shelling out to models.sh:
+    the dashboard answers this per request and a subprocess per tier per poll is
+    not worth it. Model IDS still come only from the catalog, never from here.
+    """
+    provider_env = re.sub(r"[^A-Z0-9_]", "_", provider.upper())
+    for var in (
+        f"LOKI_{provider_env}_MODEL_{catalog_tier.upper()}",
+        f"LOKI_{provider_env}_MODEL",
+    ):
+        val = (os.environ.get(var) or "").strip()
+        if val:
+            return val
+    providers = _load_model_catalog().get("providers", {})
+    entry = providers.get(provider) or providers.get("generic") or {}
+    return str(entry.get(f"latest_{catalog_tier}") or "")
+
+
+def _provider_model_offers(provider: str) -> list[dict]:
+    """The model choices to OFFER for `provider`, each with what it resolves to.
+
+    Claude keeps its established alias picker byte-for-byte: those aliases are
+    the values run.sh honors in the override file, so changing them would break
+    the one provider where mid-run switching actually works.
+
+    Every other provider is offered the generic tiers (small/medium/high), which
+    are provider-independent, each annotated with the concrete model id the
+    catalog says that provider dispatches. That is what makes the picker read
+    "medium -> gpt-5.3-codex" on codex and "medium -> claude-sonnet-5" on claude
+    without the frontend knowing a single model id.
+    """
+    if provider == "claude":
+        aliases = _load_model_catalog().get("providers", {}).get("claude", {}).get("cli_aliases", {})
+        return [
+            {"value": alias, "tier": None, "model": aliases.get(alias, "")}
+            for alias in _SESSION_MODEL_ALLOWLIST
+        ]
+    return [
+        {"value": tier, "tier": tier, "model": _resolve_catalog_model(provider, catalog_tier)}
+        for tier, catalog_tier in _TIER_LABELS
+    ]
+
+
+def _provider_supports_model_switch(provider: str) -> bool:
+    """Whether a live run on `provider` honors .loki/state/model-override.
+
+    Only claude does: run.sh:20996 gates the entire override-read block on
+    PROVIDER_NAME=claude. On any other provider the file is written and never
+    read, so the POST path rejects rather than reporting a switch that will not
+    happen.
+    """
+    return provider == "claude"
 
 
 class SessionModelRequest(BaseModel):
@@ -2890,17 +3027,28 @@ def _normalize_session_model(raw: str | None) -> str:
 # tier names ARE valid pins.
 _SESSION_PIN_ALLOWLIST = _SESSION_MODEL_ALLOWLIST + ("planning", "development", "fast")
 
+# Generic capability vocabulary. A user picks a CLASS of model (small/medium/
+# high) and each provider supplies its own latest model in that class, so nobody
+# has to know a vendor's model names. These are translated onto the canonical
+# tier names rather than added to the allowlist, keeping this mirror in step
+# with run.sh's entry-point case and the `loki plan` estimator without widening
+# what any of the three actually route on. Mirrors loki_tier_alias() in
+# providers/models.sh.
+_GENERIC_TIERS = {"small": "fast", "medium": "development", "high": "planning"}
+
 
 def _normalize_session_pin(raw: str | None) -> str:
     """Normalize a LOKI_SESSION_MODEL pin value (aliases + raw tier names).
 
     Mirrors run.sh's session-pin case: trim + lowercase, accept the four model
-    aliases and the three tier names. Interior whitespace is preserved (so
+    aliases and the three tier names, and translate the generic small/medium/
+    high vocabulary onto those tier names. Interior whitespace is preserved (so
     "fab le" stays junk and falls through to the default tier, exactly like the
     runner's "*" arm). Use this for the session-pin (no-override) derivation;
     use _normalize_session_model for the override-file / POST path.
     """
     val = (raw or "").strip().lower()
+    val = _GENERIC_TIERS.get(val, val)
     return val if val in _SESSION_PIN_ALLOWLIST else ""
 
 
@@ -3126,11 +3274,24 @@ async def get_session_model():
     # the reported effective model agrees with dispatch on BOTH routes (v7.39.1).
     if effective == "fable":
         effective = "opus"
+    provider = _active_provider()
+    offers = _provider_model_offers(provider)
+    if provider != "claude":
+        # Non-claude: the claude-alias default/effective computed above describe a
+        # dispatch that is not happening on this run. Report what the provider
+        # actually runs, from the catalog, and drop the stale override (run.sh
+        # never reads the file on this provider, so it cannot be in effect).
+        override = None
+        default = "medium"
+        effective = _resolve_catalog_model(provider, "development")
     return {
         "override": override,
         "default": default,
         "effective": effective,
-        "allowed": list(_SESSION_MODEL_ALLOWLIST),
+        "provider": provider,
+        "switchable": _provider_supports_model_switch(provider),
+        "offers": offers,
+        "allowed": [o["value"] for o in offers],
     }
 
 
@@ -3156,6 +3317,22 @@ async def set_session_model(request: SessionModelRequest):
     """
     requested_raw = (request.model or "").strip().lower()
     override_path = _model_override_path()
+    # Mid-run switching is a claude-only runtime capability: run.sh:20996 gates the
+    # override-read block on PROVIDER_NAME=claude, so on any other provider this
+    # file would be written and never read. Reject instead of writing a file that
+    # does nothing and reporting success (a false affordance is worse than no
+    # control). Clearing is still allowed everywhere: removing a stale file is
+    # always safe and never claims a switch.
+    provider = _active_provider()
+    if requested_raw != "" and not _provider_supports_model_switch(provider):
+        raise HTTPException(
+            status_code=409,
+            detail=(
+                f"Mid-run model switching is not supported on provider '{provider}'. "
+                f"The run dispatches {_resolve_catalog_model(provider, 'development') or 'its configured model'}; "
+                "restart the run with a different model to change it."
+            ),
+        )
     if requested_raw == "":
         # Clear the override; revert to tier mapping.
         try:
@@ -3965,19 +4142,30 @@ async def start_build(request: Request, body: StartBuildRequest):
         popen_env["LOKI_TARGET_DIR"] = str(workspace_dir)
         popen_env["LOKI_DIR"] = str(loki_dir)
     if start_model:
-        # EXACT-model pin (not the session-pin tier route): set all three tier
-        # models to the chosen alias so resolve_model_for_tier returns the alias
-        # for every tier and every iteration dispatches exactly the picked model.
-        # This is the honest start-time equivalent of the mid-flight override
-        # file, which run.sh clears at iteration 0. LOKI_SESSION_MODEL is set too
-        # for internal coherence (the run's own tier accounting/logging), but the
-        # env triple is the load-bearing dispatch-honesty mechanism: on the
-        # v7.104.0 stock config the session pin alone would remap opus->planning->
-        # sonnet and haiku->fast->sonnet, dispatching sonnet for both.
-        popen_env["LOKI_CLAUDE_MODEL_PLANNING"] = start_model
-        popen_env["LOKI_CLAUDE_MODEL_DEVELOPMENT"] = start_model
-        popen_env["LOKI_CLAUDE_MODEL_FAST"] = start_model
-        popen_env["LOKI_SESSION_MODEL"] = start_model
+        if start_model in _START_MODEL_GENERIC_TIERS:
+            # A generic capability tier is provider-agnostic BY CONSTRUCTION --
+            # it names a capability class, not a model, and each provider
+            # resolves its own latest model for that class via
+            # providers/models.sh. Pinning the LOKI_CLAUDE_MODEL_* triple here
+            # would be actively wrong: those variables are inert on codex and
+            # every other non-Claude provider, so the pin would silently do
+            # nothing. LOKI_SESSION_MODEL is the correct and only lever.
+            popen_env["LOKI_SESSION_MODEL"] = start_model
+        else:
+            # EXACT-model pin (not the session-pin tier route): set all three tier
+            # models to the chosen alias so resolve_model_for_tier returns the alias
+            # for every tier and every iteration dispatches exactly the picked model.
+            # This is the honest start-time equivalent of the mid-flight override
+            # file, which run.sh clears at iteration 0. LOKI_SESSION_MODEL is set too
+            # for internal coherence (the run's own tier accounting/logging), but the
+            # env triple is the load-bearing dispatch-honesty mechanism: on the
+            # v7.104.0 stock config the session pin alone would remap
+            # opus->planning->sonnet and haiku->fast->sonnet, dispatching sonnet
+            # for both.
+            popen_env["LOKI_CLAUDE_MODEL_PLANNING"] = start_model
+            popen_env["LOKI_CLAUDE_MODEL_DEVELOPMENT"] = start_model
+            popen_env["LOKI_CLAUDE_MODEL_FAST"] = start_model
+            popen_env["LOKI_SESSION_MODEL"] = start_model
     if advisor_model:
         # Opt-in Opus (or other) judge for code review; execution model unchanged.
         popen_env["LOKI_ADVISOR_MODEL"] = advisor_model

package/dashboard/static/index.html

@@ -3774,19 +3774,19 @@ var LokiDashboard=(()=>{var Re=Object.defineProperty;var _t=Object.getOwnPropert
               </div>
             `}).join("")}
         </div>
-      `}}_attachEventListeners(){let e=this.shadowRoot.getElementById("refresh-btn");e&&e.addEventListener("click",()=>this._loadTasks());let t=this.shadowRoot.getElementById("bulk-toggle-btn");t&&t.addEventListener("click",()=>this._toggleBulkMode()),this.shadowRoot.querySelectorAll(".filter-pill").forEach(r=>{r.addEventListener("click",()=>this._setFilter(r.dataset.filter))});let i=this.shadowRoot.getElementById("task-search");i&&i.addEventListener("input",r=>this._setSearch(r.target.value)),this.shadowRoot.querySelectorAll(".show-more-btn").forEach(r=>{r.addEventListener("click",()=>this._showMore(r.dataset.showMore))}),this.shadowRoot.querySelectorAll(".bulk-btn").forEach(r=>{r.addEventListener("click",()=>{let o=r.dataset.bulkAction;o==="delete"?this._bulkDelete():this._bulkMove(o)})}),this.shadowRoot.querySelectorAll(".add-task-btn").forEach(r=>{r.addEventListener("click",()=>{this._openAddTaskModal(r.dataset.status)})}),this.shadowRoot.querySelectorAll(".task-checkbox").forEach(r=>{r.addEventListener("click",o=>{o.stopPropagation(),this._toggleTaskSelection(r.dataset.checkId,o)})}),this.shadowRoot.querySelectorAll(".expand-toggle").forEach(r=>{r.addEventListener("click",o=>{o.stopPropagation(),this._toggleCardExpand(r.dataset.expandId)})}),this.shadowRoot.querySelectorAll(".task-card").forEach(r=>{let o=r.dataset.taskId,n=this._tasks.find(l=>l.id.toString()===o);n&&(r.addEventListener("click",l=>{if(this._bulkMode){this._toggleTaskSelection(o,l);return}this._openTaskDetail(n)}),r.addEventListener("keydown",l=>{l.key==="Enter"||l.key===" "?(l.preventDefault(),this._bulkMode?this._toggleTaskSelection(o,l):this._openTaskDetail(n)):(l.key==="ArrowDown"||l.key==="ArrowUp")&&(l.preventDefault(),this._navigateTaskCards(r,l.key==="ArrowDown"?"next":"prev"))}),r.classList.contains("draggable")&&(r.addEventListener("dragstart",l=>this._handleDragStart(l,n)),r.addEventListener("dragend",l=>this._handleDragEnd(l))))}),this.shadowRoot.querySelectorAll(".kanban-tasks").forEach(r=>{r.addEventListener("dragover",o=>this._handleDragOver(o)),r.addEventListener("dragenter",o=>this._handleDragEnter(o)),r.addEventListener("dragleave",o=>this._handleDragLeave(o)),r.addEventListener("drop",o=>this._handleDrop(o,r.dataset.status))});let a=this.shadowRoot.getElementById("modal-close-btn");a&&a.addEventListener("click",()=>this._closeTaskDetail());let s=this.shadowRoot.getElementById("task-detail-overlay");s&&s.addEventListener("click",r=>{r.target===s&&this._closeTaskDetail()})}_escapeHtml(e){let t=document.createElement("div");return t.textContent=e,t.innerHTML}_navigateTaskCards(e,t){let i=Array.from(this.shadowRoot.querySelectorAll(".task-card")),a=i.indexOf(e);if(a===-1)return;let s=t==="next"?a+1:a-1;s>=0&&s<i.length&&i[s].focus()}};customElements.get("loki-task-board")||customElements.define("loki-task-board",Q);var X=class extends v{static get observedAttributes(){return["api-url","theme","compact"]}constructor(){super(),this._status={mode:"offline",phase:null,iteration:null,complexity:null,connected:!1,version:null,uptime:0,activeAgents:0,pendingTasks:0},this._model={override:null,default:"sonnet",effective:"sonnet",notice:""},this._modelBusy=!1,this._startBusy=!1,this._startNotice="",this._specText="",this._startModel="",this._advisorModel="",this._api=null,this._state=U(),this._statusUpdateHandler=null,this._connectedHandler=null,this._disconnectedHandler=null}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadStatus(),this._loadModel(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling(),this._teardownApiListeners()}_teardownApiListeners(){this._api&&(this._statusUpdateHandler&&this._api.removeEventListener(f.STATUS_UPDATE,this._statusUpdateHandler),this._connectedHandler&&this._api.removeEventListener(f.CONNECTED,this._connectedHandler),this._disconnectedHandler&&this._api.removeEventListener(f.DISCONNECTED,this._disconnectedHandler))}attributeChangedCallback(e,t,i){t!==i&&(e==="api-url"&&this._api&&(this._teardownApiListeners(),this._setupApi(),this._loadStatus(),this._loadModel()),e==="theme"&&this._applyTheme(),e==="compact"&&this.render())}_setupApi(){let e=this.getAttribute("api-url")||window.location.origin;this._api=h({baseUrl:e}),this._statusUpdateHandler=t=>this._updateFromStatus(t.detail),this._connectedHandler=()=>{this._status.connected=!0,this.render()},this._disconnectedHandler=()=>{this._status.connected=!1,this._status.mode="offline",this.render()},this._api.addEventListener(f.STATUS_UPDATE,this._statusUpdateHandler),this._api.addEventListener(f.CONNECTED,this._connectedHandler),this._api.addEventListener(f.DISCONNECTED,this._disconnectedHandler)}async _loadStatus(){let e=this._api;try{let t=await e.getStatus();if(e!==this._api)return;this._updateFromStatus(t)}catch{if(e!==this._api)return;this._status.connected=!1,this._status.mode="offline",this.render()}}_updateFromStatus(e){e&&(this._status={...this._status,connected:!0,mode:e.status||"running",version:e.version,uptime:e.uptime_seconds||0,activeAgents:e.running_agents||0,pendingTasks:e.pending_tasks||0,phase:e.phase,iteration:e.iteration,complexity:e.complexity},this._state.updateSession({connected:!0,mode:this._status.mode,lastSync:new Date().toISOString()}),this.render())}_startPolling(){this._poll=b({loadFn:()=>this._loadStatus(),intervalMs:3e3,sectionId:null,immediate:!1})}_stopPolling(){this._poll&&(this._poll.stop(),this._poll=null)}_formatUptime(e){if(!e||e<0)return"--";let t=Math.floor(e/3600),i=Math.floor(e%3600/60),a=Math.floor(e%60);return t>0?`${t}h ${i}m`:i>0?`${i}m ${a}s`:`${a}s`}_escapeHtml(e){let t=document.createElement("div");return t.textContent=String(e??""),t.innerHTML}_getStatusClass(){switch(this._status.mode){case"running":case"autonomous":return"active";case"paused":return"paused";case"stopped":return"stopped";case"error":return"error";default:return"offline"}}_getStatusLabel(){switch(this._status.mode){case"running":case"autonomous":return"AUTONOMOUS";case"paused":return"PAUSED";case"stopped":return"STOPPED";case"error":return"ERROR";default:return"OFFLINE"}}async _triggerStart(){if(this._startBusy)return;let e=(this._specText||"").trim();if(!e){this._startNotice="Enter a spec or one-line brief to start a build.",this.render();return}if(!this._api||typeof this._api.startSession!="function"){this._startNotice="Start is not available on this server.",this.render();return}this._startBusy=!0,this._startNotice="Starting build...",this.render();try{let t=await this._api.startSession(e,{provider:this._status.provider||"claude",model:this._startModel||"",advisorModel:this._advisorModel||""});if(t&&t.error)throw new Error(t.error);this._startBusy=!1,this._startNotice="",this._specText="",this._status.mode="running",this._status.connected=!0,this.render(),this._loadStatus(),this.dispatchEvent(new CustomEvent("session-start",{detail:{...this._status,pid:t&&t.pid,spec:t&&t.spec}}))}catch(t){console.error("Failed to start build:",t),this._startBusy=!1,this._startNotice=t&&t.message?`Could not start: ${t.message}`:"Could not start the build. Try again.",this.render()}}_onSpecInput(e){this._specText=e}async _triggerPause(){try{let e=await this._api.pauseSession();if(e&&e.error)throw new Error(e.error);this._status.mode="paused",this.render(),this.dispatchEvent(new CustomEvent("session-pause",{detail:this._status}))}catch(e){console.error("Failed to pause session:",e),this.render()}}async _triggerResume(){try{let e=await this._api.resumeSession();if(e&&e.error)throw new Error(e.error);this._status.mode="running",this.render(),this.dispatchEvent(new CustomEvent("session-resume",{detail:this._status}))}catch(e){console.error("Failed to resume session:",e),this.render()}}async _triggerStop(){try{let e=await this._api.stopSession();if(e&&e.error)throw new Error(e.error);this._status.mode="stopped",this.render(),this.dispatchEvent(new CustomEvent("session-stop",{detail:this._status}))}catch(e){console.error("Failed to stop session:",e),this.render()}}async _loadModel(){if(!this._api||typeof this._api.getSessionModel!="function")return;let e=this._api;try{let t=await e.getSessionModel();if(e!==this._api)return;t&&!t.error&&(this._model={...this._model,override:t.override??null,default:t.default||"sonnet",effective:t.effective||t.default||"sonnet"},this.render())}catch{}}async _onModelChange(e){if(this._modelBusy)return;this._modelBusy=!0;let t=e===""?null:e;try{let i=await this._api.setSessionModel(t);if(i&&i.error)throw new Error(i.error);this._model.override=t,this._model.notice=t?`Switching to ${t}. Applies from the next iteration, for the current run only.`:"Override cleared. Reverts to the tier mapping from the next iteration.",this._modelBusy=!1,await this._loadModel()}catch(i){console.error("Failed to set session model:",i),this._model.notice="Could not change the model. Try again.",this._modelBusy=!1,this.render()}}_renderModelControl(){let e=this._model.override||"",i=[{value:"",label:`Default (tier: ${this._escapeHtml(this._model.default)})`},{value:"haiku",label:"Haiku (fastest, cheapest)"},{value:"sonnet",label:"Sonnet 5 (balanced)"},{value:"opus",label:"Opus (top coding)"},{value:"fable",label:"Fable 5 (2x Opus cost: $10/$50 per MTok)"}].map(s=>{let r=s.value===e?" selected":"";return`<option value="${this._escapeHtml(s.value)}"${r}>${this._escapeHtml(s.label)}</option>`}).join(""),a=this._model.effective==="fable";return`
+      `}}_attachEventListeners(){let e=this.shadowRoot.getElementById("refresh-btn");e&&e.addEventListener("click",()=>this._loadTasks());let t=this.shadowRoot.getElementById("bulk-toggle-btn");t&&t.addEventListener("click",()=>this._toggleBulkMode()),this.shadowRoot.querySelectorAll(".filter-pill").forEach(r=>{r.addEventListener("click",()=>this._setFilter(r.dataset.filter))});let i=this.shadowRoot.getElementById("task-search");i&&i.addEventListener("input",r=>this._setSearch(r.target.value)),this.shadowRoot.querySelectorAll(".show-more-btn").forEach(r=>{r.addEventListener("click",()=>this._showMore(r.dataset.showMore))}),this.shadowRoot.querySelectorAll(".bulk-btn").forEach(r=>{r.addEventListener("click",()=>{let o=r.dataset.bulkAction;o==="delete"?this._bulkDelete():this._bulkMove(o)})}),this.shadowRoot.querySelectorAll(".add-task-btn").forEach(r=>{r.addEventListener("click",()=>{this._openAddTaskModal(r.dataset.status)})}),this.shadowRoot.querySelectorAll(".task-checkbox").forEach(r=>{r.addEventListener("click",o=>{o.stopPropagation(),this._toggleTaskSelection(r.dataset.checkId,o)})}),this.shadowRoot.querySelectorAll(".expand-toggle").forEach(r=>{r.addEventListener("click",o=>{o.stopPropagation(),this._toggleCardExpand(r.dataset.expandId)})}),this.shadowRoot.querySelectorAll(".task-card").forEach(r=>{let o=r.dataset.taskId,n=this._tasks.find(l=>l.id.toString()===o);n&&(r.addEventListener("click",l=>{if(this._bulkMode){this._toggleTaskSelection(o,l);return}this._openTaskDetail(n)}),r.addEventListener("keydown",l=>{l.key==="Enter"||l.key===" "?(l.preventDefault(),this._bulkMode?this._toggleTaskSelection(o,l):this._openTaskDetail(n)):(l.key==="ArrowDown"||l.key==="ArrowUp")&&(l.preventDefault(),this._navigateTaskCards(r,l.key==="ArrowDown"?"next":"prev"))}),r.classList.contains("draggable")&&(r.addEventListener("dragstart",l=>this._handleDragStart(l,n)),r.addEventListener("dragend",l=>this._handleDragEnd(l))))}),this.shadowRoot.querySelectorAll(".kanban-tasks").forEach(r=>{r.addEventListener("dragover",o=>this._handleDragOver(o)),r.addEventListener("dragenter",o=>this._handleDragEnter(o)),r.addEventListener("dragleave",o=>this._handleDragLeave(o)),r.addEventListener("drop",o=>this._handleDrop(o,r.dataset.status))});let a=this.shadowRoot.getElementById("modal-close-btn");a&&a.addEventListener("click",()=>this._closeTaskDetail());let s=this.shadowRoot.getElementById("task-detail-overlay");s&&s.addEventListener("click",r=>{r.target===s&&this._closeTaskDetail()})}_escapeHtml(e){let t=document.createElement("div");return t.textContent=e,t.innerHTML}_navigateTaskCards(e,t){let i=Array.from(this.shadowRoot.querySelectorAll(".task-card")),a=i.indexOf(e);if(a===-1)return;let s=t==="next"?a+1:a-1;s>=0&&s<i.length&&i[s].focus()}};customElements.get("loki-task-board")||customElements.define("loki-task-board",Q);var X=class d extends v{static get observedAttributes(){return["api-url","theme","compact"]}constructor(){super(),this._status={mode:"offline",phase:null,iteration:null,complexity:null,connected:!1,version:null,uptime:0,activeAgents:0,pendingTasks:0},this._model={override:null,default:"sonnet",effective:"sonnet",notice:"",provider:"claude",switchable:!0,offers:[]},this._modelBusy=!1,this._startBusy=!1,this._startNotice="",this._specText="",this._startModel="",this._advisorModel="",this._api=null,this._state=U(),this._statusUpdateHandler=null,this._connectedHandler=null,this._disconnectedHandler=null}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadStatus(),this._loadModel(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling(),this._teardownApiListeners()}_teardownApiListeners(){this._api&&(this._statusUpdateHandler&&this._api.removeEventListener(f.STATUS_UPDATE,this._statusUpdateHandler),this._connectedHandler&&this._api.removeEventListener(f.CONNECTED,this._connectedHandler),this._disconnectedHandler&&this._api.removeEventListener(f.DISCONNECTED,this._disconnectedHandler))}attributeChangedCallback(e,t,i){t!==i&&(e==="api-url"&&this._api&&(this._teardownApiListeners(),this._setupApi(),this._loadStatus(),this._loadModel()),e==="theme"&&this._applyTheme(),e==="compact"&&this.render())}_setupApi(){let e=this.getAttribute("api-url")||window.location.origin;this._api=h({baseUrl:e}),this._statusUpdateHandler=t=>this._updateFromStatus(t.detail),this._connectedHandler=()=>{this._status.connected=!0,this.render()},this._disconnectedHandler=()=>{this._status.connected=!1,this._status.mode="offline",this.render()},this._api.addEventListener(f.STATUS_UPDATE,this._statusUpdateHandler),this._api.addEventListener(f.CONNECTED,this._connectedHandler),this._api.addEventListener(f.DISCONNECTED,this._disconnectedHandler)}async _loadStatus(){let e=this._api;try{let t=await e.getStatus();if(e!==this._api)return;this._updateFromStatus(t)}catch{if(e!==this._api)return;this._status.connected=!1,this._status.mode="offline",this.render()}}_updateFromStatus(e){e&&(this._status={...this._status,connected:!0,mode:e.status||"running",version:e.version,uptime:e.uptime_seconds||0,activeAgents:e.running_agents||0,pendingTasks:e.pending_tasks||0,phase:e.phase,iteration:e.iteration,complexity:e.complexity},this._state.updateSession({connected:!0,mode:this._status.mode,lastSync:new Date().toISOString()}),this.render())}_startPolling(){this._poll=b({loadFn:()=>this._loadStatus(),intervalMs:3e3,sectionId:null,immediate:!1})}_stopPolling(){this._poll&&(this._poll.stop(),this._poll=null)}_formatUptime(e){if(!e||e<0)return"--";let t=Math.floor(e/3600),i=Math.floor(e%3600/60),a=Math.floor(e%60);return t>0?`${t}h ${i}m`:i>0?`${i}m ${a}s`:`${a}s`}_escapeHtml(e){let t=document.createElement("div");return t.textContent=String(e??""),t.innerHTML}_getStatusClass(){switch(this._status.mode){case"running":case"autonomous":return"active";case"paused":return"paused";case"stopped":return"stopped";case"error":return"error";default:return"offline"}}_getStatusLabel(){switch(this._status.mode){case"running":case"autonomous":return"AUTONOMOUS";case"paused":return"PAUSED";case"stopped":return"STOPPED";case"error":return"ERROR";default:return"OFFLINE"}}async _triggerStart(){if(this._startBusy)return;let e=(this._specText||"").trim();if(!e){this._startNotice="Enter a spec or one-line brief to start a build.",this.render();return}if(!this._api||typeof this._api.startSession!="function"){this._startNotice="Start is not available on this server.",this.render();return}this._startBusy=!0,this._startNotice="Starting build...",this.render();try{let t=await this._api.startSession(e,{provider:this._status.provider||"claude",model:this._startModel||"",advisorModel:this._advisorModel||""});if(t&&t.error)throw new Error(t.error);this._startBusy=!1,this._startNotice="",this._specText="",this._status.mode="running",this._status.connected=!0,this.render(),this._loadStatus(),this.dispatchEvent(new CustomEvent("session-start",{detail:{...this._status,pid:t&&t.pid,spec:t&&t.spec}}))}catch(t){console.error("Failed to start build:",t),this._startBusy=!1,this._startNotice=t&&t.message?`Could not start: ${t.message}`:"Could not start the build. Try again.",this.render()}}_onSpecInput(e){this._specText=e}async _triggerPause(){try{let e=await this._api.pauseSession();if(e&&e.error)throw new Error(e.error);this._status.mode="paused",this.render(),this.dispatchEvent(new CustomEvent("session-pause",{detail:this._status}))}catch(e){console.error("Failed to pause session:",e),this.render()}}async _triggerResume(){try{let e=await this._api.resumeSession();if(e&&e.error)throw new Error(e.error);this._status.mode="running",this.render(),this.dispatchEvent(new CustomEvent("session-resume",{detail:this._status}))}catch(e){console.error("Failed to resume session:",e),this.render()}}async _triggerStop(){try{let e=await this._api.stopSession();if(e&&e.error)throw new Error(e.error);this._status.mode="stopped",this.render(),this.dispatchEvent(new CustomEvent("session-stop",{detail:this._status}))}catch(e){console.error("Failed to stop session:",e),this.render()}}async _loadModel(){if(!this._api||typeof this._api.getSessionModel!="function")return;let e=this._api;try{let t=await e.getSessionModel();if(e!==this._api)return;t&&!t.error&&(this._model={...this._model,override:t.override??null,default:t.default||"sonnet",effective:t.effective||t.default||"sonnet",provider:t.provider||"claude",switchable:t.switchable!==!1,offers:Array.isArray(t.offers)?t.offers:[]},this.render())}catch{}}async _onModelChange(e){if(this._modelBusy)return;this._modelBusy=!0;let t=e===""?null:e;try{let i=await this._api.setSessionModel(t);if(i&&i.error)throw new Error(i.error);this._model.override=t,this._model.notice=t?`Switching to ${t}. Applies from the next iteration, for the current run only.`:"Override cleared. Reverts to the tier mapping from the next iteration.",this._modelBusy=!1,await this._loadModel()}catch(i){console.error("Failed to set session model:",i),this._model.notice="Could not change the model. Try again.",this._modelBusy=!1,this.render()}}static get MODEL_HINTS(){return{haiku:"fastest, cheapest",sonnet:"balanced",opus:"top coding",fable:"2x Opus cost: $10/$50 per MTok"}}_renderModelControl(){let e=this._model.override||"",t=this._model.offers,i=d.MODEL_HINTS,s=[{value:"",label:`Default (${this._model.default})`},...t.map(l=>{let c=i[l.value],p=c?`${l.value} (${c})`:l.value;return{value:l.value,label:l.model?`${p} -> ${l.model}`:p}})].map(l=>{let c=l.value===e?" selected":"";return`<option value="${this._escapeHtml(l.value)}"${c}>${this._escapeHtml(l.label)}</option>`}).join(""),r=this._model.effective==="fable",o=this._model.switchable===!1;return`
       <div class="model-control">
         <div class="model-row">
           <label for="model-select">Model</label>
-          <select class="model-select" id="model-select" aria-label="Run model"${this._modelBusy?" disabled":""}>
-            ${i}
+          <select class="model-select" id="model-select" aria-label="Run model"${this._modelBusy||o?" disabled":""}>
+            ${s}
           </select>
         </div>
-        ${a?'<div class="model-cost-note">Fable 5 costs 2x Opus per token ($10/$50 per MTok).</div>':""}
-        <div class="model-disclosure">Model changes apply from the next iteration, for the current run only.</div>
+        ${r?'<div class="model-cost-note">Fable 5 costs 2x Opus per token ($10/$50 per MTok).</div>':""}
+        <div class="model-disclosure">${o?`Provider ${this._escapeHtml(this._model.provider)} runs ${this._escapeHtml(this._model.effective)} and does not support switching models mid-run. Restart the run to change it.`:"Model changes apply from the next iteration, for the current run only."}</div>
         ${this._model.notice?`<div class="model-notice">${this._escapeHtml(this._model.notice)}</div>`:""}
       </div>
-    `}_renderStartControl(){let t=[{value:"",label:"Sonnet 5 (default)"},{value:"haiku",label:"Haiku (fastest, cheapest)"},{value:"sonnet",label:"Sonnet 5 (balanced)"},{value:"opus",label:"Opus (top coding, priciest)"}].map(s=>{let r=s.value===this._startModel?" selected":"";return`<option value="${this._escapeHtml(s.value)}"${r}>${this._escapeHtml(s.label)}</option>`}).join(""),a=[{value:"",label:"Account default"},{value:"opus",label:"Opus (stronger judge)"}].map(s=>{let r=s.value===this._advisorModel?" selected":"";return`<option value="${this._escapeHtml(s.value)}"${r}>${this._escapeHtml(s.label)}</option>`}).join("");return`
+    `}_renderStartControl(){let e=d.MODEL_HINTS,i=[{value:"",label:`Default (${this._model.default})`},...this._model.offers.filter(r=>r.value!=="fable").map(r=>{let o=e[r.value],n=o?`${r.value} (${o})`:r.value;return{value:r.value,label:r.model?`${n} -> ${r.model}`:n}})].map(r=>{let o=r.value===this._startModel?" selected":"";return`<option value="${this._escapeHtml(r.value)}"${o}>${this._escapeHtml(r.label)}</option>`}).join(""),a=this._model.provider==="claude"?[{value:"",label:"Account default"},{value:"opus",label:"Opus (stronger judge)"}]:[],s=a.map(r=>{let o=r.value===this._advisorModel?" selected":"";return`<option value="${this._escapeHtml(r.value)}"${o}>${this._escapeHtml(r.label)}</option>`}).join("");return`
       <div class="start-control">
         <label class="start-label" for="spec-input">Start a build from a spec</label>
         <textarea
@@ -3804,10 +3804,11 @@ var LokiDashboard=(()=>{var Re=Object.defineProperty;var _t=Object.getOwnPropert
             id="start-model-select"
             aria-label="Execution model for this build"
             ${this._startBusy?"disabled":""}>
-            ${t}
+            ${i}
           </select>
         </div>
 
+        ${a.length?`
         <div class="start-field">
           <label for="advisor-select">Advisor</label>
           <select
@@ -3815,10 +3816,10 @@ var LokiDashboard=(()=>{var Re=Object.defineProperty;var _t=Object.getOwnPropert
             id="advisor-select"
             aria-label="Advisor (code-review judge) model"
             ${this._startBusy?"disabled":""}>
-            ${a}
+            ${s}
           </select>
         </div>
-        <div class="start-hint" id="advisor-hint">Advisor judges the code-review gate; execution stays on the model above.</div>
+        <div class="start-hint" id="advisor-hint">Advisor judges the code-review gate; execution stays on the model above.</div>`:""}
 
         <button class="control-btn start" id="start-btn" aria-label="Start build" ${this._startBusy?"disabled":""}>
           <svg viewBox="0 0 24 24" aria-hidden="true"><polygon points="5 3 19 12 5 21 5 3"/></svg>

package/docs/STRATEGY-2026-2028.md

@@ -0,0 +1,124 @@
+# Two-year adoption strategy
+
+Written 2026-07-31 from measured inputs: registry download data, competitor
+documentation fetched the same day, and benchmark results from this repository.
+Where a claim is inference rather than measurement, it says so.
+
+## The one number that matters
+
+**Floor: ~94 downloads/day. Peak: 1,263.** The 13x swing tracks our own
+release activity -- eight releases landed on 07-30. A curve that rises when we
+publish and falls when we stop is CI and mirrors, not word of mouth.
+
+Organic growth is a **rising floor**. Everything below is judged against that
+single number, measured on days we ship nothing.
+
+Two years from now the question is not "how many releases did we cut." It is
+"what is the floor, and does it rise when we are quiet."
+
+## What we actually sell, stated so it survives a demo
+
+Competitor documentation, fetched 2026-07-31:
+
+- **Lovable** runs a security scan on every publish and admins can block the
+  publish outright.
+- **Claude Code** has a review step that checks findings against actual code
+  behavior.
+- **Replit** says its agent tests its own work.
+
+So **"we verify and they don't" is false**, and a founder demo against Lovable
+would expose it. That framing is retired.
+
+What is true and unoccupied across all seven competitors: **nobody ships a
+persisted, portable, diff-bound artifact.** Theirs live in a dashboard --
+Lovable's is a findings count in a dialog, Claude Code's check run is
+deliberately non-blocking. Ours is a file: bound to a diff by `diff_sha256`,
+recording what was NOT proven as prominently as what was, verifiable by someone
+who never installed us.
+
+That is the sentence. Portable, diff-bound, honest about gaps.
+
+## The second thing we sell, now measured
+
+**The harness carries quality, not the model.** On `hard-2-ledger`, a task
+authored so a bare model fails it:
+
+| arm | result | cost |
+|---|---|---|
+| haiku, harness off | 1/4 passed | $0.86 |
+| haiku, harness on | 1/1 passed | $0.54 |
+
+Same model. Same prompt. The harness is the only variable. A correct
+implementation cost **less** than the failing ones, because a cheap failure is
+not cheap.
+
+Caveat, stated because it will be checked: n is small and trials are still
+accumulating. This demonstrates the mechanism. The rate needs more trials, and
+those are now worth buying -- before this task existed, the baseline passed
+everything and more trials bought precision around a ceiling.
+
+## Where we win, and where we should not fight
+
+**Do not fight on:** hosted preview URLs, visual editing, zero-install browser
+onboarding, managed backend primitives. Those are structural properties of a
+hosted product. Lovable publishes to `[name].lovable.app` free at zero credit
+balance; we cannot and should not try.
+
+**Win on the three axes competitors structurally cannot occupy:**
+
+1. **Air-gapped operation.** Measured with egress severed: `version`, `doctor`,
+   `plan --json`, `proof verify`, `heal --assess` all return real results. No
+   competitor can do this -- "Devin's brain always resides within Cognition's
+   Cloud." For defence, government, and regulated banking this is winnable on
+   this axis alone. One required egress (model inference), disclosed.
+
+2. **In-place brownfield.** Lovable **cannot import an existing repository at
+   all**. Replit and Cursor import into *their* environment. For a private
+   monorepo with internal dependencies, that is frequently not permitted. We
+   run where the code already lives.
+
+3. **Cost per correct result.** Haiku-plus-harness beat opus-baseline in the
+   aggregate at roughly an eighth the cost. If that holds under more trials, it
+   is a procurement argument, not a benchmark curiosity.
+
+## The two-year sequence
+
+**Year 1, first half -- earn the floor.** Every item judged by whether a first
+run reaches a result. Ship `first_run_blocked` (done, v8.6.0), read what it
+says, fix the top blocker, repeat. The floor is the scoreboard.
+
+Concretely already done and testable: 43 of 112 commands were unreachable from
+`loki help` including `loki proof`; a first-run dead end on provider-less hosts;
+`loki proof md` so the receipt travels into a PR or Slack.
+
+**Year 1, second half -- make the receipt the artefact people forward.** A
+receipt in a PR is a person showing a colleague. That is the only word-of-mouth
+mechanic available to a CLI, and it costs no infrastructure.
+
+**Year 2 -- enterprise pull, not push.** Air-gapped + in-place brownfield +
+signed provenance is a procurement story no competitor can match today. It sells
+to the buyer who cannot use the others at all, and those buyers talk to each
+other.
+
+## What would falsify this
+
+Stated so it is checkable rather than reassuring:
+
+- **The floor does not rise** over the next quarter despite first-run fixes ->
+  the bottleneck is not discoverability, and this plan is wrong.
+- **`first_run_blocked` shows trials dying on something we did not predict** ->
+  follow the data, not this document.
+- **The harness lift does not survive more trials** -> the cost argument
+  collapses and the differentiator narrows to portability alone.
+- **A competitor ships a portable signed receipt** -> the wedge is gone and we
+  compete on cost and air-gap only.
+
+## What is deliberately not here
+
+No 80-item backlog. The items that exist are the ones with a measured
+mechanism. Padding this list to look comprehensive would be the fabrication
+this project has already paid for once.
+
+Release cadence is explicitly **not** a growth lever: eight releases in one day
+produced a 1,263 spike and a 94 floor. If the floor is the goal, cadence is
+noise.

package/docs/adoption-baseline-2026-07-31.md

@@ -0,0 +1,84 @@
+# Adoption baseline, 2026-07-31
+
+The first numbers in this project taken from the registry rather than from
+intuition. Recorded so the next measurement has something to compare against.
+
+## What we actually have
+
+**4,456 npm downloads in the last 7 days.** Daily:
+
+| Day | Downloads |
+|---|---|
+| 07-24 | 863 |
+| 07-25 | 1,160 |
+| 07-26 | 196 |
+| 07-27 | 94 |
+| 07-28 | 386 |
+| 07-29 | 494 |
+| 07-30 | 1,263 |
+
+Two things follow, and the second matters more than the first.
+
+**1. We have users.** Roughly 4.5k downloads a week is not a project nobody
+has heard of. Every strategy discussion in this repo has proceeded as though
+adoption were hypothetical. It is not.
+
+**2. The shape is release-driven, not organic.** The 13x swing between 07-27
+(94) and 07-30 (1,263) tracks publishing activity -- eight releases landed on
+07-30 alone. A curve that rises when we publish and falls when we stop is
+mirrors and CI, not word of mouth. Organic growth would show a floor that
+rises over time; this shows a floor near 94.
+
+**Do not read 4,456 as 4,456 humans.** npm counts mirrors, CI, and Docker
+layer pulls. The honest statement is that the ceiling is real and the floor is
+what needs to move.
+
+## Why the floor is the metric
+
+The founder's goal is word-of-mouth growth over two years. The number that
+measures it is the **trough**, not the peak: how many installs happen on a day
+we publish nothing. Today that is ~94.
+
+Peaks are bought with releases. Floors are earned by people telling other
+people. Every adoption item should be judged against whether it moves the
+floor.
+
+## What we still cannot see, and what changed today
+
+Until v8.6.0 shipped this morning, we could see that a first run was ATTEMPTED
+and nothing about whether it succeeded. `first_run_blocked` (v8.6.0) now names
+the class of dependency that stops a first run -- enum-clamped, once per
+install, strict opt-in.
+
+That data does not exist yet: the release is hours old and the telemetry is
+off by default behind a second opt-in. It will accumulate slowly and from a
+minority of users, which is the correct trade for not exfiltrating anyone's
+environment.
+
+So the sequence is: floor today ~94/day -> ship things that plausibly move it
+-> watch the floor, not the peak.
+
+## The three things measured this session that plausibly move it
+
+Ranked by how directly they affect someone's first ten minutes:
+
+1. **43 of 112 commands were unreachable from `loki help`**, including
+   `loki proof` -- the Evidence Receipt, the thing the product argues on. Fixed
+   and gated. A user who cannot find the differentiator does not repeat it to
+   anyone.
+2. **A first-run dead end on hosts with no provider CLI.** One route named the
+   blockers and pointed at `loki tour` (no provider, no key, no spend); the
+   other said "some required prerequisites are missing" and stopped. That is
+   the exact moment an evaluator decides whether to continue.
+3. **`loki proof md`** puts the receipt in a form a person can paste into a PR
+   or a Slack message. Competitors' verification output lives in their
+   dashboard; a file is the only artifact that travels.
+
+None of these is proven to move the floor. They are the candidates with a
+plausible mechanism, and the floor is now being watched.
+
+## Reproduce
+
+```sh
+curl -s "https://api.npmjs.org/downloads/range/last-week/loki-mode"
+```