loki-mode 9.12.6 → 9.17.0

package/autonomy/telemetry.sh

@@ -194,7 +194,14 @@ _loki_known_command() {
 # a first run, never the user's paths, versions, or hostnames.
 _loki_known_blocker() {
     case "${1:-}" in
-        no_provider|node|python3|jq|git|curl|disk|skill_symlink)
+        # not_logged_in is distinct from no_provider on purpose. They are the two
+        # halves of the same wall and they need opposite fixes: no_provider means
+        # "install something", not_logged_in means "authenticate the thing you
+        # already installed". Collapsing the second into `other` would make the
+        # single most common post-install failure unactionable in the data --
+        # and it is the worst-placed one, since without this the user only learns
+        # of it after confirming the spend.
+        no_provider|not_logged_in|node|python3|jq|git|curl|disk|skill_symlink)
             printf '%s' "$1" ;;
         *)
             printf 'other' ;;

package/completions/_loki

@@ -120,6 +120,7 @@ function _loki {
 function _loki_commands {
     local -a commands
     commands=(
+        'gates:What blocks here vs only advises, and the promotion knob'
         'start:Start Loki Mode'
         'quick:Quick single-task mode'
         'quickstart:Guided first build from your idea'
@@ -171,6 +172,9 @@ function _loki_commands {
         'metrics:Session productivity report'
         'share:Share session report as GitHub Gist'
         'proof:Inspect/share proof-of-run artifacts'
+        'outcomes:What happened to the work AFTER the receipt (reverted/reworked/survived)'
+        'verdict:The five measured trust signals in one readable block'
+        'readiness:Can an agent verify its own work in this repo? (measured, not LLM-scored)'
         'preview:Preview the locally-running app'
         'deploy:Deploy the built product (CI/CD-aware)'
         'context:Context window management'
@@ -190,6 +194,7 @@ function _loki_commands {
         'magic:Spec-driven component generation'
         'assets:Export/import shareable team assets'
         'spec:Living spec drift detection'
+        'intent:Does the spec still say what was actually wanted'
         'verify:Deterministic PR verification'
         'grill:Interrogate a spec before building'
         'trust:Visible trust trajectory'

package/completions/loki.bash

@@ -5,7 +5,8 @@ _loki_completion() {
     _init_completion || return
 
     # Main subcommands (must match autonomy/loki main case statement)
-    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
+    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes verdict readiness explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover gates remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
+    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover gates remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
 
     # 1. If we are on the first argument (subcommand)
     if [[ $cword -eq 1 ]]; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.12.6"
+__version__ = "9.17.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/run.py

@@ -8,15 +8,26 @@ Usage:
 """
 
 import argparse
+import os
 import sys
 
 
 def main():
     parser = argparse.ArgumentParser(description="Loki Mode Dashboard Server")
+    # Loopback by default, matching server.py:run_server and control.py. This
+    # launcher defaulted to 0.0.0.0, which published an UNAUTHENTICATED control
+    # plane on every interface: dashboard auth is opt-in
+    # (LOKI_ENTERPRISE_AUTH, default false in dashboard/auth.py), so with it
+    # unset -- the default -- anyone routable to the host could reach endpoints
+    # that stop builds and read receipts. A default must be safe on its own;
+    # exposing the network is a decision an operator makes explicitly, so
+    # --host 0.0.0.0 and LOKI_DASHBOARD_HOST both still work for the container
+    # and Helm paths that genuinely need it.
     parser.add_argument(
         "--host",
-        default="0.0.0.0",
-        help="Host to bind to (default: 0.0.0.0)",
+        default=os.environ.get("LOKI_DASHBOARD_HOST", "127.0.0.1"),
+        help="Host to bind to (default: $LOKI_DASHBOARD_HOST or 127.0.0.1). "
+             "Use 0.0.0.0 only with authentication enabled.",
     )
     parser.add_argument(
         "--port",

package/dashboard/scim.py

@@ -0,0 +1,221 @@
+"""SCIM 2.0 user provisioning: deprovisioning that actually revokes access.
+
+WHY THIS EXISTS. Measured against our own code before writing any: OIDC is real
+here (76 references in dashboard/auth.py) and SAML and SCIM are both ZERO. That
+is the whole enterprise identity gap -- not authentication as a category, which
+we have, but PROVISIONING, which we do not.
+
+It matters more than its size suggests. With OIDC alone, an employee removed
+from the IdP stops being able to LOG IN, but any token already issued to them
+keeps working until it expires. For a buyer whose security review asks "show me
+that a terminated employee loses access within minutes", that is the answer that
+fails the review. SCIM is the protocol that answers it.
+
+WORTH KNOWING ABOUT THE COMPETITION. Factory ships SCIM. Devin's SCIM is
+documented only for Devin DESKTOP -- the page instructs you to configure it at
+windsurf.com/team/settings under the app name "Windsurf" -- and no page documents
+SCIM provisioning for Devin CLOUD sessions, which get SAML/OIDC plus IdP-group
+sync only. So this is table stakes against one competitor and a genuine gap in
+the other.
+
+WHAT THIS IS NOT. It is not a second identity system. It maps IdP group
+membership onto the scope hierarchy dashboard/auth.py already enforces
+(* -> control -> write -> read), so there is exactly one authorization model and
+SCIM only decides who holds which scope. A parallel permission model would
+eventually disagree with the real one, and the disagreement would be invisible
+until an audit.
+
+DEPROVISIONING IS SOFT BY DEFAULT, AND THAT IS DELIBERATE. `active: false`
+revokes access immediately but PRESERVES the record, because an audit trail that
+loses the identity of whoever performed past actions is not an audit trail. Hard
+delete is available and separate, so destroying history is always an explicit act.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from datetime import datetime, timezone
+from typing import Optional
+
+SCIM_SCHEMA_USER = "urn:ietf:params:scim:schemas:core:2.0:User"
+SCIM_SCHEMA_LIST = "urn:ietf:params:scim:api:messages:2.0:ListResponse"
+SCIM_SCHEMA_ERROR = "urn:ietf:params:scim:api:messages:2.0:Error"
+
+# IdP group -> our scope. Mirrors the hierarchy in dashboard/auth.py rather than
+# inventing a second one: * grants everything, control grants write and read.
+# An unrecognised group maps to "read", never to a higher scope -- an unknown
+# group is not evidence of privilege, and defaulting upward is how a
+# misconfigured IdP silently grants admin.
+GROUP_SCOPE_MAP = {
+    "loki-admins": "*",
+    "loki-owners": "*",
+    "loki-operators": "control",
+    "loki-writers": "write",
+    "loki-readers": "read",
+}
+DEFAULT_SCOPE = "read"
+
+
+def _now():
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _store_path(loki_dir):
+    return os.path.join(loki_dir, "scim", "users.json")
+
+
+def _load(loki_dir):
+    p = _store_path(loki_dir)
+    if not os.path.isfile(p):
+        return {}
+    try:
+        with open(p, "r", encoding="utf-8") as fh:
+            return json.load(fh)
+    except (OSError, ValueError):
+        # A corrupt store must not silently become an empty one: returning {}
+        # here would read as "no users provisioned" and could re-grant access to
+        # someone who was deprovisioned. Signalled to the caller instead.
+        return None
+
+
+def _save(loki_dir, data):
+    p = _store_path(loki_dir)
+    os.makedirs(os.path.dirname(p), exist_ok=True)
+    tmp = p + ".tmp"
+    with open(tmp, "w", encoding="utf-8") as fh:
+        json.dump(data, fh, indent=2, sort_keys=True)
+        fh.write("\n")
+    # Atomic replace: a half-written user store is an access-control decision
+    # made from corrupt data.
+    os.replace(tmp, p)
+
+
+def scope_for_groups(groups):
+    """Highest scope any of the user's groups grants.
+
+    Highest-wins, because a user in both loki-readers and loki-admins is an
+    admin. Unknown groups contribute DEFAULT_SCOPE and never more.
+    """
+    rank = {"read": 1, "write": 2, "control": 3, "*": 4}
+    best = DEFAULT_SCOPE
+    for g in groups or []:
+        s = GROUP_SCOPE_MAP.get(str(g).strip().lower(), DEFAULT_SCOPE)
+        if rank.get(s, 1) > rank.get(best, 1):
+            best = s
+    return best
+
+
+def provision(loki_dir, user_name, external_id=None, groups=None, active=True):
+    """Create or update a user. Returns a SCIM User resource."""
+    if not user_name:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "400",
+                "detail": "userName is required"}
+
+    data = _load(loki_dir)
+    if data is None:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "500",
+                "detail": "user store is unreadable; refusing to make an access "
+                          "decision from corrupt data"}
+
+    uid = external_id or user_name
+    existing = data.get(uid, {})
+    rec = {
+        "id": uid,
+        "userName": user_name,
+        "externalId": external_id or "",
+        "groups": list(groups or []),
+        "scope": scope_for_groups(groups),
+        "active": bool(active),
+        "created": existing.get("created") or _now(),
+        "lastModified": _now(),
+    }
+    data[uid] = rec
+    _save(loki_dir, data)
+    return to_scim_user(rec)
+
+
+def deprovision(loki_dir, uid, hard=False):
+    """Revoke access. Soft by default so the audit trail survives.
+
+    An audit log that cannot say WHO performed an action is not an audit log, so
+    a departed user's record is retained by default and merely marked inactive.
+    Hard delete exists and is separate, so destroying history is always explicit.
+    """
+    data = _load(loki_dir)
+    if data is None:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "500",
+                "detail": "user store is unreadable"}
+    if uid not in data:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "404",
+                "detail": f"no such user: {uid}"}
+
+    if hard:
+        data.pop(uid)
+        _save(loki_dir, data)
+        return {"status": "204", "deleted": uid, "audit_trail_preserved": False}
+
+    data[uid]["active"] = False
+    data[uid]["lastModified"] = _now()
+    _save(loki_dir, data)
+    return {"status": "200", "deactivated": uid, "audit_trail_preserved": True}
+
+
+def is_active(loki_dir, uid):
+    """Authorization answer for one user. Fails CLOSED on any doubt.
+
+    An unreadable store, an unknown user, and an inactive user all return False.
+    A provisioning system that fails open is worse than none, because it creates
+    the belief that deprovisioning works.
+    """
+    data = _load(loki_dir)
+    if data is None:
+        return False
+    rec = data.get(uid)
+    if not rec:
+        return False
+    return bool(rec.get("active"))
+
+
+def effective_scope(loki_dir, uid):
+    """The scope a user actually holds, or None when they hold none."""
+    data = _load(loki_dir)
+    if data is None:
+        return None
+    rec = data.get(uid)
+    if not rec or not rec.get("active"):
+        return None
+    return rec.get("scope") or DEFAULT_SCOPE
+
+
+def to_scim_user(rec):
+    return {
+        "schemas": [SCIM_SCHEMA_USER],
+        "id": rec["id"],
+        "userName": rec["userName"],
+        "externalId": rec.get("externalId", ""),
+        "active": rec.get("active", False),
+        "groups": [{"value": g} for g in rec.get("groups", [])],
+        "meta": {
+            "resourceType": "User",
+            "created": rec.get("created"),
+            "lastModified": rec.get("lastModified"),
+        },
+        # Not part of the SCIM spec, surfaced because an operator reading this
+        # response needs to see what the group mapping actually granted rather
+        # than deriving it.
+        "lokiScope": rec.get("scope"),
+    }
+
+
+def list_users(loki_dir, active_only=False):
+    data = _load(loki_dir)
+    if data is None:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "500",
+                "detail": "user store is unreadable"}
+    recs = [r for r in data.values() if (not active_only or r.get("active"))]
+    return {
+        "schemas": [SCIM_SCHEMA_LIST],
+        "totalResults": len(recs),
+        "Resources": [to_scim_user(r) for r in sorted(recs, key=lambda r: r["id"])],
+    }

package/dashboard/server.py

@@ -1224,6 +1224,28 @@ class WebSocketBoundaryMiddleware:
                 # accept-then-drop, which reads to a client as a flaky network.
                 await send({"type": "websocket.close", "code": 1008})
                 return
+            # Cross-Site WebSocket Hijacking. The address check above proves the
+            # PEER is local; it says nothing about who told that peer to connect.
+            # A browser on any origin can open ws://127.0.0.1:57374/ws -- the
+            # request comes FROM the loopback interface and passes the check
+            # above, and CORS does not apply to WebSocket upgrades, so no
+            # existing control stops it. /ws/collab is writable, so this is not
+            # read-only exposure.
+            #
+            # Same-origin browsers send Origin; non-browser clients (CLI, tests,
+            # health probes) send none. An ABSENT Origin is therefore allowed --
+            # it cannot be forged by a page, since browsers always attach it --
+            # while a PRESENT one must be in the allowlist the HTTP path already
+            # uses. That keeps every scripted client working and closes the
+            # browser-driven path, without a second source of truth for origins.
+            origin = None
+            for raw_name, raw_value in scope.get("headers", []):
+                if raw_name == b"origin":
+                    origin = raw_value.decode("latin-1").strip()
+                    break
+            if origin and "*" not in _cors_origins and origin not in _cors_origins:
+                await send({"type": "websocket.close", "code": 1008})
+                return
         await self.app(scope, receive, send)
 
 
@@ -8332,6 +8354,93 @@ async def get_trust_trajectory():
     return traj
 
 
+# =============================================================================
+# Gate policy API: which gates block here, and which only advise?
+# =============================================================================
+
+_GATE_POLICY_MODULE = None  # cached import of autonomy/lib/gate_policy.py
+
+
+def _load_gate_policy_module():
+    """Import the shared gate-policy reporter (single source of truth).
+
+    Same shape as _load_trust_module above: the derivation lives in
+    autonomy/lib/gate_policy.py so this endpoint, the bash `loki gates`, and the
+    test suite all agree, and it loads via importlib because autonomy/lib is not
+    an importable package. Cached after first load, None when unavailable.
+    """
+    global _GATE_POLICY_MODULE
+    if _GATE_POLICY_MODULE is not None:
+        return _GATE_POLICY_MODULE
+    repo_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    mod_path = os.path.join(repo_root, "autonomy", "lib", "gate_policy.py")
+    if not os.path.isfile(mod_path):
+        return None
+    try:
+        import importlib.util as _ilu
+        spec = _ilu.spec_from_file_location("gate_policy", mod_path)
+        if spec is None or spec.loader is None:
+            return None
+        mod = _ilu.module_from_spec(spec)
+        spec.loader.exec_module(mod)
+        _GATE_POLICY_MODULE = mod
+        return mod
+    except Exception:
+        return None
+
+
+@app.get("/api/gate-policy", dependencies=[Depends(auth.require_scope("read"))])
+async def get_gate_policy():
+    """Which quality gates block on this repo, and which only advise.
+
+    Read-only by construction. There is deliberately no POST counterpart:
+    promoting an advisory gate to blocking stays an explicit operator act via
+    the environment variable named in each record's `promote_with`, because a
+    surface that can silently start blocking is the thing operators most
+    reasonably fear. This endpoint reports; it never promotes.
+
+    Honest-data rule, and the reason `audit_hits` is nullable: an unmeasured
+    gate reports null, NEVER 0. Zero is the positive claim that the gate ran and
+    never fired; an absent ledger is not evidence of that. See the shape
+    contract in the gate_policy module docstring.
+
+    Fails open like /api/trust/trajectory: a missing module returns a renderable
+    available=False payload rather than a 500. Unlike that sibling the assess()
+    call is also wrapped, because it reads a ledger file that an unrelated
+    writer can leave malformed, and a broken ledger must not take down a
+    read-only report.
+
+    Response keys are the module shape contract plus `available` (bool). On the
+    fail-open path `available` is False, `status` is "unavailable" (a value the
+    module contract does not itself define, since assess() never returned), an
+    `error` string explains why, and `gates` is empty. A UI should branch on
+    `available`, not on a non-empty `gates`.
+    """
+    mod = _load_gate_policy_module()
+    if mod is None:
+        return {
+            "schema_version": 1,
+            "available": False,
+            "error": "gate_policy module not found",
+            "status": "unavailable",
+            "ledger": "absent",
+            "gates": [],
+        }
+    try:
+        res = mod.assess(str(_get_loki_dir()))
+    except Exception as e:
+        return {
+            "schema_version": 1,
+            "available": False,
+            "error": f"gate policy assessment failed: {e}",
+            "status": "unavailable",
+            "ledger": "absent",
+            "gates": [],
+        }
+    res["available"] = True
+    return res
+
+
 # =============================================================================
 # Pricing API
 # =============================================================================
@@ -10161,6 +10270,71 @@ async def remove_checklist_waiver(item_id: str):
 # Council Hard Gate Endpoint (Phase 4)
 # =============================================================================
 
+# Receipts name gates in snake_case; the UI rows are display names. Mapping is
+# explicit rather than derived (a lower()/replace() heuristic would silently
+# mis-map "Test Suite" <-> "test_coverage" and "Test Mutation" <->
+# "mutation_integrity", which are different gates).
+_RECEIPT_GATE_NAMES = {
+    "static_analysis": "Static Analysis",
+    "test_coverage": "Test Suite",
+    "code_review": "Blind Code Review",
+    "anti_sycophancy": "Anti-Sycophancy",
+    "mock_integrity": "Mock Integrity",
+    "mutation_integrity": "Test Mutation",
+    "doc_coverage": "Documentation Coverage",
+    "magic_debate": "Magic Modules Debate",
+}
+
+
+# Receipts say "passed"/"failed"; the UI switches on "pass"/"fail"
+# (dashboard-ui/components/loki-quality-gates.js:51). Passing the receipt's word
+# through unchanged matched nothing, so every gate fell to the "pending" default
+# and the page still read "0 Pass, 0 Fail, 8 Pending" while showing real
+# timestamps -- half-fixed, and only visible by loading the page.
+#
+# An UNRECOGNISED status maps to nothing and the gate stays pending. Guessing
+# (e.g. treating any unknown word as a pass) is how a future status string would
+# silently become a green badge.
+_RECEIPT_GATE_STATUS = {
+    "passed": "pass", "pass": "pass", "ok": "pass",
+    "failed": "fail", "fail": "fail", "blocked": "fail",
+}
+
+
+def _receipt_backed_gates():
+    """_DEFAULT_QUALITY_GATES, with results filled in from the newest receipt.
+
+    Fail-open by design: any error returns the plain defaults, so a malformed
+    receipt degrades to "pending" rather than breaking the Quality page.
+
+    Gates absent from the receipt keep status "pending" and get NO last_checked.
+    An absent measurement is never rendered as a result.
+    """
+    gates = [dict(g) for g in _DEFAULT_QUALITY_GATES]
+    try:
+        proofs = sorted((_get_loki_dir() / "proofs").glob("*/proof.json"))
+        if not proofs:
+            return gates
+        receipt = json.loads(proofs[-1].read_text())
+        checked_at = receipt.get("generated_at") or ""
+        by_display = {}
+        for entry in receipt.get("quality_gates", {}).get("gates", []) or []:
+            display = _RECEIPT_GATE_NAMES.get(entry.get("name", ""))
+            status = _RECEIPT_GATE_STATUS.get(str(entry.get("status", "")).lower())
+            if display and status:
+                by_display[display] = status
+        for gate in gates:
+            status = by_display.get(gate.get("name"))
+            if status:
+                gate["status"] = status
+                if checked_at:
+                    gate["last_checked"] = checked_at
+                gate["source"] = "receipt"
+    except (OSError, ValueError, KeyError, TypeError, AttributeError):
+        return [dict(g) for g in _DEFAULT_QUALITY_GATES]
+    return gates
+
+
 _DEFAULT_QUALITY_GATES = [
     {"name": "Static Analysis", "description": "CodeQL, ESLint/Pylint, type-checker findings on the diff", "status": "pending"},
     {"name": "Test Suite", "description": "Project test runner pass/fail (red blocks)", "status": "pending"},
@@ -10199,7 +10373,22 @@ async def get_council_gate():
         except (json.JSONDecodeError, IOError):
             data = {"blocked": False, "gates": _DEFAULT_QUALITY_GATES, "error": "Failed to read gate file"}
     else:
-        data = {"blocked": False, "gates": _DEFAULT_QUALITY_GATES}
+        # No live gate file. Fall back to the most recent RECEIPT, which already
+        # records per-gate results -- rather than serving eight rows that all
+        # say "Last checked: Never" while .loki/proofs/ holds the real answers.
+        #
+        # That "Never" was not a display bug: /api/council/gate served
+        # _DEFAULT_QUALITY_GATES verbatim, and those entries carry no
+        # last_checked, so the UI honestly rendered "Never" for every gate on a
+        # repo with 9 receipts.
+        #
+        # ONLY gates the receipt actually names are filled in. Measured across
+        # all 9 receipts here, that is 3 of 8 (static_analysis, code_review,
+        # doc_coverage); the other five stay "pending" with no timestamp,
+        # because a gate that never ran must not inherit a neighbour's result.
+        # Filling all eight from a 3-gate receipt is the exact false-green this
+        # codebase exists to prevent.
+        data = {"blocked": False, "gates": _receipt_backed_gates()}
 
     # Verified-completion evidence gate (additive).
     if evidence_file.exists():