loki-mode 9.16.0 → 9.17.2

package/dashboard/static/index.html

@@ -1323,6 +1323,14 @@
             <h3 style="font-family: 'Fraunces', Georgia, serif; font-size: 1.15rem; font-weight: 400; color: var(--loki-text-primary); margin-bottom: 12px;">Logs</h3>
             <loki-log-stream id="log-stream" auto-scroll max-lines="500"></loki-log-stream>
           </div>
+          <!-- LEARNINGS. /api/learnings held real records with a rootCause,
+               a fix and a preventInFuture, and had no UI consumer -- the
+               system was learning from its runs and never showing anyone
+               what it learned. Hidden until data arrives. -->
+          <div id="learnings-panel" style="display:none;">
+            <h3 style="font-family: var(--loki-font-family, 'Inter', system-ui, -apple-system, sans-serif); font-size: 1.15rem; font-weight: 400; color: var(--loki-text-primary); margin-bottom: 12px;">What this build learned</h3>
+            <div id="learnings-list"></div>
+          </div>
           <div>
             <h3 style="font-family: 'Fraunces', Georgia, serif; font-size: 1.15rem; font-weight: 400; color: var(--loki-text-primary); margin-bottom: 12px;">Memory</h3>
             <loki-memory-browser id="memory-browser" tab="summary"></loki-memory-browser>
@@ -1675,6 +1683,13 @@
         <div class="section-page-header">
           <h2 class="section-page-title">Cost</h2>
         </div>
+        <!-- SPEND CAP. /api/budget reports budget_limit, and it ships NULL:
+             there is no automatic spend stop. Nothing in the UI said so, and
+             the only place that fact surfaced was a bill. Shown ALWAYS, not
+             just when a cap exists, because "no cap" is the state a user most
+             needs to know about. -->
+        <div id="budget-banner" style="display:none;margin-bottom:12px;padding:10px 12px;
+             border:1px solid var(--loki-border);border-radius:6px;font-size:12px;"></div>
         <loki-cost-dashboard id="cost-dashboard"></loki-cost-dashboard>
       </div>
 
@@ -1685,8 +1700,18 @@
         <div class="section-page-header">
           <h2 class="section-page-title">Trust Trajectory</h2>
         </div>
+        <!-- EVIDENCE RECEIPTS. /api/proofs served 9 receipts with verdict,
+             file count and an HTML view, and NOTHING in the dashboard read it
+             -- only /api/proofs/summary (the header badge) was consumed. The
+             receipt is the thing we ask users to check; it was unreachable
+             from the UI. -->
+        <div id="receipts-panel" style="margin-bottom:16px;display:none;">
+          <h3 style="font-size:13px;font-weight:600;margin:0 0 8px;">Evidence receipts</h3>
+          <div id="receipts-list"></div>
+          <div id="receipts-note" style="font-size:11px;color:var(--loki-text-muted);margin-top:8px;"></div>
+        </div>
         <iframe id="trust-frame" title="Trust trajectory" src="about:blank"
-          style="width:100%;height:calc(100vh - 160px);border:0;border-radius:8px;background:var(--loki-bg-primary);"></iframe>
+          style="width:100%;height:calc(100vh - 260px);border:0;border-radius:8px;background:var(--loki-bg-primary);"></iframe>
       </div>
 
       <!-- Checkpoints -->
@@ -11317,7 +11342,7 @@ var LokiDashboard=(()=>{var Be=Object.defineProperty;var zt=Object.getOwnPropert
           </div>
         `}
       </div>
-    `,this.shadowRoot.querySelectorAll("[data-tab]").forEach(l=>{l.addEventListener("click",c=>this._handleTabClick(c))});let r=this.shadowRoot.getElementById("tool-time-range");r&&r.addEventListener("change",l=>this._handleTimeRangeChange(l));let o=this.shadowRoot.getElementById("analytics-retry-btn");o&&o.addEventListener("click",()=>this._loadData());let n=this.shadowRoot.getElementById("analytics-overview-btn");n&&n.addEventListener("click",()=>this._navigateToOverview())}_navigateToOverview(){this.dispatchEvent(new CustomEvent("loki-navigate",{detail:{view:"overview"},bubbles:!0,composed:!0}))}};customElements.get("loki-analytics")||customElements.define("loki-analytics",ve);var kt={pass:{color:"var(--loki-green, #22c55e)",bg:"var(--loki-green-muted, rgba(34, 197, 94, 0.15))",label:"PASS"},fail:{color:"var(--loki-red, #ef4444)",bg:"var(--loki-red-muted, rgba(239, 68, 68, 0.15))",label:"FAIL"},pending:{color:"var(--loki-yellow, #eab308)",bg:"var(--loki-yellow-muted, rgba(234, 179, 8, 0.15))",label:"PENDING"}};function Qt(d){if(!d)return"Never";try{return new Date(d).toLocaleString([],{month:"short",day:"numeric",hour:"2-digit",minute:"2-digit"})}catch{return"Unknown"}}function Xt(d){if(!d||d.length===0)return{pass:0,fail:0,pending:0,total:0};let e={pass:0,fail:0,pending:0,total:d.length};for(let t of d){let i=(t.status||"pending").toLowerCase();i==="pass"?e.pass++:i==="fail"?e.fail++:e.pending++}return e}var fe=class extends v{static get observedAttributes(){return["api-url","theme"]}constructor(){super(),this._loading=!1,this._error=null,this._api=null,this._gates=[],this._evidence={blocked:!1},this._pollInterval=null,this._lastDataHash=null,this._scanning=!1}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadData(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling()}attributeChangedCallback(e,t,i){t!==i&&(e==="api-url"&&this._api&&(this._api=h({baseUrl:i}),this._loadData()),e==="theme"&&this._applyTheme())}_setupApi(){let e=this.getAttribute("api-url")||window.location.origin;this._api=h({baseUrl:e})}_startPolling(){this._poll=b({loadFn:()=>this._loadData(),intervalMs:3e4,element:this,immediate:!1})}_stopPolling(){this._poll&&(this._poll.stop(),this._poll=null)}async _loadData(){let e=this._api;try{this._loading=!0;let t=await e._get("/api/council/gate");if(e!==this._api)return;let i=t?.gates||t||[],a=t?.evidence||{blocked:!1},s=JSON.stringify({gates:i,evidence:a});if(s===this._lastDataHash)return;this._lastDataHash=s,this._gates=Array.isArray(i)?i:[],this._evidence=a,this._error=null}catch(t){if(e!==this._api)return;this._error||(this._error=`Failed to load quality gates: ${t.message}`)}finally{this._loading=!1}this.render()}async _triggerScan(){if(this._scanning)return;let e=this._api;this._scanning=!0,this.render();try{if(await e._post("/api/quality-scan",{},{timeout:3e5}),e!==this._api)return;this._lastDataHash=null,await this._loadData()}catch(t){if(e!==this._api)return;this._error=`Quality scan failed: ${t.message}`}finally{this._scanning=!1,this.render()}}_escapeHtml(e){return e?String(e).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;"):""}_getStyles(){return`
+    `,this.shadowRoot.querySelectorAll("[data-tab]").forEach(l=>{l.addEventListener("click",c=>this._handleTabClick(c))});let r=this.shadowRoot.getElementById("tool-time-range");r&&r.addEventListener("change",l=>this._handleTimeRangeChange(l));let o=this.shadowRoot.getElementById("analytics-retry-btn");o&&o.addEventListener("click",()=>this._loadData());let n=this.shadowRoot.getElementById("analytics-overview-btn");n&&n.addEventListener("click",()=>this._navigateToOverview())}_navigateToOverview(){this.dispatchEvent(new CustomEvent("loki-navigate",{detail:{view:"overview"},bubbles:!0,composed:!0}))}};customElements.get("loki-analytics")||customElements.define("loki-analytics",ve);var kt={pass:{color:"var(--loki-green, #22c55e)",bg:"var(--loki-green-muted, rgba(34, 197, 94, 0.15))",label:"PASS"},fail:{color:"var(--loki-red, #ef4444)",bg:"var(--loki-red-muted, rgba(239, 68, 68, 0.15))",label:"FAIL"},pending:{color:"var(--loki-yellow, #eab308)",bg:"var(--loki-yellow-muted, rgba(234, 179, 8, 0.15))",label:"PENDING"}};function Qt(d){if(!d)return"Never";try{return new Date(d).toLocaleString([],{month:"short",day:"numeric",hour:"2-digit",minute:"2-digit"})}catch{return"Unknown"}}function Xt(d){if(!d||d.length===0)return{pass:0,fail:0,pending:0,total:0};let e={pass:0,fail:0,pending:0,total:d.length};for(let t of d){let i=(t.status||"pending").toLowerCase();i==="pass"?e.pass++:i==="fail"?e.fail++:e.pending++}return e}var fe=class extends v{static get observedAttributes(){return["api-url","theme"]}constructor(){super(),this._loading=!1,this._error=null,this._api=null,this._gates=[],this._evidence={blocked:!1},this._policy=null,this._pollInterval=null,this._lastDataHash=null,this._scanning=!1}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadData(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling()}attributeChangedCallback(e,t,i){t!==i&&(e==="api-url"&&this._api&&(this._api=h({baseUrl:i}),this._loadData()),e==="theme"&&this._applyTheme())}_setupApi(){let e=this.getAttribute("api-url")||window.location.origin;this._api=h({baseUrl:e})}_startPolling(){this._poll=b({loadFn:()=>this._loadData(),intervalMs:3e4,element:this,immediate:!1})}_stopPolling(){this._poll&&(this._poll.stop(),this._poll=null)}_policyLine(e){if(!Array.isArray(this._policy)||!e)return"";let i={"Static Analysis":"static_analysis","Test Suite":"test_coverage","Blind Code Review":"code_review","Anti-Sycophancy":"anti_sycophancy","Mock Integrity":"mock_integrity","Test Mutation":"mutation_integrity","Documentation Coverage":"doc_coverage","Magic Modules Debate":"magic_debate"}[e];if(!i)return"";let a=this._policy.find(l=>l&&l.gate===i);if(!a||!a.mode)return"";let s=a.mode==="blocking",r=a.audit_hits===null||a.audit_hits===void 0?"not measured":`${a.audit_hits} hit${a.audit_hits===1?"":"s"}`,o=s?"BLOCKS":"advisory",n=!s&&a.promote_with?` -- promote with ${this._escapeHtml(a.promote_with)}`:"";return`<div class="gate-meta gate-policy">${o} &middot; ${r}${n}</div>`}async _loadData(){let e=this._api;try{this._loading=!0;let t=await e._get("/api/council/gate");if(e!==this._api)return;let i=t?.gates||t||[],a=t?.evidence||{blocked:!1},s=null;try{let o=await e._get("/api/gate-policy");if(e!==this._api)return;s=Array.isArray(o?.gates)?o.gates:null}catch{s=null}let r=JSON.stringify({gates:i,evidence:a,policy:s});if(r===this._lastDataHash)return;this._lastDataHash=r,this._gates=Array.isArray(i)?i:[],this._evidence=a,this._policy=s,this._error=null}catch(t){if(e!==this._api)return;this._error||(this._error=`Failed to load quality gates: ${t.message}`)}finally{this._loading=!1}this.render()}async _triggerScan(){if(this._scanning)return;let e=this._api;this._scanning=!0,this.render();try{if(await e._post("/api/quality-scan",{},{timeout:3e5}),e!==this._api)return;this._lastDataHash=null,await this._loadData()}catch(t){if(e!==this._api)return;this._error=`Quality scan failed: ${t.message}`}finally{this._scanning=!1,this.render()}}_escapeHtml(e){return e?String(e).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;"):""}_getStyles(){return`
       :host {
         display: block;
       }
@@ -11593,6 +11618,7 @@ var LokiDashboard=(()=>{var Be=Object.defineProperty;var zt=Object.getOwnPropert
             </div>
             ${p.description?`<div class="gate-description">${this._escapeHtml(p.description)}</div>`:""}
             <div class="gate-meta">Last checked: ${Qt(p.last_checked||p.lastChecked)}</div>
+            ${this._policyLine(p.name)}
           </div>
         `}).join("")}</div>`;let r="",o=this._evidence||{};if(o.blocked){let c={empty_diff:"No changes were shipped (empty diff vs run start).",tests_red:"Tests ran and were red.",empty_diff_and_tests_red:"No changes shipped and tests were red.",no_evidence_of_completion:"No evidence of completion."},p=o.error?this._escapeHtml(o.error):c[o.reason]||this._escapeHtml(o.reason||"Completion blocked."),u=Array.isArray(o.failures)?o.failures:[],m=u.length?`<ul class="evidence-failures">${u.map(g=>`<li>${this._escapeHtml(g)}</li>`).join("")}</ul>`:"";r=`
         <div class="evidence-banner">
@@ -16021,6 +16047,143 @@ document.addEventListener('DOMContentLoaded', function() {
       badge.classList.add('show');
     }
 
+    // SPEND CAP STATE. budget_limit is NULL by default -- LOKI_BUDGET_LIMIT
+    // ships unset, so a long run has no automatic stop. That is a defensible
+    // default (a run killed at a threshold the user never chose is worse), but
+    // it must not be INVISIBLE: today the only place it surfaced was a bill.
+    //
+    // Renders the no-cap state as prominently as a cap, and names the variable
+    // that sets one. Never invents a number: an unknown current cost reads
+    // "not measured", not $0.00.
+    window.loadBudget = function () {
+      var el = document.getElementById('budget-banner');
+      if (!el) return;
+      fetch('/api/budget', { headers: { 'Accept': 'application/json' } })
+        .then(function (r) { return r.ok ? r.json() : null; })
+        .then(function (d) {
+          if (!d) return;
+          var lim = d.budget_limit;
+          var cur = d.current_cost;
+          var curTxt = (cur === null || cur === undefined) ? 'not measured'
+                     : ('$' + Number(cur).toFixed(2));
+          if (lim === null || lim === undefined) {
+            el.style.borderColor = 'var(--loki-warning)';
+            el.innerHTML = '<strong>No spend cap set.</strong> This run will not stop on cost. '
+              + 'Spent so far: ' + curTxt + '. '
+              + 'Set one with <code>LOKI_BUDGET_LIMIT=&lt;usd&gt;</code>.';
+          } else if (d.exceeded) {
+            el.style.borderColor = 'var(--loki-error)';
+            el.innerHTML = '<strong>Budget exceeded.</strong> Cap $' + Number(lim).toFixed(2)
+              + ', spent ' + curTxt + '.';
+          } else {
+            var rem = (d.remaining === null || d.remaining === undefined)
+              ? 'not measured' : ('$' + Number(d.remaining).toFixed(2));
+            el.style.borderColor = 'var(--loki-border)';
+            el.innerHTML = 'Spend cap $' + Number(lim).toFixed(2)
+              + '. Spent ' + curTxt + ', remaining ' + rem + '.';
+          }
+          el.style.display = 'block';
+        })
+        .catch(function () { /* leave hidden */ });
+    };
+
+    // LEARNINGS. What the build learned from its own gate failures.
+    //
+    // /api/learnings held real records -- rootCause, fix, preventInFuture --
+    // with no UI consumer. The system was learning from its runs and showing
+    // nobody, which makes the memory unfalsifiable: a user cannot correct a
+    // learning they cannot see. Devin's "misleading knowledge" surface is the
+    // same idea and the reason it is worth showing.
+    //
+    // Renders the record's OWN words. Nothing is summarised or re-derived: a
+    // paraphrased root cause is a second claim about a claim.
+    window.loadLearnings = function () {
+      var panel = document.getElementById('learnings-panel');
+      var list = document.getElementById('learnings-list');
+      if (!panel || !list) return;
+      fetch('/api/learnings', { headers: { 'Accept': 'application/json' } })
+        .then(function (r) { return r.ok ? r.json() : null; })
+        .then(function (d) {
+          if (!d) return;
+          var rows = Array.isArray(d) ? d : (d.learnings || []);
+          if (!rows.length) return;      // nothing learned yet: say nothing
+          rows = rows.slice().reverse().slice(0, 8);
+          var html = '';
+          for (var i = 0; i < rows.length; i++) {
+            var x = rows[i] || {};
+            var when = x.timestamp ? String(x.timestamp).slice(0, 16).replace('T', ' ') : '-';
+            var iter = (x.iteration === null || x.iteration === undefined) ? '-' : ('iter ' + x.iteration);
+            html += '<div style="padding:8px;border-bottom:1px solid var(--loki-border);font-size:12px;">'
+                 + '<div style="display:flex;gap:10px;color:var(--loki-text-muted);margin-bottom:4px;">'
+                 + '<span>' + when + '</span><span>' + iter + '</span>'
+                 + '<span>' + String(x.trigger || 'unknown trigger') + '</span></div>'
+                 + '<div style="margin-bottom:3px;"><strong>cause:</strong> '
+                 + String(x.rootCause || 'not recorded') + '</div>'
+                 + (x.fix ? '<div style="margin-bottom:3px;"><strong>fix:</strong> ' + String(x.fix) + '</div>' : '')
+                 + (x.preventInFuture ? '<div style="color:var(--loki-text-muted);"><strong>prevent:</strong> '
+                     + String(x.preventInFuture) + '</div>' : '')
+                 + '</div>';
+          }
+          list.innerHTML = html;
+          panel.style.display = 'block';
+        })
+        .catch(function () { /* leave hidden */ });
+    };
+
+    // RECEIPT LIST. Fetched on demand when the Trust section opens, not on a
+    // timer: it is a history view, and polling it would spend a request every
+    // 30s on data that only changes when a run finishes.
+    //
+    // Every field rendered comes straight from the receipt. Nothing is derived,
+    // and an absent value renders as "-" rather than a zero or a guess -- a
+    // fabricated 0 cost or a blank verdict read as "clean" is the exact false
+    // green the receipt exists to prevent.
+    window.loadReceipts = function () {
+      var panel = document.getElementById('receipts-panel');
+      var list = document.getElementById('receipts-list');
+      var note = document.getElementById('receipts-note');
+      if (!panel || !list) return;
+      fetch('/api/proofs', { headers: { 'Accept': 'application/json' } })
+        .then(function (r) { return r.ok ? r.json() : null; })
+        .then(function (d) {
+          if (!d) return;                      // endpoint absent: leave hidden
+          var rows = Array.isArray(d) ? d : (d.proofs || d.receipts || []);
+          if (!rows.length) return;            // no receipts yet: say nothing
+          rows = rows.slice().reverse().slice(0, 10);
+          var html = '';
+          for (var i = 0; i < rows.length; i++) {
+            var x = rows[i] || {};
+            var verdict = x.headline || x.final_verdict || 'UNKNOWN';
+            var verified = /^VERIFIED/i.test(verdict);
+            var col = verified ? 'var(--loki-success)' : 'var(--loki-text-muted)';
+            var files = (x.files_changed === null || x.files_changed === undefined)
+              ? '-' : String(x.files_changed);
+            var cost = (x.cost_usd === null || x.cost_usd === undefined)
+              ? '-' : ('$' + Number(x.cost_usd).toFixed(2));
+            var when = x.generated_at ? String(x.generated_at).slice(0, 16).replace('T', ' ') : '-';
+            var link = x.has_html
+              ? ('<a href="/api/proofs/' + encodeURIComponent(x.run_id || '') + '/html"'
+                 + ' target="_blank" rel="noopener" style="color:var(--loki-accent);">open</a>')
+              : '<span style="color:var(--loki-text-muted);">no html</span>';
+            html += '<div style="display:flex;gap:12px;align-items:center;padding:6px 8px;'
+                 + 'border-bottom:1px solid var(--loki-border);font-size:12px;">'
+                 + '<span style="color:' + col + ';font-weight:600;min-width:130px;">'
+                 + String(verdict).slice(0, 22) + '</span>'
+                 + '<span style="color:var(--loki-text-muted);min-width:120px;">' + when + '</span>'
+                 + '<span style="min-width:90px;">' + files + ' files</span>'
+                 + '<span style="min-width:70px;">' + cost + '</span>'
+                 + link + '</div>';
+          }
+          list.innerHTML = html;
+          if (note) {
+            note.textContent = 'Newest first. "open" renders the receipt itself. '
+              + 'Re-check any of them: loki proof verify <run-id>';
+          }
+          panel.style.display = 'block';
+        })
+        .catch(function () { /* leave hidden: no receipt surface is better than a wrong one */ });
+    };
+
     function poll() {
       fetch('/api/proofs/summary', { headers: { 'Accept': 'application/json' } })
         .then(function (r) { return r.ok ? r.json() : null; })
@@ -16065,7 +16228,10 @@ document.addEventListener('DOMContentLoaded', function() {
     // document and cannot see the SPA's manual data-loki-theme toggle, so we
     // pass the resolved theme as a query param (?theme=dark|light); the
     // standalone page reads it and matches. v7.18.0.
+    if (sectionId === 'insights') { loadLearnings(); }
+    if (sectionId === 'cost') { loadBudget(); }
     if (sectionId === 'trust') {
+      loadReceipts();
       var tframe = document.getElementById('trust-frame');
       if (tframe && (!tframe.src || tframe.src === 'about:blank' ||
           tframe.getAttribute('src') === 'about:blank')) {

package/docs/VERIFICATION-COST.md

@@ -25,6 +25,8 @@ different answer on your hardware.
 | FULL local gate | 23 to 26 minutes | `LOCAL_CI_TIER=full bash scripts/local-ci.sh`, 166 checks, five runs on an M-series Mac |
 | FAST local gate | about 1 minute | `bash scripts/local-ci.sh`, the documented pre-push tier |
 | Shell suite, sharded | 352 seconds | 323 suites, `LOCAL_CI_SHARDS=4`; 1440 seconds serial, so 4.1x |
+| `loki verify` | 77 seconds | `loki verify HEAD~1` on this repository, 5 changed files; dominated by the project's own test suite, not by our gates |
+| of which, shipped-vs-dev CVE split | 418 ms | one extra `npm audit --omit=dev`; 0.5% of the run, and the reason the audit finding can say whether a CVE reaches users |
 | `loki outcomes` | under 1 second per receipt | `git blame` and one `git log` per changed file |
 | `loki intent status` | milliseconds | hash comparison against `.loki/spec/spec.lock` |
 | Agent readiness | milliseconds | filesystem checks only, no network |
@@ -50,6 +52,24 @@ non-forgeability requires the signed path
 (`LOKI_PROOF_GPG_KEY`, see [SIGNED-RECEIPTS.md](SIGNED-RECEIPTS.md)). We removed
 our own "non-forgeable" claim in v7.111.0 after finding it false on that path.
 
+**The tests gate depends on correctly identifying YOUR test runner, and it has
+been wrong before.** Until 2026-08-07 the runner was chosen by grepping
+`package.json` for `"jest"` / `"vitest"` / `"mocha"`, which matches a
+**devDependency**. This repository is the case that exposed it: jest is a
+devDependency with no jest config while `scripts.test` runs `bash -n` plus
+`node --test`, so verify ran jest, jest globbed 895 files that are not jest
+tests, and `loki verify` returned BLOCKED on a clean tree -- permanently, for a
+defect that did not exist. It now reads `scripts.test` with a JSON parser and
+runs what the project declares.
+
+We record this rather than quietly fixing it because a false BLOCK is the more
+damaging direction of that error: a gate that cries wolf on every run trains
+you to ignore the verdict, which costs more than the gate ever earned. If the
+tests gate reports a runner you do not use, that is a bug in our detection, not
+a finding about your code -- the runner is named in
+`.loki/verify/evidence.json` under `deterministic_gates[].runner` so you can
+check which one it picked.
+
 **Only four of the eight quality gates are agent-independent.** Static analysis,
 mock-integrity, test-mutation and documentation coverage do not ask a model
 anything. The other four involve model judgment and are labelled ASSESSMENTS