loki-mode 9.18.4 → 9.20.0

package/web-app/dist/assets/{trending-up-EQFTzhEo.js → trending-up-DDrJKL5i.js}

@@ -1,4 +1,4 @@
-import{c as e}from"./index-B-0iHBPO.js";/**
+import{c as e}from"./index-BXA3UT6P.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{upload-JfI5lCSE.js → upload-C54rjN8K.js}

@@ -1,4 +1,4 @@
-import{c as a}from"./index-B-0iHBPO.js";/**
+import{c as a}from"./index-BXA3UT6P.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/assets/{usePolling-BnhPUuGd.js → usePolling-D7fw4YSM.js}

@@ -1 +1 @@
-import{r as e}from"./index-B-0iHBPO.js";function m(s,u=2e3,a=!0){const[c,l]=e.useState(null),[f,o]=e.useState(null),[i,d]=e.useState(!0),r=e.useRef(!0),n=e.useCallback(async()=>{try{const t=await s();r.current&&(l(t),o(null))}catch(t){r.current&&o(t instanceof Error?t.message:"Unknown error")}finally{r.current&&d(!1)}},[s]);return e.useEffect(()=>{if(r.current=!0,!a)return;n();const t=setInterval(n,u);return()=>{r.current=!1,clearInterval(t)}},[n,u,a]),{data:c,error:f,loading:i,refresh:n}}export{m as u};
+import{r as e}from"./index-BXA3UT6P.js";function m(s,u=2e3,a=!0){const[c,l]=e.useState(null),[f,o]=e.useState(null),[i,d]=e.useState(!0),r=e.useRef(!0),n=e.useCallback(async()=>{try{const t=await s();r.current&&(l(t),o(null))}catch(t){r.current&&o(t instanceof Error?t.message:"Unknown error")}finally{r.current&&d(!1)}},[s]);return e.useEffect(()=>{if(r.current=!0,!a)return;n();const t=setInterval(n,u);return()=>{r.current=!1,clearInterval(t)}},[n,u,a]),{data:c,error:f,loading:i,refresh:n}}export{m as u};

package/web-app/dist/assets/{user-DSUiUYtj.js → user-Cg7fbzdh.js}

@@ -1,4 +1,4 @@
-import{c}from"./index-B-0iHBPO.js";/**
+import{c}from"./index-BXA3UT6P.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.

package/web-app/dist/index.html

@@ -7,8 +7,8 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=DM+Serif+Display&family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="/lab/assets/index-B-0iHBPO.js"></script>
-    <link rel="stylesheet" crossorigin href="/lab/assets/index-BfZSDej1.css">
+    <script type="module" crossorigin src="/lab/assets/index-BXA3UT6P.js"></script>
+    <link rel="stylesheet" crossorigin href="/lab/assets/index-DgpUuqwR.css">
   </head>
   <body class="bg-background text-ink font-sans antialiased">
     <div id="root"></div>

package/web-app/server.py

@@ -8628,6 +8628,84 @@ async def docs_get_file(session_id: str, filename: str) -> Response:
     return Response(content=content, media_type="text/markdown")
 
 
+# ---------------------------------------------------------------------------
+# Evidence Receipts.
+#
+# MUST be declared ABOVE the SPA catch-all below, or these return text/html
+# instead of JSON -- the exact v7.6.0 bug documented there, which silently
+# swallowed 22 API routes.
+#
+# The EvidenceReceiptPanel calls these. Without them `loki web` (port 57375)
+# rendered "Could not load receipts" for every user while the identical panel
+# worked against the dashboard on 57374, because only the dashboard defined
+# /api/proofs. Found by driving the built bundle in a real browser -- a unit
+# test against a stubbed fetch cannot see a route that does not exist.
+#
+# Delegates to dashboard.server's readers rather than reimplementing the
+# traversal guards and the honesty bucketing. Two implementations of "which
+# receipts exist" WILL drift, and a verification surface that disagrees with
+# itself is worse than one that is merely missing.
+# ---------------------------------------------------------------------------
+def _dashboard_proofs_module():
+    """Import the dashboard's proof readers, or None if unavailable."""
+    try:
+        import sys as _sys
+        _root = str(SCRIPT_DIR.parent)
+        if _root not in _sys.path:
+            _sys.path.insert(0, _root)
+        from dashboard import server as _dash  # type: ignore
+        return _dash
+    except Exception:
+        return None
+
+
+@app.get("/api/proofs")
+async def webapp_list_proofs() -> Response:
+    """List Evidence Receipts. Mirrors the dashboard's /api/proofs exactly."""
+    dash = _dashboard_proofs_module()
+    if dash is None:
+        # An honest empty list, not a 500: a missing dashboard package means we
+        # cannot read receipts, and the panel's own empty state explains that
+        # none were found. A 500 would render as a scary error for what is a
+        # normal partial install.
+        return JSONResponse(content={"proofs": []})
+    try:
+        return JSONResponse(content=await dash.list_proofs())
+    except Exception as e:
+        return JSONResponse(status_code=500, content={"error": str(e)})
+
+
+@app.get("/api/proofs/summary")
+async def webapp_proofs_summary() -> Response:
+    """Verdict distribution across receipts. Mirrors the dashboard endpoint."""
+    dash = _dashboard_proofs_module()
+    if dash is None:
+        return JSONResponse(content={
+            "total_receipts": 0, "verified": 0, "with_gaps": 0,
+            "not_verified": 0, "unknown": 0,
+        })
+    try:
+        return JSONResponse(content=await dash.proofs_summary())
+    except Exception as e:
+        return JSONResponse(status_code=500, content={"error": str(e)})
+
+
+@app.get("/api/proofs/{run_id}")
+async def webapp_get_proof(run_id: str) -> Response:
+    """One receipt. The dashboard reader enforces the path-traversal guard."""
+    dash = _dashboard_proofs_module()
+    if dash is None:
+        return JSONResponse(status_code=404, content={"error": "proofs unavailable"})
+    try:
+        return await dash.get_proof(run_id)
+    except Exception as e:
+        # HTTPException carries its own status (404 for an unknown run id);
+        # anything else is a genuine read failure.
+        status = getattr(e, "status_code", 500)
+        detail = getattr(e, "detail", str(e))
+        return JSONResponse(status_code=status, content={"error": detail})
+
+
 # ---------------------------------------------------------------------------
 # SPA catch-all (MUST be last @app route -- see comment at the old serve_spa
 # location higher in this file). Any path that isn't matched by a specific