loki-mode 9.22.12 → 9.23.1

package/autonomy/run.sh

@@ -967,6 +967,36 @@ _loki_provider_pipeline_exit_code() {
     fi
 }
 
+# Invoke through a provider's argv-builder seam while preserving the main
+# loop's deadline, fan-out logging, and provider-stage exit status.
+_loki_invoke_argv_provider() {
+    local tier="${1:-development}"
+    local prompt="${2:-}"
+    local log_file="${3:-}"
+    local agent_log="${4:-}"
+    local iter_output="${5:-}"
+    local -a _loki_argv_pipe_status=()
+
+    if ! type provider_invoke_argv >/dev/null 2>&1; then
+        log_error "Provider ${PROVIDER_NAME:-unknown} does not implement provider_invoke_argv"
+        return 125
+    fi
+    if ! provider_invoke_argv "$tier" "$prompt" \
+        || [ "${#_LOKI_INVOKE_ARGV[@]}" -eq 0 ]; then
+        log_error "Provider ${PROVIDER_NAME:-unknown} failed to build invocation argv"
+        return 125
+    fi
+
+    LOKI_DEADLINE_IDLE_TIMEOUT="${LOKI_PROVIDER_IDLE_TIMEOUT:-0}" \
+    _loki_with_deadline "${LOKI_PROVIDER_CALL_TIMEOUT:-0}" \
+        "${_LOKI_INVOKE_ARGV[@]}" 2>&1 \
+        | tee -a "$log_file" "$agent_log" "$iter_output"
+    _loki_argv_pipe_status=("${PIPESTATUS[@]}")
+    return "$(_loki_provider_pipeline_exit_code \
+        "${_loki_argv_pipe_status[0]:-125}" \
+        "${_loki_argv_pipe_status[1]:-125}" 0)"
+}
+
 _LOKI_DEPENDENCY_SETUP_LIB="${SCRIPT_DIR}/lib/dependency-setup.sh"
 if [ -r "$_LOKI_DEPENDENCY_SETUP_LIB" ]; then
     # shellcheck source=lib/dependency-setup.sh
@@ -1519,20 +1549,20 @@ PYREG
 # if any other project is still running (KEEP) it is left up. NEVER uses a
 # blanket pkill and NEVER touches another folder's pids. Best-effort and
 # failure-swallowed: teardown bookkeeping must never block a clean exit.
-# Is this pid plausibly OUR dashboard, or a recycled number now naming something
-# else? Fails OPEN (returns 0) whenever ps cannot tell us, so the only behavior
-# change is refusing to kill a process that is positively identified as NOT a
-# dashboard. See the call site for the measured stale-file evidence.
+# Is this pid positively identified as our dashboard, rather than a recycled
+# number now naming something else? Ownership-sensitive cleanup must fail closed:
+# an absent `ps` result is not evidence, and a generic python/loki substring is
+# not specific enough to authorize a signal.
 _loki_pid_looks_like_dashboard() {
     local _p="$1" _cmd
     case "$_p" in ''|*[!0-9]*) return 1 ;; esac
     [ "$_p" -gt 1 ] 2>/dev/null || return 1     # never signal pid 0/1
     _cmd="$(ps -o command= -p "$_p" 2>/dev/null)"
-    [ -n "$_cmd" ] || return 0                   # ps unavailable: behave as before
-    case "$_cmd" in
-        *dashboard*|*uvicorn*|*loki*) return 0 ;;
-    esac
-    return 1
+    [ -n "$_cmd" ] || return 1
+    # run.sh and `loki dashboard start` both launch this exact module form.
+    # Anchor the interpreter and module tokens so an unrelated command merely
+    # mentioning "dashboard.server" in an argument cannot forge identity.
+    [[ "$_cmd" =~ ^[[:space:]]*([^[:space:]]*/)?[Pp]ython([0-9]+([.][0-9]+)*)?[[:space:]]+-m[[:space:]]+dashboard[.]server([[:space:]]|$) ]]
 }
 
 loki_mark_project_stopped_and_maybe_kill_shared_dashboard() {
@@ -1591,9 +1621,10 @@ PYCHECK
             #
             # kill -0 is NOT sufficient: a recycled pid is alive by definition,
             # which is exactly the insufficiency the loki.pgid self-check had.
-            # Mirrors _app_runner_pid_is_ours (app-runner.sh:242) and fails OPEN
-            # the same way -- if `ps` says nothing we signal as before, so a
-            # legitimate dashboard is never left running by this check.
+            # This guard fails CLOSED: if `ps` says nothing, or says something
+            # that is not the dashboard's own command, we do not signal. The
+            # cost of failing closed is a leaked dashboard the next explicit
+            # stop reaps; the cost of failing open was signalling a stranger.
             if [ -n "$_shared_pid" ] && _loki_pid_looks_like_dashboard "$_shared_pid"; then
                 kill "$_shared_pid" 2>/dev/null || true
                 sleep 0.5
@@ -1601,27 +1632,11 @@ PYCHECK
             fi
             rm -f "$_shared_pidfile" 2>/dev/null || true
         fi
-        # (d) Defense-in-depth: reclaim the dashboard port only in the CLEAR
-        # case, so we never kill a shared dashboard another project owns.
-        # BUT never kill a HEALTHY dashboard already serving on the port: that is
-        # almost always the user's own live dashboard (open in their browser), and
-        # killing it mid-use drops their session (ERR_CONNECTION_REFUSED, WS fail).
-        # A healthy server is reusable by every project, so probe /api/status first
-        # and only reclaim the port when nothing is answering (a genuinely stale
-        # listener). Opt out of the probe with LOKI_DASHBOARD_FORCE_RECLAIM=1.
-        if command -v lsof >/dev/null 2>&1; then
-            local _dash_port="${DASHBOARD_PORT:-57374}"
-            local _dash_alive=""
-            if [ "${LOKI_DASHBOARD_FORCE_RECLAIM:-}" != "1" ] && command -v curl >/dev/null 2>&1; then
-                _dash_alive=$(curl -s -o /dev/null -w '%{http_code}' --max-time 1 \
-                    "http://127.0.0.1:${_dash_port}/api/status" 2>/dev/null || true)
-            fi
-            if [ "$_dash_alive" = "200" ]; then
-                log_info "Reusing the healthy dashboard already serving on port ${_dash_port} (not reclaiming)."
-            else
-                lsof -ti:"${_dash_port}" -sTCP:LISTEN 2>/dev/null | xargs kill 2>/dev/null || true
-            fi
-        fi
+        # A port number and an HTTP response are not ownership evidence. In
+        # particular, a 404 can be an unrelated healthy service. The shared PID
+        # file plus positive command identity above is the only authority to
+        # signal a process; absent or forged ownership leaves every port holder
+        # untouched.
     fi
 }
 # Register as running now. We deliberately do NOT install an EXIT trap to
@@ -3207,7 +3222,7 @@ validate_api_keys() {
         # "loggedin" or "unknown" -> proceed (fail open on uncertainty).
     fi
 
-    # CLI tools (claude, codex, cline, aider) use their own login sessions.
+    # CLI tools (claude, codex, cline, aider, opencode) use their own login sessions.
     # Only require API keys inside Docker/K8s where CLI login isn't available.
     if [[ ! -f "/.dockerenv" ]] && [[ -z "${KUBERNETES_SERVICE_HOST:-}" ]]; then
         return 0
@@ -13425,6 +13440,43 @@ _loki_requirements_contract_emit() {
         "${LOKI_REVIEW_REQUIREMENTS_IDENTITY:-}"
 }
 
+# A reviewer dispatch can die BEFORE the provider is ever invoked -- the
+# prompt rematerialization or the shard-identity lookup below both exit 125
+# while LOKI_REVIEW_STDERR_FILE is still unset and no timing sidecar exists
+# yet. That left a lost shard structurally invisible: the logical aggregation
+# (REQUIREMENTS_LOGICAL_TIMING) substituted an anonymous placeholder and the
+# only symptom was a bare call count that could not name WHICH shard vanished.
+# Emit the same sidecar the completed path emits, plus one bounded stderr
+# line, so the existing aggregation carries a shard-identifying cause.
+# ponytail: fixed-format single line, no truncation helper needed.
+_dispatch_reviewer_prestub_failure() {
+    local review_output="$1" stderr_output="$2" stage="$3" shard_index="${4:-0}"
+    printf 'loki-review-prestub-failure stage=%s shard_index=%s reviewer=%s\n' \
+        "$stage" "$shard_index" "${5:-unknown}" >> "$stderr_output" 2>/dev/null || true
+    chmod 600 "$stderr_output" 2>/dev/null || true
+    _LOKI_RDT_PATH="${review_output%.txt}-timing.json" \
+    _LOKI_RDT_STAGE="$stage" _LOKI_RDT_SHARD="$shard_index" \
+    _LOKI_RDT_STDERR="$stderr_output" \
+    _LOKI_RDT_BUDGET="${LOKI_REVIEW_CALL_TIMEOUT:-0}" python3 - <<'REVIEW_PRESTUB_TIMING' 2>/dev/null || true
+import json
+import os
+
+record = {
+    "schema": "loki-review-dispatch/v1",
+    "budget_seconds": int(os.environ.get("_LOKI_RDT_BUDGET", "0") or 0),
+    "elapsed_ms": 0,
+    "exit_code": 125,
+    "outcome": "prestub_error",
+    "deadline_scope": "pre_dispatch",
+    "stage": os.environ.get("_LOKI_RDT_STAGE", "unknown"),
+    "shard_index": int(os.environ.get("_LOKI_RDT_SHARD", "0") or 0),
+    "stderr_bytes": os.path.getsize(os.environ["_LOKI_RDT_STDERR"]),
+}
+with open(os.environ["_LOKI_RDT_PATH"], "w", encoding="utf-8") as handle:
+    json.dump(record, handle, sort_keys=True)
+REVIEW_PRESTUB_TIMING
+}
+
 # Persist one compact record per provider review. The sidecar is written by the
 # same process that owns the dispatch, so parallel reviewer timings do not get
 # distorted by the parent's ordered wait loop.
@@ -15373,7 +15425,13 @@ BUILD_PROMPT
             prompt_text=$(python3 "$requirements_helper" read-bound \
                 "$review_prompt_file" "$prompt_sha" \
                 "$_review_max_prompt_bytes" "$prompt_identity" 2>/dev/null) \
-                || exit 125
+                || {
+                    _dispatch_reviewer_prestub_failure \
+                        "$review_stage_file" \
+                        "$review_dir/$review_id/${reviewer_name}-stderr.log" \
+                        prompt_read_bound "$reviewer_shard_index" "$reviewer_name"
+                    exit 125
+                }
             if [ "$reviewer_logical_name" = "requirements-verifier" ]; then
                 local shard_label shard_identity
                 printf -v shard_label '%03d' "$reviewer_shard_index"
@@ -15381,7 +15439,13 @@ BUILD_PROMPT
                     _LOKI_REVIEW_SHARD_INDEX="$reviewer_shard_index" python3 -c '
 import json, os
 print(json.loads(os.environ["_LOKI_REVIEW_SHARD_IDENTITIES"])[int(os.environ["_LOKI_REVIEW_SHARD_INDEX"]) - 1])
-') || exit 125
+') || {
+                    _dispatch_reviewer_prestub_failure \
+                        "$review_stage_file" \
+                        "$review_dir/$review_id/${reviewer_name}-stderr.log" \
+                        shard_identity "$reviewer_shard_index" "$reviewer_name"
+                    exit 125
+                }
                 LOKI_REVIEW_REQUIREMENTS_HELPER="$requirements_helper" \
                 LOKI_REVIEW_REQUIREMENTS_SOURCE="$requirements_source" \
                 LOKI_REVIEW_REQUIREMENTS_SNAPSHOT="$requirements_file" \
@@ -16557,9 +16621,16 @@ start_dashboard() {
         # Check if it's our own dashboard
         local existing_pid=$(lsof -ti :$DASHBOARD_PORT 2>/dev/null | head -1)
         if [ -n "$existing_pid" ]; then
-            # Only kill if it's a Python/uvicorn dashboard process
+            # Only kill a process positively identified as OUR dashboard.
+            # `-o comm=` yields just the executable name ("python3"), so the old
+            # *python*/*uvicorn* test matched ANY python process that happened to
+            # hold this port -- an unrelated http.server answering 404 was killed
+            # as a "stuck dashboard". Reuse the same full-command-line guard the
+            # teardown path uses: it fails closed on an unreadable or foreign
+            # command, so a stranger on this port is stepped over (port++) rather
+            # than signalled.
             local proc_cmd=$(ps -p "$existing_pid" -o comm= 2>/dev/null || true)
-            if [[ "$proc_cmd" == *python* ]] || [[ "$proc_cmd" == *uvicorn* ]]; then
+            if _loki_pid_looks_like_dashboard "$existing_pid"; then
                 # Never kill a HEALTHY dashboard already serving here: it is almost
                 # always the user's own live dashboard (open in their browser), and
                 # killing it on `loki start` drops their session mid-use. A healthy
@@ -23266,6 +23337,16 @@ if __name__ == "__main__":
                 } && exit_code=0 || exit_code=$?
                 ;;
 
+            opencode)
+                # Keep argv construction provider-owned: its prompt is
+                # positional, --auto is mandatory, and the model is provider
+                # scoped. The wrapper preserves the main-loop deadline/tee
+                # contract and returns the provider stage's nonzero status.
+                _loki_invoke_argv_provider "$CURRENT_TIER" "$prompt" \
+                    "$log_file" "$agent_log" "$iter_output"
+                exit_code=$?
+                ;;
+
             *)
                 log_error "Unknown provider: ${PROVIDER_NAME:-unknown}"
                 local exit_code=1
@@ -25745,7 +25826,7 @@ main() {
                     fi
                     shift 2
                 else
-                    log_error "--provider requires a value (claude, codex, cline, aider)"
+                    log_error "--provider requires a value (claude, codex, cline, aider, opencode)"
                     exit 1
                 fi
                 ;;

package/autonomy/verify.sh

@@ -368,15 +368,28 @@ _verify_zero_tests_executed() {
                 [ -n "$_zt_f" ] || continue
                 _zt_bases="${_zt_bases}${_zt_f}"$'\n'"$(basename "$_zt_f")"$'\n'
             done
-            local _zt_real=0 _zt_line _zt_label
+            local _zt_real=0 _zt_line _zt_label _zt_matches
+            _zt_matches=$(printf '%s\n' "$_zt_out" | grep -E '^(ok|not ok) [0-9]+ - ' 2>/dev/null || true)
             while IFS= read -r _zt_line; do
+                [ -n "$_zt_line" ] || continue
                 _zt_label="${_zt_line#* - }"
                 case "$_zt_bases" in
                     *$'\n'"$_zt_label"$'\n'*) continue ;;
                 esac
                 _zt_real=$((_zt_real + 1))
-            done < <(printf '%s\n' "$_zt_out" | grep -E '^(ok|not ok) [0-9]+ - ' 2>/dev/null)
-            [ "$_zt_real" -eq 0 ] && return 0
+            done << ZT_MATCHES_EOF
+$_zt_matches
+ZT_MATCHES_EOF
+            [ "$_zt_real" -gt 0 ] && return 1
+
+            # Node 26 defaults to the human-readable spec reporter under npm
+            # scripts. It has no TAP ok-lines, so an absent match is not proof
+            # that zero tests ran. Only classify zero tests when the output is
+            # positively identifiable as TAP; unknown/custom reporter shapes
+            # remain a passing run instead of becoming a false CONCERN.
+            case "$_zt_out" in
+                *"TAP version"*|*$'\n# tests '*|"# tests "*) return 0 ;;
+            esac
             return 1
             ;;
         jest)

package/bin/loki

@@ -188,7 +188,7 @@ fi
 # error regardless of which subcommand they invoke.
 if [ "${LOKI_PROVIDER:-}" = "gemini" ]; then
     echo "Error: Provider 'gemini' is deprecated as of v7.5.18 and has been removed." >&2
-    echo "Active providers: claude, codex, cline, aider" >&2
+    echo "Active providers: claude, codex, cline, aider, opencode" >&2
     echo "Unset LOKI_PROVIDER or use: LOKI_PROVIDER=claude" >&2
     exit 1
 fi
@@ -273,8 +273,19 @@ _loki_start_needs_bash() {
     # $@ = the start args (already know $1 = start). Return 0 (divert to bash) if
     # any bash-only orchestration flag or an issue-ref spec is present.
     local a
+    local explicit_provider=""
+    local provider_value_next=0
     for a in "$@"; do
+        if [ "$provider_value_next" = "1" ]; then
+            explicit_provider="$a"
+            provider_value_next=0
+            continue
+        fi
         case "$a" in
+            --provider)
+                provider_value_next=1 ;;
+            --provider=*)
+                explicit_provider="${a#--provider=}" ;;
             --parallel|--bg|--background|--github|--api|--sandbox \
             |--fast|--repo-fast|--full|--repo-full \
             |--bmad-project|--openspec \
@@ -296,6 +307,19 @@ _loki_start_needs_bash() {
         esac
     done
     unset _loki_iso_next
+
+    # The Bun RARV loop has not ported the opencode invoker yet. Keep the
+    # released, autonomous shell adapter reachable when SDK mode is enabled
+    # instead of accepting the selection and then failing after intake. CLI
+    # selection wins over env, which wins over the project-level saved choice.
+    local effective_provider="$explicit_provider"
+    if [ -z "$effective_provider" ] && [ -n "${LOKI_PROVIDER:-}" ]; then
+        effective_provider="$LOKI_PROVIDER"
+    fi
+    if [ -z "$effective_provider" ] && [ -f "${PWD}/.loki/state/provider" ]; then
+        effective_provider="$(sed -n '1p' "${PWD}/.loki/state/provider" 2>/dev/null || true)"
+    fi
+    [ "$effective_provider" = "opencode" ] && return 0
     return 1
 }
 if [ "${1:-}" = "start" ] && { [ "${LOKI_SDK_LOOP:-}" = "1" ] || [ "${LOKI_SDK_LOOP:-}" = "true" ]; }; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.22.12"
+__version__ = "9.23.1"
 
 # Expose the control app for easy import
 try:

package/dashboard/control.py

@@ -20,10 +20,11 @@ import tempfile
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Optional
+from urllib.parse import urlsplit
 
-from fastapi import Depends, FastAPI, HTTPException
+from fastapi import Depends, FastAPI, HTTPException, Request
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import StreamingResponse
+from fastapi.responses import JSONResponse, StreamingResponse
 from pydantic import BaseModel
 
 # Auth gating for the standalone control app.
@@ -56,6 +57,63 @@ except Exception:  # pragma: no cover - defensive fallback for non-package runs
 
 _CONTROL_DEP = _require_control_scope()
 
+
+def _normalized_http_origin(value: str) -> tuple[str, str, int] | None:
+    """Return a comparable browser origin, or ``None`` when malformed.
+
+    Origin is scheme + host + effective port. Paths, credentials, queries and
+    fragments are never valid in an Origin header. Normalising default ports
+    makes ``https://host`` and ``https://host:443`` equivalent without doing
+    loose prefix/suffix matching on attacker-controlled text.
+    """
+    try:
+        parsed = urlsplit(value.strip())
+        if (
+            parsed.scheme.lower() not in ("http", "https")
+            or not parsed.hostname
+            or parsed.username is not None
+            or parsed.password is not None
+            or parsed.path not in ("", "/")
+            or parsed.query
+            or parsed.fragment
+        ):
+            return None
+        port = parsed.port
+    except (TypeError, ValueError):
+        return None
+    if port is None:
+        port = 443 if parsed.scheme.lower() == "https" else 80
+    return parsed.scheme.lower(), parsed.hostname.lower(), port
+
+
+def browser_mutation_origin_allowed(
+    request: Request, allowed_origins: list[str]
+) -> bool:
+    """Allow non-browser clients, same-origin pages and explicit CORS origins.
+
+    CORS controls whether a browser may *read* a response; it does not stop a
+    simple cross-origin POST from being sent. State-changing routes therefore
+    need their own check. Browsers always attach Origin to cross-origin fetches,
+    while CLI/SDK/local health clients commonly omit it, so absence preserves
+    the existing local-first API. A present malformed or unrelated origin is
+    refused before route code can touch disk or processes.
+    """
+    supplied = request.headers.get("origin")
+    if supplied is None:
+        return True
+    if "*" in allowed_origins:
+        return True
+    supplied_origin = _normalized_http_origin(supplied)
+    if supplied_origin is None:
+        return False
+    request_origin = _normalized_http_origin(str(request.base_url))
+    if supplied_origin == request_origin:
+        return True
+    return any(
+        supplied_origin == _normalized_http_origin(candidate)
+        for candidate in allowed_origins
+    )
+
 # Configuration
 LOKI_DIR = Path(os.environ.get("LOKI_DIR", ".loki"))
 STATE_DIR = LOKI_DIR / "state"
@@ -202,16 +260,42 @@ app = FastAPI(
 # CORS middleware for dashboard frontend - restricted to localhost by default.
 # Set LOKI_DASHBOARD_CORS to override (comma-separated origins).
 _cors_default = "http://localhost:57374,http://127.0.0.1:57374"
-_cors_origins = os.environ.get("LOKI_DASHBOARD_CORS", _cors_default).split(",")
+_cors_raw = os.environ.get("LOKI_DASHBOARD_CORS", _cors_default)
+_cors_origins = [o.strip() for o in _cors_raw.split(",") if o.strip()]
+if "*" in _cors_origins or _cors_raw.strip() == "*":
+    if os.environ.get("LOKI_ENV") == "production":
+        raise RuntimeError(
+            "Wildcard CORS ('*') is not allowed in production. "
+            "Set LOKI_DASHBOARD_CORS to a specific origin list, "
+            "or set LOKI_ENV != production."
+        )
+    import logging
+
+    logging.getLogger(__name__).warning(
+        "LOKI_DASHBOARD_CORS is set to '*' -- all origins are allowed. "
+        "This is insecure for production deployments."
+    )
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=[o.strip() for o in _cors_origins if o.strip()],
+    allow_origins=_cors_origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
 )
 
 
+@app.middleware("http")
+async def browser_mutation_boundary(request: Request, call_next):
+    """Refuse cross-origin browser mutations before control side effects."""
+    if request.method in ("POST", "PUT", "PATCH", "DELETE"):
+        if not browser_mutation_origin_allowed(request, _cors_origins):
+            return JSONResponse(
+                status_code=403,
+                content={"detail": "cross-origin mutation refused"},
+            )
+    return await call_next(request)
+
+
 # Request/Response models
 class StartRequest(BaseModel):
     """Request body for starting a Loki Mode session."""

package/dashboard/server.py

@@ -58,7 +58,12 @@ from . import audit
 from . import app_secrets as secrets_mod
 from . import telemetry as _telemetry
 from . import build_supervisor as _build_execution
-from .control import atomic_write_json, find_skill_dir, is_process_running
+from .control import (
+    atomic_write_json,
+    browser_mutation_origin_allowed,
+    find_skill_dir,
+    is_process_running,
+)
 from .activity_logger import get_activity_logger
 from .api_v2 import (
     TenantContext,
@@ -187,53 +192,46 @@ def _rate_key(base: str, request: Optional[Request]) -> str:
 logger = logging.getLogger(__name__)
 
 
-# Reads that expose operational or credential-adjacent state. These stay open
-# to a LOCAL caller (zero-config use is the point) but must not be readable by
-# an anonymous remote caller when the dashboard is bound to 0.0.0.0.
+# Public API metadata needed before a caller can authenticate or before the UI
+# can choose a provider. Everything else under an API namespace is
+# state-bearing unless it is explicitly admitted here.
 #
-# Measured before this list existed, from a routable remote address with auth
-# off: /api/logs, /api/secrets/status, /api/github/status, /api/tasks,
-# /api/council/transcripts and /api/proofs all returned 200.
+# This is deliberately an ALLOWLIST, not the old list of sensitive prefixes.
+# That list silently started every new read family public. Measured from a
+# routable remote address with auth off, routes added after the list --
+# /api/context, /api/notifications, /api/agents, /api/usage,
+# /api/prd-observations and every /api/v2/* read -- all reached their handlers
+# and returned project, tenant or audit state.
 #
-# /health and /metrics are deliberately ABSENT: a container health probe and a
-# Prometheus scrape must keep working with no configuration, and neither
-# carries workspace content.
-_SENSITIVE_READ_PREFIXES = (
-    "/api/logs",
-    "/api/secrets",
-    "/api/github",
-    "/api/tasks",
-    "/api/projects",
-    "/api/council",
-    "/api/proofs",
-    "/api/phases",
-    "/api/memory",
-    "/api/learnings",
-    "/api/learning",
-    "/api/escalations",
-    "/api/spec",
-    "/api/checkpoints",
-    "/api/enterprise",
-    "/api/collab",
-    "/api/cost",
-    "/api/budget",
-    "/api/findings",
-    "/api/operator",
-    "/api/fleet",
-    "/api/registry",
-    "/api/wiki",
-    "/api/activity",
-    "/api/session",
-    "/api/failures",
-    "/api/prompt",
-    "/api/quality",
-    "/api/migration",
-    "/api/managed",
-    "/api/app-runner",
-    "/api/playwright",
-    "/api/checklist",
-    "/api/control",
-)
+# /health, /metrics, /.well-known/*, docs and static/UI routes are outside the
+# API namespaces and remain public. The three entries below contain only
+# capability/auth bootstrap metadata and are already pinned as public by the
+# dashboard auth inventory tests.
+_PUBLIC_API_GET_PATHS = frozenset({
+    "/api/auth/info",
+    "/api/enterprise/status",
+    "/api/providers/models",
+})
+
+
+def _is_state_bearing_get(path: str) -> bool:
+    """Classify dashboard reads at the namespace boundary.
+
+    A future GET under /api or the mounted Purple Lab's /lab/api namespace is
+    private by default. Exact public metadata is admitted above; probes,
+    discovery documents and UI/static files live outside these namespaces.
+    Normalize one trailing slash so FastAPI's redirect spelling cannot turn a
+    public metadata request into a remote-only failure.
+    """
+    normalized = path.rstrip("/") or "/"
+    if normalized in _PUBLIC_API_GET_PATHS:
+        return False
+    return (
+        normalized == "/api"
+        or normalized.startswith("/api/")
+        or normalized == "/lab/api"
+        or normalized.startswith("/lab/api/")
+    )
 
 
 def _trusted_proxies() -> frozenset:
@@ -1263,9 +1261,13 @@ async def dashboard_control_boundary(request: Request, call_next):
     # /health and /metrics are intentionally NOT in the sensitive list, so a
     # container health probe and a Prometheus scrape keep working unconfigured.
     gated = request.method in ("POST", "PUT", "PATCH", "DELETE")
+    if gated and not browser_mutation_origin_allowed(request, _cors_origins):
+        return JSONResponse(
+            status_code=403,
+            content={"detail": "cross-origin mutation refused"},
+        )
     if not gated:
-        path = request.url.path
-        gated = any(path.startswith(pfx) for pfx in _SENSITIVE_READ_PREFIXES)
+        gated = _is_state_bearing_get(request.url.path)
     if gated:
         try:
             require_local_or_authenticated(request)

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.22.12
+**Version:** v9.23.1
 
 ---
 
@@ -343,7 +343,7 @@ The `HUMAN_INPUT.md` file has security controls:
 
 ## Multi-Provider Support
 
-Loki Mode supports four active providers across three tiers, plus historical/upcoming entries. Pick by capability + cost.
+Loki Mode supports five active providers across three capability modes, plus historical/upcoming entries. Pick by capability + cost.
 
 ### Supported Providers
 

package/docs/RARV-C-100X-PLAN.md

@@ -220,7 +220,15 @@ Every commit proven on BOTH routes (`bin/loki` + `LOKI_LEGACY_BASH=1 bin/loki`).
 - **Post-release smoke from SHIPPED artifacts on BOTH routes**: `npm pack loki-mode@8.0.0` + `bun run bin/loki
   version` and `LOKI_LEGACY_BASH=1 ... version`; `docker run --rm asklokesh/loki-mode:8.0.0 doctor --json`;
   WebFetch brew formula version+sha.
-- **Cleanup after every local-ci/validation**: `lsof -ti:57374 | xargs kill -9; rm -rf /tmp/loki-* /tmp/test-* /tmp/package /tmp/*.tgz`.
+- **Cleanup after every local-ci/validation**: create one exact run-owned directory with `mktemp -d`
+  under the canonical `${TMPDIR:-/tmp}` root and keep all validation artifacts and recorded child
+  PIDs inside it. Use the executable operator-side sequence in
+  [`enterprise/performance.md`](enterprise/performance.md#cleanup); it does not depend on a shipped
+  cleanup helper. Stop only the exact verified child PIDs. Before removing the exact saved path,
+  require its `.loki-run-owned` marker to contain that path, require the target and marker to belong
+  to the current UID, require the target to be a canonical direct child of the temp root, refuse
+  symlinks, and refuse any target with `.git` worktree metadata. A failed guard leaves the path in
+  place for inspection.
 
 ---