loki-mode 9.22.12 → 9.23.1

package/docs/enterprise/performance.md

@@ -267,19 +267,61 @@ When enterprise features are active, background processes consume resources:
 
 ### Cleanup
 
-Enterprise processes are cleaned up on session termination:
+Keep cleanup scoped to the processes and paths created by the current invocation. Record the exact
+child process IDs when starting background services and stop only those verified processes. Do not
+kill by a shared port or process-name pattern.
 
-```bash
-# Kill dashboard server
-lsof -ti:57374 | xargs kill -9 2>/dev/null || true
-
-# Kill background enterprise processes
-pkill -f "loki-run-" 2>/dev/null || true
+Create one run-owned temporary directory before writing any temporary package, log, PID, or test
+artifact. Run the creation and cleanup blocks in the same shell so `run_tmp` retains the exact path:
 
-# Clean temp files
-rm -rf /tmp/loki-* /tmp/test-* 2>/dev/null || true
+```bash
+# Create the only temporary directory this invocation may remove.
+temp_root="$(cd "${TMPDIR:-/tmp}" 2>/dev/null && pwd -P)" || exit 1
+run_tmp="$(mktemp -d "${temp_root}/loki-run.XXXXXXXX")" || exit 1
+chmod 700 "$run_tmp" || exit 1
+run_marker="${run_tmp}/.loki-run-owned"
+printf '%s\n' "$run_tmp" >"$run_marker" || exit 1
+chmod 600 "$run_marker" || exit 1
+
+# Put this invocation's temporary artifacts under "$run_tmp" and retain exact child PIDs there.
+
+# Immediately before removal, fail closed unless every ownership boundary still holds.
+cleanup_target="$run_tmp"
+cleanup_root="$(cd "${TMPDIR:-/tmp}" 2>/dev/null && pwd -P)" || exit 64
+case "$cleanup_target" in
+    "${cleanup_root}"/loki-run.*) ;;
+    *) printf '%s\n' "Refusing cleanup outside the run-owned namespace" >&2; exit 64 ;;
+esac
+[ "$(dirname "$cleanup_target")" = "$cleanup_root" ] || exit 64
+[ -d "$cleanup_target" ] && [ ! -L "$cleanup_target" ] || exit 64
+
+cleanup_marker="${cleanup_target}/.loki-run-owned"
+[ -f "$cleanup_marker" ] && [ ! -L "$cleanup_marker" ] || exit 64
+IFS= read -r marker_value <"$cleanup_marker" || exit 64
+[ "$marker_value" = "$cleanup_target" ] || exit 64
+
+target_uid="$(stat -f '%u' "$cleanup_target" 2>/dev/null || stat -c '%u' "$cleanup_target")" || exit 64
+marker_uid="$(stat -f '%u' "$cleanup_marker" 2>/dev/null || stat -c '%u' "$cleanup_marker")" || exit 64
+[ "$target_uid" = "$(id -u)" ] && [ "$marker_uid" = "$(id -u)" ] || exit 64
+
+target_real="$(cd "$cleanup_target" 2>/dev/null && pwd -P)" || exit 64
+[ "$target_real" = "$cleanup_target" ] || exit 64
+[ "$(dirname "$target_real")" = "$cleanup_root" ] || exit 64
+
+# Refuse primary worktrees, linked worktrees, and a broken .git symlink.
+if [ -e "${cleanup_target}/.git" ] || [ -L "${cleanup_target}/.git" ]; then
+    printf '%s\n' "Refusing to remove a Git worktree" >&2
+    exit 64
+fi
+
+rm -rf -- "$cleanup_target"
+[ ! -e "$cleanup_target" ] || exit 1
 ```
 
+These are operator-side shell commands, not a Loki cleanup helper. Never replace the exact target
+with a wildcard under `/tmp` or `$TMPDIR`, and never remove a path whose marker, UID ownership,
+canonical location, symlink status, or worktree status cannot be verified.
+
 ## Performance Monitoring Checklist
 
 1. **Verify no-op behavior** -- When enterprise env vars are unset, confirm zero overhead by checking that no background threads are created and no disk I/O occurs.

package/docs/exit-codes.md

@@ -84,6 +84,10 @@ Machine-readable output is `--format json` here, not `--json`.
 | 0 | Every required check passed. Optional warnings do not fail the command. |
 | nonzero | At least one required check failed; the output names which |
 
+The contract is identical for human-readable output and `--json`. JSON is
+still emitted in full before the command exits nonzero, so automation can save
+or parse the report while also using the process status as a readiness gate.
+
 Safe as a preflight gate in an init container or pipeline step:
 
 ```sh

package/loki-ts/dist/cockpit.js

@@ -16,4 +16,4 @@ var EJ=Object.defineProperty;var TJ=(J)=>J;function WJ(J,Q){this[J]=TJ.bind(null
 `),3}let G=process.stdout.columns||Number(process.env.COLUMNS)||0,q=G>4?G-2:void 0,K=await CJ($,{protocol:Q,forceText:X,cols:q});if(Z)try{let{writeFileSync:P}=await import("fs");P(Z,K.svg)}catch{}if(K.kind==="image"&&K.data)return process.stdout.write(K.data),0;return process.stderr.write(`FALLBACK	${K.reason||"image unavailable"}
 `),3}if(import.meta.main)rJ().then((J)=>process.exit(J));export{rJ as main};
 
-//# debugId=7F0CBB32F48339CA64756E2164756E21
+//# debugId=FA320A456FDE2DB7437C9AA473A12AC3