loki-mode 9.22.12 → 9.24.0

package/dashboard/server.py

@@ -58,7 +58,12 @@ from . import audit
 from . import app_secrets as secrets_mod
 from . import telemetry as _telemetry
 from . import build_supervisor as _build_execution
-from .control import atomic_write_json, find_skill_dir, is_process_running
+from .control import (
+    atomic_write_json,
+    browser_mutation_origin_allowed,
+    find_skill_dir,
+    is_process_running,
+)
 from .activity_logger import get_activity_logger
 from .api_v2 import (
     TenantContext,
@@ -187,53 +192,46 @@ def _rate_key(base: str, request: Optional[Request]) -> str:
 logger = logging.getLogger(__name__)
 
 
-# Reads that expose operational or credential-adjacent state. These stay open
-# to a LOCAL caller (zero-config use is the point) but must not be readable by
-# an anonymous remote caller when the dashboard is bound to 0.0.0.0.
+# Public API metadata needed before a caller can authenticate or before the UI
+# can choose a provider. Everything else under an API namespace is
+# state-bearing unless it is explicitly admitted here.
 #
-# Measured before this list existed, from a routable remote address with auth
-# off: /api/logs, /api/secrets/status, /api/github/status, /api/tasks,
-# /api/council/transcripts and /api/proofs all returned 200.
+# This is deliberately an ALLOWLIST, not the old list of sensitive prefixes.
+# That list silently started every new read family public. Measured from a
+# routable remote address with auth off, routes added after the list --
+# /api/context, /api/notifications, /api/agents, /api/usage,
+# /api/prd-observations and every /api/v2/* read -- all reached their handlers
+# and returned project, tenant or audit state.
 #
-# /health and /metrics are deliberately ABSENT: a container health probe and a
-# Prometheus scrape must keep working with no configuration, and neither
-# carries workspace content.
-_SENSITIVE_READ_PREFIXES = (
-    "/api/logs",
-    "/api/secrets",
-    "/api/github",
-    "/api/tasks",
-    "/api/projects",
-    "/api/council",
-    "/api/proofs",
-    "/api/phases",
-    "/api/memory",
-    "/api/learnings",
-    "/api/learning",
-    "/api/escalations",
-    "/api/spec",
-    "/api/checkpoints",
-    "/api/enterprise",
-    "/api/collab",
-    "/api/cost",
-    "/api/budget",
-    "/api/findings",
-    "/api/operator",
-    "/api/fleet",
-    "/api/registry",
-    "/api/wiki",
-    "/api/activity",
-    "/api/session",
-    "/api/failures",
-    "/api/prompt",
-    "/api/quality",
-    "/api/migration",
-    "/api/managed",
-    "/api/app-runner",
-    "/api/playwright",
-    "/api/checklist",
-    "/api/control",
-)
+# /health, /metrics, /.well-known/*, docs and static/UI routes are outside the
+# API namespaces and remain public. The three entries below contain only
+# capability/auth bootstrap metadata and are already pinned as public by the
+# dashboard auth inventory tests.
+_PUBLIC_API_GET_PATHS = frozenset({
+    "/api/auth/info",
+    "/api/enterprise/status",
+    "/api/providers/models",
+})
+
+
+def _is_state_bearing_get(path: str) -> bool:
+    """Classify dashboard reads at the namespace boundary.
+
+    A future GET under /api or the mounted Purple Lab's /lab/api namespace is
+    private by default. Exact public metadata is admitted above; probes,
+    discovery documents and UI/static files live outside these namespaces.
+    Normalize one trailing slash so FastAPI's redirect spelling cannot turn a
+    public metadata request into a remote-only failure.
+    """
+    normalized = path.rstrip("/") or "/"
+    if normalized in _PUBLIC_API_GET_PATHS:
+        return False
+    return (
+        normalized == "/api"
+        or normalized.startswith("/api/")
+        or normalized == "/lab/api"
+        or normalized.startswith("/lab/api/")
+    )
 
 
 def _trusted_proxies() -> frozenset:
@@ -1263,9 +1261,13 @@ async def dashboard_control_boundary(request: Request, call_next):
     # /health and /metrics are intentionally NOT in the sensitive list, so a
     # container health probe and a Prometheus scrape keep working unconfigured.
     gated = request.method in ("POST", "PUT", "PATCH", "DELETE")
+    if gated and not browser_mutation_origin_allowed(request, _cors_origins):
+        return JSONResponse(
+            status_code=403,
+            content={"detail": "cross-origin mutation refused"},
+        )
     if not gated:
-        path = request.url.path
-        gated = any(path.startswith(pfx) for pfx in _SENSITIVE_READ_PREFIXES)
+        gated = _is_state_bearing_get(request.url.path)
     if gated:
         try:
             require_local_or_authenticated(request)

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.22.12
+**Version:** v9.24.0
 
 ---
 
@@ -343,7 +343,7 @@ The `HUMAN_INPUT.md` file has security controls:
 
 ## Multi-Provider Support
 
-Loki Mode supports four active providers across three tiers, plus historical/upcoming entries. Pick by capability + cost.
+Loki Mode supports five active providers across three capability modes, plus historical/upcoming entries. Pick by capability + cost.
 
 ### Supported Providers
 

package/docs/RARV-C-100X-PLAN.md

@@ -220,7 +220,15 @@ Every commit proven on BOTH routes (`bin/loki` + `LOKI_LEGACY_BASH=1 bin/loki`).
 - **Post-release smoke from SHIPPED artifacts on BOTH routes**: `npm pack loki-mode@8.0.0` + `bun run bin/loki
   version` and `LOKI_LEGACY_BASH=1 ... version`; `docker run --rm asklokesh/loki-mode:8.0.0 doctor --json`;
   WebFetch brew formula version+sha.
-- **Cleanup after every local-ci/validation**: `lsof -ti:57374 | xargs kill -9; rm -rf /tmp/loki-* /tmp/test-* /tmp/package /tmp/*.tgz`.
+- **Cleanup after every local-ci/validation**: create one exact run-owned directory with `mktemp -d`
+  under the canonical `${TMPDIR:-/tmp}` root and keep all validation artifacts and recorded child
+  PIDs inside it. Use the executable operator-side sequence in
+  [`enterprise/performance.md`](enterprise/performance.md#cleanup); it does not depend on a shipped
+  cleanup helper. Stop only the exact verified child PIDs. Before removing the exact saved path,
+  require its `.loki-run-owned` marker to contain that path, require the target and marker to belong
+  to the current UID, require the target to be a canonical direct child of the temp root, refuse
+  symlinks, and refuse any target with `.git` worktree metadata. A failed guard leaves the path in
+  place for inspection.
 
 ---
 

package/docs/enterprise/performance.md

@@ -267,19 +267,61 @@ When enterprise features are active, background processes consume resources:
 
 ### Cleanup
 
-Enterprise processes are cleaned up on session termination:
+Keep cleanup scoped to the processes and paths created by the current invocation. Record the exact
+child process IDs when starting background services and stop only those verified processes. Do not
+kill by a shared port or process-name pattern.
 
-```bash
-# Kill dashboard server
-lsof -ti:57374 | xargs kill -9 2>/dev/null || true
-
-# Kill background enterprise processes
-pkill -f "loki-run-" 2>/dev/null || true
+Create one run-owned temporary directory before writing any temporary package, log, PID, or test
+artifact. Run the creation and cleanup blocks in the same shell so `run_tmp` retains the exact path:
 
-# Clean temp files
-rm -rf /tmp/loki-* /tmp/test-* 2>/dev/null || true
+```bash
+# Create the only temporary directory this invocation may remove.
+temp_root="$(cd "${TMPDIR:-/tmp}" 2>/dev/null && pwd -P)" || exit 1
+run_tmp="$(mktemp -d "${temp_root}/loki-run.XXXXXXXX")" || exit 1
+chmod 700 "$run_tmp" || exit 1
+run_marker="${run_tmp}/.loki-run-owned"
+printf '%s\n' "$run_tmp" >"$run_marker" || exit 1
+chmod 600 "$run_marker" || exit 1
+
+# Put this invocation's temporary artifacts under "$run_tmp" and retain exact child PIDs there.
+
+# Immediately before removal, fail closed unless every ownership boundary still holds.
+cleanup_target="$run_tmp"
+cleanup_root="$(cd "${TMPDIR:-/tmp}" 2>/dev/null && pwd -P)" || exit 64
+case "$cleanup_target" in
+    "${cleanup_root}"/loki-run.*) ;;
+    *) printf '%s\n' "Refusing cleanup outside the run-owned namespace" >&2; exit 64 ;;
+esac
+[ "$(dirname "$cleanup_target")" = "$cleanup_root" ] || exit 64
+[ -d "$cleanup_target" ] && [ ! -L "$cleanup_target" ] || exit 64
+
+cleanup_marker="${cleanup_target}/.loki-run-owned"
+[ -f "$cleanup_marker" ] && [ ! -L "$cleanup_marker" ] || exit 64
+IFS= read -r marker_value <"$cleanup_marker" || exit 64
+[ "$marker_value" = "$cleanup_target" ] || exit 64
+
+target_uid="$(stat -f '%u' "$cleanup_target" 2>/dev/null || stat -c '%u' "$cleanup_target")" || exit 64
+marker_uid="$(stat -f '%u' "$cleanup_marker" 2>/dev/null || stat -c '%u' "$cleanup_marker")" || exit 64
+[ "$target_uid" = "$(id -u)" ] && [ "$marker_uid" = "$(id -u)" ] || exit 64
+
+target_real="$(cd "$cleanup_target" 2>/dev/null && pwd -P)" || exit 64
+[ "$target_real" = "$cleanup_target" ] || exit 64
+[ "$(dirname "$target_real")" = "$cleanup_root" ] || exit 64
+
+# Refuse primary worktrees, linked worktrees, and a broken .git symlink.
+if [ -e "${cleanup_target}/.git" ] || [ -L "${cleanup_target}/.git" ]; then
+    printf '%s\n' "Refusing to remove a Git worktree" >&2
+    exit 64
+fi
+
+rm -rf -- "$cleanup_target"
+[ ! -e "$cleanup_target" ] || exit 1
 ```
 
+These are operator-side shell commands, not a Loki cleanup helper. Never replace the exact target
+with a wildcard under `/tmp` or `$TMPDIR`, and never remove a path whose marker, UID ownership,
+canonical location, symlink status, or worktree status cannot be verified.
+
 ## Performance Monitoring Checklist
 
 1. **Verify no-op behavior** -- When enterprise env vars are unset, confirm zero overhead by checking that no background threads are created and no disk I/O occurs.

package/docs/exit-codes.md

@@ -84,6 +84,10 @@ Machine-readable output is `--format json` here, not `--json`.
 | 0 | Every required check passed. Optional warnings do not fail the command. |
 | nonzero | At least one required check failed; the output names which |
 
+The contract is identical for human-readable output and `--json`. JSON is
+still emitted in full before the command exits nonzero, so automation can save
+or parse the report while also using the process status as a readiness gate.
+
 Safe as a preflight gate in an init container or pipeline step:
 
 ```sh

package/loki-ts/dist/cockpit.js

@@ -16,4 +16,4 @@ var EJ=Object.defineProperty;var TJ=(J)=>J;function WJ(J,Q){this[J]=TJ.bind(null
 `),3}let G=process.stdout.columns||Number(process.env.COLUMNS)||0,q=G>4?G-2:void 0,K=await CJ($,{protocol:Q,forceText:X,cols:q});if(Z)try{let{writeFileSync:P}=await import("fs");P(Z,K.svg)}catch{}if(K.kind==="image"&&K.data)return process.stdout.write(K.data),0;return process.stderr.write(`FALLBACK	${K.reason||"image unavailable"}
 `),3}if(import.meta.main)rJ().then((J)=>process.exit(J));export{rJ as main};
 
-//# debugId=7F0CBB32F48339CA64756E2164756E21
+//# debugId=FA320A456FDE2DB7437C9AA473A12AC3