loki-mode 9.53.0 → 9.54.2

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.53.0"
+__version__ = "9.54.2"
 
 # Expose the control app for easy import
 try:

package/dashboard/api_v2.py

@@ -894,6 +894,10 @@ async def verify_audit_integrity():
 
     return {
         "valid": aggregate["valid"],
+        # verified/status: whether anything was checked (valid stays True for
+        # an empty chain); see audit.verify_all_logs_in_dir.
+        "verified": aggregate["verified"],
+        "status": aggregate["status"],
         "files_checked": aggregate["files_checked"],
         "files_skipped": aggregate.get("files_skipped", 0),
         "entries_checked": aggregate.get("entries_checked", 0),

package/dashboard/audit.py

@@ -657,7 +657,8 @@ def verify_all_logs_in_dir(audit_dir) -> dict:
     if not audit_dir.exists():
         return {"valid": True, "files_checked": 0, "files_skipped": 0,
                 "entries_checked": 0, "first_tampered_file": None,
-                "first_tampered_line": None, "genesis_file": None}
+                "first_tampered_line": None, "genesis_file": None,
+                "verified": False, "status": "nothing_checked"}
     # v7.7.15 council fix (Opus 2): rotated files have name shape
     # `audit-YYYY-MM-DD.HHMMSS.jsonl` (from `_rotate_logs_if_needed` at
     # line 167). Lexicographic sort puts `audit-2026-05-04.123456.jsonl`
@@ -689,8 +690,13 @@ def verify_all_logs_in_dir(audit_dir) -> dict:
                 "first_tampered_file": str(log_file),
                 "first_tampered_line": result.get("first_tampered_line"),
                 "genesis_file": genesis_file,
+                "verified": False,
+                "status": "tampered",
             }
         prev_hash = result.get("last_hash", prev_hash)
+    # `valid` means "no break found" and stays True for an empty chain (the
+    # cross-chain verifier reads it). `verified` and `status` say whether
+    # anything was actually checked: zero files checked is not a verified chain.
     return {
         "valid": True,
         "files_checked": files_checked,
@@ -699,6 +705,8 @@ def verify_all_logs_in_dir(audit_dir) -> dict:
         "first_tampered_file": None,
         "first_tampered_line": None,
         "genesis_file": genesis_file,
+        "verified": files_checked > 0,
+        "status": "verified" if files_checked > 0 else "nothing_checked",
     }
 
 

package/dashboard/auth.py

@@ -343,6 +343,18 @@ def list_tokens(include_revoked: bool = False) -> list[dict]:
     return result
 
 
+def _deadline_passed(value) -> bool:
+    """True when an ISO-8601 deadline is in the past, or cannot be read.
+
+    Fails closed: an unparseable value, or a naive timestamp that cannot be
+    ordered against an aware "now", is treated as passed.
+    """
+    try:
+        return datetime.now(timezone.utc) > datetime.fromisoformat(str(value))
+    except (TypeError, ValueError):
+        return True
+
+
 def validate_token(raw_token: str) -> Optional[dict]:
     """
     Validate a raw token.
@@ -372,10 +384,10 @@ def validate_token(raw_token: str) -> Optional[dict]:
         if matched_token.get("revoked"):
             return None
 
-        # Check expiration
-        if matched_token.get("expires_at"):
-            expires = datetime.fromisoformat(matched_token["expires_at"])
-            if datetime.now(timezone.utc) > expires:
+        # Check expiration, and the grace period of a rotated-out key
+        # (api_keys.rotate_key sets rotation_expires_at on the old key).
+        for field in ("expires_at", "rotation_expires_at"):
+            if matched_token.get(field) and _deadline_passed(matched_token[field]):
                 return None
 
         # Update last used

package/dashboard/registry.py

@@ -16,6 +16,8 @@ from pathlib import Path
 from typing import Iterator, Optional
 import hashlib
 
+from .api_runs import _efficiency_module
+
 
 # Registry file location
 REGISTRY_DIR = Path.home() / ".loki" / "dashboard"
@@ -686,13 +688,14 @@ def _read_project_run_snapshot(path: str) -> dict:
         .loki/context/tracking.json fallback (totals.total_cost_usd)
 
     Returns a dict with phase, iteration, cost_usd, started_at, and ended_at
-    (best-effort; missing values default to None/0). Never raises: any file
-    problem degrades the affected field to its default.
+    (best-effort; missing values default to None). iteration and cost_usd are
+    None, never 0 / 0.0, when nothing recorded them. Never raises: any file problem degrades the
+    affected field to its default.
     """
     snap = {
         "phase": "",
-        "iteration": 0,
-        "cost_usd": 0.0,
+        "iteration": None,
+        "cost_usd": None,
         "started_at": None,
         "ended_at": None,
     }
@@ -708,8 +711,8 @@ def _read_project_run_snapshot(path: str) -> dict:
             if isinstance(state, dict):
                 _p = state.get("phase", "")
                 snap["phase"] = _p if isinstance(_p, str) else ""
-                _i = state.get("iteration", 0)
-                snap["iteration"] = _i if isinstance(_i, int) else 0
+                _i = state.get("iteration")
+                snap["iteration"] = _i if isinstance(_i, int) and not isinstance(_i, bool) else None
         except (json.JSONDecodeError, OSError, ValueError):
             pass
 
@@ -727,6 +730,15 @@ def _read_project_run_snapshot(path: str) -> dict:
             pass
 
     # Cost: sum per-iteration efficiency files; fall back to context tracking.
+    # A present record is not a measurement: only a record that carried an
+    # observed value (the canonical record_is_measured, the same predicate as
+    # dashboard/server.py _record_is_measured) and a numeric cost counts, so an
+    # all-zero or field-less record, or the 0.0 a fresh tracking.json is seeded
+    # with, reads as unknown instead of $0.00. A measured $0.00 stays 0.0.
+    # ponytail: a measured record with tokens but no cost_usd adds nothing (the
+    # fleet does not price tokens); price it here if unpriced records appear.
+    eff_mod = _efficiency_module()
+    measured = eff_mod.record_is_measured if eff_mod is not None else (lambda _rec: False)
     cost = 0.0
     found_cost = False
     eff_dir = loki_dir / "metrics" / "efficiency"
@@ -738,7 +750,7 @@ def _read_project_run_snapshot(path: str) -> dict:
                     if not isinstance(data, dict):
                         continue
                     c = data.get("cost_usd")
-                    if isinstance(c, (int, float)):
+                    if isinstance(c, (int, float)) and not isinstance(c, bool) and measured(data):
                         cost += float(c)
                         found_cost = True
                 except (json.JSONDecodeError, OSError, ValueError):
@@ -754,11 +766,15 @@ def _read_project_run_snapshot(path: str) -> dict:
                     totals = ctx.get("totals", {})
                     if isinstance(totals, dict):
                         tc = totals.get("total_cost_usd")
-                        if isinstance(tc, (int, float)):
+                        if isinstance(tc, (int, float)) and not isinstance(tc, bool) and measured({
+                                "cost_usd": tc,
+                                "input_tokens": totals.get("total_input"),
+                                "output_tokens": totals.get("total_output")}):
                             cost = float(tc)
+                            found_cost = True
             except (json.JSONDecodeError, OSError, ValueError):
                 pass
-    snap["cost_usd"] = round(cost, 6)
+    snap["cost_usd"] = round(cost, 6) if found_cost else None
     return snap
 
 
@@ -836,7 +852,7 @@ def get_fleet_runs(include_inactive: bool = True) -> list[dict]:
             "running": running,
             "phase": snap.get("phase", ""),
             "iteration": snap.get("iteration", 0),
-            "cost_usd": snap.get("cost_usd", 0.0),
+            "cost_usd": snap.get("cost_usd"),
             "started_at": started_at,
             "duration_seconds": duration_seconds,
             "port": p.get("port"),
@@ -862,16 +878,22 @@ def get_fleet_summary(include_inactive: bool = True) -> dict:
     Returns counts (total / running / stopped) and a summed cost across all
     registered projects. v1 polls the shared metadata store (see
     get_fleet_runs); not a controller. Never raises.
+
+    total_cost_usd sums only runs that recorded a cost and is None when none
+    did; total_cost_partial is True when some runs recorded no cost, so the
+    total is a lower bound, not the whole bill.
     """
     runs = get_fleet_runs(include_inactive=include_inactive)
     total = len(runs)
     running = sum(1 for r in runs if r.get("running"))
-    total_cost = round(sum(float(r.get("cost_usd") or 0.0) for r in runs), 6)
+    costs = [float(r["cost_usd"]) for r in runs
+             if isinstance(r.get("cost_usd"), (int, float)) and not isinstance(r.get("cost_usd"), bool)]
     return {
         "total_runs": total,
         "running_runs": running,
         "stopped_runs": total - running,
-        "total_cost_usd": total_cost,
+        "total_cost_usd": round(sum(costs), 6) if costs else None,
+        "total_cost_partial": 0 < len(costs) < total,
     }
 
 

package/dashboard/rigour_integration.py

@@ -245,32 +245,36 @@ class RigourIntegration:
             for sev in findings:
                 findings[sev] = int(_extract_num(raw_findings, sev, 0))
 
-        # Extract category scores
+        # Extract category scores. A category Rigour did not report is None
+        # (the panel shows "--"), never a scored 0.
         raw_categories = raw.get("categories", raw.get("scores", {}))
+        if not isinstance(raw_categories, dict):
+            raw_categories = {}
         categories = {
-            "security": _extract_num(raw_categories, "security", 0),
-            "code_quality": _extract_num(raw_categories, "code_quality", _extract_num(raw_categories, "codeQuality", 0)),
-            "compliance": _extract_num(raw_categories, "compliance", 0),
-            "best_practices": _extract_num(raw_categories, "best_practices", _extract_num(raw_categories, "bestPractices", 0)),
+            "security": _extract_num(raw_categories, "security", None),
+            "code_quality": _extract_num(raw_categories, "code_quality", _extract_num(raw_categories, "codeQuality", None)),
+            "compliance": _extract_num(raw_categories, "compliance", None),
+            "best_practices": _extract_num(raw_categories, "best_practices", _extract_num(raw_categories, "bestPractices", None)),
         }
 
-        # Compute overall score
+        # Compute overall score: the reported one, else the average of the
+        # categories that were reported, else None (no score, no grade).
         raw_score = raw.get("score", raw.get("overall_score"))
+        score = None
         if raw_score is not None:
             try:
                 score = float(raw_score)
             except (ValueError, TypeError):
-                score = 0.0
+                score = None
         else:
-            # Average of non-zero categories
-            non_zero = [v for v in categories.values() if v > 0]
-            score = round(sum(non_zero) / len(non_zero), 1) if non_zero else 0.0
+            reported = [v for v in categories.values() if v is not None]
+            score = round(sum(reported) / len(reported), 1) if reported else None
 
         result: dict[str, Any] = {
             "available": True,
-            "score": round(score, 1),
+            "score": round(score, 1) if score is not None else None,
             "max_score": 100,
-            "grade": _score_to_grade(score),
+            "grade": _score_to_grade(score) if score is not None else None,
             "timestamp": datetime.now(timezone.utc).isoformat(),
             "preset": preset,
             "findings": findings,
@@ -301,8 +305,9 @@ class RigourIntegration:
             "grade": None,
             "timestamp": datetime.now(timezone.utc).isoformat(),
             "preset": preset,
-            "findings": {"critical": 0, "major": 0, "minor": 0, "info": 0},
-            "categories": {"security": 0, "code_quality": 0, "compliance": 0, "best_practices": 0},
+            # Nothing was scanned: no counts and no category scores.
+            "findings": {"critical": None, "major": None, "minor": None, "info": None},
+            "categories": {"security": None, "code_quality": None, "compliance": None, "best_practices": None},
             "reason": reason,
         }
 
@@ -325,9 +330,12 @@ class RigourIntegration:
         }
 
 
-def _extract_num(d: dict, key: str, default: float = 0) -> float:
-    """Safely extract a numeric value from a dict."""
+def _extract_num(d: dict, key: str, default: Optional[float] = 0) -> Optional[float]:
+    """Safely extract a numeric value from a dict; `default` when absent or not numeric."""
+    v = d.get(key)
+    if v is None or isinstance(v, bool):
+        return default
     try:
-        return float(d.get(key, default))
+        return float(v)
     except (ValueError, TypeError):
         return default