loki-mode 9.54.0 → 9.55.0

package/autonomy/verify.sh

@@ -1689,14 +1689,26 @@ verify_gate_runtime() {
     local boot_log="$artifact_dir/boot.log"
 
     # Boot the app in the background, bounded by the timeout wrapper. The whole
-    # process group is killed on teardown. Env is inherited (no secrets injected).
-    # PORT is exported to the resolved port so 12-factor apps (node, many python
-    # frameworks) listen where the probe looks; apps that hardcode a port ignore
-    # it harmlessly. This keeps boot-port and probe-port consistent.
+    # process group is killed on teardown. Env is inherited (no secrets injected)
+    # PLUS one new marker: LOKI_VERIFY_RUN_TOKEN, a per-run random value used
+    # ONLY as an ownership proof at teardown (see _verify_runtime_teardown) --
+    # it identifies "a process this exact verify run launched" even after a
+    # setsid()'d daemon detaches into its own session/process group, which
+    # defeats every pgid/ppid-based check (round-4 council finding: v7.109.0's
+    # daemonize-leak fixture uses child_process.spawn({detached:true}), and no
+    # pgid/ppid arm can ever match a setsid'd process). Environment variables
+    # survive setsid() and fork()/spawn() regardless of process-group changes,
+    # so this closes exactly the gap those checks cannot. PORT is exported to
+    # the resolved port so 12-factor apps (node, many python frameworks) listen
+    # where the probe looks; apps that hardcode a port ignore it harmlessly.
+    # This keeps boot-port and probe-port consistent.
+    local run_token=""
+    run_token="verify-$$-${RANDOM}-${RANDOM}-$(date +%s 2>/dev/null || echo 0)"
     local app_pid=""
     (
         cd "$tree" || exit 127
         export PORT="$port"
+        export LOKI_VERIFY_RUN_TOKEN="$run_token"
         exec "$timeout_bin" "$boot_timeout" sh -c "$method"
     ) >"$boot_log" 2>&1 &
     app_pid=$!
@@ -1769,7 +1781,7 @@ verify_gate_runtime() {
     # Reclaim BOTH the detected port and the actually-bound port (scraped from the
     # boot log) so a server that daemonized onto a different port than we guessed
     # does not leak. scraped_port may be empty (no banner) -- teardown handles it.
-    _verify_runtime_teardown "$app_pid" "$port" "$scraped_port"
+    _verify_runtime_teardown "$app_pid" "$port" "$scraped_port" "$run_token"
 
     # Interpret the result.
     if [ "$answered" != "true" ]; then
@@ -1907,8 +1919,34 @@ SMOKE_SCRIPT
 
 # Teardown: terminate the boot launcher and any process still holding the port.
 # Bounded and best effort; never blocks the gate.
+# Does pid's environment carry LOKI_VERIFY_RUN_TOKEN=<tok> exactly? Portable
+# ownership proof that survives setsid() (see the fourth arm below for why
+# pgid/ppid checks cannot). Fails CLOSED: an empty token, an unreadable
+# environment, or any ambiguity returns "no match" -- never a false positive
+# that would authorize a kill. Checked directly (not assumed) on this
+# codebase's target platforms: Linux via /proc/<pid>/environ (NUL-separated,
+# same-uid readable); macOS/BSD via `ps -E -ww -o command=` (the `-E` flag
+# specifically requests the environment block; `-e` on BSD ps means "all
+# processes" and shows nothing extra -- do not confuse the two).
+_verify_runtime_pid_has_token() {
+    local pid="$1" tok="$2"
+    case "$pid" in ''|*[!0-9]*) return 1 ;; esac
+    [ -n "$tok" ] || return 1
+    if [ -r "/proc/$pid/environ" ]; then
+        tr '\0' '\n' < "/proc/$pid/environ" 2>/dev/null | grep -qxF "LOKI_VERIFY_RUN_TOKEN=$tok"
+        return $?
+    fi
+    if command -v ps >/dev/null 2>&1; then
+        case " $(ps -E -ww -o command= -p "$pid" 2>/dev/null) " in
+            *" LOKI_VERIFY_RUN_TOKEN=$tok "*) return 0 ;;
+            *) return 1 ;;
+        esac
+    fi
+    return 1
+}
+
 _verify_runtime_teardown() {
-    local app_pid="$1" port="$2" scraped_port="${3:-}"
+    local app_pid="$1" port="$2" scraped_port="${3:-}" run_token="${4:-}"
     if [ -n "$app_pid" ]; then
         # Best: kill the launcher's whole process GROUP so a server it spawned in
         # a subshell (e.g. `vite &`) dies too. GUARDED against self-suicide: in a
@@ -1943,6 +1981,22 @@ _verify_runtime_teardown() {
     # Reclaim BOTH the detected port and the actually-bound (scraped) port from
     # any orphan that outlived the launcher -- a daemonized server that bound a
     # different port than we guessed would otherwise leak. Bounded, best effort.
+    #
+    # SCOPING (D14/D15/D16 class): `lsof -ti tcp:$port` alone, with no
+    # -sTCP:LISTEN filter, matches EVERY socket referencing that port number,
+    # including a CLIENT with an established connection whose remote port
+    # happens to be $port (e.g. a browser tab open to localhost:$port) -- that
+    # process gets SIGKILL'd even though it never bound anything. And with no
+    # ownership check at all, ANY process (this run's or not) listening on the
+    # reused port gets killed. Fixed to (1) filter to LISTEN sockets only, and
+    # (2) verify each candidate is actually part of THIS launcher's tree before
+    # killing it: its pgid matches $child_pgid (the group this teardown just
+    # tried to signal above), or its direct parent is $app_pid. A holder that
+    # matches neither is left alone -- this run never bound that port, so it
+    # never reclaims it. Trade-off: a server that called setsid() into a fresh
+    # session AND was reparented away from app_pid (neither condition holds)
+    # will leak here; failing closed on an unverified kill is the safer
+    # direction (see docs/v10/DECISIONS.md D14/D15/D16).
     if command -v lsof >/dev/null 2>&1; then
         # Build a unique, non-empty port list (scraped only if it differs).
         local _ports="$port"
@@ -1951,10 +2005,62 @@ _verify_runtime_teardown() {
         for _rp in $_ports; do
             [ -z "$_rp" ] && continue
             local holders
-            holders="$(lsof -ti tcp:"$_rp" 2>/dev/null || true)"
+            holders="$(lsof -ti tcp:"$_rp" -sTCP:LISTEN 2>/dev/null || true)"
             if [ -n "$holders" ]; then
                 printf '%s\n' "$holders" | while IFS= read -r pid; do
-                    [ -n "$pid" ] && kill -9 "$pid" 2>/dev/null || true
+                    [ -z "$pid" ] && continue
+                    local _h_pgid="" _h_ppid=""
+                    _h_pgid="$(ps -o pgid= -p "$pid" 2>/dev/null | tr -d ' ' || true)"
+                    _h_ppid="$(ps -o ppid= -p "$pid" 2>/dev/null | tr -d ' ' || true)"
+                    # THIRD ARM (council round 2, REJECT reproduced and fixed):
+                    # GNU `timeout` (this codebase's launcher, verify.sh:1699)
+                    # makes ITSELF the process-group leader, so the group's
+                    # pgid equals timeout's own pid, which equals app_pid (the
+                    # subshell execs straight into timeout with no fork). If
+                    # the launched command daemonizes -- forks a server and
+                    # the parent (timeout, then sh -c) exits -- by teardown
+                    # time: child_pgid is EMPTY (timeout already exited, so
+                    # `ps -o pgid= -p "$app_pid"` finds nothing); the orphan's
+                    # ppid is 1, not app_pid; but its pgid is STILL app_pid,
+                    # the value it inherited when timeout created the group.
+                    # Neither of the two arms above can ever match this case,
+                    # so the classic "daemonized" leak this function's own
+                    # comments describe was never reclaimed. Reproduced
+                    # directly: own daemon listener LEAKED pre-this-arm,
+                    # reclaimed after. Safe as an ownership proof, not a
+                    # loosening: a process group's pgid cannot be reassigned
+                    # to an unrelated group while any member of the original
+                    # group (here, the orphan itself, still alive and
+                    # reporting this exact pgid) still exists -- POSIX pgid
+                    # reuse is blocked until the whole group is empty.
+                    # FOURTH ARM (council round 4, 2 of 4 reviewers REJECTed
+                    # with an identical reproduction; verified independently
+                    # before applying): a process launched via
+                    # child_process.spawn({detached:true}) (Node's setsid()
+                    # wrapper) becomes its OWN session and process group
+                    # leader -- its pgid equals its OWN pid, not app_pid or
+                    # child_pgid, and its ppid is 1. None of the three arms
+                    # above can ever match that shape, which is exactly
+                    # test-runtime-gate.sh case I's fixture (the v7.109.0
+                    # daemonize-leak regression test) and a real pattern many
+                    # servers use to daemonize. Environment variables survive
+                    # setsid()/fork()/exec() regardless of process-group
+                    # changes, so LOKI_VERIFY_RUN_TOKEN (exported into the
+                    # launched app's env at boot, see the launch site above)
+                    # is checked here as a portability-verified ownership
+                    # proof (see _verify_runtime_pid_has_token; confirmed
+                    # directly on macOS with `ps -E -ww`, not assumed).
+                    # Residual, disclosed gap: a daemon that scrubs its own
+                    # environment (env -i, some process supervisors) before
+                    # detaching still leaks -- no ownership proof survives
+                    # that, and failing closed on an unverified kill remains
+                    # the safer direction.
+                    if { [ -n "$child_pgid" ] && [ -n "$_h_pgid" ] && [ "$_h_pgid" = "$child_pgid" ]; } \
+                       || { [ -n "$app_pid" ] && [ -n "$_h_ppid" ] && [ "$_h_ppid" = "$app_pid" ]; } \
+                       || { [ -n "$app_pid" ] && [ -n "$_h_pgid" ] && [ "$_h_pgid" = "$app_pid" ]; } \
+                       || _verify_runtime_pid_has_token "$pid" "$run_token"; then
+                        kill -9 "$pid" 2>/dev/null || true
+                    fi
                 done
             fi
         done

package/bin/loki

@@ -348,6 +348,18 @@ if [ "${1:-}" = "trust" ]; then
     done
 fi
 
+# `doctor --airgap` (egress audit) lives only in bash (_loki_airgap_audit).
+# The Bun doctor rejected the flag, so the default route had no audit at all.
+# Routed here, flag-anywhere, so the committed dist needs no rebuild and bash
+# stays the single implementation; bash main() fires the one cli_command event.
+if [ "${1:-}" = "doctor" ]; then
+    for _doctor_arg in "${@:2}"; do
+        if [ "$_doctor_arg" = "--airgap" ]; then
+            exec "$BASH_CLI" "$@"
+        fi
+    done
+fi
+
 # CLI consolidation (Phase B): `report kpis` is the canonical form of the
 # Bun-only KPI snapshot. The `report` noun is otherwise bash-owned (every other
 # subcommand -- session/metrics/cost/export/share/dogfood -- routes to bash

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.54.0"
+__version__ = "9.55.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/api_v2.py

@@ -894,6 +894,10 @@ async def verify_audit_integrity():
 
     return {
         "valid": aggregate["valid"],
+        # verified/status: whether anything was checked (valid stays True for
+        # an empty chain); see audit.verify_all_logs_in_dir.
+        "verified": aggregate["verified"],
+        "status": aggregate["status"],
         "files_checked": aggregate["files_checked"],
         "files_skipped": aggregate.get("files_skipped", 0),
         "entries_checked": aggregate.get("entries_checked", 0),

package/dashboard/audit.py

@@ -657,7 +657,8 @@ def verify_all_logs_in_dir(audit_dir) -> dict:
     if not audit_dir.exists():
         return {"valid": True, "files_checked": 0, "files_skipped": 0,
                 "entries_checked": 0, "first_tampered_file": None,
-                "first_tampered_line": None, "genesis_file": None}
+                "first_tampered_line": None, "genesis_file": None,
+                "verified": False, "status": "nothing_checked"}
     # v7.7.15 council fix (Opus 2): rotated files have name shape
     # `audit-YYYY-MM-DD.HHMMSS.jsonl` (from `_rotate_logs_if_needed` at
     # line 167). Lexicographic sort puts `audit-2026-05-04.123456.jsonl`
@@ -689,8 +690,13 @@ def verify_all_logs_in_dir(audit_dir) -> dict:
                 "first_tampered_file": str(log_file),
                 "first_tampered_line": result.get("first_tampered_line"),
                 "genesis_file": genesis_file,
+                "verified": False,
+                "status": "tampered",
             }
         prev_hash = result.get("last_hash", prev_hash)
+    # `valid` means "no break found" and stays True for an empty chain (the
+    # cross-chain verifier reads it). `verified` and `status` say whether
+    # anything was actually checked: zero files checked is not a verified chain.
     return {
         "valid": True,
         "files_checked": files_checked,
@@ -699,6 +705,8 @@ def verify_all_logs_in_dir(audit_dir) -> dict:
         "first_tampered_file": None,
         "first_tampered_line": None,
         "genesis_file": genesis_file,
+        "verified": files_checked > 0,
+        "status": "verified" if files_checked > 0 else "nothing_checked",
     }
 
 

package/dashboard/auth.py

@@ -343,6 +343,18 @@ def list_tokens(include_revoked: bool = False) -> list[dict]:
     return result
 
 
+def _deadline_passed(value) -> bool:
+    """True when an ISO-8601 deadline is in the past, or cannot be read.
+
+    Fails closed: an unparseable value, or a naive timestamp that cannot be
+    ordered against an aware "now", is treated as passed.
+    """
+    try:
+        return datetime.now(timezone.utc) > datetime.fromisoformat(str(value))
+    except (TypeError, ValueError):
+        return True
+
+
 def validate_token(raw_token: str) -> Optional[dict]:
     """
     Validate a raw token.
@@ -372,10 +384,10 @@ def validate_token(raw_token: str) -> Optional[dict]:
         if matched_token.get("revoked"):
             return None
 
-        # Check expiration
-        if matched_token.get("expires_at"):
-            expires = datetime.fromisoformat(matched_token["expires_at"])
-            if datetime.now(timezone.utc) > expires:
+        # Check expiration, and the grace period of a rotated-out key
+        # (api_keys.rotate_key sets rotation_expires_at on the old key).
+        for field in ("expires_at", "rotation_expires_at"):
+            if matched_token.get(field) and _deadline_passed(matched_token[field]):
                 return None
 
         # Update last used

package/dashboard/registry.py

@@ -16,6 +16,8 @@ from pathlib import Path
 from typing import Iterator, Optional
 import hashlib
 
+from .api_runs import _efficiency_module
+
 
 # Registry file location
 REGISTRY_DIR = Path.home() / ".loki" / "dashboard"
@@ -686,13 +688,14 @@ def _read_project_run_snapshot(path: str) -> dict:
         .loki/context/tracking.json fallback (totals.total_cost_usd)
 
     Returns a dict with phase, iteration, cost_usd, started_at, and ended_at
-    (best-effort; missing values default to None/0). Never raises: any file
-    problem degrades the affected field to its default.
+    (best-effort; missing values default to None). iteration and cost_usd are
+    None, never 0 / 0.0, when nothing recorded them. Never raises: any file problem degrades the
+    affected field to its default.
     """
     snap = {
         "phase": "",
-        "iteration": 0,
-        "cost_usd": 0.0,
+        "iteration": None,
+        "cost_usd": None,
         "started_at": None,
         "ended_at": None,
     }
@@ -708,8 +711,8 @@ def _read_project_run_snapshot(path: str) -> dict:
             if isinstance(state, dict):
                 _p = state.get("phase", "")
                 snap["phase"] = _p if isinstance(_p, str) else ""
-                _i = state.get("iteration", 0)
-                snap["iteration"] = _i if isinstance(_i, int) else 0
+                _i = state.get("iteration")
+                snap["iteration"] = _i if isinstance(_i, int) and not isinstance(_i, bool) else None
         except (json.JSONDecodeError, OSError, ValueError):
             pass
 
@@ -727,6 +730,15 @@ def _read_project_run_snapshot(path: str) -> dict:
             pass
 
     # Cost: sum per-iteration efficiency files; fall back to context tracking.
+    # A present record is not a measurement: only a record that carried an
+    # observed value (the canonical record_is_measured, the same predicate as
+    # dashboard/server.py _record_is_measured) and a numeric cost counts, so an
+    # all-zero or field-less record, or the 0.0 a fresh tracking.json is seeded
+    # with, reads as unknown instead of $0.00. A measured $0.00 stays 0.0.
+    # ponytail: a measured record with tokens but no cost_usd adds nothing (the
+    # fleet does not price tokens); price it here if unpriced records appear.
+    eff_mod = _efficiency_module()
+    measured = eff_mod.record_is_measured if eff_mod is not None else (lambda _rec: False)
     cost = 0.0
     found_cost = False
     eff_dir = loki_dir / "metrics" / "efficiency"
@@ -738,7 +750,7 @@ def _read_project_run_snapshot(path: str) -> dict:
                     if not isinstance(data, dict):
                         continue
                     c = data.get("cost_usd")
-                    if isinstance(c, (int, float)):
+                    if isinstance(c, (int, float)) and not isinstance(c, bool) and measured(data):
                         cost += float(c)
                         found_cost = True
                 except (json.JSONDecodeError, OSError, ValueError):
@@ -754,11 +766,15 @@ def _read_project_run_snapshot(path: str) -> dict:
                     totals = ctx.get("totals", {})
                     if isinstance(totals, dict):
                         tc = totals.get("total_cost_usd")
-                        if isinstance(tc, (int, float)):
+                        if isinstance(tc, (int, float)) and not isinstance(tc, bool) and measured({
+                                "cost_usd": tc,
+                                "input_tokens": totals.get("total_input"),
+                                "output_tokens": totals.get("total_output")}):
                             cost = float(tc)
+                            found_cost = True
             except (json.JSONDecodeError, OSError, ValueError):
                 pass
-    snap["cost_usd"] = round(cost, 6)
+    snap["cost_usd"] = round(cost, 6) if found_cost else None
     return snap
 
 
@@ -836,7 +852,7 @@ def get_fleet_runs(include_inactive: bool = True) -> list[dict]:
             "running": running,
             "phase": snap.get("phase", ""),
             "iteration": snap.get("iteration", 0),
-            "cost_usd": snap.get("cost_usd", 0.0),
+            "cost_usd": snap.get("cost_usd"),
             "started_at": started_at,
             "duration_seconds": duration_seconds,
             "port": p.get("port"),
@@ -862,16 +878,22 @@ def get_fleet_summary(include_inactive: bool = True) -> dict:
     Returns counts (total / running / stopped) and a summed cost across all
     registered projects. v1 polls the shared metadata store (see
     get_fleet_runs); not a controller. Never raises.
+
+    total_cost_usd sums only runs that recorded a cost and is None when none
+    did; total_cost_partial is True when some runs recorded no cost, so the
+    total is a lower bound, not the whole bill.
     """
     runs = get_fleet_runs(include_inactive=include_inactive)
     total = len(runs)
     running = sum(1 for r in runs if r.get("running"))
-    total_cost = round(sum(float(r.get("cost_usd") or 0.0) for r in runs), 6)
+    costs = [float(r["cost_usd"]) for r in runs
+             if isinstance(r.get("cost_usd"), (int, float)) and not isinstance(r.get("cost_usd"), bool)]
     return {
         "total_runs": total,
         "running_runs": running,
         "stopped_runs": total - running,
-        "total_cost_usd": total_cost,
+        "total_cost_usd": round(sum(costs), 6) if costs else None,
+        "total_cost_partial": 0 < len(costs) < total,
     }
 
 

package/dashboard/rigour_integration.py

@@ -245,32 +245,36 @@ class RigourIntegration:
             for sev in findings:
                 findings[sev] = int(_extract_num(raw_findings, sev, 0))
 
-        # Extract category scores
+        # Extract category scores. A category Rigour did not report is None
+        # (the panel shows "--"), never a scored 0.
         raw_categories = raw.get("categories", raw.get("scores", {}))
+        if not isinstance(raw_categories, dict):
+            raw_categories = {}
         categories = {
-            "security": _extract_num(raw_categories, "security", 0),
-            "code_quality": _extract_num(raw_categories, "code_quality", _extract_num(raw_categories, "codeQuality", 0)),
-            "compliance": _extract_num(raw_categories, "compliance", 0),
-            "best_practices": _extract_num(raw_categories, "best_practices", _extract_num(raw_categories, "bestPractices", 0)),
+            "security": _extract_num(raw_categories, "security", None),
+            "code_quality": _extract_num(raw_categories, "code_quality", _extract_num(raw_categories, "codeQuality", None)),
+            "compliance": _extract_num(raw_categories, "compliance", None),
+            "best_practices": _extract_num(raw_categories, "best_practices", _extract_num(raw_categories, "bestPractices", None)),
         }
 
-        # Compute overall score
+        # Compute overall score: the reported one, else the average of the
+        # categories that were reported, else None (no score, no grade).
         raw_score = raw.get("score", raw.get("overall_score"))
+        score = None
         if raw_score is not None:
             try:
                 score = float(raw_score)
             except (ValueError, TypeError):
-                score = 0.0
+                score = None
         else:
-            # Average of non-zero categories
-            non_zero = [v for v in categories.values() if v > 0]
-            score = round(sum(non_zero) / len(non_zero), 1) if non_zero else 0.0
+            reported = [v for v in categories.values() if v is not None]
+            score = round(sum(reported) / len(reported), 1) if reported else None
 
         result: dict[str, Any] = {
             "available": True,
-            "score": round(score, 1),
+            "score": round(score, 1) if score is not None else None,
             "max_score": 100,
-            "grade": _score_to_grade(score),
+            "grade": _score_to_grade(score) if score is not None else None,
             "timestamp": datetime.now(timezone.utc).isoformat(),
             "preset": preset,
             "findings": findings,
@@ -301,8 +305,9 @@ class RigourIntegration:
             "grade": None,
             "timestamp": datetime.now(timezone.utc).isoformat(),
             "preset": preset,
-            "findings": {"critical": 0, "major": 0, "minor": 0, "info": 0},
-            "categories": {"security": 0, "code_quality": 0, "compliance": 0, "best_practices": 0},
+            # Nothing was scanned: no counts and no category scores.
+            "findings": {"critical": None, "major": None, "minor": None, "info": None},
+            "categories": {"security": None, "code_quality": None, "compliance": None, "best_practices": None},
             "reason": reason,
         }
 
@@ -325,9 +330,12 @@ class RigourIntegration:
         }
 
 
-def _extract_num(d: dict, key: str, default: float = 0) -> float:
-    """Safely extract a numeric value from a dict."""
+def _extract_num(d: dict, key: str, default: Optional[float] = 0) -> Optional[float]:
+    """Safely extract a numeric value from a dict; `default` when absent or not numeric."""
+    v = d.get(key)
+    if v is None or isinstance(v, bool):
+        return default
     try:
-        return float(d.get(key, default))
+        return float(v)
     except (ValueError, TypeError):
         return default