loki-mode 9.55.0 → 9.56.0

package/autonomy/run.sh

@@ -5338,6 +5338,62 @@ except Exception:
     return 0
 }
 
+#===============================================================================
+# Rule of Two (moat P9): a GitHub token never reaches an agent session.
+#
+# The run reads untrusted issue text and spawns agents that act on it, so a
+# token in the exported environment is one prompt injection away from a push.
+# main() un-exports every GitHub token it inherited (the shell keeps the value).
+# Every provider, reviewer, helper and test the agent writes then starts without
+# it. Loki's own trusted GitHub calls get it back for the one command:
+#   - direct `gh ...` calls, through the gh() wrapper defined below;
+#   - _loki_with_github_tokens <cmd...>, for the post-session push/PR paths.
+# LOKI_ALLOW_AGENT_GITHUB_TOKEN=1 (exact value) restores the old inheritance
+# and prints one stderr warning that the agent holds the token.
+# This is hygiene against a naive injection, not an isolation boundary: code
+# running as the same user can still read the parent's environment block
+# (/proc/<pid>/environ on Linux, sudo on a hosted runner). The boundary is a
+# CI job that holds no write token while the agent runs (see
+# .github/workflows/loki-issue-to-pr.yml).
+#===============================================================================
+_LOKI_WITHHELD_TOKENS=""
+
+_loki_with_github_tokens() {
+    local _v _rc=0
+    for _v in $_LOKI_WITHHELD_TOKENS; do export "${_v?}"; done
+    "$@" || _rc=$?
+    for _v in $_LOKI_WITHHELD_TOKENS; do export -n "${_v?}"; done
+    return "$_rc"
+}
+
+_loki_withhold_github_tokens() {
+    local _v _held=""
+    # Operator opt-out (exact value 1): keep the earlier behavior, where the
+    # agent inherits the token. That is a Rule of Two exposure, so say so.
+    if [ "${LOKI_ALLOW_AGENT_GITHUB_TOKEN:-}" = "1" ]; then
+        for _v in GH_TOKEN GITHUB_TOKEN GH_ENTERPRISE_TOKEN GITHUB_ENTERPRISE_TOKEN; do
+            [ -n "${!_v:-}" ] && _held="${_held:+$_held }$_v"
+        done
+        [ -z "$_held" ] || printf '%s\n' "WARNING: LOKI_ALLOW_AGENT_GITHUB_TOKEN=1: the agent session holds the GitHub token ($_held); an injected prompt can push with it (Rule of Two exposure)." >&2
+        return 0
+    fi
+    for _v in GH_TOKEN GITHUB_TOKEN GH_ENTERPRISE_TOKEN GITHUB_ENTERPRISE_TOKEN; do
+        [ -n "${!_v:-}" ] || continue
+        export -n "${_v?}"
+        case " $_LOKI_WITHHELD_TOKENS " in
+            *" $_v "*) ;;
+            *) _LOKI_WITHHELD_TOKENS="${_LOKI_WITHHELD_TOKENS:+$_LOKI_WITHHELD_TOKENS }$_v" ;;
+        esac
+    done
+    [ -n "$_LOKI_WITHHELD_TOKENS" ] || return 0
+    # Only when the binary exists, so `command -v gh` keeps meaning "gh is
+    # installed" for every caller that checks it.
+    if command -v gh >/dev/null 2>&1; then
+        gh() { _loki_with_github_tokens command gh "$@"; }
+    fi
+    log_info "Withheld from agent sessions (Rule of Two): $_LOKI_WITHHELD_TOKENS. Loki's own push and PR steps still use it."
+}
+
 #===============================================================================
 # on_run_complete  (Slice 3: opt-in local git output on success)
 #
@@ -5403,11 +5459,14 @@ on_run_complete() {
     # timeout is not installed (a local wrapper keeps this set -u safe on bash
     # 3.2, where an empty array expansion would error). Keeps every existing
     # `|| true` non-fatal behavior.
+    # The push and gh calls below are the trusted post-session step, so they
+    # get the withheld GitHub token back (a plain `timeout 30 gh` would exec
+    # the binary and bypass the gh() wrapper).
     _loki_net() {
         if command -v timeout >/dev/null 2>&1; then
-            timeout 30 "$@"
+            _loki_with_github_tokens timeout 30 "$@"
         else
-            "$@"
+            _loki_with_github_tokens "$@"
         fi
     }
     # Require gh + auth.
@@ -9180,6 +9239,12 @@ setup_agent_branch() {
         log_warn "Left uncommitted from an earlier unfinished session, now treated as your files: $leftover"
     fi
     rm -f .loki/state/session-created.z 2>/dev/null
+    # BACKLOG 130(c): seal the now-empty session-created.z record so this
+    # fresh mint's OWN in-process memory of "absent" is what every later
+    # record call and commit_session_changes verify against for the rest of
+    # this run -- not the file's on-disk content, which an agent process could
+    # otherwise repopulate with a planted path before this run ever trusts it.
+    _loki_session_created_seal  # BACKLOG-130C-MINT-SEAL
     # BACKLOG 68 rework: a fresh mint starts with no tracked-since anchor and no
     # in-flight marker (never seed the anchor from session-start-sha -- an
     # anchor==start would let a later resume's "anchor..HEAD" diff include this
@@ -9236,6 +9301,40 @@ _loki_snapshot_or_fail_closed() {
 # ~9165) so that path is never reported as tampering.
 _LOKI_SNAPSHOT_SEAL=""
 
+# BACKLOG 130(c): .loki/state/session-created.z is NOT one of the two files
+# _LOKI_SNAPSHOT_SEAL above covers. It records the paths THIS session created
+# (unioned after every provider turn by _loki_record_session_created), and
+# _loki_snapshot_preexisting's resume union (line ~9683) trusts its content
+# directly: any path it lists is EXCLUDED from the new preexisting-untracked.z
+# snapshot, i.e. treated as "the session's own, never the user's". An agent
+# that plants a user's file path into session-created.z therefore gets that
+# exact path permanently exempted from pre-existing-file protection on the
+# next resume -- the file is swept into `git add -A` and the session commit as
+# if the session had created it. A separate seal, sibling to
+# _LOKI_SNAPSHOT_SEAL, closes this WITHIN one process's lifetime: sealed right
+# after every legitimate write this process makes (a successful record, the
+# fresh-mint delete, and this process's first look at the file on resume),
+# verified before any LATER point in the SAME process trusts the content,
+# fail-closed (delete the file, clear the seal) on a mismatch. Kept SEPARATE
+# from _LOKI_SNAPSHOT_SEAL rather than folded into one combined digest: this
+# file legitimately changes every provider turn, so a shared digest would
+# falsely flag tampering on every normal turn, and the fresh-mint `rm` (line
+# ~9241) runs after preexisting-untracked.z is sealed, which would falsely
+# flag every fresh mint too.
+# ACCEPTED GAP (disclosure, not prevention, same bar as BACKLOG 70's own): a
+# seal lives only in this process's memory, so it cannot verify content a
+# PRIOR process wrote before this one starts (setup_agent_branch's resume path
+# seals its own first read of the file rather than verifying it, since no
+# prior seal survives to check against) -- tampering already on disk before
+# this process begins is trusted at that one read, same as
+# _LOKI_SNAPSHOT_SEAL's own resume-time trust of preexisting-untracked.z's
+# prior content. What this DOES close: an agent process co-located with THIS
+# run can no longer plant a path into session-created.z between this run's own
+# writes and its own later reads (the resume union's exclude use, the next
+# record's merge, or the commit-time gate) without it being caught before that
+# content is trusted.
+_LOKI_SESSION_CREATED_SEAL=""
+
 # BACKLOG 129 (follow-up to BACKLOG 70/BACKLOG 70-awk): the DIGEST computation
 # above is hardened (fixed-root-path-first, no awk), but until this function
 # was added the snapshot WRITER (_loki_untracked_merge) and READER
@@ -9421,11 +9520,15 @@ _loki_snapshot_hash_tool() {
 # which a user-writable directory ahead of the system dirs (e.g. Homebrew's
 # prefix on macOS) can shadow -- not fully closed, only narrowed to hosts
 # lacking the standard tool paths; the python3 fallback below, kept only for
-# the extremely rare host with neither tool anywhere, is not proof against the
-# .pth class this function exists to close -- that path additionally hardens
-# with -I (isolated mode: also disables user site-packages, stronger than -E)
-# but remains narrower than the shasum/sha256sum path on a host where
-# Homebrew's system site-packages is itself user-writable.
+# the extremely rare host with neither tool anywhere, is resolved via
+# _loki_snapshot_py_tool and run with -I -S (BACKLOG 131(b) -- see the comment
+# at that fallback for why -S, not just -I, is required to close the .pth
+# class), so it carries the same fixed-root-path-first resolution and
+# site-packages exclusion as the other hardened call sites in this file. It
+# still inherits _loki_snapshot_py_tool's own accepted gaps (documented at
+# that function): replacing the interpreter AT ONE OF ITS FIXED PATHS requires
+# root, and its own PATH-walk fallback still trusts whatever sits first on an
+# absolute PATH entry on a host lacking those fixed paths.
 _loki_snapshot_digest() {
     local tool
     tool="$(_loki_snapshot_hash_tool)" || tool=""
@@ -9464,10 +9567,17 @@ _loki_snapshot_digest() {
         return 0
     fi
     # Fallback: neither sha256sum nor shasum found anywhere checked above
-    # (extremely rare on macOS/Linux). -I is isolated mode: stronger than -E,
-    # also disables user site-packages, but this remains narrower than the
-    # tool-based path above on a host whose Python ships a hijackable system
-    # site-packages outside the user's control (see comment above). Additional
+    # (extremely rare on macOS/Linux). Resolved via _loki_snapshot_py_tool
+    # (fixed root-owned path first) and run with -I -S, the same BACKLOG 129
+    # pattern used at _loki_untracked_merge / _loki_covered_paths: -I alone is
+    # NOT enough -- a reviewer reproduced, on a sibling function in this same
+    # tamper-detection system, that a .pth file planted in Homebrew python3's
+    # own (user-writable) site-packages directory still fires under `python3
+    # -I` alone, since -I implies -s (skip user site-packages) but does not
+    # skip the resolved interpreter's OWN site-packages. Only -S (skip ALL
+    # site-packages, including the interpreter's own) closes that. A resolve
+    # failure degrades this fallback to printing nothing, same as any other
+    # failure path here (caller treats empty as "could not seal"). Additional
     # accepted gap specific to this fallback (not present on the tool-based
     # path above, which distinguishes "-" from "?"): OSError covers BOTH
     # "file does not exist" and "file exists but is unreadable" here, so an
@@ -9478,7 +9588,9 @@ _loki_snapshot_digest() {
     # for present-but-unreadable) is straightforward but left undone here: this
     # fallback only runs on a host with neither sha256sum nor shasum anywhere,
     # already the rare case this whole function treats as a residual gap.
-    python3 -I -c 'import sys, hashlib, os
+    local pytool=""
+    pytool="$(_loki_snapshot_py_tool)" || return 1
+    "$pytool" -I -S -c 'import sys, hashlib
 sys.path[:] = [p for p in sys.path if p not in ("", ".")]
 out = []
 for path in sys.argv[1:]:
@@ -9491,6 +9603,155 @@ print(" ".join(out))' \
         ".loki/state/preexisting-untracked.z" ".loki/state/preexisting-untracked.sha.z" 2>/dev/null
 }
 
+# _loki_session_created_digest: sha256 of session-created.z alone ("-" for
+# absent, "?" for present-but-unreadable/unhashable, same sentinel contract as
+# _loki_snapshot_digest above). Deliberately a thin sibling, not a parameterized
+# reuse of _loki_snapshot_digest: that function's exact text (the `for path in
+# ...` line and the python fallback's trailing argv line) is matched by
+# tests/test-branch-lifecycle.sh's RED mutation harness, so leaving it
+# untouched keeps that harness's anchors valid. Resolved via the SAME hardened
+# tool resolvers (_loki_snapshot_hash_tool, _loki_snapshot_py_tool) as the
+# sibling above -- no fresh/unhardened python3 or shasum call site.
+_loki_session_created_digest() {
+    local tool
+    tool="$(_loki_snapshot_hash_tool)" || tool=""
+    local path=".loki/state/session-created.z"
+    # A FIFO or ANY symlink at $path (dangling or not -- [ -L ] rejects both,
+    # deliberately broader than just the dangling case: the only way this
+    # file is ever legitimately written is _loki_untracked_merge's own
+    # write-to-.tmp-then-`mv -f`, which always leaves a plain regular file at
+    # $path, never a symlink, so a symlink here is never this session's own
+    # legitimate output) is neither absent ([ -f ] is false for both) nor a
+    # hashable regular file -- falling through to the absent-file branch below
+    # would print the same "-" sentinel every fresh mint already seals as its
+    # normal starting state, silently trusting an agent-planted FIFO (whose
+    # blocked writer feeds content into the merge's later open() call) or a
+    # dangling symlink (whose target read fails and is treated as "-" too).
+    # Caught here, before either digest branch, with a sentinel ("?") that can
+    # never equal "-", a real hex digest, or empty.
+    if [ -L "$path" ] || { [ -e "$path" ] && [ ! -f "$path" ]; }; then printf '%s\n' "?"; return 0; fi  # BACKLOG-130C-NONREG-CHECK
+    if [ -n "$tool" ]; then
+        local h=""
+        if [ -f "$path" ]; then
+            case "${tool##*/}" in
+                shasum) h="$("$tool" -a 256 -- "$path" 2>/dev/null)" || h="" ;;
+                *)      h="$("$tool" -- "$path" 2>/dev/null)" || h="" ;;
+            esac
+            h="${h%% *}"
+            if [ "${#h}" -eq 64 ]; then
+                case "$h" in
+                    *[!0123456789abcdef]*) h="?" ;;
+                esac
+            else
+                h="?"
+            fi
+            printf '%s\n' "$h"
+        else
+            printf '%s\n' "-"
+        fi
+        return 0
+    fi
+    # Fallback: neither sha256sum nor shasum found anywhere (same rare-host
+    # case _loki_snapshot_digest's own fallback documents). Resolved via
+    # _loki_snapshot_py_tool, run with -I -S (see that function's comment for
+    # why -S, not just -I, is required to close the .pth vector).
+    local pytool=""
+    pytool="$(_loki_snapshot_py_tool)" || return 1
+    "$pytool" -I -S -c 'import sys, hashlib
+sys.path[:] = [p for p in sys.path if p not in ("", ".")]
+try:
+    with open(sys.argv[1], "rb") as fh:
+        print(hashlib.sha256(fh.read()).hexdigest())
+except OSError:
+    print("-")' \
+        "$path" 2>/dev/null
+}
+
+# _loki_session_created_seal: record this process's own memory of the current
+# session-created.z content, right after every point that legitimately changes
+# it (a successful union in _loki_record_session_created, the fresh-mint
+# delete, a resume, and the post-commit/no-op delete in
+# commit_session_changes). Same fail-closed shape as _loki_snapshot_seal: an
+# empty or "?" digest at seal time is itself suspicious (a legitimate write or
+# delete should never immediately be unreadable), so it is rejected rather
+# than sealed, which would let seal and a later verify silently agree on the
+# sentinel and disarm the guard for the rest of the session.
+_loki_session_created_seal() {
+    local d
+    d="$(_loki_session_created_digest)"
+    case "$d" in
+        ""|*'?'*)
+            # Fail closed, not just "untrusted": an empty seal makes
+            # _loki_session_created_verify's `[ -n "$_LOKI_SESSION_CREATED_SEAL" ]
+            # || return 0` skip every later check for the rest of this
+            # process's life. Leaving the file on disk here would fail OPEN --
+            # unreadable-but-present content would then be silently trusted by
+            # every later read site with no seal ever able to catch it. Delete
+            # it instead, matching _loki_session_created_verify's own
+            # fail-closed action on a real mismatch -- and, like that function's
+            # own re-seal after its delete, set the seal to the digest's real
+            # "absent" sentinel ("-"), not empty: an EMPTY seal here re-arms
+            # nothing (the guard above short-circuits as "never sealed" on
+            # every later check for the rest of this process), so an agent that
+            # recreates the file with a planted path in this window would get
+            # it silently merged in as trusted on the next successful record.
+            # "-" is a real, non-empty seal value that the next verify's live
+            # digest of a freshly-recreated file cannot match, keeping the
+            # guard armed against exactly that recreation.
+            rm -f .loki/state/session-created.z 2>/dev/null
+            _LOKI_SESSION_CREATED_SEAL="-"
+            log_warn "Could not seal the session-created record (hash tool failed or produced no readable digest); discarding it (its files are treated as yours, left uncommitted)"
+            audit_log "SESSION_CREATED_SEAL_FAILED" "_loki_session_created_digest returned empty or an unreadable-file sentinel at seal time"
+            ;;
+        *)
+            _LOKI_SESSION_CREATED_SEAL="$d"
+            ;;
+    esac
+}
+
+# _loki_session_created_verify: compare the live session-created.z digest
+# against the sealed one. No seal recorded (never sealed this process, or
+# deliberately cleared) is not tampering: returns success, does nothing --
+# EVERY caller that trusts session-created.z's content must therefore have
+# sealed it first (mint, resume, and after each successful record all do). A
+# seal that no longer matches IS tampering: logs and discloses it (same
+# DISCLOSURE bar as BACKLOG 70, not prevention against a same-UID process), and
+# fails closed by deleting the untrusted file outright -- its entries then
+# become "the user's, not recorded as this session's", the safe direction,
+# since a false claim of user ownership only leaves a file uncommitted on disk,
+# never deletes it, while a false claim of session ownership can get a user's
+# file swept into a commit and removed from disk on a later checkout of the
+# base. Called BEFORE any later point in the SAME process treats the file's
+# content as trustworthy (verify-before-trust, not verify-after-use):
+# _loki_record_session_created verifies at its very top, before its own
+# self-referential merge (base="$out"), and unconditionally -- not gated on
+# _LOKI_SNAPSHOT_THIS_RUN, since an interrupt/cleanup call can still fire after
+# that flag was cleared mid-session; commit_session_changes verifies at its
+# very top, before every one of its several early returns (the untrack
+# failure, the git 2.25 unstage failure, a secret-scan abort, a failed `git
+# commit`) that would otherwise skip its own rm -f cleanup and leave a
+# tampered file on disk for the next resume. _loki_resume_snapshot does NOT
+# call this function: it is this process's FIRST read of a file the PREVIOUS
+# (dead) process wrote, so there is no seal from that process to verify
+# against here; it instead calls _loki_session_created_seal directly to
+# establish THIS process's own baseline before anything (including
+# _loki_snapshot_preexisting's resume-union exclude use, right after) reads
+# the file. See the ACCEPTED GAP note at _LOKI_SESSION_CREATED_SEAL above.
+_loki_session_created_verify() {
+    local live="" path=".loki/state/session-created.z"
+    [ -n "$_LOKI_SESSION_CREATED_SEAL" ] || return 0
+    live="$(_loki_session_created_digest)"
+    if [ "$live" = "$_LOKI_SESSION_CREATED_SEAL" ]; then
+        return 0
+    fi
+    log_warn "session-created.z changed after this session recorded it (possible tampering by an agent process); discarding the record (its files are treated as yours, left uncommitted)"
+    audit_log "SESSION_CREATED_TAMPERED" "session-created.z changed after being sealed: live=$live,sealed=$_LOKI_SESSION_CREATED_SEAL"
+    rm -f "$path" 2>/dev/null
+    _LOKI_SESSION_CREATED_SEAL=""
+    _loki_session_created_seal
+    return 1
+}
+
 # _loki_snapshot_seal: record this process's own memory of what it just wrote.
 # Called only right after a successful _loki_snapshot_preexisting. Minor
 # reviewer note: a legitimate snapshot write should never hit an unreadable-
@@ -9556,10 +9817,13 @@ _loki_snapshot_verify() {
     if [ "$live" = "$_LOKI_SNAPSHOT_SEAL" ]; then
         return 0
     fi
+    log_warn "Pre-existing-file snapshot or its hash file changed after this session recorded it (possible tampering by an agent process); treating this session as unsnapshotted (nothing will be committed)"
+    # Record both digests (before clearing the seal below) so an operator
+    # reading the audit log can tell a genuine content tamper apart from a
+    # transient hash-tool failure that just produced a different digest.
+    audit_log "SNAPSHOT_TAMPERED" "preexisting-untracked.z or .sha.z changed after being sealed: live=$live,sealed=$_LOKI_SNAPSHOT_SEAL"
     _LOKI_SNAPSHOT_SEAL=""
     _LOKI_SNAPSHOT_THIS_RUN=0
-    log_warn "Pre-existing-file snapshot or its hash file changed after this session recorded it (possible tampering by an agent process); treating this session as unsnapshotted (nothing will be committed)"
-    audit_log "SNAPSHOT_TAMPERED" "preexisting-untracked.z or .sha.z changed after being sealed"
     mkdir -p .loki/state 2>/dev/null
     : > .loki/state/preexisting-untracked.failed 2>/dev/null
     return 1
@@ -9844,6 +10108,36 @@ _loki_advance_tracked_since_anchor() {
 # disk, not committed).
 _loki_record_session_created() {
     local snap=".loki/state/preexisting-untracked.z" out=".loki/state/session-created.z"
+    # BACKLOG 130(c): verify session-created.z BEFORE this run's THIS_RUN gate
+    # or its own merge trust the file -- verify-before-trust, not verify-after-
+    # use. Runs unconditionally (not gated on THIS_RUN=1): an interrupt/cleanup
+    # call can still fire after THIS_RUN was cleared mid-session (e.g. by
+    # _loki_snapshot_verify below on an earlier turn), and that call must not
+    # skip this check just because the gate below is about to return early. On
+    # a mismatch the file is already deleted by the time this returns (fail
+    # closed inside _loki_session_created_verify itself, not via this return
+    # value alone -- every call site of this function ignores its return with
+    # `|| true`, same as _loki_snapshot_verify above); the merge below then
+    # recomputes cleanly from a clean slate (base="$out" is now absent), so a
+    # legitimate record right after a caught tamper still records this turn's
+    # real files instead of hard-failing the whole call.
+    # ACCEPTED GAP (verify-to-use window, disclosed here since ordering is the
+    # whole point of this fix): this verify call and the merge's own read of
+    # "$out" as `base` (inside _loki_untracked_merge, below) are not atomic --
+    # _loki_advance_tracked_since_anchor, a git rev-parse, and a whole-repo
+    # `git status` all run in between. A same-UID write landing in that window
+    # is merged, then sealed as trusted by the seal call after a successful
+    # merge. This is the SAME shape of gap _LOKI_SNAPSHOT_SEAL's own
+    # verify/merge pair already accepts for preexisting-untracked.z (see
+    # _loki_untracked_merge's own BACKLOG 129 comment). Closing it would mean
+    # re-verifying again immediately before _loki_untracked_merge's read, inside
+    # that function -- deliberately not done here: _loki_untracked_merge's exact
+    # text is what tests/test-branch-lifecycle.sh's RED mutation harness matches
+    # by name-anchor, and threading a second, narrower verify through its
+    # shared codepath (also called with mode=exact for the OTHER snapshot) risks
+    # that anchor for a gap this narrow. Disclosure, not full prevention, is the
+    # same bar BACKLOG 70 itself accepts.
+    _loki_session_created_verify || true
     [ "${_LOKI_SNAPSHOT_THIS_RUN:-0}" = 1 ] || return 0
     # BACKLOG 70: detect tampering with the sealed snapshot as early as
     # possible (this runs after every provider turn, not just at commit time).
@@ -9857,6 +10151,11 @@ _loki_record_session_created() {
     if [ -f "$snap" ] && _loki_untracked_status "$out.status" \
        && _loki_untracked_merge "$out.status" "$out" "$snap" cover "$out"; then
         rm -f "$out.status"
+        # BACKLOG 130(c): seal this process's own memory of the record it just
+        # wrote, so the NEXT call to this function (or commit_session_changes)
+        # verifies against what THIS process actually wrote, not whatever an
+        # agent process may write to the file in between.
+        _loki_session_created_seal
         return 0
     fi
     rm -f "$out.status" "$out.tmp" 2>/dev/null
@@ -9868,6 +10167,19 @@ _loki_record_session_created() {
 # from an unfinished previous session (this session's commit includes them).
 _loki_resume_snapshot() {
     local carried=""
+    # BACKLOG 130(c): seal THIS process's own first look at session-created.z
+    # before anything below reads or trusts it (verify-before-trust). This is
+    # a resuming process picking up a file the PREVIOUS (now-dead) process
+    # wrote; there is no seal from that process to verify against here (a
+    # seal never survives past the process that set it) -- sealing now is what
+    # lets THIS process detect an agent tampering with the file for the rest
+    # of ITS OWN lifetime (every subsequent record call, and the commit-time
+    # check), the same disclosure bar BACKLOG 70 already accepts for the
+    # sibling snapshot: tampering already on disk before this process starts
+    # is an accepted gap, never silently trusted forever after. Unconditional
+    # (not gated on the union below succeeding): the union does not modify
+    # session-created.z, so this process's view of it is stable either way.
+    _loki_session_created_seal
     if ! _loki_snapshot_or_fail_closed union; then
         log_warn "Could not add your current untracked files to the pre-existing list; this session will commit nothing (review and commit manually)"
         return 0
@@ -10028,6 +10340,18 @@ commit_session_changes() {
     command -v git >/dev/null 2>&1 || return 0
     git rev-parse --is-inside-work-tree >/dev/null 2>&1 || return 0
 
+    # BACKLOG 130(c): verify session-created.z BEFORE any of this function's
+    # several early returns below (the untrack failure, the git 2.25 unstage
+    # failure, the secret-scan abort, a failed `git commit`) -- every one of
+    # them skips the two rm -f .loki/state/session-created.z cleanup sites
+    # further down, so a tampered file left on disk by any of those paths
+    # would otherwise survive untouched into the next session's resume union.
+    # Placed at the very top, before even the branch-protection/PARALLEL_MODE/
+    # branch-name checks below, so no early return in this function can skip
+    # it. On a mismatch the file is deleted here already; nothing downstream
+    # needs its own check.
+    _loki_session_created_verify || true  # BACKLOG-130C-COMMIT-TOP-VERIFY
+
     # Only act when a session feature branch was set up. This preserves the
     # LOCK A1 opt-out contract (LOKI_BRANCH_PROTECTION=false -> no agent-branch.txt
     # -> we never commit on the user's own branch), and also no-ops the detached
@@ -13283,14 +13607,26 @@ TREOF
     # summary the old best-effort parse of the tail still applies (null when it
     # finds nothing). Either way a recorded count above zero is a failure: the
     # council evidence gate and the Bun gate both read failed_count > 0 as one.
+    # BACKLOG 111: pytest's summary line also reports a distinct "error" outcome
+    # for a fixture/collection/setup error ("1 passed, 1 error in 0.5s"), which
+    # is neither "passed" nor "failed" text, so the [0-9]+ failed match alone
+    # found nothing and printed n=0 even though seen=1 -- a real error gated
+    # PASS. pytest pluralizes it ("2 errors"), so match errors? and ADD it to
+    # the failed count on that line ("2 failed, 3 errors" is 5 distinct broken
+    # tests, not 3 -- failed and error are independent outcomes within one
+    # summary line, unlike the separate cross-line max below, which exists to
+    # stop a later green summary from hiding an earlier failed run).
     # LC_ALL=C: bytes, so any runner output parses; [ \t] not [[:space:]] for
     # old mawk.
     local _tr_passed_n _tr_failed_n _tr_summary_red=false
     _tr_failed_n=$(printf '%s\n' "${output:-}" | LC_ALL=C sed "s/$(printf '\033')\[[0-9;]*[A-Za-z]//g" | LC_ALL=C awk '
         function upd(n) { if (n > f) f = n; seen = 1 }
         /^Tests:[ \t]/ || /^[ \t]*Tests[ \t]+[0-9]/ ||
-        /^=+ .*[0-9]+ (passed|failed)/ || /^[0-9]+ (passed|failed).* in [0-9.]+s/ {
-            n = 0; if (match($0, /[0-9]+ failed/)) n = substr($0, RSTART, RLENGTH) + 0; upd(n) }
+        /^=+ .*[0-9]+ (passed|failed|errors?)/ || /^[0-9]+ (passed|failed|errors?).* in [0-9.]+s/ {
+            n = 0
+            if (match($0, /[0-9]+ failed/)) n = substr($0, RSTART, RLENGTH) + 0
+            if (match($0, /[0-9]+ errors?/)) n += substr($0, RSTART, RLENGTH) + 0
+            upd(n) }
         /^[^ A-Za-z0-9]+ fail [0-9]+[ \t]*$/ { if (prev ~ /^[^ A-Za-z0-9]+ pass [0-9]+[ \t]*$/) upd($3 + 0) }
         /^[ \t]*[0-9]+ passing \(/ { upd(0) }
         /^[ \t]*[0-9]+ failing[ \t]*$/ { upd($1 + 0) }
@@ -13643,8 +13979,8 @@ if not isinstance(d, dict):
 verdict = d.get('verdict', 'unknown')
 diff = d.get('diff', {}) if isinstance(d.get('diff'), dict) else {}
 tests = d.get('tests', {}) if isinstance(d.get('tests'), dict) else {}
-diff_ok = diff.get('ok')
-tests_ok = tests.get('ok')
+diff_ok = 'inconclusive' if diff.get('inconclusive') else diff.get('ok')
+tests_ok = 'inconclusive' if tests.get('inconclusive') else tests.get('ok')
 runner = tests.get('runner', 'none')
 parts = ['verdict=%s' % verdict]
 parts.append('diff_ok=%s' % diff_ok)
@@ -27428,6 +27764,8 @@ except (json.JSONDecodeError, OSError): pass
 main() {
     _loki_install_signal_traps
     SESSION_START_EPOCH=$(date +%s)
+    # Before anything can spawn a provider (capability probes included).
+    _loki_withhold_github_tokens
 
     # First-run disclosure (shown once, before any work; best-effort).
     if type loki_show_disclosure_once &>/dev/null; then
@@ -27596,6 +27934,10 @@ main() {
 
     # Handle background mode
     if [ "$BACKGROUND_MODE" = "true" ]; then
+        # The relaunched runner withholds the tokens itself; it needs them in
+        # its environment to do so. This process exits right after launching.
+        local _bg_tok
+        for _bg_tok in $_LOKI_WITHHELD_TOKENS; do export "${_bg_tok?}"; done
         # Initialize .loki directory first
         mkdir -p .loki/logs
 
@@ -28231,7 +28573,9 @@ main() {
     # then advise the user how to open a PR. Both are no-ops when no agent branch
     # was set up (LOKI_BRANCH_PROTECTION=false) or nothing changed.
     commit_session_changes
-    create_session_pr
+    # Trusted post-session step: it gets the GitHub token main() withheld from
+    # agent sessions (its push may authenticate through the env token).
+    _loki_with_github_tokens create_session_pr
     audit_agent_action "session_stop" "Session ended" "result=$result,iterations=$ITERATION_COUNT"
 
     # The first terminal summary is written before session changes are committed.

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.55.0"
+__version__ = "9.56.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/api_keys.py

@@ -254,6 +254,13 @@ def list_keys_with_details(include_rotating: bool = True) -> list[dict]:
     Returns:
         List of key detail dicts (no hashes or raw tokens).
     """
+    # Purge rotating keys past their grace period before listing. This is the
+    # only live read path over the full token store, so it doubles as the
+    # sweep for cleanup_expired_rotating_keys, which otherwise has no caller
+    # (BACKLOG 33). Lazy, not scheduled: runs on whatever cadence callers
+    # already poll this list at.
+    cleanup_expired_rotating_keys()
+
     tokens = auth._load_tokens()
     result = []
 
@@ -298,15 +305,15 @@ def cleanup_expired_rotating_keys() -> list[str]:
         List of deleted key IDs.
     """
     tokens = auth._load_tokens()
-    now = datetime.now(timezone.utc)
     to_delete = []
 
     for tid, entry in tokens["tokens"].items():
         rotation_exp = entry.get("rotation_expires_at")
-        if rotation_exp:
-            exp_dt = datetime.fromisoformat(rotation_exp)
-            if now > exp_dt:
-                to_delete.append(tid)
+        # auth._deadline_passed fails closed: an unparseable or naive
+        # timestamp counts as expired, matching what validate_token already
+        # rejects at validation time (BACKLOG 119).
+        if rotation_exp and auth._deadline_passed(rotation_exp):
+            to_delete.append(tid)
 
     for tid in to_delete:
         del tokens["tokens"][tid]

package/dashboard/build_supervisor.py

@@ -885,7 +885,31 @@ def _host_seatbelt_profile(
         lines.append(
             f'(deny network-outbound (remote tcp "*:{port}"))'
         )
-        lines.append(f'(deny network-bind (local tcp "*:{port}"))')
+        # network-bind uses "tcp4", not "tcp": confirmed on macOS 27.0 (26A428)
+        # that sandbox-exec's (local tcp "*:PORT") filter on network-bind never
+        # matches an actual bind (a bind to 127.0.0.1 or 0.0.0.0 on the denied
+        # port succeeds), while (local tcp4 "*:PORT") correctly denies it with
+        # a clean PermissionError. network-outbound's "tcp" filter above is
+        # unaffected (verified separately: an outbound connect to a denied
+        # port is still refused), so only this line changes.
+        #
+        # Known residual gap, same platform bug family, found while fixing
+        # the above (not introduced by it -- reproduced identically against
+        # the un-patched "tcp" rule too): on this same macOS 27.0 build, EVERY
+        # port-qualified network-bind filter for IPv6 ("tcp6 \"*:PORT\"" and
+        # "ip6 \"*:PORT\"") also fails to match, so an IPv6 bind to the
+        # reserved port (e.g. "::1"/"::") still succeeds even with a "tcp6"
+        # deny added. Only a port-unqualified "(deny network-bind (local
+        # ip6))" was confirmed to actually block IPv6 binds, which would deny
+        # ALL IPv6 binding (not just the reserved ports) -- a materially wider
+        # behavior change than this port-scoping fix, and nothing in this
+        # codebase binds IPv6 today (grepped: no AF_INET6/IPv6 usage). Left
+        # unfixed here to keep this change scoped to the failing test; the
+        # reserved ports remain enforced for IPv4 (the only family in active
+        # use), and a confined build could still self-expose a reserved port
+        # over IPv6 loopback/wildcard. Tracked as a follow-up, not silently
+        # closed.
+        lines.append(f'(deny network-bind (local tcp4 "*:{port}"))')
     return ("\n".join(lines) + "\n").encode("utf-8")