superlocalmemory 3.7.8 → 3.8.0

package/src/superlocalmemory/mcp/server.py

@@ -75,13 +75,13 @@ def reset_engine():
 
 # Register tools and resources -------------------------------------------------
 #
-# Essential-only default: 25 base tools + 8 mesh tools = 33 registered
+# Essential-only default: 34 base tools + 8 mesh tools = 42 registered
 # when mesh is enabled. Set ``SLM_MCP_ALL_TOOLS=1`` to expose the full
 # toolset. Rationale: IDEs cap at 50-100 tools total (Cursor,
 # Antigravity, Windsurf) and a maximal SLM registration crowds out
 # other MCP servers the user may have installed.
 # Admin/diagnostics tools remain available via CLI (`slm <command>`).
-# Set SLM_MCP_ALL_TOOLS=1 to enable all 38 tools (power users).
+# Set SLM_MCP_ALL_TOOLS=1 to enable all 84 tools (power users).
 
 import os as _os_reg
 
@@ -107,6 +107,10 @@ _ESSENTIAL_TOOLS: set[str] = {
     "evolve_skill", "skill_health", "skill_lineage",
     # v3.6.11: Surface B Optimize tools (5)
     "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
+    # v3.8.0: bounded-loop tools (3) — CLI + /slm-loop command + MCP. Kept in
+    # the default exposure so any MCP client discovers gated loops, not just
+    # profile=code/full/power sessions.
+    "slm_loop_run", "slm_loop_history", "slm_loop_show",
 }
 
 # v3.4.4: Mesh tools — enabled if mesh_enabled in config or SLM_MCP_MESH_TOOLS=1
@@ -138,55 +142,21 @@ _user_allowlist_str = _os_reg.environ.get("SLM_MCP_TOOLS", "").strip()
 
 # ---------------------------------------------------------------------------
 # v3.6.14 WP-01: Named profile definitions
+# Extracted to mcp/profiles.py (v3.8.0) — pure data, no side effects.
+# All names re-exported here for backward compatibility with existing tests
+# and any code that imports them from this module.
 # ---------------------------------------------------------------------------
 
-_PROFILE_CORE = frozenset({  # 14
-    "remember", "recall", "search", "fetch", "list_recent", "update_memory", "forget",
-    "session_init", "close_session",
-    "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
-})
-_PROFILE_CODE = _PROFILE_CORE | frozenset({  # 20
-    "build_code_graph", "get_blast_radius", "query_graph",
-    "semantic_search_code", "get_review_context", "detect_changes",
-})
-_PROFILE_FULL_MESH = frozenset({  # 8
-    "mesh_summary", "mesh_peers", "mesh_send", "mesh_inbox",
-    "mesh_state", "mesh_lock", "mesh_events", "mesh_status",
-})
-_PROFILE_FULL = frozenset({  # 30 base — EXPLICIT literal, NOT runtime _ESSENTIAL_TOOLS (OQ-2)
-    "remember", "recall", "search", "fetch", "list_recent", "delete_memory", "update_memory",
-    "get_status", "session_init", "observe", "close_session", "report_feedback", "forget",
-    "run_maintenance", "consolidate_cognitive", "get_soft_prompts", "set_mode", "report_outcome",
-    "log_tool_event", "get_assertions", "reinforce_assertion", "contradict_assertion",
-    "evolve_skill", "skill_health", "skill_lineage",
-    "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
-}) | _PROFILE_FULL_MESH  # 38
-_PROFILE_POWER = _PROFILE_FULL | frozenset({  # 50
-    "get_version", "get_mode", "health", "consistency_check", "recall_trace",
-    "get_lifecycle_status", "set_retention_policy", "compact_memories",
-    "get_behavioral_patterns", "audit_trail", "quantize", "get_retention_stats",
-})
-_PROFILE_MESH = _PROFILE_FULL_MESH  # 8
-
-_PROFILE_DEFINITIONS: dict[str, frozenset[str]] = {
-    "core": _PROFILE_CORE,
-    "code": _PROFILE_CODE,
-    "full": _PROFILE_FULL,
-    "power": _PROFILE_POWER,
-    "mesh": _PROFILE_MESH,
-}  # "whole" intentionally absent — maps to raw server (D-2 LOCKED)
-
-# Compatibility aliases published by the v3.6 README.  Keep these explicit so
-# a stale client configuration has one deterministic meaning and emits a
-# migration warning.  Any other value is a configuration error (fail closed).
-_PROFILE_ALIASES: dict[str, str] = {
-    "core14": "core",
-    "code20": "code",
-    "full38": "full",
-    "power50": "power",
-    "mesh8": "mesh",
-    "whole81": "whole",
-}
+from superlocalmemory.mcp.profiles import (  # noqa: E402 (after env setups above)
+    _PROFILE_CORE,
+    _PROFILE_CODE,
+    _PROFILE_FULL_MESH,
+    _PROFILE_FULL,
+    _PROFILE_POWER,
+    _PROFILE_MESH,
+    _PROFILE_DEFINITIONS,
+    _PROFILE_ALIASES,
+)
 
 _profile = _os_reg.environ.get("SLM_MCP_PROFILE", "").strip().lower()
 
@@ -291,6 +261,8 @@ register_learning_tools(_target, get_engine)  # v3.4.7: Two-way learning tools
 register_evolution_tools(_target, get_engine)  # v3.4.11: Skill evolution tools
 from superlocalmemory.mcp.tools_optimize import register_optimize_tools
 register_optimize_tools(_target)  # v3.6.11: Surface B Optimize tools (proxy-free)
+from superlocalmemory.mcp.tools_loops import register_loop_tools
+register_loop_tools(_target, get_engine)  # v3.8.0: bounded-loop tools (CLI+command+MCP)
 
 
 # V3.3.21: Eager engine warmup — start initializing BEFORE first tool call.

package/src/superlocalmemory/mcp/tools_active.py

@@ -186,12 +186,6 @@ def register_active_tools(server, get_engine: Callable) -> None:
                 relevance score is ≥ 0.70 (architectural decisions that remain
                 permanently relevant still surface). Default: 30.
                 Set to 0 to disable the age gate entirely.
-
-        Scoring: five candidate producers (semantic + BM25 + temporal +
-        spreading_activation + hopfield) feed RRF fusion; the entity graph then
-        applies an optional post-fusion score enhancement. Combined with
-        Ebbinghaus exponential recency decay and FSRS stability strengthening by
-        access frequency.
         """
         try:
             from superlocalmemory.hooks.rules_engine import RulesEngine
@@ -689,7 +683,10 @@ def register_active_tools(server, get_engine: Callable) -> None:
         try:
             engine = get_engine()
             db = engine.db
-            pid = profile_id or engine.profile_id
+            # Isolation: the tenant is ALWAYS the engine's active profile. The
+            # caller-supplied profile_id is ignored — honoring it let any MCP
+            # client read/pin another profile's facts by passing profile_id.
+            pid = engine.profile_id
 
             if action == "pin":
                 if not fact_id:

package/src/superlocalmemory/mcp/tools_code_graph.py

@@ -14,10 +14,16 @@ All tools return {"success": bool, ...} envelope. Never raise.
 from __future__ import annotations
 
 import logging
+import os
 import time
 from pathlib import Path
 from typing import Any, Callable
 
+from superlocalmemory.core.security_primitives import (
+    PathTraversalError,
+    safe_resolve,
+)
+
 logger = logging.getLogger(__name__)
 
 # ---------------------------------------------------------------------------
@@ -118,7 +124,14 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
             exclude_patterns: Comma-separated glob patterns to exclude.
         """
         try:
-            repo = Path(repo_path)
+            # SEC: contain the untrusted repo_path under $HOME (same guard as
+            # update_code_graph) so repo_path="/" cannot ingest the whole
+            # filesystem into the code-graph DB.
+            from superlocalmemory.core.security_primitives import PathTraversalError
+            try:
+                repo = safe_resolve(Path.home(), repo_path)
+            except (PathTraversalError, OSError, ValueError) as exc:
+                return _error_response(f"Invalid repo_path: {exc}")
             if not repo.exists():
                 return _error_response(
                     f"Repository path does not exist: {repo_path}"
@@ -250,6 +263,22 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
             svc = _get_service()
             db = svc.db
 
+            # SEC 3.7.9 (B1): contain untrusted repo_path under $HOME and confirm
+            # it is a real git repo BEFORE any git subprocess runs with it as cwd.
+            # Blocks RCE via attacker-controlled .git config/hooks (core.fsmonitor,
+            # core.hooksPath) that git would otherwise execute in a hostile repo.
+            if repo_path:
+                try:
+                    repo = safe_resolve(Path.home(), repo_path)
+                except PathTraversalError as exc:
+                    return _error_response(f"Invalid repo_path: {exc}")
+                if not (repo / ".git").exists():
+                    return _error_response(
+                        f"Not a git repository (no .git dir): {repo_path}"
+                    )
+            else:
+                repo = svc.config.repo_root
+
             files_list = [
                 f.strip() for f in changed_files.split(",") if f.strip()
             ] if changed_files else []
@@ -258,11 +287,22 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
                 # Auto-detect via git
                 try:
                     import subprocess
-                    repo = Path(repo_path) if repo_path else svc.config.repo_root
+                    # repo is the safe_resolve-contained path computed above.
+                    # Harden git: disable hooks + fsmonitor + system config so a
+                    # hostile repo cannot execute code via the git invocation (B1).
                     result = subprocess.run(
-                        ["git", "diff", "--name-only", "HEAD~1", "HEAD"],
+                        [
+                            "git", "-c", "core.hooksPath=/dev/null",
+                            "-c", "core.fsmonitor=",
+                            "diff", "--name-only", "HEAD~1", "HEAD",
+                        ],
                         capture_output=True, text=True, timeout=30,
                         cwd=str(repo),
+                        env={
+                            **os.environ,
+                            "GIT_CONFIG_NOSYSTEM": "1",
+                            "GIT_TERMINAL_PROMPT": "0",
+                        },
                     )
                     files_list = [
                         f.strip() for f in result.stdout.strip().split("\n")
@@ -289,13 +329,19 @@ def register_code_graph_tools(server, get_engine: Callable) -> None:
             config = svc.config
             parser = CodeParser(config)
             store = GraphStore(db)
-            repo = Path(repo_path) if repo_path else config.repo_root
+            # repo already contained via safe_resolve above (B1).
 
             nodes_before = db.get_node_count()
             edges_before = db.get_edge_count()
 
             for fp in files_list:
-                full = repo / fp
+                # fp comes from caller-supplied changed_files; contain it under
+                # the (already safe-resolved) repo so "../../.ssh/id_rsa" cannot
+                # be read into the graph.
+                try:
+                    full = safe_resolve(repo, fp)
+                except Exception:
+                    continue
                 if not full.exists():
                     store.remove_file(fp)
                     continue

package/src/superlocalmemory/mcp/tools_core.py

@@ -284,10 +284,11 @@ def register_core_tools(server, get_engine: Callable) -> None:
         session_id: str = "", fast: bool = False,
         include_global: bool | None = None,
         include_shared: bool | None = None,
+        window: str = "",
     ) -> dict:
         """Search memories through hybrid retrieval, RRF fusion, and reranking.
 
-        S9-DASH-02: optional ``session_id`` threads through to the
+        Optional ``session_id`` threads through to the
         engine's outcome-queue so PostToolUse / Stop hooks can attach
         engagement signals to this recall. Claude Code should pass its
         ``CLAUDE_SESSION_ID``. Omitting it degrades to "no closed-loop
@@ -297,6 +298,11 @@ def register_core_tools(server, get_engine: Callable) -> None:
         scopes participate in retrieval. Leave them unset (``None``) to use the
         configured default — shared memory is OPT-IN, so by default recall
         returns only this profile's own facts. Pass ``True`` to opt in per call.
+
+        Time window: optional ``window`` restricts results to a event-time
+        range. Accepts a relative span (``"24h"``, ``"7d"``, ``"30d"``,
+        ``"1y"``) or an explicit range (``"2026-07-01..2026-07-31"``). Empty =
+        no time filter.
         """
         # v3.6.10: resolve "mcp_client" sentinel → URL path (HTTP) or env var (stdio)
         if agent_id == "mcp_client":
@@ -353,6 +359,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
                 fast=bool(fast),
                 include_global=include_global,
                 include_shared=include_shared,
+                window=window or None,
             )
             if result.get("ok"):
                 # Record implicit feedback: every returned result is a recall_hit

package/src/superlocalmemory/mcp/tools_evolution.py

@@ -98,11 +98,14 @@ def register_evolution_tools(server, get_engine: Callable) -> None:
             engine = get_engine()
             profile_id = engine.profile_id if engine else "default"
 
-            evolver._store.reset_cycle()
-            outcome = evolver._process_candidate(candidate, profile_id)
+            evolver._store.reset_cycle(profile_id)
+            # audit-10 fix: go through evolve_candidate so the manual/MCP path
+            # runs under a budget cycle and honours the LLM-call / wall-time /
+            # per-day caps (previously _process_candidate ran uncapped here).
+            outcome = evolver.evolve_candidate(candidate, profile_id)
 
             # Fetch the latest record for this skill to return details
-            recent = evolver._store.get_skill_history(skill_name, limit=1)
+            recent = evolver._store.get_skill_history(skill_name, profile_id, limit=1)
             record_info = {}
             if recent:
                 r = recent[0]

package/src/superlocalmemory/mcp/tools_loops.py

@@ -0,0 +1,300 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 | https://qualixar.com | https://varunpratap.com
+
+"""SLM v3.8.0 — MCP bounded-loop tools.
+
+Exposes the ``superlocalmemory.loops`` engine over MCP so an agent connected
+via MCP — not only the ``slm loop`` CLI or the ``/slm-loop`` command — can run
+a gated, bounded loop and inspect its durable ledger. Bounded loops therefore
+ship on three surfaces: CLI, plugin command, and MCP.
+
+The loop's one invariant holds identically here: an INDEPENDENT gate decides
+when the loop is done, never the agent's own claim. Over MCP the gate is an SLM
+*recall*: the loop converges the first lap a memory matching ``gate_query``
+becomes retrievable with confidence (the "verification lives in memory" model
+the engine is designed around). That makes ``slm_loop_run`` a safe, shell-free
+multi-agent coordination primitive — one agent waits, under strict bounds, for
+a memory another agent will write into shared SLM.
+
+Three tools:
+  * ``slm_loop_run``     — run one bounded, gate-verified loop to a terminal
+                           outcome. Blocks (polling the gate) until the gate
+                           passes or a bound trips. Every lap is persisted to
+                           SLM memory (tag ``loop:<name>``) and shows on the
+                           dashboard.
+  * ``slm_loop_history`` — list recorded runs for a loop name (read-only).
+  * ``slm_loop_show``    — show every lap of one run (read-only).
+
+Fail-open: every tool body returns a dict; internal errors surface as
+``ok: False`` with a message, never a raised exception.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+import time
+from typing import Any, Callable
+
+from mcp.types import ToolAnnotations
+
+from superlocalmemory.loops import (
+    Bounds,
+    LapResult,
+    Verdict,
+    engine_backed_ledger,
+    run_bounded_loop,
+)
+
+logger = logging.getLogger("slm.mcp.tools_loops")
+
+# ─── Exported tool name list (used by server.py + tests) ─────────────────────
+
+_LOOP_TOOL_NAMES = (
+    "slm_loop_run",
+    "slm_loop_history",
+    "slm_loop_show",
+)
+
+# ─── Hard caps (a loop tool must never hang the daemon or spin unbounded) ────
+
+_MAX_ITERATIONS = 200
+_MAX_WALLCLOCK_S = 120.0
+_MIN_POLL_S = 0.25
+_MAX_NAME_CHARS = 128
+_MAX_QUERY_CHARS = 2000
+
+
+def _top_score(resp: Any) -> float:
+    """Highest result score in a RecallResponse (0.0 when there are none)."""
+    best = 0.0
+    for r in getattr(resp, "results", None) or []:
+        s = getattr(r, "score", None)
+        if s is None:
+            s = getattr(r, "relevance_score", 0.0) or 0.0
+        try:
+            best = max(best, float(s))
+        except (TypeError, ValueError):
+            continue
+    return best
+
+
+def register_loop_tools(server, get_engine: Callable) -> None:
+    """Register the 3 bounded-loop tools on *server*.
+
+    *server* is duck-typed: must support the ``@server.tool()`` decorator.
+    Compatible with FastMCP, _FilteredServer, and the test mock server.
+    """
+
+    @server.tool(annotations=ToolAnnotations(readOnlyHint=False, destructiveHint=False))
+    async def slm_loop_run(
+        name: str,
+        gate_query: str,
+        gate_min_score: float = 0.0,
+        max_iterations: int = 20,
+        max_wallclock_s: float = 15.0,
+        poll_interval_s: float = 1.0,
+        max_tokens: int = 0,
+        no_progress_window: int = 0,
+    ) -> dict:
+        """Run one bounded loop that finishes only when an INDEPENDENT gate passes.
+
+        The gate is an SLM recall of ``gate_query``: the loop converges on the
+        first lap that recall returns a confident match scoring at least
+        ``gate_min_score``. The agent cannot end the loop by asserting it is
+        done — only the gate can. The call BLOCKS (polling every
+        ``poll_interval_s``) until the gate passes or a bound trips, then
+        returns the outcome. Every lap is written to SLM memory (tag
+        ``loop:<name>``) and is visible on the dashboard.
+
+        Use it to wait, under strict bounds, for a verification or coordination
+        condition to hold — e.g. for another agent to record a "build passed"
+        memory in shared SLM.
+
+        Args:
+            name: Loop name, also the memory tag. 1–128 chars.
+            gate_query: Recall query the independent gate checks each lap.
+            gate_min_score: Minimum top-result score to pass (0.0 = any
+                confident hit above the evidence floor).
+            max_iterations: Hard cap on laps (1–200).
+            max_wallclock_s: Hard cap on wall-clock seconds (0 disables; capped at 120).
+            poll_interval_s: Seconds to wait between laps (minimum 0.25).
+            max_tokens: Optional token budget (0 disables).
+            no_progress_window: Halt after this many consecutive no-change laps
+                (0 disables). A pure watcher never "changes", so leave at 0
+                unless the runner reports progress.
+        """
+        try:
+            name = (name or "").strip()
+            if not name or len(name) > _MAX_NAME_CHARS:
+                return {"ok": False, "error": f"name must be 1–{_MAX_NAME_CHARS} chars"}
+            gate_query = (gate_query or "").strip()
+            if not gate_query or len(gate_query) > _MAX_QUERY_CHARS:
+                return {
+                    "ok": False,
+                    "error": f"gate_query must be 1–{_MAX_QUERY_CHARS} chars",
+                }
+
+            iters = max(1, min(int(max_iterations), _MAX_ITERATIONS))
+            wall = (
+                min(float(max_wallclock_s), _MAX_WALLCLOCK_S)
+                if max_wallclock_s and float(max_wallclock_s) > 0
+                else None
+            )
+            poll = max(float(poll_interval_s), _MIN_POLL_S)
+            tok = int(max_tokens) if max_tokens and int(max_tokens) > 0 else None
+            # 0 = disabled (a pure watcher never "changes", so no-progress must
+            # be off by default or it would halt before the gate can pass).
+            npw = (
+                int(no_progress_window)
+                if no_progress_window and int(no_progress_window) > 0
+                else 0
+            )
+            min_score = float(gate_min_score)
+
+            engine = get_engine()
+
+            def gate(lap: int) -> Verdict:
+                resp = engine.recall(gate_query, limit=3, fast=True)
+                results = getattr(resp, "results", None) or []
+                floored = bool(getattr(resp, "no_confident_match", False))
+                top = _top_score(resp)
+                passed = bool(results) and not floored and top >= min_score
+                return Verdict(
+                    passed,
+                    f"recall '{gate_query[:48]}': hits={len(results)} "
+                    f"top={top:.3f} floor={floored}",
+                )
+
+            def runner(lap: int) -> LapResult:
+                # Watcher lap: no work of our own. Give the gate condition time
+                # to become true (e.g. another agent writing a memory) between
+                # polls. Bounded by poll interval so the wall-clock / iteration
+                # caps stay meaningful. The first lap checks immediately.
+                if lap > 1:
+                    time.sleep(poll)
+                return LapResult(changed=False, tokens=0)
+
+            ledger = engine_backed_ledger(engine)
+
+            # The loop blocks (sleeps between laps); run it off the event loop.
+            # The engine's per-call WAL connection model makes this thread-safe.
+            outcome = await asyncio.to_thread(
+                run_bounded_loop,
+                name,
+                bounds=Bounds(
+                    max_iterations=iters,
+                    max_tokens=tok,
+                    max_wallclock_s=wall,
+                    no_progress_window=npw,
+                ),
+                runner=runner,
+                gate=gate,
+                ledger=ledger,
+            )
+            laps = await asyncio.to_thread(ledger.laps, outcome.run_id)
+            return {
+                "ok": True,
+                "status": outcome.status.value,
+                "reason": outcome.reason,
+                "passed": bool(outcome.ok),
+                "laps": outcome.laps,
+                "run_id": outcome.run_id,
+                "ledger": [
+                    {
+                        "lap": e.lap,
+                        "decision": e.decision,
+                        "passed": e.passed,
+                        "detail": e.detail,
+                    }
+                    for e in laps
+                ],
+                "note": (
+                    "The gate — an independent SLM recall — decided this "
+                    "outcome; the agent's own done-claim never terminates a loop."
+                ),
+            }
+        except Exception as exc:
+            logger.exception("slm_loop_run failed (fail-open)")
+            return {"ok": False, "error": str(exc)}
+
+    @server.tool(annotations=ToolAnnotations(readOnlyHint=True))
+    async def slm_loop_history(name: str, limit: int = 20) -> dict:
+        """List recorded bounded-loop runs for a loop name, newest laps summarised.
+
+        Reads the durable SLM-backed ledger (the same rows ``slm loop history``
+        and the dashboard show). Read-only.
+
+        Args:
+            name: Loop name to list runs for.
+            limit: Maximum runs to return (1–200).
+        """
+        try:
+            name = (name or "").strip()
+            if not name:
+                return {"ok": False, "error": "name is required"}
+            lim = max(1, min(int(limit), 200))
+            engine = get_engine()
+            ledger = engine_backed_ledger(engine)
+
+            def _collect() -> list[dict]:
+                run_ids = ledger.runs(name)[:lim]
+                rows: list[dict] = []
+                for rid in run_ids:
+                    laps = ledger.laps(rid)
+                    last = laps[-1] if laps else None
+                    rows.append(
+                        {
+                            "run_id": rid,
+                            "laps": len(laps),
+                            "final": last.decision if last else "unknown",
+                            "ts": last.ts if last else "",
+                        }
+                    )
+                return rows
+
+            rows = await asyncio.to_thread(_collect)
+            return {"ok": True, "name": name, "count": len(rows), "runs": rows}
+        except Exception as exc:
+            logger.exception("slm_loop_history failed (fail-open)")
+            return {"ok": False, "error": str(exc)}
+
+    @server.tool(annotations=ToolAnnotations(readOnlyHint=True))
+    async def slm_loop_show(run_id: str, limit: int = 200) -> dict:
+        """Show every lap of one bounded-loop run, in order, from SLM memory.
+
+        Read-only. Each lap carries the gate verdict plus the agent's recorded
+        (advisory, never loop-terminating) done-claim.
+
+        Args:
+            run_id: Run identifier returned by ``slm_loop_run``.
+            limit: Maximum laps to return (1–1000).
+        """
+        try:
+            run_id = (run_id or "").strip()
+            if not run_id:
+                return {"ok": False, "error": "run_id is required"}
+            lim = max(1, min(int(limit), 1000))
+            engine = get_engine()
+            ledger = engine_backed_ledger(engine)
+
+            def _collect() -> list[dict]:
+                return [
+                    {
+                        "lap": e.lap,
+                        "ts": e.ts,
+                        "decision": e.decision,
+                        "passed": e.passed,
+                        "detail": e.detail,
+                        "agent_claimed_done": e.agent_claimed_done,
+                        "tokens": e.budget.get("tokens", 0),
+                    }
+                    for e in ledger.laps(run_id)[:lim]
+                ]
+
+            laps = await asyncio.to_thread(_collect)
+            return {"ok": True, "run_id": run_id, "count": len(laps), "laps": laps}
+        except Exception as exc:
+            logger.exception("slm_loop_show failed (fail-open)")
+            return {"ok": False, "error": str(exc)}