Changelog v1.9.0

Added

• "Ghost in the Wire" Semantic API & Session Chaos (src/loki/engine/api_chaos.py):
  • Intercepts live browser network routes via Playwright route interception (page.route / context.route) to test frontend resilience against API failures.
  • HTTP Status Code Faults: Simulates server downtime and edge gateway failures (HTTP 500, 502, 503, 504) with synthetic error JSON bodies.
  • Recursive JSON Mutator (mutate_json_payload): Injects corrupted types, deep nullifications, mutated keys, and monster strings (M*5000) into API responses.
  • Schema Stripping (strip_schema_keys): Drops critical root and nested properties from API payloads to expose missing client-side optional chaining (?.) and unhandled null pointer exceptions.
  • Delayed & Empty Responses: Introduces artificial latency spikes (500ms–4000ms) and empty payloads ({}) to expose infinite spinners and unhandled rejection states.
• Mid-Flight Auth & Session Chaos:
  • Token Invalidation & Corruption: Strips or corrupts Authorization Bearer/JWT headers mid-flight to verify token refresh cycles and graceful logout handling.
  • Synthetic 401/403 Responses: Simulates unauthorized/forbidden responses for authenticated endpoints.
  • Session Cookie Eviction: Clears cookies mid-flight to test how single-page applications cope with sudden session expiration.
  • White-Screen & Freeze Sniffer: Detects unmounted component trees, completely empty DOM bodies, unhandled exception states, and persistent loading spinners following network faults.
• Deterministic Incident Reproduction (repro_test.py):
  • Automatically records all injected API faults and routes into incident.json.
  • Injects exact mock routes into deterministic reproduction tests (repro_test.py), allowing developers and CI/CD pipelines to replay crashes without needing a live backend.
• CLI & REPL Integration:
  • Added CLI flags to loki run:
  • --api-chaos / --no-api-chaos: Enable or disable semantic API fault injection.
  • --fault-rate <float>: Configurable fault probability (0.0 to 1.0, default 0.3).
  • --auth-chaos / --no-auth-chaos: Enable or disable mid-flight auth and cookie eviction.
  • Added api_chaos: section in .loki/config.yaml and default template in loki init.
  • Added full support in conversational QA chat REPL (/run command) with reactive autocomplete.
• Visual HTML Report Telemetry (src/loki/engine/html_reporter.py):
  • Dedicated ⚡ Ghost in the Wire: API & Session Chaos Telemetry card in the HTML dashboard.
  • Displays summary stat badges, breakdown by fault vector, and an interactive table of intercepted endpoints with payload mutation previews.
  • Features a UI Resilience Verified badge when the frontend stays intact, or a Critical UI Freeze / Blank Screen Sniffed alert box when an unhandled crash or white screen is detected.
• AI Root Cause Diagnosis & Code Self-Healing (src/loki/ai/brain.py & src/loki/engine/healer.py):
  • AIBrain.diagnose_and_fix() correlates frontend crashes and layout freezes directly with injected API faults, diagnosing missing .catch(), unhandled promise rejections, or absent error boundaries.
  • CodeHealer.synthesize_patch() incorporates API fault context to generate defensive code patches (try/catch, optional chaining, fallback UI states) and validates them deterministically using repro_test.py.

Upgrade

uv tool upgrade loki-chaos-agent
# or directly from LOKI:
loki update