loki-mode 11.12.1 → 11.17.1

package/README.md

@@ -102,7 +102,7 @@ Time:       4m12s (intake 11s, plan 20s, implement 3m10s, verify 31s)
 | `loki agents list\|new\|show\|export --claude` | Custom child agents in `.loki/agents/*.md` |
 | `loki status [run-id]` | Status of the latest run, or of a given run |
 | `loki verify [run-id]` | Check a receipt's hash, signature and event log |
-| `loki answer [run-id]` | Resume a BLOCKED run with your answer (`--text "..."`) |
+| `loki answer [run-id]` | Start a follow-up run from a BLOCKED run with your answer (`--text "..."`) |
 | `loki doctor [--fix] [--json]` | Check prerequisites, providers and login; `--fix` applies safe fixes |
 | `loki control serve` | Start the Control Plane (see below) |
 | `loki dashboard` | Open the Control Plane UI, starting it if needed |
@@ -139,7 +139,7 @@ Required:
 
 - Claude Code (`claude`), installed and logged in: the default provider and the only one with every feature. The bundled Agent SDK with `ANTHROPIC_API_KEY` can stand in on the main `loki start` path, but `loki edit` and `loki chat` call the `claude` CLI.
 - Python 3.8+ (`python3`)
-- Node.js 18+ (`node`; 20+ recommended)
+- Node.js 20+ (`node`; 22 LTS is the CI target)
 - `jq`
 - Git 2.x (`git`)
 - `curl`

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.12.1
+# Loki Mode v11.17.1
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -200,7 +200,7 @@ This protocol governs **skill module** loading -- task-scoped instruction files
 <!-- generated:commands -->
 Commands (generated from `loki-ts/src/cli/registry.ts`; full reference in `docs/CLI-REFERENCE.md`):
 
-`version`, `status`, `doctor`, `provider`, `memory`, `rollback`, `proof`, `wiki`, `control`, `intent`, `kpis`, `report`, `trust`, `crash`, `contract`, `start`, `slack`, `queue`, `issues`, `undo`, `verify-pr`, `answer`, `engine10`, `help`, `chat`, `edit`, `diff`, `models`, `setup`, `quick`, `quickstart`, `init`, `template`, `verify`, `keys`, `review`, `dashboard`, `config`, `mcp`, `acp`, `stop`, `pause`, `resume`, `why`, `next`, `logs`, `ship`, `deploy`, `import`, `github`, `issue`, `ci`, `modernize`, `share`, `assets`, `export`, `notify`, `tour`, `welcome`, `onboard`, `setup-skill`, `self-update`, `remote`, `cockpit`, `code`, `context`, `secrets`, `api`, `sandbox`, `docker`, `web`, `preview`, `telemetry`, `syslog`, `explain`, `docs`, `test`, `bench`, `voice`, `own`, `secure`, `compliance`, `enterprise`, `projects`, `audit`, `cost`, `metrics`, `sentrux`, `magic`
+`version`, `status`, `doctor`, `provider`, `memory`, `rollback`, `proof`, `wiki`, `control`, `intent`, `kpis`, `report`, `trust`, `crash`, `contract`, `start`, `slack`, `queue`, `issues`, `undo`, `verify-pr`, `answer`, `engine10`, `help`, `chat`, `edit`, `diff`, `models`, `setup`, `quick`, `quickstart`, `init`, `template`, `verify`, `keys`, `review`, `dashboard`, `config`, `mcp`, `acp`, `stop`, `pause`, `resume`, `why`, `next`, `logs`, `ship`, `deploy`, `import`, `github`, `issue`, `ci`, `modernize`, `share`, `assets`, `export`, `notify`, `tour`, `welcome`, `onboard`, `setup-skill`, `self-update`, `remote`, `cockpit`, `code`, `context`, `secrets`, `api`, `sandbox`, `docker`, `web`, `preview`, `telemetry`, `syslog`, `explain`, `docs`, `test`, `bench`, `voice`, `own`, `secure`, `compliance`, `enterprise`, `projects`, `audit`, `cost`, `metrics`, `sentrux`, `magic`, `steer`
 <!-- /generated -->
 
 ---
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.12.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.12.1
+11.17.1

package/autonomy/grill.sh

@@ -245,7 +245,9 @@ grill_invoke_provider() {
             #     must never mutate the tree (defense-in-depth). Deny Edit/Write/
             #     NotebookEdit + git mutations. Opt out LOKI_REVIEW_TOOL_GUARD=0.
             # Type-guarded so an environment without the helper degrades cleanly.
-            local _gr_argv=("--dangerously-skip-permissions" "--model" "${LOKI_GRILL_MODEL:-sonnet}")
+            _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+            ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
+            local _gr_argv=("${_LOKI_PERM_ARGV[@]}" "--model" "${LOKI_GRILL_MODEL:-sonnet}")
             if type loki_subcall_bare_enabled >/dev/null 2>&1 && loki_subcall_bare_enabled; then
                 _gr_argv+=("--bare")
             fi

package/autonomy/hooks/validate-bash.sh

@@ -28,8 +28,16 @@ case "${LOKI_HOST_GUARD:-0}" in
     1|true|yes|on) HOST_GUARD=true ;;
 esac
 
+# P12-26d: under LOKI_PERMISSION_POLICY=compiled the compiled allow/deny list
+# and permission mode decide. An explicit hook "allow" skips the permission
+# prompt for every command that passes the blocklist, which would widen the
+# compiled policy, so the hook never emits one and fails closed on bad input.
+COMPILED_POLICY=false
+[ "${LOKI_PERMISSION_POLICY:-}" = "compiled" ] && COMPILED_POLICY=true
+
 if ! command -v python3 >/dev/null 2>&1; then
     "$HOST_GUARD" && deny "LOKI_HOST_GUARD: python3 is unavailable, so the Bash command cannot be inspected safely."
+    "$COMPILED_POLICY" && deny "LOKI_PERMISSION_POLICY=compiled: python3 is unavailable, so the Bash command cannot be inspected safely."
     printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}'
     exit 0
 fi
@@ -46,6 +54,7 @@ if not isinstance(command, str) or not command.strip():
 sys.stdout.write(command)
 '); then
     "$HOST_GUARD" && deny "LOKI_HOST_GUARD: malformed or missing Bash command input was denied."
+    "$COMPILED_POLICY" && deny "LOKI_PERMISSION_POLICY=compiled: malformed or missing Bash command input was denied."
     printf '%s' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}'
     exit 0
 fi
@@ -342,24 +351,50 @@ BLOCKED_PATTERNS=(
     ":\(\) *\{.*\|.*&"
 )
 
-# Safe path patterns that override blocked pattern matches
+# Safe path patterns that override blocked pattern matches. They are matched
+# per SEGMENT (the command split on ; & | newline CR), never against the whole
+# string: an unanchored or per-line match let `rm -rf /tmp/x; rm -rf /` and
+# `rm -rf /tmp/x<newline>rm -rf /` ride the override. Only the segment that hit
+# a blocked pattern must be safe; an optional trailing /dev/null redirection is
+# allowed, and `*` and `$$` in /tmp names. A `..` anywhere in the segment is
+# never safe.
+_SAFE_REDIR='([[:space:]]+[0-9]*>>?[[:space:]]*/dev/null)*[[:space:]]*'
+_SAFE_ENV='([A-Za-z_][A-Za-z0-9_]*=[A-Za-z0-9._/:-]*[[:space:]]+)*'
+# A dot-leading path component with a glob char (`/tmp/.*` expands to `/tmp/..`).
+_DOT_GLOB='/\.[^/[:space:]]*[*?[]'
 SAFE_PATTERNS=(
-    "rm -rf /tmp/"
-    "rm -rf \.loki/queue/dead-letter"
+    '^[[:space:]]*'"$_SAFE_ENV"'rm -rf (/tmp/([A-Za-z0-9._/*-]|\$\$)+[[:space:]]*)+'"$_SAFE_REDIR"'$'
+    '^[[:space:]]*'"$_SAFE_ENV"'rm -rf \.loki/queue/dead-letter[A-Za-z0-9._/-]*'"$_SAFE_REDIR"'$'
 )
 
+_segment_is_safe() {
+    local seg="$1" safe
+    [[ "$seg" == *".."* ]] && return 1
+    [[ "$seg" =~ $_DOT_GLOB ]] && return 1
+    for safe in "${SAFE_PATTERNS[@]}"; do
+        [[ "$seg" =~ $safe ]] && return 0
+    done
+    return 1
+}
+
+# Succeeds when every segment hitting $1 is safe and at least one segment hits
+# (a pattern that only matches across segments, like `curl x | sh`, is unsafe).
+_blocked_hits_all_safe() {
+    local pat="$1" flat seg hit=false
+    # Strip fd duplication (2>&1) first: its `&` is not a command separator, and removing it hides no command.
+    flat=$(printf '%s' "$COMMAND" | sed -E 's/[0-9]*>&[0-9]+//g' | tr ';&|\r' '\n')
+    while IFS= read -r seg; do
+        printf '%s' "$seg" | grep -qE "$pat" || continue
+        hit=true
+        _segment_is_safe "$seg" || return 1
+    done <<< "$flat"
+    "$hit"
+}
+
 # Check for blocked patterns
 for pattern in "${BLOCKED_PATTERNS[@]}"; do
     if echo "$COMMAND" | grep -qE "$pattern"; then
-        # Check if a safe pattern also matches (whitelist override)
-        is_safe=false
-        for safe in "${SAFE_PATTERNS[@]}"; do
-            if echo "$COMMAND" | grep -qE "$safe"; then
-                is_safe=true
-                break
-            fi
-        done
-        "$is_safe" && continue
+        _blocked_hits_all_safe "$pattern" && continue
         deny "Blocked: potentially dangerous command pattern detected"
     fi
 done
@@ -370,7 +405,10 @@ mkdir -p "$LOG_DIR"
 printf '%s' "{\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"command\":$(echo "$COMMAND" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read()))')}" >> "$LOG_DIR/bash-audit.jsonl"
 echo >> "$LOG_DIR/bash-audit.jsonl"
 
-# Allow command
+# Allow command. Compiled policy: no decision, the permission flow decides.
+if "$COMPILED_POLICY"; then
+    exit 0
+fi
 printf '%s' '{"hookSpecificOutput": {"hookEventName": "PreToolUse", "permissionDecision": "allow"}}'
 
 exit 0

package/autonomy/lib/backlog.py

@@ -308,9 +308,17 @@ def main(argv):
         child_env["LOKI_PROVIDER"] = a.provider
     elif cfg.get("provider"):
         child_env["LOKI_PROVIDER"] = cfg["provider"]
-    # ponytail: per-run cap is forwarded only; the v10 engine itself caps on time
-    if cfg.get("budgets", {}).get("per_run_usd"):
-        child_env["LOKI_BUDGET_LIMIT"] = str(cfg["budgets"]["per_run_usd"])
+    # per-run cap forwarded to each child (budgets.per_run is the TS-side alias); an exported LOKI_BUDGET_LIMIT wins over loki.yaml
+    bud = cfg.get("budgets", {})
+    per_run = bud.get("per_run_usd") or bud.get("per_run")
+    if per_run and not env.get("LOKI_BUDGET_LIMIT"):
+        child_env["LOKI_BUDGET_LIMIT"] = str(per_run)
+    group_cap = None  # a DAG group shares one total: the run cap bounds the sum of its units, not each unit
+    if dag_units:
+        try:
+            group_cap = float(env.get("LOKI_BUDGET_LIMIT") or 0) or None
+        except ValueError:
+            group_cap = None
     day_cap = cfg.get("budgets", {}).get("per_day_usd")
 
     # One job table for issues and units: they share one slot pool.
@@ -444,6 +452,13 @@ def main(argv):
         for k in [k for k, (p, _l, _w) in running.items() if p.poll() is not None]:
             finish(k)
         while pending and len(running) < conc:
+            group_spent = sum(st["cost"] or 0 for st in state.values())
+            if group_cap and group_spent >= group_cap:
+                for k in pending:
+                    state[k].update(status="BUDGET_STOP: group budget $%.2f reached ($%.2f spent)" % (group_cap, group_spent), ok=False)
+                    say("backlog: %s %s" % (spec[k]["label"], state[k]["status"]))
+                pending = []
+                break
             spent = spent_today() if day_cap else 0.0
             if day_cap and (spent is None or spent >= day_cap):
                 for k in pending:

package/autonomy/lib/chat.sh

@@ -3,7 +3,7 @@
 # Sourced by autonomy/loki; defines cmd_chat. Free text goes to the provider
 # in the current mode; slash commands delegate to existing loki commands.
 
-_LOKI_CHAT_SYSTEM_PROMPT="You are running inside Loki Mode chat. Be concise. Prefer small, verifiable changes. Loki commands available to the user: loki start (also --workspace and --deploy), loki quick, loki verify, loki receipt, loki undo."
+_LOKI_CHAT_SYSTEM_PROMPT="You are running inside Loki Mode chat. Be concise. Prefer small, verifiable changes. Loki commands available to the user: loki start (also --workspace and --deploy), loki quick, loki verify, loki receipt, loki undo. During a run, /steer sends a mid-run directive via loki steer (applied at the next plan or implement stage); /pause and /resume control the run, and /answer replies to a blocked run."
 
 _chat_loki_bin() {
     local d="${_LOKI_SCRIPT_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
@@ -41,7 +41,14 @@ _chat_help() {
 Loki chat commands:
   /plan              read-only mode (no edits)
   /build             edit mode
-  /run <prd|brief>   loki start with this session's model and provider (same run as the shell)
+  /run <prd|brief>   loki start with this session's model and provider, in the background (alias /start)
+  /start <prd|brief> alias of /run
+  /status            loki status
+  /steer <msg>       send a mid-run directive via loki steer (shows the "Steer rev N received" ack)
+  /stop              loki stop
+  /pause             loki pause (the run halts at the next iteration boundary)
+  /resume            loki resume
+  /answer <text>     loki answer --text: answer a BLOCKED run with a follow-up run
   /workspace <name> <brief>  loki start --workspace (multi-repo run, composite receipt)
   /deploy [--health-url U] [--auto-rollback]  loki deploy --execute after you confirm (gated on a VERIFIED receipt)
   /attach            attach to the current or most recent loki start run in this repo
@@ -52,7 +59,9 @@ Loki chat commands:
   /model <id>        set model for this session
   /provider <name>   switch provider (claude, codex, cline, aider, opencode)
   /cost              loki cost
+  /merge <args>      loki merge (pr <pr>, watch <pr> to repair red CI, run, list)
   /diff              git diff --stat plus diff
+  /doctor [--json]   loki doctor --repo: repo readiness score and fixes (alias /ready)
   /undo [args]       loki undo
   /help, /exit
 Attached mode (loki chat --attach or /attach): /status /steer <msg> /diff /verify /receipt /stop
@@ -62,6 +71,98 @@ HLP
 }
 
 
+# /steer: record source=chat and the chat user as actor (D02). Echo loki steer's own
+# "Steer rev N received" ack; never claim receipt it did not print.
+_chat_steer() {
+    local loki="$1" msg="$2" out rc=0 first
+    case "$msg" in
+        ""|help|h) echo "usage: /steer <message> (not help)"; return 0 ;;
+    esac
+    out="$(LOKI_STEER_SOURCE=chat LOKI_STEER_ACTOR="${LOKI_STEER_ACTOR:-${USER:-chat}}" "$loki" steer -- "$msg" 2>&1)" || rc=$?
+    [ -z "$out" ] || printf '%s\n' "$out"
+    if [ "$rc" -ne 0 ]; then echo "(exit $rc)"
+    elif ! printf '%s\n' "$out" | grep -q 'Steer rev [0-9][0-9]* received'; then
+        first="$(printf '%s\n' "$out" | tr -d '\000-\010\013-\037\177' | sed -n '/[^[:space:]]/{p;q;}' | cut -c1-120)"
+        echo "Steer not confirmed: ${first:-no confirmation from loki steer}"
+    fi
+    return 0
+}
+
+# Monotonic milliseconds and a ms sleep; both are functions so tests can inject a fake clock.
+# The clock source is chosen once per launch (_CHAT_CLOCK) so every read shares one base:
+# perl clock_gettime, else whole seconds from $SECONDS.
+_chat_clock_pick() {
+    if perl -MTime::HiRes=clock_gettime,CLOCK_MONOTONIC -e 'exit 0' >/dev/null 2>&1; then _CHAT_CLOCK=perl; else _CHAT_CLOCK=seconds; fi
+}
+_chat_now_ms() {
+    [ -n "${_CHAT_CLOCK:-}" ] || _chat_clock_pick
+    if [ "$_CHAT_CLOCK" = perl ]; then
+        perl -MTime::HiRes=clock_gettime,CLOCK_MONOTONIC -e 'printf "%d\n", clock_gettime(CLOCK_MONOTONIC) * 1000'
+    else
+        echo $(( SECONDS * 1000 ))
+    fi
+}
+_chat_sleep_ms() {
+    local ms="$1"
+    [ "$ms" -gt 0 ] 2>/dev/null || return 0
+    sleep "$(( ms / 1000 )).$(printf '%03d' $(( ms % 1000 )))"
+}
+
+# /run launch: background `loki start`, then print "Run started" only after the same
+# signals `loki status` reads show a live new run (a new engine10 run dir or a live pid file
+# that was not live before). A start that exits first reports its real error and the log path.
+# Returns non-zero when the start is not proven.
+_chat_run_launch() {
+    local loki="$1" input="$2" root="${LOKI_DIR:-.loki}" log pid rc=0 start_ms deadline_ms now_ms rem_ms iter=0 max_iter before_dir before_state
+    log="$root/chat-run.log"
+    mkdir -p "$root"
+    _chat_clock_pick
+    start_ms="$(_chat_now_ms)" || start_ms=""
+    case "$start_ms" in
+        ''|*[!0-9]*)
+            echo "Run not started (clock read failed before launch). Retry /run." >&2
+            return 1
+            ;;
+    esac
+    before_dir="$(_chat_run_dir)"; before_state="$(_chat_run_state "$before_dir")"
+    _chat_run_start "$loki" "$input" < /dev/null > "$log" 2>&1 &
+    pid=$!
+    local wait_s="${LOKI_CHAT_START_WAIT:-15}"
+    case "$wait_s" in ''|*[!0-9]*) wait_s=15 ;; esac
+    [ "$wait_s" -ge 1 ] || wait_s=1
+    deadline_ms=$(( start_ms + wait_s * 1000 ))
+    # Whole-second clock floors, so allow 1s of slack rather than give up early.
+    [ "$_CHAT_CLOCK" = perl ] || deadline_ms=$(( deadline_ms + 1000 ))
+    max_iter=$(( wait_s * 5 + 10 ))
+    while :; do
+        iter=$(( iter + 1 ))
+        local nd ns
+        nd="$(_chat_run_dir)"; ns="$(_chat_run_state "$nd")"
+        if [ "$ns" = "running" ] && { { [ "$nd" != "$before_dir" ] && _chat_pidfile_live "$nd/run.pid"; } || { [ "$nd" = "$before_dir" ] && [ "$before_state" != "running" ]; }; }; then
+            echo "Run started in the background (pid $pid). Output: $log"
+            return 0
+        fi
+        if ! kill -0 "$pid" 2>/dev/null; then
+            wait "$pid" 2>/dev/null || true
+            rc="$(sed -n 's/.*(run finished, exit \([0-9][0-9]*\).*/\1/p' "$log" 2>/dev/null | tail -n1)"
+            case "$rc" in ''|0) rc=1 ;; esac
+            echo "Run did not start (loki start exited $rc before a live run appeared). Log: $log" >&2
+            tail -n 5 "$log" 2>/dev/null | cut -c1-200 >&2
+            return "$rc"
+        fi
+        # A failed or non-numeric clock read (perl fork EAGAIN) counts as the deadline: never mix clock bases.
+        now_ms="$(_chat_now_ms)" || break
+        case "$now_ms" in ''|*[!0-9]*) break ;; esac
+        rem_ms=$(( deadline_ms - now_ms ))
+        [ "$rem_ms" -gt 0 ] || break
+        [ "$iter" -lt "$max_iter" ] || break
+        [ "$rem_ms" -le 200 ] || rem_ms=200
+        _chat_sleep_ms "$rem_ms"
+    done
+    echo "Run start not confirmed after ${wait_s}s (no live run state; launcher pid $pid still running). Log: $log" >&2
+    return 1
+}
+
 # Run a delegate without letting a non-zero exit end the session (autonomy/loki runs under set -e).
 _chat_do() { local _rc=0; "$@" || _rc=$?; [ "$_rc" -eq 0 ] || echo "(exit $_rc)"; return 0; }
 
@@ -316,7 +417,7 @@ Question: $line" || true
                 /status) _chat_do "$loki" status; continue ;;
                 /steer)
                     [ -n "$rest" ] || { echo "usage: /steer <message>"; continue; }
-                    _chat_do "$loki" steer "$rest"; continue ;;
+                    _chat_steer "$loki" "$rest"; continue ;;
                 /stop) _chat_do "$loki" stop; continue ;;
                 /detach) attached=0; echo "Detached."; continue ;;
             esac
@@ -326,10 +427,10 @@ Question: $line" || true
             /help) _chat_help ;;
             /plan) mode="plan"; echo "Plan mode: read-only." ;;
             /build) mode="build"; echo "Build mode: edits allowed." ;;
-            /run)
+            /run|/start)
                 [ -n "$rest" ] || { echo "usage: /run <prd|brief>"; continue; }
-                _chat_run_start "$loki" "$rest"
-                _chat_attach_banner || true ;;
+                local _lrc=0; _chat_run_launch "$loki" "$rest" || _lrc=$?
+                if [ "$_lrc" -eq 0 ]; then _chat_attach_banner || true; else echo "(exit $_lrc)"; fi ;;
             /workspace)
                 local _ws_name="${rest%% *}" _ws_brief=""
                 [ "$_ws_name" != "$rest" ] && _ws_brief="${rest#* }"
@@ -342,8 +443,13 @@ Question: $line" || true
             /status) _chat_do "$loki" status ;;
             /steer)
                 [ -n "$rest" ] || { echo "usage: /steer <message>"; continue; }
-                _chat_do "$loki" steer "$rest" ;;
+                _chat_steer "$loki" "$rest" ;;
             /stop) _chat_do "$loki" stop ;;
+            /pause) _chat_do "$loki" pause ;;
+            /resume) _chat_do "$loki" resume ;;
+            /answer)
+                [ -n "$rest" ] || { echo "usage: /answer <text>"; continue; }
+                _chat_do "$loki" answer --text "$rest" ;;
             /detach) echo "Not attached." ;;
             /quick)
                 [ -n "$rest" ] || { echo "usage: /quick <task>"; continue; }
@@ -355,8 +461,12 @@ Question: $line" || true
                 _chat_do "$loki" verify $rest ;;
             /receipt) _chat_do "$loki" receipt ;;
             /cost) _chat_do "$loki" cost ;;
+            /merge) # shellcheck disable=SC2086
+                _chat_do "$loki" merge $rest ;;
             /undo) # shellcheck disable=SC2086
                 _chat_do "$loki" undo $rest ;;
+            /doctor|/ready) # shellcheck disable=SC2086
+                _chat_do "$loki" doctor --repo $rest ;;
             /diff) _chat_do git diff --stat; _chat_do git diff ;;
             /model)
                 if [ -n "$rest" ]; then _CHAT_MODEL="$rest"; echo "model: $rest"; else echo "model: ${_CHAT_MODEL:-default}"; fi ;;

package/autonomy/lib/claude-flags.sh

@@ -972,3 +972,23 @@ loki_export_subagent_capacity() {
 # subprocess tree inherits it, so every subcall site gets the same capacity
 # without each one having to remember to call this.
 loki_export_subagent_capacity
+
+# P12-26: LOKI_PERMISSION_POLICY=compiled swaps --dangerously-skip-permissions for
+# --permission-mode / --allowedTools / --disallowedTools compiled from the task policy
+# by src/policies/claude_permissions.js (shared with the TS permissionArgv). Unset =
+# unchanged. Result lands in _LOKI_PERM_ARGV. A compile failure fails closed to plan.
+_loki_claude_permission_argv() {
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    [ "${LOKI_PERMISSION_POLICY:-}" = "compiled" ] || return 0
+    local _helper _out _a
+    _helper="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/src/policies/claude_permissions.js"
+    _LOKI_PERM_ARGV=(--permission-mode plan)
+    if ! command -v node >/dev/null 2>&1 || [ ! -f "$_helper" ]; then
+        echo "[loki] WARNING: LOKI_PERMISSION_POLICY=compiled: compiler unavailable; using most restrictive mode (plan)" >&2
+        return 0
+    fi
+    _out="$(node "$_helper" "${LOKI_PROJECT_DIR:-$PWD}")" || return 0
+    [ -n "$_out" ] || return 0
+    _LOKI_PERM_ARGV=()
+    while IFS= read -r _a; do _LOKI_PERM_ARGV+=("$_a"); done <<< "$_out"
+}

package/autonomy/lib/claude_permissions.py

@@ -0,0 +1,40 @@
+"""P12-26b: Python entry to the shared Claude permission policy.
+
+New file: the python launch sites (dashboard, magic) need the same argv as the
+bash and TS routes; this is a thin caller of src/policies/claude_permissions.js
+(the single compiler), not a second implementation. Unset LOKI_PERMISSION_POLICY
+returns the legacy flag byte-identically.
+"""
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+_LEGACY = ["--dangerously-skip-permissions"]
+_FAIL_CLOSED = ["--permission-mode", "plan"]
+
+
+def claude_permission_argv(project_dir: str | None = None, env: dict | None = None) -> list:
+    env = os.environ if env is None else env
+    if env.get("LOKI_PERMISSION_POLICY", "") != "compiled":
+        return list(_LEGACY)
+    helper = Path(__file__).resolve().parents[2] / "src" / "policies" / "claude_permissions.js"
+    node = shutil.which("node")
+    if node is None or not helper.is_file():
+        print("[loki] WARNING: LOKI_PERMISSION_POLICY=compiled: compiler unavailable; using most restrictive mode (plan)", file=sys.stderr)
+        return list(_FAIL_CLOSED)
+    target = project_dir or env.get("LOKI_PROJECT_DIR") or os.getcwd()
+    try:
+        done = subprocess.run([node, str(helper), str(target)], capture_output=True, text=True,
+                              timeout=30, env=dict(env), check=False)
+    except (OSError, subprocess.SubprocessError):
+        return list(_FAIL_CLOSED)
+    if done.stderr:
+        sys.stderr.write(done.stderr)
+    args = [a for a in done.stdout.split("\n") if a]
+    if done.returncode != 0 or not args:
+        return list(_FAIL_CLOSED)
+    return args

package/autonomy/lib/done-recognition.sh

@@ -157,13 +157,15 @@ _loki_done_recog_invoke() {
         local _dr_schema_content _dr_json _dr_obj
         _dr_schema_content="$(cat "$_dr_schema" 2>/dev/null)" || _dr_schema_content=""
         if [ -n "$_dr_schema_content" ]; then
+            _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+            ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
             if command -v timeout >/dev/null 2>&1; then
                 _dr_json=$(CAVEMAN_DEFAULT_MODE=off timeout "${LOKI_DONE_RECOG_TIMEOUT}" \
-                    claude --dangerously-skip-permissions -p "$prompt" \
+                    claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" \
                     --json-schema "$_dr_schema_content" --output-format json 2>/dev/null) || _dr_json=""
             else
                 _dr_json=$(CAVEMAN_DEFAULT_MODE=off \
-                    claude --dangerously-skip-permissions -p "$prompt" \
+                    claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" \
                     --json-schema "$_dr_schema_content" --output-format json 2>/dev/null) || _dr_json=""
             fi
             local _dr_py
@@ -192,12 +194,14 @@ except Exception:
 
     local rc=0
     local out=""
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
     if command -v timeout >/dev/null 2>&1; then
         out=$(CAVEMAN_DEFAULT_MODE=off timeout "${LOKI_DONE_RECOG_TIMEOUT}" \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     else
         out=$(CAVEMAN_DEFAULT_MODE=off \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     fi
     [ "$rc" -ne 0 ] && return 1
     [ -z "$out" ] && return 1

package/autonomy/lib/engine10-push.sh

@@ -2,9 +2,10 @@
 # Loki 10 engine P4 push child (ENGINE.md sections 6 and 7).
 #
 #   engine10-push.sh push-pr <repo-dir> <branch> <title> <body-file> [--draft] [--base <branch>]
-#   engine10-push.sh check-origin   (exit 0 when the pinned origin is acceptable to push-pr, else the refusal; no network)
+#   engine10-push.sh pr-ready <repo-dir> <branch> <body-file> <pr-url>   (reused open PR: replace its body, then mark it ready; <pr-url> must be the pinned-owner PR)
+#   engine10-push.sh check-origin  (exit 0 when the pinned origin is acceptable to push-pr, else the refusal; no network)
 #   engine10-push.sh comment <pr-number> <body-file>
-#   engine10-push.sh issue-comment <issue-ref> <body-file>
+#   engine10-push.sh issue-comment [--update] <issue-ref> <body-file>
 #   engine10-push.sh status  <sha> <pending|success|failure|error> <description>
 #
 # Holds GitHub credentials, runs no LLM, reads no untrusted text. Inputs come
@@ -117,6 +118,16 @@ _e10_local_push() {
 
 _e10_gh() { _loki_with_github_tokens _loki_run_neutral "$_e10_repo" command gh "$@"; }
 
+# The one open-PR lookup for push-pr reuse and pr-ready. gh cannot filter --head by owner, so a stranger's fork PR with the
+# same branch name would match; select only a same-repo PR from the pinned owner. Prints the URL, or nothing.
+_e10_find_pr() {
+    local owner="${_e10_repo%%/*}"
+    case "$owner" in '' | *[!A-Za-z0-9_.-]*) return 1 ;; esac
+    _e10_gh pr list --repo "$_e10_repo" --head "$1" --state open \
+        --json url,isCrossRepository,headRepositoryOwner,headRefName,state \
+        --jq "[.[] | select(.isCrossRepository == false and .state == \"OPEN\" and (.headRepositoryOwner.login | ascii_downcase) == \"$(printf '%s' "$owner" | tr '[:upper:]' '[:lower:]')\")] | .[0].url // empty"
+}
+
 mode="${1:-}"
 shift || true
 case "$mode" in
@@ -157,13 +168,30 @@ case "$mode" in
         else
             _loki_trusted_push _loki_with_github_tokens "$dir" "$branch" || die "push refused or failed (rc=$?)"
         fi
-        url="$(_e10_gh pr list --repo "$_e10_repo" --head "$branch" --state open --json url --jq '.[0].url')" \
-            || die "gh pr list failed"
-        if [ -z "$url" ] || [ "$url" = "null" ]; then
+        url="$(_e10_find_pr "$branch")" || die "gh pr list failed"
+        _e10_pr_state=reused
+        if [ -z "$url" ]; then
+            _e10_pr_state=created
             url="$(_e10_gh pr create --repo "$_e10_repo" --head "$branch" --title "$title" --body-file "$body" "${draft[@]}" "${base[@]}")" \
                 || die "gh pr create failed"
             url="$(printf '%s\n' "$url" | tail -n 1)"
         fi
+        printf '%s\n' "$_e10_pr_state"  # marker line before the URL: reused (open PR found) or created
+        printf '%s\n' "$url"
+        ;;
+    pr-ready)
+        # M-21 N3: a reused wave PR whose units are all PROVEN keeps its old draft state and body; fix both, same pinned origin and tokens as push-pr.
+        [ "$#" -eq 4 ] || die "usage: pr-ready <repo-dir> <branch> <body-file> <pr-url>"
+        branch="$2" body="$3" want_url="$4"
+        [ -f "$body" ] || die "body file not found: $body"
+        git check-ref-format --branch "$branch" >/dev/null 2>&1 || die "invalid branch: $branch"
+        case "$branch" in main | master | HEAD) die "refusing to edit a PR for default branch: $branch" ;; esac
+        [ -z "$_e10_local" ] || { log_info "local origin: no PR to mark ready (no-op)"; exit 0; }
+        url="$(_e10_find_pr "$branch")" || die "gh pr list failed"
+        [ -n "$url" ] || die "no open PR from $_e10_repo for branch: $branch"
+        [ "$url" = "$want_url" ] || die "refusing: PR $want_url is not the pinned-owner PR for $branch ($url)"
+        _e10_gh pr edit "$url" --repo "$_e10_repo" --body-file "$body" >/dev/null || die "gh pr edit failed"
+        _e10_gh pr ready "$url" --repo "$_e10_repo" >/dev/null || die "gh pr ready failed"
         printf '%s\n' "$url"
         ;;
     comment)
@@ -176,11 +204,32 @@ case "$mode" in
     issue-comment)
         # E-67: a FAILED run with no diff (or no remote) has no PR to open; comment on the issue
         # instead so the run's reason is never silently lost. <issue-ref> is owner/repo#N or #N.
-        [ "$#" -eq 2 ] || die "usage: issue-comment <issue-ref> <body-file>"
+        # --update: the status projector. One comment carrying the marker below is edited in place (created when absent),
+        # so an issue shows live run state without a new comment per event. Only a comment written by the authenticated
+        # gh user counts, and the body file must carry the marker (it is built by the supervisor, never from task text).
+        _e10_upd=""
+        [ "${1:-}" != "--update" ] || { _e10_upd=1; shift; }
+        [ "$#" -eq 2 ] || die "usage: issue-comment [--update] <issue-ref> <body-file>"
         num="${1##*#}"
         case "$num" in '' | *[!0-9]*) die "cannot extract issue number from: $1" ;; esac
         [ -f "$2" ] || die "body file not found: $2"
         [ -z "$_e10_local" ] || { log_info "local origin: no issue to comment on (no-op)"; exit 0; }
+        if [ -n "$_e10_upd" ]; then
+            _e10_marker='<!-- loki-status -->'
+            grep -qF -- "$_e10_marker" "$2" || die "status body must carry $_e10_marker"
+            _e10_me="$(_e10_gh api user --jq .login 2>/dev/null)" || _e10_me=""
+            _e10_cid=""
+            if [ -n "$_e10_me" ]; then
+                _e10_cid="$(_e10_gh api "repos/$_e10_repo/issues/$num/comments" --paginate \
+                    --jq ".[] | select(.user.login == \"$_e10_me\") | select(.body | contains(\"$_e10_marker\")) | .id" 2>/dev/null | head -n 1)" || _e10_cid=""
+            fi
+            case "$_e10_cid" in
+                '') _e10_gh issue comment "$num" --repo "$_e10_repo" --body-file "$2" || die "gh issue comment failed" ;;
+                *[!0-9]*) die "unexpected comment id" ;;
+                *) _e10_gh api -X PATCH "repos/$_e10_repo/issues/comments/$_e10_cid" -F "body=@$2" >/dev/null || die "gh api comment update failed" ;;
+            esac
+            exit 0
+        fi
         _e10_gh issue comment "$num" --repo "$_e10_repo" --body-file "$2" || die "gh issue comment failed"
         ;;
     status)
@@ -191,5 +240,5 @@ case "$mode" in
         _e10_gh api "repos/$_e10_repo/statuses/$1" -f "state=$2" -f context=loki/deep-verify \
             -f "description=$3" >/dev/null || die "gh api status failed"
         ;;
-    *) die "usage: engine10-push.sh push-pr|comment|issue-comment|status ..." ;;
+    *) die "usage: engine10-push.sh push-pr|pr-ready|comment|issue-comment|status ..." ;;
 esac

package/autonomy/lib/prd-enrich.sh

@@ -86,14 +86,16 @@ _loki_prd_enrich_invoke() {
     command -v claude >/dev/null 2>&1 || return 1
     local rc=0
     local out=""
+    _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    ! type _loki_claude_permission_argv >/dev/null 2>&1 || _loki_claude_permission_argv
     if command -v timeout >/dev/null 2>&1; then
         out=$(CAVEMAN_DEFAULT_MODE=off timeout "${LOKI_PRD_ENRICH_TIMEOUT}" \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     else
         # No coreutils timeout (e.g. bare macOS). Run without it; the model
         # call is a one-shot and the caller still tolerates failure.
         out=$(CAVEMAN_DEFAULT_MODE=off \
-                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+                  claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     fi
     [ "$rc" -ne 0 ] && return 1
     [ -z "$out" ] && return 1