loki-mode 11.17.13 → 11.17.16

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.13
+# Loki Mode v11.17.16
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.13 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.16 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.13
+11.17.16

package/autonomy/loki

@@ -10388,16 +10388,30 @@ _deploy_try_execute() {
             rc=4
         fi
     else
-        canary_out="$( cd "$dir" && eval "$exec_cmd" )" || rc=$?
-        printf '%s\n' "$canary_out"
-        if [ "$rc" -eq 0 ]; then
+        # Stream provider output live while keeping a copy to parse the URL from.
+        # The copy lives in a private mktemp -d dir removed on exit and on INT/TERM/HUP.
+        local dep_dir dep_tmp dep_errexit=0
+        dep_dir="$(mktemp -d "${TMPDIR:-/tmp}/loki-deploy-out.XXXXXXXX")" || dep_dir=""
+        dep_tmp=/dev/null
+        if [ -n "$dep_dir" ]; then
+            dep_tmp="${dep_dir}/out"
+            # shellcheck disable=SC2064
+            trap "rm -rf -- '${dep_dir}'; trap - INT TERM HUP; exit 130" INT TERM HUP
+        fi
+        case $- in *e*) dep_errexit=1 ;; esac
+        set +e
+        ( cd "$dir" && eval "$exec_cmd" ) 2>&1 | tee "$dep_tmp"
+        rc=${PIPESTATUS[0]}
+        [ "$dep_errexit" -eq 1 ] && set -e
+        if [ "$rc" -eq 0 ] && [ "$dep_tmp" != /dev/null ]; then
             # Same last-https-URL parse as the canary path; never invented.
-            deployed_url="$(grep -Eo 'https?://[^[:space:]]+' <<<"$canary_out" | tail -n 1)" || deployed_url=""
+            deployed_url="$(grep -Eo 'https?://[^[:space:]]+' "$dep_tmp" | tail -n 1)" || deployed_url=""
             if [ -n "$deployed_url" ]; then
                 echo "Live at: ${deployed_url}"
                 if [ -z "$health_url" ]; then health_url="$deployed_url"; health_src="captured"; fi
             fi
         fi
+        if [ -n "$dep_dir" ]; then rm -rf -- "$dep_dir"; trap - INT TERM HUP; fi
     fi
 
     # Health probe only after a deploy that exited 0. Without a URL, or after a
@@ -11073,6 +11087,97 @@ except: print(0)
             fi
             ;;
 
+        publish)
+            # Receipt-stamped export: push the verified tree to GitHub and set a
+            # loki/receipt commit status whose state comes ONLY from the receipt
+            # verdict. Never stages files; private unless --public is passed.
+            local _pub_vis="--private" _pub_name="" _pub_dir="." _pub_usage=0
+            while [ $# -gt 0 ]; do
+                case "$1" in
+                    --public) _pub_vis="--public"; shift ;;
+                    --private) _pub_vis="--private"; shift ;;
+                    --dir)
+                        case "${2:-}" in ""|-*) _pub_usage=1; break ;; esac
+                        _pub_dir="$2"; shift 2 ;;
+                    -*) _pub_usage=1; break ;;
+                    *)
+                        [ -z "$_pub_name" ] || { _pub_usage=1; break; }
+                        _pub_name="$1"; shift ;;
+                esac
+            done
+            if [ "$_pub_usage" -ne 0 ]; then
+                echo "Usage: loki github publish [name] [--public] [--dir <path>]" >&2
+                exit 2
+            fi
+            local _pub_refuse
+            _pub_refuse="$(_deploy_tree_clean "$_pub_dir")"
+            if [ -n "$_pub_refuse" ]; then
+                echo -e "${RED}Refused: ${_pub_refuse}${NC}" >&2
+                exit 1
+            fi
+            if ! command -v gh &>/dev/null; then
+                echo -e "${RED}Error: gh CLI not found. Install with: brew install gh${NC}" >&2
+                exit 1
+            fi
+            if ! gh auth status &>/dev/null; then
+                echo -e "${RED}Error: gh CLI not authenticated. Run: gh auth login${NC}" >&2
+                exit 1
+            fi
+            local _pub_sha _pub_pj _pub_verdict="NONE" _pub_anchor="" _pub_state="none"
+            _pub_sha="$(git -C "$_pub_dir" rev-parse HEAD 2>/dev/null)" || _pub_sha=""
+            if [ -z "$_pub_sha" ]; then
+                echo -e "${RED}Refused: no HEAD commit to publish${NC}" >&2
+                exit 1
+            fi
+            _pub_pj="$(_deploy_latest_receipt "$_pub_dir")"
+            if [ -n "$_pub_pj" ]; then
+                _pub_verdict="$(_deploy_receipt_verdict "$_pub_pj")"
+                _pub_anchor="$(_deploy_anchor_ok "$_pub_pj" "$_pub_dir")"
+                if [ "$_pub_verdict" = "VERIFIED" ] && [ -z "$_pub_anchor" ]; then
+                    _pub_state="success"
+                else
+                    _pub_state="failure"
+                fi
+            fi
+
+            local _pub_url="" _pub_out=""
+            if git -C "$_pub_dir" remote get-url origin &>/dev/null; then
+                if [ -n "$_pub_anchor" ] || [ -z "$_pub_pj" ]; then
+                    echo -e "${RED}Refused: HEAD is not confirmed as the receipt anchor (${_pub_anchor:-no Evidence Receipt found}). Nothing was pushed.${NC}" >&2
+                    exit 1
+                fi
+                git -C "$_pub_dir" push origin HEAD || exit 1
+            else
+                [ -n "$_pub_name" ] || _pub_name="$(basename "$(cd "$_pub_dir" && pwd)")"
+                _pub_out="$(cd "$_pub_dir" && gh repo create "$_pub_name" "$_pub_vis" --source . --push 2>&1)" || {
+                    echo "$_pub_out" >&2
+                    echo -e "${RED}gh repo create failed; nothing published.${NC}" >&2
+                    exit 1
+                }
+                _pub_url="$(printf '%s\n' "$_pub_out" | grep -Eo 'https://github\.com/[^[:space:]]+' | head -1)"
+            fi
+            [ -n "$_pub_url" ] || _pub_url="$(git -C "$_pub_dir" remote get-url origin 2>/dev/null || true)"
+
+            local _pub_slug
+            _pub_slug="$(printf '%s' "$_pub_url" | sed -E 's|^.*github\.com[:/]||; s|\.git$||')"
+            if [ "$_pub_state" = "none" ]; then
+                echo -e "${YELLOW}No Evidence Receipt found: no loki/receipt status set.${NC}"
+            elif [ -z "$_pub_slug" ] || [ "$_pub_slug" = "$_pub_url" ]; then
+                echo -e "${YELLOW}Could not resolve owner/repo: no loki/receipt status set.${NC}"
+            else
+                gh api "repos/${_pub_slug}/statuses/${_pub_sha}" \
+                    -f "state=${_pub_state}" -f "context=loki/receipt" \
+                    -f "description=Evidence Receipt verdict: ${_pub_verdict}" >/dev/null \
+                    || echo -e "${YELLOW}Warning: could not set the loki/receipt status.${NC}" >&2
+                echo "loki/receipt status: ${_pub_state} (receipt ${_pub_verdict})"
+            fi
+            if [ -n "$_pub_url" ]; then
+                echo "Repository: ${_pub_url}"
+            else
+                echo "Repository URL could not be determined."
+            fi
+            ;;
+
         help|*)
             echo -e "${BOLD}loki github${NC} - GitHub integration management"
             echo ""
@@ -11081,6 +11186,7 @@ except: print(0)
             echo "  sync         Sync completed task status back to GitHub issues"
             echo "  export       Export local tasks as new GitHub issues"
             echo "  pr [name]    Create pull request from completed work"
+            echo "  publish [name] [--public]  Push to GitHub and set a loki/receipt commit status"
             echo ""
             echo "Environment Variables:"
             echo "  LOKI_GITHUB_IMPORT=true    Import open issues as tasks on start"

package/autonomy/mcp-launch.sh

@@ -150,6 +150,7 @@ _ml_help() {
 Loki Mode -- launch the MCP (Model Context Protocol) server
 
 Usage: loki mcp [--transport stdio|http] [--port N] [--help]
+       loki mcp install --client claude|cursor|vscode|windsurf [--project|--global] [--print]
 
 Starts the Loki Mode MCP server so MCP-aware clients (Claude Code, IDEs)
 can call Loki's tools (memory, task queue, code search, build management).
@@ -200,8 +201,164 @@ install command to stderr and exits 2.
 EOF
 }
 
+# --- loki mcp install (TEN-ADOPTION-05) ------------------------------------
+# Registers the loki-mode stdio server (`npx -y loki-mode mcp`) in an MCP
+# client's config. The JSON merge keeps every other server and key, is a no-op
+# (byte-identical, no .bak) when loki-mode is already registered with the same
+# entry, writes <file>.bak before changing an existing file, and refuses to
+# touch invalid JSON.
+
+_ml_install_help() {
+    cat <<'EOF'
+Usage: loki mcp install --client claude|cursor|vscode|windsurf [--project|--global] [--print]
+
+Adds the loki-mode MCP server (npx -y loki-mode mcp) to a client's config.
+
+  claude    runs `claude mcp add loki-mode -- npx -y loki-mode mcp` when the
+            claude CLI is on PATH, otherwise prints that command.
+  cursor    .cursor/mcp.json (--project, default) or ~/.cursor/mcp.json (--global)
+  vscode    .vscode/mcp.json (project only), under the "servers" key
+  windsurf  ~/.codeium/windsurf/mcp_config.json (global only)
+
+Options:
+  --project   Write to the current project (claude: --scope project).
+  --global    Write to the user config (claude: --scope user).
+  --print     Print what would be written to stdout; write nothing.
+
+Existing files are merged (other servers and keys are kept), backed up to
+<file>.bak before a change, and left untouched if they are not valid JSON.
+EOF
+}
+
+# _ml_json_merge <file> <topkey> <type|-> : merge the loki-mode entry into file.
+# Exit codes: 0 ok (changed or already current), 3 invalid or unusable JSON.
+_ml_json_merge() {
+    python3 - "$1" "$2" "$3" <<'PY'
+import json, os, shutil, sys
+path, top, typ = sys.argv[1], sys.argv[2], sys.argv[3]
+entry = {"command": "npx", "args": ["-y", "loki-mode", "mcp"]}
+if typ != "-":
+    entry = dict([("type", typ)] + list(entry.items()))
+exists = os.path.exists(path)
+data = {}
+if exists:
+    try:
+        with open(path) as fh:
+            raw = fh.read()
+        data = json.loads(raw) if raw.strip() else {}
+    except (ValueError, OSError) as exc:
+        sys.stderr.write("Refusing to modify %s: not valid JSON (%s)\n" % (path, exc))
+        sys.exit(3)
+    if not isinstance(data, dict) or not isinstance(data.get(top, {}), dict):
+        sys.stderr.write("Refusing to modify %s: unexpected structure (need an object with an object '%s')\n" % (path, top))
+        sys.exit(3)
+servers = data.setdefault(top, {})
+if servers.get("loki-mode") == entry:
+    print("loki-mode already registered in %s" % path)
+    sys.exit(0)
+servers["loki-mode"] = entry
+if exists:
+    shutil.copy2(path, path + ".bak")
+else:
+    os.makedirs(os.path.dirname(path) or ".", exist_ok=True)
+with open(path, "w") as fh:
+    json.dump(data, fh, indent=2)
+    fh.write("\n")
+print("Registered loki-mode in %s" % path)
+PY
+}
+
+_ml_install_main() {
+    local client="" scope="" do_print=0
+    while [ $# -gt 0 ]; do
+        case "$1" in
+            --client) client="${2:-}"; shift 2 2>/dev/null || shift ;;
+            --client=*) client="${1#--client=}"; shift ;;
+            --project) scope="project"; shift ;;
+            --global) scope="global"; shift ;;
+            --print) do_print=1; shift ;;
+            --help|-h|help) _ml_install_help; return 0 ;;
+            *)
+                printf 'Unknown option for loki mcp install: %s\n' "$1" >&2
+                _ml_install_help >&2
+                return 2
+                ;;
+        esac
+    done
+    case "$client" in
+        claude|cursor|vscode|windsurf) ;;
+        *)
+            printf 'loki mcp install: --client must be one of claude, cursor, vscode, windsurf (got: %s)\n' "${client:-none}" >&2
+            return 2
+            ;;
+    esac
+
+    if [ "$client" = "claude" ]; then
+        local -a cmd=(claude mcp add)
+        case "$scope" in
+            project) cmd+=(--scope project) ;;
+            global) cmd+=(--scope user) ;;
+        esac
+        cmd+=(loki-mode -- npx -y loki-mode mcp)
+        if [ "$do_print" -eq 1 ] || ! command -v claude >/dev/null 2>&1; then
+            [ "$do_print" -eq 1 ] || printf 'claude CLI not found on PATH; run this command yourself:\n' >&2
+            printf '%s\n' "${cmd[*]}"
+            return 0
+        fi
+        "${cmd[@]}"
+        return $?
+    fi
+
+    local file top typ="-"
+    case "$client" in
+        cursor)
+            top="mcpServers"
+            if [ "$scope" = "global" ]; then file="$HOME/.cursor/mcp.json"; else file="$PWD/.cursor/mcp.json"; fi
+            ;;
+        vscode)
+            top="servers"; typ="stdio"
+            if [ "$scope" = "global" ]; then
+                printf 'loki mcp install: vscode supports --project only (workspace .vscode/mcp.json)\n' >&2
+                return 2
+            fi
+            file="$PWD/.vscode/mcp.json"
+            ;;
+        windsurf)
+            top="mcpServers"
+            if [ "$scope" = "project" ]; then
+                printf 'loki mcp install: windsurf supports --global only (~/.codeium/windsurf/mcp_config.json)\n' >&2
+                return 2
+            fi
+            file="$HOME/.codeium/windsurf/mcp_config.json"
+            ;;
+    esac
+
+    if ! command -v python3 >/dev/null 2>&1; then
+        printf 'loki mcp install needs python3 on PATH for the JSON merge.\n' >&2
+        return 2
+    fi
+    if [ "$do_print" -eq 1 ]; then
+        printf 'Would write to %s\n' "$file" >&2
+        python3 - "$top" "$typ" <<'PY'
+import json, sys
+top, typ = sys.argv[1], sys.argv[2]
+entry = {"command": "npx", "args": ["-y", "loki-mode", "mcp"]}
+if typ != "-":
+    entry = dict([("type", typ)] + list(entry.items()))
+print(json.dumps({top: {"loki-mode": entry}}, indent=2))
+PY
+        return 0
+    fi
+    _ml_json_merge "$file" "$top" "$typ"
+}
+
 # mcp_launch_main: dispatcher invoked by cmd_mcp() (autonomy/loki) or directly.
 mcp_launch_main() {
+    if [ "${1:-}" = "install" ]; then
+        shift
+        _ml_install_main "$@"
+        return $?
+    fi
     # Split argv into launcher-owned flags (consumed here) and server argv
     # (forwarded verbatim to the file-exec launch `python "$root/mcp/server.py"`).
     # The server's argparse only

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.13"
+__version__ = "11.17.16"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.13. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.16. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |
@@ -110,6 +110,7 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki config set` | Set a value |
 | `loki config get` | Get a value |
 | `loki mcp` | Launch the MCP server (stdio) |
+| `loki mcp install` | Register loki-mode in an MCP client config |
 | `loki acp` | Run Loki as an ACP agent |
 | `loki stop` | Stop execution immediately |
 | `loki pause` | Pause after the current session |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.13
+**Version:** v11.17.16
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/dev/release-checklist.md

@@ -121,10 +121,10 @@ If any check fails, do not release; fix the root cause first.
 
 Stage files by name (never `git add -A` or `git add .`), commit with the
 repo-local `asklokesh` identity, no co-author. The merge-gate merges approved
-slices to main and main publishes to npm `next` (D96); for a manual push
-(`git push origin main`), wait for Tests and Security Audit to go green on that
-exact SHA before bumping VERSION and releasing. GitHub Actions then creates the tag, the GitHub Release, publishes
-npm, builds/pushes Docker, and updates the Homebrew tap. Do not manually
+slices to main and a VERSION push publishes to npm under `latest` and `next` at once (D96, D102); the
+`publish-npm` job needs only `pack-npm` and never waits on Tests, Security Audit, nightly or the backstop.
+For a manual push (`git push origin main`), run `bash scripts/local-ci.sh` first. GitHub Actions publishes
+npm, then creates the tag and GitHub Release, builds/pushes Docker (including `:latest`), and updates the Homebrew tap. Do not manually
 create tags.
 
 Before pushing the release commit, run `bash scripts/release.sh --check-clean` (E-151): it exits 1 naming any tracked file (for example a stamped `loki-ts/dist/loki.js.map`) the commit left modified; `--bump-only` prints the "stage these files:" list.
@@ -143,7 +143,7 @@ gh release view vX.Y.Z
 ### Train cycle: previous release must be on npm
 `scripts/train-cycle.sh` (phase C) refuses to cut release N+1 until the previous `release: vX` version is visible on npm (`npm_has_version`). While it is missing, the cycle logs `PREV_NOT_ON_NPM X` and returns 0 (waiting is not a failure). An unreachable registry fails closed and adds `reason=NPM_UNREACHABLE`. After `LOKI_TC_NPM_WAIT_MIN` minutes (default 45) since the previous release commit the log becomes `PREV_NOT_ON_NPM_STALE ... refusing release, needs a human`; the release stays refused either way.
 
-Operator action: wait for the Release workflow publish to land and for the D49 auto-promote to run. Never manually promote or move the `latest` dist-tag, and never unpublish. If the STALE line appears, investigate the failed or stuck publish run rather than bypassing the check.
+Operator action: wait for the Release workflow publish-npm job to land (seconds after the push). `latest` and `next` are set together by that job (D102); do not move them by hand, and never unpublish (npm deprecate is allowed). If the STALE line appears, investigate the failed or stuck publish run rather than bypassing the check.
 
 ### Distribution Channel Checklist