loki-mode 11.17.43 → 11.17.45

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.43
+# Loki Mode v11.17.45
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.43 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.45 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.43
+11.17.45

package/autonomy/lib/secure-scan.py

@@ -18,7 +18,7 @@ The scanner is honest by construction:
     .git, vendor, bundled dist of dependencies) and oversized files, so it is
     cheap and deterministic.
 
-The five v1 rules (see internal/LOOP4-SECURE-BY-DEFAULT-PLAN.md):
+The v1 rules (rules 6 and 7 added later) (see internal/LOOP4-SECURE-BY-DEFAULT-PLAN.md):
   1. private-key-committed   (HIGH)   a PEM private-key block in any text file
   2. secret-in-client-file   (HIGH)   a real secret literal in a browser-served file
   3. world-open-datastore    (HIGH)   a literal world-open datastore rule
@@ -46,7 +46,7 @@ import os
 import re
 import sys
 
-RULES_VERSION = "1.1"
+RULES_VERSION = "1.2"
 
 # --- scan limits -----------------------------------------------------------
 # Cap per-file size so a giant generated bundle cannot stall the gate. 2 MiB is
@@ -408,6 +408,48 @@ def _tls_rule_applies(rel_path):
     return not norm.lower().endswith((".md", ".mdx", ".rst", ".txt", ".adoc"))
 
 
+# ---------------------------------------------------------------------------
+# rule 7: shell injection shapes
+# ---------------------------------------------------------------------------
+# Literal forms only, one line: subprocess.* with shell=True whose first
+# argument is an f-string, a %-format, a .format() call or a concatenation;
+# os.system() with an f-string, %-format, .format() or concatenation; and
+# child_process exec/execSync with a template literal containing ${...}.
+# Constant-string commands and list-form argv are never flagged.
+_PY_DYNAMIC_ARG = (
+    r"""(?:[rRbB]?[fF][rR]?(?:"[^"]*"|'[^']*')"""
+    r"""|(?:"[^"]*"|'[^']*')\s*(?:%|\+|\.format\()"""
+    r"""|[A-Za-z_][\w.]*\s*\+\s*(?:"|'|[A-Za-z_]))"""
+)
+_SHELL_TRUE_SUBPROCESS = re.compile(
+    r"""\bsubprocess\.(?:run|call|Popen|check_output|check_call)\(\s*"""
+    + _PY_DYNAMIC_ARG + r""".*\bshell\s*=\s*True\b"""
+)
+_OS_SYSTEM_DYNAMIC = re.compile(
+    r"""\bos\.(?:system|popen)\(\s*""" + _PY_DYNAMIC_ARG
+)
+_NODE_EXEC_TEMPLATE = re.compile(
+    r"""\b(?:child_process\.|cp\.)?(?:exec|execSync)\(\s*`[^`]*\$\{"""
+)
+_NODE_CP_FILE = re.compile(r"""\bchild_process\b""")
+_SHELL_INJECTION_PATH_RE = _TLS_FIXTURE_PATH_RE
+
+
+def _shell_rule_applies(rel_path):
+    """Same exclusions as rule 6: dev/test/fixture paths and prose docs."""
+    return _tls_rule_applies(rel_path)
+
+
+def _shell_injection_hit(text, node_file):
+    if _SHELL_TRUE_SUBPROCESS.search(text) or _OS_SYSTEM_DYNAMIC.search(text):
+        return True
+    m = _NODE_EXEC_TEMPLATE.search(text)
+    if not m:
+        return False
+    qualified = text[max(0, m.start()):m.end()].lstrip().startswith(("child_process.", "cp."))
+    return qualified or node_file
+
+
 # ---------------------------------------------------------------------------
 # file walking / reading
 # ---------------------------------------------------------------------------
@@ -471,6 +513,8 @@ def _scan_file(rel_path, lines, secrets_everywhere=False):
     browser_served = _is_browser_served(rel_path)
     prod_config = _is_production_config(rel_path)
     tls_scan = _tls_rule_applies(rel_path)
+    shell_scan = _shell_rule_applies(rel_path)
+    node_file = shell_scan and any(_NODE_CP_FILE.search(t) for _, t in lines)
 
     # rule 3 / rule 5 need whole-file context for the AND conditions.
     saw_rls_disable = None  # lineno of a DISABLE ROW LEVEL SECURITY
@@ -603,6 +647,18 @@ def _scan_file(rel_path, lines, secrets_everywhere=False):
                 "instead of turning verification off.",
             ))
 
+        # --- rule 7: shell injection shapes ------------------------------
+        if (shell_scan and not _COMMENT_OR_DOC_LINE.match(text)
+                and _shell_injection_hit(text, node_file)):
+            findings.append(_finding(
+                "shell-injection", rel_path, lineno, "HIGH",
+                "A shell command is built from a formatted or concatenated "
+                "string; any untrusted value in it becomes shell syntax.",
+                "Pass an argv list without shell=True (subprocess.run([cmd, "
+                "arg])) or use execFile/spawn with an args array; never "
+                "interpolate input into a command string.",
+            ))
+
         # --- rule 5: CORS wildcard + credentials (whole-file AND) --------
         # Skip prose/doc lines (_rule3_skip = comment-only line or .md/.rst/.txt
         # doc file): a README or comment WARNING about ACAO * + credentials is not

package/autonomy/loki

@@ -1757,14 +1757,15 @@ _help_answer() {
 _help_verify_pr() {
     echo -e "${BOLD}loki verify-pr${NC} - Verify a PR against its linked issue (experimental, LOKI_VERIFY_PR=1)"
     echo ""
-    echo "Usage: loki verify-pr <https://github.com/o/r/pull/N | o/r#N> [--out DIR]"
+    echo "Usage: loki verify-pr <https://github.com/o/r/pull/N | o/r#N> [--out DIR] [--json]"
     echo "       loki verify-pr respond <o/r#N>   fix open review comments (one commit each, on the PR"
     echo "                                        branch), push, reply with the sha; never resolves threads"
     echo ""
     echo "Derives a check from the PR's linked issue (Check: \`cmd\` or a loki-check fence)."
     echo "VERIFIED only if the check fails on the PR base, passes on its head, and the"
     echo "touched packages' suites pass. A PR with no linked issue, no check, a removed"
-    echo "test or a non-discriminating check is NOT PROVEN. Writes verify-pr-result.json."
+    echo "test or a non-discriminating check is NOT PROVEN. Writes verify-pr-result.json;"
+    echo "--json also prints that verdict object on stdout instead of the text summary."
     echo "PR code runs only in the container sandbox (scripts/verify-pr-sandbox.sh); set"
     echo "LOKI_VPR_IMAGE to a locally present image."
     echo ""
@@ -1874,9 +1875,9 @@ show_help_all() {
     echo ""
     echo "Config:"
     echo "  config [cmd]     Manage configuration (show|init|edit|path|set|get)"
-    echo "  doctor [--json]  Check system prerequisites and skill symlinks"
+    echo "  doctor [--json] [--quiet]  Check system prerequisites and skill symlinks"
     echo ""
-    echo "  version          Show version"
+    echo "  version [--json] Show version (--json for machine-readable)"
     echo "  help             Show this help ('loki help aliases' for old names)"
     echo ""
     echo "More commands (the most useful; many more are dispatchable):"
@@ -7496,6 +7497,9 @@ cmd_provider() {
             cmd_provider_set "$@"
             ;;
         list)
+            case " $* " in
+                *" --json "*) _loki_bun_delegate provider list "$@" || { echo "loki provider list --json needs bun: ${_LOKI_DELEGATE_WHY}" >&2; return 1; } ;;
+            esac
             cmd_provider_list
             ;;
         info)
@@ -7518,7 +7522,7 @@ cmd_provider() {
             echo "Commands:"
             echo "  show     Show current provider (default)"
             echo "  set      Set provider for this project"
-            echo "  list     List available providers"
+            echo "  list     List available providers (--json: name, tier, installed, version)"
             echo "  info     Show provider details (--json: capability contract)"
             echo "  matrix   Show the capability matrix per provider and engine"
             echo "  models   Show resolved model configuration for all providers"
@@ -10052,7 +10056,7 @@ _deploy_latest_receipt() {
     return 0
 }
 
-# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary] [post_rollback_health] [health_http_code] [health_match] [tree_sha] [destination] [deployed_url] [health_url_source] [env_keys_csv] [env_source] [domain] [domain_status] [tls_status] [tls_not_after] [domain_provenance]
+# _deploy_record <dir> <command> <exit_code> <run_id> <anchor_sha> [state] [health_status] [health_url] [rb_attempted] [rb_exit] [receipt_sha256] [started_at] [finished_at] [target] [canary] [post_rollback_health] [health_http_code] [health_match] [tree_sha] [destination] [deployed_url] [health_url_source] [env_keys_csv] [env_source] [domain] [domain_status] [tls_status] [tls_not_after] [domain_provenance] [live_binding]
 # Writes the executed deploy's own record, then signs it (loki.deploy/1, Ed25519 via the
 # receipt signer in loki-ts/src/util/receipt_signer.ts) so it is bound to the receipt that
 # authorized it; `loki verify <record>` re-checks it offline. An unsigned record is reported
@@ -10082,6 +10086,7 @@ _deploy_record() {
     local env_keys_csv="${23:-}" env_source="${24:-}"
     # --domain: tls_status is "unchecked" unless the openssl proof ran and said otherwise.
     local domain_rec="${25:-}" domain_status="${26:-}" tls_status="${27:-unchecked}" tls_not_after="${28:-}" domain_prov="${29:-}"
+    local live_binding="${30:-}"
     local ddir="$dir/.loki/deploys"
     [ -d "${LOKI_DIR:-}" ] && ddir="${LOKI_DIR}/deploys"
     mkdir -p "$ddir" 2>/dev/null || return 0
@@ -10091,7 +10096,7 @@ _deploy_record() {
     DR_RBA="$rb_attempted" DR_RBX="$rb_exit" DR_RSHA="$receipt_sha" DR_T0="$started_at" \
     DR_T1="$finished_at" DR_TGT="$target" DR_CAN="$canary" DR_PRB="$post_rb" DR_HC="$hcode_rec" DR_HM="$hmatch" DR_TREE="$tree_sha" DR_DEST="$dest_rec" DR_DURL="$deployed_url" DR_HSRC="$hsrc" \
     DR_ENVK="$env_keys_csv" DR_ENVS="$env_source" \
-    DR_DOM="$domain_rec" DR_DOMS="$domain_status" DR_TLS="$tls_status" DR_TLSA="$tls_not_after" DR_DOMP="$domain_prov" \
+    DR_DOM="$domain_rec" DR_DOMS="$domain_status" DR_TLS="$tls_status" DR_TLSA="$tls_not_after" DR_DOMP="$domain_prov" DR_LB="$live_binding" \
         python3 -c '
 import json, os, datetime
 state = os.environ.get("DR_STATE") or "anchored"
@@ -10130,6 +10135,7 @@ json.dump({
     "tls_status": os.environ.get("DR_TLS") or "unchecked",
     "tls_not_after": os.environ.get("DR_TLSA", ""),
     "domain_provenance": os.environ.get("DR_DOMP", ""),
+    "live_binding": os.environ.get("DR_LB") or "unchecked",
     "health_http_code": int(os.environ["DR_HC"]) if os.environ.get("DR_HC", "").isdigit() else None,
 }, open(os.environ["DR_OUT"], "w"), indent=2)
 ' 2>/dev/null || return 0
@@ -10228,6 +10234,91 @@ _deploy_probe_health() {
     return 1
 }
 
+# _deploy_provenance_root <dir> <type>
+# Echoes the static root that ships with the deploy and may carry /.well-known/, or "" when no
+# such root exists. nextjs and Vite: public/. Built static: the detected dist/ then build/.
+# docker, python and node serve no static root, so they print "" and are never bound.
+_deploy_provenance_root() {
+    local dir="${1:-.}" type="${2:-}"
+    case "$type" in
+        nextjs) printf '%s' "$dir/public" ;;
+        static)
+            if [ -f "$dir/dist/index.html" ]; then printf '%s' "$dir/dist"
+            elif [ -f "$dir/build/index.html" ]; then printf '%s' "$dir/build"
+            elif [ -f "$dir/package.json" ] && grep -q '"vite"' "$dir/package.json" 2>/dev/null; then printf '%s' "$dir/public"
+            fi
+            ;;
+    esac
+    return 0
+}
+
+# _deploy_clear_provenance <dir>
+# Removes .well-known/loki-provenance.json from EVERY candidate static root (public/, dist/,
+# build/). Runs before each deploy decides whether to write a fresh doc, so a doc left by an
+# earlier deploy can never ship with a build it does not describe (unanchored override,
+# unsupported type, signing failure, or a root that moved between deploys).
+_deploy_clear_provenance() {
+    local dir="${1:-.}" r
+    for r in public dist build; do
+        rm -f "$dir/$r/.well-known/loki-provenance.json" 2>/dev/null || true
+    done
+    return 0
+}
+
+# _deploy_write_provenance <dir> <root> <head_sha> <tree_sha> <receipt_sha256> <run_id>
+# Writes <root>/.well-known/loki-provenance.json and signs it in place (loki verify
+# --sign-provenance). Called only after the gate (including the dirty-tree check) passed, so the
+# untracked file never dirties the tree that was verified; it is also added to .git/info/exclude
+# so the NEXT deploy's dirty-tree gate does not trip over it. Returns non-zero when not signed.
+_deploy_write_provenance() {
+    local dir="$1" root="$2" head="$3" tree="$4" rsha="$5" rid="$6"
+    local f="$root/.well-known/loki-provenance.json" ex
+    rm -f "$f" 2>/dev/null
+    [ -n "$head" ] && [ -n "$tree" ] && [ -n "$rsha" ] && [ -n "$rid" ] || return 1
+    mkdir -p "$root/.well-known" 2>/dev/null || return 1
+    PV_H="$head" PV_T="$tree" PV_R="$rsha" PV_I="$rid" PV_OUT="$f" python3 -c '
+import json, os, datetime
+json.dump({"schema": "loki.provenance/1", "head_sha": os.environ["PV_H"], "tree_sha": os.environ["PV_T"],
+           "receipt_sha256": os.environ["PV_R"], "run_id": os.environ["PV_I"],
+           "built_at": datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")},
+          open(os.environ["PV_OUT"], "w"), indent=2)
+' 2>/dev/null || { rm -f "$f"; return 1; }
+    ex="$(git -C "$dir" rev-parse --git-path info/exclude 2>/dev/null)" || ex=""
+    if [ -n "$ex" ]; then
+        case "$ex" in /*) ;; *) ex="$dir/$ex" ;; esac
+        grep -qxF '**/.well-known/loki-provenance.json' "$ex" 2>/dev/null \
+            || { mkdir -p "$(dirname "$ex")" 2>/dev/null; printf '%s\n' '**/.well-known/loki-provenance.json' >> "$ex" 2>/dev/null; } || true
+    fi
+    if ! ( cd "$dir" && _loki_bun_delegate engine10 verify --sign-provenance "$f" ) >/dev/null 2>&1; then
+        rm -f "$f"
+        return 1
+    fi
+    return 0
+}
+
+# _deploy_probe_live_binding <dir> <url> <anchor>
+# Fetches <url>/.well-known/loki-provenance.json through loki verify --url --expect-sha.
+# Returns 0 VERIFIED (signature holds and head_sha equals the anchor), 1 MISMATCH (a doc
+# was served but is forged or names a different SHA, still so on the last bounded retry),
+# 2 UNCHECKED (no doc could be fetched or its key is unknown, after a bounded retry with the
+# health-probe tunables). Never VERIFIED on 2.
+_deploy_probe_live_binding() {
+    local dir="$1" url="$2" anchor="$3"
+    local attempts="${LOKI_DEPLOY_HEALTH_ATTEMPTS:-5}" interval="${LOKI_DEPLOY_HEALTH_INTERVAL:-3}" i=0 vrc=2
+    case "$attempts" in ''|*[!0-9]*) attempts=5 ;; esac
+    case "$interval" in ''|*[!0-9]*) interval=3 ;; esac
+    while [ "$i" -lt "$attempts" ]; do
+        i=$((i + 1))
+        vrc=0
+        ( cd "$dir" && _loki_bun_delegate engine10 verify --url "$url" --expect-sha "$anchor" ) >/dev/null 2>&1 || vrc=$?
+        [ "$vrc" -eq 0 ] && return 0
+        [ "$i" -lt "$attempts" ] && [ "$interval" -gt 0 ] && sleep "$interval"
+    done
+    # A mismatch on the last attempt is FAILED; earlier mismatches may be propagation of the previous build.
+    [ "$vrc" -eq 1 ] && return 1
+    return 2
+}
+
 # _deploy_policy_refusal <dir>
 # Echoes a refusal reason when the policy file does not permit a deploy, else "".
 # No policy file: "" (unchanged behaviour). File present and node or check.js
@@ -10607,6 +10698,25 @@ _deploy_try_execute() {
         esac
     fi
 
+    # Provenance doc: shipped with the build so the live URL can prove which SHA it serves.
+    local live_binding="unchecked" prov_root="" prov_written=false
+    prov_root="$(_deploy_provenance_root "$dir" "$type")"
+    # Every branch below starts from no doc: only a doc written by THIS deploy may ship.
+    _deploy_clear_provenance "$dir"
+    if [ "$anchor_state" = "unanchored_overridden" ]; then
+        live_binding="unanchored"
+        echo "Live binding unanchored: the evidence gate was overridden with the anchor UNPROVEN, so no provenance doc is published and the live URL is not bound to ${anchor:0:12}." >&2
+    elif [ -z "$prov_root" ]; then
+        live_binding="unsupported"
+        echo "Live binding unsupported: a ${type} project has no static root to serve /.well-known/loki-provenance.json, so the live URL is not bound to ${anchor:0:12}." >&2
+    elif _deploy_write_provenance "$dir" "$prov_root" "$anchor" "$(git -C "$dir" rev-parse 'HEAD^{tree}' 2>/dev/null || true)" \
+        "$(python3 -c 'import json,sys;print((json.load(open(sys.argv[1])).get("verification") or {}).get("hash") or "")' "$pj" 2>/dev/null || true)" "$run_id"; then
+        prov_written=true
+        echo "Provenance written: ${prov_root}/.well-known/loki-provenance.json"
+    else
+        echo -e "${YELLOW}WARNING: the provenance doc could not be signed, so the live URL will not be bound to this SHA.${NC}" >&2
+    fi
+
     local rc=0 started_at finished_at purl="" canary_out=""
     local -a deploy_argv=()
     read -r -a deploy_argv <<<"$exec_cmd"
@@ -10691,8 +10801,31 @@ _deploy_try_execute() {
         fi
     fi
 
-    if [ "$health_status" = "FAILED_HEALTH" ]; then
+    # Live binding: the deployed URL must serve the provenance doc for THIS anchor.
+    if [ "$prov_written" = true ] && [ "$rc" -eq 0 ] && [ "$health_status" != "FAILED_HEALTH" ] && [ -n "$deployed_url" ]; then
+        echo "Probing live binding: ${deployed_url%/}/.well-known/loki-provenance.json"
+        local lb_rc=0
+        _deploy_probe_live_binding "$dir" "$deployed_url" "$anchor" || lb_rc=$?
+        case "$lb_rc" in
+            0)
+                live_binding="VERIFIED"
+                echo -e "${GREEN}Live binding VERIFIED:${NC} ${deployed_url} serves a signed provenance doc for ${anchor:0:12}."
+                ;;
+            1)
+                live_binding="FAILED"
+                health_status="FAILED_HEALTH"
+                echo -e "${RED}FAILED_HEALTH: ${deployed_url} served a provenance doc that is forged or is not for ${anchor:0:12} (stale or wrong build served).${NC}" >&2
+                ;;
+            *)
+                echo "  Live binding unchecked: no verifiable provenance doc could be fetched from ${deployed_url}. Not a claim the live build is ${anchor:0:12}." >&2
+                ;;
+        esac
+    fi
+
+    if [ "$health_status" = "FAILED_HEALTH" ] && [ "$live_binding" != "FAILED" ]; then
         echo -e "${RED}FAILED_HEALTH: ${health_url} did not return 2xx${health_match:+ containing \"${health_match}\"} (last status ${hcode:-000}).${NC}" >&2
+    fi
+    if [ "$health_status" = "FAILED_HEALTH" ]; then
         if [ "$auto_rollback" = true ] && [ -n "$rb_cmd" ] && ! _deploy_is_destructive "$rb_cmd"; then
             echo "Rolling back: ${rb_cmd}" >&2
             rb_attempted=true
@@ -10731,7 +10864,7 @@ _deploy_try_execute() {
     rec="$(_deploy_record "$dir" "$exec_disp" "$rc" "${run_id:-unknown}" "${anchor:-unknown}" \
         "$anchor_state" "$health_status" "$health_url" "$rb_attempted" "$rb_exit" \
         "$rsha" "$started_at" "$finished_at" "${command%% *}" "$canary" "$post_rb" "$hcode" "$health_match" "$(git -C "$dir" rev-parse 'HEAD^{tree}' 2>/dev/null || true)" "$dest" "$deployed_url" "$health_src" "$env_keys" "$env_file" \
-        "$domain" "$_DD_STATUS" "$_DD_TLS" "$_DD_NOTAFTER" "$_DD_PROV")"
+        "$domain" "$_DD_STATUS" "$_DD_TLS" "$_DD_NOTAFTER" "$_DD_PROV" "$live_binding")"
     echo ""
     if [ "$rc" -eq 0 ]; then
         echo -e "${GREEN}Deploy command exited 0.${NC}"
@@ -15488,10 +15621,19 @@ cmd_version() {
         --help|-h|help)
             echo -e "${BOLD}Loki Mode -- print version${NC}"
             echo ""
-            echo "Usage: loki version"
+            echo "Usage: loki version [--json]"
             echo ""
             echo "Prints 'Loki Mode vX.Y.Z' from the VERSION file shipped with"
             echo "the package. Equivalent to 'loki --version' and 'loki -v'."
+            echo ""
+            echo "  --json    Print {\"version\",\"runtime\",\"install_path\"} as one JSON line"
+            return 0
+            ;;
+        --json)
+            local _vp="${SKILL_DIR:-}"
+            _vp="${_vp//\\/\\\\}"
+            _vp="${_vp//\"/\\\"}"
+            printf '{"version":"%s","runtime":"bash","install_path":"%s"}\n' "$(get_version)" "$_vp"
             return 0
             ;;
     esac
@@ -25722,7 +25864,7 @@ except Exception as e:
             echo "Usage: loki memory <command> [args]"
             echo ""
             echo "Learnings Commands:"
-            echo "  list              Show summary of all learnings"
+            echo "  list [--json]     Show summary of all learnings"
             echo "  show [type]       Show entries (patterns|mistakes|successes|all)"
             echo "                    Options: --limit N, --project P"
             echo "  search <query>    Search across all learnings"

package/completions/_loki

@@ -73,6 +73,7 @@ function _loki {
                 doctor)
                     _arguments \
                         '--json[Output machine-readable JSON]' \
+                        '(-q --quiet)'{-q,--quiet}'[Print only failed and warned checks plus the summary]' \
                         '--fix[Create state dirs and a default config; offer claude install and login]' \
                         '--yes[With --fix: run the claude install and login without asking]' \
                         '--help[Show help]'
@@ -164,6 +165,9 @@ function _loki {
                 completions)
                     _arguments '1:shell:(bash zsh install)'
                     ;;
+                version)
+                    _arguments '--json[Print version, runtime and install path as JSON]' '--help[Show help]'
+                    ;;
                 monitor)
                     _directories
                     ;;
@@ -186,6 +190,12 @@ function _loki {
                         '--auto-rollback[Roll back on a failed health probe]' \
                         '--help[Show help]'
                     ;;
+                verify-pr)
+                    _arguments \
+                        '--out[Result directory]:dir:_files -/' \
+                        '--json[Print the verdict object on stdout]' \
+                        '--help[Show help]'
+                    ;;
                 verify)
                     _arguments \
                         '--pubkey[Check against this public key only]:key file:_files' \
@@ -345,7 +355,7 @@ function _loki_commands {
         'bench:Run benchmarks'
         'open:Open a project resource'
         'rc:Release candidate commands'
-        'version:Show version'
+        'version:Show version (--json for machine-readable)'
         'completions:Output shell completions'
         'help:Show help'
     )
@@ -435,7 +445,7 @@ function _loki_provider {
     cmds=(
         'show:Display current provider'
         'set:Set default provider'
-        'list:List available providers'
+        'list:List available providers (--json: name, tier, installed, version)'
         'info:Get provider information (--json: capability contract)'
         'matrix:Show the capability matrix'
         'help:Provider help'

package/completions/loki.bash

@@ -72,6 +72,10 @@ _loki_completion() {
             ;;
 
         provider)
+            if [[ $cword -ge 3 && ( "${words[2]}" == "list" || "${words[2]}" == "info" ) ]]; then
+                COMPREPLY=( $(compgen -W "--json" -- "$cur") )
+                return 0
+            fi
             local provider_cmds="show set list info matrix help"
             COMPREPLY=( $(compgen -W "${provider_cmds}" -- "$cur") )
             ;;
@@ -143,7 +147,7 @@ _loki_completion() {
             ;;
         doctor)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--json --fix --yes --repo --requirements --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--json --quiet --fix --yes --repo --requirements --help" -- "$cur") )
                 return 0
             fi
             ;;
@@ -283,6 +287,13 @@ _loki_completion() {
             return 0
             ;;
 
+        verify-pr)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--out --json --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
         undo)
             if [[ "$cur" == -* ]]; then
                 COMPREPLY=( $(compgen -W "--list --plan --dry-run --help" -- "$cur") )
@@ -335,6 +346,10 @@ _loki_completion() {
             _filedir -d
             ;;
 
+        version)
+            COMPREPLY=( $(compgen -W "--json --help" -- "$cur") )
+            ;;
+
         completions)
             COMPREPLY=( $(compgen -W "bash zsh install" -- "$cur") )
             ;;

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.43"
+__version__ = "11.17.45"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.43. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.45. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |
@@ -71,6 +71,8 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki queue` | Overnight issue queue with a morning digest |
 | `loki queue add` | Queue issue refs |
 | `loki queue list` | Show the queue |
+| `loki queue remove` | Take issue refs out of the queue |
+| `loki queue clear` | Empty the queue |
 | `loki queue run` | Process the queue |
 | `loki issues` | Run every open issue in a repo and open PRs |
 | `loki issues run` | Triage and run open issues; split too-large ones into stacked PRs |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.43
+**Version:** v11.17.45
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/WORKSPACES.md

@@ -55,7 +55,7 @@ After `loki workspace run <name> <ref>` finishes, check the evidence rather than
 3. `.loki/workspaces/<name>/<run-id>/integration.json` holds `status`, the head SHA per repo and `timing`.
 4. `python3 autonomy/lib/workspace_metrics.py <run-dir> --attention-min <minutes>` prints `prs`, `prs_per_hour` and `prs_per_attention_minute`; any value it cannot measure prints `unmeasured`.
 5. Each repo PR for the run branch carries exactly one integration comment.
-6. `loki verify <run-dir>/composite.json` re-checks the composite offline (add `--pubkey FILE` on another machine). It recomputes the composite hash, re-verifies every child receipt from disk and checks the signature. It prints the integration result and every repo head SHA it attests. It is TAMPERED for a tampered or swapped child, a child head that is not the integrated head, a failed or interrupted integration status or nonzero exit code, an edited integration section, or an `integration.log` that no longer matches its recorded hash. It is UNCHECKED for an unsigned child under a signed composite, and for a legacy composite that predates the integration section and has no integrated head to compare. Deployed-SHA binding is not implemented: the composite attests what was integrated and tested, not what is running anywhere. Exit codes are the single-receipt ones: 0 VERIFIED, 1 TAMPERED, 2 UNCHECKED, 3 UNSIGNED. The composite never reads higher than its weakest child: one PARTIAL child caps it at PARTIAL.
+6. `loki verify <run-dir>/composite.json` re-checks the composite offline (add `--pubkey FILE` on another machine). It recomputes the composite hash, re-verifies every child receipt from disk and checks the signature. It prints the integration result and every repo head SHA it attests. It is TAMPERED for a tampered or swapped child, a child head that is not the integrated head, a failed or interrupted integration status or nonzero exit code, an edited integration section, or an `integration.log` that no longer matches its recorded hash. It is UNCHECKED for an unsigned child under a signed composite, and for a legacy composite that predates the integration section and has no integrated head to compare. Deployed-SHA binding is partial: `loki deploy --execute` ships a signed `.well-known/loki-provenance.json` (head_sha, tree_sha, receipt_sha256, run_id, built_at) in the static root of a single-repo nextjs, Vite or built-static project (public/, dist/ or build/) and, when the provider prints a URL, fetches it back through `loki verify --url --expect-sha`. The deploy record's `live_binding` is VERIFIED only when the served doc is signed and names the anchor SHA; a stale or forged doc is FAILED (FAILED_HEALTH, exit 4), an unreachable one is `unchecked`, and docker, python and node projects (no static root) are `unsupported`. A mismatch is retried inside the health attempts and interval budget before it is FAILED, so a URL still serving the previous build for a few seconds is not rolled back at once. A live doc that is unsigned or signed with an unknown key is `unchecked`, not FAILED, so a stale non-loki build serving such a doc passes silently. Under `--allow-unanchored` the anchor is UNPROVEN, so no doc is published and `live_binding` is `unanchored`. The deploy appends `**/.well-known/loki-provenance.json` to `.git/info/exclude` and leaves the file in the working tree. Every `loki deploy --execute` first removes that file from public/, dist/ and build/, so only a doc written by the current deploy ships; an unanchored, unsupported or unsigned deploy ships none. A provider run by hand outside `loki deploy --execute` uploads whatever doc the last loki deploy left, which names that deploy's SHA, not the new build. If the provider rebuilds remotely from a gitignored root, the doc is lost and the result is `unchecked`. None of this binds a composite: the composite attests what was integrated and tested, not what is running anywhere, and no workspace deploy writes or probes a provenance doc. Exit codes are the single-receipt ones: 0 VERIFIED, 1 TAMPERED, 2 UNCHECKED, 3 UNSIGNED. The composite never reads higher than its weakest child: one PARTIAL child caps it at PARTIAL.
 7. A run that could not seal prints `composite not sealed: <reason>` (for example a repo with no receipt). Seal by hand with `loki verify --seal-composite <run-dir>`; it refuses unless every child has a receipt.
 
 Not measured: no scale test exists for large repo counts. Claim only what you have run.