loki-mode 11.17.54 → 11.17.55

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.54
+# Loki Mode v11.17.55
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.54 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.55 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.54
+11.17.55

package/autonomy/lib/proof_redact.py

@@ -11,7 +11,7 @@ behavior changes in a way callers must be able to detect.
 Patterns implemented (see R1-proof-of-run-PLAN.md REDACTION RULES):
   - Anthropic keys (sk-ant-...) -> [REDACTED:ANTHROPIC_KEY]
   - OpenAI-style keys (sk-...)  -> [REDACTED:OPENAI_KEY]
-  - Google API keys (AI...)     -> [REDACTED:GOOGLE_KEY]
+  - Google API keys (AIza...)   -> [REDACTED:GOOGLE_KEY]
   - GitHub tokens (gh[pousr]_ and github_pat_) -> [REDACTED:GITHUB_TOKEN]
   - AWS access key ids (AKIA..) -> [REDACTED:AWS_KEY]
   - AWS secret access keys       -> [REDACTED:AWS_SECRET]
@@ -75,8 +75,8 @@ _PATTERNS = [
         re.compile(r"eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+"),
         "[REDACTED:JWT]",
     ),
-    # Google API keys (broad per app_secrets.py:22).
-    (re.compile(r"AI[a-zA-Z0-9_-]{30,}"), "[REDACTED:GOOGLE_KEY]"),
+    # Google API keys: AIza + 35 chars (matches loki-ts redact.ts).
+    (re.compile(r"AIza[A-Za-z0-9_-]{35}"), "[REDACTED:GOOGLE_KEY]"),
     # Generic OpenAI-style keys (after sk-ant- so it does not eat them).
     (re.compile(r"sk-[A-Za-z0-9_-]{20,}"), "[REDACTED:OPENAI_KEY]"),
 ]

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.17.54"
+__version__ = "11.17.55"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.54. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.17.55. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.17.54
+**Version:** v11.17.55
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/BOARD.md

@@ -1366,33 +1366,33 @@ Source: ~/git/autonomi-dev/research/2026-09-30-adoption/SWARM-PROMPT-ADOPTION.md
 | TEN-UX-51 | fix: a first-run folder that holds only .DS_Store (macOS Finder) is refused as non-empty; ignore .DS_Store and other OS metadata files when deciding the folder is empty | loki-ts/src/util/first_run_repo.ts, loki-ts/tests/engine10/preflight.test.ts | LOW | red: cd loki-ts && bun test tests/engine10/preflight.test.ts -t "ds_store only folder" fails; green: passes | released v11.17.54 | Gap: reproduced initEmptyRepo(dirWithOnly.DS_Store) returns {fatal:"not a git repository ... "}; first_run_repo.ts:12 `readdirSync(dir).length === 0` counts dotfiles |
 | TEN-STABILITY-57 | fix: appendRunOutcome is a read-modify-write, so two concurrent runs on one repo lose an outcome; serialize with a lock file or append-only records | loki-ts/src/runner/router/history_store.ts, loki-ts/tests/runner/router_history.test.ts | MEDIUM | red: cd loki-ts && bun test tests/runner/router_history.test.ts -t "concurrent append keeps all" fails; green: passes | released v11.17.54 | Gap: history_store.ts:70 reads the history, appends in memory, then renames a pid-named temp file over the target (lines 73-77); the atomic rename prevents truncation but not a lost update between two processes |
 | TEN-SECURITY-22 | fix: secure-scan silently skips untracked files larger than 1 MB, so a secret in a large new file passes the gate unreported; scan them line by line up to a hard cap and list anything above the cap as an explicit skipped file | loki-ts/src/util/secure_scan.ts, loki-ts/tests/util/secure_scan.test.ts | HIGH | red: cd loki-ts && bun test tests/util/secure_scan.test.ts -t "oversized untracked file" fails; green: passes | released v11.17.54 | Gap: secure_scan.ts:49 MAX_ADDED_FILE_BYTES = 1_000_000 and secure_scan.ts:237 `if (!st.isFile() \|\| st.size > MAX_ADDED_FILE_BYTES) continue;` drops the file with no finding, no error and no skipped count; grep for skipped or unscanned in the file finds nothing |
-| TEN-COST-59 | fix: parseCapUsd accepts ".5" and "5." as dollar caps instead of returning null (which silently drops the cap to the default) | loki-ts/src/e10ext/budget_cap.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget_cap.test.ts -t "bare decimal cap" fails; green: passes | ready@2026-10-17T12:00Z | Gap: budget_cap.ts parseCapUsd regex ^\$?\d+(\.\d+)?$ rejects .5 and 5.; probed: both return null. Chain COST-59, COST-60 (same file); serialize after none |
-| TEN-COST-60 | fix: hasApiKey also counts OPENROUTER_API_KEY and LOKI_MODEL_API_KEY so a run billed through a model route gets a cap instead of source subscription with usd 0 (no cap) | loki-ts/src/e10ext/budget_cap.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget_cap.test.ts -t "route key cap" fails; green: passes | ready@2026-10-17T12:00Z | Gap: budget_cap.ts hasApiKey checks only ANTHROPIC_API_KEY and OPENAI_API_KEY; model_routes.ts:17 and :49 read the other two token vars; probed: only OPENROUTER_API_KEY set resolves {usd:0, source:subscription}. Chain COST-59, COST-60 (same file); serialize after COST-59 |
-| TEN-COST-61 | fix: resolveRunCapS reads the first loki.yaml/loki.yml like resolveCap and cost.profile do, not the last | loki-ts/src/util/run_cap.ts, loki-ts/tests/engine10/fc21_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/fc21_cap.test.ts -t "yaml precedence" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_cap.ts resolveRunCapS uses texts[texts.length-1] while resolveCap and start.ts cost.profile use the first, so one repo with both files gets two different caps |
-| TEN-COST-62 | feature: priorFor returns a cost prior for opus models so the pre-run estimate is shown for opus-routed runs instead of nothing | loki-ts/src/runner/router/cost_preview.ts, loki-ts/tests/runner/cost_preview.test.ts | MEDIUM | red: cd loki-ts && bun test tests/runner/cost_preview.test.ts -t "opus prior" fails; green: passes | ready@2026-10-17T12:00Z | Gap: cost_preview.ts:38 tier is only haiku or sonnet, else null, so a start with an opus model prints no estimate |
-| TEN-SECURITY-23 | fix: redact GOOGLE_KEY rule requires the AIza prefix shape so ordinary identifiers starting with AI are not rewritten in logs and receipts | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "google key shape" fails; green: passes | ready@2026-10-17T12:00Z | Gap: redact.ts GOOGLE_KEY /AI[a-zA-Z0-9_-]{30,}/g matches any 32+ char identifier starting AI (over-redaction corrupts evidence). Chain SECURITY-23, 24, 25 (same file); serialize after none |
-| TEN-SECURITY-24 | feature: redact adds Slack webhook URLs, sk_test_ and rk_ Stripe keys, and whsec_ webhook secrets | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "slack stripe redact" fails; green: passes | ready@2026-10-17T12:00Z | Gap: redact.ts RULES has no pattern for hooks.slack.com/services, sk_test_, or whsec_; a pasted token reaches events and receipts unredacted. Chain SECURITY-23, 24, 25; serialize after SECURITY-23 |
+| TEN-COST-59 | fix: parseCapUsd accepts ".5" and "5." as dollar caps instead of returning null (which silently drops the cap to the default) | loki-ts/src/e10ext/budget_cap.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget_cap.test.ts -t "bare decimal cap" fails; green: passes | released v11.17.55 | Gap: budget_cap.ts parseCapUsd regex ^\$?\d+(\.\d+)?$ rejects .5 and 5.; probed: both return null. Chain COST-59, COST-60 (same file); serialize after none |
+| TEN-COST-60 | fix: hasApiKey also counts OPENROUTER_API_KEY and LOKI_MODEL_API_KEY so a run billed through a model route gets a cap instead of source subscription with usd 0 (no cap) | loki-ts/src/e10ext/budget_cap.ts, loki-ts/tests/engine10/budget_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/budget_cap.test.ts -t "route key cap" fails; green: passes | released v11.17.55 | Gap: budget_cap.ts hasApiKey checks only ANTHROPIC_API_KEY and OPENAI_API_KEY; model_routes.ts:17 and :49 read the other two token vars; probed: only OPENROUTER_API_KEY set resolves {usd:0, source:subscription}. Chain COST-59, COST-60 (same file); serialize after COST-59 |
+| TEN-COST-61 | fix: resolveRunCapS reads the first loki.yaml/loki.yml like resolveCap and cost.profile do, not the last | loki-ts/src/util/run_cap.ts, loki-ts/tests/engine10/fc21_cap.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/fc21_cap.test.ts -t "yaml precedence" fails; green: passes | released v11.17.55 | Gap: run_cap.ts resolveRunCapS uses texts[texts.length-1] while resolveCap and start.ts cost.profile use the first, so one repo with both files gets two different caps |
+| TEN-COST-62 | feature: priorFor returns a cost prior for opus models so the pre-run estimate is shown for opus-routed runs instead of nothing | loki-ts/src/runner/router/cost_preview.ts, loki-ts/tests/runner/cost_preview.test.ts | MEDIUM | red: cd loki-ts && bun test tests/runner/cost_preview.test.ts -t "opus prior" fails; green: passes | released v11.17.55 | Gap: cost_preview.ts:38 tier is only haiku or sonnet, else null, so a start with an opus model prints no estimate |
+| TEN-SECURITY-23 | fix: redact GOOGLE_KEY rule requires the AIza prefix shape so ordinary identifiers starting with AI are not rewritten in logs and receipts | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "google key shape" fails; green: passes | released v11.17.55 | Gap: redact.ts GOOGLE_KEY /AI[a-zA-Z0-9_-]{30,}/g matches any 32+ char identifier starting AI (over-redaction corrupts evidence). Chain SECURITY-23, 24, 25 (same file); serialize after none |
+| TEN-SECURITY-24 | feature: redact adds Slack webhook URLs, sk_test_ and rk_ Stripe keys, and whsec_ webhook secrets | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "slack stripe redact" fails; green: passes | released v11.17.55 | Gap: redact.ts RULES has no pattern for hooks.slack.com/services, sk_test_, or whsec_; a pasted token reaches events and receipts unredacted. Chain SECURITY-23, 24, 25; serialize after SECURITY-23 |
 | TEN-SECURITY-25 | feature: redact masks the value of key=value and key: value assignments for password, secret, token and api_key names | loki-ts/src/util/redact.ts, loki-ts/tests/util/redact.test.ts | HIGH | red: cd loki-ts && bun test tests/util/redact.test.ts -t "assignment redact" fails; green: passes | ready@2026-10-17T12:00Z | Gap: redact.ts RULES match only token-shaped literals; password=hunter2 passes through unchanged. Chain SECURITY-23, 24, 25; serialize after SECURITY-24 |
-| TEN-STABILITY-58 | fix: yamlKey reads flow-style maps such as budgets: { per_run: 5 } instead of ignoring them (the default 100 dollar cap then applies silently) | loki-ts/src/util/yaml_key.ts, loki-ts/tests/util/yaml_key.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/yaml_key.test.ts -t "flow style" fails; green: passes | ready@2026-10-17T12:00Z | Gap: yaml_key.ts yamlKey handles block style only; probed: flow style returns undefined so resolve falls to the default cap |
-| TEN-STABILITY-59 | fix: loki undo validates the run id before the LOKI_UNDO gate so a bad id reports usage, not the gate message | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/undo.test.ts -t "undo id before gate" fails; green: passes | ready@2026-10-17T12:00Z | Gap: undo.ts runUndo checks the LOKI_UNDO gate (line 239) before loadPlan validates the run id (isRunId, line 44) |
-| TEN-STABILITY-60 | enhancement: pauseTimeoutMs warns once on stderr when the pause timeout env is set but not a positive number, then uses the default | loki-ts/src/util/run_control.ts, loki-ts/tests/util/run_control.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/run_control.test.ts -t "pause timeout warn" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_control.ts pauseTimeoutMs falls back silently on garbage. Chain STABILITY-60, 61 (same file); serialize after none |
-| TEN-STABILITY-61 | enhancement: runControlBoundary records reason timeout_abandon on the cancel event when a pause expires, distinct from a user cancel | loki-ts/src/util/run_control.ts, loki-ts/tests/util/run_control.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/run_control.test.ts -t "timeout abandon event" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_control.ts runControlBoundary emits identical cancel events for a user cancel and a timeout abandon. Chain STABILITY-60, 61; serialize after STABILITY-60 |
-| TEN-STABILITY-62 | fix: queue add rejects issue number 0 for owner/repo#0 and bare 0 | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: cd loki-ts && bun test tests/commands/queue.test.ts -t "queue zero issue" fails; green: passes | ready@2026-10-17T12:00Z | Gap: queue.ts accepts queue add 0 and a/b#0; probed: both exit 0 and enqueue an unrunnable item |
-| TEN-STABILITY-63 | fix: engine10 supervisor main exits 2 with a usage line when --spec or --max-cost has no value, instead of treating it as an empty string | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/supervisor_signal.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/supervisor_signal.test.ts -t "missing flag value" fails; green: passes | ready@2026-10-17T12:00Z | Gap: supervisor.ts main arg parser turns --spec and --max-cost with a missing value into ""; the git-repo check then runs before resolveCap so the user sees an unrelated error |
-| TEN-STABILITY-65 | fix: internal handoff requires an explicit positive consecutive-failure count instead of defaulting a missing count to 0 | loki-ts/src/commands/internal_phase1.ts, loki-ts/tests/commands/internal_phase1.test.ts | LOW | red: cd loki-ts && bun test tests/commands/internal_phase1.test.ts -t "handoff count" fails; green: passes | ready@2026-10-17T12:00Z | Gap: internal_phase1.ts runHandoff: parseInt(argv[1] ?? "0") makes a missing count 0 and Number.isFinite accepts it and negatives |
-| TEN-UX-52 | fix: loki provider show with an unknown provider exits 2 and lists valid providers | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: cd loki-ts && bun test tests/commands/provider.test.ts -t "unknown provider" fails; green: passes | ready@2026-10-17T12:00Z | Gap: provider.ts runProviderShow accepts an unknown provider with exit 0 |
-| TEN-UX-53 | enhancement: loki --version and loki version reject extra positional arguments with exit 2 | loki-ts/src/commands/version.ts, loki-ts/tests/commands/version.test.ts | LOW | red: cd loki-ts && bun test tests/commands/version.test.ts -t "version extra args" fails; green: passes | ready@2026-10-17T12:00Z | Gap: version.ts ignores extra positionals; probed: loki version bogus prints the version and exits 0 |
-| TEN-UX-54 | fix: loki stats writes the Unknown option message to stderr, not stdout, so --json consumers get clean output | loki-ts/src/commands/stats.ts, loki-ts/tests/commands/stats.test.ts | LOW | red: cd loki-ts && bun test tests/commands/stats.test.ts -t "stats unknown to stderr" fails; green: passes | ready@2026-10-17T12:00Z | Gap: stats.ts computeStats returns the Unknown option text as stdout with exitCode 2 (lines 491-497) |
-| TEN-UX-55 | feature: preflight fails early with a one-line fix when the repo directory is not writable | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/preflight.test.ts -t "repo writable" fails; green: passes | ready@2026-10-17T12:00Z | Gap: preflight.ts checkPreflight has no writability probe, so a read-only checkout fails mid-run on the first write. Chain ADOPTION-34, UX-55 (same file); serialize after ADOPTION-34 |
-| TEN-ADOPTION-34 | feature: preflight probes login state for codex, cline, aider and opencode like it does for claude, so loki start names the missing login before spending | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/preflight.test.ts -t "provider login probe" fails; green: passes | ready@2026-10-17T12:00Z | Gap: preflight.ts checkPreflight has login probes only for claude. Chain ADOPTION-34, UX-55; serialize after none |
-| TEN-UX-56 | fix: loki start rejects a repeated single-value flag (--cap, --provider) with exit 2 instead of silently using the first | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/start.test.ts -t "duplicate flag" fails; green: passes | ready@2026-10-17T12:00Z | Gap: start.ts argVal is first-occurrence-wins, so loki start p.md --cap 1 --cap 50 runs with 1 and says nothing. Serialize after the AQ start.ts chain (TEN-UX-48, 50, DEPLOY-26, UX-47, 46, 45) |
-| TEN-SPEED-24 | enhancement: run_status pickRun orders runs by events.jsonl mtime and reads only the newest, instead of reading every run's events file | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/run_status.test.ts -t "pickRun mtime" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_status.ts pickRun reads every run's events.jsonl, so loki status gets slower with each run |
-| TEN-UX-57 | fix: loki status rejects unknown flags that follow a valid one (--json --bogus) with exit 1 like a leading unknown flag | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | LOW | red: cd loki-ts && bun test tests/commands/status.test.ts -t "status trailing flag" fails; green: passes | ready@2026-10-17T12:00Z | Gap: status.ts runStatus returns on the first recognised flag (lines 1038-1047), so later flags are never checked |
-| TEN-ADOPTION-35 | enhancement: doctor --fix seeds the default provider from the first installed provider CLI instead of hardcoding claude | loki-ts/src/commands/doctor_fix.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "seed provider" fails; green: passes | ready@2026-10-17T12:00Z | Gap: doctor_fix.ts step 2 writes {provider: claude} even when only codex is installed. Chain ADOPTION-35, UX-58 (same file); serialize after none |
-| TEN-UX-58 | enhancement: doctor --fix backs up an invalid .loki/config/settings.json and rewrites defaults when consent is given, instead of only printing a manual line | loki-ts/src/commands/doctor_fix.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "repair settings" fails; green: passes | ready@2026-10-17T12:00Z | Gap: doctor_fix.ts lines 120-124 push a manual line for invalid JSON and never repair it. Chain ADOPTION-35, UX-58; serialize after ADOPTION-35 |
-| TEN-QUALITY-40 | enhancement: doctor.ts uses one shared version comparator instead of three copies | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "one semver compare" fails; green: passes | ready@2026-10-17T12:00Z | Gap: doctor.ts has three hand-rolled comparators (lines 98, 318, 567); extend-never-duplicate. Serialize after ADOPTION-35, UX-58 (shared doctor.test.ts) |
-| TEN-SPEED-25 | fix: resolveLatest caches a failed registry fetch for a short period so an offline machine does not wait on the network every command | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: cd loki-ts && bun test tests/util/update_check.test.ts -t "negative cache" fails; green: passes | ready@2026-10-17T12:00Z | Gap: update_check.ts resolveLatest returns null at the failed fetch without writeCache (line 129-130), so offline runs retry each time. Chain SPEED-25, DEPLOY-27 (same file); serialize after none |
-| TEN-DEPLOY-27 | feature: updateCommandFor returns pnpm and yarn global upgrade hints for pnpm and yarn installs | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: cd loki-ts && bun test tests/util/update_check.test.ts -t "pnpm yarn hint" fails; green: passes | ready@2026-10-17T12:00Z | Gap: update_check.ts updateCommandFor knows brew, bun and npm paths only; pnpm and yarn installs get the bun hint. Chain SPEED-25, DEPLOY-27; serialize after SPEED-25 |
-| TEN-GATES-31 | fix: policyGate with LOKI_POLICY_REQUIRE_NODE=0 and no node says policy was NOT evaluated in the allow reason so prGate output shows it | loki-ts/src/util/run_outputs.ts, loki-ts/tests/engine10/policy_gate.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/policy_gate.test.ts -t "policy not evaluated" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_outputs.ts:449 returns allow when the env opt-out is set and node is missing; the reason is easy to miss. Chain GATES-31, 32 (same file); serialize after none |
-| TEN-GATES-32 | fix: policyGate reports a check.js timeout as a timeout, not as node being unavailable | loki-ts/src/util/run_outputs.ts, loki-ts/tests/engine10/policy_gate.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/policy_gate.test.ts -t "policy timeout reason" fails; green: passes | ready@2026-10-17T12:00Z | Gap: run_outputs.ts:452-453 spawnSync timeout 30000 sets r.error and the deny reason says node is unavailable. Chain GATES-31, 32; serialize after GATES-31 |
-| TEN-ADOPTION-36 | fix: loki issues run --limit and --parallel accept only plain decimal digits (reject 1e1 and 0x10) | loki-ts/src/commands/issues_run.ts, loki-ts/tests/commands/issues_run.test.ts | LOW | red: cd loki-ts && bun test tests/commands/issues_run.test.ts -t "strict int flags" fails; green: passes | ready@2026-10-17T12:00Z | Gap: issues_run.ts:96 Number(val()) accepts 1e1 and 0x10 as integers. Serialize after TEN-STABILITY-54 (same file) |
+| TEN-STABILITY-58 | fix: yamlKey reads flow-style maps such as budgets: { per_run: 5 } instead of ignoring them (the default 100 dollar cap then applies silently) | loki-ts/src/util/yaml_key.ts, loki-ts/tests/util/yaml_key.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/yaml_key.test.ts -t "flow style" fails; green: passes | released v11.17.55 | Gap: yaml_key.ts yamlKey handles block style only; probed: flow style returns undefined so resolve falls to the default cap |
+| TEN-STABILITY-59 | fix: loki undo validates the run id before the LOKI_UNDO gate so a bad id reports usage, not the gate message | loki-ts/src/commands/undo.ts, loki-ts/tests/commands/undo.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/undo.test.ts -t "undo id before gate" fails; green: passes | released v11.17.55 | Gap: undo.ts runUndo checks the LOKI_UNDO gate (line 239) before loadPlan validates the run id (isRunId, line 44) |
+| TEN-STABILITY-60 | enhancement: pauseTimeoutMs warns once on stderr when the pause timeout env is set but not a positive number, then uses the default | loki-ts/src/util/run_control.ts, loki-ts/tests/util/run_control.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/run_control.test.ts -t "pause timeout warn" fails; green: passes | released v11.17.55 | Gap: run_control.ts pauseTimeoutMs falls back silently on garbage. Chain STABILITY-60, 61 (same file); serialize after none |
+| TEN-STABILITY-61 | enhancement: runControlBoundary records reason timeout_abandon on the cancel event when a pause expires, distinct from a user cancel | loki-ts/src/util/run_control.ts, loki-ts/tests/util/run_control.test.ts | MEDIUM | red: cd loki-ts && bun test tests/util/run_control.test.ts -t "timeout abandon event" fails; green: passes | released v11.17.55 | Gap: run_control.ts runControlBoundary emits identical cancel events for a user cancel and a timeout abandon. Chain STABILITY-60, 61; serialize after STABILITY-60 |
+| TEN-STABILITY-62 | fix: queue add rejects issue number 0 for owner/repo#0 and bare 0 | loki-ts/src/commands/queue.ts, loki-ts/tests/commands/queue.test.ts | LOW | red: cd loki-ts && bun test tests/commands/queue.test.ts -t "queue zero issue" fails; green: passes | released v11.17.55 | Gap: queue.ts accepts queue add 0 and a/b#0; probed: both exit 0 and enqueue an unrunnable item |
+| TEN-STABILITY-63 | fix: engine10 supervisor main exits 2 with a usage line when --spec or --max-cost has no value, instead of treating it as an empty string | loki-ts/src/engine10/supervisor.ts, loki-ts/tests/engine10/supervisor_signal.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/supervisor_signal.test.ts -t "missing flag value" fails; green: passes | released v11.17.55 | Gap: supervisor.ts main arg parser turns --spec and --max-cost with a missing value into ""; the git-repo check then runs before resolveCap so the user sees an unrelated error |
+| TEN-STABILITY-65 | fix: internal handoff requires an explicit positive consecutive-failure count instead of defaulting a missing count to 0 | loki-ts/src/commands/internal_phase1.ts, loki-ts/tests/commands/internal_phase1.test.ts | LOW | red: cd loki-ts && bun test tests/commands/internal_phase1.test.ts -t "handoff count" fails; green: passes | released v11.17.55 | Gap: internal_phase1.ts runHandoff: parseInt(argv[1] ?? "0") makes a missing count 0 and Number.isFinite accepts it and negatives |
+| TEN-UX-52 | fix: loki provider show with an unknown provider exits 2 and lists valid providers | loki-ts/src/commands/provider.ts, loki-ts/tests/commands/provider.test.ts | LOW | red: cd loki-ts && bun test tests/commands/provider.test.ts -t "unknown provider" fails; green: passes | released v11.17.55 | Gap: provider.ts runProviderShow accepts an unknown provider with exit 0 |
+| TEN-UX-53 | enhancement: loki --version and loki version reject extra positional arguments with exit 2 | loki-ts/src/commands/version.ts, loki-ts/tests/commands/version.test.ts | LOW | red: cd loki-ts && bun test tests/commands/version.test.ts -t "version extra args" fails; green: passes | released v11.17.55 | Gap: version.ts ignores extra positionals; probed: loki version bogus prints the version and exits 0 |
+| TEN-UX-54 | fix: loki stats writes the Unknown option message to stderr, not stdout, so --json consumers get clean output | loki-ts/src/commands/stats.ts, loki-ts/tests/commands/stats.test.ts | LOW | red: cd loki-ts && bun test tests/commands/stats.test.ts -t "stats unknown to stderr" fails; green: passes | released v11.17.55 | Gap: stats.ts computeStats returns the Unknown option text as stdout with exitCode 2 (lines 491-497) |
+| TEN-UX-55 | feature: preflight fails early with a one-line fix when the repo directory is not writable | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/preflight.test.ts -t "repo writable" fails; green: passes | released v11.17.55 | Gap: preflight.ts checkPreflight has no writability probe, so a read-only checkout fails mid-run on the first write. Chain ADOPTION-34, UX-55 (same file); serialize after ADOPTION-34 |
+| TEN-ADOPTION-34 | feature: preflight probes login state for codex, cline, aider and opencode like it does for claude, so loki start names the missing login before spending | loki-ts/src/engine10/preflight.ts, loki-ts/tests/engine10/preflight.test.ts | MEDIUM | red: cd loki-ts && bun test tests/engine10/preflight.test.ts -t "provider login probe" fails; green: passes | released v11.17.55 | Gap: preflight.ts checkPreflight has login probes only for claude. Chain ADOPTION-34, UX-55; serialize after none |
+| TEN-UX-56 | fix: loki start rejects a repeated single-value flag (--cap, --provider) with exit 2 instead of silently using the first | loki-ts/src/commands/start.ts, loki-ts/tests/commands/start.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/start.test.ts -t "duplicate flag" fails; green: passes | released v11.17.55 | Gap: start.ts argVal is first-occurrence-wins, so loki start p.md --cap 1 --cap 50 runs with 1 and says nothing. Serialize after the AQ start.ts chain (TEN-UX-48, 50, DEPLOY-26, UX-47, 46, 45) |
+| TEN-SPEED-24 | enhancement: run_status pickRun orders runs by events.jsonl mtime and reads only the newest, instead of reading every run's events file | loki-ts/src/commands/run_status.ts, loki-ts/tests/commands/run_status.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/run_status.test.ts -t "pickRun mtime" fails; green: passes | released v11.17.55 | Gap: run_status.ts pickRun reads every run's events.jsonl, so loki status gets slower with each run |
+| TEN-UX-57 | fix: loki status rejects unknown flags that follow a valid one (--json --bogus) with exit 1 like a leading unknown flag | loki-ts/src/commands/status.ts, loki-ts/tests/commands/status.test.ts | LOW | red: cd loki-ts && bun test tests/commands/status.test.ts -t "status trailing flag" fails; green: passes | released v11.17.55 | Gap: status.ts runStatus returns on the first recognised flag (lines 1038-1047), so later flags are never checked |
+| TEN-ADOPTION-35 | enhancement: doctor --fix seeds the default provider from the first installed provider CLI instead of hardcoding claude | loki-ts/src/commands/doctor_fix.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "seed provider" fails; green: passes | released v11.17.55 | Gap: doctor_fix.ts step 2 writes {provider: claude} even when only codex is installed. Chain ADOPTION-35, UX-58 (same file); serialize after none |
+| TEN-UX-58 | enhancement: doctor --fix backs up an invalid .loki/config/settings.json and rewrites defaults when consent is given, instead of only printing a manual line | loki-ts/src/commands/doctor_fix.ts, loki-ts/tests/commands/doctor.test.ts | MEDIUM | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "repair settings" fails; green: passes | released v11.17.55 | Gap: doctor_fix.ts lines 120-124 push a manual line for invalid JSON and never repair it. Chain ADOPTION-35, UX-58; serialize after ADOPTION-35 |
+| TEN-QUALITY-40 | enhancement: doctor.ts uses one shared version comparator instead of three copies | loki-ts/src/commands/doctor.ts, loki-ts/tests/commands/doctor.test.ts | LOW | red: cd loki-ts && bun test tests/commands/doctor.test.ts -t "one semver compare" fails; green: passes | released v11.17.55 | Gap: doctor.ts has three hand-rolled comparators (lines 98, 318, 567); extend-never-duplicate. Serialize after ADOPTION-35, UX-58 (shared doctor.test.ts) |
+| TEN-SPEED-25 | fix: resolveLatest caches a failed registry fetch for a short period so an offline machine does not wait on the network every command | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: cd loki-ts && bun test tests/util/update_check.test.ts -t "negative cache" fails; green: passes | released v11.17.55 | Gap: update_check.ts resolveLatest returns null at the failed fetch without writeCache (line 129-130), so offline runs retry each time. Chain SPEED-25, DEPLOY-27 (same file); serialize after none |
+| TEN-DEPLOY-27 | feature: updateCommandFor returns pnpm and yarn global upgrade hints for pnpm and yarn installs | loki-ts/src/util/update_check.ts, loki-ts/tests/util/update_check.test.ts | LOW | red: cd loki-ts && bun test tests/util/update_check.test.ts -t "pnpm yarn hint" fails; green: passes | released v11.17.55 | Gap: update_check.ts updateCommandFor knows brew, bun and npm paths only; pnpm and yarn installs get the bun hint. Chain SPEED-25, DEPLOY-27; serialize after SPEED-25 |
+| TEN-GATES-31 | fix: policyGate with LOKI_POLICY_REQUIRE_NODE=0 and no node says policy was NOT evaluated in the allow reason so prGate output shows it | loki-ts/src/util/run_outputs.ts, loki-ts/tests/engine10/policy_gate.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/policy_gate.test.ts -t "policy not evaluated" fails; green: passes | released v11.17.55 | Gap: run_outputs.ts:449 returns allow when the env opt-out is set and node is missing; the reason is easy to miss. Chain GATES-31, 32 (same file); serialize after none |
+| TEN-GATES-32 | fix: policyGate reports a check.js timeout as a timeout, not as node being unavailable | loki-ts/src/util/run_outputs.ts, loki-ts/tests/engine10/policy_gate.test.ts | HIGH | red: cd loki-ts && bun test tests/engine10/policy_gate.test.ts -t "policy timeout reason" fails; green: passes | released v11.17.55 | Gap: run_outputs.ts:452-453 spawnSync timeout 30000 sets r.error and the deny reason says node is unavailable. Chain GATES-31, 32; serialize after GATES-31 |
+| TEN-ADOPTION-36 | fix: loki issues run --limit and --parallel accept only plain decimal digits (reject 1e1 and 0x10) | loki-ts/src/commands/issues_run.ts, loki-ts/tests/commands/issues_run.test.ts | LOW | red: cd loki-ts && bun test tests/commands/issues_run.test.ts -t "strict int flags" fails; green: passes | released v11.17.55 | Gap: issues_run.ts:96 Number(val()) accepts 1e1 and 0x10 as integers. Serialize after TEN-STABILITY-54 (same file) |

package/docs/v10/PROGRESS.md

@@ -2542,3 +2542,6 @@ v11.17.21 published (Release success on 462fbc40a; npm latest 11.17.21, next 11.
 
 ## 2026-10-17T14:35Z (CoS) v11.17.54
 - Wave AQ released (30 rows, 19 chains, every reviewer APPROVE by SHA, ancestry checked) plus Q18-03e (opus round 5 APPROVE e41ef40b2 after 5 BLOCK rounds); evidence in ~/loki-ci-logs/aq-check.log.
+
+## 2026-10-17T14:50Z (CoS) v11.17.55
+- Wave AR released (29 rows, 19 chains, reviewer APPROVE by SHA, ancestry checked; TEN-SECURITY-25 held at BLOCK 30fd64ba8 for a fix round). Combined checks in ~/loki-ci-logs/ar-check.log: build OK, bun test 533 pass 1 fail (known engine10 core budget, fix in flight), drift guards rc=0, control-plane 33 pass; tsc red on queue.ts:75 fixed in a2a21c137 (tsc OK, queue.test.ts 29 pass 0 fail).