loki-mode 11.17.58 → 11.17.60

package/README.md

@@ -26,7 +26,14 @@ The npm package installs the Bun runtime the engine needs as an optional depende
 Want to see a result before you install or spend anything?
 
 ```bash
-npx loki-mode tour    # prints a real receipt from a past build: no key, no spend, no network
+npx loki-mode start   # no git repo: a real receipt, no key, no spend
+npx loki-mode tour    # the same receipt when you are already inside a repo
+```
+
+`npx` downloads the package the first time, so that step needs the network. The receipt itself replays offline and checks with no provider and no key.
+
+```bash
+npx loki-mode wow     # a provider is ready: one tiny real task in a temp repo, its own receipt
 ```
 
 ## First run
@@ -57,7 +64,7 @@ Every run starts from a delivery contract derived from your task, writes checks
 loki verify              # newest run; or: loki verify <run-id>
 ```
 
-`loki verify` re-hashes the receipt, checks its signature and checks it against the run's event log. It prints a verdict and exits 0 (VERIFIED), 1 (TAMPERED), 2 (UNCHECKED), 3 (UNSIGNED, refused unless `--allow-unsigned`), 4 (run outcome not verified) or 66 (no runs); `[ $rc -eq 0 ]` is the only safe test for "verified". Full table: [docs/exit-codes.md](docs/exit-codes.md). On another machine, export the public key with `loki keys export` and pass it with `loki verify --pubkey <file>`. A receipt claims only what its checks ran, and lists what they did not; signing proves who produced it, not that the code is bug-free. Details: [docs/SIGNED-RECEIPTS.md](docs/SIGNED-RECEIPTS.md).
+`loki verify` re-hashes the receipt, checks its signature and checks it against the run's event log. It prints a verdict and exits 0 (VERIFIED), 1 (TAMPERED), 2 (UNCHECKED), 3 (UNSIGNED, refused unless `--allow-unsigned`), 4 (run outcome not verified) or 66 (no runs); `[ $rc -eq 0 ]` is the only safe test for "verified". `loki start` also requires fail-to-pass for a declared behavior change: a Wall test must fail on the old code and pass after, or the verdict stays PARTIAL (`LOKI_MUTATION_STRICT=0` opts out). Full table: [docs/exit-codes.md](docs/exit-codes.md). On another machine, export the public key with `loki keys export` and pass it with `loki verify --pubkey <file>`. A receipt claims only what its checks ran, and lists what they did not; signing proves who produced it, not that the code is bug-free. Details: [docs/SIGNED-RECEIPTS.md](docs/SIGNED-RECEIPTS.md).
 
 For a multi-repo change set, `loki start --workspace <name> "<brief>"` seals one signed `composite.json` over every child receipt, and `loki verify <run-dir>/composite.json` re-checks it offline ([docs/WORKSPACES.md](docs/WORKSPACES.md)). A composite never reads higher than its weakest child.
 
@@ -91,7 +98,7 @@ Time:       4m12s (intake 11s, plan 20s, implement 3m10s, verify 31s)
 
 | Command | What it does |
 |---------|--------------|
-| `loki start "<task>"` | The primary path: build a task, PRD file or issue, verify it, seal a receipt, open a PR (`--no-pr`, `--deep`, `--provider`, `--max-cost`). `loki "<task>"` and `loki owner/repo#N` are shorthand |
+| `loki start "<task>"` | The command you run: same provider model as a raw session, then the harness re-runs the checks and seals a receipt (`--no-pr`, `--provider`, `--max-cost`, `--haiku` to opt the first implement onto haiku). `loki "<task>"` and `loki owner/repo#N` are shorthand. No task and no git repo shows a receipt and spends nothing |
 | `loki edit "<change>"` | One targeted change in one pass, no PR, plan or council (`--verify`, `--receipt`, `--commit`, `--dry-run`) |
 | `loki quick "<task>"` | One small task with a verify loop, no PR |
 | `loki chat` | Interactive alternative: Plan and Build modes, slash commands, `/run` starts a `loki start` run, `--attach` joins one |
@@ -106,7 +113,9 @@ Time:       4m12s (intake 11s, plan 20s, implement 3m10s, verify 31s)
 | `loki doctor [--fix] [--json]` | Check prerequisites, providers and login; `--fix` applies safe fixes |
 | `loki control serve` | Start the Control Plane (see below) |
 | `loki dashboard` | Open the Control Plane UI, starting it if needed |
-| `loki tour` | Show a sample receipt offline |
+| `loki tour` | Show a sample receipt offline. `loki start` does this when you are not in a git repo and did not pass a task |
+| `loki wow` | Same live mini-task as a normal start, in a temp repo. Offline sample when no provider is ready |
+| `loki factory "<task>"` | Same as `loki start`. The policy line is printed by start |
 | `loki --help` | Everything else; `loki help <command>` for one command |
 
 Core verbs: [docs/CLI-CORE-VERBS.md](docs/CLI-CORE-VERBS.md). Every command (generated): [docs/CLI-REFERENCE.md](docs/CLI-REFERENCE.md). Engine guide, provider table, model routes, custom agents and chat: [docs/v10/GUIDE.md](docs/v10/GUIDE.md). Honest comparison with opencode: [docs/COMPARE-OPENCODE.md](docs/COMPARE-OPENCODE.md).

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.17.58
+# Loki Mode v11.17.60
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -200,7 +200,7 @@ This protocol governs **skill module** loading -- task-scoped instruction files
 <!-- generated:commands -->
 Commands (generated from `loki-ts/src/cli/registry.ts`; full reference in `docs/CLI-REFERENCE.md`):
 
-`version`, `status`, `doctor`, `provider`, `memory`, `rollback`, `backup`, `restore`, `proof`, `wiki`, `control`, `intent`, `kpis`, `report`, `trust`, `crash`, `contract`, `start`, `slack`, `queue`, `issues`, `undo`, `verify-pr`, `answer`, `engine10`, `help`, `chat`, `edit`, `diff`, `models`, `setup`, `quick`, `quickstart`, `init`, `template`, `verify`, `keys`, `review`, `dashboard`, `config`, `mcp`, `acp`, `stop`, `pause`, `resume`, `cancel`, `why`, `next`, `logs`, `ship`, `deploy`, `import`, `github`, `issue`, `ci`, `modernize`, `share`, `assets`, `export`, `notify`, `tour`, `welcome`, `onboard`, `setup-skill`, `self-update`, `remote`, `cockpit`, `code`, `context`, `secrets`, `api`, `sandbox`, `docker`, `web`, `preview`, `telemetry`, `syslog`, `explain`, `docs`, `test`, `bench`, `voice`, `own`, `secure`, `compliance`, `enterprise`, `projects`, `audit`, `cost`, `metrics`, `sentrux`, `magic`, `steer`
+`version`, `status`, `doctor`, `provider`, `memory`, `rollback`, `backup`, `restore`, `proof`, `wiki`, `control`, `intent`, `kpis`, `report`, `trust`, `crash`, `contract`, `start`, `slack`, `queue`, `issues`, `undo`, `verify-pr`, `answer`, `engine10`, `help`, `chat`, `edit`, `diff`, `models`, `setup`, `quick`, `quickstart`, `init`, `template`, `verify`, `keys`, `review`, `dashboard`, `config`, `mcp`, `acp`, `stop`, `pause`, `resume`, `cancel`, `why`, `next`, `logs`, `ship`, `deploy`, `import`, `github`, `issue`, `ci`, `modernize`, `share`, `assets`, `export`, `notify`, `tour`, `wow`, `factory`, `welcome`, `onboard`, `setup-skill`, `self-update`, `remote`, `cockpit`, `code`, `context`, `secrets`, `api`, `sandbox`, `docker`, `web`, `preview`, `telemetry`, `syslog`, `explain`, `docs`, `test`, `bench`, `voice`, `own`, `secure`, `compliance`, `enterprise`, `projects`, `audit`, `cost`, `metrics`, `sentrux`, `magic`, `steer`
 <!-- /generated -->
 
 ---
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.17.58 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.17.60 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.17.58
+11.17.60

package/autonomy/lib/engine10-push.sh

@@ -8,6 +8,16 @@
 #   engine10-push.sh issue-comment [--update] <issue-ref> <body-file>
 #   engine10-push.sh status  <sha> <pending|success|failure|error> <description>
 #
+# Fork mode: when gh reports the authenticated user cannot push to the pinned
+# repo (permissions.push false), push-pr pushes to that user's fork (created
+# if missing, verified as a fork of the pinned repo owned by that user) and
+# opens the PR upstream from <user>:<branch>. A draft run in fork mode pushes
+# to the fork only and exits 4: Loki does not open draft PRs on a repository
+# the user cannot push to. issue-comment (status and backstop comments) is a
+# no-op there for the same reason; a receipt comment on the user's own PR is
+# still posted. LOKI_PR_FORK=0 turns fork mode off (the direct push runs and
+# fails as before). No token is needed beyond the user's gh/git login.
+#
 # Holds GitHub credentials, runs no LLM, reads no untrusted text. Inputs come
 # only from argv and the origin pinned by P0 before any provider ran
 # (_LOKI_ORIGIN_PINNED=1 _LOKI_PINNED_ORIGIN=<url>). The target repository is
@@ -128,6 +138,37 @@ _e10_find_pr() {
         --jq "[.[] | select(.isCrossRepository == false and .state == \"OPEN\" and (.headRepositoryOwner.login | ascii_downcase) == \"$(printf '%s' "$owner" | tr '[:upper:]' '[:lower:]')\")] | .[0].url // empty"
 }
 
+# Fork mode probe. Prints true, false, or nothing (unknown: gh failed or did not say). Only a literal false means no push
+# access; anything else keeps the direct path (fail open, so a gh hiccup never reroutes a push the user could make).
+_e10_can_push() { _e10_gh api "repos/$_e10_repo" --jq '.permissions.push' 2>/dev/null | head -n 1; }
+_e10_fork_off() { [ "${LOKI_PR_FORK:-}" = "0" ]; }
+# Creates or finds the gh user's fork of the pinned repo; prints OWNER/REPO only after gh confirms it is a fork of
+# that repo owned by that user. A fork can take a few seconds to appear after the create call.
+_e10_fork() {
+    local me="$1" fork="" info i
+    fork="$(_e10_gh api -X POST "repos/$_e10_repo/forks" --jq .full_name 2>/dev/null | head -n 1)" || fork=""
+    [[ "$fork" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] || return 1
+    for i in 1 2 3 4 5 6; do
+        info="$(_e10_gh api "repos/$fork" --jq '[(.fork|tostring), (.parent.full_name // ""), .owner.login] | join(" ")' 2>/dev/null)" || info=""
+        if [ -n "$info" ]; then
+            [ "$(printf '%s' "$info" | tr '[:upper:]' '[:lower:]')" = "$(printf 'true %s %s' "$_e10_repo" "$me" | tr '[:upper:]' '[:lower:]')" ] || return 1
+            printf '%s\n' "$fork"
+            return 0
+        fi
+        [ "$i" -lt 6 ] && sleep 2
+    done
+    return 3 # the fork exists by name but GitHub has not served it yet
+}
+# Fork-mode twin of _e10_find_pr: the open cross-repo PR whose head is <me>:<branch> (--head matches the branch name
+# only; the jq owner filter is what pins it to <me>).
+_e10_find_fork_pr() {
+    local me="$1"
+    case "$me" in '' | *[!A-Za-z0-9_.-]*) return 1 ;; esac
+    _e10_gh pr list --repo "$_e10_repo" --head "$2" --state open \
+        --json url,isCrossRepository,headRepositoryOwner,headRefName,state \
+        --jq "[.[] | select(.isCrossRepository == true and .state == \"OPEN\" and (.headRepositoryOwner.login | ascii_downcase) == \"$(printf '%s' "$me" | tr '[:upper:]' '[:lower:]')\")] | .[0].url // empty"
+}
+
 mode="${1:-}"
 shift || true
 case "$mode" in
@@ -157,6 +198,33 @@ case "$mode" in
             printf 'local://%s#%s\n' "$_LOKI_PINNED_ORIGIN" "$branch"
             exit 0
         fi
+        if ! _e10_fork_off && [ "$(_e10_can_push)" = "false" ]; then
+            # A stacked parent published in fork mode lives on the fork, not upstream, so an upstream base would not exist.
+            [ "${#base[@]}" -eq 0 ] || die "no push access to $_e10_repo: a stacked PR (--base) needs push access there; rerun without LOKI_PR_BASE"
+            _e10_me="$(_e10_gh api user --jq .login 2>/dev/null)" || _e10_me=""
+            [[ "$_e10_me" =~ ^[A-Za-z0-9_.-]+$ ]] || die "no push access to $_e10_repo and the gh user could not be resolved for a fork; run gh auth login"
+            log_info "no push access to $_e10_repo: creating or reusing the fork under $_e10_me (LOKI_PR_FORK=0 turns this off)"
+            _e10_fork_repo="$(_e10_fork "$_e10_me")" || { [ "$?" -eq 3 ] && die "no push access to $_e10_repo: the fork under $_e10_me is still being created on GitHub; rerun to push once it exists"
+                die "no push access to $_e10_repo and its fork under $_e10_me could not be created or verified"; }
+            log_info "no push access to $_e10_repo: pushing to the fork $_e10_fork_repo"
+            _loki_trusted_push _loki_with_github_tokens "$dir" "$branch" "$_e10_fork_repo" || die "push to fork $_e10_fork_repo refused or failed (rc=$?)"
+            if [ "${#draft[@]}" -gt 0 ]; then
+                printf 'fork-only: pushed %s to %s; no draft PR is opened on %s, which you cannot push to. Open one yourself: gh pr create --repo %s --head %s:%s\n' \
+                    "$branch" "$_e10_fork_repo" "$_e10_repo" "$_e10_repo" "$_e10_me" "$branch" >&2
+                exit 4
+            fi
+            url="$(_e10_find_fork_pr "$_e10_me" "$branch")" || die "gh pr list failed"
+            _e10_pr_state=reused
+            if [ -z "$url" ]; then
+                _e10_pr_state=created
+                url="$(_e10_gh pr create --repo "$_e10_repo" --head "$_e10_me:$branch" --title "$title" --body-file "$body" "${base[@]}")" \
+                    || die "gh pr create failed"
+                url="$(printf '%s\n' "$url" | tail -n 1)"
+            fi
+            printf '%s\n' "$_e10_pr_state"
+            printf '%s\n' "$url"
+            exit 0
+        fi
         # RECOVERY: a resumed publish skips the push when the remote branch is already at the local commit.
         _e10_want="$(_e10_git -C "$dir" rev-parse -q --verify "refs/heads/$branch" 2>/dev/null)" || _e10_want=""
         _e10_have=""
@@ -207,6 +275,7 @@ case "$mode" in
         # --update: the status projector. One comment carrying the marker below is edited in place (created when absent),
         # so an issue shows live run state without a new comment per event. Only a comment written by the authenticated
         # gh user counts, and the body file must carry the marker (it is built by the supervisor, never from task text).
+        # The PR receipt comment (<!-- loki-receipt -->) uses the same upsert: a PR number is an issue number to the API.
         _e10_upd=""
         [ "${1:-}" != "--update" ] || { _e10_upd=1; shift; }
         [ "$#" -eq 2 ] || die "usage: issue-comment [--update] <issue-ref> <body-file>"
@@ -214,17 +283,42 @@ case "$mode" in
         case "$num" in '' | *[!0-9]*) die "cannot extract issue number from: $1" ;; esac
         [ -f "$2" ] || die "body file not found: $2"
         [ -z "$_e10_local" ] || { log_info "local origin: no issue to comment on (no-op)"; exit 0; }
+        # Status and backstop comments are for a repo the user maintains; on one they cannot push to they would land on
+        # someone else's issue. The receipt comment rides the user's own PR and is still posted.
+        # The receipt body starts with its marker (receipt_surface.ts); only that first line exempts a comment, so issue
+        # text quoting the marker inside a status body cannot. Unlike push-pr this fails closed: a status or backstop
+        # comment is posted only when gh confirms push access, since a wrong guess is a public comment on someone's issue.
+        if [ "$(head -n 1 -- "$2")" != '<!-- loki-receipt -->' ] && [ "$(_e10_can_push)" != "true" ]; then
+            log_info "push access to $_e10_repo not confirmed: not commenting on its issue $num"
+            exit 0
+        fi
         if [ -n "$_e10_upd" ]; then
-            _e10_marker='<!-- loki-status -->'
-            grep -qF -- "$_e10_marker" "$2" || die "status body must carry $_e10_marker"
+            _e10_marker=""
+            for _e10_m in '<!-- loki-status -->' '<!-- loki-receipt -->'; do
+                if grep -qF -- "$_e10_m" "$2"; then _e10_marker="$_e10_m"; break; fi
+            done
+            [ -n "$_e10_marker" ] || die "status body must carry <!-- loki-status --> or <!-- loki-receipt -->"
             _e10_me="$(_e10_gh api user --jq .login 2>/dev/null)" || _e10_me=""
             _e10_cid=""
+            # A receipt upsert never posts on a failed lookup: that would stack a duplicate and still report success.
+            if [ -z "$_e10_me" ] && [ "$_e10_marker" = '<!-- loki-receipt -->' ]; then die "cannot resolve the gh user for the receipt comment lookup"; fi
             if [ -n "$_e10_me" ]; then
-                _e10_cid="$(_e10_gh api "repos/$_e10_repo/issues/$num/comments" --paginate \
-                    --jq ".[] | select(.user.login == \"$_e10_me\") | select(.body | contains(\"$_e10_marker\")) | .id" 2>/dev/null | head -n 1)" || _e10_cid=""
+                if _e10_ids="$(_e10_gh api "repos/$_e10_repo/issues/$num/comments" --paginate \
+                    --jq ".[] | select(.user.login == \"$_e10_me\") | select(.body | contains(\"$_e10_marker\")) | .id" 2>/dev/null)"; then
+                    _e10_cid="$(printf '%s\n' "$_e10_ids" | head -n 1)"
+                elif [ "$_e10_marker" = '<!-- loki-receipt -->' ]; then
+                    die "receipt comment lookup failed"
+                fi
             fi
             case "$_e10_cid" in
-                '') _e10_gh issue comment "$num" --repo "$_e10_repo" --body-file "$2" || die "gh issue comment failed" ;;
+                '')
+                    # A PR number is not an issue to `gh issue comment`; the receipt marker only ever rides a PR.
+                    if [ "$_e10_marker" = '<!-- loki-receipt -->' ]; then
+                        _e10_gh pr comment "$num" --repo "$_e10_repo" --body-file "$2" || die "gh pr comment failed"
+                    else
+                        _e10_gh issue comment "$num" --repo "$_e10_repo" --body-file "$2" || die "gh issue comment failed"
+                    fi
+                    ;;
                 *[!0-9]*) die "unexpected comment id" ;;
                 *) _e10_gh api -X PATCH "repos/$_e10_repo/issues/comments/$_e10_cid" -F "body=@$2" >/dev/null || die "gh api comment update failed" ;;
             esac

package/autonomy/lib/proof_redact.py

@@ -194,8 +194,31 @@ def _env_assign_sub(m):
 # The password class is [^\s@]+ (stops only at the closing @) so passwords that
 # contain "/" (e.g. postgres://user:p/ss@host) are still fully captured.
 _URI_CREDENTIAL = re.compile(
-    r"\b([A-Za-z][A-Za-z0-9+.\-]*://[^\s:/@]*:)([^\s@]+)(@)"
+    r"\b([A-Za-z][A-Za-z0-9+.\-]{0,63}://[^\s:/@]*:)([^\s@]+)(@)"  # bounded scheme: linear (TEN-SECURITY-26)
 )
+_TOKEN = re.compile(r"\S+")
+
+
+def _redact_uri_credentials(s):
+    """Apply _URI_CREDENTIAL to the part of each whitespace-delimited token up to
+    its last "@". No match ends past that "@" (the password class stops at "@"),
+    and scanning an "@"-free tail from every scheme start is quadratic even with
+    the bounded scheme ("a://" * 16000 took 5.6s). TEN-SECURITY-26 follow-up.
+    Returns (new_string, count)."""
+    total = 0
+
+    def tok(m):
+        nonlocal total
+        t = m.group(0)
+        cut = t.rfind("@") + 1
+        if not cut:
+            return t
+        head, n = _URI_CREDENTIAL.subn(r"\1[REDACTED]\3", t[:cut])
+        total += n
+        return head + t[cut:]
+
+    return _TOKEN.sub(tok, s), total
+
 
 # Absolute user home paths -> ~ . Applied to every string (paths, diffs,
 # brief, summaries). Windows form handled separately to keep the backslash
@@ -289,7 +312,8 @@ def _redact_value(s):
     # Connection-string / URI credentials: scheme://user:PASSWORD@ -> redact
     # the password. Runs before the generic env-assign so the "scheme://user:"
     # prefix is consumed and the assign rule does not double-process it.
-    s, n = _URI_CREDENTIAL.subn(r"\1[REDACTED]\3", s)
+    # The helper applies _URI_CREDENTIAL per token; keep the two in sync.
+    s, n = _redact_uri_credentials(s)
     total += n
 
     # Secret assignments (bare, JSON-quoted, YAML-quoted): keep key, redact value.