loki-mode 11.2.2 → 11.3.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: An autonomous software factory that knows what it is supposed to deliver, and proves it did. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.2.2
+# Loki Mode v11.3.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the legacy engine, which still ships and is being removed (`loki start owner/repo#N` still routes to it; prefer `loki owner/repo#N`).
 
@@ -483,4 +483,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v11.2.2 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.3.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.2.2
+11.3.0

package/autonomy/lib/skill-link-heal.sh

@@ -13,6 +13,9 @@
 #   - its target is missing, or resolves to a different install than the running one
 #   - the running root is itself an install path with a SKILL.md, so a dev checkout
 #     or worktree never hijacks the user's global link
+#   - the running install is durable (npm global root, bun global dir, Homebrew
+#     prefix); an npx cache, temp dir or arbitrary prefix is refused with one
+#     stderr line and the link is left untouched
 
 _loki_skill_is_install_path() {
     case "${1%/}" in
@@ -21,9 +24,75 @@ _loki_skill_is_install_path() {
     return 1
 }
 
+# Durable-install rule (FC-30 amendment). A repoint writes a user-owned path, so
+# the running install must outlive this process: a one-off `npx loki-mode` run or
+# a scratch prefix would turn the link into a new dangling link. Durable means
+# the running root sits under the npm global root (`npm root -g`), the bun global
+# dir, or a Homebrew prefix. Prints a reason and returns 1 when it is not.
+_loki_skill_dir_p() { (cd "$1" 2>/dev/null && pwd -P); }
+
+# `npm root -g` bounded to 3s so a hung npm can never hang bin/loki. Output goes
+# to a file (not a pipe) so an orphaned grandchild cannot hold the caller open.
+# Returns 124 on timeout (callers fail closed), otherwise npm's own status.
+_loki_skill_npm_root() {
+    local out pid i=0 rc
+    out="$(mktemp "${TMPDIR:-/tmp}/loki-npmroot.XXXXXX")" || return 1
+    npm root -g >"$out" 2>/dev/null </dev/null &
+    pid=$!
+    while kill -0 "$pid" 2>/dev/null; do
+        if [ "$i" -ge 30 ]; then
+            kill "$pid" 2>/dev/null
+            rm -f "$out"
+            return 124
+        fi
+        sleep 0.1
+        i=$((i + 1))
+    done
+    wait "$pid"; rc=$?
+    [ "$rc" -eq 0 ] && head -n 1 "$out"
+    rm -f "$out"
+    return "$rc"
+}
+
+_loki_skill_root_durable() {
+    local root_p="$1" cand cands="" npmroot prefix rc
+    case "$root_p" in
+        */_npx/*) printf 'running from an npx cache (%s)' "$root_p"; return 1 ;;
+    esac
+    npmroot="$(_loki_skill_npm_root)"; rc=$?
+    if [ "$rc" -eq 124 ]; then
+        printf 'npm root -g timed out (running install %s not verified durable)' "$root_p"
+        return 1
+    fi
+    [ "$rc" -eq 0 ] || npmroot=""
+    [ -n "$npmroot" ] && cands="$cands
+$npmroot"
+    [ -n "${NPM_CONFIG_PREFIX:-}" ] && cands="$cands
+${NPM_CONFIG_PREFIX}/lib/node_modules"
+    cands="$cands
+${BUN_INSTALL:-${HOME:-}/.bun}/install/global/node_modules"
+    for prefix in "${HOMEBREW_PREFIX:-}" /opt/homebrew /usr/local /home/linuxbrew/.linuxbrew; do
+        [ -n "$prefix" ] || continue
+        cands="$cands
+$prefix/Cellar/loki-mode
+$prefix/opt/loki-mode
+$prefix/lib/node_modules"
+    done
+    while IFS= read -r cand; do
+        [ -n "$cand" ] || continue
+        cand="$(_loki_skill_dir_p "$cand")" || continue
+        [ "$root_p" = "$cand" ] && return 0
+        case "$root_p" in "$cand"/*) return 0 ;; esac
+    done <<EOT
+$cands
+EOT
+    printf 'running install %s is not a durable global install (npm global, bun global or Homebrew)' "$root_p"
+    return 1
+}
+
 loki_skill_link_heal() {
     [ "${LOKI_NO_SKILL_LINK_HEAL:-}" = "1" ] && return 0
-    local root="${1:-}" home="${HOME:-}" root_p rel link tgt live_p tmp
+    local root="${1:-}" home="${HOME:-}" root_p rel link tgt live_p tmp durable="" why
     [ -n "$root" ] && [ -n "$home" ] || return 0
     [ -f "$root/SKILL.md" ] || return 0
     root_p="$(cd "$root" 2>/dev/null && pwd -P)" || return 0
@@ -39,6 +108,14 @@ loki_skill_link_heal() {
             live_p="$(cd "$link" 2>/dev/null && pwd -P)" || live_p=""
             [ "$live_p" = "$root_p" ] && continue
         fi
+        if [ -z "$durable" ]; then
+            if why="$(_loki_skill_root_durable "$root_p")"; then
+                durable=yes
+            else
+                printf 'loki: not repointing skill links: %s\n' "$why" >&2
+                return 0
+            fi
+        fi
         tmp="${link}.heal.$$"
         rm -f "$tmp" 2>/dev/null
         ln -s "$root_p" "$tmp" 2>/dev/null || continue

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "11.2.2"
+__version__ = "11.3.0"
 
 # Expose the control app for easy import
 try:

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.2.2. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.3.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v11.2.2
+**Version:** v11.3.0
 
 **Engine note:** `loki "<task>"`, `loki owner/repo#N` and `loki quick` run the Loki 10 engine. `loki start` still routes to the legacy engine, which is being removed (planned work resumes 2026-10-07); prefer `loki owner/repo#N`. See [docs/v10/GUIDE.md](v10/GUIDE.md).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -344,6 +344,9 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings: swept every place Loki writes an install-time path. Provider skill links ~/.claude, ~/.codex, ~/.cline, ~/.aider skills/loki-mode (all four covered by the shared mechanism); `cmd_remote` ln -sf of the Claude skill link in autonomy/loki (only creates when SKILL.md is absent, covered by the same repair on the next run); shell completions via `completion --postinstall` and the shim (already self-healing, stamped by VERSION in ~/.loki/completions-version); no PATH shims or bin links are written by Loki (the package manager owns bin/loki). Real directories and foreign links are deliberately left to doctor.
 - Mechanism of the fix: autonomy/lib/skill-link-heal.sh `loki_skill_link_heal` repoints a symlink only when its target is a Loki install path (node_modules/loki-mode or a Homebrew loki-mode dir) that is missing or is a different install than the running one, and only when the running root is itself an install path. Atomic temp link plus rename, one stderr line, silent no-op when correct, LOKI_NO_SKILL_LINK_HEAL=1 opts out. Called from bin/loki-postinstall.js (install and upgrade) and the bin/loki shim (first run).
 - Fixture: tests/test-skill-link-heal.sh (dangling, other install, real dir, foreign link, correct link, opt-out, dev checkout), red before autonomy/lib/skill-link-heal.sh existed.
+- Amendment (FC30-DURABLE): the repair repointed to WHATEVER install was running, so a one-off `npx loki-mode@x` or a scratch-prefix install would hijack the user's link to a path that later disappears and dangles again. Rule: repoint only when the running install is durable (under `npm root -g`, the bun global dir, or a Homebrew prefix). An npx cache (_npx), a temp dir or any other prefix is refused with one stderr line and the link is left untouched. The rule lives only in autonomy/lib/skill-link-heal.sh (`_loki_skill_root_durable`); there is no TS copy, and bin/loki-postinstall.js and the bin/loki shim both call it. The check runs only on the repair path, so the steady state stays subprocess-free.
+- Amendment siblings swept: other Loki writers that derive a user-owned path from the running install location: `cmd_remote` ln -sf of the Claude skill link (creates only when SKILL.md is absent; shares the same later repair, no repoint from the running root); shell completions (stamped by VERSION, content not install-path dependent); no PATH shim or bin link is written by Loki. No other self-repair writes from the running root.
+- Amendment fixture: tests/test-skill-link-heal.sh cases 8-12 (npx cache refused, temp or arbitrary prefix refused, brew prefix healed, bun global healed, foreign link untouched), red on the npx and temp cases before the fix (11 passed, 2 failed), with npm stubbed and HOME and HOMEBREW_PREFIX faked.
 
 ## FC-31 A slice gate skips the suites that guard its own files, and main goes red in Tier B
 - User saw: main 27447cf46 failed Tier B on tests/test-doctor-blocker-parity.sh (run 37697291383). The slice R1-20 (8ff988516) changed loki-ts/src/commands/doctor.ts and gated only on tsc and bun test. The local-ci fast tier had timed out (rc=124) on a loaded host, so no shell suite ran.
@@ -370,3 +373,11 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Mechanism: `_loki_bun_delegate <cmd> "$@"` in autonomy/loki (bun resolved PATH then @oven/bun-*, dist then src, `version` preflight under 5s, then exec). Doctor is the first command moved onto it; bash keeps only a minimal "bun route unavailable" diagnostic. `cmd_control` is the precedent. Remaining twins move onto the same helper as their slices land.
 - Known gap: the delegate preflight only runs `<cli> version`. A throw inside doctor.ts AFTER the CLI loads (during the doctor run itself) is not covered by the preflight and surfaces as that crash, not the minimal fallback.
 - Fixture: tests/test-doctor-single-impl.sh.
+
+## FC-34 Test imports a temp copy of src in-process under bun --coverage
+- User saw: Tier B on main 83109bc1a failed in "Bun tests on ubuntu-latest bun=1.3.13" (`cd loki-ts && bun test --coverage`): every test printed (pass), no (fail) line and no summary, the output stopped mid coverage table and the job ended "exit code 1". The table was full of /tmp/loki-rmx-*/src/... rows. Raw view: a green test list with a dead process.
+- Law: L2 (a verdict must be produced by the runner, not lost with it), L0 (the harness must not depend on a reporter surviving deleted files).
+- Cause (measured): loki-ts/tests/engine10/route_matrix_mutation.test.ts (e49c7d29f) copies src into a mkdtemp dir 31 times and route_matrix_lib.ts matrixViolations(root) dynamically imports those copies in the test process; afterAll removes the dirs before the coverage reporter reads them. macOS exits 0 but prints 2170 loki-rmx rows; Linux died after 4 dirs.
+- Siblings swept: grep of loki-ts/tests and loki-ts/test for in-process dynamic imports from tmp/mkdtemp roots and for cpSync tests that import. Only route_matrix_lib.ts (lines 57-60, 178-179) imports from a variable root. graph.test.ts and providers.test.ts copy fixtures, not src; providers.test.ts imports real src inside a spawned script. route_matrix.test.ts passes the real src dir, which coverage tracks normally. No other hits.
+- Mechanism: the mutation test evaluates each copy through `Bun.spawn([process.execPath, route_matrix_child.ts, root])` (no --coverage), reading violations as JSON. A non-zero exit or unparsable output throws, so a crashed child can never pass a red case or the control case vacuously.
+- Fixture: the "FC-34 guard" describe block in loki-ts/tests/engine10/route_matrix_mutation.test.ts (red when the file imports route_matrix_lib in-process or does `await import(join(root` against a temp root; verified red by reverting the fix locally).