loki-mode 11.48.0 → 11.49.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.48.0
+# Loki Mode v11.49.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -476,4 +476,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.48.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.49.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.48.0
+11.49.0

package/autonomy/lib/claude-flags.sh

@@ -1138,9 +1138,22 @@ loki_permission_policy_banner() {
 _loki_claude_permission_argv() {
     _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
     _loki_permission_warn_unknown_once
-    [ "$(_loki_permission_policy_mode)" = "legacy" ] && return 0
     local _helper _out _a
     _helper="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/src/policies/claude_permissions.js"
+    if [ "$(_loki_permission_policy_mode)" = "legacy" ]; then
+        # w2-07: legacy keeps bypass but carries the default web/credential deny rules (same js source).
+        # Unusable compiler or helper failure fails closed to plan, like compiled mode and the TS route.
+        _LOKI_PERM_ARGV=(--permission-mode plan)
+        if ! command -v node >/dev/null 2>&1 || [ ! -f "$_helper" ]; then
+            echo "[loki] WARNING: legacy permission policy: compiler unavailable; using most restrictive mode (plan)" >&2
+            return 0
+        fi
+        _out="$(node "$_helper" --legacy-args)" || return 0
+        [ -n "$_out" ] || return 0
+        _LOKI_PERM_ARGV=()
+        while IFS= read -r _a; do _LOKI_PERM_ARGV+=("$_a"); done <<< "$_out"
+        return 0
+    fi
     _LOKI_PERM_ARGV=(--permission-mode plan)
     if ! command -v node >/dev/null 2>&1 || [ ! -f "$_helper" ]; then
         echo "[loki] WARNING: compiled permission policy: compiler unavailable; using most restrictive mode (plan)" >&2

package/autonomy/lib/claude_permissions.py

@@ -14,7 +14,6 @@ import subprocess
 import sys
 from pathlib import Path
 
-_LEGACY = ["--dangerously-skip-permissions"]
 _FAIL_CLOSED = ["--permission-mode", "plan"]
 _unknown_warned = False
 
@@ -30,16 +29,37 @@ def _has_operator_policy(node: str | None, helper: Path, env: dict) -> bool:
     return done.stdout.strip() == "1"
 
 
+def _legacy_argv(env: dict) -> list:
+    """Legacy bypass flag plus the default web/credential deny rules (w2-07), from the same js helper.
+
+    An unusable compiler fails closed to plan with a warning, like compiled mode and the TS route.
+    """
+    helper = Path(__file__).resolve().parents[2] / "src" / "policies" / "claude_permissions.js"
+    node = shutil.which("node")
+    if node is None or not helper.is_file():
+        print("[loki] WARNING: legacy permission policy: compiler unavailable; using most restrictive mode (plan)", file=sys.stderr)
+        return list(_FAIL_CLOSED)
+    try:
+        done = subprocess.run([node, str(helper), "--legacy-args"], capture_output=True, text=True,
+                              timeout=30, env=dict(env), check=False)
+    except (OSError, subprocess.SubprocessError):
+        return list(_FAIL_CLOSED)
+    if done.stderr:
+        sys.stderr.write(done.stderr)
+    args = [a for a in done.stdout.split("\n") if a]
+    return args if done.returncode == 0 and args else list(_FAIL_CLOSED)
+
+
 def claude_permission_argv(project_dir: str | None = None, env: dict | None = None) -> list:
     env = os.environ if env is None else env
     mode = env.get("LOKI_PERMISSION_POLICY", "")
     if mode == "legacy":
-        return list(_LEGACY)
+        return _legacy_argv(env)
     global _unknown_warned
     helper = Path(__file__).resolve().parents[2] / "src" / "policies" / "claude_permissions.js"
     node = shutil.which("node")
     if mode == "" and not _has_operator_policy(node, helper, env):
-        return list(_LEGACY)
+        return _legacy_argv(env)
     if mode not in ("", "compiled") and not _unknown_warned:
         _unknown_warned = True
         print(f"[loki] WARNING: LOKI_PERMISSION_POLICY={mode}: unknown value; using compiled", file=sys.stderr)

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.48.0"
+__version__ = "11.49.0"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.48.0. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.49.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.48.0
+**Version:** v11.49.0
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/environment-variables.md

@@ -95,6 +95,34 @@ model sees a countdown across the whole loop and wraps up instead of running out
 It is advisory only; `LOKI_BUDGET_LIMIT` is the enforcing cap. Unset, zero or a
 non-integer sends nothing.
 
+### Web access is now off by default
+
+Claude workers can no longer search or fetch from the web, and cannot read secret
+files, unless you opt in. This is intended, not a bug. A worker that follows a
+prompt-injected instruction in a web page or a file could otherwise send your
+credentials to an outside site, so the default denies the tools that make that
+possible:
+
+- `WebFetch` and `WebSearch` are denied.
+- `Read` of anything matching `.env*` (so `.env`, `.env.local`, `.envrc`, `.env.prod`, `.env.keys`, and the templates `.env.example`, `.env.sample`, `.env.template`), `*.pem`, and anything under `.aws/` or `.ssh/` is denied, anywhere on disk. The templates are blocked too: a deny beats any allow, so they cannot be carved out of the glob without missing secret names.
+
+This applies to every Claude route (shell, TypeScript and Python launch sites),
+whether `LOKI_PERMISSION_POLICY` is `compiled` or `legacy`. If the policy cannot
+be compiled (invalid `LOKI_WEB_ALLOW_DOMAINS`, or Node missing), Loki prints a
+warning and runs in `plan` mode instead of skipping the rules. Punycode (`xn--`)
+domains are rejected the same way.
+
+This is not complete secret-file protection: `Read` denies do not stop
+`Bash(cat .env)` under `--dangerously-skip-permissions`.
+
+To turn web access back on:
+
+| Setting | Effect |
+|---|---|
+| `LOKI_WEB_ALLOW_DOMAINS=docs.python.org,*.example.com` | Allows `WebFetch` for those hostnames only (comma list, ASCII hostnames). `WebSearch` stays denied. Enforced with `LOKI_PERMISSION_POLICY=compiled`; the legacy route keeps both web tools denied and warns. |
+| `allow` entry for `WebFetch` or `WebSearch` in your `claude_permissions` policy | Keeps that tool enabled. |
+| `LOKI_WEB_POLICY=off` | Disables this policy entirely: no web or credential deny rules, the previous behavior. |
+
 ## Steering the loop
 
 These control how the engine decides what to do next. Every one is on by