loki-mode 11.55.2 → 11.56.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.55.2
+# Loki Mode v11.56.0
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -476,4 +476,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.55.2 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.56.0 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.55.2
+11.56.0

package/autonomy/lib/mcp-config.sh

@@ -27,6 +27,11 @@
 #                                  element to satisfy Claude's variadic flag.
 #                                  Returns 0 on success, 1 if the bundle
 #                                  emission fails.
+#   loki_mcp_launch_for         -- emit the per-provider MCP launch as one compact JSON
+#                                  object {"argv":[..],"env":{..}[,"reason":".."]}
+#                                  for claude|codex|opencode|cline|aider. Mirror of
+#                                  mcpLaunchFor in loki-ts/src/providers/mcp_config.ts;
+#                                  tests/providers parity test reads both.
 #
 # No side effects beyond writing .loki/mcp-config.json (idempotent;
 # regenerated each call).
@@ -183,3 +188,129 @@ loki_mcp_config_argv() {
     fi
     return 0
 }
+
+# ---------- Per-provider MCP launch (CW-10) ----------
+# Usage: loki_mcp_launch_for <provider> [target_dir]
+# claude: the pre-CW-10 --mcp-config paths, unchanged. codex: `-c mcp_servers.*`
+# overrides. opencode: env OPENCODE_CONFIG_CONTENT. cline/aider/unknown: empty
+# launch plus a reason. Servers for codex/opencode: Loki bundle, project
+# <target_dir>/.mcp.json only when LOKI_MCP_PROJECT=1, ~/.claude/mcp.json overlay;
+# bundle wins a name collision, then project over overlay. `${...}` stays literal.
+loki_mcp_launch_for() {
+    local provider="${1:-}" target="${2:-${TARGET_DIR:-.}}"
+    local claude_argv="" user_path="" project_path="" lsp_detected=0 lsp_bin cline_ver="unknown" line
+    case "$provider" in
+        claude)
+            claude_argv=$(TARGET_DIR="$target" loki_mcp_config_argv) || return 1
+            ;;
+        codex | opencode)
+            TARGET_DIR="$target" loki_mcp_config_path >/dev/null || return 1
+            user_path=$(loki_user_mcp_config_path)
+            if [ "${LOKI_MCP_PROJECT:-}" = "1" ]; then
+                project_path="${target}/.mcp.json"
+            fi
+            for lsp_bin in typescript-language-server pyright-langserver pylsp gopls rust-analyzer jdtls; do
+                if command -v "$lsp_bin" >/dev/null 2>&1; then
+                    lsp_detected=1
+                    break
+                fi
+            done
+            ;;
+        cline)
+            if command -v cline >/dev/null 2>&1; then
+                line=$(cline --version 2>/dev/null | head -n 1) || line=""
+                line="${line#"${line%%[![:space:]]*}"}"
+                line="${line%"${line##*[![:space:]]}"}"
+                [ -n "$line" ] && cline_ver="$line"
+            fi
+            ;;
+    esac
+    _MCP_PROVIDER="$provider" _MCP_CLAUDE_ARGV="$claude_argv" _MCP_USER="$user_path"         _MCP_PROJECT="$project_path" _MCP_LSP="$lsp_detected" _MCP_CLINE_VER="$cline_ver"         python3 -c '
+import json, os, re
+prov = os.environ["_MCP_PROVIDER"]
+NAME = re.compile(r"^[A-Za-z0-9_-]+$")
+MAXB = 1024 * 1024
+
+def norm(raw):
+    out = {}
+    if not isinstance(raw, dict):
+        return out
+    for name, e in raw.items():
+        if not NAME.match(name) or not isinstance(e, dict):
+            continue
+        cmd = e.get("command")
+        if not isinstance(cmd, str) or not cmd:
+            continue
+        args = e.get("args", [])
+        if not isinstance(args, list) or not all(isinstance(a, str) for a in args):
+            continue
+        env = e.get("env", {})
+        if not isinstance(env, dict) or not all(isinstance(v, str) for v in env.values()):
+            continue
+        out[name] = {"command": cmd, "args": args, "env": env}
+    return out
+
+def load(p):
+    if not p:
+        return {}
+    try:
+        if not os.path.isfile(p) or os.path.getsize(p) > MAXB:
+            return {}
+        with open(p, encoding="utf-8") as h:
+            v = json.load(h)
+        return norm(v.get("mcpServers")) if isinstance(v, dict) else {}
+    except (OSError, ValueError):
+        return {}
+
+def dumps(v):
+    return json.dumps(v, ensure_ascii=False, separators=(",", ":"))
+
+def servers():
+    merged = {}
+    merged.update(load(os.environ["_MCP_USER"]))
+    merged.update(load(os.environ["_MCP_PROJECT"]))
+    bundle = {"loki-mode": {"command": "python3", "args": ["-m", "mcp.server"]}}
+    if os.environ["_MCP_LSP"] == "1":
+        bundle["lsp-proxy"] = {"command": "python3", "args": ["-m", "mcp.lsp_proxy"]}
+    merged.update(norm(bundle))
+    ordered = {k: merged[k] for k in bundle}
+    for k, v in merged.items():
+        if k not in ordered:
+            ordered[k] = v
+    return ordered
+
+res = {"argv": [], "env": {}}
+if prov == "claude":
+    res["argv"] = ["--mcp-config"] + os.environ["_MCP_CLAUDE_ARGV"].split()
+elif prov == "codex":
+    skipped = []
+    for n, s in servers().items():
+        names = [k for k in s["env"] if NAME.match(k)]
+        if any(k in res["env"] and res["env"][k] != s["env"][k] for k in names):
+            skipped.append(n)
+            continue
+        res["argv"] += ["-c", "mcp_servers.%s.command=%s" % (n, dumps(s["command"]))]
+        res["argv"] += ["-c", "mcp_servers.%s.args=%s" % (n, dumps(s["args"]))]
+        if names:
+            for k in names:
+                res["env"][k] = s["env"][k]
+            res["argv"] += ["-c", "mcp_servers.%s.env_vars=%s" % (n, dumps(names))]
+    if skipped:
+        res["reason"] = "mcp: skipped %s (env name conflict)" % ",".join(skipped)
+elif prov == "opencode":
+    mcp = {}
+    for n, s in servers().items():
+        e = {"type": "local", "command": [s["command"]] + s["args"], "enabled": True}
+        if s["env"]:
+            e["environment"] = s["env"]
+        mcp[n] = e
+    res["env"] = {"OPENCODE_CONFIG_CONTENT": dumps({"mcp": mcp})}
+elif prov == "cline":
+    res["reason"] = "mcp: unsupported (cline %s)" % os.environ["_MCP_CLINE_VER"]
+elif prov == "aider":
+    res["reason"] = "mcp: unsupported (aider has no MCP support)"
+else:
+    res["reason"] = "mcp: unsupported (provider %s)" % prov
+print(dumps(res))
+'
+}

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.55.2"
+__version__ = "11.56.0"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.55.2. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.56.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.55.2
+**Version:** v11.56.0
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/FAILURE-CLASSES.md

@@ -1443,3 +1443,15 @@ L0 review rule (ENGINE-LAWS.md L0): a fix that adds an `if` or a regex about the
 - Siblings swept: all 14 literals in loki-ts/tests, replaced in one change; per-test `, N)` timeouts are explicit single-test budgets and are not in this class.
 - Mechanism: loki-ts/tests/preload.ts exports `setLoadAwareTimeout(baseMs)`: baseMs times clamp(ceil(2 * loadavg1 / cpus), 1, 10). `LOKI_TEST_TIMEOUT_SCALE` (positive number, capped at 10) replaces the factor; `LOKI_TEST_TIMEOUT_MS` is a floor that wins when larger. A guard in loki-ts/tests/util fails on any direct `setDefaultTimeout(` call in tests.
 - Fixture: loki-ts/tests/util/test_timeout_guard.test.ts tests FC-TEST-TIMEOUT-OVERRIDES-CLI, including a subprocess run through the real setLoadAwareTimeout path (env knob lifts the budget, a real hang still times out).
+
+- Siblings swept: every registered MCP tool and resource, via the runtime-derived guard in tests/mcp/test_phase1_tools.py (seeds this cache with the marker; the observer now also sees os.scandir, os.stat, Path.iterdir and glob); the JS mirror declares its fields in src/protocols and counts them in tests/protocols/mcp-server.test.js.
+- Mechanism: part 1 (this change) moves loki_verify_fast findings under untrusted_content via _UNTRUSTED_FIELDS. The verdict-suppression half is open in #319 (cache entries must be authenticated or re-derived, then the row is closed).
+- Fixture: tests/mcp/test_phase1_tools.py test_stored_text_appears_only_inside_untrusted_content (red with loki_verify_fast trusted: leaks ['loki_verify_fast']; green after).
+
+## FC-STATE-MANAGER-ROOT-IGNORED A process-wide state manager singleton ignored its lokiDir after first use, and a per-root cache would grow without bound
+- User-visible vs raw: user-visible. getStateManager({ lokiDir }) for a second .loki directory returned the first directory's manager, so reads and writes for run B landed in run A's state; a long-lived process serving many roots would have leaked one open watcher per root once keyed naively.
+- Law: a keyed accessor honours its key on every call; a cache that holds OS resources is bounded and releases what it evicts.
+- Cause (measured): state/manager.ts kept one module-level defaultManager and created it from the first call's options only.
+- Siblings swept: state/manager.py get_state_manager has the same single-default shape and is to follow the same keying rule (separate branch); no other TS caller passes arguments to getStateManager.
+- Mechanism: one per-root cache in state/manager.ts keyed by the (st_dev, st_ino) of the .loki directory (symlinks and case spellings share a manager), capped by LOKI_STATE_MANAGER_MAX (default 8), least recently used evicted and stop()ped.
+- Fixture: loki-ts/tests/state_manager.test.ts (under loki-ts so bun and CI discover it). Red on origin/main (2 fail), green after (5 pass or 4 pass and 1 skip on a case-sensitive volume); mutations: no eviction, eviction without stop, path-string key, constant key, no LRU touch each go red.