loki-mode 11.55.3 → 11.56.1

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Runs an autonomous software factory that knows what it is supposed to deliver and proves it did, with a signed receipt. Use when the user says Loki Mode or asks to build, fix or verify software autonomously.
 ---
 
-# Loki Mode v11.55.3
+# Loki Mode v11.56.1
 
 **Current entry points (Loki 10 engine):** `loki "<task>"`, `loki owner/repo#N` and `loki quick "<task>"` run the Loki 10 engine and end with a signed receipt (`loki verify`). `loki backlog owner/repo --all` runs many issues in parallel. Guide: `docs/v10/GUIDE.md`. The skill instructions below, and `loki start`, describe the previous bash loop. PRD-file starts (`loki start ./prd.md`) and the opencode provider still run on it until FC38-SWEEP ports them; the legacy-engine command and the LOKI_ENGINE switch remain removed. Prefer `loki owner/repo#N` for issues.
 
@@ -476,4 +476,4 @@ Implemented, planned and deprecated items, with the version each landed in: `ski
 
 ---
 
-**v11.55.3 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**
+**v11.56.1 | [Autonomi](https://www.autonomi.dev/) flagship product | core skill**

package/VERSION

@@ -1 +1 @@
-11.55.3
+11.56.1

package/autonomy/lib/mcp-config.sh

@@ -27,6 +27,11 @@
 #                                  element to satisfy Claude's variadic flag.
 #                                  Returns 0 on success, 1 if the bundle
 #                                  emission fails.
+#   loki_mcp_launch_for         -- emit the per-provider MCP launch as one compact JSON
+#                                  object {"argv":[..],"env":{..}[,"reason":".."]}
+#                                  for claude|codex|opencode|cline|aider. Mirror of
+#                                  mcpLaunchFor in loki-ts/src/providers/mcp_config.ts;
+#                                  tests/providers parity test reads both.
 #
 # No side effects beyond writing .loki/mcp-config.json (idempotent;
 # regenerated each call).
@@ -183,3 +188,129 @@ loki_mcp_config_argv() {
     fi
     return 0
 }
+
+# ---------- Per-provider MCP launch (CW-10) ----------
+# Usage: loki_mcp_launch_for <provider> [target_dir]
+# claude: the pre-CW-10 --mcp-config paths, unchanged. codex: `-c mcp_servers.*`
+# overrides. opencode: env OPENCODE_CONFIG_CONTENT. cline/aider/unknown: empty
+# launch plus a reason. Servers for codex/opencode: Loki bundle, project
+# <target_dir>/.mcp.json only when LOKI_MCP_PROJECT=1, ~/.claude/mcp.json overlay;
+# bundle wins a name collision, then project over overlay. `${...}` stays literal.
+loki_mcp_launch_for() {
+    local provider="${1:-}" target="${2:-${TARGET_DIR:-.}}"
+    local claude_argv="" user_path="" project_path="" lsp_detected=0 lsp_bin cline_ver="unknown" line
+    case "$provider" in
+        claude)
+            claude_argv=$(TARGET_DIR="$target" loki_mcp_config_argv) || return 1
+            ;;
+        codex | opencode)
+            TARGET_DIR="$target" loki_mcp_config_path >/dev/null || return 1
+            user_path=$(loki_user_mcp_config_path)
+            if [ "${LOKI_MCP_PROJECT:-}" = "1" ]; then
+                project_path="${target}/.mcp.json"
+            fi
+            for lsp_bin in typescript-language-server pyright-langserver pylsp gopls rust-analyzer jdtls; do
+                if command -v "$lsp_bin" >/dev/null 2>&1; then
+                    lsp_detected=1
+                    break
+                fi
+            done
+            ;;
+        cline)
+            if command -v cline >/dev/null 2>&1; then
+                line=$(cline --version 2>/dev/null | head -n 1) || line=""
+                line="${line#"${line%%[![:space:]]*}"}"
+                line="${line%"${line##*[![:space:]]}"}"
+                [ -n "$line" ] && cline_ver="$line"
+            fi
+            ;;
+    esac
+    _MCP_PROVIDER="$provider" _MCP_CLAUDE_ARGV="$claude_argv" _MCP_USER="$user_path"         _MCP_PROJECT="$project_path" _MCP_LSP="$lsp_detected" _MCP_CLINE_VER="$cline_ver"         python3 -c '
+import json, os, re
+prov = os.environ["_MCP_PROVIDER"]
+NAME = re.compile(r"^[A-Za-z0-9_-]+$")
+MAXB = 1024 * 1024
+
+def norm(raw):
+    out = {}
+    if not isinstance(raw, dict):
+        return out
+    for name, e in raw.items():
+        if not NAME.match(name) or not isinstance(e, dict):
+            continue
+        cmd = e.get("command")
+        if not isinstance(cmd, str) or not cmd:
+            continue
+        args = e.get("args", [])
+        if not isinstance(args, list) or not all(isinstance(a, str) for a in args):
+            continue
+        env = e.get("env", {})
+        if not isinstance(env, dict) or not all(isinstance(v, str) for v in env.values()):
+            continue
+        out[name] = {"command": cmd, "args": args, "env": env}
+    return out
+
+def load(p):
+    if not p:
+        return {}
+    try:
+        if not os.path.isfile(p) or os.path.getsize(p) > MAXB:
+            return {}
+        with open(p, encoding="utf-8") as h:
+            v = json.load(h)
+        return norm(v.get("mcpServers")) if isinstance(v, dict) else {}
+    except (OSError, ValueError):
+        return {}
+
+def dumps(v):
+    return json.dumps(v, ensure_ascii=False, separators=(",", ":"))
+
+def servers():
+    merged = {}
+    merged.update(load(os.environ["_MCP_USER"]))
+    merged.update(load(os.environ["_MCP_PROJECT"]))
+    bundle = {"loki-mode": {"command": "python3", "args": ["-m", "mcp.server"]}}
+    if os.environ["_MCP_LSP"] == "1":
+        bundle["lsp-proxy"] = {"command": "python3", "args": ["-m", "mcp.lsp_proxy"]}
+    merged.update(norm(bundle))
+    ordered = {k: merged[k] for k in bundle}
+    for k, v in merged.items():
+        if k not in ordered:
+            ordered[k] = v
+    return ordered
+
+res = {"argv": [], "env": {}}
+if prov == "claude":
+    res["argv"] = ["--mcp-config"] + os.environ["_MCP_CLAUDE_ARGV"].split()
+elif prov == "codex":
+    skipped = []
+    for n, s in servers().items():
+        names = [k for k in s["env"] if NAME.match(k)]
+        if any(k in res["env"] and res["env"][k] != s["env"][k] for k in names):
+            skipped.append(n)
+            continue
+        res["argv"] += ["-c", "mcp_servers.%s.command=%s" % (n, dumps(s["command"]))]
+        res["argv"] += ["-c", "mcp_servers.%s.args=%s" % (n, dumps(s["args"]))]
+        if names:
+            for k in names:
+                res["env"][k] = s["env"][k]
+            res["argv"] += ["-c", "mcp_servers.%s.env_vars=%s" % (n, dumps(names))]
+    if skipped:
+        res["reason"] = "mcp: skipped %s (env name conflict)" % ",".join(skipped)
+elif prov == "opencode":
+    mcp = {}
+    for n, s in servers().items():
+        e = {"type": "local", "command": [s["command"]] + s["args"], "enabled": True}
+        if s["env"]:
+            e["environment"] = s["env"]
+        mcp[n] = e
+    res["env"] = {"OPENCODE_CONFIG_CONTENT": dumps({"mcp": mcp})}
+elif prov == "cline":
+    res["reason"] = "mcp: unsupported (cline %s)" % os.environ["_MCP_CLINE_VER"]
+elif prov == "aider":
+    res["reason"] = "mcp: unsupported (aider has no MCP support)"
+else:
+    res["reason"] = "mcp: unsupported (provider %s)" % prov
+print(dumps(res))
+'
+}

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.55.3"
+__version__ = "11.56.1"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.55.3. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.56.1. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.55.3
+**Version:** v11.56.1
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v10/DECISIONS.md

@@ -875,3 +875,36 @@ FC-AGENT-PROOF: a run whose only executed passing check is a test file the same
 6. The project's own install scripts (for example npm postinstall) run exactly as they do for a developer; opt-out is LOKI_E10_INSTALL=0 or loki.yaml `verify.install_deps: false`, documented in docs/environment-variables.md.
 - Amendment (D99): uv uses `uv sync --locked` (fails on an out-of-sync uv.lock; `--frozen` is replaced) and pipenv uses `pipenv install --deploy` (fails on an out-of-date Pipfile.lock; `pipenv sync` is replaced); pnpm-workspace.yaml is read in inline-list, block and unindented-block forms with `!` exclusions.
 - Reverse: founder call; the opt-out covers one-off needs.
+
+## D107 (2026-10-23, CoS records): #246 stays OFF by default (KEEP OFF)
+1. The #246 behavior ships disabled by default; it is enabled only by an explicit opt-in.
+2. Reversing this needs a new decision entry with field evidence.
+
+## D108 (2026-10-22, founder grant, CoS records on 2026-10-23): paid Claude and loki runs are pre-approved, each use is logged
+1. The founder pre-approved paid Claude runs and paid loki runs (LOKI_BENCH_SPEND_APPROVED) without a per-run question.
+2. Every use is logged (what ran, why, when) so the spend stays auditable. This extends D99.
+
+## D109 (2026-10-23, CoS records): weaktest and 246 are retired
+1. The weaktest and 246 work items are closed as retired; they are not reopened without a new decision entry.
+2. Related: D107 keeps the #246 behavior OFF by default.
+
+## D110 (2026-10-23, CoS under D99, slice pd/npmskip GO): npm dist-tag moves are fail-closed on any registry read failure
+1. scripts/npm-dist-tags.sh moves latest and next only to the highest published stable version, never backwards. It re-reads the tags after writing and restores an overtaken tag.
+2. Any failed or empty read of latest, next or the published versions refuses before ANY write (exit 1, "refusing to move latest (fail closed)"). The same script serves loki-mode and loki-mode-sdk. Class: FC-DIST-TAG-MOVED-BACKWARDS in FAILURE-CLASSES.md.
+3. Companion guards in the same slice: a verify-npm-registry job proves the registry serves the version, and release.sh --ship refuses notes that release-notes.sh rejects (not bypassable by LOKI_RELEASE_SKIP_GUARDS).
+
+## D111 (2026-10-23, CoS records, CW-04, #337): LOKI_SPEC_STRICT=1 is opt-in, default off
+1. Strict spec handling runs only when LOKI_SPEC_STRICT=1 is set; the default behavior is unchanged.
+2. Making it the default needs a new decision entry.
+
+## D112 (2026-10-23, founder mandate, CoS records): full autonomy and the 10/10 mandate
+1. The founder granted full decision authority and set 10/10 as the standing target; the CoS decides, ships and logs without per-step approval. This restates D99 and the 2026-10-22 grant.
+2. The never-do list in docs/LOKI-10-BUILD-PROMPT.md and the zero-mis-anything bar still bind.
+
+## D113 (2026-10-23, CoS records): test-only council changes are MEDIUM tier, not HIGH
+1. A change that touches only tests (no product code, gate, verifier, Seal, auth or release policy) is reviewed at MEDIUM by Tech Leads under D12, not by HIGH opus reviewers.
+2. Any change that also touches the moat, verifier, Seal, auth, security or release policy stays HIGH.
+
+## D114 (2026-10-23, CoS records, #343): Codex MCP secrets never go on argv
+1. Secret names are passed to Codex through env_vars; secret values travel only in the process environment.
+2. No secret value appears in a command line, where ps and shell history can read it.