loki-mode 11.66.2 → 11.67.1

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '11.66.2'
+__version__ = '11.67.1'

package/mcp/server.py

@@ -653,7 +653,7 @@ _TRUSTED_TOOLS = frozenset({
     "loki_memory_store_pattern", "loki_task_queue_add",
     "loki_memory_capture_session_summary",
     "loki_consolidate_memory", "loki_complete_task", "loki_v10_run",
-    "loki_v10_verify", "loki_start_project", "loki_code_search_stats",
+    "loki_v10_verify", "loki_seal_diff", "loki_start_project", "loki_code_search_stats",
     "loki_memory_redact",
     "loki_magic_stats", "loki_magic_tokens_extract",
     "cp_stats", "cp_cost", "cp_repos_list",
@@ -1900,6 +1900,36 @@ async def loki_v10_verify(receipt_path: str = "", repo_path: str = "") -> str:
         raise
 
 
+@mcp.tool()
+async def loki_seal_diff(repo_path: str, intent: str) -> str:
+    """
+    Seal changes you already made in a repo into a signed Loki receipt.
+    Use it after editing a repo yourself, to get the same Wall-verified receipt a
+    Loki run gives. The Wall is written from the intent alone, without seeing the
+    diff. Do not use it to build something (use loki_v10_run) or to re-check an
+    existing receipt (use loki_v10_verify).
+
+    Args:
+        repo_path: Git repository with uncommitted changes to seal
+        intent: What the changes are meant to do, in plain words
+
+    Returns:
+        JSON with run_id, verdict, verdict_is_verified (the receipt verdict string, not a signature check), receipt_path, sealed_ref and not_proven
+    """
+    _emit_tool_event_async('loki_seal_diff', 'start', parameters={'repo_path': repo_path, 'intent': intent})
+    try:
+        from mcp import v10_tools
+        result = await asyncio.to_thread(
+            v10_tools.seal_diff, repo_path, intent,
+            lambda p: validate_path(p, allowed_dirs=['.']))
+        _emit_tool_event_async('loki_seal_diff', 'complete', result_status='error' if isinstance(result, dict) and result.get('error') else 'success')
+        return json.dumps(result)
+    except Exception as e:
+        logger.error(f"loki_seal_diff failed: {e}")
+        _emit_tool_event_async('loki_seal_diff', 'complete', result_status='error', error=str(e))
+        raise
+
+
 @mcp.tool()
 async def loki_start_project(prd_content: str = "", prd_path: str = "") -> str:
     """

package/mcp/tests/test_read_only.py

@@ -27,7 +27,7 @@ EXPECTED_ALLOWLIST = {
 EXCLUDED_TOOLS = {
     "loki_memory_store_pattern", "loki_task_queue_add", "loki_task_queue_update",
     "loki_memory_capture_session_summary", "loki_consolidate_memory",
-    "loki_complete_task", "loki_v10_run", "loki_v10_verify",
+    "loki_complete_task", "loki_v10_run", "loki_v10_verify", "loki_seal_diff",
     "loki_start_project", "loki_checkpoint_restore", "loki_verify_fast",
     "loki_counter_evidence_template", "loki_task_queue_list",
     "loki_code_search_stats", "loki_memory_redact", "loki_graph_query",

package/mcp/tests/test_v10_tools.py

@@ -2,6 +2,7 @@
 
 import json
 import os
+import shutil
 import subprocess
 import sys
 import tempfile
@@ -244,3 +245,214 @@ class VerifyTests(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
+
+
+_FAKE_LOKI = """#!/bin/sh
+# stand-in engine: records what it was handed, writes a receipt with the verdict in $FAKE_VERDICT
+[ "$2" = "--seal-existing" ] || exit 9
+[ -z "$(git status --porcelain)" ] || exit 8
+cp "$3" "$FAKE_OUT/patch"
+printf '%s' "$1" > "$FAKE_OUT/intent"
+RID="${FAKE_RUN_ID:-e10-fake}"
+mkdir -p ".loki/runs/$RID"
+printf '{"run_id":"%s"}' "$RID" > .loki/engine.json
+printf '{"verdict":"%s","not_proven":["x"],"head_sha":"%s"}' "${FAKE_VERDICT:-VERIFIED}" "$(git rev-parse HEAD)" > ".loki/runs/$RID/receipt.json"
+"""
+
+
+def _git(cwd, *args):
+    return subprocess.run(["git", *args], cwd=cwd, capture_output=True, text=True, check=True).stdout
+
+
+class SealDiffTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp(prefix="loki-test-seal-")
+        self.addCleanup(__import__("shutil").rmtree, self.tmp, True)
+        self.repo = os.path.join(self.tmp, "repo")
+        os.makedirs(self.repo)
+        _git(self.repo, "init", "-q", "-b", "main")
+        _git(self.repo, "config", "user.name", "t")
+        _git(self.repo, "config", "user.email", "t@example.invalid")
+        with open(os.path.join(self.repo, "a.txt"), "w") as f:
+            f.write("base\n")
+        _git(self.repo, "add", "a.txt")
+        _git(self.repo, "commit", "-q", "-m", "base")
+        self.out = os.path.join(self.tmp, "out")
+        os.makedirs(self.out)
+        self.fake = os.path.join(self.tmp, "loki")
+        with open(self.fake, "w") as f:
+            f.write(_FAKE_LOKI)
+        os.chmod(self.fake, 0o755)
+        env = mock.patch.dict(os.environ, {"FAKE_OUT": self.out})
+        env.start()
+        self.addCleanup(env.stop)
+        bin_patch = mock.patch.object(v10_tools, "LOKI_BIN", self.fake)
+        bin_patch.start()
+        self.addCleanup(bin_patch.stop)
+
+    def _edit(self):
+        with open(os.path.join(self.repo, "a.txt"), "a") as f:
+            f.write("changed line\n")
+        with open(os.path.join(self.repo, "new.txt"), "w") as f:
+            f.write("brand new\n")
+
+    def test_seals_working_tree_diff_and_leaves_user_repo_untouched(self):
+        self._edit()
+        before = (_git(self.repo, "status", "--porcelain"), _git(self.repo, "rev-parse", "HEAD"),
+                  _git(self.repo, "rev-parse", "--abbrev-ref", "HEAD"), _git(self.repo, "diff", "--cached"))
+        r = v10_tools.seal_diff(self.repo, "add a line", _ok)
+        self.assertNotIn("error", r)
+        self.assertEqual((r["verdict"], r["verdict_is_verified"], r["run_id"]), ("VERIFIED", True, "e10-fake"))
+        self.assertTrue(os.path.isfile(r["receipt_path"]))
+        patch = open(os.path.join(self.out, "patch")).read()
+        self.assertIn("+changed line", patch)
+        self.assertIn("+brand new", patch)
+        self.assertEqual(open(os.path.join(self.out, "intent")).read(), "add a line")
+        after = (_git(self.repo, "status", "--porcelain"), _git(self.repo, "rev-parse", "HEAD"),
+                 _git(self.repo, "rev-parse", "--abbrev-ref", "HEAD"), _git(self.repo, "diff", "--cached"))
+        self.assertEqual(before[1:], after[1:])
+        self.assertEqual(before[3], "")
+        self.assertEqual(after[0].replace("?? .loki/\n", ""), before[0])
+
+    def test_run_id_from_the_clone_is_validated_before_any_path_join(self):
+        self._edit()
+        escape = os.path.join(self.tmp, "escaped")
+        for bad in (escape, "../../escaped", "a/../b", ".hidden/.."):
+            with mock.patch.dict(os.environ, {"FAKE_RUN_ID": bad}):
+                r = v10_tools.seal_diff(self.repo, "add a line", _ok)
+            self.assertIn("error", r, bad)
+            self.assertIn("run_id", r["error"], bad)
+        self.assertFalse(os.path.exists(os.path.join(self.repo, ".loki", "runs", "escaped")))
+        self.assertFalse(os.path.exists(os.path.join(self.repo, "escaped")))
+
+    def test_sealed_commit_lands_under_a_non_branch_ref_and_branches_are_untouched(self):
+        self._edit()
+        branches = _git(self.repo, "branch", "--list")
+        r = v10_tools.seal_diff(self.repo, "add a line", _ok)
+        self.assertEqual(r["sealed_ref"], "refs/loki/seal/e10-fake")
+        # the fake seals at the clone HEAD, which is the user's HEAD; the ref must resolve in the USER repo
+        self.assertEqual(_git(self.repo, "rev-parse", r["sealed_ref"]), _git(self.repo, "rev-parse", "HEAD"))
+        self.assertEqual(_git(self.repo, "branch", "--list"), branches)
+        self.assertIn(".loki/", r["note"])
+
+    def test_result_does_not_call_the_verdict_string_a_checked_signature(self):
+        self._edit()
+        r = v10_tools.seal_diff(self.repo, "add a line", _ok)
+        self.assertNotIn("verified", r)
+        self.assertIn("verdict_is_verified", r)
+
+    def test_failed_wall_is_not_verified(self):
+        self._edit()
+        with mock.patch.dict(os.environ, {"FAKE_VERDICT": "FAILED"}):
+            r = v10_tools.seal_diff(self.repo, "add a line", _ok)
+        self.assertEqual((r["verdict"], r["verdict_is_verified"]), ("FAILED", False))
+
+    def test_rejects_bad_input_and_empty_diff(self):
+        self.assertIn("error", v10_tools.seal_diff(self.repo, "", _ok))
+        self.assertIn("error", v10_tools.seal_diff(self.repo, "--help", _ok))
+        self.assertIn("error", v10_tools.seal_diff(self.repo, "x", _deny))
+        r = v10_tools.seal_diff(self.repo, "x", _ok)
+        self.assertIn("no changes to seal", r["error"])
+
+    def test_scratch_dir_removed(self):
+        self._edit()
+        made = []
+        real = tempfile.mkdtemp
+        def spy(*a, **k):
+            d = real(*a, **k)
+            made.append(d)
+            return d
+        with mock.patch("tempfile.mkdtemp", spy):
+            v10_tools.seal_diff(self.repo, "add a line", _ok)
+        self.assertEqual(len(made), 1)
+        self.assertFalse(os.path.exists(made[0]))
+
+
+_E2E = os.path.join(_REPO_ROOT, "loki-ts", "tests", "engine10", "fixtures", "e2e")
+
+
+@unittest.skipUnless(shutil.which("bun") and shutil.which("git"), "needs bun and git")
+class RealEngineSealDiffTests(unittest.TestCase):
+    """FC-ENGINE-ROUTE-UNMOCKED: seal_diff through the REAL bin/loki under v10_tools._env() (LOKI_ENGINE=v10), so
+    autonomy/route.sh must accept --seal-existing. Only the claude CLI is a stub (no billed call)."""
+
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp(prefix="loki-test-real-seal-")
+        self.addCleanup(shutil.rmtree, self.tmp, True)
+        self.repo = os.path.join(self.tmp, "repo")
+        shutil.copytree(os.path.join(_E2E, "repo"), self.repo)
+        _git(self.repo, "init", "-q", "-b", "main")
+        _git(self.repo, "config", "user.name", "t")
+        _git(self.repo, "config", "user.email", "t@example.invalid")
+        _git(self.repo, "add", "calc.ts", "calc.test.ts", "bunfig.toml")
+        _git(self.repo, "commit", "-q", "-m", "base")
+        with open(os.path.join(self.repo, "calc.ts"), "a") as f:
+            f.write("\nexport function multiply(a: number, b: number): number {\n  return a * b;\n}\n")
+        patches = [
+            mock.patch.object(v10_tools, "LOKI_BIN", os.path.join(_REPO_ROOT, "bin", "loki")),
+            mock.patch.dict(os.environ, {
+                "LOKI_E10_INVOKER": "cli", "LOKI_CLAUDE_CLI": os.path.join(_E2E, "bin", "claude"),
+                "PATH": os.path.join(_E2E, "bin") + os.pathsep + os.environ.get("PATH", ""),
+                "E2E_STUB_MODE": "wallcolor", "LOKI_NO_BROWSER": "1",
+                "LOKI_RECEIPT_SIGNING_KEY_FILE": os.path.join(self.tmp, "k.pem"),
+                "LOKI_TS_ENTRY": os.path.join(_REPO_ROOT, "loki-ts", "src", "cli.ts")}),
+        ]
+        for p in patches:
+            p.start()
+            self.addCleanup(p.stop)
+        for k in ("LOKI_LEGACY_BASH", "LOKI_MODEL_OVERRIDE", "LOKI_RECEIPT_SIGNING_KEY", "LOKI_ENGINE", "LOKI_E10_PLAN"): # no plan mode: the shipped path
+            os.environ.pop(k, None)
+
+    def _loki(self, *args):
+        return subprocess.run([v10_tools.LOKI_BIN, *args], cwd=self.repo, env=v10_tools._env(), capture_output=True,
+                              text=True, stdin=subprocess.DEVNULL, timeout=120)
+
+    def _seal(self):
+        r = v10_tools.seal_diff(self.repo, "add a multiply(a, b) function to calc.ts", _ok)
+        self.assertNotIn("error", r, r)
+        return r
+
+    def test_route_accepts_seal_existing_and_receipt_names_no_implementing_model(self):
+        r = self._seal()
+        self.assertEqual(r["verdict"], "VERIFIED")
+        receipt = json.load(open(r["receipt_path"]))
+        self.assertEqual(receipt["implement"]["exit"], "external")
+        self.assertEqual(receipt["model"], "external (no Loki implement session)")
+        self.assertIn("Wall author not filesystem-isolated from the external diff", r["not_proven"])
+
+    def test_wrong_external_body_never_seals_verified_on_the_shipped_path(self):
+        """FC-EXTERNAL-SEAL-WITHOUT-WALL-VERIFIED: no LOKI_E10_PLAN, wrong multiply body, default env through the tool."""
+        calc = os.path.join(self.repo, "calc.ts")
+        _git(self.repo, "checkout", "--", "calc.ts")
+        with open(calc, "a") as f:
+            f.write("\nexport function multiply(a: number, b: number): number {\n  return a + b + 1;\n}\n")
+        self.assertNotIn("LOKI_E10_PLAN", v10_tools._env())
+        r = v10_tools.seal_diff(self.repo, "add a multiply(a, b) function to calc.ts", _ok)
+        self.assertNotIn("error", r, r)
+        self.assertNotEqual(r["verdict"], "VERIFIED", r)
+        self.assertFalse(r["verdict_is_verified"])
+
+    def test_user_repo_verifies_strictly_with_no_drift_override(self):
+        before = (_git(self.repo, "rev-parse", "HEAD"), _git(self.repo, "diff", "--cached"), _git(self.repo, "branch", "--list"))
+        r = self._seal()
+        self.assertEqual(r["sealed_ref"], "refs/loki/seal/" + r["run_id"])
+        self.assertEqual((_git(self.repo, "rev-parse", "HEAD"), _git(self.repo, "diff", "--cached"), _git(self.repo, "branch", "--list")), before)
+        env = v10_tools._env()
+        self.assertNotIn("LOKI_VERIFY_ALLOW_HEAD_DRIFT", env)
+        # Before the user commits, HEAD is still the base and the sealed path is uncommitted: verify honestly says UNCHECKED.
+        pre = self._loki("verify", r["run_id"])
+        self.assertEqual(pre.returncode, 2, pre.stdout + pre.stderr)
+        self.assertIn("head drift", pre.stdout)
+        # After the user commits the sealed change, the fetched sealed head makes the drift computable: strict VERIFIED.
+        _git(self.repo, "add", "calc.ts")
+        _git(self.repo, "commit", "-q", "-m", "user commit of the sealed change")
+        p = self._loki("verify", r["run_id"])
+        self.assertEqual(p.returncode, 0, p.stdout + p.stderr)
+        self.assertIn("verdict: VERIFIED", p.stdout)
+        # Negative control: without the fetched ref the same verify cannot compute the drift and is UNCHECKED again.
+        _git(self.repo, "update-ref", "-d", r["sealed_ref"])
+        _git(self.repo, "reflog", "expire", "--expire=now", "--all")
+        _git(self.repo, "gc", "-q", "--prune=now")
+        gone = self._loki("verify", r["run_id"])
+        self.assertEqual(gone.returncode, 2, gone.stdout + gone.stderr)
+        self.assertIn("head drift", gone.stdout)

package/mcp/v10_tools.py

@@ -9,15 +9,19 @@ validator before use.
 import json
 import os
 import re
+import shutil
 import subprocess
+import tempfile
 import time
 from pathlib import Path
 from typing import Callable, Dict, List, Optional
 
 LOKI_BIN = str(Path(__file__).resolve().parent.parent / "bin" / "loki")
 RUNS_REL = os.path.join(".loki", "runs")
+RUN_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
 V10_RUN_ID_WAIT_S = 2.0
 V10_VERIFY_TIMEOUT_S = 120
+SEAL_DIFF_TIMEOUT_S = int(os.environ.get("LOKI_SEAL_DIFF_TIMEOUT_S", "1800"))
 _TERMINAL = {"stage.completed", "stage.failed", "stage.skipped"}
 
 
@@ -195,6 +199,85 @@ def v10_verify(receipt_path: str, repo_path: str, validate: Callable[[str], str]
     return {"exit_code": p.returncode, "verified": p.returncode == 0, "output": out[-2000:]}
 
 
+def _git(cwd: str, *args: str, env: Optional[Dict[str, str]] = None) -> subprocess.CompletedProcess:
+    return subprocess.run(["git", *args], cwd=cwd, env=env, stdin=subprocess.DEVNULL,
+                          capture_output=True, timeout=120)
+
+
+def seal_diff(repo_path: str, intent: str, validate: Callable[[str], str]) -> dict:
+    """Seal changes already made in repo_path (CW-12): the existing engine runs on a scratch clone of HEAD with the
+    working-tree diff handed to `--seal-existing`, so the Wall is authored from the intent alone and the diff only
+    reaches the tree at implement. The user's tree, index and branch are never touched; only the run dir is copied back."""
+    if not isinstance(intent, str) or not intent.strip() or intent.startswith("-") or "\x00" in intent:
+        return {"error": "invalid intent: must be a non-empty description that does not start with '-'"}
+    try:
+        repo = validate(repo_path)
+    except Exception as e:
+        return {"error": str(e)}
+    if not os.path.isdir(repo):
+        return {"error": f"repo_path is not a directory: {repo_path}"}
+    work = tempfile.mkdtemp(prefix="loki-seal-")
+    try:
+        if _git(repo, "rev-parse", "--verify", "-q", "HEAD").returncode != 0:
+            return {"error": "repo_path is not a git repository with a commit to diff against"}
+        # Snapshot the working tree (tracked edits plus new files) with a private index so the user's index is untouched.
+        idx_env = dict(os.environ, GIT_INDEX_FILE=os.path.join(work, "index"))
+        for step in (("read-tree", "HEAD"), ("add", "-A")):
+            r = _git(repo, *step, env=idx_env)
+            if r.returncode != 0:
+                return {"error": f"could not snapshot the working tree: {r.stderr.decode('utf-8', 'replace').strip()[-300:]}"}
+        d = _git(repo, "diff", "--cached", "--binary", "HEAD", env=idx_env)
+        if d.returncode != 0 or not d.stdout.strip():
+            return {"error": "no changes to seal: the working tree matches HEAD"}
+        patch = os.path.join(work, "external.patch")
+        with open(patch, "wb") as f:
+            f.write(d.stdout)
+        clone = os.path.join(work, "clone")
+        c = _git(work, "clone", "--quiet", "--no-hardlinks", repo, clone)
+        if c.returncode != 0:
+            return {"error": f"could not clone the repository: {c.stderr.decode('utf-8', 'replace').strip()[-300:]}"}
+        try:
+            p = subprocess.run([LOKI_BIN, intent, "--seal-existing", patch], cwd=clone, env=_env(), stdin=subprocess.DEVNULL,
+                               capture_output=True, text=True, timeout=SEAL_DIFF_TIMEOUT_S)
+        except subprocess.TimeoutExpired:
+            return {"error": f"seal timed out after {SEAL_DIFF_TIMEOUT_S}s"}
+        except OSError as e:
+            return {"error": f"could not run loki: {e}"}
+        out = ((p.stdout or "") + (p.stderr or "")).strip()
+        try:
+            with open(os.path.join(clone, ".loki", "engine.json"), "r", encoding="utf-8") as f:
+                run_id = json.load(f)["run_id"]
+            if not isinstance(run_id, str) or not RUN_ID_RE.match(run_id) or ".." in run_id:
+                return {"error": "refusing a run_id that is not a plain run id"}  # the clone is engine-written but agent-writable: never join it into a path unchecked
+            src = os.path.join(clone, RUNS_REL, run_id)
+            with open(os.path.join(src, "receipt.json"), "r", encoding="utf-8") as f:
+                receipt = json.load(f)
+        except (OSError, ValueError, KeyError):
+            return {"error": f"loki exited {p.returncode} without a receipt. Output tail:\n{out[-1500:]}"}
+        dest = os.path.join(repo, RUNS_REL, run_id)
+        os.makedirs(os.path.dirname(dest), exist_ok=True)
+        shutil.copytree(src, dest, dirs_exist_ok=True)
+        # B4: bring the sealed commit into the user repo under a non-branch ref so `loki verify <id>` resolves the sealed head
+        # without LOKI_VERIFY_ALLOW_HEAD_DRIFT. Never a branch: HEAD, the index and tracked files stay untouched.
+        ref = f"refs/loki/seal/{run_id}"
+        sealed_ref = None
+        head = receipt.get("head_sha")
+        if isinstance(head, str) and re.fullmatch(r"[0-9a-f]{40,64}", head):
+            if _git(clone, "update-ref", ref, head).returncode == 0 and \
+               _git(repo, "fetch", "--quiet", "--no-tags", clone, f"{ref}:{ref}").returncode == 0:
+                sealed_ref = ref
+        verdict = receipt.get("verdict")
+        return {"run_id": run_id, "verdict": verdict,
+                "verdict_is_verified": verdict == "VERIFIED",  # the receipt's own verdict string; no signature is checked here, run loki_v10_verify for that
+                "receipt_path": os.path.join(dest, "receipt.json"), "sealed_ref": sealed_ref,
+                "not_proven": receipt.get("not_proven", []), "exit_code": p.returncode,
+                "note": "the new untracked .loki/ directory in the repo is expected (loki start creates it the same way); HEAD, the index and tracked files are unchanged"}
+    except subprocess.TimeoutExpired:
+        return {"error": "git timed out"}
+    finally:
+        shutil.rmtree(work, ignore_errors=True)
+
+
 def _cwd_validator(p: str) -> str:
     """Resolve p and require it to sit inside the current working directory (the MCP server's, as for the SDK path)."""
     root = os.path.realpath(os.getcwd())

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "11.66.2",
+  "version": "11.67.1",
   "description": "An autonomous software factory that knows what it is supposed to deliver, and proves it did.",
   "keywords": [
     "agent",
@@ -160,5 +160,5 @@
   "dependencies": {
     "@resvg/resvg-wasm": "^2.6.2"
   },
-  "gitHead": "a0b492c2b527118fa75885b90d4a40eeb6c57d1c"
+  "gitHead": "6ff9a3206d5e346bf72c0786a44fe02575091d93"
 }