loki-mode 11.76.0 → 11.78.0

package/autonomy/telemetry.sh

@@ -52,6 +52,12 @@ _loki_telemetry_auto_off() {
     return 1
 }
 
+# BASH_SOURCE is empty when sourced under zsh: skip the lookup rather than
+# resolve dirname "" to the current directory.
+_LOKI_TELEMETRY_SELF_DIR=""
+if [ -n "${BASH_SOURCE[0]:-}" ]; then
+    _LOKI_TELEMETRY_SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd -P)" || _LOKI_TELEMETRY_SELF_DIR=""
+fi
 LOKI_POSTHOG_HOST="${LOKI_TELEMETRY_ENDPOINT:-https://us.i.posthog.com}"
 LOKI_POSTHOG_KEY="phc_ya0vGBru41AJWtGNfZZ8H9W4yjoZy4KON0nnayS7s87"
 
@@ -208,48 +214,81 @@ _loki_known_blocker() {
     esac
 }
 
+# _loki_os_family: raw `uname -s` collapsed to a fixed enum (MINGW64_NT-10.0-19045
+# and friends are one family, not one value per Windows build).
+_loki_os_family() {
+    case "${1:-}" in
+        Linux*) printf 'linux' ;;
+        Darwin*) printf 'darwin' ;;
+        MINGW*|MSYS*|CYGWIN*|Windows*) printf 'windows' ;;
+        *) printf 'other' ;;
+    esac
+}
+
+_loki_arch_family() {
+    case "${1:-}" in
+        x86_64|amd64|x64) printf 'x64' ;;
+        arm64|aarch64) printf 'arm64' ;;
+        *) printf 'other' ;;
+    esac
+}
+
+# _loki_traffic: who is driving this process, as the enum user | ci | internal,
+# so analytics can filter bots and our own seats. internal wins, then ci (CI env
+# vars or a non-interactive session), else user. Mirrors _traffic in
+# dashboard/telemetry.py.
+_loki_traffic() {
+    if [ "${LOKI_INTERNAL:-}" = "1" ] || [ "${LOKI_SEAT_TICK:-}" = "1" ] || [ -n "${LOKI_SEAT:-}" ] || [ -n "${LOKI_COMPANY_SEAT:-}" ]; then
+        printf 'internal'; return
+    fi
+    if [ -n "${CI:-}" ] || [ -n "${GITHUB_ACTIONS:-}" ] || [ -n "${GITLAB_CI:-}" ] \
+        || [ -n "${BUILDKITE:-}" ] || [ -n "${JENKINS_URL:-}" ] \
+        || [ -n "${TEAMCITY_VERSION:-}" ] || [ -n "${CONTINUOUS_INTEGRATION:-}" ]; then
+        printf 'ci'; return
+    fi
+    if [ -n "${LOKI_TTY_INTERACTIVE:-}" ]; then
+        [ "${LOKI_TTY_INTERACTIVE}" = "1" ] && printf 'user' || printf 'ci'
+        return
+    fi
+    if [ ! -t 1 ] && [ ! -t 0 ]; then printf 'ci'; return; fi
+    printf 'user'
+}
+
+# loki_telemetry <event> [key=value...]: the ONE send path of the bash senders.
+# Order is load-bearing: the opt-out gate runs before anything else, so with
+# LOKI_TELEMETRY=off or DO_NOT_TRACK=1 no python, no curl and no network code is
+# reached. Then every key and value is filtered through
+# autonomy/lib/telemetry-schema.json (unlisted event: nothing is sent; unknown
+# key or out-of-enum value: dropped). Callers' pairs are untrusted by design;
+# the trusted base properties are appended last so a caller cannot override them.
 loki_telemetry() {
     _loki_telemetry_enabled || return 0
-    local event="$1"; shift
+    local event="${1:-}"; shift
+    [ -n "$event" ] || return 0
+    # The schema sits next to this file; prefer that over SCRIPT_DIR, which some
+    # callers leave unset when they only source this file.
+    local _lib="${_LOKI_TELEMETRY_SELF_DIR:-}/lib"
+    [ -f "$_lib/telemetry-schema.json" ] || _lib="${SCRIPT_DIR:-${SKILL_DIR:-}}/lib"
+    [ -f "$_lib/telemetry-schema.json" ] && [ -f "$_lib/proof-analytics-props.py" ] || return 0
     local distinct_id
     distinct_id=$(_loki_telemetry_id 2>/dev/null) || return 0
     local version
-    version=$(cat "${SCRIPT_DIR:-${SKILL_DIR:-}}/VERSION" 2>/dev/null || cat "${SCRIPT_DIR:-${SKILL_DIR:-}}/../VERSION" 2>/dev/null || echo "unknown")
+    version=$(cat "${SCRIPT_DIR:-${SKILL_DIR:-}}/VERSION" 2>/dev/null || cat "${SCRIPT_DIR:-${SKILL_DIR:-}}/../VERSION" 2>/dev/null || cat "${_LOKI_TELEMETRY_SELF_DIR:-}/../VERSION" 2>/dev/null || echo "unknown")
     version=$(echo "$version" | tr -d '[:space:]')
     local channel
     channel=$(_loki_detect_channel 2>/dev/null || echo "unknown")
-    local os_name arch
-    os_name=$(uname -s 2>/dev/null || echo "unknown")
-    arch=$(uname -m 2>/dev/null || echo "unknown")
+    local os_family arch
+    os_family=$(_loki_os_family "$(uname -s 2>/dev/null)")
+    arch=$(_loki_arch_family "$(uname -m 2>/dev/null)")
 
-    # Build JSON payload safely using Python to prevent injection.
     # The extra key=value pairs are forwarded as "$@" -- one argv slot per pair,
-    # QUOTED. They used to be joined into a single space-delimited string and
-    # then re-split by an unquoted expansion, which broke two ways: a value
-    # containing a space was truncated (`prd=my file.md` -> `prd=my`, rest
-    # dropped) or, if a fragment itself contained `=`, forged an extra PostHog
-    # property KEY; and the unquoted expansion also globbed, so `spec=*.md`
-    # expanded against the cwd and injected file names into the payload. Callers
-    # already pass each pair as its own quoted word, so "$@" is the array and no
-    # caller signature changes.
+    # QUOTED, so a value with spaces or glob characters is neither split nor
+    # expanded. The python side splits on the first "=" only.
     local payload
-    payload=$(python3 -c "
-import json, sys
-props = {'os': sys.argv[1], 'arch': sys.argv[2], 'version': sys.argv[3], 'channel': sys.argv[4]}
-for arg in sys.argv[5:]:
-    if '=' in arg:
-        k, v = arg.split('=', 1)
-        props[k] = v
-print(json.dumps({'api_key': '$LOKI_POSTHOG_KEY', 'event': sys.argv[5] if len(sys.argv) > 5 else '', 'distinct_id': '$distinct_id', 'properties': props}))
-" "$os_name" "$arch" "$version" "$channel" "$@" 2>/dev/null) || return 0
-    # Re-inject event and distinct_id properly
-    payload=$(python3 -c "
-import json, sys
-d = json.loads(sys.argv[1])
-d['event'] = sys.argv[2]
-d['distinct_id'] = sys.argv[3]
-print(json.dumps(d))
-" "$payload" "$event" "$distinct_id" 2>/dev/null) || return 0
+    payload=$(python3 "$_lib/proof-analytics-props.py" --payload "$event" "$distinct_id" "$LOKI_POSTHOG_KEY" \
+        "$@" "os_family=$os_family" "arch=$arch" "version=$version" "channel=$channel" \
+        "traffic=$(_loki_traffic)" 2>/dev/null) || return 0
+    [ -n "$payload" ] || return 0
 
     (curl -sS --max-time 3 -X POST "${LOKI_POSTHOG_HOST}/capture/" \
         -H "Content-Type: application/json" \

package/completions/_loki

@@ -74,6 +74,15 @@ function _loki {
                 agent)
                     _loki_agent
                     ;;
+                cost)
+                    _arguments \
+                        '--json[Output machine-readable JSON]' \
+                        '--last[Show only the last N runs]:count:' \
+                        '--month[Only runs generated in that month]:month (YYYY-MM):' \
+                        '--csv[One CSV row per run]' \
+                        '--detail[Per-iteration cache and trend breakdown]' \
+                        '--help[Show help]'
+                    ;;
                 estimate)
                     _arguments \
                         '--json[Output machine-readable JSON]' \
@@ -86,6 +95,7 @@ function _loki {
                         '--json[Output machine-readable JSON]' \
                         '--badge[Print verified deploy badge]' \
                         '--probe[Re-probe last deploy health URL]' \
+                        '--follow[Print one line per run event until the run ends]' \
                         '--help[Show help]'
                     ;;
                 doctor)
@@ -203,6 +213,15 @@ function _loki {
                 code)
                     _loki_code
                     ;;
+                github)
+                    _arguments \
+                        '1:subcommand:(status sync export pr publish protect)' \
+                        '--dry-run[protect: show the branch-protection read, change nothing]' \
+                        '--off[protect: restore the saved branch protection]' \
+                        '--public[publish: create a public repository]' \
+                        '--private[publish: create a private repository]' \
+                        '--dir[publish: project directory]:directory:_directories'
+                    ;;
                 deploy)
                     _arguments \
                         '--dir[Project directory to scan]:directory:_directories' \

package/completions/loki.bash

@@ -125,6 +125,13 @@ _loki_completion() {
             COMPREPLY=( $(compgen -W "${syslog_cmds}" -- "$cur") )
             ;;
 
+        cost)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--json --last --month --csv --detail --help" -- "$cur") )
+                return 0
+            fi
+            ;;
+
         estimate)
             if [[ "$cur" == -* ]]; then
                 COMPREPLY=( $(compgen -W "--json --model --provider --help" -- "$cur") )
@@ -134,7 +141,7 @@ _loki_completion() {
 
         status)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--json --badge --probe --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--json --badge --probe --follow --help" -- "$cur") )
                 return 0
             fi
             ;;
@@ -152,6 +159,15 @@ _loki_completion() {
             fi
             ;;
 
+        github)
+            if [[ "$cur" == -* ]]; then
+                COMPREPLY=( $(compgen -W "--dry-run --off --public --private --dir --help" -- "$cur") )
+                return 0
+            fi
+            COMPREPLY=( $(compgen -W "status sync export pr publish protect" -- "$cur") )
+            return 0
+            ;;
+
         deploy)
             if [[ "$cur" == -* ]]; then
                 COMPREPLY=( $(compgen -W "--execute --destination --canary --env-file --domain --health-url --health-match --auto-rollback --dir --no-clip --allow-unanchored --help" -- "$cur") )

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.76.0"
+__version__ = "11.78.0"
 
 __all__ = ["__version__"]

package/dashboard/api_start.py

@@ -32,7 +32,7 @@ from typing import Optional
 from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel
 
-from . import auth
+from . import auth, secure_tmp
 
 logger = logging.getLogger(__name__)
 router = APIRouter(tags=["start"])
@@ -85,15 +85,7 @@ def _creds_dir() -> Path:
 
 
 def _write_secret(name: str, value: str) -> None:
-    dest = _secret_path(name)
-    tmp = dest.with_name(".%s.%d.tmp" % (dest.name, os.getpid()))
-    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
-    try:
-        os.fchmod(fd, 0o600)
-        os.write(fd, (value + "\n").encode())
-    finally:
-        os.close(fd)
-    os.replace(tmp, dest)
+    secure_tmp.write_secret_atomic(_secret_path(name), (value + "\n").encode())
 
 
 def _read_secret(name: str) -> Optional[str]:

package/dashboard/secure_tmp.py

@@ -0,0 +1,92 @@
+"""Shared write-temp-then-rename for secrets, plus the stale-temp sweep.
+
+One-line justification for a new file: no existing dashboard module owns
+secret-temp creation and cleanup (build_supervisor._atomic_write is private to
+execution state and does not sweep). A writer killed between the temp write and
+the rename would otherwise leave the secret on disk forever.
+
+Mirrors sweepStaleTmp / writeExclusiveTmp in loki-ts/src/util/atomic.ts and
+_loki_mcp_sweep_stale_tmp in autonomy/lib/mcp-config.sh.
+"""
+import os
+import re
+import stat
+import time
+from pathlib import Path
+
+STALE_SECONDS = 60 * 60
+
+
+def _pid_alive(pid: int) -> bool:
+    try:
+        os.kill(pid, 0)
+    except ProcessLookupError:
+        return False
+    except PermissionError:
+        return True  # EPERM: the process exists, owned by someone else
+    except (OSError, OverflowError, ValueError):
+        return False
+    return True
+
+
+def sweep_stale_tmp(directory, pattern: str) -> None:
+    """Remove temps left by a dead writer.
+
+    `pattern` is fullmatched against each name in `directory` (never recursive)
+    and its first group is the writer pid. An entry is removed only when it is a
+    regular file (not a symlink), owned by this uid, not ours, and its pid is
+    dead or its mtime is over 60 minutes (pid reuse). A live writer's temp stays.
+    """
+    rx = re.compile(pattern, re.DOTALL)
+    uid = os.getuid()
+    try:
+        entries = list(os.scandir(directory))
+    except OSError:
+        return
+    for entry in entries:
+        m = rx.fullmatch(entry.name)
+        if not m:
+            continue
+        pid = int(m.group(1))
+        if pid == os.getpid():
+            continue
+        if pid > 2**31 - 1:
+            continue  # not a pid we could own; never signal or remove it
+        try:
+            st = os.lstat(entry.path)
+            if not stat.S_ISREG(st.st_mode) or st.st_uid != uid:
+                continue
+            if _pid_alive(pid) and time.time() - st.st_mtime <= STALE_SECONDS:
+                continue
+            os.unlink(entry.path)
+        except OSError:
+            continue
+
+
+def write_secret_atomic(dest, data: bytes, mode: int = 0o600) -> None:
+    """Write `data` to `dest` via `.<name>.<pid>.tmp` then rename.
+
+    The temp is created O_CREAT|O_EXCL|O_NOFOLLOW so a planted symlink or file
+    is never written through. Stale temps of dead writers are swept first.
+    """
+    dest = Path(dest)
+    sweep_stale_tmp(dest.parent, r"\.%s\.(\d+)\.tmp" % re.escape(dest.name))
+    tmp = dest.with_name(".%s.%d.tmp" % (dest.name, os.getpid()))
+    try:
+        os.unlink(tmp)  # our own pid left over from a reused pid
+    except FileNotFoundError:
+        pass
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, mode)
+    try:
+        try:
+            os.fchmod(fd, mode)
+            os.write(fd, data)
+        finally:
+            os.close(fd)
+        os.replace(tmp, dest)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise

package/dashboard/telemetry.py

@@ -13,6 +13,7 @@ Force-on:  LOKI_TELEMETRY=on  OR  ~/.loki/config: TELEMETRY_ENABLED=true
 All calls are fire-and-forget, silent on failure, non-blocking.
 """
 
+import importlib.util
 import json
 import os
 import platform
@@ -153,27 +154,92 @@ def _get_version():
         return "unknown"
 
 
+_LIB = Path(__file__).resolve().parent.parent / "autonomy" / "lib"
+
+
+def _load_schema_module():
+    """The one filter and schema live in autonomy/lib (shared with the bash
+    sender). Missing files mean nothing is sent: fail closed."""
+    spec = importlib.util.spec_from_file_location(
+        "loki_telemetry_schema", str(_LIB / "proof-analytics-props.py"))
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+def _os_family():
+    name = platform.system().lower()
+    if name in ("linux", "darwin"):
+        return name
+    if name.startswith(("windows", "mingw", "msys", "cygwin")):
+        return "windows"
+    return "other"
+
+
+def _arch_family():
+    m = platform.machine().lower()
+    if m in ("x86_64", "amd64", "x64"):
+        return "x64"
+    if m in ("arm64", "aarch64"):
+        return "arm64"
+    return "other"
+
+
+def _traffic():
+    """user | ci | internal. Mirrors _loki_traffic in autonomy/telemetry.sh."""
+    env = os.environ
+    if env.get("LOKI_INTERNAL") == "1" or env.get("LOKI_SEAT_TICK") == "1" or env.get("LOKI_SEAT") or env.get("LOKI_COMPANY_SEAT"):
+        return "internal"
+    for var in ("CI", "GITHUB_ACTIONS", "GITLAB_CI", "BUILDKITE", "JENKINS_URL",
+                "TEAMCITY_VERSION", "CONTINUOUS_INTEGRATION"):
+        if env.get(var):
+            return "ci"
+    sig = env.get("LOKI_TTY_INTERACTIVE")
+    if sig:
+        return "user" if sig == "1" else "ci"
+    try:
+        if not sys.stdout.isatty() and not sys.stdin.isatty():
+            return "ci"
+    except Exception:
+        pass
+    return "user"
+
+
+def build_payload(event, properties=None):
+    """Return the schema-filtered capture body, or None when the event is not
+    listed. Caller properties are untrusted; trusted base properties win."""
+    mod = _load_schema_module()
+    raw = dict(properties or {})
+    raw.update({
+        "os_family": _os_family(),
+        "arch": _arch_family(),
+        "version": _get_version(),
+        "channel": _detect_channel(),
+        "traffic": _traffic(),
+    })
+    props = mod.sanitize(mod.load_schema(), event, raw)
+    if props is None:
+        return None
+    return {
+        "api_key": _POSTHOG_KEY,
+        "event": event,
+        "distinct_id": _get_distinct_id(),
+        "properties": props,
+    }
+
+
 def send_telemetry(event, properties=None):
-    """Send anonymous telemetry event. Non-blocking, silent on failure."""
+    """Send anonymous telemetry event. Non-blocking, silent on failure.
+    The opt-out gate runs first, before any schema or network code."""
     if not _is_enabled():
         return
 
     def _send():
         try:
-            props = {
-                "os": platform.system(),
-                "arch": platform.machine(),
-                "version": _get_version(),
-                "channel": _detect_channel(),
-            }
-            if properties:
-                props.update(properties)
-            payload = json.dumps({
-                "api_key": _POSTHOG_KEY,
-                "event": event,
-                "distinct_id": _get_distinct_id(),
-                "properties": props,
-            }).encode()
+            body = build_payload(event, properties)
+            if body is None:
+                return
+            payload = json.dumps(body).encode()
             req = Request(
                 f"{_POSTHOG_HOST}/capture/",
                 data=payload,

package/docs/ARCHITECTURE.md

@@ -244,8 +244,9 @@ templates/                 21 PRD templates (saas, cli, discord-bot, ...)
 agents/                    Agent registry: types.json, hub install, managed registry
 benchmarks/                SWE-bench and HumanEval harnesses
 plugins/                   Claude Code plugin packaging
-.github/workflows/         CI: tests, release, sbom,
-                           security-audit, post-release-smoke, ...
+.github/workflows/         release.yml, converge-dist-tags.yml,
+                           sdk-freshness.yml (the pre-push gate is
+                           scripts/local-ci.sh, run locally)
 SKILL.md                   Slim core skill (progressive disclosure entry)
 CLAUDE.md                  Project + agent operating instructions
 VERSION / package.json     Single source of version truth
@@ -324,8 +325,9 @@ docker/                            Container distribution (Dockerfiles, compose)
   TS providers module.
 - **Docker / Docker Compose** for distribution and for the multi-service,
   12-factor stacks Loki generates (web + database + cache with healthchecks).
-- **GitHub Actions** for CI/CD: test suites, SBOM and security audits,
-  multi-channel release (npm, Docker, Homebrew), and post-release smoke tests.
+- **GitHub Actions** (`.github/workflows/`): `release.yml` (multi-channel
+  release), `converge-dist-tags.yml` and `sdk-freshness.yml`. The test suites
+  run locally through `scripts/local-ci.sh`, not in a workflow.
 
 ---
 

package/docs/{v10/CLI-MODERN.md → CLI-INVENTORY.md}

@@ -11,7 +11,7 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 - DROP-LEGACY: 31
 - DELETE: 14
 - Total rows: 144
-- Registry paths (commands and nested subcommands): 212
+- Registry paths (commands and nested subcommands): 214
 
 ## Commands
 
@@ -169,19 +169,19 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 - compliance: 1
 - config: 4
 - context: 5
-- cost: 6
+- cost: 7
 - deploy: 1
 - docs: 4
 - enterprise: 2
 - explain: 5
-- export: 6
-- github: 6
+- export: 7
+- github: 7
 - import: 1
 - init: 21
 - issue: 2
 - magic: 12
 - memory: 7
-- metrics: 6
+- metrics: 7
 - modernize: 3
 - next: 1
 - notify: 6
@@ -198,7 +198,7 @@ Classes: KEEP-MODERN (v10-native or engine-neutral), UPDATE (live but needs mode
 - secrets: 3
 - secure: 3
 - setup-skill: 1
-- share: 6
+- share: 7
 - ship: 1
 - syslog: 3
 - telemetry: 1

package/docs/CLI-REFERENCE.md

@@ -1,7 +1,7 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.76.0. Do not edit by hand.
-Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for the full inventory.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.78.0. Do not edit by hand.
+Hidden and legacy-only commands are omitted; see `docs/CLI-INVENTORY.md` for the full inventory.
 
 | Command | Description |
 | --- | --- |
@@ -144,6 +144,7 @@ Hidden and legacy-only commands are omitted; see `docs/v10/CLI-MODERN.md` for th
 | `loki assets export` | Export shareable assets |
 | `loki export` | Export session data |
 | `loki notify` | Notifications |
+| `loki notify desktop` | Send a desktop notification (macOS or Linux notify-send) |
 | `loki tour` | See a sample result |
 | `loki wow` | Tiny real task, or the offline sample |
 | `loki factory` | loki start with the autonomy policy printed |

package/docs/COMPARISON.md

@@ -31,7 +31,7 @@
 
 | Feature | **Loki Mode** | **Devin** | **Codex** | **Cursor** | **Kiro** | **Antigravity** | **Amazon Q** | **OpenCode** |
 |---------|--------------|-----------|-----------|------------|----------|-----------------|--------------|--------------|
-| **Multi-Agent** | 41 prompt-defined agent roles in 8 domains adopted per phase; parallel review council + optional worktree streams (Claude), sequential elsewhere | Single | Single | Up to 8 parallel | Background | Manager Surface | Multiple types | 4 built-in |
+| **Multi-Agent** | Role inventory: 41 prompt-defined roles in 8 domains (`agents/types.json`), adopted per phase; parallel review council + optional worktree streams (Claude), sequential elsewhere | Single | Single | Up to 8 parallel | Background | Manager Surface | Multiple types | 4 built-in |
 | **Orchestration** | Full orchestrator | N/A | N/A | Git worktree | Hooks | Manager view | Workflow | Subagents |
 | **Parallel Exec** | 10+ Haiku, 4 impl (worktree) | No | No | 8 max | Yes | Yes | Yes | Yes |
 | **Agent Domains** | Eng, Ops, Business, Data, Product, Growth, Review | N/A | N/A | N/A | N/A | N/A | 3 types | N/A |
@@ -145,7 +145,7 @@
 | **Multi-Agent Verification** | Model diversity (Claude vs OpenAI, 54% improvement) | 3 blind reviewers + devil's advocate | Different approach (N/A for Claude Code - only Claude models) |
 | **Quality Gates** | Built-in verification loops | 8 explicit gates + anti-sycophancy | **Loki Mode** |
 | **Memory System** | Not documented | 3-tier episodic/semantic/procedural | **Loki Mode** |
-| **Agent Specialization** | Custom Zen Agents | 41 pre-defined specialized agent roles | **Loki Mode** |
+| **Agent Specialization** | Custom Zen Agents | Role inventory: 41 prompt-defined roles in `agents/types.json` (a count of definitions, not a measured advantage) | Different approach |
 | **CI Failure Analysis** | Explicit pattern with auto-fix | DevOps agent only | **ADOPTED from Zencoder** |
 | **Review Comment Resolution** | Auto-apply simple changes | Manual review | **ADOPTED from Zencoder** |
 | **Dependency Management** | Scheduled PRs, one group at a time | Mentioned only | **ADOPTED from Zencoder** |
@@ -174,10 +174,9 @@
 
 1. **Quality Control**: 8 explicit gates + blind review + devil's advocate vs built-in loops
 2. **Memory System**: 3-tier (episodic/semantic/procedural) with cross-project learning
-3. **Agent Specialization**: 41 pre-defined specialized agent roles across 8 domains
-4. **Anti-Sycophancy**: CONSENSAGENT patterns prevent reviewer groupthink
-5. **Autonomy Design**: Minimal human intervention from PRD to production
-6. **Research Foundation**: 10+ academic papers integrated vs proprietary
+3. **Anti-Sycophancy**: CONSENSAGENT patterns prevent reviewer groupthink
+4. **Autonomy Design**: Minimal human intervention from PRD to production
+5. **Research Foundation**: 10+ academic papers integrated vs proprietary
 
 ### Where Zencoder EXCEEDS Loki Mode
 
@@ -230,7 +229,6 @@ These are patterns from competing projects that are **practically and scientific
 | **Constitutional AI Integration** | Principles-based self-critique from Anthropic research | None have this |
 | **Anti-Sycophancy (CONSENSAGENT)** | Blind review + devil's advocate prevents groupthink | None have this |
 | **Provider Abstraction Layer** | Clean degradation from full-featured to sequential-only | Claude-only projects can't degrade |
-| **41 Specialized Agent Roles** | Purpose-built role definitions in 8 domains vs generic; Loki gates every role's output through blind review + council | agents (108) has more but less organized |
 | **Research Foundation** | 10+ academic papers integrated with citations | Most have no research backing |
 
 ### Superpowers Deep-Dive (35K+ Stars)
@@ -352,7 +350,7 @@ Tiered agent architecture with explicit escalation:
 | Dimension | Loki Mode Advantage |
 |-----------|-------------------|
 | **Autonomy** | Designed for high autonomy with minimal human intervention |
-| **Multi-Agent** | 41 prompt-defined agent roles in 8 domains adopted per phase (parallel review council + optional worktree streams on Claude, sequential elsewhere) vs 1-8 in competitors, with all output gated by blind review + council |
+| **Multi-Agent** | Role inventory: 41 prompt-defined roles in 8 domains (`agents/types.json`), adopted per phase; parallel review council + optional worktree streams on Claude, sequential elsewhere. Output is gated by blind review + council |
 | **Quality** | 8 gates + blind review + devil's advocate + property-based testing |
 | **Research** | 10+ academic papers integrated vs proprietary/undisclosed |
 | **Anti-Sycophancy** | Only agent with CONSENSAGENT-based blind review |

package/docs/COMPONENTS.md

@@ -324,7 +324,7 @@ The agent type registry and installation tooling.
 phase.
 
 **Key files:**
-- `types.json` - Agent type definitions (41 agent types across 8 domains).
+- `agents/types.json` - Agent type definitions (41 agent types across 8 domains).
 - `hub_install.py` - Agent hub install.
 - `managed_registry.py` - Managed agent registry.
 

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.76.0
+**Version:** v11.78.0
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).