loki-mode 11.90.0 → 11.92.0

package/autonomy/loki

@@ -143,6 +143,17 @@ _loki_caveman_narration_level() {
 # claude-flags.sh (like the caveman wrapper above) and fills _LOKI_PERM_ARGV; unset
 # LOKI_PERMISSION_POLICY=legacy keeps --dangerously-skip-permissions byte-identically.
 _loki_perm_argv_for() {
+    # Also sets _LOKI_CLAUDE_SHELL, the SHELL value every claude spawn in this CLI
+    # pins (/bin/bash; LOKI_E10_KEEP_USER_SHELL=1 keeps the user's). Computed in a
+    # subshell so the helper's top-level exports never leak. Falls back to the
+    # user's SHELL when the lib is unavailable. Spawn sites that need only the
+    # shell call this with output discarded.
+    _LOKI_CLAUDE_SHELL="$(
+        # shellcheck source=autonomy/lib/claude-flags.sh
+        . "${_LOKI_SCRIPT_DIR}/lib/claude-flags.sh" >/dev/null 2>&1 || exit 1
+        _loki_claude_shell_value
+    )" || _LOKI_CLAUDE_SHELL=""
+    [ -n "$_LOKI_CLAUDE_SHELL" ] || _LOKI_CLAUDE_SHELL="${SHELL-}"
     _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
     # Legacy policy: return before sourcing anything (claude-flags.sh exports caveman vars).
     [ "${LOKI_PERMISSION_POLICY:-}" = "legacy" ] && return 0
@@ -19851,7 +19862,7 @@ Tasks:
             _loki_perm_argv_for "$codebase_path"
             case "$provider_name" in
                 claude)
-                    { (cd "$codebase_path" && if [ -n "$_loki_mig_cm" ]; then CAVEMAN_DEFAULT_MODE="$_loki_mig_cm" claude "${_LOKI_PERM_ARGV[@]}" -p "$phase_prompt" --output-format stream-json --verbose 2>&1; else claude "${_LOKI_PERM_ARGV[@]}" -p "$phase_prompt" --output-format stream-json --verbose 2>&1; fi) | \
+                    { (cd "$codebase_path" && if [ -n "$_loki_mig_cm" ]; then SHELL="$_LOKI_CLAUDE_SHELL" CAVEMAN_DEFAULT_MODE="$_loki_mig_cm" claude "${_LOKI_PERM_ARGV[@]}" -p "$phase_prompt" --output-format stream-json --verbose 2>&1; else SHELL="$_LOKI_CLAUDE_SHELL" claude "${_LOKI_PERM_ARGV[@]}" -p "$phase_prompt" --output-format stream-json --verbose 2>&1; fi) | \
                         while IFS= read -r line; do
                             # Extract text from stream-json
                             if echo "$line" | python3 -c "
@@ -20029,7 +20040,7 @@ IMPORTANT RULES:
         _loki_perm_argv_for "$codebase_path"
         case "$provider_name" in
             claude)
-                { (cd "$codebase_path" && if [ -n "$_loki_doc_cm" ]; then CAVEMAN_DEFAULT_MODE="$_loki_doc_cm" claude "${_LOKI_PERM_ARGV[@]}" -p "$doc_prompt" --output-format stream-json --verbose 2>&1; else claude "${_LOKI_PERM_ARGV[@]}" -p "$doc_prompt" --output-format stream-json --verbose 2>&1; fi) | \
+                { (cd "$codebase_path" && if [ -n "$_loki_doc_cm" ]; then SHELL="$_LOKI_CLAUDE_SHELL" CAVEMAN_DEFAULT_MODE="$_loki_doc_cm" claude "${_LOKI_PERM_ARGV[@]}" -p "$doc_prompt" --output-format stream-json --verbose 2>&1; else SHELL="$_LOKI_CLAUDE_SHELL" claude "${_LOKI_PERM_ARGV[@]}" -p "$doc_prompt" --output-format stream-json --verbose 2>&1; fi) | \
                     while IFS= read -r line; do
                         if echo "$line" | python3 -c "
 import sys, json
@@ -21095,7 +21106,7 @@ Begin healing now. Follow the RARV cycle for each action."
         claude)
             _loki_perm_argv_for "$codebase_path"
             local run_args=("${_LOKI_PERM_ARGV[@]}" -p "$heal_prompt" --output-format stream-json --verbose)
-            (cd "$codebase_path" && if [ -n "$_loki_heal_cm" ]; then CAVEMAN_DEFAULT_MODE="$_loki_heal_cm" claude "${run_args[@]}" 2>&1; else claude "${run_args[@]}" 2>&1; fi) | \
+            (cd "$codebase_path" && if [ -n "$_loki_heal_cm" ]; then SHELL="$_LOKI_CLAUDE_SHELL" CAVEMAN_DEFAULT_MODE="$_loki_heal_cm" claude "${run_args[@]}" 2>&1; else SHELL="$_LOKI_CLAUDE_SHELL" claude "${run_args[@]}" 2>&1; fi) | \
                 while IFS= read -r line; do
                     if echo "$line" | python3 -c "
 import sys, json
@@ -23135,6 +23146,28 @@ print(target)
 PY
 }
 
+# One line per supported provider (names from SUPPORTED_PROVIDERS in providers/loader.sh), printed once.
+try_print_provider_setup() {
+    local want="$1" known p hint
+    known="$(sed -n 's/^SUPPORTED_PROVIDERS=(\(.*\))$/\1/p' "$_LOKI_SCRIPT_DIR/../providers/loader.sh" 2>/dev/null | tr -d '"' | head -1)"
+    if [ -z "$known" ]; then
+        echo "loki try: cannot read SUPPORTED_PROVIDERS from providers/loader.sh" >&2
+        return 1
+    fi
+    echo "loki try: no provider is ready for '$want'. Set up one of these, then run loki try again (or preview with --dry-run):"
+    for p in $known; do
+        case "$p" in
+            claude) hint="claude login   (or set ANTHROPIC_API_KEY)" ;;
+            codex) hint="codex login   (or set OPENAI_API_KEY)" ;;
+            opencode) hint="opencode auth login" ;;
+            aider) hint="install aider and set OPENAI_API_KEY or ANTHROPIC_API_KEY" ;;
+            cline) hint="install the cline CLI and configure its API key" ;;
+            *) hint="install the $p CLI (no login command is mapped for it)" ;;
+        esac
+        echo "  $p: $hint"
+    done
+}
+
 _cmd_try_body() {
     local tmp="$1" url="$2" dry_run="$3" provider="$4" max_cost="$5"
     local dest="$tmp/repo" task
@@ -23167,7 +23200,7 @@ _cmd_try_body() {
     if receipt="$(try_keep_receipt "$dest" "$stamp")"; then
         echo ""
         echo "Receipt: $receipt"
-        echo "Check it: loki verify $receipt"
+        echo "Check it: npx loki-mode verify \"$receipt\""
     else
         echo ""
         echo "No receipt was written (run exited $rc)."
@@ -23252,8 +23285,8 @@ cmd_try() {
         *) echo "loki try: unknown provider '$use_provider' (use claude, opencode, codex, cline or aider)" >&2; return 2 ;;
     esac
     if [ "$dry_run" != true ] && ! wow_provider_ready "$use_provider"; then
-        echo "loki try: no provider ready for '$use_provider'. Run 'loki doctor', or preview with --dry-run." >&2
-        return 1
+        try_print_provider_setup "$use_provider" >&2
+        return 2
     fi
 
     local tmp rc=0
@@ -24270,7 +24303,8 @@ _review_ultra() {
     echo -e "${DIM}Running: claude ${ur_argv[*]}${NC}" >&2
     echo "" >&2
     local ur_rc=0
-    claude "${ur_argv[@]}" || ur_rc=$?
+    _loki_perm_argv_for "$PWD" >/dev/null 2>&1 || true
+    SHELL="$_LOKI_CLAUDE_SHELL" claude "${ur_argv[@]}" || ur_rc=$?
     if [ "$ur_rc" -ne 0 ] && [ "$trust_ws" != true ] && [ "$ur_trust_ok" = true ]; then
         echo "If claude reported an untrusted folder, re-run: loki review --ultra --yes --trust-workspace" >&2
     fi
@@ -24397,7 +24431,8 @@ _run_ultracode() {
 
     echo -e "${DIM}Running: claude -p \"ultracode: ...\" --model opus${NC}" >&2
     echo "" >&2
-    claude "${uc_argv[@]}"
+    _loki_perm_argv_for "$PWD" >/dev/null 2>&1 || true
+    SHELL="$_LOKI_CLAUDE_SHELL" claude "${uc_argv[@]}"
     return $?
 }
 
@@ -28178,13 +28213,14 @@ _pr_record_merge() {
 # exactly 0 reverts in git history. A revert count of null (history
 # unreadable), a missing record, an unreadable trust output or an unreadable or
 # truncated file list or an unreadable diff all refuse, as does any PR whose
-# diff touches a symlink (120000) or submodule (160000) mode. Protected paths (.github/, .loki/, .env*,
+# diff touches a symlink (120000) or submodule (160000) mode, including a pure
+# rename of one (modes read from git on the base and head). Protected paths (.github/, .loki/, .env*,
 # .envrc, CODEOWNERS, plus the space-separated globs in
 # LOKI_EARNED_MERGE_PROTECTED), matched case-insensitively, always stay
 # PR-only. The reason for a refusal goes to stdout; the return code is 1.
 _pr_earned_merge_check() {
     local pr="$1" min="${LOKI_EARNED_MERGE_MIN_VERIFIED:-20}" meta="" num="" want="" lines="" seals=""
-    local kind p lp g row v r got=0 globs=() diff="" bad_mode=""
+    local kind p lp g row v r got=0 globs=() diff="" bad_mode="" renames="" refs="" base="" head="" from to m_old m_new
     case "$min" in ''|*[!0-9]*) min=20 ;; esac
     [ "$min" -ge 1 ] || min=1
     command -v jq >/dev/null 2>&1 || { echo "jq is required to read the Seal record"; return 1; }
@@ -28229,6 +28265,28 @@ EOF_FILES
     [ -n "$diff" ] || { echo "the PR's file modes are unreadable"; return 1; }
     bad_mode="$(printf '%s\n' "$diff" | awk '/^diff --git /{h=$0} /^(new file mode|deleted file mode|old mode|new mode) (120000|160000)$/{print h; exit} /^index [0-9a-f.]+ (120000|160000)$/{print h; exit}')"
     [ -z "$bad_mode" ] || { echo "${bad_mode#diff --git } involves a symlink or submodule"; return 1; }
+    # A pure rename (100% similarity) carries no mode or index line, so the scan
+    # above cannot see a symlink moving. Read both sides' modes from git.
+    renames="$(printf '%s\n' "$diff" | awk '/^rename from /{f=substr($0,13)} /^rename to /{print f "\t" substr($0,11); f=""}')"
+    if [ -n "$renames" ]; then
+        refs="$(gh pr view "$pr" --json baseRefOid,headRefOid -q '.baseRefOid + " " + .headRefOid' 2>/dev/null)" || refs=""
+        base="${refs%% *}"; head="${refs#* }"
+        case "$base$head" in ''|*[!0-9a-f]*) echo "the PR's rename modes are unreadable"; return 1 ;; esac
+        if ! git cat-file -e "${base}^{commit}" 2>/dev/null || ! git cat-file -e "${head}^{commit}" 2>/dev/null; then
+            GIT_TERMINAL_PROMPT=0 git fetch -q origin "pull/${num}/head" >/dev/null 2>&1 || true
+        fi
+        while IFS="$(printf '\t')" read -r from to; do
+            [ -n "$to" ] || continue
+            m_old="$(git ls-tree --full-tree "$base" -- "$from" 2>/dev/null | awk '{print $1; exit}')"
+            m_new="$(git ls-tree --full-tree "$head" -- "$to" 2>/dev/null | awk '{print $1; exit}')"
+            case "$m_old:$m_new" in
+                120000:*|160000:*|*:120000|*:160000) echo "rename from $from to $to involves a symlink or submodule"; return 1 ;;
+                '':*|*:'') echo "rename from $from to $to has unreadable file modes"; return 1 ;;
+            esac
+        done <<EOF_RENAMES
+$renames
+EOF_RENAMES
+    fi
     return 0
 }
 
@@ -30531,7 +30589,8 @@ cmd_remote() {
     # If workspace isn't trusted, it exits immediately with an error.
     # Use || true to prevent set -e from killing the script before auto-recovery.
     local rc_exit=0
-    claude remote-control ${rc_flags[@]+"${rc_flags[@]}"} || rc_exit=$?
+    _loki_perm_argv_for "$PWD" >/dev/null 2>&1 || true
+    SHELL="$_LOKI_CLAUDE_SHELL" claude remote-control ${rc_flags[@]+"${rc_flags[@]}"} || rc_exit=$?
 
     # Exit 0 = normal session end
     if [ $rc_exit -eq 0 ]; then
@@ -30571,7 +30630,8 @@ print('ok')
     echo ""
     echo -e "${GREEN}Launching remote control...${NC}"
     echo ""
-    exec claude remote-control ${rc_flags[@]+"${rc_flags[@]}"}
+    _loki_perm_argv_for "$PWD" >/dev/null 2>&1 || true
+    SHELL="$_LOKI_CLAUDE_SHELL" exec claude remote-control ${rc_flags[@]+"${rc_flags[@]}"}
 }
 
 # Syslog/SIEM integration management
@@ -31250,6 +31310,7 @@ cmd_metrics() {
     local last_n=0
     local save_file=false
     local share_flag=false
+    local share_visibility=""
 
     while [[ $# -gt 0 ]]; do
         case "$1" in
@@ -31266,7 +31327,8 @@ cmd_metrics() {
                 echo "  --json               Machine-readable JSON output"
                 echo "  --last N             Analyze only the last N sessions (default: all)"
                 echo "  --save               Write report to METRICS.md in project root"
-                echo "  --share              Upload report as GitHub Gist (via loki share)"
+                echo "  --share              Upload report as a secret GitHub Gist (via loki share)"
+                echo "  --public             With --share, create a PUBLIC gist instead"
                 echo "  --help, -h           Show this help"
                 echo ""
                 echo "Subcommands:"
@@ -31277,7 +31339,7 @@ cmd_metrics() {
                 echo "  loki metrics --json            # Machine-readable output"
                 echo "  loki metrics --last 5          # Last 5 sessions only"
                 echo "  loki metrics --save            # Write METRICS.md"
-                echo "  loki metrics --share           # Share as GitHub Gist"
+                echo "  loki metrics --share           # Share as a secret GitHub Gist"
                 echo "  loki metrics prometheus        # Prometheus metrics from dashboard"
                 exit 0
                 ;;
@@ -31286,6 +31348,7 @@ cmd_metrics() {
             --last=*) last_n="${1#*=}"; shift ;;
             --save) save_file=true; shift ;;
             --share) share_flag=true; shift ;;
+            --public) share_visibility="--public"; shift ;;
             prometheus)
                 # Legacy Prometheus metrics subcommand
                 shift
@@ -31685,21 +31748,22 @@ METRICS_SCRIPT
 
     # Handle --share flag
     if [ "$share_flag" = true ]; then
-        local tmpfile
-        tmpfile=$(mktemp "/tmp/loki-metrics-XXXXXX.md")
+        local tmpdir tmpfile
+        tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/loki-metrics.XXXXXXXX") || exit 1
+        tmpfile="$tmpdir/metrics.md"
         echo "$metrics_output" > "$tmpfile"
 
         if ! command -v gh &>/dev/null; then
             echo -e "${RED}gh CLI not found -- cannot share${NC}"
             echo "Install: brew install gh"
-            rm -f "$tmpfile"
+            rm -f "$tmpfile"; rmdir "$tmpdir" 2>/dev/null || true
             exit 1
         fi
 
         if ! gh auth status &>/dev/null 2>&1; then
             echo -e "${RED}GitHub CLI not authenticated${NC}"
             echo "Run 'gh auth login' to authenticate."
-            rm -f "$tmpfile"
+            rm -f "$tmpfile"; rmdir "$tmpdir" 2>/dev/null || true
             exit 1
         fi
 
@@ -31708,9 +31772,12 @@ METRICS_SCRIPT
         project_name=$(basename "$(pwd)")
         local gist_desc="Loki Mode productivity report - ${project_name:-project} ($(date +%Y-%m-%d))"
         local gist_url
-        gist_url=$(gh gist create "$tmpfile" --desc "$gist_desc" --public 2>&1)
+        if [ "$share_visibility" = "--public" ]; then
+            echo -e "${YELLOW}Warning: this gist is PUBLIC and visible to anyone with the URL.${NC}" >&2
+        fi
+        gist_url=$(gh gist create "$tmpfile" --desc "$gist_desc" $share_visibility 2>&1)
         local gist_exit=$?
-        rm -f "$tmpfile"
+        rm -f "$tmpfile"; rmdir "$tmpdir" 2>/dev/null || true
 
         if [ $gist_exit -ne 0 ]; then
             echo -e "${RED}Failed to create gist${NC}"
@@ -32805,7 +32872,8 @@ USER TASK: ${prompt}"
             local agent_exit=0
             case "$provider" in
                 claude)
-                    claude -p "$full_prompt" 2>&1 || agent_exit=$?
+                    _loki_perm_argv_for "$PWD" >/dev/null 2>&1 || true
+                    SHELL="$_LOKI_CLAUDE_SHELL" claude -p "$full_prompt" 2>&1 || agent_exit=$?
                     ;;
                 codex)
                     codex exec --sandbox workspace-write "$full_prompt" 2>&1 || agent_exit=$?
@@ -32946,7 +33014,7 @@ $diff"
             [ -f ".loki/state/provider" ] && provider=$(cat ".loki/state/provider" 2>/dev/null)
 
             case "$provider" in
-                claude)  claude -p "$review_prompt" 2>&1 ;;
+                claude)  _loki_perm_argv_for "$PWD" >/dev/null 2>&1 || true; SHELL="$_LOKI_CLAUDE_SHELL" claude -p "$review_prompt" 2>&1 ;;
                 codex)   codex exec --sandbox workspace-write "$review_prompt" 2>&1 ;;
                 cline)   cline -y "$review_prompt" 2>&1 ;;
                 aider)   aider --message "$review_prompt" --yes-always --no-auto-commits < /dev/null 2>&1 ;;
@@ -34714,7 +34782,8 @@ _docs_invoke_provider() {
             declare -F loki_child_ledger_append >/dev/null 2>&1 && _ledger=true
             local _fmt=()
             [ "$_ledger" = true ] && _fmt=(--output-format json)
-            result=$($t_prefix env CAVEMAN_DEFAULT_MODE=off claude -p ${_lean[@]+"${_lean[@]}"} ${_fmt[@]+"${_fmt[@]}"} --model "${LOKI_DOCS_MODEL:-sonnet}" "$prompt" 2>/dev/null) || exit_code=$?
+            _loki_perm_argv_for "$PWD" >/dev/null 2>&1 || true
+            result=$($t_prefix env "SHELL=$_LOKI_CLAUDE_SHELL" CAVEMAN_DEFAULT_MODE=off claude -p ${_lean[@]+"${_lean[@]}"} ${_fmt[@]+"${_fmt[@]}"} --model "${LOKI_DOCS_MODEL:-sonnet}" "$prompt" 2>/dev/null) || exit_code=$?
             if [ "$_ledger" = true ] && [ -n "$result" ]; then
                 loki_child_ledger_append docs "$result" >/dev/null 2>&1 || true
                 result=$(printf '%s' "$result" | python3 -c 'import json,sys
@@ -38915,7 +38984,8 @@ REPORT_SCRIPT
 
 cmd_share() {
     local format="markdown"
-    local visibility="--public"
+    # Secret by default: --public is passed to gh only on an explicit --public.
+    local visibility=""
 
     while [[ $# -gt 0 ]]; do
         case "$1" in
@@ -38928,20 +38998,22 @@ cmd_share() {
                 echo "returning a shareable URL."
                 echo ""
                 echo "Options:"
-                echo "  --private            Create a secret gist (default: public)"
+                echo "  --public             Create a PUBLIC gist, visible to anyone with the URL"
+                echo "  --private            Create a secret gist (default: secret; accepted for compatibility)"
                 echo "  --format <fmt>       Report format: text, markdown, html (default: markdown)"
                 echo "  --help, -h           Show this help"
                 echo ""
                 echo "Examples:"
-                echo "  loki share                         # Public markdown gist"
-                echo "  loki share --private               # Secret gist"
-                echo "  loki share --format html           # Public HTML gist"
-                echo "  loki share --private --format text  # Secret text gist"
+                echo "  loki share                         # Secret markdown gist (default)"
+                echo "  loki share --public                # Public gist"
+                echo "  loki share --format html           # Secret HTML gist"
+                echo "  loki share --public --format text  # Public text gist"
                 echo ""
                 echo "Requires: gh CLI (https://cli.github.com)"
                 exit 0
                 ;;
             --private) visibility=""; shift ;;
+            --public) visibility="--public"; shift ;;
             --format) format="${2:-markdown}"; shift 2 ;;
             --format=*) format="${1#*=}"; shift ;;
             *) echo -e "${RED}Unknown option: $1${NC}" >&2; echo "Run 'loki share --help' for usage." >&2; exit 1 ;;
@@ -38991,20 +39063,21 @@ cmd_share() {
     esac
 
     # Generate report to temp file
-    local tmpfile
-    tmpfile=$(mktemp "/tmp/loki-share-XXXXXX.$ext")
+    local tmpdir tmpfile
+    tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/loki-share.XXXXXXXX") || exit 1
+    tmpfile="$tmpdir/session-report.$ext"
 
     echo "Generating session report..."
     if ! "$0" report --format "$format" > "$tmpfile" 2>/dev/null; then
         echo -e "${RED}Failed to generate session report${NC}"
-        rm -f "$tmpfile"
+        rm -f "$tmpfile"; rmdir "$tmpdir" 2>/dev/null || true
         exit 1
     fi
 
     # Verify report is not empty
     if [ ! -s "$tmpfile" ]; then
         echo -e "${RED}Generated report is empty${NC}"
-        rm -f "$tmpfile"
+        rm -f "$tmpfile"; rmdir "$tmpdir" 2>/dev/null || true
         exit 1
     fi
 
@@ -39015,8 +39088,8 @@ cmd_share() {
 }
 
 # Internal helper: upload a single file as a GitHub Gist.
-# Args: $1=file path, $2=description, $3=visibility ("--public", "--private",
-# or "" for gh's default). NOTE: $3 is intentionally left unquoted at the
+# Args: $1=file path, $2=description, $3=visibility ("--public" for a public
+# gist, or "" for gh's default, which is a secret gist). NOTE: $3 is intentionally left unquoted at the
 # gh call site so an empty value collapses (the --private case sets it to "").
 # Removes the input file after the attempt. Prints "Shared: <url>" on success;
 # on failure prints the gh error and exits 1.
@@ -39031,6 +39104,9 @@ _loki_gist_upload() {
     # "Shared:" line and the ready-to-post hook with multi-line gh chatter.
     local gist_out gist_err gist_exit
     local errfile
+    if [ "$visibility" = "--public" ]; then
+        echo -e "${YELLOW}Warning: this gist is PUBLIC and visible to anyone with the URL.${NC}" >&2
+    fi
     # Fall back to /dev/null if mktemp fails (disk full / unwritable /tmp) so the
     # redirect target is always a real path -- never an empty string (2>"" is a
     # bash error). We lose the captured stderr text in that rare case, not the
@@ -39041,8 +39117,12 @@ _loki_gist_upload() {
     gist_err=$(cat "$errfile" 2>/dev/null)
     [ "$errfile" != "/dev/null" ] && rm -f "$errfile"
 
-    # Cleanup temp file
+    # Cleanup temp file and its private loki-* directory (rmdir only removes
+    # an empty directory).
     rm -f "$file"
+    case "$(basename "$(dirname "$file")")" in
+        loki-*) rmdir "$(dirname "$file")" 2>/dev/null || true ;;
+    esac
 
     if [ $gist_exit -ne 0 ]; then
         echo -e "${RED}Failed to create gist${NC}"
@@ -39165,8 +39245,9 @@ PYEOF
 
     # POST the redacted HTML. Auth header is sent only if a license key exists;
     # OSS users with their own endpoint need no key.
-    local tmp_body tmp_code
-    tmp_body=$(mktemp "/tmp/loki-hosted-XXXXXX.out")
+    local tmp_body tmp_code tmp_body_dir
+    tmp_body_dir=$(mktemp -d "${TMPDIR:-/tmp}/loki-hosted.XXXXXXXX") || return 1
+    tmp_body="$tmp_body_dir/response.out"
     local -a curl_args=(-sS -o "$tmp_body" -w '%{http_code}' -X POST
         -H "Content-Type: text/html"
         -H "X-Loki-Proof-Id: ${id}"
@@ -39180,7 +39261,7 @@ PYEOF
     if [ "$curl_exit" -ne 0 ]; then
         echo -e "${RED}Failed to reach hosted endpoint (curl exit ${curl_exit}).${NC}" >&2
         echo "Check LOKI_HOSTED_ENDPOINT or publish to a gist: loki proof share ${id}" >&2
-        rm -f "$tmp_body"
+        rm -f "$tmp_body"; rmdir "$tmp_body_dir" 2>/dev/null || true
         return 1
     fi
 
@@ -39207,7 +39288,7 @@ except Exception:
 print(url)
 PYEOF
 )
-            rm -f "$tmp_body"
+            rm -f "$tmp_body"; rmdir "$tmp_body_dir" 2>/dev/null || true
             if [ -n "$published_url" ]; then
                 echo -e "${GREEN}Published: ${published_url}${NC}"
             else
@@ -39224,7 +39305,7 @@ PYEOF
                 echo "" >&2
             fi
             echo "Nothing was published. Or publish to a gist: loki proof share ${id}" >&2
-            rm -f "$tmp_body"
+            rm -f "$tmp_body"; rmdir "$tmp_body_dir" 2>/dev/null || true
             return 1
             ;;
     esac
@@ -39495,7 +39576,8 @@ cmd_proof() {
             echo ""
             echo "Options for 'share':"
             echo "  --yes                Skip the redaction-preview confirmation prompt"
-            echo "  --private            Create a secret gist (default: public)"
+            echo "  --public             Create a PUBLIC gist, visible to anyone with the URL"
+            echo "  --private            Create a secret gist (default: secret; accepted for compatibility)"
             echo "  --hosted             Publish to LOKI_HOSTED_ENDPOINT (open-core seam; no official backend yet)"
             echo ""
             echo "Proofs are generated automatically at run completion (LOKI_PROOF=0 to opt out)."
@@ -40153,7 +40235,7 @@ print(json.dumps(doc, indent=2))
         share)
             local id=""
             local skip_confirm=0
-            local visibility="--public"
+            local visibility=""
             local hosted=0
             # every python3 invocation below reads proof.json from inside
             # the checkout being shared. Resolve an absolute path once so an
@@ -40258,8 +40340,9 @@ PYEOF
             fi
 
             # Copy to a temp file so _loki_gist_upload can remove it after.
-            local tmpfile
-            tmpfile=$(mktemp "/tmp/loki-proof-XXXXXX.html")
+            local tmpfile tmpdir
+            tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/loki-proof.XXXXXXXX") || exit 1
+            tmpfile="$tmpdir/proof.html"
             cp "$html" "$tmpfile"
             echo "Uploading proof page..."
             local gist_desc="Loki Mode proof-of-run ${id}"

package/autonomy/quickstart.sh

@@ -825,6 +825,17 @@ _qs_classify_invoke() {
     if command -v timeout >/dev/null 2>&1; then to="timeout"
     elif command -v gtimeout >/dev/null 2>&1; then to="gtimeout"; fi
     _LOKI_PERM_ARGV=(--dangerously-skip-permissions)
+    # Pin SHELL=/bin/bash for the claude child (LOKI_E10_KEEP_USER_SHELL=1 keeps the user
+    # shell). Computed in a subshell so the helper's top-level exports never leak.
+    local _qs_shell _qs_shell_lib
+    _qs_shell_lib="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)/lib/claude-flags.sh"
+    _qs_shell="$(
+        # shellcheck source=/dev/null
+        type _loki_claude_shell_value >/dev/null 2>&1 \
+            || . "$_qs_shell_lib" >/dev/null 2>&1 || exit 1
+        _loki_claude_shell_value
+    )" || _qs_shell=""
+    [ -n "$_qs_shell" ] || _qs_shell="${SHELL-}"
     if [ "${LOKI_PERMISSION_POLICY:-}" != "legacy" ]; then
         # P12-26b: nothing on this path sources claude-flags.sh. Compute in a subshell so its
         # top-level exports (caveman vars) never leak; fail closed to plan when unavailable.
@@ -844,10 +855,10 @@ _qs_classify_invoke() {
         fi
     fi
     if [ -n "$to" ]; then
-        out=$(CAVEMAN_DEFAULT_MODE=off "$to" "${LOKI_QUICKSTART_CLASSIFY_TIMEOUT}" \
+        out=$(SHELL="$_qs_shell" CAVEMAN_DEFAULT_MODE=off "$to" "${LOKI_QUICKSTART_CLASSIFY_TIMEOUT}" \
                   claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     else
-        out=$(CAVEMAN_DEFAULT_MODE=off \
+        out=$(SHELL="$_qs_shell" CAVEMAN_DEFAULT_MODE=off \
                   claude "${_LOKI_PERM_ARGV[@]}" -p "$prompt" 2>/dev/null) || rc=$?
     fi
     [ "$rc" -ne 0 ] && return 1

package/completions/_loki

@@ -100,7 +100,7 @@ function _loki {
                 estimate)
                     _arguments \
                         '--json[Output machine-readable JSON]' \
-                        '--model[Model whose rough prior to use]:model:' \
+                        '--model[Model whose first-run prior to use]:model:' \
                         '--provider[Provider whose default model is used]:provider:' \
                         '--help[Show help]'
                     ;;
@@ -185,7 +185,8 @@ function _loki {
                         '--json[Machine-readable JSON output]' \
                         '--last[Analyze last N sessions]:number:' \
                         '--save[Write report to METRICS.md]' \
-                        '--share[Upload report as GitHub Gist]' \
+                        '--share[Upload report as a secret GitHub Gist]' \
+                        '--public[With --share, create a PUBLIC gist]' \
                         '--help[Show help]' \
                         '1:subcommand:(prometheus)'
                     ;;
@@ -199,14 +200,16 @@ function _loki {
                     ;;
                 share)
                     _arguments \
-                        '--private[Create a secret gist]' \
+                        '--public[Create a PUBLIC gist, visible to anyone with the URL]' \
+                        '--private[Create a secret gist (default)]' \
                         '--format[Report format]:format:(text markdown html)' \
                         '--help[Show help]'
                     ;;
                 proof)
                     _arguments \
                         '--yes[Skip redaction-preview confirmation]' \
-                        '--private[Create a secret gist when sharing]' \
+                        '--public[Create a PUBLIC gist when sharing]' \
+                        '--private[Create a secret gist when sharing (default)]' \
                         '--hosted[Hosted publishing (coming in R9)]' \
                         '--dry-run[Scan and list what share would publish; publishes nothing]' \
                         '--help[Show help]' \

package/completions/loki.bash

@@ -355,7 +355,7 @@ _loki_completion() {
 
         metrics)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--json --last --save --share --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--json --last --save --share --public --help" -- "$cur") )
                 return 0
             fi
             local metrics_cmds="prometheus"
@@ -373,7 +373,7 @@ _loki_completion() {
 
         share)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--private --format --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--public --private --format --help" -- "$cur") )
                 return 0
             fi
             if [[ "$prev" == "--format" ]]; then
@@ -384,7 +384,7 @@ _loki_completion() {
 
         proof)
             if [[ "$cur" == -* ]]; then
-                COMPREPLY=( $(compgen -W "--yes --private --hosted --dry-run --out --help" -- "$cur") )
+                COMPREPLY=( $(compgen -W "--yes --public --private --hosted --dry-run --out --help" -- "$cur") )
                 return 0
             fi
             if [[ $cword -eq 2 ]]; then

package/dashboard/__init__.py

@@ -7,6 +7,6 @@ Modules:
     control: Session control helpers (status, atomic writes, origin check)
 """
 
-__version__ = "11.90.0"
+__version__ = "11.92.0"
 
 __all__ = ["__version__"]

package/docs/CLI-REFERENCE.md

@@ -1,6 +1,6 @@
 # CLI reference
 
-Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.90.0. Do not edit by hand.
+Generated from `loki-ts/src/cli/registry.ts` by `scripts/generate-stale-zero.sh` for v11.92.0. Do not edit by hand.
 Hidden and legacy-only commands are omitted; see `docs/CLI-INVENTORY.md` for the full inventory.
 
 | Command | Description |

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 Loki Mode, by [Autonomi](https://www.autonomi.dev/), turns a spec or an issue into a verified pull request with a receipt you can check. This page covers installing it, a first run, and the options around it.
 
-**Version:** v11.90.0
+**Version:** v11.92.0
 
 **Engine note:** `loki start` is the primary command. `loki start`, `loki "<task>"`, `loki owner/repo#N` and `loki quick` all run the Loki 10 engine, whatever the flag order or input form (PRD file, issue ref, task or one-word brief). The previous loop runs only on `--engine legacy`, `LOKI_ENGINE=legacy`, or for one call when a flag Loki 10 cannot honor is present. See the [user guide](v10/GUIDE.md) and the [5-minute quickstart](QUICKSTART.md).
 

package/docs/v11/VERIFY-PR-SANDBOX.md

@@ -36,7 +36,7 @@ Deviation from the card: there is no mounted output dir. A writable host mount w
 - Oversized output: capped by `--max-output`; `output_truncated` is set.
 - Fork bomb: `--pids-limit 256`. Memory bomb: `--memory`. Disk fill: tmpfs size caps.
 - Forged result: the checked code can print a fake `LOKI_VPR_END` line. A per-run 128-bit nonce is sent to the wrapper on stdin and the checked command runs with stdin from /dev/null; the host accepts only the last line carrying that nonce. Docker's default seccomp profile does NOT block ptrace or process_vm_readv on kernels >= 4.8, and the checked command runs as the same uid as the wrapper inside the container, so a hostile process can read the wrapper's memory and recover the nonce. The nonce therefore only stops accidental or naive forgery; it is not a security boundary. One cross-check is added: the wrapper exits with the check's code and the host rejects (status ERROR) a sentinel that disagrees with docker's own exit code. The PR code can still make its own check report success, which is why `result.json` is a signal about the check and not the final verdict (VPR-2 owns that, and it must not treat a bare COMPLETED exit 0 as proof). A custom seccomp profile denying ptrace is a possible hardening and is not shipped here.
-- Forged report: the report path is a per-run random name given only on the runner's command line, so printed totals cannot forge it. A hostile test that reads its parent's command line (or the nonce, see above) and rewrites the file after the runner exits can still forge a pass; the same ptrace-class residual applies.
+- Forged report: the report path is a per-run random name given only on the runner's command line, so printed totals cannot forge it. The checked tests run inside the runner's process or its worker processes, so a hostile test that reads the path from the process command line can register an exit hook that rewrites the file after the runner has written it, and can still forge a pass; the same ptrace-class residual applies.
 - Docker pool exhaustion: reported as BLOCKED, never as a failing check.
 
 ## Not covered (residual, tracked for VPR-2 review)