loki-mode 5.20.3 → 5.20.5

package/Dockerfile

@@ -0,0 +1,86 @@
+# Loki Mode Docker Image
+# Build: docker build -t loki-mode .
+# Run: docker run -it -v $(pwd):/workspace loki-mode
+
+FROM ubuntu:24.04
+
+LABEL maintainer="Lokesh Mure"
+LABEL version="5.8.9"
+LABEL description="Multi-agent autonomous startup system for Claude Code, Codex CLI, and Gemini CLI"
+
+# Prevent interactive prompts during install
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Install base dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    bash \
+    ca-certificates \
+    curl \
+    git \
+    gnupg \
+    jq \
+    python3 \
+    python3-pip \
+    python3-venv \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Node.js 20 LTS from NodeSource (fixes nodejs/npm CVEs)
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/* \
+    && npm cache clean --force
+
+# Install GitHub CLI directly from releases (latest version, not from apt)
+# This avoids CVE-2024-52308 in older Ubuntu-packaged versions
+RUN ARCH=$(dpkg --print-architecture) && \
+    GH_VERSION=$(curl -s https://api.github.com/repos/cli/cli/releases/latest | jq -r .tag_name | sed 's/v//') && \
+    curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${ARCH}.tar.gz" -o /tmp/gh.tar.gz && \
+    tar -xzf /tmp/gh.tar.gz -C /tmp && \
+    mv /tmp/gh_${GH_VERSION}_linux_${ARCH}/bin/gh /usr/local/bin/gh && \
+    rm -rf /tmp/gh* && \
+    gh --version
+
+# Upgrade Python packages to fix setuptools/wheel CVEs
+# Remove old debian-managed packages first, then install fixed versions
+RUN rm -rf /usr/lib/python3/dist-packages/setuptools* \
+    /usr/lib/python3/dist-packages/wheel* \
+    /usr/lib/python3/dist-packages/pkg_resources* \
+    && pip3 install --no-cache-dir --break-system-packages \
+    "setuptools>=78.1.1" \
+    "wheel>=0.46.2"
+
+# Update npm to get latest dependency fixes (tar, glob, cross-spawn)
+RUN npm install -g npm@latest \
+    && npm cache clean --force
+
+# Create app directory
+WORKDIR /opt/loki-mode
+
+# Copy Loki Mode files
+COPY SKILL.md VERSION ./
+COPY autonomy/ ./autonomy/
+COPY skills/ ./skills/
+COPY references/ ./references/
+COPY docs/ ./docs/
+
+# Make scripts executable
+RUN chmod +x autonomy/run.sh autonomy/loki
+
+# Set up symlinks
+RUN mkdir -p /root/.claude/skills && \
+    ln -sf /opt/loki-mode /root/.claude/skills/loki-mode && \
+    ln -sf /opt/loki-mode/autonomy/loki /usr/local/bin/loki
+
+# Set workspace as working directory
+WORKDIR /workspace
+
+# Run as non-root user for security (optional, uncomment if needed)
+# RUN useradd -m -s /bin/bash loki && chown -R loki:loki /opt/loki-mode
+# USER loki
+
+# Default command shows help
+CMD ["loki", "help"]
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD loki version || exit 1

package/Dockerfile.sandbox

@@ -0,0 +1,253 @@
+#===============================================================================
+# Loki Mode Security-Hardened Sandbox Dockerfile
+# Multi-stage build for minimal attack surface
+#
+# Build:  docker build -t loki-mode:sandbox -f Dockerfile.sandbox .
+# Run:    ./autonomy/sandbox.sh start
+#
+# Security Features:
+#   - Multi-stage build (smaller final image, no build tools)
+#   - Non-root user execution (UID 1000)
+#   - Minimal base image (Debian slim)
+#   - No shell history persistence
+#   - Read-only root filesystem compatible
+#   - Health checks for container orchestration
+#   - Explicit capability requirements documented
+#
+# Note: Alpine was considered but rejected due to:
+#   - musl libc compatibility issues with Node.js native modules
+#   - Claude/Codex/Gemini CLI npm packages may have glibc dependencies
+#   - Debian slim provides good balance of size and compatibility
+#===============================================================================
+
+#-------------------------------------------------------------------------------
+# Stage 1: Builder - Install CLIs and dependencies
+#-------------------------------------------------------------------------------
+FROM debian:bookworm-slim AS builder
+
+# Security: Avoid caching sensitive data in apt lists
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    gnupg \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Node.js 20 LTS (required for Claude CLI and npm packages)
+# Security: Use official NodeSource repository with GPG verification
+RUN curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /usr/share/keyrings/nodesource.gpg \
+    && echo "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" > /etc/apt/sources.list.d/nodesource.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install GitHub CLI
+# Security: Use official GitHub repository with GPG verification
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | gpg --dearmor -o /usr/share/keyrings/githubcli.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends gh \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install AI CLIs globally
+# Security: npm install with --ignore-scripts prevents arbitrary code execution during install
+# Note: These are placeholder package names - update when official packages are available
+WORKDIR /opt/cli-install
+
+# Claude CLI (Anthropic official)
+RUN npm install -g @anthropic-ai/claude-code --ignore-scripts 2>/dev/null || \
+    echo "Claude CLI not available on npm, will need manual install"
+
+# Codex CLI (OpenAI) - install if available
+RUN npm install -g @openai/codex --ignore-scripts 2>/dev/null || \
+    echo "Codex CLI not available on npm, will need manual install"
+
+# Gemini CLI (Google) - install if available
+RUN npm install -g @google/gemini-cli --ignore-scripts 2>/dev/null || \
+    echo "Gemini CLI not available on npm, will need manual install"
+
+#-------------------------------------------------------------------------------
+# Stage 2: Runtime - Minimal production image
+#-------------------------------------------------------------------------------
+FROM debian:bookworm-slim AS runtime
+
+LABEL maintainer="Lokesh Mure"
+LABEL version="5.5.1"
+LABEL description="Security-hardened sandbox for Loki Mode multi-agent system"
+LABEL org.opencontainers.image.source="https://github.com/asklokesh/claudeskill-loki-mode"
+
+# Security: Prevent interactive prompts and reduce image size
+ENV DEBIAN_FRONTEND=noninteractive \
+    # Security: Disable npm update checks (reduces network exposure)
+    NPM_CONFIG_UPDATE_NOTIFIER=false \
+    # Security: Prevent shell history from persisting
+    HISTFILE=/dev/null \
+    # Runtime: Set proper locale
+    LANG=C.UTF-8 \
+    LC_ALL=C.UTF-8 \
+    # Loki: Default configuration
+    LOKI_SANDBOX_MODE=true
+
+# Install minimal runtime dependencies
+# Security: --no-install-recommends reduces attack surface
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    # Core utilities
+    bash \
+    ca-certificates \
+    curl \
+    # Version control
+    git \
+    # JSON processing (required by loki scripts)
+    jq \
+    # Python runtime (for some AI CLI dependencies)
+    python3-minimal \
+    # Process management
+    procps \
+    # Network utilities for health checks
+    netcat-openbsd \
+    # Timezone data (for log timestamps)
+    tzdata \
+    # Security: Clean up apt cache
+    && rm -rf /var/lib/apt/lists/* \
+    && apt-get clean \
+    && rm -rf /var/cache/apt/archives/*
+
+# Copy Node.js and npm from builder
+# Security: Only copy runtime, not build tools
+COPY --from=builder /usr/bin/node /usr/bin/node
+COPY --from=builder /usr/lib/node_modules /usr/lib/node_modules
+COPY --from=builder /usr/bin/npm /usr/bin/npm
+COPY --from=builder /usr/bin/npx /usr/bin/npx
+
+# Copy GitHub CLI from builder
+COPY --from=builder /usr/bin/gh /usr/bin/gh
+
+# Copy installed CLI tools from builder (global node_modules)
+COPY --from=builder /usr/local/lib/node_modules /usr/local/lib/node_modules
+COPY --from=builder /usr/local/bin /usr/local/bin
+
+# Create symlinks for node binaries
+RUN ln -sf /usr/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm 2>/dev/null || true \
+    && ln -sf /usr/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx 2>/dev/null || true
+
+#-------------------------------------------------------------------------------
+# Security: Create non-root user
+#-------------------------------------------------------------------------------
+# Security: Use specific UID/GID for predictable permissions
+# UID 1000 is commonly mapped to host user for volume mounts
+ARG USER_UID=1000
+ARG USER_GID=1000
+
+RUN groupadd --gid ${USER_GID} loki \
+    && useradd --uid ${USER_UID} --gid ${USER_GID} --shell /bin/bash --create-home loki \
+    # Security: Remove unnecessary SUID binaries
+    && find / -perm /4000 -type f -exec chmod u-s {} \; 2>/dev/null || true \
+    && find / -perm /2000 -type f -exec chmod g-s {} \; 2>/dev/null || true
+
+#-------------------------------------------------------------------------------
+# Install Loki Mode
+#-------------------------------------------------------------------------------
+# Create app directory with proper ownership
+RUN mkdir -p /opt/loki-mode && chown loki:loki /opt/loki-mode
+
+WORKDIR /opt/loki-mode
+
+# Copy Loki Mode files with explicit ownership
+# Security: Copy only necessary files, not entire repo
+COPY --chown=loki:loki SKILL.md VERSION ./
+COPY --chown=loki:loki autonomy/ ./autonomy/
+COPY --chown=loki:loki providers/ ./providers/
+COPY --chown=loki:loki skills/ ./skills/
+COPY --chown=loki:loki references/ ./references/
+
+# Copy docs if they exist (optional)
+COPY --chown=loki:loki docs/ ./docs/ 2>/dev/null || true
+
+# Make scripts executable
+RUN chmod +x autonomy/run.sh autonomy/loki autonomy/sandbox.sh autonomy/serve.sh 2>/dev/null || true \
+    && chmod +x providers/*.sh 2>/dev/null || true
+
+# Create necessary directories with proper permissions
+RUN mkdir -p /home/loki/.claude/skills \
+    && mkdir -p /home/loki/.config/gh \
+    && mkdir -p /home/loki/.ssh \
+    && chown -R loki:loki /home/loki
+
+# Set up symlinks for loki user
+RUN ln -sf /opt/loki-mode /home/loki/.claude/skills/loki-mode \
+    && ln -sf /opt/loki-mode/autonomy/loki /usr/local/bin/loki
+
+#-------------------------------------------------------------------------------
+# Configure workspace
+#-------------------------------------------------------------------------------
+# Create workspace directory
+RUN mkdir -p /workspace && chown loki:loki /workspace
+
+# Security: Create .loki directory for state (can be mounted as volume)
+RUN mkdir -p /workspace/.loki && chown loki:loki /workspace/.loki
+
+WORKDIR /workspace
+
+#-------------------------------------------------------------------------------
+# Health check
+#-------------------------------------------------------------------------------
+# Security: Health check runs as container user
+# Checks: loki CLI accessible, workspace writable, node available
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD loki version > /dev/null 2>&1 && \
+        test -w /workspace && \
+        node --version > /dev/null 2>&1 || exit 1
+
+#-------------------------------------------------------------------------------
+# Runtime configuration
+#-------------------------------------------------------------------------------
+# Security: Switch to non-root user
+USER loki
+
+# Expose ports for dashboard and API
+# Security: Ports > 1024 don't require root
+EXPOSE 9898 57374
+
+# Security: Set restrictive umask
+# New files will be created with 644 (files) and 755 (directories)
+RUN echo "umask 022" >> /home/loki/.bashrc
+
+#-------------------------------------------------------------------------------
+# Entrypoint
+#-------------------------------------------------------------------------------
+# Security: Use exec form to avoid shell injection
+# Default command shows help; sandbox.sh overrides with actual command
+ENTRYPOINT ["/opt/loki-mode/autonomy/loki"]
+CMD ["help"]
+
+#===============================================================================
+# Security Notes for Operators:
+#
+# 1. Run with --security-opt=no-new-privileges:true
+#    Prevents privilege escalation via setuid binaries
+#
+# 2. Run with --cap-drop=ALL --cap-add=<needed>
+#    Minimal capabilities: CHOWN, SETUID, SETGID, DAC_OVERRIDE
+#
+# 3. Resource limits (enforced by sandbox.sh):
+#    --cpus=2 --memory=4g --pids-limit=256
+#
+# 4. Network isolation options:
+#    --network=none     (most secure, no network)
+#    --network=bridge   (default, isolated network)
+#    --network=host     (least secure, avoid)
+#
+# 5. Filesystem security:
+#    Mount project as read-only when possible: -v ./project:/workspace:ro
+#    Use named volume for .loki state: -v loki-state:/workspace/.loki:rw
+#
+# 6. API keys should be passed as environment variables, not mounted files:
+#    -e ANTHROPIC_API_KEY -e OPENAI_API_KEY -e GOOGLE_API_KEY
+#
+# 7. For production, consider:
+#    - Using seccomp profiles to restrict syscalls
+#    - AppArmor/SELinux profiles for additional isolation
+#    - Running in a VM or dedicated sandbox environment
+#===============================================================================

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Multi-agent autonomous startup system. Triggers on "Loki Mode". Takes PRD to deployed product with zero human intervention. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v5.20.3
+# Loki Mode v5.20.5
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -253,4 +253,4 @@ Auto-detected or force with `LOKI_COMPLEXITY`:
 
 ---
 
-**v5.20.3 | Dashboard Consolidation, Unified Web Components | ~250 lines core**
+**v5.20.5 | Dashboard Consolidation, Unified Web Components | ~250 lines core**

package/VERSION

@@ -1 +1 @@
-5.20.3
+5.20.5

package/autonomy/loki

@@ -1915,7 +1915,7 @@ EOF
     if [[ "$start_loki" == "true" ]]; then
         echo ""
         echo -e "${GREEN}Starting Loki Mode with generated PRD...${NC}"
-        cmd_start "$output_file" "${start_args[@]}"
+        cmd_start "$output_file" ${start_args[@]+"${start_args[@]}"}
     else
         echo ""
         echo "Next steps:"

package/dashboard/Dockerfile

@@ -0,0 +1,79 @@
+# Loki Mode Dashboard - Docker Image
+# Multi-stage build: frontend build + Python backend
+#
+# Build:
+#   docker build -t loki-dashboard ./dashboard
+#
+# Run:
+#   docker run -p 8420:8420 -v ~/.loki:/home/appuser/.loki loki-dashboard
+#
+# Enterprise mode:
+#   docker run -p 8420:8420 \
+#     -e LOKI_ENTERPRISE_AUTH=true \
+#     -e LOKI_ENTERPRISE_AUDIT=true \
+#     -v ~/.loki:/home/appuser/.loki \
+#     loki-dashboard
+
+# Stage 1: Build frontend
+FROM node:20-alpine AS frontend-builder
+
+WORKDIR /app/frontend
+
+# Install dependencies
+COPY frontend/package*.json ./
+RUN npm ci --ignore-scripts
+
+# Build frontend
+COPY frontend/ ./
+RUN npm run build
+
+# Stage 2: Python backend with built frontend
+FROM python:3.11-slim-bookworm
+
+# Set labels
+LABEL org.opencontainers.image.title="Loki Mode Dashboard"
+LABEL org.opencontainers.image.description="Multi-project task management dashboard for Loki Mode"
+LABEL org.opencontainers.image.source="https://github.com/asklokesh/loki-mode"
+
+# Environment
+ENV PYTHONUNBUFFERED=1
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV LOKI_DASHBOARD_HOST=0.0.0.0
+ENV LOKI_DASHBOARD_PORT=8420
+
+# Create non-root user for security
+RUN useradd --create-home --shell /bin/bash appuser
+
+WORKDIR /app
+
+# Install Python dependencies
+COPY requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy backend code as a package (dashboard/)
+# This preserves the package structure for relative imports
+COPY __init__.py database.py models.py server.py registry.py auth.py audit.py ./dashboard/
+
+# Copy built frontend to static directory inside package
+COPY --from=frontend-builder /app/frontend/dist ./dashboard/static
+
+# Create data directories with correct ownership
+RUN mkdir -p /home/appuser/.loki/dashboard/audit && \
+    chown -R appuser:appuser /home/appuser/.loki && \
+    chown -R appuser:appuser /app
+
+# Switch to non-root user
+USER appuser
+
+# Set HOME for the app user
+ENV HOME=/home/appuser
+
+# Health check using Python (curl not available in slim image)
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8420/health')" || exit 1
+
+# Expose port
+EXPOSE 8420
+
+# Run server with correct module path
+CMD ["python", "-m", "uvicorn", "dashboard.server:app", "--host", "0.0.0.0", "--port", "8420"]

package/dashboard/docker-compose.yml

@@ -0,0 +1,47 @@
+# Loki Mode Dashboard - Docker Compose
+#
+# Usage:
+#   cd dashboard
+#   docker compose up -d
+#
+# Enterprise mode:
+#   LOKI_ENTERPRISE_AUTH=true LOKI_ENTERPRISE_AUDIT=true docker compose up -d
+#
+# View logs:
+#   docker compose logs -f
+#
+# Stop:
+#   docker compose down
+
+services:
+  dashboard:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: loki-dashboard:latest
+    container_name: loki-dashboard
+    ports:
+      - "${LOKI_DASHBOARD_PORT:-8420}:8420"
+    environment:
+      - LOKI_DASHBOARD_HOST=0.0.0.0
+      - LOKI_DASHBOARD_PORT=8420
+      - LOKI_ENTERPRISE_AUTH=${LOKI_ENTERPRISE_AUTH:-false}
+      - LOKI_ENTERPRISE_AUDIT=${LOKI_ENTERPRISE_AUDIT:-false}
+      - LOKI_AUDIT_MAX_SIZE_MB=${LOKI_AUDIT_MAX_SIZE_MB:-10}
+      - LOKI_AUDIT_MAX_FILES=${LOKI_AUDIT_MAX_FILES:-10}
+    volumes:
+      # Persist data directory
+      - loki-data:/home/appuser/.loki
+      # Optional: Mount host .loki directory for shared access
+      # - ~/.loki:/home/appuser/.loki
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8420/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+    restart: unless-stopped
+
+volumes:
+  loki-data:
+    driver: local

package/docker-compose.yml

@@ -0,0 +1,37 @@
+# Loki Mode Docker Compose (v5.0.0)
+# Usage: docker-compose run loki start
+# Note: version key removed - deprecated in Docker Compose v2+
+
+services:
+  loki:
+    build: .
+    image: loki-mode:latest
+    volumes:
+      # Mount current directory as workspace
+      - .:/workspace:rw
+      # Persist .loki state between runs
+      - loki-state:/workspace/.loki
+      # Share git config for commits
+      - ~/.gitconfig:/root/.gitconfig:ro
+      # Share SSH keys for git operations
+      - ~/.ssh:/root/.ssh:ro
+      # Share GitHub CLI auth
+      - ~/.config/gh:/root/.config/gh:ro
+    environment:
+      # Loki Mode configuration
+      - LOKI_NOTIFICATIONS=false  # No desktop notifications in container
+      - LOKI_DASHBOARD=true
+      - LOKI_DASHBOARD_PORT=57374
+      # Pass through GitHub token if set
+      - GITHUB_TOKEN
+      - GH_TOKEN
+    ports:
+      # Expose dashboard
+      - "57374:57374"
+    working_dir: /workspace
+    stdin_open: true
+    tty: true
+
+volumes:
+  loki-state:
+    driver: local

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loki-mode",
-  "version": "5.20.3",
+  "version": "5.20.5",
   "description": "Multi-agent autonomous startup system for Claude Code, Codex CLI, and Gemini CLI",
   "keywords": [
     "claude",
@@ -46,7 +46,10 @@
     "dashboard/models.py",
     "dashboard/registry.py",
     "dashboard/run.py",
-    "dashboard/requirements.txt"
+    "dashboard/requirements.txt",
+    "Dockerfile",
+    "Dockerfile.sandbox",
+    "docker-compose.yml"
   ],
   "scripts": {
     "postinstall": "node bin/postinstall.js",