loki-mode 5.38.0 → 5.39.1

package/README.md

@@ -13,6 +13,8 @@
 [![HumanEval](https://img.shields.io/badge/HumanEval-98.17%25%20Pass%401-brightgreen)](benchmarks/results/)
 [![SWE-bench](https://img.shields.io/badge/SWE--bench-99.67%25%20Patch%20Gen-brightgreen)](benchmarks/results/)
 
+**Current Version: v5.39.1**
+
 **[Documentation Website](https://asklokesh.github.io/loki-mode/)** | **[Architecture](https://asklokesh.github.io/loki-mode/blog/#architecture)** | **[Research](https://asklokesh.github.io/loki-mode/blog/#research)** | **[Comparisons](https://asklokesh.github.io/loki-mode/blog/#comparisons)**
 
 > **PRD → Deployed Product in Zero Human Intervention**
@@ -77,7 +79,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: asklokesh/loki-mode@v5
+      - uses: asklokesh/loki-mode@v5.38
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           mode: review          # review, fix, or test
@@ -214,6 +216,8 @@ PRD → Research → Architecture → Development → Testing → Deployment →
 | **Stops on errors** | **Self-healing**: circuit breakers, dead letter queues, exponential backoff, automatic recovery |
 | **No visibility** into progress | **Real-time dashboard** with agent monitoring, task queues, and live status updates |
 | **"Done" when code is written** | **Never "done"**: continuous optimization, A/B testing, customer feedback loops, perpetual improvement |
+| **No security controls** | **Enterprise-ready**: TLS/HTTPS, OIDC/SSO, RBAC, audit trails, SIEM integration, Prometheus metrics (v5.36.0-v5.38.0) |
+| **Direct commits to main** | **Branch protection**: auto-create feature branches, clean PR workflow, never touches main directly (v5.37.0) |
 
 ### **Core Advantages**
 
@@ -235,6 +239,14 @@ PRD → Research → Architecture → Development → Testing → Deployment →
 | **CLI (v4.1.0)** | `loki` command for start/stop/pause/status | [CLI Commands](#cli-commands-v410) |
 | **Config Files** | YAML configuration support | [autonomy/config.example.yaml](autonomy/config.example.yaml) |
 | **Dashboard** | Realtime Kanban board, agent monitoring | [Dashboard Guide](docs/dashboard-guide.md) |
+| **TLS/HTTPS (v5.36.0)** | Dashboard encryption with self-signed certs | [Network Security](docs/network-security.md) |
+| **OIDC/SSO (v5.36.0)** | Google, Azure AD, Okta authentication | [Authentication Guide](docs/authentication.md) |
+| **RBAC (v5.37.0)** | Admin, operator, viewer, auditor roles | [Authorization Guide](docs/authorization.md) |
+| **Metrics Export (v5.38.0)** | Prometheus/OpenMetrics `/metrics` endpoint | [Metrics Guide](docs/metrics.md) |
+| **Branch Protection (v5.37.0)** | Auto-create feature branches for PRs | [Git Workflow](docs/git-workflow.md) |
+| **Audit Trail (v5.37.0)** | Agent action logging with integrity chain | [Audit Logging](docs/audit-logging.md) |
+| **SIEM Integration (v5.38.0)** | Syslog forwarding for enterprise security | [SIEM Guide](docs/siem-integration.md) |
+| **OpenClaw Bridge (v5.38.0)** | Multi-agent coordination protocol | [OpenClaw Integration](docs/openclaw-integration.md) |
 | **41 Agent Types** | Engineering, Ops, Business, Data, Product, Growth, Orchestration | [Agent Definitions](references/agent-types.md) |
 | **RARV Cycle** | Reason-Act-Reflect-Verify workflow | [Core Workflow](references/core-workflow.md) |
 | **Quality Gates** | 7-gate system: guardrails, static analysis, blind review, anti-sycophancy, severity blocking, test coverage | [Quality Control](references/quality-control.md) |
@@ -248,6 +260,67 @@ PRD → Research → Architecture → Development → Testing → Deployment →
 
 ---
 
+## Enterprise Security & Compliance (v5.36.0-v5.38.0)
+
+Loki Mode now includes production-ready security and compliance features for enterprise deployments:
+
+### **Authentication & Authorization**
+- **TLS/HTTPS Encryption**: Self-signed certificates for dashboard encryption (v5.36.0)
+- **OIDC/SSO Integration**: Support for Google, Azure AD, and Okta authentication (v5.36.0)
+- **RBAC Roles**: Four-tier role system (v5.37.0)
+  - **Admin**: Full control, configuration changes, user management
+  - **Operator**: Start/stop sessions, modify tasks, execute actions
+  - **Viewer**: Read-only dashboard access, view logs and metrics
+  - **Auditor**: Access audit logs, compliance reports, security events
+
+### **Observability & Monitoring**
+- **Prometheus/OpenMetrics**: `/metrics` endpoint for production monitoring (v5.38.0)
+  - Task completion rates, agent performance, memory usage
+  - Integration with Grafana, Datadog, New Relic
+- **Audit Trail**: SHA-256 integrity chain for all agent actions (v5.37.0)
+  - Tamper-evident logging with cryptographic verification
+  - Complete action history: who did what, when, and why
+- **SIEM Integration**: Syslog forwarding (RFC 5424) for enterprise security (v5.38.0)
+  - Send logs to Splunk, QRadar, ArcSight, Elastic SIEM
+  - Real-time security event detection and alerting
+
+### **Development Safety**
+- **Branch Protection**: Auto-create feature branches for all PR work (v5.37.0)
+  - Never commits directly to main/master
+  - Automatic branch naming: `loki/feature/<task-id>`
+  - Clean merge workflow with squash commits
+- **OpenClaw Bridge**: Multi-agent coordination protocol integration (v5.38.0)
+  - Standardized inter-agent communication
+  - Cross-system orchestration support
+
+### **Quick Start (Enterprise Mode)**
+
+```bash
+# Enable TLS/HTTPS
+export LOKI_TLS_ENABLED=true
+export LOKI_TLS_CERT=/path/to/cert.pem
+export LOKI_TLS_KEY=/path/to/key.pem
+
+# Configure OIDC
+export LOKI_OIDC_PROVIDER=google
+export LOKI_OIDC_CLIENT_ID=your-client-id
+export LOKI_OIDC_CLIENT_SECRET=your-client-secret
+
+# Enable audit logging
+export LOKI_AUDIT_ENABLED=true
+export LOKI_AUDIT_INTEGRITY_CHECK=true
+
+# Enable Prometheus metrics
+export LOKI_METRICS_ENABLED=true
+
+# Start with enterprise features
+loki start --enterprise ./my-prd.md
+```
+
+For detailed configuration, see [docs/network-security.md](docs/network-security.md), [docs/authentication.md](docs/authentication.md), and [docs/authorization.md](docs/authorization.md).
+
+---
+
 ## Dashboard & Real-Time Monitoring
 
 Monitor your autonomous startup being built in real-time through the Loki Mode dashboard:
@@ -309,9 +382,11 @@ Last Updated: 2026-01-04 20:45:32
 
 # Or open manually
 open http://localhost:57374
+# HTTPS mode (v5.36.0+):
+open https://localhost:57374
 ```
 
-The dashboard at `http://localhost:57374` auto-refreshes via WebSocket. Works with any modern browser.
+The dashboard at `http://localhost:57374` (or `https://localhost:57374` with TLS enabled) auto-refreshes via WebSocket. Works with any modern browser.
 
 ---
 
@@ -464,18 +539,23 @@ graph TB
     PROVIDERS --> AGENTS
 
     subgraph INFRA["Infrastructure"]
-        DASHBOARD["Dashboard<br/>(FastAPI + Web UI)"]
+        DASHBOARD["Dashboard<br/>(FastAPI + Web UI)<br/>TLS/HTTPS, OIDC, RBAC"]
         MEMORY["Memory System<br/>(Episodic/Semantic/Procedural)"]
         COUNCIL["Completion Council<br/>(3-member voting)"]
         QUEUE["Task Queue<br/>(.loki/queue/)"]
+        METRICS["Metrics Export<br/>(Prometheus/OpenMetrics)"]
+        AUDIT["Audit Trail<br/>(SHA-256 integrity chain)"]
     end
 
     AGENTS --> QUEUE
     VERIFY --> COUNCIL
     REFLECT --> MEMORY
     COMPOUND --> MEMORY
+    AGENTS --> AUDIT
     DASHBOARD -.->|"reads"| QUEUE
     DASHBOARD -.->|"reads"| MEMORY
+    DASHBOARD -.->|"reads"| AUDIT
+    DASHBOARD -.->|"exposes"| METRICS
 ```
 
 **Key components:**
@@ -484,7 +564,9 @@ graph TB
 - **Agent Swarms** -- 41 specialized agent types across 7 swarms, spawned on demand based on project complexity.
 - **Completion Council** -- 3 members vote on whether the project is done. Anti-sycophancy devil's advocate on unanimous votes.
 - **Memory System** -- Episodic traces, semantic patterns, procedural skills. Progressive disclosure reduces context usage by 60-80%.
-- **Dashboard** -- FastAPI server reading `.loki/` flat files, with real-time web UI for task queue, agents, logs, and council state.
+- **Dashboard** -- FastAPI server reading `.loki/` flat files, with real-time web UI for task queue, agents, logs, and council state. Now with TLS/HTTPS, OIDC/SSO, and RBAC (v5.36.0-v5.37.0).
+- **Metrics Export** -- Prometheus/OpenMetrics endpoint for production monitoring (v5.38.0).
+- **Audit Trail** -- SHA-256 integrity chain for tamper-evident logging of all agent actions (v5.37.0).
 
 ---
 
@@ -503,6 +585,10 @@ The `loki` CLI provides easy access to all Loki Mode features:
 | `loki import` | Import GitHub issues as tasks |
 | `loki config show` | Show configuration |
 | `loki config init` | Create config file from template |
+| `loki audit logs` | View audit trail (v5.37.0) |
+| `loki audit verify` | Verify log integrity chain (v5.37.0) |
+| `loki metrics` | Display Prometheus metrics (v5.38.0) |
+| `loki syslog test` | Test SIEM integration (v5.38.0) |
 | `loki version` | Show version |
 
 ### Configuration File
@@ -622,6 +708,9 @@ IMPLEMENT → REVIEW (parallel) → AGGREGATE → FIX → RE-REVIEW → COMPLETE
 ├── metrics/        # Efficiency tracking and reward signals
 ├── messages/       # Inter-agent communication
 ├── logs/           # Audit logs
+├── audit/          # Audit trail with SHA-256 integrity chain (v5.37.0)
+├── security/       # TLS certificates, OIDC configs (v5.36.0)
+├── rbac/           # Role definitions and permissions (v5.37.0)
 ├── config/         # Configuration files
 ├── prompts/        # Agent role prompts
 ├── artifacts/      # Releases, reports, backups
@@ -710,6 +799,13 @@ LOKI_MAX_WAIT=7200 \
 | `LOKI_BASE_WAIT` | 60 | Base wait time in seconds |
 | `LOKI_MAX_WAIT` | 3600 | Maximum wait time (1 hour) |
 | `LOKI_SKIP_PREREQS` | false | Skip prerequisite checks |
+| `LOKI_TLS_ENABLED` | false | Enable HTTPS/TLS for dashboard (v5.36.0) |
+| `LOKI_OIDC_PROVIDER` | - | OIDC provider: google, azure, okta (v5.36.0) |
+| `LOKI_RBAC_ENABLED` | false | Enable role-based access control (v5.37.0) |
+| `LOKI_AUDIT_ENABLED` | false | Enable audit logging with integrity chain (v5.37.0) |
+| `LOKI_METRICS_ENABLED` | false | Enable Prometheus /metrics endpoint (v5.38.0) |
+| `LOKI_SYSLOG_ENABLED` | false | Enable syslog forwarding to SIEM (v5.38.0) |
+| `LOKI_BRANCH_PROTECTION` | true | Auto-create feature branches (v5.37.0) |
 
 ### **Circuit Breakers**
 
@@ -779,6 +875,27 @@ npx vibe-kanban
 
 See [integrations/vibe-kanban.md](integrations/vibe-kanban.md) for complete step-by-step setup guide and troubleshooting.
 
+### **OpenClaw Bridge (v5.38.0)**
+
+Loki Mode now supports the OpenClaw multi-agent coordination protocol for cross-system orchestration:
+
+```bash
+# Enable OpenClaw bridge
+export LOKI_OPENCLAW_ENABLED=true
+export LOKI_OPENCLAW_ENDPOINT=http://openclaw-server:8080
+
+# Start with OpenClaw integration
+loki start --openclaw ./prd.md
+```
+
+**Benefits:**
+- Standardized inter-agent communication across different AI systems
+- Coordinate with external agent frameworks (AutoGPT, MetaGPT, etc.)
+- Share task queues and state between multiple orchestrators
+- Cross-platform agent collaboration
+
+See [docs/openclaw-integration.md](docs/openclaw-integration.md) for complete setup and API reference.
+
 ---
 
 ## Testing

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Multi-agent autonomous startup system. Triggers on "Loki Mode". Takes PRD to deployed product with zero human intervention. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v5.38.0
+# Loki Mode v5.39.1
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -260,4 +260,4 @@ The following features are documented in skill modules but not yet fully automat
 | Quality gates 3-reviewer system | Implemented (v5.35.0) | 5 specialist reviewers in `skills/quality-gates.md`; execution in run.sh |
 | Benchmarks (HumanEval, SWE-bench) | Infrastructure only | Runner scripts and datasets exist in `benchmarks/`; no published results |
 
-**v5.38.0 | feat: branch protection, prometheus metrics, log integrity, OpenClaw bridge | ~260 lines core**
+**v5.39.1 | fix: 46-bug audit across all distributions, JSON injection, Docker mounts, auth hardening | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-5.38.0
+5.39.1

package/api/README.md

@@ -62,7 +62,7 @@ export LOKI_API_TOKEN=$(loki serve --generate-token)
 loki serve --host 0.0.0.0
 
 # Connect from another machine
-curl -H "Authorization: Bearer $LOKI_API_TOKEN" http://server:8420/health
+curl -H "Authorization: Bearer $LOKI_API_TOKEN" http://server:57374/health
 ```
 
 ## API Endpoints
@@ -148,7 +148,7 @@ curl -H "Authorization: Bearer $LOKI_API_TOKEN" http://server:8420/health
 ### Start a Session
 
 ```bash
-curl -X POST http://localhost:8420/api/sessions \
+curl -X POST http://localhost:57374/api/sessions \
   -H "Content-Type: application/json" \
   -d '{"provider": "claude", "prdPath": "./docs/prd.md"}'
 ```
@@ -156,7 +156,7 @@ curl -X POST http://localhost:8420/api/sessions \
 ### Subscribe to Events
 
 ```javascript
-const events = new EventSource('http://localhost:8420/api/events');
+const events = new EventSource('http://localhost:57374/api/events');
 
 events.addEventListener('task:completed', (e) => {
   const event = JSON.parse(e.data);
@@ -178,7 +178,7 @@ events.onerror = (err) => {
 ```typescript
 import { LokiClient } from './api/client.ts';
 
-const client = new LokiClient('http://localhost:8420');
+const client = new LokiClient('http://localhost:57374');
 
 // Start a session
 const { sessionId } = await client.startSession({
@@ -207,16 +207,16 @@ client.close();
 
 ```bash
 # Filter by session
-curl "http://localhost:8420/api/events?sessionId=session_123"
+curl "http://localhost:57374/api/events?sessionId=session_123"
 
 # Filter by event types
-curl "http://localhost:8420/api/events?types=task:completed,task:failed"
+curl "http://localhost:57374/api/events?types=task:completed,task:failed"
 
 # Filter log level
-curl "http://localhost:8420/api/events?minLevel=warn"
+curl "http://localhost:57374/api/events?minLevel=warn"
 
 # Replay recent history
-curl "http://localhost:8420/api/events?history=50"
+curl "http://localhost:57374/api/events?history=50"
 ```
 
 ## Development

package/autonomy/loki

@@ -112,6 +112,13 @@ EMIT_SH="$SKILL_DIR/events/emit.sh"
 LEARNING_EMIT_SH="$SKILL_DIR/learning/emit.sh"
 LOKI_DIR=".loki"
 
+# Anonymous usage telemetry
+PROJECT_DIR="$SKILL_DIR"
+_TELEMETRY_SCRIPT="$SKILL_DIR/autonomy/telemetry.sh"
+if [ -f "$_TELEMETRY_SCRIPT" ]; then
+    source "$_TELEMETRY_SCRIPT"
+fi
+
 # Get version from VERSION file
 get_version() {
     if [ -f "$SKILL_DIR/VERSION" ]; then
@@ -321,6 +328,10 @@ show_help() {
     echo "  memory [cmd]     Cross-project learnings (list|show|search|stats)"
     echo "  compound [cmd]   Knowledge compounding (list|show|search|run|stats)"
     echo "  council [cmd]    Completion council (status|verdicts|convergence|force-review|report)"
+    echo "  checkpoint|cp    Save/restore session checkpoints"
+    echo "  projects         Multi-project registry management"
+    echo "  audit            Agent action audit log"
+    echo "  enterprise       Enterprise feature management (tokens, OIDC)"
     echo "  metrics          Prometheus/OpenMetrics metrics from dashboard"
     echo "  dogfood          Show self-development statistics"
     echo "  secrets [cmd]    API key status and validation (status|validate)"
@@ -4219,6 +4230,8 @@ main() {
     local command="$1"
     shift
 
+    loki_telemetry "cli_command" "command=$command" 2>/dev/null || true
+
     case "$command" in
         start)
             cmd_start "$@"
@@ -7079,8 +7092,8 @@ cmd_metrics() {
             # Fetch metrics from dashboard
             local url="http://${host}:${port}/metrics"
             local response
-            response=$(curl -sf "$url" 2>/dev/null)
-            if [ $? -ne 0 ]; then
+            response=$(curl -sf "$url" 2>/dev/null) || true
+            if [ -z "$response" ]; then
                 echo -e "${RED}Error: Could not connect to dashboard at ${url}${NC}"
                 echo "Make sure the dashboard is running: loki serve"
                 exit 1

package/autonomy/run.sh

@@ -534,6 +534,13 @@ if [ -f "$COUNCIL_SCRIPT" ]; then
     source "$COUNCIL_SCRIPT"
 fi
 
+# Anonymous usage telemetry (opt-out: LOKI_TELEMETRY_DISABLED=true or DO_NOT_TRACK=1)
+TELEMETRY_SCRIPT="$SCRIPT_DIR/telemetry.sh"
+if [ -f "$TELEMETRY_SCRIPT" ]; then
+    # shellcheck source=telemetry.sh
+    source "$TELEMETRY_SCRIPT"
+fi
+
 # 2026 Research Enhancements (minimal additions)
 PROMPT_REPETITION=${LOKI_PROMPT_REPETITION:-true}
 CONFIDENCE_ROUTING=${LOKI_CONFIDENCE_ROUTING:-true}
@@ -777,8 +784,14 @@ get_iteration_duration_ms() {
 
 validate_api_keys() {
     local provider="${LOKI_PROVIDER:-claude}"
-    local key_var=""
 
+    # CLI tools (claude, codex, gemini) use their own login sessions.
+    # Only require API keys inside Docker/K8s where CLI login isn't available.
+    if [[ ! -f "/.dockerenv" ]] && [[ -z "${KUBERNETES_SERVICE_HOST:-}" ]]; then
+        return 0
+    fi
+
+    local key_var=""
     case "$provider" in
         claude) key_var="ANTHROPIC_API_KEY" ;;
         codex)  key_var="OPENAI_API_KEY" ;;
@@ -1542,17 +1555,18 @@ create_worktree() {
 
     log_step "Creating worktree: $stream_name"
 
+    local wt_exit=1
     if [ -n "$branch_name" ]; then
         # Create new branch
-        git -C "$TARGET_DIR" worktree add "$worktree_path" -b "$branch_name" 2>/dev/null || \
-        git -C "$TARGET_DIR" worktree add "$worktree_path" "$branch_name" 2>/dev/null
+        git -C "$TARGET_DIR" worktree add "$worktree_path" -b "$branch_name" 2>/dev/null && wt_exit=0 || \
+        { git -C "$TARGET_DIR" worktree add "$worktree_path" "$branch_name" 2>/dev/null && wt_exit=0; }
     else
         # Track main branch
-        git -C "$TARGET_DIR" worktree add "$worktree_path" main 2>/dev/null || \
-        git -C "$TARGET_DIR" worktree add "$worktree_path" HEAD 2>/dev/null
+        git -C "$TARGET_DIR" worktree add "$worktree_path" main 2>/dev/null && wt_exit=0 || \
+        { git -C "$TARGET_DIR" worktree add "$worktree_path" HEAD 2>/dev/null && wt_exit=0; }
     fi
 
-    if [ $? -eq 0 ]; then
+    if [ $wt_exit -eq 0 ]; then
         WORKTREE_PATHS[$stream_name]="$worktree_path"
 
         # Copy .loki state to worktree
@@ -2180,6 +2194,11 @@ EOF
 
     # Write budget.json if a budget limit is configured
     if [ -n "$BUDGET_LIMIT" ]; then
+        # Validate budget limit is numeric before writing JSON
+        if ! echo "$BUDGET_LIMIT" | grep -qE '^[0-9]+(\.[0-9]+)?$'; then
+            log_warn "Invalid BUDGET_LIMIT '$BUDGET_LIMIT', defaulting to 0"
+            BUDGET_LIMIT=0
+        fi
         cat > ".loki/metrics/budget.json" << BUDGET_EOF
 {
   "limit": $BUDGET_LIMIT,
@@ -3402,10 +3421,15 @@ audit_log() {
 
     mkdir -p .loki/logs
 
-    local log_entry=$(cat << EOF
-{"timestamp":"$(date -u +%Y-%m-%dT%H:%M:%SZ)","event":"$event_type","data":"$event_data","user":"$(whoami)","pid":$$}
-EOF
-)
+    local log_entry
+    if command -v jq >/dev/null 2>&1; then
+        log_entry=$(jq -n --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --arg evt "$event_type" --arg data "$event_data" --arg user "$(whoami)" --argjson pid "$$" '{timestamp:$ts,event:$evt,data:$data,user:$user,pid:$pid}')
+    else
+        local safe_type safe_data
+        safe_type=$(printf '%s' "$event_type" | sed 's/["\\]/\\&/g; s/\n/\\n/g')
+        safe_data=$(printf '%s' "$event_data" | sed 's/["\\]/\\&/g; s/\n/\\n/g')
+        log_entry="{\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"event\":\"$safe_type\",\"data\":\"$safe_data\",\"user\":\"$(whoami)\",\"pid\":$$}"
+    fi
     echo "$log_entry" >> "$audit_file"
 }
 
@@ -3644,10 +3668,16 @@ save_learning() {
         init_learnings_db
     fi
 
-    local learning_entry=$(cat << EOF
-{"timestamp":"$(date -u +%Y-%m-%dT%H:%M:%SZ)","project":"$project","category":"$category","description":"$description"}
-EOF
-)
+    local learning_entry
+    if command -v jq >/dev/null 2>&1; then
+        learning_entry=$(jq -n --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --arg proj "$project" --arg cat "$category" --arg desc "$description" '{timestamp:$ts,project:$proj,category:$cat,description:$desc}')
+    else
+        local safe_proj safe_cat safe_desc
+        safe_proj=$(printf '%s' "$project" | sed 's/["\\]/\\&/g; s/\n/\\n/g')
+        safe_cat=$(printf '%s' "$category" | sed 's/["\\]/\\&/g; s/\n/\\n/g')
+        safe_desc=$(printf '%s' "$description" | sed 's/["\\]/\\&/g; s/\n/\\n/g')
+        learning_entry="{\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"project\":\"$safe_proj\",\"category\":\"$safe_cat\",\"description\":\"$safe_desc\"}"
+    fi
     echo "$learning_entry" >> "$target_file"
     log_info "Saved $learning_type: $category"
 }
@@ -6653,6 +6683,7 @@ except (json.JSONDecodeError, OSError): pass
 
 main() {
     trap cleanup INT TERM
+    SESSION_START_EPOCH=$(date +%s)
 
     echo ""
     echo -e "${BOLD}${BLUE}"
@@ -6904,8 +6935,8 @@ main() {
 
     # Load relevant learnings for this project context
     if [ -n "$PRD_PATH" ] && [ -f "$PRD_PATH" ]; then
-        get_relevant_learnings "$(cat "$PRD_PATH" | head -100)"
-        load_solutions_context "$(cat "$PRD_PATH" | head -100)"
+        get_relevant_learnings "$(head -100 "$PRD_PATH")"
+        load_solutions_context "$(head -100 "$PRD_PATH")"
     else
         get_relevant_learnings "general development"
         load_solutions_context "general development"
@@ -6926,6 +6957,12 @@ main() {
         "complexity=${DETECTED_COMPLEXITY:-standard}" \
         "pid=$$"
 
+    # Anonymous usage telemetry
+    loki_telemetry "session_start" \
+        "provider=${PROVIDER_NAME:-claude}" \
+        "complexity=${DETECTED_COMPLEXITY:-standard}" \
+        "parallel=${PARALLEL_MODE:-false}" 2>/dev/null || true
+
     # Run in appropriate mode
     local result=0
     if [ "$PARALLEL_MODE" = "true" ]; then
@@ -6985,6 +7022,14 @@ main() {
         "provider=${PROVIDER_NAME:-claude}" \
         "iterations=$ITERATION_COUNT"
 
+    # Anonymous usage telemetry
+    local session_duration=$(($(date +%s) - ${SESSION_START_EPOCH:-$(date +%s)}))
+    loki_telemetry "session_end" \
+        "provider=${PROVIDER_NAME:-claude}" \
+        "duration=$session_duration" \
+        "iterations=$ITERATION_COUNT" \
+        "result=$result" 2>/dev/null || true
+
     # Emit learning signal for session completion (SYN-018)
     if [ "$result" = "0" ]; then
         emit_learning_signal success_pattern \

package/autonomy/sandbox.sh

@@ -45,7 +45,7 @@ PROJECT_DIR="${PROJECT_DIR%/}"
 
 # Container name includes path hash to avoid collisions between similarly-named projects
 # macOS uses md5 instead of md5sum
-PROJECT_HASH=$(echo "$PROJECT_DIR" | md5sum 2>/dev/null | cut -c1-8 || md5 2>/dev/null | cut -c1-8 || echo "$$")
+PROJECT_HASH=$(echo "$PROJECT_DIR" | (md5sum 2>/dev/null || md5 -r 2>/dev/null || echo "$$") | cut -c1-8)
 CONTAINER_NAME="loki-sandbox-$(basename "$PROJECT_DIR" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g')-${PROJECT_HASH}"
 
 # Sandbox settings

package/autonomy/telemetry.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Anonymous usage telemetry for Loki Mode
+# Opt-out: LOKI_TELEMETRY_DISABLED=true or DO_NOT_TRACK=1
+# All calls are fire-and-forget, silent on failure, non-blocking
+
+LOKI_POSTHOG_HOST="${LOKI_TELEMETRY_ENDPOINT:-https://us.i.posthog.com}"
+LOKI_POSTHOG_KEY="phc_ya0vGBru41AJWtGNfZZ8H9W4yjoZy4KON0nnayS7s87"
+
+_loki_telemetry_enabled() {
+    [ "${LOKI_TELEMETRY_DISABLED:-}" = "true" ] && return 1
+    [ "${DO_NOT_TRACK:-}" = "1" ] && return 1
+    command -v curl >/dev/null 2>&1 || return 1
+    return 0
+}
+
+_loki_telemetry_id() {
+    local id_file="${HOME}/.loki-telemetry-id"
+    if [ -f "$id_file" ] 2>/dev/null; then
+        cat "$id_file" 2>/dev/null
+        return
+    fi
+    local new_id
+    new_id=$(python3 -c "import uuid; print(uuid.uuid4())" 2>/dev/null) || \
+    new_id=$(uuidgen 2>/dev/null | tr '[:upper:]' '[:lower:]') || \
+    new_id="anon-$(date +%s)-$$"
+    printf '%s\n' "$new_id" > "$id_file" 2>/dev/null
+    printf '%s' "$new_id"
+}
+
+_loki_detect_channel() {
+    local dir="${PROJECT_DIR:-${SKILL_DIR:-${SCRIPT_DIR:-}}}"
+    if [ -f "/.dockerenv" ] 2>/dev/null; then printf 'docker'; return; fi
+    case "$dir" in
+        */Cellar/*|*/homebrew/*) printf 'homebrew' ;;
+        */node_modules/*) printf 'npm' ;;
+        */.claude/skills/*) printf 'skill' ;;
+        *) printf 'source' ;;
+    esac
+}
+
+loki_telemetry() {
+    _loki_telemetry_enabled || return 0
+    local event="$1"; shift
+    local distinct_id props_json
+    distinct_id=$(_loki_telemetry_id 2>/dev/null) || return 0
+    local version
+    version=$(cat "${SCRIPT_DIR:-${SKILL_DIR:-}}/VERSION" 2>/dev/null || cat "${SCRIPT_DIR:-${SKILL_DIR:-}}/../VERSION" 2>/dev/null || echo "unknown")
+    version=$(echo "$version" | tr -d '[:space:]')
+    local channel
+    channel=$(_loki_detect_channel 2>/dev/null || echo "unknown")
+    local os_name arch
+    os_name=$(uname -s 2>/dev/null || echo "unknown")
+    arch=$(uname -m 2>/dev/null || echo "unknown")
+
+    # Build properties from remaining args (key=value pairs)
+    local extra_props=""
+    for arg in "$@"; do
+        local key="${arg%%=*}"
+        local val="${arg#*=}"
+        extra_props="${extra_props},\"${key}\":\"${val}\""
+    done
+
+    local payload
+    payload=$(printf '{"api_key":"%s","event":"%s","distinct_id":"%s","properties":{"os":"%s","arch":"%s","version":"%s","channel":"%s"%s}}' \
+        "$LOKI_POSTHOG_KEY" "$event" "$distinct_id" "$os_name" "$arch" "$version" "$channel" "$extra_props")
+
+    (curl -sS --max-time 3 -X POST "${LOKI_POSTHOG_HOST}/capture/" \
+        -H "Content-Type: application/json" \
+        -d "$payload" >/dev/null 2>&1 &) 2>/dev/null
+    return 0
+}

package/bin/postinstall.js

@@ -89,3 +89,40 @@ console.log('Or in Claude Code:');
 console.log('  claude --dangerously-skip-permissions');
 console.log('  Then say: "Loki Mode"');
 console.log('');
+
+// Anonymous install telemetry (fire-and-forget, silent)
+try {
+  if (process.env.LOKI_TELEMETRY_DISABLED !== 'true' && process.env.DO_NOT_TRACK !== '1') {
+    const https = require('https');
+    const crypto = require('crypto');
+    const idFile = path.join(homeDir, '.loki-telemetry-id');
+    let distinctId;
+    try {
+      distinctId = fs.readFileSync(idFile, 'utf8').trim();
+    } catch {
+      distinctId = crypto.randomUUID();
+      try { fs.writeFileSync(idFile, distinctId + '\n'); } catch {}
+    }
+    const payload = JSON.stringify({
+      api_key: 'phc_ya0vGBru41AJWtGNfZZ8H9W4yjoZy4KON0nnayS7s87',
+      event: 'install',
+      distinct_id: distinctId,
+      properties: {
+        os: os.platform(),
+        arch: os.arch(),
+        version: version,
+        channel: 'npm',
+        node_version: process.version,
+      },
+    });
+    const req = https.request({
+      hostname: 'us.i.posthog.com',
+      path: '/capture/',
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': payload.length },
+      timeout: 3000,
+    });
+    req.on('error', () => {});
+    req.end(payload);
+  }
+} catch {}