loki-mode 6.18.0 → 6.20.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Multi-agent autonomous startup system. Triggers on "Loki Mode". Takes PRD to deployed product with minimal human intervention. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v6.18.0
+# Loki Mode v6.20.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -267,4 +267,4 @@ The following features are documented in skill modules but not yet fully automat
 | Quality gates 3-reviewer system | Implemented (v5.35.0) | 5 specialist reviewers in `skills/quality-gates.md`; execution in run.sh |
 | Benchmarks (HumanEval, SWE-bench) | Infrastructure only | Runner scripts and datasets exist in `benchmarks/`; no published results |
 
-**v6.18.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v6.20.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-6.18.0
+6.20.0

package/autonomy/loki

@@ -420,7 +420,7 @@ show_help() {
     echo "  checkpoint|cp    Save/restore session checkpoints"
     echo "  projects         Multi-project registry management"
     echo "  audit [cmd]      Agent audit log and quality scanning (log|scan)"
-    echo "  review [dir]     Run quality gates on any project (standalone, no AI needed)"
+    echo "  review [opts]    Standalone code review with quality gates (diff, staged, PR, files)"
     echo "  optimize         Optimize prompts based on session history"
     echo "  enterprise       Enterprise feature management (tokens, OIDC)"
     echo "  metrics          Prometheus/OpenMetrics metrics from dashboard"
@@ -435,6 +435,7 @@ show_help() {
     echo "  agent [cmd]      Agent type dispatch (list|info|run|start|review)"
     echo "  remote [PRD]     Start remote session (connect from phone/browser, Claude Pro/Max)"
   echo "  trigger          Event-driven autonomous execution (schedules, webhooks)"
+    echo "  failover [cmd]   Cross-provider auto-failover (status|--enable|--test|--chain)"
     echo "  plan <PRD>       Dry-run PRD analysis: complexity, cost, and execution plan"
     echo "  version          Show version"
     echo "  help             Show this help"
@@ -8299,6 +8300,225 @@ for line in sys.stdin:
     esac
 }
 
+# Cross-provider auto-failover management (v6.19.0)
+cmd_failover() {
+    local loki_dir="${TARGET_DIR:-.}/.loki"
+    local failover_file="$loki_dir/state/failover.json"
+    local script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+    if [ $# -eq 0 ]; then
+        # No args: show current failover config and health
+        if [ ! -f "$failover_file" ]; then
+            echo -e "${BOLD}Cross-Provider Auto-Failover${NC}"
+            echo ""
+            echo "Status: DISABLED"
+            echo ""
+            echo "Enable with: loki failover --enable"
+            echo "Or set:      LOKI_FAILOVER=true loki start"
+            return 0
+        fi
+
+        echo -e "${BOLD}Cross-Provider Auto-Failover${NC}"
+        echo ""
+        python3 << 'PYEOF'
+import json, os
+fpath = os.path.join(os.environ.get('TARGET_DIR', '.'), '.loki/state/failover.json')
+try:
+    with open(fpath) as f:
+        d = json.load(f)
+    status = "ENABLED" if d.get("enabled") else "DISABLED"
+    print(f"Status:           {status}")
+    print(f"Chain:            {' -> '.join(d.get('chain', []))}")
+    print(f"Current provider: {d.get('currentProvider', 'unknown')}")
+    print(f"Primary provider: {d.get('primaryProvider', 'unknown')}")
+    print(f"Failover count:   {d.get('failoverCount', 0)}")
+    last = d.get('lastFailover')
+    print(f"Last failover:    {last if last else 'never'}")
+    print()
+    print("Health Status:")
+    health = d.get('healthCheck', {})
+    for provider in d.get('chain', []):
+        h = health.get(provider, 'unknown')
+        indicator = '[OK]' if h == 'healthy' else '[--]' if h == 'unknown' else '[!!]'
+        print(f"  {indicator} {provider}: {h}")
+except FileNotFoundError:
+    print("Failover not initialized. Run: loki failover --enable")
+except Exception as e:
+    print(f"Error reading failover state: {e}")
+PYEOF
+        return 0
+    fi
+
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            --enable)
+                mkdir -p "$loki_dir/state"
+                local current_provider
+                current_provider=$(cat "$loki_dir/state/provider" 2>/dev/null || echo "claude")
+                local chain="${LOKI_FAILOVER_CHAIN:-claude,codex,gemini}"
+
+                cat > "$failover_file" << FEOF
+{
+  "enabled": true,
+  "chain": $(printf '%s' "$chain" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read().strip().split(",")))' 2>/dev/null || echo '["claude","codex","gemini"]'),
+  "currentProvider": "$current_provider",
+  "primaryProvider": "$current_provider",
+  "lastFailover": null,
+  "failoverCount": 0,
+  "healthCheck": {}
+}
+FEOF
+                echo -e "${GREEN}Failover enabled${NC}"
+                echo "Chain: $chain"
+                echo "Primary: $current_provider"
+                shift
+                ;;
+            --disable)
+                if [ -f "$failover_file" ]; then
+                    python3 -c "
+import json
+with open('$failover_file') as f: d = json.load(f)
+d['enabled'] = False
+with open('$failover_file', 'w') as f: json.dump(d, f, indent=2)
+" 2>/dev/null
+                    echo -e "${YELLOW}Failover disabled${NC}"
+                else
+                    echo "Failover not initialized."
+                fi
+                shift
+                ;;
+            --chain)
+                shift
+                local new_chain="$1"
+                if [ -z "$new_chain" ]; then
+                    echo -e "${RED}Error: --chain requires a comma-separated list of providers${NC}"
+                    return 1
+                fi
+                # Validate each provider in chain
+                local IFS=','
+                for p in $new_chain; do
+                    case "$p" in
+                        claude|codex|gemini|cline|aider) ;;
+                        *) echo -e "${RED}Error: invalid provider '$p' in chain${NC}"; return 1 ;;
+                    esac
+                done
+                unset IFS
+
+                if [ ! -f "$failover_file" ]; then
+                    echo -e "${RED}Error: failover not initialized. Run: loki failover --enable${NC}"
+                    return 1
+                fi
+
+                python3 -c "
+import json
+with open('$failover_file') as f: d = json.load(f)
+d['chain'] = '$new_chain'.split(',')
+with open('$failover_file', 'w') as f: json.dump(d, f, indent=2)
+" 2>/dev/null
+                echo "Failover chain updated: $new_chain"
+                shift
+                ;;
+            --test)
+                echo -e "${BOLD}Testing all providers in failover chain...${NC}"
+                echo ""
+                # Source provider loader for health checks
+                if [ -f "$script_dir/../providers/loader.sh" ]; then
+                    source "$script_dir/../providers/loader.sh"
+                fi
+
+                local chain_providers="claude,codex,gemini"
+                if [ -f "$failover_file" ]; then
+                    chain_providers=$(python3 -c "import json; print(','.join(json.load(open('$failover_file')).get('chain', ['claude','codex','gemini'])))" 2>/dev/null || echo "claude,codex,gemini")
+                fi
+
+                local IFS=','
+                local all_pass=true
+                for p in $chain_providers; do
+                    printf "  %-10s " "$p:"
+
+                    # Check CLI installed
+                    local cli_name="$p"
+                    if command -v "$cli_name" &>/dev/null; then
+                        local cli_version
+                        cli_version=$("$cli_name" --version 2>/dev/null | head -1 || echo "unknown")
+                        printf "CLI %-20s " "[$cli_version]"
+                    else
+                        printf "CLI %-20s " "[NOT INSTALLED]"
+                        echo -e "${RED}FAIL${NC}"
+                        all_pass=false
+                        continue
+                    fi
+
+                    # Check API key
+                    local has_key=false
+                    case "$p" in
+                        claude) [ -n "${ANTHROPIC_API_KEY:-}" ] && has_key=true ;;
+                        codex) [ -n "${OPENAI_API_KEY:-}" ] && has_key=true ;;
+                        gemini) [ -n "${GOOGLE_API_KEY:-${GEMINI_API_KEY:-}}" ] && has_key=true ;;
+                        cline|aider) has_key=true ;;  # Key check varies
+                    esac
+
+                    if [ "$has_key" = "true" ]; then
+                        printf "Key [OK]  "
+                        echo -e "${GREEN}PASS${NC}"
+                    else
+                        printf "Key [MISSING]  "
+                        echo -e "${RED}FAIL${NC}"
+                        all_pass=false
+                    fi
+                done
+                unset IFS
+
+                echo ""
+                if [ "$all_pass" = "true" ]; then
+                    echo -e "${GREEN}All providers healthy${NC}"
+                else
+                    echo -e "${YELLOW}Some providers unavailable - failover chain may be limited${NC}"
+                fi
+                shift
+                ;;
+            --reset)
+                if [ -f "$failover_file" ]; then
+                    rm -f "$failover_file"
+                    echo "Failover state reset to defaults."
+                else
+                    echo "No failover state to reset."
+                fi
+                shift
+                ;;
+            --help|-h)
+                echo -e "${BOLD}loki failover${NC} - Cross-provider auto-failover management (v6.19.0)"
+                echo ""
+                echo "Usage: loki failover [options]"
+                echo ""
+                echo "Options:"
+                echo "  (no args)        Show failover status and health"
+                echo "  --enable         Enable auto-failover"
+                echo "  --disable        Disable auto-failover"
+                echo "  --chain X,Y,Z    Set failover chain (e.g., claude,codex,gemini)"
+                echo "  --test           Test all providers in chain"
+                echo "  --reset          Reset failover state to defaults"
+                echo "  --help, -h       Show this help"
+                echo ""
+                echo "Environment:"
+                echo "  LOKI_FAILOVER=true         Enable failover at startup"
+                echo "  LOKI_FAILOVER_CHAIN=X,Y,Z  Set default chain"
+                echo ""
+                echo "When a rate limit (429/529) is detected, Loki automatically switches"
+                echo "to the next healthy provider in the chain. After each successful"
+                echo "iteration on a fallback provider, the primary is health-checked and"
+                echo "execution switches back when it recovers."
+                return 0
+                ;;
+            *)
+                echo -e "${RED}Unknown option: $1${NC}"
+                echo "Run 'loki failover --help' for usage."
+                return 1
+                ;;
+        esac
+    done
+}
+
 # Dry-run PRD analysis and cost estimation (v6.18.0)
 cmd_plan() {
     local prd_file=""
@@ -8966,6 +9186,9 @@ main() {
         plan)
             cmd_plan "$@"
             ;;
+        failover)
+            cmd_failover "$@"
+            ;;
         version|--version|-v)
             cmd_version
             ;;
@@ -8982,224 +9205,477 @@ main() {
             ;;
     esac
 }
-
-# Standalone project review - run quality gates on any codebase (v6.14.0)
+# Standalone code review - diff-based quality gates (v6.20.0)
 cmd_review() {
-    local target_dir="."
-    local json_output=""
-    local verbose=""
+    local review_staged=false
+    local review_pr=""
+    local review_since=""
+    local review_target=""
+    local review_format="text"
+    local review_severity="all"
 
     while [[ $# -gt 0 ]]; do
         case "$1" in
-            --json) json_output="true"; shift ;;
-            --verbose|-v) verbose="true"; shift ;;
             --help|-h)
-                echo -e "${BOLD}loki review${NC} - Run quality gates on any project (standalone)"
+                echo -e "${BOLD}loki review${NC} - Standalone code review with quality gates"
                 echo ""
-                echo "Usage: loki review [directory] [options]"
+                echo "Usage: loki review [options] [file-or-dir]"
                 echo ""
-                echo "Arguments:"
-                echo "  directory       Path to project (default: current directory)"
+                echo "Reviews code changes using static analysis, security scanning,"
+                echo "style checks, and anti-pattern detection. No AI needed."
+                echo ""
+                echo "Sources (default: uncommitted changes via git diff):"
+                echo "  --staged             Review staged changes only"
+                echo "  --pr <number>        Review a GitHub PR"
+                echo "  --since <commit>     Review changes since a commit"
+                echo "  <file-or-dir>        Review specific files or directory"
                 echo ""
                 echo "Options:"
-                echo "  --json          Machine-readable JSON output"
-                echo "  --verbose, -v   Show detailed output per gate"
-                echo "  --help, -h      Show this help"
+                echo "  --format json        Output as JSON (for CI integration)"
+                echo "  --severity <level>   Filter: critical, high, medium, low, info (shows level+above)"
+                echo "  --help, -h           Show this help"
                 echo ""
-                echo "Gates: project-type, lint, tests, security, dependencies, structure"
-                echo "Exit code: 0 if all pass, 1 if any fail"
+                echo "Exit codes:"
+                echo "  0  No HIGH or CRITICAL findings"
+                echo "  1  HIGH severity findings present"
+                echo "  2  CRITICAL severity findings present"
+                echo ""
+                echo "Examples:"
+                echo "  loki review                     # Review uncommitted changes"
+                echo "  loki review --staged             # Review staged changes"
+                echo "  loki review --pr 42              # Review GitHub PR #42"
+                echo "  loki review src/                 # Review all files in src/"
+                echo "  loki review --since HEAD~5       # Changes in last 5 commits"
+                echo "  loki review --format json        # JSON output for CI"
+                echo "  loki review --severity high      # Only HIGH+ findings"
                 return 0
                 ;;
+            --staged) review_staged=true; shift ;;
+            --pr)
+                shift
+                review_pr="${1:-}"
+                if [ -z "$review_pr" ]; then
+                    echo -e "${RED}Error: --pr requires a PR number${NC}"
+                    return 1
+                fi
+                shift
+                ;;
+            --since)
+                shift
+                review_since="${1:-}"
+                if [ -z "$review_since" ]; then
+                    echo -e "${RED}Error: --since requires a commit reference${NC}"
+                    return 1
+                fi
+                shift
+                ;;
+            --format)
+                shift
+                review_format="${1:-text}"
+                shift
+                ;;
+            --severity)
+                shift
+                review_severity="${1:-all}"
+                review_severity="$(echo "$review_severity" | tr '[:upper:]' '[:lower:]')"
+                shift
+                ;;
             -*) echo -e "${RED}Unknown option: $1${NC}"; return 1 ;;
-            *) target_dir="$1"; shift ;;
+            *) review_target="$1"; shift ;;
         esac
     done
 
-    # Resolve and validate directory
-    target_dir="$(cd "$target_dir" 2>/dev/null && pwd)" || {
-        echo -e "${RED}Error: Directory not found: $target_dir${NC}"; return 1
-    }
-
-    local project_type="unknown"
-    local results=()  # gate:status pairs
-    local total_pass=0 total_warn=0 total_fail=0
-    local gate_details=()
-
-    # Helper: record gate result
-    _review_gate() {
-        local gate="$1" status="$2" detail="${3:-}"
-        results+=("$gate:$status")
-        gate_details+=("$gate:$detail")
-        case "$status" in
-            PASS) total_pass=$((total_pass + 1)) ;;
-            WARN) total_warn=$((total_warn + 1)) ;;
-            FAIL) total_fail=$((total_fail + 1)) ;;
+    # Severity level ordering (higher number = more severe)
+    _review_sev_level() {
+        case "$1" in
+            INFO) echo 1 ;;
+            LOW) echo 2 ;;
+            MEDIUM) echo 3 ;;
+            HIGH) echo 4 ;;
+            CRITICAL) echo 5 ;;
+            *) echo 0 ;;
         esac
     }
 
-    # Gate 1: Detect project type
-    if [ -f "$target_dir/package.json" ]; then
-        project_type="node"
-    elif [ -f "$target_dir/pyproject.toml" ] || [ -f "$target_dir/setup.py" ] || [ -f "$target_dir/requirements.txt" ]; then
-        project_type="python"
-    elif [ -f "$target_dir/go.mod" ]; then
-        project_type="go"
-    elif [ -f "$target_dir/Cargo.toml" ]; then
-        project_type="rust"
-    fi
-    if [ "$project_type" != "unknown" ]; then
-        _review_gate "project-type" "PASS" "Detected: $project_type"
+    local min_sev=0
+    case "$review_severity" in
+        info) min_sev=1 ;;
+        low) min_sev=2 ;;
+        medium) min_sev=3 ;;
+        high) min_sev=4 ;;
+        critical) min_sev=5 ;;
+        all) min_sev=0 ;;
+    esac
+
+    # Gather code to review
+    local diff_content=""
+    local review_files=""
+    local source_desc=""
+
+    if [ -n "$review_pr" ]; then
+        # PR review via gh CLI
+        if ! command -v gh &>/dev/null; then
+            echo -e "${RED}Error: gh CLI required for PR review. Install: https://cli.github.com${NC}"
+            return 1
+        fi
+        diff_content=$(gh pr diff "$review_pr" 2>&1) || {
+            echo -e "${RED}Error: Could not fetch PR #${review_pr}: $diff_content${NC}"
+            return 1
+        }
+        source_desc="PR #${review_pr}"
+    elif [ -n "$review_since" ]; then
+        diff_content=$(git diff "$review_since" 2>&1) || {
+            echo -e "${RED}Error: Invalid commit reference: $review_since${NC}"
+            return 1
+        }
+        source_desc="changes since $review_since"
+    elif [ -n "$review_target" ]; then
+        # File or directory target - get full contents
+        if [ -d "$review_target" ]; then
+            review_files=$(find "$review_target" -type f \
+                \( -name "*.sh" -o -name "*.bash" -o -name "*.py" -o -name "*.js" -o -name "*.ts" \
+                -o -name "*.jsx" -o -name "*.tsx" -o -name "*.go" -o -name "*.rs" -o -name "*.rb" \
+                -o -name "*.java" -o -name "*.c" -o -name "*.cpp" -o -name "*.h" \) \
+                -not -path "*/node_modules/*" -not -path "*/.git/*" \
+                -not -path "*/vendor/*" -not -path "*/__pycache__/*" \
+                -not -path "*/.venv/*" -not -path "*/target/*" 2>/dev/null)
+            source_desc="directory $review_target"
+        elif [ -f "$review_target" ]; then
+            review_files="$review_target"
+            source_desc="file $review_target"
+        else
+            echo -e "${RED}Error: Not found: $review_target${NC}"
+            return 1
+        fi
+    elif [ "$review_staged" = true ]; then
+        diff_content=$(git diff --cached 2>/dev/null)
+        source_desc="staged changes"
     else
-        _review_gate "project-type" "WARN" "Could not detect project type"
+        diff_content=$(git diff 2>/dev/null)
+        source_desc="uncommitted changes"
     fi
 
-    # Gate 2: Lint check
-    local lint_output="" lint_status="PASS"
-    case "$project_type" in
-        node)
-            if [ -f "$target_dir/.eslintrc.js" ] || [ -f "$target_dir/.eslintrc.json" ] || [ -f "$target_dir/.eslintrc.yml" ] || [ -f "$target_dir/eslint.config.js" ] || [ -f "$target_dir/eslint.config.mjs" ]; then
-                lint_output=$(cd "$target_dir" && npx eslint . --max-warnings=0 2>&1) || lint_status="FAIL"
-            else
-                lint_output="No ESLint config found"; lint_status="WARN"
-            fi ;;
-        python)
-            if command -v ruff &>/dev/null; then
-                lint_output=$(cd "$target_dir" && ruff check . 2>&1) || lint_status="FAIL"
-            elif command -v pylint &>/dev/null; then
-                lint_output=$(cd "$target_dir" && pylint --recursive=y . 2>&1) || lint_status="FAIL"
-            else
-                lint_output="No linter available (install ruff or pylint)"; lint_status="WARN"
-            fi ;;
-        go)
-            if command -v golangci-lint &>/dev/null; then
-                lint_output=$(cd "$target_dir" && golangci-lint run 2>&1) || lint_status="FAIL"
-            else
-                lint_output=$(cd "$target_dir" && go vet ./... 2>&1) || lint_status="FAIL"
-            fi ;;
-        rust)
-            lint_output=$(cd "$target_dir" && cargo clippy -- -D warnings 2>&1) || lint_status="FAIL"
-            ;;
-        *) lint_output="Skipped (unknown project type)"; lint_status="WARN" ;;
-    esac
-    _review_gate "lint" "$lint_status" "$lint_output"
-
-    # Gate 3: Tests
-    local test_output="" test_status="PASS"
-    case "$project_type" in
-        node)
-            if grep -q '"test"' "$target_dir/package.json" 2>/dev/null; then
-                test_output=$(cd "$target_dir" && npm test 2>&1) || test_status="FAIL"
-            else
-                test_output="No test script in package.json"; test_status="WARN"
-            fi ;;
-        python)
-            if command -v pytest &>/dev/null; then
-                test_output=$(cd "$target_dir" && pytest --tb=short 2>&1) || test_status="FAIL"
-            else
-                test_output="pytest not available"; test_status="WARN"
-            fi ;;
-        go) test_output=$(cd "$target_dir" && go test ./... 2>&1) || test_status="FAIL" ;;
-        rust) test_output=$(cd "$target_dir" && cargo test 2>&1) || test_status="FAIL" ;;
-        *) test_output="Skipped (unknown project type)"; test_status="WARN" ;;
-    esac
-    _review_gate "tests" "$test_status" "$test_output"
-
-    # Gate 4: Security - grep for hardcoded secrets
-    local secret_output="" secret_status="PASS"
-    local secret_patterns='(API_KEY|SECRET_KEY|PASSWORD|TOKEN|PRIVATE_KEY)\s*[=:]\s*["\x27][A-Za-z0-9+/=_-]{8,}'
-    secret_output=$(grep -rEn "$secret_patterns" "$target_dir" \
-        --include="*.js" --include="*.ts" --include="*.py" --include="*.go" --include="*.rs" \
-        --include="*.jsx" --include="*.tsx" --include="*.java" --include="*.rb" \
-        --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=vendor \
-        --exclude-dir=__pycache__ --exclude-dir=.venv --exclude-dir=target 2>/dev/null) || true
-    if [ -n "$secret_output" ]; then
-        secret_status="FAIL"
-        secret_output="Potential hardcoded secrets found:
-$secret_output"
-    else
-        secret_output="No hardcoded secrets detected"
+    # Check if there is anything to review
+    if [ -z "$diff_content" ] && [ -z "$review_files" ]; then
+        if [ "$review_format" = "json" ]; then
+            echo '{"source":"'"$source_desc"'","findings":[],"summary":{"critical":0,"high":0,"medium":0,"low":0,"info":0,"total":0},"exit_code":0}'
+        else
+            echo -e "${GREEN}No changes to review ($source_desc).${NC}"
+        fi
+        return 0
     fi
-    _review_gate "security" "$secret_status" "$secret_output"
 
-    # Gate 5: Dependency audit
-    local dep_output="" dep_status="PASS"
-    case "$project_type" in
-        node)
-            if [ -f "$target_dir/package-lock.json" ] || [ -f "$target_dir/yarn.lock" ]; then
-                dep_output=$(cd "$target_dir" && npm audit --production 2>&1) || dep_status="WARN"
-            else
-                dep_output="No lockfile found"; dep_status="WARN"
-            fi ;;
-        python)
-            if command -v pip-audit &>/dev/null; then
-                dep_output=$(cd "$target_dir" && pip-audit 2>&1) || dep_status="WARN"
-            else
-                dep_output="pip-audit not available"; dep_status="WARN"
-            fi ;;
-        *) dep_output="No dependency audit available for $project_type"; dep_status="WARN" ;;
-    esac
-    _review_gate "dependencies" "$dep_status" "$dep_output"
-
-    # Gate 6: Structure check
-    local struct_output="" struct_status="PASS" struct_issues=()
-    [ ! -f "$target_dir/README.md" ] && [ ! -f "$target_dir/README.rst" ] && [ ! -f "$target_dir/README" ] && struct_issues+=("Missing README")
-    local file_count
-    file_count=$(find "$target_dir" -type f -not -path '*/.git/*' -not -path '*/node_modules/*' -not -path '*/vendor/*' -not -path '*/__pycache__/*' -not -path '*/.venv/*' -not -path '*/target/*' 2>/dev/null | wc -l | tr -d ' ')
-    [ "$file_count" -gt 5000 ] && struct_issues+=("Large project: $file_count files")
-    local huge_files
-    huge_files=$(find "$target_dir" -type f -size +1M -not -path '*/.git/*' -not -path '*/node_modules/*' -not -path '*/vendor/*' -not -path '*/target/*' 2>/dev/null | head -5)
-    [ -n "$huge_files" ] && struct_issues+=("Files >1MB found: $(echo "$huge_files" | wc -l | tr -d ' ')")
-    if [ ${#struct_issues[@]} -gt 0 ]; then
-        struct_status="WARN"
-        struct_output=$(printf '%s\n' "${struct_issues[@]}")
+    # Build file content for non-diff reviews
+    local all_content=""
+    if [ -n "$review_files" ]; then
+        while IFS= read -r f; do
+            [ -z "$f" ] && continue
+            all_content+="=== FILE: $f ===
+$(cat "$f" 2>/dev/null)
+"
+        done <<< "$review_files"
     else
-        struct_output="README present, $file_count files, no oversized files"
-    fi
-    _review_gate "structure" "$struct_status" "$struct_output"
-
-    # Output results
-    if [ -n "$json_output" ]; then
-        local gates_json="["
-        local first="true"
-        for r in "${results[@]}"; do
-            local gate="${r%%:*}" status="${r#*:}"
-            [ "$first" = "true" ] && first="" || gates_json+=","
-            gates_json+="{\"gate\":\"$gate\",\"status\":\"$status\"}"
+        all_content="$diff_content"
+    fi
+
+    # Findings array: "file|line|severity|category|finding|suggestion"
+    local findings=()
+    local has_critical=false
+    local has_high=false
+
+    # Helper to add a finding
+    _add_finding() {
+        local file="$1" line="$2" sev="$3" cat="$4" finding="$5" suggestion="$6"
+        local sev_num
+        sev_num=$(_review_sev_level "$sev")
+        if [ "$sev_num" -ge "$min_sev" ]; then
+            findings+=("${file}|${line}|${sev}|${cat}|${finding}|${suggestion}")
+            [ "$sev" = "CRITICAL" ] && has_critical=true || true
+            [ "$sev" = "HIGH" ] && has_high=true || true
+        fi
+    }
+
+    # --- Gate 1: Static Analysis ---
+    # Run shellcheck on shell files if available
+    if command -v shellcheck &>/dev/null; then
+        local shell_files=""
+        if [ -n "$review_files" ]; then
+            shell_files=$(echo "$review_files" | grep -E '\.(sh|bash)$' || true)
+        elif [ -n "$diff_content" ]; then
+            shell_files=$(echo "$diff_content" | grep -E '^\+\+\+ b/' | sed 's|^+++ b/||' | grep -E '\.(sh|bash)$' || true)
+        fi
+        if [ -n "$shell_files" ]; then
+            while IFS= read -r sf; do
+                [ -z "$sf" ] && continue
+                [ ! -f "$sf" ] && continue
+                local sc_out
+                sc_out=$(shellcheck -f gcc "$sf" 2>/dev/null || true)
+                while IFS= read -r sc_line; do
+                    [ -z "$sc_line" ] && continue
+                    local sc_file sc_lineno sc_sev sc_msg
+                    sc_file=$(echo "$sc_line" | cut -d: -f1)
+                    sc_lineno=$(echo "$sc_line" | cut -d: -f2)
+                    sc_sev=$(echo "$sc_line" | sed -n 's/.*: \(warning\|error\|note\|info\):.*/\1/p')
+                    sc_msg=$(echo "$sc_line" | sed 's/.*: \(warning\|error\|note\|info\): //')
+                    local mapped_sev="LOW"
+                    case "$sc_sev" in
+                        error) mapped_sev="HIGH" ;;
+                        warning) mapped_sev="MEDIUM" ;;
+                        *) mapped_sev="LOW" ;;
+                    esac
+                    _add_finding "$sc_file" "$sc_lineno" "$mapped_sev" "static-analysis" "$sc_msg" "Fix shellcheck finding"
+                done <<< "$sc_out"
+            done <<< "$shell_files"
+        fi
+    fi
+
+    # Run eslint if available on JS/TS files
+    if command -v npx &>/dev/null; then
+        local js_files=""
+        if [ -n "$review_files" ]; then
+            js_files=$(echo "$review_files" | grep -E '\.(js|ts|jsx|tsx)$' || true)
+        elif [ -n "$diff_content" ]; then
+            js_files=$(echo "$diff_content" | grep -E '^\+\+\+ b/' | sed 's|^+++ b/||' | grep -E '\.(js|ts|jsx|tsx)$' || true)
+        fi
+        if [ -n "$js_files" ]; then
+            while IFS= read -r jsf; do
+                [ -z "$jsf" ] && continue
+                [ ! -f "$jsf" ] && continue
+                if [ -f ".eslintrc.js" ] || [ -f ".eslintrc.json" ] || [ -f "eslint.config.js" ] || [ -f "eslint.config.mjs" ]; then
+                    local eslint_out
+                    eslint_out=$(npx eslint --format compact "$jsf" 2>/dev/null || true)
+                    while IFS= read -r el; do
+                        [ -z "$el" ] && continue
+                        [[ "$el" == *"problem"* ]] && continue
+                        local el_file el_line el_msg
+                        el_file=$(echo "$el" | cut -d: -f1)
+                        el_line=$(echo "$el" | cut -d: -f2)
+                        el_msg=$(echo "$el" | sed 's/^[^)]*) //')
+                        local el_sev="LOW"
+                        [[ "$el" == *"Error"* ]] && el_sev="MEDIUM"
+                        _add_finding "$el_file" "$el_line" "$el_sev" "static-analysis" "$el_msg" "Fix eslint finding"
+                    done <<< "$eslint_out"
+                fi
+            done <<< "$js_files"
+        fi
+    fi
+
+    # --- Gate 2: Security Scan ---
+    # Helper: scan for a pattern across files or diff content
+    _review_scan() {
+        local pattern="$1" sev="$2" cat="$3" finding="$4" suggestion="$5"
+        if [ -n "$review_files" ]; then
+            # Scan actual files with grep -Hn (file:line:content)
+            local scan_files_arr=()
+            while IFS= read -r sf; do
+                [ -z "$sf" ] && continue
+                [ -f "$sf" ] && scan_files_arr+=("$sf")
+            done <<< "$review_files"
+            [ ${#scan_files_arr[@]} -eq 0 ] && return
+            while IFS= read -r match; do
+                [ -z "$match" ] && continue
+                local mf ml
+                mf=$(echo "$match" | cut -d: -f1)
+                ml=$(echo "$match" | cut -d: -f2)
+                _add_finding "$mf" "$ml" "$sev" "$cat" "$finding" "$suggestion"
+            done < <(grep -HnE "$pattern" "${scan_files_arr[@]}" 2>/dev/null || true)
+        else
+            # Scan diff content (line numbers are from the text blob)
+            while IFS= read -r match; do
+                [ -z "$match" ] && continue
+                local ml
+                ml=$(echo "$match" | cut -d: -f1)
+                _add_finding "diff" "$ml" "$sev" "$cat" "$finding" "$suggestion"
+            done < <(echo "$all_content" | grep -nE "$pattern" 2>/dev/null || true)
+        fi
+    }
+
+    # Hardcoded secrets
+    local secret_patterns=(
+        'API_KEY\s*[=:]\s*["\x27][A-Za-z0-9+/=_-]{8,}'
+        'SECRET_KEY\s*[=:]\s*["\x27][A-Za-z0-9+/=_-]{8,}'
+        'PASSWORD\s*[=:]\s*["\x27][^\x27"]{4,}'
+        'PRIVATE_KEY\s*[=:]\s*["\x27][A-Za-z0-9+/=_-]{8,}'
+        'AWS_ACCESS_KEY_ID\s*[=:]\s*["\x27]AK[A-Z0-9]{18}'
+        'ghp_[A-Za-z0-9]{36}'
+        'sk-[A-Za-z0-9]{32,}'
+        'Bearer\s+[A-Za-z0-9._-]{20,}'
+    )
+    for pattern in "${secret_patterns[@]}"; do
+        _review_scan "$pattern" "CRITICAL" "security" \
+            "Potential hardcoded secret detected" \
+            "Use environment variables or a secrets manager instead"
+    done
+
+    # SQL injection patterns
+    _review_scan '(SELECT|INSERT|UPDATE|DELETE|DROP)\s.*\+\s*(req\.|request\.|params\.|user)' \
+        "HIGH" "security" \
+        "Potential SQL injection: string concatenation in query" \
+        "Use parameterized queries or prepared statements"
+
+    # eval/exec usage
+    _review_scan '(^|\s)(eval|exec)\s*\(' \
+        "HIGH" "security" \
+        "Dangerous eval/exec usage detected" \
+        "Avoid eval/exec with dynamic input; use safer alternatives"
+
+    # Unsafe deserialization
+    _review_scan '(pickle\.loads?|yaml\.load\s*\()' \
+        "HIGH" "security" \
+        "Unsafe deserialization detected (pickle/yaml.load)" \
+        "Use yaml.safe_load or avoid pickle with untrusted data"
+
+    # --- Gate 3: Code Style ---
+    # Long functions (>100 lines heuristic from diff)
+    if [ -n "$review_files" ]; then
+        while IFS= read -r f; do
+            [ -z "$f" ] && continue
+            [ ! -f "$f" ] && continue
+            local line_count
+            line_count=$(wc -l < "$f" | tr -d ' ')
+            if [ "$line_count" -gt 500 ]; then
+                _add_finding "$f" "1" "MEDIUM" "style" \
+                    "File has $line_count lines (>500)" \
+                    "Consider breaking into smaller modules"
+            fi
+            # Check for very long lines
+            local long_lines
+            long_lines=$(awk 'length > 200 {count++} END {print count+0}' "$f" 2>/dev/null)
+            if [ "$long_lines" -gt 5 ]; then
+                _add_finding "$f" "1" "LOW" "style" \
+                    "$long_lines lines exceed 200 characters" \
+                    "Break long lines for readability"
+            fi
+        done <<< "$review_files"
+    fi
+
+    # TODO/FIXME/HACK/XXX detection
+    _review_scan '(TODO|FIXME|HACK|XXX):' "INFO" "style" \
+        "TODO/FIXME/HACK/XXX comment marker found" \
+        "Track in issue tracker instead of code comments"
+
+    # --- Gate 4: Anti-pattern Detection ---
+    # console.log left in code (JS/TS)
+    _review_scan 'console\.(log|debug|warn)\(' "LOW" "anti-pattern" \
+        "console.log statement (debug artifact?)" \
+        "Remove debug logging or use a proper logger"
+
+    # Catch bare except in Python
+    _review_scan 'except\s*:' "MEDIUM" "anti-pattern" \
+        "Bare except clause catches all exceptions" \
+        "Catch specific exceptions (e.g., except ValueError)"
+
+    # Disabled SSL verification
+    _review_scan '(verify\s*=\s*False|VERIFY_SSL\s*=\s*False|NODE_TLS_REJECT_UNAUTHORIZED.*0|rejectUnauthorized.*false)' \
+        "HIGH" "anti-pattern" \
+        "SSL verification disabled" \
+        "Enable SSL verification in production"
+
+    # Hardcoded IP addresses (skip localhost/0.0.0.0/version patterns)
+    _review_scan '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' \
+        "LOW" "anti-pattern" \
+        "Hardcoded IP address detected" \
+        "Use configuration or DNS names instead"
+
+    # --- Tally results ---
+    local count_critical=0 count_high=0 count_medium=0 count_low=0 count_info=0
+    for f in "${findings[@]}"; do
+        local sev
+        sev=$(echo "$f" | cut -d'|' -f3)
+        case "$sev" in
+            CRITICAL) count_critical=$((count_critical + 1)) ;;
+            HIGH) count_high=$((count_high + 1)) ;;
+            MEDIUM) count_medium=$((count_medium + 1)) ;;
+            LOW) count_low=$((count_low + 1)) ;;
+            INFO) count_info=$((count_info + 1)) ;;
+        esac
+    done
+    local count_total=${#findings[@]}
+
+    # Determine exit code
+    local exit_code=0
+    [ "$has_high" = true ] && exit_code=1 || true
+    [ "$has_critical" = true ] && exit_code=2 || true
+
+    # --- Output ---
+    if [ "$review_format" = "json" ]; then
+        local json_findings="["
+        local first=true
+        for f in "${findings[@]}"; do
+            local f_file f_line f_sev f_cat f_finding f_suggestion
+            f_file=$(echo "$f" | cut -d'|' -f1)
+            f_line=$(echo "$f" | cut -d'|' -f2)
+            f_sev=$(echo "$f" | cut -d'|' -f3)
+            f_cat=$(echo "$f" | cut -d'|' -f4)
+            f_finding=$(echo "$f" | cut -d'|' -f5)
+            f_suggestion=$(echo "$f" | cut -d'|' -f6)
+            # Escape quotes for JSON
+            f_finding=$(echo "$f_finding" | sed 's/"/\\"/g')
+            f_suggestion=$(echo "$f_suggestion" | sed 's/"/\\"/g')
+            f_file=$(echo "$f_file" | sed 's/"/\\"/g')
+            [ "$first" = true ] && first=false || json_findings+=","
+            json_findings+="{\"file\":\"$f_file\",\"line\":$f_line,\"severity\":\"$f_sev\",\"category\":\"$f_cat\",\"finding\":\"$f_finding\",\"suggestion\":\"$f_suggestion\"}"
         done
-        gates_json+="]"
-        printf '{"directory":"%s","project_type":"%s","pass":%d,"warn":%d,"fail":%d,"gates":%s}\n' \
-            "$target_dir" "$project_type" "$total_pass" "$total_warn" "$total_fail" "$gates_json"
+        json_findings+="]"
+        printf '{"source":"%s","findings":%s,"summary":{"critical":%d,"high":%d,"medium":%d,"low":%d,"info":%d,"total":%d},"exit_code":%d}\n' \
+            "$source_desc" "$json_findings" "$count_critical" "$count_high" "$count_medium" "$count_low" "$count_info" "$count_total" "$exit_code"
     else
-        echo -e "${BOLD}Loki Review: $target_dir${NC}"
-        echo -e "Project type: ${CYAN}$project_type${NC}"
+        echo -e "${BOLD}Loki Code Review${NC}"
+        echo -e "Source: ${CYAN}$source_desc${NC}"
         echo "---"
-        for r in "${results[@]}"; do
-            local gate="${r%%:*}" status="${r#*:}"
-            case "$status" in
-                PASS) echo -e "  ${GREEN}[PASS]${NC} $gate" ;;
-                WARN) echo -e "  ${YELLOW}[WARN]${NC} $gate" ;;
-                FAIL) echo -e "  ${RED}[FAIL]${NC} $gate" ;;
-            esac
-        done
-        echo "---"
-        echo -e "Results: ${GREEN}$total_pass passed${NC}, ${YELLOW}$total_warn warnings${NC}, ${RED}$total_fail failed${NC}"
 
-        if [ -n "$verbose" ]; then
-            echo ""
-            echo -e "${BOLD}Details:${NC}"
-            for d in "${gate_details[@]}"; do
-                local gate="${d%%:*}" detail="${d#*:}"
-                echo -e "\n${CYAN}[$gate]${NC}"
-                echo "$detail" | head -30
+        if [ "$count_total" -eq 0 ]; then
+            echo -e "${GREEN}No findings. Code looks clean.${NC}"
+        else
+            # Group by severity
+            for sev_name in CRITICAL HIGH MEDIUM LOW INFO; do
+                local printed_header=false
+                for f in "${findings[@]}"; do
+                    local f_sev
+                    f_sev=$(echo "$f" | cut -d'|' -f3)
+                    [ "$f_sev" != "$sev_name" ] && continue
+                    if [ "$printed_header" = false ]; then
+                        local sev_color="$NC"
+                        case "$sev_name" in
+                            CRITICAL) sev_color="$RED" ;;
+                            HIGH) sev_color="$RED" ;;
+                            MEDIUM) sev_color="$YELLOW" ;;
+                            LOW) sev_color="$CYAN" ;;
+                            INFO) sev_color="$DIM" ;;
+                        esac
+                        echo ""
+                        echo -e "${sev_color}${BOLD}[$sev_name]${NC}"
+                        printed_header=true
+                    fi
+                    local f_file f_line f_cat f_finding f_suggestion
+                    f_file=$(echo "$f" | cut -d'|' -f1)
+                    f_line=$(echo "$f" | cut -d'|' -f2)
+                    f_cat=$(echo "$f" | cut -d'|' -f4)
+                    f_finding=$(echo "$f" | cut -d'|' -f5)
+                    f_suggestion=$(echo "$f" | cut -d'|' -f6)
+                    echo -e "  ${DIM}$f_file:$f_line${NC} [$f_cat] $f_finding"
+                    echo -e "    -> $f_suggestion"
+                done
             done
         fi
+
+        echo ""
+        echo "---"
+        echo -e "Summary: ${RED}$count_critical critical${NC}, ${RED}$count_high high${NC}, ${YELLOW}$count_medium medium${NC}, ${CYAN}$count_low low${NC}, ${DIM}$count_info info${NC} ($count_total total)"
+
+        if [ "$exit_code" -eq 2 ]; then
+            echo -e "${RED}CRITICAL findings detected. Review required.${NC}"
+        elif [ "$exit_code" -eq 1 ]; then
+            echo -e "${RED}HIGH severity findings detected.${NC}"
+        else
+            echo -e "${GREEN}No HIGH or CRITICAL findings.${NC}"
+        fi
     fi
 
-    # Exit code: 1 if any failures
-    [ "$total_fail" -gt 0 ] && return 1
-    return 0
+    return "$exit_code"
 }
 
+
 # Worktree management (v6.7.0)
 cmd_worktree() {
     local subcommand="${1:-list}"

package/autonomy/run.sh

@@ -6525,6 +6525,278 @@ calculate_wait() {
     echo $wait_time
 }
 
+#===============================================================================
+# Cross-Provider Auto-Failover (v6.19.0)
+#===============================================================================
+
+# Initialize failover state file on startup
+init_failover_state() {
+    local failover_dir="${TARGET_DIR:-.}/.loki/state"
+    local failover_file="$failover_dir/failover.json"
+
+    # Only create if failover is enabled via env or config
+    if [ "${LOKI_FAILOVER:-false}" != "true" ]; then
+        return
+    fi
+
+    mkdir -p "$failover_dir"
+
+    if [ ! -f "$failover_file" ]; then
+        local chain="${LOKI_FAILOVER_CHAIN:-claude,codex,gemini}"
+        local primary="${PROVIDER_NAME:-claude}"
+        cat > "$failover_file" << FEOF
+{
+  "enabled": true,
+  "chain": $(printf '%s' "$chain" | python3 -c 'import sys,json; print(json.dumps(sys.stdin.read().strip().split(",")))' 2>/dev/null || echo '["claude","codex","gemini"]'),
+  "currentProvider": "$primary",
+  "primaryProvider": "$primary",
+  "lastFailover": null,
+  "failoverCount": 0,
+  "healthCheck": {
+    "$primary": "healthy"
+  }
+}
+FEOF
+        log_info "Failover initialized: chain=$chain, primary=$primary"
+    fi
+}
+
+# Read failover config from state file
+# Sets: FAILOVER_ENABLED, FAILOVER_CHAIN, FAILOVER_CURRENT, FAILOVER_PRIMARY
+read_failover_config() {
+    local failover_file="${TARGET_DIR:-.}/.loki/state/failover.json"
+
+    if [ ! -f "$failover_file" ]; then
+        FAILOVER_ENABLED="false"
+        return 1
+    fi
+
+    eval "$(python3 << 'PYEOF' 2>/dev/null || echo 'FAILOVER_ENABLED=false'
+import json, os
+try:
+    with open(os.path.join(os.environ.get('TARGET_DIR', '.'), '.loki/state/failover.json')) as f:
+        d = json.load(f)
+    chain = ','.join(d.get('chain', ['claude','codex','gemini']))
+    print(f'FAILOVER_ENABLED={str(d.get("enabled", False)).lower()}')
+    print(f'FAILOVER_CHAIN="{chain}"')
+    print(f'FAILOVER_CURRENT="{d.get("currentProvider", "claude")}"')
+    print(f'FAILOVER_PRIMARY="{d.get("primaryProvider", "claude")}"')
+    print(f'FAILOVER_COUNT={d.get("failoverCount", 0)}')
+except Exception:
+    print('FAILOVER_ENABLED=false')
+PYEOF
+    )"
+}
+
+# Update failover state file
+update_failover_state() {
+    local key="$1"
+    local value="$2"
+    local failover_file="${TARGET_DIR:-.}/.loki/state/failover.json"
+
+    [ ! -f "$failover_file" ] && return 1
+
+    python3 << PYEOF 2>/dev/null || true
+import json, os
+fpath = os.path.join(os.environ.get('TARGET_DIR', '.'), '.loki/state/failover.json')
+try:
+    with open(fpath) as f:
+        d = json.load(f)
+    key = "$key"
+    value = "$value"
+    # Handle type conversion
+    if value == "null":
+        d[key] = None
+    elif value == "true":
+        d[key] = True
+    elif value == "false":
+        d[key] = False
+    elif value.isdigit():
+        d[key] = int(value)
+    else:
+        d[key] = value
+    with open(fpath, 'w') as f:
+        json.dump(d, f, indent=2)
+except Exception:
+    pass
+PYEOF
+}
+
+# Update health status for a specific provider in failover.json
+update_failover_health() {
+    local provider="$1"
+    local status="$2"  # healthy, unhealthy, unknown
+    local failover_file="${TARGET_DIR:-.}/.loki/state/failover.json"
+
+    [ ! -f "$failover_file" ] && return 1
+
+    python3 << PYEOF 2>/dev/null || true
+import json, os
+fpath = os.path.join(os.environ.get('TARGET_DIR', '.'), '.loki/state/failover.json')
+try:
+    with open(fpath) as f:
+        d = json.load(f)
+    if 'healthCheck' not in d:
+        d['healthCheck'] = {}
+    d['healthCheck']["$provider"] = "$status"
+    with open(fpath, 'w') as f:
+        json.dump(d, f, indent=2)
+except Exception:
+    pass
+PYEOF
+}
+
+# Check provider health: API key exists + CLI installed
+# Returns: 0 if healthy, 1 if unhealthy
+check_provider_health() {
+    local provider="$1"
+
+    # Check CLI is installed
+    case "$provider" in
+        claude)
+            command -v claude &>/dev/null || return 1
+            [ -n "${ANTHROPIC_API_KEY:-}" ] || return 1
+            ;;
+        codex)
+            command -v codex &>/dev/null || return 1
+            [ -n "${OPENAI_API_KEY:-}" ] || return 1
+            ;;
+        gemini)
+            command -v gemini &>/dev/null || return 1
+            [ -n "${GOOGLE_API_KEY:-${GEMINI_API_KEY:-}}" ] || return 1
+            ;;
+        cline)
+            command -v cline &>/dev/null || return 1
+            ;;
+        aider)
+            command -v aider &>/dev/null || return 1
+            ;;
+        *)
+            return 1
+            ;;
+    esac
+
+    return 0
+}
+
+# Attempt failover to next healthy provider in chain
+# Called when rate limit is detected on current provider
+# Returns: 0 if failover succeeded, 1 if all providers exhausted
+attempt_provider_failover() {
+    read_failover_config || return 1
+
+    if [ "$FAILOVER_ENABLED" != "true" ]; then
+        return 1
+    fi
+
+    local current="${FAILOVER_CURRENT:-${PROVIDER_NAME:-claude}}"
+    log_warn "Failover: rate limit on $current, checking chain: $FAILOVER_CHAIN"
+
+    # Mark current as unhealthy
+    update_failover_health "$current" "unhealthy"
+
+    # Walk the chain looking for the next healthy provider
+    local IFS=','
+    local found_current=false
+    local tried_wrap=false
+
+    # Two passes: first from current position to end, then from start to current
+    for provider in $FAILOVER_CHAIN $FAILOVER_CHAIN; do
+        if [ "$provider" = "$current" ]; then
+            if [ "$found_current" = "true" ]; then
+                # We've wrapped around, all exhausted
+                break
+            fi
+            found_current=true
+            continue
+        fi
+
+        [ "$found_current" != "true" ] && continue
+
+        # Check if this provider is healthy
+        if check_provider_health "$provider"; then
+            log_info "Failover: switching from $current to $provider"
+
+            # Load the new provider config
+            local provider_dir
+            provider_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/providers"
+            if [ -f "$provider_dir/$provider.sh" ]; then
+                source "$provider_dir/$provider.sh"
+            fi
+
+            # Update state
+            update_failover_state "currentProvider" "$provider"
+            update_failover_state "lastFailover" "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+            update_failover_state "failoverCount" "$((FAILOVER_COUNT + 1))"
+            update_failover_health "$provider" "healthy"
+
+            # Update runtime provider vars
+            PROVIDER_NAME="$provider"
+
+            emit_event_json "provider_failover" \
+                "from=$current" \
+                "to=$provider" \
+                "reason=rate_limit" \
+                "iteration=$ITERATION_COUNT" 2>/dev/null || true
+
+            log_info "Failover: now using $provider (failover #$((FAILOVER_COUNT + 1)))"
+            return 0
+        else
+            log_debug "Failover: $provider is unhealthy, skipping"
+            update_failover_health "$provider" "unhealthy"
+        fi
+    done
+
+    log_warn "Failover: all providers in chain exhausted, falling back to retry"
+    return 1
+}
+
+# Check if primary provider has recovered after running on a fallback
+# Called after each successful iteration when on a non-primary provider
+# Returns: 0 if switched back to primary, 1 if still on fallback
+check_primary_recovery() {
+    read_failover_config || return 1
+
+    if [ "$FAILOVER_ENABLED" != "true" ]; then
+        return 1
+    fi
+
+    local current="${FAILOVER_CURRENT:-${PROVIDER_NAME:-claude}}"
+    local primary="${FAILOVER_PRIMARY:-claude}"
+
+    # Already on primary
+    if [ "$current" = "$primary" ]; then
+        return 1
+    fi
+
+    # Check if primary is healthy again
+    if check_provider_health "$primary"; then
+        log_info "Failover: primary provider $primary appears healthy, switching back"
+
+        # Load primary provider config
+        local provider_dir
+        provider_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/providers"
+        if [ -f "$provider_dir/$primary.sh" ]; then
+            source "$provider_dir/$primary.sh"
+        fi
+
+        update_failover_state "currentProvider" "$primary"
+        update_failover_health "$primary" "healthy"
+
+        PROVIDER_NAME="$primary"
+
+        emit_event_json "provider_recovery" \
+            "from=$current" \
+            "to=$primary" \
+            "iteration=$ITERATION_COUNT" 2>/dev/null || true
+
+        log_info "Failover: recovered to primary provider $primary"
+        return 0
+    fi
+
+    return 1
+}
+
 #===============================================================================
 # Rate Limit Detection
 #===============================================================================
@@ -8145,6 +8417,9 @@ run_autonomous() {
     load_state
     local retry=$RETRY_COUNT
 
+    # Initialize Cross-Provider Failover (v6.19.0)
+    init_failover_state
+
     # Initialize Completion Council (v5.25.0)
     if type council_init &>/dev/null; then
         council_init "$prd_path"
@@ -8784,6 +9059,9 @@ if __name__ == "__main__":
                 log_warn "Council will evaluate at next check interval (every ${COUNCIL_CHECK_INTERVAL:-5} iterations)"
             fi
 
+            # Cross-provider failover: check if primary has recovered (v6.19.0)
+            check_primary_recovery 2>/dev/null || true
+
             # SUCCESS exit - continue IMMEDIATELY to next iteration (no wait!)
             log_step "Starting next iteration..."
             ((retry++))
@@ -8801,6 +9079,13 @@ if __name__ == "__main__":
         local wait_time
 
         if [ $rate_limit_wait -gt 0 ]; then
+            # Cross-provider failover (v6.19.0): try switching provider before waiting
+            if attempt_provider_failover 2>/dev/null; then
+                log_info "Failover succeeded - retrying immediately with ${PROVIDER_NAME}"
+                ((retry++))
+                continue
+            fi
+
             wait_time=$rate_limit_wait
             local human_time=$(format_duration $wait_time)
             log_warn "Rate limit detected! Waiting until reset (~$human_time)..."

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "6.18.0"
+__version__ = "6.20.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Complete installation instructions for all platforms and use cases.
 
-**Version:** v6.18.0
+**Version:** v6.20.0
 
 ---
 

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '6.18.0'
+__version__ = '6.20.0'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loki-mode",
-  "version": "6.18.0",
+  "version": "6.20.0",
   "description": "Loki Mode by Autonomi - Multi-agent autonomous startup system for Claude Code, Codex CLI, and Gemini CLI",
   "keywords": [
     "agent",