loki-mode 6.19.0 → 6.20.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Multi-agent autonomous startup system. Triggers on "Loki Mode". Takes PRD to deployed product with minimal human intervention. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v6.19.0
+# Loki Mode v6.20.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -267,4 +267,4 @@ The following features are documented in skill modules but not yet fully automat
 | Quality gates 3-reviewer system | Implemented (v5.35.0) | 5 specialist reviewers in `skills/quality-gates.md`; execution in run.sh |
 | Benchmarks (HumanEval, SWE-bench) | Infrastructure only | Runner scripts and datasets exist in `benchmarks/`; no published results |
 
-**v6.19.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v6.20.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-6.19.0
+6.20.0

package/autonomy/loki

@@ -420,7 +420,7 @@ show_help() {
     echo "  checkpoint|cp    Save/restore session checkpoints"
     echo "  projects         Multi-project registry management"
     echo "  audit [cmd]      Agent audit log and quality scanning (log|scan)"
-    echo "  review [dir]     Run quality gates on any project (standalone, no AI needed)"
+    echo "  review [opts]    Standalone code review with quality gates (diff, staged, PR, files)"
     echo "  optimize         Optimize prompts based on session history"
     echo "  enterprise       Enterprise feature management (tokens, OIDC)"
     echo "  metrics          Prometheus/OpenMetrics metrics from dashboard"
@@ -9205,224 +9205,477 @@ main() {
             ;;
     esac
 }
-
-# Standalone project review - run quality gates on any codebase (v6.14.0)
+# Standalone code review - diff-based quality gates (v6.20.0)
 cmd_review() {
-    local target_dir="."
-    local json_output=""
-    local verbose=""
+    local review_staged=false
+    local review_pr=""
+    local review_since=""
+    local review_target=""
+    local review_format="text"
+    local review_severity="all"
 
     while [[ $# -gt 0 ]]; do
         case "$1" in
-            --json) json_output="true"; shift ;;
-            --verbose|-v) verbose="true"; shift ;;
             --help|-h)
-                echo -e "${BOLD}loki review${NC} - Run quality gates on any project (standalone)"
+                echo -e "${BOLD}loki review${NC} - Standalone code review with quality gates"
                 echo ""
-                echo "Usage: loki review [directory] [options]"
+                echo "Usage: loki review [options] [file-or-dir]"
                 echo ""
-                echo "Arguments:"
-                echo "  directory       Path to project (default: current directory)"
+                echo "Reviews code changes using static analysis, security scanning,"
+                echo "style checks, and anti-pattern detection. No AI needed."
+                echo ""
+                echo "Sources (default: uncommitted changes via git diff):"
+                echo "  --staged             Review staged changes only"
+                echo "  --pr <number>        Review a GitHub PR"
+                echo "  --since <commit>     Review changes since a commit"
+                echo "  <file-or-dir>        Review specific files or directory"
                 echo ""
                 echo "Options:"
-                echo "  --json          Machine-readable JSON output"
-                echo "  --verbose, -v   Show detailed output per gate"
-                echo "  --help, -h      Show this help"
+                echo "  --format json        Output as JSON (for CI integration)"
+                echo "  --severity <level>   Filter: critical, high, medium, low, info (shows level+above)"
+                echo "  --help, -h           Show this help"
                 echo ""
-                echo "Gates: project-type, lint, tests, security, dependencies, structure"
-                echo "Exit code: 0 if all pass, 1 if any fail"
+                echo "Exit codes:"
+                echo "  0  No HIGH or CRITICAL findings"
+                echo "  1  HIGH severity findings present"
+                echo "  2  CRITICAL severity findings present"
+                echo ""
+                echo "Examples:"
+                echo "  loki review                     # Review uncommitted changes"
+                echo "  loki review --staged             # Review staged changes"
+                echo "  loki review --pr 42              # Review GitHub PR #42"
+                echo "  loki review src/                 # Review all files in src/"
+                echo "  loki review --since HEAD~5       # Changes in last 5 commits"
+                echo "  loki review --format json        # JSON output for CI"
+                echo "  loki review --severity high      # Only HIGH+ findings"
                 return 0
                 ;;
+            --staged) review_staged=true; shift ;;
+            --pr)
+                shift
+                review_pr="${1:-}"
+                if [ -z "$review_pr" ]; then
+                    echo -e "${RED}Error: --pr requires a PR number${NC}"
+                    return 1
+                fi
+                shift
+                ;;
+            --since)
+                shift
+                review_since="${1:-}"
+                if [ -z "$review_since" ]; then
+                    echo -e "${RED}Error: --since requires a commit reference${NC}"
+                    return 1
+                fi
+                shift
+                ;;
+            --format)
+                shift
+                review_format="${1:-text}"
+                shift
+                ;;
+            --severity)
+                shift
+                review_severity="${1:-all}"
+                review_severity="$(echo "$review_severity" | tr '[:upper:]' '[:lower:]')"
+                shift
+                ;;
             -*) echo -e "${RED}Unknown option: $1${NC}"; return 1 ;;
-            *) target_dir="$1"; shift ;;
+            *) review_target="$1"; shift ;;
         esac
     done
 
-    # Resolve and validate directory
-    target_dir="$(cd "$target_dir" 2>/dev/null && pwd)" || {
-        echo -e "${RED}Error: Directory not found: $target_dir${NC}"; return 1
-    }
-
-    local project_type="unknown"
-    local results=()  # gate:status pairs
-    local total_pass=0 total_warn=0 total_fail=0
-    local gate_details=()
-
-    # Helper: record gate result
-    _review_gate() {
-        local gate="$1" status="$2" detail="${3:-}"
-        results+=("$gate:$status")
-        gate_details+=("$gate:$detail")
-        case "$status" in
-            PASS) total_pass=$((total_pass + 1)) ;;
-            WARN) total_warn=$((total_warn + 1)) ;;
-            FAIL) total_fail=$((total_fail + 1)) ;;
+    # Severity level ordering (higher number = more severe)
+    _review_sev_level() {
+        case "$1" in
+            INFO) echo 1 ;;
+            LOW) echo 2 ;;
+            MEDIUM) echo 3 ;;
+            HIGH) echo 4 ;;
+            CRITICAL) echo 5 ;;
+            *) echo 0 ;;
         esac
     }
 
-    # Gate 1: Detect project type
-    if [ -f "$target_dir/package.json" ]; then
-        project_type="node"
-    elif [ -f "$target_dir/pyproject.toml" ] || [ -f "$target_dir/setup.py" ] || [ -f "$target_dir/requirements.txt" ]; then
-        project_type="python"
-    elif [ -f "$target_dir/go.mod" ]; then
-        project_type="go"
-    elif [ -f "$target_dir/Cargo.toml" ]; then
-        project_type="rust"
-    fi
-    if [ "$project_type" != "unknown" ]; then
-        _review_gate "project-type" "PASS" "Detected: $project_type"
+    local min_sev=0
+    case "$review_severity" in
+        info) min_sev=1 ;;
+        low) min_sev=2 ;;
+        medium) min_sev=3 ;;
+        high) min_sev=4 ;;
+        critical) min_sev=5 ;;
+        all) min_sev=0 ;;
+    esac
+
+    # Gather code to review
+    local diff_content=""
+    local review_files=""
+    local source_desc=""
+
+    if [ -n "$review_pr" ]; then
+        # PR review via gh CLI
+        if ! command -v gh &>/dev/null; then
+            echo -e "${RED}Error: gh CLI required for PR review. Install: https://cli.github.com${NC}"
+            return 1
+        fi
+        diff_content=$(gh pr diff "$review_pr" 2>&1) || {
+            echo -e "${RED}Error: Could not fetch PR #${review_pr}: $diff_content${NC}"
+            return 1
+        }
+        source_desc="PR #${review_pr}"
+    elif [ -n "$review_since" ]; then
+        diff_content=$(git diff "$review_since" 2>&1) || {
+            echo -e "${RED}Error: Invalid commit reference: $review_since${NC}"
+            return 1
+        }
+        source_desc="changes since $review_since"
+    elif [ -n "$review_target" ]; then
+        # File or directory target - get full contents
+        if [ -d "$review_target" ]; then
+            review_files=$(find "$review_target" -type f \
+                \( -name "*.sh" -o -name "*.bash" -o -name "*.py" -o -name "*.js" -o -name "*.ts" \
+                -o -name "*.jsx" -o -name "*.tsx" -o -name "*.go" -o -name "*.rs" -o -name "*.rb" \
+                -o -name "*.java" -o -name "*.c" -o -name "*.cpp" -o -name "*.h" \) \
+                -not -path "*/node_modules/*" -not -path "*/.git/*" \
+                -not -path "*/vendor/*" -not -path "*/__pycache__/*" \
+                -not -path "*/.venv/*" -not -path "*/target/*" 2>/dev/null)
+            source_desc="directory $review_target"
+        elif [ -f "$review_target" ]; then
+            review_files="$review_target"
+            source_desc="file $review_target"
+        else
+            echo -e "${RED}Error: Not found: $review_target${NC}"
+            return 1
+        fi
+    elif [ "$review_staged" = true ]; then
+        diff_content=$(git diff --cached 2>/dev/null)
+        source_desc="staged changes"
     else
-        _review_gate "project-type" "WARN" "Could not detect project type"
+        diff_content=$(git diff 2>/dev/null)
+        source_desc="uncommitted changes"
     fi
 
-    # Gate 2: Lint check
-    local lint_output="" lint_status="PASS"
-    case "$project_type" in
-        node)
-            if [ -f "$target_dir/.eslintrc.js" ] || [ -f "$target_dir/.eslintrc.json" ] || [ -f "$target_dir/.eslintrc.yml" ] || [ -f "$target_dir/eslint.config.js" ] || [ -f "$target_dir/eslint.config.mjs" ]; then
-                lint_output=$(cd "$target_dir" && npx eslint . --max-warnings=0 2>&1) || lint_status="FAIL"
-            else
-                lint_output="No ESLint config found"; lint_status="WARN"
-            fi ;;
-        python)
-            if command -v ruff &>/dev/null; then
-                lint_output=$(cd "$target_dir" && ruff check . 2>&1) || lint_status="FAIL"
-            elif command -v pylint &>/dev/null; then
-                lint_output=$(cd "$target_dir" && pylint --recursive=y . 2>&1) || lint_status="FAIL"
-            else
-                lint_output="No linter available (install ruff or pylint)"; lint_status="WARN"
-            fi ;;
-        go)
-            if command -v golangci-lint &>/dev/null; then
-                lint_output=$(cd "$target_dir" && golangci-lint run 2>&1) || lint_status="FAIL"
-            else
-                lint_output=$(cd "$target_dir" && go vet ./... 2>&1) || lint_status="FAIL"
-            fi ;;
-        rust)
-            lint_output=$(cd "$target_dir" && cargo clippy -- -D warnings 2>&1) || lint_status="FAIL"
-            ;;
-        *) lint_output="Skipped (unknown project type)"; lint_status="WARN" ;;
-    esac
-    _review_gate "lint" "$lint_status" "$lint_output"
-
-    # Gate 3: Tests
-    local test_output="" test_status="PASS"
-    case "$project_type" in
-        node)
-            if grep -q '"test"' "$target_dir/package.json" 2>/dev/null; then
-                test_output=$(cd "$target_dir" && npm test 2>&1) || test_status="FAIL"
-            else
-                test_output="No test script in package.json"; test_status="WARN"
-            fi ;;
-        python)
-            if command -v pytest &>/dev/null; then
-                test_output=$(cd "$target_dir" && pytest --tb=short 2>&1) || test_status="FAIL"
-            else
-                test_output="pytest not available"; test_status="WARN"
-            fi ;;
-        go) test_output=$(cd "$target_dir" && go test ./... 2>&1) || test_status="FAIL" ;;
-        rust) test_output=$(cd "$target_dir" && cargo test 2>&1) || test_status="FAIL" ;;
-        *) test_output="Skipped (unknown project type)"; test_status="WARN" ;;
-    esac
-    _review_gate "tests" "$test_status" "$test_output"
-
-    # Gate 4: Security - grep for hardcoded secrets
-    local secret_output="" secret_status="PASS"
-    local secret_patterns='(API_KEY|SECRET_KEY|PASSWORD|TOKEN|PRIVATE_KEY)\s*[=:]\s*["\x27][A-Za-z0-9+/=_-]{8,}'
-    secret_output=$(grep -rEn "$secret_patterns" "$target_dir" \
-        --include="*.js" --include="*.ts" --include="*.py" --include="*.go" --include="*.rs" \
-        --include="*.jsx" --include="*.tsx" --include="*.java" --include="*.rb" \
-        --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=vendor \
-        --exclude-dir=__pycache__ --exclude-dir=.venv --exclude-dir=target 2>/dev/null) || true
-    if [ -n "$secret_output" ]; then
-        secret_status="FAIL"
-        secret_output="Potential hardcoded secrets found:
-$secret_output"
-    else
-        secret_output="No hardcoded secrets detected"
+    # Check if there is anything to review
+    if [ -z "$diff_content" ] && [ -z "$review_files" ]; then
+        if [ "$review_format" = "json" ]; then
+            echo '{"source":"'"$source_desc"'","findings":[],"summary":{"critical":0,"high":0,"medium":0,"low":0,"info":0,"total":0},"exit_code":0}'
+        else
+            echo -e "${GREEN}No changes to review ($source_desc).${NC}"
+        fi
+        return 0
     fi
-    _review_gate "security" "$secret_status" "$secret_output"
 
-    # Gate 5: Dependency audit
-    local dep_output="" dep_status="PASS"
-    case "$project_type" in
-        node)
-            if [ -f "$target_dir/package-lock.json" ] || [ -f "$target_dir/yarn.lock" ]; then
-                dep_output=$(cd "$target_dir" && npm audit --production 2>&1) || dep_status="WARN"
-            else
-                dep_output="No lockfile found"; dep_status="WARN"
-            fi ;;
-        python)
-            if command -v pip-audit &>/dev/null; then
-                dep_output=$(cd "$target_dir" && pip-audit 2>&1) || dep_status="WARN"
-            else
-                dep_output="pip-audit not available"; dep_status="WARN"
-            fi ;;
-        *) dep_output="No dependency audit available for $project_type"; dep_status="WARN" ;;
-    esac
-    _review_gate "dependencies" "$dep_status" "$dep_output"
-
-    # Gate 6: Structure check
-    local struct_output="" struct_status="PASS" struct_issues=()
-    [ ! -f "$target_dir/README.md" ] && [ ! -f "$target_dir/README.rst" ] && [ ! -f "$target_dir/README" ] && struct_issues+=("Missing README")
-    local file_count
-    file_count=$(find "$target_dir" -type f -not -path '*/.git/*' -not -path '*/node_modules/*' -not -path '*/vendor/*' -not -path '*/__pycache__/*' -not -path '*/.venv/*' -not -path '*/target/*' 2>/dev/null | wc -l | tr -d ' ')
-    [ "$file_count" -gt 5000 ] && struct_issues+=("Large project: $file_count files")
-    local huge_files
-    huge_files=$(find "$target_dir" -type f -size +1M -not -path '*/.git/*' -not -path '*/node_modules/*' -not -path '*/vendor/*' -not -path '*/target/*' 2>/dev/null | head -5)
-    [ -n "$huge_files" ] && struct_issues+=("Files >1MB found: $(echo "$huge_files" | wc -l | tr -d ' ')")
-    if [ ${#struct_issues[@]} -gt 0 ]; then
-        struct_status="WARN"
-        struct_output=$(printf '%s\n' "${struct_issues[@]}")
+    # Build file content for non-diff reviews
+    local all_content=""
+    if [ -n "$review_files" ]; then
+        while IFS= read -r f; do
+            [ -z "$f" ] && continue
+            all_content+="=== FILE: $f ===
+$(cat "$f" 2>/dev/null)
+"
+        done <<< "$review_files"
     else
-        struct_output="README present, $file_count files, no oversized files"
-    fi
-    _review_gate "structure" "$struct_status" "$struct_output"
-
-    # Output results
-    if [ -n "$json_output" ]; then
-        local gates_json="["
-        local first="true"
-        for r in "${results[@]}"; do
-            local gate="${r%%:*}" status="${r#*:}"
-            [ "$first" = "true" ] && first="" || gates_json+=","
-            gates_json+="{\"gate\":\"$gate\",\"status\":\"$status\"}"
+        all_content="$diff_content"
+    fi
+
+    # Findings array: "file|line|severity|category|finding|suggestion"
+    local findings=()
+    local has_critical=false
+    local has_high=false
+
+    # Helper to add a finding
+    _add_finding() {
+        local file="$1" line="$2" sev="$3" cat="$4" finding="$5" suggestion="$6"
+        local sev_num
+        sev_num=$(_review_sev_level "$sev")
+        if [ "$sev_num" -ge "$min_sev" ]; then
+            findings+=("${file}|${line}|${sev}|${cat}|${finding}|${suggestion}")
+            [ "$sev" = "CRITICAL" ] && has_critical=true || true
+            [ "$sev" = "HIGH" ] && has_high=true || true
+        fi
+    }
+
+    # --- Gate 1: Static Analysis ---
+    # Run shellcheck on shell files if available
+    if command -v shellcheck &>/dev/null; then
+        local shell_files=""
+        if [ -n "$review_files" ]; then
+            shell_files=$(echo "$review_files" | grep -E '\.(sh|bash)$' || true)
+        elif [ -n "$diff_content" ]; then
+            shell_files=$(echo "$diff_content" | grep -E '^\+\+\+ b/' | sed 's|^+++ b/||' | grep -E '\.(sh|bash)$' || true)
+        fi
+        if [ -n "$shell_files" ]; then
+            while IFS= read -r sf; do
+                [ -z "$sf" ] && continue
+                [ ! -f "$sf" ] && continue
+                local sc_out
+                sc_out=$(shellcheck -f gcc "$sf" 2>/dev/null || true)
+                while IFS= read -r sc_line; do
+                    [ -z "$sc_line" ] && continue
+                    local sc_file sc_lineno sc_sev sc_msg
+                    sc_file=$(echo "$sc_line" | cut -d: -f1)
+                    sc_lineno=$(echo "$sc_line" | cut -d: -f2)
+                    sc_sev=$(echo "$sc_line" | sed -n 's/.*: \(warning\|error\|note\|info\):.*/\1/p')
+                    sc_msg=$(echo "$sc_line" | sed 's/.*: \(warning\|error\|note\|info\): //')
+                    local mapped_sev="LOW"
+                    case "$sc_sev" in
+                        error) mapped_sev="HIGH" ;;
+                        warning) mapped_sev="MEDIUM" ;;
+                        *) mapped_sev="LOW" ;;
+                    esac
+                    _add_finding "$sc_file" "$sc_lineno" "$mapped_sev" "static-analysis" "$sc_msg" "Fix shellcheck finding"
+                done <<< "$sc_out"
+            done <<< "$shell_files"
+        fi
+    fi
+
+    # Run eslint if available on JS/TS files
+    if command -v npx &>/dev/null; then
+        local js_files=""
+        if [ -n "$review_files" ]; then
+            js_files=$(echo "$review_files" | grep -E '\.(js|ts|jsx|tsx)$' || true)
+        elif [ -n "$diff_content" ]; then
+            js_files=$(echo "$diff_content" | grep -E '^\+\+\+ b/' | sed 's|^+++ b/||' | grep -E '\.(js|ts|jsx|tsx)$' || true)
+        fi
+        if [ -n "$js_files" ]; then
+            while IFS= read -r jsf; do
+                [ -z "$jsf" ] && continue
+                [ ! -f "$jsf" ] && continue
+                if [ -f ".eslintrc.js" ] || [ -f ".eslintrc.json" ] || [ -f "eslint.config.js" ] || [ -f "eslint.config.mjs" ]; then
+                    local eslint_out
+                    eslint_out=$(npx eslint --format compact "$jsf" 2>/dev/null || true)
+                    while IFS= read -r el; do
+                        [ -z "$el" ] && continue
+                        [[ "$el" == *"problem"* ]] && continue
+                        local el_file el_line el_msg
+                        el_file=$(echo "$el" | cut -d: -f1)
+                        el_line=$(echo "$el" | cut -d: -f2)
+                        el_msg=$(echo "$el" | sed 's/^[^)]*) //')
+                        local el_sev="LOW"
+                        [[ "$el" == *"Error"* ]] && el_sev="MEDIUM"
+                        _add_finding "$el_file" "$el_line" "$el_sev" "static-analysis" "$el_msg" "Fix eslint finding"
+                    done <<< "$eslint_out"
+                fi
+            done <<< "$js_files"
+        fi
+    fi
+
+    # --- Gate 2: Security Scan ---
+    # Helper: scan for a pattern across files or diff content
+    _review_scan() {
+        local pattern="$1" sev="$2" cat="$3" finding="$4" suggestion="$5"
+        if [ -n "$review_files" ]; then
+            # Scan actual files with grep -Hn (file:line:content)
+            local scan_files_arr=()
+            while IFS= read -r sf; do
+                [ -z "$sf" ] && continue
+                [ -f "$sf" ] && scan_files_arr+=("$sf")
+            done <<< "$review_files"
+            [ ${#scan_files_arr[@]} -eq 0 ] && return
+            while IFS= read -r match; do
+                [ -z "$match" ] && continue
+                local mf ml
+                mf=$(echo "$match" | cut -d: -f1)
+                ml=$(echo "$match" | cut -d: -f2)
+                _add_finding "$mf" "$ml" "$sev" "$cat" "$finding" "$suggestion"
+            done < <(grep -HnE "$pattern" "${scan_files_arr[@]}" 2>/dev/null || true)
+        else
+            # Scan diff content (line numbers are from the text blob)
+            while IFS= read -r match; do
+                [ -z "$match" ] && continue
+                local ml
+                ml=$(echo "$match" | cut -d: -f1)
+                _add_finding "diff" "$ml" "$sev" "$cat" "$finding" "$suggestion"
+            done < <(echo "$all_content" | grep -nE "$pattern" 2>/dev/null || true)
+        fi
+    }
+
+    # Hardcoded secrets
+    local secret_patterns=(
+        'API_KEY\s*[=:]\s*["\x27][A-Za-z0-9+/=_-]{8,}'
+        'SECRET_KEY\s*[=:]\s*["\x27][A-Za-z0-9+/=_-]{8,}'
+        'PASSWORD\s*[=:]\s*["\x27][^\x27"]{4,}'
+        'PRIVATE_KEY\s*[=:]\s*["\x27][A-Za-z0-9+/=_-]{8,}'
+        'AWS_ACCESS_KEY_ID\s*[=:]\s*["\x27]AK[A-Z0-9]{18}'
+        'ghp_[A-Za-z0-9]{36}'
+        'sk-[A-Za-z0-9]{32,}'
+        'Bearer\s+[A-Za-z0-9._-]{20,}'
+    )
+    for pattern in "${secret_patterns[@]}"; do
+        _review_scan "$pattern" "CRITICAL" "security" \
+            "Potential hardcoded secret detected" \
+            "Use environment variables or a secrets manager instead"
+    done
+
+    # SQL injection patterns
+    _review_scan '(SELECT|INSERT|UPDATE|DELETE|DROP)\s.*\+\s*(req\.|request\.|params\.|user)' \
+        "HIGH" "security" \
+        "Potential SQL injection: string concatenation in query" \
+        "Use parameterized queries or prepared statements"
+
+    # eval/exec usage
+    _review_scan '(^|\s)(eval|exec)\s*\(' \
+        "HIGH" "security" \
+        "Dangerous eval/exec usage detected" \
+        "Avoid eval/exec with dynamic input; use safer alternatives"
+
+    # Unsafe deserialization
+    _review_scan '(pickle\.loads?|yaml\.load\s*\()' \
+        "HIGH" "security" \
+        "Unsafe deserialization detected (pickle/yaml.load)" \
+        "Use yaml.safe_load or avoid pickle with untrusted data"
+
+    # --- Gate 3: Code Style ---
+    # Long functions (>100 lines heuristic from diff)
+    if [ -n "$review_files" ]; then
+        while IFS= read -r f; do
+            [ -z "$f" ] && continue
+            [ ! -f "$f" ] && continue
+            local line_count
+            line_count=$(wc -l < "$f" | tr -d ' ')
+            if [ "$line_count" -gt 500 ]; then
+                _add_finding "$f" "1" "MEDIUM" "style" \
+                    "File has $line_count lines (>500)" \
+                    "Consider breaking into smaller modules"
+            fi
+            # Check for very long lines
+            local long_lines
+            long_lines=$(awk 'length > 200 {count++} END {print count+0}' "$f" 2>/dev/null)
+            if [ "$long_lines" -gt 5 ]; then
+                _add_finding "$f" "1" "LOW" "style" \
+                    "$long_lines lines exceed 200 characters" \
+                    "Break long lines for readability"
+            fi
+        done <<< "$review_files"
+    fi
+
+    # TODO/FIXME/HACK/XXX detection
+    _review_scan '(TODO|FIXME|HACK|XXX):' "INFO" "style" \
+        "TODO/FIXME/HACK/XXX comment marker found" \
+        "Track in issue tracker instead of code comments"
+
+    # --- Gate 4: Anti-pattern Detection ---
+    # console.log left in code (JS/TS)
+    _review_scan 'console\.(log|debug|warn)\(' "LOW" "anti-pattern" \
+        "console.log statement (debug artifact?)" \
+        "Remove debug logging or use a proper logger"
+
+    # Catch bare except in Python
+    _review_scan 'except\s*:' "MEDIUM" "anti-pattern" \
+        "Bare except clause catches all exceptions" \
+        "Catch specific exceptions (e.g., except ValueError)"
+
+    # Disabled SSL verification
+    _review_scan '(verify\s*=\s*False|VERIFY_SSL\s*=\s*False|NODE_TLS_REJECT_UNAUTHORIZED.*0|rejectUnauthorized.*false)' \
+        "HIGH" "anti-pattern" \
+        "SSL verification disabled" \
+        "Enable SSL verification in production"
+
+    # Hardcoded IP addresses (skip localhost/0.0.0.0/version patterns)
+    _review_scan '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' \
+        "LOW" "anti-pattern" \
+        "Hardcoded IP address detected" \
+        "Use configuration or DNS names instead"
+
+    # --- Tally results ---
+    local count_critical=0 count_high=0 count_medium=0 count_low=0 count_info=0
+    for f in "${findings[@]}"; do
+        local sev
+        sev=$(echo "$f" | cut -d'|' -f3)
+        case "$sev" in
+            CRITICAL) count_critical=$((count_critical + 1)) ;;
+            HIGH) count_high=$((count_high + 1)) ;;
+            MEDIUM) count_medium=$((count_medium + 1)) ;;
+            LOW) count_low=$((count_low + 1)) ;;
+            INFO) count_info=$((count_info + 1)) ;;
+        esac
+    done
+    local count_total=${#findings[@]}
+
+    # Determine exit code
+    local exit_code=0
+    [ "$has_high" = true ] && exit_code=1 || true
+    [ "$has_critical" = true ] && exit_code=2 || true
+
+    # --- Output ---
+    if [ "$review_format" = "json" ]; then
+        local json_findings="["
+        local first=true
+        for f in "${findings[@]}"; do
+            local f_file f_line f_sev f_cat f_finding f_suggestion
+            f_file=$(echo "$f" | cut -d'|' -f1)
+            f_line=$(echo "$f" | cut -d'|' -f2)
+            f_sev=$(echo "$f" | cut -d'|' -f3)
+            f_cat=$(echo "$f" | cut -d'|' -f4)
+            f_finding=$(echo "$f" | cut -d'|' -f5)
+            f_suggestion=$(echo "$f" | cut -d'|' -f6)
+            # Escape quotes for JSON
+            f_finding=$(echo "$f_finding" | sed 's/"/\\"/g')
+            f_suggestion=$(echo "$f_suggestion" | sed 's/"/\\"/g')
+            f_file=$(echo "$f_file" | sed 's/"/\\"/g')
+            [ "$first" = true ] && first=false || json_findings+=","
+            json_findings+="{\"file\":\"$f_file\",\"line\":$f_line,\"severity\":\"$f_sev\",\"category\":\"$f_cat\",\"finding\":\"$f_finding\",\"suggestion\":\"$f_suggestion\"}"
         done
-        gates_json+="]"
-        printf '{"directory":"%s","project_type":"%s","pass":%d,"warn":%d,"fail":%d,"gates":%s}\n' \
-            "$target_dir" "$project_type" "$total_pass" "$total_warn" "$total_fail" "$gates_json"
+        json_findings+="]"
+        printf '{"source":"%s","findings":%s,"summary":{"critical":%d,"high":%d,"medium":%d,"low":%d,"info":%d,"total":%d},"exit_code":%d}\n' \
+            "$source_desc" "$json_findings" "$count_critical" "$count_high" "$count_medium" "$count_low" "$count_info" "$count_total" "$exit_code"
     else
-        echo -e "${BOLD}Loki Review: $target_dir${NC}"
-        echo -e "Project type: ${CYAN}$project_type${NC}"
+        echo -e "${BOLD}Loki Code Review${NC}"
+        echo -e "Source: ${CYAN}$source_desc${NC}"
         echo "---"
-        for r in "${results[@]}"; do
-            local gate="${r%%:*}" status="${r#*:}"
-            case "$status" in
-                PASS) echo -e "  ${GREEN}[PASS]${NC} $gate" ;;
-                WARN) echo -e "  ${YELLOW}[WARN]${NC} $gate" ;;
-                FAIL) echo -e "  ${RED}[FAIL]${NC} $gate" ;;
-            esac
-        done
-        echo "---"
-        echo -e "Results: ${GREEN}$total_pass passed${NC}, ${YELLOW}$total_warn warnings${NC}, ${RED}$total_fail failed${NC}"
 
-        if [ -n "$verbose" ]; then
-            echo ""
-            echo -e "${BOLD}Details:${NC}"
-            for d in "${gate_details[@]}"; do
-                local gate="${d%%:*}" detail="${d#*:}"
-                echo -e "\n${CYAN}[$gate]${NC}"
-                echo "$detail" | head -30
+        if [ "$count_total" -eq 0 ]; then
+            echo -e "${GREEN}No findings. Code looks clean.${NC}"
+        else
+            # Group by severity
+            for sev_name in CRITICAL HIGH MEDIUM LOW INFO; do
+                local printed_header=false
+                for f in "${findings[@]}"; do
+                    local f_sev
+                    f_sev=$(echo "$f" | cut -d'|' -f3)
+                    [ "$f_sev" != "$sev_name" ] && continue
+                    if [ "$printed_header" = false ]; then
+                        local sev_color="$NC"
+                        case "$sev_name" in
+                            CRITICAL) sev_color="$RED" ;;
+                            HIGH) sev_color="$RED" ;;
+                            MEDIUM) sev_color="$YELLOW" ;;
+                            LOW) sev_color="$CYAN" ;;
+                            INFO) sev_color="$DIM" ;;
+                        esac
+                        echo ""
+                        echo -e "${sev_color}${BOLD}[$sev_name]${NC}"
+                        printed_header=true
+                    fi
+                    local f_file f_line f_cat f_finding f_suggestion
+                    f_file=$(echo "$f" | cut -d'|' -f1)
+                    f_line=$(echo "$f" | cut -d'|' -f2)
+                    f_cat=$(echo "$f" | cut -d'|' -f4)
+                    f_finding=$(echo "$f" | cut -d'|' -f5)
+                    f_suggestion=$(echo "$f" | cut -d'|' -f6)
+                    echo -e "  ${DIM}$f_file:$f_line${NC} [$f_cat] $f_finding"
+                    echo -e "    -> $f_suggestion"
+                done
             done
         fi
+
+        echo ""
+        echo "---"
+        echo -e "Summary: ${RED}$count_critical critical${NC}, ${RED}$count_high high${NC}, ${YELLOW}$count_medium medium${NC}, ${CYAN}$count_low low${NC}, ${DIM}$count_info info${NC} ($count_total total)"
+
+        if [ "$exit_code" -eq 2 ]; then
+            echo -e "${RED}CRITICAL findings detected. Review required.${NC}"
+        elif [ "$exit_code" -eq 1 ]; then
+            echo -e "${RED}HIGH severity findings detected.${NC}"
+        else
+            echo -e "${GREEN}No HIGH or CRITICAL findings.${NC}"
+        fi
     fi
 
-    # Exit code: 1 if any failures
-    [ "$total_fail" -gt 0 ] && return 1
-    return 0
+    return "$exit_code"
 }
 
+
 # Worktree management (v6.7.0)
 cmd_worktree() {
     local subcommand="${1:-list}"

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "6.19.0"
+__version__ = "6.20.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Complete installation instructions for all platforms and use cases.
 
-**Version:** v6.19.0
+**Version:** v6.20.0
 
 ---
 

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '6.19.0'
+__version__ = '6.20.0'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loki-mode",
-  "version": "6.19.0",
+  "version": "6.20.0",
   "description": "Loki Mode by Autonomi - Multi-agent autonomous startup system for Claude Code, Codex CLI, and Gemini CLI",
   "keywords": [
     "agent",