loki-mode 6.26.1 → 6.26.3

package/README.md

@@ -8,8 +8,13 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Agent Types](https://img.shields.io/badge/Agent%20Types-41-blue)]()
 [![Autonomi](https://img.shields.io/badge/Autonomi-autonomi.dev-5B4EEA)](https://www.autonomi.dev/)
+[![Docker Pulls](https://img.shields.io/docker/pulls/asklokesh/loki-mode)](https://hub.docker.com/r/asklokesh/loki-mode)
 
-**Current Version: v6.22.0**
+**Current Version: v6.26.2**
+
+### Traction
+
+**737 stars** | **150 forks** | **10,200+ Docker pulls** | **18,000+ npm downloads** | **571+ commits** | **12 releases in a single day (March 18, 2026)**
 
 ---
 
@@ -133,6 +138,9 @@ See [full architecture documentation](docs/enterprise/architecture.md) for the d
 | **Enterprise** | TLS, OIDC/SSO, RBAC, OTEL, policy engine, audit trails | [Enterprise Guide](docs/enterprise/architecture.md) |
 | **Integrations** | Jira, Slack, Teams, GitHub Actions (Linear: partial) | [Integration Cookbook](docs/enterprise/integration-cookbook.md) |
 | **Deployment** | Helm, Docker Compose, Terraform configs (AWS/Azure/GCP) | [Deployment Guide](deploy/helm/README.md) |
+| **Web App** | Replit-like UI with 10 React components, PRD input, agent dashboard, file browser, memory viewer | [Dashboard Guide](docs/dashboard-guide.md) |
+| **Cost Estimation** | Pre-execution analysis with complexity scoring, token/cost projection | [Memory System](references/memory-system.md) |
+| **Auto-Failover** | Cross-provider failover (Claude -> Codex -> Gemini) when rate limited | [Provider Guide](skills/providers.md) |
 | **SDKs** | Python (`loki-mode-sdk`), TypeScript (`loki-mode-sdk`) | [SDK Guide](docs/enterprise/sdk-guide.md) |
 
 ### Multi-Provider Support
@@ -162,6 +170,13 @@ Claude gets full features (subagents, parallelization, MCP, Task tool). All othe
 | `loki import` | Import GitHub issues as tasks |
 | `loki memory <cmd>` | Memory system CLI (index, timeline, search, consolidate) |
 | `loki enterprise` | Enterprise feature management (tokens, OIDC) |
+| `loki plan [PRD]` | Pre-execution analysis: complexity scoring, cost estimation, iteration prediction |
+| `loki review [--staged\|--diff]` | AI-powered code review with 4 quality gates, severity filtering, CI output |
+| `loki onboard [path]` | Instant project analysis and CLAUDE.md generation (12+ config types, 3 depth levels) |
+| `loki ci` | CI/CD quality gate integration (GitHub Actions, GitLab CI, Jenkins, CircleCI) |
+| `loki test [--file\|--dir\|--changed]` | AI-powered test generation (8 languages, 9 frameworks) |
+| `loki failover [status\|--enable\|--chain]` | Cross-provider auto-failover when primary hits rate limits |
+| `loki web` | Launch the web app (Replit-like UI for visual PRD-to-code workflow) |
 | `loki version` | Show version |
 
 Run `loki --help` for all commands. Full reference: [CLI Reference](wiki/CLI-Reference.md) | Configuration: [config.example.yaml](autonomy/config.example.yaml)

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Multi-agent autonomous startup system. Triggers on "Loki Mode". Takes PRD to deployed product with minimal human intervention. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v6.26.1
+# Loki Mode v6.26.3
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -267,4 +267,4 @@ The following features are documented in skill modules but not yet fully automat
 | Quality gates 3-reviewer system | Implemented (v5.35.0) | 5 specialist reviewers in `skills/quality-gates.md`; execution in run.sh |
 | Benchmarks (HumanEval, SWE-bench) | Infrastructure only | Runner scripts and datasets exist in `benchmarks/`; no published results |
 
-**v6.26.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v6.26.3 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-6.26.1
+6.26.3

package/autonomy/run.sh

@@ -9347,7 +9347,6 @@ cleanup() {
         if type app_runner_cleanup &>/dev/null; then
             app_runner_cleanup
         fi
-        stop_dashboard
         stop_status_monitor
         kill_all_registered
         rm -f "$loki_dir/loki.pid" 2>/dev/null
@@ -9379,7 +9378,6 @@ except (json.JSONDecodeError, OSError): pass
         if type app_runner_cleanup &>/dev/null; then
             app_runner_cleanup
         fi
-        stop_dashboard
         stop_status_monitor
         kill_all_registered
         rm -f "$loki_dir/loki.pid" "$loki_dir/PAUSE" 2>/dev/null
@@ -9974,7 +9972,6 @@ main() {
     if type app_runner_cleanup &>/dev/null; then
         app_runner_cleanup
     fi
-    stop_dashboard
     stop_status_monitor
     local loki_dir="${TARGET_DIR:-.}/.loki"
     rm -f "$loki_dir/loki.pid" 2>/dev/null

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "6.26.1"
+__version__ = "6.26.3"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -286,43 +286,6 @@ manager = ConnectionManager()
 start_time = datetime.now(timezone.utc)
 
 
-async def _orphan_watchdog():
-    """Background task that shuts down dashboard if the parent session dies.
-
-    When the session process is killed (SIGKILL), the cleanup trap never runs
-    and the dashboard is left orphaned. This watchdog checks the session PID
-    every 30 seconds and initiates shutdown if the session is gone.
-    """
-    loki_dir = _get_loki_dir()
-    pid_file = loki_dir / "loki.pid"
-    # Wait 60s before first check to let session fully start
-    await asyncio.sleep(60)
-    while True:
-        try:
-            if pid_file.exists():
-                pid = int(pid_file.read_text().strip())
-                try:
-                    os.kill(pid, 0)  # Check if process exists
-                except OSError:
-                    # Session PID is dead -- we're orphaned
-                    logger.warning(
-                        "Session PID %d is gone. Dashboard shutting down to avoid orphan.", pid
-                    )
-                    # Clean up our own PID file
-                    dash_pid = loki_dir / "dashboard" / "dashboard.pid"
-                    dash_pid.unlink(missing_ok=True)
-                    # Give a moment for any in-flight requests
-                    await asyncio.sleep(2)
-                    os._exit(0)
-            # If PID file doesn't exist and we've been running >2 min, also shut down
-            elif time.time() - _dashboard_start_time > 120:
-                logger.warning("No session PID file found. Dashboard shutting down.")
-                os._exit(0)
-        except (ValueError, OSError):
-            pass
-        await asyncio.sleep(30)
-
-
 _dashboard_start_time = time.time()
 
 
@@ -332,11 +295,8 @@ async def lifespan(app: FastAPI):
     # Startup
     await init_db()
     _telemetry.send_telemetry("dashboard_start")
-    # Start orphan watchdog
-    watchdog_task = asyncio.create_task(_orphan_watchdog())
     yield
     # Shutdown
-    watchdog_task.cancel()
     await close_db()
 
 
@@ -436,6 +396,26 @@ async def get_status() -> StatusResponse:
     loki_dir = _get_loki_dir()
     uptime = (datetime.now(timezone.utc) - start_time).total_seconds()
 
+    # Read VERSION file early (independent of .loki/ dir)
+    version = "unknown"
+    dashboard_dir = os.path.dirname(__file__)
+    project_root = os.path.dirname(dashboard_dir)
+    version_file = os.path.join(project_root, "VERSION")
+    if os.path.isfile(version_file):
+        try:
+            with open(version_file) as vf:
+                version = vf.read().strip()
+        except (OSError, IOError) as e:
+            logger.warning(f"Failed to read VERSION file: {e}")
+
+    # If .loki/ directory doesn't exist, return idle status immediately
+    if not loki_dir.is_dir():
+        return StatusResponse(
+            status="idle",
+            version=version,
+            uptime_seconds=uptime,
+        )
+
     # Read dashboard-state.json (written by run.sh every 2 seconds)
     state_file = loki_dir / "dashboard-state.json"
     pid_file = loki_dir / "loki.pid"
@@ -450,18 +430,6 @@ async def get_status() -> StatusResponse:
     current_task = ""
     pending_tasks = 0
     running_agents = 0
-    version = "unknown"
-
-    # Read VERSION file
-    dashboard_dir = os.path.dirname(__file__)
-    project_root = os.path.dirname(dashboard_dir)
-    version_file = os.path.join(project_root, "VERSION")
-    if os.path.isfile(version_file):
-        try:
-            with open(version_file) as vf:
-                version = vf.read().strip()
-        except (OSError, IOError) as e:
-            logger.warning(f"Failed to read VERSION file: {e}")
 
     # Read dashboard state
     if state_file.exists():
@@ -4825,8 +4793,12 @@ def start_migration_phase(migration_id: str, request_body: dict):
 async def serve_spa_catchall(full_path: str):
     """Serve static files or fall back to index.html for SPA routing."""
     if STATIC_DIR:
+        static_root = os.path.realpath(STATIC_DIR)
         # Try to serve the exact file first (e.g. /vite.svg, /manifest.json)
-        candidate = os.path.join(STATIC_DIR, full_path)
+        # Use realpath to prevent path traversal attacks
+        candidate = os.path.realpath(os.path.join(STATIC_DIR, full_path))
+        if not candidate.startswith(static_root + os.sep) and candidate != static_root:
+            return Response(status_code=404)
         if os.path.isfile(candidate):
             return FileResponse(candidate)
         # Fall back to index.html for client-side routes

package/dashboard/static/index.html

@@ -5297,8 +5297,8 @@ var LokiDashboard=(()=>{var pt=Object.defineProperty;var Pt=Object.getOwnPropert
         </div>
       `}).join(""):'<div class="item" style="color:var(--loki-text-muted)">No items</div>'}_renderEmpty(){return`
       <div class="empty-state">
-        <p>Checklist not initialized</p>
-        <p class="hint">The PRD checklist will be created during the first iteration when a PRD is provided.</p>
+        <p><strong>No checklist data yet.</strong></p>
+        <p class="hint">The PRD checklist is generated during the first iteration. Start a session with <code>loki start ./prd.md</code> -- groups and items will appear here as the session progresses and can be expanded for details.</p>
       </div>
     `}_attachEventListeners(){let t=this.shadowRoot;t&&(t.querySelectorAll(".category-header[data-category]").forEach(e=>{e.addEventListener("click",()=>this._toggleCategory(e.dataset.category))}),t.querySelectorAll("button[data-waive-id]").forEach(e=>{e.addEventListener("click",i=>{i.stopPropagation(),this._waiveItem(e.dataset.waiveId)})}),t.querySelectorAll("button[data-unwaive-id]").forEach(e=>{e.addEventListener("click",i=>{i.stopPropagation(),this._unwaiveItem(e.dataset.unwaiveId)})}))}_escapeHtml(t){return t?String(t).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;"):""}};customElements.define("loki-checklist-viewer",K);var St={not_initialized:{color:"var(--loki-text-muted, #71717a)",label:"Not Started",pulse:!1},starting:{color:"var(--loki-yellow, #ca8a04)",label:"Starting...",pulse:!0},running:{color:"var(--loki-green, #16a34a)",label:"Running",pulse:!0},stale:{color:"var(--loki-yellow, #ca8a04)",label:"Stale",pulse:!1},completed:{color:"var(--loki-text-muted, #a1a1aa)",label:"Completed",pulse:!1},failed:{color:"var(--loki-red, #dc2626)",label:"Failed",pulse:!1},crashed:{color:"var(--loki-red, #dc2626)",label:"Crashed",pulse:!1},stopped:{color:"var(--loki-text-muted, #a1a1aa)",label:"Stopped",pulse:!1},unknown:{color:"var(--loki-text-muted, #71717a)",label:"Unknown",pulse:!1}},V=class extends h{static get observedAttributes(){return["api-url","theme"]}constructor(){super(),this._loading=!1,this._error=null,this._api=null,this._pollInterval=null,this._status=null,this._logs=[],this._lastDataHash=null,this._lastLogsHash=null}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadData(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling()}attributeChangedCallback(t,e,i){e!==i&&(t==="api-url"&&this._api&&(this._api.baseUrl=i,this._loadData()),t==="theme"&&this._applyTheme())}_setupApi(){let t=this.getAttribute("api-url")||window.location.origin;this._api=g({baseUrl:t})}_startPolling(){this._pollInterval=setInterval(()=>this._loadData(),3e3),this._visibilityHandler=()=>{document.hidden?this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null):this._pollInterval||(this._loadData(),this._pollInterval=setInterval(()=>this._loadData(),3e3))},document.addEventListener("visibilitychange",this._visibilityHandler)}_stopPolling(){this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null),this._visibilityHandler&&(document.removeEventListener("visibilitychange",this._visibilityHandler),this._visibilityHandler=null)}async _loadData(){try{let[t,e]=await Promise.all([this._api.getAppRunnerStatus(),this._api.getAppRunnerLogs()]),i=JSON.stringify({status:t?.status,port:t?.port,restarts:t?.restart_count,url:t?.url}),a=JSON.stringify(e?.lines?.slice(-5)||[]),s=a!==this._lastLogsHash;if(i===this._lastDataHash&&!s)return;this._lastDataHash=i,this._lastLogsHash=a,this._status=t,this._logs=e?.lines||[],this._error=null,this.render(),this._scrollLogsToBottom()}catch(t){this._error||(this._error=`Failed to load app status: ${t.message}`,this.render())}}_scrollLogsToBottom(){let t=this.shadowRoot;if(!t)return;let e=t.querySelector(".log-area");e&&(e.scrollTop=e.scrollHeight)}async _handleRestart(){try{await this._api.restartApp(),this._loadData()}catch(t){this._error=`Restart failed: ${t.message}`,this.render()}}async _handleStop(){try{await this._api.stopApp(),this._loadData()}catch(t){this._error=`Stop failed: ${t.message}`,this.render()}}_formatUptime(t){if(!t)return"--";let e=new Date(t),a=Math.floor((new Date-e)/1e3);if(a<60)return`${a}s`;if(a<3600)return`${Math.floor(a/60)}m ${a%60}s`;let s=Math.floor(a/3600),r=Math.floor(a%3600/60);return`${s}h ${r}m`}_isValidUrl(t){if(!t)return!1;try{let e=new URL(t);return e.protocol==="http:"||e.protocol==="https:"}catch{return!1}}_getStyles(){return`
       .app-status {
@@ -8991,7 +8991,7 @@ var LokiDashboard=(()=>{var pt=Object.defineProperty;var Pt=Object.getOwnPropert
         color: var(--loki-text-muted, #939084);
         font-size: 13px;
       }
-    `}render(){let t=this.shadowRoot;if(!t)return;let e=this._gates,i=ee(e),a;this._loading&&e.length===0?a='<div class="loading">Loading quality gates...</div>':e.length===0?a='<div class="empty-state">Quality gates will activate during code review phases. Gates are evaluated after each RARV iteration.</div>':a=`<div class="gates-grid">${e.map(o=>{let n=(o.status||"pending").toLowerCase(),l=Lt[n]||Lt.pending;return`
+    `}render(){let t=this.shadowRoot;if(!t)return;let e=this._gates,i=ee(e),a;this._loading&&e.length===0?a='<div class="loading">Loading quality gates...</div>':e.length===0?a='<div class="empty-state"><strong>No gate results yet.</strong> Quality gates run automatically between RARV iterations during an active session. Start a session with <code>loki start ./prd.md</code> to see results here. You can also run gates manually with <code>loki review</code>.</div>':a=`<div class="gates-grid">${e.map(o=>{let n=(o.status||"pending").toLowerCase(),l=Lt[n]||Lt.pending;return`
           <div class="gate-card status-${n}">
             <div class="gate-header">
               <span class="gate-name">${this._escapeHtml(o.name||"Unnamed Gate")}</span>

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Complete installation instructions for all platforms and use cases.
 
-**Version:** v6.26.1
+**Version:** v6.26.3
 
 ---
 

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '6.26.1'
+__version__ = '6.26.2'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loki-mode",
-  "version": "6.26.1",
+  "version": "6.26.3",
   "description": "Loki Mode by Autonomi - Multi-agent autonomous startup system for Claude Code, Codex CLI, and Gemini CLI",
   "keywords": [
     "agent",