loki-mode 6.26.2 → 6.26.4

package/README.md

@@ -8,8 +8,13 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Agent Types](https://img.shields.io/badge/Agent%20Types-41-blue)]()
 [![Autonomi](https://img.shields.io/badge/Autonomi-autonomi.dev-5B4EEA)](https://www.autonomi.dev/)
+[![Docker Pulls](https://img.shields.io/docker/pulls/asklokesh/loki-mode)](https://hub.docker.com/r/asklokesh/loki-mode)
 
-**Current Version: v6.22.0**
+**Current Version: v6.26.2**
+
+### Traction
+
+**737 stars** | **150 forks** | **10,200+ Docker pulls** | **18,000+ npm downloads** | **571+ commits** | **12 releases in a single day (March 18, 2026)**
 
 ---
 
@@ -133,6 +138,9 @@ See [full architecture documentation](docs/enterprise/architecture.md) for the d
 | **Enterprise** | TLS, OIDC/SSO, RBAC, OTEL, policy engine, audit trails | [Enterprise Guide](docs/enterprise/architecture.md) |
 | **Integrations** | Jira, Slack, Teams, GitHub Actions (Linear: partial) | [Integration Cookbook](docs/enterprise/integration-cookbook.md) |
 | **Deployment** | Helm, Docker Compose, Terraform configs (AWS/Azure/GCP) | [Deployment Guide](deploy/helm/README.md) |
+| **Web App** | Replit-like UI with 10 React components, PRD input, agent dashboard, file browser, memory viewer | [Dashboard Guide](docs/dashboard-guide.md) |
+| **Cost Estimation** | Pre-execution analysis with complexity scoring, token/cost projection | [Memory System](references/memory-system.md) |
+| **Auto-Failover** | Cross-provider failover (Claude -> Codex -> Gemini) when rate limited | [Provider Guide](skills/providers.md) |
 | **SDKs** | Python (`loki-mode-sdk`), TypeScript (`loki-mode-sdk`) | [SDK Guide](docs/enterprise/sdk-guide.md) |
 
 ### Multi-Provider Support
@@ -162,6 +170,13 @@ Claude gets full features (subagents, parallelization, MCP, Task tool). All othe
 | `loki import` | Import GitHub issues as tasks |
 | `loki memory <cmd>` | Memory system CLI (index, timeline, search, consolidate) |
 | `loki enterprise` | Enterprise feature management (tokens, OIDC) |
+| `loki plan [PRD]` | Pre-execution analysis: complexity scoring, cost estimation, iteration prediction |
+| `loki review [--staged\|--diff]` | AI-powered code review with 4 quality gates, severity filtering, CI output |
+| `loki onboard [path]` | Instant project analysis and CLAUDE.md generation (12+ config types, 3 depth levels) |
+| `loki ci` | CI/CD quality gate integration (GitHub Actions, GitLab CI, Jenkins, CircleCI) |
+| `loki test [--file\|--dir\|--changed]` | AI-powered test generation (8 languages, 9 frameworks) |
+| `loki failover [status\|--enable\|--chain]` | Cross-provider auto-failover when primary hits rate limits |
+| `loki web` | Launch the web app (Replit-like UI for visual PRD-to-code workflow) |
 | `loki version` | Show version |
 
 Run `loki --help` for all commands. Full reference: [CLI Reference](wiki/CLI-Reference.md) | Configuration: [config.example.yaml](autonomy/config.example.yaml)

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Multi-agent autonomous startup system. Triggers on "Loki Mode". Takes PRD to deployed product with minimal human intervention. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v6.26.2
+# Loki Mode v6.26.4
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -267,4 +267,4 @@ The following features are documented in skill modules but not yet fully automat
 | Quality gates 3-reviewer system | Implemented (v5.35.0) | 5 specialist reviewers in `skills/quality-gates.md`; execution in run.sh |
 | Benchmarks (HumanEval, SWE-bench) | Infrastructure only | Runner scripts and datasets exist in `benchmarks/`; no published results |
 
-**v6.26.2 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v6.26.4 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-6.26.2
+6.26.4

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "6.26.2"
+__version__ = "6.26.4"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -4793,8 +4793,12 @@ def start_migration_phase(migration_id: str, request_body: dict):
 async def serve_spa_catchall(full_path: str):
     """Serve static files or fall back to index.html for SPA routing."""
     if STATIC_DIR:
+        static_root = os.path.realpath(STATIC_DIR)
         # Try to serve the exact file first (e.g. /vite.svg, /manifest.json)
-        candidate = os.path.join(STATIC_DIR, full_path)
+        # Use realpath to prevent path traversal attacks
+        candidate = os.path.realpath(os.path.join(STATIC_DIR, full_path))
+        if not candidate.startswith(static_root + os.sep) and candidate != static_root:
+            return Response(status_code=404)
         if os.path.isfile(candidate):
             return FileResponse(candidate)
         # Fall back to index.html for client-side routes

package/dashboard/static/index.html

@@ -5297,8 +5297,8 @@ var LokiDashboard=(()=>{var pt=Object.defineProperty;var Pt=Object.getOwnPropert
         </div>
       `}).join(""):'<div class="item" style="color:var(--loki-text-muted)">No items</div>'}_renderEmpty(){return`
       <div class="empty-state">
-        <p>Checklist not initialized</p>
-        <p class="hint">The PRD checklist will be created during the first iteration when a PRD is provided.</p>
+        <p><strong>No checklist data yet.</strong></p>
+        <p class="hint">The PRD checklist is generated during the first iteration. Start a session with <code>loki start ./prd.md</code> -- groups and items will appear here as the session progresses and can be expanded for details.</p>
       </div>
     `}_attachEventListeners(){let t=this.shadowRoot;t&&(t.querySelectorAll(".category-header[data-category]").forEach(e=>{e.addEventListener("click",()=>this._toggleCategory(e.dataset.category))}),t.querySelectorAll("button[data-waive-id]").forEach(e=>{e.addEventListener("click",i=>{i.stopPropagation(),this._waiveItem(e.dataset.waiveId)})}),t.querySelectorAll("button[data-unwaive-id]").forEach(e=>{e.addEventListener("click",i=>{i.stopPropagation(),this._unwaiveItem(e.dataset.unwaiveId)})}))}_escapeHtml(t){return t?String(t).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;"):""}};customElements.define("loki-checklist-viewer",K);var St={not_initialized:{color:"var(--loki-text-muted, #71717a)",label:"Not Started",pulse:!1},starting:{color:"var(--loki-yellow, #ca8a04)",label:"Starting...",pulse:!0},running:{color:"var(--loki-green, #16a34a)",label:"Running",pulse:!0},stale:{color:"var(--loki-yellow, #ca8a04)",label:"Stale",pulse:!1},completed:{color:"var(--loki-text-muted, #a1a1aa)",label:"Completed",pulse:!1},failed:{color:"var(--loki-red, #dc2626)",label:"Failed",pulse:!1},crashed:{color:"var(--loki-red, #dc2626)",label:"Crashed",pulse:!1},stopped:{color:"var(--loki-text-muted, #a1a1aa)",label:"Stopped",pulse:!1},unknown:{color:"var(--loki-text-muted, #71717a)",label:"Unknown",pulse:!1}},V=class extends h{static get observedAttributes(){return["api-url","theme"]}constructor(){super(),this._loading=!1,this._error=null,this._api=null,this._pollInterval=null,this._status=null,this._logs=[],this._lastDataHash=null,this._lastLogsHash=null}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadData(),this._startPolling()}disconnectedCallback(){super.disconnectedCallback(),this._stopPolling()}attributeChangedCallback(t,e,i){e!==i&&(t==="api-url"&&this._api&&(this._api.baseUrl=i,this._loadData()),t==="theme"&&this._applyTheme())}_setupApi(){let t=this.getAttribute("api-url")||window.location.origin;this._api=g({baseUrl:t})}_startPolling(){this._pollInterval=setInterval(()=>this._loadData(),3e3),this._visibilityHandler=()=>{document.hidden?this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null):this._pollInterval||(this._loadData(),this._pollInterval=setInterval(()=>this._loadData(),3e3))},document.addEventListener("visibilitychange",this._visibilityHandler)}_stopPolling(){this._pollInterval&&(clearInterval(this._pollInterval),this._pollInterval=null),this._visibilityHandler&&(document.removeEventListener("visibilitychange",this._visibilityHandler),this._visibilityHandler=null)}async _loadData(){try{let[t,e]=await Promise.all([this._api.getAppRunnerStatus(),this._api.getAppRunnerLogs()]),i=JSON.stringify({status:t?.status,port:t?.port,restarts:t?.restart_count,url:t?.url}),a=JSON.stringify(e?.lines?.slice(-5)||[]),s=a!==this._lastLogsHash;if(i===this._lastDataHash&&!s)return;this._lastDataHash=i,this._lastLogsHash=a,this._status=t,this._logs=e?.lines||[],this._error=null,this.render(),this._scrollLogsToBottom()}catch(t){this._error||(this._error=`Failed to load app status: ${t.message}`,this.render())}}_scrollLogsToBottom(){let t=this.shadowRoot;if(!t)return;let e=t.querySelector(".log-area");e&&(e.scrollTop=e.scrollHeight)}async _handleRestart(){try{await this._api.restartApp(),this._loadData()}catch(t){this._error=`Restart failed: ${t.message}`,this.render()}}async _handleStop(){try{await this._api.stopApp(),this._loadData()}catch(t){this._error=`Stop failed: ${t.message}`,this.render()}}_formatUptime(t){if(!t)return"--";let e=new Date(t),a=Math.floor((new Date-e)/1e3);if(a<60)return`${a}s`;if(a<3600)return`${Math.floor(a/60)}m ${a%60}s`;let s=Math.floor(a/3600),r=Math.floor(a%3600/60);return`${s}h ${r}m`}_isValidUrl(t){if(!t)return!1;try{let e=new URL(t);return e.protocol==="http:"||e.protocol==="https:"}catch{return!1}}_getStyles(){return`
       .app-status {
@@ -8991,7 +8991,7 @@ var LokiDashboard=(()=>{var pt=Object.defineProperty;var Pt=Object.getOwnPropert
         color: var(--loki-text-muted, #939084);
         font-size: 13px;
       }
-    `}render(){let t=this.shadowRoot;if(!t)return;let e=this._gates,i=ee(e),a;this._loading&&e.length===0?a='<div class="loading">Loading quality gates...</div>':e.length===0?a='<div class="empty-state">Quality gates will activate during code review phases. Gates are evaluated after each RARV iteration.</div>':a=`<div class="gates-grid">${e.map(o=>{let n=(o.status||"pending").toLowerCase(),l=Lt[n]||Lt.pending;return`
+    `}render(){let t=this.shadowRoot;if(!t)return;let e=this._gates,i=ee(e),a;this._loading&&e.length===0?a='<div class="loading">Loading quality gates...</div>':e.length===0?a='<div class="empty-state"><strong>No gate results yet.</strong> Quality gates run automatically between RARV iterations during an active session. Start a session with <code>loki start ./prd.md</code> to see results here. You can also run gates manually with <code>loki review</code>.</div>':a=`<div class="gates-grid">${e.map(o=>{let n=(o.status||"pending").toLowerCase(),l=Lt[n]||Lt.pending;return`
           <div class="gate-card status-${n}">
             <div class="gate-header">
               <span class="gate-name">${this._escapeHtml(o.name||"Unnamed Gate")}</span>

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Complete installation instructions for all platforms and use cases.
 
-**Version:** v6.26.2
+**Version:** v6.26.4
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loki-mode",
-  "version": "6.26.2",
+  "version": "6.26.4",
   "description": "Loki Mode by Autonomi - Multi-agent autonomous startup system for Claude Code, Codex CLI, and Gemini CLI",
   "keywords": [
     "agent",