loki-mode 7.0.1 → 7.1.0

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.0.1
+**Version:** v7.1.0
 
 ---
 

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.0.1'
+__version__ = '7.1.0'

package/mcp/managed_tools.py

@@ -98,6 +98,17 @@ def redact_memory_versions(
             "scanned": 0,
         }
 
+    # v7.0.2: bound pattern length to mitigate ReDoS. Catastrophic-backtracking
+    # patterns like (a+)+$ can hang the MCP server. 512 chars is generous for
+    # legitimate compliance/PII patterns.
+    if not isinstance(pattern, str) or len(pattern) > 512:
+        return {
+            "error": "pattern must be a string of <=512 characters (ReDoS guard)",
+            "redacted_count": 0,
+            "errors": [],
+            "scanned": 0,
+        }
+
     try:
         compiled = re.compile(pattern)
     except re.error as e:

package/memory/managed_memory/client.py

@@ -101,7 +101,12 @@ class ManagedClient:
         stores = getattr(beta, "memory_stores", None) or getattr(beta, "stores", None)
         if stores is None or not hasattr(stores, "list"):
             raise ManagedDisabled("memory_stores API not available in SDK")
-        result = stores.list()
+        try:
+            result = stores.list()
+        except ManagedDisabled:
+            raise
+        except Exception as e:
+            raise ManagedDisabled(f"stores_list failed: {e!s}") from e
         # SDK returns a pydantic model; normalize to list of dicts.
         data = getattr(result, "data", result)
         return [self._to_dict(x) for x in (data or [])]
@@ -117,7 +122,12 @@ class ManagedClient:
         stores = getattr(beta, "memory_stores", None) or getattr(beta, "stores", None)
         if stores is None or not hasattr(stores, "create"):
             raise ManagedDisabled("memory_stores.create not available in SDK")
-        created = stores.create(name=name, description=description, scope=scope)
+        try:
+            created = stores.create(name=name, description=description, scope=scope)
+        except ManagedDisabled:
+            raise
+        except Exception as e:
+            raise ManagedDisabled(f"stores_get_or_create failed: {e!s}") from e
         return self._to_dict(created)
 
     # ---------- memories ------------------------------------------------
@@ -148,7 +158,12 @@ class ManagedClient:
         }
         if sha256_precondition:
             kwargs["if_match_sha256"] = sha256_precondition
-        created = memories.create(**kwargs)
+        try:
+            created = memories.create(**kwargs)
+        except ManagedDisabled:
+            raise
+        except Exception as e:
+            raise ManagedDisabled(f"memory_create failed: {e!s}") from e
         return self._to_dict(created)
 
     def memory_read(self, store_id: str, memory_id: str) -> Dict[str, Any]:
@@ -156,7 +171,12 @@ class ManagedClient:
         memories = getattr(beta, "memories", None)
         if memories is None or not hasattr(memories, "retrieve"):
             raise ManagedDisabled("memories.retrieve not available in SDK")
-        got = memories.retrieve(store_id=store_id, memory_id=memory_id)
+        try:
+            got = memories.retrieve(store_id=store_id, memory_id=memory_id)
+        except ManagedDisabled:
+            raise
+        except Exception as e:
+            raise ManagedDisabled(f"memory_read failed: {e!s}") from e
         return self._to_dict(got)
 
     def memories_list(
@@ -169,7 +189,12 @@ class ManagedClient:
         kwargs: Dict[str, Any] = {"store_id": store_id}
         if path_prefix:
             kwargs["path_prefix"] = path_prefix
-        result = memories.list(**kwargs)
+        try:
+            result = memories.list(**kwargs)
+        except ManagedDisabled:
+            raise
+        except Exception as e:
+            raise ManagedDisabled(f"memories_list failed: {e!s}") from e
         data = getattr(result, "data", result)
         return [self._to_dict(x) for x in (data or [])]
 

package/memory/managed_memory/events.py

@@ -21,6 +21,45 @@ from typing import Any, Dict, Optional
 _ROTATE_BYTES = 10 * 1024 * 1024
 
 
+def _load_loki_version() -> str:
+    """
+    Read the repo VERSION file once at module import.
+
+    Resolves to <repo_root>/VERSION assuming this file lives at
+    <repo_root>/memory/managed_memory/events.py. If the file is missing
+    or unreadable for any reason, returns the literal string "unknown"
+    so the correlation field is ALWAYS present on emitted events.
+    """
+    try:
+        version_path = Path(__file__).resolve().parents[2] / "VERSION"
+        return version_path.read_text(encoding="utf-8").strip() or "unknown"
+    except Exception:
+        return "unknown"
+
+
+# Cached at module load: never re-read per-event. The repo version does not
+# change during a single Python process lifetime.
+_LOKI_VERSION: str = _load_loki_version()
+
+
+def _correlation_stamp() -> Dict[str, Any]:
+    """
+    Build the correlation fields to merge into every payload.
+
+    Reads LOKI_ITERATION_COUNT and LOKI_SESSION_ID from the environment.
+    Missing env vars are OMITTED (not set to None) so callers can tell
+    "unset" apart from "explicitly null". loki_version is always present.
+    """
+    stamp: Dict[str, Any] = {"loki_version": _LOKI_VERSION}
+    iteration = os.environ.get("LOKI_ITERATION_COUNT")
+    if iteration is not None and iteration != "":
+        stamp["iteration_id"] = iteration
+    session = os.environ.get("LOKI_SESSION_ID")
+    if session is not None and session != "":
+        stamp["session_id"] = session
+    return stamp
+
+
 def _events_dir(target_dir: Optional[str] = None) -> Path:
     base = target_dir or os.environ.get("LOKI_TARGET_DIR") or os.getcwd()
     return Path(base) / ".loki" / "managed"
@@ -66,10 +105,18 @@ def emit_managed_event(
         path = dir_path / "events.ndjson"
         _maybe_rotate(path)
 
+        # Stamp correlation fields (loki_version always; iteration_id and
+        # session_id when env vars are set). Caller-supplied keys win: if
+        # the payload already carries iteration_id / session_id / loki_version
+        # the explicit caller value is preserved. Single-writer invariant
+        # is preserved because we only mutate the in-memory dict here; the
+        # write path (file handle, lock-free append) is unchanged.
+        merged_payload = {**_correlation_stamp(), **(payload or {})}
+
         record = {
             "ts": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
             "type": event_type,
-            "payload": payload,
+            "payload": merged_payload,
         }
         # Line-buffered append; JSONL.
         with open(path, "a", encoding="utf-8") as f:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loki-mode",
-  "version": "7.0.1",
+  "version": "7.1.0",
   "description": "Loki Mode by Autonomi - Multi-agent autonomous startup system for Claude Code, Codex CLI, and Gemini CLI",
   "keywords": [
     "agent",

package/providers/managed.py

@@ -69,7 +69,7 @@ import logging
 import os
 import threading
 import time
-from dataclasses import asdict, dataclass, field
+from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Dict, List, Optional
 

package/skills/memory.md

@@ -1,4 +1,4 @@
-# Memory Integration (v7.0.0+)
+# Memory Integration (v7.1.0+)
 
 Loki Mode ships two memory layers:
 
@@ -109,8 +109,10 @@ With managed memory on, a new project gets access to:
 - `.loki/memory/skills/*.json` (org store, RO)
 - `.loki/memory/anti_patterns/*.json` (org store, RO)
 
-Promotions from user-RW to org-RO go through an explicit
-`loki_memory_promote` MCP tool that requires human approval. Never
+Promotions from user-RW to org-RO are MANUAL only at v7.0.x. Use the
+Managed Agents API directly (`memory_stores.memories.create` against the
+org store) with human review. An MCP `loki_memory_promote` tool is on
+the roadmap but NOT shipped in v7.0.x; do not depend on it. Never
 auto-promote.
 
 ## PII redaction
@@ -182,4 +184,4 @@ Dashboard endpoints (read-only, view-layer merge):
 
 ---
 
-**v7.0.0** | Opt-in, additive, rollback-safe. Default behavior unchanged.
+**v7.1.0** | Opt-in, additive, rollback-safe. Default behavior unchanged.