loki-mode 7.108.0 → 7.109.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.108.0
+# Loki Mode v7.109.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.108.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.109.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.108.0
+7.109.0

package/autonomy/run.sh

@@ -12200,8 +12200,11 @@ parse_claude_reset_time() {
     local current_min=$(date +%M)
     local current_sec=$(date +%S)
 
-    # Calculate seconds until reset
-    local current_secs=$((current_hour * 3600 + current_min * 60 + current_sec))
+    # Calculate seconds until reset. Force base-10 (10#) on the zero-padded
+    # date values: 08/09 are invalid octal, so bare arithmetic aborts ("value
+    # too great for base") during those clock windows and silently discards the
+    # real rate-limit reset wait, falling back to a too-short generic backoff.
+    local current_secs=$((10#$current_hour * 3600 + 10#$current_min * 60 + 10#$current_sec))
     local reset_secs=$((hour * 3600))
 
     local wait_secs=$((reset_secs - current_secs))
@@ -12634,8 +12637,14 @@ except Exception:
     # Return the payload on stdout
     printf '%s\n' "$payload"
 
-    # Consume the signal (next iteration would otherwise re-trigger)
+    # Consume the signal (next iteration would otherwise re-trigger).
+    # Also remove the fallback if it coexists: TASK_COMPLETION_CLAIMED and
+    # COMPLETION_REQUESTED are both valid, non-exclusive completion mechanisms, so
+    # a belt-and-suspenders agent can leave both present. Removing only the active
+    # one orphans the other, which then reads as a phantom claim on a later
+    # iteration and forces every-iteration council evaluation. Consume both.
     rm -f "$signal_file" 2>/dev/null
+    rm -f "$fallback_file" 2>/dev/null
     return 0
 }
 

package/autonomy/verify.sh

@@ -830,14 +830,22 @@ PYEOF
         if grep -qE '"(express|fastify|koa|hapi|@hapi/hapi|next|nuxt|@nestjs/core|@nestjs/platform-express|http-server|connect|restify|polka|@sveltejs/kit|vite)"[[:space:]]*:' "$dir/package.json" 2>/dev/null; then
             _node_http_signal="dep"
         fi
-        # (b) a listen()/createServer()/serve() call in a shallow scan of JS/TS
-        #     sources (bounded: node_modules/.git excluded). Uses grep -q (a
-        #     boolean, no pipe) so this is safe under set -o pipefail (a piped
-        #     `| head` would SIGPIPE grep and, under pipefail, drop the result).
+        # (b) a STRONG server-creation call in a shallow scan of JS/TS sources.
+        #     "Strong" means a module-qualified server constructor (http/https/
+        #     http2/net .createServer, or Bun.serve/Deno.serve) -- NOT a bare
+        #     `.listen(` which is common in tests (`http.createServer().listen(0)`)
+        #     and unrelated code. Test/example/build dirs are excluded so an
+        #     incidental server in a test never marks a CLI as bootable-HTTP.
+        #     Uses grep -q (a boolean, no pipe) so this is safe under
+        #     set -o pipefail (a piped `| head` would SIGPIPE grep and, under
+        #     pipefail, drop the result).
         if [ -z "$_node_http_signal" ]; then
-            if grep -rqE '\.listen\(|createServer\(|http2?\.createServer|Bun\.serve\(|Deno\.serve\(' \
+            if grep -rqE 'https?\.createServer|http2\.createServer|net\.createServer|Bun\.serve\(|Deno\.serve\(' \
                 "$dir" --include='*.js' --include='*.ts' --include='*.mjs' --include='*.cjs' \
-                --exclude-dir=node_modules --exclude-dir=.git 2>/dev/null; then
+                --exclude-dir=node_modules --exclude-dir=.git \
+                --exclude-dir=test --exclude-dir=tests --exclude-dir=__tests__ \
+                --exclude-dir=examples --exclude-dir=example \
+                --exclude-dir=dist --exclude-dir=build --exclude-dir=spec 2>/dev/null; then
                 _node_http_signal="src"
             fi
         fi
@@ -964,6 +972,11 @@ verify_gate_runtime() {
     local deadline=$(( $(date +%s) + boot_timeout ))
     local have_curl="false"
     command -v curl >/dev/null 2>&1 && have_curl="true"
+    # The port we actually probe. Starts at the guessed default; if the boot log
+    # announces a different bound port (e.g. Vite on 5173, which ignores PORT and
+    # the default map cannot know), we re-point the probe THERE. scraped_port is
+    # stashed so teardown can also reclaim it (fixes the different-port leak).
+    local probe_port="$port" scraped_port=""
 
     while [ "$(date +%s)" -lt "$deadline" ]; do
         # If the app process already exited, stop polling (it failed to stay up).
@@ -971,6 +984,15 @@ verify_gate_runtime() {
             # Give one last probe in case it forked a daemon and exited.
             :
         fi
+        # Scrape the actually-bound port from the boot log (progressively filled).
+        # Only re-point when it differs from the current probe target.
+        if [ -z "$scraped_port" ]; then
+            scraped_port="$(_verify_runtime_scrape_port "$boot_log" 2>/dev/null || true)"
+            if [ -n "$scraped_port" ] && [ "$scraped_port" != "$probe_port" ]; then
+                probe_port="$scraped_port"
+                url="http://127.0.0.1:${probe_port}${health_path}"
+            fi
+        fi
         if [ "$have_curl" = "true" ]; then
             http_status="$(curl -s -o /dev/null -w '%{http_code}' --max-time 3 "$url" 2>/dev/null || echo "")"
             if [ -n "$http_status" ] && [ "$http_status" != "000" ]; then
@@ -980,7 +1002,7 @@ verify_gate_runtime() {
         else
             # Portable fallback: raw TCP GET via bash /dev/tcp (best effort).
             local resp=""
-            resp="$(_verify_runtime_raw_probe "$port" "$health_path" 2>/dev/null || true)"
+            resp="$(_verify_runtime_raw_probe "$probe_port" "$health_path" 2>/dev/null || true)"
             if [ -n "$resp" ]; then
                 http_status="$resp"
                 answered="true"
@@ -1007,7 +1029,10 @@ verify_gate_runtime() {
     fi
 
     # Teardown: kill the launcher and any child it spawned. Best effort; bounded.
-    _verify_runtime_teardown "$app_pid" "$port"
+    # Reclaim BOTH the detected port and the actually-bound port (scraped from the
+    # boot log) so a server that daemonized onto a different port than we guessed
+    # does not leak. scraped_port may be empty (no banner) -- teardown handles it.
+    _verify_runtime_teardown "$app_pid" "$port" "$scraped_port"
 
     # Interpret the result.
     if [ "$answered" != "true" ]; then
@@ -1073,6 +1098,37 @@ _verify_runtime_raw_probe() {
     printf '%s' "$line" | grep -oE 'HTTP/[0-9.]+ [0-9]{3}' | grep -oE '[0-9]{3}$' || return 1
 }
 
+# Scrape the actually-bound localhost port from a dev server's boot log. Dev
+# servers (Vite, SvelteKit, Nuxt, Next, CRA, ...) print a "Local:" / "listening
+# on" banner with their real port, which is frequently NOT the guessed default
+# (bare Vite binds 5173 and ignores PORT). We parse ONLY a localhost/127.0.0.1
+# bind announcement so we never lock onto an unrelated outbound URL the app might
+# have logged (which some other live process could answer -> false green). ANSI
+# color codes are stripped first (dev banners are colorized). Echoes the first
+# matched port, or nothing. Bounded: reads only the given log file, no network.
+_verify_runtime_scrape_port() {
+    local log="$1"
+    [ -f "$log" ] || return 1
+    # Strip ANSI escapes first (dev banners are colorized). Then, line by line,
+    # match a localhost/127.0.0.1 bind announcement and extract the PORT that
+    # sits at the end of the match (the number after the final colon / after
+    # "port"), never an IP octet. Emit the first port found.
+    local line p
+    while IFS= read -r line; do
+        # A URL like http://localhost:5173 or http://127.0.0.1:5173/ .
+        p="$(printf '%s' "$line" | grep -oiE 'https?://(localhost|127\.0\.0\.1):[0-9]{2,5}' | grep -oE ':[0-9]{2,5}' | grep -oE '[0-9]{2,5}' | head -1)"
+        # Or a "listening on [127.0.0.1:]5173" / "listening on port 5173" phrase.
+        if [ -z "$p" ]; then
+            p="$(printf '%s' "$line" | grep -oiE 'listening on( port)?[[:space:]:]*([0-9.]+:)?[0-9]{2,5}' | grep -oE '[0-9]{2,5}$' | head -1)"
+        fi
+        if [ -n "$p" ]; then
+            printf '%s' "$p"
+            return 0
+        fi
+    done < <(sed -E $'s/\033\\[[0-9;?]*[A-Za-z]//g' "$log" 2>/dev/null)
+    return 1
+}
+
 # Optional screenshot via the playwright inline smoke script (reused contract:
 # url screenshot results timeout). Bounded by the same timeout wrapper. Returns
 # 0 if the screenshot file was produced, nonzero otherwise. Never fatal.
@@ -1110,30 +1166,56 @@ SMOKE_SCRIPT
 # Teardown: terminate the boot launcher and any process still holding the port.
 # Bounded and best effort; never blocks the gate.
 _verify_runtime_teardown() {
-    local app_pid="$1" port="$2"
+    local app_pid="$1" port="$2" scraped_port="${3:-}"
     if [ -n "$app_pid" ]; then
-        # Kill the process group of the launcher when possible, else the PID.
+        # Best: kill the launcher's whole process GROUP so a server it spawned in
+        # a subshell (e.g. `vite &`) dies too. GUARDED against self-suicide: in a
+        # non-interactive script job control is off, so a background job can share
+        # the verifier's OWN process group; a negative-PID kill there would kill
+        # us (and our parent). Only group-kill when the child's PGID differs from
+        # ours AND equals the child PID (i.e. it is a real group leader).
+        local child_pgid="" self_pgid=""
+        child_pgid="$(ps -o pgid= -p "$app_pid" 2>/dev/null | tr -d ' ' || true)"
+        self_pgid="$(ps -o pgid= -p $$ 2>/dev/null | tr -d ' ' || true)"
+        if [ -n "$child_pgid" ] && [ "$child_pgid" != "$self_pgid" ] \
+           && [ "$child_pgid" = "$app_pid" ]; then
+            kill -- -"$child_pgid" 2>/dev/null || true
+        fi
+        # Always TERM the launcher PID itself.
         kill "$app_pid" 2>/dev/null || true
         # Kill any direct children (the timeout wrapper spawns sh -c "$method").
         if command -v pkill >/dev/null 2>&1; then
             pkill -P "$app_pid" 2>/dev/null || true
         fi
-        # Give it a moment, then hard-kill.
+        # Give it a moment, then hard-kill (PID, and group again when safe).
         local i=0
         while [ "$i" -lt 3 ] && kill -0 "$app_pid" 2>/dev/null; do
             sleep 1; i=$((i + 1))
         done
+        if [ -n "$child_pgid" ] && [ "$child_pgid" != "$self_pgid" ] \
+           && [ "$child_pgid" = "$app_pid" ]; then
+            kill -9 -- -"$child_pgid" 2>/dev/null || true
+        fi
         kill -9 "$app_pid" 2>/dev/null || true
     fi
-    # Reclaim the port from any orphan that outlived the launcher (bounded).
+    # Reclaim BOTH the detected port and the actually-bound (scraped) port from
+    # any orphan that outlived the launcher -- a daemonized server that bound a
+    # different port than we guessed would otherwise leak. Bounded, best effort.
     if command -v lsof >/dev/null 2>&1; then
-        local holders
-        holders="$(lsof -ti tcp:"$port" 2>/dev/null || true)"
-        if [ -n "$holders" ]; then
-            printf '%s\n' "$holders" | while IFS= read -r pid; do
-                [ -n "$pid" ] && kill -9 "$pid" 2>/dev/null || true
-            done
-        fi
+        # Build a unique, non-empty port list (scraped only if it differs).
+        local _ports="$port"
+        [ -n "$scraped_port" ] && [ "$scraped_port" != "$port" ] && _ports="$_ports $scraped_port"
+        local _rp
+        for _rp in $_ports; do
+            [ -z "$_rp" ] && continue
+            local holders
+            holders="$(lsof -ti tcp:"$_rp" 2>/dev/null || true)"
+            if [ -n "$holders" ]; then
+                printf '%s\n' "$holders" | while IFS= read -r pid; do
+                    [ -n "$pid" ] && kill -9 "$pid" 2>/dev/null || true
+                done
+            fi
+        done
     fi
 }
 

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.108.0"
+__version__ = "7.109.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.108.0
+**Version:** v7.109.0
 
 ---
 

package/docs/TOP-100-BACKLOG.md

@@ -120,3 +120,40 @@ Generated 2026-07-01 by the top100-backlog-enumeration ultracode workflow (7 age
 | 98 | low | S | autonomous | dashboard | Web-app docs: fill video placeholder (coming-soon text) |
 | 99 | low | M | autonomous | cli | C# provider support (roslyn analyzers + dotnet build, deferred) |
 | 100 | low | XL | founder-gated | engine | BMAD-METHOD v6 integration (net-new, needs founder planning) |
+
+## Gate split (what can actually close autonomously) - 2026-07-01
+
+The /goal asks to work through all 100. The honest structural reality: only a
+subset is autonomously completable. The rest need a founder decision or are
+community/CI-infra work that cannot be forced from this session.
+
+- **Autonomous (I can execute end-to-end): ~25 items** (the `gate=autonomous` rows).
+- **Founder-gated (blocked on a decision only the founder can make): ~35 items.**
+  Licensing (#5), hosted deploy target (#6, #23, #36), enterprise RBAC/SSO (#15),
+  sandbox backend choice (#14, #42), spend (#49 SWE-bench, #18 live-model), npm
+  publish + brand (#4, #13, #61), telemetry (#62), GitHub App (#46). Prepped to
+  one-approval-away where possible; CANNOT close without the founder.
+- **Community / CI-infra (~40 items):** flake root-causes, coverage thresholds,
+  platform runners (ARM64/Windows), distribution resilience. Environmental
+  hardening, not single-session feature work.
+
+### Shipped this session (accuracy-moat, from the competitive gap-analysis)
+
+Net-new accuracy work driven from docs/research-2026-07/gap-analysis-backlog.json
+(a companion list), NOT retroactive Top-100 claims:
+
+- v7.105.0 - convergence: council evaluates on completion-claim (4.0x faster, n=3). commit b8a368a0.
+- v7.106.0 - reverse-classical test provenance (tautological tests downgraded). commit 71299faa.
+- v7.107.0 - loki mcp --transport http loopback bind + bearer auth (+ latent crash fix). commit f3aa523c.
+- v7.108.0 - runtime boot smoke gate + annotate-before-act expectation ledger. commit 806fc374.
+
+### Top-100 items with a concrete shipped commit
+
+- #40 (dashboard memory summary on JSON-backed projects) - commit 330de52d.
+- #22 (3 parallel code reviewers) - already present in the engine (council path).
+
+### Next autonomous batch (by value, unblocked, user-visible)
+
+Picked from the `autonomous` rows by value + real-user impact (not primitives that
+ship dormant). Verify each before starting; several may overlap the already-built
+private autonomi-verify TS engine (e.g. #7/#8 - check before rebuilding).

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var X8=Object.defineProperty;var K8=($)=>$;function q8($,Q){this[$]=K8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)X8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:q8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var v1={};b(v1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as r,dirname as i$}from"path";import{fileURLToPath as J8}from"url";import{existsSync as x$}from"fs";import{homedir as V8}from"os";function W8(){let $=y1;for(let Q=0;Q<6;Q++){if(x$(r($,"VERSION"))&&x$(r($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return r(y1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(x$(r(Q,"VERSION"))&&x$(r(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return r($,"..","..","..")}function P(){return process.env.LOKI_DIR??r(process.cwd(),".loki")}function T$(){return r(V8(),".loki")}var y1,h;var C=L(()=>{y1=i$(J8(import.meta.url));h=W8()});import{readFileSync as U8}from"fs";import{resolve as H8,dirname as G8}from"path";import{fileURLToPath as B8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.108.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=G8(B8(import.meta.url)),Z=e$(Q);Q$=U8(H8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var c1={};b(c1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>u1,commandVersion:()=>S8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>f1});async function u1($,Q=f1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([u1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=N8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function N8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function S8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var f1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function t($){return D8?"":$}var D8,T,S,_,nZ,I,k,y,J;var c=L(()=>{D8=(process.env.NO_COLOR??"").length>0;T=t("\x1B[0;31m"),S=t("\x1B[0;32m"),_=t("\x1B[1;33m"),nZ=t("\x1B[0;34m"),I=t("\x1B[0;36m"),k=t("\x1B[1m"),y=t("\x1B[2m"),J=t("\x1B[0m")});import{existsSync as c8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(c8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var J0={};b(J0,{runStatus:()=>U3});import{existsSync as v,readFileSync as U$,readdirSync as e1,statSync as $0}from"fs";import{resolve as D,basename as Q3}from"path";import{homedir as Z3}from"os";function Q0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Q0($),U=Q0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function X3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
+var X8=Object.defineProperty;var K8=($)=>$;function q8($,Q){this[$]=K8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)X8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:q8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var v1={};b(v1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as r,dirname as i$}from"path";import{fileURLToPath as J8}from"url";import{existsSync as x$}from"fs";import{homedir as V8}from"os";function W8(){let $=y1;for(let Q=0;Q<6;Q++){if(x$(r($,"VERSION"))&&x$(r($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return r(y1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(x$(r(Q,"VERSION"))&&x$(r(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return r($,"..","..","..")}function P(){return process.env.LOKI_DIR??r(process.cwd(),".loki")}function T$(){return r(V8(),".loki")}var y1,h;var C=L(()=>{y1=i$(J8(import.meta.url));h=W8()});import{readFileSync as U8}from"fs";import{resolve as H8,dirname as G8}from"path";import{fileURLToPath as B8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.109.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=G8(B8(import.meta.url)),Z=e$(Q);Q$=U8(H8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var c1={};b(c1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>u1,commandVersion:()=>S8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>f1});async function u1($,Q=f1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([u1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=N8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function N8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function S8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var f1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function t($){return D8?"":$}var D8,T,S,_,nZ,I,k,y,J;var c=L(()=>{D8=(process.env.NO_COLOR??"").length>0;T=t("\x1B[0;31m"),S=t("\x1B[0;32m"),_=t("\x1B[1;33m"),nZ=t("\x1B[0;34m"),I=t("\x1B[0;36m"),k=t("\x1B[1m"),y=t("\x1B[2m"),J=t("\x1B[0m")});import{existsSync as c8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(c8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var J0={};b(J0,{runStatus:()=>U3});import{existsSync as v,readFileSync as U$,readdirSync as e1,statSync as $0}from"fs";import{resolve as D,basename as Q3}from"path";import{homedir as Z3}from"os";function Q0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Q0($),U=Q0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function X3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -805,4 +805,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(z8),2}}i1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var EZ=await RZ(Bun.argv.slice(2));process.exit(EZ);
 
-//# debugId=45CBA837EB346E2A64756E2164756E21
+//# debugId=68DF9A47D3B818A364756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.108.0'
+__version__ = '7.109.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.108.0",
+  "version": "7.109.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.108.0",
+  "version": "7.109.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",