loki-mode 7.109.0 → 7.111.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.109.0
+# Loki Mode v7.111.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.109.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.111.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.109.0
+7.111.0

package/autonomy/app-runner.sh

@@ -673,8 +673,11 @@ _detect_port() {
                 fi
                 local port
                 # Handle both simple (HOST:CONTAINER) and IP-bound (IP:HOST:CONTAINER) port formats
-                # Also handle port ranges like "8080-8090:8080-8090" by taking the first port
-                port=$(grep -E '^\s*-\s*"?[0-9]' "$compose_file" 2>/dev/null | head -1 | sed 's/.*- *"*//;s/".*//;' | awk -F: '{print $(NF-1)}' | awk -F- '{print $1}')
+                # Also handle port ranges like "8080-8090:8080-8090" by taking the FIRST port.
+                # The leading strip must be anchored (^...) and must NOT use a greedy `.*-`,
+                # otherwise it consumes the range's internal dash and yields the LAST port
+                # (e.g. "8080-8090:8080-8090" -> 8090 instead of 8080). See wave-3 repro.
+                port=$(grep -E '^\s*-\s*"?[0-9]' "$compose_file" 2>/dev/null | head -1 | sed -E 's/^[[:space:]]*-[[:space:]]*"?//; s/".*$//' | awk -F: '{print $(NF-1)}' | awk -F- '{print $1}')
                 _APP_RUNNER_PORT="${port:-8080}"
             fi
             ;;

package/autonomy/completion-council.sh

@@ -3103,7 +3103,14 @@ council_evaluate() {
             # Step 3: Unanimous -- run devil's advocate
             local da_result
             da_result=$(council_devils_advocate_review "$ITERATION_COUNT")
-            if [ "$da_result" = "OVERRIDE_CONTINUE" ]; then
+            # council_devils_advocate_review emits log_warn/log_info lines to
+            # STDOUT (run.sh log_* echo to stdout, not stderr), so da_result is a
+            # multi-line string whose LAST line is the verdict token. Comparing
+            # the whole capture against "OVERRIDE_CONTINUE" never matched, which
+            # silently defeated the anti-sycophancy backstop. Take the last line.
+            local da_verdict
+            da_verdict="$(printf '%s\n' "$da_result" | tail -n1)"
+            if [ "$da_verdict" = "OVERRIDE_CONTINUE" ]; then
                 log_warn "Council evaluate: devil's advocate overrode unanimous COMPLETE"
                 # Write transcript: DA triggered and flipped the outcome (Path B)
                 council_write_transcript "${ITERATION_COUNT:-0}" "REJECTED" "true" "true" "$_eval_threshold"

package/autonomy/lib/proof-generator.py

@@ -675,8 +675,11 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
 
     # ---- v1.1 evidence model -------------------------------------------------
     # FACTS: deterministic, re-derivable, NON-LLM. A skeptic can recompute every
-    # one of these from the same .loki state. This is what makes a green receipt
-    # impossible to forge: the headline is computed ONLY from these facts.
+    # one of these from the same .loki state. The headline is computed ONLY from
+    # these facts. NOTE: this is NOT tamper-proof against a hand-forger on the
+    # unsigned path -- whoever can write the proof can also rewrite the facts and
+    # recompute the hash. True non-forgeability requires the neutral signed record
+    # (service-held key). See proof-verify.py verify() docstring.
     git_facts = {
         "base_sha": os.environ.get("_LOKI_ITER_START_SHA", "").strip(),
         "head_sha": _git_head_sha(target_dir),
@@ -725,8 +728,11 @@ def _build_proof(args, loki_dir, target_dir, repo_root):
     }
 
     # HONESTY: every fact that is not_run/inconclusive/skipped, surfaced loudly,
-    # plus a deterministic headline a forger cannot turn green without real
-    # exit_code:0 evidence and a non-empty diff.
+    # plus a deterministic headline derived from the recorded facts (real
+    # exit_code:0 evidence and a non-empty diff). On the unsigned path this
+    # deters an inconsistent editor, but does NOT stop a consistent hand-forger
+    # who rewrites the facts and re-hashes; neutral non-forgeability needs the
+    # signed record.
     degraded = _compute_degraded(facts)
     headline = _compute_headline(facts, degraded)
     honesty = {

package/autonomy/lib/proof-pr.sh

@@ -235,6 +235,20 @@ def main():
         "nothing could be verified. The headline is computed only from "
         "deterministic, re-derivable facts, never from an AI opinion."
     )
+    _line()
+    # Honest scope of "verify it yourself". A reviewer CAN recompute the diff and
+    # the integrity hash, and proof-verify.py re-derives the headline from the
+    # recorded facts to catch an inconsistent edit. But on the unsigned path the
+    # recorded test/build facts are produced by Loki and taken at face value:
+    # a consistent rewrite of facts + headline is not caught here. Neutral,
+    # adversarial non-forgeability (Loki not trusted) needs the signed record.
+    _line(
+        "Scope: you can recompute the diff and the integrity hash yourself, and "
+        "`loki proof verify` re-derives the headline from the recorded facts. On "
+        "an unsigned receipt the recorded test/build facts are produced by Loki "
+        "and taken at face value; a signed receipt is required for verification "
+        "that does not trust Loki."
+    )
     return 0
 
 

package/autonomy/lib/proof-verify.py

@@ -2,13 +2,26 @@
 """Deterministic re-verifier for Loki Mode proof-of-run receipts.
 
 Companion to proof-generator.py. The generator writes proof.json with an
-integrity hash so a skeptic can prove the JSON was not edited. This module
-goes one step further: it re-checks the receipt's recorded FACTS against the
-live repo, so a skeptic can prove the facts are STILL TRUE (the diff the
-receipt claims still matches what is in git), not merely that the JSON bytes
-are unaltered. That re-check is what makes the receipt non-forgeable: you
-cannot hand-write a proof.json whose recorded diff survives a re-run against
-the repo it claims to describe.
+integrity hash so a skeptic can prove the JSON bytes were not edited since
+they were hashed. This module goes further: it re-checks the receipt's
+recorded FACTS against the live repo, so a skeptic can prove the recorded
+diff STILL matches what is in git, not merely that the JSON bytes are
+unaltered. It also re-derives the honesty headline from the recorded facts
+(see headline_consistent below) to catch an INCONSISTENT edit -- a proof
+whose headline was flipped to VERIFIED while the facts still say not_run.
+
+What this does NOT do -- honest scope. On the UNSIGNED path (no valid gpg
+signature) the generator is TRUSTED: the recorded facts are taken at face
+value. A forger who rewrites BOTH the facts AND the headline to a mutually
+consistent lie, then recomputes the integrity hash, still passes every
+check here -- the hash proves only bytes-unedited-since-hashing, and the
+re-derived diff can be made to match a repo the forger controls. Neutral,
+adversarial non-forgeability (the generator is NOT trusted) requires the
+SIGNED record: a detached gpg signature from a key the verifier trusts.
+When gpg_ok is True the generator is not trusted; when gpg_ok is "n/a" it
+is. This module reports that distinction (generator_trusted) rather than
+overclaiming that re-checking the diff makes a receipt non-forgeable. It
+does not.
 
 Three checks (mirrors dashboard/audit.py verify-CLI style):
 
@@ -165,6 +178,61 @@ def _to_int(v, default=0):
         return default
 
 
+# ---------------------------------------------------------------------------
+# headline re-derivation (MUST match proof-generator._compute_headline exactly)
+# ---------------------------------------------------------------------------
+
+def _compute_headline(facts, degraded):
+    """Deterministic headline re-derived from the recorded facts.
+
+    MUST match proof-generator.py _compute_headline() byte-for-byte in logic
+    (same DRIFT-GUARD contract as _canonical / _diff_sha256_from_stat above).
+    We mirror rather than import because proof-generator.py has a hyphen in its
+    filename (not a plain import) and this file already mirrors its sibling's
+    hashing helpers with the same "MUST match" discipline. If the generator's
+    rules change, this copy MUST be updated in lockstep.
+
+    Redaction note: proof_redact.py only rewrites secret/path substrings inside
+    string values; it never touches the status enums, integer counts, exit_code,
+    or the shape/length of the degraded list that this function reads, and it
+    leaves bool(command) truthy. So re-deriving from the STORED (post-redaction)
+    facts yields the identical headline the generator computed pre-redaction.
+    """
+    tests = facts.get("tests") or {}
+    build = facts.get("build") or {}
+    git = facts.get("git") or {}
+    diff_nonempty = bool((git.get("diff") or {}).get("count"))
+
+    sec = facts.get("security") or {}
+    sec_high = bool(sec.get("ran") and (sec.get("high_active") or 0) > 0)
+    any_failed = (
+        tests.get("status") == "failed"
+        or build.get("status") == "failed"
+        or any(g.get("status") == "failed"
+               for g in (facts.get("quality_gates") or []))
+        or sec_high
+    )
+    if any_failed:
+        return "NOT VERIFIED"
+
+    tests_verified = (
+        tests.get("status") == "verified"
+        and bool(tests.get("command"))
+        and tests.get("exit_code") == 0
+    )
+    if tests_verified and not degraded and diff_nonempty:
+        return "VERIFIED"
+    any_verified = (
+        tests.get("status") == "verified"
+        or build.get("status") == "verified"
+        or any(g.get("status") == "passed"
+               for g in (facts.get("quality_gates") or []))
+    )
+    if any_verified and degraded:
+        return "VERIFIED WITH GAPS"
+    return "NOT VERIFIED"
+
+
 # ---------------------------------------------------------------------------
 # proof field extraction (schema v1.0 + v1.1 tolerant)
 # ---------------------------------------------------------------------------
@@ -236,6 +304,31 @@ def _recorded_degraded(proof):
     return []
 
 
+def _recorded_degraded_raw(proof):
+    """Return honesty.degraded EXACTLY as recorded (for headline re-derivation).
+
+    _recorded_degraded coerces items to str for the report; _compute_headline
+    only cares whether the list is empty, so we pass the raw list to preserve
+    the generator's exact truthiness semantics.
+    """
+    honesty = proof.get("honesty")
+    if isinstance(honesty, dict):
+        deg = honesty.get("degraded")
+        if isinstance(deg, list):
+            return deg
+    return []
+
+
+def _recorded_headline(proof):
+    """Return honesty.headline as recorded (stripped str), or None if absent."""
+    honesty = proof.get("honesty")
+    if isinstance(honesty, dict):
+        h = honesty.get("headline")
+        if isinstance(h, str) and h.strip():
+            return h.strip()
+    return None
+
+
 # ---------------------------------------------------------------------------
 # gpg
 # ---------------------------------------------------------------------------
@@ -316,19 +409,38 @@ def verify(proof_path, repo_dir="."):
 
     Returns a dict:
       {
-        hash_ok:      bool                      tamper check passed
-        diff_drift:   bool | None               True=drift, False=match,
+        hash_ok:            bool                tamper check passed
+        diff_drift:         bool | None         True=drift, False=match,
                                                  None=could not check
-        diff_recheck: {recorded, current}       the two diff stats compared
-        gpg_ok:       True | False | "n/a"      signature verdict
-        degraded:     [str]                     honesty.degraded from the proof
-        reason:       str                       why ok is False (when it is)
-        ok:           bool                      overall verdict
+        diff_recheck:       {recorded, current} the two diff stats compared
+        gpg_ok:             True | False | "n/a"  signature verdict
+        generator_trusted:  bool                see note below
+        headline_consistent: bool | None        see note below
+        degraded:           [str]               honesty.degraded from the proof
+        reason:             str                 why ok is False (when it is)
+        ok:                 bool                overall verdict
       }
 
-    `ok` = hash_ok AND diff_drift is False AND gpg_ok in (True, "n/a").
+    `ok` = hash_ok AND diff_drift is False AND gpg_ok in (True, "n/a")
+           AND headline_consistent is not False.
     Note: diff_drift None (unverifiable) makes ok False, by design -- we never
     report "verified" when the central fact could not be re-checked.
+
+    generator_trusted: True on the UNSIGNED path (gpg_ok != True), False when a
+    valid signature is present (gpg_ok is True). On the unsigned path the facts
+    are taken at face value; neutral non-forgeability is NOT guaranteed. This
+    field exists so the report can state that honestly even when ok is True (at
+    which point `reason` is cleared).
+
+    headline_consistent: defense-in-depth. We re-derive the honesty headline
+    from the RECORDED facts (same logic as proof-generator._compute_headline)
+    and compare it to the stored honesty.headline. False means an INCONSISTENT
+    edit -- e.g. the headline was flipped to VERIFIED while the facts still say
+    not_run. That catches a careless/partial forgery. It does NOT catch a
+    CONSISTENT forger who rewrites both the facts AND the headline to a matching
+    lie and recomputes the integrity hash: on the unsigned path that still
+    passes (generator_trusted stays True). None means we could not re-derive
+    (no recorded headline, or no facts to derive from) -- not a failure.
     """
     proof = _load_proof(proof_path)
 
@@ -337,6 +449,8 @@ def verify(proof_path, repo_dir="."):
         "diff_drift": None,
         "diff_recheck": {"recorded": None, "current": None},
         "gpg_ok": "n/a",
+        "generator_trusted": True,
+        "headline_consistent": None,
         "degraded": _recorded_degraded(proof),
         "reason": "",
         "ok": False,
@@ -366,6 +480,12 @@ def verify(proof_path, repo_dir="."):
     gpg_sig = verification.get("gpg_signature")
     result["gpg_ok"] = _verify_gpg(canonical_bytes, gpg_sig)
 
+    # generator_trusted: only a VALID signature (gpg_ok is True) means the
+    # generator is NOT trusted (neutral non-forgeability). "n/a" or a bad sig
+    # leaves the generator trusted -- the facts are taken at face value and a
+    # consistent forger is NOT caught. Stated so ok=True still discloses it.
+    result["generator_trusted"] = (result["gpg_ok"] is not True)
+
     # ----- 2. DRIFT CHECK --------------------------------------------------
     recorded_stat = _recorded_diff_stat(proof)
     result["diff_recheck"]["recorded"] = recorded_stat
@@ -439,11 +559,37 @@ def verify(proof_path, repo_dir="."):
                 if drift and not result["reason"]:
                     result["reason"] = "recorded diff no longer matches the repo (drift detected)"
 
+    # ----- 4. HEADLINE CONSISTENCY (defense-in-depth) ----------------------
+    # Re-derive the headline from the recorded facts and compare to the stored
+    # honesty.headline. A mismatch means the headline was edited to disagree
+    # with the facts it claims to summarize (an INCONSISTENT forgery, e.g.
+    # headline flipped to VERIFIED while facts.tests.status is still not_run).
+    # This catches careless/partial tampering only. It does NOT catch a
+    # CONSISTENT forger who rewrites both the facts and the headline to a
+    # matching lie and recomputes the integrity hash -- on the unsigned path
+    # that still passes (see generator_trusted). Neutral non-forgeability needs
+    # the signed record, not this check.
+    recorded_headline = _recorded_headline(proof)
+    facts = proof.get("facts")
+    if recorded_headline is not None and isinstance(facts, dict):
+        derived = _compute_headline(facts, _recorded_degraded_raw(proof))
+        result["headline_consistent"] = (derived == recorded_headline)
+        if not result["headline_consistent"] and not result["reason"]:
+            result["reason"] = (
+                "honesty.headline (%r) disagrees with the headline re-derived "
+                "from the recorded facts (%r); the headline was edited to "
+                "misrepresent the facts" % (recorded_headline, derived)
+            )
+    else:
+        # No recorded headline, or no facts to re-derive from: cannot check.
+        result["headline_consistent"] = None
+
     # ----- overall verdict -------------------------------------------------
     result["ok"] = bool(
         result["hash_ok"]
         and result["diff_drift"] is False
         and result["gpg_ok"] in (True, "n/a")
+        and result["headline_consistent"] is not False
     )
     if result["ok"]:
         result["reason"] = ""

package/autonomy/lib/proof_redact.py

@@ -12,7 +12,7 @@ Patterns implemented (see R1-proof-of-run-PLAN.md REDACTION RULES):
   - Anthropic keys (sk-ant-...) -> [REDACTED:ANTHROPIC_KEY]
   - OpenAI-style keys (sk-...)  -> [REDACTED:OPENAI_KEY]
   - Google API keys (AI...)     -> [REDACTED:GOOGLE_KEY]
-  - GitHub tokens (gh[pousr]_)  -> [REDACTED:GITHUB_TOKEN]
+  - GitHub tokens (gh[pousr]_ and github_pat_) -> [REDACTED:GITHUB_TOKEN]
   - AWS access key ids (AKIA..) -> [REDACTED:AWS_KEY]
   - AWS secret access keys       -> [REDACTED:AWS_SECRET]
   - Slack tokens (xox[baprs]-)  -> [REDACTED:SLACK_TOKEN]
@@ -59,6 +59,11 @@ def reset_context():
 _PATTERNS = [
     # Anthropic keys must precede the generic sk- rule.
     (re.compile(r"sk-ant-[A-Za-z0-9_-]{20,}"), "[REDACTED:ANTHROPIC_KEY]"),
+    # GitHub fine-grained PATs (github_pat_...). Must precede the classic
+    # gh[pousr]_ rule: "github_pat_" does not match gh[pousr]_ (the char after
+    # "gh" is "i"), so the classic rule would leave fine-grained PATs untouched.
+    # The token body is a mix of [A-Za-z0-9_], so allow underscores here.
+    (re.compile(r"github_pat_[A-Za-z0-9_]{20,}"), "[REDACTED:GITHUB_TOKEN]"),
     # GitHub tokens: ghp_, gho_, ghu_, ghs_, ghr_.
     (re.compile(r"gh[pousr]_[A-Za-z0-9]{20,}"), "[REDACTED:GITHUB_TOKEN]"),
     # Slack tokens: xoxb-, xoxa-, xoxp-, xoxr-, xoxs-.

package/autonomy/loki

@@ -31119,7 +31119,10 @@ PYEOF
             # canonical proof (tamper check) and re-derives the diff from the
             # recorded base_sha vs live HEAD (drift check). Exit 0 = clean, 1 =
             # tamper/drift, 2 = unusable input. This is the "verify it yourself"
-            # path that makes the Evidence Receipt non-forgeable.
+            # path: it re-checks integrity + re-derives the diff from git, so an
+            # inconsistent edit is caught. It does NOT prove non-forgeability on
+            # the unsigned path (a hand-forger can rewrite facts and re-hash);
+            # neutral non-forgeability requires the signed record.
             local id="${1:-}"
             if [ -z "$id" ]; then
                 echo -e "${RED}Missing proof id.${NC} Use 'loki proof list'."

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.109.0"
+__version__ = "7.111.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -1180,6 +1180,16 @@ async def get_status() -> StatusResponse:
     if state_file.exists():
         try:
             state = _safe_json_read(state_file, {})
+            # dashboard-state.json is agent/user-written and, under atomic-write
+            # races or hand edits, its top level can be a list/string/number
+            # rather than an object. state.get(...) would then raise
+            # AttributeError, which the surrounding (JSONDecodeError, KeyError)
+            # handler does NOT catch -> /api/status 500s and blanks the board.
+            # Coerce to {} so a bad shape degrades to the idle payload. Placed
+            # BEFORE the _has_dashboard_state flag so a truthy non-dict (e.g.
+            # [1,2,3]) cannot flip it on with corrupt data.
+            if not isinstance(state, dict):
+                state = {}
             if state:
                 _has_dashboard_state = True
             phase = state.get("phase", "")
@@ -1188,8 +1198,15 @@ async def get_status() -> StatusResponse:
             mode = state.get("mode", "")
             # Count only agents with alive PIDs (not raw array length)
             agents_list = state.get("agents", [])
+            if not isinstance(agents_list, list):
+                agents_list = []
             running_agents = 0
             for agent in agents_list:
+                # agents entries can be bare strings/None in malformed state;
+                # agent.get(...) would raise AttributeError. Skip non-dicts.
+                if not isinstance(agent, dict):
+                    running_agents += 1  # legacy/opaque entry -> count as running
+                    continue
                 agent_pid = agent.get("pid")
                 if agent_pid:
                     try:
@@ -1202,10 +1219,17 @@ async def get_status() -> StatusResponse:
                     running_agents += 1
 
             tasks = state.get("tasks", {})
-            pending_tasks = len(tasks.get("pending", []))
+            if not isinstance(tasks, dict):
+                tasks = {}
+            _pending = tasks.get("pending", [])
+            pending_tasks = len(_pending) if isinstance(_pending, list) else 0
             in_progress = tasks.get("inProgress", [])
-            if in_progress:
-                current_task = in_progress[0].get("payload", {}).get("action", "")
+            if not isinstance(in_progress, list):
+                in_progress = []
+            if in_progress and isinstance(in_progress[0], dict):
+                _payload = in_progress[0].get("payload", {})
+                if isinstance(_payload, dict):
+                    current_task = _payload.get("action", "")
         except (json.JSONDecodeError, KeyError):
             pass
 
@@ -1783,6 +1807,13 @@ async def list_tasks(
     if state_file.exists():
         try:
             state = json.loads(state_file.read_text())
+            # dashboard-state.json top level can itself be a list/string/number
+            # (agent/user-written, atomic-write race). state.get(...) would then
+            # raise AttributeError BEFORE the task_groups guard below, and the
+            # surrounding (JSONDecodeError, KeyError) handler does not catch it
+            # -> /api/tasks 500s and blanks the board. Coerce state first.
+            if not isinstance(state, dict):
+                state = {}
             task_groups = state.get("tasks", {})
             # v7.104.4: dashboard-state.json is user/agent-written and can be
             # malformed or partially written. If "tasks" is not a dict, or a
@@ -6621,6 +6652,11 @@ def _compute_cost_snapshot() -> dict:
     if budget_file.exists():
         try:
             budget_data = json.loads(budget_file.read_text())
+            # budget.json can be a bare number/list/string; guard before .get()
+            # so the cost-summary endpoint degrades instead of raising an
+            # AttributeError uncaught by (JSONDecodeError, KeyError).
+            if not isinstance(budget_data, dict):
+                budget_data = {}
             budget_limit = budget_data.get("limit")
             if budget_limit is not None:
                 budget_used = estimated_cost
@@ -6664,6 +6700,12 @@ async def get_budget():
     if budget_file.exists():
         try:
             budget_data = json.loads(budget_file.read_text())
+            # budget.json can be a bare number/list/string (agent/user-written
+            # or atomic-write race), so budget_data.get(...) would raise
+            # AttributeError, uncaught by (JSONDecodeError, KeyError) -> 500.
+            # Coerce to {} so the endpoint degrades to no-limit defaults.
+            if not isinstance(budget_data, dict):
+                budget_data = {}
             budget_limit = budget_data.get("limit") or budget_data.get("budget_limit")
             budget_used = budget_data.get("budget_used", 0.0)
             exceeded = budget_data.get("exceeded", False)
@@ -6687,6 +6729,9 @@ async def get_budget():
         if exceeded_at is None:
             try:
                 sig_data = json.loads(signal_file.read_text())
+                # Signal file may parse to a non-dict; guard before .get().
+                if not isinstance(sig_data, dict):
+                    sig_data = {}
                 exceeded_at = sig_data.get("timestamp")
             except (json.JSONDecodeError, KeyError):
                 pass
@@ -10935,9 +10980,17 @@ async def proofs_summary():
     """Honest aggregate over the active project's Evidence Receipts.
 
     Counts are computed ONLY from real proof.json files; nothing is invented.
-    The single source of truth for "verified" is the v1.1 deterministic
-    honesty.headline (proof-generator.py::_compute_headline), which a forger
-    cannot turn green without real exit_code:0 evidence. Buckets:
+    Each proof is bucketed on its recorded honesty.headline, computed by the
+    deterministic proof-generator.py::_compute_headline (never an LLM opinion).
+    Honest scope of that guarantee: the integrity hash proves the JSON bytes
+    were not edited since they were hashed, and proof-verify.py re-derives the
+    git diff so a skeptic can confirm the recorded diff still matches the repo.
+    But on the UNSIGNED path the generator is TRUSTED -- a forger who rewrites
+    both the facts and the headline to a mutually consistent lie and recomputes
+    the hash still buckets as verified here. Neutral, adversarial non-forgeability
+    (the generator is not trusted) requires the SIGNED record (a gpg signature
+    proof-verify.py checks). This endpoint reports what the generator recorded;
+    it does not itself re-verify. Buckets:
 
       verified      -> honesty.headline == "VERIFIED"
       with_gaps     -> honesty.headline == "VERIFIED WITH GAPS"

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.109.0
+**Version:** v7.111.0
 
 ---
 

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var X8=Object.defineProperty;var K8=($)=>$;function q8($,Q){this[$]=K8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)X8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:q8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var v1={};b(v1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as r,dirname as i$}from"path";import{fileURLToPath as J8}from"url";import{existsSync as x$}from"fs";import{homedir as V8}from"os";function W8(){let $=y1;for(let Q=0;Q<6;Q++){if(x$(r($,"VERSION"))&&x$(r($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return r(y1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(x$(r(Q,"VERSION"))&&x$(r(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return r($,"..","..","..")}function P(){return process.env.LOKI_DIR??r(process.cwd(),".loki")}function T$(){return r(V8(),".loki")}var y1,h;var C=L(()=>{y1=i$(J8(import.meta.url));h=W8()});import{readFileSync as U8}from"fs";import{resolve as H8,dirname as G8}from"path";import{fileURLToPath as B8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.109.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=G8(B8(import.meta.url)),Z=e$(Q);Q$=U8(H8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var c1={};b(c1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>u1,commandVersion:()=>S8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>f1});async function u1($,Q=f1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([u1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=N8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function N8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function S8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var f1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function t($){return D8?"":$}var D8,T,S,_,nZ,I,k,y,J;var c=L(()=>{D8=(process.env.NO_COLOR??"").length>0;T=t("\x1B[0;31m"),S=t("\x1B[0;32m"),_=t("\x1B[1;33m"),nZ=t("\x1B[0;34m"),I=t("\x1B[0;36m"),k=t("\x1B[1m"),y=t("\x1B[2m"),J=t("\x1B[0m")});import{existsSync as c8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(c8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var J0={};b(J0,{runStatus:()=>U3});import{existsSync as v,readFileSync as U$,readdirSync as e1,statSync as $0}from"fs";import{resolve as D,basename as Q3}from"path";import{homedir as Z3}from"os";function Q0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Q0($),U=Q0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function X3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
+var X8=Object.defineProperty;var K8=($)=>$;function q8($,Q){this[$]=K8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)X8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:q8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var v1={};b(v1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as r,dirname as i$}from"path";import{fileURLToPath as J8}from"url";import{existsSync as x$}from"fs";import{homedir as V8}from"os";function W8(){let $=y1;for(let Q=0;Q<6;Q++){if(x$(r($,"VERSION"))&&x$(r($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return r(y1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(x$(r(Q,"VERSION"))&&x$(r(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return r($,"..","..","..")}function P(){return process.env.LOKI_DIR??r(process.cwd(),".loki")}function T$(){return r(V8(),".loki")}var y1,h;var C=L(()=>{y1=i$(J8(import.meta.url));h=W8()});import{readFileSync as U8}from"fs";import{resolve as H8,dirname as G8}from"path";import{fileURLToPath as B8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.111.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=G8(B8(import.meta.url)),Z=e$(Q);Q$=U8(H8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var c1={};b(c1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>u1,commandVersion:()=>S8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>f1});async function u1($,Q=f1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([u1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=N8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function N8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function S8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var f1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function t($){return D8?"":$}var D8,T,S,_,nZ,I,k,y,J;var c=L(()=>{D8=(process.env.NO_COLOR??"").length>0;T=t("\x1B[0;31m"),S=t("\x1B[0;32m"),_=t("\x1B[1;33m"),nZ=t("\x1B[0;34m"),I=t("\x1B[0;36m"),k=t("\x1B[1m"),y=t("\x1B[2m"),J=t("\x1B[0m")});import{existsSync as c8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(c8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var J0={};b(J0,{runStatus:()=>U3});import{existsSync as v,readFileSync as U$,readdirSync as e1,statSync as $0}from"fs";import{resolve as D,basename as Q3}from"path";import{homedir as Z3}from"os";function Q0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Q0($),U=Q0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function X3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -805,4 +805,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(z8),2}}i1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var EZ=await RZ(Bun.argv.slice(2));process.exit(EZ);
 
-//# debugId=68DF9A47D3B818A364756E2164756E21
+//# debugId=75C1D788DA07ECAB64756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.109.0'
+__version__ = '7.111.0'

package/mcp/lsp_proxy.py

@@ -1478,6 +1478,95 @@ def write_diagnostics_artifact(root: Optional[str] = None,
             'count_warnings': count_warnings}
 
 
+def _run_http_transport(port: int) -> None:
+    """Run the LSP-proxy MCP server over Streamable HTTP, bound to loopback.
+
+    Mirrors mcp/server.py:_run_http_transport for consistency. FastMCP has no
+    'http' transport literal (it uses 'streamable-http') and run() takes no
+    port= kwarg, so the old mcp.run(transport='http', port=...) call never
+    worked (TypeError). We build the Streamable-HTTP ASGI app ourselves, bind
+    127.0.0.1 explicitly, and run it via uvicorn -- the same supported path.
+
+    Two hardening properties over a bare FastMCP HTTP launch:
+
+      1. Explicit loopback bind. We set host='127.0.0.1' ourselves and run the
+         ASGI app via uvicorn rather than relying on any implicit default, so a
+         reader of `lsof`/`ss` sees 127.0.0.1 unambiguously and a future SDK
+         default change cannot silently widen the bind to 0.0.0.0.
+
+      2. Optional bearer-token auth. When LOKI_MCP_AUTH_TOKEN is set in the
+         environment, a Starlette middleware requires every HTTP request to
+         carry `Authorization: Bearer <token>` (rejecting mismatches with 401).
+         When the env var is unset or empty, NO middleware is installed at all,
+         so the request path is exactly the unauthenticated FastMCP behavior.
+
+    hasattr-guarded against the whole supported mcp 1.x range: if the installed
+    SDK lacks streamable_http_app, we fail with a clear message rather than an
+    AttributeError.
+    """
+    if not hasattr(mcp, "streamable_http_app"):
+        logger.error(
+            "Installed MCP SDK does not support Streamable HTTP transport "
+            "(no FastMCP.streamable_http_app). Upgrade the 'mcp' package "
+            "(pip install -U mcp) or use the default stdio transport."
+        )
+        sys.exit(1)
+
+    host = "127.0.0.1"
+
+    # Pin host/port on the SDK settings too, so any code that reads them (and
+    # the SDK's own transport-security allowed_hosts, which defaults to
+    # 127.0.0.1/localhost) stays consistent with what uvicorn actually binds.
+    try:
+        if hasattr(mcp, "settings"):
+            if hasattr(mcp.settings, "host"):
+                mcp.settings.host = host
+            if hasattr(mcp.settings, "port"):
+                mcp.settings.port = port
+    except Exception as _set_err:  # pragma: no cover - defensive
+        logger.warning("Could not pin MCP host/port settings: %s", _set_err)
+
+    app = mcp.streamable_http_app()
+
+    token = os.environ.get("LOKI_MCP_AUTH_TOKEN", "")
+    if token:
+        # Only import the middleware pieces when auth is actually requested, so
+        # the unauthenticated path has zero new dependencies or behavior.
+        from starlette.middleware.base import BaseHTTPMiddleware
+        from starlette.responses import JSONResponse
+
+        expected_header = "Bearer " + token
+
+        async def _require_bearer(request, call_next):
+            # BaseHTTPMiddleware auto-forwards non-http scopes (lifespan etc.),
+            # so the StreamableHTTPSessionManager lifespan still starts.
+            provided = request.headers.get("authorization", "")
+            # Constant-time compare to avoid leaking the token via timing.
+            import hmac
+            if not hmac.compare_digest(provided, expected_header):
+                return JSONResponse(
+                    {"error": "unauthorized"},
+                    status_code=401,
+                    headers={"WWW-Authenticate": "Bearer"},
+                )
+            return await call_next(request)
+
+        app.add_middleware(BaseHTTPMiddleware, dispatch=_require_bearer)
+        logger.info(
+            "MCP HTTP auth enabled: bearer token required "
+            "(LOKI_MCP_AUTH_TOKEN is set)."
+        )
+    else:
+        logger.info(
+            "MCP HTTP auth disabled: no LOKI_MCP_AUTH_TOKEN set "
+            "(loopback-only, unauthenticated)."
+        )
+
+    import uvicorn
+    logger.info("MCP Streamable HTTP listening on http://%s:%d/mcp", host, port)
+    uvicorn.run(app, host=host, port=port, log_level="info")
+
+
 def main() -> None:
     import argparse
     parser = argparse.ArgumentParser(
@@ -1536,7 +1625,11 @@ def main() -> None:
     detected = _detect_lsps()
     logger.info("Detected LSPs: %s", sorted(detected.keys()) or 'none')
     if args.transport == 'http':
-        mcp.run(transport='http', port=args.port)
+        # Explicit loopback bind + optional bearer-token auth. FastMCP has no
+        # 'http' transport literal (it uses 'streamable-http') and run() takes
+        # no port= kwarg, so the old mcp.run(transport='http', port=...) call
+        # never worked (TypeError); _run_http_transport is the supported path.
+        _run_http_transport(args.port)
     else:
         mcp.run(transport='stdio')
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.109.0",
+  "version": "7.111.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.109.0",
+  "version": "7.111.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/providers/aider.sh

@@ -58,9 +58,9 @@ _aider_default_from_catalog() {
     if [ -f "${script_dir}/models.sh" ]; then
         # shellcheck source=./models.sh
         source "${script_dir}/models.sh"
-        loki_latest_model aider development 2>/dev/null || echo "claude-opus-4-7"
+        loki_latest_model aider development 2>/dev/null || echo "claude-opus-4-8"
     else
-        echo "claude-opus-4-7"
+        echo "claude-opus-4-8"
     fi
 }
 AIDER_DEFAULT_MODEL="${LOKI_AIDER_MODEL:-${LOKI_MODEL_DEVELOPMENT:-$(_aider_default_from_catalog)}}"

package/providers/claude.sh

@@ -48,7 +48,7 @@ PROVIDER_MAX_PARALLEL=10
 # The Claude Code CLI resolves aliases (opus/sonnet/haiku) to the latest available
 # model at invocation time, so we pass aliases rather than dated IDs. The canonical
 # mapping lives in providers/model_catalog.json (single source of truth):
-#   opus   -> latest Opus   (e.g. claude-opus-4-7 -- 1M context, adaptive thinking)
+#   opus   -> latest Opus   (e.g. claude-opus-4-8 -- 1M context, adaptive thinking)
 #   sonnet -> latest Sonnet (e.g. claude-sonnet-4-6)
 #   haiku  -> latest Haiku  (e.g. claude-haiku-4-5)
 # Override per tier with LOKI_CLAUDE_MODEL_PLANNING, _DEVELOPMENT, _FAST.

package/providers/cline.sh

@@ -59,9 +59,9 @@ _cline_default_from_catalog() {
     if [ -f "${script_dir}/models.sh" ]; then
         # shellcheck source=./models.sh
         source "${script_dir}/models.sh"
-        loki_latest_model cline development 2>/dev/null || echo "claude-opus-4-7"
+        loki_latest_model cline development 2>/dev/null || echo "claude-opus-4-8"
     else
-        echo "claude-opus-4-7"
+        echo "claude-opus-4-8"
     fi
 }
 CLINE_DEFAULT_MODEL="${LOKI_CLINE_MODEL:-${LOKI_MODEL_DEVELOPMENT:-$(_cline_default_from_catalog)}}"

package/providers/codex.sh

@@ -234,21 +234,29 @@ provider_invoke_with_tier() {
         *)                    model="$PROVIDER_MODEL_DEVELOPMENT" ;;
     esac
 
-    local extra_flags=()
+    # --search is a TOP-LEVEL `codex` flag, not a `codex exec` flag. On codex
+    # 0.141.0 `codex exec ... --search` aborts with "unexpected argument
+    # '--search' found", silently breaking LOKI_CODEX_WEB_SEARCH. It must be
+    # placed before the `exec` subcommand. --output-last-message (-o) IS an
+    # `codex exec` flag and stays after `exec`. Keep the two in separate arrays.
+    local pre_exec_flags=()
     if [ "${LOKI_CODEX_WEB_SEARCH:-false}" = "true" ]; then
-        extra_flags+=(--search)
+        pre_exec_flags+=(--search)
     fi
+    local extra_flags=()
     if [ "${LOKI_CODEX_OUTPUT_LAST:-true}" != "false" ] && [ -n "${LOKI_LOG_FILE:-}" ]; then
         extra_flags+=(--output-last-message "${LOKI_LOG_FILE}.last-message")
     fi
 
     LOKI_CODEX_REASONING_EFFORT="$effort" \
     CODEX_MODEL_REASONING_EFFORT="$effort" \
-    # Guard the extra_flags array expansion: with no web-search / output-last
-    # knobs the array is empty, and a bare "${arr[@]}" under `set -u` aborts with
+    # Guard the array expansions: with no web-search / output-last knobs an
+    # array is empty, and a bare "${arr[@]}" under `set -u` aborts with
     # "unbound variable" on bash 3.2 (stock macOS /bin/bash). ${arr[@]+...}
     # expands to nothing when empty and preserves spaced elements otherwise.
-    codex exec \
+    codex \
+        "${pre_exec_flags[@]+"${pre_exec_flags[@]}"}" \
+        exec \
         --sandbox workspace-write \
         --skip-git-repo-check \
         --model "$model" \

package/providers/models.sh

@@ -8,7 +8,7 @@
 #
 # Usage:
 #   source providers/models.sh
-#   model=$(loki_latest_model claude planning)   # -> claude-opus-4-7
+#   model=$(loki_latest_model claude planning)   # -> claude-opus-4-8
 #
 # Env override order: LOKI_<PROVIDER>_MODEL_<TIER> > LOKI_<PROVIDER>_MODEL > catalog latest.