loki-mode 7.113.0 → 7.115.0

package/autonomy/verify.sh

@@ -170,6 +170,71 @@ verify_diff_base() {
     return 0
 }
 
+# ---------------------------------------------------------------------------
+# Code-scope / locality record (rank 10, ADVISORY-FIRST).
+#
+# Turns the already-computed VERIFY_DIFF_FILES / VERIFY_DIFF_INS / VERIFY_DIFF_DEL
+# into a structured scope record: {files_changed, net_lines, verdict, thresholds}.
+# net_lines is line GROWTH (insertions - deletions), matching "net line growth" --
+# it goes negative on deletion-heavy diffs (only growth trips a threshold).
+#
+# ADVISORY BY DEFAULT. The verdict is a LABEL in the record only; this helper does
+# NOT emit a gate row and does NOT feed verify_compute_verdict, so it can never
+# change the exit code or block a build (the friction-regression guard, and the
+# greenfield byte-identity guarantee -- loki start never reaches verify_main).
+#
+# Thresholds:
+#   - Soft thresholds (LOKI_SCOPE_SOFT_FILES / LOKI_SCOPE_SOFT_NET_LINES) have sane
+#     defaults; exceeding a soft threshold with NO hard cap set -> verdict "warn".
+#   - Hard caps (LOKI_SCOPE_MAX_FILES / LOKI_SCOPE_MAX_NET_LINES) are OPT-IN: only
+#     when such an env var is EXPLICITLY SET and exceeded does the verdict become
+#     "block". Even then this record does not by itself block the build; it is the
+#     opt-in signal a consumer/enforcer can act on.
+#   - Under all applicable thresholds -> "ok".
+#
+# Sets globals: VERIFY_SCOPE_FILES VERIFY_SCOPE_NET_LINES VERIFY_SCOPE_VERDICT
+#               VERIFY_SCOPE_SOFT_FILES VERIFY_SCOPE_SOFT_NET_LINES
+#               VERIFY_SCOPE_MAX_FILES VERIFY_SCOPE_MAX_NET_LINES (empty when unset)
+# ---------------------------------------------------------------------------
+verify_scope_record() {
+    local files="${VERIFY_DIFF_FILES:-0}"
+    local ins="${VERIFY_DIFF_INS:-0}"
+    local del="${VERIFY_DIFF_DEL:-0}"
+    local net=$(( ins - del ))
+
+    # Soft advisory thresholds (defaults; overridable).
+    local soft_files="${LOKI_SCOPE_SOFT_FILES:-25}"
+    local soft_net="${LOKI_SCOPE_SOFT_NET_LINES:-500}"
+    # Hard caps are opt-in: unset means "never block".
+    local max_files="${LOKI_SCOPE_MAX_FILES:-}"
+    local max_net="${LOKI_SCOPE_MAX_NET_LINES:-}"
+
+    local verdict="ok"
+
+    # Hard-cap check first (only when explicitly set) -> "block".
+    if [ -n "$max_files" ] && [ "$files" -gt "$max_files" ] 2>/dev/null; then
+        verdict="block"
+    elif [ -n "$max_net" ] && [ "$net" -gt "$max_net" ] 2>/dev/null; then
+        verdict="block"
+    # Soft threshold (advisory, no hard cap tripped) -> "warn".
+    elif [ "$files" -gt "$soft_files" ] 2>/dev/null; then
+        verdict="warn"
+    elif [ "$net" -gt "$soft_net" ] 2>/dev/null; then
+        verdict="warn"
+    fi
+
+    VERIFY_SCOPE_FILES="$files"
+    VERIFY_SCOPE_NET_LINES="$net"
+    VERIFY_SCOPE_VERDICT="$verdict"
+    VERIFY_SCOPE_SOFT_FILES="$soft_files"
+    VERIFY_SCOPE_SOFT_NET_LINES="$soft_net"
+    VERIFY_SCOPE_MAX_FILES="$max_files"
+    VERIFY_SCOPE_MAX_NET_LINES="$max_net"
+
+    _verify_log "scope: $files files, net $net lines -> $verdict (soft $soft_files/$soft_net, hard ${max_files:-unset}/${max_net:-unset})"
+    return 0
+}
+
 # ---------------------------------------------------------------------------
 # Gate: build (faithful extension of run.sh language detection).
 #
@@ -916,6 +981,100 @@ PYEOF
     return 0
 }
 
+# ---------------------------------------------------------------------------
+# Setup-recipe WRITER (rank 7). Writes .loki/setup-recipe.json after a VERIFIED
+# runtime boot, capturing the deterministic steps to reach a runnable state so
+# later verify/e2e runs replay the recipe instead of re-detecting heuristically
+# (the CONSUMER already exists in _verify_runtime_detect: it reads "start"/"port").
+#
+# Keys: {install, seed, env_keys, start, health_path, port}.
+#   - env_keys are env var NAMES ONLY, harvested from .env.example / .env in the
+#     tree (left side of `NAME=value`). SECRET VALUES ARE NEVER PERSISTED.
+#   - install/seed are best-effort deterministic detections (npm ci / pip install
+#     / go mod download; a seed script when present). Empty string when unknown.
+#
+# Best effort and fail-open: any failure leaves no recipe and never changes the
+# gate outcome. Called ONLY from the boot-pass branch, so a failed boot writes
+# nothing.
+#
+# Args: $1 tree  $2 start_command  $3 port  $4 health_path
+# ---------------------------------------------------------------------------
+_verify_write_setup_recipe() {
+    local tree="$1" start="$2" port="$3" health_path="$4"
+    command -v python3 >/dev/null 2>&1 || return 0
+    [ -d "$tree" ] || return 0
+
+    # Detect a deterministic install command from the tree (best effort).
+    local install=""
+    if [ -f "$tree/package-lock.json" ]; then
+        install="npm ci"
+    elif [ -f "$tree/package.json" ]; then
+        install="npm install"
+    elif [ -f "$tree/requirements.txt" ]; then
+        install="pip install -r requirements.txt"
+    elif [ -f "$tree/go.mod" ]; then
+        install="go mod download"
+    elif [ -f "$tree/Cargo.toml" ]; then
+        install="cargo fetch"
+    fi
+
+    # Detect a seed step (best effort): package.json "seed" script, else empty.
+    local seed=""
+    if [ -f "$tree/package.json" ] && grep -q '"seed"[[:space:]]*:' "$tree/package.json" 2>/dev/null; then
+        seed="npm run seed"
+    fi
+
+    # Harvest env var NAMES only from .env.example / .env (never the values).
+    # The python writer parses these; we hand it the file paths that exist.
+    local env_src=""
+    [ -f "$tree/.env.example" ] && env_src="$tree/.env.example"
+    [ -z "$env_src" ] && [ -f "$tree/.env" ] && env_src="$tree/.env"
+
+    _SR_DIR="$tree/.loki" _SR_INSTALL="$install" _SR_SEED="$seed" \
+    _SR_START="$start" _SR_HEALTH="$health_path" _SR_PORT="$port" \
+    _SR_ENVSRC="$env_src" \
+    python3 - <<'PYEOF' 2>/dev/null || return 0
+import json, os, re
+
+out_dir = os.environ["_SR_DIR"]
+
+# env_keys: NAMES ONLY. Parse KEY=VALUE / export KEY=VALUE lines, keep the KEY.
+# The value side is never read into the recipe (security AC).
+env_keys = []
+src = os.environ.get("_SR_ENVSRC") or ""
+if src and os.path.exists(src):
+    seen = set()
+    try:
+        with open(src) as f:
+            for line in f:
+                line = line.strip()
+                if not line or line.startswith("#") or "=" not in line:
+                    continue
+                name = line.split("=", 1)[0].strip()
+                name = re.sub(r"^export\s+", "", name)
+                if re.match(r"^[A-Za-z_][A-Za-z0-9_]*$", name) and name not in seen:
+                    seen.add(name)
+                    env_keys.append(name)
+    except Exception:
+        env_keys = []
+
+recipe = {
+    "install": os.environ.get("_SR_INSTALL", ""),
+    "seed": os.environ.get("_SR_SEED", ""),
+    "env_keys": env_keys,
+    "start": os.environ.get("_SR_START", ""),
+    "health_path": os.environ.get("_SR_HEALTH", "") or "/",
+    "port": os.environ.get("_SR_PORT", ""),
+}
+
+os.makedirs(out_dir, exist_ok=True)
+with open(os.path.join(out_dir, "setup-recipe.json"), "w") as f:
+    json.dump(recipe, f, indent=2)
+    f.write("\n")
+PYEOF
+    return 0
+}
+
 verify_gate_runtime() {
     local tree="$1"
     # Opt-out (default on). Disabled -> emit no row -> byte-identical.
@@ -1055,6 +1214,11 @@ verify_gate_runtime() {
             "Runtime boot smoke failed: '$method' booted but returned HTTP $http_status on $url (server error)."
     else
         _verify_add_gate "runtime" "pass" "boot" "$summary" "true"
+        # Setup-recipe WRITER (rank 7). Only on a VERIFIED boot (2xx/3xx/4xx):
+        # persist a deterministic .loki/setup-recipe.json that the runtime
+        # detector (_verify_runtime_detect) consumes first on later runs. Env var
+        # NAMES only, never secret VALUES. Best effort; never changes the verdict.
+        _verify_write_setup_recipe "$tree" "$method" "$probe_port" "$health_path" || true
     fi
 
     # Record a structured runtime artifact alongside the gate row so the boot is
@@ -1339,6 +1503,13 @@ verify_emit_evidence() {
     _V_BLOCKON="$block_on" \
     _V_LEDGER_SHA="${_VERIFY_EXPECT_LEDGER_SHA:-}" \
     _V_LEDGER_HASHOK="${_VERIFY_EXPECT_LEDGER_HASH_OK:-}" \
+    _V_SCOPE_FILES="${VERIFY_SCOPE_FILES:-}" \
+    _V_SCOPE_NET="${VERIFY_SCOPE_NET_LINES:-}" \
+    _V_SCOPE_VERDICT="${VERIFY_SCOPE_VERDICT:-}" \
+    _V_SCOPE_SOFT_FILES="${VERIFY_SCOPE_SOFT_FILES:-}" \
+    _V_SCOPE_SOFT_NET="${VERIFY_SCOPE_SOFT_NET_LINES:-}" \
+    _V_SCOPE_MAX_FILES="${VERIFY_SCOPE_MAX_FILES:-}" \
+    _V_SCOPE_MAX_NET="${VERIFY_SCOPE_MAX_NET_LINES:-}" \
     python3 - <<'PYEOF'
 import json, os, hashlib
 
@@ -1432,6 +1603,33 @@ if _ledger_sha:
         "hash_ok": (os.environ.get("_V_LEDGER_HASHOK") == "true"),
     }
 
+# Code-scope / locality record (rank 10, advisory-first). Additive top-level
+# "scope" object; the verdict here is a LABEL only and never affects the
+# document's authoritative verdict/exit_code. Emitted only when the scope helper
+# ran (env set), so evidence.json stays byte-identical on paths that skip it.
+_scope_verdict = os.environ.get("_V_SCOPE_VERDICT") or ""
+if _scope_verdict:
+    def _to_int(name, default=0):
+        v = os.environ.get(name) or ""
+        try:
+            return int(v)
+        except (TypeError, ValueError):
+            return default
+    _thresholds = {
+        "soft_files": _to_int("_V_SCOPE_SOFT_FILES"),
+        "soft_net_lines": _to_int("_V_SCOPE_SOFT_NET"),
+        # Hard caps are opt-in; None when not explicitly set.
+        "max_files": (_to_int("_V_SCOPE_MAX_FILES") if (os.environ.get("_V_SCOPE_MAX_FILES") or "") != "" else None),
+        "max_net_lines": (_to_int("_V_SCOPE_MAX_NET") if (os.environ.get("_V_SCOPE_MAX_NET") or "") != "" else None),
+    }
+    doc["scope"] = {
+        "files_changed": _to_int("_V_SCOPE_FILES"),
+        "net_lines": _to_int("_V_SCOPE_NET"),
+        "verdict": _scope_verdict,
+        "advisory": True,
+        "thresholds": _thresholds,
+    }
+
 os.makedirs(out_dir, exist_ok=True)
 ev_path = os.path.join(out_dir, "evidence.json")
 with open(ev_path, "w") as f:
@@ -2069,6 +2267,11 @@ verify_main() {
 
     verify_diff_base "$base_ref"
 
+    # Code-scope / locality record (rank 10, advisory-first). Reads the diff
+    # stats verify_diff_base just computed; never emits a gate row or feeds the
+    # verdict, so it can never block or change the exit code.
+    verify_scope_record
+
     # Short-circuit on an empty or unresolvable change set. A verifier verifies
     # a CHANGE; with nothing to verify there is no basis for a VERIFIED verdict.
     # Recording the gates as skipped (rather than running them against the whole

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.113.0"
+__version__ = "7.115.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.113.0
+**Version:** v7.115.0
 
 ---
 

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.113.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
+var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.115.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -814,4 +814,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(K8),2}}e1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var SZ=await NZ(Bun.argv.slice(2));process.exit(SZ);
 
-//# debugId=F380D5B346BDE4D764756E2164756E21
+//# debugId=7679240CF905E39B64756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.113.0'
+__version__ = '7.115.0'

package/mcp/lsp_proxy.py

@@ -1595,8 +1595,49 @@ def main() -> None:
              'install dir -- the install dir is only the import path for '
              '`-m mcp.lsp_proxy`.',
     )
+    parser.add_argument(
+        '--check-symbols', action='store_true',
+        help='One-shot: read a newline-delimited list of symbol names on stdin '
+             'and, for each, run lsp_check_exists against the workspace at '
+             '--root. Emits JSON {"available": bool, "results": {sym: '
+             'true|false|null}} on stdout. available=false / null verdicts mean '
+             'no language server was reachable (honest inconclusive, never a '
+             'fabricated exists). Same cwd/--root contract as --write-diagnostics: '
+             'cwd is the install dir so `-m mcp.lsp_proxy` imports; --root is the '
+             'TARGET project the symbols must exist in.',
+    )
     args = parser.parse_args()
 
+    if args.check_symbols:
+        # One-shot symbol-existence probe for the acceptance-oracle (source-
+        # grounded checklist). Chdir into --root so the in-process LSP client's
+        # _resolve_workspace_root()/_pick_language_for_workspace() see the TARGET
+        # project (the process cwd is the install dir for the import). Always
+        # cleans up spawned language-server subprocesses via the finally arm.
+        target = os.path.abspath(args.root or os.getcwd())
+        symbols = [ln.strip() for ln in sys.stdin.read().splitlines() if ln.strip()]
+        results: Dict[str, Any] = {}
+        available = False
+        try:
+            if os.path.isdir(target):
+                os.chdir(target)
+            for sym in symbols:
+                try:
+                    raw = _lsp_check_exists_blocking(sym)
+                    parsed = json.loads(raw)
+                except (OSError, ValueError):
+                    results[sym] = None
+                    continue
+                exists = parsed.get('exists', None)
+                results[sym] = exists
+                # A non-null verdict on ANY symbol means the server answered.
+                if exists is not None:
+                    available = True
+        finally:
+            _cleanup_all_clients()
+        print(json.dumps({'available': available, 'results': results}))
+        return
+
     if args.write_diagnostics:
         # One-shot writer mode -- no MCP server, no event loop. Always cleans
         # up any spawned LSP clients before exit. `--root` is the TARGET

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.113.0",
+  "version": "7.115.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.113.0",
+  "version": "7.115.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",