loki-mode 7.119.0 → 7.121.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.119.0
+# Loki Mode v7.121.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.119.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.121.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.119.0
+7.121.0

package/autonomy/checklist-verify.py

@@ -53,12 +53,19 @@ def run_check(check: dict, project_dir: str, timeout: int) -> dict:
 
     try:
         if check_type == "file_exists":
-            path = check.get("path", "")
+            # The checklist is LLM-emitted (generated_from a PRD), so the path
+            # field name is not pinnable: real checks in the wild carry the path
+            # under "path" OR "target" OR "file". Reading only "path" made a valid
+            # file_exists on a present file (target="package.json") raise
+            # "Invalid path characters: ''" -> None -> the item stuck 'pending' ->
+            # a correct build never reached a verified card. Alias the variants
+            # (same fake-inconclusive class as the grep/tests_pass runner bugs).
+            path = check.get("path") or check.get("target") or check.get("file") or ""
             full_path = _validate_path(path, project_dir)
             result["passed"] = os.path.exists(full_path)
 
         elif check_type == "file_contains":
-            path = check.get("path", "")
+            path = check.get("path") or check.get("target") or check.get("file") or ""
             pattern = check.get("pattern", "")
             if pattern and not _SAFE_PATTERN_RE.match(pattern):
                 result["passed"] = None
@@ -84,11 +91,47 @@ def run_check(check: dict, project_dir: str, timeout: int) -> dict:
                 result["passed"] = None
                 result["output"] = f"Unsafe pattern rejected: {pattern!r}"
             elif pattern:
-                # Use list form (shell=False) to prevent injection
-                if os.path.isfile(os.path.join(project_dir, "package.json")):
-                    cmd = ["npx", "jest", "--testPathPattern", pattern, "--passWithNoTests"]
+                # Runner-agnostic: use the PROJECT'S OWN declared test command
+                # rather than hardcoding a runner. A project's package.json
+                # "scripts.test" may be vitest / jest / mocha / node:test / ava /
+                # etc. Hardcoding `npx jest` was a fake-RED: on a vitest project
+                # (cdbbb5af, "test":"vitest run", jest not installed) `npx jest`
+                # either errored on the drifted --testPathPattern flag or npx tried
+                # to FETCH jest and timed out -> a genuinely-passing 26/26 suite read
+                # False/None ("tests not run") -> the item never reaches 'verified'
+                # -> a correct build never shows a verified card. Running the
+                # declared command runs the runner the build actually chose, so it
+                # is model-/complexity-agnostic. NB: we run the WHOLE declared suite
+                # (the per-item `pattern` is not a runner filter -- a mismatched
+                # vitest/jest filter can exit 0 with zero tests run = a fake-green).
+                pkg_path = os.path.join(project_dir, "package.json")
+                test_script = None
+                if os.path.isfile(pkg_path):
+                    try:
+                        with open(pkg_path) as _pf:
+                            _pkg = json.load(_pf)
+                        test_script = (_pkg.get("scripts") or {}).get("test")
+                    except (json.JSONDecodeError, OSError):
+                        test_script = None
+                if os.path.isfile(pkg_path):
+                    if test_script and test_script.strip():
+                        # `npm test` runs scripts.test with the project's local
+                        # runner on PATH; list-form + shell=False + cwd = same
+                        # posture as before (the engine already ran this exact
+                        # command to build the workspace -- not a new surface).
+                        cmd = ["npm", "test", "--silent"]
+                    else:
+                        # package.json but no test script -> nothing declared to
+                        # run. Do NOT invent a runner (that reintroduces the
+                        # hardcoded-runner fake-RED). Inconclusive, not a failure.
+                        result["passed"] = None
+                        result["output"] = (
+                            "No 'scripts.test' declared in package.json; cannot run "
+                            "the project's tests (inconclusive, not a failure)."
+                        )
+                        return result
                 else:
-                    cmd = ["python3", "-m", "pytest", "-q", pattern]
+                    cmd = ["python3", "-m", "pytest", "-q"]
                 try:
                     proc = subprocess.run(
                         cmd,
@@ -98,34 +141,39 @@ def run_check(check: dict, project_dir: str, timeout: int) -> dict:
                         timeout=timeout,
                     )
                     combined = proc.stdout + proc.stderr
-                    # Trust gate: a tests_pass check REQUIRES that at least one
-                    # test was actually discovered and run. jest is invoked with
-                    # --passWithNoTests, so a zero-match pattern exits 0 ("No
-                    # tests found ...") -- that would be a fake-green (a required
-                    # verification passing with nothing run). pytest exits 5 when
-                    # it collects no tests. Detect either no-test signal and fail
-                    # the check rather than report success on an empty run.
+                    _low = combined.lower()
+                    # Trust gate: a tests_pass check REQUIRES that at least one test
+                    # actually ran. A runner can exit 0 with nothing executed
+                    # (jest --passWithNoTests, a mismatched vitest filter, a no-op
+                    # `echo` test script) -> that would be a FAKE-GREEN (a required
+                    # verification passing with zero tests). Detect the no-test
+                    # signals across runners and refuse to pass on an empty run.
                     no_tests = (
-                        "No tests found" in combined
-                        or "no tests ran" in combined.lower()
-                        or "no tests to run" in combined.lower()
-                        or proc.returncode == 5  # pytest: no tests collected
+                        "no tests found" in _low            # jest
+                        or "no test files found" in _low    # vitest
+                        or "no tests ran" in _low           # pytest/jest phrasing
+                        or "no tests to run" in _low
+                        or proc.returncode == 5             # pytest: none collected
                     )
                     if no_tests:
                         result["passed"] = False
                         result["output"] = (
                             "No tests discovered for required check "
-                            f"(pattern={pattern!r}); a tests_pass check must run "
-                            "at least one test. Output: "
+                            "(a tests_pass check must run at least one test). "
+                            "Output: "
                         ) + combined[:400]
                     else:
+                        # rc==0 with tests run -> True; ran and FAILED -> False
+                        # (blocks). "Ran and failed" is an honest False; only a
+                        # runner that could not RUN (timeout / not found, below)
+                        # is inconclusive None -- same moat as grep_codebase.
                         result["passed"] = proc.returncode == 0
                         result["output"] = combined[:500]
                 except subprocess.TimeoutExpired:
-                    result["passed"] = None  # timeout = pending
+                    result["passed"] = None  # timeout = pending (couldn't run)
                     result["output"] = f"Timed out after {timeout}s"
                 except FileNotFoundError:
-                    result["passed"] = None
+                    result["passed"] = None  # runner not found = couldn't run
                     result["output"] = "Test runner not found"
             else:
                 result["passed"] = None
@@ -169,9 +217,17 @@ def run_check(check: dict, project_dir: str, timeout: int) -> dict:
             elif pattern:
                 try:
                     # grep with --exclude-dir for safety (no .git, node_modules)
-                    # Use '--' to prevent pattern being interpreted as flags
+                    # Use '--' to prevent pattern being interpreted as flags.
+                    # Use -E (ERE) NOT the default BRE: LLM-emitted patterns are
+                    # ERE/PCRE-flavoured (e.g. app\.get\('/api/tasks'). In BRE an
+                    # escaped `\(` is a GROUP-OPEN, so an unmatched one makes grep
+                    # error 'parentheses not balanced' (rc=2) -- a fake-RED that
+                    # marked 3 present endpoints failing -> a 64-min non-converging
+                    # build (#142/#124). Under -E, `\(` is a LITERAL paren (no
+                    # error) AND quantifiers `.` `*` `+` keep their regex meaning,
+                    # so a present-as-regex endpoint matches instead of erroring.
                     proc = subprocess.run(
-                        ["grep", "-r", "-l",
+                        ["grep", "-r", "-l", "-E",
                          "--exclude-dir=.git", "--exclude-dir=node_modules",
                          "--exclude-dir=.loki", "--exclude-dir=__pycache__",
                          "--", pattern, "."],
@@ -180,9 +236,74 @@ def run_check(check: dict, project_dir: str, timeout: int) -> dict:
                         text=True,
                         timeout=timeout,
                     )
-                    result["passed"] = proc.returncode == 0
-                    files_found = proc.stdout.strip().split("\n") if proc.stdout.strip() else []
-                    result["output"] = f"Found in {len(files_found)} file(s)"
+                    # grep exit codes: 0=match found, 1=no match, >=2=ERROR (bad
+                    # regex, unreadable file, or a grep variant -- e.g. ugrep on
+                    # macOS -- that rejects a pattern GNU grep accepts). A grep that
+                    # ERRORED has NOT proven the pattern is absent, so it must be
+                    # INCONCLUSIVE (passed=None), NOT a hard False. Collapsing an
+                    # error to False is a fake-RED: it marks a genuinely-present
+                    # endpoint 'failing' -> the council hard-gate blocks a correct
+                    # build forever (observed: an LLM-emitted pattern app\.get\('...'
+                    # made ugrep error position-26 mismatched-paren -> returncode 2
+                    # -> 3 working endpoints read failing -> a 64-min non-converging
+                    # build). Only a clean 1 (real no-match) is an honest False.
+                    if proc.returncode == 0:
+                        result["passed"] = True
+                        files_found = proc.stdout.strip().split("\n") if proc.stdout.strip() else []
+                        result["output"] = f"Found in {len(files_found)} file(s)"
+                    elif proc.returncode == 1:
+                        result["passed"] = False
+                        result["output"] = "Found in 0 file(s)"
+                    else:
+                        # rc>=2 = grep ERROR even under -E (e.g. a genuinely
+                        # malformed pattern, or an unreadable file). Do NOT collapse
+                        # to False (fake-RED) and do NOT punt straight to
+                        # inconclusive (that opens a fake-green: an ABSENT endpoint
+                        # whose pattern also errors would read pending, not failing).
+                        # RECOVER real signal by retrying as a FIXED string (grep -F,
+                        # escapes stripped to the intended literal), which cannot
+                        # error on metacharacters. A fixed-string retry is a strict
+                        # subset match: rc=0 (literal present) is a sound True; a
+                        # literal-absent rc=1 keeps the honest-False moat for the
+                        # common case. Only if -F ALSO errors is the check truly
+                        # unrecoverable -> inconclusive (None), never a hard fail.
+                        # NB: the -E primary already resolves the whole LLM
+                        # escaped-paren class, so this branch is now rarely reached.
+                        literal = re.sub(r'\\(.)', r'\1', pattern)
+                        try:
+                            proc2 = subprocess.run(
+                                ["grep", "-r", "-l", "-F",
+                                 "--exclude-dir=.git", "--exclude-dir=node_modules",
+                                 "--exclude-dir=.loki", "--exclude-dir=__pycache__",
+                                 "--", literal, "."],
+                                cwd=project_dir, capture_output=True,
+                                text=True, timeout=timeout,
+                            )
+                        except subprocess.TimeoutExpired:
+                            proc2 = None
+                        if proc2 is not None and proc2.returncode == 0:
+                            files_found = proc2.stdout.strip().split("\n") if proc2.stdout.strip() else []
+                            result["passed"] = True
+                            result["output"] = f"Found in {len(files_found)} file(s) (fixed-string retry after regex error)"
+                        else:
+                            # -F rc=1 (literal absent) or rc>=2 (also errored) ->
+                            # INCONCLUSIVE (None), never False. Once -E has failed to
+                            # parse the pattern, the escape-stripped literal cannot
+                            # distinguish "present only via a regex quantifier" from
+                            # "genuinely absent" -- so a literal-absent here is NOT
+                            # proof of absence. Mapping it to False would re-open the
+                            # narrowed fake-RED. None -> item 'pending' (never blocks
+                            # a correct build); a genuinely-absent endpoint is caught
+                            # by the -E primary's honest rc=1 False above, not here.
+                            result["passed"] = None
+                            _err = (proc.stderr or "").strip().splitlines()
+                            _why = ("literal-absent, cannot prove absence"
+                                    if (proc2 is not None and proc2.returncode == 1)
+                                    else (_err[0] if _err else f"exit {proc.returncode}"))
+                            result["output"] = (
+                                "grep regex error, unrecoverable (inconclusive, not a failure): "
+                                + _why
+                            )[:200]
                 except subprocess.TimeoutExpired:
                     result["passed"] = None
                     result["output"] = f"Timed out after {timeout}s"

package/autonomy/run.sh

@@ -9317,6 +9317,21 @@ _loki_zero_tests_executed() {
             fi
             return 1
             ;;
+        unittest)
+            # #139: `python3 -m unittest discover` on ZERO discovered tests prints
+            # "Ran 0 tests" + "NO TESTS RAN". Depending on the Python version it
+            # exits 5 (newer, already not-pass) OR 0 (older = a silent fake-green,
+            # the #82/#89 trap). POSITIVE detection so it is inconclusive on BOTH:
+            # a "Ran 0 tests" line (authoritative), or the "NO TESTS RAN" banner,
+            # AND no ran-count >= 1. A real run prints "Ran N test(s)" with N>=1
+            # and "OK"/"FAILED", so it is never downgraded. Verified live: zero ->
+            # "Ran 0 tests"/"NO TESTS RAN"; one -> "Ran 1 test"/"OK".
+            if printf '%s' "$_zt_out" | grep -qE '^Ran 0 tests' 2>/dev/null \
+               || printf '%s' "$_zt_out" | grep -qE '^NO TESTS RAN$' 2>/dev/null; then
+                return 0
+            fi
+            return 1
+            ;;
         *)
             # Unknown/unparseable runner -> never claim zero-tests (safe default).
             return 1
@@ -9483,6 +9498,17 @@ sys.stdout.write(t.strip())
                 -print -quit 2>/dev/null | grep -q .; then
                 has_python_project=true
             fi
+        elif find "${TARGET_DIR:-.}" -maxdepth 2 -type f \
+                \( -name 'test_*.py' -o -name '*_test.py' \) \
+                -not -path '*/.loki/*' -not -path '*/.git/*' -not -path '*/node_modules/*' \
+                -not -path '*/.venv/*' -not -path '*/venv/*' \
+                -print -quit 2>/dev/null | grep -q .; then
+            # #139: a ROOT-LEVEL (or shallow) test_*.py / *_test.py with NO tests/
+            # dir and NO config file. The founder's invoice CLI had exactly this
+            # shape (test_invoice_cli.py at the root) -> was missed -> tests read
+            # "not run" on a genuinely-passing 16-test unittest suite. This is the
+            # same false-negative class as #79 (validated work reads as unvalidated).
+            has_python_project=true
         fi
         if [ "$has_python_project" = "true" ] && command -v pytest &>/dev/null; then
             test_runner="pytest"
@@ -9499,6 +9525,29 @@ sys.stdout.write(t.strip())
                 [ "$pytest_exit" -ne 0 ] && test_passed=false
                 details="pytest: $(echo "$output" | tail -5 | tr '\n' ' ')"
             fi
+        elif [ "$has_python_project" = "true" ] && command -v python3 &>/dev/null; then
+            # #139: pytest ABSENT but a Python test suite exists. stdlib unittest
+            # discovery runs test_*.py with ZERO third-party deps -- so a legit
+            # unittest suite (the invoice CLI's 16 tests) is verified instead of
+            # silently read as "not run". The zero-test guard (unittest case) makes
+            # a zero-discovery run inconclusive, NOT a fake-green pass (unittest
+            # prints "NO TESTS RAN" and exits 0 -- the #82/#89 trap, guarded).
+            test_runner="unittest"
+            local output unittest_exit _ut_to
+            _ut_to="${LOKI_PYTEST_TIMEOUT:-${LOKI_GATE_TIMEOUT:-300}}"
+            local _ut_cmd=(timeout "${_ut_to}s")
+            command -v gtimeout &>/dev/null && _ut_cmd=(gtimeout "${_ut_to}s")
+            command -v timeout &>/dev/null || command -v gtimeout &>/dev/null || _ut_cmd=()
+            output=$(cd "${TARGET_DIR:-.}" && "${_ut_cmd[@]}" python3 -m unittest discover -p 'test_*.py' 2>&1)
+            unittest_exit=$?
+            if [ "$unittest_exit" -eq 124 ]; then
+                test_passed=false
+                log_warn "unittest gate timed out after ${_ut_to}s (exit 124)"
+                details="unittest: TIMED OUT after ${_ut_to}s -- $(echo "$output" | tail -3 | tr '\n' ' ')"
+            else
+                [ "$unittest_exit" -ne 0 ] && test_passed=false
+                details="unittest: $(echo "$output" | tail -5 | tr '\n' ' ')"
+            fi
         fi
     fi
 

package/autonomy/verify.sh

@@ -350,6 +350,18 @@ _verify_zero_tests_executed() {
             fi
             return 1
             ;;
+        unittest)
+            # #139: `python3 -m unittest discover` on ZERO discovered tests prints
+            # "Ran 0 tests" + "NO TESTS RAN". On older Python it EXITS 0 (a silent
+            # fake-green), on newer it exits 5 (already not-pass). POSITIVE detection
+            # so it is inconclusive on BOTH. A real run prints "Ran N test(s)" (N>=1)
+            # + "OK"/"FAILED" -> never downgraded. Mirrors run.sh's guard exactly.
+            if printf '%s' "$_zt_out" | grep -qE '^Ran 0 tests' 2>/dev/null \
+               || printf '%s' "$_zt_out" | grep -qE '^NO TESTS RAN$' 2>/dev/null; then
+                return 0
+            fi
+            return 1
+            ;;
         *)
             return 1
             ;;
@@ -411,8 +423,15 @@ verify_gate_tests() {
         # them so the gate runs (or goes inconclusive -> CONCERNS when no
         # runner is installed), never silently skipped.
         if [ "$has_python" = "false" ]; then
-            if find "$tree" -maxdepth 1 -type f \
+            # maxdepth 2 (was 1) + exclusions to MIRROR run.sh's enforce_test_coverage
+            # detection exactly (#139 parity): a shallow-but-not-root test_*.py (e.g.
+            # a src/-adjacent test) is now seen by BOTH gates, not just run.sh. Still
+            # the safe direction (under-detect only, never a fake-green): worst case a
+            # deeper test dir is inconclusive, never falsely VERIFIED.
+            if find "$tree" -maxdepth 2 -type f \
                 \( -name 'test_*.py' -o -name '*_test.py' \) \
+                -not -path '*/.loki/*' -not -path '*/.git/*' -not -path '*/node_modules/*' \
+                -not -path '*/.venv/*' -not -path '*/venv/*' \
                 -print -quit 2>/dev/null | grep -q .; then
                 has_python=true
             fi
@@ -421,9 +440,19 @@ verify_gate_tests() {
             if command -v pytest >/dev/null 2>&1; then
                 runner="pytest"
                 out="$(cd "$tree" && timeout "$timeout_s" pytest --tb=short 2>&1)" || rc=$?
+            elif command -v python3 >/dev/null 2>&1; then
+                # #139 parity: pytest ABSENT but a Python suite exists -> run it with
+                # stdlib unittest (zero third-party deps) instead of going blindly
+                # inconclusive. A real passing test_*.py suite is now VERIFIED here
+                # too, matching run.sh's enforce_test_coverage. Zero-discovery is
+                # handled below (unittest exits 5 on newer Python = fail-not-pass, or
+                # a "Ran 0 tests" line detected by the zero-test guard on the run.sh
+                # mirror) so this never green-washes an empty suite.
+                runner="unittest"
+                out="$(cd "$tree" && timeout "$timeout_s" python3 -m unittest discover -p 'test_*.py' 2>&1)" || rc=$?
             else
                 # Applicable but cannot run -> inconclusive (Entanglement 2).
-                _verify_add_gate "tests" "inconclusive" "pytest" "python project detected but pytest not on PATH" "true"
+                _verify_add_gate "tests" "inconclusive" "pytest" "python project detected but no pytest/python3 on PATH" "true"
                 return 0
             fi
         fi

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.119.0"
+__version__ = "7.121.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.119.0
+**Version:** v7.121.0
 
 ---
 

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.119.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
+var q8=Object.defineProperty;var J8=($)=>$;function V8($,Q){this[$]=J8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)q8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:V8.bind(Q,Z)})};var P=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var m1={};b(m1,{lokiDir:()=>j,homeLokiDir:()=>T$,findRepoRootForVersion:()=>$1,REPO_ROOT:()=>h});import{resolve as t,dirname as e$}from"path";import{fileURLToPath as W8}from"url";import{existsSync as N$}from"fs";import{homedir as H8}from"os";function G8(){let $=v1;for(let Q=0;Q<6;Q++){if(N$(t($,"VERSION"))&&N$(t($,"autonomy/run.sh")))return $;let Z=e$($);if(Z===$)break;$=Z}return t(v1,"..","..","..")}function $1($){let Q=$;for(let Z=0;Z<6;Z++){if(N$(t(Q,"VERSION"))&&N$(t(Q,"autonomy/run.sh")))return Q;let z=e$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function j(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(H8(),".loki")}var v1,h;var C=P(()=>{v1=e$(W8(import.meta.url));h=G8()});import{readFileSync as U8}from"fs";import{resolve as Y8,dirname as B8}from"path";import{fileURLToPath as M8}from"url";function S$(){if(Q$!==null)return Q$;let $="7.121.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=B8(M8(import.meta.url)),Z=$1(Q);Q$=U8(Y8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var Q1=P(()=>{C()});var p1={};b(p1,{runOrThrow:()=>S8,run:()=>R,readStreamCapped:()=>c1,commandVersion:()=>C8,commandExists:()=>u,ShellError:()=>Z1,MAX_STDOUT_BYTES:()=>u1});async function c1($,Q=u1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function R($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([c1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function S8($,Q={}){let Z=await R($,Q);if(Z.exitCode!==0)throw new Z1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function u($){let Q=D8($),Z=await R(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function D8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function C8($,Q="--version"){if(!await u($))return null;let z=await R([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var u1=16777216,Z1;var o=P(()=>{Z1=class Z1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return b8?"":$}var b8,M,S,_,tZ,L,k,y,J;var p=P(()=>{b8=(process.env.NO_COLOR??"").length>0;M=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),tZ=r("\x1B[0;34m"),L=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as l8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(l8($))return A$=$,$;let Q=await u("python3.12");if(Q)return A$=Q,Q;let Z=await u("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return R([Z,"-c",$],Q)}var A$;var V$=P(()=>{o()});var V0={};b(V0,{runStatus:()=>U3});import{existsSync as v,readFileSync as H$,readdirSync as $0,statSync as Q0}from"fs";import{resolve as D,basename as z3}from"path";import{homedir as X3}from"os";function Z0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function z0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*C$/Q);if(X>C$)X=C$;let q=C$-X,K=S;if(z>=80)K=M;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=Z0($),H=Z0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${H})`}async function q3(){if(await u("jq"))return!0;return process.stdout.write(`${M}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -814,4 +814,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(K8),2}}e1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var SZ=await NZ(Bun.argv.slice(2));process.exit(SZ);
 
-//# debugId=7B2014E7E7C6AC4464756E2164756E21
+//# debugId=3745511B1A35D37D64756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.119.0'
+__version__ = '7.121.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.119.0",
+  "version": "7.121.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.119.0",
+  "version": "7.121.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",