loki-mode 7.129.5 → 8.0.1

package/bin/loki

@@ -32,6 +32,19 @@ SCRIPT_DIR=$(dirname "$SCRIPT_PATH")
 REPO_ROOT=$(cd "$SCRIPT_DIR/.." 2>/dev/null && pwd)
 BASH_CLI="$REPO_ROOT/autonomy/loki"
 
+# v8.1: resolve the one-switch SDK mode (LOKI_SDK_MODE=off|judges|full) into the
+# per-site LOKI_SDK_* flags HERE, in the outermost shim, BEFORE the `start`
+# routing fork below reads LOKI_SDK_LOOP. Without this, `LOKI_SDK_MODE=full loki
+# start` would run the judges on the SDK but silently keep the RARV loop on the
+# legacy bash binary, because the routing decision predates autonomy/loki's own
+# resolve. Same idempotent lib all three entrypoints source; exported flags reach
+# the child (bash or Bun). No-op when the mode is unset.
+if [ -f "$REPO_ROOT/autonomy/lib/sdk-mode.sh" ]; then
+    # shellcheck source=../autonomy/lib/sdk-mode.sh
+    source "$REPO_ROOT/autonomy/lib/sdk-mode.sh"
+    loki_sdk_resolve_mode
+fi
+
 # v7.89.0 telemetry TTY fix (council cH_r1): resolve interactivity EXACTLY ONCE
 # here, while this shim still owns the user's real TTY, and export it as an
 # explicit signal. The telemetry gates (telemetry.sh / crash.sh / dashboard
@@ -164,7 +177,7 @@ if [ -z "${LOKI_TELEMETRY_DISABLED:-}" ] && [ "${DO_NOT_TRACK:-}" != "1" ] && [
             _loki_disclose_telemetry_once
             # Fire-and-forget the installed event; detach all FDs (v7.8.3 broken-pipe fix).
             ( SCRIPT_DIR="$REPO_ROOT/autonomy"; source "$SCRIPT_DIR/telemetry.sh" 2>/dev/null \
-              && loki_telemetry "installed" "first_command=${1:-}" 2>/dev/null ) >/dev/null 2>&1 </dev/null &
+              && loki_telemetry "installed" "first_command=$(_loki_known_command "${1:-}")" 2>/dev/null ) >/dev/null 2>&1 </dev/null &
             disown 2>/dev/null || true
         fi
     fi
@@ -180,6 +193,45 @@ if [ "${LOKI_PROVIDER:-}" = "gemini" ]; then
     exit 1
 fi
 
+# First-run funnel, stage C: the activation ATTEMPT (first `loki start`).
+#
+# WHY HERE. This shim runs for BOTH routes before any exec, so one emit at this
+# point covers all four dispositions of a start: the Bun SDK fork, the
+# needs-bash divert, LOKI_LEGACY_BASH, and the no-Bun fallthrough. An emit down
+# in run.sh would be bash-route-only and would report installs climbing while
+# starts sat near zero under LOKI_SDK_MODE=full, which is exactly the blind spot
+# this is meant to close. Placed after the gemini guard (that path exits) and
+# before the LOKI_LEGACY_BASH check (which execs).
+#
+# `run` is the deprecated start alias and `quick` is grouped with them in the
+# bash config pre-pass, so all three count as an activation attempt.
+#
+# Gate: the strict EXISTING double gate, unchanged -- telemetry enabled AND
+# analytics explicitly opted in (_loki_analytics_enabled), default OFF even for
+# diagnostics-on users. No new consent knob, no new endpoint.
+#
+# Disclosure runs in the FOREGROUND first (the backgrounded emit has all three
+# FDs detached, so a disclosure printed in there would go to /dev/null and the
+# user would never see it), gated on the same analytics gate the egress uses so
+# we never disclose for an egress that will not happen. This mirrors the
+# cli_command sites below. No arguments are read, so nothing user-authored can
+# reach the payload.
+case "${1:-}" in
+    start|run|quick)
+        if command -v curl &>/dev/null && [ -f "$REPO_ROOT/autonomy/telemetry.sh" ]; then
+            if ( SCRIPT_DIR="$REPO_ROOT/autonomy"; source "$SCRIPT_DIR/telemetry.sh" 2>/dev/null \
+                 && declare -f _loki_analytics_enabled >/dev/null 2>&1 && _loki_analytics_enabled \
+                 && [ ! -f "${HOME}/.loki/funnel-start-attempted" ] ); then
+                _loki_disclose_telemetry_once
+            fi
+            ( SCRIPT_DIR="$REPO_ROOT/autonomy"; source "$SCRIPT_DIR/telemetry.sh" 2>/dev/null \
+              && loki_emit_funnel_once "start-attempted" "first_start_attempted" \
+                   "entry=$(_loki_known_command "${1:-}")" 2>/dev/null ) >/dev/null 2>&1 </dev/null &
+            disown 2>/dev/null || true
+        fi
+        ;;
+esac
+
 # Force-fall-through to bash when the rollback flag is set.
 if [ "${LOKI_LEGACY_BASH:-0}" = "1" ] || [ "${LOKI_LEGACY_BASH:-}" = "true" ]; then
     exec "$BASH_CLI" "$@"
@@ -191,6 +243,61 @@ if ! command -v bun &>/dev/null; then
     exec "$BASH_CLI" "$@"
 fi
 
+# v8 Phase 4: route `start` to the Bun RARV loop ONLY when LOKI_SDK_LOOP is on.
+# Default (unset) keeps `loki start` on the bash cmd_start, byte-identical. This
+# guard is AFTER the legacy check (LOKI_LEGACY_BASH=1 still force-overrides to
+# bash above) and AFTER the bun-presence check (a bun-less host already fell to
+# bash). Accepts 1|true to match the flag's documented =1 usage; bash cannot
+# cheaply reproduce truthy()'s yes/on spellings, so those are not honored here
+# (documented divergence, same as other bin/loki bool guards). v8.1: LOKI_SDK_LOOP
+# may also be set by the mode resolver above (LOKI_SDK_MODE=full -> LOOP=1), so
+# `LOKI_SDK_MODE=full loki start` now correctly routes the loop to Bun here.
+#
+# RUN-25 iter 2 (T3(c) pre-flight): the Bun runAutonomous loop handles the RARV
+# loop only. Orchestration flags that do pre-loop work the Bun loop does NOT do
+# (git-worktree parallel streams, GitHub/issue import, Docker sandbox, the API
+# server, backgrounding, alternate spec sources) must run on the bash route so the
+# user gets FULL behavior even with the loop flag on. Scan the start args for any
+# such flag (or an issue-ref positional) and, if present, DIVERT back to bash
+# instead of taking the Bun fork. This is the "pre-loop handled, not rejected"
+# guarantee that makes the eventual loop default-flip a no-regression. Runner
+# flags (--simple, --allow-haiku, --regen-prd, --skip-memory, provider knobs) are
+# handled by start.ts and do NOT divert. See artifacts/ITER1-FLAG-RECONCILE.md.
+_loki_start_needs_bash() {
+    # $@ = the start args (already know $1 = start). Return 0 (divert to bash) if
+    # any bash-only orchestration flag or an issue-ref spec is present.
+    local a
+    for a in "$@"; do
+        case "$a" in
+            --parallel|--bg|--background|--github|--api|--sandbox \
+            |--bmad-project|--openspec \
+            |--mirofish|--mirofish-docker|--mirofish-rounds|--mirofish-timeout|--mirofish-bg \
+            |--issue|--dry-run|--no-start|--output|--worktree|-w|--pr|--ship|--detach|-d)
+                return 0 ;;
+            --isolation)
+                # value follows; only worktree/docker/sandbox divert (none stays Bun).
+                _loki_iso_next=1 ;;
+            worktree|wt|docker|sandbox)
+                [ "${_loki_iso_next:-0}" = "1" ] && { unset _loki_iso_next; return 0; }
+                _loki_iso_next=0 ;;
+            *)
+                # issue-ref positional: owner/repo#N, a tracker URL, or *#<digits>.
+                case "$a" in
+                    */*\#[0-9]*|http*://*/issues/*|http*://*/browse/*) return 0 ;;
+                esac
+                _loki_iso_next=0 ;;
+        esac
+    done
+    unset _loki_iso_next
+    return 1
+}
+if [ "${1:-}" = "start" ] && { [ "${LOKI_SDK_LOOP:-}" = "1" ] || [ "${LOKI_SDK_LOOP:-}" = "true" ]; }; then
+    if _loki_start_needs_bash "${@:2}"; then
+        exec "$BASH_CLI" "$@"
+    fi
+    exec bun "$BUN_CLI" "$@"
+fi
+
 # CLI consolidation (Phase A): `trust detail` is the grouped form of the
 # trust-metrics breakdown. The Bun `trust` handler only knows the trajectory
 # view (it rejects unknown args), and Phase A moves no handler logic, so the
@@ -249,7 +356,7 @@ if [ "${1:-}" = "report" ]; then
                  && declare -f _loki_telemetry_enabled >/dev/null 2>&1 && _loki_telemetry_enabled ); then
                 _loki_disclose_telemetry_once
             fi
-            ( SCRIPT_DIR="$REPO_ROOT/autonomy"; source "$SCRIPT_DIR/telemetry.sh" 2>/dev/null && loki_telemetry "cli_command" "command=${1:-}" 2>/dev/null ) >/dev/null 2>&1 </dev/null &
+            ( SCRIPT_DIR="$REPO_ROOT/autonomy"; source "$SCRIPT_DIR/telemetry.sh" 2>/dev/null && loki_telemetry "cli_command" "command=$(_loki_known_command "${1:-}")" 2>/dev/null ) >/dev/null 2>&1 </dev/null &
             disown 2>/dev/null || true
         fi
         exec bun "$BUN_CLI" "$@"
@@ -291,7 +398,7 @@ case "${1:-}" in
                  && declare -f _loki_telemetry_enabled >/dev/null 2>&1 && _loki_telemetry_enabled ); then
                 _loki_disclose_telemetry_once
             fi
-            ( SCRIPT_DIR="$REPO_ROOT/autonomy"; source "$SCRIPT_DIR/telemetry.sh" 2>/dev/null && loki_telemetry "cli_command" "command=${1:-}" 2>/dev/null ) >/dev/null 2>&1 </dev/null &
+            ( SCRIPT_DIR="$REPO_ROOT/autonomy"; source "$SCRIPT_DIR/telemetry.sh" 2>/dev/null && loki_telemetry "cli_command" "command=$(_loki_known_command "${1:-}")" 2>/dev/null ) >/dev/null 2>&1 </dev/null &
             disown 2>/dev/null || true
         fi
         exec bun "$BUN_CLI" "$@"

package/completions/_loki

@@ -126,10 +126,12 @@ function _loki_commands {
         'monitor:Monitor Docker Compose services with auto-fix'
         'demo:Interactive 60-second demo'
         'tour:Offline sample receipt replay (no key, no spend)'
+        'welcome:Friendly first-run opener (what Loki is, next steps)'
         'init:Interactive PRD builder'
         'stop:Stop execution'
         'pause:Pause execution'
         'resume:Resume execution'
+        'steer:Steer a running build with a note (needs LOKI_PROMPT_INJECTION=1)'
         'status:Show status'
         'next:Run the right next step for the current build'
         'ship:Finish the build (gates + PR advice) in one command'
@@ -144,18 +146,26 @@ function _loki_commands {
         'notify:Notification commands'
         'import:Import GitHub issues'
         'issue:GitHub issue commands'
+        'github:GitHub integration commands'
         'config:Config commands'
         'provider:Provider commands'
         'reset:Reset session state'
         'memory:Memory commands'
         'compound:Knowledge compounding commands'
+        'checkpoint:Snapshot and restore session state'
         'council:Completion council commands'
         'dogfood:Self-development statistics'
         'projects:Project registry commands'
         'enterprise:Enterprise feature commands'
+        'secrets:Secrets and API key management'
+        'cockpit:Live cockpit view of a running build'
+        'secure:Secure-by-default gate (findings and waivers)'
+        'own:Finish-and-own ownership handoff'
         'telemetry:OpenTelemetry management'
         'agent:Agent type dispatch'
         'doctor:Check system prerequisites'
+        'watchdog:Watchdog process supervision'
+        'docs:Documentation commands'
         'onboard:Analyze repo and generate CLAUDE.md'
         'metrics:Session productivity report'
         'share:Share session report as GitHub Gist'

package/completions/loki.bash

@@ -5,7 +5,7 @@ _loki_completion() {
     _init_completion || return
 
     # Main subcommands (must match autonomy/loki main case statement)
-    local main_commands="start quick monitor demo tour init stop pause resume status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets doctor watchdog audit metrics syslog onboard share proof explain plan report cost kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
+    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own doctor watchdog audit metrics syslog onboard share proof explain plan report cost kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
 
     # 1. If we are on the first argument (subcommand)
     if [[ $cword -eq 1 ]]; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.129.5"
+__version__ = "8.0.1"
 
 # Expose the control app for easy import
 try:

package/dashboard/audit.py

@@ -22,6 +22,15 @@ import os
 import socket
 import sys
 import threading
+
+# POSIX-only. Used to serialize the tamper-evident chain append ACROSS PROCESSES
+# (threading.Lock cannot). Imported defensively so this module still loads on a
+# platform without it; the writer degrades to thread-only serialization rather
+# than refusing to record an audit entry.
+try:
+    import fcntl
+except ImportError:  # pragma: no cover - non-POSIX
+    fcntl = None  # type: ignore[assignment]
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any, Optional
@@ -59,6 +68,40 @@ _last_hash: str = "0" * 64  # Genesis hash
 _hash_lock = threading.Lock()
 
 
+def _tail_chain_hash(fh) -> "str | None":
+    """Return the _integrity_hash of the LAST well-formed line in an open log.
+
+    Called while holding the exclusive flock, so what it reads is the true chain
+    tip on disk rather than whatever this process last remembered. That is the
+    whole point: a second writer process must chain from the first writer's
+    entry, not from its own frozen import-time tip.
+
+    Returns None when there is nothing to chain from -- an empty file, or a tail
+    this function cannot parse. None means "no opinion", and the caller keeps its
+    existing _last_hash. It deliberately does NOT return a genesis or an empty
+    string on a parse failure: inventing a tip is how a chain silently re-roots,
+    which reads downstream as tampering. Scanning backwards means a torn final
+    line (a process killed mid-append) is skipped rather than treated as the tip.
+    """
+    try:
+        fh.seek(0)
+        lines = fh.read().splitlines()
+    except (OSError, UnicodeDecodeError):
+        return None
+
+    for raw in reversed(lines):
+        raw = raw.strip()
+        if not raw:
+            continue
+        try:
+            h = json.loads(raw).get("_integrity_hash")
+        except (ValueError, AttributeError):
+            continue  # torn or foreign line; keep looking back
+        if isinstance(h, str) and h:
+            return h
+    return None
+
+
 def _recover_last_hash() -> str:
     """Recover the last integrity hash from the most recent audit log file.
 
@@ -281,16 +324,62 @@ def log_event(
     # change and is intentionally not done here.
     global _last_hash
     with _hash_lock:
-        if INTEGRITY_ENABLED:
-            entry_json = json.dumps(entry, sort_keys=True, default=str)
-            entry["_integrity_hash"] = _compute_chain_hash(entry_json, _last_hash)
-            _last_hash = entry["_integrity_hash"]
-
         log_file = _get_current_log_file()
         _rotate_logs_if_needed(log_file)
 
-        with open(log_file, "a") as f:
-            f.write(json.dumps(entry) + "\n")
+        if not INTEGRITY_ENABLED:
+            with open(log_file, "a") as f:
+                f.write(json.dumps(entry) + "\n")
+            _forward_to_syslog(entry)
+            return entry
+
+        # CROSS-PROCESS serialization. _hash_lock is a threading.Lock, which has
+        # no meaning across processes, and _last_hash is resolved ONCE at import
+        # (see the _recover_last_hash call near the top of this module). Together
+        # those meant every concurrently-live writer PROCESS chained from its own
+        # frozen tip, silently forking the chain at write time with no tampering
+        # involved. Measured on a real machine: 25 of 67 audit files internally
+        # chain-broken, ~10k entries, spanning months and still occurring.
+        #
+        # That is not a cosmetic bug. This chain is the tamper-evidence: a
+        # verifier cannot distinguish "two writers raced" from "someone edited
+        # the log", so a self-inflicted fork burns the very signal the chain
+        # exists to provide. It fails LOUD rather than silent, which is the safe
+        # direction, but it destroys the guarantee either way.
+        #
+        # Fix: take an exclusive flock on the log file and re-derive the true
+        # tail INSIDE it, so the tip we chain from is whatever actually landed on
+        # disk, not what this process remembered. Best effort by design -- a
+        # platform without flock, or a filesystem that refuses it, degrades to
+        # the previous behavior rather than dropping the audit record. Losing an
+        # audit entry is worse than a fork.
+        with open(log_file, "a+") as f:
+            locked = False
+            try:
+                fcntl.flock(f.fileno(), fcntl.LOCK_EX)
+                locked = True
+            except (OSError, AttributeError, NameError):
+                pass  # no flock here; fall through unserialized
+
+            try:
+                if locked:
+                    tail = _tail_chain_hash(f)
+                    if tail is not None:
+                        _last_hash = tail
+
+                entry_json = json.dumps(entry, sort_keys=True, default=str)
+                entry["_integrity_hash"] = _compute_chain_hash(entry_json, _last_hash)
+                _last_hash = entry["_integrity_hash"]
+
+                f.seek(0, os.SEEK_END)
+                f.write(json.dumps(entry) + "\n")
+                f.flush()
+            finally:
+                if locked:
+                    try:
+                        fcntl.flock(f.fileno(), fcntl.LOCK_UN)
+                    except OSError:
+                        pass
 
     # Forward to syslog if configured (outside the lock: fire-and-forget and
     # must never extend the critical section / block other writers).