loki-mode 7.18.1 → 7.18.3

package/autonomy/loki

@@ -61,6 +61,13 @@ if [ -f "$_LOKI_SCRIPT_DIR/tui.sh" ]; then
     source "$_LOKI_SCRIPT_DIR/tui.sh"
 fi
 
+# Crash-reporting helpers (provides loki_collection_enabled, used by
+# cmd_telemetry status and cmd_crash). Self-guarded against double-source.
+if [ -f "$_LOKI_SCRIPT_DIR/crash.sh" ]; then
+    # shellcheck source=crash.sh
+    source "$_LOKI_SCRIPT_DIR/crash.sh"
+fi
+
 # Resolve the script's real path (handles symlinks)
 resolve_script_path() {
     local script="$1"
@@ -502,12 +509,19 @@ show_help() {
     echo ""
     echo "Usage: loki <command> [options]"
     echo ""
+    echo "New here? Try one of these first:"
+    echo "  loki doctor               Check your setup is ready (instant)"
+    echo "  loki quick \"add a health endpoint\"   One small task, start to finish"
+    echo "  loki demo                 Build a sample todo app end to end (real run)"
+    echo "  loki start ./prd.md       Build from a spec (PRD file, GitHub issue, or no arg)"
+    echo "  Docs: https://github.com/asklokesh/loki-mode  |  Report a problem: loki crash"
+    echo ""
     echo "Commands:"
     echo "  start [PRD|ISSUE] Start Loki Mode (PRD file, issue ref, or no arg)"
     echo "  run <issue>      (deprecated) Alias for 'loki start <issue-ref>'"
     echo "  quick \"task\"     Quick single-task mode (lightweight, 3 iterations max)"
     echo "  monitor [path]   Monitor Docker Compose services with auto-fix (v6.67.0)"
-    echo "  demo             Run interactive demo (~60s simulated session)"
+    echo "  demo             Build a sample todo app end to end (real run)"
     echo "  init [name]      Project scaffolding with 21 PRD templates"
     echo "  issue <url|num>  (deprecated) Use 'loki start <issue-ref>' instead"
     echo "  watch [prd]      Auto-rerun on PRD file changes (v6.33.0)"
@@ -611,7 +625,7 @@ show_help() {
     echo "  loki start --bg ./prd.md      # Start in background"
     echo "  loki start --parallel ./prd.md   # Parallel mode (git worktrees)"
     echo "  loki quick \"add dark mode\"  # Single-task mode (3 iters max)"
-    echo "  loki demo                     # 60-second interactive demo"
+    echo "  loki demo                     # Build a sample todo app end to end"
     echo "  loki init -t saas-starter     # Scaffold from template"
     echo "  loki template install <src>   # Install a community PRD template"
     echo ""
@@ -13472,6 +13486,9 @@ main() {
         report)
             cmd_report "$@"
             ;;
+        crash)
+            cmd_crash "$@"
+            ;;
         share)
             cmd_share "$@"
             ;;
@@ -17943,6 +17960,201 @@ for line in sys.stdin:
 }
 
 # Telemetry management (v6.7.0)
+cmd_crash() {
+    # Phase 0: local-only crash report inspection. NO network egress.
+    #
+    # PARITY: the user-facing strings here MUST match the TS canonical command
+    # at loki-ts/src/commands/crash.ts byte-for-byte (ignoring color codes).
+    # The whole subcommand body is implemented in one Python helper so the
+    # behavior (filename-id resolution, "-" for missing fields, JSON shape,
+    # URL encoding, exit codes) cannot drift from the TS route.
+    #
+    # Subcommands:
+    #   loki crash               list .loki/crash/*.json reports
+    #   loki crash show <id>     pretty-print one scrubbed report
+    #   loki crash submit [<id>] print the scrubbed payload + a prefilled
+    #                            GitHub issue URL for MANUAL submission
+    _LOKI_CRASH_DIR=".loki/crash" _LOKI_CRASH_SUB="${1-}" _LOKI_CRASH_ARG="${2-}" \
+    python3 -c '
+import json, os, sys, urllib.parse
+
+# Colors: honor NO_COLOR (https://no-color.org) exactly like the TS route
+# (loki-ts/src/util/colors.ts). Codes match autonomy/loki:25-32 byte-for-byte.
+_no_color = len(os.environ.get("NO_COLOR", "")) > 0
+def _c(code):
+    return "" if _no_color else code
+RED = _c("\x1b[0;31m")
+GREEN = _c("\x1b[0;32m")
+YELLOW = _c("\x1b[1;33m")
+CYAN = _c("\x1b[0;36m")
+BOLD = _c("\x1b[1m")
+NC = _c("\x1b[0m")
+
+ISSUE_BASE = "https://github.com/asklokesh/loki-mode/issues/new"
+CRASH_DIR = os.environ["_LOKI_CRASH_DIR"]
+SUB = os.environ.get("_LOKI_CRASH_SUB", "")
+ARG = os.environ.get("_LOKI_CRASH_ARG", "")
+
+HELP = (
+    BOLD + "loki crash" + NC + " - inspect and manually submit local crash reports\n"
+    "\n"
+    "Usage: loki crash [subcommand] [args]\n"
+    "\n"
+    "Subcommands:\n"
+    "  (none)               List crash reports in .loki/crash/\n"
+    "  show <id>            Pretty-print one scrubbed crash report\n"
+    "  submit [<id>]        Print the scrubbed payload and a prefilled GitHub\n"
+    "                       issue URL for manual submission\n"
+    "\n"
+    "Crash reports are anonymous, scrubbed, and stored locally only. Nothing is\n"
+    "sent automatically in this version. See docs/PRIVACY.md.\n"
+)
+
+def s(v):
+    return "-" if v is None else str(v)
+
+def pad(text, w):
+    return text if len(text) >= w else text + " " * (w - len(text))
+
+def report_ids():
+    if not os.path.isdir(CRASH_DIR):
+        return []
+    try:
+        names = [e for e in os.listdir(CRASH_DIR)
+                 if e.endswith(".json") and os.path.isfile(os.path.join(CRASH_DIR, e))]
+    except OSError:
+        return []
+    return sorted(n[:-len(".json")] for n in names)
+
+def _safe_id(rid):
+    # Reject path traversal: ids are bare filenames (no separators, no "..",
+    # no leading separator). This guards the direct filename lookup; the
+    # fingerprint-resolution loop only ever passes real listdir ids, which
+    # always pass. Mirrors the identical rule in loki-ts crash.ts.
+    if rid is None or rid == "":
+        return False
+    if "/" in rid or "\\" in rid or ".." in rid:
+        return False
+    if rid[0] in ("/", "\\"):
+        return False
+    return True
+
+def read_report(rid):
+    if not _safe_id(rid):
+        return None
+    p = os.path.join(CRASH_DIR, rid + ".json")
+    if not os.path.exists(p):
+        return None
+    try:
+        with open(p) as f:
+            return json.load(f)
+    except Exception:
+        return {}
+
+def resolve_report(arg):
+    direct = read_report(arg)
+    if direct is not None:
+        return (arg, direct)
+    for rid in report_ids():
+        r = read_report(rid)
+        if r is not None and str(r.get("fingerprint", "")) == arg:
+            return (rid, r)
+    return None
+
+def dumps(obj):
+    return json.dumps(obj, indent=2, ensure_ascii=False)
+
+def list_crashes():
+    ids = report_ids()
+    if not ids:
+        sys.stdout.write(YELLOW + "No crash reports found." + NC +
+                         " Nothing has been captured in .loki/crash/.\n")
+        return 0
+    sys.stdout.write(pad("ID", 40) + "  " + pad("CAPTURED_AT", 22) + "  ERROR_CLASS\n")
+    for rid in ids:
+        d = read_report(rid) or {}
+        fp = s(d.get("fingerprint"))
+        captured_at = s(d.get("captured_at"))
+        error_class = s(d.get("error_class"))
+        visible_id = fp if fp != "-" else rid
+        sys.stdout.write(pad(visible_id, 40) + "  " + pad(captured_at, 22) + "  " + error_class + "\n")
+    sys.stdout.write(
+        "\n" + str(len(ids)) + " report(s). Run \x27loki crash show <id>\x27 to inspect, "
+        "\x27loki crash submit\x27 to get a prefilled GitHub issue URL.\n")
+    return 0
+
+def show_crash(rid):
+    if not rid:
+        sys.stderr.write(RED + "Missing crash id." + NC + " Use \x27loki crash\x27 to list reports.\n")
+        return 2
+    resolved = resolve_report(rid)
+    if resolved is None:
+        sys.stderr.write(RED + "Crash report not found: " + rid + NC + "\n")
+        sys.stderr.write("Use \x27loki crash\x27 to see available reports.\n")
+        return 1
+    sys.stdout.write(dumps(resolved[1]) + "\n")
+    return 0
+
+def issue_url(report):
+    error_class = s(report.get("error_class"))
+    fp = s(report.get("fingerprint"))
+    short_fp = fp[:12] if fp != "-" else "unknown"
+    title = "crash: " + error_class + " (" + short_fp + ")"
+    payload = dumps(report)
+    body = "\n".join([
+        "Anonymous crash report captured by Loki Mode (scrubbed, whitelist-only).",
+        "",
+        "Scrubbed payload:",
+        "```json",
+        payload,
+        "```",
+        "",
+        "Nothing was sent automatically. This issue is submitted manually by me.",
+    ])
+    q = urllib.parse.urlencode({"title": title, "body": body})
+    return ISSUE_BASE + "?" + q
+
+def submit_crash(rid):
+    if rid:
+        target = resolve_report(rid)
+        if target is None:
+            sys.stderr.write(RED + "Crash report not found: " + rid + NC + "\n")
+            sys.stderr.write("Use \x27loki crash\x27 to see available reports.\n")
+            return 1
+    else:
+        ids = report_ids()
+        if not ids:
+            sys.stdout.write(YELLOW + "No crash reports found." + NC + " Nothing to submit.\n")
+            return 0
+        last_id = ids[-1]
+        target = (last_id, read_report(last_id) or {})
+    sys.stdout.write(BOLD + "Scrubbed payload (this is the ENTIRE report):" + NC + "\n")
+    sys.stdout.write(dumps(target[1]) + "\n\n")
+    sys.stdout.write(YELLOW + "Nothing is sent automatically in this version." + NC +
+                     " Loki Mode never transmits crash data on its own.\n")
+    sys.stdout.write("To submit manually, open this prefilled GitHub issue and review it first:\n\n")
+    sys.stdout.write("  " + CYAN + issue_url(target[1]) + NC + "\n\n")
+    sys.stdout.write(GREEN + "The payload above is exactly what the URL contains." + NC + "\n")
+    sys.stdout.write("See docs/PRIVACY.md for what is and is not collected.\n")
+    return 0
+
+if SUB == "":
+    sys.exit(list_crashes())
+elif SUB in ("--help", "-h", "help"):
+    sys.stdout.write(HELP)
+    sys.exit(0)
+elif SUB == "show":
+    sys.exit(show_crash(ARG))
+elif SUB == "submit":
+    sys.exit(submit_crash(ARG))
+else:
+    sys.stderr.write(RED + "Unknown crash subcommand: " + SUB + NC + "\n")
+    sys.stdout.write(HELP)
+    sys.exit(2)
+'
+    return $?
+}
+
 cmd_telemetry() {
     local subcommand="${1:-status}"
     shift 2>/dev/null || true
@@ -18007,6 +18219,25 @@ try {
                     echo -e "  Saved:     $saved_endpoint"
                 fi
             fi
+
+            # Unified collection state (PostHog usage telemetry + crash reporting).
+            # loki_collection_enabled is the single source of truth (crash.sh).
+            echo ""
+            if type loki_collection_enabled &>/dev/null; then
+                if loki_collection_enabled; then
+                    echo -e "  Collection: ${GREEN}enabled${NC} (anonymous diagnostics; turn off with: loki telemetry off)"
+                else
+                    echo -e "  Collection: ${YELLOW}disabled${NC} (re-enable with: loki telemetry on)"
+                fi
+            fi
+
+            # Count of pending local crash reports (.loki/crash/*.json).
+            local crash_dir=".loki/crash"
+            local pending=0
+            if [ -d "$crash_dir" ]; then
+                pending=$(find "$crash_dir" -maxdepth 1 -name '*.json' -type f 2>/dev/null | wc -l | tr -d '[:space:]')
+            fi
+            echo -e "  Crash reports pending: ${pending:-0} (see: loki crash)"
             echo ""
             ;;
 
@@ -18074,26 +18305,28 @@ TELEM_DISABLE_PY
             echo "  Unset LOKI_OTEL_ENDPOINT in your shell for immediate effect."
             ;;
 
-        stop)
-            # Persistent opt-out across all sessions
+        stop|off)
+            # Persistent opt-out across all sessions. This is the unified
+            # opt-out: it gates BOTH PostHog usage telemetry AND crash reporting.
             local global_config="${HOME}/.loki/config"
             mkdir -p "${HOME}/.loki"
 
             # Remove existing TELEMETRY_DISABLED line if present, then add
+            # (idempotent).
             if [ -f "$global_config" ]; then
                 grep -v "^TELEMETRY_DISABLED=" "$global_config" > "${global_config}.tmp" 2>/dev/null || true
                 mv "${global_config}.tmp" "$global_config"
             fi
             echo "TELEMETRY_DISABLED=true" >> "$global_config"
 
-            echo -e "${BOLD}Telemetry permanently disabled${NC}"
+            echo -e "${BOLD}Telemetry and crash reporting disabled${NC}"
             echo ""
             echo "  Opt-out saved to: $global_config"
             echo "  This persists across all sessions and new runs."
-            echo "  Run 'loki telemetry start' to re-enable."
+            echo "  Run 'loki telemetry on' to re-enable."
             ;;
 
-        start)
+        start|on)
             # Remove persistent opt-out
             local global_config="${HOME}/.loki/config"
             if [ -f "$global_config" ]; then
@@ -18101,9 +18334,10 @@ TELEM_DISABLE_PY
                 mv "${global_config}.tmp" "$global_config"
             fi
 
-            echo -e "${BOLD}Telemetry opt-out removed${NC}"
+            echo -e "${BOLD}Telemetry and crash reporting re-enabled${NC}"
             echo ""
-            echo "  Telemetry can now be enabled with 'loki telemetry enable [endpoint]'."
+            echo "  Anonymous diagnostics collection is on again."
+            echo "  OTEL tracing can be configured with 'loki telemetry enable [endpoint]'."
             ;;
 
         --help|-h|help)
@@ -18112,11 +18346,13 @@ TELEM_DISABLE_PY
             echo "Usage: loki telemetry <command>"
             echo ""
             echo "Commands:"
-            echo "  status              Show current telemetry config"
+            echo "  status              Show OTEL config + collection state + pending crash reports"
             echo "  enable [endpoint]   Enable OTEL (default: http://localhost:4318)"
             echo "  disable             Disable OTEL for current project"
-            echo "  stop                Permanently opt out of telemetry across all sessions"
-            echo "  start               Remove persistent opt-out, re-enable telemetry"
+            echo "  off                 Opt out of all anonymous diagnostics (telemetry + crash)"
+            echo "  on                  Re-enable anonymous diagnostics"
+            echo "  stop                Alias for 'off' (permanent opt-out across all sessions)"
+            echo "  start               Alias for 'on' (remove persistent opt-out)"
             echo ""
             ;;
         *)

package/autonomy/run.sh

@@ -651,6 +651,15 @@ if [ -f "$TELEMETRY_SCRIPT" ]; then
     source "$TELEMETRY_SCRIPT"
 fi
 
+# Crash-reporting helpers (Phase 0: local-only, zero egress).
+# Provides loki_collection_enabled (unified opt-out), loki_crash_capture,
+# loki_crash_friction, loki_show_disclosure_once.
+CRASH_SCRIPT="$SCRIPT_DIR/crash.sh"
+if [ -f "$CRASH_SCRIPT" ]; then
+    # shellcheck source=crash.sh
+    source "$CRASH_SCRIPT"
+fi
+
 
 
 # 2026 Research Enhancements (minimal additions)
@@ -1743,6 +1752,11 @@ invoke_with_timeout() {
     done
 
     log_error "Provider spawn failed after $((max_retries+1)) attempts (timeout=${timeout}s)"
+    # Crash friction (retry_loop): provider spawn exhausted all retries -- a
+    # clear threshold (not a single retry). Best-effort, never blocks.
+    if type loki_crash_friction &>/dev/null; then
+        loki_crash_friction "retry_loop" "provider spawn failed after $((max_retries+1)) attempts" >/dev/null 2>&1 || true
+    fi
     return 124
 }
 
@@ -6107,7 +6121,11 @@ track_gate_failure() {
     local gate_file="${TARGET_DIR:-.}/.loki/quality/gate-failure-count.json"
     mkdir -p "$(dirname "$gate_file")"
 
-    _GATE_FILE="$gate_file" _GATE_NAME="$gate_name" python3 -c "
+    # IMPORTANT: this function's stdout IS its return value (callers do
+    # count=$(track_gate_failure ...)). Capture the count first, then do any
+    # side-effects with their stdout suppressed, then echo ONLY the count.
+    local count
+    count=$(_GATE_FILE="$gate_file" _GATE_NAME="$gate_name" python3 -c "
 import json, os
 gate_file = os.environ['_GATE_FILE']
 gate_name = os.environ['_GATE_NAME']
@@ -6120,7 +6138,16 @@ counts[gate_name] = counts.get(gate_name, 0) + 1
 with open(gate_file, 'w') as f:
     json.dump(counts, f, indent=2)
 print(counts[gate_name])
-" 2>/dev/null || echo "1"
+" 2>/dev/null || echo "1")
+
+    # Crash friction (gate_failure): fire exactly once at the threshold (3
+    # consecutive failures) so a sustained failure does not re-fire every
+    # iteration. Best-effort, stdout suppressed so the count stays clean.
+    if [ "${count:-0}" -eq 3 ] 2>/dev/null && type loki_crash_friction &>/dev/null; then
+        loki_crash_friction "gate_failure" "gate=${gate_name} consecutive=${count}" >/dev/null 2>&1 || true
+    fi
+
+    echo "$count"
 }
 
 clear_gate_failure() {
@@ -8196,6 +8223,11 @@ attempt_provider_failover() {
     done
 
     log_warn "Failover: all providers in chain exhausted, falling back to retry"
+    # Crash friction (rate_limit_loop): a clear threshold -- every provider in
+    # the failover chain is rate-limited/unhealthy. Best-effort, never blocks.
+    if type loki_crash_friction &>/dev/null; then
+        loki_crash_friction "rate_limit_loop" "failover chain exhausted: ${FAILOVER_CHAIN}" >/dev/null 2>&1 || true
+    fi
     return 1
 }
 
@@ -11989,6 +12021,23 @@ if __name__ == "__main__":
                 "status=$([[ $exit_code -eq 0 ]] && echo ok || echo error)"
         fi
 
+        # Crash capture (Phase 0: local-only, best-effort, never blocks).
+        # Conservative: only on a genuine non-zero failure exit. Signal-induced
+        # exits (130 SIGINT / 143 SIGTERM / 137 SIGKILL) are user/operator
+        # interrupts, not crashes, so we skip them. Known conservatism tradeoff:
+        # this fires once per iteration on any nonzero exit, so a long, repeatedly
+        # failing run can accumulate multiple local reports under .loki/crash/.
+        if [ "$exit_code" -ne 0 ] 2>/dev/null && \
+           [ "$exit_code" -ne 130 ] && [ "$exit_code" -ne 143 ] && [ "$exit_code" -ne 137 ] && \
+           type loki_crash_capture &>/dev/null; then
+            loki_crash_capture \
+                "IterationError" \
+                "provider exited non-zero on iteration ${ITERATION_COUNT:-?}" \
+                "$([ -f "$iter_output" ] && tail -c 16384 "$iter_output" 2>/dev/null || true)" \
+                "${rarv_phase:-iteration}" \
+                "$exit_code"
+        fi
+
         # PRD Checklist verification on interval (v5.44.0)
         if type checklist_should_verify &>/dev/null && checklist_should_verify; then
             checklist_verify
@@ -12914,6 +12963,11 @@ main() {
     trap cleanup INT TERM
     SESSION_START_EPOCH=$(date +%s)
 
+    # First-run disclosure (shown once, before any work; best-effort).
+    if type loki_show_disclosure_once &>/dev/null; then
+        loki_show_disclosure_once
+    fi
+
     echo ""
     echo -e "${BOLD}${BLUE}"
     echo "  ██╗      ██████╗ ██╗  ██╗██╗    ███╗   ███╗ ██████╗ ██████╗ ███████╗"

package/autonomy/telemetry.sh

@@ -7,8 +7,19 @@ LOKI_POSTHOG_HOST="${LOKI_TELEMETRY_ENDPOINT:-https://us.i.posthog.com}"
 LOKI_POSTHOG_KEY="phc_ya0vGBru41AJWtGNfZZ8H9W4yjoZy4KON0nnayS7s87"
 
 _loki_telemetry_enabled() {
+    # Unified opt-out: these checks must mirror loki_collection_enabled in
+    # autonomy/crash.sh so one switch gates BOTH PostHog usage telemetry and
+    # crash reporting.
+    # LOKI_TELEMETRY=off (case-insensitive)
+    local _telem_lower
+    _telem_lower="$(printf '%s' "${LOKI_TELEMETRY:-}" | tr '[:upper:]' '[:lower:]')"
+    [ "$_telem_lower" = "off" ] && return 1
     [ "${LOKI_TELEMETRY_DISABLED:-}" = "true" ] && return 1
     [ "${DO_NOT_TRACK:-}" = "1" ] && return 1
+    # Persistent opt-out in ~/.loki/config
+    if [ -f "${HOME}/.loki/config" ] && grep -q "^TELEMETRY_DISABLED=true" "${HOME}/.loki/config" 2>/dev/null; then
+        return 1
+    fi
     command -v curl >/dev/null 2>&1 || return 1
     return 0
 }

package/bin/loki

@@ -116,11 +116,13 @@ fi
 # Two-token routes (provider show/list, memory list/index) match on the first
 # token only; the Bun dispatcher handles subcommand routing internally.
 case "${1:-}" in
-    version|--version|-v|status|stats|doctor|provider|memory|rollback|internal|kpis|trust|proof|wiki)
+    version|--version|-v|status|stats|doctor|provider|memory|rollback|internal|kpis|trust|proof|wiki|crash)
         # v7.5.2: rollback added (wires loki-ts/src/commands/rollback.ts).
         # v7.5.3: internal added for autonomy/run.sh phase1-hooks calls.
         # v7.5.28: kpis added (Phase K MVP: read-only KPI snapshot).
         # R4: trust added (visible trust trajectory; Bun route, bash fallback).
+        # crash added (Crash Reporting Phase 0: inspect/manually submit local
+        # scrubbed crash reports; Bun route, bash fallback).
         #
         # v7.8.2: emit the cli_command product-analytics event for Bun-routed
         # commands. The bash CLI fires this from autonomy/loki main(), but the

package/bin/postinstall.js

@@ -180,8 +180,22 @@ console.log('New here? Run `loki welcome` for a 30-second tour.');
 console.log('');
 
 // Anonymous install telemetry (fire-and-forget, silent)
+// Unified opt-out: these checks mirror loki_collection_enabled in
+// autonomy/crash.sh so one switch gates BOTH PostHog usage telemetry and
+// crash reporting.
+function _lokiCollectionDisabled() {
+  if ((process.env.LOKI_TELEMETRY || '').toLowerCase() === 'off') return true;
+  if (process.env.LOKI_TELEMETRY_DISABLED === 'true') return true;
+  if (process.env.DO_NOT_TRACK === '1') return true;
+  try {
+    const cfg = path.join(homeDir, '.loki', 'config');
+    const lines = fs.readFileSync(cfg, 'utf8').split('\n');
+    if (lines.some((l) => l.startsWith('TELEMETRY_DISABLED=true'))) return true;
+  } catch {}
+  return false;
+}
 try {
-  if (process.env.LOKI_TELEMETRY_DISABLED !== 'true' && process.env.DO_NOT_TRACK !== '1') {
+  if (!_lokiCollectionDisabled()) {
     const https = require('https');
     const crypto = require('crypto');
     const idFile = path.join(homeDir, '.loki-telemetry-id');

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.18.1"
+__version__ = "7.18.3"
 
 # Expose the control app for easy import
 try:

package/dashboard/telemetry.py

@@ -19,10 +19,25 @@ _POSTHOG_KEY = "phc_ya0vGBru41AJWtGNfZZ8H9W4yjoZy4KON0nnayS7s87"
 
 
 def _is_enabled():
+    # Unified opt-out: these checks must mirror loki_collection_enabled in
+    # autonomy/crash.sh so one switch gates BOTH PostHog usage telemetry and
+    # crash reporting.
+    if os.environ.get("LOKI_TELEMETRY", "").lower() == "off":
+        return False
     if os.environ.get("LOKI_TELEMETRY_DISABLED") == "true":
         return False
     if os.environ.get("DO_NOT_TRACK") == "1":
         return False
+    # Persistent opt-out in ~/.loki/config (matches the bash grep prefix
+    # semantics: any line beginning with TELEMETRY_DISABLED=true).
+    try:
+        config_path = Path.home() / ".loki" / "config"
+        if config_path.is_file():
+            for line in config_path.read_text().splitlines():
+                if line.startswith("TELEMETRY_DISABLED=true"):
+                    return False
+    except Exception:
+        pass
     return True