loki-mode 7.41.0 → 7.41.1

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 11 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.41.0
+# Loki Mode v7.41.1
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -398,4 +398,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.41.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.41.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.41.0
+7.41.1

package/autonomy/app-runner.sh

@@ -136,6 +136,121 @@ HEALTH_EOF
     mv "$tmp_file" "$_APP_RUNNER_DIR/health.json"
 }
 
+# Re-derive a detection.json field (type/command) so we can rewrite it after a
+# port reconcile without threading those values through globals. Echoes the raw
+# string value (empty on miss). Mirrors the grep-based read style used by
+# app_runner_status.
+_read_detection_field() {
+    local field="$1"
+    [ -f "$_APP_RUNNER_DIR/detection.json" ] || return 0
+    grep -o "\"${field}\": *\"[^\"]*\"" "$_APP_RUNNER_DIR/detection.json" 2>/dev/null \
+        | head -1 | sed 's/.*"\([^"]*\)"$/\1/'
+}
+
+# Rewrite detection.json with the reconciled port, preserving type/command.
+_rewrite_detection_port() {
+    local d_type d_command
+    d_type=$(_read_detection_field "type")
+    d_command=$(_read_detection_field "command")
+    [ -n "$d_type" ] || return 0
+    _write_detection "$d_type" "$d_command"
+}
+
+# Fix #2 (finding #597): reconcile the recorded port with the port the app
+# ACTUALLY bound, using the listen line in app.log as the source of truth. This
+# corrects the dashboard Live Preview even when the app ignores PORT and picks
+# its own port. Bounded poll: returns as soon as a listen line is found, and
+# never runs for docker (compose URLs come from published-port mapping) or when
+# no port was recorded. Default window LOKI_APP_PORT_RECONCILE_SECS (default 12)
+# at 0.5s intervals. On no match within the window the recorded port is kept (no
+# regression). Stdout: nothing; mutates _APP_RUNNER_PORT / _APP_RUNNER_URL and
+# rewrites state.json + detection.json only when the real port differs.
+_app_runner_reconcile_port() {
+    [ "$_APP_RUNNER_IS_DOCKER" != true ] || return 0
+    [ -n "$_APP_RUNNER_PORT" ] && [ "$_APP_RUNNER_PORT" -gt 0 ] 2>/dev/null || return 0
+    local log_file="$_APP_RUNNER_DIR/app.log"
+
+    # Fast path: if the recorded port already serves HTTP, the app honored our
+    # chosen port (fix #1 worked) or otherwise bound it -- nothing to reconcile,
+    # and we avoid the poll latency entirely. Covers quiet-but-serving apps that
+    # never log a recognizable listen line.
+    if command -v curl >/dev/null 2>&1 && \
+       curl -sf -o /dev/null -m 2 "http://localhost:${_APP_RUNNER_PORT}/" 2>/dev/null; then
+        return 0
+    fi
+
+    local max_secs="${LOKI_APP_PORT_RECONCILE_SECS:-12}"
+    [[ "$max_secs" =~ ^[0-9]+$ ]] || max_secs=12
+    local max_iter=$(( max_secs * 2 ))
+    [ "$max_iter" -gt 0 ] || max_iter=1
+
+    local real_port="" iter=0
+    while [ "$iter" -lt "$max_iter" ]; do
+        if [ -f "$log_file" ]; then
+            real_port=$(_parse_listen_port "$log_file")
+            [ -n "$real_port" ] && break
+        fi
+        # Stop early if the process already died (failed start): nothing to wait for.
+        if [ -n "$_APP_RUNNER_PID" ] && ! kill -0 "$_APP_RUNNER_PID" 2>/dev/null; then
+            break
+        fi
+        sleep 0.5
+        iter=$(( iter + 1 ))
+    done
+
+    [ -n "$real_port" ] || return 0
+    if [ "$real_port" != "$_APP_RUNNER_PORT" ]; then
+        log_info "App Runner: reconciled port $_APP_RUNNER_PORT -> $real_port (from app.log listen line)"
+        _APP_RUNNER_PORT="$real_port"
+        _APP_RUNNER_URL="http://localhost:${real_port}"
+        _rewrite_detection_port
+    fi
+    return 0
+}
+
+# Parse the actual bound port from an app log file. Scans known listen-line
+# shapes in priority order and returns the LAST (most recent) plausible port,
+# tolerating ANSI color codes that dev servers emit. Validates 1-65535. Echoes
+# the port or nothing.
+_parse_listen_port() {
+    local file="$1"
+    [ -f "$file" ] || return 0
+    # Strip ANSI SGR sequences (\e[...m) so color-wrapped URLs still match.
+    local clean
+    clean=$(sed -E $'s/\x1b\\[[0-9;]*m//g' "$file" 2>/dev/null) || clean=$(cat "$file" 2>/dev/null)
+    [ -n "$clean" ] || return 0
+
+    local candidate=""
+    # 1) Explicit URL with a port: http://host:PORT  (most reliable).
+    candidate=$(printf '%s\n' "$clean" \
+        | grep -oiE 'https?://[a-z0-9.\-]+:[0-9]{1,5}' \
+        | grep -oE ':[0-9]{1,5}' | tr -d ':' | tail -1)
+    # 2) A number anchored to the literal word "port": "port 8080", "port=3000",
+    #    "port: 5000". This runs BEFORE the bare host:port scan so a clock-style
+    #    timestamp on the same line (e.g. "12:30:45 ... port 8080") cannot win.
+    if [ -z "$candidate" ]; then
+        candidate=$(printf '%s\n' "$clean" \
+            | grep -ioE 'port[ =:]+[0-9]{1,5}' \
+            | grep -oE '[0-9]{1,5}' | tail -1)
+    fi
+    # 3) Keyword listen lines with a real host token before the colon:
+    #    "localhost:5173", "0.0.0.0:8080", "127.0.0.1:3000". Requiring a letter
+    #    or a dot immediately left of the colon excludes "HH:MM" timestamps,
+    #    which have a digit there.
+    if [ -z "$candidate" ]; then
+        candidate=$(printf '%s\n' "$clean" \
+            | grep -iE 'listen|running on|ready|started|serving|server' \
+            | grep -oiE '[a-z.][a-z0-9.\-]*:[0-9]{1,5}' \
+            | grep -oE ':[0-9]{1,5}' | tr -d ':' | tail -1)
+    fi
+
+    [ -n "$candidate" ] || return 0
+    # Validate range 1-65535.
+    if [ "$candidate" -ge 1 ] 2>/dev/null && [ "$candidate" -le 65535 ] 2>/dev/null; then
+        printf '%s\n' "$candidate"
+    fi
+}
+
 # Rotate app.log if it exceeds max lines
 _rotate_app_log() {
     local log_file="$_APP_RUNNER_DIR/app.log"
@@ -606,6 +721,21 @@ app_runner_start() {
     log_step "App Runner: starting application ($_APP_RUNNER_METHOD on port $_APP_RUNNER_PORT)..."
     _rotate_app_log
 
+    # Fix #1 (finding #597): pass Loki's chosen port to the app via the env so the
+    # app honors it instead of binding its own default (e.g. a Node app reading
+    # `process.env.PORT || 4000` would otherwise bind 4000 while Loki recorded the
+    # guessed 3000, leaving the dashboard Live Preview pointed at a dead port).
+    # We export PORT plus the common ecosystem aliases. An app that ignores these
+    # vars is unaffected; an ignored env var is harmless by definition. We do NOT
+    # set HOST/BIND -- changing the bind address can break apps. For docker (which
+    # gets its port via published-port mapping, not the child env) this is a no-op
+    # at the binary boundary, so we only export for the direct-exec path.
+    local _port_env_prefix=""
+    if [ "$_APP_RUNNER_IS_DOCKER" != true ] && \
+       [ -n "$_APP_RUNNER_PORT" ] && [ "$_APP_RUNNER_PORT" -gt 0 ] 2>/dev/null; then
+        _port_env_prefix="export PORT=$_APP_RUNNER_PORT HTTP_PORT=$_APP_RUNNER_PORT SERVER_PORT=$_APP_RUNNER_PORT APP_PORT=$_APP_RUNNER_PORT; "
+    fi
+
     # Start the process in a new process group
     if command -v setsid >/dev/null 2>&1; then
         _APP_RUNNER_HAS_SETSID=true
@@ -615,7 +745,7 @@ app_runner_start() {
         # Note: $_APP_RUNNER_METHOD has passed _validate_app_command (whitelist).
         # The `--` after `bash -lc` prevents flag injection if the assembled
         # script string ever begins with a `-`.
-        (cd "$dir" && setsid bash -lc -- 'echo $$ > "'"$_pgid_file"'"; exec '"$_APP_RUNNER_METHOD" >> "$_APP_RUNNER_DIR/app.log" 2>&1) &
+        (cd "$dir" && setsid bash -lc -- "$_port_env_prefix"'echo $$ > "'"$_pgid_file"'"; exec '"$_APP_RUNNER_METHOD" >> "$_APP_RUNNER_DIR/app.log" 2>&1) &
         local _subshell_pid=$!
         # Wait briefly for the pgid file to appear, then read the real PGID
         local _pgid_wait=0
@@ -633,7 +763,7 @@ app_runner_start() {
         _APP_RUNNER_HAS_SETSID=false
         # Note: $_APP_RUNNER_METHOD has passed _validate_app_command (whitelist).
         # The `--` after `bash -lc` prevents flag injection.
-        (cd "$dir" && bash -lc -- "$_APP_RUNNER_METHOD" >> "$_APP_RUNNER_DIR/app.log" 2>&1) &
+        (cd "$dir" && bash -lc -- "${_port_env_prefix}exec $_APP_RUNNER_METHOD" >> "$_APP_RUNNER_DIR/app.log" 2>&1) &
         _APP_RUNNER_PID=$!
     fi
     # Register with central PID registry if available
@@ -675,8 +805,13 @@ app_runner_start() {
             return 1
         fi
     elif kill -0 "$_APP_RUNNER_PID" 2>/dev/null; then
+        # Reconcile recorded port with the port the app actually bound (finding
+        # #597), so state.json / detection.json / the preview URL point at the
+        # live port even when the app ignored PORT. Mutates globals before the
+        # state write below. Bounded; no-op when the app honored the chosen port.
+        _app_runner_reconcile_port
         _write_app_state "running"
-        log_info "App Runner: application started (PID: $_APP_RUNNER_PID)"
+        log_info "App Runner: application started (PID: $_APP_RUNNER_PID) on port $_APP_RUNNER_PORT"
         return 0
     else
         log_error "App Runner: application failed to start"

package/autonomy/lib/claude-flags.sh

@@ -527,8 +527,22 @@ LOKI_CAVEMAN_VERSION="${LOKI_CAVEMAN_VERSION:-1.9.0}"
 
 # The compression level for free-form activation. Maps directly to caveman's
 # CAVEMAN_DEFAULT_MODE values: lite | full | ultra | wenyan | wenyan-lite |
-# wenyan-full | wenyan-ultra. Default "full" (the founder-locked global default).
-# Never "off" here -- "off" is the suppression value, not an activation level.
+# wenyan-full | wenyan-ultra. Never "off" here -- "off" is the suppression value,
+# not an activation level.
+#
+# v7.x #593 -- INTELLIGENT AUTO-SELECTION (no new user knob): when the user does
+# NOT set LOKI_CAVEMAN_LEVEL explicitly, the level is INFERRED per-invocation from
+# the run's existing RARV-tier signal (see _loki_caveman_infer_level). When the
+# user DOES set it, that value overrides the inference entirely (opt-out escape
+# hatch). Capture set-ness BEFORE the ":-full" default clobbers it -- once the
+# default fills the var, "user set full" and "defaulted to full" are
+# indistinguishable, so the inference would silently never fire. ${var+set} is
+# non-empty only when the var was genuinely set (even to empty). The "full"
+# default is kept so the public var still reads "full" for external readers and
+# so a child re-source re-derives USERSET correctly (unexported default).
+if [ -z "${LOKI_CAVEMAN_LEVEL_USERSET+x}" ]; then
+    LOKI_CAVEMAN_LEVEL_USERSET="${LOKI_CAVEMAN_LEVEL+set}"
+fi
 LOKI_CAVEMAN_LEVEL="${LOKI_CAVEMAN_LEVEL:-full}"
 
 # ---------- DEFAULT-SUPPRESS: off by construction, tree-wide ----------
@@ -563,6 +577,34 @@ fi
 export LOKI_CAVEMAN_USER_MODE
 export CAVEMAN_DEFAULT_MODE=off
 
+# ---------- v7.x #593 intelligent compression-level inference ----------
+# Infer the caveman compression level from the run's existing RARV-tier signal,
+# so the level is DECIDED by inspecting the work rather than asked of the user.
+# No new user input is introduced: the tier already drives effort/model selection
+# (loki_effort_for_tier, get_rarv_tier). On the bash route the tier is read from
+# LOKI_CURRENT_TIER (exported by run_autonomous each iteration); the TS mirror
+# (cavemanActivateEnv) receives the same tier vocabulary (planning|development|
+# fast) via call.tier, so both routes infer identically from the same signal.
+#
+# INFERENCE RULE (deterministic, conservative-for-accuracy):
+#   planning    (Reason phase -- architecture / design / nuanced reasoning) -> lite
+#   development (Act / Reflect -- implementation, the prior default)         -> full
+#   fast        (Verify phase -- testing / validation, more routine)         -> full
+#   unknown / empty tier                                                     -> full
+# The auto ceiling is "full": inference NEVER selects ultra. ultra is reachable
+# only via an explicit LOKI_CAVEMAN_LEVEL override (the opt-out escape hatch), so
+# the autonomous path can never compress hard enough to lose technical nuance.
+# "lite" on planning protects the highest-nuance output (architecture/design);
+# everything else stays at the established "full" default. When the tier is
+# unknown we pick the SAFER (established) "full", never something more aggressive.
+_loki_caveman_infer_level() {
+    local tier="${1:-${LOKI_CURRENT_TIER:-}}"
+    case "$tier" in
+        planning) printf '%s' "lite" ;;
+        *)        printf '%s' "full" ;;
+    esac
+}
+
 # Rank a caveman mode by compression aggressiveness for the no-raise comparison.
 # Higher number = more aggressive (drops more nuance). "off" is the floor; unknown
 # or empty modes rank as -1 (treated as "no opinion", so they never win a min()).
@@ -656,7 +698,17 @@ loki_caveman_enabled() {
 loki_caveman_activate_env() {
     loki_caveman_supported || return 0
     loki_caveman_enabled   || return 0
-    local level="${LOKI_CAVEMAN_LEVEL:-full}"
+    # #593: the level is the EXPLICIT user value when LOKI_CAVEMAN_LEVEL was set
+    # (override / opt-out escape hatch), else the INFERRED level from the RARV
+    # tier. The no-raise guard below then runs unchanged on this base, so an
+    # explicit level is still lowered toward a user's lower global mode exactly
+    # as before -- "override" means override the inference, not the no-raise.
+    local level
+    if [ -n "${LOKI_CAVEMAN_LEVEL_USERSET:-}" ]; then
+        level="${LOKI_CAVEMAN_LEVEL:-full}"
+    else
+        level="$(_loki_caveman_infer_level)"
+    fi
     # Respect (never exceed) a user's explicitly-lower global level. A user who
     # globally set CAVEMAN_DEFAULT_MODE=off opted OUT of compression entirely;
     # honor that by activating nothing (empty -> bare claude invocation).

package/autonomy/loki

@@ -77,6 +77,35 @@ if [ -f "$_LOKI_SCRIPT_DIR/provider-offer.sh" ]; then
     source "$_LOKI_SCRIPT_DIR/provider-offer.sh"
 fi
 
+# caveman ACTIVATION level for FREE-FORM (narration) claude subcalls in this CLI
+# (migration phase exec, migration docs-gen, heal execution). Prints the level to
+# pass as CAVEMAN_DEFAULT_MODE when activation is warranted, else nothing. autonomy/
+# loki does NOT source claude-flags.sh globally, so this lazily sources it on demand
+# (same pattern as the ultrareview/workflows gates and autonomy/lib/voter-agents.sh).
+# The gate (provider==claude, claude on PATH, opt-in, no legacy-completion-match,
+# no-raise of a user's lower global level) lives entirely in loki_caveman_activate_env;
+# this is just the lazy-source wrapper. Degrades to empty (bare invocation, byte-
+# identical to pre-caveman) when the lib is missing or the helper is unavailable.
+# NEVER use this for captured-output / parsed subcalls -- those HARD-SUPPRESS with
+# CAVEMAN_DEFAULT_MODE=off (see _docs_invoke_provider and run.sh:3286).
+_loki_caveman_narration_level() {
+    if ! declare -F loki_caveman_activate_env >/dev/null 2>&1; then
+        local _cm_lib=""
+        if [ -f "${_LOKI_SCRIPT_DIR}/lib/claude-flags.sh" ]; then
+            _cm_lib="${_LOKI_SCRIPT_DIR}/lib/claude-flags.sh"
+        elif [ -f "$(dirname "$0")/lib/claude-flags.sh" ]; then
+            _cm_lib="$(dirname "$0")/lib/claude-flags.sh"
+        fi
+        if [ -n "$_cm_lib" ]; then
+            # shellcheck source=autonomy/lib/claude-flags.sh
+            . "$_cm_lib" 2>/dev/null || true
+        fi
+    fi
+    if declare -F loki_caveman_activate_env >/dev/null 2>&1; then
+        loki_caveman_activate_env
+    fi
+}
+
 # Quickstart guided interview (v7.29.0): provides cmd_quickstart and its
 # deterministic offline template matcher. Functions-only file (no top-level
 # command), sourced here so the dispatch case can call cmd_quickstart. Composes
@@ -11499,9 +11528,19 @@ Tasks:
         local phase_exit=0
         if [ -n "$phase_prompt" ]; then
             local provider_name="${LOKI_PROVIDER:-claude}"
+            # caveman ACTIVATION (free-form narration): the phase exec writes its
+            # deliverables via tools; stdout is piped to python and only DISPLAYED,
+            # never captured/parsed for a verdict. So compress the narration tokens
+            # at the configured level when warranted (mirrors run.sh:13167 main loop).
+            # An EMPTY CAVEMAN_DEFAULT_MODE is NOT inert (caveman falls back to the
+            # user global default), so when activation is not warranted we must NOT
+            # set the var at all (bare branch), keeping the call byte-identical to
+            # pre-caveman. No-op when caveman is absent.
+            local _loki_mig_cm=""
+            _loki_mig_cm="$(_loki_caveman_narration_level)"
             case "$provider_name" in
                 claude)
-                    { (cd "$codebase_path" && claude --dangerously-skip-permissions -p "$phase_prompt" --output-format stream-json --verbose 2>&1) | \
+                    { (cd "$codebase_path" && if [ -n "$_loki_mig_cm" ]; then CAVEMAN_DEFAULT_MODE="$_loki_mig_cm" claude --dangerously-skip-permissions -p "$phase_prompt" --output-format stream-json --verbose 2>&1; else claude --dangerously-skip-permissions -p "$phase_prompt" --output-format stream-json --verbose 2>&1; fi) | \
                         while IFS= read -r line; do
                             # Extract text from stream-json
                             if echo "$line" | python3 -c "
@@ -11667,9 +11706,15 @@ IMPORTANT RULES:
 
         local doc_exit=0
         local provider_name="${LOKI_PROVIDER:-claude}"
+        # caveman ACTIVATION (free-form narration): docs-gen writes the docs via
+        # tools; stdout is piped to python and only DISPLAYED, never captured/parsed.
+        # Compress narration at the configured level when warranted; empty -> bare
+        # branch, byte-identical to pre-caveman (empty mode is NOT inert). No-op absent.
+        local _loki_doc_cm=""
+        _loki_doc_cm="$(_loki_caveman_narration_level)"
         case "$provider_name" in
             claude)
-                { (cd "$codebase_path" && claude --dangerously-skip-permissions -p "$doc_prompt" --output-format stream-json --verbose 2>&1) | \
+                { (cd "$codebase_path" && if [ -n "$_loki_doc_cm" ]; then CAVEMAN_DEFAULT_MODE="$_loki_doc_cm" claude --dangerously-skip-permissions -p "$doc_prompt" --output-format stream-json --verbose 2>&1; else claude --dangerously-skip-permissions -p "$doc_prompt" --output-format stream-json --verbose 2>&1; fi) | \
                     while IFS= read -r line; do
                         if echo "$line" | python3 -c "
 import sys, json
@@ -12290,10 +12335,17 @@ Begin healing now. Follow the RARV cycle for each action."
 
     # Execute with the appropriate provider
     local heal_exit=0
+    # caveman ACTIVATION (free-form narration): heal execution writes its artifacts
+    # (.loki/healing/*, characterization tests) via tools; stdout is piped to python
+    # and only DISPLAYED, never captured/parsed for a verdict. Compress narration at
+    # the configured level when warranted; empty -> bare branch, byte-identical to
+    # pre-caveman (empty mode is NOT inert). No-op when caveman is absent.
+    local _loki_heal_cm=""
+    _loki_heal_cm="$(_loki_caveman_narration_level)"
     case "$provider" in
         claude)
             local run_args=(--dangerously-skip-permissions -p "$heal_prompt" --output-format stream-json --verbose)
-            (cd "$codebase_path" && claude "${run_args[@]}" 2>&1) | \
+            (cd "$codebase_path" && if [ -n "$_loki_heal_cm" ]; then CAVEMAN_DEFAULT_MODE="$_loki_heal_cm" claude "${run_args[@]}" 2>&1; else claude "${run_args[@]}" 2>&1; fi) | \
                 while IFS= read -r line; do
                     if echo "$line" | python3 -c "
 import sys, json
@@ -13719,8 +13771,11 @@ tokens_per_tier = {
 # row from a stale \$0.25/\$1.25 (Haiku 3.5) to the published Claude Haiku 4.5
 # price of \$1/\$5 (anthropic.com/news/claude-haiku-4-5), so all four rows now
 # match the three canonical model-keyed tables (run.sh pricing.json, run.sh
-# check_budget_limit, dashboard _DEFAULT_PRICING) and a fable-forced quote
-# honestly shows MORE than Opus, not less.
+# check_budget_limit, dashboard _DEFAULT_PRICING). The Fable row (\$10/\$50) is
+# kept as the reference price, but since v7.39.1 fable is unavailable at the API
+# and a fable pin RESOLVES to Opus everywhere -- so a fable-pinned run both
+# dispatches AND quotes Opus (\$5/\$25), matching the runner. The Fable price row
+# is only reachable as an explicit advisory reference, not via a session pin.
 pricing = {
     'Fable':  {'input': 10.00, 'output': 50.00},
     'Opus':   {'input': 5.00, 'output': 25.00},
@@ -23691,7 +23746,16 @@ _docs_invoke_provider() {
 
     case "$provider" in
         claude)
-            result=$($t_prefix claude -p "$prompt" 2>/dev/null) || exit_code=$?
+            # caveman HARD-SUPPRESS (captured deliverable): the claude stdout IS
+            # the generated doc -- it is captured here and written verbatim to a
+            # markdown file by both callers (loki:23869, loki:24239). A globally
+            # active caveman would compress this stdout, corrupting the generated
+            # CLAUDE.md / DECISIONS.md / README into caveman-speak. So disable
+            # caveman unconditionally on this site (mirrors run.sh:3286, the
+            # structurally identical captured `claude -p` resolution subcall).
+            # env-prefix form because of the optional $t_prefix timeout wrapper.
+            # No-op when caveman is absent.
+            result=$($t_prefix env CAVEMAN_DEFAULT_MODE=off claude -p "$prompt" 2>/dev/null) || exit_code=$?
             ;;
         codex)
             result=$($t_prefix codex exec --full-auto "$prompt" 2>/dev/null) || exit_code=$?