loki-mode 7.42.0 → 7.43.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 11 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.42.0
+# Loki Mode v7.43.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -398,4 +398,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.42.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.43.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.42.0
+7.43.0

package/autonomy/app-runner.sh

@@ -156,6 +156,112 @@ _rewrite_detection_port() {
     _write_detection "$d_type" "$d_command"
 }
 
+# Collect the transitive descendant tree of a PID (children, grandchildren, ...).
+#
+# Echoes one PID per line, deepest-LAST is NOT guaranteed; order is breadth-first
+# from the root. The root PID itself is NOT included. Used by the non-setsid stop
+# fallback (BUG 1): the app is started as `( ... ) &` WITHOUT setsid, so on stock
+# macOS the whole tree (subshell -> bash -lc -> npm -> sh -> node -> workers)
+# inherits the ORCHESTRATOR's process group. A `kill -- -PGID` would therefore
+# signal run.sh and the Claude agent driving it (self-termination), so we MUST
+# walk parent->child links from OUR pid only. This guarantees we never signal a
+# process outside our own subtree: every returned pid has our root as an ancestor.
+#
+# Snapshot semantics: the caller MUST collect the full tree BEFORE sending any
+# signal. If we TERM top-down while walking, grandchildren reparent to init and
+# `pgrep -P <dead-parent>` returns nothing, re-creating the orphaned-worker bug
+# this fix exists to close.
+_app_runner_collect_descendants() {
+    local root="$1"
+    # Guard against empty / init / kernel pids: walking from 0/1 would sweep
+    # unrelated processes. A valid app pid is always > 1.
+    case "$root" in
+        ''|0|1) return 0 ;;
+    esac
+    if ! [[ "$root" =~ ^[0-9]+$ ]]; then
+        return 0
+    fi
+
+    local -a frontier=("$root")
+    local -a found=()
+    local pid child
+    local -a kids
+    # Bound iterations defensively against a pathological/looping tree.
+    local guard=0
+    while [ "${#frontier[@]}" -gt 0 ] && [ "$guard" -lt 10000 ]; do
+        guard=$(( guard + 1 ))
+        pid="${frontier[0]}"
+        frontier=("${frontier[@]:1}")
+        # Direct children of pid.
+        kids=()
+        while IFS= read -r child; do
+            [ -n "$child" ] && kids+=("$child")
+        done < <(pgrep -P "$pid" 2>/dev/null)
+        local k
+        for k in "${kids[@]:-}"; do
+            [ -n "$k" ] || continue
+            found+=("$k")
+            frontier+=("$k")
+        done
+    done
+
+    local f
+    for f in "${found[@]:-}"; do
+        [ -n "$f" ] && printf '%s\n' "$f"
+    done
+}
+
+# Signal an EXPLICIT, pre-captured set of PIDs with a given signal.
+#
+# Usage: _app_runner_signal_pids <SIGNAL> <pid> [pid ...]
+#
+# Why an explicit list and not "(re-)walk from root": a worker that traps
+# SIGTERM (a Node server doing graceful shutdown is the textbook case) survives
+# the TERM phase while its intermediate ancestors (npm, sh) die. Once the
+# ancestors die, the surviving worker reparents to init, so re-deriving the tree
+# from the now-dead root via `pgrep -P` would return NOTHING -- the KILL phase
+# would be skipped and the orphaned, port-holding worker would live on. That is
+# exactly the orphaned-worker bug (BUG 1) resurfacing at the force-kill phase.
+# The fix: the caller snapshots root + all descendants ONCE before any signal,
+# and every phase (TERM, aliveness, KILL) operates over that frozen list.
+#
+# Safety: the caller builds the list from _app_runner_collect_descendants, which
+# only ever follows parent->child links from OUR pid, so the list can never
+# contain a process outside our own subtree. We signal pids individually (never
+# a process group) because in the non-setsid path the app inherits the
+# orchestrator's process group; a group signal would kill run.sh and the agent.
+# Pids are signaled in REVERSE capture order so descendants (captured after the
+# root) are signaled before the root.
+_app_runner_signal_pids() {
+    local sig="$1"; shift
+    local -a pids=("$@")
+    local i p
+    for (( i=${#pids[@]}-1; i>=0; i-- )); do
+        p="${pids[$i]}"
+        case "$p" in
+            ''|0|1) continue ;;
+        esac
+        kill "-${sig}" "$p" 2>/dev/null || true
+    done
+}
+
+# True (0) if ANY pid in the EXPLICIT pre-captured list is still alive.
+# Used by the non-setsid stop grace-wait so a deep worker that outlived the main
+# subshell does not let us fall through to "stopped" prematurely. Operates over
+# the frozen snapshot for the same reason _app_runner_signal_pids does.
+_app_runner_any_alive() {
+    local p
+    for p in "$@"; do
+        case "$p" in
+            ''|0|1) continue ;;
+        esac
+        if kill -0 "$p" 2>/dev/null; then
+            return 0
+        fi
+    done
+    return 1
+}
+
 # Fix #2 (finding #597): reconcile the recorded port with the port the app
 # ACTUALLY bound, using the listen line in app.log as the source of truth. This
 # corrects the dashboard Live Preview even when the app ignores PORT and picks
@@ -887,32 +993,82 @@ app_runner_stop() {
         fi
     fi
 
+    # BUG 1 fix: on the non-setsid fallback (the DEFAULT path on stock macOS,
+    # which has no setsid) capture the FULL process subtree -- root + every
+    # transitive descendant -- ONCE, BEFORE sending any signal. The old
+    # `pkill -TERM -P <pid>` reached only ONE level of children, so deep workers
+    # (npm -> sh -> node -> workers) holding the listening socket survived as
+    # orphans and kept the port bound, blocking the next start.
+    #
+    # Capturing once is load-bearing: a worker that traps SIGTERM survives the
+    # TERM phase while its intermediate ancestors die, then reparents to init.
+    # Re-deriving the tree from the now-dead root would return nothing and skip
+    # the KILL phase, leaving the port-holder alive. Every phase below (TERM,
+    # grace-wait, KILL) operates over this one frozen snapshot instead.
+    local -a _stop_snapshot=()
+    if [ "$_APP_RUNNER_HAS_SETSID" != true ]; then
+        _stop_snapshot=("$_APP_RUNNER_PID")
+        local _snap_d
+        while IFS= read -r _snap_d; do
+            [ -n "$_snap_d" ] && _stop_snapshot+=("$_snap_d")
+        done < <(_app_runner_collect_descendants "$_APP_RUNNER_PID")
+    fi
+
     # Send SIGTERM to process and children
     if [ "$_APP_RUNNER_HAS_SETSID" = true ]; then
+        # setsid path: the app is its own process group leader, so a group
+        # signal reaches the whole tree safely. Unchanged.
         kill -TERM "-$_APP_RUNNER_PID" 2>/dev/null || kill -TERM "$_APP_RUNNER_PID" 2>/dev/null || true
     else
-        pkill -TERM -P "$_APP_RUNNER_PID" 2>/dev/null || true
-        kill -TERM "$_APP_RUNNER_PID" 2>/dev/null || true
+        # Group-kill is NOT used here: in this path the app inherits the
+        # orchestrator's process group, so a group signal would kill run.sh and
+        # the agent driving it. Signal the frozen snapshot, descendants first.
+        _app_runner_signal_pids TERM "${_stop_snapshot[@]}"
     fi
 
-    # Wait up to 5 seconds for graceful shutdown
+    # Wait up to 5 seconds for graceful shutdown. Key the wait on the WHOLE
+    # snapshot being alive (not just the main pid): a deep worker can outlive the
+    # main subshell, and treating the main pid's exit as "done" is exactly what
+    # let workers leak before. setsid path keeps the simpler main-pid check.
     local waited=0
     while [ "$waited" -lt 5 ]; do
-        if ! kill -0 "$_APP_RUNNER_PID" 2>/dev/null; then
-            break
+        if [ "$_APP_RUNNER_HAS_SETSID" = true ]; then
+            kill -0 "$_APP_RUNNER_PID" 2>/dev/null || break
+        else
+            _app_runner_any_alive "${_stop_snapshot[@]}" || break
         fi
         sleep 1
         waited=$(( waited + 1 ))
     done
 
     # Force kill if still running
-    if kill -0 "$_APP_RUNNER_PID" 2>/dev/null; then
+    local _still_alive=false
+    if [ "$_APP_RUNNER_HAS_SETSID" = true ]; then
+        kill -0 "$_APP_RUNNER_PID" 2>/dev/null && _still_alive=true
+    else
+        _app_runner_any_alive "${_stop_snapshot[@]}" && _still_alive=true
+    fi
+    if [ "$_still_alive" = true ]; then
         log_warn "App Runner: process did not stop gracefully, sending SIGKILL"
         if [ "$_APP_RUNNER_HAS_SETSID" = true ]; then
             kill -KILL "-$_APP_RUNNER_PID" 2>/dev/null || kill -KILL "$_APP_RUNNER_PID" 2>/dev/null || true
         else
-            pkill -KILL -P "$_APP_RUNNER_PID" 2>/dev/null || true
-            kill -KILL "$_APP_RUNNER_PID" 2>/dev/null || true
+            # BUG 1 fix (KILL phase): SIGKILL the SAME frozen snapshot (root +
+            # all descendants captured pre-signal), so a TERM-trapping worker
+            # that reparented to init is still force-killed. SIGKILL cannot be
+            # trapped, so this is the terminal guarantee that no port-holder
+            # survives. The snapshot does the real work. The fresh walk below only
+            # adds anything while the root is still alive (a worker spawned during
+            # shutdown); once the root is dead it is empty and the snapshot covers.
+            _app_runner_signal_pids KILL "${_stop_snapshot[@]}"
+            local -a _kill_fresh=()
+            local _kf
+            while IFS= read -r _kf; do
+                [ -n "$_kf" ] && _kill_fresh+=("$_kf")
+            done < <(_app_runner_collect_descendants "$_APP_RUNNER_PID")
+            if [ "${#_kill_fresh[@]}" -gt 0 ]; then
+                _app_runner_signal_pids KILL "${_kill_fresh[@]}"
+            fi
         fi
     fi
 
@@ -1094,6 +1250,11 @@ app_runner_watchdog() {
     # it restarts the stack under the same crash-count circuit breaker.
     if [ "$_APP_RUNNER_IS_DOCKER" = true ] && echo "$_APP_RUNNER_METHOD" | grep -q "docker compose"; then
         if app_runner_health_check; then
+            # BUG 3 fix: the breaker is meant to fire on 5 CONSECUTIVE failures.
+            # A confirmed-healthy observation clears any accumulated count so a
+            # long-lived stack that recovered from a few transient blips is not
+            # tripped permanently on cumulative (non-consecutive) crashes.
+            _APP_RUNNER_CRASH_COUNT=0
             return 0
         fi
         _APP_RUNNER_CRASH_COUNT=$(( _APP_RUNNER_CRASH_COUNT + 1 ))
@@ -1125,6 +1286,11 @@ app_runner_watchdog() {
 
     # Process alive, nothing to do
     if kill -0 "$_APP_RUNNER_PID" 2>/dev/null; then
+        # BUG 3 fix: a confirmed-alive observation clears the accumulated crash
+        # count so the breaker fires only on 5 CONSECUTIVE deaths, not on 5
+        # cumulative crashes that were each successfully recovered over a long
+        # session (which would trip the breaker on a HEALTHY app).
+        _APP_RUNNER_CRASH_COUNT=0
         return 0
     fi
 

package/autonomy/completion-council.sh

@@ -1519,8 +1519,17 @@ council_evidence_gate() {
         if committed_files=$(git diff --name-only "$base_sha" HEAD 2>/dev/null); then
             :
         else
-            # Base present but unreachable (e.g. shallow clone): fall back to
-            # working-tree diff vs HEAD (mirrors proof-generator.py fallback).
+            # Base present but UNREACHABLE (e.g. shallow clone, history rewrite,
+            # or `git reset --hard` -- a documented live hazard). The diff vs the
+            # run-start SHA cannot be computed, so we can no longer prove that the
+            # committed-union diff is empty. Treat this as INCONCLUSIVE, not as
+            # positive empty-diff fabrication evidence: an agent that committed
+            # all its work leaves a clean working tree, and `git diff HEAD` would
+            # read empty -> a false BLOCK. We still fall back to the working-tree
+            # diff vs HEAD to capture any uncommitted work, but the empty-diff
+            # block is suppressed below via the diff_inconclusive guard.
+            diff_inconclusive="true"
+            diff_inconclusive_reason="base_unreachable"
             committed_files=$(git diff --name-only HEAD 2>/dev/null || echo "")
         fi
         unstaged_files=$(git diff --name-only HEAD 2>/dev/null || echo "")
@@ -1543,7 +1552,11 @@ council_evidence_gate() {
         else
             diff_files=0
         fi
-        if [ "$diff_files" -eq 0 ]; then
+        # Only treat an empty union as positive fabrication evidence when the
+        # baseline was CONCLUSIVE. If the base SHA was unreachable (history
+        # rewrite / reset --hard), a clean committed tree yields an empty
+        # working-tree diff that must NOT read as empty-diff fabrication.
+        if [ "$diff_files" -eq 0 ] && [ "$diff_inconclusive" != "true" ]; then
             diff_fails="true"
         fi
     fi

package/autonomy/loki

@@ -1057,6 +1057,7 @@ cmd_start() {
                 echo "Options:"
                 echo "  --provider NAME       AI provider: claude (default), codex, cline, aider"
                 echo "  --parallel            Enable parallel mode with git worktrees"
+                echo "  --allow-haiku         Enable Haiku model for the fast tier (default: disabled)"
                 echo "  --bg, --background    Run in background mode"
                 echo "  --simple              Force simple complexity tier (3 phases)"
                 echo "  --complex             Force complex complexity tier (8 phases)"
@@ -1180,6 +1181,17 @@ cmd_start() {
                 args+=("--parallel")
                 shift
                 ;;
+            --allow-haiku)
+                # Enable Haiku for the fast tier. Mirrors the LOKI_ALLOW_HAIKU=true
+                # env var (consumed by providers/claude.sh and run.sh). Documented in
+                # loki --help and run.sh; previously only the env var worked here, so
+                # `loki start ./prd.md --allow-haiku` aborted with "Unknown option".
+                # Export reaches the runner; also forward as an arg so the run.sh
+                # parser (run.sh:15015) sees it on every route.
+                export LOKI_ALLOW_HAIKU=true
+                args+=("--allow-haiku")
+                shift
+                ;;
             --regen-prd|--regenerate-prd|--regen|--fresh-prd)
                 # v7.8.1: force a fresh generated PRD on a no-PRD run, overriding
                 # the staleness-aware reuse (decide_generated_prd_action in

package/autonomy/run.sh

@@ -7041,6 +7041,48 @@ enforce_test_coverage() {
             local output
             output=$(cd "${TARGET_DIR:-.}" && timeout "$gate_timeout" npx mocha 2>&1) || test_passed=false
             details="mocha: $(echo "$output" | tail -3 | tr '\n' ' ')"
+        else
+            # v7.41.x (test-coverage fail-open fix): a real "scripts.test" was
+            # previously missed entirely. A greenfield project whose package.json
+            # has {"scripts":{"test":"node --test"}} (or any non-placeholder test
+            # script) actually runs a working suite via `npm test`, yet the gate
+            # reported runner:none + pass:true -- so a project whose tests FAIL
+            # green-lit identically. Detect a real test script (excluding the npm
+            # placeholder "no test specified") with a JSON parser, not grep (grep
+            # would false-positive on devDeps / unrelated keys), then run the
+            # configured command. This MUST sit before the monorepo/python/go/rust
+            # checks, all of which gate on test_runner=="none".
+            local _pkg_test_script
+            _pkg_test_script=$(_LOKI_PKG="${TARGET_DIR:-.}/package.json" python3 -c "
+import json, os, sys
+try:
+    with open(os.environ['_LOKI_PKG']) as f:
+        d = json.load(f)
+except Exception:
+    sys.exit(0)
+t = (d.get('scripts') or {}).get('test') or ''
+# npm's default placeholder; treat as 'no test'.
+if 'no test specified' in t.lower():
+    sys.exit(0)
+sys.stdout.write(t.strip())
+" 2>/dev/null || echo "")
+            if [ -n "$_pkg_test_script" ]; then
+                # LOKI_TEST_COMMAND lets an operator override the invocation; the
+                # default is the project's own `npm test`.
+                local _test_cmd="${LOKI_TEST_COMMAND:-npm test}"
+                # Label the runner by what the script invokes so evidence is
+                # honest (node --test, vitest, jest, etc. all surface here).
+                case "$_pkg_test_script" in
+                    *"node --test"*|*"node:test"*) test_runner="node-test" ;;
+                    *vitest*) test_runner="vitest" ;;
+                    *jest*)   test_runner="jest" ;;
+                    *mocha*)  test_runner="mocha" ;;
+                    *)        test_runner="npm-test" ;;
+                esac
+                local output
+                output=$(cd "${TARGET_DIR:-.}" && timeout "$gate_timeout" sh -c "$_test_cmd" 2>&1) || test_passed=false
+                details="$test_runner ($_test_cmd): $(echo "$output" | tail -5 | tr '\n' ' ')"
+            fi
         fi
     fi
 
@@ -7165,10 +7207,23 @@ enforce_test_coverage() {
     fi
 
     if [ "$test_runner" = "none" ]; then
-        log_info "Test coverage: no test runner detected, skipping"
+        log_info "Test coverage: no test runner detected, recording inconclusive (not pass)"
+        # v7.41.x fail-open fix: previously this wrote pass:true, so a project
+        # whose tests truly do not run was indistinguishable from one whose tests
+        # passed. Record pass:"inconclusive" instead. The completion-council
+        # evidence gate already treats runner=="none" as pass-through regardless
+        # of the pass value (completion-council.sh: runner=='none' short-circuits
+        # BEFORE the `passed is False` block), so genuinely-no-tests stays
+        # non-blocking (no infinite hang), while the JSON record is now honest:
+        # "no tests" never reads as "tests passed". A DETECTED runner that fails
+        # still writes pass:false below and BLOCKS.
+        #
+        # unit-tests.pass is only read for the status-line display (run.sh ~2183,
+        # PASS vs PENDING); keeping the touch preserves the historical
+        # non-blocking behavior for legitimate no-test projects.
         touch "$quality_dir/unit-tests.pass"
         cat > "$quality_dir/test-results.json" << TREOF
-{"timestamp":"$(date -u +%Y-%m-%dT%H:%M:%SZ)","runner":"none","pass":true,"summary":"No test runner detected"}
+{"timestamp":"$(date -u +%Y-%m-%dT%H:%M:%SZ)","runner":"none","pass":"inconclusive","summary":"No test runner detected"}
 TREOF
         # Finding #598: stamp the per-iteration freshness marker so a later
         # completion-route capture (ensure_completion_test_evidence) reuses this
@@ -14161,6 +14216,22 @@ if __name__ == "__main__":
                 log_warn "  Review details under .loki/quality/reviews/ ; gate_failures=${gate_failures}"
                 _gate_block_for_completion=""
                 # Fall through; the gate-failed loop continues normally
+            # HIGH (trust-gate): the checklist hard gate must also guard the
+            # DEFAULT completion-promise / loki_complete_task route, not only the
+            # interval-gated council path (council_evaluate) and the dashboard
+            # force-review path -- both of which already call this gate. Without
+            # it, an agent that leaves a `priority: critical` checklist item
+            # `failing` and claims done on a non-council-interval iteration would
+            # ship, bypassing the checklist gate entirely. council_reverify_checklist
+            # ran above (when a claim is present) so statuses are fresh here.
+            # Mirrors the evidence/held-out gate arms below. No-op safe:
+            # council_checklist_gate returns 0 (pass) when there is no checklist
+            # results file or when no critical items are failing, so this branch
+            # never fires on those projects. Gate output is written by the gate.
+            elif [ "$_completion_claimed" = 1 ] && type council_checklist_gate &>/dev/null && ! council_checklist_gate; then
+                log_warn "Completion claim rejected: critical checklist item(s) failing (hard gate)."
+                log_warn "  Details under .loki/council/gate-block.json"
+                # Fall through; keep iterating until critical checklist items pass.
             # v7.19.1: the verified-completion evidence gate must also guard the
             # DEFAULT completion route (a completion claim via loki_complete_task
             # / the completion-promise text), not only the interval-gated council

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.42.0"
+__version__ = "7.43.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/static/index.html

@@ -3910,7 +3910,7 @@ var LokiDashboard=(()=>{var Ee=Object.defineProperty;var rt=Object.getOwnPropert
       `:e.steps!==void 0?`
         <div class="detail-panel">
           <div class="detail-header">
-            <h3>Skill: ${e.name}</h3>
+            <h3>Skill: ${this._escapeHtml(e.name)}</h3>
             <button class="close-btn" id="close-detail">&times;</button>
           </div>
           <div class="detail-body">
@@ -5518,7 +5518,7 @@ var LokiDashboard=(()=>{var Ee=Object.defineProperty;var rt=Object.getOwnPropert
           ${this._renderTabContent()}
         </div>
 
-        ${this._error?`<div class="error-banner">${this._error}</div>`:""}
+        ${this._error?`<div class="error-banner">${this._escapeHtml(this._error)}</div>`:""}
       </div>
     `,this._attachEventListeners())}_attachEventListeners(){let e=this.shadowRoot;if(!e)return;let t=e.getElementById("force-review-btn");t&&t.addEventListener("click",()=>this._forceReview()),e.querySelectorAll(".tab[data-tab]").forEach(i=>{i.addEventListener("click",()=>this._setTab(i.dataset.tab))})}_renderTabContent(){switch(this._activeTab){case"overview":return this._renderOverview();case"decisions":return this._renderDecisions();case"convergence":return this._renderConvergence();case"agents":return this._renderAgents();default:return""}}_renderOverview(){let e=this._councilState||{},t=e.consecutive_no_change||0,i=e.done_signals||0,a=e.total_votes||0,s=e.approve_votes||0,r=this._verdicts.length>0?this._verdicts[this._verdicts.length-1]:null,o=this._agents.filter(n=>n.alive).length;return`
       <div class="overview-grid">
@@ -5631,27 +5631,27 @@ var LokiDashboard=(()=>{var Ee=Object.defineProperty;var rt=Object.getOwnPropert
           <div class="agent-card ${this._selectedAgent?.id===t.id?"agent-selected":""}"
                data-agent-index="${i}">
             <div class="agent-header">
-              <span class="agent-name">${t.name||t.id||"Unknown"}</span>
+              <span class="agent-name">${this._escapeHtml(t.name||t.id||"Unknown")}</span>
               <span class="agent-status ${t.alive?"status-alive":"status-dead"}">
                 ${t.alive?"Running":"Stopped"}
               </span>
             </div>
             <div class="agent-meta">
-              ${t.type?`<span class="agent-type">${t.type}</span>`:""}
+              ${t.type?`<span class="agent-type">${this._escapeHtml(t.type)}</span>`:""}
               ${t.pid?`<span class="agent-pid">PID: ${t.pid}</span>`:""}
-              ${t.task?`<span class="agent-task">Task: ${t.task}</span>`:""}
+              ${t.task?`<span class="agent-task">Task: ${this._escapeHtml(t.task)}</span>`:""}
             </div>
             ${this._selectedAgent?.id===t.id?`
               <div class="agent-actions">
                 ${t.alive?`
-                  <button class="btn btn-sm btn-warn" data-action="pause" data-agent-id="${t.id||t.name}">
+                  <button class="btn btn-sm btn-warn" data-action="pause" data-agent-id="${this._escapeHtml(t.id||t.name)}">
                     Pause
                   </button>
-                  <button class="btn btn-sm btn-danger" data-action="kill" data-agent-id="${t.id||t.name}">
+                  <button class="btn btn-sm btn-danger" data-action="kill" data-agent-id="${this._escapeHtml(t.id||t.name)}">
                     Kill
                   </button>
                 `:`
-                  <button class="btn btn-sm btn-primary" data-action="resume" data-agent-id="${t.id||t.name}">
+                  <button class="btn btn-sm btn-primary" data-action="resume" data-agent-id="${this._escapeHtml(t.id||t.name)}">
                     Resume
                   </button>
                 `}
@@ -5660,7 +5660,7 @@ var LokiDashboard=(()=>{var Ee=Object.defineProperty;var rt=Object.getOwnPropert
           </div>
         `).join("")}
       </div>
-    `;return this._pendingRaf=requestAnimationFrame(()=>{this._pendingRaf=null;let t=this.shadowRoot;t&&t.querySelectorAll(".agent-card[data-agent-index]").forEach(i=>{let a=parseInt(i.dataset.agentIndex,10),s=this._agents[a];s&&(i.addEventListener("click",()=>this._selectAgent(s)),i.querySelectorAll("[data-action]").forEach(r=>{r.addEventListener("click",o=>{o.stopPropagation();let n=r.dataset.action,l=r.dataset.agentId;n==="pause"?this._pauseAgent(l):n==="kill"?this._killAgent(l):n==="resume"&&this._resumeAgent(l)})}))})}),e}_formatTime(e){if(!e)return"";try{return new Date(e).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"})}catch{return e}}_getStyles(){return`
+    `;return this._pendingRaf=requestAnimationFrame(()=>{this._pendingRaf=null;let t=this.shadowRoot;t&&t.querySelectorAll(".agent-card[data-agent-index]").forEach(i=>{let a=parseInt(i.dataset.agentIndex,10),s=this._agents[a];s&&(i.addEventListener("click",()=>this._selectAgent(s)),i.querySelectorAll("[data-action]").forEach(r=>{r.addEventListener("click",o=>{o.stopPropagation();let n=r.dataset.action,l=r.dataset.agentId;n==="pause"?this._pauseAgent(l):n==="kill"?this._killAgent(l):n==="resume"&&this._resumeAgent(l)})}))})}),e}_formatTime(e){if(!e)return"";try{return new Date(e).toLocaleTimeString([],{hour:"2-digit",minute:"2-digit"})}catch{return e}}_escapeHtml(e){return e?String(e).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;"):""}_getStyles(){return`
       :host {
         display: block;
         font-family: 'Inter', -apple-system, BlinkMacSystemFont, sans-serif;

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.42.0
+**Version:** v7.43.0
 
 ---
 

package/events/bus.py

@@ -328,17 +328,20 @@ class EventBus:
             Events as they arrive
         """
         start_time = time.time()
-        last_check = datetime.now(timezone.utc).isoformat()
 
         while True:
             if timeout and (time.time() - start_time) > timeout:
                 break
 
-            # Set last_check BEFORE fetching to avoid missing events that
-            # arrive between fetch and timestamp update
-            next_check = datetime.now(timezone.utc).isoformat()
-            events = self.get_pending_events(types=types, since=last_check)
-            last_check = next_check
+            # Dedup is driven solely by _processed_ids (maintained via
+            # mark_processed), NOT by a wall-clock `since` window. A local
+            # `since=now` filter silently drops any event whose timestamp is
+            # at or behind the subscriber's clock: cross-process clock skew
+            # (an emitter a few ms/s behind) or second-granularity timestamps
+            # (emit.sh's .000Z fallback) would lose events forever. This
+            # mirrors start_background_processing() and bus.ts, which both
+            # call get_pending_events with no `since` argument.
+            events = self.get_pending_events(types=types)
 
             for event in events:
                 yield event

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var n6=Object.defineProperty;var a6=($)=>$;function s6($,Q){this[$]=a6.bind(null,Q)}var h=($,Q)=>{for(var Z in Q)n6($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:s6.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var K$=import.meta.require;var S1={};h(S1,{lokiDir:()=>P,homeLokiDir:()=>o$,findRepoRootForVersion:()=>d$,REPO_ROOT:()=>m});import{resolve as n,dirname as l$}from"path";import{fileURLToPath as t6}from"url";import{existsSync as P$}from"fs";import{homedir as r6}from"os";function i6(){let $=N1;for(let Q=0;Q<6;Q++){if(P$(n($,"VERSION"))&&P$(n($,"autonomy/run.sh")))return $;let Z=l$($);if(Z===$)break;$=Z}return n(N1,"..","..","..")}function d$($){let Q=$;for(let Z=0;Z<6;Z++){if(P$(n(Q,"VERSION"))&&P$(n(Q,"autonomy/run.sh")))return Q;let z=l$(Q);if(z===Q)break;Q=z}return n($,"..","..","..")}function P(){return process.env.LOKI_DIR??n(process.cwd(),".loki")}function o$(){return n(r6(),".loki")}var N1,m;var C=L(()=>{N1=l$(t6(import.meta.url));m=i6()});import{readFileSync as e6}from"fs";import{resolve as $Q,dirname as QQ}from"path";import{fileURLToPath as ZQ}from"url";function F$(){if($$!==null)return $$;let $="7.42.0";if(typeof $==="string"&&$.length>0)return $$=$,$$;try{let Q=QQ(ZQ(import.meta.url)),Z=d$(Q);$$=e6($Q(Z,"VERSION"),"utf-8").trim()}catch{$$="unknown"}return $$}var $$=null;var n$=L(()=>{C()});var C1={};h(C1,{runOrThrow:()=>zQ,run:()=>j,commandVersion:()=>KQ,commandExists:()=>f,ShellError:()=>a$});async function j($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[W,K,U]=await Promise.all([new Response(Z.stdout).text(),new Response(Z.stderr).text(),Z.exited]);return{stdout:W,stderr:K,exitCode:U}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function zQ($,Q={}){let Z=await j($,Q);if(Z.exitCode!==0)throw new a$(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=XQ($),Z=await j(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function XQ($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function KQ($,Q="--version"){if(!await f($))return null;let z=await j([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var a$;var d=L(()=>{a$=class a$ extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function a($){return WQ?"":$}var WQ,T,S,I,TZ,w,R,y,q;var c=L(()=>{WQ=(process.env.NO_COLOR??"").length>0;T=a("\x1B[0;31m"),S=a("\x1B[0;32m"),I=a("\x1B[1;33m"),TZ=a("\x1B[0;34m"),w=a("\x1B[0;36m"),R=a("\x1B[1m"),y=a("\x1B[2m"),q=a("\x1B[0m")});import{existsSync as TQ}from"fs";async function Q$(){if(B$!==void 0)return B$;let $="/opt/homebrew/bin/python3.12";if(TQ($))return B$=$,$;let Q=await f("python3.12");if(Q)return B$=Q,Q;let Z=await f("python3");return B$=Z,Z}async function Z$($,Q={}){let Z=await Q$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return j([Z,"-c",$],Q)}var B$;var W$=L(()=>{d()});var t1={};h(t1,{runStatus:()=>gQ});import{existsSync as v,readFileSync as U$,readdirSync as l1,statSync as d1}from"fs";import{resolve as D,basename as xQ}from"path";import{homedir as NQ}from"os";async function DQ(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${q}
+var n6=Object.defineProperty;var a6=($)=>$;function s6($,Q){this[$]=a6.bind(null,Q)}var h=($,Q)=>{for(var Z in Q)n6($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:s6.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var K$=import.meta.require;var S1={};h(S1,{lokiDir:()=>P,homeLokiDir:()=>o$,findRepoRootForVersion:()=>d$,REPO_ROOT:()=>m});import{resolve as n,dirname as l$}from"path";import{fileURLToPath as t6}from"url";import{existsSync as P$}from"fs";import{homedir as r6}from"os";function i6(){let $=N1;for(let Q=0;Q<6;Q++){if(P$(n($,"VERSION"))&&P$(n($,"autonomy/run.sh")))return $;let Z=l$($);if(Z===$)break;$=Z}return n(N1,"..","..","..")}function d$($){let Q=$;for(let Z=0;Z<6;Z++){if(P$(n(Q,"VERSION"))&&P$(n(Q,"autonomy/run.sh")))return Q;let z=l$(Q);if(z===Q)break;Q=z}return n($,"..","..","..")}function P(){return process.env.LOKI_DIR??n(process.cwd(),".loki")}function o$(){return n(r6(),".loki")}var N1,m;var C=L(()=>{N1=l$(t6(import.meta.url));m=i6()});import{readFileSync as e6}from"fs";import{resolve as $Q,dirname as QQ}from"path";import{fileURLToPath as ZQ}from"url";function F$(){if($$!==null)return $$;let $="7.43.0";if(typeof $==="string"&&$.length>0)return $$=$,$$;try{let Q=QQ(ZQ(import.meta.url)),Z=d$(Q);$$=e6($Q(Z,"VERSION"),"utf-8").trim()}catch{$$="unknown"}return $$}var $$=null;var n$=L(()=>{C()});var C1={};h(C1,{runOrThrow:()=>zQ,run:()=>j,commandVersion:()=>KQ,commandExists:()=>f,ShellError:()=>a$});async function j($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[W,K,U]=await Promise.all([new Response(Z.stdout).text(),new Response(Z.stderr).text(),Z.exited]);return{stdout:W,stderr:K,exitCode:U}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function zQ($,Q={}){let Z=await j($,Q);if(Z.exitCode!==0)throw new a$(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=XQ($),Z=await j(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function XQ($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function KQ($,Q="--version"){if(!await f($))return null;let z=await j([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var a$;var d=L(()=>{a$=class a$ extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function a($){return WQ?"":$}var WQ,T,S,I,TZ,w,R,y,q;var c=L(()=>{WQ=(process.env.NO_COLOR??"").length>0;T=a("\x1B[0;31m"),S=a("\x1B[0;32m"),I=a("\x1B[1;33m"),TZ=a("\x1B[0;34m"),w=a("\x1B[0;36m"),R=a("\x1B[1m"),y=a("\x1B[2m"),q=a("\x1B[0m")});import{existsSync as TQ}from"fs";async function Q$(){if(B$!==void 0)return B$;let $="/opt/homebrew/bin/python3.12";if(TQ($))return B$=$,$;let Q=await f("python3.12");if(Q)return B$=Q,Q;let Z=await f("python3");return B$=Z,Z}async function Z$($,Q={}){let Z=await Q$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return j([Z,"-c",$],Q)}var B$;var W$=L(()=>{d()});var t1={};h(t1,{runStatus:()=>gQ});import{existsSync as v,readFileSync as U$,readdirSync as l1,statSync as d1}from"fs";import{resolve as D,basename as xQ}from"path";import{homedir as NQ}from"os";async function DQ(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${q}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -789,4 +789,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(o6),2}}p1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var ZZ=await QZ(Bun.argv.slice(2));process.exit(ZZ);
 
-//# debugId=D7F92E946CD3E45564756E2164756E21
+//# debugId=D2E334AA5C606B8064756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.42.0'
+__version__ = '7.43.0'

package/mcp/server.py

@@ -1257,6 +1257,12 @@ async def get_continuity() -> str:
         return "# CONTINUITY.md not found"
     except PathTraversalError:
         return "# Access denied"
+    except Exception as e:
+        # Match the tool-handler error-envelope pattern so a corrupt or
+        # unreadable state file (e.g. IsADirectoryError, OSError) returns an
+        # honest error string instead of raising uncaught into the MCP runtime.
+        logger.error(f"get_continuity failed: {e}")
+        return f"# Error reading CONTINUITY.md: {e}"
 
 
 @mcp.resource("loki://memory/index")
@@ -1271,14 +1277,26 @@ async def get_memory_index() -> str:
                 return json.dumps(index_data)
             return json.dumps({"topics": [], "message": "Index not initialized"})
 
-        # Fallback to direct file read
+        # Fallback to direct file read. Parse-and-reserialize so a corrupt
+        # index.json yields a clean error envelope instead of serving corrupt
+        # bytes as a successful response (or raising on a downstream consumer).
         index_path = safe_path_join('.loki', 'memory', 'index.json')
         if os.path.exists(index_path):
             with safe_open(index_path, 'r') as f:
-                return f.read()
+                raw = f.read()
+            try:
+                return json.dumps(json.loads(raw))
+            except (json.JSONDecodeError, ValueError) as e:
+                logger.error(f"get_memory_index: corrupt index.json: {e}")
+                return json.dumps({"error": f"corrupt index.json: {e}", "topics": []})
         return json.dumps({"topics": [], "message": "Index not initialized"})
     except PathTraversalError:
         return json.dumps({"error": "Access denied", "topics": []})
+    except Exception as e:
+        # Generic envelope so any other state-file failure (OSError,
+        # IsADirectoryError) returns honestly rather than raising uncaught.
+        logger.error(f"get_memory_index failed: {e}")
+        return json.dumps({"error": str(e), "topics": []})
 
 
 @mcp.resource("loki://queue/pending")
@@ -1304,6 +1322,12 @@ async def get_pending_tasks() -> str:
         return json.dumps({"pending_tasks": [], "count": 0})
     except PathTraversalError:
         return json.dumps({"error": "Access denied", "pending_tasks": [], "count": 0})
+    except Exception as e:
+        # Generic envelope: a degraded install (STATE_MANAGER_AVAILABLE=False)
+        # does a bare json.load on .loki/state/task-queue.json; a corrupt file
+        # raises JSONDecodeError that must return an error, not crash the runtime.
+        logger.error(f"get_pending_tasks failed: {e}")
+        return json.dumps({"error": str(e), "pending_tasks": [], "count": 0})
 
 
 # ============================================================

package/memory/vector_index.py

@@ -281,7 +281,12 @@ class VectorIndex:
         import tempfile
         npz_path = f"{path}.npz"
         npz_dir = os.path.dirname(npz_path) or "."
-        tmp_fd, tmp_path = tempfile.mkstemp(dir=npz_dir, suffix=".npz.tmp")
+        # The temp file MUST end in ".npz". np.savez appends ".npz" to any
+        # target whose name does not already end in ".npz", so a ".npz.tmp"
+        # suffix would make numpy write the real archive to <tmp>.npz and leave
+        # the original temp file 0 bytes. os.replace would then move the empty
+        # file into place and orphan the real data (corrupting every index).
+        tmp_fd, tmp_path = tempfile.mkstemp(dir=npz_dir, suffix=".npz")
         os.close(tmp_fd)
         try:
             np.savez(

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.42.0",
+  "version": "7.43.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 11 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.42.0",
+  "version": "7.43.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 11 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/providers/codex.sh

@@ -116,10 +116,17 @@ provider_version() {
 # Invocation function
 # Note: Codex uses positional prompt, not -p flag
 # Note: Reasoning effort is configured via environment or config, not CLI flag
+# v7.x: pin the resolved model explicitly via -m/--model. Without it, codex
+# falls back to the installed CLI's built-in default (e.g. gpt-5.5 on codex
+# 0.132.0), which silently ignores _codex_validate_model and makes the run.sh
+# cost table (priced for gpt-5.3-codex) wrong. --model is the documented model
+# selector and is readable in process listings.
 provider_invoke() {
     local prompt="$1"
     shift
-    codex exec --full-auto --skip-git-repo-check "$prompt" "$@"
+    codex exec --full-auto --skip-git-repo-check \
+        --model "$PROVIDER_MODEL_DEVELOPMENT" \
+        "$prompt" "$@"
 }
 
 # Model tier to effort level parameter (Codex uses effort, not separate models)
@@ -197,6 +204,18 @@ provider_invoke_with_tier() {
     local effort
     effort=$(resolve_model_for_tier "$tier")
 
+    # Resolve the model name by tier. These three vars can diverge via the
+    # generic LOKI_MODEL_* env (each validated by _codex_validate_model), so
+    # honor the tier rather than hardcoding development. Capability aliases
+    # (best/balanced/cheap) mirror resolve_model_for_tier's mapping.
+    local model
+    case "$tier" in
+        planning|best)        model="$PROVIDER_MODEL_PLANNING" ;;
+        development|balanced) model="$PROVIDER_MODEL_DEVELOPMENT" ;;
+        fast|cheap)           model="$PROVIDER_MODEL_FAST" ;;
+        *)                    model="$PROVIDER_MODEL_DEVELOPMENT" ;;
+    esac
+
     local extra_flags=()
     if [ "${LOKI_CODEX_WEB_SEARCH:-false}" = "true" ]; then
         extra_flags+=(--search)
@@ -211,6 +230,7 @@ provider_invoke_with_tier() {
         --ask-for-approval never \
         --sandbox danger-full-access \
         --skip-git-repo-check \
+        --model "$model" \
         "${extra_flags[@]}" \
         "$prompt" "$@"
 }