loki-mode 7.45.0 → 7.45.1

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 11 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.45.0
+# Loki Mode v7.45.1
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -407,4 +407,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.45.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.45.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.45.0
+7.45.1

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.45.0"
+__version__ = "7.45.1"
 
 # Expose the control app for easy import
 try:

package/dashboard/registry.py

@@ -9,9 +9,11 @@ from __future__ import annotations
 
 import json
 import os
+import tempfile
+from contextlib import contextmanager
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Optional
+from typing import Iterator, Optional
 import hashlib
 
 
@@ -25,6 +27,62 @@ def _ensure_registry_dir() -> None:
     REGISTRY_DIR.mkdir(parents=True, exist_ok=True)
 
 
+@contextmanager
+def _registry_lock() -> Iterator[None]:
+    """
+    Best-effort advisory lock around a read-modify-write of the registry.
+
+    Two concurrent writers (e.g. two `loki docker start` in different repos, or
+    a docker run racing a host `loki start`) would otherwise both load the old
+    registry, mutate, and save, dropping one writer's entry (lost update). This
+    serializes the leaf mutators so they take turns.
+
+    Degrades gracefully: if fcntl is unavailable (Windows) or the lock cannot
+    be acquired for any reason, execution proceeds without a lock rather than
+    blocking a build. The atomic write in _save_registry still guarantees no
+    reader ever sees a torn file; only the lost-update protection is
+    best-effort.
+
+    The lock path is derived from the current REGISTRY_DIR at call time (not a
+    module-level constant) so tests that monkeypatch REGISTRY_DIR stay
+    hermetic. Not reentrant: do not nest this around another leaf mutator (the
+    leaf mutators do not call one another).
+    """
+    _ensure_registry_dir()
+    lock_fd = None
+    locked = False
+    try:
+        import fcntl  # POSIX only; absent on Windows
+
+        lock_path = REGISTRY_DIR / ".registry.lock"
+        try:
+            lock_fd = os.open(str(lock_path), os.O_CREAT | os.O_RDWR, 0o644)
+            fcntl.flock(lock_fd, fcntl.LOCK_EX)
+            locked = True
+        except OSError:
+            # Could not open or lock the file; proceed without the lock.
+            locked = False
+    except ImportError:
+        # fcntl not available (e.g. Windows); proceed without the lock.
+        lock_fd = None
+
+    try:
+        yield
+    finally:
+        if lock_fd is not None:
+            try:
+                if locked:
+                    import fcntl
+
+                    fcntl.flock(lock_fd, fcntl.LOCK_UN)
+            except (OSError, ImportError):
+                pass
+            try:
+                os.close(lock_fd)
+            except OSError:
+                pass
+
+
 def _load_registry() -> dict:
     """Load the project registry from disk."""
     _ensure_registry_dir()
@@ -38,10 +96,39 @@ def _load_registry() -> dict:
 
 
 def _save_registry(registry: dict) -> None:
-    """Save the project registry to disk."""
+    """
+    Save the project registry to disk atomically.
+
+    Writes to a temp file in the SAME directory as REGISTRY_FILE (so os.replace
+    is an atomic rename on the same filesystem), flushes and fsyncs it, then
+    os.replace()s it over the destination. Every reader therefore sees either
+    the complete old file or the complete new file, never a half-written (torn)
+    one. The temp file is removed on any error path so partial files never
+    leak.
+
+    Note: atomic write alone eliminates torn reads but does not by itself
+    prevent lost updates under true simultaneity. The leaf mutators wrap their
+    load->mutate->save in _registry_lock() to serialize concurrent writers and
+    reduce that window; when locking is unavailable the degradation is honest
+    (torn reads still impossible, lost-update still possible).
+    """
     _ensure_registry_dir()
-    with open(REGISTRY_FILE, "w") as f:
-        json.dump(registry, f, indent=2, default=str)
+    tmp_fd, tmp_path = tempfile.mkstemp(
+        dir=str(REGISTRY_DIR), prefix=".projects.", suffix=".tmp"
+    )
+    try:
+        with os.fdopen(tmp_fd, "w") as f:
+            json.dump(registry, f, indent=2, default=str)
+            f.flush()
+            os.fsync(f.fileno())
+        os.replace(tmp_path, str(REGISTRY_FILE))
+    except BaseException:
+        # Clean up the temp file on any failure so we never leak partial files.
+        try:
+            os.unlink(tmp_path)
+        except OSError:
+            pass
+        raise
 
 
 def _generate_project_id(path: str) -> str:
@@ -70,34 +157,38 @@ def register_project(
     if not os.path.isdir(path):
         raise ValueError(f"Path does not exist: {path}")
 
-    registry = _load_registry()
     project_id = _generate_project_id(path)
 
-    # Check if already registered
-    if project_id in registry["projects"]:
-        # Update existing entry
-        project = registry["projects"][project_id]
-        if name:
-            project["name"] = name
-        if alias:
-            project["alias"] = alias
-        project["updated_at"] = datetime.now(timezone.utc).isoformat()
-    else:
-        # Create new entry
-        project = {
-            "id": project_id,
-            "path": path,
-            "name": name or os.path.basename(path),
-            "alias": alias,
-            "registered_at": datetime.now(timezone.utc).isoformat(),
-            "updated_at": datetime.now(timezone.utc).isoformat(),
-            "last_accessed": None,
-            "has_loki_dir": os.path.isdir(os.path.join(path, ".loki")),
-            "status": "active",
-        }
-        registry["projects"][project_id] = project
+    # Lock the load->mutate->save so concurrent registrations serialize and do
+    # not lost-update each other (the multi-repo `loki docker` happy path).
+    with _registry_lock():
+        registry = _load_registry()
 
-    _save_registry(registry)
+        # Check if already registered
+        if project_id in registry["projects"]:
+            # Update existing entry
+            project = registry["projects"][project_id]
+            if name:
+                project["name"] = name
+            if alias:
+                project["alias"] = alias
+            project["updated_at"] = datetime.now(timezone.utc).isoformat()
+        else:
+            # Create new entry
+            project = {
+                "id": project_id,
+                "path": path,
+                "name": name or os.path.basename(path),
+                "alias": alias,
+                "registered_at": datetime.now(timezone.utc).isoformat(),
+                "updated_at": datetime.now(timezone.utc).isoformat(),
+                "last_accessed": None,
+                "has_loki_dir": os.path.isdir(os.path.join(path, ".loki")),
+                "status": "active",
+            }
+            registry["projects"][project_id] = project
+
+        _save_registry(registry)
     return project
 
 
@@ -111,19 +202,20 @@ def unregister_project(identifier: str) -> bool:
     Returns:
         True if removed, False if not found
     """
-    registry = _load_registry()
-
-    # Find by ID, path, or alias
-    project_id = None
-    for pid, project in registry["projects"].items():
-        if pid == identifier or project["path"] == identifier or project.get("alias") == identifier:
-            project_id = pid
-            break
-
-    if project_id:
-        del registry["projects"][project_id]
-        _save_registry(registry)
-        return True
+    with _registry_lock():
+        registry = _load_registry()
+
+        # Find by ID, path, or alias
+        project_id = None
+        for pid, project in registry["projects"].items():
+            if pid == identifier or project["path"] == identifier or project.get("alias") == identifier:
+                project_id = pid
+                break
+
+        if project_id:
+            del registry["projects"][project_id]
+            _save_registry(registry)
+            return True
     return False
 
 
@@ -179,13 +271,14 @@ def update_last_accessed(identifier: str) -> Optional[dict]:
     Returns:
         Updated project entry or None
     """
-    registry = _load_registry()
-
-    for pid, project in registry["projects"].items():
-        if pid == identifier or project["path"] == identifier or project.get("alias") == identifier:
-            project["last_accessed"] = datetime.now(timezone.utc).isoformat()
-            _save_registry(registry)
-            return project
+    with _registry_lock():
+        registry = _load_registry()
+
+        for pid, project in registry["projects"].items():
+            if pid == identifier or project["path"] == identifier or project.get("alias") == identifier:
+                project["last_accessed"] = datetime.now(timezone.utc).isoformat()
+                _save_registry(registry)
+                return project
     return None
 
 
@@ -207,19 +300,20 @@ def mark_project_stopped(identifier: str) -> Optional[dict]:
         Idempotent: marking an already-stopped project is a no-op that still
         returns the entry.
     """
-    registry = _load_registry()
-
-    for pid_key, project in registry["projects"].items():
-        if (
-            pid_key == identifier
-            or project["path"] == identifier
-            or project.get("alias") == identifier
-        ):
-            project["status"] = "stopped"
-            project["pid"] = None
-            project["updated_at"] = datetime.now(timezone.utc).isoformat()
-            _save_registry(registry)
-            return project
+    with _registry_lock():
+        registry = _load_registry()
+
+        for pid_key, project in registry["projects"].items():
+            if (
+                pid_key == identifier
+                or project["path"] == identifier
+                or project.get("alias") == identifier
+            ):
+                project["status"] = "stopped"
+                project["pid"] = None
+                project["updated_at"] = datetime.now(timezone.utc).isoformat()
+                _save_registry(registry)
+                return project
     return None
 
 

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.45.0
+**Version:** v7.45.1
 
 ---
 
@@ -389,7 +389,7 @@ provider works inside the container. Provide auth with your Anthropic API key:
 # Run Loki Mode in Docker (Claude provider, API-key auth)
 docker run --rm -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
   -v $(pwd):/workspace -w /workspace \
-  asklokesh/loki-mode:7.45.0 start ./my-spec.md
+  asklokesh/loki-mode:7.45.1 start ./my-spec.md
 ```
 
 ##### docker compose + .env (no host install)

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var n6=Object.defineProperty;var a6=($)=>$;function s6($,Q){this[$]=a6.bind(null,Q)}var h=($,Q)=>{for(var Z in Q)n6($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:s6.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var K$=import.meta.require;var S1={};h(S1,{lokiDir:()=>P,homeLokiDir:()=>o$,findRepoRootForVersion:()=>d$,REPO_ROOT:()=>m});import{resolve as n,dirname as l$}from"path";import{fileURLToPath as t6}from"url";import{existsSync as P$}from"fs";import{homedir as r6}from"os";function i6(){let $=N1;for(let Q=0;Q<6;Q++){if(P$(n($,"VERSION"))&&P$(n($,"autonomy/run.sh")))return $;let Z=l$($);if(Z===$)break;$=Z}return n(N1,"..","..","..")}function d$($){let Q=$;for(let Z=0;Z<6;Z++){if(P$(n(Q,"VERSION"))&&P$(n(Q,"autonomy/run.sh")))return Q;let z=l$(Q);if(z===Q)break;Q=z}return n($,"..","..","..")}function P(){return process.env.LOKI_DIR??n(process.cwd(),".loki")}function o$(){return n(r6(),".loki")}var N1,m;var C=L(()=>{N1=l$(t6(import.meta.url));m=i6()});import{readFileSync as e6}from"fs";import{resolve as $Q,dirname as QQ}from"path";import{fileURLToPath as ZQ}from"url";function F$(){if($$!==null)return $$;let $="7.45.0";if(typeof $==="string"&&$.length>0)return $$=$,$$;try{let Q=QQ(ZQ(import.meta.url)),Z=d$(Q);$$=e6($Q(Z,"VERSION"),"utf-8").trim()}catch{$$="unknown"}return $$}var $$=null;var n$=L(()=>{C()});var C1={};h(C1,{runOrThrow:()=>zQ,run:()=>j,commandVersion:()=>KQ,commandExists:()=>f,ShellError:()=>a$});async function j($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[W,K,U]=await Promise.all([new Response(Z.stdout).text(),new Response(Z.stderr).text(),Z.exited]);return{stdout:W,stderr:K,exitCode:U}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function zQ($,Q={}){let Z=await j($,Q);if(Z.exitCode!==0)throw new a$(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=XQ($),Z=await j(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function XQ($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function KQ($,Q="--version"){if(!await f($))return null;let z=await j([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var a$;var d=L(()=>{a$=class a$ extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function a($){return WQ?"":$}var WQ,T,S,I,TZ,w,R,y,q;var c=L(()=>{WQ=(process.env.NO_COLOR??"").length>0;T=a("\x1B[0;31m"),S=a("\x1B[0;32m"),I=a("\x1B[1;33m"),TZ=a("\x1B[0;34m"),w=a("\x1B[0;36m"),R=a("\x1B[1m"),y=a("\x1B[2m"),q=a("\x1B[0m")});import{existsSync as TQ}from"fs";async function Q$(){if(B$!==void 0)return B$;let $="/opt/homebrew/bin/python3.12";if(TQ($))return B$=$,$;let Q=await f("python3.12");if(Q)return B$=Q,Q;let Z=await f("python3");return B$=Z,Z}async function Z$($,Q={}){let Z=await Q$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return j([Z,"-c",$],Q)}var B$;var W$=L(()=>{d()});var t1={};h(t1,{runStatus:()=>gQ});import{existsSync as v,readFileSync as U$,readdirSync as l1,statSync as d1}from"fs";import{resolve as D,basename as xQ}from"path";import{homedir as NQ}from"os";async function DQ(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${q}
+var n6=Object.defineProperty;var a6=($)=>$;function s6($,Q){this[$]=a6.bind(null,Q)}var h=($,Q)=>{for(var Z in Q)n6($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:s6.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var K$=import.meta.require;var S1={};h(S1,{lokiDir:()=>P,homeLokiDir:()=>o$,findRepoRootForVersion:()=>d$,REPO_ROOT:()=>m});import{resolve as n,dirname as l$}from"path";import{fileURLToPath as t6}from"url";import{existsSync as P$}from"fs";import{homedir as r6}from"os";function i6(){let $=N1;for(let Q=0;Q<6;Q++){if(P$(n($,"VERSION"))&&P$(n($,"autonomy/run.sh")))return $;let Z=l$($);if(Z===$)break;$=Z}return n(N1,"..","..","..")}function d$($){let Q=$;for(let Z=0;Z<6;Z++){if(P$(n(Q,"VERSION"))&&P$(n(Q,"autonomy/run.sh")))return Q;let z=l$(Q);if(z===Q)break;Q=z}return n($,"..","..","..")}function P(){return process.env.LOKI_DIR??n(process.cwd(),".loki")}function o$(){return n(r6(),".loki")}var N1,m;var C=L(()=>{N1=l$(t6(import.meta.url));m=i6()});import{readFileSync as e6}from"fs";import{resolve as $Q,dirname as QQ}from"path";import{fileURLToPath as ZQ}from"url";function F$(){if($$!==null)return $$;let $="7.45.1";if(typeof $==="string"&&$.length>0)return $$=$,$$;try{let Q=QQ(ZQ(import.meta.url)),Z=d$(Q);$$=e6($Q(Z,"VERSION"),"utf-8").trim()}catch{$$="unknown"}return $$}var $$=null;var n$=L(()=>{C()});var C1={};h(C1,{runOrThrow:()=>zQ,run:()=>j,commandVersion:()=>KQ,commandExists:()=>f,ShellError:()=>a$});async function j($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[W,K,U]=await Promise.all([new Response(Z.stdout).text(),new Response(Z.stderr).text(),Z.exited]);return{stdout:W,stderr:K,exitCode:U}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function zQ($,Q={}){let Z=await j($,Q);if(Z.exitCode!==0)throw new a$(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=XQ($),Z=await j(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function XQ($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function KQ($,Q="--version"){if(!await f($))return null;let z=await j([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var a$;var d=L(()=>{a$=class a$ extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function a($){return WQ?"":$}var WQ,T,S,I,TZ,w,R,y,q;var c=L(()=>{WQ=(process.env.NO_COLOR??"").length>0;T=a("\x1B[0;31m"),S=a("\x1B[0;32m"),I=a("\x1B[1;33m"),TZ=a("\x1B[0;34m"),w=a("\x1B[0;36m"),R=a("\x1B[1m"),y=a("\x1B[2m"),q=a("\x1B[0m")});import{existsSync as TQ}from"fs";async function Q$(){if(B$!==void 0)return B$;let $="/opt/homebrew/bin/python3.12";if(TQ($))return B$=$,$;let Q=await f("python3.12");if(Q)return B$=Q,Q;let Z=await f("python3");return B$=Z,Z}async function Z$($,Q={}){let Z=await Q$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return j([Z,"-c",$],Q)}var B$;var W$=L(()=>{d()});var t1={};h(t1,{runStatus:()=>gQ});import{existsSync as v,readFileSync as U$,readdirSync as l1,statSync as d1}from"fs";import{resolve as D,basename as xQ}from"path";import{homedir as NQ}from"os";async function DQ(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${q}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -789,4 +789,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(o6),2}}p1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var ZZ=await QZ(Bun.argv.slice(2));process.exit(ZZ);
 
-//# debugId=7FCBCE9F1C748AE964756E2164756E21
+//# debugId=91DA611FDFEA183B64756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.45.0'
+__version__ = '7.45.1'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.45.0",
+  "version": "7.45.1",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 11 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.45.0",
+  "version": "7.45.1",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 11 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",