loki-mode 7.5.30 → 7.6.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Multi-agent autonomous startup system. Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.5.30
+# Loki Mode v7.6.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -381,4 +381,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.5.30 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.6.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.5.30
+7.6.0

package/autonomy/loki

@@ -3689,6 +3689,12 @@ cmd_web_help() {
     echo "  loki web                  Start Purple Lab and open in browser"
     echo "  loki web --no-open        Start without opening browser"
     echo "  loki web stop             Stop the Purple Lab server"
+    echo ""
+    echo "Note (since v7.5.30):"
+    echo "  Purple Lab is also embedded in the Dashboard as a Lab sidebar entry."
+    echo "  Run 'loki dashboard start' and click 'Lab' to use the same UI"
+    echo "  without spawning a second port. 'loki web' standalone remains"
+    echo "  supported (Rule 0); both modes serve the same React bundle."
 }
 
 cmd_web_start() {
@@ -13993,7 +13999,7 @@ if total_removed > 0:
         index)
             # Show or rebuild the memory index layer
             if [ "${2:-}" = "rebuild" ]; then
-                python3 -c "
+                PYTHONPATH="${SKILL_DIR}${PYTHONPATH:+:$PYTHONPATH}" python3 -c "
 try:
     from memory.layers import IndexLayer
     layer = IndexLayer('.loki/memory')
@@ -14017,7 +14023,7 @@ except Exception as e:
         consolidate)
             # Run consolidation pipeline
             local hours="${2:-24}"
-            LOKI_HOURS="$hours" python3 -c "
+            LOKI_HOURS="$hours" PYTHONPATH="${SKILL_DIR}${PYTHONPATH:+:$PYTHONPATH}" python3 -c "
 import os
 try:
     from memory.consolidation import ConsolidationPipeline
@@ -14054,7 +14060,7 @@ except Exception as e:
                 echo "Usage: loki memory retrieve <query>"
                 exit 1
             fi
-            LOKI_QUERY="$query" python3 -c "
+            LOKI_QUERY="$query" PYTHONPATH="${SKILL_DIR}${PYTHONPATH:+:$PYTHONPATH}" python3 -c "
 import os
 try:
     from memory.retrieval import MemoryRetrieval
@@ -14085,7 +14091,7 @@ except Exception as e:
                 echo "Usage: loki memory episode <id>"
                 exit 1
             fi
-            LOKI_ID="$id" python3 -c "
+            LOKI_ID="$id" PYTHONPATH="${SKILL_DIR}${PYTHONPATH:+:$PYTHONPATH}" python3 -c "
 import os
 try:
     from memory.engine import MemoryEngine
@@ -14109,7 +14115,7 @@ except Exception as e:
             local id="${2:-}"
             if [ -z "$id" ]; then
                 # List all patterns
-                python3 -c "
+                PYTHONPATH="${SKILL_DIR}${PYTHONPATH:+:$PYTHONPATH}" python3 -c "
 try:
     from memory.engine import MemoryEngine
     engine = MemoryEngine(base_path='.loki/memory')
@@ -14127,7 +14133,7 @@ except Exception as e:
     print(f'Error: {e}')
 " 2>/dev/null
             else
-                LOKI_ID="$id" python3 -c "
+                LOKI_ID="$id" PYTHONPATH="${SKILL_DIR}${PYTHONPATH:+:$PYTHONPATH}" python3 -c "
 import os
 try:
     from memory.engine import MemoryEngine

package/autonomy/run.sh

@@ -9189,6 +9189,13 @@ build_prompt() {
     # Context Memory Instructions (integrated with new memory system)
     local memory_instruction="MEMORY SYSTEM: Relevant context from past sessions is provided below (if any). Your actions will be automatically recorded for future reference. For complex handoffs: create .loki/memory/handoffs/{timestamp}.md. For important decisions: they will be captured in the timeline. Check .loki/CONTINUITY.md for session-level working memory."
 
+    # USAGE.md instruction (v7.6.0) -- always-on end-user handoff doc.
+    # REGARDLESS of whether the PRD mentions it, the agent MUST write USAGE.md
+    # at the project root before signaling completion. This becomes the
+    # canonical "how do I run and verify this" artifact surfaced to the user
+    # and to the dashboard/Purple Lab UI.
+    local usage_doc_instruction="USAGE_DOC_REQUIRED: Before invoking loki_complete_task (or touching .loki/signals/COMPLETION_REQUESTED), write USAGE.md at the project root. Detect the stack from package.json/requirements.txt/Cargo.toml/go.mod/etc. and include these sections: (1) Prerequisites (runtimes, ports, env vars), (2) Install (exact command, e.g. 'npm install' or 'pip install -r requirements.txt'), (3) Start (exact command, e.g. 'npm start' or 'python server.py'), (4) Verify -- 2 to 3 copy-paste commands the user can run to confirm it works (curl examples for APIs with expected output, browser URL for web UIs, command invocation for CLIs), (5) Stop (Ctrl+C or 'lsof -ti:PORT | xargs kill -9' for backgrounded servers). Keep it under 100 lines, plain Markdown, no emojis. If USAGE.md already exists and is accurate, leave it; otherwise create or update it."
+
     # Load existing context if resuming
     local context_injection=""
     if [ $retry -gt 0 ]; then
@@ -9518,15 +9525,15 @@ except Exception:
         else
             if [ $retry -eq 0 ]; then
                 if [ -n "$prd" ]; then
-                    echo "Loki Mode with PRD at $prd. $human_directive $gate_failure_context $queue_tasks $bmad_context $openspec_context $mirofish_context $magic_context $checklist_status $app_runner_info $playwright_info $memory_context_section $rarv_instruction $memory_instruction $completion_instruction $sdlc_instruction $autonomous_suffix"
+                    echo "Loki Mode with PRD at $prd. $human_directive $gate_failure_context $queue_tasks $bmad_context $openspec_context $mirofish_context $magic_context $checklist_status $app_runner_info $playwright_info $memory_context_section $rarv_instruction $memory_instruction $usage_doc_instruction $completion_instruction $sdlc_instruction $autonomous_suffix"
                 else
-                    echo "Loki Mode. $human_directive $gate_failure_context $queue_tasks $bmad_context $openspec_context $mirofish_context $magic_context $checklist_status $app_runner_info $playwright_info $memory_context_section $analysis_instruction $rarv_instruction $memory_instruction $completion_instruction $sdlc_instruction $autonomous_suffix"
+                    echo "Loki Mode. $human_directive $gate_failure_context $queue_tasks $bmad_context $openspec_context $mirofish_context $magic_context $checklist_status $app_runner_info $playwright_info $memory_context_section $analysis_instruction $rarv_instruction $memory_instruction $usage_doc_instruction $completion_instruction $sdlc_instruction $autonomous_suffix"
                 fi
             else
                 if [ -n "$prd" ]; then
-                    echo "Loki Mode - Resume iteration #$iteration (retry #$retry). PRD: $prd. $human_directive $gate_failure_context $queue_tasks $bmad_context $openspec_context $mirofish_context $magic_context $checklist_status $app_runner_info $playwright_info $memory_context_section $rarv_instruction $memory_instruction $completion_instruction $sdlc_instruction $autonomous_suffix"
+                    echo "Loki Mode - Resume iteration #$iteration (retry #$retry). PRD: $prd. $human_directive $gate_failure_context $queue_tasks $bmad_context $openspec_context $mirofish_context $magic_context $checklist_status $app_runner_info $playwright_info $memory_context_section $rarv_instruction $memory_instruction $usage_doc_instruction $completion_instruction $sdlc_instruction $autonomous_suffix"
                 else
-                    echo "Loki Mode - Resume iteration #$iteration (retry #$retry). $human_directive $gate_failure_context $queue_tasks $bmad_context $openspec_context $mirofish_context $magic_context $checklist_status $app_runner_info $playwright_info $memory_context_section Use .loki/generated-prd.md if exists. $rarv_instruction $memory_instruction $completion_instruction $sdlc_instruction $autonomous_suffix"
+                    echo "Loki Mode - Resume iteration #$iteration (retry #$retry). $human_directive $gate_failure_context $queue_tasks $bmad_context $openspec_context $mirofish_context $magic_context $checklist_status $app_runner_info $playwright_info $memory_context_section Use .loki/generated-prd.md if exists. $rarv_instruction $memory_instruction $usage_doc_instruction $completion_instruction $sdlc_instruction $autonomous_suffix"
                 fi
             fi
         fi
@@ -9567,6 +9574,7 @@ except Exception:
         else
             printf 'You are a coding assistant. Analyze this codebase and suggest improvements. Write working code and commit changes.\n'
         fi
+        printf '%s\n' "$usage_doc_instruction"
         printf '</loki_system>\n'
         printf '[CACHE_BREAKPOINT]\n'
 
@@ -9597,6 +9605,7 @@ except Exception:
     printf '%s\n' "$sdlc_instruction"
     printf '%s\n' "$autonomous_suffix"
     printf '%s\n' "$memory_instruction"
+    printf '%s\n' "$usage_doc_instruction"
     # For codebase-analysis mode (no PRD), analysis_instruction is part of the
     # static prefix so it remains cache-stable.
     if [ -z "$prd" ]; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.5.30"
+__version__ = "7.6.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -2688,6 +2688,167 @@ async def get_memory_timeline():
     return {"entries": episodes, "lastUpdated": None}
 
 
+# ---------------------------------------------------------------------------
+# Memory File Browser (v7.6.0) - generic drill-down into .loki/memory/
+# ---------------------------------------------------------------------------
+# Exposes raw episodic/learnings/ledgers/handoffs files plus root-level
+# notes (decisions.md, mistakes.md, patterns.md, investigation-*.md, etc.)
+# so the dashboard can let users click through what the agent has stored.
+#
+# Safety: type is a whitelisted enum; path is validated by resolving against
+# the memory directory and rejecting anything outside it (also rejects
+# absolute paths and ".." segments before resolution).
+
+_MEMORY_FILE_TYPES = {
+    "episodic": "episodic",
+    "learnings": "learnings",
+    "ledgers": "ledgers",
+    "handoffs": "handoffs",
+    "semantic": "semantic",
+    "skills": "skills",
+    "root": "",  # files directly under .loki/memory/
+}
+
+_MEMORY_FILE_MAX_BYTES = 2 * 1024 * 1024  # 2 MiB cap per file read
+
+
+def _safe_memory_path(rel_path: str) -> _Path:
+    """Resolve rel_path under .loki/memory/ and reject traversal attempts.
+
+    Raises HTTPException(400) on bad input, HTTPException(403) on traversal.
+    """
+    if not rel_path or not isinstance(rel_path, str):
+        raise HTTPException(status_code=400, detail="path required")
+    # Reject NULs and absolute paths up front
+    if "\x00" in rel_path or rel_path.startswith("/") or rel_path.startswith("\\"):
+        raise HTTPException(status_code=400, detail="invalid path")
+    # Reject explicit traversal segments before touching the filesystem
+    parts = rel_path.replace("\\", "/").split("/")
+    if any(p == ".." for p in parts):
+        raise HTTPException(status_code=403, detail="path traversal blocked")
+    memory_dir = _get_loki_dir() / "memory"
+    try:
+        real_memory = os.path.realpath(str(memory_dir))
+    except Exception:
+        raise HTTPException(status_code=500, detail="memory dir unavailable")
+    candidate = memory_dir / rel_path
+    try:
+        resolved = os.path.realpath(str(candidate))
+    except Exception:
+        raise HTTPException(status_code=400, detail="invalid path")
+    # Must live strictly under real_memory (not be it, not escape via symlink)
+    if not (resolved == real_memory or resolved.startswith(real_memory + os.sep)):
+        raise HTTPException(status_code=403, detail="path outside memory dir")
+    return _Path(resolved)
+
+
+@app.get("/api/memory/files", dependencies=[Depends(auth.require_scope("read"))])
+async def list_memory_files(
+    type: str = Query(default="root", description="One of: episodic, learnings, ledgers, handoffs, semantic, skills, root"),
+    limit: int = Query(default=500, ge=1, le=2000),
+):
+    """List files under a memory subdirectory.
+
+    Returns: {type, dir, files: [{path, name, size, modified, kind}]}
+    `path` is relative to .loki/memory/ and safe to pass back to /api/memory/file.
+    """
+    if type not in _MEMORY_FILE_TYPES:
+        raise HTTPException(status_code=400, detail=f"unknown type; expected one of {sorted(_MEMORY_FILE_TYPES)}")
+    sub = _MEMORY_FILE_TYPES[type]
+    memory_dir = _get_loki_dir() / "memory"
+    target_dir = memory_dir / sub if sub else memory_dir
+    if not target_dir.exists():
+        return {"type": type, "dir": str(target_dir), "files": []}
+
+    real_memory = os.path.realpath(str(memory_dir))
+    entries: list[dict[str, Any]] = []
+
+    if type == "root":
+        # Only files directly under .loki/memory/ (don't descend into subdirs)
+        iterator = (p for p in target_dir.iterdir() if p.is_file())
+    elif type == "episodic":
+        # Episodic is organized by date subdirectory; walk one level.
+        def _ep_iter():
+            for child in target_dir.iterdir():
+                if child.is_file():
+                    yield child
+                elif child.is_dir():
+                    for f in child.iterdir():
+                        if f.is_file():
+                            yield f
+        iterator = _ep_iter()
+    else:
+        # Flat directory listing (learnings, ledgers, handoffs, semantic, skills)
+        iterator = (p for p in target_dir.rglob("*") if p.is_file())
+
+    for f in iterator:
+        try:
+            resolved = os.path.realpath(str(f))
+            if not resolved.startswith(real_memory + os.sep):
+                continue  # skip symlinks escaping the memory dir
+            rel = os.path.relpath(resolved, real_memory)
+            st = f.stat()
+            entries.append({
+                "path": rel,
+                "name": f.name,
+                "size": st.st_size,
+                "modified": st.st_mtime,
+                "kind": f.suffix.lstrip(".").lower() or "txt",
+            })
+        except Exception:
+            continue
+        if len(entries) >= limit:
+            break
+
+    # Newest first
+    entries.sort(key=lambda e: e["modified"], reverse=True)
+    return {"type": type, "dir": str(target_dir), "files": entries}
+
+
+@app.get("/api/memory/file", dependencies=[Depends(auth.require_scope("read"))])
+async def get_memory_file(
+    path: str = Query(..., min_length=1, max_length=512, description="Path relative to .loki/memory/"),
+):
+    """Read a single file under .loki/memory/ with strict path-traversal guards.
+
+    Returns: {path, name, size, modified, kind, content, truncated}
+    JSON files are returned with content as a string; the caller can JSON.parse.
+    """
+    target = _safe_memory_path(path)
+    if not target.exists():
+        raise HTTPException(status_code=404, detail="file not found")
+    if not target.is_file():
+        raise HTTPException(status_code=400, detail="not a file")
+    try:
+        st = target.stat()
+    except Exception:
+        raise HTTPException(status_code=500, detail="stat failed")
+    truncated = False
+    try:
+        if st.st_size > _MEMORY_FILE_MAX_BYTES:
+            with open(target, "rb") as fh:
+                raw = fh.read(_MEMORY_FILE_MAX_BYTES)
+            truncated = True
+        else:
+            with open(target, "rb") as fh:
+                raw = fh.read()
+        # Decode as UTF-8 with replacement so we never 500 on a stray byte.
+        content = raw.decode("utf-8", errors="replace")
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"read failed: {e}")
+    return {
+        "path": path,
+        "name": target.name,
+        "size": st.st_size,
+        "modified": st.st_mtime,
+        "kind": target.suffix.lstrip(".").lower() or "txt",
+        "content": content,
+        "truncated": truncated,
+    }
+
+
 # ---------------------------------------------------------------------------
 # Memory Search & Stats (v6.15.0) - SQLite FTS5 powered
 # ---------------------------------------------------------------------------

package/dashboard/static/index.html

@@ -615,6 +615,89 @@
             <h3 style="font-family: 'DM Serif Display', Georgia, serif; font-size: 1.15rem; font-weight: 400; color: var(--loki-text-primary); margin-bottom: 12px;">Memory</h3>
             <loki-memory-browser id="memory-browser" tab="summary"></loki-memory-browser>
           </div>
+          <div>
+            <h3 style="font-family: 'DM Serif Display', Georgia, serif; font-size: 1.15rem; font-weight: 400; color: var(--loki-text-primary); margin-bottom: 12px;">Memory Files</h3>
+            <div id="memory-files-panel" style="background: var(--loki-bg-card, #1a1a1a); border: 1px solid var(--loki-border, #333); border-radius: 5px; padding: 12px;">
+              <div style="display: flex; gap: 6px; flex-wrap: wrap; margin-bottom: 10px;" id="memory-files-tabs"></div>
+              <div style="display: grid; grid-template-columns: minmax(220px, 320px) 1fr; gap: 12px; min-height: 280px;">
+                <div id="memory-files-list" style="border: 1px solid var(--loki-border, #333); border-radius: 4px; padding: 8px; max-height: 480px; overflow-y: auto; font-size: 12px;">Loading...</div>
+                <div id="memory-files-viewer" style="border: 1px solid var(--loki-border, #333); border-radius: 4px; padding: 12px; max-height: 480px; overflow: auto; font-family: 'JetBrains Mono', monospace; font-size: 12px; white-space: pre-wrap; word-break: break-word; color: var(--loki-text-primary, #eee);">Select a file to view its contents.</div>
+              </div>
+            </div>
+            <script>
+              (function(){
+                var TYPES = [
+                  {id: 'root', label: 'Notes'},
+                  {id: 'episodic', label: 'Episodes'},
+                  {id: 'learnings', label: 'Learnings'},
+                  {id: 'ledgers', label: 'Ledgers'},
+                  {id: 'handoffs', label: 'Handoffs'},
+                  {id: 'semantic', label: 'Semantic'},
+                  {id: 'skills', label: 'Skills'}
+                ];
+                var state = {type: 'root', files: [], selected: null};
+                var tabsEl = document.getElementById('memory-files-tabs');
+                var listEl = document.getElementById('memory-files-list');
+                var viewEl = document.getElementById('memory-files-viewer');
+                function esc(s){ var d = document.createElement('div'); d.textContent = String(s == null ? '' : s); return d.innerHTML; }
+                function fmtSize(n){ if (n < 1024) return n + ' B'; if (n < 1024*1024) return (n/1024).toFixed(1) + ' KB'; return (n/1024/1024).toFixed(2) + ' MB'; }
+                function fmtTime(ts){ try { return new Date(ts*1000).toLocaleString(); } catch(e){ return ''; } }
+                function renderTabs(){
+                  tabsEl.innerHTML = TYPES.map(function(t){
+                    var active = t.id === state.type;
+                    return '<button data-type="' + t.id + '" style="padding: 5px 10px; font-size: 11px; border-radius: 4px; border: 1px solid ' + (active ? 'var(--loki-accent, #553de9)' : 'var(--loki-border, #333)') + '; background: ' + (active ? 'var(--loki-accent, #553de9)' : 'transparent') + '; color: ' + (active ? '#fff' : 'var(--loki-text-primary, #ccc)') + '; cursor: pointer;">' + esc(t.label) + '</button>';
+                  }).join('');
+                  Array.prototype.forEach.call(tabsEl.querySelectorAll('button'), function(b){
+                    b.addEventListener('click', function(){ loadType(b.getAttribute('data-type')); });
+                  });
+                }
+                function renderList(){
+                  if (!state.files.length){ listEl.innerHTML = '<div style="color: var(--loki-text-muted, #888); padding: 8px;">No files in this section.</div>'; return; }
+                  listEl.innerHTML = state.files.map(function(f){
+                    var active = state.selected && state.selected.path === f.path;
+                    return '<div data-path="' + esc(f.path) + '" style="padding: 6px 8px; border-radius: 3px; cursor: pointer; margin-bottom: 2px; background: ' + (active ? 'var(--loki-accent, #553de9)' : 'transparent') + '; color: ' + (active ? '#fff' : 'inherit') + ';" title="' + esc(f.path) + '"><div style="font-weight: 500;">' + esc(f.name) + '</div><div style="font-size: 10px; color: ' + (active ? 'rgba(255,255,255,0.8)' : 'var(--loki-text-muted, #888)') + ';">' + fmtSize(f.size) + ' -- ' + esc(fmtTime(f.modified)) + '</div></div>';
+                  }).join('');
+                  Array.prototype.forEach.call(listEl.querySelectorAll('div[data-path]'), function(d){
+                    d.addEventListener('click', function(){ loadFile(d.getAttribute('data-path')); });
+                  });
+                }
+                function renderViewer(file){
+                  if (!file){ viewEl.textContent = 'Select a file to view its contents.'; return; }
+                  var header = file.name + '  (' + fmtSize(file.size) + (file.truncated ? ', truncated' : '') + ')
+' + file.path + '
+
+';
+                  var body = file.content || '';
+                  if (file.kind === 'json'){
+                    try { body = JSON.stringify(JSON.parse(body), null, 2); } catch(e){ /* leave raw */ }
+                  }
+                  viewEl.textContent = header + body;
+                }
+                function loadType(t){
+                  state.type = t; state.selected = null;
+                  renderTabs(); renderViewer(null);
+                  listEl.innerHTML = 'Loading...';
+                  fetch('/api/memory/files?type=' + encodeURIComponent(t) + '&limit=500')
+                    .then(function(r){ if (!r.ok) throw new Error('HTTP ' + r.status); return r.json(); })
+                    .then(function(j){ state.files = (j && j.files) || []; renderList(); })
+                    .catch(function(e){ listEl.innerHTML = '<div style="color: var(--loki-red, #e74c3c); padding: 8px;">Failed: ' + esc(e.message) + '</div>'; });
+                }
+                function loadFile(p){
+                  state.selected = state.files.filter(function(f){ return f.path === p; })[0] || {path: p};
+                  renderList();
+                  viewEl.textContent = 'Loading ' + p + '...';
+                  fetch('/api/memory/file?path=' + encodeURIComponent(p))
+                    .then(function(r){ if (!r.ok) return r.json().then(function(j){ throw new Error(j.detail || ('HTTP ' + r.status)); }); return r.json(); })
+                    .then(function(j){ renderViewer(j); })
+                    .catch(function(e){ viewEl.textContent = 'Failed: ' + e.message; });
+                }
+                // Initialize when Insights becomes visible (or immediately if already visible)
+                function init(){ renderTabs(); loadType('root'); }
+                if (document.getElementById('page-insights')){ init(); }
+                else { document.addEventListener('DOMContentLoaded', init); }
+              })();
+            </script>
+          </div>
           <div>
             <h3 style="font-family: 'DM Serif Display', Georgia, serif; font-size: 1.15rem; font-weight: 400; color: var(--loki-text-primary); margin-bottom: 12px;">Learning Metrics</h3>
             <loki-learning-dashboard id="learning-dashboard" time-range="7d"></loki-learning-dashboard>

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.5.30
+**Version:** v7.6.0
 
 ---
 

package/loki-ts/dist/loki.js

@@ -451,7 +451,7 @@ Subcommands:
 
 This command is invoked by autonomy/run.sh between iterations. Users
 should not run it directly -- run \`loki start\` instead.
-`,iK;var T7=L(()=>{y();_1();iK=o1});y();import{readFileSync as E7}from"fs";import{resolve as x7,dirname as F7}from"path";import{fileURLToPath as w7}from"url";var o=null;function i1(){if(o!==null)return o;let K="7.5.30";if(typeof K==="string"&&K.length>0)return o=K,o;try{let $=F7(w7(import.meta.url)),z=S1($);o=E7(x7(z,"VERSION"),"utf-8").trim()}catch{o="unknown"}return o}function e1(){return process.stdout.write(`Loki Mode v${i1()}
+`,iK;var T7=L(()=>{y();_1();iK=o1});y();import{readFileSync as E7}from"fs";import{resolve as x7,dirname as F7}from"path";import{fileURLToPath as w7}from"url";var o=null;function i1(){if(o!==null)return o;let K="7.6.0";if(typeof K==="string"&&K.length>0)return o=K,o;try{let $=F7(w7(import.meta.url)),z=S1($);o=E7(x7(z,"VERSION"),"utf-8").trim()}catch{o="unknown"}return o}function e1(){return process.stdout.write(`Loki Mode v${i1()}
 `),0}p();n();y();import{readFileSync as C7,existsSync as h7}from"fs";import{resolve as b7}from"path";var y7=["claude","codex","cline","aider"];function $0(){let K=b7(P(),"state","provider");if(!h7(K))return"";try{return C7(K,"utf-8").trim()}catch{return""}}function v7(K,$){return K||$||process.env.LOKI_PROVIDER||"claude"}function g7(K){let $=$0(),z=v7(K,$);switch(process.stdout.write(`${k}Current Provider${W}
 `),process.stdout.write(`
 `),process.stdout.write(`${O}Provider:${W} ${z}
@@ -534,4 +534,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${$}
 `),process.stderr.write(A7),2}}process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var $6=await K6(Bun.argv.slice(2));process.exit($6);
 
-//# debugId=7C8104E1C877694564756E2164756E21
+//# debugId=1FE99E821A4C6C7B64756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.5.30'
+__version__ = '7.6.0'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loki-mode",
-  "version": "7.5.30",
+  "version": "7.6.0",
   "description": "Loki Mode by Autonomi. Multi-agent autonomous SDLC framework. Spec to deployed app: PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief. 4 AI providers (Claude Code, OpenAI Codex, Cline, Aider). 11 quality gates.",
   "keywords": [
     "agent",

package/web-app/server.py

@@ -7720,36 +7720,15 @@ async def get_audit_log() -> JSONResponse:
 
 # ---------------------------------------------------------------------------
 # Static file serving (built React app)
+# IMPORTANT: serve_spa was previously defined here at line 7725, BEFORE the
+# /api/magic, /api/deploy, /api/sessions/.../github/actions, and
+# /api/sessions/.../docs route registrations. FastAPI registers routes in
+# definition order, so the catch-all '/{full_path:path}' silently swallowed
+# those 22 endpoints (they returned index.html instead of JSON). Moved to
+# the very end of the file just before standalone_app in v7.6.0 so all
+# specific API routes register first.
 # ---------------------------------------------------------------------------
 
-@app.get("/{full_path:path}")
-async def serve_spa(full_path: str) -> FileResponse:
-    """Serve the React SPA and static assets from dist/.
-
-    The Vite build is configured with base: '/lab/' (Phase Merge-3), so the
-    bundled HTML references assets at '/lab/assets/...'. Under the canonical
-    standalone_app (and dashboard's Merge-4 mount), Starlette's Mount strips
-    '/lab' from the scope path before dispatch, so this handler usually sees
-    'assets/...' directly and the strip below is a no-op. The strip is
-    retained as defense-in-depth for direct-`app` invocations (e.g. tests or
-    operators running `uvicorn server:app` instead of `server:standalone_app`).
-    """
-    index = DIST_DIR / "index.html"
-    if not index.exists():
-        return JSONResponse(
-            status_code=503,
-            content={"error": "Web app not built. Run: cd web-app && npm run build"},
-        )
-    # Resolve to the dist directory, tolerating the /lab/ base in standalone mode.
-    relative = full_path[4:] if full_path.startswith("lab/") else full_path
-    requested = DIST_DIR / relative
-    if relative and requested.is_file() and str(requested.resolve()).startswith(str(DIST_DIR.resolve())):
-        import mimetypes
-        content_type = mimetypes.guess_type(str(requested))[0] or "application/octet-stream"
-        return FileResponse(str(requested), media_type=content_type)
-    # SPA fallback: return index.html for all non-file routes
-    return FileResponse(str(index))
-
 
 # ---------------------------------------------------------------------------
 # Magic Modules API (/api/magic/*)
@@ -8649,6 +8628,45 @@ async def docs_get_file(session_id: str, filename: str) -> Response:
     return Response(content=content, media_type="text/markdown")
 
 
+# ---------------------------------------------------------------------------
+# SPA catch-all (MUST be last @app route -- see comment at the old serve_spa
+# location higher in this file). Any path that isn't matched by a specific
+# @app.get/post/... above falls through here and serves the React bundle.
+# v7.6.0 bug fix: previously this was at line 7725 and silently swallowed
+# 22 downstream API routes (/api/magic/*, /api/deploy/*, /api/sessions/.../
+# github/actions/*, /api/sessions/.../docs/*) which returned text/html
+# instead of JSON. Real-user test (Playwright on /lab/magic) surfaced it.
+# ---------------------------------------------------------------------------
+
+@app.get("/{full_path:path}")
+async def serve_spa(full_path: str) -> FileResponse:
+    """Serve the React SPA and static assets from dist/.
+
+    The Vite build is configured with base: '/lab/' (Phase Merge-3), so the
+    bundled HTML references assets at '/lab/assets/...'. Under the canonical
+    standalone_app (and dashboard's Merge-4 mount), Starlette's Mount strips
+    '/lab' from the scope path before dispatch, so this handler usually sees
+    'assets/...' directly and the strip below is a no-op. The strip is
+    retained as defense-in-depth for direct-`app` invocations (e.g. tests or
+    operators running `uvicorn server:app` instead of `server:standalone_app`).
+    """
+    index = DIST_DIR / "index.html"
+    if not index.exists():
+        return JSONResponse(
+            status_code=503,
+            content={"error": "Web app not built. Run: cd web-app && npm run build"},
+        )
+    # Resolve to the dist directory, tolerating the /lab/ base in standalone mode.
+    relative = full_path[4:] if full_path.startswith("lab/") else full_path
+    requested = DIST_DIR / relative
+    if relative and requested.is_file() and str(requested.resolve()).startswith(str(DIST_DIR.resolve())):
+        import mimetypes
+        content_type = mimetypes.guess_type(str(requested))[0] or "application/octet-stream"
+        return FileResponse(str(requested), media_type=content_type)
+    # SPA fallback: return index.html for all non-file routes
+    return FileResponse(str(index))
+
+
 # ---------------------------------------------------------------------------
 # Standalone wrapper (Phase Merge-3): mounts the FastAPI `app` under '/lab/'
 # so the rebased Vite bundle (with base: '/lab/') routes correctly through