loki-mode 7.69.0 → 7.71.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.69.0
+# Loki Mode v7.71.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -406,4 +406,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.69.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.71.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.69.0
+7.71.0

package/autonomy/hooks/migration-hooks.sh

@@ -393,7 +393,7 @@ for friction in data.get('frictions', []):
             print(f'BLOCKED (strict): Friction {friction.get(\"id\", \"?\")} in {loc} - strict mode requires explicit approval')
             sys.exit(0)
 print('OK')
-" "$file_path" "$strict" "$heal_dir/friction-map.json" 2>/dev/null || echo "OK")
+" "$file_path" "$strict" "$heal_dir/friction-map.json" 2>/dev/null || echo "BLOCKED: friction-map check failed (corrupt/unreadable friction-map.json or python3 unavailable) -- failing closed")
 
         if [[ "$blocked" == BLOCKED* ]]; then
             echo "HOOK_BLOCKED: $blocked"

package/autonomy/run.sh

@@ -1005,6 +1005,129 @@ log_error() { echo -e "${RED}[ERROR]${NC} $*"; }
 log_step() { echo -e "${CYAN}[STEP]${NC} $*"; }
 log_debug() { [[ "${LOKI_DEBUG:-}" == "true" ]] && echo -e "${CYAN}[DEBUG]${NC} $*" >&2 || true; }
 
+# Live Build HUD (v7.71.0): a single append-only per-iteration status line on the
+# interactive TTY path. Pure additive stdout decoration -- never piped into any
+# tee, so the dashboard agent.log and the stream-json parser are untouched. The
+# whole function is structured so any internal failure still returns 0; it can
+# never abort the iteration loop. Gated: TTY + not background + LOKI_HUD != 0.
+# Usage: render_build_hud <iter> <phase> <duration_secs>
+render_build_hud() {
+    # Gate first: emit nothing unless interactive TTY, not --bg, and not opted out.
+    # Inverted into an early return so the off-TTY path is byte-identical (no output).
+    if ! { [ -t 1 ] && [ "${BACKGROUND_MODE:-false}" != "true" ] && [ "${LOKI_HUD:-1}" != "0" ]; }; then
+        return 0
+    fi
+
+    local _iter="${1:-0}" _phase="${2:-?}" _dur="${3:-0}"
+    [ -z "$_phase" ] && _phase="?"
+    # Sanitize numerics so set -u arithmetic/format below can never error out.
+    case "$_dur" in (*[!0-9]*|'') _dur=0 ;; esac
+    local _max="${MAX_ITERATIONS:-0}"
+    case "$_max" in (*[!0-9]*|'') _max=0 ;; esac
+
+    # Field list: each field is appended only when its data is present. Missing
+    # data => the field is omitted entirely (never a fabricated value).
+    local _fields="$_phase"
+    _fields="${_fields} | iter ${_iter}/${_max}"
+
+    # Cost from the context tracker totals (the same field the dashboard shows).
+    # NOTE: tracking.json totals accumulate across runs in the same dir (not reset
+    # on a fresh `loki start`), so this is cumulative cost for the project dir, not
+    # strictly this single run. Labeled plainly "$" / "cost" to avoid overclaiming.
+    # OMIT entirely when empty/missing/non-Claude.
+    local _cost=""
+    if command -v python3 >/dev/null 2>&1; then
+        _cost="$(python3 -c "
+import json
+try:
+    t = json.load(open('.loki/context/tracking.json'))
+    c = t.get('totals', {}).get('total_cost_usd', 0)
+    c = float(c)
+    if c > 0:
+        print('%.2f' % c)
+except Exception:
+    pass
+" 2>/dev/null || true)"
+    fi
+    [ -n "$_cost" ] && _fields="${_fields} | \$${_cost}"
+
+    # Files changed (+ins/-del and file count) vs the run start SHA. Reuse the
+    # build_completion_summary diff approach incl. the .loki/.git exclude pathspec.
+    # OMIT when no start sha, not a git repo, or no diff data.
+    local _start_sha="${_LOKI_RUN_START_SHA:-}"
+    if [ -n "$_start_sha" ]; then
+        local _shortstat _ins _del _files
+        _shortstat="$( (cd "${TARGET_DIR:-.}" && git diff --shortstat "${_start_sha}..HEAD" -- . ':(exclude).loki/' ':(exclude).git/' ':(exclude)**/.loki/**') 2>/dev/null || true )"
+        if [ -n "$_shortstat" ]; then
+            _files="$(printf '%s\n' "$_shortstat" | grep -oE '[0-9]+ file' | grep -oE '[0-9]+' | head -1 2>/dev/null || true)"
+            _ins="$(printf '%s\n' "$_shortstat" | grep -oE '[0-9]+ insertion' | grep -oE '[0-9]+' | head -1 2>/dev/null || true)"
+            _del="$(printf '%s\n' "$_shortstat" | grep -oE '[0-9]+ deletion' | grep -oE '[0-9]+' | head -1 2>/dev/null || true)"
+            [ -z "$_files" ] && _files=0
+            [ -z "$_ins" ] && _ins=0
+            [ -z "$_del" ] && _del=0
+            _fields="${_fields} | +${_ins}/-${_del} (${_files} files)"
+        fi
+    fi
+
+    # Per-iteration time (the duration arg). Labeled "took" (not "iter") so it
+    # does not collide with the "iter N/max" iteration-count field above.
+    _fields="${_fields} | took $(_hud_fmt_secs "$_dur")"
+
+    # Elapsed time for the whole run, from the once-captured run-start epoch.
+    local _start_epoch="${_LOKI_RUN_START_EPOCH:-}"
+    case "$_start_epoch" in (*[!0-9]*|'') _start_epoch="" ;; esac
+    if [ -n "$_start_epoch" ]; then
+        local _now _elapsed
+        _now="$(date +%s 2>/dev/null || true)"
+        case "$_now" in (*[!0-9]*|'') _now="" ;; esac
+        if [ -n "$_now" ] && [ "$_now" -ge "$_start_epoch" ] 2>/dev/null; then
+            _elapsed=$(( _now - _start_epoch ))
+            _fields="${_fields} | elapsed $(_hud_fmt_secs "$_elapsed")"
+        fi
+    fi
+
+    # ETA (PO lock #1): omit by default. Only a SMALL user-set LOKI_MAX_ITERATIONS
+    # (not the 1000 default) yields a meaningful target, so that is the single ETA
+    # trigger here. A LOKI_BUDGET_LIMIT cap is also an allowed trigger per the
+    # plan, but a budget-derived ETA needs cost-rate math that is easy to get
+    # wrong; per "keep it simple and safe, when unsure omit", budget ETA is left
+    # out rather than rendered approximately.
+    local _lmi="${LOKI_MAX_ITERATIONS:-}"
+    case "$_lmi" in (*[!0-9]*|'') _lmi="" ;; esac
+    if [ -n "$_lmi" ] && [ "$_lmi" -gt 0 ] 2>/dev/null && [ "$_lmi" -lt 1000 ] 2>/dev/null \
+       && [ "$_iter" -gt 0 ] 2>/dev/null && [ "$_iter" -lt "$_lmi" ] 2>/dev/null \
+       && [ -n "$_start_epoch" ]; then
+        local _now2 _el2 _per _remain_iters _eta
+        _now2="$(date +%s 2>/dev/null || true)"
+        case "$_now2" in (*[!0-9]*|'') _now2="" ;; esac
+        if [ -n "$_now2" ] && [ "$_now2" -ge "$_start_epoch" ] 2>/dev/null; then
+            _el2=$(( _now2 - _start_epoch ))
+            _per=$(( _el2 / _iter ))
+            _remain_iters=$(( _lmi - _iter ))
+            _eta=$(( _per * _remain_iters ))
+            [ "$_eta" -gt 0 ] 2>/dev/null && _fields="${_fields} | eta ~$(_hud_fmt_secs "$_eta")"
+        fi
+    fi
+
+    echo -e "${CYAN}[HUD]${NC} ${_fields}"
+    return 0
+}
+
+# Format a whole-seconds integer as a compact duration: 37s, 2m11s, 1h03m.
+# Best-effort and set -u safe; any odd input degrades to "0s".
+_hud_fmt_secs() {
+    local _s="${1:-0}"
+    case "$_s" in (*[!0-9]*|'') _s=0 ;; esac
+    if [ "$_s" -lt 60 ] 2>/dev/null; then
+        printf '%ds' "$_s"
+    elif [ "$_s" -lt 3600 ] 2>/dev/null; then
+        printf '%dm%02ds' "$(( _s / 60 ))" "$(( _s % 60 ))"
+    else
+        printf '%dh%02dm' "$(( _s / 3600 ))" "$(( (_s % 3600) / 60 ))"
+    fi
+    return 0
+}
+
 #===============================================================================
 # Process Registry (PID Supervisor)
 # Central registry of all spawned child processes for reliable cleanup
@@ -14156,6 +14279,13 @@ except Exception:
     _LOKI_RUN_START_SHA="$(cat "$_start_sha_file" 2>/dev/null || echo "")"
     export _LOKI_RUN_START_SHA
 
+    # Live Build HUD (v7.71.0): capture the run-start epoch ONCE for the elapsed
+    # field. Pure assignment (`:` builtin), emits no output, so the non-TTY/CI/Bun
+    # parity surface is byte-identical. := preserves a value across a resume only
+    # within the same process; a fresh run stamps now.
+    : "${_LOKI_RUN_START_EPOCH:=$(date +%s)}"
+    export _LOKI_RUN_START_EPOCH
+
     # Session-scope the mid-flight model override (model-honesty fix). The
     # override file (.loki/state/model-override) is a LIVE-RUN control: the
     # dashboard UI and docs state it "applies to the current run". A leftover
@@ -15779,6 +15909,13 @@ else:
         if [ $exit_code -eq 0 ]; then
             # Episode trace already captured by auto_capture_episode above (v6.15.0)
 
+            # Live Build HUD (v7.71.0): one append-only status line per successful
+            # iteration. At the top of the success branch so it fires for ALL
+            # success sub-paths (incl. perpetual mode / completion). TTY-gated and
+            # `|| true` so it can never abort the loop. Never tee'd -> dashboard
+            # agent.log + stream parser untouched.
+            render_build_hud "${ITERATION_COUNT:-0}" "${rarv_phase:-?}" "${duration:-0}" || true
+
             # Perpetual mode: NEVER stop, always continue
             if [ "$PERPETUAL_MODE" = "true" ]; then
                 log_info "Perpetual mode: Ignoring exit, continuing immediately..."
@@ -16034,6 +16171,12 @@ else:
         # Only apply retry logic for ERRORS (non-zero exit code)
         # Episode trace already captured by auto_capture_episode above (v6.15.0)
 
+        # Live Build HUD (v7.71.0): a failing iteration still shows motion (lock
+        # #3). At the top of the failure fall-through so it fires for ALL failure
+        # sub-paths, incl. the rate-limit/failover branch that `continue`s before
+        # the "Will retry" log_warn below. TTY-gated, `|| true`, never tee'd.
+        render_build_hud "${ITERATION_COUNT:-0}" "${rarv_phase:-?}" "${duration:-0}" || true
+
         # Checkpoint failed iteration state (v5.57.0)
         create_checkpoint "iteration-${ITERATION_COUNT} failed (exit=$exit_code)" "iteration-${ITERATION_COUNT}-fail"
 

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.69.0"
+__version__ = "7.71.0"
 
 # Expose the control app for easy import
 try:

package/docs/BUILD-HUD-PLAN.md

@@ -0,0 +1,90 @@
+# BUILD-HUD-PLAN.md -- In-Terminal Live Build HUD
+
+## Product Owner scope locks (decided 2026-06-18)
+1. ETA: OMIT unless an explicit small LOKI_MAX_ITERATIONS or a LOKI_BUDGET_LIMIT cap is present. Default behavior shows no ETA.
+2. Phase wording: show the RARV phase name (REASON/ACT/REFLECT/VERIFY) -- that is what the live loop tracks. Do not add the planning/development tier word.
+3. Failure-iteration render: YES, render the HUD on both the success and the retry/failure path (the "is it working" moment matters most when an iteration fails).
+4. Opt-out var: LOKI_HUD (default 1 = on; LOKI_HUD=0 disables). TTY-gated.
+
+## 1. Goal
+When a user runs `loki start ./prd.md` in a foreground (interactive TTY) terminal, emit a single clean per-iteration status line at each iteration boundary showing: RARV phase, iteration N/max, cumulative cost, files changed (+/-) vs run start_sha, and per-iteration + elapsed time (ETA only when a real target exists per lock #1). Pure additive stdout decoration on the interactive path. Must not change non-TTY/CI/`--bg` output by a single byte, must not touch the stream-json parser, `log_step` lines, or the dashboard, and must degrade cleanly when cost data is unavailable.
+
+## 2. Live route confirmation (re-verified)
+- Orchestrator: `autonomy/run.sh`, `set -uo pipefail` (NOT `set -e`).
+- Iteration loop body: provider dispatched after the RARV banner (`run.sh:14662`); `rarv_phase` set at `run.sh:14589` via `get_rarv_phase_name "$ITERATION_COUNT"` (in scope for the whole iteration body).
+- `ITERATION_COUNT` = `run.sh:620` (init 0); `MAX_ITERATIONS` = `run.sh:619` (default `LOKI_MAX_ITERATIONS:-1000`).
+- Provider exit + `duration=$((end_time - start_time))` computed at `run.sh:15279-15280`.
+- Success path continues at `log_step "Starting next iteration..."` `run.sh:16026`.
+- Bun runner `loki-ts/src/runner/autonomous.ts` `runAutonomous` is dormant for `loki start` (bash route is live).
+
+## 3. Render point -- iteration END boundary (NOT start)
+Render once per iteration, after the provider exits and cost/duration are available, before the loop continues. Insert a single call
+
+```
+render_build_hud "$ITERATION_COUNT" "$rarv_phase" "$duration" || true
+```
+
+immediately after `duration` is computed (`run.sh:15280`) and after the result-cost file for this iteration has been flushed by the embedded stream parser (~`run.sh:15206-15208`). Iteration start is wrong: current iteration cost/files do not exist yet. Per lock #3, also add a second guarded call on the failure/retry path (same region, after the exit-code log_warn).
+
+## 4. Data sources (reuse only -- do not re-implement)
+| Field | Source | Notes |
+|---|---|---|
+| Phase | `$rarv_phase` (already set `run.sh:14589`) | REASON/ACT/REFLECT/VERIFY. |
+| Iteration N/max | `$ITERATION_COUNT` / `$MAX_ITERATIONS` | Already in scope. |
+| Cumulative cost | `.loki/context/tracking.json` -> `totals.total_cost_usd` (read pattern at `run.sh:4531`) | Cumulative for the run. Do NOT re-sum result-cost-*.json. |
+| Files changed (+/-) | `git diff --shortstat "${_LOKI_RUN_START_SHA}..HEAD"` with the exclude pathspec from `build_completion_summary` (`run.sh:2607-2618`) | Reuse `_LOKI_RUN_START_SHA` (exported `run.sh:14157`) + `':(exclude).loki/' ':(exclude).git/'`. |
+| Per-iteration time | `$duration` (`run.sh:15280`) | Already computed. |
+| Elapsed (run) | In-process epoch var captured once at loop entry (see SS6) | Parity-safe: var assignment emits no output. |
+| ETA | Per lock #1: only when explicit small max or budget cap | Default: omit. |
+
+## 5. Env / TTY gate
+HUD renders only when ALL hold (first lines of `render_build_hud`, early `return 0` otherwise):
+```
+[ -t 1 ] && [ "${BACKGROUND_MODE:-false}" != "true" ] && [ "${LOKI_HUD:-1}" != "0" ]
+```
+- `[ -t 1 ]` is the established idiom (`run.sh:10241, 13929`).
+- `BACKGROUND_MODE` guard mirrors the auto-open gate (`run.sh:10241`), covering `--bg`/`--detach`.
+
+## 6. Rendering approach -- append-only clean line, never `\r`
+The agent streams provider output to the same TTY during the iteration. A repainting `\r` bar would fight that stream. Therefore: a single append-only log line emitted only at the iteration boundary (after the stream for that iteration ended), styled like `log_step`/`log_info`. No carriage-return repaint, no cursor save/restore, no background thread. Distinct prefix `[HUD]` in `${CYAN}`/`${NC}` (`run.sh:1005`). Run-elapsed source: `: "${_LOKI_RUN_START_EPOCH:=$(date +%s)}"` placed once before the loop (pure assignment, parity-safe; do NOT stat start-sha mtime -- unreliable on resume).
+
+Illustrative line:
+```
+[HUD] REASON | iter 3/1000 | $0.42 | +180/-24 (4 files) | took 37s | elapsed 2m11s
+```
+
+## 7. set -uo pipefail safety + degrade
+- Guard every var with defaults: `${ITERATION_COUNT:-0}`, `${MAX_ITERATIONS:-0}`, `${rarv_phase:-?}`, `${_LOKI_RUN_START_SHA:-}`, `${_LOKI_RUN_START_EPOCH:-}`.
+- No `((x++))` from unset/zero; arithmetic only on integer-defaulted values.
+- Every external read best-effort: `2>/dev/null || true`, matching existing helpers.
+- Degrade: cost unavailable -> OMIT the cost field (never print $0.00 as real, never crash). files unavailable -> omit files field. The call site is `render_build_hud ... || true` so the helper can never abort the loop.
+
+## 8. Byte-identical-off-TTY guarantee (two mechanisms)
+1. Gate: helper returns before emitting unless TTY + not background + LOKI_HUD != 0.
+2. stdout-only, never tee'd: HUD uses plain `echo`/`printf` to stdout, NEVER piped into `tee -a "$log_file" "$agent_log"` (`run.sh:14643, 14662`). The dashboard reads `.loki/logs/agent.log`; the HUD never enters any `tee -a`, so logs + dashboard are untouched by construction. The stream-json parser reads the provider's stdout pipe, not the orchestrator terminal stdout.
+
+## 9. Parity argument (bash-only HUD is safe)
+- `runAutonomous` is dormant for `loki start`; the bash loop is the live route -> no live parity gap.
+- `tests/test-bash-bun-parity.sh` compares build_prompt output, PHASE_KEYS/SDLC list, the effort matrix, report/stats stdout -- NOT the autonomous loop terminal stdout. A loop HUD line is invisible to every parity invariant. No Bun mirror required (track a follow-up if runAutonomous becomes live).
+
+## 10. Test plan (`tests/test-build-hud.sh`, wired into run-all-tests)
+1. HUD appears on a TTY (pty harness): assert `[HUD]` + `iter 1/`; with a fake tracking.json assert cost field; remove it and assert line still appears without cost (degrade).
+2. HUD absent off-TTY byte-identical: capture full stdout off-TTY with LOKI_HUD unset and with LOKI_HUD=0; assert `diff` clean (HUD adds nothing off-TTY).
+3. Opt-out on TTY: TTY + LOKI_HUD=0 -> no `[HUD]`.
+4. Dashboard/log untouched: after a stubbed TTY iteration, assert `.loki/logs/agent.log` has no `[HUD]` (not tee'd).
+5. set -u safety: run helper under `bash -u` with all vars unset; assert exit 0, no unbound error.
+6. Regression: `tests/test-bash-bun-parity.sh` still green unchanged.
+
+## 11. Step-by-step task list
+Agent A -- implementation (`autonomy/run.sh` only):
+1. Add `render_build_hud()` near logging helpers (after `run.sh:1005`); first lines = SS5 gate + early `return 0`; body builds line from present fields only; stdout-only echo; `[HUD]` + CYAN/NC; wrapped so it can never abort the loop.
+2. Cumulative-cost read reusing the tracking.json totals pattern (`run.sh:4531`), `2>/dev/null || true`.
+3. Files-changed read reusing `git diff --shortstat "${_LOKI_RUN_START_SHA}..HEAD"` + exclude pathspec (`run.sh:2607-2618`).
+4. `: "${_LOKI_RUN_START_EPOCH:=$(date +%s)}"` once before the loop.
+5. Single call after `duration` at `run.sh:15280`; second guarded call on the failure path (lock #3).
+6. Confirm NOT inside any `tee -a`; stdout only.
+
+Agent B -- tests + docs:
+7. Write `tests/test-build-hud.sh` (all 6 cases); wire into `tests/run-all-tests.sh`.
+8. Document `LOKI_HUD` in `.env.example` + env reference docs.
+9. Run the new test + parity test; confirm green + off-TTY byte-identical.

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.69.0
+**Version:** v7.71.0
 
 ---
 
@@ -395,7 +395,7 @@ provider works inside the container. Provide auth with your Anthropic API key:
 # Run Loki Mode in Docker (Claude provider, API-key auth)
 docker run --rm -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
   -v $(pwd):/workspace -w /workspace \
-  asklokesh/loki-mode:7.69.0 start ./my-spec.md
+  asklokesh/loki-mode:7.71.0 start ./my-spec.md
 ```
 
 ##### docker compose + .env (no host install)