loki-mode 7.7.32 → 7.7.34

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-to-product system. Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product via the RARV-C closure loop, with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.7.32
+# Loki Mode v7.7.34
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -381,4 +381,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.7.32 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.7.34 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.7.32
+7.7.34

package/autonomy/loki

@@ -145,6 +145,48 @@ LEARNING_EMIT_SH="$SKILL_DIR/learning/emit.sh"
 LOKI_DIR="${LOKI_DIR:-.loki}"
 export LOKI_DIR
 
+# v7.7.34: launch the autonomous runner as a SESSION/PROCESS-GROUP LEADER so the
+# whole tree (orchestrator + the claude/codex/aider agent pipeline + monitors)
+# shares one process group and can be killed atomically with `kill -- -PGID`.
+# Without this, stopping the orchestrator pid orphans the agent child (it
+# reparents to init and keeps editing files), which is the "dashboard says
+# stopped but it keeps running" bug. macOS has no `setsid` binary, so prefer the
+# real binary (Linux/Docker), then perl POSIX::setsid, then python3 os.setsid,
+# then degrade to a plain exec (the cwd+sentinel agent sweep is the backstop).
+# This execs (replaces the current process); callers use it exactly like `exec`.
+#
+# IMPORTANT: setsid detaches the new session from the controlling terminal, so a
+# foreground INTERACTIVE `loki start` would then ignore Ctrl+C (breaking the
+# documented pause/exit-on-Ctrl+C UX). In an interactive shell, job control
+# ALREADY places the runner in its own process group, so the agent child shares
+# it and group-kill on stop works WITHOUT setsid. We therefore only create a new
+# session when stdin is NOT a tty (scripts / CI / detached launches), where the
+# runner would otherwise inherit the caller's group and escape group-kill.
+# Interactive runs keep Ctrl+C. Opt out entirely with LOKI_NO_NEW_SESSION=1;
+# force it on (e.g. for testing) with LOKI_FORCE_NEW_SESSION=1.
+_loki_new_session_exec() {
+    if [ "${LOKI_NO_NEW_SESSION:-}" = "1" ]; then
+        exec "$@"
+    elif [ -t 0 ] && [ "${LOKI_FORCE_NEW_SESSION:-}" != "1" ]; then
+        # Interactive terminal: keep the controlling tty so Ctrl+C still works.
+        # We do NOT setsid here, so the runner may SHARE the interactive shell's
+        # process group. Therefore we do NOT export LOKI_OWN_SESSION, and the
+        # runner will NOT record loki.pgid -- group-kill is unsafe on a shared
+        # shell group (it could kill the user's shell). Stop falls back to the
+        # cwd + [LOKI-AUTONOMY-AGENT] sentinel sweep, which is safe and reaps the
+        # agent by identity rather than by group.
+        exec "$@"
+    elif command -v setsid >/dev/null 2>&1; then
+        LOKI_OWN_SESSION=1 exec setsid "$@"
+    elif command -v perl >/dev/null 2>&1; then
+        LOKI_OWN_SESSION=1 exec perl -e 'use POSIX qw(setsid); setsid(); exec @ARGV or exit 127;' "$@"
+    elif command -v python3 >/dev/null 2>&1; then
+        LOKI_OWN_SESSION=1 exec python3 -c 'import os,sys; os.setsid(); os.execvp(sys.argv[1], sys.argv[1:])' "$@"
+    else
+        exec "$@"
+    fi
+}
+
 # Anonymous usage telemetry
 PROJECT_DIR="$SKILL_DIR"
 _TELEMETRY_SCRIPT="$SKILL_DIR/autonomy/telemetry.sh"
@@ -1624,7 +1666,7 @@ cmd_start() {
     # variable" under bash 3.2 (macOS default) + `set -u` when args is empty.
     # User report: `loki start` with no PRD on /Users/lokesh/git/anonima
     # crashed at this line. Safe expansion guards against empty arrays.
-    exec "$RUN_SH" ${args[@]+"${args[@]}"}
+    _loki_new_session_exec "$RUN_SH" ${args[@]+"${args[@]}"}
 }
 
 # Check if session is running
@@ -1874,6 +1916,62 @@ cmd_stop() {
         # Stop global session
         touch "$LOKI_DIR/STOP"
 
+        # v7.7.34: group-kill first. The autonomous agent (claude/codex/aider)
+        # shares the orchestrator's process group (the runner is launched as a
+        # session leader), so signaling the whole group reaps the orchestrator
+        # AND the agent child atomically. Killing only the orchestrator pid lets
+        # the agent reparent to init and keep editing files -- the reported bug.
+        # Guards: only a numeric pgid > 1 that is NOT this shell's own group.
+        local _stop_pgid_file
+        for _stop_pgid_file in "$LOKI_DIR/loki.pgid" "$LOKI_DIR/run.pgid"; do
+            [ -f "$_stop_pgid_file" ] || continue
+            local _spgid
+            _spgid=$(cat "$_stop_pgid_file" 2>/dev/null | tr -d ' ')
+            case "$_spgid" in ''|*[!0-9]*) continue ;; esac
+            [ "$_spgid" -gt 1 ] 2>/dev/null || continue
+            local _my_pgid
+            _my_pgid=$(ps -o pgid= -p $$ 2>/dev/null | tr -d ' ')
+            [ "$_spgid" = "$_my_pgid" ] && continue   # never kill our own group
+            # Collect protected pids (dashboard, app-runner, registered pids) so
+            # a group-kill never takes down the dashboard if it happens to share
+            # the orchestrator group. Mirrors the dashboard Python route.
+            local _protected=" "
+            local _pf
+            if [ -d "$LOKI_DIR/pids" ]; then
+                for _pf in "$LOKI_DIR/pids"/*.json; do
+                    [ -f "$_pf" ] || continue
+                    _protected="${_protected}$(basename "$_pf" .json) "
+                done
+            fi
+            for _pf in "$LOKI_DIR/dashboard/dashboard.pid" "${HOME}/.loki/dashboard/dashboard.pid"; do
+                [ -f "$_pf" ] && _protected="${_protected}$(cat "$_pf" 2>/dev/null | tr -d ' ') "
+            done
+            # Does any protected pid share this group?
+            local _conflict=0 _gp
+            for _gp in $(ps -axo pid=,pgid= 2>/dev/null | awk -v g="$_spgid" '$2==g{print $1}'); do
+                case "$_protected" in *" $_gp "*) _conflict=1; break ;; esac
+            done
+            if [ "$_conflict" = "1" ]; then
+                # Per-pid kill of group members EXCLUDING protected pids.
+                for _gp in $(ps -axo pid=,pgid= 2>/dev/null | awk -v g="$_spgid" '$2==g{print $1}'); do
+                    case "$_protected" in *" $_gp "*) continue ;; esac
+                    [ "$_gp" = "$$" ] && continue
+                    kill -TERM "$_gp" 2>/dev/null || true
+                done
+                sleep 1
+                for _gp in $(ps -axo pid=,pgid= 2>/dev/null | awk -v g="$_spgid" '$2==g{print $1}'); do
+                    case "$_protected" in *" $_gp "*) continue ;; esac
+                    [ "$_gp" = "$$" ] && continue
+                    kill -KILL "$_gp" 2>/dev/null || true
+                done
+            else
+                kill -TERM -- -"$_spgid" 2>/dev/null || true
+                sleep 1
+                kill -KILL -- -"$_spgid" 2>/dev/null || true
+            fi
+            rm -f "$_stop_pgid_file" 2>/dev/null || true
+        done
+
         local killed_pid=""
         for pid_file in "$LOKI_DIR/loki.pid" "$LOKI_DIR/run.pid"; do
             if [ -f "$pid_file" ]; then
@@ -8861,8 +8959,9 @@ QPRDEOF
         exit 1
     fi
 
-    # Run the orchestrator with quick settings
-    exec "$RUN_SH" "$quick_prd"
+    # Run the orchestrator with quick settings (session leader -- see
+    # _loki_new_session_exec; enables atomic group-kill on stop).
+    _loki_new_session_exec "$RUN_SH" "$quick_prd"
 }
 
 # Docker Compose monitoring with auto-fix (v6.67.0)

package/autonomy/run.sh

@@ -12681,7 +12681,29 @@ main() {
         # CRITICAL: Unset LOKI_RUNNING_FROM_TEMP so the background process does its own self-copy
         # Otherwise it would run directly from the original file and the trap would delete it
         local original_script="$SCRIPT_DIR/run.sh"
-        LOKI_RUNNING_FROM_TEMP='' nohup "$original_script" "${cmd_args[@]}" > "$log_file" 2>&1 &
+        # v7.7.34: launch the backgrounded runner as its own session leader so
+        # its agent tree shares one process group, killable atomically on stop.
+        # Prefer setsid (Linux/Docker), then perl, then python3, then plain nohup.
+        local _sess_launcher=""
+        if [ "${LOKI_NO_NEW_SESSION:-}" != "1" ]; then
+            if command -v setsid >/dev/null 2>&1; then _sess_launcher="setsid"
+            elif command -v perl >/dev/null 2>&1; then _sess_launcher="perl-setsid"
+            elif command -v python3 >/dev/null 2>&1; then _sess_launcher="python-setsid"; fi
+        fi
+        # Background mode is never interactive, so a new session is always safe
+        # and desirable (detaches from the tty and gives a dedicated group for
+        # stop). Export LOKI_OWN_SESSION=1 so the backgrounded runner records its
+        # pgid.
+        case "$_sess_launcher" in
+            setsid)
+                LOKI_RUNNING_FROM_TEMP='' LOKI_OWN_SESSION=1 nohup setsid "$original_script" "${cmd_args[@]}" > "$log_file" 2>&1 & ;;
+            perl-setsid)
+                LOKI_RUNNING_FROM_TEMP='' LOKI_OWN_SESSION=1 nohup perl -e 'use POSIX qw(setsid); setsid(); exec @ARGV or exit 127;' "$original_script" "${cmd_args[@]}" > "$log_file" 2>&1 & ;;
+            python-setsid)
+                LOKI_RUNNING_FROM_TEMP='' LOKI_OWN_SESSION=1 nohup python3 -c 'import os,sys; os.setsid(); os.execvp(sys.argv[1], sys.argv[1:])' "$original_script" "${cmd_args[@]}" > "$log_file" 2>&1 & ;;
+            *)
+                LOKI_RUNNING_FROM_TEMP='' nohup "$original_script" "${cmd_args[@]}" > "$log_file" 2>&1 & ;;
+        esac
         local bg_pid=$!
         echo "$bg_pid" > "$pid_file"
         register_pid "$bg_pid" "background-session" "log=$log_file"
@@ -12829,6 +12851,21 @@ main() {
 
     # Write PID file for ALL modes (foreground + background)
     echo "$$" > "$pid_file"
+    # v7.7.34: record the orchestrator's process-group id next to the pid so the
+    # stop paths can `kill -- -PGID` the whole tree (orchestrator + agent +
+    # monitors) atomically, closing the orphaned-agent hole.
+    # CRITICAL SAFETY: only record the pgid when this runner is its OWN session
+    # leader (LOKI_OWN_SESSION=1, set by the launcher when it setsid'd). If we
+    # did NOT create a new session (interactive foreground, where we keep the
+    # controlling tty for Ctrl+C), the runner may SHARE the user's shell process
+    # group, and group-killing it would kill the user's shell. In that case we
+    # leave loki.pgid absent and stop relies on the cwd+sentinel agent sweep.
+    if [ "${LOKI_OWN_SESSION:-}" = "1" ]; then
+        _loki_pgid="$(ps -o pgid= -p $$ 2>/dev/null | tr -d ' ')"
+        if [ -n "$_loki_pgid" ]; then
+            echo "$_loki_pgid" > "${pid_file%.pid}.pgid" 2>/dev/null || true
+        fi
+    fi
     # Store session ID in state for dashboard/status visibility
     if [ -n "${LOKI_SESSION_ID:-}" ]; then
         echo "${LOKI_SESSION_ID}" > ".loki/sessions/${LOKI_SESSION_ID}/session_id"

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.7.32"
+__version__ = "7.7.34"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -10,6 +10,7 @@ import asyncio
 import json
 import logging
 import os
+import subprocess
 import time
 from collections import defaultdict
 from dataclasses import asdict
@@ -2322,6 +2323,24 @@ async def stop_running_project(request: Request, body: RunningProjectStopRequest
         # pid already dead or unsignalable -- treat as stopped.
         stopped = True
 
+    # v7.7.33: the registry pid can be stale (a crashed/restarted session leaves
+    # an orphaned loki-run-*.sh under a new pid). Reap any orchestrator whose CWD
+    # is this project's dir so a stale pid cannot yield a false "stopped". Scoped
+    # by cwd to this project only.
+    if loki_dir is not None:
+        proj_dir = loki_dir.parent
+        # v7.7.34: group-kill first (atomic; reaps the orphan-prone agent child),
+        # then the cwd+sentinel reaper as backstop.
+        _pgid2 = _read_pgid(loki_dir)
+        if _pgid2 is not None:
+            await asyncio.to_thread(_killpg_project, _pgid2, _collect_protected_pids(loki_dir))
+        found_any, all_gone = await asyncio.to_thread(
+            _reap_orchestrators_until_clear, proj_dir, str(proj_dir))
+        if found_any:
+            stopped = all_gone
+        elif not all_gone:
+            stopped = False
+
     # Mark session.json stopped in that project's .loki.
     if loki_dir is not None:
         session_file = loki_dir / "session.json"
@@ -2581,6 +2600,351 @@ def _get_loki_dir() -> _Path:
     return _Path(".loki")
 
 
+def _find_orchestrator_pids_for_dir(project_dir: _Path) -> list[int]:
+    """Find live Loki orchestrator PIDs whose working directory IS project_dir.
+
+    v7.7.33: the dashboard Stop button used to signal only loki.pid. When that
+    pid file was stale (e.g. a crashed/restarted session left an orphaned
+    `bash /tmp/loki-run-XXXXXX.sh` reparented to init under a NEW pid), Stop
+    killed nothing live yet reported "stopped". The orchestrator temp-script
+    name carries no project identity, so we map orchestrator -> project by the
+    process CWD, which is reliably the project directory.
+
+    Strictly scoped: returns ONLY pids whose cwd resolves to project_dir, so a
+    stop on one project never reaps another folder's runner. Best-effort: on any
+    enumeration failure returns an empty list (callers still signal loki.pid).
+    """
+    pids: list[int] = []
+    try:
+        target = os.path.realpath(str(project_dir))
+    except OSError:
+        return pids
+
+    # Enumerate candidate orchestrator processes (the loki-run-*.sh temp script).
+    # Anchor the pattern to the real temp-dir path prefix (mktemp writes the
+    # runner to $TMPDIR or /tmp), so an unrelated process that merely mentions a
+    # "loki-run-*.sh" string in its argv is far less likely to match. The cwd
+    # equality check below is the authoritative scope guard regardless.
+    # pgrep enumeration can transiently miss a live process (kernel proc-list
+    # timing under load), which would let a still-running orphan slip past the
+    # post-kill survivor check and yield a false "stopped". Union a few quick
+    # passes to make the enumeration resilient. The cwd filter below still
+    # guarantees scope correctness for whatever is enumerated.
+    import time as _time
+    # Two candidate patterns, BOTH cwd-filtered below (cwd is the authoritative
+    # scope guard):
+    #   1. /loki-run-*.sh  -- the orchestrator temp script.
+    #   2. [LOKI-AUTONOMY-AGENT]  -- the sentinel Loki injects as the first line
+    #      of the agent's --append-system-prompt (v7.7.34). This matches the
+    #      claude/codex/aider AGENT process, which has no "loki-run" in its argv
+    #      and (critically) survives as an orphan (PPID 1) when the orchestrator
+    #      is killed -- the cause of "dashboard says stopped but it keeps
+    #      running". An interactive provider session never carries this sentinel,
+    #      so it is never matched.
+    _patterns = [r"/loki-run-[^/ ]*\.sh", r"\[LOKI-AUTONOMY-AGENT\]"]
+    candidate_set: set[int] = set()
+    enumerated = False
+    for _attempt in range(3):
+        for _pat in _patterns:
+            try:
+                out = subprocess.run(
+                    ["pgrep", "-f", _pat],
+                    capture_output=True, text=True, timeout=5,
+                )
+                enumerated = True
+                for line in out.stdout.split():
+                    try:
+                        candidate_set.add(int(line))
+                    except ValueError:
+                        pass
+            except (OSError, subprocess.SubprocessError):
+                pass
+        if _attempt < 2:
+            _time.sleep(0.15)
+    if not enumerated:
+        return pids
+    candidates = list(candidate_set)
+
+    for pid in candidates:
+        if _pid_is_gone(pid):
+            continue  # skip zombies / already-reaped
+        cwd = _pid_cwd(pid)
+        if cwd and os.path.realpath(cwd) == target:
+            pids.append(pid)
+    return pids
+
+
+def _pid_cwd(pid: int) -> Optional[str]:
+    """Return a process's current working directory, or None.
+
+    Linux: read /proc/<pid>/cwd. macOS/BSD: fall back to `lsof -a -p <pid> -d cwd`.
+    Best-effort and exception-safe; never raises.
+    """
+    # Linux fast path
+    proc_cwd = f"/proc/{pid}/cwd"
+    try:
+        if os.path.isdir(f"/proc/{pid}"):
+            return os.readlink(proc_cwd)
+    except OSError:
+        pass
+    # macOS / BSD: lsof
+    try:
+        out = subprocess.run(
+            ["lsof", "-a", "-p", str(pid), "-d", "cwd", "-Fn"],
+            capture_output=True, text=True, timeout=5,
+        )
+        for line in out.stdout.splitlines():
+            if line.startswith("n"):
+                return line[1:]
+    except (OSError, subprocess.SubprocessError):
+        pass
+    return None
+
+
+def _read_pgid(loki_dir: _Path) -> Optional[int]:
+    """Read the orchestrator process-group id recorded at .loki/loki.pgid (or the
+    per-session variant). Returns a valid pgid (>1) or None. Never raises."""
+    for name in ("loki.pgid", "run.pgid"):
+        f = loki_dir / name
+        try:
+            if f.exists():
+                v = int(f.read_text().strip())
+                if v > 1:
+                    return v
+        except (ValueError, OSError):
+            pass
+    # per-session pgid files
+    try:
+        sess_dir = loki_dir / "sessions"
+        if sess_dir.is_dir():
+            for sd in sess_dir.iterdir():
+                pf = sd / "loki.pgid"
+                if pf.exists():
+                    v = int(pf.read_text().strip())
+                    if v > 1:
+                        return v
+    except (ValueError, OSError):
+        pass
+    return None
+
+
+def _collect_protected_pids(loki_dir: _Path) -> set:
+    """Pids that must NOT be killed by a group stop: the dashboard, app-runner,
+    and anything registered under .loki/pids/ (filename is the pid). Plus this
+    server process. Best-effort; never raises."""
+    protected = {os.getpid()}
+    try:
+        protected.add(os.getppid())
+    except OSError:
+        pass
+    try:
+        pids_dir = loki_dir / "pids"
+        if pids_dir.is_dir():
+            for f in pids_dir.glob("*.json"):
+                try:
+                    protected.add(int(f.stem))
+                except ValueError:
+                    pass
+    except OSError:
+        pass
+    # the standalone dashboard pid file
+    for cand in (loki_dir / "dashboard" / "dashboard.pid",
+                 _Path.home() / ".loki" / "dashboard" / "dashboard.pid"):
+        try:
+            if cand.exists():
+                protected.add(int(cand.read_text().strip()))
+        except (ValueError, OSError):
+            pass
+    return protected
+
+
+def _killpg_project(pgid: Optional[int], protected_pids: Optional[set] = None) -> bool:
+    """Atomically stop a project's whole process tree by signaling its process
+    GROUP: SIGTERM, wait up to 5s, then SIGKILL. This is the v7.7.34 fix for the
+    orphaned-agent bug -- killing only the orchestrator pid let the agent child
+    reparent to init and keep running; a group kill reaps the orchestrator, the
+    agent, and every monitor at once with no orphan window.
+
+    Guards (CRITICAL): refuse to signal an absent/0/1 pgid or this server's OWN
+    process group (never commit suicide). If any protected pid (e.g. the shared
+    dashboard registered in .loki/pids) shares the target pgid, fall back to
+    per-pid kills of the group members EXCLUDING the protected pids, so the
+    dashboard is never taken down. Best-effort; never raises. Returns True if a
+    group signal (or scoped fallback) was issued."""
+    import signal as _signal
+    import time as _time
+    if not isinstance(pgid, int) or pgid <= 1:
+        return False
+    try:
+        if pgid == os.getpgrp():
+            return False  # never kill our own group
+    except OSError:
+        pass
+    protected = protected_pids or set()
+
+    def _group_members(g: int) -> list:
+        try:
+            out = subprocess.run(["ps", "-axo", "pid=,pgid="],
+                                 capture_output=True, text=True, timeout=5)
+        except (OSError, subprocess.SubprocessError):
+            return []
+        members = []
+        for line in out.stdout.splitlines():
+            parts = line.split()
+            if len(parts) >= 2:
+                try:
+                    pid_i, pgid_i = int(parts[0]), int(parts[1])
+                except ValueError:
+                    continue
+                if pgid_i == g:
+                    members.append(pid_i)
+        return members
+
+    members = _group_members(pgid)
+    conflict = any(p in protected for p in members)
+
+    if conflict:
+        # A protected pid (dashboard/app-runner) shares this group. Do NOT blast
+        # the whole group; signal only the non-protected members per-pid.
+        targets = [p for p in members if p not in protected and p != os.getpid()]
+        for sig in (_signal.SIGTERM,):
+            for p in targets:
+                try:
+                    os.kill(p, sig)
+                except OSError:
+                    pass
+        _time.sleep(2.0)
+        for p in targets:
+            try:
+                os.kill(p, _signal.SIGKILL)
+            except OSError:
+                pass
+        return True
+
+    # Clean case: signal the whole group.
+    try:
+        os.killpg(pgid, _signal.SIGTERM)
+    except (OSError, ProcessLookupError):
+        return True  # group already gone
+    for _ in range(10):
+        _time.sleep(0.5)
+        if not _group_members(pgid):
+            return True
+    try:
+        os.killpg(pgid, _signal.SIGKILL)
+    except (OSError, ProcessLookupError):
+        pass
+    return True
+
+
+def _reap_orchestrators_until_clear(project_dir: _Path, expected_cwd: str,
+                                    rounds: int = 6) -> tuple[bool, bool]:
+    """Find and terminate orchestrators for project_dir, looping until the
+    project is clear across a confirming re-scan. Returns (found_any, all_gone).
+
+    Robust against transient pgrep enumeration misses: a single find-then-scan
+    could miss a live orphan and falsely report it gone. We repeat find+kill and
+    require TWO consecutive empty scans before declaring all_gone, so a one-off
+    enumeration miss cannot yield a false "stopped". Runs in a worker thread (the
+    caller wraps it in asyncio.to_thread) so the blocking kills do not stall the
+    event loop. Strictly cwd-scoped via _find_orchestrator_pids_for_dir.
+    """
+    import time as _time
+    found_any = False
+    consecutive_empty = 0
+    for _round in range(rounds):
+        found = _find_orchestrator_pids_for_dir(project_dir)
+        if found:
+            found_any = True
+            consecutive_empty = 0
+            for opid in found:
+                _terminate_pid(opid, expected_cwd=expected_cwd)
+        else:
+            consecutive_empty += 1
+            if consecutive_empty >= 2:
+                return (found_any, True)  # clear, confirmed twice
+            _time.sleep(0.2)  # brief pause before the confirming re-scan
+    # Exhausted rounds: report gone only if the final scan is empty.
+    return (found_any, not _find_orchestrator_pids_for_dir(project_dir))
+
+
+def _pid_is_gone(pid: int) -> bool:
+    """True if pid no longer exists OR is a zombie/defunct (effectively dead,
+    just not yet reaped by its parent). os.kill(pid,0) succeeds on a zombie, so
+    we additionally consult `ps` for the process state. Never raises."""
+    try:
+        os.kill(pid, 0)
+    except OSError:
+        return True  # no such process
+    # alive per signal-0; check for zombie state (Z / defunct). Note: os.kill
+    # above proved the pid exists, so EMPTY ps output is a transient race, NOT a
+    # reap -- do not treat it as gone (that would falsely report a live
+    # orchestrator stopped). Only an explicit Z/zombie state counts as gone.
+    try:
+        out = subprocess.run(["ps", "-o", "state=", "-p", str(pid)],
+                             capture_output=True, text=True, timeout=5)
+        st = out.stdout.strip()
+        if st.startswith("Z"):
+            return True  # zombie / defunct -- effectively dead
+    except (OSError, subprocess.SubprocessError):
+        pass
+    return False
+
+
+def _terminate_pid(pid: int, timeout_s: float = 5.0,
+                   expected_cwd: Optional[str] = None) -> bool:
+    """SIGTERM a pid, wait up to timeout_s, then SIGKILL. Return True if it is
+    gone afterward. Reaps direct children first (pkill -P) so the provider/app
+    child does not outlive the orchestrator. A zombie counts as gone.
+    Best-effort, never raises.
+
+    If expected_cwd is given, re-verify the pid's cwd still matches it right
+    before signaling (TOCTOU guard against pid reuse between enumeration and
+    kill). If it no longer matches, do nothing and report the pid gone."""
+    import time as _time
+    if expected_cwd is not None:
+        cwd = _pid_cwd(pid)
+        # Only skip the kill when the cwd POSITIVELY differs (true pid reuse).
+        # A failed/transient cwd lookup (cwd is None) must NOT cancel the kill:
+        # the pid came from a cwd-matched enumeration moments ago, and treating a
+        # transient lookup miss as "recycled" would skip killing a live
+        # orchestrator and falsely report it stopped.
+        if cwd:
+            try:
+                if os.path.realpath(cwd) != os.path.realpath(expected_cwd):
+                    return True  # pid recycled to a different cwd -- do not kill
+            except OSError:
+                pass  # fall through and kill the originally-matched pid
+    try:
+        # reap children first so a wedged child cannot keep the tree alive
+        subprocess.run(["pkill", "-TERM", "-P", str(pid)],
+                       capture_output=True, timeout=5)
+    except (OSError, subprocess.SubprocessError):
+        pass
+    try:
+        os.kill(pid, 15)
+    except (ProcessLookupError, OSError):
+        return True  # already gone
+    deadline = timeout_s
+    while deadline > 0:
+        _time.sleep(0.5)
+        deadline -= 0.5
+        if _pid_is_gone(pid):
+            return True
+    # still alive -> SIGKILL the tree
+    try:
+        subprocess.run(["pkill", "-9", "-P", str(pid)],
+                       capture_output=True, timeout=5)
+    except (OSError, subprocess.SubprocessError):
+        pass
+    try:
+        os.kill(pid, 9)
+    except (ProcessLookupError, OSError):
+        return True
+    _time.sleep(0.3)
+    return _pid_is_gone(pid)
+
+
 _SAFE_ID_RE = re.compile(r'^[a-zA-Z0-9_-]+$')
 
 
@@ -3914,6 +4278,36 @@ async def stop_session(request: Request):
         except (ValueError, OSError, ProcessLookupError):
             process_stopped = True
 
+    # v7.7.33: loki.pid alone is not authoritative. If it was stale (a crashed
+    # or restarted session can leave an orphaned `loki-run-*.sh` under a new pid
+    # reparented to init), the kill above is a no-op yet reports "stopped" while
+    # the real orchestrator keeps running. Reap any orchestrator process whose
+    # CWD is THIS project's directory. Strictly scoped by cwd, so a stop on one
+    # project never touches another folder's runner.
+    # v7.7.34: group-kill is the PRIMARY, atomic teardown. Signal the
+    # orchestrator's whole process group so the agent child (which reparents to
+    # init when only the orchestrator pid is killed) dies WITH it. Protected pids
+    # (dashboard/app-runner) are spared. The cwd+sentinel reaper below is the
+    # backstop for already-orphaned agents from pre-v7.7.34 sessions.
+    _loki_dir_for_pg = _get_loki_dir()
+    _pgid = _read_pgid(_loki_dir_for_pg)
+    _protected = _collect_protected_pids(_loki_dir_for_pg)
+    if _pgid is not None:
+        await asyncio.to_thread(_killpg_project, _pgid, _protected)
+    project_dir = _get_loki_dir().parent
+    _proj = str(project_dir)
+    found_any, all_gone = await asyncio.to_thread(
+        _reap_orchestrators_until_clear, project_dir, _proj)
+    # The orchestrator-survivor scan is authoritative over loki.pid. If any
+    # orchestrator for this project was ever found, report stopped only when none
+    # survive. If we found one (stale-pid case), the real outcome wins over the
+    # loki.pid false positive. If the scan kept finding survivors, report not
+    # stopped even if loki.pid claimed success.
+    if found_any:
+        process_stopped = all_gone
+    elif not all_gone:
+        process_stopped = False
+
     # Mark session.json as stopped
     session_file = _get_loki_dir() / "session.json"
     if session_file.exists():

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.7.32
+**Version:** v7.7.34
 
 ---
 

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var _7=Object.defineProperty;var I7=(K)=>K;function P7(K,$){this[K]=I7.bind(null,$)}var v=(K,$)=>{for(var Q in $)_7(K,Q,{get:$[Q],enumerable:!0,configurable:!0,set:P7.bind($,Q)})};var w=(K,$)=>()=>(K&&($=K(K=0)),$);var t=import.meta.require;var e1={};v(e1,{lokiDir:()=>L,homeLokiDir:()=>k1,findRepoRootForVersion:()=>S1,REPO_ROOT:()=>p});import{resolve as u,dirname as N1}from"path";import{fileURLToPath as L7}from"url";import{existsSync as J1}from"fs";import{homedir as R7}from"os";function E7(){let K=i1;for(let $=0;$<6;$++){if(J1(u(K,"VERSION"))&&J1(u(K,"autonomy/run.sh")))return K;let Q=N1(K);if(Q===K)break;K=Q}return u(i1,"..","..","..")}function S1(K){let $=K;for(let Q=0;Q<6;Q++){if(J1(u($,"VERSION"))&&J1(u($,"autonomy/run.sh")))return $;let X=N1($);if(X===$)break;$=X}return u(K,"..","..","..")}function L(){return process.env.LOKI_DIR??u(process.cwd(),".loki")}function k1(){return u(R7(),".loki")}var i1,p;var g=w(()=>{i1=N1(L7(import.meta.url));p=E7()});import{readFileSync as w7}from"fs";import{resolve as x7,dirname as F7}from"path";import{fileURLToPath as N7}from"url";function G1(){if(o!==null)return o;let K="7.7.32";if(typeof K==="string"&&K.length>0)return o=K,o;try{let $=F7(N7(import.meta.url)),Q=S1($);o=w7(x7(Q,"VERSION"),"utf-8").trim()}catch{o="unknown"}return o}var o=null;var C1=w(()=>{g()});var $0={};v($0,{runOrThrow:()=>S7,run:()=>C,commandVersion:()=>C7,commandExists:()=>b,ShellError:()=>D1});async function C(K,$={}){let Q=Bun.spawn({cmd:[...K],stdout:"pipe",stderr:"pipe",env:$.env?{...process.env,...$.env}:process.env,cwd:$.cwd}),X,Z;if($.timeoutMs&&$.timeoutMs>0)X=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},$.timeoutMs);try{let[W,z,q]=await Promise.all([new Response(Q.stdout).text(),new Response(Q.stderr).text(),Q.exited]);return{stdout:W,stderr:z,exitCode:q}}finally{if(X)clearTimeout(X);if(Z)clearTimeout(Z)}}async function S7(K,$={}){let Q=await C(K,$);if(Q.exitCode!==0)throw new D1(`command failed (${Q.exitCode}): ${K.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function b(K){let $=k7(K),Q=await C(["sh","-c",`command -v ${$}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function k7(K){if(!/^[A-Za-z0-9._/-]+$/.test(K))throw Error(`refused to shell-escape suspect token: ${K}`);return K}async function C7(K,$="--version"){if(!await b(K))return null;let X=await C([K,$],{timeoutMs:5000});if(X.exitCode!==0)return null;return((X.stdout||X.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var D1;var n=w(()=>{D1=class D1 extends Error{message;exitCode;stdout;stderr;constructor(K,$,Q,X){super(K);this.message=K;this.exitCode=$;this.stdout=Q;this.stderr=X;this.name="ShellError"}}});function c(K){return D7?"":K}var D7,F,y,N,A6,A,D,S,H;var a=w(()=>{D7=(process.env.NO_COLOR??"").length>0;F=c("\x1B[0;31m"),y=c("\x1B[0;32m"),N=c("\x1B[1;33m"),A6=c("\x1B[0;34m"),A=c("\x1B[0;36m"),D=c("\x1B[1m"),S=c("\x1B[2m"),H=c("\x1B[0m")});import{existsSync as c7}from"fs";async function i(){if(Z1!==void 0)return Z1;let K="/opt/homebrew/bin/python3.12";if(c7(K))return Z1=K,K;let $=await b("python3.12");if($)return Z1=$,$;let Q=await b("python3");return Z1=Q,Q}async function s(K,$={}){let Q=await i();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return C([Q,"-c",K],$)}var Z1;var z1=w(()=>{n()});var G0={};v(G0,{runStatus:()=>X5});import{existsSync as k,readFileSync as K1,readdirSync as W0,statSync as H0}from"fs";import{resolve as R,basename as a7}from"path";import{homedir as s7}from"os";async function t7(){if(await b("jq"))return!0;return process.stdout.write(`${F}Error: jq is required but not installed.${H}
+var _7=Object.defineProperty;var I7=(K)=>K;function P7(K,$){this[K]=I7.bind(null,$)}var v=(K,$)=>{for(var Q in $)_7(K,Q,{get:$[Q],enumerable:!0,configurable:!0,set:P7.bind($,Q)})};var w=(K,$)=>()=>(K&&($=K(K=0)),$);var t=import.meta.require;var e1={};v(e1,{lokiDir:()=>L,homeLokiDir:()=>k1,findRepoRootForVersion:()=>S1,REPO_ROOT:()=>p});import{resolve as u,dirname as N1}from"path";import{fileURLToPath as L7}from"url";import{existsSync as J1}from"fs";import{homedir as R7}from"os";function E7(){let K=i1;for(let $=0;$<6;$++){if(J1(u(K,"VERSION"))&&J1(u(K,"autonomy/run.sh")))return K;let Q=N1(K);if(Q===K)break;K=Q}return u(i1,"..","..","..")}function S1(K){let $=K;for(let Q=0;Q<6;Q++){if(J1(u($,"VERSION"))&&J1(u($,"autonomy/run.sh")))return $;let X=N1($);if(X===$)break;$=X}return u(K,"..","..","..")}function L(){return process.env.LOKI_DIR??u(process.cwd(),".loki")}function k1(){return u(R7(),".loki")}var i1,p;var g=w(()=>{i1=N1(L7(import.meta.url));p=E7()});import{readFileSync as w7}from"fs";import{resolve as x7,dirname as F7}from"path";import{fileURLToPath as N7}from"url";function G1(){if(o!==null)return o;let K="7.7.34";if(typeof K==="string"&&K.length>0)return o=K,o;try{let $=F7(N7(import.meta.url)),Q=S1($);o=w7(x7(Q,"VERSION"),"utf-8").trim()}catch{o="unknown"}return o}var o=null;var C1=w(()=>{g()});var $0={};v($0,{runOrThrow:()=>S7,run:()=>C,commandVersion:()=>C7,commandExists:()=>b,ShellError:()=>D1});async function C(K,$={}){let Q=Bun.spawn({cmd:[...K],stdout:"pipe",stderr:"pipe",env:$.env?{...process.env,...$.env}:process.env,cwd:$.cwd}),X,Z;if($.timeoutMs&&$.timeoutMs>0)X=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}Z=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},$.timeoutMs);try{let[W,z,q]=await Promise.all([new Response(Q.stdout).text(),new Response(Q.stderr).text(),Q.exited]);return{stdout:W,stderr:z,exitCode:q}}finally{if(X)clearTimeout(X);if(Z)clearTimeout(Z)}}async function S7(K,$={}){let Q=await C(K,$);if(Q.exitCode!==0)throw new D1(`command failed (${Q.exitCode}): ${K.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function b(K){let $=k7(K),Q=await C(["sh","-c",`command -v ${$}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function k7(K){if(!/^[A-Za-z0-9._/-]+$/.test(K))throw Error(`refused to shell-escape suspect token: ${K}`);return K}async function C7(K,$="--version"){if(!await b(K))return null;let X=await C([K,$],{timeoutMs:5000});if(X.exitCode!==0)return null;return((X.stdout||X.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var D1;var n=w(()=>{D1=class D1 extends Error{message;exitCode;stdout;stderr;constructor(K,$,Q,X){super(K);this.message=K;this.exitCode=$;this.stdout=Q;this.stderr=X;this.name="ShellError"}}});function c(K){return D7?"":K}var D7,F,y,N,A6,A,D,S,H;var a=w(()=>{D7=(process.env.NO_COLOR??"").length>0;F=c("\x1B[0;31m"),y=c("\x1B[0;32m"),N=c("\x1B[1;33m"),A6=c("\x1B[0;34m"),A=c("\x1B[0;36m"),D=c("\x1B[1m"),S=c("\x1B[2m"),H=c("\x1B[0m")});import{existsSync as c7}from"fs";async function i(){if(Z1!==void 0)return Z1;let K="/opt/homebrew/bin/python3.12";if(c7(K))return Z1=K,K;let $=await b("python3.12");if($)return Z1=$,$;let Q=await b("python3");return Z1=Q,Q}async function s(K,$={}){let Q=await i();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return C([Q,"-c",K],$)}var Z1;var z1=w(()=>{n()});var G0={};v(G0,{runStatus:()=>X5});import{existsSync as k,readFileSync as K1,readdirSync as W0,statSync as H0}from"fs";import{resolve as R,basename as a7}from"path";import{homedir as s7}from"os";async function t7(){if(await b("jq"))return!0;return process.stdout.write(`${F}Error: jq is required but not installed.${H}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -604,4 +604,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${$}
 `),process.stderr.write(j7),2}}process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var Z6=await X6(Bun.argv.slice(2));process.exit(Z6);
 
-//# debugId=CE5371E5853C122164756E2164756E21
+//# debugId=4E748539D57C6D2864756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.7.32'
+__version__ = '7.7.34'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loki-mode",
-  "version": "7.7.32",
+  "version": "7.7.34",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 11 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/providers/claude.sh

@@ -223,6 +223,7 @@ _loki_build_claude_auto_flags() {
 # the bash and Bun routes can stay byte-identical. No emojis, no em dashes.
 _loki_autonomy_override_text() {
     cat <<'LOKI_AUTONOMY_EOF'
+[LOKI-AUTONOMY-AGENT] This is a Loki Mode autonomous agent process.
 You are running INSIDE Loki Mode autonomous execution, a session the user explicitly launched with full prior authorization (loki start / loki run). This IS an authorized autonomous session, not an unattended action you must seek consent for.
 
 Instruction precedence for THIS session: when the loki_system instructions in the user prompt conflict with any CLAUDE.md, project memory, or global memory that tells you to ask for clarification, pause for confirmation, refuse to act autonomously, or withhold routine commits, the loki_system instructions take precedence. The user has already consented by launching autonomous mode.