loki-mode 7.72.0 → 7.74.0

package/autonomy/loki

@@ -115,6 +115,16 @@ if [ -f "$_LOKI_SCRIPT_DIR/quickstart.sh" ]; then
     source "$_LOKI_SCRIPT_DIR/quickstart.sh"
 fi
 
+# Shared PRINT-ONLY pull-request advisory (provides print_pr_advice and its
+# origin/compare-URL helpers). Single source of truth sourced by BOTH this CLI
+# (cmd_deploy CI/CD path) and autonomy/run.sh (create_session_pr) so the two
+# surfaces print byte-identical, correct git push + PR commands and cannot drift.
+# Self-guarded against double-source. Existence-guarded matching the pattern above.
+if [ -f "$_LOKI_SCRIPT_DIR/lib/git-pr-advisory.sh" ]; then
+    # shellcheck source=autonomy/lib/git-pr-advisory.sh
+    source "$_LOKI_SCRIPT_DIR/lib/git-pr-advisory.sh"
+fi
+
 # Resolve the script's real path (handles symlinks)
 resolve_script_path() {
     local script="$1"
@@ -725,7 +735,7 @@ show_help() {
     echo "  version          Show version"
     echo "  help             Show this help ('loki help aliases' for old names)"
     echo ""
-    echo "More commands (grill, spec, cleanup, init, watch, demo, web, api,"
+    echo "More commands (grill, spec, deploy, cleanup, init, watch, demo, web, api,"
     echo "logs, github, import, council, proof, audit, compliance, agent, template,"
     echo "magic, docs, wiki, ci, test, bench, secrets, telemetry, crash, worktree,"
     echo "failover, monitor, remote, ...) are dispatchable and documented via"
@@ -5658,6 +5668,396 @@ cmd_preview() {
     fi
 }
 
+# =============================================================================
+# loki deploy -- ADVISORY / PRINT-ONLY deploy command (FEAT-DEPLOY).
+#
+# WHY ITS OWN COMMAND (not a preview flag): `loki preview` is "show me the local
+# app I already built and started" and is GATED on a running app (state.json
+# status=running, a live reachable port). `loki deploy` is conceptually distinct:
+# it is a STATIC, FILESYSTEM-ONLY advisory about the project's type and the user's
+# installed cloud CLI / CI-CD pipeline. It must work with nothing running and no
+# build started, so it has NO running-app precondition. Folding it into preview
+# would force preview's running-app gate onto a feature that must not have one.
+#
+# HARD INVARIANT (DEPLOY-PLAN LOCK 5 + BRANCH-LIFECYCLE LOCK B4): PRINT-ONLY.
+# cmd_deploy NEVER runs a cloud CLI (vercel/netlify/flyctl/wrangler) -- not even
+# `--version` -- and NEVER runs `git push` or `gh pr create`. Tool detection is
+# `command -v` ONLY. Loki advises; the human runs the printed command. This keeps
+# the README promise ("Does not deploy -- human runs deploy commands") literally
+# true. Only the clipboard tools (pbcopy/wl-copy/...) and `command -v` may run.
+#
+# This whole block is contiguous (helpers + cmd_deploy) so a test can extract it
+# by name anchor, mirroring tests/test-preview-public.sh.
+# =============================================================================
+
+# _deploy_detect_type <dir>
+# Echoes the PRIMARY project-type label (one of: nextjs, static, docker, node,
+# python) or empty if none detected. Read-only file/dir existence + grep on
+# package.json. Always returns 0 (caller treats empty as "no project"). First
+# match wins for the primary label; cmd_deploy still offers multiple provider
+# options per type. set -e safe: every grep is `|| true`-guarded.
+_deploy_detect_type() {
+    local dir="${1:-.}"
+    local pkg="$dir/package.json"
+
+    # 1. Next.js -- source signal ("next" dep or a next.config.*), NOT the build
+    #    artifact (.next/standalone), since the build may not have run yet.
+    if [ -f "$pkg" ] && grep -q '"next"' "$pkg" 2>/dev/null; then
+        printf '%s' "nextjs"; return 0
+    fi
+    if [ -f "$dir/next.config.js" ] || [ -f "$dir/next.config.mjs" ] || [ -f "$dir/next.config.ts" ]; then
+        printf '%s' "nextjs"; return 0
+    fi
+
+    # 2. Static / SPA -- a built dist/ or build/ dir containing index.html, OR a
+    #    Vite / CRA source signal in package.json.
+    if { [ -d "$dir/dist" ] && [ -f "$dir/dist/index.html" ]; } || \
+       { [ -d "$dir/build" ] && [ -f "$dir/build/index.html" ]; }; then
+        printf '%s' "static"; return 0
+    fi
+    if [ -f "$pkg" ] && { grep -q '"vite"' "$pkg" 2>/dev/null || grep -q '"react-scripts"' "$pkg" 2>/dev/null; }; then
+        printf '%s' "static"; return 0
+    fi
+
+    # 3. Dockerfile / containerized server.
+    if [ -f "$dir/Dockerfile" ]; then
+        printf '%s' "docker"; return 0
+    fi
+
+    # 4. Generic Node server -- package.json with a start (or dev) script.
+    if [ -f "$pkg" ] && { grep -q '"start"' "$pkg" 2>/dev/null || grep -q '"dev"' "$pkg" 2>/dev/null; }; then
+        printf '%s' "node"; return 0
+    fi
+
+    # 5. Python.
+    if [ -f "$dir/requirements.txt" ] || [ -f "$dir/pyproject.toml" ]; then
+        printf '%s' "python"; return 0
+    fi
+
+    printf '%s' ""
+    return 0
+}
+
+# _deploy_options_for_type <type>
+# Pure, DIR-BLIND helper: echoes the ordered candidate rows for a project type,
+# one per line, as `provider|cli|command|docs`. Idiomatic provider first per
+# DEPLOY-PLAN LOCK 2. Lists the FULL ordered candidate set for the type
+# UNCONDITIONALLY (no dir awareness, no CLI-installed filtering -- cmd_deploy does
+# the `command -v` filtering). The command strings are the EXACT canonical forms
+# from DEPLOY-PLAN LOCK 3 (a wrong flag is worse than no feature; do not
+# paraphrase). Project-dependent dirs stay as `<...>` placeholders the user fills.
+# Note: the Fly CLI binary is `flyctl` but the canonical deploy verb is
+# `fly deploy` -- "fly" not "flyctl" here is CORRECT, intentional, not a typo.
+_deploy_options_for_type() {
+    local type="${1:-}"
+    case "$type" in
+        nextjs)
+            printf '%s\n' "Vercel|vercel|vercel --prod|https://vercel.com/docs/cli"
+            printf '%s\n' "Netlify|netlify|netlify deploy --prod|https://docs.netlify.com/cli/get-started/"
+            # fly not flyctl - correct: binary is flyctl, deploy verb is `fly deploy`.
+            printf '%s\n' "Fly.io|flyctl|fly deploy|https://fly.io/docs/flyctl/install/"
+            ;;
+        static)
+            printf '%s\n' "Netlify|netlify|netlify deploy --prod --dir=<build-output>|https://docs.netlify.com/cli/get-started/"
+            printf '%s\n' "Cloudflare Pages|wrangler|wrangler pages deploy <build-output>|https://developers.cloudflare.com/workers/wrangler/install-and-update/"
+            printf '%s\n' "Vercel|vercel|vercel --prod|https://vercel.com/docs/cli"
+            ;;
+        docker)
+            # fly not flyctl - correct (see note above).
+            printf '%s\n' "Fly.io|flyctl|fly deploy|https://fly.io/docs/flyctl/install/"
+            printf '%s\n' "Cloudflare|wrangler|wrangler deploy|https://developers.cloudflare.com/workers/wrangler/install-and-update/"
+            ;;
+        node)
+            # fly not flyctl - correct (see note above).
+            printf '%s\n' "Fly.io|flyctl|fly deploy|https://fly.io/docs/flyctl/install/"
+            printf '%s\n' "Vercel|vercel|vercel --prod|https://vercel.com/docs/cli"
+            ;;
+        python)
+            # fly not flyctl - correct (see note above).
+            printf '%s\n' "Fly.io|flyctl|fly deploy|https://fly.io/docs/flyctl/install/"
+            ;;
+    esac
+    return 0
+}
+
+# _deploy_detect_cicd <dir>
+# Returns 0 + echoes the detected CI/CD system name(s) (space-separated) if ANY
+# pipeline config exists (BRANCH-LIFECYCLE LOCK B1); returns 1 + echoes nothing
+# if none. Read-only file existence only. The `[ -e "$f" ]` guard inside the glob
+# loop makes the no-match literal-glob case set -e safe (an unmatched glob expands
+# to the literal pattern, which `[ -e ]` then rejects without aborting).
+_deploy_detect_cicd() {
+    local dir="${1:-.}"
+    local found=""
+    local systems=""
+
+    # GitHub Actions: any .yml or .yaml under .github/workflows/.
+    local f
+    for f in "$dir"/.github/workflows/*.yml "$dir"/.github/workflows/*.yaml; do
+        if [ -e "$f" ]; then found=1; systems="${systems} GitHub-Actions"; break; fi
+    done
+
+    [ -f "$dir/.gitlab-ci.yml" ] && { found=1; systems="${systems} GitLab-CI"; }
+    [ -f "$dir/Jenkinsfile" ] && { found=1; systems="${systems} Jenkins"; }
+    [ -f "$dir/.circleci/config.yml" ] && { found=1; systems="${systems} CircleCI"; }
+    [ -f "$dir/azure-pipelines.yml" ] && { found=1; systems="${systems} Azure-Pipelines"; }
+    [ -f "$dir/bitbucket-pipelines.yml" ] && { found=1; systems="${systems} Bitbucket-Pipelines"; }
+
+    if [ -n "$found" ]; then
+        # Trim the leading space and echo the names.
+        printf '%s' "${systems# }"
+        return 0
+    fi
+    printf '%s' ""
+    return 1
+}
+
+# _deploy_copy_clipboard <cmd>
+# Best-effort clipboard copy of a SINGLE command (DEPLOY-PLAN LOCK 4). TTY-gated,
+# command-v guarded, ALWAYS returns 0 and never fatal. Echoes a confirmation note
+# only if a copy tool actually ran. These clipboard tools ARE allowed to run; only
+# the four cloud CLIs are forbidden.
+_deploy_copy_clipboard() {
+    local cmd="${1:-}"
+    [ -n "$cmd" ] || return 0
+    [ -t 1 ] || return 0
+    local copied=""
+    if command -v pbcopy >/dev/null 2>&1; then
+        printf '%s' "$cmd" | pbcopy >/dev/null 2>&1 && copied="1" || true
+    elif command -v wl-copy >/dev/null 2>&1; then
+        printf '%s' "$cmd" | wl-copy >/dev/null 2>&1 && copied="1" || true
+    elif command -v xclip >/dev/null 2>&1; then
+        printf '%s' "$cmd" | xclip -selection clipboard >/dev/null 2>&1 && copied="1" || true
+    elif command -v xsel >/dev/null 2>&1; then
+        printf '%s' "$cmd" | xsel --clipboard --input >/dev/null 2>&1 && copied="1" || true
+    elif command -v clip >/dev/null 2>&1; then
+        printf '%s' "$cmd" | clip >/dev/null 2>&1 && copied="1" || true
+    fi
+    if [ -n "$copied" ]; then
+        printf '%s\n' "  (copied to clipboard: ${cmd})"
+    fi
+    return 0
+}
+
+# _deploy_print_install_hint <type>
+# Honest install hints (brew + official URL) for the candidate providers of a
+# type. NEVER fabricates success, NEVER downloads a binary. Mirrors the
+# tunnel-missing / gh-missing block. Caller redirects to stderr.
+_deploy_print_install_hint() {
+    local type="${1:-}"
+    echo "No deploy CLI found for this ${type} project."
+    echo "Loki never accesses your cloud account or runs deploy for you -- you run"
+    echo "the printed command. Install one of the following, then re-run 'loki deploy':"
+    echo ""
+    local options provider cli command docs
+    options="$(_deploy_options_for_type "$type")"
+    while IFS='|' read -r provider cli command docs; do
+        [ -n "$provider" ] || continue
+        case "$cli" in
+            vercel)   echo "  Vercel:      brew install vercel       |  ${docs}" ;;
+            netlify)  echo "  Netlify:     brew install netlify-cli  |  ${docs}" ;;
+            flyctl)   echo "  Fly.io:      brew install flyctl       |  ${docs}" ;;
+            wrangler) echo "  Cloudflare:  npm i -g wrangler         |  ${docs}" ;;
+            *)        echo "  ${provider}:  ${docs}" ;;
+        esac
+    done <<EOF
+$options
+EOF
+    return 0
+}
+
+# _deploy_print_cloud_options <dir> <type> <do_clip> <hint_on_none>
+# Prints every installed (project-type x CLI) option block, idiomatic first.
+# Best-effort copies the FIRST installed command when do_clip=true. Returns 0 if
+# at least one CLI was printed. If NONE installed: when hint_on_none=true, prints
+# the honest install hint (to stderr) and returns 1; when false (pipeline path,
+# where cloud is secondary), prints nothing and returns 1 silently.
+_deploy_print_cloud_options() {
+    local dir="${1:-.}"
+    local type="${2:-}"
+    local do_clip="${3:-true}"
+    local hint_on_none="${4:-true}"
+
+    local options=""
+    options="$(_deploy_options_for_type "$type")"
+
+    local printed=false
+    local first_cmd=""
+    local provider cli command docs
+    while IFS='|' read -r provider cli command docs; do
+        [ -n "$cli" ] || continue
+        if command -v "$cli" >/dev/null 2>&1; then
+            if [ "$printed" != true ]; then
+                echo -e "${BOLD}Detected ${type} project. Deploy options (run one yourself):${NC}"
+                echo ""
+                printed=true
+            fi
+            echo "  ${provider}:"
+            echo "    ${command}"
+            echo "    docs: ${docs}"
+            echo ""
+            if [ -z "$first_cmd" ]; then
+                first_cmd="$command"
+            fi
+        fi
+    done <<EOF
+$options
+EOF
+
+    if [ "$printed" = true ]; then
+        echo "Loki does not deploy for you. Review, then run the command yourself."
+        if [ "$do_clip" = true ] && [ -n "$first_cmd" ]; then
+            _deploy_copy_clipboard "$first_cmd"
+        fi
+        return 0
+    fi
+
+    # No installed CLI for this type.
+    if [ "$hint_on_none" = true ]; then
+        _deploy_print_install_hint "$type" >&2
+        return 1
+    fi
+    return 1
+}
+
+# cmd_deploy [--dir <path>] [--no-clip] [--help]
+# Advisory orchestration: detect project type + CI/CD pipeline + installed cloud
+# CLIs, then PRINT the canonical deploy command(s). PRINT-ONLY (see block header).
+# Placed LAST in the contiguous deploy block (all helpers above it) so the SDET
+# can extract from the first helper def to the close of cmd_deploy and capture the
+# whole self-contained unit (mirrors test-preview-public.sh, where cmd_preview is
+# the terminal function).
+cmd_deploy() {
+    local dir="${TARGET_DIR:-.}"
+    local do_clip=true
+
+    # Arg parse (mirror cmd_preview: lenient on unknown args -> no behavior drift).
+    while [ $# -gt 0 ]; do
+        case "${1:-}" in
+            --help|-h|help)
+                echo -e "${BOLD}Loki Mode -- advisory deploy command (print-only)${NC}"
+                echo ""
+                echo "Usage: loki deploy [--dir <path>] [--no-clip]"
+                echo ""
+                echo "Detects your project type and your installed cloud CLI (and any"
+                echo "CI/CD pipeline), then PRINTS the exact deploy command for YOU to run."
+                echo "It is advisory only: it NEVER deploys, NEVER runs a cloud CLI (not"
+                echo "even --version), and NEVER runs 'git push'. Loki does not access your"
+                echo "cloud account. You run the printed command. Detection is read-only."
+                echo ""
+                echo "If a CI/CD pipeline (GitHub Actions, GitLab CI, Jenkins, CircleCI,"
+                echo "Azure Pipelines, Bitbucket) is detected, the primary advice is the"
+                echo "git push + pull-request path, because your pipeline deploys on merge."
+                echo ""
+                echo "Options:"
+                echo "  --dir <path>   Project directory to scan (default: current dir)"
+                echo "  --no-clip      Do not copy the idiomatic command to the clipboard"
+                echo "  --help, -h     Show this help and exit"
+                return 0
+                ;;
+            --dir)
+                dir="${2:-.}"
+                # Guard the value-consuming shift: if --dir is the LAST arg (no
+                # value), an unguarded shift plus the loop's trailing shift would
+                # underflow and abort under set -e. Consume a value only if present.
+                [ $# -ge 2 ] && shift
+                ;;
+            --no-clip)
+                do_clip=false
+                ;;
+        esac
+        shift
+    done
+
+    # Resolve to '.' if the chosen dir does not exist (honest, no crash).
+    [ -d "$dir" ] || dir="."
+
+    # Detect CI/CD pipeline FIRST (BRANCH-LIFECYCLE LOCK B3 precedence).
+    local cicd=""
+    cicd="$(_deploy_detect_cicd "$dir" || true)"
+    local has_pipeline=false
+    [ -n "$cicd" ] && has_pipeline=true
+
+    # Detect project type (filesystem-only; LOCK 6 -- not gated on a running app).
+    local type=""
+    type="$(_deploy_detect_type "$dir")"
+
+    # ---- Pipeline path (LOCK B3): git push + PR advised FIRST, cloud secondary.
+    if [ "$has_pipeline" = true ]; then
+        echo -e "${BOLD}CI/CD pipeline detected (${cicd})${NC}"
+        echo "Your pipeline deploys on push/merge, so the primary deploy path is"
+        echo "commit + push + pull request:"
+        echo ""
+
+        # Derive base/head for the PR advice. set -e safe: every git call is
+        # 2>/dev/null with a fallback so a non-zero git never aborts the shell.
+        local head="" base=""
+        head="$(git -C "$dir" rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")"
+        [ -n "$head" ] || head="HEAD"
+        case "$head" in
+            loki/*)
+                # On a loki branch: prefer the persisted base, else origin default.
+                if [ -s "$dir/.loki/state/base-branch.txt" ]; then
+                    base="$(head -n1 "$dir/.loki/state/base-branch.txt" 2>/dev/null || echo "")"
+                fi
+                ;;
+        esac
+        if [ -z "$base" ]; then
+            # Best-effort: origin's default branch (e.g. origin/main -> main).
+            local origin_head=""
+            origin_head="$(git -C "$dir" symbolic-ref refs/remotes/origin/HEAD 2>/dev/null || echo "")"
+            if [ -n "$origin_head" ]; then
+                base="${origin_head##*/}"
+            fi
+        fi
+
+        if [ -n "$base" ] && declare -F print_pr_advice >/dev/null 2>&1; then
+            print_pr_advice "$base" "$head" "$dir"
+        elif declare -F print_pr_advice >/dev/null 2>&1; then
+            echo "  Could not determine the PR base branch automatically."
+            echo "  Set your PR base manually when opening the pull request for: ${head}"
+            print_pr_advice "manually-set-base" "$head" "$dir"
+        else
+            echo "  git push -u origin ${head}"
+            echo "  Open a pull request for ${head} (set the base branch manually)."
+        fi
+        echo ""
+
+        # Cloud CLI options are SECONDARY when a pipeline exists. Print them if a
+        # project type + installed CLI match, but never fail the command on their
+        # absence (the git/PR advice above is the real deliverable here).
+        if [ -n "$type" ]; then
+            # Pass do_clip=false here: in the pipeline path the git push line is
+            # the PRIMARY advice (LOCK B3) and print_pr_advice already copied it to
+            # the clipboard, so the secondary cloud command must NOT overwrite it.
+            local printed_any=false
+            _deploy_print_cloud_options "$dir" "$type" "false" "false" && printed_any=true || true
+            if [ "$printed_any" != true ]; then
+                : # No installed cloud CLI; the pipeline path already advised. Fine.
+            fi
+        fi
+        return 0
+    fi
+
+    # ---- No-pipeline path: cloud-CLI advisory exactly per DEPLOY-PLAN.md.
+    # Honest failure: no project type detected.
+    if [ -z "$type" ]; then
+        {
+            echo "No deployable project detected in: ${dir}"
+            echo "Looked for: package.json (Next.js/Vite/CRA/Node), Dockerfile,"
+            echo "dist/ or build/ with index.html, requirements.txt, pyproject.toml."
+            echo "Run 'loki deploy --dir <path>' to point at your project directory."
+        } >&2
+        return 1
+    fi
+
+    # Print cloud options; clipboard the idiomatic one. Returns non-zero (with an
+    # honest install hint) when NO matching CLI is installed.
+    local rc=0
+    _deploy_print_cloud_options "$dir" "$type" "$do_clip" "true" || rc=$?
+    return $rc
+}
+
 # Import GitHub issues
 cmd_import() {
     # v7.6.2 B-13 fix: --help must print help, not start an import.
@@ -6996,10 +7396,10 @@ cmd_watch() {
                 return 0
                 ;;
             --once) run_once=true; shift ;;
-            --interval) poll_interval="${2:-2}"; shift 2 ;;
+            --interval) poll_interval="${2:-2}"; [ $# -ge 2 ] && shift 2 || shift ;;
             --interval=*) poll_interval="${1#*=}"; shift ;;
             --no-auto-start) no_auto_start=true; shift ;;
-            --debounce) debounce="${2:-3}"; shift 2 ;;
+            --debounce) debounce="${2:-3}"; [ $# -ge 2 ] && shift 2 || shift ;;
             --debounce=*) debounce="${1#*=}"; shift ;;
             -*)
                 echo -e "${RED}Unknown option: $1${NC}"
@@ -14966,6 +15366,9 @@ main() {
         preview)
             cmd_preview "$@"
             ;;
+        deploy)
+            cmd_deploy "$@"
+            ;;
         open)
             # CLI consolidation (Phase A): 'open' is a deprecated alias of 'preview'.
             _deprecated_alias open preview "$@"
@@ -19474,11 +19877,11 @@ else:
                 case "$1" in
                     --name|-n)
                         name="${2:-}"
-                        shift 2
+                        if [ $# -ge 2 ]; then shift 2; else shift; fi
                         ;;
                     --alias|-a)
                         alias="${2:-}"
-                        shift 2
+                        if [ $# -ge 2 ]; then shift 2; else shift; fi
                         ;;
                     *)
                         shift
@@ -19494,10 +19897,21 @@ else:
                 exit 1
             fi
 
-            _REGISTRY_FILE="$registry_file" _PROJ_PATH="$path" _PROJ_NAME="$name" _PROJ_ALIAS="$alias" python3 -c "
+            # Route the read-modify-write through dashboard/registry.py so the
+            # mutation is serialized under its fcntl lock and written atomically
+            # (tempfile + os.replace), matching the v7.45.1 hardening that
+            # run.sh registration and mark_project_stopped already use. The
+            # inline open(...,'w') path here was unlocked and truncating, which
+            # could lose a concurrent writer's entry or expose a 0-byte file to
+            # a reader. Falls back to an atomic temp-file write if registry.py
+            # cannot be imported at runtime (never a bare truncating open).
+            _REGISTRY_FILE="$registry_file" _PROJ_PATH="$path" _PROJ_NAME="$name" _PROJ_ALIAS="$alias" \
+            _REGISTRY_SKILL="${SKILL_DIR:-$_LOKI_SCRIPT_DIR/..}" python3 -c "
 import json
 import os
+import sys
 import hashlib
+import tempfile
 from datetime import datetime, timezone
 
 registry_file = os.environ['_REGISTRY_FILE']
@@ -19505,41 +19919,62 @@ path = os.environ['_PROJ_PATH']
 name = os.environ['_PROJ_NAME'] or os.path.basename(path)
 alias = os.environ['_PROJ_ALIAS'] or None
 
-# Generate project ID
-project_id = hashlib.md5(path.encode()).hexdigest()[:12]
-
-# Load registry
-with open(registry_file, 'r') as f:
-    data = json.load(f)
+sys.path.insert(0, os.environ.get('_REGISTRY_SKILL', '.'))
+try:
+    from dashboard import registry
+except Exception:
+    registry = None
 
-projects = data.get('projects', {})
-now = datetime.now(timezone.utc).isoformat()
-
-if project_id in projects:
-    # Update existing
-    projects[project_id]['name'] = name
-    if alias:
-        projects[project_id]['alias'] = alias
-    projects[project_id]['updated_at'] = now
-    print(f'Updated: {name}')
+if registry is not None:
+    existing = registry.get_project(path)
+    project = registry.register_project(path, name, alias)
+    print('Updated: ' + name if existing else 'Registered: ' + name)
 else:
-    # Add new
-    projects[project_id] = {
-        'id': project_id,
-        'path': path,
-        'name': name,
-        'alias': alias,
-        'registered_at': now,
-        'updated_at': now,
-        'last_accessed': None,
-        'has_loki_dir': os.path.isdir(os.path.join(path, '.loki')),
-        'status': 'active',
-    }
-    print(f'Registered: {name}')
-
-data['projects'] = projects
-with open(registry_file, 'w') as f:
-    json.dump(data, f, indent=2)
+    # Fallback: atomic temp-file write (no truncating open) if registry.py
+    # is unavailable. Mirrors register_project semantics (sha256 id).
+    project_id = hashlib.sha256(path.encode()).hexdigest()[:12]
+    try:
+        with open(registry_file, 'r') as f:
+            data = json.load(f)
+    except (OSError, json.JSONDecodeError):
+        data = {'version': '1.0', 'projects': {}}
+    projects = data.get('projects', {})
+    now = datetime.now(timezone.utc).isoformat()
+    if project_id in projects:
+        projects[project_id]['name'] = name
+        if alias:
+            projects[project_id]['alias'] = alias
+        projects[project_id]['updated_at'] = now
+        print(f'Updated: {name}')
+    else:
+        projects[project_id] = {
+            'id': project_id,
+            'path': path,
+            'name': name,
+            'alias': alias,
+            'registered_at': now,
+            'updated_at': now,
+            'last_accessed': None,
+            'has_loki_dir': os.path.isdir(os.path.join(path, '.loki')),
+            'status': 'active',
+        }
+        print(f'Registered: {name}')
+    data['projects'] = projects
+    reg_dir = os.path.dirname(registry_file) or '.'
+    os.makedirs(reg_dir, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(dir=reg_dir, prefix='.projects.', suffix='.tmp')
+    try:
+        with os.fdopen(fd, 'w') as f:
+            json.dump(data, f, indent=2)
+            f.flush()
+            os.fsync(f.fileno())
+        os.replace(tmp, registry_file)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
 
 print(f'  Path: {path}')
 if alias:
@@ -19555,34 +19990,69 @@ if alias:
                 exit 1
             fi
 
-            _REGISTRY_FILE="$registry_file" _IDENTIFIER="$identifier" python3 -c "
+            # Route through registry.unregister_project so the delete is
+            # serialized + atomic. Look the name up first to preserve the
+            # "Removed: {name}" output. Falls back to an atomic temp-file write
+            # if registry.py cannot be imported (never a truncating open).
+            _REGISTRY_FILE="$registry_file" _IDENTIFIER="$identifier" \
+            _REGISTRY_SKILL="${SKILL_DIR:-$_LOKI_SCRIPT_DIR/..}" python3 -c "
 import json
 import os
+import sys
+import tempfile
 
 registry_file = os.environ['_REGISTRY_FILE']
 identifier = os.environ['_IDENTIFIER']
 
-with open(registry_file, 'r') as f:
-    data = json.load(f)
-
-projects = data.get('projects', {})
-found_id = None
-
-for pid, project in projects.items():
-    if pid == identifier or project['path'] == identifier or project.get('alias') == identifier:
-        found_id = pid
-        break
+sys.path.insert(0, os.environ.get('_REGISTRY_SKILL', '.'))
+try:
+    from dashboard import registry
+except Exception:
+    registry = None
 
-if found_id:
-    name = projects[found_id]['name']
-    del projects[found_id]
-    data['projects'] = projects
-    with open(registry_file, 'w') as f:
-        json.dump(data, f, indent=2)
-    print(f'Removed: {name}')
+if registry is not None:
+    existing = registry.get_project(identifier)
+    if existing and registry.unregister_project(identifier):
+        print('Removed: ' + existing['name'])
+    else:
+        print(f'Not found: {identifier}')
+        sys.exit(1)
 else:
-    print(f'Not found: {identifier}')
-    exit(1)
+    # Fallback: atomic temp-file write if registry.py is unavailable.
+    try:
+        with open(registry_file, 'r') as f:
+            data = json.load(f)
+    except (OSError, json.JSONDecodeError):
+        data = {'version': '1.0', 'projects': {}}
+    projects = data.get('projects', {})
+    found_id = None
+    for pid, project in projects.items():
+        if pid == identifier or project['path'] == identifier or project.get('alias') == identifier:
+            found_id = pid
+            break
+    if found_id:
+        name = projects[found_id]['name']
+        del projects[found_id]
+        data['projects'] = projects
+        reg_dir = os.path.dirname(registry_file) or '.'
+        os.makedirs(reg_dir, exist_ok=True)
+        fd, tmp = tempfile.mkstemp(dir=reg_dir, prefix='.projects.', suffix='.tmp')
+        try:
+            with os.fdopen(fd, 'w') as f:
+                json.dump(data, f, indent=2)
+                f.flush()
+                os.fsync(f.fileno())
+            os.replace(tmp, registry_file)
+        except BaseException:
+            try:
+                os.unlink(tmp)
+            except OSError:
+                pass
+            raise
+        print(f'Removed: {name}')
+    else:
+        print(f'Not found: {identifier}')
+        sys.exit(1)
 "
             ;;
 
@@ -19648,87 +20118,119 @@ else:
             echo -e "${BOLD}Syncing Project Registry${NC}"
             echo ""
 
-            python3 -c "
+            # Route through registry.sync_registry_with_discovery so the
+            # discover->merge->save is serialized + atomic and uses the same
+            # sha256 ids as the rest of the registry. Reproduce the prior
+            # stdout (per-project "Added:" lines + summary) from its return
+            # value. Falls back to an atomic temp-file write if registry.py
+            # cannot be imported (never a truncating open).
+            _REGISTRY_FILE="$registry_file" \
+            _REGISTRY_SKILL="${SKILL_DIR:-$_LOKI_SCRIPT_DIR/..}" python3 -c "
 import json
 import os
+import sys
 import hashlib
+import tempfile
 from pathlib import Path
 from datetime import datetime, timezone
 
-registry_file = '$registry_file'
-home = Path.home()
-
-# Load registry
-with open(registry_file, 'r') as f:
-    data = json.load(f)
-projects = data.get('projects', {})
-
-# Discover projects
-search_paths = [
-    home / 'git',
-    home / 'projects',
-    home / 'code',
-    home / 'dev',
-    home / 'workspace',
-    home / 'src',
-]
+registry_file = os.environ['_REGISTRY_FILE']
 
-discovered = []
+sys.path.insert(0, os.environ.get('_REGISTRY_SKILL', '.'))
+try:
+    from dashboard import registry
+except Exception:
+    registry = None
 
-def search_dir(path, depth=0, max_depth=3):
-    if depth > max_depth:
-        return
+if registry is not None:
+    result = registry.sync_registry_with_discovery()
+    for project in result['details']['added']:
+        print(f\"  Added: {project['name']}\")
+    print('')
+    print(f\"Added: {result['added']}, Missing: {result['missing']}, Total: {result['total']}\")
+else:
+    # Fallback: atomic temp-file write if registry.py is unavailable.
+    home = Path.home()
     try:
-        if not path.is_dir():
-            return
-        loki_dir = path / '.loki'
-        if loki_dir.is_dir():
-            discovered.append(str(path))
-            return
-        for child in path.iterdir():
-            if child.is_dir() and not child.name.startswith('.'):
-                search_dir(child, depth + 1, max_depth)
-    except (PermissionError, OSError):
-        pass
-
-for search_path in search_paths:
-    if search_path.exists():
-        search_dir(search_path)
+        with open(registry_file, 'r') as f:
+            data = json.load(f)
+    except (OSError, json.JSONDecodeError):
+        data = {'version': '1.0', 'projects': {}}
+    projects = data.get('projects', {})
+    search_paths = [
+        home / 'git',
+        home / 'projects',
+        home / 'code',
+        home / 'dev',
+        home / 'workspace',
+        home / 'src',
+    ]
+    discovered = []
 
-# Add new projects
-added = 0
-now = datetime.now(timezone.utc).isoformat()
+    def search_dir(path, depth=0, max_depth=3):
+        if depth > max_depth:
+            return
+        try:
+            if not path.is_dir():
+                return
+            loki_dir = path / '.loki'
+            if loki_dir.is_dir():
+                discovered.append(str(path))
+                return
+            for child in path.iterdir():
+                if child.is_dir() and not child.name.startswith('.'):
+                    search_dir(child, depth + 1, max_depth)
+        except (PermissionError, OSError):
+            pass
 
-for path in discovered:
-    project_id = hashlib.md5(path.encode()).hexdigest()[:12]
-    if project_id not in projects:
-        projects[project_id] = {
-            'id': project_id,
-            'path': path,
-            'name': os.path.basename(path),
-            'alias': None,
-            'registered_at': now,
-            'updated_at': now,
-            'last_accessed': None,
-            'has_loki_dir': True,
-            'status': 'active',
-        }
-        added += 1
-        print(f'  Added: {os.path.basename(path)}')
+    for search_path in search_paths:
+        if search_path.exists():
+            search_dir(search_path)
+
+    added = 0
+    now = datetime.now(timezone.utc).isoformat()
+    for path in discovered:
+        project_id = hashlib.sha256(path.encode()).hexdigest()[:12]
+        if project_id not in projects:
+            projects[project_id] = {
+                'id': project_id,
+                'path': path,
+                'name': os.path.basename(path),
+                'alias': None,
+                'registered_at': now,
+                'updated_at': now,
+                'last_accessed': None,
+                'has_loki_dir': True,
+                'status': 'active',
+            }
+            added += 1
+            print(f'  Added: {os.path.basename(path)}')
 
-# Check for missing
-missing = 0
-for pid, project in list(projects.items()):
-    if not os.path.isdir(project['path']):
-        project['status'] = 'missing'
-        missing += 1
+    missing = 0
+    for pid, project in list(projects.items()):
+        if not os.path.isdir(project['path']):
+            project['status'] = 'missing'
+            missing += 1
 
-data['projects'] = projects
-with open(registry_file, 'w') as f:
-    json.dump(data, f, indent=2)
+    data['projects'] = projects
+    reg_dir = os.path.dirname(registry_file) or '.'
+    os.makedirs(reg_dir, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(dir=reg_dir, prefix='.projects.', suffix='.tmp')
+    try:
+        with os.fdopen(fd, 'w') as f:
+            json.dump(data, f, indent=2)
+            f.flush()
+            os.fsync(f.fileno())
+        os.replace(tmp, registry_file)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
 
-print('')
-print(f'Added: {added}, Missing: {missing}, Total: {len(projects)}')
+    print('')
+    print(f'Added: {added}, Missing: {missing}, Total: {len(projects)}')
 " 2>/dev/null
             ;;
 
@@ -22143,11 +22645,18 @@ _context_add() {
         local loki_dir="${LOKI_DIR:-.loki}"
         mkdir -p "$loki_dir/state"
         local ctx_files="$loki_dir/state/context-files.json"
-        python3 -c "
+        # Pass values via env vars (not string interpolation) so a filename
+        # with an apostrophe or other special char cannot break the python
+        # source (was a swallowed SyntaxError -> set -e abort -> file silently
+        # not added). Matches the safe pattern used by the registry commands.
+        _CTX_PATH="$file_path" _CTX_TOKENS="$est_tokens" _CTX_SIZE="$size" \
+        _CTX_LINES="$lines" _CTX_FILE="$ctx_files" python3 -c "
 import json, os
-path = '$file_path'
-tokens = $est_tokens
-ctx_file = '$ctx_files'
+path = os.environ['_CTX_PATH']
+tokens = int(os.environ['_CTX_TOKENS'])
+ctx_file = os.environ['_CTX_FILE']
+size = int(os.environ['_CTX_SIZE'])
+lines = int(os.environ['_CTX_LINES'])
 try:
     with open(ctx_file) as f:
         files = json.load(f)
@@ -22155,7 +22664,7 @@ except:
     files = []
 # Avoid duplicates
 files = [f for f in files if f.get('path') != path]
-files.append({'path': path, 'estimated_tokens': tokens, 'size': $size, 'lines': $lines})
+files.append({'path': path, 'estimated_tokens': tokens, 'size': size, 'lines': lines})
 with open(ctx_file, 'w') as f:
     json.dump(files, f, indent=2)
 " 2>/dev/null
@@ -29350,7 +29859,7 @@ cmd_docker() {
     local -a fwd=()
     while [ $# -gt 0 ]; do
         case "$1" in
-            --image) shift; export LOKI_DOCKER_IMAGE="${1:-}"; shift ;;
+            --image) [ $# -ge 2 ] && { shift; export LOKI_DOCKER_IMAGE="$1"; } || { echo "loki docker --image requires a value" >&2; return 1; }; shift ;;
             --dry-run) dry_run=1; shift ;;
             --api) with_api=1; fwd+=("$1"); shift ;;
             *) fwd+=("$1"); shift ;;