loki-mode 7.80.0 → 7.81.0

package/README.md

@@ -279,7 +279,9 @@ Real-time monitoring, agent status, task queue, WebSocket streaming, and Live Ap
 <td width="33%" valign="top">
 
 ### Enterprise Layer
-TLS, OIDC/SSO, RBAC, OTEL tracing, policy engine, audit trails. Activated via env vars.
+TLS, OIDC bearer-token validation (the foundation for SSO; browser SAML login is
+roadmap), scoped RBAC, OTEL tracing, policy engine, audit trails. Activated via
+env vars. See [Enterprise Identity Roadmap](docs/ENTERPRISE-IDENTITY-ROADMAP.md).
 
 [Enterprise Guide](docs/enterprise/architecture.md)
 
@@ -305,7 +307,7 @@ The historical feature set (platform pages, Monaco IDE workspace, AI chat panel)
 | 5 AI provider failover | Yes | No | No | No |
 | 8 quality gates | Yes | No | No | No |
 | Blind code review | Yes | No | No | No |
-| Enterprise auth (SSO/RBAC) | Yes | No | Yes | No |
+| Enterprise auth (OIDC token + scoped RBAC) | Yes | No | Yes | No |
 | Air-gapped deployment | Yes | No | No | No |
 | Docker + CI/CD generation | Yes | No | Yes | No |
 | Source-available (BUSL-1.1) | Yes | No | No | No |

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.80.0
+# Loki Mode v7.81.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -406,4 +406,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.80.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.81.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.80.0
+7.81.0

package/autonomy/lib/checkpoint_sync.py

@@ -11,9 +11,18 @@ Honest scope
 ------------
 - This syncs the lightweight checkpoint state (.loki/state/checkpoints/**) to the
   configured object store, and hydrates it back on a durable resume when the
-  local volume came up empty. It does NOT sync the git refs/loki/cp/* worktree
-  snapshots (those live in .git, not .loki, and are out of LokiStore's root);
-  the checkpoint metadata + .loki snapshot are what this transfers.
+  local volume came up empty.
+- It ALSO syncs the git refs/loki/cp/* worktree snapshots (the working-tree
+  state captured by `git stash create` and anchored under refs/loki/cp/<id>).
+  Those commits live in .git (outside LokiStore's .loki root), so they cannot be
+  copied as plain objects; instead, for each checkpoint that carries a
+  worktree-snapshot.txt SHA we export a `git bundle` of that commit to the store
+  (key runs/<run-id>/worktree-bundles/<checkpoint-id>.bundle) and, on hydrate,
+  `git fetch` it back and re-create the ref. This makes a fresh-node resume able
+  to restore the full working tree, not just the .loki metadata. Best-effort and
+  gated on git being present; a repo without git or without snapshots simply
+  skips this part. Honest remaining limit: snapshots capture TRACKED changes only
+  (the same limit as create_checkpoint's `git stash create`).
 - All operations are best-effort. A sync/hydrate error never raises to the
   caller's control flow (run.sh treats a nonzero exit as "skip, continue").
   The bash side logs and continues a build on any failure.
@@ -40,7 +49,9 @@ Exit codes: 0 on success (including "nothing to do"); nonzero on any error
 from __future__ import annotations
 
 import os
+import subprocess
 import sys
+import tempfile
 
 # Local-first guard: this shim is only meaningful for a non-local backend. If the
 # backend is local/unset, do nothing (run.sh should not even call us, but be
@@ -49,6 +60,61 @@ _BACKEND = (os.environ.get("LOKI_STORAGE_BACKEND") or "local").strip().lower()
 
 # The subtree of the .loki/ store that holds checkpoint state.
 _CHECKPOINT_PREFIX = "state/checkpoints/"
+# Object-store subkey holding the git-bundle exports of refs/loki/cp/* snapshots.
+_BUNDLE_SUBKEY = "worktree-bundles/"
+
+
+def _project_dir() -> str:
+    """The project working directory (git repo root containing .loki/)."""
+    loki_dir = os.environ.get("LOKI_DIR") or os.path.join(
+        os.environ.get("TARGET_DIR", "."), ".loki"
+    )
+    # .loki lives at <project>/.loki, so the project dir is its parent.
+    return os.path.dirname(os.path.abspath(loki_dir))
+
+
+def _git(args, cwd, capture=True):
+    """Run a git command best-effort; return (rc, stdout). Never raises."""
+    try:
+        proc = subprocess.run(
+            ["git", *args],
+            cwd=cwd,
+            stdout=subprocess.PIPE if capture else subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            text=True,
+            check=False,
+        )
+        return proc.returncode, (proc.stdout or "").strip()
+    except (OSError, ValueError):
+        return 1, ""
+
+
+def _have_git_repo(project_dir) -> bool:
+    if not project_dir or not os.path.isdir(project_dir):
+        return False
+    rc, _ = _git(["rev-parse", "--is-inside-work-tree"], project_dir)
+    return rc == 0
+
+
+def _iter_checkpoint_snapshots(local):
+    """Yield (checkpoint_id, snapshot_sha) for every worktree-snapshot.txt found
+    in the local checkpoint store. checkpoint_id is the directory name under
+    state/checkpoints/ that owns the snapshot."""
+    for subkey in local.list(_CHECKPOINT_PREFIX):
+        # subkey like state/checkpoints/<cp-id>/worktree-snapshot.txt
+        if not subkey.endswith("/worktree-snapshot.txt"):
+            continue
+        parts = subkey.split("/")
+        # .../checkpoints/<cp-id>/worktree-snapshot.txt -> cp-id is parts[-2]
+        if len(parts) < 2:
+            continue
+        cp_id = parts[-2]
+        try:
+            sha = local.get(subkey).decode("utf-8", "replace").strip()
+        except Exception:
+            continue
+        if sha:
+            yield cp_id, sha
 
 
 def _resolve_run_id() -> str:
@@ -122,9 +188,64 @@ def cmd_sync() -> int:
         f"[checkpoint-sync] pushed {count} checkpoint object(s) to "
         f"{_BACKEND} under runs/{run_id}/\n"
     )
+
+    # Also export the git refs/loki/cp/* worktree snapshots as bundles (V2).
+    bundles = _sync_worktree_bundles(local, remote, run_id)
+    if bundles:
+        sys.stderr.write(
+            f"[checkpoint-sync] pushed {bundles} worktree snapshot bundle(s)\n"
+        )
     return 0
 
 
+def _sync_worktree_bundles(local, remote, run_id) -> int:
+    """For each checkpoint snapshot SHA, `git bundle` the commit and store it.
+    Best-effort; returns the count pushed. Skips silently without git/snapshots."""
+    project_dir = _project_dir()
+    if not _have_git_repo(project_dir):
+        return 0
+    pushed = 0
+    for cp_id, sha in _iter_checkpoint_snapshots(local):
+        # Symmetric with hydrate: never bundle/store an unsafe cp_id ref name.
+        if not _safe_cp_id(cp_id):
+            sys.stderr.write(f"[checkpoint-sync] skipped unsafe snapshot id: {cp_id}\n")
+            continue
+        # Verify the commit still exists locally before bundling.
+        rc, _ = _git(["cat-file", "-e", f"{sha}^{{commit}}"], project_dir)
+        if rc != 0:
+            continue
+        tmp_fd, tmp_path = tempfile.mkstemp(suffix=".bundle")
+        os.close(tmp_fd)
+        try:
+            # `git bundle create` needs a REF-style argument; a bare SHA (or a
+            # single-rev `sha`/`sha~0..sha`) makes git refuse with "empty bundle"
+            # because there is no ref to anchor. The snapshot is already anchored
+            # at refs/loki/cp/<cp_id> by create_checkpoint, so bundle THAT ref.
+            # The bundle is self-contained for the snapshot commit + its history.
+            rc, _ = _git(
+                ["bundle", "create", tmp_path, f"refs/loki/cp/{cp_id}"],
+                project_dir,
+                capture=False,
+            )
+            if rc != 0 or not os.path.exists(tmp_path) or os.path.getsize(tmp_path) == 0:
+                continue
+            with open(tmp_path, "rb") as f:
+                data = f.read()
+            remote.put(_run_key(run_id, f"{_BUNDLE_SUBKEY}{cp_id}.bundle"), data)
+            # Persist the SHA alongside so hydrate can re-create the exact ref.
+            remote.put(
+                _run_key(run_id, f"{_BUNDLE_SUBKEY}{cp_id}.sha"),
+                (sha + "\n").encode("utf-8"),
+            )
+            pushed += 1
+        finally:
+            try:
+                os.unlink(tmp_path)
+            except OSError:
+                pass
+    return pushed
+
+
 def cmd_hydrate() -> int:
     """
     Pull checkpoint state from the object store into the local volume, but ONLY
@@ -169,9 +290,95 @@ def cmd_hydrate() -> int:
         f"[checkpoint-sync] hydrated {count} checkpoint object(s) from "
         f"{_BACKEND} for runs/{run_id}/\n"
     )
+
+    # Restore git refs/loki/cp/* worktree snapshots from their bundles (V2).
+    restored = _hydrate_worktree_bundles(remote, run_id)
+    if restored:
+        sys.stderr.write(
+            f"[checkpoint-sync] restored {restored} worktree snapshot ref(s)\n"
+        )
     return 0
 
 
+def _hydrate_worktree_bundles(remote, run_id) -> int:
+    """Fetch each stored worktree bundle and re-create refs/loki/cp/<id>.
+    Best-effort; returns the count restored. No-op without git or bundles."""
+    project_dir = _project_dir()
+    if not _have_git_repo(project_dir):
+        return 0
+    bundle_prefix = _run_key(run_id, _BUNDLE_SUBKEY)
+    try:
+        remote_keys = remote.list(bundle_prefix)
+    except Exception:
+        return 0
+    restored = 0
+    for rk in remote_keys:
+        if not rk.endswith(".bundle"):
+            continue
+        cp_id = rk.rsplit("/", 1)[-1][: -len(".bundle")]
+        # Guard cp_id against ref-injection (the bundle key comes from the store).
+        if not _safe_cp_id(cp_id):
+            sys.stderr.write(f"[checkpoint-sync] skipped unsafe bundle id: {cp_id}\n")
+            continue
+        # Recover the snapshot SHA (stored sidecar) so we re-create the exact ref.
+        sha = ""
+        try:
+            sha = remote.get(_run_key(run_id, f"{_BUNDLE_SUBKEY}{cp_id}.sha")).decode(
+                "utf-8", "replace"
+            ).strip()
+        except Exception:
+            sha = ""
+        if not sha or any(c not in "0123456789abcdef" for c in sha.lower()):
+            continue
+        tmp_fd, tmp_path = tempfile.mkstemp(suffix=".bundle")
+        os.close(tmp_fd)
+        try:
+            remote.get_to(rk, tmp_path)
+            # Fetch the commit objects out of the bundle into this repo.
+            rc, _ = _git(["fetch", tmp_path, sha], project_dir, capture=False)
+            if rc != 0:
+                continue
+            # Re-create the anchored ref so `git gc` cannot prune it and a resume
+            # can find the snapshot exactly as create_checkpoint left it.
+            rc, _ = _git(
+                ["update-ref", f"refs/loki/cp/{cp_id}", sha], project_dir, capture=False
+            )
+            if rc == 0:
+                restored += 1
+        finally:
+            try:
+                os.unlink(tmp_path)
+            except OSError:
+                pass
+    return restored
+
+
+# Safe characters for a checkpoint id used in a git ref path (defense vs
+# ref-injection from a crafted object-store key). Checkpoint ids are of the form
+# cp-<iter>-<epoch>. We do NOT rely on git's own ref-name validation as the only
+# backstop (defense-in-depth): reject the git-special forms too.
+_SAFE_CP_CHARS = set(
+    "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_."
+)
+
+
+def _safe_cp_id(cp_id: str) -> bool:
+    """True iff cp_id is safe to interpolate into refs/loki/cp/<cp_id>.
+
+    Char-allowlist PLUS explicit rejection of git-special ref forms that the
+    allowlist would otherwise permit ('.', '..', a trailing dot, a '.lock'
+    suffix, 'HEAD', '@'). Not exploitable today (cp ids are locally minted), but
+    this must not depend on git's validation when the id can come from a store key.
+    """
+    if not cp_id or any(c not in _SAFE_CP_CHARS for c in cp_id):
+        return False
+    if cp_id in (".", "..", "HEAD", "@"):
+        return False
+    if cp_id.endswith(".") or cp_id.endswith(".lock"):
+        return False
+    return True
+
+
 def main(argv) -> int:
     if len(argv) < 2 or argv[1] not in ("sync", "hydrate"):
         sys.stderr.write("usage: checkpoint_sync.py {sync|hydrate}\n")

package/autonomy/loki

@@ -1501,6 +1501,17 @@ cmd_start() {
             --config=*|--vars=*|--env-file=*)
                 shift
                 ;;
+            --)
+                # End-of-options: everything after is positional. Lets a caller
+                # pass an untrusted spec that might start with '-' safely, e.g.
+                # `loki start -- "$spec"` from the queue consumer, so a crafted
+                # work item can never be parsed as a flag.
+                shift
+                if [ -z "$positional_arg" ] && [ "$#" -ge 1 ]; then
+                    positional_arg="$1"
+                fi
+                break
+                ;;
             -*)
                 echo -e "${RED}Unknown option: $1${NC}"
                 exit 1
@@ -29729,8 +29740,16 @@ PYEOF
 cmd_bench() {
     local bench_sh="$SKILL_DIR/benchmarks/bench/run.sh"
     if [ ! -f "$bench_sh" ]; then
-        log_error "benchmark harness not found: $bench_sh"
-        return 1
+        # The benchmarks/ harness (~8MB, mostly historical result dumps) is a
+        # dev/research feature deliberately omitted from the published package
+        # (.npmignore excludes benchmarks/). On a packaged install it is absent,
+        # so degrade honestly instead of a bare "not found" that reads like a
+        # broken install. Run it from a loki-mode source checkout.
+        echo "loki bench: the benchmark harness is not available in this install." >&2
+        echo "It is a development/research feature shipped only in the loki-mode source" >&2
+        echo "repository, not the published package. Clone the repo and run:" >&2
+        echo "  ./benchmarks/run-benchmarks.sh humaneval --execute --loki" >&2
+        return 0
     fi
     local sub="${1:-}"
     case "$sub" in

package/autonomy/queue-consumer.sh

@@ -0,0 +1,346 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2155  # Declare and assign separately (acceptable in this codebase)
+#===============================================================================
+# Loki Mode - Reference Queue Consumer
+#
+# A pluggable reference queue-consumer entrypoint for the Helm worker modes:
+#
+#   deployment -- long-running consumer. Loops forever, pulling one work item at
+#                 a time, running `loki start <spec>`, and acking on success.
+#   serverless -- one-shot consumer (LOKI_QUEUE_ONESHOT=1). Pulls EXACTLY one
+#                 item, runs it, exits with that build's exit code. Intended for
+#                 a KEDA ScaledJob that creates one Job per queued item.
+#
+# A "work item" is a Loki spec ref accepted by `loki start`: a path/brief, a
+# GitHub issue ref (owner/repo#N), or a JSON object {"spec": "..."} (the spec
+# field is extracted; any other JSON keys are ignored by this reference consumer).
+#
+# Backends (LOKI_QUEUE_BACKEND):
+#   redis  -- REAL. Default when redis-cli is on PATH. BLPOP/LPOP a Redis list
+#             (LOKI_QUEUE_KEY). At-most-once: a popped item is removed from the
+#             queue before the build runs, so a crashed build does NOT requeue
+#             automatically (this is a reference consumer, not a broker with
+#             visibility timeouts -- see HONESTY below).
+#   file   -- REAL. Always-available fallback for testing / airgapped clusters.
+#             Pops the OLDEST file from LOKI_QUEUE_DIR/pending atomically (mv to
+#             LOKI_QUEUE_DIR/processing), runs it, then moves it to done/ on
+#             success or failed/ on terminal failure.
+#
+# HONESTY (do not overstate this):
+#   - Only redis and file are shipped. SQS, Pub/Sub, RabbitMQ, Kafka, etc. are
+#     BRING-YOUR-OWN: override queue.command in values.yaml with your own
+#     consumer. They are documented, not implemented here.
+#   - The redis backend is at-most-once (LPOP-then-run). It has no visibility
+#     timeout / dead-letter requeue. If a build crashes after the item is popped,
+#     that item is lost from the queue. For at-least-once delivery use the file
+#     backend (a crashed build leaves the item in processing/ for manual
+#     re-drive) or bring a real broker.
+#   - The file backend's atomicity relies on `mv` being atomic within a single
+#     filesystem (true for a normal PVC). Two consumers racing the same pending
+#     dir is safe (mv either wins or fails-and-skips), but is not load-balanced.
+#
+# Robustness:
+#   - SIGTERM-graceful: a TERM/INT received mid-build lets the CURRENT item
+#     finish and ack, then exits cleanly (no half-acked item).
+#   - Bounded empty-poll backoff in loop mode; one-shot returns 0 on empty.
+#   - Never silently crash-loops: every exit path logs a reason.
+#   - set -u safe throughout.
+#
+# Environment:
+#   LOKI_QUEUE_BACKEND   redis | file        (default: redis if redis-cli present, else file)
+#   LOKI_QUEUE_ONESHOT   1 = process one item then exit (serverless); else loop (deployment)
+#   LOKI_QUEUE_KEY       redis list key      (default: loki-builds)
+#   LOKI_QUEUE_URL       redis-cli -u URL    (default: $REDIS_URL or redis://127.0.0.1:6379)
+#   LOKI_QUEUE_DIR       file backend root   (default: .loki/queue)
+#   LOKI_QUEUE_POLL_SEC  loop-mode empty-poll wait, seconds (default: 5)
+#   LOKI_QUEUE_BLOCK_SEC redis BLPOP block timeout, seconds (default: 5)
+#   LOKI_TERMINAL_EXIT   run.sh terminal-failure exit code (default: 20)
+#===============================================================================
+
+set -uo pipefail
+
+LOG_PREFIX="[queue-consumer]"
+
+log() { printf '%s %s\n' "$LOG_PREFIX" "$*" >&2; }
+
+# --- configuration with safe defaults -----------------------------------------
+QUEUE_KEY="${LOKI_QUEUE_KEY:-loki-builds}"
+QUEUE_DIR="${LOKI_QUEUE_DIR:-.loki/queue}"
+POLL_SEC="${LOKI_QUEUE_POLL_SEC:-5}"
+BLOCK_SEC="${LOKI_QUEUE_BLOCK_SEC:-5}"
+TERMINAL_EXIT="${LOKI_TERMINAL_EXIT:-20}"
+ONESHOT="${LOKI_QUEUE_ONESHOT:-0}"
+REDIS_URL_DEFAULT="${REDIS_URL:-redis://127.0.0.1:6379}"
+QUEUE_URL="${LOKI_QUEUE_URL:-$REDIS_URL_DEFAULT}"
+
+# Allow the loki binary to be overridden for tests (PATH stub) or vendored paths.
+LOKI_BIN="${LOKI_BIN:-loki}"
+
+# Backend selection: explicit env wins; else redis if redis-cli is present; else file.
+select_backend() {
+    if [ -n "${LOKI_QUEUE_BACKEND:-}" ]; then
+        printf '%s' "$LOKI_QUEUE_BACKEND"
+        return 0
+    fi
+    if command -v redis-cli >/dev/null 2>&1; then
+        printf '%s' "redis"
+    else
+        printf '%s' "file"
+    fi
+}
+
+# --- graceful shutdown --------------------------------------------------------
+# A TERM/INT sets a flag. The loop checks it between items. If it arrives during
+# a build, the build is allowed to finish and ack; only then do we exit. This
+# guarantees no item is left half-processed by our own shutdown.
+STOP_REQUESTED=0
+request_stop() {
+    STOP_REQUESTED=1
+    log "shutdown signal received; will exit after the current item finishes"
+}
+trap request_stop TERM INT
+
+# --- spec extraction ----------------------------------------------------------
+# A work item may be a bare spec ref or a JSON object {"spec": "..."}. Extract
+# the spec string. Bare refs pass through unchanged. JSON is parsed with python3
+# (already a runtime dependency); if python3 is unavailable or parsing fails, the
+# raw item is used as-is (a bare ref is the common case).
+extract_spec() {
+    local item="$1"
+    # Trim leading/trailing whitespace/newlines.
+    item="${item#"${item%%[![:space:]]*}"}"
+    item="${item%"${item##*[![:space:]]}"}"
+    case "$item" in
+        '{'*)
+            if command -v python3 >/dev/null 2>&1; then
+                local parsed
+                parsed="$(printf '%s' "$item" | python3 -c '
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    s = d.get("spec", "") if isinstance(d, dict) else ""
+    sys.stdout.write(str(s))
+except Exception:
+    pass
+' 2>/dev/null)"
+                if [ -n "$parsed" ]; then
+                    printf '%s' "$parsed"
+                    return 0
+                fi
+            fi
+            # Fall through: not parseable, return raw (caller may still reject).
+            printf '%s' "$item"
+            ;;
+        *)
+            printf '%s' "$item"
+            ;;
+    esac
+}
+
+# --- run one build ------------------------------------------------------------
+# Runs `loki start <spec>` for the given spec. Returns the build's exit code.
+# An empty spec is treated as a terminal failure (a queue item with no spec is
+# malformed; we do not silently run a no-spec codebase-analysis off the queue).
+run_build() {
+    local spec="$1"
+    if [ -z "$spec" ]; then
+        log "ERROR: empty spec extracted from work item; treating as terminal failure"
+        return "$TERMINAL_EXIT"
+    fi
+    # Flag-injection guard: a queue item is untrusted (it came off the queue). A
+    # spec that begins with '-' would be parsed by `loki start` as a FLAG, not a
+    # PRD path / issue ref / brief (e.g. an item "--ship" would silently switch
+    # the build into auto-merge-PR mode). A leading-dash item is never a valid
+    # spec, so reject it as malformed rather than letting it steer the build.
+    # (The whole item is already a single argv element -- quoting holds -- so this
+    # is the remaining surface: a single known flag token.)
+    case "$spec" in
+        -*)
+            log "ERROR: work-item spec starts with '-' (would be parsed as a loki flag): $spec -- treating as terminal failure"
+            return "$TERMINAL_EXIT"
+            ;;
+    esac
+    log "starting build: spec=$spec"
+    # End-of-options separator so even a future leading-dash that slips past the
+    # guard cannot be read as a flag (cmd_start gained a `--` handler).
+    "$LOKI_BIN" start -- "$spec"
+    local rc=$?
+    log "build finished: spec=$spec exit=$rc"
+    return "$rc"
+}
+
+# =============================================================================
+# Redis backend
+# =============================================================================
+redis_cli() {
+    redis-cli -u "$QUEUE_URL" "$@"
+}
+
+# Pop one item from the redis list. In loop mode use BLPOP (blocks up to
+# BLOCK_SEC, then returns empty so we can check the stop flag); in one-shot use
+# LPOP (non-blocking, exits immediately on an empty queue).
+# Prints the popped item to stdout, or nothing if the queue was empty.
+redis_pop() {
+    if [ "$ONESHOT" = "1" ]; then
+        redis-cli -u "$QUEUE_URL" --no-raw LPOP "$QUEUE_KEY" 2>/dev/null | _redis_unquote
+    else
+        # BLPOP returns two lines: the key name, then the value. Take the value.
+        redis-cli -u "$QUEUE_URL" BLPOP "$QUEUE_KEY" "$BLOCK_SEC" 2>/dev/null | sed -n '2p'
+    fi
+}
+
+# --no-raw LPOP wraps the value in quotes; strip a single surrounding pair and
+# a literal "(nil)" sentinel. (BLPOP path uses raw output and skips this.)
+_redis_unquote() {
+    local line
+    IFS= read -r line || true
+    [ "$line" = "(nil)" ] && return 0
+    # Strip one leading and trailing double quote if present.
+    line="${line#\"}"
+    line="${line%\"}"
+    printf '%s' "$line"
+}
+
+redis_consume_one() {
+    local item
+    item="$(redis_pop)"
+    if [ -z "$item" ]; then
+        return 100  # sentinel: queue empty
+    fi
+    local spec
+    spec="$(extract_spec "$item")"
+    run_build "$spec"
+    return $?
+}
+
+# =============================================================================
+# File backend
+# =============================================================================
+# Layout under LOKI_QUEUE_DIR:
+#   pending/     work items waiting to be processed (one file each)
+#   processing/  the item currently being processed (atomically mv'd here)
+#   done/        successfully processed items
+#   failed/      terminally-failed items (exit == TERMINAL_EXIT or empty spec)
+file_init_dirs() {
+    mkdir -p "$QUEUE_DIR/pending" "$QUEUE_DIR/processing" "$QUEUE_DIR/done" "$QUEUE_DIR/failed" 2>/dev/null || {
+        log "ERROR: cannot create queue directories under $QUEUE_DIR"
+        return 1
+    }
+}
+
+# Claim the oldest pending file by atomically mv'ing it to processing/. Prints
+# the claimed processing-path on success; prints nothing if pending is empty.
+# The mv is the atomic claim: if a racing consumer grabbed it first, mv fails and
+# we move on to the next candidate.
+file_claim_oldest() {
+    local f base dest
+    # Oldest by mtime. `ls -tr` lists oldest first; restrict to regular files.
+    while IFS= read -r f; do
+        [ -z "$f" ] && continue
+        [ -f "$f" ] || continue
+        base="$(basename "$f")"
+        dest="$QUEUE_DIR/processing/$base"
+        if mv "$f" "$dest" 2>/dev/null; then
+            printf '%s' "$dest"
+            return 0
+        fi
+        # mv failed (another consumer claimed it): try the next candidate.
+    done <<EOF
+$(ls -tr "$QUEUE_DIR/pending" 2>/dev/null | while IFS= read -r n; do printf '%s/pending/%s\n' "$QUEUE_DIR" "$n"; done)
+EOF
+    return 0  # nothing claimed
+}
+
+file_consume_one() {
+    file_init_dirs || return 1
+    local claimed
+    claimed="$(file_claim_oldest)"
+    if [ -z "$claimed" ]; then
+        return 100  # sentinel: queue empty
+    fi
+    local base
+    base="$(basename "$claimed")"
+    local item
+    item="$(cat "$claimed" 2>/dev/null)"
+    local spec
+    spec="$(extract_spec "$item")"
+    run_build "$spec"
+    local rc=$?
+    if [ "$rc" -eq 0 ]; then
+        mv "$claimed" "$QUEUE_DIR/done/$base" 2>/dev/null || log "WARN: could not move $base to done/"
+    elif [ "$rc" -eq "$TERMINAL_EXIT" ]; then
+        mv "$claimed" "$QUEUE_DIR/failed/$base" 2>/dev/null || log "WARN: could not move $base to failed/"
+        log "item $base TERMINAL-FAILED (exit $rc); moved to failed/, not acked"
+    else
+        # Transient crash: leave it in processing/ for manual re-drive. We do NOT
+        # auto-requeue (no retry counter in a flat dir); honest at-least-once.
+        log "item $base crashed (exit $rc); left in processing/ for re-drive"
+    fi
+    return "$rc"
+}
+
+# =============================================================================
+# Driver
+# =============================================================================
+consume_one() {
+    case "$1" in
+        redis) redis_consume_one ;;
+        file)  file_consume_one ;;
+        *)
+            log "ERROR: unknown LOKI_QUEUE_BACKEND='$1' (supported: redis, file)"
+            return 2
+            ;;
+    esac
+}
+
+main() {
+    local backend
+    backend="$(select_backend)"
+
+    # Fail fast on a misconfigured redis backend rather than crash-looping.
+    if [ "$backend" = "redis" ] && ! command -v redis-cli >/dev/null 2>&1; then
+        log "ERROR: LOKI_QUEUE_BACKEND=redis but redis-cli is not on PATH"
+        return 2
+    fi
+    if [ "$backend" != "redis" ] && [ "$backend" != "file" ]; then
+        log "ERROR: unknown LOKI_QUEUE_BACKEND='$backend' (supported: redis, file)"
+        return 2
+    fi
+
+    if [ "$ONESHOT" = "1" ]; then
+        log "mode=oneshot backend=$backend (serverless: process one item then exit)"
+        consume_one "$backend"
+        local rc=$?
+        if [ "$rc" -eq 100 ]; then
+            log "queue empty; nothing to process; exiting 0"
+            return 0
+        fi
+        return "$rc"
+    fi
+
+    log "mode=loop backend=$backend (deployment: process items until SIGTERM)"
+    while [ "$STOP_REQUESTED" -ne 1 ]; do
+        consume_one "$backend"
+        local rc=$?
+        if [ "$rc" -eq 100 ]; then
+            # Empty queue. The redis BLPOP path already blocked; sleep only for
+            # the file backend (it polls). A pending stop check happens at loop
+            # top, so we never sleep through a shutdown longer than one interval.
+            if [ "$backend" = "file" ]; then
+                sleep "$POLL_SEC"
+            fi
+            continue
+        fi
+        if [ "$rc" -eq 2 ]; then
+            # Configuration error: do not hot-loop. Surface and exit non-zero.
+            log "fatal configuration error; exiting"
+            return 2
+        fi
+        # rc is a build result (0 success, TERMINAL_EXIT terminal, other crash).
+        # Build outcomes are normal operation, not consumer errors: keep looping.
+    done
+    log "stopped gracefully after current item; exiting 0"
+    return 0
+}
+
+main "$@"

package/autonomy/sandbox.sh

@@ -1156,6 +1156,33 @@ start_sandbox() {
         log_info "  Seccomp:  enabled"
     fi
 
+    # A5+: workspace-mount allowlist enforcement (opt-in via LOKI_ALLOWED_PATHS).
+    #
+    # The workspace bind-mount below is where provider-driven agent file writes
+    # actually land (the agent writes inside /workspace, which is $PROJECT_DIR on
+    # the host). Unlike the custom --mount surface, this mount was previously
+    # always made writable regardless of LOKI_ALLOWED_PATHS, so an allowlist that
+    # did not include the project dir was silently ignored for the main write
+    # surface.
+    #
+    # When LOKI_ALLOWED_PATHS is set and the workspace itself is OUTSIDE the
+    # allowlist, fail closed: refuse to start rather than bind-mount it writable.
+    # This is genuinely enforceable because docker mount mode (rw vs ro) and which
+    # host paths get bound are decided HERE, before the container exists -- the
+    # kernel enforces the resulting mount, not a wrapper check. We refuse rather
+    # than auto-downgrade to :ro because a read-only workspace cannot be written
+    # by the agent at all and would silently produce a no-op build; refusing makes
+    # the misconfiguration visible. (Allowlisted extra paths are still mounted via
+    # the custom --mount surface above, which also enforces the allowlist.)
+    #
+    # When LOKI_ALLOWED_PATHS is empty (default), _sandbox_path_within_allowed
+    # returns 0 unconditionally, so this is byte-identical to prior behavior.
+    if ! _sandbox_path_within_allowed "$PROJECT_DIR"; then
+        log_error "Workspace is outside LOKI_ALLOWED_PATHS, refusing to mount it writable: $PROJECT_DIR"
+        log_error "  Add the project directory to LOKI_ALLOWED_PATHS, or unset LOKI_ALLOWED_PATHS to disable path enforcement."
+        return 1
+    fi
+
     # Mount project directory
     if [[ "$SANDBOX_READONLY" == "true" ]]; then
         docker_args+=("--volume" "$PROJECT_DIR:/workspace:ro")

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.80.0"
+__version__ = "7.81.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -3316,6 +3316,224 @@ async def stop_running_project(request: Request, body: RunningProjectStopRequest
     }
 
 
+def _recover_spec_source(path: str) -> Optional[_Path]:
+    """Find a re-launchable spec source inside a registry-stored project path.
+
+    Retry re-runs `loki start` from a project's own working directory, so the
+    spec must already live there. This never accepts a caller-supplied path: the
+    project path comes from the registry and only well-known in-tree locations
+    are probed. Returns the first existing spec as an absolute Path, or None when
+    nothing re-launchable is found (the caller then refuses honestly rather than
+    spawning a run that would no-op).
+
+    Probe order (highest fidelity first):
+      1. A hand-authored PRD in the project root or docs/ (PRD.md, prd.md,
+         docs/PRD.md, docs/prd.md) -- the same set check_project_health uses.
+      2. A previously generated PRD (.loki/generated-prd.md / .json) written by
+         a prior no-PRD codebase-analysis run.
+      3. The most recent dashboard inline spec (.loki/specs/*.md) written by the
+         browser PRD-input flow.
+    """
+    if not path:
+        return None
+    try:
+        base = _Path(path)
+    except (TypeError, ValueError):
+        return None
+    if not base.is_dir():
+        return None
+
+    # 1. Hand-authored PRD.
+    for rel in ("PRD.md", "prd.md", "docs/PRD.md", "docs/prd.md"):
+        candidate = base / rel
+        if candidate.is_file():
+            return candidate.resolve()
+
+    loki_dir = base / ".loki"
+
+    # 2. Previously generated PRD.
+    for rel in ("generated-prd.md", "generated-prd.json"):
+        candidate = loki_dir / rel
+        if candidate.is_file():
+            return candidate.resolve()
+
+    # 3. Most recent dashboard inline spec.
+    specs_dir = loki_dir / "specs"
+    if specs_dir.is_dir():
+        try:
+            specs = sorted(
+                (s for s in specs_dir.glob("*.md") if s.is_file()),
+                key=lambda s: s.stat().st_mtime,
+                reverse=True,
+            )
+        except OSError:
+            specs = []
+        if specs:
+            return specs[0].resolve()
+
+    return None
+
+
+@app.post(
+    "/api/fleet/runs/{identifier}/retry",
+    dependencies=[Depends(auth.require_scope("control"))],
+)
+async def retry_fleet_run(request: Request, identifier: str):
+    """Re-launch ONE finished/failed build in the fleet view.
+
+    Resolves the run via the registry (by id / path / alias), exactly like
+    cancel_fleet_run, so the caller identifier is NEVER treated as a filesystem
+    path. Retry re-runs `loki start` (via run.sh) from the project's own stored
+    working directory against a spec source recovered from that directory.
+
+    Guards:
+      - Refuses with 409 if the project is currently running (live pid probe or a
+        fresh session.json), so a retry never double-launches an active build.
+      - Refuses with 409 if no re-launchable spec source exists in the project
+        directory (an honest refusal: retry needs the original spec or working
+        dir; we do not fabricate a launch that would no-op).
+
+    On success the runner re-registers the project as running with its own pid
+    (loki_register_running_project in run.sh); we also flip the registry status
+    to running immediately so the fleet view reflects the relaunch without
+    waiting for the runner's first registry write.
+    """
+    if not _control_limiter.check("control"):
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
+
+    project = registry.get_project(identifier)
+    if not project:
+        raise HTTPException(status_code=404, detail="Run not found in fleet")
+
+    project_id = project.get("id")
+    audit.log_event(
+        action="retry",
+        resource_type="fleet_run",
+        details={"source": "api", "project_id": project_id},
+        ip_address=request.client.host if request.client else None,
+    )
+
+    # Only ever operate on the registry-stored path (never the identifier).
+    path = project.get("path", "")
+    if not path:
+        raise HTTPException(
+            status_code=409,
+            detail="Project has no recorded working directory; retry needs the original working dir",
+        )
+    proj_dir = _Path(path)
+    if not proj_dir.is_dir():
+        raise HTTPException(
+            status_code=409,
+            detail=f"Project directory no longer exists: {path}",
+        )
+    proj_dir = proj_dir.resolve()
+    loki_dir = proj_dir / ".loki"
+
+    # Recover a re-launchable spec from the project's own directory FIRST (before
+    # the claim, so we can refuse honestly without holding the lock). Honest
+    # refusal when nothing usable is present (no fabricated no-op launch).
+    spec_file = await asyncio.to_thread(_recover_spec_source, str(proj_dir))
+    if spec_file is None:
+        raise HTTPException(
+            status_code=409,
+            detail=(
+                "No re-launchable spec found in the project directory. Retry "
+                "needs the original spec (PRD.md, .loki/generated-prd.md, or a "
+                "prior dashboard spec) or the original working dir."
+            ),
+        )
+
+    # Locate run.sh (same resolver start_build uses).
+    skill_dir = find_skill_dir()
+    run_sh = skill_dir / "autonomy" / "run.sh"
+    if not run_sh.exists():
+        raise HTTPException(status_code=500, detail=f"run.sh not found at {run_sh}")
+
+    # Atomic check-and-CLAIM (closes the double-launch TOCTOU). Two concurrent
+    # retry calls on the same stopped project must not both spawn. Under the
+    # registry lock we re-read the live entry, refuse if it is running (pid alive,
+    # the project's own session staleness window, or already "launching" -- a
+    # sibling that just claimed it), else stamp status="launching" + save. The
+    # lock + persisted "launching" marker make the window indivisible: the second
+    # caller sees "launching" and is refused before it can spawn.
+    _live_pid = project.get("pid")
+    if registry._pid_alive(_live_pid):
+        raise HTTPException(
+            status_code=409,
+            detail="Project is currently running; cancel it before retrying",
+        )
+    if loki_dir.is_dir() and _project_run_active(loki_dir) is not None:
+        raise HTTPException(
+            status_code=409,
+            detail="A build is already running in this project",
+        )
+    with registry._registry_lock():
+        reg = registry._load_registry()
+        entry = reg.get("projects", {}).get(project_id)
+        if entry is not None:
+            cur_status = entry.get("status")
+            cur_pid = entry.get("pid")
+            if cur_status == "launching" or registry._pid_alive(cur_pid):
+                raise HTTPException(
+                    status_code=409,
+                    detail="A retry for this project is already in progress",
+                )
+            entry["status"] = "launching"
+            entry["updated_at"] = datetime.now(timezone.utc).isoformat()
+            registry._save_registry(reg)
+
+    # Re-launch from the project's own CWD, mirroring start_build's spawn.
+    args = [str(run_sh), "--bg", str(spec_file)]
+    try:
+        process = subprocess.Popen(
+            args,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            start_new_session=True,
+            cwd=str(proj_dir),
+        )
+    except (OSError, subprocess.SubprocessError) as e:
+        # Release the "launching" claim so a failed spawn does not wedge the
+        # project (else every future retry would be refused as in-progress).
+        try:
+            with registry._registry_lock():
+                reg = registry._load_registry()
+                entry = reg.get("projects", {}).get(project_id)
+                if entry is not None and entry.get("status") == "launching":
+                    entry["status"] = "stopped"
+                    entry["updated_at"] = datetime.now(timezone.utc).isoformat()
+                    registry._save_registry(reg)
+        except Exception:
+            pass
+        raise HTTPException(status_code=500, detail=f"Failed to retry build: {e}")
+
+    # Flip the registry status to running immediately. The runner also
+    # re-registers with its own pid on startup, but updating here gives the
+    # fleet view an instant, accurate reflection of the relaunch. The
+    # load->mutate->save runs under the registry lock so it does not lost-update
+    # against the runner's concurrent re-registration.
+    try:
+        with registry._registry_lock():
+            reg = registry._load_registry()
+            if project_id in reg.get("projects", {}):
+                reg["projects"][project_id]["status"] = "running"
+                reg["projects"][project_id]["pid"] = process.pid
+                reg["projects"][project_id]["updated_at"] = datetime.now(
+                    timezone.utc
+                ).isoformat()
+                registry._save_registry(reg)
+    except Exception:
+        pass
+
+    return {
+        "success": True,
+        "project_id": project_id,
+        "retried": True,
+        "pid": process.pid,
+        "spec": str(spec_file),
+    }
+
+
 @app.post(
     "/api/fleet/runs/{identifier}/cancel",
     dependencies=[Depends(auth.require_scope("control"))],
@@ -3330,9 +3548,10 @@ async def cancel_fleet_run(request: Request, identifier: str):
     recorded orchestrator pid, group-kill + cwd-scoped reap as backstop, then
     mark the registry/session stopped.
 
-    Retry is intentionally NOT exposed: there is no clean cross-project
-    re-launch primitive in the registry path (the original spec source lives
-    only in each project's CWD). Retry is a documented follow-up.
+    Retry (re-launch) is exposed separately at
+    POST /api/fleet/runs/{identifier}/retry, which re-runs `loki start` from
+    the registry-stored project directory against a spec recovered from that
+    directory (refuses honestly when none exists).
     """
     if not _control_limiter.check("control"):
         raise HTTPException(status_code=429, detail="Rate limit exceeded")

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.80.0
+**Version:** v7.81.0
 
 ---
 
@@ -395,7 +395,7 @@ provider works inside the container. Provide auth with your Anthropic API key:
 # Run Loki Mode in Docker (Claude provider, API-key auth)
 docker run --rm -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
   -v $(pwd):/workspace -w /workspace \
-  asklokesh/loki-mode:7.80.0 start ./my-spec.md
+  asklokesh/loki-mode:7.81.0 start ./my-spec.md
 ```
 
 ##### docker compose + .env (no host install)

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var QQ=Object.defineProperty;var ZQ=($)=>$;function zQ($,Q){this[$]=ZQ.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)QQ($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:zQ.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var q$=import.meta.require;var h1={};b(h1,{lokiDir:()=>P,homeLokiDir:()=>i$,findRepoRootForVersion:()=>t$,REPO_ROOT:()=>g});import{resolve as a,dirname as r$}from"path";import{fileURLToPath as XQ}from"url";import{existsSync as R$}from"fs";import{homedir as KQ}from"os";function qQ(){let $=b1;for(let Q=0;Q<6;Q++){if(R$(a($,"VERSION"))&&R$(a($,"autonomy/run.sh")))return $;let Z=r$($);if(Z===$)break;$=Z}return a(b1,"..","..","..")}function t$($){let Q=$;for(let Z=0;Z<6;Z++){if(R$(a(Q,"VERSION"))&&R$(a(Q,"autonomy/run.sh")))return Q;let z=r$(Q);if(z===Q)break;Q=z}return a($,"..","..","..")}function P(){return process.env.LOKI_DIR??a(process.cwd(),".loki")}function i$(){return a(KQ(),".loki")}var b1,g;var C=L(()=>{b1=r$(XQ(import.meta.url));g=qQ()});import{readFileSync as VQ}from"fs";import{resolve as JQ,dirname as UQ}from"path";import{fileURLToPath as WQ}from"url";function E$(){if(Q$!==null)return Q$;let $="7.80.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=UQ(WQ(import.meta.url)),Z=t$(Q);Q$=VQ(JQ(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var e$=L(()=>{C()});var g1={};b(g1,{runOrThrow:()=>HQ,run:()=>F,readStreamCapped:()=>m1,commandVersion:()=>BQ,commandExists:()=>f,ShellError:()=>$1,MAX_STDOUT_BYTES:()=>v1});async function m1($,Q=v1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:U}=await Z.read();if(K)break;if(!U)continue;if(q+=U.byteLength,q>Q){let J=U.byteLength-(q-Q);X+=z.decode(U.subarray(0,J),{stream:!0});break}X+=z.decode(U,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,U]=await Promise.all([m1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:U}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function HQ($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new $1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=GQ($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function GQ($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function BQ($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var v1=16777216,$1;var d=L(()=>{$1=class $1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function s($){return YQ?"":$}var YQ,O,S,_,_Z,I,k,h,V;var c=L(()=>{YQ=(process.env.NO_COLOR??"").length>0;O=s("\x1B[0;31m"),S=s("\x1B[0;32m"),_=s("\x1B[1;33m"),_Z=s("\x1B[0;34m"),I=s("\x1B[0;36m"),k=s("\x1B[1m"),h=s("\x1B[2m"),V=s("\x1B[0m")});import{existsSync as jQ}from"fs";async function Z$(){if(Y$!==void 0)return Y$;let $="/opt/homebrew/bin/python3.12";if(jQ($))return Y$=$,$;let Q=await f("python3.12");if(Q)return Y$=Q,Q;let Z=await f("python3");return Y$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var Y$;var V$=L(()=>{d()});var X0={};b(X0,{runStatus:()=>oQ});import{existsSync as y,readFileSync as U$,readdirSync as r1,statSync as t1}from"fs";import{resolve as D,basename as vQ}from"path";import{homedir as mQ}from"os";function i1($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function e1($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*N$/Q);if(X>N$)X=N$;let q=N$-X,K=S;if(z>=80)K=O;else if(z>=50)K=_;let U="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),J=i1($),W=i1(Q);return`  ${k}${Z}${V} ${K}[${U}]${V} ${z}% (${J} / ${W})`}async function fQ(){if(await f("jq"))return!0;return process.stdout.write(`${O}Error: jq is required but not installed.${V}
+var QQ=Object.defineProperty;var ZQ=($)=>$;function zQ($,Q){this[$]=ZQ.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)QQ($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:zQ.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var q$=import.meta.require;var h1={};b(h1,{lokiDir:()=>P,homeLokiDir:()=>i$,findRepoRootForVersion:()=>t$,REPO_ROOT:()=>g});import{resolve as a,dirname as r$}from"path";import{fileURLToPath as XQ}from"url";import{existsSync as R$}from"fs";import{homedir as KQ}from"os";function qQ(){let $=b1;for(let Q=0;Q<6;Q++){if(R$(a($,"VERSION"))&&R$(a($,"autonomy/run.sh")))return $;let Z=r$($);if(Z===$)break;$=Z}return a(b1,"..","..","..")}function t$($){let Q=$;for(let Z=0;Z<6;Z++){if(R$(a(Q,"VERSION"))&&R$(a(Q,"autonomy/run.sh")))return Q;let z=r$(Q);if(z===Q)break;Q=z}return a($,"..","..","..")}function P(){return process.env.LOKI_DIR??a(process.cwd(),".loki")}function i$(){return a(KQ(),".loki")}var b1,g;var C=L(()=>{b1=r$(XQ(import.meta.url));g=qQ()});import{readFileSync as VQ}from"fs";import{resolve as JQ,dirname as UQ}from"path";import{fileURLToPath as WQ}from"url";function E$(){if(Q$!==null)return Q$;let $="7.81.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=UQ(WQ(import.meta.url)),Z=t$(Q);Q$=VQ(JQ(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var e$=L(()=>{C()});var g1={};b(g1,{runOrThrow:()=>HQ,run:()=>F,readStreamCapped:()=>m1,commandVersion:()=>BQ,commandExists:()=>f,ShellError:()=>$1,MAX_STDOUT_BYTES:()=>v1});async function m1($,Q=v1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:U}=await Z.read();if(K)break;if(!U)continue;if(q+=U.byteLength,q>Q){let J=U.byteLength-(q-Q);X+=z.decode(U.subarray(0,J),{stream:!0});break}X+=z.decode(U,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,U]=await Promise.all([m1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:U}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function HQ($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new $1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=GQ($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function GQ($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function BQ($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var v1=16777216,$1;var d=L(()=>{$1=class $1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function s($){return YQ?"":$}var YQ,O,S,_,_Z,I,k,h,V;var c=L(()=>{YQ=(process.env.NO_COLOR??"").length>0;O=s("\x1B[0;31m"),S=s("\x1B[0;32m"),_=s("\x1B[1;33m"),_Z=s("\x1B[0;34m"),I=s("\x1B[0;36m"),k=s("\x1B[1m"),h=s("\x1B[2m"),V=s("\x1B[0m")});import{existsSync as jQ}from"fs";async function Z$(){if(Y$!==void 0)return Y$;let $="/opt/homebrew/bin/python3.12";if(jQ($))return Y$=$,$;let Q=await f("python3.12");if(Q)return Y$=Q,Q;let Z=await f("python3");return Y$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var Y$;var V$=L(()=>{d()});var X0={};b(X0,{runStatus:()=>oQ});import{existsSync as y,readFileSync as U$,readdirSync as r1,statSync as t1}from"fs";import{resolve as D,basename as vQ}from"path";import{homedir as mQ}from"os";function i1($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function e1($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*N$/Q);if(X>N$)X=N$;let q=N$-X,K=S;if(z>=80)K=O;else if(z>=50)K=_;let U="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),J=i1($),W=i1(Q);return`  ${k}${Z}${V} ${K}[${U}]${V} ${z}% (${J} / ${W})`}async function fQ(){if(await f("jq"))return!0;return process.stdout.write(`${O}Error: jq is required but not installed.${V}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -793,4 +793,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write($Q),2}}s1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var qZ=await KZ(Bun.argv.slice(2));process.exit(qZ);
 
-//# debugId=5DBFF3AC2E319A5664756E2164756E21
+//# debugId=C0A7A027BE2CCC6B64756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.80.0'
+__version__ = '7.81.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.80.0",
+  "version": "7.81.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.80.0",
+  "version": "7.81.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",