loki-mode 7.83.0 → 7.84.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.83.0
+# Loki Mode v7.84.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -406,4 +406,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.83.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.84.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.83.0
+7.84.0

package/autonomy/loki

@@ -3193,6 +3193,10 @@ cmd_next() {
 cmd_ship() {
     local do_preview=false
     local review_args=()
+    # Tracks whether the caller passed an explicit scope flag (--staged, --since,
+    # ...). Passthrough flags like --yes/--severity do NOT set this, so they do
+    # not suppress the clean-loki-branch auto-scoping below.
+    local ship_explicit_scope=false
     while [ $# -gt 0 ]; do
         case "${1:-}" in
             --help|-h|help)
@@ -3222,7 +3226,31 @@ cmd_ship() {
                 return 0
                 ;;
             --preview) do_preview=true ;;
-            *) review_args+=("$1") ;;
+            # Only a known set of NON-scope passthrough flags are exempt from
+            # "explicit scope". Everything else the caller passes -- an explicit
+            # scope flag (--staged/--since/...), a positional <file-or-dir>, or any
+            # other review flag that narrows WHAT is reviewed -- counts as explicit
+            # scope, so we do NOT override it with the clean-branch auto-scoping
+            # below. This is the safe default: passthrough-that-changes-scope must
+            # win over our auto-scope. The exempt list is only flags that never
+            # change scope: --yes/-y (skip prompt), --severity (threshold).
+            # (Without this, `loki ship somefile.py` on a clean loki branch would
+            # get --since base injected and review the whole range, not the file.)
+            --yes|-y|--severity=*)
+                review_args+=("$1") ;;
+            # --severity in its DOCUMENTED two-token form (`--severity high`) takes
+            # a VALUE in the next arg. Consume both here so the value does not fall
+            # to the catch-all and wrongly mark explicit scope (which would skip the
+            # clean-branch auto-scoping and re-introduce the empty-diff false-clean
+            # bug). --severity sets a threshold, not a scope, so neither token is
+            # explicit scope.
+            --severity)
+                review_args+=("$1")
+                if [ "$#" -ge 2 ] && [ "${2#-}" = "$2" ]; then
+                    review_args+=("$2"); shift
+                fi
+                ;;
+            *) review_args+=("$1"); ship_explicit_scope=true ;;
         esac
         shift
     done
@@ -3243,6 +3271,41 @@ cmd_ship() {
 
     # 2. Run the SAME diff quality gates as cmd_review. Capture its documented
     #    exit code (0 clean, 1 HIGH, 2 CRITICAL). set -e safe: capture via || rc=$?.
+    #
+    #    Scope correction: cmd_review defaults to the UNCOMMITTED diff, but run.sh
+    #    auto-commits the session's work to the loki/session-* branch, so by the
+    #    time `loki ship` runs the tree is usually CLEAN -- which would make review
+    #    see an empty diff and falsely report "clean" before advising a PR (the
+    #    safety gate would be a no-op exactly when it matters). When the caller
+    #    gave no explicit scope AND we are on a loki/* branch with a clean tree,
+    #    default the scope to the branch-vs-base RANGE (the work being shipped),
+    #    resolved the same way the PR advice below resolves it.
+    local _ship_dir="."
+    if [ "$ship_explicit_scope" = false ]; then
+        local _ship_head="" _ship_base="" _ship_dirty=""
+        _ship_head="$(git -C "$_ship_dir" rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")"
+        # Untracked files (e.g. a gitignored .loki/) do not count as "dirty" --
+        # what matters is whether the shippable TRACKED work is already committed.
+        _ship_dirty="$(git -C "$_ship_dir" status --porcelain --untracked-files=no 2>/dev/null)"
+        case "$_ship_head" in
+            loki/*)
+                if [ -z "$_ship_dirty" ]; then
+                    if [ -s "$_ship_dir/.loki/state/base-branch.txt" ]; then
+                        _ship_base="$(head -n1 "$_ship_dir/.loki/state/base-branch.txt" 2>/dev/null || echo "")"
+                    fi
+                    if [ -z "$_ship_base" ]; then
+                        local _ship_oh=""
+                        _ship_oh="$(git -C "$_ship_dir" symbolic-ref refs/remotes/origin/HEAD 2>/dev/null || echo "")"
+                        [ -n "$_ship_oh" ] && _ship_base="${_ship_oh##*/}"
+                    fi
+                    if [ -n "$_ship_base" ] && git -C "$_ship_dir" rev-parse --verify --quiet "$_ship_base" >/dev/null 2>&1; then
+                        review_args+=("--since" "$_ship_base")
+                        echo -e "${DIM}Clean working tree on $_ship_head; reviewing the branch range vs $_ship_base.${NC}"
+                    fi
+                fi
+                ;;
+        esac
+    fi
     echo -e "${BOLD}Running quality gates on the diff (loki review)...${NC}"
     echo ""
     local rc=0

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.83.0"
+__version__ = "7.84.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/registry.py

@@ -342,6 +342,60 @@ def mark_project_stopped(identifier: str) -> Optional[dict]:
     return None
 
 
+def prune_missing_projects(running_ids: Optional[set] = None) -> list[dict]:
+    """Remove registry entries whose project path no longer exists on disk.
+
+    The registry records every cwd that has ever been seen by `loki start` and,
+    until this function runs, never garbage-collects them: deleted / renamed /
+    temp project directories accumulate forever and bloat the dashboard project
+    switcher with paths that no longer exist. This prunes those dead entries.
+
+    Safety:
+      - A path is considered dead only when os.path.isdir(path) is False.
+      - A currently-running project is NEVER pruned even if its path check is
+        racy (e.g. a transient unmount): pass its project id in running_ids and
+        the entry is kept regardless of the disk check. An entry with a live pid
+        recorded in the registry is also kept defensively (a running build whose
+        dir momentarily fails to stat must not be dropped, which would orphan
+        the switcher's Stop target).
+      - The whole load->mutate->save runs under _registry_lock() with the atomic
+        _save_registry, so it is safe under concurrency with the leaf mutators.
+
+    Args:
+        running_ids: Optional set of project ids that are known to be running
+            and must be retained unconditionally. None means "trust the disk
+            check and the per-entry recorded pid only".
+
+    Returns:
+        The list of pruned (removed) project entries. Empty when nothing was
+        removed.
+    """
+    keep_running = running_ids or set()
+    pruned: list[dict] = []
+    with _registry_lock():
+        registry = _load_registry()
+        projects = registry.get("projects", {})
+
+        survivors = {}
+        for project_id, project in projects.items():
+            path = project.get("path", "")
+            # Keep unconditionally if the caller marked it running, or if the
+            # registry has a live pid recorded for it.
+            if project_id in keep_running or _pid_alive(project.get("pid")):
+                survivors[project_id] = project
+                continue
+            # Otherwise keep only if the path still exists on disk.
+            if path and os.path.isdir(path):
+                survivors[project_id] = project
+            else:
+                pruned.append(project)
+
+        if pruned:
+            registry["projects"] = survivors
+            _save_registry(registry)
+    return pruned
+
+
 def check_project_health(identifier: str) -> dict:
     """
     Check the health status of a project.

package/dashboard/server.py

@@ -2900,6 +2900,17 @@ async def list_running_projects():
     Live-vs-stale is derived from pid liveness, which is robust even when a
     session is hard-killed (no exit hook fires). Never raises: registry
     problems degrade to an empty list.
+
+    Registry hygiene (project switcher): the registry records every cwd ever
+    seen by `loki start` and never garbage-collects, so the switcher list grows
+    without bound and shows paths that no longer exist on disk. This endpoint:
+      - opportunistically prunes registry entries whose path is gone AND which
+        are not running (registry.prune_missing_projects), keeping the on-disk
+        store small. Running projects are never pruned.
+      - returns a CLEAN list: a project is included only if its path still
+        exists on disk OR it is currently running (or is the active project).
+      - sorts by last_accessed desc (most relevant first) and caps the list
+        defensively, but never drops a running or the active project.
     """
     out = []
     try:
@@ -2907,6 +2918,19 @@ async def list_running_projects():
     except Exception:
         projects = []
     active = _active_project_dir
+
+    def _is_active(path: str) -> bool:
+        # Compare via realpath: /api/focus resolves symlinks (e.g. macOS
+        # /tmp -> /private/tmp) while the registry stores abspath, so a plain
+        # abspath compare would never match a focused symlinked project.
+        if not (active and path):
+            return False
+        try:
+            return os.path.realpath(active) == os.path.realpath(path)
+        except OSError:
+            return os.path.abspath(active) == os.path.abspath(path)
+
+    running_ids = set()
     for p in projects:
         path = p.get("path", "")
         pid = p.get("pid")
@@ -2936,15 +2960,15 @@ async def list_running_projects():
                     running = s.get("status") == "running"
             except Exception:
                 pass
-        # Compare via realpath: /api/focus resolves symlinks (e.g. macOS
-        # /tmp -> /private/tmp) while the registry stores abspath, so a plain
-        # abspath compare would never match a focused symlinked project.
-        is_active = False
-        if active and path:
-            try:
-                is_active = os.path.realpath(active) == os.path.realpath(path)
-            except OSError:
-                is_active = os.path.abspath(active) == os.path.abspath(path)
+        path_exists = bool(path) and os.path.isdir(path)
+        is_active = _is_active(path)
+        if running:
+            running_ids.add(p.get("id"))
+        # CLEAN list: include only projects whose path still exists, or which
+        # are running, or which are the active project. A dead path that is not
+        # running is excluded (and pruned from the store below).
+        if not (path_exists or running or is_active):
+            continue
         out.append({
             "id": p.get("id"),
             "name": p.get("name") or (os.path.basename(path) if path else "project"),
@@ -2953,7 +2977,29 @@ async def list_running_projects():
             "status": p.get("status"),
             "running": running,
             "is_active": is_active,
+            "_last_accessed": p.get("last_accessed") or p.get("registered_at") or "",
         })
+
+    # Opportunistically garbage-collect dead entries from the on-disk registry
+    # so it never grows without bound. Running projects (by id, plus any with a
+    # live recorded pid inside the helper) are retained even if the disk check
+    # is racy. Best-effort: a prune failure must not break the listing.
+    try:
+        registry.prune_missing_projects(running_ids=running_ids)
+    except Exception:
+        pass
+
+    # Most relevant first: last_accessed desc. Cap defensively, but never hide a
+    # running or active project (partition them out before the cap).
+    _SWITCHER_CAP = 50
+    out.sort(key=lambda r: r.get("_last_accessed", ""), reverse=True)
+    if len(out) > _SWITCHER_CAP:
+        pinned = [r for r in out if r["running"] or r["is_active"]]
+        rest = [r for r in out if not (r["running"] or r["is_active"])]
+        out = pinned + rest[: max(0, _SWITCHER_CAP - len(pinned))]
+    # Drop the internal sort key from the response shape.
+    for r in out:
+        r.pop("_last_accessed", None)
     return {"projects": out, "active_project_dir": active}