loki-mode 7.87.0 → 7.89.0

package/dashboard/telemetry.py

@@ -1,12 +1,14 @@
 """Anonymous usage telemetry for Loki Mode dashboard.
 
-Collection is OPT-IN and OFF by default. Nothing is sent unless the user
-explicitly opts in, so a default install (including air-gapped, GDPR, and
-FedRAMP deployments) never phones home.
+Collection is ON BY DEFAULT for an ordinary individual install, and AUTO-OFF in
+enterprise / CI / air-gapped / non-interactive contexts (see _auto_off), so those
+deployments stay silent out of the box (GDPR / FedRAMP safe). Only anonymous
+diagnostics are ever sent; never code, prompts, paths, keys, or repo names. The
+gate mirrors autonomy/telemetry.sh + autonomy/crash.sh exactly.
 
-Opt-in (one required): LOKI_TELEMETRY=on  OR  ~/.loki/config: TELEMETRY_ENABLED=true
 Opt-out (always wins): LOKI_TELEMETRY=off / LOKI_TELEMETRY_DISABLED=true /
                        DO_NOT_TRACK=1 / ~/.loki/config: TELEMETRY_DISABLED=true
+Force-on:  LOKI_TELEMETRY=on  OR  ~/.loki/config: TELEMETRY_ENABLED=true
 
 All calls are fire-and-forget, silent on failure, non-blocking.
 """
@@ -14,6 +16,7 @@ All calls are fire-and-forget, silent on failure, non-blocking.
 import json
 import os
 import platform
+import sys
 import threading
 import uuid
 from pathlib import Path
@@ -25,17 +28,57 @@ _POSTHOG_HOST = os.environ.get(
 _POSTHOG_KEY = "phc_ya0vGBru41AJWtGNfZZ8H9W4yjoZy4KON0nnayS7s87"
 
 
+def _auto_off():
+    """Enterprise / CI / air-gapped / non-interactive detection: contexts where
+    on-by-default would be inappropriate, so collection auto-disables and stays
+    silent out of the box. MUST stay in sync with _loki_telemetry_auto_off
+    (autonomy/telemetry.sh) and _loki_collection_auto_off (autonomy/crash.sh)."""
+    if os.environ.get("CI") == "true":
+        return True
+    for var in ("GITHUB_ACTIONS", "GITLAB_CI", "BUILDKITE", "JENKINS_URL",
+                "TEAMCITY_VERSION"):
+        if os.environ.get(var):
+            return True
+    if os.environ.get("CONTINUOUS_INTEGRATION") == "true":
+        return True
+    if os.environ.get("LOKI_ENTERPRISE") == "true":
+        return True
+    if os.environ.get("LOKI_AIRGAP") == "true":
+        return True
+    # Non-interactive detection (council cH_r1 AC2). Interactivity is resolved
+    # exactly once at the real entry point (bin/loki shim / autonomy/loki main)
+    # and exported as LOKI_TTY_INTERACTIVE. Trust that explicit signal instead of
+    # a fresh isatty() probe, because the gate can run in a detached/non-TTY
+    # context (backgrounded thread / subprocess) where isatty() would wrongly
+    # auto-off a real interactive user. Fall back to a live isatty() probe only
+    # when the signal is unset (the helper ran without passing an entry point).
+    # MUST match _loki_telemetry_auto_off (telemetry.sh) and
+    # _loki_collection_auto_off (crash.sh).
+    tty_signal = os.environ.get("LOKI_TTY_INTERACTIVE")
+    if tty_signal is not None and tty_signal != "":
+        return tty_signal != "1"
+    # Non-interactive: neither stdout nor stdin is a terminal (scripts/pipes/
+    # detached/containers). An individual user at a real shell has a TTY.
+    try:
+        if not sys.stdout.isatty() and not sys.stdin.isatty():
+            return True
+    except Exception:
+        pass
+    return False
+
+
 def _is_enabled():
-    # Unified OPT-IN gate. Collection is OFF by default; enabled ONLY when the
-    # user has opted in AND has not also opted out. This precedence MUST mirror
-    # loki_collection_enabled in autonomy/crash.sh and _loki_telemetry_enabled
-    # in autonomy/telemetry.sh so one model gates BOTH PostHog usage telemetry
-    # and crash reporting.
+    # Unified gate. Default ON for individual interactive installs; auto-OFF in
+    # enterprise/CI/air-gapped contexts; explicit opt-out always wins. Precedence
+    # MUST mirror loki_collection_enabled in autonomy/crash.sh and
+    # _loki_telemetry_enabled in autonomy/telemetry.sh so one model gates BOTH
+    # PostHog usage telemetry and crash reporting.
     #
     # Precedence:
-    #   1. Any opt-out flag present  -> False (hard kill, always wins)
-    #   2. Else any opt-in flag present -> True
-    #   3. Else (default)            -> False (no egress)
+    #   1. Any opt-out flag present     -> False (hard kill, always wins)
+    #   2. Else explicit opt-in present -> True (force-on, even in CI/enterprise)
+    #   3. Else enterprise/CI/air-gapped -> False (auto-off, safe out of the box)
+    #   4. Else (individual default)    -> True (anonymous diagnostics)
     telem = os.environ.get("LOKI_TELEMETRY", "").lower()
 
     # --- 1. Opt-out always wins ---
@@ -59,14 +102,18 @@ def _is_enabled():
     except Exception:
         pass
 
-    # --- 2. Opt-in required to enable ---
+    # --- 2. Explicit opt-in forces ON (overrides the enterprise/CI auto-off) ---
     if telem == "on":
         return True
     if config_enabled:
         return True
 
-    # --- 3. Default: OFF ---
-    return False
+    # --- 3. Enterprise / CI / air-gapped: auto-off (safe out of the box) ---
+    if _auto_off():
+        return False
+
+    # --- 4. Individual interactive default: ON (anonymous diagnostics) ---
+    return True
 
 
 def _get_distinct_id():

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.87.0
+**Version:** v7.89.0
 
 ---
 
@@ -395,7 +395,7 @@ provider works inside the container. Provide auth with your Anthropic API key:
 # Run Loki Mode in Docker (Claude provider, API-key auth)
 docker run --rm -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
   -v $(pwd):/workspace -w /workspace \
-  asklokesh/loki-mode:7.87.0 start ./my-spec.md
+  asklokesh/loki-mode:7.89.0 start ./my-spec.md
 ```
 
 ##### docker compose + .env (no host install)

package/docs/PRIVACY.md

@@ -6,21 +6,32 @@ match the code, the code is the bug; please open an issue.
 
 ## Summary
 
-- Anonymous diagnostics are OPT-IN and OFF by default. A default install sends
-  no telemetry or diagnostics of any kind. This covers a default `npm install`,
-  the CLI (session and command events), the dashboard, and the welcome page
-  form. Air-gapped, GDPR, and FedRAMP deployments are safe out of the box: an
-  untouched install sends us no telemetry or diagnostics. (This statement scopes
-  to telemetry and diagnostics; provider CLIs you configure, such as Claude or
-  Codex, make their own network calls under your own credentials and are
-  governed by their vendors.)
-- When you DO opt in, Loki Mode collects anonymous diagnostics to help find and
-  fix bugs. It NEVER collects your code, prompts, PRDs, file paths, environment
-  values, API keys, repository names, emails, or IP addresses.
+- Anonymous diagnostics are ON BY DEFAULT for an ordinary individual install,
+  and AUTO-OFF in enterprise, CI, and air-gapped contexts. This covers the CLI
+  (session and command events), the dashboard, and the welcome page form. What is
+  ever sent is ONLY anonymous diagnostics (operating system, architecture, Loki
+  version, error type, and sanitized stack signatures). It NEVER includes your
+  code, prompts, PRDs, file paths, environment values, API keys, repository
+  names, emails, or IP addresses. (This statement scopes to telemetry and
+  diagnostics; provider CLIs you configure, such as Claude or Codex, make their
+  own network calls under your own credentials and are governed by their vendors.)
+- Enterprise / CI / air-gapped deployments are safe out of the box: collection
+  AUTO-DISABLES (no opt-out needed) when any of these is detected -- CI
+  (CI/GITHUB_ACTIONS/GITLAB_CI/BUILDKITE/JENKINS_URL/TEAMCITY_VERSION/
+  CONTINUOUS_INTEGRATION), an enterprise/air-gapped marker
+  (LOKI_ENTERPRISE=true / LOKI_AIRGAP=true), or a non-interactive session (no
+  TTY: scripts, pipes, cron, detached/container runs). In those contexts an
+  untouched install sends us nothing. GDPR / FedRAMP deployments stay clean.
+- Disclosure is never covert: the first-run welcome screen states (once) that
+  anonymous diagnostics are on and how to turn them off, and this document is the
+  canonical reference.
+- Opt out anytime, and opt-out ALWAYS wins: `loki telemetry off` /
+  `LOKI_TELEMETRY=off` / `LOKI_TELEMETRY_DISABLED=true` / `DO_NOT_TRACK=1` /
+  `~/.loki/config: TELEMETRY_DISABLED=true`. Conversely `loki telemetry on`
+  force-enables even inside CI/enterprise if you want to send us diagnostics.
 - Crash reporting (Phase 0) is local-only with zero network egress regardless,
-  and is also gated by opt-in, so a default install writes nothing at all.
-- You opt in with a single switch (`loki telemetry on` or `LOKI_TELEMETRY=on`)
-  and can opt back out at any time. Opt-out always wins over opt-in.
+  and is gated by the same switch, so an opted-out (or auto-off) install writes
+  nothing at all.
 
 ## Two collection paths exist
 
@@ -46,10 +57,14 @@ Phase 0 behavior:
     GitHub issue URL so you can submit it manually if you choose. Loki Mode does
     not submit anything for you in this version.
 
-### 2. Usage telemetry (anonymous, opt-in)
+### 2. Usage telemetry (anonymous, on by default for individuals)
 
-Loki Mode can send anonymous usage telemetry via PostHog, but ONLY after you opt
-in. By default it is OFF and nothing is sent.
+Loki Mode sends anonymous usage telemetry via PostHog. It is ON by default for an
+ordinary individual install, and AUTO-OFF in enterprise, CI, air-gapped, and
+non-interactive contexts (see the precedence below). It is gated by the same
+switch as crash reporting, so a single opt-out (`loki telemetry off` /
+`DO_NOT_TRACK=1`) disables everything, and it never sends your code, prompts,
+paths, keys, or repo names -- only anonymous diagnostics.
 
 - Endpoint: `https://us.i.posthog.com/capture/` (override with
   `LOKI_TELEMETRY_ENDPOINT`). The PostHog project key is a public ingest key.
@@ -115,36 +130,45 @@ prompts, briefs, and diffs can never reach the payload even if a redaction rule
 were to miss something. Secrets are additionally scrubbed by the shared redactor
 before whitelisting.
 
-## How to opt in (and opt back out)
+## How to turn it off (and force it on)
 
-Collection is OFF by default. To turn it on, use ANY one of:
+Anonymous diagnostics are ON by default for an ordinary individual install. To
+turn them off at any time, use ANY one of the following. Opt-out always wins, so
+setting one of these guarantees nothing is collected or sent:
 
-- Run `loki telemetry on` (persists `TELEMETRY_ENABLED=true` to `~/.loki/config`)
-- Set the environment variable `LOKI_TELEMETRY=on` (exact word `on`,
-  case-insensitive; values like `1` or `true` do NOT count as consent)
-
-To opt back out at any time, use ANY one of the following. Opt-out always wins
-over opt-in, so setting one of these guarantees nothing is collected or sent:
-
-- Run `loki telemetry off`
+- Run `loki telemetry off` (persists `TELEMETRY_DISABLED=true` to `~/.loki/config`)
 - Set `LOKI_TELEMETRY=off`
 - Set `DO_NOT_TRACK=1` (the cross-tool community convention)
 - Set `LOKI_TELEMETRY_DISABLED=true`
 
+To FORCE it on (for example to send us diagnostics from a context that would
+otherwise auto-disable, like CI), use ANY one of:
+
+- Run `loki telemetry on` (persists `TELEMETRY_ENABLED=true` to `~/.loki/config`)
+- Set `LOKI_TELEMETRY=on` (exact word `on`, case-insensitive)
+
 ### Precedence (exact)
 
 1. If any opt-out flag is set, collection is OFF (hard kill, always wins).
-2. Else if any opt-in flag is set, collection is ON.
-3. Otherwise (the default), collection is OFF.
+2. Else if an explicit opt-in (`loki telemetry on` / `LOKI_TELEMETRY=on` /
+   `TELEMETRY_ENABLED=true`) is set, collection is ON (this overrides the
+   enterprise/CI/air-gapped auto-off below).
+3. Else if the context is enterprise / CI / air-gapped / non-interactive,
+   collection is OFF (auto-off, safe out of the box). Detected via: CI /
+   GITHUB_ACTIONS / GITLAB_CI / BUILDKITE / JENKINS_URL / TEAMCITY_VERSION /
+   CONTINUOUS_INTEGRATION, or LOKI_ENTERPRISE=true / LOKI_AIRGAP=true, or no TTY.
+4. Otherwise (an ordinary individual install), collection is ON.
+
+In all enabled cases, if `curl` is unavailable there is no egress.
 
 ### Air-gapped and enterprise deployments
 
-Because collection is opt-in, a default install in an air-gapped, GDPR, or
-FedRAMP environment sends us no telemetry or diagnostics: there is nothing to
-turn off because there is nothing on. To make opting in impossible by accident
-across a fleet, bake `LOKI_TELEMETRY_DISABLED=true` (or `DO_NOT_TRACK=1`) into
-your base image or CI environment; opt-out always wins regardless of any later
-opt-in.
+A default install in an air-gapped, CI, or non-interactive environment sends us
+no telemetry or diagnostics: collection AUTO-DISABLES there (step 3 above), so
+there is nothing to turn off. To make collection impossible across a fleet
+regardless of context, bake `LOKI_TELEMETRY_DISABLED=true` (or `DO_NOT_TRACK=1`)
+into your base image or CI environment; opt-out always wins over everything,
+including a stray `loki telemetry on`.
 
 This same gate covers ALL paths: the `npm install` event, CLI session and
 command events, the dashboard event, the welcome form, and local crash capture.
@@ -183,9 +207,12 @@ that choice plainly so you can decide whether to opt out.
 
 ## Compliance posture
 
-- Opt-in by default: nothing is collected or sent unless the user explicitly
-  opts in. A default install (including air-gapped) sends us no telemetry or
-  diagnostics.
+- Safe-by-default for enterprise: collection AUTO-DISABLES in enterprise, CI,
+  air-gapped, and non-interactive contexts, so an untouched install in those
+  environments sends us no telemetry or diagnostics (no action required). For an
+  ordinary individual install it is on by default (anonymous diagnostics only),
+  disclosed once on first use, and a single opt-out (`loki telemetry off` /
+  `DO_NOT_TRACK=1`) always wins and disables everything.
 - Anonymous by design: no PII is in the whitelist; emails and IP addresses are
   denied outright. The welcome form's role / company-size / tools fields are
   self-reported and anonymous (no name, email, or IP).