loki-mode 7.94.0 → 7.96.0

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.94.0
+**Version:** v7.96.0
 
 ---
 

package/events/bus.ts

@@ -292,7 +292,13 @@ export class EventBus {
 
     if (archive) {
       try {
-        const files = fs.readdirSync(this.pendingDir).filter((f) => f.includes(event.id));
+        // Match the exact id at the filename boundary. Emitted files are named
+        // `${timestamp}_${id}.json`, so a substring match (f.includes(event.id))
+        // would also match a DIFFERENT event whose id contains this id as a
+        // substring, archiving/marking the wrong event file (event loss). The
+        // Python impl already uses the precise `*_${id}.json` glob; mirror it.
+        const suffix = `_${event.id}.json`;
+        const files = fs.readdirSync(this.pendingDir).filter((f) => f.endsWith(suffix));
         for (const file of files) {
           const src = path.join(this.pendingDir, file);
           const dst = path.join(this.archiveDir, file);

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var z8=Object.defineProperty;var X8=($)=>$;function K8($,Q){this[$]=X8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)z8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:K8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var y1={};b(y1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as t,dirname as i$}from"path";import{fileURLToPath as q8}from"url";import{existsSync as E$}from"fs";import{homedir as J8}from"os";function V8(){let $=h1;for(let Q=0;Q<6;Q++){if(E$(t($,"VERSION"))&&E$(t($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return t(h1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(E$(t(Q,"VERSION"))&&E$(t(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function P(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(J8(),".loki")}var h1,h;var C=L(()=>{h1=i$(q8(import.meta.url));h=V8()});import{readFileSync as W8}from"fs";import{resolve as U8,dirname as H8}from"path";import{fileURLToPath as G8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.94.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=H8(G8(import.meta.url)),Z=e$(Q);Q$=W8(U8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var u1={};b(u1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>f1,commandVersion:()=>N8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>m1});async function f1($,Q=m1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([f1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=E8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function E8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function N8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var m1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return S8?"":$}var S8,T,S,_,lZ,I,k,y,J;var c=L(()=>{S8=(process.env.NO_COLOR??"").length>0;T=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),lZ=r("\x1B[0;34m"),I=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as u8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(u8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var q0={};b(q0,{runStatus:()=>W3});import{existsSync as v,readFileSync as U$,readdirSync as i1,statSync as e1}from"fs";import{resolve as D,basename as $3}from"path";import{homedir as Q3}from"os";function $0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Q0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=$0($),U=$0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function z3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
+var z8=Object.defineProperty;var X8=($)=>$;function K8($,Q){this[$]=X8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)z8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:K8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var y1={};b(y1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as t,dirname as i$}from"path";import{fileURLToPath as q8}from"url";import{existsSync as E$}from"fs";import{homedir as J8}from"os";function V8(){let $=h1;for(let Q=0;Q<6;Q++){if(E$(t($,"VERSION"))&&E$(t($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return t(h1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(E$(t(Q,"VERSION"))&&E$(t(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function P(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(J8(),".loki")}var h1,h;var C=L(()=>{h1=i$(q8(import.meta.url));h=V8()});import{readFileSync as W8}from"fs";import{resolve as U8,dirname as H8}from"path";import{fileURLToPath as G8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.96.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=H8(G8(import.meta.url)),Z=e$(Q);Q$=W8(U8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var u1={};b(u1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>f1,commandVersion:()=>N8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>m1});async function f1($,Q=m1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([f1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=E8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function E8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function N8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var m1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return S8?"":$}var S8,T,S,_,lZ,I,k,y,J;var c=L(()=>{S8=(process.env.NO_COLOR??"").length>0;T=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),lZ=r("\x1B[0;34m"),I=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as u8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(u8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var q0={};b(q0,{runStatus:()=>W3});import{existsSync as v,readFileSync as U$,readdirSync as i1,statSync as e1}from"fs";import{resolve as D,basename as $3}from"path";import{homedir as Q3}from"os";function $0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Q0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=$0($),U=$0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function z3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -802,4 +802,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(Z8),2}}r1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var FZ=await jZ(Bun.argv.slice(2));process.exit(FZ);
 
-//# debugId=4B46D2108E7A951364756E2164756E21
+//# debugId=E60A742D72C38FD764756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.94.0'
+__version__ = '7.96.0'

package/mcp/learning_collector.py

@@ -512,6 +512,24 @@ def get_mcp_learning_collector(
         MCPLearningCollector instance
     """
     global _collector
+    # Recreate when the requested loki_dir differs from the cached collector's
+    # directory. The module-level singleton would otherwise return a collector
+    # bound to a PREVIOUS project's .loki dir on cwd change, contaminating one
+    # project's learnings into another in a multi-project session. Compare by
+    # realpath so symlinked/relative paths to the same dir do not churn.
+    if _collector is not None and loki_dir is not None:
+        try:
+            cached = os.path.realpath(str(getattr(_collector, "loki_dir", "")))
+            requested = os.path.realpath(str(loki_dir))
+            if cached != requested:
+                close = getattr(_collector, "close", None)
+                if callable(close):
+                    close()
+                _collector = None
+        except Exception:
+            # On any path-resolution error, fall through and reuse the cache
+            # rather than risk losing the collector.
+            pass
     if _collector is None:
         _collector = MCPLearningCollector(loki_dir=loki_dir)
     return _collector

package/mcp/server.py

@@ -64,13 +64,28 @@ _learning_collector = None
 
 
 def _get_learning_collector():
-    """Get or create the LearningCollector instance for MCP server."""
+    """Get or create the LearningCollector instance for MCP server.
+
+    Revalidates the cached collector against the current cwd-derived .loki dir
+    (mirrors the StateManager realpath-compare-recreate guard in
+    _get_mcp_state_manager). A multi-project MCP session can change cwd between
+    calls; without this, the cached collector stays bound to a PREVIOUS
+    project's .loki dir and contaminates one project's learnings into another.
+    """
     global _learning_collector
     if not LEARNING_COLLECTOR_AVAILABLE:
         return None
+    from pathlib import Path
+    loki_dir = Path(os.getcwd()) / '.loki'
+    if _learning_collector is not None:
+        existing_dir = getattr(_learning_collector, 'loki_dir', None)
+        if existing_dir and os.path.realpath(str(existing_dir)) != os.path.realpath(str(loki_dir)):
+            # Project directory changed, recreate
+            close = getattr(_learning_collector, 'close', None)
+            if callable(close):
+                close()
+            _learning_collector = None
     if _learning_collector is None:
-        from pathlib import Path
-        loki_dir = Path(os.getcwd()) / '.loki'
         _learning_collector = get_mcp_learning_collector(loki_dir=loki_dir)
     return _learning_collector
 

package/memory/consolidation.py

@@ -228,28 +228,34 @@ class ConsolidationPipeline:
                     merged = False
                     for idx, existing in enumerate(existing_patterns):
                         if self._patterns_similar(new_pattern, existing):
-                            # Re-read the target pattern fresh immediately before
-                            # merging (BUG-MEM C1, lost-update). The whole-run
-                            # snapshot at step 4 can be stale by now: a concurrent
-                            # storage.increment_pattern_usage() (atomic read-mutate-
-                            # write under one exclusive lock) may have bumped
-                            # usage_count/last_used AFTER the snapshot. merge_with_existing() builds the
-                            # merged record from best_match.usage_count/last_used,
-                            # so merging from the stale snapshot clobbers that bump.
-                            # Re-reading narrows the window to this single write.
-                            merge_base = self._reload_pattern(existing)
-                            merged_pattern = self.merge_with_existing(new_pattern, [merge_base])
-                            self.storage.update_pattern(merged_pattern)
-                            # Refresh the in-memory copy so a later new pattern in
-                            # this same run that also merges into this existing
-                            # pattern builds on the just-merged state. Without this,
-                            # the second merge reads the stale pre-merge base and its
-                            # update_pattern() overwrites storage, silently dropping
-                            # the first merge's conditions/source_episodes/confidence.
-                            existing_patterns[idx] = merged_pattern
-                            result.patterns_merged += 1
-                            merged = True
-                            break
+                            # Atomic read-merge-write (BUG-MEM C1, lost-update).
+                            # The whole-run snapshot at step 4 can be stale by now:
+                            # a concurrent storage.increment_pattern_usage()
+                            # (atomic read-mutate-write under one exclusive lock)
+                            # may have bumped usage_count/last_used AFTER the
+                            # snapshot, and merge_with_existing() builds the merged
+                            # record from the base's usage_count/last_used. The
+                            # merge now runs INSIDE update_pattern_with_merge's
+                            # single lock on patterns.json (the same path
+                            # increment_pattern_usage locks), so the merge base is
+                            # the live on-disk record and the bump cannot be lost.
+                            merged_holder = {}
+
+                            def _merge(current, _np=new_pattern, _holder=merged_holder):
+                                base = SemanticPattern.from_dict(current)
+                                m = self.merge_with_existing(_np, [base])
+                                _holder["pattern"] = m
+                                return m
+
+                            if self.storage.update_pattern_with_merge(existing.id, _merge):
+                                merged_pattern = merged_holder["pattern"]
+                                # Refresh the in-memory copy so a later new pattern
+                                # in this same run that also merges into this
+                                # existing pattern builds on the just-merged state.
+                                existing_patterns[idx] = merged_pattern
+                                result.patterns_merged += 1
+                                merged = True
+                                break
 
                     if not merged:
                         self.storage.save_pattern(new_pattern)
@@ -277,20 +283,27 @@ class ConsolidationPipeline:
             for idx, existing in enumerate(existing_patterns):
                 if (existing.incorrect_approach and
                     self._patterns_similar(anti_pattern, existing, threshold=0.6)):
-                    # Re-read fresh before merge (same C1 lost-update guard as the
-                    # cluster merge loop above): merge from current on-disk state,
-                    # not the potentially-stale step-4 snapshot.
-                    merge_base = self._reload_pattern(existing)
-                    merged_pattern = self.merge_with_existing(anti_pattern, [merge_base])
-                    self.storage.update_pattern(merged_pattern)
-                    # Refresh in-memory copy (same data-loss guard as the cluster
-                    # merge loop above): a later anti-pattern merging into this same
-                    # existing pattern must build on the just-merged state, not the
-                    # stale pre-merge base.
-                    existing_patterns[idx] = merged_pattern
-                    result.patterns_merged += 1
-                    merged = True
-                    break
+                    # Atomic read-merge-write (same C1 lost-update guard as the
+                    # cluster merge loop above): merge from the live on-disk record
+                    # inside update_pattern_with_merge's single lock so a concurrent
+                    # usage bump cannot be clobbered.
+                    merged_holder = {}
+
+                    def _merge(current, _ap=anti_pattern, _holder=merged_holder):
+                        base = SemanticPattern.from_dict(current)
+                        m = self.merge_with_existing(_ap, [base])
+                        _holder["pattern"] = m
+                        return m
+
+                    if self.storage.update_pattern_with_merge(existing.id, _merge):
+                        merged_pattern = merged_holder["pattern"]
+                        # Refresh in-memory copy: a later anti-pattern merging into
+                        # this same existing pattern must build on the just-merged
+                        # state, not the stale pre-merge base.
+                        existing_patterns[idx] = merged_pattern
+                        result.patterns_merged += 1
+                        merged = True
+                        break
 
             if not merged:
                 self.storage.save_pattern(anti_pattern)
@@ -324,34 +337,12 @@ class ConsolidationPipeline:
         result.duration_seconds = time.time() - start_time
         return result
 
-    def _reload_pattern(self, fallback: SemanticPattern) -> SemanticPattern:
-        """Re-read a pattern fresh from storage immediately before merging.
-
-        Used by the merge branches to avoid the C1 lost-update: the step-4
-        snapshot may be stale (a concurrent usage bump can land after it), and
-        merge_with_existing() copies usage_count/last_used from the base. Reading
-        the current on-disk record makes the merge build on live state.
-
-        Mirrors the snapshot's dict/object handling. If load_pattern returns
-        nothing (e.g. the record vanished), fall back to the in-memory copy so the
-        merge still proceeds rather than crashing.
-
-        Residual limitation (honest): load_pattern and update_pattern are SEPARATE
-        lock acquisitions, so a bump landing between this re-read and the write is
-        still lost. This narrows the race window from the whole run to a single
-        write; it is a mitigation, not cross-process atomicity. A full fix needs a
-        compare-and-set or merge-callback update in storage, which is out of scope
-        for this file (storage.py is frozen this batch).
-        """
-        try:
-            fresh = self.storage.load_pattern(fallback.id)
-        except Exception:
-            return fallback
-        if not fresh:
-            return fallback
-        if isinstance(fresh, dict):
-            return SemanticPattern.from_dict(fresh)
-        return fresh
+    # NOTE: The former _reload_pattern() helper (a partial C1 lost-update
+    # mitigation that re-read the pattern in a SEPARATE lock from the write) was
+    # removed once the merge moved fully inside storage.update_pattern_with_merge,
+    # which performs the read, merge, and write under ONE exclusive lock on
+    # patterns.json. That closes the lost-update race cross-process; no residual
+    # narrow window remains.
 
     # -------------------------------------------------------------------------
     # Clustering Methods

package/memory/storage.py

@@ -857,6 +857,75 @@ class MemoryStorage:
 
         return True
 
+    def update_pattern_with_merge(self, pattern_id: str, merge_fn) -> bool:
+        """Atomically merge into an existing pattern under a single lock.
+
+        Closes the consolidation lost-update (BUG-MEM C1): the previous flow read
+        the pattern (load_pattern) and wrote the merged result (update_pattern) in
+        SEPARATE lock acquisitions, so a concurrent increment_pattern_usage() bump
+        landing between the read and the write was lost. Here the read of the
+        current on-disk record, the caller's merge, and the write all happen
+        inside ONE exclusive _file_lock on patterns.json -- the same path
+        increment_pattern_usage() and update_pattern() lock -- so they mutually
+        exclude and no bump is clobbered.
+
+        Args:
+            pattern_id: Id of the existing pattern to merge into.
+            merge_fn: Callable taking the current on-disk pattern dict and
+                returning the merged record (dict, or any object exposing
+                to_dict()/__dict__). It must preserve the id. The dict it
+                receives is a fresh read performed under the lock.
+
+        Returns:
+            True if the pattern was found and the merged record written, False if
+            the pattern id was not present (caller should fall back to a create).
+        """
+        if not pattern_id:
+            return False
+
+        patterns_path = self.base_path / "semantic" / "patterns.json"
+
+        with self._file_lock(patterns_path, exclusive=True):
+            if not patterns_path.exists():
+                return False
+
+            with open(patterns_path, "r", encoding="utf-8") as f:
+                try:
+                    patterns_file = json.load(f)
+                except (json.JSONDecodeError, UnicodeDecodeError):
+                    return False
+
+            patterns = patterns_file.get("patterns", [])
+            target_idx = None
+            current = None
+            for i, p in enumerate(patterns):
+                if isinstance(p, dict) and p.get("id") == pattern_id:
+                    target_idx = i
+                    current = p
+                    break
+
+            if target_idx is None:
+                return False
+
+            # Caller merges against the fresh, lock-protected current record.
+            merged = merge_fn(current)
+            if hasattr(merged, "to_dict"):
+                merged_data = merged.to_dict()
+            elif hasattr(merged, "__dict__"):
+                merged_data = merged.__dict__.copy()
+            else:
+                merged_data = dict(merged)
+
+            # Never let a merge orphan the record by changing its id.
+            merged_data["id"] = pattern_id
+            merged_data["updated_at"] = datetime.now(timezone.utc).isoformat()
+            patterns_file["patterns"][target_idx] = merged_data
+            patterns_file["last_updated"] = datetime.now(timezone.utc).isoformat()
+
+            self._atomic_write(patterns_path, patterns_file)
+
+        return True
+
     # -------------------------------------------------------------------------
     # Skill Storage
     # -------------------------------------------------------------------------

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.94.0",
+  "version": "7.96.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.94.0",
+  "version": "7.96.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",