loki-mode 7.96.0 → 7.97.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v7.96.0
+# Loki Mode v7.97.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -408,4 +408,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v7.96.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**
+**v7.97.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~260 lines core**

package/VERSION

@@ -1 +1 @@
-7.96.0
+7.97.0

package/autonomy/hooks/migration-hooks.sh

@@ -162,7 +162,14 @@ hook_pre_file_edit() {
     [[ -z "$file_path" ]] && return 0
     local snap_base
     snap_base=$(_migration_snapshot_dir)
-    _heal_snapshot_save "$snap_base" "$file_path"
+    # Enforce the pairing contract: if the snapshot cannot be captured, BLOCK the
+    # edit. Proceeding would leave post_file_edit's block_and_rollback path with
+    # no snapshot to restore -- a test failure would then leave the broken edit
+    # in place (silent revert failure). Fail loud/closed here instead.
+    if ! _heal_snapshot_save "$snap_base" "$file_path"; then
+        echo "HOOK_BLOCKED: could not capture a pre-edit snapshot for ${file_path}; refusing to edit without a revert path. Check that ${snap_base}/snapshots is writable."
+        return 1
+    fi
     return 0
 }
 
@@ -418,7 +425,15 @@ print('OK')
     # Capture a pre-edit snapshot so post_healing_modify can revert ONLY the
     # healing edit on test failure (not unrelated uncommitted changes, and not
     # via git checkout which discards everything). Keyed by file path.
-    _heal_snapshot_save "$heal_dir" "$file_path"
+    #
+    # Enforce the pairing contract: if the snapshot cannot be captured, BLOCK the
+    # edit. Proceeding would leave the edit with no revert path -- a later test
+    # failure would then leave the broken edit in place while honestly reporting
+    # "no snapshot" (silent revert failure). Fail loud/closed here instead.
+    if ! _heal_snapshot_save "$heal_dir" "$file_path"; then
+        echo "HOOK_BLOCKED: could not capture a pre-edit snapshot for ${file_path}; refusing to modify it without a revert path. Check that ${heal_dir}/snapshots is writable."
+        return 1
+    fi
 
     return 0
 }
@@ -438,27 +453,63 @@ _heal_snapshot_path() {
 # healing edit will CREATE it), write a sentinel marker instead so the revert
 # path knows to remove the file rather than restore content.
 #
-# Pairing contract: hook_pre_healing_modify (which calls this) MUST run for a
-# file before hook_post_healing_modify reverts it. The snapshot is refreshed on
+# Pairing contract (ENFORCED, fail-closed): hook_pre_healing_modify (which calls
+# this) MUST run for a file before hook_post_healing_modify reverts it, AND that
+# pre call MUST leave behind a revertable snapshot. The snapshot is refreshed on
 # every pre call, so a post without a matching fresh pre could restore a stale
 # blob. On the success path the snapshot is intentionally left in place; the
 # next pre overwrites it.
+#
+# Returns 0 ONLY when a revertable snapshot demonstrably exists on disk after
+# this call: exactly one of {content snapshot, ".absent" marker}. Returns 1 on
+# ANY failure (cannot create the snapshot dir, cp/sentinel write failed, the
+# wrong marker survived, or both/neither markers exist). A 1 return MUST block
+# the edit at the caller -- otherwise the edit proceeds with no revert path and a
+# later test failure leaves the broken edit in place (the silent-revert-failure
+# this guard exists to prevent). NEVER return 0 on a failure path.
 _heal_snapshot_save() {
     local heal_dir="$1"
     local file_path="$2"
+    # Empty file_path: nothing to snapshot. Callers treat empty file_path as a
+    # no-op (return 0 before reaching here in the hooks); not a contract breach.
     [[ -z "$file_path" ]] && return 0
     local snap_dir="$heal_dir/snapshots"
-    mkdir -p "$snap_dir" 2>/dev/null || return 0
+    if ! mkdir -p "$snap_dir" 2>/dev/null || [[ ! -d "$snap_dir" ]]; then
+        return 1
+    fi
     local snap
     snap=$(_heal_snapshot_path "$heal_dir" "$file_path")
     if [[ -f "$file_path" ]]; then
-        cp "$file_path" "$snap" 2>/dev/null || return 0
-        rm -f "$snap.absent" 2>/dev/null || true
+        # Capture content, then drop any stale absent-marker so EXACTLY the
+        # content snapshot survives. Fail closed if either step fails.
+        if ! cp "$file_path" "$snap" 2>/dev/null; then
+            return 1
+        fi
+        if ! rm -f "$snap.absent" 2>/dev/null; then
+            return 1
+        fi
+        # Verify exactly the content snapshot exists and the absent-marker is
+        # gone. A lingering marker is a contract violation (restore checks the
+        # content snapshot first, but the inconsistency must not be tolerated).
+        if [[ ! -f "$snap" || -f "$snap.absent" ]]; then
+            return 1
+        fi
     else
         # File does not exist pre-edit: record an "absent" marker, drop any
-        # stale content snapshot.
-        rm -f "$snap" 2>/dev/null || true
-        : > "$snap.absent" 2>/dev/null || true
+        # stale content snapshot. CRITICAL: if the stale content snapshot is not
+        # removed, restore checks the content snapshot FIRST and would restore
+        # content for a file that should have been REMOVED. Fail closed if the
+        # stale snapshot cannot be cleared or the marker cannot be written.
+        if ! rm -f "$snap" 2>/dev/null; then
+            return 1
+        fi
+        if ! : > "$snap.absent" 2>/dev/null; then
+            return 1
+        fi
+        # Verify exactly the absent-marker exists and no content snapshot does.
+        if [[ ! -f "$snap.absent" || -f "$snap" ]]; then
+            return 1
+        fi
     fi
     return 0
 }

package/autonomy/run.sh

@@ -3801,6 +3801,82 @@ effective_session_cap() {
     return 0
 }
 
+# Auto-flag parity for parallel worktree Claude sessions (wave-5 fix).
+# The main RARV loop applies adaptive cost/resilience flags to its claude
+# invocation (run.sh:16007-16030 effort/max-budget/fallback) plus an MCP
+# bundle, but the parallel worktree spawn shipped a bare invocation that missed
+# them entirely. This populates the global _LOKI_WT_AUTO_FLAGS array with ONLY
+# the flags that are safe on the plain (non stream-json) worktree invocation:
+#   --effort           adaptive reasoning depth (dev tier)
+#   --max-budget-usd   per-call hard backstop
+#   --fallback-model   resilience to model overload/unavailability
+#   --mcp-config       (+ --strict-mcp-config) the same MCP bundle the Bun
+#                      route emits; a SUPERSET of the bash main loop, which does
+#                      NOT emit --mcp-config (see ledger run.sh:15990-15996).
+#                      Worktree dev streams benefit from the bundled MCP servers.
+# We deliberately do NOT replicate the stream-json-coupled flags
+# (--include-hook-events, --include-partial-messages) nor --output-format /
+# --session-id: this invocation logs free-form text, not parsed stream-json, so
+# those would be invalid or unwanted here. Each flag is gated on CLI support +
+# its opt-out env var, matching the main loop. Extracted from spawn_worktree_session
+# so it is unit-testable (tests/test-worktree-auto-flags.sh).
+_loki_build_worktree_claude_flags() {
+    _LOKI_WT_AUTO_FLAGS=()
+    # Non-claude providers never receive these flags.
+    if [ "${PROVIDER_NAME:-claude}" != "claude" ]; then
+        return 0
+    fi
+    # Dev-tier model param drives the fallback derivation (worktree streams are
+    # development work). Resolve via the provider helper when available.
+    local _loki_wt_primary=""
+    if type provider_get_tier_param >/dev/null 2>&1; then
+        _loki_wt_primary="$(provider_get_tier_param development 2>/dev/null || true)"
+    fi
+    if [ "${LOKI_AUTO_EFFORT:-on}" != "off" ] \
+       && type loki_effort_for_tier >/dev/null 2>&1 \
+       && type loki_claude_flag_supported >/dev/null 2>&1 \
+       && loki_claude_flag_supported "--effort"; then
+        local _loki_wt_effort
+        _loki_wt_effort="$(loki_effort_for_tier development "${DETECTED_COMPLEXITY:-${LOKI_COMPLEXITY:-standard}}")"
+        [ -n "$_loki_wt_effort" ] && _LOKI_WT_AUTO_FLAGS+=("--effort" "$_loki_wt_effort")
+    fi
+    if [ "${LOKI_AUTO_BUDGET:-on}" != "off" ] \
+       && type loki_remaining_budget >/dev/null 2>&1 \
+       && type loki_claude_flag_supported >/dev/null 2>&1 \
+       && loki_claude_flag_supported "--max-budget-usd"; then
+        local _loki_wt_rem
+        _loki_wt_rem="$(loki_remaining_budget)"
+        [ -n "$_loki_wt_rem" ] && _LOKI_WT_AUTO_FLAGS+=("--max-budget-usd" "$_loki_wt_rem")
+    fi
+    if [ "${LOKI_AUTO_FALLBACK:-on}" != "off" ] \
+       && [ -n "$_loki_wt_primary" ] \
+       && type loki_fallback_for_primary >/dev/null 2>&1 \
+       && type loki_claude_flag_supported >/dev/null 2>&1 \
+       && loki_claude_flag_supported "--fallback-model"; then
+        local _loki_wt_fb
+        _loki_wt_fb="$(loki_fallback_for_primary "$_loki_wt_primary")"
+        [ -n "$_loki_wt_fb" ] && _LOKI_WT_AUTO_FLAGS+=("--fallback-model" "$_loki_wt_fb")
+    fi
+    if type loki_mcp_config_argv >/dev/null 2>&1 \
+       && type loki_claude_flag_supported >/dev/null 2>&1 \
+       && loki_claude_flag_supported "--mcp-config"; then
+        local _loki_wt_mcp
+        if _loki_wt_mcp="$(loki_mcp_config_argv)" && [ -n "$_loki_wt_mcp" ]; then
+            _LOKI_WT_AUTO_FLAGS+=("--mcp-config")
+            local _loki_wt_mcp_path
+            for _loki_wt_mcp_path in $_loki_wt_mcp; do
+                _LOKI_WT_AUTO_FLAGS+=("$_loki_wt_mcp_path")
+            done
+            # --strict-mcp-config only alongside a real bundle, never bare.
+            if [ "${LOKI_STRICT_MCP:-1}" != "0" ] \
+               && loki_claude_flag_supported "--strict-mcp-config"; then
+                _LOKI_WT_AUTO_FLAGS+=("--strict-mcp-config")
+            fi
+        fi
+    fi
+    return 0
+}
+
 # Spawn a Claude session in a worktree
 spawn_worktree_session() {
     local stream_name="$1"
@@ -3843,6 +3919,11 @@ spawn_worktree_session() {
 
     log_step "Spawning ${PROVIDER_DISPLAY_NAME:-Claude} session: $stream_name"
 
+    # Build the worktree auto-flag set (effort/max-budget/fallback/mcp-config)
+    # BEFORE the ( subshell so it is inherited (a `bash -c` would not). Populates
+    # the global _LOKI_WT_AUTO_FLAGS array. See _loki_build_worktree_claude_flags.
+    _loki_build_worktree_claude_flags
+
     (
         cd "$worktree_path" || exit 1
         _wt_exit=0
@@ -3858,12 +3939,17 @@ spawn_worktree_session() {
                 if type loki_caveman_activate_env >/dev/null 2>&1; then
                     _loki_wt_cm="$(loki_caveman_activate_env)"
                 fi
+                # Expand the auto-flag array with the bash-3.2 empty-array guard
+                # (${arr[@]+...}) so a bare "${arr[@]}" under set -u does not
+                # abort with "unbound variable" when no flags were collected.
                 if [ -n "$_loki_wt_cm" ]; then
                     CAVEMAN_DEFAULT_MODE="$_loki_wt_cm" claude --dangerously-skip-permissions \
+                        "${_LOKI_WT_AUTO_FLAGS[@]+"${_LOKI_WT_AUTO_FLAGS[@]}"}" \
                         -p "Loki Mode: $task_prompt. Read .loki/CONTINUITY.md for context." \
                         >> "$log_file" 2>&1 || _wt_exit=$?
                 else
                     claude --dangerously-skip-permissions \
+                        "${_LOKI_WT_AUTO_FLAGS[@]+"${_LOKI_WT_AUTO_FLAGS[@]}"}" \
                         -p "Loki Mode: $task_prompt. Read .loki/CONTINUITY.md for context." \
                         >> "$log_file" 2>&1 || _wt_exit=$?
                 fi

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "7.96.0"
+__version__ = "7.97.0"
 
 # Expose the control app for easy import
 try:

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v7.96.0
+**Version:** v7.97.0
 
 ---
 

package/events/bus.py

@@ -130,6 +130,16 @@ class LokiEvent:
         # dedup (_processed_ids + pending-file glob) and re-importing every flat
         # line on each call. Derive a DETERMINISTIC id from the record content
         # so repeated imports of the same line are idempotent.
+        #
+        # Width: the digest source is user-controllable (timestamp + type +
+        # payload). An 8-hex-char (32-bit) truncation collides at the birthday
+        # bound around ~77k distinct events (sqrt(2^32)); a collision makes two
+        # DISTINCT events share an id, so dedup (_processed_ids + pending glob)
+        # silently DROPS the second event. Widen to 16 hex chars (64 bits) so
+        # the collision bound moves to ~4 billion distinct events -- well past
+        # any realistic events.jsonl. This deterministic-derivation path is
+        # Python-only (bus.ts has no jsonl import and mints a random id when one
+        # is absent), so widening here needs no cross-language parity change.
         event_id = data.get('id', '')
         if not event_id:
             digest_src = '%s|%s|%s' % (
@@ -137,7 +147,7 @@ class LokiEvent:
                 raw_type,
                 json.dumps(payload, sort_keys=True),
             )
-            event_id = hashlib.sha1(digest_src.encode('utf-8')).hexdigest()[:8]
+            event_id = hashlib.sha1(digest_src.encode('utf-8')).hexdigest()[:16]
 
         return cls(
             id=event_id,

package/events/emit.sh

@@ -119,16 +119,27 @@ fi
 
 # JSON escape helper: handles \, ", and control characters including newlines
 #
-# The sed pass escapes the named short forms (\\ \" \t \r \b \f); the first awk
-# pass collapses embedded newlines to \n. Any OTHER C0 control byte
-# (0x01-0x07, 0x0B, 0x0E-0x1F) is invalid raw inside a JSON string and is
-# escaped as \uXXXX by the final awk pass -- otherwise json.loads / JSON.parse
-# reject the line and consumers (dashboard _read_events, learning aggregator)
-# silently drop it. The named short forms are already two-char ASCII by the
-# time the final pass runs, so they are never re-escaped.
+# The sed pass escapes backslash, double-quote, tab and carriage-return to
+# their named short forms (\\ \" \t \r); the first awk pass collapses embedded
+# newlines to \n. Every REMAINING C0 control byte (0x01-0x08, 0x0B-0x0C,
+# 0x0E-0x1F -- which includes backspace 0x08 and form-feed 0x0C) is invalid raw
+# inside a JSON string and is escaped as \uXXXX by the final awk pass (its map
+# covers all of i=1..31). Without that escaping json.loads / JSON.parse reject
+# the line and consumers (dashboard _read_events, learning aggregator) silently
+# drop it. The named short forms emitted by sed are already two-char ASCII by
+# the time the final pass runs, so they are never re-escaped.
+#
+# NOTE: backspace/form-feed are deliberately NOT escaped in the sed pass.
+# Doing so requires embedding the raw control bytes in the sed pattern, which
+# editors silently strip -- that left the two empty-pattern sed no-ops this
+# helper previously carried. An empty sed regex reuses the LAST applied regex,
+# so those entries were dead AND a latent corruption hazard. The final awk
+# pass already escapes every byte in i=1..31 (backspace and form-feed included)
+# to the six-char uXXXX unicode escape, producing valid JSON, so the
+# named-short-form variants are unnecessary.
 json_escape() {
     printf '%s' "$1" \
-        | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g; s/\r/\\r/g; s//\\b/g; s//\\f/g' \
+        | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g; s/\r/\\r/g' \
         | awk '{if(NR>1) printf "\\n"; printf "%s", $0}' \
         | awk 'BEGIN{for(i=1;i<=31;i++)m[sprintf("%c",i)]=sprintf("\\u%04x",i)}
                {s=""; n=length($0);
@@ -163,9 +174,23 @@ EVENT=$(cat <<EOF
 EOF
 )
 
-# Write event file
+# Write event file atomically.
+#
+# A bare `echo "$EVENT" > "$EVENT_FILE"` is NON-atomic: a reader (bus.py
+# get_pending_events / from_dict, dashboard) that globs `*.json` mid-write sees
+# a truncated/partial file and either fails json.loads (event silently dropped)
+# or, worse, reads a half-written record. Write to a sibling temp file in the
+# SAME directory (so rename(2) is an atomic same-filesystem operation) and then
+# rename into place; a `.tmp` suffix keeps the in-progress file out of the
+# `*.json` glob readers use. Clean up the temp on any failure so partials never
+# linger.
 EVENT_FILE="$EVENTS_DIR/${TIMESTAMP//:/-}_$EVENT_ID.json"
-echo "$EVENT" > "$EVENT_FILE"
+EVENT_TMP="$EVENT_FILE.tmp"
+if printf '%s\n' "$EVENT" > "$EVENT_TMP" && mv -f "$EVENT_TMP" "$EVENT_FILE"; then
+    :
+else
+    rm -f "$EVENT_TMP" 2>/dev/null || true
+fi
 
 # Rotate events.jsonl if it exceeds 50MB (keep 1 backup)
 EVENTS_LOG="$LOKI_DIR/events.jsonl"

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var z8=Object.defineProperty;var X8=($)=>$;function K8($,Q){this[$]=X8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)z8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:K8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var y1={};b(y1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as t,dirname as i$}from"path";import{fileURLToPath as q8}from"url";import{existsSync as E$}from"fs";import{homedir as J8}from"os";function V8(){let $=h1;for(let Q=0;Q<6;Q++){if(E$(t($,"VERSION"))&&E$(t($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return t(h1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(E$(t(Q,"VERSION"))&&E$(t(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function P(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(J8(),".loki")}var h1,h;var C=L(()=>{h1=i$(q8(import.meta.url));h=V8()});import{readFileSync as W8}from"fs";import{resolve as U8,dirname as H8}from"path";import{fileURLToPath as G8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.96.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=H8(G8(import.meta.url)),Z=e$(Q);Q$=W8(U8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var u1={};b(u1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>f1,commandVersion:()=>N8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>m1});async function f1($,Q=m1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([f1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=E8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function E8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function N8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var m1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return S8?"":$}var S8,T,S,_,lZ,I,k,y,J;var c=L(()=>{S8=(process.env.NO_COLOR??"").length>0;T=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),lZ=r("\x1B[0;34m"),I=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as u8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(u8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var q0={};b(q0,{runStatus:()=>W3});import{existsSync as v,readFileSync as U$,readdirSync as i1,statSync as e1}from"fs";import{resolve as D,basename as $3}from"path";import{homedir as Q3}from"os";function $0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Q0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=$0($),U=$0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function z3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
+var z8=Object.defineProperty;var X8=($)=>$;function K8($,Q){this[$]=X8.bind(null,Q)}var b=($,Q)=>{for(var Z in Q)z8($,Z,{get:Q[Z],enumerable:!0,configurable:!0,set:K8.bind(Q,Z)})};var L=($,Q)=>()=>($&&(Q=$($=0)),Q);var J$=import.meta.require;var y1={};b(y1,{lokiDir:()=>P,homeLokiDir:()=>T$,findRepoRootForVersion:()=>e$,REPO_ROOT:()=>h});import{resolve as t,dirname as i$}from"path";import{fileURLToPath as q8}from"url";import{existsSync as E$}from"fs";import{homedir as J8}from"os";function V8(){let $=h1;for(let Q=0;Q<6;Q++){if(E$(t($,"VERSION"))&&E$(t($,"autonomy/run.sh")))return $;let Z=i$($);if(Z===$)break;$=Z}return t(h1,"..","..","..")}function e$($){let Q=$;for(let Z=0;Z<6;Z++){if(E$(t(Q,"VERSION"))&&E$(t(Q,"autonomy/run.sh")))return Q;let z=i$(Q);if(z===Q)break;Q=z}return t($,"..","..","..")}function P(){return process.env.LOKI_DIR??t(process.cwd(),".loki")}function T$(){return t(J8(),".loki")}var h1,h;var C=L(()=>{h1=i$(q8(import.meta.url));h=V8()});import{readFileSync as W8}from"fs";import{resolve as U8,dirname as H8}from"path";import{fileURLToPath as G8}from"url";function N$(){if(Q$!==null)return Q$;let $="7.97.0";if(typeof $==="string"&&$.length>0)return Q$=$,Q$;try{let Q=H8(G8(import.meta.url)),Z=e$(Q);Q$=W8(U8(Z,"VERSION"),"utf-8").trim()}catch{Q$="unknown"}return Q$}var Q$=null;var $1=L(()=>{C()});var u1={};b(u1,{runOrThrow:()=>x8,run:()=>F,readStreamCapped:()=>f1,commandVersion:()=>N8,commandExists:()=>f,ShellError:()=>Q1,MAX_STDOUT_BYTES:()=>m1});async function f1($,Q=m1){let Z=$.getReader(),z=new TextDecoder,X="",q=0;try{while(q<Q){let{done:K,value:W}=await Z.read();if(K)break;if(!W)continue;if(q+=W.byteLength,q>Q){let V=W.byteLength-(q-Q);X+=z.decode(W.subarray(0,V),{stream:!0});break}X+=z.decode(W,{stream:!0})}X+=z.decode()}finally{try{await Z.cancel()}catch{}Z.releaseLock()}return X}async function F($,Q={}){let Z=Bun.spawn({cmd:[...$],stdout:"pipe",stderr:"pipe",env:Q.env?{...process.env,...Q.env}:process.env,cwd:Q.cwd}),z,X;if(Q.timeoutMs&&Q.timeoutMs>0)z=setTimeout(()=>{try{Z.kill("SIGTERM")}catch{}X=setTimeout(()=>{try{Z.kill("SIGKILL")}catch{}},2000)},Q.timeoutMs);try{let[q,K,W]=await Promise.all([f1(Z.stdout),new Response(Z.stderr).text(),Z.exited]);return{stdout:q,stderr:K,exitCode:W}}finally{if(z)clearTimeout(z);if(X)clearTimeout(X)}}async function x8($,Q={}){let Z=await F($,Q);if(Z.exitCode!==0)throw new Q1(`command failed (${Z.exitCode}): ${$.join(" ")}`,Z.exitCode,Z.stdout,Z.stderr);return Z}async function f($){let Q=E8($),Z=await F(["sh","-c",`command -v ${Q}`],{timeoutMs:5000});if(Z.exitCode===0)return Z.stdout.trim()||null;return null}function E8($){if(!/^[A-Za-z0-9._/-]+$/.test($))throw Error(`refused to shell-escape suspect token: ${$}`);return $}async function N8($,Q="--version"){if(!await f($))return null;let z=await F([$,Q],{timeoutMs:5000});if(z.exitCode!==0)return null;return((z.stdout||z.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var m1=16777216,Q1;var d=L(()=>{Q1=class Q1 extends Error{message;exitCode;stdout;stderr;constructor($,Q,Z,z){super($);this.message=$;this.exitCode=Q;this.stdout=Z;this.stderr=z;this.name="ShellError"}}});function r($){return S8?"":$}var S8,T,S,_,lZ,I,k,y,J;var c=L(()=>{S8=(process.env.NO_COLOR??"").length>0;T=r("\x1B[0;31m"),S=r("\x1B[0;32m"),_=r("\x1B[1;33m"),lZ=r("\x1B[0;34m"),I=r("\x1B[0;36m"),k=r("\x1B[1m"),y=r("\x1B[2m"),J=r("\x1B[0m")});import{existsSync as u8}from"fs";async function Z$(){if(A$!==void 0)return A$;let $="/opt/homebrew/bin/python3.12";if(u8($))return A$=$,$;let Q=await f("python3.12");if(Q)return A$=Q,Q;let Z=await f("python3");return A$=Z,Z}async function z$($,Q={}){let Z=await Z$();if(!Z)return{stdout:"",stderr:"python3 not found",exitCode:127};return F([Z,"-c",$],Q)}var A$;var V$=L(()=>{d()});var q0={};b(q0,{runStatus:()=>W3});import{existsSync as v,readFileSync as U$,readdirSync as i1,statSync as e1}from"fs";import{resolve as D,basename as $3}from"path";import{homedir as Q3}from"os";function $0($){let Q=Math.trunc($);if(Q>=1e6)return`${(Math.trunc(Q/1e6*10)/10).toFixed(1)}M`;if(Q>=1000)return`${(Math.trunc(Q/1000*10)/10).toFixed(1)}K`;return String(Q)}function Q0($,Q,Z){if(Q===0)return null;let z=Math.trunc($*100/Q),X=Math.trunc($*D$/Q);if(X>D$)X=D$;let q=D$-X,K=S;if(z>=80)K=T;else if(z>=50)K=_;let W="=".repeat(Math.max(0,X))+" ".repeat(Math.max(0,q)),V=$0($),U=$0(Q);return`  ${k}${Z}${J} ${K}[${W}]${J} ${z}% (${V} / ${U})`}async function z3(){if(await f("jq"))return!0;return process.stdout.write(`${T}Error: jq is required but not installed.${J}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -802,4 +802,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}default:return process.stderr.write(`Unknown command: ${Q}
 `),process.stderr.write(Z8),2}}r1();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var FZ=await jZ(Bun.argv.slice(2));process.exit(FZ);
 
-//# debugId=E60A742D72C38FD764756E2164756E21
+//# debugId=ABBB64E42A394DE264756E2164756E21

package/mcp/__init__.py

@@ -57,4 +57,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '7.96.0'
+__version__ = '7.97.0'

package/memory/engine.py

@@ -1034,6 +1034,39 @@ class MemoryEngine:
 
         return None
 
+    @staticmethod
+    def _parse_optional_datetime(
+        raw: Any, *, record_id: str = "<unknown>", field: str = "last_accessed"
+    ) -> Optional[datetime]:
+        """Tolerantly parse an optional ISO datetime field off a stored record.
+
+        A corrupt/non-ISO value on ONE record must not raise out of the
+        _dict_to_* converters and crash the whole batch list-comp in
+        get_recent_episodes / find_patterns / list_skills (which would drop EVERY
+        item in the scan, not just the bad one) on the RARV retrieval hot path.
+        An unparseable value falls back to None (treated as never-accessed) so
+        the record is still returned and retrievable.
+
+        Returns a tz-aware datetime (UTC assumed when naive), or None when the
+        value is missing/empty/unparseable.
+        """
+        if not raw:
+            return None
+        if isinstance(raw, datetime):
+            return raw.replace(tzinfo=timezone.utc) if raw.tzinfo is None else raw
+        if isinstance(raw, str):
+            value = raw[:-1] if raw.endswith("Z") else raw
+            try:
+                parsed = datetime.fromisoformat(value)
+            except ValueError:
+                logger.warning(
+                    "Record %s has unparseable %s %r; treating as never-accessed",
+                    record_id, field, raw,
+                )
+                return None
+            return parsed.replace(tzinfo=timezone.utc) if parsed.tzinfo is None else parsed
+        return None
+
     def _dict_to_episode(self, data: Dict[str, Any]) -> EpisodeTrace:
         """Convert dictionary to EpisodeTrace."""
         # Parse timestamp string to datetime
@@ -1081,20 +1114,13 @@ class MemoryEngine:
             for e in errors_raw
         ]
 
-        # Parse last_accessed datetime
-        last_accessed = None
-        last_accessed_raw = data.get("last_accessed")
-        if last_accessed_raw:
-            if isinstance(last_accessed_raw, str):
-                if last_accessed_raw.endswith("Z"):
-                    last_accessed_raw = last_accessed_raw[:-1]
-                last_accessed = datetime.fromisoformat(last_accessed_raw)
-                if last_accessed.tzinfo is None:
-                    last_accessed = last_accessed.replace(tzinfo=timezone.utc)
-            elif isinstance(last_accessed_raw, datetime):
-                last_accessed = last_accessed_raw
-                if last_accessed.tzinfo is None:
-                    last_accessed = last_accessed.replace(tzinfo=timezone.utc)
+        # Parse last_accessed datetime (tolerant: a corrupt value falls back to
+        # None so a single bad episode never crashes the retrieval batch).
+        last_accessed = self._parse_optional_datetime(
+            data.get("last_accessed"),
+            record_id=data.get("id", "<unknown>"),
+            field="last_accessed",
+        )
 
         return EpisodeTrace(
             id=data.get("id", ""),
@@ -1119,21 +1145,14 @@ class MemoryEngine:
 
     def _dict_to_pattern(self, data: Dict[str, Any]) -> SemanticPattern:
         """Convert dictionary to SemanticPattern."""
-        # Parse last_used string to datetime or None
-        last_used = None
-        last_used_raw = data.get("last_used")
-        if last_used_raw:
-            if isinstance(last_used_raw, str):
-                # Handle ISO format with Z suffix
-                if last_used_raw.endswith("Z"):
-                    last_used_raw = last_used_raw[:-1]
-                last_used = datetime.fromisoformat(last_used_raw)
-                if last_used.tzinfo is None:
-                    last_used = last_used.replace(tzinfo=timezone.utc)
-            elif isinstance(last_used_raw, datetime):
-                last_used = last_used_raw
-                if last_used.tzinfo is None:
-                    last_used = last_used.replace(tzinfo=timezone.utc)
+        # Parse last_used string to datetime or None (tolerant: a corrupt value
+        # on one pattern must not crash the find_patterns retrieval batch; it
+        # shares the same hot path and crash mechanism as last_accessed below).
+        last_used = self._parse_optional_datetime(
+            data.get("last_used"),
+            record_id=data.get("id", "<unknown>"),
+            field="last_used",
+        )
 
         # Convert links dicts to Link objects
         links_raw = data.get("links", [])
@@ -1142,20 +1161,12 @@ class MemoryEngine:
             for link in links_raw
         ]
 
-        # Parse last_accessed datetime
-        last_accessed = None
-        last_accessed_raw = data.get("last_accessed")
-        if last_accessed_raw:
-            if isinstance(last_accessed_raw, str):
-                if last_accessed_raw.endswith("Z"):
-                    last_accessed_raw = last_accessed_raw[:-1]
-                last_accessed = datetime.fromisoformat(last_accessed_raw)
-                if last_accessed.tzinfo is None:
-                    last_accessed = last_accessed.replace(tzinfo=timezone.utc)
-            elif isinstance(last_accessed_raw, datetime):
-                last_accessed = last_accessed_raw
-                if last_accessed.tzinfo is None:
-                    last_accessed = last_accessed.replace(tzinfo=timezone.utc)
+        # Parse last_accessed datetime (tolerant: see _dict_to_episode).
+        last_accessed = self._parse_optional_datetime(
+            data.get("last_accessed"),
+            record_id=data.get("id", "<unknown>"),
+            field="last_accessed",
+        )
 
         return SemanticPattern(
             id=data.get("id", ""),
@@ -1182,20 +1193,12 @@ class MemoryEngine:
             for e in raw_errors
         ]
 
-        # Parse last_accessed datetime
-        last_accessed = None
-        last_accessed_raw = data.get("last_accessed")
-        if last_accessed_raw:
-            if isinstance(last_accessed_raw, str):
-                if last_accessed_raw.endswith("Z"):
-                    last_accessed_raw = last_accessed_raw[:-1]
-                last_accessed = datetime.fromisoformat(last_accessed_raw)
-                if last_accessed.tzinfo is None:
-                    last_accessed = last_accessed.replace(tzinfo=timezone.utc)
-            elif isinstance(last_accessed_raw, datetime):
-                last_accessed = last_accessed_raw
-                if last_accessed.tzinfo is None:
-                    last_accessed = last_accessed.replace(tzinfo=timezone.utc)
+        # Parse last_accessed datetime (tolerant: see _dict_to_episode).
+        last_accessed = self._parse_optional_datetime(
+            data.get("last_accessed"),
+            record_id=data.get("id", "<unknown>"),
+            field="last_accessed",
+        )
 
         return ProceduralSkill(
             id=data.get("id", ""),

package/memory/rag_injector.py

@@ -9,10 +9,66 @@ for injection into the RARV prompt cycle.
 
 import argparse
 import json
+import re
 import sys
 from pathlib import Path
 
 
+# Per-field hard cap so a single oversized/garbage memory entry cannot dominate
+# the injected context or push real signal out of the token budget.
+_MAX_FIELD_CHARS = 600
+
+# Control characters (excluding ordinary whitespace handled separately) that
+# must never reach the prompt: they can corrupt rendering or smuggle hidden
+# directives. Covers C0 controls and DEL.
+_CONTROL_CHARS_RE = re.compile(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]")
+
+
+def _sanitize_field(value, max_chars=_MAX_FIELD_CHARS):
+    """Neutralize a single field from stored memory before it enters a prompt.
+
+    Memory entries are untrusted input: a malicious or garbage pattern could
+    contain prompt-injection payloads (fake instructions, fabricated section
+    headers, code-fence breakers, or directives that try to override the RARV
+    prompt). This collapses each field to a single safe inline line so it can
+    only ever read as data, never as structure or instructions.
+
+    Steps:
+    - Coerce non-strings to str (a dict/list value would otherwise break
+      formatting or interpolate unexpected structure).
+    - Drop control characters (keeps the visible text intact).
+    - Collapse ALL newlines/tabs/carriage-returns to single spaces so the
+      field cannot add new lines, fake "### " section headers, close the
+      knowledge block, or open/close a markdown code fence.
+    - Defang leading structural markdown markers (#, >, -, *, backticks) so the
+      field cannot pose as a heading/list/fence even after collapsing.
+    - Truncate to a bounded length.
+    """
+    if value is None:
+        return ''
+    if not isinstance(value, str):
+        value = str(value)
+    # Remove control characters first.
+    value = _CONTROL_CHARS_RE.sub('', value)
+    # Collapse any vertical whitespace and tabs into single spaces. This is the
+    # core injection defense: without newlines the field cannot introduce new
+    # markdown structure or standalone instruction lines.
+    value = re.sub(r'[\r\n\t]+', ' ', value)
+    # Collapse runs of spaces left behind.
+    value = re.sub(r' {2,}', ' ', value).strip()
+    # Defang leading structural markdown so the field cannot masquerade as a
+    # heading, blockquote, list item, or code fence.
+    value = re.sub(r'^[#>\-*`]+\s*', '', value)
+    # Defang markdown header markers anywhere in the (now single-line) value so
+    # a collapsed payload cannot reintroduce a "### " section marker inline.
+    # Backticks are neutralized too so a field cannot open/close a code fence.
+    value = re.sub(r'#{1,6}\s', '', value)
+    value = value.replace('`', '')
+    if len(value) > max_chars:
+        value = value[:max_chars].rstrip() + '...'
+    return value
+
+
 def build_rag_context(query, max_tokens=2000, knowledge_dir=None):
     """Build RAG context from the knowledge graph.
 
@@ -39,11 +95,20 @@ def build_rag_context(query, max_tokens=2000, knowledge_dir=None):
     total_chars = 0
 
     for p in patterns:
-        # Support both 'name'/'pattern' and 'description' fields
-        name = p.get('name', p.get('pattern', 'Unknown Pattern'))
-        desc = p.get('description', p.get('correct_approach', ''))
-        category = p.get('category', '')
-        source = p.get('_source_project', '')
+        # Support both 'name'/'pattern' and 'description' fields.
+        # Every field is sanitized: memory entries are untrusted input and must
+        # not be able to inject instructions or break the prompt structure.
+        name = _sanitize_field(p.get('name', p.get('pattern', 'Unknown Pattern')))
+        desc = _sanitize_field(p.get('description', p.get('correct_approach', '')))
+        category = _sanitize_field(p.get('category', ''))
+        source_raw = p.get('_source_project', '')
+        # Path().name strips any directory traversal; sanitize the basename too.
+        source = _sanitize_field(Path(str(source_raw)).name) if source_raw else ''
+
+        # name may be empty after sanitization (e.g. a field that was only
+        # markdown markers); fall back so the heading is never blank.
+        if not name:
+            name = 'Unknown Pattern'
 
         section = '### ' + name
         if category:
@@ -52,7 +117,7 @@ def build_rag_context(query, max_tokens=2000, knowledge_dir=None):
         if desc:
             section += desc + '\n'
         if source:
-            section += '_Source: ' + Path(source).name + '_\n'
+            section += '_Source: ' + source + '_\n'
 
         if total_chars + len(section) > max_chars:
             break

package/memory/retrieval.py

@@ -269,6 +269,7 @@ class MemoryRetrieval:
         vector_indices: Optional[Dict[str, VectorIndex]] = None,
         base_path: str = ".loki/memory",
         namespace: Optional[str] = None,
+        include_unstamped_legacy: bool = False,
     ):
         """
         Initialize the memory retrieval system.
@@ -279,12 +280,20 @@ class MemoryRetrieval:
             vector_indices: Optional dict of vector indices (episodic, semantic, skills)
             base_path: Base path for memory storage directory
             namespace: Optional namespace for scoped retrieval
+            include_unstamped_legacy: Opt-in escape hatch. When False (the
+                secure default), legacy entries that lack a "_namespace" stamp
+                are EXCLUDED from a namespaced query. This prevents a silent
+                cross-namespace leak where one project reads another project's
+                unstamped memory. Set True only when migrating a single-project
+                store whose entries predate namespace stamping and you have
+                verified every entry belongs to the active namespace.
         """
         self.storage = storage
         self.embedding_engine = embedding_engine
         self.vector_indices = vector_indices or {}
         self.base_path = Path(base_path)
         self._namespace = namespace
+        self._include_unstamped_legacy = include_unstamped_legacy
         # Track when indices were last built to detect staleness (BUG-MEM-002).
         # When consolidation modifies patterns, indices become stale and should
         # be rebuilt before the next similarity search.
@@ -318,25 +327,45 @@ class MemoryRetrieval:
         Behavior:
         - If self._namespace is None, accept all (backward compat for unscoped retrieval).
         - If result has "_namespace" matching, accept.
-        - If result lacks "_namespace" (legacy entry written before stamping),
-          log a deprecation warning (rate-limited) and ACCEPT for backward compat.
-        - Otherwise, reject.
+        - If result lacks "_namespace" (legacy entry written before stamping):
+          treat it conservatively. An unstamped entry has no provable origin,
+          so under a namespaced query it could belong to ANY namespace and
+          including it is a silent cross-namespace leak (one project reading
+          another's memory). By default (self._include_unstamped_legacy is
+          False) such entries are EXCLUDED, with a rate-limited warning telling
+          operators to re-save the entry to add a stamp. Operators who have
+          verified a single-project store predates stamping can opt back in via
+          include_unstamped_legacy=True.
+        - Otherwise (stamp present but does not match), reject.
         """
         if self._namespace is None:
             return True
         result_ns = result.get("_namespace")
         if result_ns is None:
-            # Legacy entry without namespace stamp; accept for backward compat
-            # but warn so operators can re-save to add stamps.
+            # Legacy entry without namespace stamp. No provable origin -> do not
+            # silently leak it across namespaces. Exclude by default; warn so
+            # operators can re-save to add a stamp (rate-limited to avoid spam).
             if MemoryRetrieval._legacy_warned_count < MemoryRetrieval._LEGACY_WARN_LIMIT:
-                logger.warning(
-                    "Memory entry id=%s lacks '_namespace' stamp (legacy "
-                    "entry). Including in results for backward compatibility. "
-                    "Re-save this entry to enable namespace isolation.",
-                    result.get("id", "<unknown>"),
-                )
+                if self._include_unstamped_legacy:
+                    logger.warning(
+                        "Memory entry id=%s lacks '_namespace' stamp (legacy "
+                        "entry). Including under namespace=%s because "
+                        "include_unstamped_legacy is set. Re-save this entry to "
+                        "stamp it and remove the opt-in.",
+                        result.get("id", "<unknown>"),
+                        self._namespace,
+                    )
+                else:
+                    logger.warning(
+                        "Memory entry id=%s lacks '_namespace' stamp (legacy "
+                        "entry). Excluding from namespace=%s query to prevent a "
+                        "cross-namespace leak. Re-save this entry to stamp it, "
+                        "or pass include_unstamped_legacy=True to opt in.",
+                        result.get("id", "<unknown>"),
+                        self._namespace,
+                    )
                 MemoryRetrieval._legacy_warned_count += 1
-            return True
+            return self._include_unstamped_legacy
         return result_ns == self._namespace
 
     def with_namespace(self, namespace: str) -> "MemoryRetrieval":
@@ -361,6 +390,7 @@ class MemoryRetrieval:
             vector_indices=self.vector_indices,
             base_path=str(self.base_path),
             namespace=namespace,
+            include_unstamped_legacy=self._include_unstamped_legacy,
         )
 
     # -------------------------------------------------------------------------

package/memory/storage.py

@@ -33,6 +33,29 @@ except ImportError:
 # Default namespace constant
 DEFAULT_NAMESPACE = "default"
 
+# Allowed namespace characters. A namespace becomes a single path segment under
+# the memory root, so it must not contain separators, traversal, or whitespace.
+_NAMESPACE_RE = re.compile(r'^[a-zA-Z0-9_-]+$')
+
+
+def _validate_namespace_charset(namespace: str) -> None:
+    """Reject a namespace whose characters could escape its directory.
+
+    Charset-only check, shared by ``__init__`` and ``with_namespace`` so the two
+    validation sites cannot drift. Callers are responsible for deciding whether a
+    None/empty namespace is acceptable (it is in ``__init__`` for backward
+    compat; it is rejected in ``with_namespace``); this only runs once a concrete
+    non-default namespace string is present.
+
+    Raises:
+        ValueError: If the namespace contains anything outside [A-Za-z0-9_-].
+    """
+    if not _NAMESPACE_RE.match(namespace):
+        raise ValueError(
+            f"Invalid namespace '{namespace}': "
+            "only alphanumeric characters, hyphens, and underscores are allowed"
+        )
+
 
 class MemoryStorage:
     """
@@ -73,14 +96,11 @@ class MemoryStorage:
         self._root_path = Path(effective_base)
         self._namespace = namespace
 
-        # Validate namespace to prevent path traversal
+        # Validate namespace to prevent path traversal. None/empty is accepted
+        # here for backward compat (it selects the default, un-namespaced root);
+        # only a concrete non-default namespace is charset-checked.
         if namespace and namespace != DEFAULT_NAMESPACE:
-            import re
-            if not re.match(r'^[a-zA-Z0-9_-]+$', namespace):
-                raise ValueError(
-                    f"Invalid namespace '{namespace}': "
-                    "only alphanumeric characters, hyphens, and underscores are allowed"
-                )
+            _validate_namespace_charset(namespace)
 
         # Calculate effective base path (with namespace if specified)
         if namespace and namespace != DEFAULT_NAMESPACE:
@@ -119,15 +139,21 @@ class MemoryStorage:
             New MemoryStorage instance for the specified namespace
 
         Raises:
-            ValueError: If namespace contains path traversal characters
-        """
-        import re
-        if namespace and namespace != DEFAULT_NAMESPACE:
-            if not re.match(r'^[a-zA-Z0-9_-]+$', namespace):
-                raise ValueError(
-                    f"Invalid namespace '{namespace}': "
-                    "only alphanumeric characters, hyphens, and underscores are allowed"
-                )
+            ValueError: If namespace is empty/None/non-string, or contains
+                characters outside [A-Za-z0-9_-] (path-traversal defense).
+        """
+        # with_namespace is an explicit "switch to this namespace" call, so an
+        # empty, None, whitespace-only, or non-string namespace is meaningless
+        # and must be rejected rather than silently resolving to the default
+        # root (which is what __init__ would do with a falsy namespace). Reject,
+        # do not normalize: normalization would mask a caller bug.
+        if not isinstance(namespace, str) or not namespace.strip():
+            raise ValueError(
+                f"Invalid namespace {namespace!r}: "
+                "must be a non-empty string"
+            )
+        if namespace != DEFAULT_NAMESPACE:
+            _validate_namespace_charset(namespace)
         return MemoryStorage(
             base_path=str(self._root_path),
             namespace=namespace,
@@ -1328,9 +1354,20 @@ class MemoryStorage:
                 base = min(1.0, base + 0.05 * min(len(errors), 3))
 
         # Access frequency boost (diminishing returns).
-        # `or 0` guards against an explicit null access_count crashing the
-        # comparison and log1p call below.
+        # `or 0` guards an explicit null access_count; the isinstance/`< 0`
+        # clamp additionally guards a non-numeric (e.g. a stored "5") or negative
+        # value (corrupt or hand-edited record) reaching the `> 0` comparison and
+        # log1p() below. A bare string raises TypeError on `"5" > 0`, and a
+        # negative <= -1 raises a math domain error in log1p; bool is excluded so
+        # a stray True is not treated as a count of 1. All coerce to 0 (no boost)
+        # so importance scoring never crashes the scan.
         access_count = memory.get("access_count") or 0
+        if (
+            not isinstance(access_count, (int, float))
+            or isinstance(access_count, bool)
+            or access_count < 0
+        ):
+            access_count = 0
         if access_count > 0:
             # Log scale boost, caps at about 0.15 for 100+ accesses
             access_boost = 0.05 * math.log1p(access_count)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "7.96.0",
+  "version": "7.97.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "7.96.0",
+  "version": "7.97.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",