loki-mode 8.10.0 → 8.12.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v8.10.0
+# Loki Mode v8.12.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -469,4 +469,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v8.10.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v8.12.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-8.10.0
+8.12.0

package/agents/hub_install.py

@@ -31,6 +31,18 @@ SECURITY MODEL
         ignored, never run, and their presence is reported)
       - manifests that are not the declared kind
 
+WHAT AN INSTALLED AGENT DOES
+    An installed agent is not inert metadata. Beyond `loki agent
+    list/info/run`, it joins the code-review reviewer pool: its `focus`
+    entries act as trigger keywords scored against the diff, and on a match
+    it is dispatched as a real reviewer whose findings feed the same
+    Critical/High = BLOCK mechanism as a built-in. Selection is strictly
+    ADDITIVE -- installed agents are appended after the built-in battery and
+    can never displace a built-in reviewer, and at most 2 fire per review.
+    Consistent with the security model above, only manifest TEXT (persona /
+    focus / capabilities) reaches the reviewer prompt; nothing is executed.
+    See skills/quality-gates.md "Adding Your Own Reviewer".
+
 STORE LAYOUT (project-local, under .loki/)
     .loki/agents/installed.json      list of installed agent manifests
     .loki/templates/<name>.md        installed template body

package/autonomy/run.sh

@@ -657,16 +657,29 @@ loki_detect_scoped_change() {
 
     # Greenfield is not a scoped change: no repo, or a repo with almost no
     # history, means we are building something new.
+    #
+    # Ask git whether this is a work tree rather than testing for a .git
+    # DIRECTORY: in a git worktree (and in a submodule) .git is a FILE, so the
+    # old -d test rejected every worktree-based run -- including the parallel
+    # workflow streams this project runs by default. rev-parse is true for a
+    # plain clone, a worktree, and a submodule alike, and replaces two
+    # subprocesses' worth of checking with one.
     local target="${TARGET_DIR:-.}"
-    [ -d "$target/.git" ] || return 1
+    git -C "$target" rev-parse --is-inside-work-tree >/dev/null 2>&1 || return 1
     local commits
     commits="$(git -C "$target" rev-list --count HEAD 2>/dev/null || echo 0)"
     [ "${commits:-0}" -ge 5 ] || return 1
 
     # An issue-sourced spec is the canonical scoped change: someone filed a
     # discrete request against code that already exists.
+    #
+    # The spec path is passed in by the caller ($1). It used to be read only
+    # from LOKI_PRD_FILE / LOKI_ISSUE_REF, but `loki start <issue>` writes
+    # .loki/prd-issue-N.md and hands run.sh that path as a POSITIONAL argument,
+    # so neither variable was ever set and this check could not fire.
+    local spec="${1:-${LOKI_PRD_FILE:-}}"
     [ -n "${LOKI_ISSUE_REF:-}" ] && return 0
-    case "${LOKI_PRD_FILE:-}" in
+    case "$spec" in
         *prd-issue-*) return 0 ;;
     esac
 
@@ -674,7 +687,7 @@ loki_detect_scoped_change() {
 }
 
 loki_apply_scoped_change_profile() {
-    loki_detect_scoped_change || return 0
+    loki_detect_scoped_change "${1:-}" || return 0
 
     # Off: cannot affect the correctness of a scoped change to existing code.
     : "${LOKI_PHASE_WEB_RESEARCH:=false}"
@@ -10597,17 +10610,38 @@ print("REPEATED_GATE_BLOCKER (PRIORITY): action=escalate gate=%s count=%d thresh
 # Usage: _loki_run_pytest_with_timeout <target_dir> [pytest_args...]
 # Stdout: combined pytest output
 # Exit: 0 on pass, non-zero on fail. Exit 124 indicates the timeout fired.
-_loki_run_pytest_with_timeout() {
-    local target_dir="$1"; shift
-    local pytest_timeout="${LOKI_PYTEST_TIMEOUT:-${LOKI_GATE_TIMEOUT:-300}}"
-    local _to_cmd=()
+# Portable timeout-prefix probe, shared by every gate that must be wall-clock
+# bounded. Stock macOS ships NEITHER `timeout` NOR `gtimeout` (gtimeout arrives
+# with coreutils), so a bare `timeout` would resolve to "command not found"
+# (exit 127) and flip test_passed=false on every macOS run -- turning a rare
+# hang into a universal false RED. When no timeout binary exists we emit an
+# EMPTY prefix and run unbounded, which is the pre-existing behaviour.
+#
+# Usage: _loki_timeout_prefix <seconds> <gate-label>   (writes words to stdout)
+#   local _cmd=(); read -r -a _cmd <<< "$(_loki_timeout_prefix 300 'go test')"
+#   "${_cmd[@]}" go test ./...
+_loki_timeout_prefix() {
+    local secs="$1" label="${2:-gate}"
     if command -v gtimeout >/dev/null 2>&1; then
-        _to_cmd=(gtimeout "${pytest_timeout}s")
+        printf 'gtimeout %ss' "$secs"
     elif command -v timeout >/dev/null 2>&1; then
-        _to_cmd=(timeout "${pytest_timeout}s")
+        printf 'timeout %ss' "$secs"
     else
-        log_warn "Neither gtimeout nor timeout available; pytest gate will run unbounded (install coreutils on macOS)"
+        # >&2 is LOAD-BEARING: this function's STDOUT becomes the command-prefix
+        # array at every call site. log_warn writes to stdout (run.sh:1684), so
+        # without this redirect the warning text itself would be executed as the
+        # command -> exit 127 -> test_passed=false on every box lacking a timeout
+        # binary (stock macOS). That would be a universal false RED, strictly
+        # worse than the unbounded hang this helper exists to prevent.
+        log_warn "Neither gtimeout nor timeout available; ${label} will run unbounded (install coreutils on macOS)" >&2
     fi
+}
+
+_loki_run_pytest_with_timeout() {
+    local target_dir="$1"; shift
+    local pytest_timeout="${LOKI_PYTEST_TIMEOUT:-${LOKI_GATE_TIMEOUT:-300}}"
+    local _to_cmd=()
+    read -r -a _to_cmd <<< "$(_loki_timeout_prefix "$pytest_timeout" 'pytest gate')"
     (cd "$target_dir" && "${_to_cmd[@]}" pytest "$@" 2>&1)
 }
 
@@ -11081,9 +11115,8 @@ sys.stdout.write(t.strip())
             test_runner="unittest"
             local output unittest_exit _ut_to
             _ut_to="${LOKI_PYTEST_TIMEOUT:-${LOKI_GATE_TIMEOUT:-300}}"
-            local _ut_cmd=(timeout "${_ut_to}s")
-            command -v gtimeout &>/dev/null && _ut_cmd=(gtimeout "${_ut_to}s")
-            command -v timeout &>/dev/null || command -v gtimeout &>/dev/null || _ut_cmd=()
+            local _ut_cmd=()
+            read -r -a _ut_cmd <<< "$(_loki_timeout_prefix "$_ut_to" 'unittest gate')"
             output=$(cd "${TARGET_DIR:-.}" && "${_ut_cmd[@]}" python3 -m unittest discover -p 'test_*.py' 2>&1)
             unittest_exit=$?
             if [ "$unittest_exit" -eq 124 ]; then
@@ -11098,19 +11131,46 @@ sys.stdout.write(t.strip())
     fi
 
     # Go
+    # Wall-clock bounded like every other runner above. `go test` self-imposes
+    # -timeout 10m PER TEST BINARY, but `./...` runs one binary per package, so
+    # the AGGREGATE is unbounded -- and a test blocked in a cgo call or a syscall
+    # can outlive that panic. `cargo test` has no default timeout at all. Without
+    # this the gate hangs the whole iteration with no verdict.
+    # $gate_timeout is NOT in scope here (it is declared inside the package.json
+    # block), so read LOKI_GATE_TIMEOUT directly.
     if [ "$test_runner" = "none" ] && [ -f "${TARGET_DIR:-.}/go.mod" ] && command -v go &>/dev/null; then
         test_runner="go-test"
-        local output
-        output=$(cd "${TARGET_DIR:-.}" && go test ./... 2>&1) || test_passed=false
-        details="go test: $(echo "$output" | tail -3 | tr '\n' ' ')"
+        local output go_exit _go_to _go_cmd=()
+        _go_to="${LOKI_GATE_TIMEOUT:-300}"
+        read -r -a _go_cmd <<< "$(_loki_timeout_prefix "$_go_to" 'go test gate')"
+        output=$(cd "${TARGET_DIR:-.}" && "${_go_cmd[@]}" go test ./... 2>&1)
+        go_exit=$?
+        if [ "$go_exit" -eq 124 ]; then
+            test_passed=false
+            log_warn "go test gate timed out after ${_go_to}s (exit 124)"
+            details="go test: TIMED OUT after ${_go_to}s -- $(echo "$output" | tail -3 | tr '\n' ' ')"
+        else
+            [ "$go_exit" -ne 0 ] && test_passed=false
+            details="go test: $(echo "$output" | tail -3 | tr '\n' ' ')"
+        fi
     fi
 
     # Rust
     if [ "$test_runner" = "none" ] && [ -f "${TARGET_DIR:-.}/Cargo.toml" ] && command -v cargo &>/dev/null; then
         test_runner="cargo-test"
-        local output
-        output=$(cd "${TARGET_DIR:-.}" && cargo test 2>&1) || test_passed=false
-        details="cargo test: $(echo "$output" | tail -3 | tr '\n' ' ')"
+        local output cargo_exit _cargo_to _cargo_cmd=()
+        _cargo_to="${LOKI_GATE_TIMEOUT:-300}"
+        read -r -a _cargo_cmd <<< "$(_loki_timeout_prefix "$_cargo_to" 'cargo test gate')"
+        output=$(cd "${TARGET_DIR:-.}" && "${_cargo_cmd[@]}" cargo test 2>&1)
+        cargo_exit=$?
+        if [ "$cargo_exit" -eq 124 ]; then
+            test_passed=false
+            log_warn "cargo test gate timed out after ${_cargo_to}s (exit 124)"
+            details="cargo test: TIMED OUT after ${_cargo_to}s -- $(echo "$output" | tail -3 | tr '\n' ' ')"
+        else
+            [ "$cargo_exit" -ne 0 ] && test_passed=false
+            details="cargo test: $(echo "$output" | tail -3 | tr '\n' ' ')"
+        fi
     fi
 
     # node --test (built-in Node test runner) -- config-less fallback (task #79).
@@ -16936,8 +16996,64 @@ check_completion_promise() {
 }
 
 # Check if max iterations reached
+# EVIDENCE-AWARE ITERATION CAP.
+#
+# The cap used to be a bare counter: it consulted no gate, no council, and no
+# evidence. A run one step from finishing was cut off identically to a run
+# thrashing in circles, and both reported the same terminal.
+#
+# An iteration count is a PROXY for "is this converging". Where real evidence
+# exists, prefer the evidence. Two signals are already on disk at this point:
+#
+#   1. the model's own completion request (.loki/signals/COMPLETION_REQUESTED),
+#      which the agent writes when it believes the work is done
+#   2. gate state (.loki/quality/gate-failures.txt), which says whether the
+#      last verification pass actually found anything
+#
+# When the model says it is done AND no gate is failing, the run gets ONE extra
+# iteration to land it. That is the difference between a finished product and a
+# terminal failure at the buzzer.
+#
+# WHY THIS CANNOT LOOP FOREVER, which is the only thing that matters here:
+# the grace is granted at most once per run (a marker file, checked before it
+# is written), it requires POSITIVE evidence rather than the absence of a
+# signal, and it extends by exactly one iteration. A run that keeps claiming
+# done without finishing gets the cap, once, and then stops. Published
+# measurements put automated-verifier false-negative rates near 24%, so an
+# unbounded verifier-driven loop would burn real money on already-correct work.
+# This is deliberately a bounded nudge, not a verifier-driven terminal.
+#
+# LOKI_ITERATION_GRACE=0 restores the pure counter.
+_iteration_grace_available() {
+    [ "${LOKI_ITERATION_GRACE:-1}" != "0" ] || return 1
+
+    local _loki_root="${TARGET_DIR:-.}/.loki"
+    local _marker="$_loki_root/state/iteration-grace-used"
+    [ -f "$_marker" ] && return 1
+
+    # POSITIVE evidence the model believes it is done. Absence is not evidence.
+    [ -f "$_loki_root/signals/COMPLETION_REQUESTED" ] || return 1
+
+    # ...and nothing is currently failing. A non-empty gate-failures.txt means
+    # the last verification pass found real problems, so a "done" claim on top
+    # of it is exactly the case the cap should still stop.
+    local _gf="$_loki_root/quality/gate-failures.txt"
+    if [ -s "$_gf" ]; then
+        return 1
+    fi
+
+    mkdir -p "$_loki_root/state" 2>/dev/null || true
+    printf 'granted at iteration %s\n' "${ITERATION_COUNT:-0}" > "$_marker" 2>/dev/null || true
+    return 0
+}
+
 check_max_iterations() {
     if [ $ITERATION_COUNT -ge $MAX_ITERATIONS ]; then
+        if _iteration_grace_available; then
+            MAX_ITERATIONS=$((MAX_ITERATIONS + 1))
+            log_info "Iteration cap reached, but the agent reports done with no failing gate -- granting ONE final iteration to land it (once per run; LOKI_ITERATION_GRACE=0 to disable)."
+            return 1
+        fi
         log_warn "Max iterations ($MAX_ITERATIONS) reached. Stopping."
         return 0
     fi
@@ -24182,6 +24298,15 @@ main() {
         set --
     fi
 
+    # Re-apply the scoped-change profile now that PRD_PATH is known.
+    #
+    # The module-scope call runs at source time, BEFORE this argument parsing,
+    # so the spec path was always empty there and an issue-sourced build could
+    # never be recognised. Re-running it here is idempotent: the profile assigns
+    # with := so anything already set (including an explicit operator override)
+    # is left untouched, and a non-scoped run still returns immediately.
+    loki_apply_scoped_change_profile "$PRD_PATH"
+
     # Validate PRD if provided
     if [ -n "$PRD_PATH" ] && [ ! -f "$PRD_PATH" ]; then
         log_error "PRD file not found: $PRD_PATH"

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "8.10.0"
+__version__ = "8.12.0"
 
 # Expose the control app for easy import
 try:

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var h_=Object.create;var{getPrototypeOf:v_,defineProperty:rK,getOwnPropertyNames:g_}=Object;var m_=Object.prototype.hasOwnProperty;function u_(Z){return this[Z]}var p_,d_,c_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?p_??=new WeakMap:d_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?h_(v_(Z)):{};let K=X||!Z||!Z.__esModule?rK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of g_(Z))if(!m_.call(K,$))rK(K,$,{get:u_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var qQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var l_=(Z)=>Z;function i_(Z,X){this[Z]=l_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)rK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:i_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var e0=import.meta.require;var kO={};l0(kO,{lokiDir:()=>j0,homeLokiDir:()=>P4,findRepoRootForVersion:()=>eK,REPO_ROOT:()=>r0});import{resolve as n7,dirname as tK}from"path";import{fileURLToPath as a_}from"url";import{existsSync as GQ}from"fs";import{homedir as s_}from"os";function n_(){let Z=RO;for(let X=0;X<6;X++){if(GQ(n7(Z,"VERSION"))&&GQ(n7(Z,"autonomy/run.sh")))return Z;let Q=tK(Z);if(Q===Z)break;Z=Q}return n7(RO,"..","..","..")}function eK(Z){let X=Z;for(let Q=0;Q<6;Q++){if(GQ(n7(X,"VERSION"))&&GQ(n7(X,"autonomy/run.sh")))return X;let Y=tK(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function P4(){return n7(s_(),".loki")}var RO,r0;var G8=p(()=>{RO=tK(a_(import.meta.url));r0=n_()});import{readFileSync as o_}from"fs";import{resolve as r_,dirname as t_}from"path";import{fileURLToPath as e_}from"url";function f3(){if(h5!==null)return h5;let Z="8.10.0";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=t_(e_(import.meta.url)),Q=eK(X);h5=o_(r_(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var HQ=p(()=>{G8()});var bO={};l0(bO,{runOrThrow:()=>Of,run:()=>E0,readStreamCapped:()=>UQ,commandVersion:()=>Af,commandExists:()=>X9,ShellError:()=>Z$,MAX_STDOUT_BYTES:()=>yO});async function UQ(Z,X=yO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let W=$.byteLength-(z-X);J+=Y.decode($.subarray(0,W),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([UQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Of(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Z$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=Lf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Lf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Af(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var yO=16777216,Z$;var x9=p(()=>{Z$=class Z$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return jf?"":Z}var jf,L0,k8,p0,ZV0,i0,H8,Q9,v;var S6=p(()=>{jf=(process.env.NO_COLOR??"").length>0;L0=o7("\x1B[0;31m"),k8=o7("\x1B[0;32m"),p0=o7("\x1B[1;33m"),ZV0=o7("\x1B[0;34m"),i0=o7("\x1B[0;36m"),H8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),v=o7("\x1B[0m")});import{existsSync as xf}from"fs";async function E7(){if(k4!==void 0)return k4;let Z="/opt/homebrew/bin/python3.12";if(xf(Z))return k4=Z,Z;let X=await X9("python3.12");if(X)return k4=X,X;let Q=await X9("python3");return k4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var k4;var r7=p(()=>{x9()});var ZL={};l0(ZL,{runStatus:()=>Yh});import{existsSync as Y9,readFileSync as v3,readdirSync as iO,statSync as aO}from"fs";import{resolve as h8,basename as sf}from"path";import{homedir as nf}from"os";function sO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function nO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*NQ/X);if(J>NQ)J=NQ;let z=NQ-J,K=k8;if(Y>=80)K=L0;else if(Y>=50)K=p0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),W=sO(Z),V=sO(X);return`  ${H8}${Q}${v} ${K}[${$}]${v} ${Y}% (${W} / ${V})`}async function rf(){if(await X9("jq"))return!0;return process.stdout.write(`${L0}Error: jq is required but not installed.${v}
+var h_=Object.create;var{getPrototypeOf:v_,defineProperty:rK,getOwnPropertyNames:g_}=Object;var m_=Object.prototype.hasOwnProperty;function u_(Z){return this[Z]}var p_,d_,c_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?p_??=new WeakMap:d_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?h_(v_(Z)):{};let K=X||!Z||!Z.__esModule?rK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of g_(Z))if(!m_.call(K,$))rK(K,$,{get:u_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var qQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var l_=(Z)=>Z;function i_(Z,X){this[Z]=l_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)rK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:i_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var e0=import.meta.require;var kO={};l0(kO,{lokiDir:()=>j0,homeLokiDir:()=>P4,findRepoRootForVersion:()=>eK,REPO_ROOT:()=>r0});import{resolve as n7,dirname as tK}from"path";import{fileURLToPath as a_}from"url";import{existsSync as GQ}from"fs";import{homedir as s_}from"os";function n_(){let Z=RO;for(let X=0;X<6;X++){if(GQ(n7(Z,"VERSION"))&&GQ(n7(Z,"autonomy/run.sh")))return Z;let Q=tK(Z);if(Q===Z)break;Z=Q}return n7(RO,"..","..","..")}function eK(Z){let X=Z;for(let Q=0;Q<6;Q++){if(GQ(n7(X,"VERSION"))&&GQ(n7(X,"autonomy/run.sh")))return X;let Y=tK(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function P4(){return n7(s_(),".loki")}var RO,r0;var G8=p(()=>{RO=tK(a_(import.meta.url));r0=n_()});import{readFileSync as o_}from"fs";import{resolve as r_,dirname as t_}from"path";import{fileURLToPath as e_}from"url";function f3(){if(h5!==null)return h5;let Z="8.12.0";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=t_(e_(import.meta.url)),Q=eK(X);h5=o_(r_(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var HQ=p(()=>{G8()});var bO={};l0(bO,{runOrThrow:()=>Of,run:()=>E0,readStreamCapped:()=>UQ,commandVersion:()=>Af,commandExists:()=>X9,ShellError:()=>Z$,MAX_STDOUT_BYTES:()=>yO});async function UQ(Z,X=yO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let W=$.byteLength-(z-X);J+=Y.decode($.subarray(0,W),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([UQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Of(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Z$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=Lf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Lf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Af(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var yO=16777216,Z$;var x9=p(()=>{Z$=class Z$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return jf?"":Z}var jf,L0,k8,p0,ZV0,i0,H8,Q9,v;var S6=p(()=>{jf=(process.env.NO_COLOR??"").length>0;L0=o7("\x1B[0;31m"),k8=o7("\x1B[0;32m"),p0=o7("\x1B[1;33m"),ZV0=o7("\x1B[0;34m"),i0=o7("\x1B[0;36m"),H8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),v=o7("\x1B[0m")});import{existsSync as xf}from"fs";async function E7(){if(k4!==void 0)return k4;let Z="/opt/homebrew/bin/python3.12";if(xf(Z))return k4=Z,Z;let X=await X9("python3.12");if(X)return k4=X,X;let Q=await X9("python3");return k4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var k4;var r7=p(()=>{x9()});var ZL={};l0(ZL,{runStatus:()=>Yh});import{existsSync as Y9,readFileSync as v3,readdirSync as iO,statSync as aO}from"fs";import{resolve as h8,basename as sf}from"path";import{homedir as nf}from"os";function sO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function nO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*NQ/X);if(J>NQ)J=NQ;let z=NQ-J,K=k8;if(Y>=80)K=L0;else if(Y>=50)K=p0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),W=sO(Z),V=sO(X);return`  ${H8}${Q}${v} ${K}[${$}]${v} ${Y}% (${W} / ${V})`}async function rf(){if(await X9("jq"))return!0;return process.stdout.write(`${L0}Error: jq is required but not installed.${v}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1222,4 +1222,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:Y}=await Promise.resolve().then(() => (b_(),y_));return Y(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(__),2}}cO();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var fW0=await _W0(Bun.argv.slice(2));process.exit(fW0);
 
-//# debugId=FFC5E67020401A2F64756E2164756E21
+//# debugId=12231098D894234164756E2164756E21

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '8.10.0'
+__version__ = '8.12.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "8.10.0",
+  "version": "8.12.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "8.10.0",
+  "version": "8.12.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/skills/00-index.md

@@ -35,6 +35,8 @@
 | Legacy healing, modernization, archaeology | `healing.md` |
 | Plan deepening, knowledge extraction | `compound-learning.md` |
 | Managed Agents memory, multiagent council, flag hierarchy | `memory.md` |
+| Non-trivial change (>3 files, agent runtime, MINOR/MAJOR release) | `sdlc-fleet.md` |
+| Adding your own gate/reviewer/agent to the loop | `extending.md` |
 
 ## Module Descriptions
 
@@ -159,6 +161,20 @@
 - Language-specific guides (COBOL, legacy Java, PHP, Python 2)
 - Full reference: `references/legacy-healing-patterns.md`
 
+### sdlc-fleet.md
+**When:** Any non-trivial change (feature touching >3 files, bug fix in agent
+runtime / council / memory / auto-spawn, MINOR or MAJOR release, cross-route
+parity change). Binding per CLAUDE.md, so this index must be able to route to it.
+- Six roles: Architect, Product Owner, Dev Fleet, SDET, Council Reviewers, Real-User QA
+- Unanimous 3-of-3 APPROVE required from the review council
+- Skip rules: typo fixes, docs-only edits, reverts, emergency hotfixes
+
+### extending.md
+**When:** Adding a custom reviewer/agent to the loop without editing engine files
+- The live seam: `loki agent install` -> `.loki/agents/installed.json`
+- What is strictly additive vs what can never displace a built-in gate
+- Honest status of `src/plugins/` (built, tested, not wired into the loop)
+
 ### providers.md (v5.0.0)
 **When:** Using non-Claude providers (Codex, Cline, Aider), understanding degraded mode
 - Provider comparison matrix

package/skills/extending.md

@@ -0,0 +1,131 @@
+# Extending the Loop
+
+**When to load:** you want to add your own reviewer, agent, or gate to the RARV
+loop without editing engine files.
+
+Read this before writing an extension. Every claim below is cited to source, and
+the one live seam is exercised by `tests/test-installed-agent-reviewer.sh`
+(10 tests, wired into `tests/run-all-tests.sh:732`).
+
+## What is actually extensible today
+
+| Surface | Extend without editing engine files? | Mechanism |
+|---|---|---|
+| Code-review reviewer pool | **Yes** | `loki agent install` -> `.loki/agents/installed.json` |
+| Numbered quality gates 1-8 | No | Compiled into `autonomy/run.sh` phases; opt-out flags only |
+| RARV phases | No | Phase sequence lives in `run_autonomous()` (`autonomy/run.sh`) |
+| MCP tools | Yes | Standard MCP server config (see `references/mcp-integration.md`) |
+
+Only the reviewer pool has a supported, tested, data-only extension seam. The
+rest are opt-out (disable) surfaces, not opt-in (add) surfaces. If you need a new
+blocking gate, that is an engine change, not an extension.
+
+## The reviewer seam (R10)
+
+`autonomy/run.sh:14002-14036` loads user-installed agents into a dict named
+`INSTALLED_SPECIALISTS` (declared at `:14013`), separate from the built-in
+`SPECIALISTS` pool.
+
+Line numbers drift. Re-anchor with
+`grep -n "R10 extension seam" autonomy/run.sh` before relying on them.
+
+### Install
+
+Write a manifest and install it. The source may be a local path, a git repo URL,
+or a raw manifest URL (`autonomy/loki:26774`).
+
+```json
+{
+  "type": "a11y-auditor",
+  "name": "Accessibility Auditor",
+  "swarm": "review",
+  "capabilities": "WCAG and screen-reader review",
+  "focus": ["aria", "accessibility", "contrast", "keyboard"],
+  "persona": "You audit for WCAG 2.2 AA compliance."
+}
+```
+
+```bash
+loki agent install ./my-agent/manifest.json
+# Installed agent: a11y-auditor  (Accessibility Auditor)
+# Stored in .loki/agents/installed.json
+```
+
+`focus` is load-bearing: those strings become the keywords that decide whether
+your reviewer fires on a given diff. An agent with an empty `focus` is skipped
+rather than made always-on (`autonomy/run.sh:14027`).
+
+### When it fires
+
+Your reviewer only fires when one of its `focus` keywords appears in the diff or
+changed-file list, so a backend-only change does not pay for an a11y auditor.
+Verified by running the real selector block extracted from `run.sh` against a
+diff containing `aria-label`, `contrast`, `keyboard`:
+
+```
+REVIEWERS: ['architecture-strategist', 'maintainer-mergeability',
+            'eng-frontend', 'security-sentinel', 'a11y-auditor']
+```
+
+The silent case (a diff matching none of the agent's keywords leaves it out of
+the pool) is covered by the `stays silent on a diff its keywords do not match`
+case in `tests/test-installed-agent-reviewer.sh`.
+
+## Three invariants you cannot override
+
+These are deliberate. An extension can only ADD scrutiny.
+
+1. **Never displaces a built-in reviewer.** Installed agents are kept in a
+   separate dict and APPENDED after the built-in `ranked[:want]` selection
+   (`autonomy/run.sh:14011` records that an earlier version displaced
+   `security-sentinel`, which is why the dicts are split). In the run above,
+   `security-sentinel` is still present alongside the installed agent.
+2. **Never shadows a built-in type.** An installed agent whose `type` collides
+   with a built-in is skipped (`autonomy/run.sh:14022-14024`).
+3. **Capped at 2 installed reviewers per run.** `_MAX_INSTALLED_REVIEWERS = 2`
+   (`autonomy/run.sh:14104`). Each appended agent costs one more LLM reviewer
+   call every iteration. Verified: three installed agents whose keywords all
+   match one diff yield exactly two appended reviewers
+   (`['a11y-one', 'a11y-two']`, the third dropped).
+
+A corrupt or absent `installed.json` is swallowed and leaves the normal battery
+intact (`autonomy/run.sh:14035-14036`) -- extensions must never be able to break
+code review.
+
+## Manifests are data, never code
+
+`hub_install.py` stores manifest fields; it never executes anything from them.
+Executable-looking fields are stripped and reported. Verified by installing a
+manifest carrying a `postinstall` field:
+
+```
+{"type": "a11y-auditor", ..., "_ignored_executable_fields": ["postinstall"]}
+```
+
+The command in that field did not run. Covered by the test
+`manifest postinstall field is not stored and never runs (data-only)`.
+
+## `src/plugins/` is NOT a seam (status: unwired)
+
+`src/plugins/` contains `GatePlugin`, `AgentPlugin`, `MCPPlugin`,
+`IntegrationPlugin`, a loader and a validator, with 84 passing tests in
+`tests/plugins/`.
+
+**Status: not wired.** No engine file calls any of it, and the loop will never
+call it. There is no `require` of `src/plugins` in
+`autonomy/run.sh`, `autonomy/loki`, or anywhere outside its own tests, and
+`tests/plugins/` is absent from the `test` script in `package.json`, from
+`tests/run-all-tests.sh`, and from `scripts/local-ci.sh` -- so those 84 tests do
+not run in CI.
+
+Do not register a gate through `GatePlugin` expecting the loop to execute it.
+Registration succeeds and nothing ever calls the gate. It is documented here so
+the next reader does not mistake a green test suite for a working feature.
+
+## Adding a real gate
+
+If you need a new blocking gate, it is an engine change: add the phase to
+`autonomy/run.sh`, give it an opt-out flag matching the `LOKI_GATE_*` convention
+in `skills/quality-gates.md`, and mirror it on the Bun route. Follow
+`skills/sdlc-fleet.md` -- a new gate is a non-trivial change and needs the
+council.

package/skills/model-selection.md

@@ -32,7 +32,7 @@ Claude Fable 5 (alias `fable`, full id `claude-fable-5`) is Anthropic's most cap
 
 ### Mid-flight model switching
 
-You can change the model a **live run** uses, from the dashboard or by writing a state file. The switch applies at the **next iteration boundary** (each iteration spawns a fresh `claude -p`, which fixes the model per invocation, so it never changes mid-invocation). The override applies to the **current run only**: the runner clears a leftover override at the start of a fresh run, so a switch never silently carries into future runs. The override is also clamped by `LOKI_MAX_TIER`: if the operator set a cost ceiling, an override above it is clamped down with one honest log line, and the dashboard reports the clamped effective model. The clamp is scoped, not blanket: on the override path a `sonnet` ceiling downgrades only `fable` (to `PROVIDER_MODEL_DEVELOPMENT`, opus by default), while a plain `opus` override stays opus; a `haiku` ceiling pins to `PROVIDER_MODEL_FAST`; an `opus` ceiling caps only `fable` back to opus. (The clamp is enforced on the bash runner, which is the live `start` route; the experimental Bun runner does not yet port it.)
+You can change the model a **live run** uses, from the dashboard or by writing a state file. The switch applies at the **next iteration boundary** (each iteration spawns a fresh `claude -p`, which fixes the model per invocation, so it never changes mid-invocation). The override applies to the **current run only**: the runner clears a leftover override at the start of a fresh run, so a switch never silently carries into future runs. The override is also clamped by `LOKI_MAX_TIER`: if the operator set a cost ceiling, an override above it is clamped down with one honest log line, and the dashboard reports the clamped effective model. The clamp is scoped, not blanket: on the override path a `sonnet` ceiling downgrades only `fable` (to `PROVIDER_MODEL_DEVELOPMENT`, sonnet by default per `providers/claude.sh:61`), while a plain `opus` override stays opus; a `haiku` ceiling pins to `PROVIDER_MODEL_FAST`; an `opus` ceiling caps only `fable` back to opus. (The clamp is enforced on the bash runner, which is the live `start` route; the experimental Bun runner does not yet port it.)
 
 - Dashboard: the Model selector in the session-control panel. The Fable option shows its 2x-Opus cost; an inline notice discloses the iteration-boundary timing. It calls `POST /api/session/model`.
 - File / CLI: write an allowlisted alias (`haiku`, `sonnet`, `opus`, `fable`) to `.loki/state/model-override`. Empty or absent file reverts to the tier mapping. Invalid content is ignored (the runtime warns once). The value is allowlist-validated because it is fed straight into `claude --model`.
@@ -58,7 +58,7 @@ For diffs that move money or mutate infrastructure (payments, billing, spend aut
 
 ### Cost estimate honesty
 
-`loki plan` quotes the model the runner actually dispatches, on **every** path, for the levers the runner honors. This includes the stock no-lever default: the `sonnet` session pin resolves through the development tier to opus, so the quote names Opus (not Sonnet) on the default path. Set `LOKI_SESSION_MODEL=fable`, or have a pending `.loki/state/model-override` of `fable`, and the estimate uses Fable's $10/$50 pricing with a 2x-Opus note. The quote, the dashboard `effective` model, and the actual `claude --model` argument always agree on both routes: the session-pin tier route (no override) and the override-path clamp (override present) are each mirrored exactly in the estimator and the dashboard, so the same lever that changes the quote changes the run. `LOKI_MAX_TIER` is applied to the quote too, so the estimate never quotes a model above the operator's cost ceiling. (`LOKI_MODEL` is not a session lever and does not affect the run; use `LOKI_SESSION_MODEL`.)
+`loki plan` quotes the model the runner actually dispatches, on **every** path, for the levers the runner honors. This includes the stock no-lever default: the `sonnet` session pin resolves through the development tier to sonnet, so the quote names Sonnet on the default path (`providers/claude.sh:61` sets `CLAUDE_DEFAULT_DEVELOPMENT="sonnet"`, and the estimator mirrors it at `autonomy/loki:17378-17382`; a stock `loki plan` prints `Model distribution: Sonnet x1`). Set `LOKI_SESSION_MODEL=fable`, or have a pending `.loki/state/model-override` of `fable`, and the estimate uses Fable's $10/$50 pricing with a 2x-Opus note. The quote, the dashboard `effective` model, and the actual `claude --model` argument always agree on both routes: the session-pin tier route (no override) and the override-path clamp (override present) are each mirrored exactly in the estimator and the dashboard, so the same lever that changes the quote changes the run. `LOKI_MAX_TIER` is applied to the quote too, so the estimate never quotes a model above the operator's cost ceiling. (`LOKI_MODEL` is not a session lever and does not affect the run; use `LOKI_SESSION_MODEL`.)
 
 **Where the dispatched model is disclosed (precisely):**
 - Override path (a `.loki/state/model-override` alias): the runner logs the override and the clamp line (`model override: <model>`, plus the one honest clamp-down log line when `LOKI_MAX_TIER` reduces it); the dashboard `GET /api/session/model` `effective` field reports the clamped model.
@@ -68,14 +68,29 @@ For diffs that move money or mutate infrastructure (payments, billing, spend aut
 
 ## Multi-Provider Support (v5.0.0)
 
-Loki Mode supports five AI providers. Claude has full features; all others run in **degraded mode** (sequential execution only, no Task tool, no parallel agents).
-
-| Provider | Full Features | Degraded | CLI Flag |
-|----------|---------------|----------|----------|
-| **Claude Code** | Yes | No | `--provider claude` (default) |
-| **OpenAI Codex CLI** | No | Yes | `--provider codex` |
-| **Cline CLI** | No | Yes | `--provider cline` |
-| **Aider** | No | Yes | `--provider aider` |
+Loki Mode supports five AI providers. The authoritative list is
+`SUPPORTED_PROVIDERS` in `providers/loader.sh:8`; each provider's capability
+flags live in its own `providers/<name>.sh`. Claude has full features. Every
+other provider runs sequentially (no Task tool, no parallel agents), but only
+those with `PROVIDER_DEGRADED=true` are flagged degraded.
+
+| Provider | Full Features | `PROVIDER_DEGRADED` | CLI Flag |
+|----------|---------------|---------------------|----------|
+| **Claude Code** | Yes | false (`providers/claude.sh:104`) | `--provider claude` (default) |
+| **OpenAI Codex CLI** | No | true (`providers/codex.sh:180`) | `--provider codex` |
+| **Cline CLI** | No | false (`providers/cline.sh:97`) | `--provider cline` |
+| **Aider** | No | true (`providers/aider.sh:95`) | `--provider aider` |
+| **opencode** | No | false (`providers/opencode.sh:66`) | `--provider opencode` |
+
+Only **codex** and **aider** are flagged degraded. Cline and opencode are
+sequential but not degraded, so do not describe them as degraded-mode providers.
+
+**opencode** is the model-agnostic route: it reaches 75+ model providers, so it
+is the path to cheap/open models. It is sequential like the others
+(`PROVIDER_HAS_SUBAGENTS=false`, `PROVIDER_HAS_PARALLEL=false`,
+`PROVIDER_HAS_TASK_TOOL=false` at `providers/opencode.sh:61-63`) but it does
+support MCP (`PROVIDER_HAS_MCP=true`, `:64`), which is why it is not marked
+degraded.
 
 **Degraded mode limitations:**
 - No Task tool (cannot spawn subagents)