loki-mode 8.6.1 → 8.8.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v8.6.1
+# Loki Mode v8.8.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -469,4 +469,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v8.6.1 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v8.8.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-8.6.1
+8.8.0

package/autonomy/lib/deadline.py

@@ -254,6 +254,14 @@ def _process_snapshot() -> dict[int, _ProcessRecord]:
     return snapshot
 
 
+class _LineageUnknown(Exception):
+    """The lineage marker could not be read because the process is gone.
+
+    Distinct from "the marker is absent". A vanished process is not evidence
+    of a lineage violation -- it is the absence of evidence either way.
+    """
+
+
 def _process_has_lineage_token(pid: int, token: str) -> bool:
     needle = f"{_LINEAGE_ENV_NAME}={token}".encode("ascii")
     if sys.platform == "darwin":
@@ -274,6 +282,19 @@ def _process_has_lineage_token(pid: int, token: str) -> bool:
         try:
             with open(f"/proc/{pid}/environ", "rb") as handle:
                 return needle in handle.read().split(b"\0")
+        except FileNotFoundError:
+            # The process is already gone. /proc/<pid>/environ disappears the
+            # moment a child is reaped, so a short-lived runner that exits
+            # before this check runs is indistinguishable here from one that
+            # never carried the marker -- and answering "no marker" for it
+            # fails the lineage guard and returns 127 as a LAUNCH failure, for
+            # a process that in fact launched and completed.
+            #
+            # Signal "unknown", not "absent". The caller decides, because only
+            # the caller knows whether the process it spawned is still alive.
+            # macOS never hit this: it has the pipe-handle fallback, so the
+            # bug was Linux-only and invisible on a developer Mac.
+            raise _LineageUnknown(pid) from None
         except OSError:
             return False
     return False
@@ -354,10 +375,23 @@ class _LineageTracker:
         root = _process_record(process.pid)
         if root is None:
             raise RuntimeError("provider attempt identity is unavailable")
-        if not (
-            _process_has_lineage_token(root.pid, token)
-            or _process_has_lineage_pipe(root.pid, lineage_pipe_handles)
-        ):
+        try:
+            has_marker = (
+                _process_has_lineage_token(root.pid, token)
+                or _process_has_lineage_pipe(root.pid, lineage_pipe_handles)
+            )
+        except _LineageUnknown:
+            # The child exited before we could read its marker. That is a
+            # completed run, not a lineage violation -- and it is the common
+            # case for any runner that finishes fast. Confirm it really is our
+            # child (Popen.poll() is authoritative: it reaps only the process
+            # this object spawned) before accepting.
+            #
+            # This stays fail-closed for the case the guard exists to catch: a
+            # LIVE process whose marker is genuinely missing still raises,
+            # because poll() returns None for it and we fall through.
+            has_marker = process.poll() is not None
+        if not has_marker:
             raise RuntimeError("provider attempt lineage marker is unavailable")
         self.root_pid = root.pid
         self.session_id = root.session_id

package/autonomy/loki

@@ -61,6 +61,16 @@ if [ -f "$_LOKI_SCRIPT_DIR/tui.sh" ]; then
     source "$_LOKI_SCRIPT_DIR/tui.sh"
 fi
 
+# Portable lock helper -- provides safe_acquire_lock / safe_release_lock.
+# Needed here (not just in run.sh) because ensure_dashboard_venv tears down and
+# rebuilds the HOST-GLOBAL ~/.loki/dashboard-venv, so two concurrent CLI
+# invocations can otherwise delete the venv the other is importing from.
+# Self-guarded against double-source.
+if [ -f "$_LOKI_SCRIPT_DIR/lib/lock.sh" ]; then
+    # shellcheck source=lib/lock.sh
+    source "$_LOKI_SCRIPT_DIR/lib/lock.sh"
+fi
+
 # Crash-reporting helpers (provides loki_collection_enabled, used by
 # cmd_telemetry status and cmd_crash). Self-guarded against double-source.
 if [ -f "$_LOKI_SCRIPT_DIR/crash.sh" ]; then
@@ -446,6 +456,33 @@ ensure_dashboard_venv() {
         return 0
     fi
 
+    # The venv is HOST-GLOBAL, so concurrent runs must not rebuild it at once:
+    # one run's `rm -rf` would delete the tree another is importing from. Lock
+    # the venv path itself -- safe_acquire_lock appends ".lockdir", giving a
+    # SIBLING mutex that the teardown below cannot destroy. Timeout must outlast
+    # a real cold `python3 -m venv` + `pip install` (not the 5s used by the
+    # JSON read-modify-write call sites).
+    local _venv_locked=false
+    if type safe_acquire_lock >/dev/null 2>&1; then
+        if safe_acquire_lock "$dashboard_venv" "${LOKI_VENV_LOCK_TIMEOUT:-300}"; then
+            _venv_locked=true
+            # The winner may have finished the build while we waited -- re-probe
+            # before tearing anything down.
+            DASHBOARD_PYTHON="python3"
+            [ -x "${dashboard_venv}/bin/python3" ] && DASHBOARD_PYTHON="${dashboard_venv}/bin/python3"
+            if "$DASHBOARD_PYTHON" -c "import fastapi; import sqlalchemy; import aiosqlite" 2>/dev/null; then
+                safe_release_lock "$dashboard_venv"
+                return 0
+            fi
+        else
+            # Do NOT fall through into the rm -rf unlocked -- that is the exact
+            # race this lock exists to prevent.
+            echo -e "${RED}Timed out waiting for another run to finish building the dashboard venv${NC}"
+            echo "  Retry, or remove a stale lock: rm -rf ${dashboard_venv}.lockdir"
+            return 1
+        fi
+    fi
+
     echo -e "${YELLOW}Setting up dashboard virtualenv...${NC}"
 
     # Create venv if missing or broken
@@ -461,6 +498,7 @@ ensure_dashboard_venv() {
             echo "You may need to install python3-venv:"
             echo "  sudo apt install python3-venv    (Debian/Ubuntu)"
             echo "  brew install python3              (macOS)"
+            [ "$_venv_locked" = true ] && safe_release_lock "$dashboard_venv"
             return 1
         }
     fi
@@ -485,6 +523,7 @@ ensure_dashboard_venv() {
         if ! "${dashboard_venv}/bin/pip" install fastapi uvicorn pydantic websockets sqlalchemy aiosqlite httpx pexpect watchdog 2>&1 | tail -1; then
             echo -e "${RED}Failed to install dashboard dependencies${NC}"
             echo "Try manually: ${dashboard_venv}/bin/pip install fastapi uvicorn sqlalchemy aiosqlite"
+            [ "$_venv_locked" = true ] && safe_release_lock "$dashboard_venv"
             return 1
         fi
         # Try greenlet separately (optional, needs C compiler on some platforms)
@@ -497,9 +536,11 @@ ensure_dashboard_venv() {
         echo "Try removing the venv and retrying:"
         echo "  rm -rf ${dashboard_venv}"
         echo "  loki dashboard start"
+        [ "$_venv_locked" = true ] && safe_release_lock "$dashboard_venv"
         return 1
     fi
 
+    [ "$_venv_locked" = true ] && safe_release_lock "$dashboard_venv"
     return 0
 }
 
@@ -5337,7 +5378,14 @@ cmd_provider_models() {
     echo -e "${BOLD}Model Configuration (resolved):${NC}"
     echo ""
 
-    local providers=("claude" "codex" "cline" "aider")
+    echo -e "  ${CYAN}Ask for a tier by capability -- small, medium or high -- and each"
+    echo -e "  provider supplies its own latest model in that class. medium is the"
+    echo -e "  default. Set one with LOKI_SESSION_MODEL=small or --session-model small.${NC}"
+    echo ""
+
+    # opencode ships a provider file and a catalog entry, so omitting it here
+    # under-reported what this command claims to show ("all providers").
+    local providers=("claude" "codex" "cline" "aider" "opencode")
     for provider in "${providers[@]}"; do
         local provider_file="$script_dir/providers/${provider}.sh"
         [ -f "$provider_file" ] || continue
@@ -5407,7 +5455,34 @@ cmd_provider_models() {
                 fast)        value="$fast" ;;
             esac
 
-            printf "    %-12s %-30s (source: %s)\n" "${tier^}:" "$value" "$source"
+            # Label each tier with the GENERIC vocabulary users actually select
+            # (small|medium|high), so this command answers "what do I really get
+            # if I ask for medium on this provider" without anyone having to know
+            # a vendor model name. The canonical tier name stays alongside it
+            # because every env var, log line and state file still uses it -- and
+            # a user reading LOKI_CLAUDE_MODEL_DEVELOPMENT needs to see the two
+            # spellings connected. Mapping mirrors loki_tier_alias() in
+            # providers/models.sh.
+            local generic
+            case "$tier" in
+                fast)        generic="small" ;;
+                development) generic="medium" ;;
+                planning)    generic="high" ;;
+                *)           generic="$tier" ;;
+            esac
+
+            # An EMPTY resolved model is a real, supported state, not a lookup
+            # failure: providers/codex.sh sets CODEX_DEFAULT_MODEL="" on purpose
+            # so no --model flag is passed and Codex resolves an
+            # account-appropriate default (a hardcoded name broke ChatGPT-account
+            # users outright). Say that plainly instead of printing a blank
+            # column. Deliberately NOT filled in from the catalog: this table
+            # reports what will be DISPATCHED, and the catalog id would be a
+            # guess this file is documented as unable to make.
+            [ -n "$value" ] || value="(provider default -- no --model sent)"
+
+            printf "    %-8s %-14s %-38s (source: %s)\n" \
+                "$generic" "(${tier})" "$value" "$source"
         done
 
         # Show extra info per provider
@@ -11341,6 +11416,49 @@ except Exception:
     fi
     echo ""
 
+    # Model catalog freshness. Providers ship models constantly and this catalog
+    # is hand-maintained, so it rots silently -- nothing else in the system ever
+    # reports its age. Reads ONLY the local file's "updated" field: zero network
+    # I/O, so `loki doctor` stays air-gapped-safe (docs/air-gapped.md). We do not
+    # and will not auto-fetch or guess model IDs; inventing a model that does not
+    # exist is worse than being stale, so refresh stays a human-verified step.
+    #
+    # Informational only -- like Runtime route and Cockpit above, it does NOT
+    # touch pass/warn/fail counts and never calls _doctor_block, so a stale
+    # catalog can never flip doctor's exit code or block a build. Advisory by
+    # construction, not by convention.
+    #
+    # Mirrored byte-for-byte in loki-ts/src/commands/doctor.ts -- the bun-parity
+    # matrix diffs this section (it is NOT in the normalizer's strip list), so
+    # edit BOTH routes or parity fails.
+    echo -e "${CYAN}Model catalog:${NC}"
+    _catalog_path="${LOKI_MODEL_CATALOG:-${_LOKI_SCRIPT_DIR}/../providers/model_catalog.json}"
+    _catalog_line=$(LOKI_CATALOG_PATH="$_catalog_path" python3 -c "
+import json, os, datetime
+# Threshold: 90 days. The upstream probe workflow runs weekly, so a catalog
+# untouched for a quarter means the probe PRs are going unread.
+STALE_DAYS = 90
+p = os.environ['LOKI_CATALOG_PATH']
+try:
+    updated = json.load(open(p))['updated']
+    age = (datetime.date.today() - datetime.date.fromisoformat(updated)).days
+except Exception:
+    print('warn|Catalog unreadable or missing an ISO \"updated\" date -- cannot determine age')
+else:
+    if age > STALE_DAYS:
+        print(f'warn|Last updated {updated} ({age} days ago) -- may be missing newer models. Refresh: python3 tools/probe-model-catalog.py (reports new model IDs from provider docs; you verify and edit the catalog by hand -- never auto-applied)')
+    else:
+        print(f'pass|Last updated {updated} ({age} days ago)')
+" 2>/dev/null)
+    # Fail-open: if python3 is missing or the probe dies, say so and move on.
+    [ -n "$_catalog_line" ] || _catalog_line="warn|Could not probe catalog age"
+    if [ "${_catalog_line%%|*}" = "pass" ]; then
+        echo -e "  ${GREEN}PASS${NC}  ${_catalog_line#*|}"
+    else
+        echo -e "  ${YELLOW}WARN${NC}  ${_catalog_line#*|}"
+    fi
+    echo ""
+
     # Cockpit capability (E5): report what `loki cockpit` will actually do in
     # this terminal. Informational only (does NOT touch pass/warn/fail counts,
     # like Runtime route above), so the bun-parity matrix stays reconcilable.
@@ -11448,7 +11566,9 @@ except Exception:
 cmd_doctor_json() {
     local _loki_version
     _loki_version=$(get_version)
-    LOKI_VERSION="$_loki_version" python3 -c "
+    LOKI_VERSION="$_loki_version" \
+    LOKI_CATALOG_PATH="${LOKI_MODEL_CATALOG:-${_LOKI_SCRIPT_DIR}/../providers/model_catalog.json}" \
+    python3 -c "
 import json, os, subprocess, sys, shutil
 
 def get_version(cmd, args=None):
@@ -11623,6 +11743,32 @@ if _any_provider:
 else:
     fail_count += 1
 
+# Model catalog freshness. Local read only -- no network. Advisory: deliberately
+# excluded from pass/fail/warn counts and from 'ok', so a stale catalog can never
+# flip doctor's exit code. Mirrors describeCatalogFreshness() in
+# loki-ts/src/commands/doctor.ts.
+CATALOG_STALE_DAYS = 90
+_cat_path = os.environ['LOKI_CATALOG_PATH']
+try:
+    import datetime as _dt
+    _cat_updated = json.load(open(_cat_path))['updated']
+    _cat_age = (_dt.date.today() - _dt.date.fromisoformat(_cat_updated)).days
+    if _cat_age > CATALOG_STALE_DAYS:
+        # Deliberately NOT counted. The block comment above states catalog age is
+        # excluded from pass/fail/warn and from 'ok' so a stale catalog can never
+        # fail a build -- this increment contradicted that contract, and it also
+        # broke route parity: the Bun route (doctor.ts) never counted it, so the
+        # same host reported warnings: 2 on bash and 1 on Bun. bun-parity
+        # compares these byte for byte, so it would have gone red on day 91.
+        model_catalog = {'status': 'warn', 'updated': _cat_updated, 'age_days': _cat_age,
+                         'detail': f'Last updated {_cat_updated} ({_cat_age} days ago) -- may be missing newer models'}
+    else:
+        model_catalog = {'status': 'pass', 'updated': _cat_updated, 'age_days': _cat_age,
+                         'detail': f'Last updated {_cat_updated} ({_cat_age} days ago)'}
+except Exception:
+    model_catalog = {'status': 'warn', 'updated': None, 'age_days': None,
+                     'detail': 'Catalog unreadable or missing an ISO \"updated\" date -- cannot determine age'}
+
 result = {
     'loki_mode_version': os.environ.get('LOKI_VERSION', 'unknown'),
     'checks': checks,
@@ -11634,6 +11780,7 @@ result = {
     'sentrux': sentrux,
     'receipt_signing': receipt_signing,
     'memory': memory,
+    'model_catalog': model_catalog,
     'summary': {
         'passed': pass_count,
         'failed': fail_count,
@@ -17159,8 +17306,19 @@ def _loki_norm_alias(raw):
 # pin is a tier route, so tier names ARE valid pins. This normalizer mirrors
 # run.sh's trim+lowercase (interior whitespace preserved, so 'fab le' stays junk
 # and falls through to the default tier exactly like the runner's '*' arm).
+#
+# GENERIC TIER VOCABULARY (small|medium|high): translated onto the canonical
+# tier names before the allowlist check, mirroring run.sh's entry-point case.
+# The estimator runs in its own process and reads LOKI_SESSION_MODEL directly,
+# so without this a 'medium' pin would fall through to the '' default and the
+# quote would silently price a different model than the run dispatches -- the
+# exact estimator-vs-runner divergence this file keeps paying down. Only the
+# three new words are translated; every existing value passes through unchanged.
+_LOKI_GENERIC_TIERS = {'small': 'fast', 'medium': 'development', 'high': 'planning'}
+
 def _loki_norm_session_pin(raw):
     raw = (raw or '').strip().lower()
+    raw = _LOKI_GENERIC_TIERS.get(raw, raw)
     return raw if raw in (
         'haiku', 'sonnet', 'opus', 'fable',
         'planning', 'development', 'fast',
@@ -18128,6 +18286,23 @@ main() {
     local command="$1"
     shift
 
+    # LOKI_HELP_ONLY is set by `loki help <command>`, which delegates by
+    # re-entering dispatch as `loki <command> --help`. Asking for help must
+    # never DO anything, and dispatch reaches commands that start builds, stop
+    # runs and modify the install. Every command honours --help today; this
+    # makes that a guaranteed property of the help path rather than a fact
+    # someone has to re-verify whenever a command is added. If the delegated
+    # invocation somehow lost its --help, refuse rather than execute.
+    if [ "${LOKI_HELP_ONLY:-0}" = "1" ]; then
+        case " $* " in
+            *" --help "*|*" -h "*) : ;;
+            *)
+                echo "loki: refusing to run '$command' from the help path" >&2
+                return 1
+                ;;
+        esac
+    fi
+
     # v7.4.13: first-run telemetry moved to bin/loki shim so it fires for
     # both Bun-routed and bash-routed commands (autonomy/loki main() never
     # runs for the 8 ported commands). Marker file: ~/.loki-first-run.
@@ -18585,6 +18760,22 @@ main() {
             # deprecated-alias table; bare help prints the grouped front page.
             if [ "${1:-}" = "aliases" ]; then
                 show_help_aliases
+            elif [ -n "${1:-}" ]; then
+                # `loki help <command>` reaches the command's own help. Before
+                # this, $1 was read only for the literal "aliases" and otherwise
+                # discarded, so `loki help proof` printed the same generic front
+                # page as bare `loki help` -- while `loki proof --help` printed
+                # real help. Both spellings now agree.
+                #
+                # LOKI_HELP_ONLY makes this safe by construction rather than by
+                # audit. Delegation re-enters dispatch, and dispatch reaches
+                # commands that start, stop and modify things. Every one of them
+                # honours --help today, but "asking for help must never DO
+                # anything" is a property worth enforcing at the boundary
+                # instead of re-checking every time a command is added.
+                local _help_target="$1"
+                shift
+                LOKI_HELP_ONLY=1 "$0" "$_help_target" --help "$@"
             else
                 show_help
             fi

package/autonomy/run.sh

@@ -535,6 +535,43 @@ if [ -n "${LOKI_SESSION_ID:-}" ]; then
     unset _loki_sid_raw _loki_sid_safe
 fi
 
+# GENERIC TIER VOCABULARY (small|medium|high). A user should be able to ask for
+# a capability class without naming a vendor model, and get that provider's
+# latest model in the class. LOKI_SESSION_MODEL is the knob that already does
+# this -- it accepts the raw tier names planning|development|fast alongside the
+# Claude aliases -- so the generic words are normalized ONTO it here rather than
+# becoming a fourth spelling. LOKI_MAX_TIER (a cost CEILING) and LOKI_TIER (the
+# OSS/enterprise licensing seam) mean different things and are left alone.
+#
+# WHY NORMALIZE AT THE ENTRY POINT: the session-pin case block is byte-mirrored
+# in the estimator (autonomy/loki) and the dashboard (dashboard/server.py), and
+# every one of those mirrors is locked by a parity test. Translating here means
+# they keep seeing only the three canonical tier names and none of them change.
+#
+# The mapping is loki_tier_alias() in providers/models.sh -- the single source
+# of truth, not a second copy. Inlined as a case because run.sh must not source
+# a provider file this early in startup. Kept in lockstep by
+# tests/test-generic-tiers.sh.
+#
+# ONLY the three new words are translated. sonnet/haiku/opus/fable and the raw
+# tier names pass through untouched, so an unset LOKI_SESSION_MODEL still
+# defaults to sonnet and "medium" resolves to the same development-tier model
+# today's builds already use. This changes no existing run's model.
+# NORMALIZATION IS TRIM-ONLY + LOWERCASE, matching the estimator and dashboard
+# mirrors exactly. Interior whitespace is deliberately PRESERVED, so " med ium "
+# stays junk here just as it does there. Stripping interior spaces would make
+# this reader accept a value the other two reject, which is the precise kind of
+# divergence the session-pin parity tests exist to catch.
+_loki_generic_tier="${LOKI_SESSION_MODEL:-}"
+_loki_generic_tier="${_loki_generic_tier#"${_loki_generic_tier%%[![:space:]]*}"}"
+_loki_generic_tier="${_loki_generic_tier%"${_loki_generic_tier##*[![:space:]]}"}"
+case "$(printf '%s' "$_loki_generic_tier" | tr '[:upper:]' '[:lower:]')" in
+    small)  LOKI_SESSION_MODEL="fast"        ; export LOKI_SESSION_MODEL ;;
+    medium) LOKI_SESSION_MODEL="development" ; export LOKI_SESSION_MODEL ;;
+    high)   LOKI_SESSION_MODEL="planning"    ; export LOKI_SESSION_MODEL ;;
+esac
+unset _loki_generic_tier
+
 # Process Supervision (opt-in)
 WATCHDOG_ENABLED=${LOKI_WATCHDOG:-"false"}          # Enable process health monitoring
 WATCHDOG_INTERVAL=${LOKI_WATCHDOG_INTERVAL:-30}     # Check interval in seconds
@@ -12951,6 +12988,67 @@ with open(os.environ["LOKI_DA_PROMPT_OUT"], "w", encoding="utf-8") as handle:
 BUILD_DA_PROMPT
 }
 
+# Derive a review size cap (in bytes) from the active provider's context window.
+#
+# Args: $1 = env override (wins outright when set), $2 = historical default.
+# Echoes the effective cap.
+#
+# Why this exists: the caps were fixed byte counts sized for a ~200k-token model.
+# A local 12b/14b with an 8k-32k window would be handed a 425000-byte prompt and
+# fail in a way that reads as "the model is bad" rather than "we mis-sized it".
+#
+# Two stated assumptions, kept separate so they stay auditable:
+#   1. ~3 bytes per token. Real tokenizers land around 3-4 for code-heavy text;
+#      3 is the conservative end, and under-estimating capacity errs toward a
+#      smaller cap, which is the safe direction for a fail-closed gate.
+#   2. ~75% of the window is available for review INPUT. The remainder is the
+#      reviewer's own output and reasoning, which share the same window.
+# Neither is precise, and neither needs to be: the result is only ever used to
+# LOWER a cap below the shipped default.
+#
+# The min() is load-bearing. PROVIDER_CONTEXT_WINDOW is set on every current run
+# (LOKI_PROVIDER defaults to claude, whose window is 1000000), so deriving
+# upward would raise the cap 4-8x for every existing user. Taking the smaller of
+# derived-vs-default means a cap can only ever move DOWN. Concretely, a window
+# clamps to the shipped default whenever it is >= ~188889 tokens; every provider
+# that declares a window today (1M/400k/200k/200k) clears that, and a provider
+# declaring none takes the unset path, so no shipped provider changes behavior.
+# Only a genuinely small window (a local 12b/14b) shrinks anything.
+#
+# The shipped defaults are 425000 (prompt) and 400000 (diff). That 25000-byte gap
+# is the reviewer scaffolding wrapped around the diff, and the ordering is
+# load-bearing: if both caps derived to the SAME number, a diff sized just under
+# the diff gate would build a prompt exceeding the prompt gate, so every review
+# would block fail-closed with no operator-visible cause, on exactly the
+# small-window providers this derivation exists to support. Scaling by
+# _default/425000 preserves that gap at every window size. The 425000 denominator
+# must track the prompt-cap default passed by the caller below; if that default
+# changes, change the denominator with it or the diff-cap proportion breaks.
+review_effective_cap() {
+    local _override="$1" _default="$2"
+    # Operator wins outright, at any value, over both the default and the window.
+    if [ -n "$_override" ]; then
+        printf '%s' "$_override"
+        return 0
+    fi
+    # Fail safe to the historical default unless the window is a clean positive
+    # integer. A non-numeric result here would make the caller's `[ ... -gt ... ]`
+    # exit 2, which reads as false and would dispatch an oversized review.
+    case "${PROVIDER_CONTEXT_WINDOW:-}" in
+        ''|*[!0-9]*) printf '%s' "$_default"; return 0 ;;
+    esac
+    [ "$PROVIDER_CONTEXT_WINDOW" -gt 0 ] 2>/dev/null || { printf '%s' "$_default"; return 0; }
+    # Derive the INPUT budget, then scale it to this caller's cap so the
+    # prompt/diff proportion (and thus the scaffolding gap) is preserved.
+    local _budget=$(( PROVIDER_CONTEXT_WINDOW * 3 / 4 * 3 ))
+    local _derived=$(( _budget * _default / 425000 ))
+    if [ "$_derived" -lt "$_default" ]; then
+        printf '%s' "$_derived"
+    else
+        printf '%s' "$_default"
+    fi
+}
+
 run_code_review() {
     local loki_dir="${TARGET_DIR:-.}/.loki"
     local review_dir="$loki_dir/quality/reviews"
@@ -13311,11 +13409,12 @@ ${dependency_context}"
     # produces an opaque block. This remains fail-closed and never truncates.
     local _review_diff_bytes=0
     _review_diff_bytes=$(printf '%s' "$diff_content" | wc -c | tr -d ' ')
-    local _review_max_bytes="${LOKI_REVIEW_MAX_DIFF_BYTES:-400000}"
+    local _review_max_bytes
+    _review_max_bytes=$(review_effective_cap "${LOKI_REVIEW_MAX_DIFF_BYTES:-}" 400000)
     if [ "${_review_diff_bytes:-0}" -gt "$_review_max_bytes" ] 2>/dev/null; then
         local _big_dirs
         _big_dirs=$(printf '%s\n' "$changed_files" | sed 's#/.*##' | grep -v '^$' | sort | uniq -c | sort -rn | head -3 | awk '{print $2" ("$1" files)"}' | tr '\n' ' ')
-        log_error "Code review: context is ${_review_diff_bytes} bytes (limit ${_review_max_bytes}); refusing to truncate or dispatch a partial review. Biggest dirs: ${_big_dirs:-unknown}. Split the change or raise LOKI_REVIEW_MAX_DIFF_BYTES."
+        log_error "Code review: context is ${_review_diff_bytes} bytes (limit ${_review_max_bytes}, derived from PROVIDER_CONTEXT_WINDOW=${PROVIDER_CONTEXT_WINDOW:-unset}); refusing to truncate or dispatch a partial review. Biggest dirs: ${_big_dirs:-unknown}. Split the change or raise LOKI_REVIEW_MAX_DIFF_BYTES."
         emit_event_json "code_review_diff_oversized" \
             "review_id=$review_id" \
             "diff_bytes=$_review_diff_bytes" \
@@ -13847,7 +13946,8 @@ REVIEW_SELECTION_RECORD
     reviewer_count=$(echo "$selected_specialists" | python3 -c "import sys,json; print(len(json.load(sys.stdin)['reviewers']))")
     local dispatch_count
     dispatch_count=$(echo "$dispatch_specialists" | python3 -c "import sys,json; print(len(json.load(sys.stdin)['reviewers']))")
-    local _review_max_prompt_bytes="${LOKI_REVIEW_MAX_PROMPT_BYTES:-425000}"
+    local _review_max_prompt_bytes
+    _review_max_prompt_bytes=$(review_effective_cap "${LOKI_REVIEW_MAX_PROMPT_BYTES:-}" 425000)
     local _review_max_output_bytes="${LOKI_REVIEW_MAX_OUTPUT_BYTES:-1048576}"
     local review_pending_dir="$review_dir/$review_id/.pending"
     if ! mkdir -m 700 "$review_pending_dir" 2>/dev/null; then
@@ -15433,40 +15533,71 @@ start_dashboard() {
 
     # Check all required imports
     if ! "$python_cmd" -c "import fastapi; import sqlalchemy; import aiosqlite" 2>/dev/null; then
-        log_step "Setting up dashboard virtualenv..."
-        if ! [ -x "${dashboard_venv}/bin/python3" ]; then
-            # Remove broken venv if exists
-            [ -d "$dashboard_venv" ] && rm -rf "$dashboard_venv"
-            mkdir -p "$HOME/.loki"
-            python3 -m venv "$dashboard_venv" 2>/dev/null || python3.13 -m venv "$dashboard_venv" 2>/dev/null || {
-                log_warn "Failed to create virtualenv"
-                log_warn "You may need: sudo apt install python3-venv"
-            }
-        fi
-        if [ -x "${dashboard_venv}/bin/python3" ]; then
-            python_cmd="${dashboard_venv}/bin/python3"
-            log_step "Installing dashboard dependencies..."
-            if [ -f "$req_file" ]; then
-                "${dashboard_venv}/bin/pip" install -r "$req_file" 2>&1 | tail -1 || {
-                    log_warn "Pinned deps failed, trying unpinned..."
+        # The venv is HOST-GLOBAL, so concurrent runs must not rebuild it at
+        # once: one run's `rm -rf` would delete the tree another is importing
+        # from. Lock the venv path itself -- safe_acquire_lock appends
+        # ".lockdir", giving a SIBLING mutex the teardown below cannot destroy.
+        # Timeout must outlast a real cold venv create + pip install (not the 5s
+        # used by the JSON read-modify-write call sites). Mirrors the same guard
+        # in ensure_dashboard_venv (autonomy/loki) -- edit BOTH.
+        local _venv_locked=false
+        if type safe_acquire_lock >/dev/null 2>&1 \
+            && safe_acquire_lock "$dashboard_venv" "${LOKI_VENV_LOCK_TIMEOUT:-300}"; then
+            _venv_locked=true
+        fi
+        # Re-probe: the run we queued behind may have just built it for us.
+        [ -x "${dashboard_venv}/bin/python3" ] && python_cmd="${dashboard_venv}/bin/python3"
+        if "$python_cmd" -c "import fastapi; import sqlalchemy; import aiosqlite" 2>/dev/null; then
+            [ "$_venv_locked" = true ] && safe_release_lock "$dashboard_venv"
+            _venv_locked=false
+        elif [ "$_venv_locked" = false ] && type safe_acquire_lock >/dev/null 2>&1; then
+            # Lock timed out and the venv is still unusable. Do NOT rm -rf
+            # unlocked -- that is the exact race this lock exists to prevent.
+            #
+            # The re-probe above may have pointed python_cmd at the OTHER run's
+            # half-built venv (bin/python3 exists, pip install not finished).
+            # Reset to the system interpreter so the server launch below does not
+            # exec a knowingly-broken one.
+            python_cmd="python3"
+            log_warn "Timed out waiting for another run to build the dashboard venv"
+            log_warn "Dashboard will not be available (stale lock? rm -rf ${dashboard_venv}.lockdir)"
+        else
+            log_step "Setting up dashboard virtualenv..."
+            if ! [ -x "${dashboard_venv}/bin/python3" ]; then
+                # Remove broken venv if exists
+                [ -d "$dashboard_venv" ] && rm -rf "$dashboard_venv"
+                mkdir -p "$HOME/.loki"
+                python3 -m venv "$dashboard_venv" 2>/dev/null || python3.13 -m venv "$dashboard_venv" 2>/dev/null || {
+                    log_warn "Failed to create virtualenv"
+                    log_warn "You may need: sudo apt install python3-venv"
+                }
+            fi
+            if [ -x "${dashboard_venv}/bin/python3" ]; then
+                python_cmd="${dashboard_venv}/bin/python3"
+                log_step "Installing dashboard dependencies..."
+                if [ -f "$req_file" ]; then
+                    "${dashboard_venv}/bin/pip" install -r "$req_file" 2>&1 | tail -1 || {
+                        log_warn "Pinned deps failed, trying unpinned..."
+                        "${dashboard_venv}/bin/pip" install fastapi uvicorn pydantic websockets sqlalchemy aiosqlite 2>&1 | tail -1 || {
+                            log_warn "Failed to install dashboard dependencies"
+                            log_warn "Dashboard will not be available"
+                        }
+                        # greenlet is optional (needs C compiler on some platforms)
+                        "${dashboard_venv}/bin/pip" install greenlet 2>/dev/null || true
+                    }
+                else
                     "${dashboard_venv}/bin/pip" install fastapi uvicorn pydantic websockets sqlalchemy aiosqlite 2>&1 | tail -1 || {
                         log_warn "Failed to install dashboard dependencies"
                         log_warn "Dashboard will not be available"
                     }
-                    # greenlet is optional (needs C compiler on some platforms)
                     "${dashboard_venv}/bin/pip" install greenlet 2>/dev/null || true
-                }
+                fi
             else
-                "${dashboard_venv}/bin/pip" install fastapi uvicorn pydantic websockets sqlalchemy aiosqlite 2>&1 | tail -1 || {
-                    log_warn "Failed to install dashboard dependencies"
-                    log_warn "Dashboard will not be available"
-                }
-                "${dashboard_venv}/bin/pip" install greenlet 2>/dev/null || true
+                log_warn "Failed to install dashboard dependencies"
+                log_warn "Run manually: python3 -m venv ${dashboard_venv} && ${dashboard_venv}/bin/pip install fastapi uvicorn sqlalchemy aiosqlite"
             fi
-        else
-            log_warn "Failed to install dashboard dependencies"
-            log_warn "Run manually: python3 -m venv ${dashboard_venv} && ${dashboard_venv}/bin/pip install fastapi uvicorn sqlalchemy aiosqlite"
         fi
+        [ "$_venv_locked" = true ] && safe_release_lock "$dashboard_venv"
     fi
 
     # Start the FastAPI dashboard server
@@ -20750,6 +20881,16 @@ except Exception as exc:
             # Trim to last 500KB
             tail -c 500000 "$agent_log" > "$agent_log.tmp" && mv "$agent_log.tmp" "$agent_log"
         fi
+
+        # Same cap on the daily log. agent.log has been trimmed since it was
+        # introduced; its sibling never was, and it receives the full raw
+        # stream-json of every iteration -- measured ~1.5MB per iteration, so a
+        # 500-iteration run leaves ~725MB per day per build, times however many
+        # builds share the machine. Same threshold, same trim, no new rotation
+        # scheme.
+        if [ -f "$log_file" ] && [ "$(stat -f%z "$log_file" 2>/dev/null || stat -c%s "$log_file" 2>/dev/null)" -gt 1000000 ]; then
+            tail -c 500000 "$log_file" > "$log_file.tmp" && mv "$log_file.tmp" "$log_file"
+        fi
         touch "$agent_log"
         echo "" >> "$agent_log"
         echo "════════════════════════════════════════════════════════════════" >> "$agent_log"

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "8.6.1"
+__version__ = "8.8.0"
 
 # Expose the control app for easy import
 try: