loki-mode 8.65.0 → 8.67.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v8.65.0
+# Loki Mode v8.67.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -469,4 +469,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v8.65.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v8.67.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-8.65.0
+8.67.0

package/autonomy/loki

@@ -2083,6 +2083,59 @@ cmd_start() {
         esac
     done
 
+    # Explicit-provider pre-flight. Runs BEFORE provider_offer_gate below, and
+    # is deliberately narrower than it.
+    #
+    # provider_offer_gate passes when ANY provider is on PATH, so `--provider
+    # codex` on a claude-only machine sails through it and dies much later in
+    # the runner. And when NOTHING is installed the gate offers to install
+    # CLAUDE, which is a nudge toward substituting a provider the user did not
+    # ask for. An explicit choice that cannot be honoured is an error, never a
+    # silent (or suggested) swap: running a different model than the one asked
+    # for is worse than failing.
+    #
+    # Only guards an EXPLICIT choice (--provider flag or LOKI_PROVIDER). The
+    # default path returns immediately and still gets the friendly install
+    # offer below. The later check at the "Pre-flight: check that the provider
+    # CLI is installed" block stays: it covers effective_provider, which
+    # includes the default, so the two have different scopes.
+    local _pf_explicit="${provider:-${LOKI_PROVIDER:-}}"
+    if [ -n "$_pf_explicit" ] && ! command -v "$_pf_explicit" >/dev/null 2>&1; then
+        # Provider name == binary name here, same assumption as the existing
+        # check below and provider-offer.sh:53. opencode is included; it is in
+        # SUPPORTED_PROVIDERS but missing from the older lists.
+        local _pf_installed=""
+        local _pf_p
+        for _pf_p in claude codex cline aider opencode; do
+            if command -v "$_pf_p" >/dev/null 2>&1; then
+                _pf_installed="${_pf_installed:+$_pf_installed }$_pf_p"
+            fi
+        done
+
+        echo -e "${RED}Error: you asked for provider '$_pf_explicit', but its CLI is not installed.${NC}" >&2
+        echo "" >&2
+        echo "Install it:" >&2
+        case "$_pf_explicit" in
+            claude)   echo "  npm install -g @anthropic-ai/claude-code" >&2 ;;
+            codex)    echo "  npm install -g @openai/codex" >&2 ;;
+            cline)    echo "  npm install -g cline" >&2 ;;
+            aider)    echo "  pip install aider-chat" >&2 ;;
+            opencode) echo "  npm install -g opencode-ai" >&2 ;;
+            *)        echo "  No install command is known for '$_pf_explicit'." >&2 ;;
+        esac
+        echo "" >&2
+        if [ -n "$_pf_installed" ]; then
+            echo "Installed providers on this machine: $_pf_installed" >&2
+            echo "Re-run with one of those, e.g. loki start --provider ${_pf_installed%% *}" >&2
+        else
+            echo "No supported provider CLI is installed on this machine." >&2
+            echo "Supported providers: claude, codex, cline, aider, opencode" >&2
+        fi
+        echo "" >&2
+        echo "Loki will not silently run a different provider than the one you asked for." >&2
+        exit 1
+    fi
+
     # v7.29.0: provider pre-flight gate. If no provider CLI is installed, offer
     # to install one (TTY) or print honest manual instructions and exit 2
     # (non-TTY/CI), BEFORE any spend or runner entry. This moves what used to be
@@ -11229,6 +11282,18 @@ cmd_doctor() {
     fi
     echo ""
 
+    # Provider Availability. Which provider a build would ACTUALLY pick, which
+    # is decided by providers/loader.sh auto_detect_provider, not by PATH order
+    # and not by the section above. Rendered by the shared helper in
+    # provider-offer.sh so the Bun route prints the identical bytes (doctor
+    # stdout is byte-compared -- tests/test-doctor-blocker-parity.sh). Skipped
+    # silently, with no error, when loader.sh is missing or unsourceable.
+    if declare -f render_provider_availability >/dev/null 2>&1; then
+        if render_provider_availability; then
+            echo ""
+        fi
+    fi
+
     echo -e "${CYAN}API Keys:${NC}"
     # Note: CLI tools use their own login sessions outside Docker/K8s.
     # This section helps first-time users verify they can authenticate.
@@ -11710,6 +11775,16 @@ else:
 cmd_doctor_json() {
     local _loki_version
     _loki_version=$(get_version)
+    # Provider availability, computed in bash and handed to the python program
+    # as an env var (same pattern as LOKI_VERSION). Computed here rather than
+    # inside the program because the answer comes from sourcing loader.sh.
+    # Empty when loader.sh is unavailable, and the key is then null: the same
+    # graceful skip the text section performs.
+    local _provider_availability=""
+    if declare -f provider_availability_json >/dev/null 2>&1; then
+        _provider_availability="$(provider_availability_json 2>/dev/null || true)"
+    fi
+    LOKI_PROVIDER_AVAILABILITY="$_provider_availability" \
     LOKI_VERSION="$_loki_version" \
     LOKI_CATALOG_PATH="${LOKI_MODEL_CATALOG:-${_LOKI_SCRIPT_DIR}/../providers/model_catalog.json}" \
     python3 -c "
@@ -11913,9 +11988,20 @@ except Exception:
     model_catalog = {'status': 'warn', 'updated': None, 'age_days': None,
                      'detail': 'Catalog unreadable or missing an ISO \"updated\" date -- cannot determine age'}
 
+# Provider availability, handed in from bash (see cmd_doctor_json). Null when
+# providers/loader.sh could not be sourced, mirroring the text sections skip.
+# CAUTION: this block lives inside a DOUBLE-QUOTED python3 -c program, so no
+# apostrophes and no double quotes anywhere here, comments included.
+try:
+    _pa_raw = os.environ.get('LOKI_PROVIDER_AVAILABILITY', '').strip()
+    provider_availability = json.loads(_pa_raw) if _pa_raw else None
+except Exception:
+    provider_availability = None
+
 result = {
     'loki_mode_version': os.environ.get('LOKI_VERSION', 'unknown'),
     'checks': checks,
+    'provider_availability': provider_availability,
     'disk': {
         'available_gb': disk_gb,
         'status': disk_status

package/autonomy/provider-offer.sh

@@ -35,6 +35,22 @@ else
     _PO_NC=$'\033[0m'
 fi
 
+# Section colors for render_provider_availability. Deliberately gated on
+# NO_COLOR ALONE, unlike the _PO_* set above which also blanks on a non-TTY.
+# The section is printed inside `loki doctor` next to blocks colored by loki own
+# CYAN/GREEN/NC, and those are blanked on NO_COLOR only (autonomy/loki:37). A
+# TTY test here would strip color from this one section whenever doctor stdout
+# is piped while every neighbour kept its escapes.
+if [ -n "${NO_COLOR:-}" ]; then
+    _PO_S_CYAN=''; _PO_S_GREEN=''; _PO_S_YELLOW=''; _PO_S_DIM=''; _PO_S_NC=''
+else
+    _PO_S_CYAN=$'\033[0;36m'
+    _PO_S_GREEN=$'\033[0;32m'
+    _PO_S_YELLOW=$'\033[1;33m'
+    _PO_S_DIM=$'\033[2m'
+    _PO_S_NC=$'\033[0m'
+fi
+
 # The one canonical install command. Quoted everywhere; never re-derived.
 _PO_INSTALL_CMD="npm install -g @anthropic-ai/claude-code"
 
@@ -351,6 +367,109 @@ provider_offer_gate() {
     return 2
 }
 
+# render_provider_availability: print the "Provider Availability" doctor section.
+#
+# WHY IT LIVES HERE. `loki doctor` stdout is compared byte for byte between the
+# bash route and the Bun route (tests/test-doctor-blocker-parity.sh, and the
+# bun-parity workflow). Two independent renderers drift; one shared renderer
+# cannot. This is the same parity-by-construction seam the install offer and the
+# detect-sdk probe already use, so doctor.ts calls this instead of reimplementing
+# the priority list in TypeScript.
+#
+# WHY IT DOES NOT REUSE THE EXISTING "AI Providers" BLOCK. That block answers a
+# different question -- is each CLI on PATH, and how do I install it. This one
+# answers "which provider would a build actually pick", which is a property of
+# providers/loader.sh auto_detect_provider, not of PATH. It also covers opencode,
+# which the older block never listed.
+#
+# THE ORDER IS NOT SUPPORTED_PROVIDERS. auto_detect_provider walks
+# claude cline codex aider opencode; SUPPORTED_PROVIDERS is declared
+# claude codex cline aider opencode -- codex and cline are SWAPPED. Marking the
+# first installed entry of SUPPORTED_PROVIDERS would name codex on a machine
+# where a build would really pick cline. So the selected provider is always
+# whatever auto_detect_provider returns, never re-derived here.
+#
+# DEGRADES SILENTLY. Requirement: if loader.sh cannot be sourced, the section is
+# skipped rather than erroring. Everything runs inside one subshell, so a missing
+# or broken loader returns non-zero with nothing printed and doctor continues.
+render_provider_availability() {
+    # Path derived from THIS FILE, never from SKILL_DIR or _LOKI_SCRIPT_DIR:
+    # those belong to autonomy/loki and are unset when doctor.ts spawns this
+    # script standalone, which would blank the section on the Bun route only.
+    local _po_here
+    _po_here="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd)" || return 1
+    local _loader="$_po_here/providers/loader.sh"
+    [ -f "$_loader" ] || return 1
+
+    (
+        # shellcheck source=/dev/null
+        source "$_loader" >/dev/null 2>&1 || exit 1
+        declare -f auto_detect_provider >/dev/null 2>&1 || exit 1
+        [ "${#SUPPORTED_PROVIDERS[@]}" -gt 0 ] 2>/dev/null || exit 1
+
+        local _selected
+        _selected="$(auto_detect_provider 2>/dev/null)"
+
+        printf '%s\n' "${_PO_S_CYAN}Provider Availability:${_PO_S_NC}"
+        local _p
+        for _p in "${SUPPORTED_PROVIDERS[@]}"; do
+            if check_provider_installed "$_p" >/dev/null 2>&1; then
+                if [ "$_p" = "$_selected" ]; then
+                    printf '%s\n' "  ${_PO_S_GREEN}PASS${_PO_S_NC}  $_p - installed ${_PO_S_DIM}(auto-selected)${_PO_S_NC}"
+                else
+                    printf '%s\n' "  ${_PO_S_GREEN}PASS${_PO_S_NC}  $_p - installed"
+                fi
+            else
+                printf '%s\n' "  ${_PO_S_YELLOW}WARN${_PO_S_NC}  $_p - not installed"
+            fi
+        done
+
+        if [ -n "$_selected" ]; then
+            printf '%s\n' "  ${_PO_S_DIM}Auto-selected provider: ${_selected} (override with LOKI_PROVIDER)${_PO_S_NC}"
+        else
+            printf '%s\n' "  ${_PO_S_DIM}Auto-selected provider: none (no supported CLI installed)${_PO_S_NC}"
+        fi
+    ) || return 1
+}
+
+# provider_availability_json: the same data as one JSON object, for doctor --json.
+# Separate from the renderer so neither format has to parse the other. Same
+# degrade rule: no loader means no output and a non-zero status.
+provider_availability_json() {
+    local _po_here
+    _po_here="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd)" || return 1
+    local _loader="$_po_here/providers/loader.sh"
+    [ -f "$_loader" ] || return 1
+
+    (
+        # shellcheck source=/dev/null
+        source "$_loader" >/dev/null 2>&1 || exit 1
+        declare -f auto_detect_provider >/dev/null 2>&1 || exit 1
+        [ "${#SUPPORTED_PROVIDERS[@]}" -gt 0 ] 2>/dev/null || exit 1
+
+        local _selected _p _rows=""
+        _selected="$(auto_detect_provider 2>/dev/null)"
+        for _p in "${SUPPORTED_PROVIDERS[@]}"; do
+            if check_provider_installed "$_p" >/dev/null 2>&1; then
+                _rows="${_rows}${_p}=true"$'\n'
+            else
+                _rows="${_rows}${_p}=false"$'\n'
+            fi
+        done
+        _PA_SELECTED="$_selected" _PA_ROWS="$_rows" python3 -c '
+import json, os
+rows = []
+for line in os.environ.get("_PA_ROWS", "").splitlines():
+    if not line:
+        continue
+    name, _, installed = line.partition("=")
+    rows.append({"name": name, "installed": installed == "true"})
+selected = os.environ.get("_PA_SELECTED", "") or None
+print(json.dumps({"selected": selected, "providers": rows}, indent=2))
+' 2>/dev/null || exit 1
+    ) || return 1
+}
+
 # Executed directly (doctor.ts child_process bridge, or manual): run the offer.
 # When sourced by autonomy/loki, this block does not run.
 if [ "${BASH_SOURCE[0]}" = "$0" ]; then
@@ -362,6 +481,10 @@ if [ "${BASH_SOURCE[0]}" = "$0" ]; then
         # (loki-ts/src/commands/doctor.ts). Prints nothing, so it cannot perturb
         # the parity-captured stdout.
         detect-sdk)   detect_bundled_sdk_provider ;;
+        # Doctor "Provider Availability" section + its --json payload. Both
+        # routes call these so the two renderings cannot drift apart.
+        providers)      render_provider_availability ;;
+        providers-json) provider_availability_json ;;
         *)            offer_provider_install report ;;
     esac
 fi

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "8.65.0"
+__version__ = "8.67.0"
 
 # Expose the control app for easy import
 try: