loki-mode 8.78.0 → 8.80.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v8.78.0
+# Loki Mode v8.80.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -469,4 +469,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v8.78.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v8.80.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-8.78.0
+8.80.0

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "8.78.0"
+__version__ = "8.80.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -7359,6 +7359,49 @@ def _get_model_pricing() -> dict:
     return _MODEL_PRICING
 
 
+# The five fields whose presence makes ONE efficiency record a measurement.
+# Mirrors _MEASURED_FIELDS in autonomy/lib/efficiency_cost.py, which is the
+# canonical source. Kept as a local copy deliberately: the dashboard must not
+# sys.path-hack into autonomy/lib at request time just to read a constant.
+_MEASURED_FIELDS = (
+    "cost_usd",
+    "input_tokens",
+    "output_tokens",
+    "cache_read_tokens",
+    "cache_creation_tokens",
+)
+
+
+def _record_is_measured(rec: Any) -> bool:
+    """True when ONE efficiency record actually carries an observed value.
+
+    Mirrors record_is_measured() in autonomy/lib/efficiency_cost.py. Same field
+    list, same bool exclusion, same semantics -- read that docstring for the
+    reasoning. Do not let the two drift.
+
+    A PRESENT FILE IS NOT A MEASUREMENT. A run that did work necessarily
+    consumed tokens, so an all-zero record means we FAILED TO MEASURE, and
+    unmeasured must read as unknown rather than as free. This is the same
+    defect fixed on the receipt (v8.52.0), the prompt (v8.53.0), the verifier
+    (v8.54.0), the cost summary (v8.69.0) and kpis.ts (v8.72.0/v8.74.0); the
+    two dashboard cost readers were never audited for it.
+
+    Note the `and v` is a truthiness test on ONE field of ONE record, which is
+    the intended rule (zero contributes no evidence). It is NOT a guard on the
+    aggregate: a set of measured records summing to $0.00 is a real measured
+    zero and must still render 0.0, never null.
+    """
+    if not isinstance(rec, dict):
+        return False
+    for key in _MEASURED_FIELDS:
+        v = rec.get(key)
+        if isinstance(v, bool):
+            continue
+        if isinstance(v, (int, float)) and v:
+            return True
+    return False
+
+
 def _calculate_model_cost(
     model: str,
     input_tokens: int,
@@ -7414,6 +7457,8 @@ def _compute_cost_snapshot() -> dict:
     budget_limit = None
     budget_used = 0.0
     budget_remaining = None
+    # Did ANY record carry an observed value? Not "was a file present".
+    cost_recorded = False
 
     # Read efficiency files (one JSON file per iteration/task).
     # Use the iteration-*.json pattern so this reader sees the same
@@ -7430,6 +7475,8 @@ def _compute_cost_snapshot() -> dict:
                 # AttributeError. Skip such files rather than 500 the endpoint.
                 if not isinstance(data, dict):
                     continue
+                if _record_is_measured(data):
+                    cost_recorded = True
 
                 inp = data.get("input_tokens", 0)
                 out = data.get("output_tokens", 0)
@@ -7483,6 +7530,10 @@ def _compute_cost_snapshot() -> dict:
                 total_input = totals.get("total_input", 0)
                 total_output = totals.get("total_output", 0)
                 if total_input > 0 or total_output > 0:
+                    # Real observed tokens from the context tracker: this IS a
+                    # measurement, even if the recorded USD total happens to
+                    # be 0.
+                    cost_recorded = True
                     estimated_cost = totals.get("total_cost_usd", 0.0)
                     # Rebuild by_model and by_phase from per_iteration data
                     for it in ctx.get("per_iteration", []):
@@ -7519,14 +7570,21 @@ def _compute_cost_snapshot() -> dict:
     # expensive condition, so reporting it for a run with no data would send
     # someone hunting a caching problem that does not exist.
     _read_in = total_input + total_cache_read
+    # Unmeasured reads as null, never as 0/$0.00. `cost_recorded` is True when
+    # at least one record carried an OBSERVED value (_record_is_measured), so a
+    # set of measured records that genuinely sums to zero still renders 0.0 --
+    # the direction that would otherwise blank real data (the v8.72.0 trap).
     return {
-        "total_input_tokens": total_input,
-        "total_output_tokens": total_output,
-        "total_cache_read_tokens": total_cache_read,
-        "total_cache_creation_tokens": total_cache_creation,
-        "total_tokens": total_input + total_output + total_cache_read + total_cache_creation,
+        "total_input_tokens": total_input if cost_recorded else None,
+        "total_output_tokens": total_output if cost_recorded else None,
+        "total_cache_read_tokens": total_cache_read if cost_recorded else None,
+        "total_cache_creation_tokens": total_cache_creation if cost_recorded else None,
+        "total_tokens": (
+            total_input + total_output + total_cache_read + total_cache_creation
+        ) if cost_recorded else None,
         "cache_hit_ratio": round(total_cache_read / _read_in, 4) if _read_in > 0 else None,
-        "estimated_cost_usd": round(estimated_cost, 6),
+        "estimated_cost_usd": round(estimated_cost, 6) if cost_recorded else None,
+        "cost_recorded": cost_recorded,
         "by_phase": {k: {
             "input_tokens": v["input_tokens"],
             "output_tokens": v["output_tokens"],
@@ -7785,7 +7843,13 @@ def _compute_cost_timeline() -> dict:
         records.sort(key=_iter_key)
         cumulative = 0.0
         for data in records:
-            cost_recorded = True
+            # A PRESENT FILE IS NOT A MEASUREMENT. This previously flipped on
+            # for any parseable record, so the all-zero records a pre-v8.51.0
+            # codex run wrote reported total_usd $0.00 with cost_recorded True
+            # -- the endpoint asserting the run was FREE. Same predicate as
+            # /api/cost so the two cost readers cannot disagree.
+            if _record_is_measured(data):
+                cost_recorded = True
             inp = data.get("input_tokens", 0) or 0
             out = data.get("output_tokens", 0) or 0
             # Cache tiers, same as the /api/cost path. This snapshot drives the

package/events/emit.sh

@@ -306,7 +306,47 @@ fi
 # trailing newline. `|| true` keeps observability from ever aborting the emit
 # under `set -e` (matches autonomy/run.sh:9896).
 FLAT_EVENT="{\"timestamp\":\"$TIMESTAMP\",\"type\":\"$TYPE_ESC\",\"data\":$PAYLOAD}"
+# An ABSENT size reading is the empty string, NOT 0 -- see the vacuity note
+# below. A missing file legitimately measures 0 bytes; a `stat` that could not
+# run measures NOTHING, and the two must not collapse to the same value.
+_size_before=$(stat -f%z "$EVENTS_LOG" 2>/dev/null || stat -c%s "$EVENTS_LOG" 2>/dev/null || echo "")
+[ -n "$_size_before" ] || _size_before=0
 safe_append_event_jsonl "$EVENTS_LOG" "$FLAT_EVENT" 2>/dev/null || true
 
+# VERIFY THE APPEND LANDED. A dropped event is an ABSENT MEASUREMENT, and an
+# absent measurement read as a fact is how "0 events for a stage" gets reported
+# as "the stage did not happen".
+#
+# The helper's exit code cannot be trusted for this: BOTH best-effort fallback
+# paths (the flock-timeout branch at line 62 and the mkdir give-up branch at
+# line 91) end in `printf ... || true; return 0`, so a failed append returns 0.
+# Measured on an unwritable events.jsonl: emit.sh printed an id and exited 0
+# having written ZERO bytes. Compare the file size instead -- it is the only
+# signal that reflects what a downstream reader will actually see.
+#
+# NOT FATAL, BY CONSTRUCTION. emit.sh is fire-and-forget telemetry on the hot
+# path of every run; nothing waits on its result and a wedged or aborted emit
+# costs far more than a dropped line. So this only makes the loss VISIBLE:
+#   - the warning goes to STDERR, never stdout. Line 312's `echo "$EVENT_ID"`
+#     is the caller contract (`ID=$(bash emit.sh ...)`); anything else on
+#     stdout corrupts it.
+#   - the whole check sits in an `if`, so a failing `stat` cannot trip `set -e`.
+#   - the exit status is unchanged: a dropped event still exits 0.
+# Set LOKI_EMIT_QUIET=1 to suppress the warning (the drop still happens; you
+# are only choosing not to hear about it).
+#
+# GUARD AGAINST VACUITY. If `stat` cannot run, the old `|| echo 0` made BOTH
+# readings 0, they compared equal, and every SUCCESSFUL emit warned. A warning
+# that cries wolf on the hot path is worse than none -- it is exactly what
+# trains people to filter the channel that was supposed to surface real loss.
+# An empty reading means "not measured", and an absent measurement is never
+# evidence of a drop, so we stay silent rather than guess. Verified: with a
+# `stat` forced to exit 1, a healthy emit is silent and still writes its line.
+_size_after=$(stat -f%z "$EVENTS_LOG" 2>/dev/null || stat -c%s "$EVENTS_LOG" 2>/dev/null || echo "")
+if [ "${LOKI_EMIT_QUIET:-0}" != "1" ] && [ -n "$_size_after" ] && [ "$_size_after" = "$_size_before" ]; then
+    printf '[loki-events] WARNING: event %s (type=%s) was NOT recorded in %s -- downstream counts will under-report\n' \
+        "$EVENT_ID" "$TYPE" "$EVENTS_LOG" >&2
+fi
+
 # Output event ID
 echo "$EVENT_ID"

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var m_=Object.create;var{getPrototypeOf:u_,defineProperty:eK,getOwnPropertyNames:p_}=Object;var d_=Object.prototype.hasOwnProperty;function c_(Z){return this[Z]}var l_,i_,a_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?l_??=new WeakMap:i_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?m_(u_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of p_(Z))if(!d_.call(K,$))eK(K,$,{get:c_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var s_=(Z)=>Z;function n_(Z,X){this[Z]=s_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:n_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var e0=import.meta.require;var kO={};l0(kO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as o_}from"url";import{existsSync as UQ}from"fs";import{homedir as r_}from"os";function t_(){let Z=RO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(RO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(r_(),".loki")}var RO,i0;var H8=p(()=>{RO=Z$(o_(import.meta.url));i0=t_()});import{readFileSync as e_}from"fs";import{resolve as Zf,dirname as Xf}from"path";import{fileURLToPath as Qf}from"url";function h3(){if(h5!==null)return h5;let Z="8.78.0";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Xf(Qf(import.meta.url)),Q=X$(X);h5=e_(Zf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var bO={};l0(bO,{runOrThrow:()=>jf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Tf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>yO});async function NQ(Z,X=yO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let W=$.byteLength-(z-X);J+=Y.decode($.subarray(0,W),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function jf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=Mf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Mf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Tf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var yO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return wf?"":Z}var wf,L0,F8,p0,zV0,a0,W8,Q9,v;var S6=p(()=>{wf=(process.env.NO_COLOR??"").length>0;L0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),p0=o7("\x1B[1;33m"),zV0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),W8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),v=o7("\x1B[0m")});import{existsSync as bf}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(bf(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var ZL={};l0(ZL,{runStatus:()=>Kh});import{existsSync as Y9,readFileSync as g3,readdirSync as iO,statSync as aO}from"fs";import{resolve as h8,basename as rf}from"path";import{homedir as tf}from"os";function sO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function nO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*LQ/X);if(J>LQ)J=LQ;let z=LQ-J,K=F8;if(Y>=80)K=L0;else if(Y>=50)K=p0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),W=sO(Z),V=sO(X);return`  ${W8}${Q}${v} ${K}[${$}]${v} ${Y}% (${W} / ${V})`}async function Zh(){if(await X9("jq"))return!0;return process.stdout.write(`${L0}Error: jq is required but not installed.${v}
+var m_=Object.create;var{getPrototypeOf:u_,defineProperty:eK,getOwnPropertyNames:p_}=Object;var d_=Object.prototype.hasOwnProperty;function c_(Z){return this[Z]}var l_,i_,a_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?l_??=new WeakMap:i_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?m_(u_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of p_(Z))if(!d_.call(K,$))eK(K,$,{get:c_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var s_=(Z)=>Z;function n_(Z,X){this[Z]=s_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:n_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var e0=import.meta.require;var kO={};l0(kO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as o_}from"url";import{existsSync as UQ}from"fs";import{homedir as r_}from"os";function t_(){let Z=RO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(RO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(r_(),".loki")}var RO,i0;var H8=p(()=>{RO=Z$(o_(import.meta.url));i0=t_()});import{readFileSync as e_}from"fs";import{resolve as Zf,dirname as Xf}from"path";import{fileURLToPath as Qf}from"url";function h3(){if(h5!==null)return h5;let Z="8.80.0";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Xf(Qf(import.meta.url)),Q=X$(X);h5=e_(Zf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var bO={};l0(bO,{runOrThrow:()=>jf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Tf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>yO});async function NQ(Z,X=yO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let W=$.byteLength-(z-X);J+=Y.decode($.subarray(0,W),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function jf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=Mf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Mf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Tf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var yO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return wf?"":Z}var wf,L0,F8,p0,zV0,a0,W8,Q9,v;var S6=p(()=>{wf=(process.env.NO_COLOR??"").length>0;L0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),p0=o7("\x1B[1;33m"),zV0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),W8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),v=o7("\x1B[0m")});import{existsSync as bf}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(bf(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var ZL={};l0(ZL,{runStatus:()=>Kh});import{existsSync as Y9,readFileSync as g3,readdirSync as iO,statSync as aO}from"fs";import{resolve as h8,basename as rf}from"path";import{homedir as tf}from"os";function sO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function nO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*LQ/X);if(J>LQ)J=LQ;let z=LQ-J,K=F8;if(Y>=80)K=L0;else if(Y>=50)K=p0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),W=sO(Z),V=sO(X);return`  ${W8}${Q}${v} ${K}[${$}]${v} ${Y}% (${W} / ${V})`}async function Zh(){if(await X9("jq"))return!0;return process.stdout.write(`${L0}Error: jq is required but not installed.${v}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1232,4 +1232,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:Y}=await Promise.resolve().then(() => (h_(),f_));return Y(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(v_),2}}cO();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var uW0=await mW0(Bun.argv.slice(2));process.exit(uW0);
 
-//# debugId=EB92D509ECECF70F64756E2164756E21
+//# debugId=2DD3A14345063CF864756E2164756E21

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '8.78.0'
+__version__ = '8.80.0'

package/mcp/server.py

@@ -29,6 +29,21 @@ from typing import Optional, List, Dict, Any
 # Add parent directory to path for imports
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
+# THE canonical "was this actually measured?" predicate, imported (never
+# restated) from autonomy/lib/efficiency_cost.py. That module's docstring is
+# explicit that a second copy of this rule is how the honesty rule drifts.
+# autonomy/lib has no __init__.py, so it goes on sys.path by file-relative
+# path -- the same pattern tests/test_bench_adapters.py uses. Both autonomy/
+# and mcp/ ship in package.json files[], so this resolves in the npm tarball.
+sys.path.insert(
+    0,
+    os.path.join(
+        os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+        "autonomy", "lib",
+    ),
+)
+from efficiency_cost import record_is_measured  # noqa: E402
+
 # Import event bus for tool call events
 try:
     from events.bus import EventBus, EventType, EventSource, LokiEvent
@@ -1467,6 +1482,47 @@ async def loki_project_status() -> str:
         return json.dumps({"error": str(e)})
 
 
+_EFFICIENCY_MEASURED_FIELDS = (
+    "cost_usd",
+    "input_tokens",
+    "output_tokens",
+    "cache_read_tokens",
+    "cache_creation_tokens",
+)
+
+
+def _honest_efficiency_record(rec):
+    """Blank cost/token fields on a record that carries NO observed value.
+
+    loki_agent_metrics is machine-consumed: another agent reads this and does
+    budget accounting on it. Returning cost_usd=0 for a run we simply failed to
+    measure asserts the run was FREE, which is a fabricated fact -- the same
+    class that cost this repo six releases. An unmeasured value must read as
+    null, never as zero.
+
+    The measured/unmeasured decision is delegated wholesale to
+    record_is_measured() (autonomy/lib/efficiency_cost.py), so this surface and
+    the receipt cannot drift apart.
+
+    A genuinely measured ZERO is preserved: record_is_measured() looks at ALL
+    five fields, so a record with cost_usd=0.002 and input_tokens=0 is measured
+    and is returned UNTOUCHED -- that 0 stays 0. The decision is therefore made
+    once for the WHOLE record, never per field: 0 is falsy, so a per-field falsy
+    test would blank exactly those genuine measured zeros (the v8.72.0 trap).
+    """
+    if not isinstance(rec, dict):
+        return rec
+    if record_is_measured(rec):
+        return rec
+    out = dict(rec)
+    for key in _EFFICIENCY_MEASURED_FIELDS:
+        if key in out:
+            out[key] = None
+    # Explicit, so a consumer can tell "we did not measure" from "absent key".
+    out["measured"] = False
+    return out
+
+
 @mcp.tool()
 async def loki_agent_metrics() -> str:
     """
@@ -1486,7 +1542,9 @@ async def loki_agent_metrics() -> str:
                 if fname.endswith('.json'):
                     fpath = safe_path_join('.loki', 'metrics', 'efficiency', fname)
                     with safe_open(fpath, 'r') as f:
-                        metrics["agents"].append(json.load(f))
+                        metrics["agents"].append(
+                            _honest_efficiency_record(json.load(f))
+                        )
 
         # Read token economics
         econ_path = safe_path_join('.loki', 'metrics', 'token-economics.json')

package/memory/rag_injector.py

@@ -98,9 +98,24 @@ def build_rag_context(query, max_tokens=2000, knowledge_dir=None):
         # Support both 'name'/'pattern' and 'description' fields.
         # Every field is sanitized: memory entries are untrusted input and must
         # not be able to inject instructions or break the prompt structure.
-        name = _sanitize_field(p.get('name', p.get('pattern', 'Unknown Pattern')))
-        desc = _sanitize_field(p.get('description', p.get('correct_approach', '')))
+        # `or` chaining, not .get(a, .get(b, default)): a present-but-empty
+        # 'description' would otherwise shadow a real 'correct_approach', and a
+        # row missing BOTH name keys would resolve to the literal string
+        # 'Unknown Pattern' -- truthy, so the substance check below could never
+        # fire on it.
+        name = _sanitize_field(p.get('name') or p.get('pattern') or '')
+        desc = _sanitize_field(p.get('description') or p.get('correct_approach') or '')
         category = _sanitize_field(p.get('category', ''))
+
+        # Substance check: a pattern that matched only on its category (or
+        # whose fields sanitized away to nothing) has no memory to inject.
+        # Rendering it as "### Unknown Pattern" under the "patterns were found
+        # in the organization knowledge base" header presents a fabricated
+        # memory as a real one and burns prompt budget. Name OR description is
+        # enough -- category alone is a bucket label, not a memory, and a named
+        # pattern with no description is still genuine signal.
+        if not name and not desc:
+            continue
         source_raw = p.get('_source_project', '')
         # Path().name strips any directory traversal; sanitize the basename too.
         source = _sanitize_field(Path(str(source_raw)).name) if source_raw else ''

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "8.78.0",
+  "version": "8.80.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "8.78.0",
+  "version": "8.80.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/providers/loader.sh

@@ -76,10 +76,18 @@ validate_provider_config() {
     # Variables that must be defined but can be empty string.
     #
     # PROVIDER_AUTONOMOUS_FLAG moved here in v8.2.0: not every CLI needs a flag
-    # to run non-interactively. `opencode run <prompt>` is already autonomous, so
-    # requiring a non-empty value rejected a perfectly valid provider as
-    # "incomplete". The variable must still be DEFINED -- an author who forgets
-    # it entirely is still caught -- but an intentional empty value is legal.
+    # to run non-interactively, so requiring a non-empty value could reject a
+    # valid provider as "incomplete". The variable must still be DEFINED -- an
+    # author who forgets it entirely is still caught -- but an intentional empty
+    # value is legal.
+    #
+    # The original justification cited `opencode run <prompt>` as already
+    # autonomous. That was WRONG and cost opencode users every run: `opencode run
+    # --help` (1.18.9) shows `--auto ... [default: false]`, so without it the run
+    # blocks on a permission prompt. opencode now declares "--auto". Keep this
+    # list for a provider that genuinely needs no flag, but VERIFY against the
+    # real CLI's --help before adding one -- an empty value here is a silent hang,
+    # not a validation error.
     local allow_empty_vars=(
         PROVIDER_PROMPT_FLAG
         PROVIDER_AUTONOMOUS_FLAG

package/providers/opencode.sh

@@ -46,7 +46,15 @@ PROVIDER_CLI="opencode"
 # CLI Invocation
 # `run` takes the prompt POSITIONALLY; there is no -p/--prompt flag.
 PROVIDER_SUBCOMMAND="run"
-PROVIDER_AUTONOMOUS_FLAG=""
+# --auto is REQUIRED for autonomous operation. Verified against the real CLI
+# (opencode 1.18.9): `opencode run --help` documents
+#   --auto  auto-approve permissions that are not explicitly denied  [default: false]
+# The earlier empty value assumed `opencode run <prompt>` was already
+# non-interactive. It is not: without --auto the run stalls on the first
+# permission prompt with no TTY to answer it, which is indistinguishable from a
+# hang. This is opencode's equivalent of claude's --dangerously-skip-permissions
+# and aider's --yes-always, both of which their providers already pass.
+PROVIDER_AUTONOMOUS_FLAG="--auto"
 PROVIDER_PROMPT_FLAG=""
 PROVIDER_PROMPT_POSITIONAL=true
 
@@ -123,7 +131,7 @@ provider_invoke() {
     shift
     [ -n "$prompt" ] || return 1
     command -v opencode >/dev/null 2>&1 || return 127
-    opencode run --model "$PROVIDER_MODEL_DEVELOPMENT" "$prompt" "$@"
+    opencode run --auto --model "$PROVIDER_MODEL_DEVELOPMENT" "$prompt" "$@"
 }
 
 # provider_invoke_with_tier <tier> <prompt>
@@ -138,7 +146,7 @@ provider_invoke_with_tier() {
     command -v opencode >/dev/null 2>&1 || return 127
     local model
     model="$(provider_get_tier_param "$tier")"
-    opencode run --model "$model" "$prompt" "$@"
+    opencode run --auto --model "$model" "$prompt" "$@"
 }
 
 # provider_invoke_argv <tier> <prompt> -- see providers/claude.sh for rationale.
@@ -147,5 +155,5 @@ provider_invoke_argv() {
     local prompt="${2:-}"
     local model
     model="$(provider_get_tier_param "$tier")"
-    _LOKI_INVOKE_ARGV=(opencode run --model "$model" "$prompt")
+    _LOKI_INVOKE_ARGV=(opencode run --auto --model "$model" "$prompt")
 }