loki-mode 8.88.0 → 8.89.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v8.88.0
+# Loki Mode v8.89.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -469,4 +469,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v8.88.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v8.89.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-8.88.0
+8.89.0

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "8.88.0"
+__version__ = "8.89.0"
 
 # Expose the control app for easy import
 try:

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var m_=Object.create;var{getPrototypeOf:u_,defineProperty:eK,getOwnPropertyNames:p_}=Object;var d_=Object.prototype.hasOwnProperty;function c_(Z){return this[Z]}var l_,i_,a_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?l_??=new WeakMap:i_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?m_(u_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of p_(Z))if(!d_.call(K,$))eK(K,$,{get:c_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var s_=(Z)=>Z;function n_(Z,X){this[Z]=s_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:n_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var e0=import.meta.require;var kO={};l0(kO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as o_}from"url";import{existsSync as UQ}from"fs";import{homedir as r_}from"os";function t_(){let Z=RO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(RO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(r_(),".loki")}var RO,i0;var H8=p(()=>{RO=Z$(o_(import.meta.url));i0=t_()});import{readFileSync as e_}from"fs";import{resolve as Zf,dirname as Xf}from"path";import{fileURLToPath as Qf}from"url";function h3(){if(h5!==null)return h5;let Z="8.88.0";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Xf(Qf(import.meta.url)),Q=X$(X);h5=e_(Zf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var bO={};l0(bO,{runOrThrow:()=>jf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Tf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>yO});async function NQ(Z,X=yO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let W=$.byteLength-(z-X);J+=Y.decode($.subarray(0,W),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function jf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=Mf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Mf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Tf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var yO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return wf?"":Z}var wf,L0,F8,p0,zV0,a0,W8,Q9,v;var S6=p(()=>{wf=(process.env.NO_COLOR??"").length>0;L0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),p0=o7("\x1B[1;33m"),zV0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),W8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),v=o7("\x1B[0m")});import{existsSync as bf}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(bf(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var ZL={};l0(ZL,{runStatus:()=>Kh});import{existsSync as Y9,readFileSync as g3,readdirSync as iO,statSync as aO}from"fs";import{resolve as h8,basename as rf}from"path";import{homedir as tf}from"os";function sO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function nO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*LQ/X);if(J>LQ)J=LQ;let z=LQ-J,K=F8;if(Y>=80)K=L0;else if(Y>=50)K=p0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),W=sO(Z),V=sO(X);return`  ${W8}${Q}${v} ${K}[${$}]${v} ${Y}% (${W} / ${V})`}async function Zh(){if(await X9("jq"))return!0;return process.stdout.write(`${L0}Error: jq is required but not installed.${v}
+var m_=Object.create;var{getPrototypeOf:u_,defineProperty:eK,getOwnPropertyNames:p_}=Object;var d_=Object.prototype.hasOwnProperty;function c_(Z){return this[Z]}var l_,i_,a_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?l_??=new WeakMap:i_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?m_(u_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of p_(Z))if(!d_.call(K,$))eK(K,$,{get:c_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var s_=(Z)=>Z;function n_(Z,X){this[Z]=s_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:n_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var e0=import.meta.require;var kO={};l0(kO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as o_}from"url";import{existsSync as UQ}from"fs";import{homedir as r_}from"os";function t_(){let Z=RO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(RO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(r_(),".loki")}var RO,i0;var H8=p(()=>{RO=Z$(o_(import.meta.url));i0=t_()});import{readFileSync as e_}from"fs";import{resolve as Zf,dirname as Xf}from"path";import{fileURLToPath as Qf}from"url";function h3(){if(h5!==null)return h5;let Z="8.89.0";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Xf(Qf(import.meta.url)),Q=X$(X);h5=e_(Zf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var bO={};l0(bO,{runOrThrow:()=>jf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Tf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>yO});async function NQ(Z,X=yO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let W=$.byteLength-(z-X);J+=Y.decode($.subarray(0,W),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function jf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=Mf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function Mf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Tf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var yO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return wf?"":Z}var wf,L0,F8,p0,zV0,a0,W8,Q9,v;var S6=p(()=>{wf=(process.env.NO_COLOR??"").length>0;L0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),p0=o7("\x1B[1;33m"),zV0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),W8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),v=o7("\x1B[0m")});import{existsSync as bf}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(bf(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var ZL={};l0(ZL,{runStatus:()=>Kh});import{existsSync as Y9,readFileSync as g3,readdirSync as iO,statSync as aO}from"fs";import{resolve as h8,basename as rf}from"path";import{homedir as tf}from"os";function sO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function nO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*LQ/X);if(J>LQ)J=LQ;let z=LQ-J,K=F8;if(Y>=80)K=L0;else if(Y>=50)K=p0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),W=sO(Z),V=sO(X);return`  ${W8}${Q}${v} ${K}[${$}]${v} ${Y}% (${W} / ${V})`}async function Zh(){if(await X9("jq"))return!0;return process.stdout.write(`${L0}Error: jq is required but not installed.${v}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1232,4 +1232,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:Y}=await Promise.resolve().then(() => (h_(),f_));return Y(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(v_),2}}cO();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var uW0=await mW0(Bun.argv.slice(2));process.exit(uW0);
 
-//# debugId=9115B3EA38A3D81564756E2164756E21
+//# debugId=C2908F5759B1B75564756E2164756E21

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '8.88.0'
+__version__ = '8.89.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "8.88.0",
+  "version": "8.89.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "8.88.0",
+  "version": "8.89.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/tools/preflight.sh

@@ -0,0 +1,340 @@
+#!/usr/bin/env bash
+# Will this run succeed, and what will it likely cost? Answered BEFORE the run.
+#
+# WHY THIS EXISTS. The signals that predict a doomed or expensive build already
+# exist, but a user has to know four commands to collect them, and three of the
+# four are easy to reach for in a form that MUTATES. This is one read-only
+# command that composes them into a single verdict.
+#
+# COMPOSE, NEVER REIMPLEMENT. Every number and every fix string below comes out
+# of the surface that owns it. This repo has already paid for the alternative:
+# four separate provider lists drifted apart, and "unmeasured" was rendered as
+# "$0.00" on four surfaces before the estimator centralised the predicate. So:
+#
+#   provider selection  providers/loader.sh auto_detect_provider (the ONE list)
+#   blockers + fixes    loki doctor --json  (its detail strings, verbatim)
+#   resumable run       loki next --dry-run (read-only; loki resume DELETES the
+#                       PAUSE file, so it can never be the seam a preflight uses)
+#   projected cost      tools/estimate-run.py --json (its notes, verbatim)
+#
+# When a signal is absent this prints UNKNOWN and says why. It never prints 0
+# for something it did not measure, and it never invents the iteration horizon:
+# --iterations is the estimator's REQUIRED input precisely so a guess cannot be
+# laundered through a real per-iteration cost, and passing a default here would
+# reintroduce that on this surface.
+#
+# Read-only: starts nothing, spends nothing, contacts no provider.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+# ponytail: overridable so the "missing helper degrades to unavailable" path is
+# testable without moving repo files out from under a live install.
+LOKI_PREFLIGHT_DOCTOR="${LOKI_PREFLIGHT_DOCTOR:-$REPO_ROOT/autonomy/loki}"
+LOKI_PREFLIGHT_ESTIMATOR="${LOKI_PREFLIGHT_ESTIMATOR:-$REPO_ROOT/tools/estimate-run.py}"
+LOKI_PREFLIGHT_LOADER="${LOKI_PREFLIGHT_LOADER:-$REPO_ROOT/providers/loader.sh}"
+
+BOLD='\033[1m'; RED='\033[0;31m'; GREEN='\033[0;32m'
+YELLOW='\033[1;33m'; DIM='\033[2m'; NC='\033[0m'
+
+# timeout(1) is coreutils; on macOS it exists only via homebrew. Hard-coding it
+# made this script exit 127 on a stock mac -- and made the scrubbed-PATH test
+# impossible to run at all. Degrade to running the helper uncapped rather than
+# failing the whole preflight over a missing convenience.
+_run_capped() {
+    local secs="$1"; shift
+    if command -v timeout >/dev/null 2>&1; then
+        timeout "$secs" "$@"
+    elif command -v gtimeout >/dev/null 2>&1; then
+        gtimeout "$secs" "$@"
+    else
+        "$@"
+    fi
+}
+
+ITERATIONS=""
+WORKSPACE="."
+
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        --iterations)
+            # An empty value must ERROR, not silently read as "flag absent" --
+            # that would quietly downgrade a requested projection to UNKNOWN and
+            # look like missing history rather than a typo.
+            if [ -z "${2:-}" ]; then
+                echo "preflight: --iterations requires a value" >&2; exit 64
+            fi
+            ITERATIONS="$2"; shift 2 ;;
+        --iterations=*)
+            ITERATIONS="${1#*=}"
+            if [ -z "$ITERATIONS" ]; then
+                echo "preflight: --iterations requires a value" >&2; exit 64
+            fi
+            shift ;;
+        --help|-h)
+            echo "loki preflight -- will this run succeed, and what will it cost?"
+            echo ""
+            echo "Usage: tools/preflight.sh [WORKSPACE] [--iterations N]"
+            echo ""
+            echo "Read-only. Starts nothing, spends nothing, contacts no provider."
+            echo ""
+            echo "  --iterations N   Project cost over N iterations. Without it the"
+            echo "                   measured per-iteration cost is still shown; the"
+            echo "                   total reads UNKNOWN rather than being guessed."
+            exit 0 ;;
+        -*)
+            echo "preflight: unknown option: $1" >&2; exit 64 ;;
+        *)
+            WORKSPACE="$1"; shift ;;
+    esac
+done
+
+if [ -n "$ITERATIONS" ] && ! [[ "$ITERATIONS" =~ ^[1-9][0-9]*$ ]]; then
+    echo "preflight: --iterations must be a positive integer, got: $ITERATIONS" >&2
+    exit 64
+fi
+
+if [ ! -d "$WORKSPACE" ]; then
+    echo "preflight: no such workspace: $WORKSPACE" >&2
+    exit 66
+fi
+
+BLOCKERS=()   # each entry: "what blocks|the command that fixes it"
+WARNINGS=()
+
+echo -e "${BOLD}Loki preflight${NC} -- $(cd "$WORKSPACE" && pwd)"
+echo -e "${DIM}Read-only: starts nothing, spends nothing, contacts no provider.${NC}"
+echo ""
+
+# ---- Provider ---------------------------------------------------------------
+# auto_detect_provider is THE priority list. Restating the order here is how the
+# four-lists-disagree bug happened, so this sources it and asks.
+echo -e "${BOLD}Provider${NC}"
+PROVIDER=""
+if [ -r "$LOKI_PREFLIGHT_LOADER" ]; then
+    # shellcheck disable=SC1090
+    if source "$LOKI_PREFLIGHT_LOADER" >/dev/null 2>&1 \
+       && declare -f auto_detect_provider >/dev/null 2>&1; then
+        PROVIDER="$(auto_detect_provider 2>/dev/null || true)"
+        if [ -n "$PROVIDER" ]; then
+            echo -e "  ${GREEN}OK${NC}    auto-detection would select: ${BOLD}${PROVIDER}${NC}"
+        else
+            echo -e "  ${RED}FAIL${NC}  no provider CLI installed"
+        fi
+    else
+        echo -e "  ${YELLOW}UNKNOWN${NC}  provider loader unreadable -- selection not determined"
+        WARNINGS+=("provider selection unavailable: could not load $LOKI_PREFLIGHT_LOADER")
+    fi
+else
+    echo -e "  ${YELLOW}UNKNOWN${NC}  provider loader missing -- selection not determined"
+    WARNINGS+=("provider selection unavailable: $LOKI_PREFLIGHT_LOADER not found")
+fi
+echo ""
+
+# ---- Doctor blockers --------------------------------------------------------
+# --json only. The TEXT path backgrounds a first-run-blocked telemetry emit on
+# failure, which a read-only preflight must not trigger.
+echo -e "${BOLD}Environment${NC}"
+DOCTOR_JSON=""
+if [ -x "$LOKI_PREFLIGHT_DOCTOR" ] || [ -r "$LOKI_PREFLIGHT_DOCTOR" ]; then
+    DOCTOR_JSON="$(cd "$WORKSPACE" && _run_capped 120 bash "$LOKI_PREFLIGHT_DOCTOR" doctor --json 2>/dev/null || true)"
+fi
+if [ -z "$DOCTOR_JSON" ]; then
+    echo -e "  ${YELLOW}UNKNOWN${NC}  doctor unavailable -- environment blockers not checked"
+    WARNINGS+=("environment check unavailable: could not run '$LOKI_PREFLIGHT_DOCTOR doctor --json'")
+else
+    # Surface doctor's OWN blocker text. Re-authoring the fix line is how the
+    # advice drifts from the thing that actually installs the dependency.
+    DOCTOR_REPORT="$(printf '%s' "$DOCTOR_JSON" | python3 -c '
+import json, sys
+try:
+    d = json.load(sys.stdin)
+except Exception:
+    sys.exit(3)
+lines = []
+for c in d.get("checks") or []:
+    if c.get("status") == "fail":
+        name = c.get("name") or c.get("command") or "check"
+        cmd = c.get("command") or ""
+        lines.append("BLOCK\t%s is missing or too old\tInstall %s, then re-run: loki doctor" % (name, cmd or name))
+ai = d.get("ai_provider") or {}
+if ai.get("status") == "fail":
+    detail = ai.get("detail") or "No AI provider CLI."
+    what, _, fix = detail.partition("Fix:")
+    lines.append("BLOCK\t%s\t%s" % (what.strip().rstrip(".") or "No AI provider CLI",
+                                    fix.strip() or "install a provider CLI"))
+disk = d.get("disk") or {}
+if disk.get("status") == "fail":
+    lines.append("BLOCK\tLow disk space (%s GB available)\tFree up disk, then re-run: loki doctor"
+                 % disk.get("available_gb"))
+s = d.get("summary") or {}
+lines.append("SUMMARY\t%s\t%s" % (s.get("passed"), s.get("warnings")))
+print("\n".join(lines))
+' 2>/dev/null || true)"
+
+    if [ -z "$DOCTOR_REPORT" ]; then
+        echo -e "  ${YELLOW}UNKNOWN${NC}  doctor output unparseable -- environment blockers not checked"
+        WARNINGS+=("environment check unavailable: doctor --json produced no readable result")
+    else
+        _env_blocks=0
+        while IFS=$'\t' read -r kind a b; do
+            case "$kind" in
+                BLOCK)
+                    # THE TWO LISTS DISAGREE, and preflight is the first surface
+                    # that shows both at once. auto_detect_provider iterates
+                    # claude cline codex aider opencode; doctor's ai_provider
+                    # checks only the first four. On an opencode-only machine
+                    # this printed "would select: opencode" directly above
+                    # "No AI provider CLI" -- a self-contradicting report.
+                    # Neither producer is editable from here, so the
+                    # disagreement is NAMED rather than silently resolved:
+                    # asserting either side is right would be a fifth opinion
+                    # about which providers count, which is how the four lists
+                    # drifted apart in the first place.
+                    if [ "$a" = "No AI provider CLI" ] && [ -n "$PROVIDER" ]; then
+                        echo -e "  ${YELLOW}WARN${NC}  doctor reports no provider, but auto-detection selected '${PROVIDER}'"
+                        echo -e "  ${DIM}      doctor does not recognise '${PROVIDER}'. Unresolved here: these two${NC}"
+                        echo -e "  ${DIM}      checks disagree, so provider readiness is UNCERTAIN, not confirmed.${NC}"
+                        WARNINGS+=("provider readiness uncertain: auto-detection selected '$PROVIDER' but doctor does not count it as a provider")
+                    else
+                        echo -e "  ${RED}FAIL${NC}  $a"
+                        BLOCKERS+=("$a|$b")
+                        _env_blocks=$((_env_blocks + 1))
+                    fi ;;
+                SUMMARY)
+                    if [ "$_env_blocks" -eq 0 ]; then
+                        echo -e "  ${GREEN}OK${NC}    doctor: $a checks passed, $b warning(s)"
+                    fi ;;
+            esac
+        done <<< "$DOCTOR_REPORT"
+    fi
+fi
+
+# A provider is required to run at all. Doctor reports it too, so only add this
+# when doctor could not be consulted -- otherwise the same blocker lists twice.
+if [ -z "$PROVIDER" ] && [ -r "$LOKI_PREFLIGHT_LOADER" ] && [ -z "$DOCTOR_JSON" ]; then
+    BLOCKERS+=("No AI provider CLI|npm install -g @anthropic-ai/claude-code")
+fi
+echo ""
+
+# ---- Resumable run ----------------------------------------------------------
+# loki next --dry-run resolves the saved run status and prints the exact
+# continuation command WITHOUT acting. loki resume would rm the PAUSE file.
+echo -e "${BOLD}Saved state${NC}"
+if [ ! -d "$WORKSPACE/.loki" ]; then
+    echo -e "  ${DIM}no .loki/ here -- this would be a fresh run${NC}"
+elif [ -z "$DOCTOR_JSON" ] && [ ! -r "$LOKI_PREFLIGHT_DOCTOR" ]; then
+    echo -e "  ${YELLOW}UNKNOWN${NC}  cannot resolve saved run state (loki CLI unavailable)"
+    WARNINGS+=("saved-state check unavailable: $LOKI_PREFLIGHT_DOCTOR not found")
+else
+    NEXT_OUT="$(cd "$WORKSPACE" && _run_capped 60 bash "$LOKI_PREFLIGHT_DOCTOR" next --dry-run 2>/dev/null || true)"
+    if [ -z "$NEXT_OUT" ]; then
+        echo -e "  ${DIM}no resumable run found${NC}"
+    else
+        _outcome="$(printf '%s' "$NEXT_OUT" | sed -n 's/.*Last outcome *: *//p' | head -1)"
+        _will="$(printf '%s' "$NEXT_OUT" | sed -n 's/.*Will run *: *//p' | head -1)"
+        if [ -n "$_outcome" ]; then
+            echo -e "  ${YELLOW}FOUND${NC} interrupted or paused run present (last outcome: ${BOLD}${_outcome}${NC})"
+            [ -n "$_will" ] && echo -e "        continue it with: ${BOLD}${_will}${NC}"
+            WARNINGS+=("a resumable run exists here; starting fresh would leave it behind")
+        else
+            echo -e "  ${DIM}no resumable run found${NC}"
+        fi
+    fi
+fi
+echo ""
+
+# ---- Projected cost ---------------------------------------------------------
+echo -e "${BOLD}Projected cost${NC}"
+if [ ! -r "$LOKI_PREFLIGHT_ESTIMATOR" ]; then
+    echo -e "  ${YELLOW}UNKNOWN${NC}  estimator unavailable -- no cost projection"
+    WARNINGS+=("cost projection unavailable: $LOKI_PREFLIGHT_ESTIMATOR not found")
+else
+    # --iterations is REQUIRED by the estimator by design. Passing 1 here just to
+    # satisfy it and then scaling would be the guess it refuses to make, so when
+    # the user gave none we ask for the per-iteration basis only and report the
+    # total as UNKNOWN.
+    _est_iters="${ITERATIONS:-1}"
+    EST_JSON="$(_run_capped 60 python3 "$LOKI_PREFLIGHT_ESTIMATOR" --iterations "$_est_iters" "$WORKSPACE" --json 2>/dev/null || true)"
+    if [ -z "$EST_JSON" ]; then
+        echo -e "  ${YELLOW}UNKNOWN${NC}  estimator produced no result -- no cost projection"
+        WARNINGS+=("cost projection unavailable: estimator did not return a result")
+    else
+        # The estimator's own notes carry the "not \$0.00" wording. Printed
+        # verbatim so this surface cannot drift from the rule it inherits.
+        printf '%s' "$EST_JSON" | LOKI_PF_ITERS="${ITERATIONS:-}" python3 -c '
+import json, os, sys
+try:
+    d = json.load(sys.stdin)
+except Exception:
+    print("  UNKNOWN  estimator output unreadable -- no cost projection")
+    sys.exit(0)
+iters = os.environ.get("LOKI_PF_ITERS") or ""
+if not d.get("has_basis"):
+    print("  UNKNOWN  no measured, priced iteration in this workspace")
+    for n in d.get("notes") or []:
+        print("           " + n)
+else:
+    med = d.get("median_cost_per_iteration_usd")
+    print("  measured per-iteration cost: $%.4f (median of %d priced iteration(s))"
+          % (med, d.get("basis_count") or 0))
+    if d.get("single_point_basis"):
+        print("           basis is a SINGLE data point -- arithmetically fine,")
+        print("           epistemically weak; treat the total as indicative only")
+    if iters:
+        proj = d.get("projected_cost_usd")
+        # Explicit None check. "or 0.0" would render an absent projection as
+        # $0.00 -- the exact defect this surface exists to refuse, and it would
+        # slip in on the one branch that prints a real dollar figure.
+        if proj is None:
+            print("  projected total: UNKNOWN -- estimator returned no projection")
+        else:
+            print("  projected for %s iteration(s): $%.2f  [ESTIMATE, not a guarantee]"
+                  % (iters, proj))
+    else:
+        print("  projected total: UNKNOWN -- pass --iterations N to project a total")
+        print("           (the horizon is not guessed: an invented N would launder")
+        print("            a guess through a real per-iteration cost)")
+'
+    fi
+fi
+echo ""
+
+# ---- Verdict ----------------------------------------------------------------
+echo -e "${BOLD}========================================${NC}"
+if [ "${#BLOCKERS[@]}" -gt 0 ]; then
+    echo -e "${RED}${BOLD}VERDICT: BLOCKED${NC}"
+    echo ""
+    echo "This run cannot succeed until these are fixed:"
+    for b in "${BLOCKERS[@]}"; do
+        echo -e "  - ${BOLD}${b%%|*}${NC}"
+        echo -e "    fix: ${b#*|}"
+    done
+    # Warnings are printed under BLOCKED too. Showing them only on the READY
+    # paths meant a blocked run silently DROPPED every uncertain signal -- the
+    # user fixes the named blocker, re-runs, and only then discovers a second
+    # problem that was already known. An unmeasured signal must not become
+    # invisible just because something else failed first.
+    if [ "${#WARNINGS[@]}" -gt 0 ]; then
+        echo ""
+        echo "Also uncertain (not blocking):"
+        for w in "${WARNINGS[@]}"; do
+            echo "  - $w"
+        done
+    fi
+    echo ""
+    echo "Then re-run: tools/preflight.sh"
+    exit 1
+elif [ "${#WARNINGS[@]}" -gt 0 ]; then
+    echo -e "${YELLOW}${BOLD}VERDICT: READY WITH WARNINGS${NC}"
+    echo ""
+    for w in "${WARNINGS[@]}"; do
+        echo "  - $w"
+    done
+    exit 0
+else
+    echo -e "${GREEN}${BOLD}VERDICT: READY${NC}"
+    exit 0
+fi