loki-mode 9.12.5 → 9.16.0

package/autonomy/telemetry.sh

@@ -194,7 +194,14 @@ _loki_known_command() {
 # a first run, never the user's paths, versions, or hostnames.
 _loki_known_blocker() {
     case "${1:-}" in
-        no_provider|node|python3|jq|git|curl|disk|skill_symlink)
+        # not_logged_in is distinct from no_provider on purpose. They are the two
+        # halves of the same wall and they need opposite fixes: no_provider means
+        # "install something", not_logged_in means "authenticate the thing you
+        # already installed". Collapsing the second into `other` would make the
+        # single most common post-install failure unactionable in the data --
+        # and it is the worst-placed one, since without this the user only learns
+        # of it after confirming the spend.
+        no_provider|not_logged_in|node|python3|jq|git|curl|disk|skill_symlink)
             printf '%s' "$1" ;;
         *)
             printf 'other' ;;

package/autonomy/verify.sh

@@ -2522,9 +2522,18 @@ try:
     # secrets/lint/deps). It must NEVER claim "verified" when the authoritative
     # verdict is not VERIFIED -- a tool named Verify printing "-> verified" next
     # to a BLOCKED result is a fake-green-shaped surface, and this product never
-    # lies about done. So the banner reports the engine's partial finding,
+    # lies about done. So the banner reports the partial finding of the engine,
     # explicitly subordinated to the authoritative verdict, and never the word
     # "verified" on its own when the verdict disagrees.
+    #
+    # NO APOSTROPHES IN THIS BODY. This heredoc sits inside "$( ... )", and bash
+    # 3.2 -- the /bin/bash that every stock macOS ships -- tracks quoting THROUGH
+    # the command substitution even though the heredoc is quoted with <<PYEOF.
+    # One apostrophe opens a quote that never closes, so the parser swallows the
+    # rest of the file and reports "syntax error near unexpected token (" at a
+    # line ~270 later that is perfectly valid. The whole file then fails to
+    # parse: `loki verify --help` exits 2 printing NOTHING on a stock Mac, while
+    # working fine under Homebrew bash 5. Verified by minimal reproduction.
     verdict = (os.environ.get("_V_VERDICT") or "").strip().upper()
     if e.get("inconclusive"):
         finding = "inconclusive (%s)" % (e.get("inconclusive_reason") or "no reason")

package/completions/_loki

@@ -171,6 +171,9 @@ function _loki_commands {
         'metrics:Session productivity report'
         'share:Share session report as GitHub Gist'
         'proof:Inspect/share proof-of-run artifacts'
+        'outcomes:What happened to the work AFTER the receipt (reverted/reworked/survived)'
+        'verdict:The five measured trust signals in one readable block'
+        'readiness:Can an agent verify its own work in this repo? (measured, not LLM-scored)'
         'preview:Preview the locally-running app'
         'deploy:Deploy the built product (CI/CD-aware)'
         'context:Context window management'
@@ -190,6 +193,7 @@ function _loki_commands {
         'magic:Spec-driven component generation'
         'assets:Export/import shareable team assets'
         'spec:Living spec drift detection'
+        'intent:Does the spec still say what was actually wanted'
         'verify:Deterministic PR verification'
         'grill:Interrogate a spec before building'
         'trust:Visible trust trajectory'

package/completions/loki.bash

@@ -5,7 +5,8 @@ _loki_completion() {
     _init_completion || return
 
     # Main subcommands (must match autonomy/loki main case statement)
-    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
+    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt outcomes verdict readiness explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
+    local main_commands="start quick monitor demo tour welcome init stop pause resume steer status next ship dashboard web serve api sandbox notify import github issue intent config provider reset memory compound checkpoint council dogfood projects enterprise secrets cockpit secure own handoff doctor watchdog audit metrics syslog onboard share proof receipt explain plan report cost estimate kpis stats test ci watch telemetry agent context ctx code run export review optimize heal modernize migrate cluster worktree wt trigger failover remote deploy docker mcp magic assets analyze compliance crash open otel preview quickstart rc rollback self-update sentrux setup-skill spec state template trust trust-metrics ultracode update verify voice why wiki bench cleanup logs grill docs cp version completions help"
 
     # 1. If we are on the first argument (subcommand)
     if [[ $cword -eq 1 ]]; then

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.12.5"
+__version__ = "9.16.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/api_operator.py

@@ -77,11 +77,24 @@ def _loki_dir() -> str:
     others, and an import-time snapshot would pin whichever was true when the
     module first loaded.
     """
-    return os.environ.get("LOKI_DIR") or os.path.join(os.getcwd(), ".loki")
+    return os.environ.get("LOKI_DIR") or os.path.join(_safe_getcwd(), ".loki")
+
+
+def _safe_getcwd() -> str:
+    """os.getcwd() raises FileNotFoundError once the cwd is deleted.
+
+    These helpers run per request, so letting that propagate turns a stale
+    working directory into a blanket 500 across the whole API. Fall back to
+    this package's tree, which is on disk by definition.
+    """
+    try:
+        return os.getcwd()
+    except OSError:
+        return os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 
 
 def _repo_dir() -> str:
-    return os.environ.get("LOKI_REPO_DIR") or os.getcwd()
+    return os.environ.get("LOKI_REPO_DIR") or _safe_getcwd()
 
 
 # Ceilings for the receipt walk on the HTTP path. Generous enough that a real

package/dashboard/api_v2.py

@@ -527,7 +527,12 @@ async def list_runs(
             try:
                 from . import api_runs as _fs_runs
 
-                _loki = os.environ.get("LOKI_DIR") or os.path.join(os.getcwd(), ".loki")
+                # A deleted cwd raises from os.getcwd(); this runs per request.
+                try:
+                    _cwd = os.getcwd()
+                except OSError:
+                    _cwd = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+                _loki = os.environ.get("LOKI_DIR") or os.path.join(_cwd, ".loki")
                 _fs = _fs_runs.list_runs(_loki)
                 # The adapter returns an envelope carrying source, freshness
                 # and an explicit reason when empty. Never fabricate a row:

package/dashboard/control.py

@@ -72,22 +72,64 @@ def find_skill_dir() -> Path:
             return configured
         raise RuntimeError(f"LOKI_SKILL_DIR is not a Loki source tree: {configured}")
 
+    # os.getcwd() RAISES FileNotFoundError when the working directory has been
+    # deleted out from under the process. That is not hypothetical: a dashboard
+    # started inside a temp workspace keeps running after the workspace is
+    # cleaned up, and then EVERY endpoint that resolves a path 500s at once --
+    # observed as ~60 simultaneous 500s including /api/status, whose handler
+    # touches almost nothing. A long-lived server must survive losing its cwd.
+    def _cwd_or_none() -> "Path | None":
+        try:
+            return Path.cwd()
+        except OSError:
+            return None
+
     candidates = [
         Path.home() / ".claude" / "skills" / "loki-mode",
         Path(__file__).parent.parent,
-        Path.cwd()
+        _cwd_or_none(),
     ]
     for candidate in candidates:
-        if (candidate / "SKILL.md").exists() and (candidate / "autonomy" / "run.sh").exists():
-            return candidate
-    return Path.cwd()
+        if candidate is None:
+            continue
+        try:
+            if ((candidate / "SKILL.md").exists()
+                    and (candidate / "autonomy" / "run.sh").exists()):
+                return candidate
+        except OSError:
+            continue
+
+    # The fallback must not be the one path that can still raise. When the cwd
+    # is gone, resolve to this file's own tree -- it is on disk by definition,
+    # since we are executing out of it.
+    return _cwd_or_none() or Path(__file__).resolve().parent.parent
 
 SKILL_DIR = find_skill_dir()
 RUN_SH = SKILL_DIR / "autonomy" / "run.sh"
 
-# Ensure directories exist
-STATE_DIR.mkdir(parents=True, exist_ok=True)
-LOG_DIR.mkdir(parents=True, exist_ok=True)
+
+def _cwd_or_skill_dir() -> Path:
+    """The cwd, or the skill tree when the cwd has been deleted.
+
+    Used where a real directory is required (subprocess cwd=), as opposed to
+    the confinement check in validate(), which must fail closed instead.
+    """
+    try:
+        return Path.cwd()
+    except OSError:
+        return SKILL_DIR
+
+# Ensure directories exist.
+# Best-effort at IMPORT time. LOKI_DIR defaults to the relative path ".loki",
+# so when the working directory has been deleted these mkdirs raise
+# FileNotFoundError and the whole module fails to import -- which takes the
+# entire dashboard down rather than the one feature that needs the directory.
+# Whoever actually writes into these paths still surfaces its own error.
+for _startup_dir in (STATE_DIR, LOG_DIR):
+    try:
+        _startup_dir.mkdir(parents=True, exist_ok=True)
+    except OSError:
+        pass
 
 # Utility: atomic write with optional file locking
 def atomic_write_json(file_path: Path, data: dict, use_lock: bool = True):
@@ -202,8 +244,16 @@ class StartRequest(BaseModel):
         if not prd_path.is_file():
             raise ValueError(f"PRD path is not a file: {self.prd}")
 
-        # Verify path resolves within CWD or a reasonable parent
-        cwd = Path.cwd().resolve()
+        # Verify path resolves within CWD or a reasonable parent.
+        # FAIL CLOSED if the cwd is gone: this is a path-confinement check, so
+        # an unresolvable base must reject the path, never skip the comparison.
+        try:
+            cwd = Path.cwd().resolve()
+        except OSError as exc:
+            raise ValueError(
+                "cannot validate PRD path: the working directory no longer "
+                "exists (%s)" % exc
+            ) from exc
         try:
             prd_path.relative_to(cwd)
         except ValueError:
@@ -450,7 +500,9 @@ async def start_session(request: StartRequest):
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
             start_new_session=True,
-            cwd=str(Path.cwd())
+            # A deleted cwd would make Popen itself raise; fall back to the
+            # skill tree rather than failing to launch the run at all.
+            cwd=str(_cwd_or_skill_dir())
         )
 
         # Save provider for status tracking

package/dashboard/run.py

@@ -8,15 +8,26 @@ Usage:
 """
 
 import argparse
+import os
 import sys
 
 
 def main():
     parser = argparse.ArgumentParser(description="Loki Mode Dashboard Server")
+    # Loopback by default, matching server.py:run_server and control.py. This
+    # launcher defaulted to 0.0.0.0, which published an UNAUTHENTICATED control
+    # plane on every interface: dashboard auth is opt-in
+    # (LOKI_ENTERPRISE_AUTH, default false in dashboard/auth.py), so with it
+    # unset -- the default -- anyone routable to the host could reach endpoints
+    # that stop builds and read receipts. A default must be safe on its own;
+    # exposing the network is a decision an operator makes explicitly, so
+    # --host 0.0.0.0 and LOKI_DASHBOARD_HOST both still work for the container
+    # and Helm paths that genuinely need it.
     parser.add_argument(
         "--host",
-        default="0.0.0.0",
-        help="Host to bind to (default: 0.0.0.0)",
+        default=os.environ.get("LOKI_DASHBOARD_HOST", "127.0.0.1"),
+        help="Host to bind to (default: $LOKI_DASHBOARD_HOST or 127.0.0.1). "
+             "Use 0.0.0.0 only with authentication enabled.",
     )
     parser.add_argument(
         "--port",

package/dashboard/scim.py

@@ -0,0 +1,221 @@
+"""SCIM 2.0 user provisioning: deprovisioning that actually revokes access.
+
+WHY THIS EXISTS. Measured against our own code before writing any: OIDC is real
+here (76 references in dashboard/auth.py) and SAML and SCIM are both ZERO. That
+is the whole enterprise identity gap -- not authentication as a category, which
+we have, but PROVISIONING, which we do not.
+
+It matters more than its size suggests. With OIDC alone, an employee removed
+from the IdP stops being able to LOG IN, but any token already issued to them
+keeps working until it expires. For a buyer whose security review asks "show me
+that a terminated employee loses access within minutes", that is the answer that
+fails the review. SCIM is the protocol that answers it.
+
+WORTH KNOWING ABOUT THE COMPETITION. Factory ships SCIM. Devin's SCIM is
+documented only for Devin DESKTOP -- the page instructs you to configure it at
+windsurf.com/team/settings under the app name "Windsurf" -- and no page documents
+SCIM provisioning for Devin CLOUD sessions, which get SAML/OIDC plus IdP-group
+sync only. So this is table stakes against one competitor and a genuine gap in
+the other.
+
+WHAT THIS IS NOT. It is not a second identity system. It maps IdP group
+membership onto the scope hierarchy dashboard/auth.py already enforces
+(* -> control -> write -> read), so there is exactly one authorization model and
+SCIM only decides who holds which scope. A parallel permission model would
+eventually disagree with the real one, and the disagreement would be invisible
+until an audit.
+
+DEPROVISIONING IS SOFT BY DEFAULT, AND THAT IS DELIBERATE. `active: false`
+revokes access immediately but PRESERVES the record, because an audit trail that
+loses the identity of whoever performed past actions is not an audit trail. Hard
+delete is available and separate, so destroying history is always an explicit act.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from datetime import datetime, timezone
+from typing import Optional
+
+SCIM_SCHEMA_USER = "urn:ietf:params:scim:schemas:core:2.0:User"
+SCIM_SCHEMA_LIST = "urn:ietf:params:scim:api:messages:2.0:ListResponse"
+SCIM_SCHEMA_ERROR = "urn:ietf:params:scim:api:messages:2.0:Error"
+
+# IdP group -> our scope. Mirrors the hierarchy in dashboard/auth.py rather than
+# inventing a second one: * grants everything, control grants write and read.
+# An unrecognised group maps to "read", never to a higher scope -- an unknown
+# group is not evidence of privilege, and defaulting upward is how a
+# misconfigured IdP silently grants admin.
+GROUP_SCOPE_MAP = {
+    "loki-admins": "*",
+    "loki-owners": "*",
+    "loki-operators": "control",
+    "loki-writers": "write",
+    "loki-readers": "read",
+}
+DEFAULT_SCOPE = "read"
+
+
+def _now():
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _store_path(loki_dir):
+    return os.path.join(loki_dir, "scim", "users.json")
+
+
+def _load(loki_dir):
+    p = _store_path(loki_dir)
+    if not os.path.isfile(p):
+        return {}
+    try:
+        with open(p, "r", encoding="utf-8") as fh:
+            return json.load(fh)
+    except (OSError, ValueError):
+        # A corrupt store must not silently become an empty one: returning {}
+        # here would read as "no users provisioned" and could re-grant access to
+        # someone who was deprovisioned. Signalled to the caller instead.
+        return None
+
+
+def _save(loki_dir, data):
+    p = _store_path(loki_dir)
+    os.makedirs(os.path.dirname(p), exist_ok=True)
+    tmp = p + ".tmp"
+    with open(tmp, "w", encoding="utf-8") as fh:
+        json.dump(data, fh, indent=2, sort_keys=True)
+        fh.write("\n")
+    # Atomic replace: a half-written user store is an access-control decision
+    # made from corrupt data.
+    os.replace(tmp, p)
+
+
+def scope_for_groups(groups):
+    """Highest scope any of the user's groups grants.
+
+    Highest-wins, because a user in both loki-readers and loki-admins is an
+    admin. Unknown groups contribute DEFAULT_SCOPE and never more.
+    """
+    rank = {"read": 1, "write": 2, "control": 3, "*": 4}
+    best = DEFAULT_SCOPE
+    for g in groups or []:
+        s = GROUP_SCOPE_MAP.get(str(g).strip().lower(), DEFAULT_SCOPE)
+        if rank.get(s, 1) > rank.get(best, 1):
+            best = s
+    return best
+
+
+def provision(loki_dir, user_name, external_id=None, groups=None, active=True):
+    """Create or update a user. Returns a SCIM User resource."""
+    if not user_name:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "400",
+                "detail": "userName is required"}
+
+    data = _load(loki_dir)
+    if data is None:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "500",
+                "detail": "user store is unreadable; refusing to make an access "
+                          "decision from corrupt data"}
+
+    uid = external_id or user_name
+    existing = data.get(uid, {})
+    rec = {
+        "id": uid,
+        "userName": user_name,
+        "externalId": external_id or "",
+        "groups": list(groups or []),
+        "scope": scope_for_groups(groups),
+        "active": bool(active),
+        "created": existing.get("created") or _now(),
+        "lastModified": _now(),
+    }
+    data[uid] = rec
+    _save(loki_dir, data)
+    return to_scim_user(rec)
+
+
+def deprovision(loki_dir, uid, hard=False):
+    """Revoke access. Soft by default so the audit trail survives.
+
+    An audit log that cannot say WHO performed an action is not an audit log, so
+    a departed user's record is retained by default and merely marked inactive.
+    Hard delete exists and is separate, so destroying history is always explicit.
+    """
+    data = _load(loki_dir)
+    if data is None:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "500",
+                "detail": "user store is unreadable"}
+    if uid not in data:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "404",
+                "detail": f"no such user: {uid}"}
+
+    if hard:
+        data.pop(uid)
+        _save(loki_dir, data)
+        return {"status": "204", "deleted": uid, "audit_trail_preserved": False}
+
+    data[uid]["active"] = False
+    data[uid]["lastModified"] = _now()
+    _save(loki_dir, data)
+    return {"status": "200", "deactivated": uid, "audit_trail_preserved": True}
+
+
+def is_active(loki_dir, uid):
+    """Authorization answer for one user. Fails CLOSED on any doubt.
+
+    An unreadable store, an unknown user, and an inactive user all return False.
+    A provisioning system that fails open is worse than none, because it creates
+    the belief that deprovisioning works.
+    """
+    data = _load(loki_dir)
+    if data is None:
+        return False
+    rec = data.get(uid)
+    if not rec:
+        return False
+    return bool(rec.get("active"))
+
+
+def effective_scope(loki_dir, uid):
+    """The scope a user actually holds, or None when they hold none."""
+    data = _load(loki_dir)
+    if data is None:
+        return None
+    rec = data.get(uid)
+    if not rec or not rec.get("active"):
+        return None
+    return rec.get("scope") or DEFAULT_SCOPE
+
+
+def to_scim_user(rec):
+    return {
+        "schemas": [SCIM_SCHEMA_USER],
+        "id": rec["id"],
+        "userName": rec["userName"],
+        "externalId": rec.get("externalId", ""),
+        "active": rec.get("active", False),
+        "groups": [{"value": g} for g in rec.get("groups", [])],
+        "meta": {
+            "resourceType": "User",
+            "created": rec.get("created"),
+            "lastModified": rec.get("lastModified"),
+        },
+        # Not part of the SCIM spec, surfaced because an operator reading this
+        # response needs to see what the group mapping actually granted rather
+        # than deriving it.
+        "lokiScope": rec.get("scope"),
+    }
+
+
+def list_users(loki_dir, active_only=False):
+    data = _load(loki_dir)
+    if data is None:
+        return {"schemas": [SCIM_SCHEMA_ERROR], "status": "500",
+                "detail": "user store is unreadable"}
+    recs = [r for r in data.values() if (not active_only or r.get("active"))]
+    return {
+        "schemas": [SCIM_SCHEMA_LIST],
+        "totalResults": len(recs),
+        "Resources": [to_scim_user(r) for r in sorted(recs, key=lambda r: r["id"])],
+    }

package/dashboard/server.py

@@ -1224,6 +1224,28 @@ class WebSocketBoundaryMiddleware:
                 # accept-then-drop, which reads to a client as a flaky network.
                 await send({"type": "websocket.close", "code": 1008})
                 return
+            # Cross-Site WebSocket Hijacking. The address check above proves the
+            # PEER is local; it says nothing about who told that peer to connect.
+            # A browser on any origin can open ws://127.0.0.1:57374/ws -- the
+            # request comes FROM the loopback interface and passes the check
+            # above, and CORS does not apply to WebSocket upgrades, so no
+            # existing control stops it. /ws/collab is writable, so this is not
+            # read-only exposure.
+            #
+            # Same-origin browsers send Origin; non-browser clients (CLI, tests,
+            # health probes) send none. An ABSENT Origin is therefore allowed --
+            # it cannot be forged by a page, since browsers always attach it --
+            # while a PRESENT one must be in the allowlist the HTTP path already
+            # uses. That keeps every scripted client working and closes the
+            # browser-driven path, without a second source of truth for origins.
+            origin = None
+            for raw_name, raw_value in scope.get("headers", []):
+                if raw_name == b"origin":
+                    origin = raw_value.decode("latin-1").strip()
+                    break
+            if origin and "*" not in _cors_origins and origin not in _cors_origins:
+                await send({"type": "websocket.close", "code": 1008})
+                return
         await self.app(scope, receive, send)
 
 
@@ -4417,7 +4439,8 @@ async def start_build(request: Request, body: StartBuildRequest):
         loki_dir = workspace_dir / ".loki"
     else:
         loki_dir = _get_loki_dir()
-        project_dir = loki_dir.parent if loki_dir.name == ".loki" else _Path.cwd()
+        project_dir = (loki_dir.parent if loki_dir.name == ".loki"
+                       else (_safe_cwd() or _Path(".")))
         project_dir = project_dir.resolve()
 
     # Legacy no-workspace starts keep their existing single-flight behavior.
@@ -5637,6 +5660,22 @@ _active_project_dir: Optional[str] = None
 _DASHBOARD_AUTOSTARTED: bool = os.environ.get("LOKI_DASHBOARD_AUTOSTARTED") == "1"
 
 
+def _safe_cwd() -> "_Path | None":
+    """The current directory, or None if it no longer exists.
+
+    os.getcwd() RAISES FileNotFoundError when the working directory has been
+    deleted out from under a live process. A dashboard started inside a temp
+    workspace keeps serving after that workspace is cleaned up, and every
+    endpoint resolving a path then 500s simultaneously -- observed as ~60
+    concurrent 500s including /api/status, whose handler touches almost
+    nothing. Losing the cwd must degrade to a fallback, never to a stack trace.
+    """
+    try:
+        return _Path.cwd()
+    except OSError:
+        return None
+
+
 def _get_loki_dir() -> _Path:
     """Get LOKI_DIR, refreshing from env on each call for consistency.
 
@@ -5661,10 +5700,14 @@ def _get_loki_dir() -> _Path:
     if env_dir and _Path(env_dir).is_absolute():
         return _Path(env_dir)
 
-    # Check CWD first
-    cwd_loki = _Path.cwd() / ".loki"
-    if cwd_loki.is_dir():
-        return cwd_loki
+    # Check CWD first. _safe_cwd() rather than _Path.cwd(): this function runs
+    # on nearly every request, and a deleted working directory would otherwise
+    # raise FileNotFoundError here and 500 the entire API at once.
+    _cwd = _safe_cwd()
+    if _cwd is not None:
+        cwd_loki = _cwd / ".loki"
+        if cwd_loki.is_dir():
+            return cwd_loki
 
     # Check home directory fallback
     home_loki = _Path.home() / ".loki"