loki-mode 9.19.1 → 9.21.0

package/dashboard/server.py

@@ -9977,6 +9977,71 @@ def _build_metrics_text() -> str:
     lines.append(f"loki_uptime_seconds {round(uptime_seconds, 1)}")
     lines.append("")
 
+    # -- Evidence Receipts -----------------------------------------------------
+    # The receipt is the product's differentiator and was INVISIBLE to
+    # monitoring: /metrics emitted 12 lines and none of them were about
+    # verification. An operator could not alert on "builds stopped producing
+    # receipts" or "the unknown-verdict share is climbing", which are the two
+    # failures that make the whole guarantee worthless in production.
+    #
+    # `unknown` IS ITS OWN SERIES, deliberately. The summary endpoint refuses
+    # to count a receipt as verified when it cannot prove it was, and folding
+    # that into either verified or not_verified would launder the distinction
+    # the receipt exists to preserve.
+    #
+    # Bucketed on honesty.headline exactly as proofs_summary does, reading the
+    # same files, so the metric and the API cannot drift.
+    _proof_total = _proof_verified = _proof_gaps = _proof_notver = _proof_unknown = 0
+    _proof_attested = _proof_signed = 0
+    try:
+        _pdir = loki_dir / "proofs"
+        _entries = sorted(_pdir.iterdir()) if _pdir.is_dir() else []
+    except OSError:
+        _entries = []
+    for _entry in _entries:
+        if not _entry.is_dir():
+            continue
+        _pj = _entry / "proof.json"
+        if not _pj.is_file():
+            continue
+        _data = _safe_json_read(_pj, default=None)
+        if not isinstance(_data, dict):
+            continue
+        _proof_total += 1
+        _honesty = _data.get("honesty")
+        _head = _honesty.get("headline") if isinstance(_honesty, dict) else None
+        if _head == "VERIFIED":
+            _proof_verified += 1
+        elif _head == "VERIFIED WITH GAPS":
+            _proof_gaps += 1
+        elif _head == "NOT VERIFIED":
+            _proof_notver += 1
+        else:
+            _proof_unknown += 1
+        _ver = _data.get("verification")
+        if isinstance(_ver, dict):
+            if _ver.get("attestation"):
+                _proof_attested += 1
+            if _ver.get("gpg_signature"):
+                _proof_signed += 1
+
+    lines.append("# HELP loki_receipts_total Evidence Receipts on disk")
+    lines.append("# TYPE loki_receipts_total gauge")
+    lines.append(f"loki_receipts_total {_proof_total}")
+    lines.append("")
+    lines.append("# HELP loki_receipts_by_verdict Receipts bucketed on the recorded honesty headline")
+    lines.append("# TYPE loki_receipts_by_verdict gauge")
+    lines.append(f'loki_receipts_by_verdict{{verdict="verified"}} {_proof_verified}')
+    lines.append(f'loki_receipts_by_verdict{{verdict="with_gaps"}} {_proof_gaps}')
+    lines.append(f'loki_receipts_by_verdict{{verdict="not_verified"}} {_proof_notver}')
+    lines.append(f'loki_receipts_by_verdict{{verdict="unknown"}} {_proof_unknown}')
+    lines.append("")
+    lines.append("# HELP loki_receipts_with_provenance Receipts carrying a checkable provenance record")
+    lines.append("# TYPE loki_receipts_with_provenance gauge")
+    lines.append(f'loki_receipts_with_provenance{{kind="attestation"}} {_proof_attested}')
+    lines.append(f'loki_receipts_with_provenance{{kind="gpg"}} {_proof_signed}')
+    lines.append("")
+
     return "\n".join(lines) + "\n"
 
 

package/docs/COMPETITIVE-SCORECARD.md

@@ -397,6 +397,37 @@ bash tests/test-competitor-verify-surface.sh               # the installed-CLI a
 loki proof verify <id>                                     # re-hash a receipt, exit 1 on tamper
 ```
 
+### 3d. Our own numbers on the axes people ask about, measured 2026-08-08
+
+These are ABSOLUTE measurements of this product with a CI guard behind each. They
+are deliberately NOT presented as a comparison: no competitor number appears
+here, because three of the four named competitors have no runnable binary on
+this machine and the fourth exposes no equivalent command. A number next to a
+blank is not a ratio.
+
+| Axis | Measured | Budget | Guarded by |
+|---|---|---|---|
+| UI page weight | 787 KB | 1024 KB | `tests/test-dashboard-bundle-budget.sh` |
+| Backend verify latency | 7 ms | under 1000 ms | `tests/test-fast-verify.sh` |
+| Worker horizontal scale | 1..25 replicas render | n/a | `tests/test-helm-worker-scaling.sh` |
+
+Two of those three guards already existed; only the page-weight budget was added
+on 2026-08-08. Recording that because "we measured it" and "we added a
+measurement" are different claims and the difference matters.
+
+What these numbers do NOT establish: they say nothing about output quality,
+which is the axis a user actually cares about, and nothing about how any
+competitor performs on the same axes. A fast gate that verifies the wrong thing
+is worse than a slow one that verifies the right thing.
+
+Reproduce:
+
+```bash
+bash tests/test-dashboard-bundle-budget.sh   # prints the KB and the budget
+bash tests/test-fast-verify.sh               # prints the ms and the budget
+bash tests/test-helm-worker-scaling.sh       # renders 1, 2, 5 and 25 replicas
+```
+
 ### 3c. Deploy surface, measured 2026-08-08
 
 Ran on the four competitor CLIs installed on this machine. Method matters here:

package/docs/OUTCOME-CANARY.md

@@ -0,0 +1,61 @@
+# Outcome Canary
+
+`python3 tools/outcome-canary.py report.json --enable-canary --subject <key> --control-route <name>`
+plans a reversible canary split between the route an [outcome router](./OUTCOME-ROUTER.md)
+report selected and an operator-named control. It is a planner: it never invokes or
+switches a provider, never weakens a gate, and writes nothing.
+
+The canary is opt-in. Without `--enable-canary` it refuses, so a plan can never be
+produced by accident.
+
+## Evidence it demands
+
+The tool refuses unless the evidence stands up on its own terms:
+
+- the report parses, is a `loki-outcome-router/v1` object, and carries `source`,
+  a 64-hex `source_sha256`, and a `candidates` list
+- the recorded source file still exists and still hashes to `source_sha256`, so a
+  plan cannot rest on trials that changed after they were measured
+- the exact router-report bytes are hashed as `report_sha256`; that digest is
+  emitted in the plan and participates in assignment, so a report edited after
+  review cannot reuse the prior plan binding
+- the report selected a primary route, the control route is present, both are
+  `eligible`, and the two differ
+- `trials` and `mean_risk` on both routes are strictly valid numbers: booleans,
+  `NaN`, and `Infinity` are rejected, not coerced
+- both routes have equal trial counts, so the two arms rest on matched evidence
+- neither route's mean risk exceeds `--max-risk` (default `.25`)
+- `--canary-percent` (default `10`) is a finite number from 0 to 100
+
+Every failed check is reported in `refusal_reasons`; the plan is refused as a whole
+rather than partially applied.
+
+## Assignment
+
+Assignment is deterministic and needs no stored state. The tool hashes a
+NUL-joined, domain-separated string of `loki-outcome-canary/v1`, the subject, the
+router-report digest, the source digest, the primary route, the control route, and the percentage, then takes
+that sha256 modulo 10000 against the percentage. The same subject and the same
+evidence always land in the same arm, in any process; different subjects spread
+across arms. Because the digest includes the evidence, changing the trials
+reshuffles the split rather than silently carrying an old assignment forward.
+
+Percent 0 assigns every subject to control and percent 100 assigns every subject to
+the canary, which is what makes the rollback a real command rather than a promise.
+
+## Rollback
+
+A plan always carries `reversible: true` and a `rollback` object naming the control
+route, its effect, and the exact command that assigns control to everyone:
+
+```
+python3 tools/outcome-canary.py report.json --enable-canary \
+  --subject <key> --control-route <name> --canary-percent 0
+```
+
+## Output and exit codes
+
+`--json` emits the whole plan for automation; the default is human-readable. Exit 0
+means a plan exists, 3 means the evidence or policy cannot support one (including a
+missing `--enable-canary`, and a source that drifted), 64 is an invocation error,
+and 66 is a missing report file or a report whose evidence source is gone.

package/docs/OUTCOME-ROUTER.md

@@ -0,0 +1,7 @@
+# Outcome Router
+
+`python3 tools/outcome-router.py trials.jsonl` recommends a route only from measured local trials. Each JSONL row records `route`, strict-boolean `accepted`, non-negative `cost_usd`, positive `duration_minutes`, `risk` from 0 to 1, and optional string `verifier`.
+
+The advisor first rejects routes above the risk ceiling, with sparse evidence, or without an accepted outcome. It then ranks eligible routes by the harmonic mean of accepted outcomes per dollar and per minute, penalized by mean risk. Invalid input poisons eligibility instead of disappearing from the evidence basis. It never invokes or switches a provider and never weakens a gate.
+
+Use `--json` for automation, `--min-trials` and `--max-risk` for evidence policy, and `--risk-weight` to tune the risk penalty. Exit 0 means a recommendation exists, 3 means the evidence cannot support one, 64 is invocation error, and 66 is a missing input file.

package/docs/PROOF-PASSPORT.md

@@ -0,0 +1,29 @@
+# Proof Passport
+
+Proof Passport binds a provider-neutral Outcome Contract to an existing Loki
+receipt. The JSON artifact preserves the exact contract and receipt digests,
+the verifier verdict, executor/verifier separation, and explicit trust
+limitations.
+
+Generate the machine-readable passport and a portable PR/CI summary together:
+
+```bash
+python3 tools/proof-passport.py \
+  outcome-contract.json proof.json proof-passport.json \
+  --repo-dir . \
+  --markdown-output proof-passport.md
+```
+
+The command exits `0` only for `VERIFIED`, `1` for `FAILED`, and `2` for
+`UNVERIFIABLE` or invalid input. Existing output files are never replaced
+unless `--force` is supplied. Both outputs are checked before either is
+written, so a conflicting Markdown path cannot leave a new JSON artifact
+behind.
+
+The Markdown artifact is suitable for a pull-request comment or
+`$GITHUB_STEP_SUMMARY`. It contains the full SHA-256 evidence bindings and
+trust limitations, but no repository or machine-specific paths.
+
+Proof Passport does not currently sign the passport itself. Receipt signature
+status is reported separately and must not be interpreted as a passport
+signature.

package/docs/SIGNED-RECEIPTS.md

@@ -94,9 +94,120 @@ which exact code" without asking anyone to trust the agent that produced it.
 - If the signing key is compromised, signed receipts from that key are worth
   exactly what the key is worth. Normal key hygiene applies.
 
+## Attestation: provenance without a key exchange
+
+gpg settles the local case, where the operator already holds the keyring. It
+does not survive the remote path. A submitter who ran `loki start --remote`
+never had access to the cluster, so "import the publisher's public key" is the
+step where independent verification stops happening in practice.
+
+A receipt served by `trigger-server.py` therefore also carries an **attestation**
+under `verification.attestation`: an Ed25519 JWT signed by the receiver, with
+the signing keys published, unauthenticated, at `/.well-known/jwks.json`.
+
+```bash
+# Third party, offline. Needs proof.json and jwks.json -- nothing else.
+curl -s https://loki.example.com/.well-known/jwks.json > jwks.json
+loki proof verify <id> --jwks ./jwks.json
+
+# Or fetch the key set directly from the server that produced the receipt.
+loki proof verify <id> --jwks https://loki.example.com
+```
+
+Four outcomes, deliberately kept distinct:
+
+| Verdict | Meaning |
+|---|---|
+| `VERIFIED` | The token is valid **and** covers these exact bytes. |
+| `FAILED` | The token does not cover these bytes: altered after signing, or lifted from another run. |
+| `ABSENT` | This receipt carries no attestation. A fact about the receipt. |
+| `NOT CHECKED` | The key set could not be read. **Not** a verdict, in either direction. |
+
+`ABSENT` and `NOT CHECKED` are never collapsed. One is a property of the
+receipt; the other is an absent measurement, and reporting an unchecked receipt
+as merely unattested would overstate what was established.
+
+The JWT binds `job_id`, `run_id` and `receipt_sha256`, and the verifier
+**recomputes** that digest from the receipt body rather than trusting the
+recorded `verification.hash`. Editing the body and rewriting the hash to match
+therefore still fails: the signed claim is the anchor, not the field in the file.
+
+### Key rotation
+
+Every token carries a `kid`, and JWKS serves the active key plus any retired
+ones (`LOKI_RECEIPT_RETIRED_PUBKEYS`, a colon-separated list of PEM paths). This
+is required rather than optional: with a single unlabeled key, the first
+rotation would make every previously-issued receipt fail verification -- and a
+receipt that stops verifying is indistinguishable from a tampered one.
+
+### In a Kubernetes cluster
+
+The Helm chart wires this for you. Generate a key and pass it as a file:
+
+```bash
+openssl genpkey -algorithm ed25519 -out receipt-signing-key.pem
+helm upgrade --install loki ./helm/loki-mode \
+  --set-file secrets.receiptSigningKey=receipt-signing-key.pem
+```
+
+The chart mounts it **into the receiver only**, read-only at mode `0400`, and
+sets `LOKI_RECEIPT_SIGNING_KEY_FILE` to the projected path. The worker never
+receives it, and that asymmetry is enforced by the chart rather than left to
+convention: a worker runs model-directed code, so a key there would let a build
+sign its own receipt.
+
+Left unset, the receiver serves receipts unsigned and `/.well-known/jwks.json`
+returns an empty key set -- honest, but a `--remote` submitter then has no way
+to prove who produced their receipt without an out-of-band key import.
+
+### With docker-compose
+
+Opt-in, and deliberately shipped commented out. Docker has no optional bind
+mount: a bind to a missing path is a hard container start failure, so enabling
+it by default would stop the receiver from starting for everyone who has not
+generated a key.
+
+```bash
+openssl genpkey -algorithm ed25519 -out ./receipt-signing-key.pem
+```
+
+Then uncomment the two lines the compose file points at (the
+`LOKI_RECEIPT_SIGNING_KEY_FILE` env var and the `receipt-signing-key.pem`
+mount) on the `receiver` service. Never commit that key file.
+
+### Configuration
+
+| Variable | Effect |
+|---|---|
+| `LOKI_RECEIPT_SIGNING_KEY_FILE` | PEM path to the Ed25519 private key (normal Kubernetes mounted-secret path). |
+| `LOKI_RECEIPT_SIGNING_KEY` | The PEM inline, for non-Kubernetes deployments. |
+| `LOKI_RECEIPT_RETIRED_PUBKEYS` | Colon-separated PEM paths for retired public keys. |
+
+Unset means unsigned: no attestation is attached and the receipt keeps its
+existing verdict.
+
+The same two variables also work for a **local** build. Set
+`LOKI_RECEIPT_SIGNING_KEY_FILE` before `loki start` and the generator attests
+the receipt directly, so a laptop or CI receipt is checkable by the same
+`--jwks` path a cluster receipt uses. Publish the matching JWKS wherever your
+consumers can reach it (or hand them `jwks.json` alongside the receipt).
+
+**In a cluster, the receiver signs -- never the worker.** A worker runs
+model-directed code and already holds provider credentials, so a key there would
+let a build sign its own receipt, which attests to nothing. The local case is
+different in kind, not an exception to this: there is no separation between
+submitter and builder on your own machine, and the attestation says "this
+receipt came from a holder of this key" rather than "an independent party
+witnessed this build."
+
 ## Source
 
 - Signing: `autonomy/lib/proof-generator.py` (`_gpg_detached_sign`, and the
   `LOKI_PROOF_GPG_KEY` gate)
 - Verification: `autonomy/lib/proof-verify.py` (`_verify_gpg`)
 - Scope test: `tests/test-proof-forgery-defense.sh`
+- Attestation: `autonomy/receipt_jwt.py`; served by `autonomy/trigger-server.py`
+  (`_attest`, `_handle_jwks`); checked by `loki_proof_attestation_check` and
+  `loki_remote_attestation_status` in `autonomy/loki`
+- Attestation tests: `tests/test-receipt-jwt-attestation.sh`,
+  `tests/test-remote-attestation-verdict.sh`, `tests/test-proof-verify-jwks.sh`

package/docs/metrics.md

@@ -74,6 +74,38 @@ Returns metrics in OpenMetrics text format. No authentication required by defaul
 |--------|------|-------------|
 | `loki_events_total` | counter | Total number of events recorded in events.jsonl |
 
+### Evidence Receipt Metrics
+
+The verification surface, exposed so an operator can alert on it. Two failures
+make the receipt guarantee worthless in production and neither was observable
+before these existed: builds silently stopping producing receipts, and the
+`unknown` share climbing.
+
+| Metric | Type | Description |
+|--------|------|-------------|
+| `loki_receipts_total` | gauge | Evidence Receipts on disk for the active project |
+| `loki_receipts_by_verdict{verdict=...}` | gauge | Receipts bucketed on the recorded honesty headline: `verified`, `with_gaps`, `not_verified`, `unknown` |
+| `loki_receipts_with_provenance{kind=...}` | gauge | Receipts carrying a checkable provenance record: `attestation` (Ed25519 JWT) or `gpg` |
+
+`unknown` IS ITS OWN SERIES and must stay that way. The summary refuses to
+count a receipt as verified when it cannot prove it was -- schema v1.0 receipts
+carry no honesty block -- so folding that bucket into `verified` is dishonest
+and folding it into `not_verified` is alarming and also wrong.
+
+These read the same files as `GET /api/proofs/summary`, so the metric and the
+API cannot disagree; a test asserts it. An empty project reports `0`, not an
+error, so a fresh install does not look like a broken exporter.
+
+Example alerts:
+
+```
+# receipts stopped being produced
+increase(loki_receipts_total[6h]) == 0
+
+# the unverifiable share is growing
+loki_receipts_by_verdict{verdict="unknown"} / loki_receipts_total > 0.2
+```
+
 ## Data Sources
 
 Metrics are derived from `.loki/` flat files:

package/events/emit.sh

@@ -171,6 +171,37 @@ if [ "$_emit_max" -gt 0 ]; then
             kill -0 "$_emit_target" 2>/dev/null || exit 0
             _waited=$((_waited + 1))
         done
+        # FORENSICS BEFORE THE KILL (issue #184).
+        #
+        # The watchdog bounds the damage but has never recorded WHY the hang
+        # happened, which is why the cause is still unknown after two disproved
+        # hypotheses (the lock-retry counter, and six synthetic race probes).
+        # A SIGKILL destroys the only evidence that existed.
+        #
+        # Captures a stack sample and the process tree to a file, then kills. On
+        # the next occurrence the reader gets a stack instead of a guess.
+        #
+        # Every part is bounded and best-effort: this runs INSIDE the watchdog,
+        # so a capture that blocks would replace a bounded failure with an
+        # unbounded one -- the exact thing the watchdog exists to prevent.
+        # `sample` is macOS-only and absent on Linux; both branches are guarded
+        # and neither is allowed to fail the watchdog.
+        _emit_diag_dir="${LOKI_EMIT_DIAG_DIR:-${TMPDIR:-/tmp}}"
+        _emit_diag="$_emit_diag_dir/loki-emit-hang-$_emit_target.txt"
+        {
+            echo "emit.sh watchdog fired after ${_emit_max}s on pid $_emit_target"
+            echo "captured: $(date -u '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null)"
+            echo "--- ps ---"
+            ps -o pid=,ppid=,pgid=,stat=,etime=,command= -p "$_emit_target" 2>/dev/null
+            echo "--- children ---"
+            ps -eo pid=,ppid=,stat=,command= 2>/dev/null | awk -v p="$_emit_target" '$2==p'
+            echo "--- stack (macOS sample, 1s) ---"
+            if command -v sample >/dev/null 2>&1; then
+                sample "$_emit_target" 1 -mayDie 2>/dev/null | head -60
+            else
+                echo "(sample unavailable on this platform)"
+            fi
+        } > "$_emit_diag" 2>/dev/null || true
         kill -9 "$_emit_target" 2>/dev/null || true
     ) >/dev/null 2>&1 &
     # Disown so the watchdog is not a tracked job of the caller's shell.

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.19.1";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
+var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.21.0";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1236,4 +1236,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:Y}=await Promise.resolve().then(() => (g_(),v_));return Y(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(m_),2}}lO();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var dV0=await pV0(Bun.argv.slice(2));process.exit(dV0);
 
-//# debugId=78ABA7C02A59114D64756E2164756E21
+//# debugId=8B493F2C51A0A0E764756E2164756E21

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.19.1'
+__version__ = '9.21.0'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.19.1",
+  "version": "9.21.0",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.19.1",
+  "version": "9.21.0",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",