loki-mode 9.22.2 → 9.22.4

package/README.md

@@ -51,6 +51,56 @@ That is the whole happy path. It asks for a one-line idea, picks a template,
 shows the real cost and time estimate before spending anything, then builds.
 Press Enter through every step and you get a sample Todo app.
 
+One command, no prompts (CI, scripts, containers, any shell without a terminal):
+
+```bash
+loki quickstart "a todo app with user accounts" --yes
+```
+
+Both halves are required with no terminal: an idea (or a path to a PRD file)
+and an explicit `--yes`. Given both, Loki picks the top-ranked template
+automatically, prints the same honest cost and time estimate, and starts the
+build without asking anything. Missing either half exits 2 with the
+needs-a-terminal message and writes nothing, so an ambient `LOKI_AUTO_CONFIRM`
+or a stray argument in CI can never start a paid build on its own. Existing
+files are never overwritten: if `prd.md` is present the PRD lands at
+`prd-quickstart.md`, then numbered suffixes as needed.
+
+Choose an exact shipped starter when the top-ranked match is not the one you
+want:
+
+```bash
+loki quickstart "an internal reporting workspace" --template dashboard --yes
+```
+
+`--template` accepts an exact template name for idea inputs and works the same
+way with interactive use or `--dry-run` (including JSON preview). Unknown
+templates, duplicate flags, and combinations with a PRD path refuse before
+provider discovery, estimation, writes, or build execution.
+
+Preview the same deterministic template choice and estimator-backed plan with
+zero writes or execution:
+
+```bash
+loki quickstart "a todo app with user accounts" --dry-run
+```
+
+Preview requires an idea or readable PRD path, works without a terminal or AI
+provider, and exits before creating a PRD or starting a build. `--dry-run` and
+`--yes` are mutually exclusive so execution intent is never ambiguous.
+
+For scripts and local dashboards, add `--json` to receive one versioned JSON
+object instead of terminal text:
+
+```bash
+loki quickstart "a todo app with user accounts" --dry-run --json
+```
+
+The object contains the input kind, deterministic selected template (or `null`
+for an existing PRD), and the exact estimator response under `plan`. `--json`
+requires `--dry-run`; invalid input or estimator failure writes no JSON, and the
+command still exits before provider discovery, file writes, or build execution.
+
 Or go straight at it:
 
 ```bash

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.22.2
+# Loki Mode v9.22.4
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.22.2 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.22.4 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.22.2
+9.22.4

package/autonomy/loki

@@ -35298,6 +35298,9 @@ cmd_proof() {
             echo "  show <id>            Pretty-print .loki/proofs/<id>/proof.json"
             echo "  verify <id>          Re-check a receipt against the repo (tamper + drift);"
             echo "                       exit 0 clean, 1 tamper/drift. Verify it yourself."
+            echo "  passport <contract> <id|proof.json> <output.json>"
+            echo "                       Bind work from any agent to a portable Outcome Contract"
+            echo "                       and independently rechecked Evidence Receipt"
             echo ""
             echo "Options for 'verify':"
             echo "  --human              Render the verdict and every failure reason as prose"
@@ -35474,6 +35477,47 @@ PYEOF
             fi
             exit 0
             ;;
+        passport)
+            # EXEC-PROOF-01: make the provider-neutral Proof Passport reachable
+            # from the installed product. The Python implementation already
+            # binds the executor/verifier identities, exact contract digest,
+            # exact receipt bytes, and independently re-derived verdict. Before
+            # this subcommand, users had to know the repository-only tools/
+            # path, so the portable proof workflow was not actually a product
+            # workflow for npm consumers.
+            #
+            # The second positional accepts either a local proof id or an
+            # explicit receipt path. That lets a Loki run use its short id while
+            # Codex, Claude Code, Cursor, Factory, or any other executor can hand
+            # over a provider-neutral proof.json without copying it into .loki.
+            local contract="${1:-}"
+            local receipt_ref="${2:-}"
+            local output="${3:-}"
+            if [ -z "$contract" ] || [ -z "$receipt_ref" ] || [ -z "$output" ]; then
+                echo -e "${RED}Usage: loki proof passport <contract.json> <proof-id|proof.json> <output.json> [options]${NC}" >&2
+                echo "Options: --repo-dir DIR --markdown-output FILE --force" >&2
+                exit 64
+            fi
+            shift 3
+
+            local receipt_path="$receipt_ref"
+            if [ ! -f "$receipt_path" ]; then
+                receipt_path="${proofs_dir}/${receipt_ref}/proof.json"
+            fi
+            if [ ! -f "$receipt_path" ]; then
+                echo -e "${RED}Receipt not found: ${receipt_ref}${NC}" >&2
+                echo "Pass a proof id from 'loki proof list' or a path to proof.json." >&2
+                exit 2
+            fi
+
+            local passport_tool="${SKILL_DIR}/tools/proof-passport.py"
+            if [ ! -f "$passport_tool" ]; then
+                echo -e "${RED}Proof Passport tool not found: ${passport_tool}${NC}" >&2
+                exit 3
+            fi
+            python3 "$passport_tool" "$contract" "$receipt_path" "$output" "$@"
+            exit $?
+            ;;
         md)
             # Paste-able Markdown for a PR comment, a Slack message, or a
             # ticket. The renderer already existed -- render_evidence_receipt_md

package/autonomy/quickstart.sh

@@ -283,6 +283,19 @@ _qs_template_summary() {
     esac
 }
 
+# _qs_template_exists <name>: accept only an exact shipped template basename.
+# Keeping validation here (rather than accepting an arbitrary path) prevents
+# --template from becoming a second PRD/file-read surface. The intentionally
+# narrow character set also makes names safe to join below without traversal.
+_qs_template_exists() {
+    local name="${1:-}"
+    case "$name" in
+        ""|*[!a-z0-9-]*) return 1;;
+    esac
+    [ "$name" != "README" ] || return 1
+    [ -f "$(_qs_templates_dir)/$name.md" ]
+}
+
 # _qs_selected_provider: print the provider a build would ACTUALLY pick, or
 # nothing. Single source of truth is providers/loader.sh auto_detect_provider --
 # the same seam render_provider_availability (provider-offer.sh:395) uses, and
@@ -327,7 +340,7 @@ _qs_selected_provider() {
 # non-zero if the estimator gave no result (caller falls back to a no-number
 # confirm, never fabricating a figure).
 _qs_emit_plan() {
-    local prd_path="$1" template_name="$2"
+    local prd_path="$1" template_name="$2" json_output="${3:-false}" input_kind="${4:-idea}"
     local plan_json=""
     plan_json=$(show_prd_plan "$prd_path" "true" "false" 2>/dev/null) || plan_json=""
     if [ -z "$plan_json" ]; then
@@ -358,6 +371,32 @@ print('{}{}'.format(iters, rng_str))
     if [ -z "$parsed" ]; then
         return 1
     fi
+
+    if [ "$json_output" = true ]; then
+        local json_payload=""
+        json_payload=$(printf '%s' "$plan_json" | python3 -c '
+import json
+import sys
+
+plan = json.load(sys.stdin)
+if not isinstance(plan, dict):
+    sys.exit(1)
+template_name, input_kind = sys.argv[1:3]
+payload = {
+    "schema_version": 1,
+    "command": "loki quickstart",
+    "mode": "dry-run",
+    "input_kind": input_kind,
+    "selected_template": template_name if input_kind == "idea" else None,
+    "source_name": template_name if input_kind == "prd" else None,
+    "plan": plan,
+}
+json.dump(payload, sys.stdout, separators=(",", ":"), sort_keys=True)
+' "$template_name" "$input_kind" 2>/dev/null) || json_payload=""
+        [ -n "$json_payload" ] || return 1
+        printf '%s\n' "$json_payload" >&3
+        return 0
+    fi
     local tier_u cost_u time_u iter_u
     tier_u=$(printf '%s' "$parsed" | sed -n '1p')
     cost_u=$(printf '%s' "$parsed" | sed -n '2p')
@@ -391,16 +430,32 @@ _qs_help() {
     printf '\n'
     printf 'Options:\n'
     printf '  --yes, -y     Auto-confirm the final build prompt (still shows the plan)\n'
+    printf '  --dry-run     Preview the selected template and plan; write/start nothing\n'
+    printf '  --json        With --dry-run, emit one machine-readable JSON object\n'
+    printf '  --template N  Use the exact shipped template N for an IDEA\n'
     printf '  --help, -h    Show this help and exit\n'
     printf '\n'
+    printf 'Non-interactive use:\n'
+    printf '  loki quickstart "a todo app with user accounts" --yes\n'
+    printf '  Both an IDEA (or PRD path) and --yes are required with no terminal.\n'
+    printf '  Missing either one exits 2 and writes nothing. The top-ranked\n'
+    printf '  template is chosen automatically and the plan is still shown.\n'
+    printf '  Add --template NAME to choose a shipped template instead.\n'
+    printf '\n'
+    printf 'Zero-spend preview:\n'
+    printf '  loki quickstart "a todo app" --dry-run\n'
+    printf '  An IDEA (or readable PRD path) is required. No provider is checked,\n'
+    printf '  no file is written, and no build is started. Do not combine with --yes.\n'
+    printf '  Add --json for versioned JSON only; --json requires --dry-run.\n'
+    printf '\n'
     printf 'Steps:\n'
-    printf '  1. Setup      Check for an AI provider; offer to install if missing\n'
+    printf '  1. Setup      Check for an AI provider for execution (skipped in preview)\n'
     printf '  2. Build      Describe what you want, or Enter for the sample Todo app\n'
     printf '  3. Template   Pick the closest starting template (offline keyword match)\n'
     printf '  4. Plan       Review the honest cost/time estimate, then confirm\n'
     printf '\n'
-    printf 'The PRD is written to ./prd.md in the current directory, then the build\n'
-    printf 'starts. For non-interactive automation use: loki start <prd> --yes\n'
+    printf 'The PRD is written to ./prd.md in the current directory (or the next\n'
+    printf 'free prd-quickstart*.md name if that exists), then the build starts.\n'
     return 0
 }
 
@@ -408,14 +463,36 @@ _qs_help() {
 # (slice B), show_prd_plan (slice A), the template matcher, and cmd_start.
 #
 # Order is load-bearing:
-#   --help (exit 0) -> non-TTY/CI gate (hint + exit 2) -> provider gate ->
+#   argv validation -> non-TTY/CI gate (hint + exit 2) -> provider gate or skip ->
 #   step 2 (idea / PRD path) -> step 3 (template) -> step 4 (plan + confirm) ->
 #   write PRD to CWD -> cmd_start --yes --no-plan (subshelled; it execs the runner).
+#
+# The non-TTY/CI gate admits two fully-specified shapes:
+#   loki quickstart "<idea>|<prd-path>" --yes
+#   loki quickstart "<idea>|<prd-path>" --dry-run
+# Execution requires argv consent; preview forbids it. Both paths skip prompts
+# and share template ranking plus the honest estimator. Only execution crosses
+# the provider, confirm, write, and cmd_start boundaries.
 cmd_quickstart() {
     local positional=""
     local assume_yes=false
+    local dry_run=false
+    local json_output=false
+    local template_override=""
+    local template_flag_seen=false
     if _qs_assume_yes; then assume_yes=true; fi
 
+    # yes_flag tracks EXPLICIT --yes/-y on THIS command's argv, and nothing else.
+    # It is deliberately NOT assume_yes: _qs_assume_yes also returns true for an
+    # ambient LOKI_ASSUME_YES or LOKI_AUTO_CONFIRM=true, and LOKI_AUTO_CONFIRM is
+    # exactly what `loki --yes <anything>` (loki:2313) and CI-ish environments
+    # export. Gating the non-interactive bypass on assume_yes would let an
+    # ambient env var plus a stray positional silently start a PAID build in CI
+    # with no human in the loop. The safety contract asks for explicit consent,
+    # so consent must come from argv. assume_yes keeps its existing meaning for
+    # the confirm prompt, so the interactive journey is byte-identical.
+    local yes_flag=false
+
     while [ $# -gt 0 ]; do
         case "$1" in
             --help|-h)
@@ -424,8 +501,30 @@ cmd_quickstart() {
                 ;;
             --yes|-y)
                 assume_yes=true
+                yes_flag=true
+                shift
+                ;;
+            --dry-run)
+                dry_run=true
+                shift
+                ;;
+            --json)
+                json_output=true
                 shift
                 ;;
+            --template)
+                if [ "$template_flag_seen" = true ]; then
+                    printf '%s--template may be specified only once.%s\n' "$_QS_RED" "$_QS_NC" >&2
+                    exit 2
+                fi
+                template_flag_seen=true
+                if [ $# -lt 2 ] || [ -z "${2:-}" ] || [[ "${2:-}" == --* ]]; then
+                    printf '%s--template requires an exact shipped template name.%s\n' "$_QS_RED" "$_QS_NC" >&2
+                    exit 2
+                fi
+                template_override="$2"
+                shift 2
+                ;;
             --*)
                 printf '%sUnknown option: %s%s\n' "$_QS_RED" "$1" "$_QS_NC" >&2
                 printf "Run 'loki quickstart --help' for usage.\n" >&2
@@ -444,36 +543,133 @@ cmd_quickstart() {
         esac
     done
 
-    # Non-TTY / CI: quickstart is interactive by definition. Never hang on read;
-    # print the automation hint to stderr and exit 2 (design 3.8).
-    if _qs_non_interactive; then
-        printf 'loki quickstart is interactive and needs a terminal. For automation use: loki start <prd> --yes\n' >&2
+    # A preview is an explicit no-execution request. Reject simultaneous build
+    # consent instead of guessing which instruction wins. This check precedes
+    # provider discovery, estimation, and every write.
+    if [ "$dry_run" = true ] && [ "$yes_flag" = true ]; then
+        printf '%s--dry-run cannot be combined with --yes or -y.%s\n' "$_QS_RED" "$_QS_NC" >&2
+        exit 2
+    fi
+
+    if [ "$json_output" = true ] && [ "$dry_run" != true ]; then
+        printf '%s--json requires --dry-run.%s\n' "$_QS_RED" "$_QS_NC" >&2
         exit 2
     fi
 
+    # Explicit template selection is deliberately an IDEA-only surface. It is
+    # validated before provider discovery, estimation, and every write/build
+    # boundary so a typo or conflicting PRD can never fall through to spend.
+    if [ "$template_flag_seen" = true ]; then
+        if [ -z "$positional" ]; then
+            printf '%s--template requires an IDEA argument.%s\n' "$_QS_RED" "$_QS_NC" >&2
+            exit 2
+        fi
+        case "$positional" in
+            */*|*.md|*.markdown|*.txt|*.json|*.yaml|*.yml)
+                printf '%s--template cannot be combined with a PRD path.%s\n' "$_QS_RED" "$_QS_NC" >&2
+                exit 2
+                ;;
+        esac
+        if [ -f "$positional" ]; then
+            printf '%s--template cannot be combined with a PRD path.%s\n' "$_QS_RED" "$_QS_NC" >&2
+            exit 2
+        fi
+        if ! _qs_template_exists "$template_override"; then
+            printf '%sUnknown shipped template: %s%s\n' "$_QS_RED" "$template_override" "$_QS_NC" >&2
+            exit 2
+        fi
+    fi
+
+    # Preview is deliberately non-interactive: without an explicit idea or PRD
+    # path there is nothing deterministic to estimate. A path-looking argument
+    # must resolve to a readable regular file; otherwise treating a typo such as
+    # ./prd.md as prose would preview an unrelated template and mislead the user.
+    if [ "$dry_run" = true ]; then
+        if [ -z "$positional" ]; then
+            printf 'loki quickstart --dry-run requires an IDEA or readable PRD path.\n' >&2
+            exit 2
+        fi
+        case "$positional" in
+            */*|*.md|*.markdown|*.txt|*.json|*.yaml|*.yml)
+                if [ ! -f "$positional" ] || [ ! -r "$positional" ]; then
+                    printf 'PRD path is not a readable file: %s\n' "$positional" >&2
+                    exit 2
+                fi
+                ;;
+        esac
+    fi
+
+    # Non-TTY / CI: quickstart is interactive by definition, so by default it
+    # never hangs on a read -- it prints the automation hint to stderr and exits
+    # 2 (design 3.8).
+    #
+    # The execution exception is a fully-specified invocation:
+    #   loki quickstart "<idea>" --yes      (or a PRD path in place of the idea)
+    # Both halves are required. A non-empty positional supplies the input that
+    # steps 2-3 would otherwise have to ask for, and an explicit argv --yes
+    # supplies the consent step 4 would otherwise have to ask for. With both
+    # present there is nothing left to prompt about, so the refusal is pure
+    # friction for a newly installed operator running one command.
+    #
+    # Missing EITHER half keeps the refusal verbatim and writes nothing: a bare
+    # `loki quickstart` in CI still cannot spend, and neither can one that has an
+    # idea but no consent. Fail-closed is the load-bearing direction here -- the
+    # bypass must be something an operator opts into by typing both, never
+    # something an environment can arrive at on its own.
+    local noninteractive_ok=false
+    if _qs_non_interactive; then
+        if [ "$dry_run" = true ] || { [ -n "$positional" ] && [ "$yes_flag" = true ]; }; then
+            noninteractive_ok=true
+        else
+            printf 'loki quickstart is interactive and needs a terminal. For automation use: loki start <prd> --yes\n' >&2
+            exit 2
+        fi
+    fi
+
+    # Machine-readable preview follows the exact same selection and estimator
+    # path as the human preview. Suppress presentation stdout while retaining a
+    # duplicate of the caller's stdout on fd 3; _qs_emit_plan writes the single
+    # validated JSON object there only after estimation succeeds. Stderr stays
+    # available for fail-closed diagnostics.
+    local json_stdout_redirected=false
+    if [ "$json_output" = true ]; then
+        exec 3>&1 1>/dev/null
+        json_stdout_redirected=true
+    fi
+
     printf '\n'
-    printf '%sLoki Mode quickstart -- four quick questions, then your build starts.%s\n' "$_QS_BOLD" "$_QS_NC"
+    if [ "$dry_run" = true ]; then
+        printf '%sLoki Mode quickstart preview -- template and plan only.%s\n' "$_QS_BOLD" "$_QS_NC"
+    else
+        printf '%sLoki Mode quickstart -- four quick questions, then your build starts.%s\n' "$_QS_BOLD" "$_QS_NC"
+    fi
     printf '\n'
 
     # ----- Step 1 of 4: Setup (reuse the slice-B provider offer) -------------
     printf '%sStep 1 of 4: Setup%s\n' "$_QS_BOLD" "$_QS_NC"
-    printf '  Checking for an AI provider CLI ...\n'
+    if [ "$dry_run" = true ]; then
+        # Estimation and deterministic template selection are local. Previewing
+        # must work before provider installation and must not run provider code.
+        printf '  Preview mode: provider check skipped; no build will start.\n'
+    else
+        printf '  Checking for an AI provider CLI ...\n'
     # Ask the loader FIRST: it is the only thing that knows what the runner will
     # really pick, and it is the only check that sees opencode. Falling back to
     # detect_any_provider (stale four, PATH-only) keeps the no-provider guard
     # intact when the loader is absent or unreadable.
-    local found=""
-    found="$(_qs_selected_provider)" || found=""
-    if [ -n "$found" ]; then
-        printf '  Found: %s. Good.\n' "$found"
-    elif detect_any_provider; then
-        printf '  Found: an AI provider CLI. Good.\n'
-    else
-        # Run the inline install + login offer. provider_offer_gate returns 2 if
-        # no provider ends up available (declined, or install failed).
-        if ! provider_offer_gate; then
-            printf '%sNo provider available; cannot start a build. Install one and re-run loki quickstart.%s\n' "$_QS_RED" "$_QS_NC" >&2
-            exit 2
+        local found=""
+        found="$(_qs_selected_provider)" || found=""
+        if [ -n "$found" ]; then
+            printf '  Found: %s. Good.\n' "$found"
+        elif detect_any_provider; then
+            printf '  Found: an AI provider CLI. Good.\n'
+        else
+            # Run the inline install + login offer. provider_offer_gate returns 2 if
+            # no provider ends up available (declined, or install failed).
+            if ! provider_offer_gate; then
+                printf '%sNo provider available; cannot start a build. Install one and re-run loki quickstart.%s\n' "$_QS_RED" "$_QS_NC" >&2
+                exit 2
+            fi
         fi
     fi
     printf '\n'
@@ -484,27 +680,34 @@ cmd_quickstart() {
     local prd_source=""        # an existing PRD file path, when the user has one
     local brief=""             # the one-line idea (drives template matching)
     local template_name=""
+    local input_kind="idea"
 
     if [ -n "$positional" ] && [ -f "$positional" ]; then
         prd_source="$positional"
+        input_kind="prd"
         printf '%sUsing your PRD: %s%s\n' "$_QS_DIM" "$positional" "$_QS_NC"
         printf '\n'
     else
         printf '%sStep 2 of 4: What do you want to build?%s\n' "$_QS_BOLD" "$_QS_NC"
-        printf '  Describe it in one line, or paste a path to a PRD file.\n'
-        printf '  (Press Enter to build the sample Todo app.)\n'
-        if [ -n "$positional" ]; then
+        if [ "$dry_run" = true ]; then
             brief="$positional"
-            printf '> %s\n' "$brief"
+            printf '  Previewing idea: %s\n' "$brief"
         else
-            local answer=""
-            printf '> '
-            read -r answer 2>/dev/null || answer=""
-            # If the typed value is an existing file, treat it as a PRD path.
-            if [ -n "$answer" ] && [ -f "$answer" ]; then
-                prd_source="$answer"
+            printf '  Describe it in one line, or paste a path to a PRD file.\n'
+            printf '  (Press Enter to build the sample Todo app.)\n'
+            if [ -n "$positional" ]; then
+                brief="$positional"
+                printf '> %s\n' "$brief"
             else
-                brief="$answer"
+                local answer=""
+                printf '> '
+                read -r answer 2>/dev/null || answer=""
+                # If the typed value is an existing file, treat it as a PRD path.
+                if [ -n "$answer" ] && [ -f "$answer" ]; then
+                    prd_source="$answer"
+                else
+                    brief="$answer"
+                fi
             fi
         fi
         printf '\n'
@@ -512,6 +715,11 @@ cmd_quickstart() {
 
     # ----- Step 3 of 4: Pick a template (skipped if a PRD path was given) ----
     if [ -z "$prd_source" ]; then
+        if [ -n "$template_override" ]; then
+            template_name="$template_override"
+            printf '%sStep 3 of 4: Template%s\n' "$_QS_BOLD" "$_QS_NC"
+            printf '  Selected %s (--template).\n\n' "$template_name"
+        else
         local -a top3=()
         local line
         while IFS= read -r line; do
@@ -523,25 +731,40 @@ cmd_quickstart() {
             top3=("simple-todo-app")
         fi
 
-        printf '%sStep 3 of 4: Pick a starting template%s\n' "$_QS_BOLD" "$_QS_NC"
-        if [ -n "$brief" ]; then
-            printf '  Closest matches for "%s":\n' "$brief"
+        # The MENU, not just the read, is interactive-only. Offering "Choose 1-3"
+        # to a shell that can never answer is a prompt the operator has to read
+        # and mistrust; worse, it makes a transcript indistinguishable from one
+        # that actually stopped for input. The ranking above is shared by both
+        # paths -- only its presentation differs.
+        local pick=""
+        if [ "$noninteractive_ok" != true ]; then
+            printf '%sStep 3 of 4: Pick a starting template%s\n' "$_QS_BOLD" "$_QS_NC"
+            if [ -n "$brief" ]; then
+                printf '  Closest matches for "%s":\n' "$brief"
+            else
+                printf '  Closest matches for the sample Todo app:\n'
+            fi
+            local i=1 t suffix
+            for t in "${top3[@]}"; do
+                suffix=""
+                [ "$i" -eq 1 ] && suffix="   (default)"
+                printf '    %d) %-18s %s%s\n' "$i" "$t" "$(_qs_template_summary "$t")" "$suffix"
+                i=$((i + 1))
+            done
+            printf '  Choose 1-%d, or press Enter for 1.\n' "${#top3[@]}"
+            printf '> '
+            read -r pick 2>/dev/null || pick=""
+            printf '\n'
         else
-            printf '  Closest matches for the sample Todo app:\n'
+            # Deterministic selection: the empty pick below resolves to top3[0],
+            # the same rank the interactive picker offers as "(default)". The
+            # ranking itself is unchanged -- _qs_score_templates is offline,
+            # deterministic and already the single source of order -- so the
+            # non-interactive choice is exactly the one an operator pressing
+            # Enter would get. No picker, no prompt, no second code path.
+            printf '%sStep 3 of 4: Template%s\n' "$_QS_BOLD" "$_QS_NC"
+            printf '  Selected %s (top match) for "%s".\n\n' "${top3[0]}" "$brief"
         fi
-        local i=1 t suffix
-        for t in "${top3[@]}"; do
-            suffix=""
-            [ "$i" -eq 1 ] && suffix="   (default)"
-            printf '    %d) %-18s %s%s\n' "$i" "$t" "$(_qs_template_summary "$t")" "$suffix"
-            i=$((i + 1))
-        done
-        printf '  Choose 1-%d, or press Enter for 1.\n' "${#top3[@]}"
-
-        local pick=""
-        printf '> '
-        read -r pick 2>/dev/null || pick=""
-        printf '\n'
 
         case "$pick" in
             ""|1) template_name="${top3[0]}";;
@@ -550,6 +773,8 @@ cmd_quickstart() {
             *) template_name="${top3[0]}";;  # any unexpected input -> the default
         esac
 
+        fi
+
         local tdir; tdir="$(_qs_templates_dir)"
         prd_source="$tdir/$template_name.md"
         if [ ! -f "$prd_source" ]; then
@@ -562,11 +787,41 @@ cmd_quickstart() {
 
     # ----- Step 4 of 4: Review the plan (reuse the slice-A estimator) --------
     printf '%sStep 4 of 4: Review the plan%s\n' "$_QS_BOLD" "$_QS_NC"
+    # The plan is ALWAYS rendered, on both paths, from the same real estimator.
+    # The non-interactive path shows it before execution rather than before a
+    # prompt: the operator still gets the honest quote in the transcript, and it
+    # is still the figure cmd_start runs with, so the quote equals the charge.
     local estimate_ok=true
-    if ! _qs_emit_plan "$prd_source" "$template_name"; then
+    if ! _qs_emit_plan "$prd_source" "$template_name" "$json_output" "$input_kind"; then
         estimate_ok=false
-        printf '%sCould not compute a cost estimate (the estimator did not return a result).%s\n' "$_QS_YELLOW" "$_QS_NC"
-        printf '\n'
+        # No honest number available. Interactively this flips the confirm to
+        # default-NO below. Non-interactively there is no one to review the
+        # missing plan, so fail closed before writing a PRD or starting a build.
+        # Explicit --yes authorizes the displayed estimate; it is not consent
+        # to spend without one.
+        if [ "$noninteractive_ok" = true ]; then
+            if [ "$json_stdout_redirected" = true ]; then
+                exec 1>&3 3>&-
+                json_stdout_redirected=false
+            fi
+            printf 'Could not compute a cost estimate; non-interactive quickstart requires a displayed plan and started no build.\n' >&2
+            return 2
+        else
+            printf '%sCould not compute a cost estimate (the estimator did not return a result).%s\n' "$_QS_YELLOW" "$_QS_NC"
+            printf '\n'
+        fi
+    fi
+
+    # The preview terminal boundary is intentionally immediately after the
+    # shared estimator. Reaching it proves the same template and plan were
+    # rendered, while returning here makes the confirm, PRD copy, and cmd_start
+    # structurally unreachable.
+    if [ "$dry_run" = true ]; then
+        printf 'Preview complete. No provider was run, no file was written, and no build was started.\n'
+        if [ "$json_stdout_redirected" = true ]; then
+            exec 1>&3 3>&-
+        fi
+        return 0
     fi
 
     # ----- Confirm ----------------------------------------------------------
@@ -595,8 +850,16 @@ cmd_quickstart() {
     local target="./prd.md"
     if [ -e "$target" ]; then
         local overwrite=""
-        printf 'prd.md already exists. Overwrite? [y/N] '
-        read -r overwrite 2>/dev/null || overwrite=""
+        # Non-interactive never asks and never overwrites. Leaving $overwrite
+        # empty falls into the existing suffix walk below, which is already the
+        # correct no-clobber behavior -- prd-quickstart.md, then numbered free
+        # suffixes exactly as needed. Reused rather than reimplemented so the two
+        # paths cannot drift, and so "never overwrite" holds by construction
+        # (there is no branch here that can reach the clobber).
+        if [ "$noninteractive_ok" != true ]; then
+            printf 'prd.md already exists. Overwrite? [y/N] '
+            read -r overwrite 2>/dev/null || overwrite=""
+        fi
         if [[ ! "$overwrite" =~ ^[Yy] ]]; then
             # Declining to overwrite one file must never silently destroy
             # another (bug-hunt MEDIUM): the fallback gets the same existence

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.22.2"
+__version__ = "9.22.4"
 
 # Expose the control app for easy import
 try:

package/dashboard/api_releases.py

@@ -133,9 +133,12 @@ def _git_tags(repo_dir: str, limit: int) -> tuple:
         "refs/tags",
     ]
     try:
+        # Fixed git executable, integer-formatted option, separate cwd, and an
+        # argv vector keep caller data out of shell parsing.
         proc = subprocess.run(
-            cmd, cwd=repo_dir, capture_output=True, text=True,
-            timeout=_GIT_TIMEOUT_S,
+            cmd,  # lgtm[py/command-line-injection]
+            cwd=repo_dir, capture_output=True, text=True,
+            timeout=_GIT_TIMEOUT_S, shell=False,
         )
     except FileNotFoundError:
         return [], "git executable not found on PATH"

package/dashboard/control.py

@@ -495,14 +495,17 @@ async def start_session(request: StartRequest):
 
     try:
         # Start the process
+        # RUN_SH is a trusted fixed path; provider and PRD were validated above,
+        # and argv is passed directly without a command shell.
         process = subprocess.Popen(
-            args,
+            args,  # lgtm[py/command-line-injection]
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
             start_new_session=True,
             # A deleted cwd would make Popen itself raise; fall back to the
             # skill tree rather than failing to launch the run at all.
-            cwd=str(_cwd_or_skill_dir())
+            cwd=str(_cwd_or_skill_dir()),
+            shell=False,
         )
 
         # Save provider for status tracking

package/dashboard/server.py

@@ -4313,13 +4313,16 @@ def _start_supervised_workspace_build(
         supervisor_log = _build_execution.execution_dir(execution_id) / "supervisor.log"
         try:
             with _build_execution.open_private_log(supervisor_log) as log_handle:
+                # sys.executable and the module name are fixed; validated build
+                # fields remain argv data and never reach a command shell.
                 process = subprocess.Popen(
-                    supervisor_args,
+                    supervisor_args,  # lgtm[py/command-line-injection]
                     stdout=log_handle,
                     stderr=subprocess.STDOUT,
                     start_new_session=True,
                     cwd=str(skill_dir),
                     env=popen_env,
+                    shell=False,
                 )
         except (OSError, subprocess.SubprocessError) as exc:
             finished_at = _build_execution.utc_now()
@@ -4582,13 +4585,16 @@ async def start_build(request: Request, body: StartBuildRequest):
     args.append("--bg")
     args.append(str(spec_file))
     try:
+        # run_sh is a trusted fixed path; provider and spec were validated, and
+        # the argv vector is executed directly without shell interpretation.
         process = subprocess.Popen(
-            args,
+            args,  # lgtm[py/command-line-injection]
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
             start_new_session=True,
             cwd=str(project_dir),
             env=popen_env,
+            shell=False,
         )
     except (OSError, subprocess.SubprocessError) as e:
         raise HTTPException(status_code=500, detail=f"Failed to start build: {e}")

package/docs/INSTALLATION.md

@@ -183,6 +183,17 @@ builds the sample Todo app.
 loki quickstart
 ```
 
+For a fully specified first build, provide the idea, an optional exact shipped
+starter template, and explicit consent:
+
+```bash
+loki quickstart "an internal reporting workspace" --template dashboard --yes
+```
+
+Use `--dry-run` instead of `--yes` to preview the same template and plan without
+provider discovery, file writes, or execution; add `--json` for one versioned
+machine-readable object.
+
 Drop a spec -- any artifact that describes what you want built -- and Loki
 Mode takes it from spec to deployed app. Specs can be a markdown PRD, a
 GitHub issue URL, or a YAML feature description.

package/docs/OUTCOME-CANARY-EVALUATION.md

@@ -25,6 +25,21 @@ loki outcomes canary evaluate report.json observations.json \
 
 Evaluation is opt-in. Without `--enable-evaluation`, the command refuses.
 
+Automation that may act only on one exact decision can add an explicit verdict
+gate:
+
+```bash
+loki outcomes canary evaluate report.json observations.json \
+  --enable-evaluation --control-route safe --canary-percent 10 \
+  --require-verdict PROMOTE --json
+```
+
+`--require-verdict` accepts only `PROMOTE`, `HOLD`, or `ROLLBACK`. A complete
+evaluation still prints its actual verdict, but exits 3 when that verdict does
+not exactly match the required value. JSON output also includes
+`required_verdict` and `requirement_met` when the gate is requested. Omitting the
+gate preserves the existing behavior: every complete verdict exits 0.
+
 ## Retain a decision receipt
 
 After a complete evaluation, create one immutable portable proof by independently
@@ -35,6 +50,19 @@ loki outcomes canary receipt report.json observations.json receipt.json \
   --enable-receipt --control-route safe --canary-percent 10 --min-samples 5
 ```
 
+Automation can require the rederived verdict before the receipt is published:
+
+```bash
+loki outcomes canary receipt report.json observations.json receipt.json \
+  --enable-receipt --control-route safe --canary-percent 10 --min-samples 5 \
+  --require-verdict PROMOTE --json
+```
+
+The target is created only when the actual verdict exactly matches the required
+`PROMOTE`, `HOLD`, or `ROLLBACK` value. A mismatch exits `3`, reports both verdicts
+and `"requirement_met": false`, and leaves the target absent. Omitting
+`--require-verdict` preserves the existing behavior of recording any complete verdict.
+
 The command creates a new canonical `loki-outcome-canary-decision-receipt/v1`
 file. It binds the exact report, source, and observation digests; the full
 evaluation policy; privacy-safe aggregate arm results; the acceptance delta; and
@@ -56,6 +84,20 @@ loki outcomes canary verify report.json observations.json receipt.json \
   --enable-verification --json
 ```
 
+Automation that may act only on one exact independently verified decision can
+gate the verifier itself:
+
+```bash
+loki outcomes canary verify report.json observations.json receipt.json \
+  --enable-verification --require-verdict PROMOTE --json
+```
+
+`--require-verdict` accepts only `PROMOTE`, `HOLD`, or `ROLLBACK`. A receipt that
+fully verifies still prints its actual verdict, but exits 3 when that verdict
+does not exactly match the required value. JSON output also includes
+`required_verdict` and `requirement_met` when the gate is requested. Omitting the
+gate preserves the existing behavior: every fully verified receipt exits 0.
+
 The read-only verifier takes the policy from the canonical receipt, independently
 reruns the deterministic evaluation, rechecks the report, source, and observation
 bytes, and requires the complete rederived receipt to match exactly. It returns
@@ -139,5 +181,6 @@ unbound evidence returns `REFUSED` rather than a partial verdict.
 `--json` emits the aggregate arms, policy, exact evidence digests, verdict, and
 refusal reasons. It is portable across machines because it omits local input paths.
 The default output is a short human-readable summary. Exit 0 means
-a verdict was produced (including `ROLLBACK`), 3 means evaluation was refused, 64
-is an invocation error, and 66 is a missing input file.
+a verdict was produced (including `ROLLBACK`) and any requested exact-verdict
+gate matched. Exit 3 means evaluation was refused or an exact-verdict gate did
+not match, 64 is an invocation error, and 66 is a missing input file.

package/docs/PROOF-PASSPORT.md

@@ -5,10 +5,12 @@ receipt. The JSON artifact preserves the exact contract and receipt digests,
 the verifier verdict, executor/verifier separation, and explicit trust
 limitations.
 
-Generate the machine-readable passport and a portable PR/CI summary together:
+Generate the machine-readable passport and a portable PR/CI summary together
+from the installed product. The receipt argument can be a proof id from
+`loki proof list` or a path to any provider's compatible `proof.json`:
 
 ```bash
-python3 tools/proof-passport.py \
+loki proof passport \
   outcome-contract.json proof.json proof-passport.json \
   --repo-dir . \
   --markdown-output proof-passport.md

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.22.2";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
+var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.22.4";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1236,4 +1236,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:Y}=await Promise.resolve().then(() => (g_(),v_));return Y(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(m_),2}}lO();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var dV0=await pV0(Bun.argv.slice(2));process.exit(dV0);
 
-//# debugId=1B1E1BA0D9D91D1E64756E2164756E21
+//# debugId=C61EF35407CE212F64756E2164756E21

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.22.2'
+__version__ = '9.22.4'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.22.2",
+  "version": "9.22.4",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.22.2",
+  "version": "9.22.4",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/tools/outcome-canary-evaluate.py

@@ -235,6 +235,7 @@ def main(argv=None):
     parser.add_argument("--max-risk", type=float, default=.25)
     parser.add_argument("--min-samples", type=int, default=5)
     parser.add_argument("--min-lift-bps", type=int, default=1)
+    parser.add_argument("--require-verdict", choices=("PROMOTE", "HOLD", "ROLLBACK"))
     parser.add_argument("--json", action="store_true")
     args = parser.parse_args(argv)
     for path in (args.report, args.observations):
@@ -245,8 +246,19 @@ def main(argv=None):
         args.report, args.observations, args.control_route, args.canary_percent,
         args.max_risk, args.min_samples, args.min_lift_bps, args.enable_evaluation,
     )
+    requirement_met = (
+        not result["refusal_reasons"]
+        and (args.require_verdict is None or result["verdict"] == args.require_verdict)
+    )
     if args.json:
-        print(json.dumps(result, sort_keys=True))
+        output = result
+        if args.require_verdict is not None:
+            output = {
+                **result,
+                "required_verdict": args.require_verdict,
+                "requirement_met": requirement_met,
+            }
+        print(json.dumps(output, sort_keys=True))
     elif result["refusal_reasons"]:
         print("Canary evaluation: REFUSED")
         for reason in result["refusal_reasons"]:
@@ -264,7 +276,10 @@ def main(argv=None):
         print(f"  accepted delta: {result['accepted_delta_bps']} bps")
         print(f"  report sha256: {result['report_sha256']}")
         print(f"  observations sha256: {result['observations_sha256']}")
-    return REFUSED if result["refusal_reasons"] else OK
+        if args.require_verdict is not None:
+            status = "MET" if requirement_met else "NOT MET"
+            print(f"  required verdict: {args.require_verdict} ({status})")
+    return OK if requirement_met else REFUSED
 
 
 if __name__ == "__main__":

package/tools/outcome-canary-receipt-verify.py

@@ -160,6 +160,7 @@ def main(argv=None):
     parser.add_argument("observations")
     parser.add_argument("receipt")
     parser.add_argument("--enable-verification", action="store_true")
+    parser.add_argument("--require-verdict", choices=("PROMOTE", "HOLD", "ROLLBACK"))
     parser.add_argument("--json", action="store_true")
     args = parser.parse_args(argv)
     for path in (args.report, args.observations, args.receipt):
@@ -169,14 +170,28 @@ def main(argv=None):
     result = verify_receipt(
         args.report, args.observations, args.receipt, args.enable_verification
     )
+    requirement_met = (
+        result["status"] == "VERIFIED"
+        and (args.require_verdict is None or result["verdict"] == args.require_verdict)
+    )
     if args.json:
-        print(json.dumps(result, sort_keys=True))
+        output = result
+        if args.require_verdict is not None:
+            output = {
+                **result,
+                "required_verdict": args.require_verdict,
+                "requirement_met": requirement_met,
+            }
+        print(json.dumps(output, sort_keys=True))
     elif result["status"] == "VERIFIED":
         print(f"Canary decision receipt: VERIFIED ({result['verdict']})")
         print(f"  sha256={result['receipt_sha256']}")
+        if args.require_verdict is not None:
+            status = "MET" if requirement_met else "NOT MET"
+            print(f"  required verdict: {args.require_verdict} ({status})")
     else:
         print(f"Canary decision receipt: REFUSED ({result['refusal_reason']})")
-    return OK if result["status"] == "VERIFIED" else REFUSED
+    return OK if requirement_met else REFUSED
 
 
 if __name__ == "__main__":

package/tools/outcome-canary-receipt.py

@@ -13,6 +13,7 @@ import tempfile
 OK, REFUSED, USAGE, NO_INPUT = 0, 3, 64, 66
 DOMAIN = "loki-outcome-canary-decision-receipt/v1"
 MAX_BYTES = 5 * 1024 * 1024
+VERDICTS = {"PROMOTE", "HOLD", "ROLLBACK"}
 
 
 class Parser(argparse.ArgumentParser):
@@ -106,7 +107,8 @@ def _publish_create_only(path, payload):
 
 def create_receipt(report_path, observations_path, receipt_path, control_route,
                    canary_percent=10.0, max_risk=.25, min_samples=5,
-                   min_lift_bps=1, enable_receipt=False):
+                   min_lift_bps=1, enable_receipt=False,
+                   require_verdict=None):
     """Reverify a decision and publish one immutable portable receipt."""
     result = {
         "receipt": DOMAIN,
@@ -118,6 +120,14 @@ def create_receipt(report_path, observations_path, receipt_path, control_route,
     if not enable_receipt:
         result["refusal_reason"] = "receipt_not_enabled"
         return result
+    if require_verdict is not None:
+        result.update({
+            "required_verdict": require_verdict,
+            "requirement_met": False,
+        })
+        if require_verdict not in VERDICTS:
+            result["refusal_reason"] = "required_verdict_invalid"
+            return result
     try:
         _target_is_absent(receipt_path)
         evaluator = _load_tool(
@@ -127,11 +137,11 @@ def create_receipt(report_path, observations_path, receipt_path, control_route,
             report_path, observations_path, control_route, canary_percent,
             max_risk, min_samples, min_lift_bps, True,
         )
-        if decision.get("refusal_reasons") or decision.get("verdict") not in {
-            "PROMOTE", "HOLD", "ROLLBACK"
-        }:
+        if decision.get("refusal_reasons") or decision.get("verdict") not in VERDICTS:
             result["refusal_reason"] = "evaluation_refused"
             return result
+        if require_verdict is not None:
+            result["verdict"] = decision["verdict"]
 
         report_bytes = _read_named_regular(report_path)
         observations_bytes = _read_named_regular(observations_path)
@@ -149,6 +159,9 @@ def create_receipt(report_path, observations_path, receipt_path, control_route,
         if _sha256(source_bytes) != decision["source_sha256"]:
             result["refusal_reason"] = "source_unsafe_or_drifted"
             return result
+        if require_verdict is not None and decision["verdict"] != require_verdict:
+            result["refusal_reason"] = "verdict_mismatch"
+            return result
 
         receipt = {
             "receipt": DOMAIN,
@@ -184,6 +197,8 @@ def create_receipt(report_path, observations_path, receipt_path, control_route,
             "verdict": decision["verdict"],
             "receipt_sha256": _sha256(payload),
         })
+        if require_verdict is not None:
+            result["requirement_met"] = True
     except FileNotFoundError:
         result["refusal_reason"] = "input_missing"
     except (OSError, ValueError, json.JSONDecodeError, UnicodeDecodeError) as exc:
@@ -210,6 +225,7 @@ def main(argv=None):
     parser.add_argument("--max-risk", type=float, default=.25)
     parser.add_argument("--min-samples", type=int, default=5)
     parser.add_argument("--min-lift-bps", type=int, default=1)
+    parser.add_argument("--require-verdict", choices=("PROMOTE", "HOLD", "ROLLBACK"))
     parser.add_argument("--json", action="store_true")
     args = parser.parse_args(argv)
     for path in (args.report, args.observations):
@@ -219,15 +235,20 @@ def main(argv=None):
     result = create_receipt(
         args.report, args.observations, args.receipt, args.control_route,
         args.canary_percent, args.max_risk, args.min_samples,
-        args.min_lift_bps, args.enable_receipt,
+        args.min_lift_bps, args.enable_receipt, args.require_verdict,
     )
     if args.json:
         print(json.dumps(result, sort_keys=True))
     elif result["status"] == "RECORDED":
         print(f"Canary decision receipt: RECORDED ({result['verdict']})")
         print(f"  sha256={result['receipt_sha256']}")
+        if args.require_verdict is not None:
+            print(f"  required verdict: {args.require_verdict} (MET)")
     else:
         print(f"Canary decision receipt: REFUSED ({result['refusal_reason']})")
+        if args.require_verdict is not None and result["verdict"] is not None:
+            print(f"  actual verdict: {result['verdict']}")
+            print(f"  required verdict: {args.require_verdict} (NOT MET)")
     return OK if result["status"] == "RECORDED" else REFUSED
 
 

package/web-app/server.py

@@ -2668,14 +2668,17 @@ async def start_session(req: StartRequest) -> JSONResponse:
             if req.provider:
                 build_env["LOKI_PROVIDER"] = req.provider
 
+            # LOKI_CLI is a trusted fixed path; request data stays in an argv
+            # vector and is never parsed as shell command text.
             proc = subprocess.Popen(
-                cmd,
+                cmd,  # lgtm[py/command-line-injection]
                 stdout=subprocess.PIPE,
                 stderr=subprocess.STDOUT,
                 stdin=subprocess.DEVNULL,
                 text=True,
                 cwd=project_dir,
                 env=build_env,
+                shell=False,
                 **({"start_new_session": True} if sys.platform != "win32"
                    else {"creationflags": subprocess.CREATE_NEW_PROCESS_GROUP}),
             )
@@ -4253,8 +4256,10 @@ async def chat_session(session_id: str, req: ChatRequest) -> JSONResponse:
             chat_env.update(_load_secrets())
             # Pass provider via env for quick mode (loki quick uses LOKI_PROVIDER env)
             chat_env["LOKI_PROVIDER"] = chat_provider
+            # loki is resolved from the trusted application install; message,
+            # provider, and PRD path remain argv data with no command shell.
             proc = subprocess.Popen(
-                cmd_args,
+                cmd_args,  # lgtm[py/command-line-injection]
                 stdout=subprocess.PIPE,
                 stderr=subprocess.STDOUT,
                 stdin=subprocess.DEVNULL,
@@ -4262,6 +4267,7 @@ async def chat_session(session_id: str, req: ChatRequest) -> JSONResponse:
                 cwd=str(target),
                 env=chat_env,
                 start_new_session=True,
+                shell=False,
             )
             task.process = proc
             _track_child_pid(proc.pid)