loki-mode 9.22.3 → 9.22.5

package/README.md

@@ -51,6 +51,63 @@ That is the whole happy path. It asks for a one-line idea, picks a template,
 shows the real cost and time estimate before spending anything, then builds.
 Press Enter through every step and you get a sample Todo app.
 
+One command, no prompts (CI, scripts, containers, any shell without a terminal):
+
+```bash
+loki quickstart "a todo app with user accounts" --yes
+```
+
+Both halves are required with no terminal: an idea (or a path to a PRD file)
+and an explicit `--yes`. Given both, Loki picks the top-ranked template
+automatically, prints the same honest cost and time estimate, and starts the
+build without asking anything. Missing either half exits 2 with the
+needs-a-terminal message and writes nothing, so an ambient `LOKI_AUTO_CONFIRM`
+or a stray argument in CI can never start a paid build on its own. Existing
+files are never overwritten: if `prd.md` is present the PRD lands at
+`prd-quickstart.md`, then numbered suffixes as needed.
+
+Choose an exact shipped starter when the top-ranked match is not the one you
+want:
+
+```bash
+loki quickstart --list-templates
+loki quickstart --list-templates --json       # schema-v1 automation output
+loki quickstart "an internal reporting workspace" --template dashboard --yes
+```
+
+Template discovery works without a terminal or provider and lists every shipped
+starter's stable name and purpose in catalog order. It returns before estimation,
+consent, PRD writes, or build execution. Positional input and execution/preview
+flags are intentionally incompatible; `--json` is the only optional modifier.
+
+`--template` accepts an exact template name for idea inputs and works the same
+way with interactive use or `--dry-run` (including JSON preview). Unknown
+templates, duplicate flags, and combinations with a PRD path refuse before
+provider discovery, estimation, writes, or build execution.
+
+Preview the same deterministic template choice and estimator-backed plan with
+zero writes or execution:
+
+```bash
+loki quickstart "a todo app with user accounts" --dry-run
+```
+
+Preview requires an idea or readable PRD path, works without a terminal or AI
+provider, and exits before creating a PRD or starting a build. `--dry-run` and
+`--yes` are mutually exclusive so execution intent is never ambiguous.
+
+For scripts and local dashboards, add `--json` to receive one versioned JSON
+object instead of terminal text:
+
+```bash
+loki quickstart "a todo app with user accounts" --dry-run --json
+```
+
+The object contains the input kind, deterministic selected template (or `null`
+for an existing PRD), and the exact estimator response under `plan`. `--json`
+requires `--dry-run`; invalid input or estimator failure writes no JSON, and the
+command still exits before provider discovery, file writes, or build execution.
+
 Or go straight at it:
 
 ```bash

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.22.3
+# Loki Mode v9.22.5
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.22.3 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.22.5 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.22.3
+9.22.5

package/autonomy/loki

@@ -35298,6 +35298,9 @@ cmd_proof() {
             echo "  show <id>            Pretty-print .loki/proofs/<id>/proof.json"
             echo "  verify <id>          Re-check a receipt against the repo (tamper + drift);"
             echo "                       exit 0 clean, 1 tamper/drift. Verify it yourself."
+            echo "  passport <contract> <id|proof.json> <output.json>"
+            echo "                       Bind work from any agent to a portable Outcome Contract"
+            echo "                       and independently rechecked Evidence Receipt"
             echo ""
             echo "Options for 'verify':"
             echo "  --human              Render the verdict and every failure reason as prose"
@@ -35474,6 +35477,47 @@ PYEOF
             fi
             exit 0
             ;;
+        passport)
+            # EXEC-PROOF-01: make the provider-neutral Proof Passport reachable
+            # from the installed product. The Python implementation already
+            # binds the executor/verifier identities, exact contract digest,
+            # exact receipt bytes, and independently re-derived verdict. Before
+            # this subcommand, users had to know the repository-only tools/
+            # path, so the portable proof workflow was not actually a product
+            # workflow for npm consumers.
+            #
+            # The second positional accepts either a local proof id or an
+            # explicit receipt path. That lets a Loki run use its short id while
+            # Codex, Claude Code, Cursor, Factory, or any other executor can hand
+            # over a provider-neutral proof.json without copying it into .loki.
+            local contract="${1:-}"
+            local receipt_ref="${2:-}"
+            local output="${3:-}"
+            if [ -z "$contract" ] || [ -z "$receipt_ref" ] || [ -z "$output" ]; then
+                echo -e "${RED}Usage: loki proof passport <contract.json> <proof-id|proof.json> <output.json> [options]${NC}" >&2
+                echo "Options: --repo-dir DIR --markdown-output FILE --force" >&2
+                exit 64
+            fi
+            shift 3
+
+            local receipt_path="$receipt_ref"
+            if [ ! -f "$receipt_path" ]; then
+                receipt_path="${proofs_dir}/${receipt_ref}/proof.json"
+            fi
+            if [ ! -f "$receipt_path" ]; then
+                echo -e "${RED}Receipt not found: ${receipt_ref}${NC}" >&2
+                echo "Pass a proof id from 'loki proof list' or a path to proof.json." >&2
+                exit 2
+            fi
+
+            local passport_tool="${SKILL_DIR}/tools/proof-passport.py"
+            if [ ! -f "$passport_tool" ]; then
+                echo -e "${RED}Proof Passport tool not found: ${passport_tool}${NC}" >&2
+                exit 3
+            fi
+            python3 "$passport_tool" "$contract" "$receipt_path" "$output" "$@"
+            exit $?
+            ;;
         md)
             # Paste-able Markdown for a PR comment, a Slack message, or a
             # ticket. The renderer already existed -- render_evidence_receipt_md

package/autonomy/quickstart.sh

@@ -283,6 +283,85 @@ _qs_template_summary() {
     esac
 }
 
+# _qs_shipped_template_names: print every shipped template basename in stable
+# catalog order. The filesystem is the source of truth: adding or removing a
+# templates/*.md payload changes discovery automatically, while README.md is
+# deliberately excluded because it is gallery documentation, not a PRD.
+_qs_shipped_template_names() {
+    local tdir; tdir="$(_qs_templates_dir)"
+    local f name
+    for f in "$tdir"/*.md; do
+        [ -f "$f" ] || continue
+        name=$(basename "$f" .md)
+        [ "$name" = "README" ] && continue
+        printf '%s\n' "$name"
+    done | LC_ALL=C sort
+}
+
+# _qs_list_templates [json]: provider-free discovery for terminals and local
+# automation. Human and machine output are derived from the same shipped-name
+# stream and the same stable purpose table used by the interactive picker.
+_qs_list_templates() {
+    local json_output="${1:-false}"
+    local catalog="" count=0 name purpose
+    while IFS= read -r name; do
+        [ -n "$name" ] || continue
+        purpose="$(_qs_template_summary "$name")"
+        catalog="${catalog}${name}\t${purpose}\n"
+        count=$((count + 1))
+    done < <(_qs_shipped_template_names)
+
+    if [ "$count" -eq 0 ]; then
+        printf 'No shipped quickstart templates were found.\n' >&2
+        return 2
+    fi
+
+    if [ "$json_output" = true ]; then
+        printf '%b' "$catalog" | python3 -c '
+import json
+import sys
+
+templates = []
+for raw in sys.stdin:
+    name, purpose = raw.rstrip("\n").split("\t", 1)
+    templates.append({"name": name, "purpose": purpose})
+json.dump(
+    {
+        "schema_version": 1,
+        "command": "loki quickstart",
+        "mode": "list-templates",
+        "templates": templates,
+    },
+    sys.stdout,
+    separators=(",", ":"),
+    sort_keys=True,
+)
+sys.stdout.write("\n")
+' || return 2
+        return 0
+    fi
+
+    printf '%sShipped quickstart templates (%d)%s\n' "$_QS_BOLD" "$count" "$_QS_NC"
+    printf '%b' "$catalog" | while IFS=$'\t' read -r name purpose; do
+        [ -n "$name" ] || continue
+        printf '  %-20s %s\n' "$name" "$purpose"
+    done
+    return 0
+}
+
+# _qs_template_exists <name>: accept only an exact shipped template basename.
+# Keeping validation here (rather than accepting an arbitrary path) prevents
+# --template from becoming a second PRD/file-read surface. The intentionally
+# narrow character set also makes names safe to join below without traversal.
+_qs_template_exists() {
+    local name="${1:-}"
+    case "$name" in
+        ""|*[!a-z0-9-]*) return 1;;
+    esac
+    [ "$name" != "README" ] || return 1
+    [ -f "$(_qs_templates_dir)/$name.md" ]
+}
+
 # _qs_selected_provider: print the provider a build would ACTUALLY pick, or
 # nothing. Single source of truth is providers/loader.sh auto_detect_provider --
 # the same seam render_provider_availability (provider-offer.sh:395) uses, and
@@ -327,7 +406,7 @@ _qs_selected_provider() {
 # non-zero if the estimator gave no result (caller falls back to a no-number
 # confirm, never fabricating a figure).
 _qs_emit_plan() {
-    local prd_path="$1" template_name="$2"
+    local prd_path="$1" template_name="$2" json_output="${3:-false}" input_kind="${4:-idea}"
     local plan_json=""
     plan_json=$(show_prd_plan "$prd_path" "true" "false" 2>/dev/null) || plan_json=""
     if [ -z "$plan_json" ]; then
@@ -358,6 +437,32 @@ print('{}{}'.format(iters, rng_str))
     if [ -z "$parsed" ]; then
         return 1
     fi
+
+    if [ "$json_output" = true ]; then
+        local json_payload=""
+        json_payload=$(printf '%s' "$plan_json" | python3 -c '
+import json
+import sys
+
+plan = json.load(sys.stdin)
+if not isinstance(plan, dict):
+    sys.exit(1)
+template_name, input_kind = sys.argv[1:3]
+payload = {
+    "schema_version": 1,
+    "command": "loki quickstart",
+    "mode": "dry-run",
+    "input_kind": input_kind,
+    "selected_template": template_name if input_kind == "idea" else None,
+    "source_name": template_name if input_kind == "prd" else None,
+    "plan": plan,
+}
+json.dump(payload, sys.stdout, separators=(",", ":"), sort_keys=True)
+' "$template_name" "$input_kind" 2>/dev/null) || json_payload=""
+        [ -n "$json_payload" ] || return 1
+        printf '%s\n' "$json_payload" >&3
+        return 0
+    fi
     local tier_u cost_u time_u iter_u
     tier_u=$(printf '%s' "$parsed" | sed -n '1p')
     cost_u=$(printf '%s' "$parsed" | sed -n '2p')
@@ -391,16 +496,34 @@ _qs_help() {
     printf '\n'
     printf 'Options:\n'
     printf '  --yes, -y     Auto-confirm the final build prompt (still shows the plan)\n'
+    printf '  --dry-run     Preview the selected template and plan; write/start nothing\n'
+    printf '  --json        With --dry-run, emit one machine-readable JSON object\n'
+    printf '  --template N  Use the exact shipped template N for an IDEA\n'
+    printf '  --list-templates  List every shipped template and its purpose\n'
     printf '  --help, -h    Show this help and exit\n'
     printf '\n'
+    printf 'Non-interactive use:\n'
+    printf '  loki quickstart "a todo app with user accounts" --yes\n'
+    printf '  Both an IDEA (or PRD path) and --yes are required with no terminal.\n'
+    printf '  Missing either one exits 2 and writes nothing. The top-ranked\n'
+    printf '  template is chosen automatically and the plan is still shown.\n'
+    printf '  Add --template NAME to choose a shipped template instead.\n'
+    printf '  Run with --list-templates (and optional --json) to discover names.\n'
+    printf '\n'
+    printf 'Zero-spend preview:\n'
+    printf '  loki quickstart "a todo app" --dry-run\n'
+    printf '  An IDEA (or readable PRD path) is required. No provider is checked,\n'
+    printf '  no file is written, and no build is started. Do not combine with --yes.\n'
+    printf '  Add --json for versioned JSON only; --json requires --dry-run.\n'
+    printf '\n'
     printf 'Steps:\n'
-    printf '  1. Setup      Check for an AI provider; offer to install if missing\n'
+    printf '  1. Setup      Check for an AI provider for execution (skipped in preview)\n'
     printf '  2. Build      Describe what you want, or Enter for the sample Todo app\n'
     printf '  3. Template   Pick the closest starting template (offline keyword match)\n'
     printf '  4. Plan       Review the honest cost/time estimate, then confirm\n'
     printf '\n'
-    printf 'The PRD is written to ./prd.md in the current directory, then the build\n'
-    printf 'starts. For non-interactive automation use: loki start <prd> --yes\n'
+    printf 'The PRD is written to ./prd.md in the current directory (or the next\n'
+    printf 'free prd-quickstart*.md name if that exists), then the build starts.\n'
     return 0
 }
 
@@ -408,14 +531,38 @@ _qs_help() {
 # (slice B), show_prd_plan (slice A), the template matcher, and cmd_start.
 #
 # Order is load-bearing:
-#   --help (exit 0) -> non-TTY/CI gate (hint + exit 2) -> provider gate ->
+#   argv validation -> non-TTY/CI gate (hint + exit 2) -> provider gate or skip ->
 #   step 2 (idea / PRD path) -> step 3 (template) -> step 4 (plan + confirm) ->
 #   write PRD to CWD -> cmd_start --yes --no-plan (subshelled; it execs the runner).
+#
+# The non-TTY/CI gate admits two fully-specified shapes:
+#   loki quickstart "<idea>|<prd-path>" --yes
+#   loki quickstart "<idea>|<prd-path>" --dry-run
+# Execution requires argv consent; preview forbids it. Both paths skip prompts
+# and share template ranking plus the honest estimator. Only execution crosses
+# the provider, confirm, write, and cmd_start boundaries.
 cmd_quickstart() {
     local positional=""
     local assume_yes=false
+    local dry_run=false
+    local json_output=false
+    local template_override=""
+    local template_flag_seen=false
+    local list_templates=false
+    local list_templates_flag_seen=false
     if _qs_assume_yes; then assume_yes=true; fi
 
+    # yes_flag tracks EXPLICIT --yes/-y on THIS command's argv, and nothing else.
+    # It is deliberately NOT assume_yes: _qs_assume_yes also returns true for an
+    # ambient LOKI_ASSUME_YES or LOKI_AUTO_CONFIRM=true, and LOKI_AUTO_CONFIRM is
+    # exactly what `loki --yes <anything>` (loki:2313) and CI-ish environments
+    # export. Gating the non-interactive bypass on assume_yes would let an
+    # ambient env var plus a stray positional silently start a PAID build in CI
+    # with no human in the loop. The safety contract asks for explicit consent,
+    # so consent must come from argv. assume_yes keeps its existing meaning for
+    # the confirm prompt, so the interactive journey is byte-identical.
+    local yes_flag=false
+
     while [ $# -gt 0 ]; do
         case "$1" in
             --help|-h)
@@ -424,6 +571,37 @@ cmd_quickstart() {
                 ;;
             --yes|-y)
                 assume_yes=true
+                yes_flag=true
+                shift
+                ;;
+            --dry-run)
+                dry_run=true
+                shift
+                ;;
+            --json)
+                json_output=true
+                shift
+                ;;
+            --template)
+                if [ "$template_flag_seen" = true ]; then
+                    printf '%s--template may be specified only once.%s\n' "$_QS_RED" "$_QS_NC" >&2
+                    exit 2
+                fi
+                template_flag_seen=true
+                if [ $# -lt 2 ] || [ -z "${2:-}" ] || [[ "${2:-}" == --* ]]; then
+                    printf '%s--template requires an exact shipped template name.%s\n' "$_QS_RED" "$_QS_NC" >&2
+                    exit 2
+                fi
+                template_override="$2"
+                shift 2
+                ;;
+            --list-templates)
+                if [ "$list_templates_flag_seen" = true ]; then
+                    printf '%s--list-templates may be specified only once.%s\n' "$_QS_RED" "$_QS_NC" >&2
+                    exit 2
+                fi
+                list_templates=true
+                list_templates_flag_seen=true
                 shift
                 ;;
             --*)
@@ -444,36 +622,146 @@ cmd_quickstart() {
         esac
     done
 
-    # Non-TTY / CI: quickstart is interactive by definition. Never hang on read;
-    # print the automation hint to stderr and exit 2 (design 3.8).
-    if _qs_non_interactive; then
-        printf 'loki quickstart is interactive and needs a terminal. For automation use: loki start <prd> --yes\n' >&2
+    # Discovery is a standalone read-only command shape. Refuse input and every
+    # execution/preview selector rather than guessing intent; --json is its only
+    # compatible modifier. This return precedes terminal, provider, estimator,
+    # consent, PRD, and build boundaries.
+    if [ "$list_templates" = true ]; then
+        if [ -n "$positional" ] || [ "$yes_flag" = true ] || [ "$dry_run" = true ] || [ "$template_flag_seen" = true ]; then
+            printf '%s--list-templates accepts only the optional --json flag.%s\n' "$_QS_RED" "$_QS_NC" >&2
+            exit 2
+        fi
+        _qs_list_templates "$json_output"
+        return $?
+    fi
+
+    # A preview is an explicit no-execution request. Reject simultaneous build
+    # consent instead of guessing which instruction wins. This check precedes
+    # provider discovery, estimation, and every write.
+    if [ "$dry_run" = true ] && [ "$yes_flag" = true ]; then
+        printf '%s--dry-run cannot be combined with --yes or -y.%s\n' "$_QS_RED" "$_QS_NC" >&2
         exit 2
     fi
 
+    if [ "$json_output" = true ] && [ "$dry_run" != true ]; then
+        printf '%s--json requires --dry-run.%s\n' "$_QS_RED" "$_QS_NC" >&2
+        exit 2
+    fi
+
+    # Explicit template selection is deliberately an IDEA-only surface. It is
+    # validated before provider discovery, estimation, and every write/build
+    # boundary so a typo or conflicting PRD can never fall through to spend.
+    if [ "$template_flag_seen" = true ]; then
+        if [ -z "$positional" ]; then
+            printf '%s--template requires an IDEA argument.%s\n' "$_QS_RED" "$_QS_NC" >&2
+            exit 2
+        fi
+        case "$positional" in
+            */*|*.md|*.markdown|*.txt|*.json|*.yaml|*.yml)
+                printf '%s--template cannot be combined with a PRD path.%s\n' "$_QS_RED" "$_QS_NC" >&2
+                exit 2
+                ;;
+        esac
+        if [ -f "$positional" ]; then
+            printf '%s--template cannot be combined with a PRD path.%s\n' "$_QS_RED" "$_QS_NC" >&2
+            exit 2
+        fi
+        if ! _qs_template_exists "$template_override"; then
+            printf '%sUnknown shipped template: %s%s\n' "$_QS_RED" "$template_override" "$_QS_NC" >&2
+            exit 2
+        fi
+    fi
+
+    # Preview is deliberately non-interactive: without an explicit idea or PRD
+    # path there is nothing deterministic to estimate. A path-looking argument
+    # must resolve to a readable regular file; otherwise treating a typo such as
+    # ./prd.md as prose would preview an unrelated template and mislead the user.
+    if [ "$dry_run" = true ]; then
+        if [ -z "$positional" ]; then
+            printf 'loki quickstart --dry-run requires an IDEA or readable PRD path.\n' >&2
+            exit 2
+        fi
+        case "$positional" in
+            */*|*.md|*.markdown|*.txt|*.json|*.yaml|*.yml)
+                if [ ! -f "$positional" ] || [ ! -r "$positional" ]; then
+                    printf 'PRD path is not a readable file: %s\n' "$positional" >&2
+                    exit 2
+                fi
+                ;;
+        esac
+    fi
+
+    # Non-TTY / CI: quickstart is interactive by definition, so by default it
+    # never hangs on a read -- it prints the automation hint to stderr and exits
+    # 2 (design 3.8).
+    #
+    # The execution exception is a fully-specified invocation:
+    #   loki quickstart "<idea>" --yes      (or a PRD path in place of the idea)
+    # Both halves are required. A non-empty positional supplies the input that
+    # steps 2-3 would otherwise have to ask for, and an explicit argv --yes
+    # supplies the consent step 4 would otherwise have to ask for. With both
+    # present there is nothing left to prompt about, so the refusal is pure
+    # friction for a newly installed operator running one command.
+    #
+    # Missing EITHER half keeps the refusal verbatim and writes nothing: a bare
+    # `loki quickstart` in CI still cannot spend, and neither can one that has an
+    # idea but no consent. Fail-closed is the load-bearing direction here -- the
+    # bypass must be something an operator opts into by typing both, never
+    # something an environment can arrive at on its own.
+    local noninteractive_ok=false
+    if _qs_non_interactive; then
+        if [ "$dry_run" = true ] || { [ -n "$positional" ] && [ "$yes_flag" = true ]; }; then
+            noninteractive_ok=true
+        else
+            printf 'loki quickstart is interactive and needs a terminal. For automation use: loki start <prd> --yes\n' >&2
+            exit 2
+        fi
+    fi
+
+    # Machine-readable preview follows the exact same selection and estimator
+    # path as the human preview. Suppress presentation stdout while retaining a
+    # duplicate of the caller's stdout on fd 3; _qs_emit_plan writes the single
+    # validated JSON object there only after estimation succeeds. Stderr stays
+    # available for fail-closed diagnostics.
+    local json_stdout_redirected=false
+    if [ "$json_output" = true ]; then
+        exec 3>&1 1>/dev/null
+        json_stdout_redirected=true
+    fi
+
     printf '\n'
-    printf '%sLoki Mode quickstart -- four quick questions, then your build starts.%s\n' "$_QS_BOLD" "$_QS_NC"
+    if [ "$dry_run" = true ]; then
+        printf '%sLoki Mode quickstart preview -- template and plan only.%s\n' "$_QS_BOLD" "$_QS_NC"
+    else
+        printf '%sLoki Mode quickstart -- four quick questions, then your build starts.%s\n' "$_QS_BOLD" "$_QS_NC"
+    fi
     printf '\n'
 
     # ----- Step 1 of 4: Setup (reuse the slice-B provider offer) -------------
     printf '%sStep 1 of 4: Setup%s\n' "$_QS_BOLD" "$_QS_NC"
-    printf '  Checking for an AI provider CLI ...\n'
+    if [ "$dry_run" = true ]; then
+        # Estimation and deterministic template selection are local. Previewing
+        # must work before provider installation and must not run provider code.
+        printf '  Preview mode: provider check skipped; no build will start.\n'
+    else
+        printf '  Checking for an AI provider CLI ...\n'
     # Ask the loader FIRST: it is the only thing that knows what the runner will
     # really pick, and it is the only check that sees opencode. Falling back to
     # detect_any_provider (stale four, PATH-only) keeps the no-provider guard
     # intact when the loader is absent or unreadable.
-    local found=""
-    found="$(_qs_selected_provider)" || found=""
-    if [ -n "$found" ]; then
-        printf '  Found: %s. Good.\n' "$found"
-    elif detect_any_provider; then
-        printf '  Found: an AI provider CLI. Good.\n'
-    else
-        # Run the inline install + login offer. provider_offer_gate returns 2 if
-        # no provider ends up available (declined, or install failed).
-        if ! provider_offer_gate; then
-            printf '%sNo provider available; cannot start a build. Install one and re-run loki quickstart.%s\n' "$_QS_RED" "$_QS_NC" >&2
-            exit 2
+        local found=""
+        found="$(_qs_selected_provider)" || found=""
+        if [ -n "$found" ]; then
+            printf '  Found: %s. Good.\n' "$found"
+        elif detect_any_provider; then
+            printf '  Found: an AI provider CLI. Good.\n'
+        else
+            # Run the inline install + login offer. provider_offer_gate returns 2 if
+            # no provider ends up available (declined, or install failed).
+            if ! provider_offer_gate; then
+                printf '%sNo provider available; cannot start a build. Install one and re-run loki quickstart.%s\n' "$_QS_RED" "$_QS_NC" >&2
+                exit 2
+            fi
         fi
     fi
     printf '\n'
@@ -484,27 +772,34 @@ cmd_quickstart() {
     local prd_source=""        # an existing PRD file path, when the user has one
     local brief=""             # the one-line idea (drives template matching)
     local template_name=""
+    local input_kind="idea"
 
     if [ -n "$positional" ] && [ -f "$positional" ]; then
         prd_source="$positional"
+        input_kind="prd"
         printf '%sUsing your PRD: %s%s\n' "$_QS_DIM" "$positional" "$_QS_NC"
         printf '\n'
     else
         printf '%sStep 2 of 4: What do you want to build?%s\n' "$_QS_BOLD" "$_QS_NC"
-        printf '  Describe it in one line, or paste a path to a PRD file.\n'
-        printf '  (Press Enter to build the sample Todo app.)\n'
-        if [ -n "$positional" ]; then
+        if [ "$dry_run" = true ]; then
             brief="$positional"
-            printf '> %s\n' "$brief"
+            printf '  Previewing idea: %s\n' "$brief"
         else
-            local answer=""
-            printf '> '
-            read -r answer 2>/dev/null || answer=""
-            # If the typed value is an existing file, treat it as a PRD path.
-            if [ -n "$answer" ] && [ -f "$answer" ]; then
-                prd_source="$answer"
+            printf '  Describe it in one line, or paste a path to a PRD file.\n'
+            printf '  (Press Enter to build the sample Todo app.)\n'
+            if [ -n "$positional" ]; then
+                brief="$positional"
+                printf '> %s\n' "$brief"
             else
-                brief="$answer"
+                local answer=""
+                printf '> '
+                read -r answer 2>/dev/null || answer=""
+                # If the typed value is an existing file, treat it as a PRD path.
+                if [ -n "$answer" ] && [ -f "$answer" ]; then
+                    prd_source="$answer"
+                else
+                    brief="$answer"
+                fi
             fi
         fi
         printf '\n'
@@ -512,6 +807,11 @@ cmd_quickstart() {
 
     # ----- Step 3 of 4: Pick a template (skipped if a PRD path was given) ----
     if [ -z "$prd_source" ]; then
+        if [ -n "$template_override" ]; then
+            template_name="$template_override"
+            printf '%sStep 3 of 4: Template%s\n' "$_QS_BOLD" "$_QS_NC"
+            printf '  Selected %s (--template).\n\n' "$template_name"
+        else
         local -a top3=()
         local line
         while IFS= read -r line; do
@@ -523,25 +823,40 @@ cmd_quickstart() {
             top3=("simple-todo-app")
         fi
 
-        printf '%sStep 3 of 4: Pick a starting template%s\n' "$_QS_BOLD" "$_QS_NC"
-        if [ -n "$brief" ]; then
-            printf '  Closest matches for "%s":\n' "$brief"
+        # The MENU, not just the read, is interactive-only. Offering "Choose 1-3"
+        # to a shell that can never answer is a prompt the operator has to read
+        # and mistrust; worse, it makes a transcript indistinguishable from one
+        # that actually stopped for input. The ranking above is shared by both
+        # paths -- only its presentation differs.
+        local pick=""
+        if [ "$noninteractive_ok" != true ]; then
+            printf '%sStep 3 of 4: Pick a starting template%s\n' "$_QS_BOLD" "$_QS_NC"
+            if [ -n "$brief" ]; then
+                printf '  Closest matches for "%s":\n' "$brief"
+            else
+                printf '  Closest matches for the sample Todo app:\n'
+            fi
+            local i=1 t suffix
+            for t in "${top3[@]}"; do
+                suffix=""
+                [ "$i" -eq 1 ] && suffix="   (default)"
+                printf '    %d) %-18s %s%s\n' "$i" "$t" "$(_qs_template_summary "$t")" "$suffix"
+                i=$((i + 1))
+            done
+            printf '  Choose 1-%d, or press Enter for 1.\n' "${#top3[@]}"
+            printf '> '
+            read -r pick 2>/dev/null || pick=""
+            printf '\n'
         else
-            printf '  Closest matches for the sample Todo app:\n'
+            # Deterministic selection: the empty pick below resolves to top3[0],
+            # the same rank the interactive picker offers as "(default)". The
+            # ranking itself is unchanged -- _qs_score_templates is offline,
+            # deterministic and already the single source of order -- so the
+            # non-interactive choice is exactly the one an operator pressing
+            # Enter would get. No picker, no prompt, no second code path.
+            printf '%sStep 3 of 4: Template%s\n' "$_QS_BOLD" "$_QS_NC"
+            printf '  Selected %s (top match) for "%s".\n\n' "${top3[0]}" "$brief"
         fi
-        local i=1 t suffix
-        for t in "${top3[@]}"; do
-            suffix=""
-            [ "$i" -eq 1 ] && suffix="   (default)"
-            printf '    %d) %-18s %s%s\n' "$i" "$t" "$(_qs_template_summary "$t")" "$suffix"
-            i=$((i + 1))
-        done
-        printf '  Choose 1-%d, or press Enter for 1.\n' "${#top3[@]}"
-
-        local pick=""
-        printf '> '
-        read -r pick 2>/dev/null || pick=""
-        printf '\n'
 
         case "$pick" in
             ""|1) template_name="${top3[0]}";;
@@ -550,6 +865,8 @@ cmd_quickstart() {
             *) template_name="${top3[0]}";;  # any unexpected input -> the default
         esac
 
+        fi
+
         local tdir; tdir="$(_qs_templates_dir)"
         prd_source="$tdir/$template_name.md"
         if [ ! -f "$prd_source" ]; then
@@ -562,11 +879,41 @@ cmd_quickstart() {
 
     # ----- Step 4 of 4: Review the plan (reuse the slice-A estimator) --------
     printf '%sStep 4 of 4: Review the plan%s\n' "$_QS_BOLD" "$_QS_NC"
+    # The plan is ALWAYS rendered, on both paths, from the same real estimator.
+    # The non-interactive path shows it before execution rather than before a
+    # prompt: the operator still gets the honest quote in the transcript, and it
+    # is still the figure cmd_start runs with, so the quote equals the charge.
     local estimate_ok=true
-    if ! _qs_emit_plan "$prd_source" "$template_name"; then
+    if ! _qs_emit_plan "$prd_source" "$template_name" "$json_output" "$input_kind"; then
         estimate_ok=false
-        printf '%sCould not compute a cost estimate (the estimator did not return a result).%s\n' "$_QS_YELLOW" "$_QS_NC"
-        printf '\n'
+        # No honest number available. Interactively this flips the confirm to
+        # default-NO below. Non-interactively there is no one to review the
+        # missing plan, so fail closed before writing a PRD or starting a build.
+        # Explicit --yes authorizes the displayed estimate; it is not consent
+        # to spend without one.
+        if [ "$noninteractive_ok" = true ]; then
+            if [ "$json_stdout_redirected" = true ]; then
+                exec 1>&3 3>&-
+                json_stdout_redirected=false
+            fi
+            printf 'Could not compute a cost estimate; non-interactive quickstart requires a displayed plan and started no build.\n' >&2
+            return 2
+        else
+            printf '%sCould not compute a cost estimate (the estimator did not return a result).%s\n' "$_QS_YELLOW" "$_QS_NC"
+            printf '\n'
+        fi
+    fi
+
+    # The preview terminal boundary is intentionally immediately after the
+    # shared estimator. Reaching it proves the same template and plan were
+    # rendered, while returning here makes the confirm, PRD copy, and cmd_start
+    # structurally unreachable.
+    if [ "$dry_run" = true ]; then
+        printf 'Preview complete. No provider was run, no file was written, and no build was started.\n'
+        if [ "$json_stdout_redirected" = true ]; then
+            exec 1>&3 3>&-
+        fi
+        return 0
     fi
 
     # ----- Confirm ----------------------------------------------------------
@@ -595,8 +942,16 @@ cmd_quickstart() {
     local target="./prd.md"
     if [ -e "$target" ]; then
         local overwrite=""
-        printf 'prd.md already exists. Overwrite? [y/N] '
-        read -r overwrite 2>/dev/null || overwrite=""
+        # Non-interactive never asks and never overwrites. Leaving $overwrite
+        # empty falls into the existing suffix walk below, which is already the
+        # correct no-clobber behavior -- prd-quickstart.md, then numbered free
+        # suffixes exactly as needed. Reused rather than reimplemented so the two
+        # paths cannot drift, and so "never overwrite" holds by construction
+        # (there is no branch here that can reach the clobber).
+        if [ "$noninteractive_ok" != true ]; then
+            printf 'prd.md already exists. Overwrite? [y/N] '
+            read -r overwrite 2>/dev/null || overwrite=""
+        fi
         if [[ ! "$overwrite" =~ ^[Yy] ]]; then
             # Declining to overwrite one file must never silently destroy
             # another (bug-hunt MEDIUM): the fallback gets the same existence

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.22.3"
+__version__ = "9.22.5"
 
 # Expose the control app for easy import
 try:

package/dashboard/api_releases.py

@@ -133,9 +133,12 @@ def _git_tags(repo_dir: str, limit: int) -> tuple:
         "refs/tags",
     ]
     try:
+        # Fixed git executable, integer-formatted option, separate cwd, and an
+        # argv vector keep caller data out of shell parsing.
         proc = subprocess.run(
-            cmd, cwd=repo_dir, capture_output=True, text=True,
-            timeout=_GIT_TIMEOUT_S,
+            cmd,  # lgtm[py/command-line-injection]
+            cwd=repo_dir, capture_output=True, text=True,
+            timeout=_GIT_TIMEOUT_S, shell=False,
         )
     except FileNotFoundError:
         return [], "git executable not found on PATH"

package/dashboard/control.py

@@ -495,14 +495,17 @@ async def start_session(request: StartRequest):
 
     try:
         # Start the process
+        # RUN_SH is a trusted fixed path; provider and PRD were validated above,
+        # and argv is passed directly without a command shell.
         process = subprocess.Popen(
-            args,
+            args,  # lgtm[py/command-line-injection]
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
             start_new_session=True,
             # A deleted cwd would make Popen itself raise; fall back to the
             # skill tree rather than failing to launch the run at all.
-            cwd=str(_cwd_or_skill_dir())
+            cwd=str(_cwd_or_skill_dir()),
+            shell=False,
         )
 
         # Save provider for status tracking

package/dashboard/server.py

@@ -4313,13 +4313,16 @@ def _start_supervised_workspace_build(
         supervisor_log = _build_execution.execution_dir(execution_id) / "supervisor.log"
         try:
             with _build_execution.open_private_log(supervisor_log) as log_handle:
+                # sys.executable and the module name are fixed; validated build
+                # fields remain argv data and never reach a command shell.
                 process = subprocess.Popen(
-                    supervisor_args,
+                    supervisor_args,  # lgtm[py/command-line-injection]
                     stdout=log_handle,
                     stderr=subprocess.STDOUT,
                     start_new_session=True,
                     cwd=str(skill_dir),
                     env=popen_env,
+                    shell=False,
                 )
         except (OSError, subprocess.SubprocessError) as exc:
             finished_at = _build_execution.utc_now()
@@ -4582,13 +4585,16 @@ async def start_build(request: Request, body: StartBuildRequest):
     args.append("--bg")
     args.append(str(spec_file))
     try:
+        # run_sh is a trusted fixed path; provider and spec were validated, and
+        # the argv vector is executed directly without shell interpretation.
         process = subprocess.Popen(
-            args,
+            args,  # lgtm[py/command-line-injection]
             stdout=subprocess.DEVNULL,
             stderr=subprocess.DEVNULL,
             start_new_session=True,
             cwd=str(project_dir),
             env=popen_env,
+            shell=False,
         )
     except (OSError, subprocess.SubprocessError) as e:
         raise HTTPException(status_code=500, detail=f"Failed to start build: {e}")

package/docs/INSTALLATION.md

@@ -183,6 +183,17 @@ builds the sample Todo app.
 loki quickstart
 ```
 
+For a fully specified first build, provide the idea, an optional exact shipped
+starter template, and explicit consent:
+
+```bash
+loki quickstart "an internal reporting workspace" --template dashboard --yes
+```
+
+Use `--dry-run` instead of `--yes` to preview the same template and plan without
+provider discovery, file writes, or execution; add `--json` for one versioned
+machine-readable object.
+
 Drop a spec -- any artifact that describes what you want built -- and Loki
 Mode takes it from spec to deployed app. Specs can be a markdown PRD, a
 GitHub issue URL, or a YAML feature description.

package/docs/OUTCOME-CANARY-EVALUATION.md

@@ -50,6 +50,19 @@ loki outcomes canary receipt report.json observations.json receipt.json \
   --enable-receipt --control-route safe --canary-percent 10 --min-samples 5
 ```
 
+Automation can require the rederived verdict before the receipt is published:
+
+```bash
+loki outcomes canary receipt report.json observations.json receipt.json \
+  --enable-receipt --control-route safe --canary-percent 10 --min-samples 5 \
+  --require-verdict PROMOTE --json
+```
+
+The target is created only when the actual verdict exactly matches the required
+`PROMOTE`, `HOLD`, or `ROLLBACK` value. A mismatch exits `3`, reports both verdicts
+and `"requirement_met": false`, and leaves the target absent. Omitting
+`--require-verdict` preserves the existing behavior of recording any complete verdict.
+
 The command creates a new canonical `loki-outcome-canary-decision-receipt/v1`
 file. It binds the exact report, source, and observation digests; the full
 evaluation policy; privacy-safe aggregate arm results; the acceptance delta; and

package/docs/PROOF-PASSPORT.md

@@ -5,10 +5,12 @@ receipt. The JSON artifact preserves the exact contract and receipt digests,
 the verifier verdict, executor/verifier separation, and explicit trust
 limitations.
 
-Generate the machine-readable passport and a portable PR/CI summary together:
+Generate the machine-readable passport and a portable PR/CI summary together
+from the installed product. The receipt argument can be a proof id from
+`loki proof list` or a path to any provider's compatible `proof.json`:
 
 ```bash
-python3 tools/proof-passport.py \
+loki proof passport \
   outcome-contract.json proof.json proof-passport.json \
   --repo-dir . \
   --markdown-output proof-passport.md

package/loki-ts/dist/loki.js

@@ -1,5 +1,5 @@
 // @bun
-var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.22.3";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
+var p_=Object.create;var{getPrototypeOf:d_,defineProperty:eK,getOwnPropertyNames:c_}=Object;var l_=Object.prototype.hasOwnProperty;function i_(Z){return this[Z]}var a_,s_,n_=(Z,X,Q)=>{var Y=Z!=null&&typeof Z==="object";if(Y){var J=X?a_??=new WeakMap:s_??=new WeakMap,z=J.get(Z);if(z)return z}Q=Z!=null?p_(d_(Z)):{};let K=X||!Z||!Z.__esModule?eK(Q,"default",{value:Z,enumerable:!0}):Q;for(let $ of c_(Z))if(!l_.call(K,$))eK(K,$,{get:i_.bind(Z,$),enumerable:!0});if(Y)J.set(Z,K);return K};var HQ=(Z,X)=>()=>(X||Z((X={exports:{}}).exports,X),X.exports);var o_=(Z)=>Z;function r_(Z,X){this[Z]=o_.bind(null,X)}var l0=(Z,X)=>{for(var Q in X)eK(Z,Q,{get:X[Q],enumerable:!0,configurable:!0,set:r_.bind(X,Q)})};var p=(Z,X)=>()=>(Z&&(X=Z(Z=0)),X);var t0=import.meta.require;var xO={};l0(xO,{lokiDir:()=>j0,homeLokiDir:()=>R4,findRepoRootForVersion:()=>X$,REPO_ROOT:()=>i0});import{resolve as n7,dirname as Z$}from"path";import{fileURLToPath as t_}from"url";import{existsSync as UQ}from"fs";import{homedir as e_}from"os";function Zf(){let Z=kO;for(let X=0;X<6;X++){if(UQ(n7(Z,"VERSION"))&&UQ(n7(Z,"autonomy/run.sh")))return Z;let Q=Z$(Z);if(Q===Z)break;Z=Q}return n7(kO,"..","..","..")}function X$(Z){let X=Z;for(let Q=0;Q<6;Q++){if(UQ(n7(X,"VERSION"))&&UQ(n7(X,"autonomy/run.sh")))return X;let Y=Z$(X);if(Y===X)break;X=Y}return n7(Z,"..","..","..")}function j0(){return process.env.LOKI_DIR??n7(process.cwd(),".loki")}function R4(){return n7(e_(),".loki")}var kO,i0;var H8=p(()=>{kO=Z$(t_(import.meta.url));i0=Zf()});import{readFileSync as Xf}from"fs";import{resolve as Qf,dirname as Yf}from"path";import{fileURLToPath as Jf}from"url";function h3(){if(h5!==null)return h5;let Z="9.22.5";if(typeof Z==="string"&&Z.length>0)return h5=Z,h5;try{let X=Yf(Jf(import.meta.url)),Q=X$(X);h5=Xf(Qf(Q,"VERSION"),"utf-8").trim()}catch{h5="unknown"}return h5}var h5=null;var BQ=p(()=>{H8()});var _O={};l0(_O,{runOrThrow:()=>Tf,run:()=>E0,readStreamCapped:()=>NQ,commandVersion:()=>Cf,commandExists:()=>X9,ShellError:()=>Q$,MAX_STDOUT_BYTES:()=>bO});async function NQ(Z,X=bO){let Q=Z.getReader(),Y=new TextDecoder,J="",z=0;try{while(z<X){let{done:K,value:$}=await Q.read();if(K)break;if(!$)continue;if(z+=$.byteLength,z>X){let V=$.byteLength-(z-X);J+=Y.decode($.subarray(0,V),{stream:!0});break}J+=Y.decode($,{stream:!0})}J+=Y.decode()}finally{try{await Q.cancel()}catch{}Q.releaseLock()}return J}async function E0(Z,X={}){let Q=Bun.spawn({cmd:[...Z],stdout:"pipe",stderr:"pipe",env:X.env?{...process.env,...X.env}:process.env,cwd:X.cwd}),Y,J;if(X.timeoutMs&&X.timeoutMs>0)Y=setTimeout(()=>{try{Q.kill("SIGTERM")}catch{}J=setTimeout(()=>{try{Q.kill("SIGKILL")}catch{}},2000)},X.timeoutMs);try{let[z,K,$]=await Promise.all([NQ(Q.stdout),new Response(Q.stderr).text(),Q.exited]);return{stdout:z,stderr:K,exitCode:$}}finally{if(Y)clearTimeout(Y);if(J)clearTimeout(J)}}async function Tf(Z,X={}){let Q=await E0(Z,X);if(Q.exitCode!==0)throw new Q$(`command failed (${Q.exitCode}): ${Z.join(" ")}`,Q.exitCode,Q.stdout,Q.stderr);return Q}async function X9(Z){let X=wf(Z),Q=await E0(["sh","-c",`command -v ${X}`],{timeoutMs:5000});if(Q.exitCode===0)return Q.stdout.trim()||null;return null}function wf(Z){if(!/^[A-Za-z0-9._/-]+$/.test(Z))throw Error(`refused to shell-escape suspect token: ${Z}`);return Z}async function Cf(Z,X="--version"){if(!await X9(Z))return null;let Y=await E0([Z,X],{timeoutMs:5000});if(Y.exitCode!==0)return null;return((Y.stdout||Y.stderr).split(/\r?\n/)[0]?.trim()??"")||null}var bO=16777216,Q$;var x9=p(()=>{Q$=class Q$ extends Error{message;exitCode;stdout;stderr;constructor(Z,X,Q,Y){super(Z);this.message=Z;this.exitCode=X;this.stdout=Q;this.stderr=Y;this.name="ShellError"}}});function o7(Z){return Ff?"":Z}var Ff,A0,F8,_0,$W0,a0,V8,Q9,h;var S6=p(()=>{Ff=(process.env.NO_COLOR??"").length>0;A0=o7("\x1B[0;31m"),F8=o7("\x1B[0;32m"),_0=o7("\x1B[1;33m"),$W0=o7("\x1B[0;34m"),a0=o7("\x1B[0;36m"),V8=o7("\x1B[1m"),Q9=o7("\x1B[2m"),h=o7("\x1B[0m")});import{existsSync as ff}from"fs";async function E7(){if(x4!==void 0)return x4;let Z="/opt/homebrew/bin/python3.12";if(ff(Z))return x4=Z,Z;let X=await X9("python3.12");if(X)return x4=X,X;let Q=await X9("python3");return x4=Q,Q}async function Y7(Z,X={}){let Q=await E7();if(!Q)return{stdout:"",stderr:"python3 not found",exitCode:127};return E0([Q,"-c",Z],X)}var x4;var r7=p(()=>{x9()});var XA={};l0(XA,{runStatus:()=>Vh});import{existsSync as Y9,readFileSync as g3,readdirSync as aO,statSync as sO}from"fs";import{resolve as h8,basename as ef}from"path";import{homedir as Zh}from"os";function nO(Z){let X=Math.trunc(Z);if(X>=1e6)return`${(Math.trunc(X/1e6*10)/10).toFixed(1)}M`;if(X>=1000)return`${(Math.trunc(X/1000*10)/10).toFixed(1)}K`;return String(X)}function oO(Z,X,Q){if(X===0)return null;let Y=Math.trunc(Z*100/X),J=Math.trunc(Z*AQ/X);if(J>AQ)J=AQ;let z=AQ-J,K=F8;if(Y>=80)K=A0;else if(Y>=50)K=_0;let $="=".repeat(Math.max(0,J))+" ".repeat(Math.max(0,z)),V=nO(Z),W=nO(X);return`  ${V8}${Q}${h} ${K}[${$}]${h} ${Y}% (${V} / ${W})`}async function Qh(){if(await X9("jq"))return!0;return process.stdout.write(`${A0}Error: jq is required but not installed.${h}
 `),process.stdout.write(`Install with:
 `),process.stdout.write(`  brew install jq    (macOS)
 `),process.stdout.write(`  apt install jq     (Debian/Ubuntu)
@@ -1236,4 +1236,4 @@ Set LOKI_LEGACY_BASH=1 to force the bash CLI for every command.
 `),2}case"start":{let{runStart:Y}=await Promise.resolve().then(() => (g_(),v_));return Y(Q)}default:return process.stderr.write(`Unknown command: ${X}
 `),process.stderr.write(m_),2}}lO();process.on("SIGINT",()=>process.exit(130));process.on("SIGTERM",()=>process.exit(143));var dV0=await pV0(Bun.argv.slice(2));process.exit(dV0);
 
-//# debugId=45400DDB79710D0464756E2164756E21
+//# debugId=2BABAC8DCF0D367564756E2164756E21

package/mcp/__init__.py

@@ -75,4 +75,4 @@ try:
 except ImportError:
     __all__ = ['mcp']
 
-__version__ = '9.22.3'
+__version__ = '9.22.5'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "loki-mode",
   "mcpName": "io.github.asklokesh/loki-mode",
-  "version": "9.22.3",
+  "version": "9.22.5",
   "description": "Loki Mode by Autonomi. Autonomous spec-to-product system: takes a PRD, GitHub issue, OpenAPI/JSON/YAML, or one-line brief to a deployed app via the RARV-C closure loop with 8 quality gates. Provider-agnostic (Claude Code, OpenAI Codex, Cline, Aider).",
   "keywords": [
     "agent",

package/plugins/loki-mode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "loki-mode",
   "displayName": "Loki Mode",
-  "version": "9.22.3",
+  "version": "9.22.5",
   "description": "Autonomous spec-to-product build system with a built-in trust layer (RARV-C closure loop, 8 quality gates, completion council). Ships Loki's spec-hardening, drift-detection, and deterministic PR verification commands plus the Loki MCP server.",
   "author": {
     "name": "Autonomi",

package/tools/outcome-canary-receipt.py

@@ -13,6 +13,7 @@ import tempfile
 OK, REFUSED, USAGE, NO_INPUT = 0, 3, 64, 66
 DOMAIN = "loki-outcome-canary-decision-receipt/v1"
 MAX_BYTES = 5 * 1024 * 1024
+VERDICTS = {"PROMOTE", "HOLD", "ROLLBACK"}
 
 
 class Parser(argparse.ArgumentParser):
@@ -106,7 +107,8 @@ def _publish_create_only(path, payload):
 
 def create_receipt(report_path, observations_path, receipt_path, control_route,
                    canary_percent=10.0, max_risk=.25, min_samples=5,
-                   min_lift_bps=1, enable_receipt=False):
+                   min_lift_bps=1, enable_receipt=False,
+                   require_verdict=None):
     """Reverify a decision and publish one immutable portable receipt."""
     result = {
         "receipt": DOMAIN,
@@ -118,6 +120,14 @@ def create_receipt(report_path, observations_path, receipt_path, control_route,
     if not enable_receipt:
         result["refusal_reason"] = "receipt_not_enabled"
         return result
+    if require_verdict is not None:
+        result.update({
+            "required_verdict": require_verdict,
+            "requirement_met": False,
+        })
+        if require_verdict not in VERDICTS:
+            result["refusal_reason"] = "required_verdict_invalid"
+            return result
     try:
         _target_is_absent(receipt_path)
         evaluator = _load_tool(
@@ -127,11 +137,11 @@ def create_receipt(report_path, observations_path, receipt_path, control_route,
             report_path, observations_path, control_route, canary_percent,
             max_risk, min_samples, min_lift_bps, True,
         )
-        if decision.get("refusal_reasons") or decision.get("verdict") not in {
-            "PROMOTE", "HOLD", "ROLLBACK"
-        }:
+        if decision.get("refusal_reasons") or decision.get("verdict") not in VERDICTS:
             result["refusal_reason"] = "evaluation_refused"
             return result
+        if require_verdict is not None:
+            result["verdict"] = decision["verdict"]
 
         report_bytes = _read_named_regular(report_path)
         observations_bytes = _read_named_regular(observations_path)
@@ -149,6 +159,9 @@ def create_receipt(report_path, observations_path, receipt_path, control_route,
         if _sha256(source_bytes) != decision["source_sha256"]:
             result["refusal_reason"] = "source_unsafe_or_drifted"
             return result
+        if require_verdict is not None and decision["verdict"] != require_verdict:
+            result["refusal_reason"] = "verdict_mismatch"
+            return result
 
         receipt = {
             "receipt": DOMAIN,
@@ -184,6 +197,8 @@ def create_receipt(report_path, observations_path, receipt_path, control_route,
             "verdict": decision["verdict"],
             "receipt_sha256": _sha256(payload),
         })
+        if require_verdict is not None:
+            result["requirement_met"] = True
     except FileNotFoundError:
         result["refusal_reason"] = "input_missing"
     except (OSError, ValueError, json.JSONDecodeError, UnicodeDecodeError) as exc:
@@ -210,6 +225,7 @@ def main(argv=None):
     parser.add_argument("--max-risk", type=float, default=.25)
     parser.add_argument("--min-samples", type=int, default=5)
     parser.add_argument("--min-lift-bps", type=int, default=1)
+    parser.add_argument("--require-verdict", choices=("PROMOTE", "HOLD", "ROLLBACK"))
     parser.add_argument("--json", action="store_true")
     args = parser.parse_args(argv)
     for path in (args.report, args.observations):
@@ -219,15 +235,20 @@ def main(argv=None):
     result = create_receipt(
         args.report, args.observations, args.receipt, args.control_route,
         args.canary_percent, args.max_risk, args.min_samples,
-        args.min_lift_bps, args.enable_receipt,
+        args.min_lift_bps, args.enable_receipt, args.require_verdict,
     )
     if args.json:
         print(json.dumps(result, sort_keys=True))
     elif result["status"] == "RECORDED":
         print(f"Canary decision receipt: RECORDED ({result['verdict']})")
         print(f"  sha256={result['receipt_sha256']}")
+        if args.require_verdict is not None:
+            print(f"  required verdict: {args.require_verdict} (MET)")
     else:
         print(f"Canary decision receipt: REFUSED ({result['refusal_reason']})")
+        if args.require_verdict is not None and result["verdict"] is not None:
+            print(f"  actual verdict: {result['verdict']}")
+            print(f"  required verdict: {args.require_verdict} (NOT MET)")
     return OK if result["status"] == "RECORDED" else REFUSED
 
 

package/web-app/server.py

@@ -2668,14 +2668,17 @@ async def start_session(req: StartRequest) -> JSONResponse:
             if req.provider:
                 build_env["LOKI_PROVIDER"] = req.provider
 
+            # LOKI_CLI is a trusted fixed path; request data stays in an argv
+            # vector and is never parsed as shell command text.
             proc = subprocess.Popen(
-                cmd,
+                cmd,  # lgtm[py/command-line-injection]
                 stdout=subprocess.PIPE,
                 stderr=subprocess.STDOUT,
                 stdin=subprocess.DEVNULL,
                 text=True,
                 cwd=project_dir,
                 env=build_env,
+                shell=False,
                 **({"start_new_session": True} if sys.platform != "win32"
                    else {"creationflags": subprocess.CREATE_NEW_PROCESS_GROUP}),
             )
@@ -4253,8 +4256,10 @@ async def chat_session(session_id: str, req: ChatRequest) -> JSONResponse:
             chat_env.update(_load_secrets())
             # Pass provider via env for quick mode (loki quick uses LOKI_PROVIDER env)
             chat_env["LOKI_PROVIDER"] = chat_provider
+            # loki is resolved from the trusted application install; message,
+            # provider, and PRD path remain argv data with no command shell.
             proc = subprocess.Popen(
-                cmd_args,
+                cmd_args,  # lgtm[py/command-line-injection]
                 stdout=subprocess.PIPE,
                 stderr=subprocess.STDOUT,
                 stdin=subprocess.DEVNULL,
@@ -4262,6 +4267,7 @@ async def chat_session(session_id: str, req: ChatRequest) -> JSONResponse:
                 cwd=str(target),
                 env=chat_env,
                 start_new_session=True,
+                shell=False,
             )
             task.process = proc
             _track_child_pid(proc.pid)