loki-mode 9.48.2 → 9.49.3

package/.github/workflows/loki-issue-to-pr.yml

@@ -61,7 +61,7 @@ jobs:
         # Pinned to a TAG, not @main. A moving ref would hand every user
         # whatever main holds at the moment their issue is labeled, including a
         # half-landed release. Bump this line deliberately.
-        uses: asklokesh/loki-mode/.github/actions/issue-to-pr@v9.48.2
+        uses: asklokesh/loki-mode/.github/actions/issue-to-pr@v9.49.3
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
         with:

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.48.2
+# Loki Mode v9.49.3
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.48.2 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.49.3 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.48.2
+9.49.3

package/autonomy/lib/claude-flags.sh

@@ -51,7 +51,21 @@ loki_effort_for_tier() {
 
 # ---------- Remaining budget ----------
 # Compute remaining budget = LOKI_BUDGET_LIMIT - cumulative spend so far.
-# Spend lives in .loki/metrics/budget.json under "current_spend" (per autonomy/run.sh:8167+).
+# Spend lives in .loki/metrics/budget.json under "budget_used".
+#
+# It was read as "current_spend" until v9.50.0, a key NO production writer has
+# ever emitted. All six writers of that file (run.sh:6581,17851,17869,
+# loki-ts/src/runner/budget.ts:267, dashboard/server.py:7953, autonomy/loki)
+# write "budget_used". The old citation pointed at run.sh:8167+, which is
+# per-iteration token parsing and writes no budget key at all.
+#
+# Effect of the bug: spend always read 0, so --max-budget-usd was handed the
+# FULL cap on every call instead of the remainder, and the per-call backstop
+# never tightened as spend accumulated. Only reachable for users who set
+# LOKI_BUDGET_LIMIT explicitly (run.sh sets BUDGET_LIMIT, not LOKI_*), i.e.
+# exactly the cost-conscious users who asked for the cap.
+# "current_spend" is still accepted as a fallback so a budget.json written by
+# an in-flight older run still parses.
 # Emit empty string when budget is unlimited (LOKI_BUDGET_LIMIT unset or 0).
 # Emit empty when remaining <= 0 (caller decides what to do; we never emit 0).
 loki_remaining_budget() {
@@ -71,7 +85,9 @@ import json, os, sys
 try:
     with open(os.environ["_LOKI_BUDGET_FILE"]) as f:
         d = json.load(f)
-    v = d.get("current_spend", 0)
+    v = d.get("budget_used")
+    if v is None:
+        v = d.get("current_spend", 0)
     print(float(v))
 except Exception:
     print(0)

package/autonomy/loki

@@ -13538,10 +13538,34 @@ except Exception:
         "$HOME/.cline/skills/loki-mode:Cline CLI"
         "$HOME/.aider/skills/loki-mode:Aider CLI"
     )
+    # SEVERITY DEPENDS ON WHOSE SKILL IT IS (v9.48.x). A dangling skill symlink
+    # used to block unconditionally, so a stale link left by an old checkout
+    # path exited 1 on a HEALTHY machine -- while the Provider Availability
+    # section three lines above said that same provider was "not installed".
+    # Doctor contradicted itself on one screen and told the user to fix a tool
+    # they do not have.
+    #
+    # The link only blocks when it belongs to the provider a build would
+    # actually launch. Anything else is inert state: still reported, with the
+    # dangling target and the fix, but not a reason to refuse to start.
+    #
+    # `|| true` is mandatory under `set -euo pipefail`: the accessor returns
+    # non-zero when no provider resolves (a bare call would abort doctor), and
+    # an empty id then makes every entry non-blocking -- the same direction the
+    # No-AI-provider blocker above already covers.
+    local _selected_provider=""
+    if declare -f effective_provider_id >/dev/null 2>&1; then
+        _selected_provider="$(effective_provider_id 2>/dev/null || true)"
+    fi
     for entry in "${skill_dirs[@]}"; do
         local sdir="${entry%%:*}"
         local sname="${entry#*:}"
         local short_path="${sdir/$HOME/~}"
+        # Provider id from the directory, never a parallel list: `.claude` ->
+        # `claude`. A fifth hand-maintained list is how the lists in this repo
+        # have drifted from auto_detect_provider before (v8.76.0, v8.82.0).
+        local _sid="${sdir#"$HOME"/.}"
+        _sid="${_sid%%/*}"
         if [ -f "$sdir/SKILL.md" ]; then
             echo -e "  ${GREEN}PASS${NC}  $sname  ${DIM}$short_path${NC}"
             pass_count=$((pass_count + 1))
@@ -13560,10 +13584,22 @@ except Exception:
                 _target=$(ls -ld "$sdir" 2>/dev/null | sed -e 's/^[^>]*-> //')
                 [ -n "$_target" ] || _target="unknown"
             fi
-            echo -e "  ${RED}FAIL${NC}  $sname  ${DIM}(broken symlink -> $_target)${NC}"
-            echo -e "         ${YELLOW}Fix: loki setup-skill${NC}"
-            _doctor_block "$sname is a broken symlink. Fix: loki setup-skill"
-            fail_count=$((fail_count + 1))
+            # Blocking ONLY for the provider a build would actually use. The
+            # non-blocking arm is a WARN rather than a non-counted FAIL on
+            # purpose: a red FAIL badge that never reaches `N failed` or the
+            # `Blocking (N)` list makes the summary disagree with the screen.
+            # Either way the dangling target and the fix are still printed --
+            # the stale link is reported, never silently swallowed.
+            if [ -n "$_selected_provider" ] && [ "$_sid" = "$_selected_provider" ]; then
+                echo -e "  ${RED}FAIL${NC}  $sname  ${DIM}(broken symlink -> $_target)${NC}"
+                echo -e "         ${YELLOW}Fix: loki setup-skill${NC}"
+                _doctor_block "$sname is a broken symlink. Fix: loki setup-skill"
+                fail_count=$((fail_count + 1))
+            else
+                echo -e "  ${YELLOW}WARN${NC}  $sname  ${DIM}(broken symlink -> $_target)${NC}"
+                echo -e "         ${YELLOW}Fix: loki setup-skill${NC}"
+                warn_count=$((warn_count + 1))
+            fi
         else
             echo -e "  ${YELLOW}WARN${NC}  $sname  ${DIM}(not found - run 'loki setup-skill')${NC}"
             warn_count=$((warn_count + 1))
@@ -14183,14 +14219,26 @@ memory = {
 #
 # CAUTION: this block lives inside a DOUBLE-QUOTED python3 -c program, so no
 # apostrophes and no double quotes anywhere here, comments included.
+#
+# SEVERITY MIRRORS THE TEXT PATH: a dangling link is a failure only for the
+# provider a build would actually use. Read from the SAME payload the text
+# route uses (LOKI_PROVIDER_AVAILABILITY, set by cmd_doctor_json), parsed here
+# rather than via a second env var so the two cannot disagree. LOKI_PROVIDER
+# wins for the same reason effective_provider_id honors it.
 _SKILL_ENTRIES = (
-    ('Claude Code', '.claude/skills/loki-mode'),
-    ('Codex CLI', '.codex/skills/loki-mode'),
-    ('Cline CLI', '.cline/skills/loki-mode'),
-    ('Aider CLI', '.aider/skills/loki-mode'),
+    ('Claude Code', '.claude/skills/loki-mode', 'claude'),
+    ('Codex CLI', '.codex/skills/loki-mode', 'codex'),
+    ('Cline CLI', '.cline/skills/loki-mode', 'cline'),
+    ('Aider CLI', '.aider/skills/loki-mode', 'aider'),
 )
+try:
+    _sk_pa = os.environ.get('LOKI_PROVIDER_AVAILABILITY', '').strip()
+    _sk_selected = (json.loads(_sk_pa).get('selected') or '') if _sk_pa else ''
+except Exception:
+    _sk_selected = ''
+_sk_selected = os.environ.get('LOKI_PROVIDER', '') or _sk_selected
 skills = []
-for _sk_name, _sk_rel in _SKILL_ENTRIES:
+for _sk_name, _sk_rel, _sk_id in _SKILL_ENTRIES:
     _sk_dir = os.path.join(os.path.expanduser('~'), _sk_rel)
     # JSON is commonly archived or forwarded to automation. Keep the useful
     # user-relative location without exposing the machine-specific home path.
@@ -14200,8 +14248,14 @@ for _sk_name, _sk_rel in _SKILL_ENTRIES:
                        'detail': None, 'required': 'required'})
     elif os.path.islink(_sk_dir):
         # islink is true for a DANGLING link (lstat-based), which is exactly
-        # the broken case the text path reports as FAIL.
-        skills.append({'name': _sk_name, 'path': _sk_json_path, 'status': 'fail',
+        # the broken case the text path reports. fail only for the effective
+        # provider; otherwise warn, matching the text path badge for badge.
+        # `required` stays 'required' in both arms: an absent link has always
+        # been warn+required, so the warn arm introduces no new shape, and a
+        # consumer keys on `status`.
+        _sk_blocking = bool(_sk_selected) and _sk_id == _sk_selected
+        skills.append({'name': _sk_name, 'path': _sk_json_path,
+                       'status': 'fail' if _sk_blocking else 'warn',
                        'detail': 'broken symlink. Fix: loki setup-skill',
                        'required': 'required'})
     else:
@@ -17358,7 +17412,78 @@ if manifests:
             echo -e "${RED}Error: No repositories found matching: ${multi_repo}${NC}"
             return 1
         fi
-        # HONESTY: this flag DISCOVERS repositories; it does not migrate them.
+        # ORCHESTRATION (v9.49.0): --multi-repo now MIGRATES each discovered
+        # repository, one at a time, instead of only listing them.
+        #
+        # WHY A WRAPPER AND NOT SURGERY INSIDE THIS FUNCTION: cmd_migrate_start
+        # is self-contained per codebase_path (manifest, secret scan, phases)
+        # and was measured to have 20 `return`s and ZERO `exit`s, so it is
+        # safe to call in a loop -- a failing repo returns a code instead of
+        # killing the run. Recursing once per repo reuses every existing gate
+        # rather than reimplementing the pipeline.
+        #
+        # PARTIAL-FAILURE SEMANTICS: continue-and-report, decided on the
+        # codebase's own precedent, not preference:
+        #   - the task schema already has `blocked` as a first-class state
+        #     alongside `completed` (mcp/server.py:888), so "some units did not
+        #     finish" is already expressible
+        #   - run.sh carries 562 best-effort sites: the house style is degrade
+        #     honestly, do not abort
+        #   - fail-closed is reserved for DEPENDENCY violations (a migrate phase
+        #     refusing to run without its predecessor's artifacts, :17575), and
+        #     independent repositories have no such dependency on each other
+        # One repo failing therefore must not deny the other four their result.
+        # The per-repo status table plus a non-zero aggregate exit code is what
+        # makes that honest rather than silent.
+        #
+        # LOKI_MULTI_REPO_SEQUENTIAL=0 is NOT offered: these share a migrations
+        # dir and a dashboard port, and parallel runs would interleave output
+        # into an unreadable report.
+        if [ "$repo_count" -gt 1 ] && [ "${_LOKI_MR_CHILD:-0}" != "1" ]; then
+            echo -e "${BOLD}Multi-repo migration${NC} ($repo_count repositories, sequential)"
+            echo "---"
+            for repo in "${repos[@]}"; do echo "  - $repo"; done
+            echo ""
+
+            local _mr_ok=0 _mr_bad=0
+            local _mr_rows=""
+            local _mr_repo _mr_rc
+            for _mr_repo in "${repos[@]}"; do
+                echo ""
+                echo -e "${CYAN}=== [$((_mr_ok + _mr_bad + 1))/$repo_count] $_mr_repo ===${NC}"
+                _mr_rc=0
+                # _LOKI_MR_CHILD guards the recursion: the child sees the same
+                # --multi-repo argument and must NOT re-enter this block.
+                _LOKI_MR_CHILD=1 cmd_migrate_start \
+                    "$_mr_repo" "$target" "$plan_only" "$phase" "$parallel" \
+                    "$compliance" "$dry_run" "$resume" "" "$export_report" \
+                    "$no_dashboard" "$no_docs" || _mr_rc=$?
+                if [ "$_mr_rc" -eq 0 ]; then
+                    _mr_ok=$((_mr_ok + 1))
+                    _mr_rows="${_mr_rows}  OK       ${_mr_repo}"$'\n'
+                else
+                    _mr_bad=$((_mr_bad + 1))
+                    _mr_rows="${_mr_rows}  BLOCKED  ${_mr_repo} (exit ${_mr_rc})"$'\n'
+                fi
+            done
+
+            echo ""
+            echo -e "${BOLD}Multi-repo result${NC}"
+            echo "---"
+            printf '%s' "$_mr_rows"
+            echo ""
+            echo "  ${_mr_ok} of ${repo_count} migrated, ${_mr_bad} blocked."
+            if [ "$_mr_bad" -gt 0 ]; then
+                # A non-zero exit is what keeps "continue" from becoming
+                # "silently tolerate": CI and `loki next` both branch on it.
+                echo -e "${YELLOW}Some repositories did not complete. Re-run just those, or inspect them with 'loki why'.${NC}"
+                return 1
+            fi
+            return 0
+        fi
+
+        # HONESTY (single-repo, or a --multi-repo glob that matched exactly one):
+        # this flag DISCOVERS repositories; it does not migrate them.
         # `repos[]` is populated here and never referenced again -- everything
         # below operates on the single "$codebase_path". The old message said
         # "Multi-repo migration (3 repositories)" and listed all three, then

package/autonomy/notification-checker.py

@@ -165,7 +165,15 @@ def check_budget_threshold(trigger, loki_dir, iteration, notifications):
         state = json.loads(state_file.read_text())
         budget = state.get("budget", {})
         limit = budget.get("limit", 0)
-        used = budget.get("used", 0)
+        # run.sh:7084 nests .loki/metrics/budget.json verbatim under "budget",
+        # and that file's spend key is "budget_used". Reading only "used" meant
+        # this trigger never fired in production: verified against the exact
+        # state run.sh writes, 0 notifications were produced at 85% of cap.
+        # "used" stays as a fallback for the /api/cost-shaped payload
+        # (autonomy/loki:28122), which does write that key.
+        used = budget.get("budget_used")
+        if used is None:
+            used = budget.get("used", 0)
         if limit <= 0:
             return None
         pct = (used / limit) * 100
@@ -241,24 +249,44 @@ def check_file_access(trigger, loki_dir, iteration, notifications):
 
 
 def check_quality_gate(trigger, loki_dir, iteration, notifications):
-    """Check for quality gate failures. Reports ALL failed gates, not just first."""
-    state_file = Path(loki_dir) / "dashboard-state.json"
-    if not state_file.exists():
-        return []
-
+    """Check for quality gate failures. Reports ALL failed gates, not just first.
+
+    Reads .loki/quality/gate-failures.txt, which is what run.sh actually writes
+    (:24100, :24142, :24553) as a comma-terminated list of failing gate names,
+    e.g. "mock_integrity,".
+
+    This previously read state["qualityGates"] out of dashboard-state.json,
+    sourced from .loki/state/quality-gates.json (run.sh:6972). NOTHING writes
+    that file: all seven repo references are readers, autonomy/hooks/
+    quality-gate.sh:12 guards on `[ ! -f ]`, and proof-generator.py:345 records
+    the same finding as issue #125 and already works around it by reading these
+    per-gate artifacts. The aggregate was therefore always absent, qualityGates
+    was always null, and this trigger could never fire -- the same dead-reader
+    defect as the budget key, in the same file.
+
+    gate-failures.txt is the canonical failure source used by
+    proof-generator.py:413 and loki-ts build_prompt_helpers.ts:250, so this
+    reuses a proven contract rather than introducing a second one.
+    """
+    failures_file = Path(loki_dir) / "quality" / "gate-failures.txt"
     results = []
     try:
-        state = json.loads(state_file.read_text())
-        gates = state.get("qualityGates", {})
-        if isinstance(gates, dict):
-            for gate_name, gate_data in gates.items():
-                if isinstance(gate_data, dict) and gate_data.get("status") == "failed":
-                    msg = trigger["message"].format(gate=gate_name)
-                    results.append(make_notification(
-                        trigger["id"], trigger["severity"], msg, iteration,
-                        {"gate": gate_name},
-                    ))
-    except (json.JSONDecodeError, OSError, KeyError):
+        if failures_file.exists():
+            # Cap the read: a pathological file must not be loaded whole
+            # (same reason as build_prompt.ts:707).
+            raw = failures_file.read_text(errors="replace")[:8000]
+            seen = set()
+            for name in raw.replace("\n", ",").split(","):
+                gate_name = name.strip()
+                if not gate_name or gate_name in seen:
+                    continue
+                seen.add(gate_name)
+                msg = trigger["message"].format(gate=gate_name)
+                results.append(make_notification(
+                    trigger["id"], trigger["severity"], msg, iteration,
+                    {"gate": gate_name},
+                ))
+    except (OSError, KeyError):
         pass
     return results if results else None
 

package/autonomy/provider-offer.sh

@@ -464,6 +464,49 @@ render_provider_availability() {
     ) || return 1
 }
 
+# effective_provider_id: print the provider id a build would ACTUALLY use, or
+# nothing when none is resolvable. Exit status is 0 only when an id was printed.
+#
+# WHY IT EXISTS. Doctor grades a dangling skill symlink, and the severity of
+# that depends on WHOSE skill it is. A stale link for a provider the user does
+# not use is inert state; the same link for the provider a build will launch is
+# a real blocker. Both the text route and the Bun route need that one id, and
+# both previously re-derived it inside their own subshells (the two callers
+# below). Deriving it a third and fourth time is exactly the drift this file's
+# header exists to prevent, so it is extracted here once.
+#
+# LOKI_PROVIDER WINS. render_provider_availability prints "override with
+# LOKI_PROVIDER" two lines above, so honoring auto-detection alone would grade
+# a skill link against a provider the very same screen says is not in use.
+# The override is NOT validated against installed state on purpose: an explicit
+# LOKI_PROVIDER is the user's stated intent, and a build would carry it through.
+#
+# DEGRADES SILENTLY, like its two siblings: a missing or unsourceable loader
+# prints nothing and returns non-zero, and the caller falls back to treating
+# every entry as non-blocking rather than erroring.
+effective_provider_id() {
+    if [ -n "${LOKI_PROVIDER:-}" ]; then
+        printf '%s\n' "$LOKI_PROVIDER"
+        return 0
+    fi
+
+    local _po_here
+    _po_here="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." 2>/dev/null && pwd)" || return 1
+    local _loader="$_po_here/providers/loader.sh"
+    [ -f "$_loader" ] || return 1
+
+    local _sel
+    _sel="$(
+        # shellcheck source=/dev/null
+        source "$_loader" >/dev/null 2>&1 || exit 1
+        declare -f auto_detect_provider >/dev/null 2>&1 || exit 1
+        auto_detect_provider 2>/dev/null
+    )" || return 1
+
+    [ -n "$_sel" ] || return 1
+    printf '%s\n' "$_sel"
+}
+
 # provider_availability_json: the same data as one JSON object, for doctor --json.
 # Separate from the renderer so neither format has to parse the other. Same
 # degrade rule: no loader means no output and a non-zero status.
@@ -517,6 +560,10 @@ if [ "${BASH_SOURCE[0]}" = "$0" ]; then
         # routes call these so the two renderings cannot drift apart.
         providers)      render_provider_availability ;;
         providers-json) provider_availability_json ;;
+        # The provider id a build would actually use, for the Bun doctor's
+        # skill-severity decision. Same one-implementation rule as the two
+        # above: doctor.ts reads this instead of re-deriving the priority list.
+        effective-provider) effective_provider_id ;;
         *)            offer_provider_install report ;;
     esac
 fi