loki-mode 9.48.2 → 9.49.3

package/autonomy/quickstart.sh

@@ -703,6 +703,175 @@ PY
     return 0
 }
 
+# _qs_is_rejection <answer>: true when the user explicitly declined the offered
+# templates. Before this existed the picker's `*)` arm mapped ANY unrecognized
+# answer -- "none", "no", "skip", "q" -- onto top3[0], so an explicit rejection
+# was silently converted into a selection and quickstart built a todo app for a
+# user who had just said none of them fit. An explicit no must never become a
+# yes; these answers route to the brief-as-spec path instead.
+_qs_is_rejection() {
+    local a
+    a=$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')
+    case "$a" in
+        none|no|n|skip|q|quit|neither|nope|"none of these"|"none of them") return 0;;
+    esac
+    return 1
+}
+
+# _qs_detect_brownfield: print a short human reason when the CWD is an existing
+# project, and return 0. Return 1 (printing nothing) for a greenfield directory.
+#
+# Signals are EXPLICIT MANIFESTS plus a git repo with at least one commit. A
+# loose "any source file present" check was deliberately rejected: the test
+# harnesses write helper scripts and stray .md files into their working
+# directories, so a broad check would classify an empty scratch dir as an
+# existing project and silently reroute the greenfield flow. A manifest or a
+# commit is a deliberate artifact of a real project, which is the claim being
+# made on screen.
+#
+# bash 3.2 safe: no associative arrays, no mapfile.
+_qs_detect_brownfield() {
+    local reasons="" m
+    for m in package.json pyproject.toml go.mod Cargo.toml pom.xml Gemfile composer.json build.gradle setup.py; do
+        if [ -f "./$m" ]; then
+            if [ -z "$reasons" ]; then reasons="$m"; else reasons="$reasons, $m"; fi
+        fi
+    done
+    # A git repo counts only WITH a commit: `git init` alone in an empty folder
+    # is where a brand-new greenfield build legitimately starts, and treating
+    # that as "existing code" would break the first-run flow.
+    if git rev-parse --git-dir >/dev/null 2>&1 && git rev-parse HEAD >/dev/null 2>&1; then
+        if [ -z "$reasons" ]; then reasons="git repo"; else reasons="$reasons, git repo"; fi
+    fi
+    [ -n "$reasons" ] || return 1
+    printf '%s' "$reasons"
+    return 0
+}
+
+# _qs_classify_invoke <prompt>: the single model-call primitive for intent
+# classification. Its own function so tests can override it, mirroring
+# _loki_prd_enrich_invoke (autonomy/lib/prd-enrich.sh:43).
+#
+# Calls `claude -p` directly rather than the provider_invoke shell function
+# because `timeout` execs a real command, not a function -- the same documented
+# reason prd-enrich gives. No HTTP: this repo is provider-agnostic over CLIs and
+# has zero chat/completions calls in source.
+#
+# The timeout is deliberately short. Quickstart is the first thing a new user
+# runs, so a stalled provider must degrade to the offline scorer in seconds
+# rather than inherit prd-enrich's 120s budget.
+: "${LOKI_QUICKSTART_CLASSIFY_TIMEOUT:=15}"
+_qs_classify_invoke() {
+    local prompt="$1"
+    command -v claude >/dev/null 2>&1 || return 1
+    local rc=0 out=""
+    local to=""
+    if command -v timeout >/dev/null 2>&1; then to="timeout"
+    elif command -v gtimeout >/dev/null 2>&1; then to="gtimeout"; fi
+    if [ -n "$to" ]; then
+        out=$(CAVEMAN_DEFAULT_MODE=off "$to" "${LOKI_QUICKSTART_CLASSIFY_TIMEOUT}" \
+                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+    else
+        out=$(CAVEMAN_DEFAULT_MODE=off \
+                  claude --dangerously-skip-permissions -p "$prompt" 2>/dev/null) || rc=$?
+    fi
+    [ "$rc" -ne 0 ] && return 1
+    [ -z "$out" ] && return 1
+    printf '%s' "$out"
+    return 0
+}
+
+# _qs_classify_intent <brief>: print new_project | change_to_existing_code when
+# the model answers cleanly, and return 0. Return 1 on ANY miss.
+#
+# FAIL-CLOSED IS LOAD-BEARING. No provider, no network, a slow call, a non-zero
+# exit, an empty body, or an unrecognized word all return 1, and every caller
+# falls back to the offline keyword ranking that shipped before this existed.
+# Quickstart must never hang or hard-fail on the model path.
+_qs_classify_intent() {
+    local brief="$1"
+    [ -n "$brief" ] || return 1
+    local out=""
+    out=$(_qs_classify_invoke "Classify this software request as exactly one word.
+
+Answer new_project if the user wants a brand-new application built from scratch.
+Answer change_to_existing_code if the user wants to modify, update, fix, restyle,
+refactor, or add to code that already exists.
+Answer unclear if you genuinely cannot tell.
+
+Reply with ONE word and nothing else: new_project, change_to_existing_code, or unclear.
+
+Request: $brief") || return 1
+    # Take the first bare word; a chatty model must not defeat the match.
+    out=$(printf '%s' "$out" | tr -d '\r' | tr '[:upper:]' '[:lower:]' | tr -cs 'a-z_' ' ')
+    case " $out " in
+        *" change_to_existing_code "*) printf 'change_to_existing_code'; return 0;;
+        *" new_project "*)             printf 'new_project'; return 0;;
+    esac
+    return 1
+}
+
+# _qs_write_change_prd <path> <brief> <mode>: render a spec from the user's own
+# brief. <mode> is "change" (a change against an existing codebase) or "new" (a
+# brand-new project).
+#
+# The mode argument is load-bearing and must never be inferred from
+# $brownfield_reason. That variable stays populated after the classifier flips a
+# brownfield verdict back to a new build, so a user in an existing repo who asks
+# for "a brand new X" and then rejects the template would be handed
+# existing-codebase framing for a project that does not exist yet. Both callers
+# set the mode explicitly at the point they decide what the spec IS.
+#
+# Why not reuse cmd_start's existing seams: `--brief` runs synthesize_brief_prd
+# (loki:15759), which says "Build the smallest working version of the above" and
+# stamps "Mode: Brief (zero-config first run)" -- greenfield framing that would
+# reproduce the original bug one layer down. `loki start <dir>` runs
+# synthesize_repo_prd (loki:15802), a quoted heredoc carrying NO caller text: it
+# tells the agent to pick its own improvement and would discard what the user
+# actually asked for. Neither carries a user-specified change against existing
+# code, so this writes that spec and hands it to the normal PRD path.
+#
+# The brief is written via printf argument, never expanded into the heredoc, so
+# no shell metacharacter in user input is interpreted.
+_qs_write_change_prd() {
+    local out_file="$1" brief="$2" mode="${3:-change}"
+    {
+        if [ "$mode" = "new" ]; then
+            printf '# Build Request\n\n'
+            printf '## Goal\n'
+            printf '%s\n\n' "$brief"
+            printf '## Context\n'
+            printf 'This is a NEW project. Build it from scratch in the working directory.\n'
+            printf 'No starting template was chosen, so the Goal above is the whole spec.\n\n'
+            printf '## Requirements\n'
+            printf -- '- Scaffold the new application described in the Goal above.\n'
+            printf -- '- Build the smallest version that genuinely works end to end.\n'
+            printf -- '- Choose a conventional, well-supported stack for this kind of app.\n\n'
+            printf '## Success Criteria\n'
+            printf -- '- The application described in the Goal runs and is usable.\n'
+            printf -- '- Everything the Goal explicitly asks for is present.\n\n'
+        else
+            printf '# Change Request\n\n'
+            printf '## Goal\n'
+            printf '%s\n\n' "$brief"
+            printf '## Context\n'
+            printf 'This is an EXISTING codebase, not a new project. The working directory\n'
+            printf 'already contains the application this change applies to.\n\n'
+            printf '## Requirements\n'
+            printf -- '- Read the existing code first and follow its established conventions.\n'
+            printf -- '- Make the change described in the Goal above, and only that change.\n'
+            printf -- '- Do NOT scaffold a new project, and do NOT replace the existing app.\n'
+            printf -- '- Preserve all unrelated existing behavior and files.\n\n'
+            printf '## Success Criteria\n'
+            printf -- '- The change described in the Goal is visible when the app runs.\n'
+            printf -- '- Existing functionality still works; nothing unrelated regressed.\n\n'
+        fi
+        printf '## Constraints\n'
+        printf -- '- Keep the diff bounded and easy to review.\n'
+        printf -- '- No emojis, no em dashes in code, comments, or docs.\n'
+    } > "$out_file"
+}
+
 # _qs_help: concise usage for `loki quickstart --help`.
 _qs_help() {
     printf '%sloki quickstart%s - guided first build (setup, idea, template, plan, go)\n' "$_QS_BOLD" "$_QS_NC"
@@ -749,8 +918,18 @@ _qs_help() {
     printf '  3. Template   Pick the closest starting template (offline keyword match)\n'
     printf '  4. Plan       Review the honest cost/time estimate, then confirm\n'
     printf '\n'
+    printf 'Existing projects:\n'
+    printf '  If the current directory is already a project (package.json,\n'
+    printf '  pyproject.toml, go.mod, Cargo.toml, a git repo with commits, and\n'
+    printf '  similar), quickstart treats your description as a CHANGE to that\n'
+    printf '  code instead of a new build. No template is offered and no file is\n'
+    printf '  written into your project directory.\n'
+    printf '  At the template prompt you can always answer "none" (or skip/no/q)\n'
+    printf '  to use your description directly as the spec.\n'
+    printf '\n'
     printf 'The PRD is written to ./prd.md in the current directory (or the next\n'
     printf 'free prd-quickstart*.md name if that exists), then the build starts.\n'
+    printf 'The change-request path above writes no PRD into your project.\n'
     return 0
 }
 
@@ -1122,7 +1301,50 @@ cmd_quickstart() {
     fi
 
     # ----- Step 3 of 4: Pick a template (skipped if a PRD path was given) ----
-    if [ -z "$prd_source" ]; then
+    #
+    # BROWNFIELD FIRST. Offering greenfield templates inside an existing project
+    # is how "update the color theme of this app" became a brand-new todo app.
+    # When the CWD is already a project, a brief is a CHANGE REQUEST against the
+    # code that is here, so the template picker is skipped entirely.
+    #
+    # Gating:
+    #   - dry_run is excluded: preview must stay the deterministic template/plan
+    #     preview its JSON schema promises, and must run no provider code.
+    #   - an explicit --template is excluded: the user was specific, and an
+    #     explicit choice outranks detection.
+    # spec_mode records WHY the brief became the spec, decided at each site that
+    # decides it. It is not derived from $brownfield_reason: that stays set
+    # after the classifier flip below, and reusing it would frame a brand-new
+    # build as a change to code that does not exist.
+    local brownfield_reason="" use_brief_as_spec=false spec_mode="change"
+    if [ -z "$prd_source" ] && [ -z "$template_override" ] && [ "$dry_run" != true ] && [ -n "$brief" ]; then
+        brownfield_reason="$(_qs_detect_brownfield)" || brownfield_reason=""
+        if [ -n "$brownfield_reason" ]; then
+            use_brief_as_spec=true
+            spec_mode="change"
+            # The model gets the final say when a provider CLI is available, so
+            # "build me a brand new dashboard" typed inside an existing repo is
+            # still treated as a new build. Fail-closed: any miss keeps the
+            # filesystem verdict, which is deterministic and offline.
+            local _qs_intent=""
+            _qs_intent="$(_qs_classify_intent "$brief")" || _qs_intent=""
+            if [ "$_qs_intent" = "new_project" ]; then
+                use_brief_as_spec=false
+                # This path falls through to the template picker and can reach
+                # the rejection arm below, so the mode must not stay "change".
+                spec_mode="new"
+            fi
+        fi
+    fi
+
+    if [ "$use_brief_as_spec" = true ]; then
+        printf '%sStep 3 of 4: Existing project detected%s\n' "$_QS_BOLD" "$_QS_NC"
+        printf '  Detected an existing project (%s). Treating this as a change\n' "$brownfield_reason"
+        printf '  to your code, not a new build.\n'
+        printf '  No starting template is being used.\n\n'
+        input_kind="change"
+        template_name="change-request"
+    elif [ -z "$prd_source" ]; then
         if [ -n "$template_override" ]; then
             template_name="$template_override"
             printf '%sStep 3 of 4: Template%s\n' "$_QS_BOLD" "$_QS_NC"
@@ -1174,25 +1396,85 @@ cmd_quickstart() {
             printf '  Selected %s (top match) for "%s".\n\n' "${top3[0]}" "$brief"
         fi
 
+        # An explicit rejection is honored, never converted into a selection.
+        # This arm used to be absent, so "none" fell through to `*)` and became
+        # top3[0] -- the founder-reported bug where typing "none" still built a
+        # todo app. With no template, the user's own brief becomes the spec.
+        if _qs_is_rejection "$pick"; then
+            if [ -z "$brief" ]; then
+                # Nothing to build from: no template AND no description. Refuse
+                # rather than invent a spec or silently fall back to a template.
+                printf '%sNo template selected and no description given; nothing to build.%s\n' "$_QS_RED" "$_QS_NC" >&2
+                printf 'Re-run: loki quickstart "<what you want>"\n' >&2
+                exit 2
+            fi
+            use_brief_as_spec=true
+            # Reaching the picker at all means this is NOT an existing codebase
+            # being changed: the brownfield arm skips the picker entirely, and
+            # the classifier-override arm above already set "new". Rejecting a
+            # template asks for a new project with no starting template.
+            spec_mode="new"
+            input_kind="change"
+            template_name="no-template"
+            printf '  No template. Using your description as the spec.\n\n'
+        else
         case "$pick" in
             ""|1) template_name="${top3[0]}";;
             2) template_name="${top3[1]:-${top3[0]}}";;
             3) template_name="${top3[2]:-${top3[0]}}";;
-            *) template_name="${top3[0]}";;  # any unexpected input -> the default
+            *) template_name="${top3[0]}";;  # any unrecognized NON-rejection input
         esac
+        fi
 
         fi
 
-        local tdir; tdir="$(_qs_templates_dir)"
-        prd_source="$tdir/$template_name.md"
-        if [ ! -f "$prd_source" ]; then
-            printf '%sTemplate file not found: %s%s\n' "$_QS_RED" "$prd_source" "$_QS_NC" >&2
-            exit 1
+        if [ "$use_brief_as_spec" != true ]; then
+            local tdir; tdir="$(_qs_templates_dir)"
+            prd_source="$tdir/$template_name.md"
+            if [ ! -f "$prd_source" ]; then
+                printf '%sTemplate file not found: %s%s\n' "$_QS_RED" "$prd_source" "$_QS_NC" >&2
+                exit 1
+            fi
         fi
     else
         template_name="$(basename "$prd_source")"
     fi
 
+    # The change-request spec is staged OUTSIDE the working tree. It is derived
+    # from what the user typed, not authored by them, so landing it in the CWD
+    # would drop an unrequested file into an existing project -- and the ./prd.md
+    # overwrite prompt below exists precisely to keep quickstart from writing
+    # over a file the user already has. Staging in a temp file keeps the
+    # brownfield path write-free in the user's directory.
+    if [ "$use_brief_as_spec" = true ]; then
+        # The .md suffix is load-bearing, not cosmetic. cmd_start classifies a
+        # positional via detect_arg_type (loki:1675): an extensionless path is
+        # only reached by the late `[ -e "$arg" ]` branch, and BOTH PRD
+        # existence guards (loki:2962, loki:2985) are `case` arms matching
+        # *.md|*.json|*.txt|*.yaml|*.yml, so an extensionless spec silently
+        # skips the fail-fast checks. Naming it .md puts classification on the
+        # explicit extension branch and under those guards.
+        # BSD mktemp (stock macOS) does NOT substitute the X-run when a suffix
+        # follows it: `mktemp foo.XXXXXX.md` creates the LITERAL file
+        # "foo.XXXXXX.md". That is a fixed name, so a second concurrent
+        # quickstart would fail to create it and the build would never start.
+        # Create with a bare X-run (portable, unique), then rename to add .md.
+        local _qs_stage=""
+        _qs_stage="$(mktemp "${TMPDIR:-/tmp}/loki-quickstart-change.XXXXXX")" || {
+            printf '%sCould not stage the change request.%s\n' "$_QS_RED" "$_QS_NC" >&2
+            exit 1
+        }
+        if mv "$_qs_stage" "$_qs_stage.md" 2>/dev/null; then
+            prd_source="$_qs_stage.md"
+        else
+            prd_source="$_qs_stage"
+        fi
+        # Not trap-cleaned on purpose: cmd_start EXECS the runner and never
+        # returns here, and the runner must still be able to read this spec.
+        # It lives in TMPDIR under a mktemp name, so the OS reaps it.
+        _qs_write_change_prd "$prd_source" "$brief" "$spec_mode"
+    fi
+
     # ----- Step 4 of 4: Review the plan (reuse the slice-A estimator) --------
     printf '%sStep 4 of 4: Review the plan%s\n' "$_QS_BOLD" "$_QS_NC"
     # The plan is ALWAYS rendered, on both paths, from the same real estimator.
@@ -1280,8 +1562,14 @@ cmd_quickstart() {
     fi
 
     # ----- Land the PRD at ./prd.md (design 3.6) ----------------------------
+    # The change-request path deliberately lands NOTHING in the working tree.
+    # The user asked for a change to code that already exists; dropping a
+    # generated prd.md into their project is the unrequested write that made the
+    # original bug worse. The staged spec is handed to cmd_start directly.
     local target="./prd.md"
-    if [ -e "$target" ]; then
+    if [ "$use_brief_as_spec" = true ]; then
+        target="$prd_source"
+    elif [ -e "$target" ]; then
         local overwrite=""
         # Non-interactive never asks and never overwrites. Leaving $overwrite
         # empty falls into the existing suffix walk below, which is already the
@@ -1338,6 +1626,10 @@ cmd_quickstart() {
             return 2
         fi
         rm -f "$preview_stage"
+    elif [ "$use_brief_as_spec" = true ]; then
+        # $target IS $prd_source here (the staged change request); copying a
+        # file onto itself would truncate it.
+        :
     elif ! cp "$prd_source" "$target" 2>/dev/null; then
         printf '%sCould not write the PRD to the current directory. Try a writable directory.%s\n' "$_QS_RED" "$_QS_NC" >&2
         exit 1
@@ -1345,7 +1637,12 @@ cmd_quickstart() {
 
     printf '\n'
     printf 'Starting your build. Progress streams here in the terminal.\n'
-    printf '  PRD saved to: %s\n' "$target"
+    if [ "$use_brief_as_spec" = true ]; then
+        printf '  Change request: %s\n' "$brief"
+        printf '  No file was written to your project directory.\n'
+    else
+        printf '  PRD saved to: %s\n' "$target"
+    fi
     # `loki dashboard` with no subcommand prints help and exits -- it does not
     # start. Naming the bare command here sent every first-run user to a help
     # screen at the exact moment they wanted to watch their build.

package/autonomy/run.sh

@@ -1181,10 +1181,12 @@ PERPETUAL_MODE=${LOKI_PERPETUAL_MODE:-false}
 #
 # MEASURED, not chosen. Real per-iteration wall clock across every recorded run
 # on this machine: median 718s, max 1746s. So the 1000 default is an 8.3-DAY
-# ceiling -- and it is the ONLY backstop, because the other two valves ship
-# disabled: LOKI_BUDGET_LIMIT defaults to "" (check_budget_limit returns
-# immediately) and LOKI_MAX_DURATION defaults to 0 (check_max_duration returns
-# "never stop").
+# ceiling. When this analysis was written it was also the ONLY backstop,
+# because the other two valves shipped disabled. That is no longer true of the
+# budget: since v9.42.0 LOKI_BUDGET_LIMIT defaults to "100.00" (see :527 --
+# note `-` not `:-`, so only an EXPLICIT "" means unlimited), and breaching it
+# pauses the run. LOKI_MAX_DURATION does still default to 0 (check_max_duration
+# returns "never stop" at :18278).
 #
 # It also contradicts our own documentation. SETUP.md tells users to RAISE the
 # budget for large work with LOKI_MAX_ITERATIONS=40, and the demo uses 10 -- so
@@ -17860,6 +17862,43 @@ BUDGETUPD_EOF
         return 0
     fi
 
+    # LIVE COST VISIBILITY. The loop has always computed cumulative spend here,
+    # every iteration, and printed NOTHING until 80% of the cap. That silence is
+    # the "predatory / un-capped" feeling users report about agentic tools: the
+    # enforcement was never missing (the cap pauses at 100.00 by default), only
+    # the visibility was, so spend was discoverable solely after the fact.
+    #
+    # Reuses the $current_cost computed above; deliberately NOT a second reader.
+    # Two readers of one number disagreeing is the exact defect class fixed in
+    # 405da630, and a per-iteration cost line is not worth reintroducing it.
+    #
+    # Safe on stdout: this function has exactly two non-comment references in
+    # the file -- its own definition, and the single loop call site, which
+    # tests the exit code and never captures output. Verified with a
+    # comment-excluding grep plus a positive control.
+    #
+    # This comment deliberately does NOT spell out the call-site expression.
+    # tests/test-max-duration.sh:151 counts that exact string across this file
+    # and asserts there is exactly ONE, so quoting it here made the count 2 and
+    # turned a green suite red -- a text guard firing on prose written to
+    # explain it. Describe the call site; never reproduce it.
+    #
+    # log_info is additionally gated by _loki_log_enabled, so quiet modes stay
+    # quiet.
+    # The zero test must be NUMERIC. `[ "$current_cost" != "0" ]` is a string
+    # compare and the python above emits "0.0", so a run with nothing recorded
+    # would announce "Cost so far: $0.0" -- claiming a measurement we do not
+    # have, which is the exact fabrication this codebase deletes on sight.
+    #
+    # No else-branch: BUDGET_LIMIT empty means unlimited, and check_budget_limit
+    # returns at its first line in that case, so any "no cap set" arm here would
+    # be unreachable code advertising a message that can never print. The
+    # no-cap disclosure already lives at run-start (show_run_start_estimate).
+    if [ -n "$current_cost" ] \
+       && awk -v c="$current_cost" 'BEGIN{exit !(c+0 > 0)}' 2>/dev/null; then
+        log_info "Cost so far: \$${current_cost} of \$${BUDGET_LIMIT} cap (iteration ${ITERATION_COUNT:-0})."
+    fi
+
     # Update budget.json with current usage (not exceeded)
     if [ -n "$current_cost" ] && [ "$current_cost" != "0" ]; then
         cat > ".loki/metrics/budget.json" << BUDGETUPD_EOF

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.48.2"
+__version__ = "9.49.3"
 
 # Expose the control app for easy import
 try:

package/dashboard/static/index.html

@@ -2444,7 +2444,11 @@ var LokiDashboard=(()=>{var Ie=Object.defineProperty;var zt=Object.getOwnPropert
           PASSED
         </div>
       </div>
-    `}_renderJourney(){if(this._journeyState==="unavailable")return'<div class="journey-state" role="status">Issue-to-PR evidence is unavailable. No readiness claim can be made.</div>';if(this._journeyState!=="ready"||!this._journeyProof)return'<div class="journey-state" role="status">No issue-to-PR receipt yet. Start an issue run to record its first result, proof, and PR state.</div>';let e=this._journeyProof,t=e?.facts?.journey;if(!t||!t.issue)return'<div class="journey-state" role="status">Latest receipt is not an issue run. Issue-to-PR readiness is not applicable.</div>';let i=t.time_to_first_result_sec,a=typeof i=="number"&&i>=0,s=t.first_result_kind==="code_change"?"verified patch":t.first_result_kind==="proposed_solution_plan"?"proposed solution":"result",r=a?`${Math.round(i)}s to ${s}`:"Not measured",o=typeof e?.honesty?.headline=="string"?e.honesty.headline:null,n=Array.isArray(e?.honesty?.degraded)?e.honesty.degraded.length:null,l=o||"Not evaluated",c=n===null?"Uncertainty not measured":n===0?"No recorded gaps":`${n} recorded gap${n===1?"":"s"}`,p=t.pull_request,u="Not prepared",m="";p&&p.state&&(u=String(p.state).replace(/_/g," "),this._isSafeWebUrl(p.url)&&(m=`<a class="journey-link" href="${this._escapeHtml(p.url)}" target="_blank" rel="noopener noreferrer">Open PR</a>`));let g=this._data.phase||(this._data.status==="running"?"In progress":"Run complete");return`
+    `}_renderDisconnected(){return`<div class="journey-state" role="status">
+      Not connected to the Loki API. No session numbers can be shown until it
+      reconnects. Start it with <code>loki dashboard start</code>, or check the
+      API URL in Settings.
+    </div>`}_renderJourney(){if(this._journeyState==="unavailable")return'<div class="journey-state" role="status">Issue-to-PR evidence is unavailable. No readiness claim can be made.</div>';if(this._journeyState!=="ready"||!this._journeyProof)return'<div class="journey-state" role="status">No issue-to-PR receipt yet. Start an issue run to record its first result, proof, and PR state.</div>';let e=this._journeyProof,t=e?.facts?.journey;if(!t||!t.issue)return'<div class="journey-state" role="status">Latest receipt is not an issue run. Issue-to-PR readiness is not applicable.</div>';let i=t.time_to_first_result_sec,a=typeof i=="number"&&i>=0,s=t.first_result_kind==="code_change"?"verified patch":t.first_result_kind==="proposed_solution_plan"?"proposed solution":"result",r=a?`${Math.round(i)}s to ${s}`:"Not measured",o=typeof e?.honesty?.headline=="string"?e.honesty.headline:null,n=Array.isArray(e?.honesty?.degraded)?e.honesty.degraded.length:null,l=o||"Not evaluated",c=n===null?"Uncertainty not measured":n===0?"No recorded gaps":`${n} recorded gap${n===1?"":"s"}`,p=t.pull_request,u="Not prepared",m="";p&&p.state&&(u=String(p.state).replace(/_/g," "),this._isSafeWebUrl(p.url)&&(m=`<a class="journey-link" href="${this._escapeHtml(p.url)}" target="_blank" rel="noopener noreferrer">Open PR</a>`));let g=this._data.phase||(this._data.status==="running"?"In progress":"Run complete");return`
       <section class="journey" aria-labelledby="journey-heading">
         <div class="journey-heading" id="journey-heading">Issue to PR</div>
         <div class="journey-steps">
@@ -2633,6 +2637,7 @@ var LokiDashboard=(()=>{var Ie=Object.defineProperty;var zt=Object.getOwnPropert
           <span class="overview-title">Overview</span>
         </div>
 
+        ${this._data.connected?`
         ${this._renderJourney()}
 
         <div class="overview-grid">
@@ -2687,6 +2692,7 @@ var LokiDashboard=(()=>{var Ie=Object.defineProperty;var zt=Object.getOwnPropert
             <div class="card-value small-text">${p}</div>
           </div>
         </div>
+        `:this._renderDisconnected()}
       </div>
     `}};customElements.get("loki-overview")||customElements.define("loki-overview",X);var Ft=[{id:"pending",label:"Pending",status:"pending",color:"var(--loki-text-muted)"},{id:"in_progress",label:"In Progress",status:"in_progress",color:"var(--loki-blue)"},{id:"review",label:"In Review",status:"review",color:"var(--loki-purple)"},{id:"done",label:"Completed",status:"done",color:"var(--loki-green)"}],Z=class d extends v{static get observedAttributes(){return["api-url","project-id","theme","readonly"]}constructor(){super(),this._tasks=[],this._loading=!0,this._error=null,this._draggedTask=null,this._selectedTask=null,this._expandedCards=new Set,this._selectedTasks=new Set,this._bulkMode=!1,this._activeFilter="all",this._searchQuery="",this._visibleCounts={},this._api=null,this._state=N()}static get PAGE_SIZE(){return 10}_getVisibleCount(e){let t=this._visibleCounts[e];return typeof t=="number"&&t>0?t:d.PAGE_SIZE}_showMore(e){this._visibleCounts[e]=this._getVisibleCount(e)+d.PAGE_SIZE,this.render()}_columnIcon(e){switch(e){case"pending":return'<circle cx="12" cy="12" r="10"/>';case"in_progress":return'<path d="M12 2v4M12 18v4M4.93 4.93l2.83 2.83M16.24 16.24l2.83 2.83M2 12h4M18 12h4M4.93 19.07l2.83-2.83M16.24 7.76l2.83-2.83"/>';case"review":return'<path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/>';case"done":return'<path d="M22 11.08V12a10 10 0 11-5.93-9.14"/><polyline points="22 4 12 14.01 9 11.01"/>';default:return'<circle cx="12" cy="12" r="10"/>'}}connectedCallback(){super.connectedCallback(),this._setupApi(),this._loadTasks()}disconnectedCallback(){super.disconnectedCallback(),this._teardownApiListeners()}_teardownApiListeners(){this._api&&this._onTaskEvent&&(this._api.removeEventListener(f.TASK_CREATED,this._onTaskEvent),this._api.removeEventListener(f.TASK_UPDATED,this._onTaskEvent),this._api.removeEventListener(f.TASK_DELETED,this._onTaskEvent))}attributeChangedCallback(e,t,i){t!==i&&(e==="api-url"&&this._api&&(this._teardownApiListeners(),this._setupApi(),this._loadTasks()),e==="project-id"&&this._loadTasks(),e==="theme"&&this._applyTheme())}_setupApi(){let e=this.getAttribute("api-url")||window.location.origin;this._api=h({baseUrl:e}),this._onTaskEvent=()=>this._loadTasks(),this._api.addEventListener(f.TASK_CREATED,this._onTaskEvent),this._api.addEventListener(f.TASK_UPDATED,this._onTaskEvent),this._api.addEventListener(f.TASK_DELETED,this._onTaskEvent)}async _loadTasks(){let e=this._api;this._loading=!0,this._error=null,this.render();try{let t=this.getAttribute("project-id"),i=t?{projectId:parseInt(t)}:{},a=await e.listTasks(i);if(e!==this._api)return;this._tasks=a;let s=this._state.get("localTasks")||[];s.length>0&&(this._tasks=[...this._tasks,...s.map(r=>({...r,isLocal:!0}))]),this._state.update({"cache.tasks":this._tasks},!1)}catch(t){if(e!==this._api)return;this._error=t.message,this._tasks=(this._state.get("localTasks")||[]).map(i=>({...i,isLocal:!0}))}this._loading=!1,this.render()}_getTasksByStatus(e){return this._getFilteredTasks().filter(i=>i.status?.toLowerCase().replace(/-/g,"_")===e)}_handleDragStart(e,t){this.hasAttribute("readonly")||(this._draggedTask=t,e.target.classList.add("dragging"),e.dataTransfer.effectAllowed="move",e.dataTransfer.setData("text/plain",t.id.toString()))}_handleDragEnd(e){e.target.classList.remove("dragging"),this._draggedTask=null,this.shadowRoot.querySelectorAll(".kanban-tasks").forEach(t=>{t.classList.remove("drag-over")})}_handleDragOver(e){e.preventDefault(),e.dataTransfer.dropEffect="move"}_handleDragEnter(e){e.preventDefault(),e.currentTarget.classList.add("drag-over")}_handleDragLeave(e){e.currentTarget.contains(e.relatedTarget)||e.currentTarget.classList.remove("drag-over")}async _handleDrop(e,t){if(e.preventDefault(),e.currentTarget.classList.remove("drag-over"),!this._draggedTask||this.hasAttribute("readonly"))return;let i=this._draggedTask.id,a=this._tasks.find(r=>r.id===i);if(!a)return;let s=a.status;if(s!==t){a.status=t,this.render();try{a.isLocal?this._state.moveLocalTask(i,t):await this._api.moveTask(i,t,0),this.dispatchEvent(new CustomEvent("task-moved",{detail:{taskId:i,oldStatus:s,newStatus:t}}))}catch(r){a.status=s,this.render(),console.error("Failed to move task:",r)}}}_toggleCardExpand(e){this._expandedCards.has(e)?this._expandedCards.delete(e):this._expandedCards.add(e),this.render()}_toggleTaskSelection(e,t){t&&t.stopPropagation(),this._selectedTasks.has(e)?this._selectedTasks.delete(e):this._selectedTasks.add(e),this.render()}_toggleBulkMode(){this._bulkMode=!this._bulkMode,this._bulkMode||this._selectedTasks.clear(),this.render()}async _bulkMove(e){let t=[...this._selectedTasks];for(let i of t){let a=this._tasks.find(s=>String(s.id)===String(i));if(a&&a.status!==e)try{a.isLocal?this._state.moveLocalTask(i,e):await this._api.moveTask(i,e,0),a.status=e}catch(s){console.error("Failed to bulk move task:",i,s)}}this._selectedTasks.clear(),this._bulkMode=!1,this.render(),this._loadTasks()}async _bulkDelete(){let e=[...this._selectedTasks];for(let t of e)try{await this._api.deleteTask(t)}catch(i){console.error("Failed to delete task:",t,i)}this._selectedTasks.clear(),this._bulkMode=!1,this._loadTasks()}_setFilter(e){this._activeFilter=e,this._visibleCounts={},this.render()}_setSearch(e){this._searchQuery=e||"",this._visibleCounts={},this._renderTaskRegion();let t=this.shadowRoot.getElementById("task-search");if(t){t.focus();let i=t.value.length;try{t.setSelectionRange(i,i)}catch{}}}_getFilteredTasks(){let e=[...this._tasks],t=new Date,i=new Date(t.getFullYear(),t.getMonth(),t.getDate()),a=new Date(i.getTime()-7*24*60*60*1e3);switch(this._activeFilter){case"today":e=e.filter(r=>{let o=r.created_at?new Date(r.created_at):null;return o&&o>=i});break;case"this-week":e=e.filter(r=>{let o=r.created_at?new Date(r.created_at):null;return o&&o>=a});break;case"running":e=e.filter(r=>r.status==="in_progress");break;case"failed":e=e.filter(r=>r.status==="failed"||r.status==="error");break;default:break}let s=this._searchQuery.trim().toLowerCase();return s&&(e=e.filter(r=>[r.id,r.title,r.description,r.type].map(n=>String(n??"").toLowerCase()).join(" ").includes(s))),e}_openAddTaskModal(e="pending"){this.dispatchEvent(new CustomEvent("add-task",{detail:{status:e}}))}_openTaskDetail(e){this._selectedTask=e,this.render(),this.dispatchEvent(new CustomEvent("task-click",{detail:{task:e}}))}_closeTaskDetail(){this._selectedTask=null,this.render()}_renderMarkdown(e){return C(e)}_formatTimestamp(e){if(!e)return"";try{let t=new Date(e);return isNaN(t.getTime())?this._escapeHtml(String(e)):t.toLocaleString()}catch{return this._escapeHtml(String(e))}}_phaseClass(e){let t=String(e||"").toLowerCase();return["reason","plan","planning"].includes(t)?"phase-reason":["act","execute","execution","implement"].includes(t)?"phase-act":["reflect","review"].includes(t)?"phase-reflect":["verify","test","gate"].includes(t)?"phase-verify":"phase-default"}_logLevelClass(e){let t=String(e||"info").toLowerCase();return t==="error"||t==="fatal"?"log-error":t==="warn"||t==="warning"?"log-warn":t==="debug"||t==="trace"?"log-debug":"log-info"}_renderTaskDetailModal(e){if(!e)return"";let t=(e.priority||"medium").toLowerCase(),i=t.charAt(0).toUpperCase()+t.slice(1),a=e.status||"pending",s=a.replace(/_/g," ").replace(/\b\w/g,g=>g.toUpperCase()),r=e.metadata||{},o=Array.isArray(e.acceptance_criteria)?e.acceptance_criteria:[],n=Array.isArray(e.context_files)?e.context_files:[],l=e.specification||"",c=e.description||"",p=Array.isArray(e.notes)?e.notes:[],u=Array.isArray(e.logs)?e.logs:[],m=e.full_content||"";return`
       <div class="modal-overlay" id="task-detail-overlay">

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.48.2
+**Version:** v9.49.3
 
 ---
 

package/docs/KNOWN-ISSUES.md

@@ -0,0 +1,42 @@
+
+## doctor --json writes 108 bytes to stderr on a provider-less host
+
+`bash autonomy/loki doctor --json` on a host with NO provider CLI emits:
+
+```
+autonomy/loki: line 14066: required: command not found
+autonomy/loki: line 14066: status: command not found
+```
+
+**Not user-affecting, and not a JSON defect.** stdout is 5176 bytes of valid
+JSON; only stderr is polluted. Every `doctor --json` assertion in the repo
+discards stderr (`tests/test-airgap-commands.sh:50`,
+`tests/test-doctor-blocker-parity.sh:129,132`,
+`tests/test-doctor-ci-gateable.sh:46,84,86`).
+`tests/test-e2e-features.sh:104` was the lone outlier using `2>&1` and has been
+brought into line.
+
+**Attribution:** introduced this session. `git show 0416810d:autonomy/loki`
+(v9.48.2) emits 0 bytes on the same host; HEAD emits 108. The region was last
+touched by `56e03374 feat(doctor): show provider availability`.
+
+**Six hypotheses tested and REFUTED, so the next person does not repeat them:**
+
+1. Word-splitting of `$_provider_availability` at `:14066` -- the assignment is
+   correctly quoted; reproduced in isolation as OK.
+2. `provider_availability_json` emitting to stderr -- 0 bytes, clean 353-byte
+   JSON in isolation.
+3. Its callees `auto_detect_provider` / `check_provider_installed` -- both
+   silent.
+4. The JSON value's content -- `required` and `status` appear 0 times in it.
+5. The value being multi-line and breaking the env-assignment chain -- forcing
+   `LOKI_PROVIDER_AVAILABILITY=""` as a literal STILL reproduces.
+6. `render_provider_availability` -- silent in isolation, and disabling the call
+   still reproduces.
+
+**Also known:** `bash -n` parses the file clean; sourcing the file and calling
+`cmd_doctor_json` directly emits 0 bytes, while executing the file emits 108.
+That difference (streaming read vs single parse) is the strongest remaining
+lead. The words `required` and `status` are python identifiers at `:14085-14098`
+inside the `python3 -c "` string that opens at `:14069`.
+

package/docs/cost-controls.md

@@ -25,7 +25,7 @@ They bound different things, and a run that stalls needs all three.
 
 | Cap | Bounds | Default |
 |---|---|---|
-| `LOKI_BUDGET_LIMIT` | Total spend, in USD | unset (no cap) |
+| `LOKI_BUDGET_LIMIT` | Total spend, in USD | `100.00` (breaching pauses the run) |
 | `LOKI_MAX_ITERATIONS` | Number of iterations | 1000 |
 | `LOKI_MAX_DURATION` | Wall-clock time | unset (no cap) |
 

package/docs/environment-variables.md

@@ -23,7 +23,7 @@ with nowhere to look them up.
 |---|---|---|
 | `LOKI_PRD_FILE` | none | Path to a spec file, as an alternative to the positional argument. |
 | `LOKI_MAX_ITERATIONS` | `1000` | Hard cap on iterations. Reaching it is a deterministic terminal failure, not a success. Also in `config schema`. |
-| `LOKI_BUDGET_LIMIT` | unset (no cap) | Spend cap in USD. On exhaustion the run stops and reports a terminal failure -- see [exit codes](./exit-codes.md). |
+| `LOKI_BUDGET_LIMIT` | `100.00` | Spend cap in USD. Breaching it **pauses** the run (writes `.loki/PAUSE` and saves state); it never kills work or discards a deliverable. Remove `.loki/PAUSE` to resume, or raise the cap. Set to `""` for no cap. A warning is logged at 80%. |
 | `LOKI_MAX_DURATION` | unset (no cap) | Wall-clock cap in seconds. Stops cleanly at the next iteration boundary with a `max_duration_reached` terminal status. `loki start --max-duration` also accepts `90m` / `2h`. |
 | `LOKI_AUTO_CONFIRM` | unset | `true`/`false` to control prompts. Takes precedence over `CI`. |
 | `LOKI_CONFIG_DUMP` | `0` | `1` prints the resolved configuration and exits **without starting a run or spending anything**. |