loki-mode 9.49.2 → 9.49.4

package/.github/workflows/loki-issue-to-pr.yml

@@ -61,7 +61,7 @@ jobs:
         # Pinned to a TAG, not @main. A moving ref would hand every user
         # whatever main holds at the moment their issue is labeled, including a
         # half-landed release. Bump this line deliberately.
-        uses: asklokesh/loki-mode/.github/actions/issue-to-pr@v9.49.2
+        uses: asklokesh/loki-mode/.github/actions/issue-to-pr@v9.49.4
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
         with:

package/README.md

@@ -532,14 +532,14 @@ Required:
 
 - An agent provider CLI: [Claude Code](https://docs.claude.com/en/docs/claude-code) (`claude`, Tier 1, recommended and E2E-verified - the provider Loki Mode is built for). Cline, Codex, Aider, and opencode are supported as experimental providers (wiring in place; not yet E2E-verified by us). Loki cannot run a build without one of these installed and authenticated.
 - Python 3.10+ (`python3`) for the dashboard, memory system, and orchestration helpers.
+- Node.js 18+ (`node`) for the npm install path and the bundled runtime.
+- `jq` for the JSON that the shell flows and the quality gates parse.
 - Git 2.x (`git`) for checkpoints and worktrees.
 - `curl` for installation and network calls.
 
 Recommended:
 
 - Bun 1.3.0+ (`bun`) for the fast runtime (the recommended install path above installs it).
-- Node.js 18+ and npm if you install via npm instead of Bun.
-- `jq` for nicer JSON handling in shell flows.
 - Docker if you want Loki's App Runner to run containerized projects, or to run Loki itself from the published image.
 
 You also need credentials for whichever provider you use (for Claude Code, an authenticated `claude` login or `ANTHROPIC_API_KEY`). `loki doctor` flags a missing or unauthenticated provider as the first thing to fix.

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.49.2
+# Loki Mode v9.49.4
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.49.2 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.49.4 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.49.2
+9.49.4

package/autonomy/lib/claude-flags.sh

@@ -51,7 +51,21 @@ loki_effort_for_tier() {
 
 # ---------- Remaining budget ----------
 # Compute remaining budget = LOKI_BUDGET_LIMIT - cumulative spend so far.
-# Spend lives in .loki/metrics/budget.json under "current_spend" (per autonomy/run.sh:8167+).
+# Spend lives in .loki/metrics/budget.json under "budget_used".
+#
+# It was read as "current_spend" until v9.50.0, a key NO production writer has
+# ever emitted. All six writers of that file (run.sh:6581,17851,17869,
+# loki-ts/src/runner/budget.ts:267, dashboard/server.py:7953, autonomy/loki)
+# write "budget_used". The old citation pointed at run.sh:8167+, which is
+# per-iteration token parsing and writes no budget key at all.
+#
+# Effect of the bug: spend always read 0, so --max-budget-usd was handed the
+# FULL cap on every call instead of the remainder, and the per-call backstop
+# never tightened as spend accumulated. Only reachable for users who set
+# LOKI_BUDGET_LIMIT explicitly (run.sh sets BUDGET_LIMIT, not LOKI_*), i.e.
+# exactly the cost-conscious users who asked for the cap.
+# "current_spend" is still accepted as a fallback so a budget.json written by
+# an in-flight older run still parses.
 # Emit empty string when budget is unlimited (LOKI_BUDGET_LIMIT unset or 0).
 # Emit empty when remaining <= 0 (caller decides what to do; we never emit 0).
 loki_remaining_budget() {
@@ -71,7 +85,9 @@ import json, os, sys
 try:
     with open(os.environ["_LOKI_BUDGET_FILE"]) as f:
         d = json.load(f)
-    v = d.get("current_spend", 0)
+    v = d.get("budget_used")
+    if v is None:
+        v = d.get("current_spend", 0)
     print(float(v))
 except Exception:
     print(0)

package/autonomy/lib/proof-verify.py

@@ -324,7 +324,8 @@ def _compute_headline(facts, degraded):
         or tests.get("status") == "failed"
         or build.get("status") == "failed"
         or any(g.get("status") == "failed"
-               for g in (facts.get("quality_gates") or []))
+               for g in (facts.get("quality_gates") or [])
+               if _is_exogenous(g))
         or sec_high
         or fn_failed
     )
@@ -342,7 +343,8 @@ def _compute_headline(facts, degraded):
         tests.get("status") == "verified"
         or build.get("status") == "verified"
         or any(g.get("status") == "passed"
-               for g in (facts.get("quality_gates") or []))
+               for g in (facts.get("quality_gates") or [])
+               if _is_exogenous(g))
     )
     if any_verified and degraded:
         return "VERIFIED WITH GAPS"

package/autonomy/notification-checker.py

@@ -165,7 +165,15 @@ def check_budget_threshold(trigger, loki_dir, iteration, notifications):
         state = json.loads(state_file.read_text())
         budget = state.get("budget", {})
         limit = budget.get("limit", 0)
-        used = budget.get("used", 0)
+        # run.sh:7084 nests .loki/metrics/budget.json verbatim under "budget",
+        # and that file's spend key is "budget_used". Reading only "used" meant
+        # this trigger never fired in production: verified against the exact
+        # state run.sh writes, 0 notifications were produced at 85% of cap.
+        # "used" stays as a fallback for the /api/cost-shaped payload
+        # (autonomy/loki:28122), which does write that key.
+        used = budget.get("budget_used")
+        if used is None:
+            used = budget.get("used", 0)
         if limit <= 0:
             return None
         pct = (used / limit) * 100
@@ -241,24 +249,44 @@ def check_file_access(trigger, loki_dir, iteration, notifications):
 
 
 def check_quality_gate(trigger, loki_dir, iteration, notifications):
-    """Check for quality gate failures. Reports ALL failed gates, not just first."""
-    state_file = Path(loki_dir) / "dashboard-state.json"
-    if not state_file.exists():
-        return []
-
+    """Check for quality gate failures. Reports ALL failed gates, not just first.
+
+    Reads .loki/quality/gate-failures.txt, which is what run.sh actually writes
+    (:24100, :24142, :24553) as a comma-terminated list of failing gate names,
+    e.g. "mock_integrity,".
+
+    This previously read state["qualityGates"] out of dashboard-state.json,
+    sourced from .loki/state/quality-gates.json (run.sh:6972). NOTHING writes
+    that file: all seven repo references are readers, autonomy/hooks/
+    quality-gate.sh:12 guards on `[ ! -f ]`, and proof-generator.py:345 records
+    the same finding as issue #125 and already works around it by reading these
+    per-gate artifacts. The aggregate was therefore always absent, qualityGates
+    was always null, and this trigger could never fire -- the same dead-reader
+    defect as the budget key, in the same file.
+
+    gate-failures.txt is the canonical failure source used by
+    proof-generator.py:413 and loki-ts build_prompt_helpers.ts:250, so this
+    reuses a proven contract rather than introducing a second one.
+    """
+    failures_file = Path(loki_dir) / "quality" / "gate-failures.txt"
     results = []
     try:
-        state = json.loads(state_file.read_text())
-        gates = state.get("qualityGates", {})
-        if isinstance(gates, dict):
-            for gate_name, gate_data in gates.items():
-                if isinstance(gate_data, dict) and gate_data.get("status") == "failed":
-                    msg = trigger["message"].format(gate=gate_name)
-                    results.append(make_notification(
-                        trigger["id"], trigger["severity"], msg, iteration,
-                        {"gate": gate_name},
-                    ))
-    except (json.JSONDecodeError, OSError, KeyError):
+        if failures_file.exists():
+            # Cap the read: a pathological file must not be loaded whole
+            # (same reason as build_prompt.ts:707).
+            raw = failures_file.read_text(errors="replace")[:8000]
+            seen = set()
+            for name in raw.replace("\n", ",").split(","):
+                gate_name = name.strip()
+                if not gate_name or gate_name in seen:
+                    continue
+                seen.add(gate_name)
+                msg = trigger["message"].format(gate=gate_name)
+                results.append(make_notification(
+                    trigger["id"], trigger["severity"], msg, iteration,
+                    {"gate": gate_name},
+                ))
+    except (OSError, KeyError):
         pass
     return results if results else None
 

package/autonomy/run.sh

@@ -1181,10 +1181,12 @@ PERPETUAL_MODE=${LOKI_PERPETUAL_MODE:-false}
 #
 # MEASURED, not chosen. Real per-iteration wall clock across every recorded run
 # on this machine: median 718s, max 1746s. So the 1000 default is an 8.3-DAY
-# ceiling -- and it is the ONLY backstop, because the other two valves ship
-# disabled: LOKI_BUDGET_LIMIT defaults to "" (check_budget_limit returns
-# immediately) and LOKI_MAX_DURATION defaults to 0 (check_max_duration returns
-# "never stop").
+# ceiling. When this analysis was written it was also the ONLY backstop,
+# because the other two valves shipped disabled. That is no longer true of the
+# budget: since v9.42.0 LOKI_BUDGET_LIMIT defaults to "100.00" (see :527 --
+# note `-` not `:-`, so only an EXPLICIT "" means unlimited), and breaching it
+# pauses the run. LOKI_MAX_DURATION does still default to 0 (check_max_duration
+# returns "never stop" at :18278).
 #
 # It also contradicts our own documentation. SETUP.md tells users to RAISE the
 # budget for large work with LOKI_MAX_ITERATIONS=40, and the demo uses 10 -- so
@@ -17860,6 +17862,43 @@ BUDGETUPD_EOF
         return 0
     fi
 
+    # LIVE COST VISIBILITY. The loop has always computed cumulative spend here,
+    # every iteration, and printed NOTHING until 80% of the cap. That silence is
+    # the "predatory / un-capped" feeling users report about agentic tools: the
+    # enforcement was never missing (the cap pauses at 100.00 by default), only
+    # the visibility was, so spend was discoverable solely after the fact.
+    #
+    # Reuses the $current_cost computed above; deliberately NOT a second reader.
+    # Two readers of one number disagreeing is the exact defect class fixed in
+    # 405da630, and a per-iteration cost line is not worth reintroducing it.
+    #
+    # Safe on stdout: this function has exactly two non-comment references in
+    # the file -- its own definition, and the single loop call site, which
+    # tests the exit code and never captures output. Verified with a
+    # comment-excluding grep plus a positive control.
+    #
+    # This comment deliberately does NOT spell out the call-site expression.
+    # tests/test-max-duration.sh:151 counts that exact string across this file
+    # and asserts there is exactly ONE, so quoting it here made the count 2 and
+    # turned a green suite red -- a text guard firing on prose written to
+    # explain it. Describe the call site; never reproduce it.
+    #
+    # log_info is additionally gated by _loki_log_enabled, so quiet modes stay
+    # quiet.
+    # The zero test must be NUMERIC. `[ "$current_cost" != "0" ]` is a string
+    # compare and the python above emits "0.0", so a run with nothing recorded
+    # would announce "Cost so far: $0.0" -- claiming a measurement we do not
+    # have, which is the exact fabrication this codebase deletes on sight.
+    #
+    # No else-branch: BUDGET_LIMIT empty means unlimited, and check_budget_limit
+    # returns at its first line in that case, so any "no cap set" arm here would
+    # be unreachable code advertising a message that can never print. The
+    # no-cap disclosure already lives at run-start (show_run_start_estimate).
+    if [ -n "$current_cost" ] \
+       && awk -v c="$current_cost" 'BEGIN{exit !(c+0 > 0)}' 2>/dev/null; then
+        log_info "Cost so far: \$${current_cost} of \$${BUDGET_LIMIT} cap (iteration ${ITERATION_COUNT:-0})."
+    fi
+
     # Update budget.json with current usage (not exceeded)
     if [ -n "$current_cost" ] && [ "$current_cost" != "0" ]; then
         cat > ".loki/metrics/budget.json" << BUDGETUPD_EOF

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.49.2"
+__version__ = "9.49.4"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -261,16 +261,16 @@ def _real_client_host(request: Request):
     client = getattr(request, "client", None)
     host = getattr(client, "host", None) if client else None
     if host is None:
-        return None
+        return None, False
     if host in _trusted_proxies():
         fwd = request.headers.get("x-forwarded-for", "")
         first = fwd.split(",")[0].strip()
         if first:
-            return first
-    return host
+            return first, True
+    return host, False
 
 
-def _is_local_caller(host) -> bool:
+def _is_local_caller(host, from_forwarded: bool = False) -> bool:
     """True only for a caller we can positively identify as non-routable.
 
     A peer that is not an IP literal (ASGI test transports report
@@ -285,7 +285,18 @@ def _is_local_caller(host) -> bool:
     try:
         return ipaddress.ip_address(host).is_loopback
     except ValueError:
-        return True
+        # A DIRECT peer that is not an IP literal is genuinely local: ASGI test
+        # transports report "testclient" and UDS transports report names, and
+        # refusing those closes no hole while breaking 17 tests.
+        #
+        # A FORWARDED value is different in kind. It arrived inside a request
+        # header, so treating an unparseable one as local lets any caller behind
+        # a trusted proxy pass the local check by sending a non-IP token.
+        # Measured: with LOKI_TRUSTED_PROXIES set, "not-an-ip", "unknown" and
+        # "testclient" all returned local, while an empty value correctly did
+        # not. "unknown" is a literal some proxies emit when the client address
+        # is unavailable, so this is reachable without an attacker choosing it.
+        return not from_forwarded
 
 
 def require_local_or_authenticated(request: Request) -> None:
@@ -316,13 +327,13 @@ def require_local_or_authenticated(request: Request) -> None:
     """
     if auth.ENTERPRISE_AUTH_ENABLED or auth.OIDC_ENABLED:
         return
-    host = _real_client_host(request)
+    host, host_from_forwarded = _real_client_host(request)
     if host is None:
         raise HTTPException(
             status_code=403,
             detail="control requires an identifiable client; enable "
                    "LOKI_ENTERPRISE_AUTH to allow remote access")
-    if _is_local_caller(host):
+    if _is_local_caller(host, host_from_forwarded):
         return
     raise HTTPException(
         status_code=403,
@@ -1211,14 +1222,16 @@ class WebSocketBoundaryMiddleware:
         if not (auth.ENTERPRISE_AUTH_ENABLED or auth.OIDC_ENABLED):
             client = scope.get("client")
             host = client[0] if client else None
+            host_from_forwarded = False
             if host in _trusted_proxies():
                 for raw_name, raw_value in scope.get("headers", []):
                     if raw_name == b"x-forwarded-for":
                         first = raw_value.decode("latin-1").split(",")[0].strip()
                         if first:
                             host = first
+                            host_from_forwarded = True
                         break
-            if not _is_local_caller(host):
+            if not _is_local_caller(host, host_from_forwarded):
                 # 1008 = policy violation. Closing with a code beats an
                 # accept-then-drop, which reads to a client as a flaky network.
                 await send({"type": "websocket.close", "code": 1008})

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.49.2
+**Version:** v9.49.4
 
 ---
 

package/docs/P0-SWEEP-PLAN.md

@@ -42,7 +42,7 @@ Honest count after this sweep: 8 gates.
 | 5 | Mock Integrity Detector | enforce_mock_integrity -> tests/detect-mock-problems.sh | Yes (HIGH blocks) | LOKI_GATE_MOCK=false |
 | 6 | Test Mutation Detector | enforce_mutation_integrity -> tests/detect-test-mutations.sh | Yes (HIGH blocks) | LOKI_GATE_MUTATION=false |
 | 7 | Documentation Coverage | run_doc_quality_gate (run.sh:7388) | Yes | LOKI_GATE_DOC_COVERAGE=false |
-| 8 | Magic Modules Debate | run_magic_debate_gate (run.sh:7495) | Yes (BLOCK sev) | LOKI_GATE_MAGIC_DEBATE=false |
+| 8 | Magic Modules Debate | run_magic_debate_gate (run.sh:7495) | No, advisory by default. NOTE added 2026-09-13: this row said "Yes (BLOCK sev)" and that was never true on either route; bash enforces only with LOKI_GATE_MAGIC_DEBATE_BLOCKING=true and Bun self-skips unless LOKI_GATE_MAGIC_DEBATE="true". Line numbers in this document are as grep-verified in June 2026 and are left unchanged. | LOKI_GATE_MAGIC_DEBATE=false |
 
 Conditional auditor (documented separately, NOT numbered): Backward-Compatibility
 / legacy-healing-auditor (healing mode only). Removed: Input/Output Guardrails.

package/docs/cost-controls.md

@@ -25,7 +25,7 @@ They bound different things, and a run that stalls needs all three.
 
 | Cap | Bounds | Default |
 |---|---|---|
-| `LOKI_BUDGET_LIMIT` | Total spend, in USD | unset (no cap) |
+| `LOKI_BUDGET_LIMIT` | Total spend, in USD | `100.00` (breaching pauses the run) |
 | `LOKI_MAX_ITERATIONS` | Number of iterations | 1000 |
 | `LOKI_MAX_DURATION` | Wall-clock time | unset (no cap) |
 

package/docs/cursor-comparison.md

@@ -76,7 +76,7 @@ velocity_quality_balance:
 5. Mock Integrity Detector - HIGH blocks
 6. Test Mutation Detector - HIGH blocks
 7. Documentation Coverage
-8. Magic Modules Debate - BLOCK severity
+8. Magic Modules Debate - advisory by default on both routes (bash needs LOKI_GATE_MAGIC_DEBATE_BLOCKING=true; Bun self-skips unless LOKI_GATE_MAGIC_DEBATE="true")
 
 Conditional auditor (not numbered): backward-compatibility / legacy-healing-auditor (healing mode only).
 

package/docs/environment-variables.md

@@ -23,7 +23,7 @@ with nowhere to look them up.
 |---|---|---|
 | `LOKI_PRD_FILE` | none | Path to a spec file, as an alternative to the positional argument. |
 | `LOKI_MAX_ITERATIONS` | `1000` | Hard cap on iterations. Reaching it is a deterministic terminal failure, not a success. Also in `config schema`. |
-| `LOKI_BUDGET_LIMIT` | unset (no cap) | Spend cap in USD. On exhaustion the run stops and reports a terminal failure -- see [exit codes](./exit-codes.md). |
+| `LOKI_BUDGET_LIMIT` | `100.00` | Spend cap in USD. Breaching it **pauses** the run (writes `.loki/PAUSE` and saves state); it never kills work or discards a deliverable. Remove `.loki/PAUSE` to resume, or raise the cap. Set to `""` for no cap. A warning is logged at 80%. |
 | `LOKI_MAX_DURATION` | unset (no cap) | Wall-clock cap in seconds. Stops cleanly at the next iteration boundary with a `max_duration_reached` terminal status. `loki start --max-duration` also accepts `90m` / `2h`. |
 | `LOKI_AUTO_CONFIRM` | unset | `true`/`false` to control prompts. Takes precedence over `CI`. |
 | `LOKI_CONFIG_DUMP` | `0` | `1` prints the resolved configuration and exits **without starting a run or spending anything**. |