loki-mode 9.49.3 → 9.49.4

package/.github/workflows/loki-issue-to-pr.yml

@@ -61,7 +61,7 @@ jobs:
         # Pinned to a TAG, not @main. A moving ref would hand every user
         # whatever main holds at the moment their issue is labeled, including a
         # half-landed release. Bump this line deliberately.
-        uses: asklokesh/loki-mode/.github/actions/issue-to-pr@v9.49.3
+        uses: asklokesh/loki-mode/.github/actions/issue-to-pr@v9.49.4
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
         with:

package/README.md

@@ -532,14 +532,14 @@ Required:
 
 - An agent provider CLI: [Claude Code](https://docs.claude.com/en/docs/claude-code) (`claude`, Tier 1, recommended and E2E-verified - the provider Loki Mode is built for). Cline, Codex, Aider, and opencode are supported as experimental providers (wiring in place; not yet E2E-verified by us). Loki cannot run a build without one of these installed and authenticated.
 - Python 3.10+ (`python3`) for the dashboard, memory system, and orchestration helpers.
+- Node.js 18+ (`node`) for the npm install path and the bundled runtime.
+- `jq` for the JSON that the shell flows and the quality gates parse.
 - Git 2.x (`git`) for checkpoints and worktrees.
 - `curl` for installation and network calls.
 
 Recommended:
 
 - Bun 1.3.0+ (`bun`) for the fast runtime (the recommended install path above installs it).
-- Node.js 18+ and npm if you install via npm instead of Bun.
-- `jq` for nicer JSON handling in shell flows.
 - Docker if you want Loki's App Runner to run containerized projects, or to run Loki itself from the published image.
 
 You also need credentials for whichever provider you use (for Claude Code, an authenticated `claude` login or `ANTHROPIC_API_KEY`). `loki doctor` flags a missing or unauthenticated provider as the first thing to fix.

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.49.3
+# Loki Mode v9.49.4
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.49.3 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.49.4 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.49.3
+9.49.4

package/autonomy/lib/proof-verify.py

@@ -324,7 +324,8 @@ def _compute_headline(facts, degraded):
         or tests.get("status") == "failed"
         or build.get("status") == "failed"
         or any(g.get("status") == "failed"
-               for g in (facts.get("quality_gates") or []))
+               for g in (facts.get("quality_gates") or [])
+               if _is_exogenous(g))
         or sec_high
         or fn_failed
     )
@@ -342,7 +343,8 @@ def _compute_headline(facts, degraded):
         tests.get("status") == "verified"
         or build.get("status") == "verified"
         or any(g.get("status") == "passed"
-               for g in (facts.get("quality_gates") or []))
+               for g in (facts.get("quality_gates") or [])
+               if _is_exogenous(g))
     )
     if any_verified and degraded:
         return "VERIFIED WITH GAPS"

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.49.3"
+__version__ = "9.49.4"
 
 # Expose the control app for easy import
 try:

package/dashboard/server.py

@@ -261,16 +261,16 @@ def _real_client_host(request: Request):
     client = getattr(request, "client", None)
     host = getattr(client, "host", None) if client else None
     if host is None:
-        return None
+        return None, False
     if host in _trusted_proxies():
         fwd = request.headers.get("x-forwarded-for", "")
         first = fwd.split(",")[0].strip()
         if first:
-            return first
-    return host
+            return first, True
+    return host, False
 
 
-def _is_local_caller(host) -> bool:
+def _is_local_caller(host, from_forwarded: bool = False) -> bool:
     """True only for a caller we can positively identify as non-routable.
 
     A peer that is not an IP literal (ASGI test transports report
@@ -285,7 +285,18 @@ def _is_local_caller(host) -> bool:
     try:
         return ipaddress.ip_address(host).is_loopback
     except ValueError:
-        return True
+        # A DIRECT peer that is not an IP literal is genuinely local: ASGI test
+        # transports report "testclient" and UDS transports report names, and
+        # refusing those closes no hole while breaking 17 tests.
+        #
+        # A FORWARDED value is different in kind. It arrived inside a request
+        # header, so treating an unparseable one as local lets any caller behind
+        # a trusted proxy pass the local check by sending a non-IP token.
+        # Measured: with LOKI_TRUSTED_PROXIES set, "not-an-ip", "unknown" and
+        # "testclient" all returned local, while an empty value correctly did
+        # not. "unknown" is a literal some proxies emit when the client address
+        # is unavailable, so this is reachable without an attacker choosing it.
+        return not from_forwarded
 
 
 def require_local_or_authenticated(request: Request) -> None:
@@ -316,13 +327,13 @@ def require_local_or_authenticated(request: Request) -> None:
     """
     if auth.ENTERPRISE_AUTH_ENABLED or auth.OIDC_ENABLED:
         return
-    host = _real_client_host(request)
+    host, host_from_forwarded = _real_client_host(request)
     if host is None:
         raise HTTPException(
             status_code=403,
             detail="control requires an identifiable client; enable "
                    "LOKI_ENTERPRISE_AUTH to allow remote access")
-    if _is_local_caller(host):
+    if _is_local_caller(host, host_from_forwarded):
         return
     raise HTTPException(
         status_code=403,
@@ -1211,14 +1222,16 @@ class WebSocketBoundaryMiddleware:
         if not (auth.ENTERPRISE_AUTH_ENABLED or auth.OIDC_ENABLED):
             client = scope.get("client")
             host = client[0] if client else None
+            host_from_forwarded = False
             if host in _trusted_proxies():
                 for raw_name, raw_value in scope.get("headers", []):
                     if raw_name == b"x-forwarded-for":
                         first = raw_value.decode("latin-1").split(",")[0].strip()
                         if first:
                             host = first
+                            host_from_forwarded = True
                         break
-            if not _is_local_caller(host):
+            if not _is_local_caller(host, host_from_forwarded):
                 # 1008 = policy violation. Closing with a code beats an
                 # accept-then-drop, which reads to a client as a flaky network.
                 await send({"type": "websocket.close", "code": 1008})

package/docs/INSTALLATION.md

@@ -2,7 +2,7 @@
 
 The flagship product of [Autonomi](https://www.autonomi.dev/). Loki Mode is a spec-driven autonomous builder with a built-in trust layer that takes any spec to a deployed product and verifies completion with evidence (quality gates plus a completion council), not just a "done" claim. Complete installation instructions for all platforms and use cases.
 
-**Version:** v9.49.3
+**Version:** v9.49.4
 
 ---
 

package/docs/P0-SWEEP-PLAN.md

@@ -42,7 +42,7 @@ Honest count after this sweep: 8 gates.
 | 5 | Mock Integrity Detector | enforce_mock_integrity -> tests/detect-mock-problems.sh | Yes (HIGH blocks) | LOKI_GATE_MOCK=false |
 | 6 | Test Mutation Detector | enforce_mutation_integrity -> tests/detect-test-mutations.sh | Yes (HIGH blocks) | LOKI_GATE_MUTATION=false |
 | 7 | Documentation Coverage | run_doc_quality_gate (run.sh:7388) | Yes | LOKI_GATE_DOC_COVERAGE=false |
-| 8 | Magic Modules Debate | run_magic_debate_gate (run.sh:7495) | Yes (BLOCK sev) | LOKI_GATE_MAGIC_DEBATE=false |
+| 8 | Magic Modules Debate | run_magic_debate_gate (run.sh:7495) | No, advisory by default. NOTE added 2026-09-13: this row said "Yes (BLOCK sev)" and that was never true on either route; bash enforces only with LOKI_GATE_MAGIC_DEBATE_BLOCKING=true and Bun self-skips unless LOKI_GATE_MAGIC_DEBATE="true". Line numbers in this document are as grep-verified in June 2026 and are left unchanged. | LOKI_GATE_MAGIC_DEBATE=false |
 
 Conditional auditor (documented separately, NOT numbered): Backward-Compatibility
 / legacy-healing-auditor (healing mode only). Removed: Input/Output Guardrails.

package/docs/cursor-comparison.md

@@ -76,7 +76,7 @@ velocity_quality_balance:
 5. Mock Integrity Detector - HIGH blocks
 6. Test Mutation Detector - HIGH blocks
 7. Documentation Coverage
-8. Magic Modules Debate - BLOCK severity
+8. Magic Modules Debate - advisory by default on both routes (bash needs LOKI_GATE_MAGIC_DEBATE_BLOCKING=true; Bun self-skips unless LOKI_GATE_MAGIC_DEBATE="true")
 
 Conditional auditor (not numbered): backward-compatibility / legacy-healing-auditor (healing mode only).