loki-mode 9.55.0 → 9.57.0

package/.github/actions/issue-to-pr/action.yml

@@ -1,11 +1,34 @@
 name: 'Loki Issue to PR'
-description: 'Hand Loki Mode a GitHub issue; it opens a pull request with a verifiable evidence receipt.'
+description: 'Hand Loki Mode a GitHub issue; it produces a patch and a PR body with a verifiable evidence receipt. Open the PR from a separate job that runs no agent.'
 author: 'asklokesh'
 
 branding:
   icon: 'git-pull-request'
   color: 'purple'
 
+# Rule of Two: the issue text is untrusted, so the job that runs this action
+# must not hold a write token. Run it with `permissions: contents: read,
+# issues: read` and `actions/checkout` with `persist-credentials: false`, upload
+# `outputs.patch`, and push and open the PR from a second job that runs no
+# agent. .github/workflows/loki-issue-to-pr.yml in asklokesh/loki-mode is the
+# reference. Earlier versions pushed and opened the PR from the same step that
+# ran the agent; this one does not.
+#
+# Token co-location within THIS job: the fetch step below holds GH_TOKEN and
+# runs no agent; the agent step runs `loki start` on the pre-fetched PRD file
+# and is given no token (GH_TOKEN/GITHUB_TOKEN/GH_ENTERPRISE_TOKEN/
+# GITHUB_ENTERPRISE_TOKEN all explicitly blanked, overriding anything the
+# caller's `uses:` step set at a level this composite's steps would otherwise
+# inherit). This narrows exposure to the same-step case (a prompt-injected
+# agent invoking `gh`/git with the token directly) but does NOT provide
+# process isolation: fetch and agent steps still share one runner VM and one
+# Actions Runner.Worker process holding the job token in memory, reachable via
+# /proc/<pid>/environ or ptrace with the passwordless sudo hosted runners
+# grant (see the March 2025 tj-actions/changed-files compromise, which used
+# exactly this). The real isolation boundary is the caller's job split: keep
+# this job's permissions read-only (contents: read, issues: read) and push
+# from a separate job/runner, as the reference workflow does.
+
 inputs:
   issue:
     description: 'Issue reference. Defaults to the issue that triggered this workflow.'
@@ -29,13 +52,29 @@ inputs:
     default: 'latest'
 
 outputs:
+  patch:
+    description: 'Path to the patch Loki committed on top of the checked-out commit (empty file when nothing changed).'
+    value: ${{ steps.run.outputs.patch }}
+  pr_body:
+    description: 'Path to a PR body carrying the evidence receipt.'
+    value: ${{ steps.run.outputs.pr_body }}
   pr_url:
-    description: 'URL of the pull request Loki opened, empty if none was opened.'
-    value: ${{ steps.run.outputs.pr_url }}
+    description: 'Always empty. This action no longer opens the pull request; open it from a job that runs no agent.'
+    value: ''
 
 runs:
   using: 'composite'
   steps:
+    - name: Refuse a checkout that left a push token behind
+      shell: bash
+      run: |
+        # actions/checkout persists the job token in git config unless told
+        # not to. The agent could push with it, whatever this action does.
+        if git config --get-regexp '^http\..*\.extraheader$' >/dev/null 2>&1; then
+          echo "::error::actions/checkout left a token in git config that the agent could push with. Set 'persist-credentials: false' on the checkout step of this job."
+          exit 1
+        fi
+
     - name: Install Loki Mode
       shell: bash
       run: npm install -g loki-mode@${{ inputs.version }}
@@ -46,7 +85,7 @@ runs:
       run: |
         # Prefer the explicit input; otherwise use the triggering issue. Failing
         # CLOSED here is deliberate: a run with no issue would otherwise start
-        # from the repository's own state and produce an unrelated PR.
+        # from the repository's own state and produce an unrelated change.
         REF="${{ inputs.issue }}"
         if [ -z "$REF" ]; then
           NUM="${{ github.event.issue.number }}"
@@ -59,45 +98,142 @@ runs:
         echo "ref=$REF" >> "$GITHUB_OUTPUT"
         echo "Resolved issue reference: $REF"
 
-    - name: Resolve the issue to a pull request
-      id: run
+    - name: Fetch the issue (holds the token, runs no agent)
+      id: fetch
       shell: bash
       env:
-        # gh is what opens the PR. Without a token the run still builds and the
-        # PR step no-ops, so this is not fatal, but it IS the common misconfig.
+        # Used only to read the issue in this step. Never exported to the
+        # agent step below.
         GH_TOKEN: ${{ github.token }}
+        ISSUE_REF: ${{ steps.ref.outputs.ref }}
+      run: |
+        set -euo pipefail
+
+        case "$ISSUE_REF" in
+          */*'#'*) : ;;
+          *) echo "::error::Malformed issue reference: $ISSUE_REF (expected owner/repo#number)"; exit 1 ;;
+        esac
+        REPO="${ISSUE_REF%%#*}"
+        NUMBER="${ISSUE_REF##*#}"
+        case "$NUMBER" in
+          ''|*[!0-9]*) echo "::error::Issue number must be digits, got '$NUMBER' from '$ISSUE_REF'"; exit 1 ;;
+        esac
+
+        # Same fields as fetch_github_issue() in autonomy/issue-providers.sh:
+        # number,title,body,labels,author,createdAt,url. No comments -- the
+        # PRD the agent works from carries the same content the CLI's own
+        # issue-mode path would have handed it, nothing wider.
+        ISSUE_JSON="$(gh issue view "$NUMBER" --repo "$REPO" \
+          --json number,title,body,labels,author,createdAt,url)"
+
+        OUT="$RUNNER_TEMP/loki-out"
+        mkdir -p "$OUT"
+        PRD_FILE="$OUT/prd-issue-${NUMBER}.md"
+
+        REPO="$REPO" ISSUE_JSON="$ISSUE_JSON" PRD_FILE="$PRD_FILE" python3 -c "
+        import json, os
+
+        data = json.loads(os.environ['ISSUE_JSON'])
+        repo = os.environ['REPO']
+        title = data.get('title', '')
+        body = data.get('body') or ''
+        labels = ', '.join(l['name'] for l in data.get('labels', []))
+        author = (data.get('author') or {}).get('login', '')
+        url = data.get('url', '')
+        created_at = data.get('createdAt', '')
+        number = data.get('number', '')
+
+        lines = [
+            '# PRD: ' + title,
+            '',
+            '**Source:** GitHub Issue [#' + str(number) + '](' + url + ')',
+            '**Author:** @' + author,
+            '**Created:** ' + created_at,
+            '**Repository:** ' + repo,
+        ]
+        if labels:
+            lines.append('**Labels:** ' + labels)
+        lines += [
+            '',
+            '---',
+            '',
+            '## Overview',
+            '',
+            body,
+            '',
+            '---',
+            '',
+            '## Acceptance Criteria',
+            '',
+            'Based on the issue description, implement the following:',
+            '',
+            '1. Address all requirements specified in the issue body above',
+            '2. Ensure backward compatibility (unless explicitly breaking changes are requested)',
+            '3. Add appropriate tests for new functionality',
+            '4. Update documentation as needed',
+            '',
+            '---',
+            '',
+            '## References',
+            '',
+            '- Original Issue: ' + url,
+            '',
+        ]
+        with open(os.environ['PRD_FILE'], 'w') as f:
+            f.write(chr(10).join(lines))
+        "
+        echo "prd=$PRD_FILE" >> "$GITHUB_OUTPUT"
+        echo "issue_number=$NUMBER" >> "$GITHUB_OUTPUT"
+
+    - name: Resolve the issue to a patch (no token in this step's environment)
+      id: run
+      shell: bash
+      env:
         LOKI_PROVIDER: ${{ inputs.provider }}
         LOKI_BUDGET_LIMIT: ${{ inputs.budget_limit }}
         LOKI_MAX_ITERATIONS: ${{ inputs.max_iterations }}
-        # The PR is the deliverable, so the PR path is on. Default-on since
-        # v9.43.0; set explicitly here so the action does not depend on the
-        # installed version's default.
-        LOKI_DELEGATE_PR: '1'
+        # The agent step never pushes or opens a PR (Rule of Two).
+        LOKI_DELEGATE_PR: '0'
+        ISSUE_REF: ${{ steps.ref.outputs.ref }}
+        PRD_FILE: ${{ steps.fetch.outputs.prd }}
+        # Explicitly blanked, not merely omitted: this overrides any value the
+        # caller's `uses:` step set, which a composite action's steps would
+        # otherwise inherit. These are the same four run.sh withholds
+        # (_loki_withhold_github_tokens).
+        GH_TOKEN: ''
+        GITHUB_TOKEN: ''
+        GH_ENTERPRISE_TOKEN: ''
+        GITHUB_ENTERPRISE_TOKEN: ''
       run: |
         set -uo pipefail
 
-        # git identity: gh pr create needs commits to have an author.
+        # git identity: Loki commits the session's work on its own branch.
         git config user.name  "${GITHUB_ACTOR:-loki-mode}"
         git config user.email "${GITHUB_ACTOR:-loki-mode}@users.noreply.github.com"
 
-        loki start "${{ steps.ref.outputs.ref }}" || RC=$?
-        RC="${RC:-0}"
-
-        # Report the PR if one was opened. Read it from the state Loki writes
-        # rather than re-deriving it, so this reports what ACTUALLY happened.
-        PR_URL=""
-        if [ -f .loki/state/pr-url.txt ]; then
-          PR_URL="$(cat .loki/state/pr-url.txt 2>/dev/null || true)"
-        fi
-        echo "pr_url=$PR_URL" >> "$GITHUB_OUTPUT"
+        START_SHA="$(git rev-parse HEAD)"
+        RC=0
+        loki start "$PRD_FILE" || RC=$?
 
-        if [ -n "$PR_URL" ]; then
-          echo "Pull request: $PR_URL"
-        else
-          echo "::warning::No pull request was opened. Check that gh is authenticated, the branch is not a default branch, and the run produced changes."
-        fi
+        OUT="$RUNNER_TEMP/loki-out"
+        mkdir -p "$OUT"
+        git diff --binary "$START_SHA" HEAD -- . ':(exclude).loki' > "$OUT/loki.patch"
+        {
+          echo "Resolves ${ISSUE_REF}."
+          echo ""
+          ID="$(cat .loki/state/last-proof-id.txt 2>/dev/null || true)"
+          LIB="$(npm root -g)/loki-mode/autonomy/lib/proof-pr.sh"
+          if [ -n "$ID" ] && [ -f ".loki/proofs/$ID/proof.json" ] && [ -f "$LIB" ]; then
+            # shellcheck source=/dev/null
+            . "$LIB" && render_evidence_receipt_md ".loki/proofs/$ID/proof.json" "" ""
+          else
+            echo "Evidence Receipt: unavailable for this run."
+          fi
+        } > "$OUT/pr-body.md"
+        echo "patch=$OUT/loki.patch" >> "$GITHUB_OUTPUT"
+        echo "pr_body=$OUT/pr-body.md" >> "$GITHUB_OUTPUT"
 
-        # Surface the receipt path so a reviewer can check the evidence.
+        echo "::warning::This action does not open the pull request (Rule of Two). Upload outputs.patch and open the PR from a job that holds the write token and runs no agent; see .github/workflows/loki-issue-to-pr.yml in asklokesh/loki-mode."
         if [ -d .loki/proofs ]; then
           echo "Evidence receipts under .loki/proofs/"
         fi

package/.github/workflows/loki-issue-to-pr.yml

@@ -1,10 +1,21 @@
 # Hand Loki an issue, get a pull request.
 #
-# Label an issue `loki` (or comment `/loki`) and this opens a PR with an
-# evidence receipt. Copy this file into .github/workflows/ of any repository.
+# Label an issue `loki` (or comment `/loki` as a repository owner, member or
+# collaborator) and this opens a PR with an evidence receipt. Copy this file
+# into .github/workflows/ of any repository.
 #
 # REQUIRED: set ANTHROPIC_API_KEY in repository secrets. Without it the run
 # cannot call a model and fails fast rather than burning minutes.
+#
+# Rule of Two: issue text is untrusted, so the agent that reads it never holds
+# a write token. The work is split in two jobs on two fresh runners:
+#   agent    reads the issue and runs Loki with a read-only token. Its only
+#            output is an artifact: a patch and a PR body.
+#   publish  holds the write token and runs no agent. It applies the patch as
+#            data, pushes a branch and opens the PR.
+# A patch that touches .github/workflows/ cannot be pushed with this token
+# (GitHub requires the `workflows` permission), so the publish job fails
+# visibly rather than letting an agent rewrite CI.
 name: Loki - Issue to PR
 
 on:
@@ -24,24 +35,29 @@ concurrency:
   group: loki-issue-${{ github.event.issue.number || inputs.issue }}
   cancel-in-progress: false
 
-permissions:
-  contents: write        # push the agent branch
-  pull-requests: write   # open the PR
-  issues: read
+# Nothing by default; each job asks for exactly what it needs.
+permissions: {}
 
 jobs:
-  resolve:
-    # Gate on an explicit signal so the agent never fires on unrelated activity.
+  agent:
+    # Gate on an explicit signal so the agent never fires on unrelated
+    # activity. A label needs triage access; a `/loki` comment must come from
+    # someone with write-level association, not any GitHub user.
     if: >-
       (github.event_name == 'issues' && github.event.label.name == 'loki') ||
-      (github.event_name == 'issue_comment' && startsWith(github.event.comment.body, '/loki')) ||
+      (github.event_name == 'issue_comment' && startsWith(github.event.comment.body, '/loki') &&
+       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
       github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     timeout-minutes: 45
+    permissions:
+      contents: read   # checkout
+      issues: read     # Loki reads the issue
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0   # the agent branches and diffs; a shallow clone breaks both
+          persist-credentials: false   # leave no token in .git/config for the agent
 
       - uses: actions/setup-node@v4
         with:
@@ -56,32 +72,129 @@ jobs:
             exit 1
           fi
 
-      - name: Resolve the issue
-        id: loki
-        # Pinned to a TAG, not @main. A moving ref would hand every user
-        # whatever main holds at the moment their issue is labeled, including a
-        # half-landed release. Bump this line deliberately.
-        uses: asklokesh/loki-mode/.github/actions/issue-to-pr@v9.49.4
+      - name: Install Loki Mode
+        run: npm install -g loki-mode
+
+      - name: Resolve the issue (no write access)
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          # Read-only in this job (contents: read, issues: read). Loki uses it
+          # to fetch the issue and withholds it from the agent session.
+          GH_TOKEN: ${{ github.token }}
+          ISSUE: ${{ github.event.issue.number || inputs.issue }}
+          LOKI_BUDGET_LIMIT: '10.00'
+          LOKI_MAX_ITERATIONS: '20'
+          # Never push or open a PR from here; the publish job does that.
+          LOKI_DELEGATE_PR: '0'
+        run: |
+          set -uo pipefail
+          case "$ISSUE" in
+            ''|*[!0-9]*) echo "::error::Issue number must be digits, got '$ISSUE'."; exit 1 ;;
+          esac
+
+          # git identity: Loki commits the session's work on its own branch.
+          git config user.name  "${GITHUB_ACTOR:-loki-mode}"
+          git config user.email "${GITHUB_ACTOR:-loki-mode}@users.noreply.github.com"
+
+          RC=0
+          loki start "${GITHUB_REPOSITORY}#${ISSUE}" || RC=$?
+
+          OUT="$RUNNER_TEMP/loki-out"
+          mkdir -p "$OUT"
+          # The deliverable is what the session committed on top of the commit
+          # this run started from. .loki/ is run state, never part of the change.
+          git diff --binary "$GITHUB_SHA" HEAD -- . ':(exclude).loki' > "$OUT/loki.patch"
+
+          # PR body: the evidence receipt this run wrote, when there is one.
+          {
+            echo "Resolves #${ISSUE}."
+            echo ""
+            ID="$(cat .loki/state/last-proof-id.txt 2>/dev/null || true)"
+            LIB="$(npm root -g)/loki-mode/autonomy/lib/proof-pr.sh"
+            if [ -n "$ID" ] && [ -f ".loki/proofs/$ID/proof.json" ] && [ -f "$LIB" ]; then
+              # shellcheck source=/dev/null
+              . "$LIB" && render_evidence_receipt_md ".loki/proofs/$ID/proof.json" "" ""
+            else
+              echo "Evidence Receipt: unavailable for this run."
+            fi
+          } > "$OUT/pr-body.md"
+
+          if [ -s "$OUT/loki.patch" ]; then
+            echo "Loki produced a change; the publish job opens the pull request."
+          else
+            echo "::warning::Loki produced no committed change, so no pull request will be opened."
+          fi
+          exit "$RC"
+
+      - name: Hand the patch to the publish job
+        uses: actions/upload-artifact@v4
         with:
-          issue: ${{ github.event.issue.number || inputs.issue }}
-          budget_limit: '10.00'
+          name: loki-patch
+          path: ${{ runner.temp }}/loki-out/
+          if-no-files-found: error
+          retention-days: 7
 
-      - name: Report back on the issue
-        if: always() && steps.loki.outputs.pr_url != ''
+  publish:
+    # Runs only after the agent job succeeded. Everything it reads from that
+    # job is attacker-controllable data: no job outputs, no `${{ }}` of agent
+    # values in a script, nothing from the artifact is executed.
+    needs: agent
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write        # push the branch
+      pull-requests: write   # open the PR
+      issues: write          # report back on the issue
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}   # the commit the agent started from
+          persist-credentials: false
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: loki-patch
+          path: ${{ runner.temp }}/loki-out
+
+      - name: Open the pull request
         env:
           GH_TOKEN: ${{ github.token }}
-          PR_URL: ${{ steps.loki.outputs.pr_url }}
           ISSUE: ${{ github.event.issue.number || inputs.issue }}
+          BASE: ${{ github.ref_name }}
         run: |
-          # Build the body in a file: a blank line inside an inline YAML string
-          # terminates the block scalar and breaks the workflow parse.
+          set -euo pipefail
+          case "$ISSUE" in
+            ''|*[!0-9]*) echo "::error::Issue number must be digits, got '$ISSUE'."; exit 1 ;;
+          esac
+
+          PATCH="$RUNNER_TEMP/loki-out/loki.patch"
+          BODY="$RUNNER_TEMP/loki-out/pr-body.md"
+          if [ ! -s "$PATCH" ]; then
+            echo "The agent produced no change; nothing to open."
+            exit 0
+          fi
+          [ -s "$BODY" ] || echo "Resolves #${ISSUE}." > "$BODY"
+
+          BRANCH="loki/issue-${ISSUE}-${GITHUB_RUN_ID}"
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch -c "$BRANCH"
+          git apply --index "$PATCH"
+          git commit -q -m "Loki: resolve #${ISSUE}"
+          gh auth setup-git
+          git push origin "HEAD:refs/heads/${BRANCH}"
+
+          PR_URL="$(gh pr create --base "$BASE" --head "$BRANCH" \
+            --title "Loki: resolve #${ISSUE}" --body-file "$BODY")"
+          echo "Pull request: $PR_URL"
+
+          # Build the comment in a file: a blank line inside an inline YAML
+          # string terminates the block scalar and breaks the workflow parse.
           {
             echo "Loki opened a pull request: $PR_URL"
             echo ""
             echo "The PR body carries an evidence receipt stating what was verified,"
             echo "what was skipped, and what is degraded. Check it rather than taking"
             echo "the result on trust."
-          } > /tmp/loki-issue-comment.md
-          gh issue comment "$ISSUE" --body-file /tmp/loki-issue-comment.md || true
+          } > "$RUNNER_TEMP/loki-issue-comment.md"
+          gh issue comment "$ISSUE" --body-file "$RUNNER_TEMP/loki-issue-comment.md" || true

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.55.0
+# Loki Mode v9.57.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.55.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.57.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.55.0
+9.57.0

package/autonomy/lib/proof-check.sh

@@ -40,6 +40,15 @@ _PROOF_CHECK_SH=1
 # Best-effort timeout wrapper so a hung network call cannot stall the caller.
 # Mirrors the run.sh _loki_net idiom. Never fatal.
 _proof_check_net() {
+    # run.sh withholds GitHub tokens from agent sessions (Rule of Two); this is
+    # one of Loki's own trusted calls, so it takes them back for the command.
+    if declare -f _loki_with_github_tokens >/dev/null 2>&1; then
+        _loki_with_github_tokens _proof_check_net_timed "$@"
+    else
+        _proof_check_net_timed "$@"
+    fi
+}
+_proof_check_net_timed() {
     if command -v timeout >/dev/null 2>&1; then
         timeout 30 "$@"
     else

package/autonomy/lib/proof-generator.py

@@ -1152,16 +1152,25 @@ def _collect_journey(loki_dir):
         },
     }
 
-    # Time to first useful result. Prefer the first verified code artifact when
-    # one exists. Before that, issue mode can truthfully report its acceptance-
+    # Time to first useful result. Prefer the first code artifact when one
+    # exists. Before that, issue mode can truthfully report its acceptance-
     # bound proposed plan, explicitly labelled as NOT a verified patch.
+    #
+    # first_result_verified_patch is honesty-critical: it must be True only
+    # when a verification step actually ran on the first result, never merely
+    # because a code change happened. first-artifact.json (run.sh) is written
+    # from `git status --porcelain` the instant the tree goes dirty -- a
+    # change signal, not a verification signal -- so this branch is False,
+    # same as the plan branch below. No producer in this codebase sets this
+    # True today; it stays here, honestly False, for the day a verified-patch
+    # signal exists to flip it.
     fa = _read_json(os.path.join(state, "first-artifact.json"), default=None)
     if isinstance(fa, dict):
         v = fa.get("seconds_to_first_artifact")
         if isinstance(v, (int, float)) and v >= 0:
             out["time_to_first_result_sec"] = int(v)
             out["first_result_kind"] = "code_change"
-            out["first_result_verified_patch"] = True
+            out["first_result_verified_patch"] = False
     else:
         fr = _read_json(os.path.join(state, "first-useful-result.json"), default=None)
         if isinstance(fr, dict):

package/autonomy/lib/workspace_diff.py

@@ -109,13 +109,16 @@ def _preexisting_untracked(repo_dir):
 
 
 def _covered(key, paths):
-    """True when ``key`` or one of its parent directories ("a/", "a/b/") is in
-    ``paths``: an ignored directory entry covers everything below it."""
+    """True when ``key`` or one of its parent directories is in ``paths``,
+    either as a directory entry ("a/", "a/b/") or a bare-path entry ("a",
+    "a/b"): an ignored directory, or a preexisting file later replaced by a
+    directory of the same name, covers everything below it."""
     if key in paths:
         return True
     cut = key.find("/")
     while cut != -1:
-        if key[:cut + 1] in paths:
+        parent = key[:cut]
+        if parent in paths or (parent + "/") in paths:
             return True
         cut = key.find("/", cut + 1)
     return False
@@ -209,7 +212,7 @@ def collect_workspace_diff(repo_dir, base, include_diffs=False):
             # not land in the receipt.
             recorded = hashes.get(key)
             if recorded and _content_hash(os.path.join(repo_dir, path)) != recorded:
-                files.append({"path": path, "insertions": 0, "deletions": 0,
+                files.append({"path": key, "insertions": 0, "deletions": 0,
                               "status": "preexisting_modified"})
             continue
         stat = _git(
@@ -219,9 +222,17 @@ def collect_workspace_diff(repo_dir, base, include_diffs=False):
         )
         parsed = _parse_numstat(stat)
         entry = parsed[0] if parsed else {
-            "path": path, "insertions": 0, "deletions": 0, "status": "untracked"
+            "path": key, "insertions": 0, "deletions": 0, "status": "untracked"
         }
-        entry["path"] = path
+        # Tracked entries come from `git diff --numstat`, which git always
+        # reports repo-top-relative regardless of -C. Untracked/preexisting
+        # paths come from `git ls-files --others`, which git reports relative
+        # to repo_dir (the caller's TARGET_DIR) instead, so without `prefix`
+        # they would stay TARGET_DIR-relative while tracked entries are
+        # repo-relative -- two path bases in the same receipt. `key` (prefix +
+        # path) normalizes both to repo-top-relative to match the tracked
+        # convention.
+        entry["path"] = key
         entry["status"] = "untracked_binary" if entry["status"] == "binary" else "untracked"
         files.append(entry)
         if diffs is not None:
@@ -231,7 +242,7 @@ def collect_workspace_diff(repo_dir, base, include_diffs=False):
                 allowed=(0, 1),
             )
             if patch:
-                diffs.append({"path": path, "patch": patch})
+                diffs.append({"path": key, "patch": patch})
 
     files.sort(key=lambda item: item["path"])
     return {