loki-mode 9.59.0 → 9.63.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.59.0
+# Loki Mode v9.63.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.59.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.63.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.59.0
+9.63.0

package/autonomy/lib/browser-open.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Loki Mode -- the single guarded browser opener (S-103).
+#
+# Every place Loki opens a browser MUST go through loki_open_url. Tests and
+# agent sessions must never pop a browser tab on a developer's machine (a
+# test run once opened dozens of "Loki Mode" tabs at an offline dashboard).
+# tests/test-browser-open-guard.sh fails if a raw opener call appears anywhere
+# else.
+#
+# Public API:
+#   loki_browser_allowed      -> 0 when a browser may be opened, 1 otherwise
+#   loki_open_url <target>    -> 0 when an opener ran, 1 when suppressed or no
+#                                opener exists (caller prints the URL instead)
+#
+# Suppressed when any of these hold:
+#   LOKI_NO_BROWSER=1 or LOKI_NO_AUTO_OPEN=1 (explicit opt-out)
+#   CI is set
+#   LOKI_TEST, BATS_VERSION, BATS_TEST_FILENAME or PYTEST_CURRENT_TEST is set
+#   stdout is not a TTY
+#
+# Call loki_open_url WITHOUT redirecting its stdout: the TTY check reads fd 1.
+# The helper silences the opener itself.
+
+if [ "${__LOKI_BROWSER_OPEN_SH_LOADED:-0}" = "1" ]; then
+    return 0 2>/dev/null || true
+fi
+__LOKI_BROWSER_OPEN_SH_LOADED=1
+
+loki_browser_allowed() {
+    [ "${LOKI_NO_BROWSER:-0}" = "1" ] && return 1
+    [ "${LOKI_NO_AUTO_OPEN:-0}" = "1" ] && return 1
+    [ -n "${CI:-}" ] && return 1
+    [ -n "${LOKI_TEST:-}${BATS_VERSION:-}${BATS_TEST_FILENAME:-}${PYTEST_CURRENT_TEST:-}" ] && return 1
+    [ -t 1 ] || return 1
+    return 0
+}
+
+loki_open_url() {
+    local target="$1"
+    loki_browser_allowed || return 1
+    if command -v open >/dev/null 2>&1; then
+        open "$target" >/dev/null 2>&1
+    elif command -v xdg-open >/dev/null 2>&1; then
+        xdg-open "$target" >/dev/null 2>&1
+    elif command -v cmd.exe >/dev/null 2>&1; then
+        # Windows (Git Bash/WSL): `start` is a cmd builtin; "" is its title arg.
+        cmd.exe /c start "" "$target" >/dev/null 2>&1
+    else
+        return 1
+    fi
+}

package/autonomy/lib/deadline.py

@@ -29,17 +29,29 @@ _LINEAGE_DISCOVERY_WINDOW_SECONDS = 0.20
 _RECONCILE_SCHEDULING_MARGIN_SECONDS = 0.30
 _LINEAGE_ENV_NAME = "LOKI_DEADLINE_LINEAGE"
 _CONTROL_ENV_NAME = "LOKI_DEADLINE_CONTROL_FILE"
+# How long spawn_tracked waits for the bootstrap to report that it is running.
+# Exceeding it fails the launch closed; it never skips the lineage check.
+_LAUNCH_READY_TIMEOUT_SECONDS = 30.0
+
+# The ready byte is written by interpreted code, so execve has fully returned
+# to userspace and the kernel has published the new environment block. Popen
+# returning is NOT that point: its exec-error pipe closes at close-on-exec time,
+# before the ELF loader sets mm->env_end, and /proc/<pid>/environ reads as empty
+# for a live child in that window.
 _EXEC_BOOTSTRAP = """
 import os
 import sys
 
-gate = int(sys.argv[1])
+ready = int(sys.argv[1])
+os.write(ready, b"1")
+os.close(ready)
+gate = int(sys.argv[2])
 released = os.read(gate, 1)
 os.close(gate)
 if released != b"1":
     raise SystemExit(125)
 try:
-    os.execvpe(sys.argv[2], sys.argv[2:], os.environ)
+    os.execvpe(sys.argv[3], sys.argv[3:], os.environ)
 except FileNotFoundError:
     raise SystemExit(127)
 except PermissionError:
@@ -585,6 +597,7 @@ def spawn_tracked(
     process: subprocess.Popen[bytes] | None = None
     gate_read = gate_write = -1
     lineage_read = lineage_write = -1
+    ready_read = ready_write = -1
     try:
         subreaper = _configure_child_subreaper()
         token = secrets.token_hex(16)
@@ -594,6 +607,7 @@ def spawn_tracked(
         inherited = tuple(popen_kwargs.pop("pass_fds", ()))
         gate_read, gate_write = os.pipe()
         lineage_read, lineage_write = os.pipe()
+        ready_read, ready_write = os.pipe()
         handles = (
             _darwin_pipe_handles(os.getpid(), lineage_read)
             if sys.platform == "darwin"
@@ -602,14 +616,34 @@ def spawn_tracked(
         if sys.platform == "darwin" and not handles:
             raise RuntimeError("attempt lineage pipe identity is unavailable")
         process = subprocess.Popen(
-            [sys.executable, "-c", _EXEC_BOOTSTRAP, str(gate_read), *command],
+            [
+                sys.executable,
+                "-c",
+                _EXEC_BOOTSTRAP,
+                str(ready_write),
+                str(gate_read),
+                *command,
+            ],
             start_new_session=True,
             env=child_env,
-            pass_fds=(*inherited, gate_read, lineage_write),
+            pass_fds=(*inherited, ready_write, gate_read, lineage_write),
             **popen_kwargs,
         )
         os.close(gate_read)
         gate_read = -1
+        os.close(ready_write)
+        ready_write = -1
+        # Wait until the bootstrap is running before reading its marker. EOF
+        # without a byte means it died first; the tracker's reaped-child path
+        # (poll) owns that case, so fall through to it.
+        with selectors.DefaultSelector() as ready_wait:
+            ready_wait.register(ready_read, selectors.EVENT_READ)
+            readable = ready_wait.select(_LAUNCH_READY_TIMEOUT_SECONDS)
+        if not readable:
+            raise RuntimeError("provider attempt did not report ready")
+        os.read(ready_read, 1)
+        os.close(ready_read)
+        ready_read = -1
         tracker = _LineageTracker(process, subreaper, token, handles)
         tracker._lineage_read_fd = lineage_read
         lineage_read = -1
@@ -620,7 +654,14 @@ def spawn_tracked(
         lineage_write = -1
         return process, tracker
     except BaseException:
-        for descriptor in (gate_read, gate_write, lineage_read, lineage_write):
+        for descriptor in (
+            gate_read,
+            gate_write,
+            lineage_read,
+            lineage_write,
+            ready_read,
+            ready_write,
+        ):
             if descriptor >= 0:
                 try:
                     os.close(descriptor)

package/autonomy/lib/proof-check.sh

@@ -42,7 +42,14 @@ _PROOF_CHECK_SH=1
 _proof_check_net() {
     # run.sh withholds GitHub tokens from agent sessions (Rule of Two); this is
     # one of Loki's own trusted calls, so it takes them back for the command.
-    if declare -f _loki_with_github_tokens >/dev/null 2>&1; then
+    if declare -f _loki_run_neutral >/dev/null 2>&1; then
+        # BACKLOG 149 round 5: run from / with GH_REPO read as data first, so
+        # gh's own git calls never load the agent's repo config while holding
+        # the real credentials.
+        local _pc_repo
+        _pc_repo="$(_loki_trusted_repo)"
+        _loki_with_github_tokens _loki_run_neutral "$_pc_repo" _proof_check_net_timed "$@"
+    elif declare -f _loki_with_github_tokens >/dev/null 2>&1; then
         _loki_with_github_tokens _proof_check_net_timed "$@"
     else
         _proof_check_net_timed "$@"
@@ -197,8 +204,16 @@ post_verified_completion_check() {
 
     # --- Resolve owner/repo (nameWithOwner). ----------------------------------
     # Prefer the current repo context (Loki's model is same-repo branch PRs).
+    # Under run.sh, gh runs from / (BACKLOG 149 round 5) and `gh repo view`
+    # with no argument IGNORES GH_REPO, so it could never resolve the repo
+    # there. Use the origin repo run.sh already reads as data and validates.
+    # Standalone (no run.sh helpers), gh runs in the cwd repo as before.
     local repo=""
-    repo="$(_proof_check_net gh repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null || true)"
+    if declare -f _loki_trusted_repo >/dev/null 2>&1; then
+        repo="$(_loki_trusted_repo)"
+    else
+        repo="$(_proof_check_net gh repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null || true)"
+    fi
 
     # --- Resolve head sha: PR head if a pr_url is given, else proof fallback. --
     local head_sha=""

package/autonomy/loki

@@ -71,6 +71,13 @@ if [ -f "$_LOKI_SCRIPT_DIR/lib/lock.sh" ]; then
     source "$_LOKI_SCRIPT_DIR/lib/lock.sh"
 fi
 
+# Guarded browser opener (loki_open_url). Every browser open goes through it
+# so tests, CI and non-TTY runs never pop a tab. If missing, nothing opens.
+if [ -f "$_LOKI_SCRIPT_DIR/lib/browser-open.sh" ]; then
+    # shellcheck source=lib/browser-open.sh
+    source "$_LOKI_SCRIPT_DIR/lib/browser-open.sh"
+fi
+
 # Crash-reporting helpers (provides loki_collection_enabled, used by
 # cmd_telemetry status and cmd_crash). Self-guarded against double-source.
 if [ -f "$_LOKI_SCRIPT_DIR/crash.sh" ]; then
@@ -3613,8 +3620,8 @@ cmd_start() {
                 # cockpit hint is printed by _loki_start_handoff for the Both path.
                 args+=("--bg")
                 local _du="http://127.0.0.1:${LOKI_DASHBOARD_PORT:-57374}"
-                if command -v open >/dev/null 2>&1; then open "$_du" >/dev/null 2>&1 &
-                elif command -v xdg-open >/dev/null 2>&1; then xdg-open "$_du" >/dev/null 2>&1 & fi
+                # stdout must stay unredirected: loki_open_url checks the TTY.
+                loki_open_url "$_du" 2>/dev/null &
                 ;;
             launch-bg-watch)
                 # Watch (cockpit only) detaches without opening the browser.
@@ -7693,16 +7700,10 @@ cmd_dashboard_open() {
 
     echo -e "${GREEN}Opening dashboard: $url${NC}"
 
-    # Open in browser (cross-platform)
-    if command -v open &> /dev/null; then
-        open "$url"
-    elif command -v xdg-open &> /dev/null; then
-        xdg-open "$url"
-    elif command -v start &> /dev/null; then
-        start "$url"
-    else
+    # Open in browser (cross-platform, guarded: no-op in tests/CI/non-TTY)
+    if ! loki_open_url "$url" 2>/dev/null; then
         echo ""
-        echo "Could not detect browser opener."
+        echo "Browser not opened (headless, test, or no opener)."
         echo "Please open in browser: $url"
     fi
 }
@@ -7753,6 +7754,12 @@ cmd_welcome_terminal() {
         echo -e "  ${DIM}Anonymous diagnostics on (os/arch/version/error type only -- never${NC}"
         echo -e "  ${DIM}code, prompts, or paths). Off: loki telemetry off  -  docs/PRIVACY.md${NC}"
         echo ""
+    elif [ -n "${LOKI_TELEMETRY_DISABLED:-}" ] || [ -n "${DO_NOT_TRACK:-}" ]; then
+        # Off-by-default means silence otherwise (nothing to disclose), but an
+        # EXPLICIT opt-out via env var deserves a confirmation that it took
+        # effect, distinct from the default off state nobody asked about.
+        echo -e "  ${DIM}Analytics are off (LOKI_TELEMETRY_DISABLED/DO_NOT_TRACK).${NC}"
+        echo ""
     fi
 }
 
@@ -7774,21 +7781,14 @@ cmd_welcome() {
         q="${q}&telemetry=off"
     fi
 
-    # Headless / Docker / CI / no-browser: print the terminal welcome only.
-    local has_browser=""
-    if command -v open >/dev/null 2>&1; then has_browser="open"
-    elif command -v xdg-open >/dev/null 2>&1; then has_browser="xdg-open"
-    elif command -v start >/dev/null 2>&1; then has_browser="start"
-    fi
-
-    if [ -z "$has_browser" ] || [ ! -f "$welcome_file" ] || [ -n "${CI:-}" ] || [ ! -t 1 ]; then
-        cmd_welcome_terminal "$ver"
-        [ -f "$welcome_file" ] && echo -e "  ${DIM}Full welcome page: ${welcome_file}${NC}" && echo ""
+    # Headless / Docker / CI / tests / no-browser: print the terminal welcome.
+    if [ -f "$welcome_file" ] && loki_open_url "file://${welcome_file}?${q}" 2>/dev/null; then
+        echo -e "${GREEN}Opened the Loki Mode welcome page in your browser.${NC}"
         return 0
     fi
-
-    echo -e "${GREEN}Opening the Loki Mode welcome page in your browser...${NC}"
-    "$has_browser" "file://${welcome_file}?${q}" >/dev/null 2>&1 || cmd_welcome_terminal "$ver"
+    cmd_welcome_terminal "$ver"
+    [ -f "$welcome_file" ] && echo -e "  ${DIM}Full welcome page: ${welcome_file}${NC}" && echo ""
+    return 0
 }
 
 # First-run hook: open the welcome once, then never again. Browser only when
@@ -7802,7 +7802,7 @@ cmd_welcome_maybe_firstrun() {
     # re-checks for a browser and falls back to the terminal welcome, so we
     # gate purely on interactivity + CI here (grouped to avoid &&/|| precedence
     # ambiguity). Backgrounded so it never delays the start.
-    if [ -t 1 ] && [ -z "${CI:-}" ]; then
+    if declare -F loki_browser_allowed >/dev/null 2>&1 && loki_browser_allowed; then
         (cmd_welcome >/dev/null 2>&1 &) || true
     fi
 }
@@ -8132,11 +8132,7 @@ cmd_web_start() {
             local url="http://${PURPLE_LAB_DEFAULT_HOST}:${port}/lab/"
             echo -e "Open: ${CYAN}$url${NC}"
             if [ "$open_browser" = true ]; then
-                if command -v open &> /dev/null; then
-                    open "$url"
-                elif command -v xdg-open &> /dev/null; then
-                    xdg-open "$url"
-                fi
+                loki_open_url "$url" 2>/dev/null || true
             fi
             return 0
         fi
@@ -8231,15 +8227,7 @@ cmd_web_start() {
     if [ "$open_browser" = true ]; then
         if [ "$server_ready" = true ]; then
             echo ""
-            if command -v open &> /dev/null; then
-                open "$url"
-            elif command -v xdg-open &> /dev/null; then
-                xdg-open "$url"
-            elif command -v start &> /dev/null; then
-                start "$url"
-            else
-                echo "Please open in browser: $url"
-            fi
+            loki_open_url "$url" 2>/dev/null || echo "Please open in browser: $url"
         else
             echo ""
             echo -e "${YELLOW}Browser not opened because server is not ready yet.${NC}"
@@ -8885,15 +8873,7 @@ cmd_preview() {
     echo "Served from localhost on this machine."
 
     if [ "$open_browser" = true ]; then
-        if command -v open &> /dev/null; then
-            open "$url"
-        elif command -v xdg-open &> /dev/null; then
-            xdg-open "$url"
-        elif command -v start &> /dev/null; then
-            start "$url"
-        else
-            echo "Please open in browser: $url"
-        fi
+        loki_open_url "$url" 2>/dev/null || echo "Please open in browser: $url"
     fi
 }
 
@@ -16050,16 +16030,16 @@ cmd_demo() {
         if [ "$has_web" = true ] && [ -n "$open_target" ]; then
             echo -e "${CYAN}A web frontend was generated.${NC}"
             echo ""
-            echo -n "Open in browser? [Y/n] "
-            read -r answer </dev/tty 2>/dev/null || answer="n"
-            if [[ -z "$answer" || "$answer" =~ ^[Yy] ]]; then
-                if command -v open &>/dev/null; then
-                    open "$open_target"
-                elif command -v xdg-open &>/dev/null; then
-                    xdg-open "$open_target"
-                else
-                    echo -e "Open this file in your browser: ${BLUE}$open_target${NC}"
-                fi
+            local answer="n"
+            # Ask only when a browser may open, so a test never blocks on /dev/tty.
+            if loki_browser_allowed 2>/dev/null; then
+                echo -n "Open in browser? [Y/n] "
+                read -r answer </dev/tty 2>/dev/null || answer="n"
+            fi
+            if [[ -z "$answer" || "$answer" =~ ^[Yy] ]] && loki_open_url "$open_target" 2>/dev/null; then
+                :
+            else
+                echo -e "Open this file in your browser: ${BLUE}$open_target${NC}"
             fi
         elif [ "$has_start_script" = true ]; then
             echo -e "${CYAN}A start script was found in package.json.${NC}"
@@ -17958,9 +17938,7 @@ print(json.dumps({'id': manifest.id, 'dir': str(pipeline.migration_dir)}))
                     sleep 2
                     if kill -0 "$migrate_dashboard_pid" 2>/dev/null; then
                         echo -e "  Dashboard:   ${CYAN}${url_scheme}://127.0.0.1:${dashboard_port}/${NC}"
-                        if [[ "$OSTYPE" == "darwin"* ]]; then
-                            open "${url_scheme}://127.0.0.1:${dashboard_port}/" 2>/dev/null || true
-                        fi
+                        loki_open_url "${url_scheme}://127.0.0.1:${dashboard_port}/" 2>/dev/null || true
                         echo ""
                     else
                         echo -e "  ${YELLOW}Dashboard failed to start (check logs)${NC}"
@@ -37174,15 +37152,9 @@ print(json.dumps(doc, indent=2))
                 exit 1
             fi
             echo -e "${GREEN}Opening proof: $html${NC}"
-            if command -v open &>/dev/null; then
-                open "$html"
-            elif command -v xdg-open &>/dev/null; then
-                xdg-open "$html"
-            elif command -v start &>/dev/null; then
-                start "$html"
-            else
+            if ! loki_open_url "$html" 2>/dev/null; then
                 echo ""
-                echo "Could not detect browser opener."
+                echo "Browser not opened (headless, test, or no opener)."
                 echo "Please open in browser: $html"
             fi
             exit 0