loki-mode 9.66.0 → 9.68.0

package/SKILL.md

@@ -3,7 +3,7 @@ name: loki-mode
 description: Autonomous spec-driven build system with a built-in trust layer. It does not call work done until it is verified (RARV-C closure loop, 8 quality gates, completion council, verified-completion evidence gate). Triggers on "Loki Mode". Takes a spec (PRD, GitHub issue, OpenAPI doc, etc.) to deployed product with minimal human intervention. Provider-agnostic. Requires --dangerously-skip-permissions flag.
 ---
 
-# Loki Mode v9.66.0
+# Loki Mode v9.68.0
 
 **You are an autonomous agent. You make decisions. You do not ask questions. You do not stop.**
 
@@ -470,4 +470,4 @@ See `CHANGELOG.md` entries [7.5.7], [7.5.8], [7.5.13] for the per-fix list and r
 
 ---
 
-**v9.66.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**
+**v9.68.0 | [Autonomi](https://www.autonomi.dev/) flagship product | ~410 lines core**

package/VERSION

@@ -1 +1 @@
-9.66.0
+9.68.0

package/autonomy/lib/done-recognition.sh

@@ -461,8 +461,20 @@ def tests_axis(path):
         if ec != 0:
             return "red"
         # exit 0 alone is green only if nothing else contradicts it (checked below).
+    def _nonzero_int(v):
+        return isinstance(v, int) and not isinstance(v, bool) and v != 0
+    # Zero-test record: nothing actually ran, regardless of self-reported
+    # pass/fail. Checked before the pass:true/false branches below so a
+    # plausible {"pass": true, "total": 0} shape cannot slip through the
+    # pass:true branch as a false green.
+    if isinstance(d.get("total"), int) and d.get("total") == 0:
+        return "unknown"
     p = d.get("pass")
     if p is True:
+        # A self-reported pass contradicted by a nonzero failure count (under
+        # either key production/legacy shapes use) is not authoritative green.
+        if _nonzero_int(d.get("failed")) or _nonzero_int(d.get("failed_count")):
+            return "red"
         # A clean pass:true with no contradicting red signal is authoritative green.
         if d.get("failed") in (None, 0) and (ec in (None, 0)):
             return "green"

package/autonomy/loki

@@ -856,8 +856,48 @@ PY
 # absent measurement is not evidence, and inventing a PASS here would be worse
 # than inventing a FAIL.
 loki_remote_attestation_status() {
-    local pj="$1" url="$2"
+    local pj="$1" url="$2" _jh
     [ -n "$url" ] || { printf ''; return 0; }
+    # A JWKS key set travels over the same channel as the receipt it certifies.
+    # Plain http lets anyone on the network path swap in their own key set, and
+    # the attestation would then "verify" against a forged key -- a MITM the
+    # TLS the API already uses is meant to prevent. Only https is trusted;
+    # loopback http and file:// are the exceptions, because neither one leaves
+    # this machine for anyone to sit on. Checked here, before python is even
+    # invoked, so a rejected URL is never fetched -- not "fetched and then
+    # distrusted". Same check in loki_proof_attestation_check below -- change
+    # both.
+    #
+    # The host is bounded exactly (up to the first "/", then stripped of any
+    # port) rather than matched with a trailing glob, and a userinfo "@" is
+    # rejected outright -- "http://127.0.0.1:80@evil.com" is host evil.com to
+    # any real URL parser (userinfo before the @, host after), and a loose
+    # `http://127.0.0.1:*` glob would wrongly wave that straight through.
+    case "$url" in
+        https://*|file://*) ;;
+        http://*)
+            _jh="${url#http://}"; _jh="${_jh%%/*}"
+            case "$_jh" in
+                *@*) printf ''; return 0 ;;
+            esac
+            # A bracketed IPv6 literal must be the WHOLE host: "[::1]" or
+            # "[::1]:port", never a prefix, or "[::1].evil.com" (not itself
+            # resolvable as loopback, but not rejected either) would parse as
+            # loopback "::1" with everything after the first "]" silently
+            # dropped instead of validated.
+            case "$_jh" in
+                \[*\]) _jh="${_jh#\[}"; _jh="${_jh%\]}" ;;
+                \[*\]:*) _jh="${_jh#\[}"; _jh="${_jh%%\]:*}" ;;
+                \[*) printf ''; return 0 ;;
+                *) _jh="${_jh%%:*}" ;;
+            esac
+            case "$_jh" in
+                127.0.0.1|localhost|::1) ;;
+                *) printf ''; return 0 ;;
+            esac
+            ;;
+        *) printf ''; return 0 ;;
+    esac
     command -v python3 >/dev/null 2>&1 || { printf ''; return 0; }
     local tok
     # jq's `//` treats JSON false the same as null/missing, which is exactly
@@ -954,8 +994,53 @@ PY
 # testing found exactly this: a mutation applied to the first copy left every
 # assertion of the second suite green.
 loki_proof_attestation_check() {
-    local pj="$1" src="$2"
+    local pj="$1" src="$2" _jh
     [ -n "$src" ] || { printf ''; return 0; }
+    # Same MITM guard as loki_remote_attestation_status above -- change both.
+    # Only applies to a URL source; a local file (the third-party offline case)
+    # never travels a network and needs no scheme at all. The host is bounded
+    # exactly and a userinfo "@" is rejected outright -- see the sibling
+    # function's comment for why a trailing glob is not safe here.
+    #
+    # A recognized scheme prefix is checked FIRST, before any "-f" test: the
+    # process cwd is the checkout being verified (attacker-controlled), and a
+    # repo can ship a file whose literal name IS a URL string (for example
+    # "https:/evil.example.com/.well-known/jwks.json" as a real path on disk).
+    # Testing "-f" first would treat that shadow file as the local-file form
+    # and hand its content straight to the caller with no network involved at
+    # all -- silently defeating the "only https is trusted" guarantee this
+    # function exists to provide. Scheme detection must win over the
+    # filesystem every time, not just when no file happens to collide.
+    case "$src" in
+        https://*|http://*|file://*)
+            case "$src" in
+                https://*|file://*) ;;
+                http://*)
+                    _jh="${src#http://}"; _jh="${_jh%%/*}"
+                    case "$_jh" in
+                        *@*) printf ''; return 0 ;;
+                    esac
+                    # See loki_remote_attestation_status above for why the
+                    # bracketed-IPv6 match must bound the closing bracket.
+                    case "$_jh" in
+                        \[*\]) _jh="${_jh#\[}"; _jh="${_jh%\]}" ;;
+                        \[*\]:*) _jh="${_jh#\[}"; _jh="${_jh%%\]:*}" ;;
+                        \[*) printf ''; return 0 ;;
+                        *) _jh="${_jh%%:*}" ;;
+                    esac
+                    case "$_jh" in
+                        127.0.0.1|localhost|::1) ;;
+                        *) printf ''; return 0 ;;
+                    esac
+                    ;;
+            esac
+            ;;
+        *)
+            # A plain path is decided in python below, which reports an
+            # unsigned receipt as "none" BEFORE it looks at the key file, so a
+            # missing key file on an unsigned receipt still fails (exit 1).
+            ;;
+    esac
     command -v python3 >/dev/null 2>&1 || { printf ''; return 0; }
     python3 -E - "$pj" "$src" "${_LOKI_SCRIPT_DIR}" <<'PY' 2>/dev/null || printf ''
 # The cwd is the checkout being verified: drop it from sys.path before any
@@ -984,15 +1069,20 @@ if tok is None or tok == "" or tok is False:
     print("none"); sys.exit(0)       # a FACT about the receipt, not an error
 src = sys.argv[2]
 try:
-    if os.path.isfile(src):
-        jwks = json.load(open(src))
-    else:
-        if not src.startswith(("http://", "https://")):
-            sys.exit(1)
+    # Scheme check first, same as the bash gate above -- a "-f" test run
+    # first would let a local file whose literal name IS an http(s) URL
+    # string (the process cwd is the checkout being verified) silently stand
+    # in for a real fetch. A recognized scheme always means "URL", even if a
+    # same-named file happens to exist on disk.
+    if src.startswith(("http://", "https://")):
         url = src if src.rstrip("/").endswith("jwks.json") else \
             src.rstrip("/") + "/.well-known/jwks.json"
         with urllib.request.urlopen(url, timeout=10) as r:
             jwks = json.loads(r.read())
+    elif os.path.isfile(src):
+        jwks = json.load(open(src))
+    else:
+        sys.exit(1)
 except Exception:
     sys.exit(1)                      # "" : unreachable/unreadable, no verdict
 # A key set that is not {"keys": [{...}, ...]} -- INCLUDING an empty list -- is
@@ -1177,7 +1267,8 @@ loki_remote_verify_receipt() {
     # gpg-unavailable branch above: NOT CHECKED, return 0, provenance unproven.
     if [ -z "$_attest" ] && jq -e '.verification.attestation // empty' "$pj" >/dev/null 2>&1; then
         echo -e "  ${YELLOW}NOT CHECKED${NC}: the receipt carries an attestation, but it could not be checked"
-        echo "    against ${_attest_url:-<no url>} (JWKS unreachable, or python cryptography missing)."
+        echo "    against ${_attest_url:-<no url>} (JWKS unreachable, python cryptography missing, or"
+        echo "    the JWKS URL is not https -- only loopback is allowed over plain http)."
         echo "    Its integrity hash matches. Provenance is unproven here, not disproven."
         echo "    Install python3 cryptography, or re-run where the build server is reachable."
         return 0
@@ -37014,7 +37105,8 @@ print(json.dumps(json.load(open(os.environ['LOKI_PROOF_JSON'])), indent=2))
                         # read as either a pass or an accusation, so it exits 2
                         # (could not check). A tamper/drift 1 from the base
                         # verifier is a finding and is never softened to 2.
-                        echo -e "${YELLOW}attestation: NOT CHECKED -- could not check against ${_pv_jwks} (key set unreadable, or verifier dependency missing).${NC}" >&2
+                        echo -e "${YELLOW}attestation: NOT CHECKED -- could not check against ${_pv_jwks} (key set unreadable,${NC}" >&2
+                        echo -e "${YELLOW}  verifier dependency missing, or the JWKS URL is not https -- only loopback is allowed over plain http).${NC}" >&2
                         echo "  This is not a failure of the receipt. Nothing was proven either way (exit 2)." >&2
                         if [ "$_pv_rc" -eq 0 ]; then _pv_rc=2; fi
                         _pv_attestation_field="NOT CHECKED"

package/autonomy/run.sh

@@ -5911,6 +5911,27 @@ _loki_trusted_push() {
         log_warn "Not pushing branch '$_branch': origin changed during the run (it was $(_loki_github_repo_from_url "$_LOKI_PINNED_ORIGIN" 2>/dev/null || echo "not a GitHub repository") when the run started). Loki does not push to a destination the agent could have chosen."
         return 2
     fi
+    # S-100: never push a default branch, for every caller (on_run_complete,
+    # create_session_pr): the branch name can come from agent-writable state.
+    # The default branch is resolved for the origin just validated (the pinned
+    # one when pinned), gh run from / with an explicit OWNER/REPO. An
+    # unresolvable default branch refuses: fail closed.
+    local _repo _def=""
+    case "$_branch" in
+        main|master|HEAD)
+            log_warn "Not pushing branch '$_branch': Loki never pushes directly to a default branch."
+            return 2 ;;
+    esac
+    _repo="$(_loki_github_repo_from_url "$_url")"
+    _def="$(_loki_run_neutral "$_repo" "$_runner" gh repo view "$_repo" --json defaultBranchRef --jq '.defaultBranchRef.name' 2>/dev/null)" || _def=""
+    if [ -z "$_def" ]; then
+        log_warn "Not pushing branch '$_branch': could not resolve the default branch of $_repo, and Loki never risks a direct push to it."
+        return 2
+    fi
+    if [ "$_branch" = "$_def" ]; then
+        log_warn "Not pushing branch '$_branch': it is the default branch of $_repo, and Loki never pushes directly to the default branch."
+        return 2
+    fi
     _tmp="$(mktemp -d "${TMPDIR:-/tmp}/loki-push.XXXXXX")" || return 1
     # --update-shallow: a shallow agent repo's history ends in shallow roots,
     # which a plain fetch rejects while still exiting 0. The rev-parse makes a
@@ -6070,6 +6091,8 @@ on_run_complete() {
     case "$branch" in
         ""|main|master|HEAD) return 0 ;;
     esac
+    # S-100: the repository's ACTUAL default branch (develop, trunk, ...) is
+    # refused inside _loki_trusted_push, for every caller.
     log_info "LOKI_DELEGATE_PR=1: opening a local pull request for branch '$branch'..."
     # Push, then create. Non-interactive (no tty in --bg). Best-effort, each
     # network call bounded by the timeout guard above.
@@ -21516,9 +21539,14 @@ except (json.JSONDecodeError, KeyError, TypeError, OSError):
                 mv "$state_file" "${state_file}.corrupt.$(date +%s)" 2>/dev/null || true
                 # Starts at iteration 0: drop the previous session's test
                 # evidence, as the iteration-0 block at the end does.
+                # S-124 follow-up: static-analysis.pass has no freshness
+                # marker of its own (same reasoning as the block below), so
+                # this corrupted-state restart must drop it too, or a stale
+                # copy survives this sibling iteration-0 trigger.
                 rm -f "${TARGET_DIR:-.}/.loki/quality/.test-results.iter" \
                       "${TARGET_DIR:-.}/.loki/quality/unit-tests.pass" \
-                      "${TARGET_DIR:-.}/.loki/quality/test-results.json" 2>/dev/null || true
+                      "${TARGET_DIR:-.}/.loki/quality/test-results.json" \
+                      "${TARGET_DIR:-.}/.loki/quality/static-analysis.pass" 2>/dev/null || true
                 return
             fi
 
@@ -21589,16 +21617,19 @@ except (json.JSONDecodeError, KeyError, TypeError, OSError):
         RETRY_COUNT=0
     fi
     # A session that starts at iteration 0 has run nothing yet, so a leftover
-    # freshness marker or unit-tests.pass is a previous session's evidence.
-    # Iterations restart at 0, so keeping them would let an old pass:true read
-    # as this iteration's result.
+    # freshness marker, unit-tests.pass, or static-analysis.pass is a previous
+    # session's evidence. Iterations restart at 0, so keeping them would let
+    # an old pass:true read as this iteration's result.
     if [ "${ITERATION_COUNT:-0}" = "0" ]; then
-        # Same path the writer (enforce_test_coverage) and the freshness
-        # readers use.
+        # Same path the writer (enforce_test_coverage, enforce_static_analysis)
+        # and the freshness readers use.
         local _q="${TARGET_DIR:-.}/.loki/quality"
         # test-results.json too: with the marker gone the receipt's quality
         # gates fall back to its status, reporting a previous session's run.
-        rm -f "$_q/.test-results.iter" "$_q/unit-tests.pass" "$_q/test-results.json" 2>/dev/null || true
+        # static-analysis.pass has no freshness marker of its own, so a stale
+        # copy from a previous session reads as a pass of this session's
+        # exogenous static_analysis gate unless it is dropped here too.
+        rm -f "$_q/.test-results.iter" "$_q/unit-tests.pass" "$_q/test-results.json" "$_q/static-analysis.pass" 2>/dev/null || true
     fi
 }
 

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.66.0"
+__version__ = "9.68.0"
 
 # Expose the control app for easy import
 try:

package/dashboard/migration_engine.py

@@ -766,19 +766,29 @@ class MigrationPipeline:
                 current_phase = phase
                 overall_status = "failed"
 
-        # Feature stats
-        features_total = 0
-        features_passing = 0
+        # Feature stats. Missing/corrupt is NOT the same as a real empty
+        # plan (0 features): counts go to None with a reason so a consumer
+        # can tell "no features yet" apart from "could not read the file".
+        features_total: Optional[int] = 0
+        features_passing: Optional[int] = 0
+        features_error: Optional[str] = None
         try:
             features = self.load_features()
             features_total = len(features)
             features_passing = sum(1 for f in features if f.passes)
-        except (FileNotFoundError, json.JSONDecodeError, TypeError):
-            pass
-
-        # Step stats
-        steps_total = 0
-        steps_completed = 0
+        except FileNotFoundError:
+            features_total = None
+            features_passing = None
+            features_error = "features.json not found"
+        except (json.JSONDecodeError, TypeError) as exc:
+            features_total = None
+            features_passing = None
+            features_error = f"features.json is corrupt: {exc}"
+
+        # Step stats. Same missing/corrupt-vs-empty distinction as features.
+        steps_total: Optional[int] = 0
+        steps_completed: Optional[int] = 0
+        steps_error: Optional[str] = None
         current_step = None
         current_step_index = 0
         try:
@@ -790,8 +800,14 @@ class MigrationPipeline:
                 current_step = in_progress[0].id
             # Current step index: completed + 1 (1-based) or completed if all done
             current_step_index = min(steps_completed + 1, steps_total) if steps_total else 0
-        except (FileNotFoundError, json.JSONDecodeError, TypeError):
-            pass
+        except FileNotFoundError:
+            steps_total = None
+            steps_completed = None
+            steps_error = "migration-plan.json not found"
+        except (json.JSONDecodeError, TypeError) as exc:
+            steps_total = None
+            steps_completed = None
+            steps_error = f"migration-plan.json is corrupt: {exc}"
 
         # Last checkpoint metadata
         last_checkpoint_data: Optional[dict[str, Any]] = None
@@ -849,8 +865,17 @@ class MigrationPipeline:
             "source": source_path,
             "target": target_name,
             "current_step": current_step,
-            "features": {"passing": features_passing, "total": features_total},
-            "steps": {"current": current_step_index, "completed": steps_completed, "total": steps_total},
+            "features": {
+                "passing": features_passing,
+                "total": features_total,
+                **({"reason": features_error} if features_error else {}),
+            },
+            "steps": {
+                "current": current_step_index,
+                "completed": steps_completed,
+                "total": steps_total,
+                **({"reason": steps_error} if steps_error else {}),
+            },
             "last_checkpoint": last_checkpoint_data,
             "checkpoints_count": len(manifest.checkpoints),
             "seams": seams_data,

package/dashboard/prompt_optimizer.py

@@ -66,7 +66,11 @@ class PromptOptimizer:
         """Get the current (latest) prompt optimization version.
 
         Returns:
-            The latest version data, or a default structure if none exists.
+            The latest version data on a clean read. If no version file
+            exists yet, a "never_ran" marker with null fields (distinct
+            from a real version 0). If the file exists but cannot be
+            parsed, an "error" marker (also null fields) so a corrupt file
+            is never mistaken for "never ran".
         """
         latest = self._latest_file()
         if latest.is_file():
@@ -74,13 +78,20 @@ class PromptOptimizer:
                 return json.loads(latest.read_text(encoding="utf-8"))
             except (json.JSONDecodeError, OSError) as exc:
                 logger.warning("Failed to read latest prompt version: %s", exc)
+                return self._sentinel("error")
 
+        return self._sentinel("never_ran")
+
+    @staticmethod
+    def _sentinel(status: str) -> dict[str, Any]:
+        """Build a never-ran/error marker. Never a fake version 0 or a fake count."""
         return {
-            "version": 0,
+            "version": None,
             "generated_at": None,
-            "based_on_sessions": 0,
-            "failures_analyzed": 0,
+            "based_on_sessions": None,
+            "failures_analyzed": None,
             "changes": [],
+            "status": status,
         }
 
     def get_prompt_for_agent(self, agent_type: str) -> dict[str, Any] | None:
@@ -95,7 +106,7 @@ class PromptOptimizer:
             Dict with agent-specific prompt changes, or None if no optimizations exist.
         """
         current = self.get_current_version()
-        if current["version"] == 0:
+        if not current["version"]:
             return None
 
         agent_changes = [c for c in current.get("changes", []) if c.get("agent_type") == agent_type]
@@ -225,7 +236,9 @@ class PromptOptimizer:
         changes = self._generate_changes(failure_data)
 
         with self._file_lock:
-            current_version = self.get_current_version()["version"]
+            # Never-ran and error sentinels both carry version None; either
+            # way there is no real prior version, so the next one is 1.
+            current_version = self.get_current_version()["version"] or 0
             new_version = current_version + 1
 
             result = {

package/dashboard/server.py

@@ -10350,7 +10350,7 @@ async def get_checklist_waivers():
     try:
         return json.loads(waivers_file.read_text())
     except (json.JSONDecodeError, IOError):
-        return {"waivers": [], "error": "Failed to read waivers file"}
+        return JSONResponse(status_code=500, content={"error": "Failed to read waivers file"})
 
 
 @app.post("/api/checklist/waivers", dependencies=[Depends(auth.require_scope("control"))])