opencode-skills-collection 4.0.16 → 4.0.18

package/bundled-skills/find-complementary-founders/scripts/test_moltbook_publish.py

@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+"""Focused local tests for Moltbook profile-link and invitation boundaries."""
+
+from __future__ import annotations
+
+import unittest
+from datetime import date, timedelta
+
+import github_thread
+import moltbook_publish
+
+
+COMMIT_SHA = "0123456789abcdef0123456789abcdef01234567"
+PROFILE_URL = (
+    "https://github.com/example/project/blob/"
+    f"{COMMIT_SHA}/owner-profile.public.json"
+)
+APPROVED_AT = (date.today() - timedelta(days=1)).isoformat()
+EXPIRES_ON = (date.today() + timedelta(days=30)).isoformat()
+GENERATED_AT = f"{APPROVED_AT}T00:00:00+00:00"
+
+
+def public_profile() -> dict:
+    stages = {
+        name: {
+            "score": 0,
+            "level": "unknown",
+            "confidence": "none",
+            "evidence_count": 0,
+        }
+        for name in ("zero_to_one", "one_to_ten", "ten_to_hundred")
+    }
+    functions = {
+        name: {
+            "score": 0,
+            "level": "unknown",
+            "confidence": "none",
+            "evidence_count": 0,
+        }
+        for name in (
+            "problem_discovery",
+            "product",
+            "engineering",
+            "design",
+            "go_to_market",
+            "operations",
+            "people_leadership",
+            "capital_partnerships",
+        )
+    }
+    return {
+        "schema_version": "1.0",
+        "profile_type": "founder-collaboration",
+        "alias": "builder-42",
+        "summary": "Technical product builder.",
+        "generated_at": GENERATED_AT,
+        "expires_on": EXPIRES_ON,
+        "stage_contributions": stages,
+        "functional_contributions": functions,
+        "preferences": {"stages": [], "functions": []},
+        "seeking": {
+            "stages": ["one_to_ten"],
+            "functions": [],
+            "project_themes": [],
+            "collaboration_modes": [],
+            "shared_principles": [],
+        },
+        "public_evidence": [],
+        "contact": {
+            "type": "github_issues",
+            "url": "https://github.com/example/project/issues",
+        },
+        "consent": {
+            "state": "public_profile_approved",
+            "approved_at": APPROVED_AT,
+            "expires_on": EXPIRES_ON,
+            "scope": "Inbound collaboration replies only",
+        },
+        "interpretation": {
+            "status": "owner-approved collaboration hypothesis",
+            "not_for": [
+                "employment screening",
+                "psychometric diagnosis",
+                "sensitive-trait inference",
+            ],
+        },
+    }
+
+
+class MoltbookBoundaryTests(unittest.TestCase):
+    def test_accepts_full_sha_github_blob_profile_url(self) -> None:
+        self.assertEqual(
+            moltbook_publish.safe_profile_url(PROFILE_URL),
+            PROFILE_URL,
+        )
+
+    def test_rejects_mutable_branch_profile_urls(self) -> None:
+        for url in (
+            "https://github.com/example/project/blob/main/owner-profile.public.json",
+            "https://github.com/example/project/blob/short/owner-profile.public.json",
+        ):
+            with self.subTest(url=url):
+                with self.assertRaises(moltbook_publish.PublishError):
+                    moltbook_publish.safe_profile_url(url)
+
+    def test_rejects_external_profile_hosts(self) -> None:
+        url = (
+            "https://raw.githubusercontent.com/example/project/"
+            f"{COMMIT_SHA}/owner-profile.public.json"
+        )
+        with self.assertRaises(moltbook_publish.PublishError):
+            moltbook_publish.safe_profile_url(url)
+
+    def test_rejects_credentialed_query_fragment_and_port_variants(self) -> None:
+        path = f"example/project/blob/{COMMIT_SHA}/owner-profile.public.json"
+        for url in (
+            f"https://attacker@github.com/{path}",
+            f"https://github.com/{path}?raw=1",
+            f"https://github.com/{path}#profile",
+            f"https://github.com:443/{path}",
+        ):
+            with self.subTest(url=url):
+                with self.assertRaises(moltbook_publish.PublishError):
+                    moltbook_publish.safe_profile_url(url)
+
+    def test_public_renderers_gate_other_owner_invitation(self) -> None:
+        profile = public_profile()
+        title, post = moltbook_publish.render_post(
+            profile,
+            "https://github.com/merc1305/findMate",
+        )
+        reply = moltbook_publish.render_profile_reply(profile, PROFILE_URL)
+
+        self.assertTrue(title.startswith("Complementary project partners"))
+        for output in (post, reply):
+            self.assertIn(
+                "your own owner explicitly asks to explore partner-seeking help",
+                output,
+            )
+        self.assertNotIn("run the open skill only on your own owner", post)
+        self.assertNotIn("show the canonical protocol to your own owner", reply)
+
+    def test_inline_github_fallback_uses_safe_renderer_placeholder(self) -> None:
+        body = github_thread.render_inline_profile_reply(public_profile())
+
+        self.assertIn("Owner-approved profile: inline", body)
+        self.assertIn("FINDMATE_PROFILE_JSON_BEGIN", body)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/bundled-skills/hugging-face-model-trainer/scripts/convert_to_gguf.py

@@ -47,6 +47,7 @@ from transformers import AutoModelForCausalLM, AutoTokenizer
 from peft import PeftModel
 from huggingface_hub import HfApi
 import subprocess
+import tempfile
 
 
 def check_system_dependencies():
@@ -130,6 +131,14 @@ def env_flag(name):
 print("🔄 GGUF Conversion Script")
 print("=" * 60)
 
+# Every run receives a private, unpredictable workspace. Keeping the
+# TemporaryDirectory object alive until process exit also guarantees cleanup.
+WORKSPACE = tempfile.TemporaryDirectory(prefix="aas-gguf-")
+WORK_ROOT = WORKSPACE.name
+MERGED_DIR = os.path.join(WORK_ROOT, "merged-model")
+LLAMA_DIR = os.path.join(WORK_ROOT, "llama.cpp")
+GGUF_OUTPUT_DIR = os.path.join(WORK_ROOT, "gguf-output")
+
 # Check system dependencies first
 if not check_system_dependencies():
     print("\n❌ Please install the missing system dependencies and try again.")
@@ -194,7 +203,7 @@ except Exception as e:
 
 # Step 2: Save merged model temporarily
 print("\n💾 Step 2: Saving merged model...")
-merged_dir = "/tmp/merged_model"
+merged_dir = MERGED_DIR
 try:
     merged_model.save_pretrained(merged_dir, safe_serialization=True)
     tokenizer.save_pretrained(merged_dir)
@@ -208,13 +217,13 @@ print("\n📥 Step 3: Setting up llama.cpp for GGUF conversion...")
 
 # Clone llama.cpp repository
 if not run_command(
-    ["git", "clone", "https://github.com/ggerganov/llama.cpp.git", "/tmp/llama.cpp"],
+    ["git", "clone", "https://github.com/ggerganov/llama.cpp.git", LLAMA_DIR],
     "Cloning llama.cpp repository"
 ):
     print("   Trying alternative clone method...")
     # Try shallow clone
     if not run_command(
-        ["git", "clone", "--depth", "1", "https://github.com/ggerganov/llama.cpp.git", "/tmp/llama.cpp"],
+        ["git", "clone", "--depth", "1", "https://github.com/ggerganov/llama.cpp.git", LLAMA_DIR],
         "Cloning llama.cpp (shallow)"
     ):
         sys.exit(1)
@@ -222,7 +231,7 @@ if not run_command(
 # Install Python dependencies
 print("   Installing Python dependencies...")
 if not run_command(
-    ["pip", "install", "-r", "/tmp/llama.cpp/requirements.txt"],
+    ["pip", "install", "-r", os.path.join(LLAMA_DIR, "requirements.txt")],
     "Installing llama.cpp requirements"
 ):
     print("   ⚠️  Some requirements may already be installed")
@@ -235,10 +244,10 @@ if not run_command(
 
 # Step 4: Convert to GGUF (FP16)
 print("\n🔄 Step 4: Converting to GGUF format (FP16)...")
-gguf_output_dir = "/tmp/gguf_output"
+gguf_output_dir = GGUF_OUTPUT_DIR
 os.makedirs(gguf_output_dir, exist_ok=True)
 
-convert_script = "/tmp/llama.cpp/convert_hf_to_gguf.py"
+convert_script = os.path.join(LLAMA_DIR, "convert_hf_to_gguf.py")
 model_name = safe_filename_component(ADAPTER_MODEL.split('/')[-1], "ADAPTER_MODEL repo name")
 gguf_file = f"{gguf_output_dir}/{model_name}-f16.gguf"
 
@@ -262,11 +271,12 @@ print("\n⚙️  Step 5: Creating quantized versions...")
 
 # Build quantize tool using CMake (more reliable than make)
 print("   Building quantize tool with CMake...")
-os.makedirs("/tmp/llama.cpp/build", exist_ok=True)
+build_dir = os.path.join(LLAMA_DIR, "build")
+os.makedirs(build_dir, exist_ok=True)
 
 # Configure with CMake
 if not run_command(
-    ["cmake", "-B", "/tmp/llama.cpp/build", "-S", "/tmp/llama.cpp",
+    ["cmake", "-B", build_dir, "-S", LLAMA_DIR,
      "-DGGML_CUDA=OFF"],
     "Configuring with CMake"
 ):
@@ -275,7 +285,7 @@ if not run_command(
 
 # Build just the quantize tool
 if not run_command(
-    ["cmake", "--build", "/tmp/llama.cpp/build", "--target", "llama-quantize", "-j", "4"],
+    ["cmake", "--build", build_dir, "--target", "llama-quantize", "-j", "4"],
     "Building llama-quantize"
 ):
     print("   ❌ Build failed!")
@@ -284,7 +294,7 @@ if not run_command(
 print("   ✅ Quantize tool built")
 
 # Use the CMake build output path
-quantize_bin = "/tmp/llama.cpp/build/bin/llama-quantize"
+quantize_bin = os.path.join(build_dir, "bin", "llama-quantize")
 
 # Common quantization formats
 quant_formats = [

package/bundled-skills/instagram/scripts/config.py

@@ -6,20 +6,38 @@ Importado por todos os outros scripts.
 """
 from __future__ import annotations
 
+import os
+import shutil
 from pathlib import Path
 from typing import Any, Dict
 
 # ── Paths ─────────────────────────────────────────────────────────────────────
 ROOT_DIR = Path(__file__).parent.parent
 SCRIPTS_DIR = ROOT_DIR / "scripts"
-DATA_DIR = ROOT_DIR / "data"
+LEGACY_DATA_DIR = ROOT_DIR / "data"
+DATA_DIR = Path(os.environ.get(
+    "AAS_INSTAGRAM_DATA_DIR",
+    Path.home() / ".local" / "share" / "agentic-awesome-skills" / "instagram",
+)).expanduser()
 EXPORTS_DIR = DATA_DIR / "exports"
 STATIC_DIR = ROOT_DIR / "static"
 DB_PATH = DATA_DIR / "instagram.db"
 
-# Garante que diretórios existem
-DATA_DIR.mkdir(parents=True, exist_ok=True)
-EXPORTS_DIR.mkdir(parents=True, exist_ok=True)
+# Tokens and app secrets are stored in the SQLite database. Keep every newly
+# created database, journal, and sidecar private, and migrate legacy state once.
+os.umask(0o077)
+if LEGACY_DATA_DIR.exists() and LEGACY_DATA_DIR != DATA_DIR and not DATA_DIR.exists():
+    DATA_DIR.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    shutil.move(str(LEGACY_DATA_DIR), str(DATA_DIR))
+    print(f"AVISO: dados sensiveis do Instagram migrados para {DATA_DIR}")
+for directory in (DATA_DIR.parent.parent, DATA_DIR.parent, DATA_DIR, EXPORTS_DIR):
+    directory.mkdir(parents=True, exist_ok=True, mode=0o700)
+    try:
+        directory.chmod(0o700)
+    except OSError:
+        pass
+if DB_PATH.exists() and not DB_PATH.is_symlink():
+    DB_PATH.chmod(0o600)
 
 # ── Instagram Graph API ───────────────────────────────────────────────────────
 API_VERSION = "v21.0"

package/bundled-skills/instagram/scripts/db.py

@@ -12,6 +12,7 @@ Uso:
 from __future__ import annotations
 
 import json
+import os
 import sqlite3
 from datetime import datetime, timezone
 from pathlib import Path
@@ -239,7 +240,14 @@ class Database:
         self.db_path.parent.mkdir(parents=True, exist_ok=True)
 
     def _connect(self) -> sqlite3.Connection:
+        self.db_path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        if self.db_path.is_symlink():
+            raise RuntimeError("Instagram database must not be a symbolic link")
+        if not self.db_path.exists():
+            descriptor = os.open(self.db_path, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+            os.close(descriptor)
         conn = sqlite3.connect(self.db_path)
+        os.chmod(self.db_path, 0o600)
         conn.row_factory = sqlite3.Row
         conn.execute("PRAGMA journal_mode=WAL")
         conn.execute("PRAGMA synchronous=NORMAL")

package/bundled-skills/junta-leiloeiros/scripts/export.py

@@ -15,6 +15,7 @@ from __future__ import annotations
 import argparse
 import csv
 import json
+import re
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
@@ -40,6 +41,13 @@ from db import Database
 OUTPUT_DIR = Path(__file__).parent.parent / "data" / "exports"
 
 
+def spreadsheet_safe_cell(value):
+    """Neutralize strings that spreadsheet programs can interpret as formulas."""
+    if isinstance(value, str) and re.match(r"^[\x00-\x20]*[=+@-]", value):
+        return "'" + value
+    return value
+
+
 def export_json(records: list, output_dir: Path, suffix: str = "") -> Path:
     output_dir.mkdir(parents=True, exist_ok=True)
     ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
@@ -72,9 +80,10 @@ def export_csv(records: list, output_dir: Path, suffix: str = "") -> Path:
     path = output_dir / f"leiloeiros{suffix}_{ts}.csv"
 
     with safe_user_path(path).open("w", newline="", encoding="utf-8-sig") as f:
-        writer = csv.DictWriter(f, fieldnames=list(records[0].keys()), extrasaction="ignore")
+        fieldnames = list(records[0].keys())
+        writer = csv.DictWriter(f, fieldnames=fieldnames, extrasaction="ignore")
         writer.writeheader()
-        writer.writerows(records)
+        writer.writerows({key: spreadsheet_safe_cell(value) for key, value in record.items()} for record in records)
     print(f"[CSV] {len(records)} registros → {path}")
     return path
 

package/bundled-skills/junta-leiloeiros/scripts/serve_api.py

@@ -18,6 +18,7 @@ from __future__ import annotations
 
 import argparse
 import csv
+import re
 import io
 import json
 import sys
@@ -131,7 +132,10 @@ def export_csv():
         extrasaction="ignore",
     )
     writer.writeheader()
-    writer.writerows(records)
+    writer.writerows({
+        key: ("'" + value if isinstance(value, str) and re.match(r"^[\x00-\x20]*[=+@-]", value) else value)
+        for key, value in record.items()
+    } for record in records)
     output.seek(0)
 
     return StreamingResponse(

package/bundled-skills/loki-mode/CLAUDE.md

@@ -6,7 +6,7 @@ Multi-agent autonomous startup system for Claude Code. Takes PRD to fully deploy
 
 ```bash
 # Launch Claude Code with autonomous permissions
-claude --dangerously-skip-permissions
+claude
 
 # Then invoke:
 # "Loki Mode" or "Loki Mode with PRD at path/to/prd"

package/bundled-skills/loki-mode/CONTEXT-EXPORT.md

@@ -65,7 +65,7 @@ loki-mode/
 
 ### Quick Start (Recommended)
 ```bash
-./autonomy/run.sh ./docs/requirements.md
+bash autonomy/run.sh ./docs/requirements.md
 ```
 
 ### What run.sh Does
@@ -90,7 +90,7 @@ watch -n 2 cat .loki/STATUS.txt
 ### Claude Code Invocation
 The autonomy runner pipes the prompt through stdin for live output:
 ```bash
-echo "$prompt" | claude --dangerously-skip-permissions
+echo "$prompt" | claude
 ```
 
 **Important:** Using `-p` flag doesn't stream output properly. Piping through stdin shows interactive output.
@@ -130,7 +130,7 @@ echo "$prompt" | claude --dangerously-skip-permissions
 
 ### 1. "Blank output when running autonomously"
 **Cause:** Using `-p` flag doesn't stream output
-**Solution:** Use stdin pipe: `echo "$prompt" | claude --dangerously-skip-permissions`
+**Solution:** Use stdin pipe: `echo "$prompt" | claude` and retain normal permission prompts.
 
 ### 2. "Vibe Kanban not showing tasks"
 **Cause:** Vibe Kanban is UI-driven, doesn't read JSON files automatically

package/bundled-skills/loki-mode/INSTALLATION.md

@@ -265,7 +265,7 @@ ls -la ~/.claude/
 
 ### Autonomous Runner Won't Start
 
-**Problem:** `./autonomy/run.sh` gives "command not found" or permission errors.
+**Problem:** `bash autonomy/run.sh` gives "command not found" or permission errors.
 
 **Solutions:**
 1. **Make executable:**
@@ -277,7 +277,7 @@ ls -la ~/.claude/
    ```bash
    # Make sure you're in the loki-mode directory
    cd ~/.claude/skills/loki-mode
-   ./autonomy/run.sh
+   bash autonomy/run.sh
    ```
 
 3. **Check prerequisites:**
@@ -362,7 +362,7 @@ After installation:
 
 1. **Quick Test:** Run a simple example
    ```bash
-   ./autonomy/run.sh examples/simple-todo-app.md
+   bash autonomy/run.sh examples/simple-todo-app.md
    ```
 
 2. **Read Documentation:** Check out [README.md](README.md) for usage guides

package/bundled-skills/loki-mode/README.md

@@ -74,7 +74,7 @@ PRD → Research → Architecture → Development → Testing → Deployment →
 | **No testing** or basic unit tests | **14 automated quality gates**: security scans, load tests, accessibility audits, code reviews |
 | **Code only** - you handle the rest | **Full business operations**: marketing, sales, legal, HR, finance, investor relations |
 | **Stops on errors** | **Self-healing**: circuit breakers, dead letter queues, exponential backoff, automatic recovery |
-| **No visibility** into progress | **Real-time dashboard** with agent monitoring, task queues, and live status updates |
+| **No visibility** into progress | **Local status files** with agent monitoring and task queues |
 | **"Done" when code is written** | **Never "done"**: continuous optimization, A/B testing, customer feedback loops, perpetual improvement |
 
 ### **Core Advantages**
@@ -142,13 +142,13 @@ Tasks:
 Last Updated: 2026-01-04 20:45:32
 ```
 
-**Access the dashboard:**
+**Dashboard status:**
 ```bash
 # Automatically opens when running autonomously
-./autonomy/run.sh ./docs/requirements.md
+bash autonomy/run.sh ./docs/requirements.md
 
 # Or open manually
-open .loki/dashboard/index.html
+The legacy unauthenticated HTTP dashboard is disabled. Inspect `.loki/STATUS.txt` and the reviewed JSON state files locally instead.
 ```
 
 Auto-refreshes every 3 seconds. Works with any modern browser.
@@ -212,7 +212,7 @@ There is **NEVER** a "finished" state. After completing the PRD, Loki Mode:
 
 ```bash
 # Start autonomous mode
-./autonomy/run.sh ./docs/requirements.md
+bash autonomy/run.sh ./docs/requirements.md
 
 # Hit rate limit? Script automatically:
 # ├─ Saves state checkpoint
@@ -262,10 +262,10 @@ Save as `my-prd.md`.
 
 ```bash
 # Autonomous mode (recommended)
-./autonomy/run.sh ./my-prd.md
+bash autonomy/run.sh ./my-prd.md
 
 # Or manual mode
-claude --dangerously-skip-permissions
+claude
 > Loki Mode with PRD at ./my-prd.md
 ```
 
@@ -381,7 +381,7 @@ Test Loki Mode with these pre-built PRDs in the `examples/` directory:
 
 ```bash
 # Example: Run with simple todo app
-./autonomy/run.sh examples/simple-todo-app.md
+bash autonomy/run.sh examples/simple-todo-app.md
 ```
 
 ---
@@ -396,7 +396,7 @@ Customize the autonomous runner with environment variables:
 LOKI_MAX_RETRIES=100 \
 LOKI_BASE_WAIT=120 \
 LOKI_MAX_WAIT=7200 \
-./autonomy/run.sh ./docs/requirements.md
+bash autonomy/run.sh ./docs/requirements.md
 ```
 
 | Variable | Default | Description |
@@ -432,7 +432,7 @@ channels:
 
 ## Requirements
 
-- **Claude Code** with `--dangerously-skip-permissions` flag
+- **Claude Code** with its normal permission prompts enabled
 - **Internet access** for competitive research and deployment
 - **Cloud provider credentials** (for deployment phase)
 - **Python 3** (for test suite)
@@ -540,7 +540,7 @@ Built for the [Claude Code](https://claude.ai) ecosystem, powered by Anthropic's
 
 ```bash
 git clone https://github.com/asklokesh/loki-mode.git ~/.claude/skills/loki-mode
-./autonomy/run.sh your-prd.md
+bash autonomy/run.sh your-prd.md
 ```
 
 ---

package/bundled-skills/loki-mode/SKILL.md

@@ -97,7 +97,7 @@ Development <- QA <- Deployment <- Business Ops <- Growth Loop
 
 ```bash
 # Launch with autonomous permissions
-claude --dangerously-skip-permissions
+claude
 ```
 
 ---
@@ -121,7 +121,7 @@ These files are part of the running Loki Mode process. Editing them will crash t
 | File | Reason |
 |------|--------|
 | `~/.claude/skills/loki-mode/autonomy/run.sh` | Currently executing bash script |
-| `.loki/dashboard/*` | Served by active HTTP server |
+| `.loki/dashboard/*` | Legacy dashboard assets; network serving is disabled |
 
 If bugs are found in these files, document them in `.loki/CONTINUITY.md` under "Pending Fixes" for manual repair after the session ends.
 

package/bundled-skills/loki-mode/autonomy/README.md

@@ -6,10 +6,10 @@ Single script that handles everything: prerequisites, setup, Vibe Kanban monitor
 
 ```bash
 # Run with a PRD
-./autonomy/run.sh ./docs/requirements.md
+bash autonomy/run.sh ./docs/requirements.md
 
 # Run interactively
-./autonomy/run.sh
+bash autonomy/run.sh
 ```
 
 That's it! The script will:
@@ -90,14 +90,14 @@ export LOKI_MAX_WAIT=3600       # Max wait time in seconds (default: 3600)
 export LOKI_SKIP_PREREQS=true
 
 # Run with custom settings
-LOKI_MAX_RETRIES=100 LOKI_BASE_WAIT=120 ./autonomy/run.sh ./docs/prd.md
+LOKI_MAX_RETRIES=100 LOKI_BASE_WAIT=120 bash autonomy/run.sh ./docs/prd.md
 ```
 
 ## How Auto-Resume Works
 
 ```
 ┌─────────────────────────────────────────────────────────────┐
-│  ./autonomy/run.sh prd.md                                   │
+│  bash autonomy/run.sh prd.md                                │
 └─────────────────────────────────────────────────────────────┘
                           │
                           ▼
@@ -152,7 +152,7 @@ If you stop the script (Ctrl+C) or it crashes, just run it again:
 
 ```bash
 # State is saved, will resume from last checkpoint
-./autonomy/run.sh ./docs/requirements.md
+bash autonomy/run.sh ./docs/requirements.md
 ```
 
 The script detects the previous state and continues from where it left off.
@@ -161,7 +161,7 @@ The script detects the previous state and continues from where it left off.
 
 | Feature | Manual Mode | Autonomy Mode |
 |---------|-------------|---------------|
-| Start | `claude --dangerously-skip-permissions` | `./autonomy/run.sh` |
+| Start | `claude` | `bash autonomy/run.sh` |
 | Prereq check | Manual | Automatic |
 | Rate limit handling | Manual restart | Auto-resume |
 | State persistence | Manual checkpoint | Automatic |
@@ -181,7 +181,7 @@ Make sure you're running from the loki-mode directory or have installed the skil
 ```bash
 # Option 1: Run from project directory
 cd /path/to/loki-mode
-./autonomy/run.sh
+bash autonomy/run.sh
 
 # Option 2: Install skill globally
 cp -r . ~/.claude/skills/loki-mode/
@@ -197,5 +197,5 @@ cat .loki/logs/autonomy-*.log | tail -100
 cat .loki/state/orchestrator.json
 
 # Increase retries
-LOKI_MAX_RETRIES=200 ./autonomy/run.sh ./docs/prd.md
+LOKI_MAX_RETRIES=200 bash autonomy/run.sh ./docs/prd.md
 ```