Changelog v1.9.1

Added

• Docker & Container Detection in loki init (src/loki/engine/scanner.py):
  • Automatically identifies Dockerfile, compose files (docker-compose.yml, compose.yaml), and container configurations to enrich stack metadata and knowledge.json (PR [#17](https://github.com/Elabsurdo984/loki-agent/pull/17) by @aipd506).
• Model Profile Registry Test Suite (tests/test_config.py):
  • Author comprehensive test coverage for custom AI model profiles and configuration serialization (PR [#14](https://github.com/Elabsurdo984/loki-agent/pull/14) by @aipd506).

Security Hardening & Bug Fixes

This release completes a comprehensive security, concurrency, and stability overhaul across all core engine subsystems, resolving all 14 findings identified in the project security audit.

🔒 Security & Privacy Hardening

• SSRF & Authorization Bypass Prevention (SEC-01, src/loki/safety.py):
  • Enforced POSIX forward-slash normalization on URLs before parsing to prevent backslash (\) discrepancy vulnerabilities between Python's urllib.parse and underlying browser network engines.
  • Hardened host authorization checks against path-confusion and authority spoofing.
• Defensive Containment in Source Code Healing (SEC-02, src/loki/engine/healer.py):
  • Enforced strict project repository root containment (Path.is_relative_to(repo_root)) in resolve_source_file(), apply_patch(), and rollback() to prevent arbitrary file read/write and path traversal attacks.
  • Corrected file extension regex alternation ordering ((?:html|jsx|js|tsx|ts|...) with word boundaries) so .jsx and .tsx source files are not prematurely truncated to .js and .ts.
• Sensitive Credential & PII Scrubbing in HAR Responses (SEC-03, src/loki/engine/scrubber.py):
  • Extended NetworkScrubber to sanitize sensitive authentication credentials, Bearer tokens, private keys, passwords, and PII from intercepted HTTP response bodies in addition to request headers.
• Canonical Security Constitution (SECURITY.md):
  • Created project-wide SECURITY.md establishing non-negotiable security invariants, target authorization gates, journey credential masking, and private vulnerability reporting workflows.

⚡ Engine & Playwright Stability

• Route Hanging Elimination in API Chaos (ENG-01, src/loki/engine/api_chaos.py):
  • Fixed an invalid Playwright route lifecycle bug where route.continue_() was erroneously called after route.fetch(), which previously caused network requests to hang indefinitely.
• Config Key Deserialization (ENG-02, src/loki/config.py):
  • Fixed silent omission of auth_fault_rate and api_chaos configuration blocks when reading .loki/config.yaml (PR [#15](https://github.com/Elabsurdo984/loki-agent/pull/15) by @aipd506).
• Network Tormentor Teardown & Offline Leak Prevention (CHA-01, src/loki/personas/network_tormentor.py):
  • Ensured that network emulation routes and offline states are safely restored in a finally block during chaos sessions, preventing persistent browser network blackouts on unhandled exceptions.
• Robust Status Handling in Visual HTML Reports (REP-01, src/loki/engine/html_reporter.py):
  • Resolved TypeError / AttributeError exceptions when rendering runs with null or string status representations (PR [#12](https://github.com/Elabsurdo984/loki-agent/pull/12) by @aipd506).
• Replayer Crash Classification Integrity (REP-02, src/loki/engine/replayer.py):
  • Prevented internal Python syntax or runtime errors during repro_test.py replay execution from being falsely reported as "Crash Reproduced".
• AST-Safe Snippet Alignment & Uniqueness in Code Healer (HLA-01, src/loki/engine/healer.py):
  • Added strict occurrence count validation (count == 1) for exact and fuzzy code replacements, preventing ambiguous patch applications that could corrupt source files.
  • Preserved internal blank line counts in fuzzy sliding window comparisons to eliminate slice index drift.

🖥️ CLI & Interactive REPL Resilience

• Chat REPL Process Survival on Sub-Command Exit (CLI-01, src/loki/ai/chat.py):
  • Updated CLI action runner (_run_cli_action) to intercept (typer.Exit, SystemExit), preventing interactive chat sessions from abruptly terminating when sub-commands exit.
• Chat Role Alternation Preservation (CLI-02, src/loki/ai/chat.py):
  • Prevented orphaned user messages from breaking LLM conversation history role alternation when an AI provider call fails (PR [#11](https://github.com/Elabsurdo984/loki-agent/pull/11) by @TheIrvin).
• Unix In-Memory Module Persistence Post-Update (UPD-01, src/loki/engine/updater.py, src/loki/ai/chat.py):
  • Added explicit restart notices upon successful update on Unix platforms and added an interactive exit confirmation prompt in loki chat's /update command to ensure users do not continue running outdated in-memory bytecode.

🌪️ Infrastructure Chaos Concurrency

• Atomic Worker PID Tracking & TOCTOU Elimination (INF-01, src/loki/engine/infra_chaos.py):
  • Implemented thread and advisory cross-platform file locking (msvcrt.locking on Windows, fcntl.flock on Unix) on .loki/infra_stress_workers.lock.
  • Validated integer types during PID parsing and tracking (PR [#13](https://github.com/Elabsurdo984/loki-agent/pull/13) by @aipd506).
  • Switched PID file writes to atomic temporary file replacement (Path.replace()), preventing file corruption and untracked orphan stress workers under concurrent stress tasks.
• Multi-Process Handling & Partial Kill Visibility (INF-02, src/loki/engine/infra_chaos.py):
  • Enhanced kill_process() to iterate through all processes listening on a shared socket port, returning granular success details and preventing partial kill masking.
  • Updated pause_process() to suspend and safely resume all matching processes across shared ports using a guaranteed try ... finally: lifecycle.

Contributors

• @TheIrvin made their first contribution (PR [#11](https://github.com/Elabsurdo984/loki-agent/pull/11)).
• @aipd506 made their first contribution (PR [#12](https://github.com/Elabsurdo984/loki-agent/pull/12), PR [#13](https://github.com/Elabsurdo984/loki-agent/pull/13), PR [#14](https://github.com/Elabsurdo984/loki-agent/pull/14), PR [#15](https://github.com/Elabsurdo984/loki-agent/pull/15), PR [#17](https://github.com/Elabsurdo984/loki-agent/pull/17)).

Upgrade

uv tool upgrade loki-chaos-agent
# or directly from LOKI:
loki update