codelocal 1.5.0-beta.1

package/README.md

@@ -0,0 +1,27 @@
+# CodeLocal
+
+Local code intelligence and execution runtime for ChatGPT.
+
+## Install
+
+```bash
+npm i -g codelocal
+```
+
+## Run
+
+```bash
+codelocal
+```
+
+CodeLocal starts the machine runtime in your terminal and connects it to ChatGPT.
+
+To authorize the current project once:
+
+```bash
+codelocal .
+```
+
+This npm package contains compiled runtime files only. The CodeLocal source repository and cloud backend are not distributed in this package.
+
+Copyright © CodeLocal. All rights reserved.

package/dist/approval-memory.js

@@ -0,0 +1,105 @@
+import { createHash, randomUUID } from "node:crypto";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { DEFAULT_STATE_DIR, readJsonFile, writeJsonAtomic } from "./state.js";
+function workspaceHash(workspaceKey) {
+    return createHash("sha256").update(workspaceKey).digest("hex").slice(0, 24);
+}
+export class ApprovalMemory {
+    rootDir;
+    constructor(rootDir = path.join(DEFAULT_STATE_DIR, "approvals")) {
+        this.rootDir = rootDir;
+    }
+    fileFor(workspaceKey) {
+        return path.join(this.rootDir, `${workspaceHash(workspaceKey)}.json`);
+    }
+    async read(workspaceKey) {
+        const value = await readJsonFile(this.fileFor(workspaceKey), { version: 1, workspaceKey, approvals: [] });
+        const approvals = Array.isArray(value.approvals)
+            ? value.approvals.filter((entry) => entry?.workspaceKey === workspaceKey && typeof entry.actionKey === "string")
+            : [];
+        return { version: 1, workspaceKey, approvals };
+    }
+    async write(workspaceKey, approvals) {
+        const unique = new Map();
+        for (const entry of approvals)
+            unique.set(entry.actionKey, entry);
+        await writeJsonAtomic(this.fileFor(workspaceKey), {
+            version: 1,
+            workspaceKey,
+            approvals: [...unique.values()].sort((a, b) => b.lastUsedAt - a.lastUsedAt),
+        });
+    }
+    async find(workspaceKey, actionKey) {
+        const data = await this.read(workspaceKey);
+        return data.approvals.find((entry) => entry.actionKey === actionKey) ?? null;
+    }
+    async remember(workspaceKey, decision) {
+        if (decision.approvalPolicy !== "rememberable" || !decision.approvalKey)
+            return null;
+        const data = await this.read(workspaceKey);
+        const previous = data.approvals.find((entry) => entry.actionKey === decision.approvalKey);
+        const now = Date.now();
+        const entry = {
+            id: previous?.id ?? randomUUID(),
+            workspaceKey,
+            actionKey: decision.approvalKey,
+            label: decision.approvalLabel ?? decision.redactedCommand,
+            redactedCommand: decision.redactedCommand,
+            riskLevel: decision.riskLevel,
+            matchedRules: [...decision.matchedRules],
+            createdAt: previous?.createdAt ?? now,
+            lastUsedAt: now,
+            useCount: (previous?.useCount ?? 0) + 1,
+        };
+        await this.write(workspaceKey, [...data.approvals.filter((item) => item.actionKey !== entry.actionKey), entry]);
+        return entry;
+    }
+    async touch(workspaceKey, actionKey) {
+        const data = await this.read(workspaceKey);
+        const entry = data.approvals.find((item) => item.actionKey === actionKey);
+        if (!entry)
+            return null;
+        entry.lastUsedAt = Date.now();
+        entry.useCount = Math.max(0, Number(entry.useCount) || 0) + 1;
+        await this.write(workspaceKey, data.approvals);
+        return entry;
+    }
+    async list(workspaceKey) {
+        if (workspaceKey)
+            return (await this.read(workspaceKey)).approvals;
+        const names = await fs.readdir(this.rootDir).catch(() => []);
+        const output = [];
+        for (const name of names) {
+            if (!name.endsWith(".json"))
+                continue;
+            const value = await readJsonFile(path.join(this.rootDir, name), { version: 1, workspaceKey: "", approvals: [] });
+            if (!value.workspaceKey || !Array.isArray(value.approvals))
+                continue;
+            output.push(...value.approvals.filter((entry) => entry?.workspaceKey === value.workspaceKey && typeof entry.actionKey === "string"));
+        }
+        return output.sort((a, b) => b.lastUsedAt - a.lastUsedAt);
+    }
+    async revoke(identifier, workspaceKey) {
+        const targets = workspaceKey ? [workspaceKey] : [...new Set((await this.list()).map((entry) => entry.workspaceKey))];
+        let removed = 0;
+        for (const key of targets) {
+            const data = await this.read(key);
+            const next = data.approvals.filter((entry) => entry.id !== identifier && entry.actionKey !== identifier);
+            removed += data.approvals.length - next.length;
+            if (next.length !== data.approvals.length)
+                await this.write(key, next);
+        }
+        return removed;
+    }
+    async reset(workspaceKey) {
+        if (workspaceKey) {
+            const data = await this.read(workspaceKey);
+            await fs.rm(this.fileFor(workspaceKey), { force: true });
+            return data.approvals.length;
+        }
+        const count = (await this.list()).length;
+        await fs.rm(this.rootDir, { recursive: true, force: true });
+        return count;
+    }
+}

package/dist/audit.js

@@ -0,0 +1,34 @@
+import path from "node:path";
+import { appendPrivateJsonl, DEFAULT_STATE_DIR } from "./state.js";
+import { redactCommand } from "./security-policy.js";
+const AUDIT_ENABLED = process.env.CODELOCAL_AUDIT_FILE !== "0";
+const AUDIT_FILE = process.env.CODELOCAL_AUDIT_PATH ?? path.join(DEFAULT_STATE_DIR, "audit.jsonl");
+function sanitize(value, key = "") {
+    if (value instanceof Error)
+        return { name: value.name, message: value.message };
+    if (Array.isArray(value))
+        return value.map((item) => sanitize(item));
+    if (typeof value === "string") {
+        if (/command|detail|query/i.test(key))
+            return redactCommand(value).slice(0, 2000);
+        if (/content|patch|input|oldText|newText/i.test(key))
+            return `[${Buffer.byteLength(value, "utf8")} bytes]`;
+        return value.slice(0, 4000);
+    }
+    if (!value || typeof value !== "object")
+        return value;
+    const out = {};
+    for (const [childKey, childValue] of Object.entries(value)) {
+        if (/token|secret|password|authorization|cookie|credentialSecret/i.test(childKey))
+            out[childKey] = "[REDACTED]";
+        else
+            out[childKey] = sanitize(childValue, childKey);
+    }
+    return out;
+}
+export async function audit(event) {
+    if (!AUDIT_ENABLED)
+        return;
+    const record = sanitize({ ts: event.ts ?? new Date().toISOString(), ...event });
+    await appendPrivateJsonl(AUDIT_FILE, record).catch(() => undefined);
+}

package/dist/chat-approval.js

@@ -0,0 +1,77 @@
+import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
+function hash(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function sameHex(a, b) {
+    const aa = Buffer.from(a, "hex");
+    const bb = Buffer.from(b, "hex");
+    return aa.length === bb.length && timingSafeEqual(aa, bb);
+}
+export class ChatApprovalBroker {
+    ttlMs;
+    pending = new Map();
+    constructor(ttlMs = Number(process.env.CODELOCAL_CHAT_APPROVAL_TTL_MS ?? 5 * 60_000)) {
+        this.ttlMs = ttlMs;
+    }
+    fingerprint(command, cwd, decision) {
+        return hash(JSON.stringify({
+            rawCommandHash: hash(command),
+            redactedCommand: decision.redactedCommand,
+            cwd,
+            rules: [...decision.matchedRules].sort(),
+            risk: decision.riskLevel,
+            approvalPolicy: decision.approvalPolicy,
+            approvalKey: decision.approvalKey ?? null,
+        }));
+    }
+    prune() {
+        const now = Date.now();
+        for (const [id, approval] of this.pending)
+            if (approval.expiresAt <= now)
+                this.pending.delete(id);
+    }
+    preflight(command, cwd, decision) {
+        this.prune();
+        if (decision.blocked)
+            return { status: "blocked", riskLevel: decision.riskLevel, reason: decision.reason, matchedRules: decision.matchedRules, command: decision.redactedCommand, approvalPolicy: decision.approvalPolicy, approvalKey: decision.approvalKey, approvalLabel: decision.approvalLabel };
+        if (!decision.requiresApproval)
+            return { status: "safe", riskLevel: decision.riskLevel, reason: decision.reason, matchedRules: decision.matchedRules, command: decision.redactedCommand, approvalPolicy: decision.approvalPolicy, approvalKey: decision.approvalKey, approvalLabel: decision.approvalLabel };
+        const approvalToken = randomUUID() + randomUUID().replaceAll("-", "");
+        const id = randomUUID();
+        const expiresAt = Date.now() + this.ttlMs;
+        this.pending.set(id, { tokenHash: hash(approvalToken), fingerprint: this.fingerprint(command, cwd, decision), expiresAt });
+        return {
+            status: "approval_required",
+            riskLevel: decision.riskLevel,
+            reason: decision.reason,
+            matchedRules: decision.matchedRules,
+            command: decision.redactedCommand,
+            approvalPolicy: decision.approvalPolicy,
+            approvalKey: decision.approvalKey,
+            approvalLabel: decision.approvalLabel,
+            approvalToken: `${id}.${approvalToken}`,
+            expiresAt,
+        };
+    }
+    consume(approvalToken, command, cwd, decision) {
+        this.prune();
+        if (!decision.requiresApproval || decision.blocked)
+            return !decision.blocked;
+        if (!approvalToken)
+            return false;
+        const dot = approvalToken.indexOf(".");
+        if (dot <= 0)
+            return false;
+        const id = approvalToken.slice(0, dot);
+        const secret = approvalToken.slice(dot + 1);
+        const pending = this.pending.get(id);
+        if (!pending)
+            return false;
+        this.pending.delete(id);
+        if (pending.expiresAt <= Date.now())
+            return false;
+        if (!sameHex(pending.tokenHash, hash(secret)))
+            return false;
+        return sameHex(pending.fingerprint, this.fingerprint(command, cwd, decision));
+    }
+}

package/dist/cli-saas.js

@@ -0,0 +1,311 @@
+#!/usr/bin/env node
+import path from "node:path";
+import os from "node:os";
+import { promises as fs } from "node:fs";
+import { spawn } from "node:child_process";
+import { defaultDeviceIdentity, deleteLocalCredential, loadLocalCredential, saveLocalCredential } from "./identity.js";
+import { WorkspaceRegistry } from "./workspace-registry.js";
+import { ApprovalMemory } from "./approval-memory.js";
+import { RuntimeDaemon } from "./runtime-daemon.js";
+const DEFAULT_CLOUD = process.env.CODELOCAL_SERVER ?? "https://codelocal.cloud";
+function usage() {
+    console.log(`CodeLocal CLI · machine runtime
+
+Quick start:
+  codelocal
+
+One-time workspace access:
+  codelocal grant ~/Projects/my-app
+
+Then keep only this running:
+  codelocal
+
+ChatGPT can list your previously granted workspaces and activate the one you choose in chat.
+
+Commands:
+  codelocal                       Start the machine runtime; no project cwd required
+  codelocal grant <project>       Authorize a project folder locally
+  codelocal ungrant <id|project>  Remove a project's local authorization
+  codelocal workspaces            List authorized local workspaces
+  codelocal .                     Backward-compatible: grant + activate current project
+  codelocal <project-path>        Backward-compatible: grant + activate a project
+  codelocal login                 Open CodeLocal login
+  codelocal dashboard             Open CodeLocal dashboard
+  codelocal pair [gateway]        Pair this machine manually
+  codelocal status                Show pairing + workspace status
+  codelocal approvals             List remembered local approvals
+  codelocal approvals revoke <id> Revoke one remembered approval
+  codelocal approvals reset       Forget all remembered approvals
+  codelocal doctor <project>      Run local environment checks
+  codelocal mcp ...               Manage local MCP extensions
+
+Default cloud:
+  ${DEFAULT_CLOUD}
+`);
+}
+function normalizeBase(value) {
+    const url = new URL(value);
+    if (url.protocol === "ws:")
+        url.protocol = "http:";
+    if (url.protocol === "wss:")
+        url.protocol = "https:";
+    url.pathname = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString().replace(/\/$/, "");
+}
+function httpToWs(base) {
+    const url = new URL(normalizeBase(base));
+    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+    url.pathname = "/client";
+    return url.toString();
+}
+function wsToHttp(value) {
+    return normalizeBase(value);
+}
+function openBrowser(url) {
+    try {
+        let command;
+        let args;
+        if (process.platform === "darwin") {
+            command = "open";
+            args = [url];
+        }
+        else if (process.platform === "win32") {
+            command = "cmd";
+            args = ["/c", "start", "", url];
+        }
+        else {
+            command = "xdg-open";
+            args = [url];
+        }
+        const child = spawn(command, args, { detached: true, stdio: "ignore", shell: false });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function pair(baseArg = DEFAULT_CLOUD) {
+    const base = normalizeBase(baseArg || DEFAULT_CLOUD);
+    const wsUrl = httpToWs(base);
+    const existing = await loadLocalCredential(wsUrl);
+    if (existing)
+        return existing;
+    const device = defaultDeviceIdentity();
+    const response = await fetch(`${base}/pair/start`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(device),
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (!response.ok)
+        throw new Error(`Unable to start device pairing (${response.status}).`);
+    const pairing = await response.json();
+    console.log(`\nCodeLocal needs to pair this machine.\n`);
+    console.log(`Pairing code: ${pairing.code}`);
+    console.log(`Approve: ${pairing.approveUrl}\n`);
+    if (openBrowser(pairing.approveUrl))
+        console.log("Opened your default browser. Sign in to CodeLocal and approve this device.");
+    else
+        console.log("Open the approval URL in your browser, sign in, and approve this device.");
+    console.log("Waiting for approval…");
+    while (Date.now() < pairing.expiresAt) {
+        await new Promise((resolve) => setTimeout(resolve, 1800));
+        const claim = await fetch(`${base}/pair/claim`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ pairingId: pairing.pairingId, code: pairing.code }),
+            signal: AbortSignal.timeout(10_000),
+        }).catch(() => null);
+        if (!claim?.ok)
+            continue;
+        const credential = await claim.json();
+        const saved = await saveLocalCredential({ ...credential, serverUrl: wsUrl });
+        console.log(`✓ ${credential.deviceName} paired with CodeLocal Cloud.\n`);
+        return saved;
+    }
+    throw new Error("Pairing expired. Run `codelocal` again to create a new pairing request.");
+}
+async function validateCredential(server, credential) {
+    try {
+        const response = await fetch(`${wsToHttp(server)}/api/client/auth/check`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "x-codelocal-credential-id": credential.credentialId,
+                authorization: `Device ${credential.credentialSecret}`,
+            },
+            body: "{}",
+            signal: AbortSignal.timeout(8_000),
+        });
+        if (response.status === 401 || response.status === 403 || response.status === 404)
+            return false;
+        return true;
+    }
+    catch {
+        return true;
+    }
+}
+async function resolvedRuntime(serverArg) {
+    // The selected gateway must come from an explicit override or this build's default.
+    // Never let a credential saved for an older gateway silently retarget CodeLocal.
+    const configured = serverArg || process.env.SERVER_URL || httpToWs(DEFAULT_CLOUD);
+    const server = configured.startsWith("ws://") || configured.startsWith("wss://") ? configured : httpToWs(configured);
+    let credential = await loadLocalCredential(server);
+    if (credential && !(await validateCredential(server, credential))) {
+        console.log("Stored CodeLocal credential is no longer valid or the gateway is incompatible. Pairing this machine again…");
+        await deleteLocalCredential();
+        credential = null;
+    }
+    if (!credential)
+        credential = await pair(wsToHttp(server));
+    return { server, credential };
+}
+async function runRuntime(projectArg, serverArg) {
+    const registry = new WorkspaceRegistry();
+    let initialWorkspaceId;
+    if (projectArg) {
+        const granted = await registry.grant(projectArg);
+        initialWorkspaceId = granted.workspaceId;
+        console.log(`✓ Workspace granted: ${granted.workspaceName}`);
+    }
+    const { server, credential } = await resolvedRuntime(serverArg);
+    const daemon = new RuntimeDaemon({ baseUrl: wsToHttp(server), serverUrl: server, credential, initialWorkspaceId });
+    const stop = async () => { await daemon.stop(); process.exit(0); };
+    process.once("SIGINT", () => { void stop(); });
+    process.once("SIGTERM", () => { void stop(); });
+    await daemon.run();
+}
+async function grant(projectArg) {
+    if (!projectArg)
+        throw new Error("Usage: codelocal grant <project-folder>");
+    const entry = await new WorkspaceRegistry().grant(projectArg);
+    console.log(`✓ Granted ${entry.workspaceName}`);
+    console.log(`  ID: ${entry.workspaceId}`);
+    console.log(`  Path: ${entry.localPath}`);
+    console.log("If `codelocal` is already running, it will sync this workspace shortly.");
+}
+async function ungrant(identifier) {
+    if (!identifier)
+        throw new Error("Usage: codelocal ungrant <workspace-id|project-folder>");
+    const removed = await new WorkspaceRegistry().revoke(identifier);
+    console.log(removed ? "✓ Workspace authorization removed." : "Workspace was not found in the local authorization registry.");
+}
+async function listWorkspaces() {
+    const workspaces = await new WorkspaceRegistry().list();
+    if (!workspaces.length) {
+        console.log("No authorized workspaces. Use `codelocal grant /path/to/project`.");
+        return;
+    }
+    for (const workspace of workspaces) {
+        console.log(`${workspace.workspaceName}\n  ${workspace.workspaceId}\n  ${workspace.localPath}${workspace.lastActivatedAt ? `\n  last activated ${new Date(workspace.lastActivatedAt).toLocaleString()}` : ""}\n`);
+    }
+}
+async function approvalsCommand(args) {
+    const memory = new ApprovalMemory();
+    const action = args[0] ?? "list";
+    if (action === "list") {
+        const approvals = await memory.list();
+        if (!approvals.length) {
+            console.log("No remembered approvals.");
+            return;
+        }
+        for (const approval of approvals) {
+            console.log(`${approval.label}\n  ID: ${approval.id}\n  Workspace: ${approval.workspaceKey}\n  Key: ${approval.actionKey}\n  Used: ${approval.useCount} · last ${new Date(approval.lastUsedAt).toLocaleString()}\n`);
+        }
+        return;
+    }
+    if (action === "revoke") {
+        const id = args[1];
+        if (!id)
+            throw new Error("Usage: codelocal approvals revoke <id|action-key>");
+        const removed = await memory.revoke(id);
+        console.log(removed ? `✓ Removed ${removed} remembered approval${removed === 1 ? "" : "s"}.` : "Approval not found.");
+        return;
+    }
+    if (action === "reset") {
+        const removed = await memory.reset();
+        console.log(`✓ Forgot ${removed} remembered approval${removed === 1 ? "" : "s"}.`);
+        return;
+    }
+    throw new Error("Usage: codelocal approvals [list|revoke <id|action-key>|reset]");
+}
+async function status() {
+    const credential = await loadLocalCredential();
+    const workspaces = await new WorkspaceRegistry().list();
+    console.log(JSON.stringify({
+        device: defaultDeviceIdentity(),
+        paired: !!credential,
+        authorizedWorkspaces: workspaces.map(({ workspaceId, workspaceName, localPath, grantedAt, lastActivatedAt }) => ({ workspaceId, workspaceName, localPath, grantedAt, lastActivatedAt })),
+        credential: credential ? {
+            credentialId: credential.credentialId,
+            deviceId: credential.deviceId,
+            deviceName: credential.deviceName,
+            serverUrl: credential.serverUrl,
+            createdAt: credential.createdAt,
+            credentialSecret: "[REDACTED]",
+        } : null,
+        stateDir: process.env.CODELOCAL_STATE_DIR ?? path.join(os.homedir(), ".codelocal"),
+    }, null, 2));
+}
+async function login(baseArg = DEFAULT_CLOUD, dashboard = false) {
+    const base = normalizeBase(baseArg || DEFAULT_CLOUD);
+    const url = dashboard ? `${base}/dashboard` : `${base}/login`;
+    console.log(url);
+    if (!openBrowser(url))
+        console.log("Open the URL above in your browser.");
+}
+async function looksLikeProjectPath(value) {
+    if (!value || value.startsWith("-"))
+        return false;
+    if (value === "." || value === ".." || value.startsWith("./") || value.startsWith("../") || path.isAbsolute(value))
+        return true;
+    return fs.stat(path.resolve(value)).then((stat) => stat.isDirectory()).catch(() => false);
+}
+async function delegateLegacyCli() {
+    await import("./cli.js");
+}
+const [, , command, ...args] = process.argv;
+try {
+    if (!command)
+        await runRuntime();
+    else if (command === "help" || command === "--help" || command === "-h")
+        usage();
+    else if (command === "login")
+        await login(args[0] ?? DEFAULT_CLOUD, false);
+    else if (command === "dashboard")
+        await login(args[0] ?? DEFAULT_CLOUD, true);
+    else if (command === "pair") {
+        await pair(args[0] ?? DEFAULT_CLOUD);
+    }
+    else if (command === "status")
+        await status();
+    else if (command === "approvals")
+        await approvalsCommand(args);
+    else if (command === "workspaces")
+        await listWorkspaces();
+    else if (command === "grant")
+        await grant(args[0]);
+    else if (command === "ungrant")
+        await ungrant(args[0]);
+    else if (command === "start")
+        await runRuntime(args[0] ?? ".", args[1]);
+    else if (command === "doctor" || command === "mcp")
+        await delegateLegacyCli();
+    else if (command === "rotate" || command === "revoke") {
+        console.log("Device rotation/revocation is account-scoped in SaaS mode. Opening Security/Devices dashboard…");
+        await login(DEFAULT_CLOUD, true);
+    }
+    else if (await looksLikeProjectPath(command))
+        await runRuntime(command, args[0]);
+    else {
+        usage();
+        process.exitCode = 1;
+    }
+}
+catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+}