lcode-cli 0.4.1__py3-none-any.whl → 0.6.0__py3-none-any.whl

lcode/__init__.py

@@ -1,3 +1,3 @@
 """lcode — a local-first terminal coding agent powered by open-weight models via Ollama."""
 
-__version__ = "0.4.1"
+__version__ = "0.6.0"

lcode/agent.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import base64
 import datetime as dt
 import json
 import platform
@@ -19,18 +20,21 @@ from rich.markup import escape
 from rich.panel import Panel
 from rich.text import Text
 
-from lcode import catalog, limits, sessions, web
+from lcode import catalog, limits, sessions, vision, web
 from lcode.checkpoints import Checkpoints
 from lcode.config import format_tokens
 from lcode.mcp import McpManager
 from lcode.ollama import Ollama, OllamaError
 from lcode.permissions import Permissions
 from lcode.render import MarkdownStreamer
+from lcode.sandbox import Sandbox, SandboxError, project_root
 from lcode.tools import (
     SCHEMAS,
+    VIEW_IMAGE_SCHEMA,
     WEB_FETCH_SCHEMA,
     WEB_SEARCH_SCHEMA,
     Toolbox,
+    ToolError,
     is_binary,
     parse_text_tool_calls,
     tree,
@@ -140,6 +144,10 @@ class Settings:
     search_backend: str = "auto"
     searxng_url: str | None = None
     checkpoints: bool = True  # snapshot files before the model changes them, for /undo
+    sandbox: str = "off"  # off, docker or podman: where the model's shell commands run
+    sandbox_image: str | None = None
+    sandbox_network: bool = False
+    vision_model: str = "auto"  # auto, off or an Ollama model that can see images
 
 
 class Agent:
@@ -153,7 +161,13 @@ class Agent:
         self.session_id = self.new_session_id()
         self.checkpoints = Checkpoints(self.console, settings.checkpoints)
         self.mcp: McpManager | None = None  # set by the CLI when MCP servers are configured
+        self.sandbox = (
+            Sandbox(settings.sandbox, settings.sandbox_image, settings.sandbox_network, self.console)
+            if settings.sandbox != "off"
+            else None
+        )
         self._mcp_prompt = ""  # the MCP part at the end of the system prompt
+        self._vision: str | bool | None = False  # the model that looks at images; False = not decided yet
         self.session_name = ""
         self.session_title = ""
         self.ctx_used = 0
@@ -195,10 +209,65 @@ class Agent:
         schemas = list(SCHEMAS)
         if self.settings.web != "off":
             schemas += [*([WEB_SEARCH_SCHEMA] if self.search_backend() else []), WEB_FETCH_SCHEMA]
+        if self.vision_model():
+            schemas.append(VIEW_IMAGE_SCHEMA)
         if self.mcp:
             schemas += self.mcp.schemas(self.settings.context)
         return schemas
 
+    def vision_model(self) -> str | None:
+        """The model that looks at images for this session, if any (see lcode.vision)."""
+        if self._vision is False:
+            self._vision = vision.pick_model(self.ollama, self.settings.model, self.settings.vision_model)
+        return self._vision or None
+
+    def free_gpu(self) -> list[str]:
+        """Unload lcode's models from Ollama so another program can use the GPU; the next request reloads.
+
+        Only lcode's own models: the session's and the one that looks at images.
+        """
+        mine = {self.settings.model, *([self._vision] if isinstance(self._vision, str) else [])}
+        freed = []
+        for entry in self.ollama.running():
+            name = entry.get("name") or entry.get("model") or ""
+            if name in mine or name.removesuffix(":latest") in mine:
+                try:
+                    self.ollama.unload(name)
+                    freed.append(name.removesuffix(":latest"))
+                except OllamaError:
+                    pass
+        return freed
+
+    def look(self, path: Path, question: str = "") -> str:
+        """Describe an image with the vision model. Raises ToolError if it can't."""
+        model = self.vision_model()
+        if not model:
+            raise ToolError(f"can't look at {path.name}: {vision.INSTALL_HINT}")
+        try:
+            image = vision.read_image(path)
+            # The session's own model keeps its settings, so Ollama doesn't reload it.
+            options = self.options() if model == self.settings.model else None
+            loading = "" if model == self.settings.model else " (loads it; the next request reloads the main model)"
+            with self.console.status(f"Looking at {path.name} with {model}{loading}…", spinner="dots"):
+                return vision.describe(self.ollama, model, image, question, options, self.settings.keep_alive)
+        except vision.VisionError as e:
+            raise ToolError(str(e)) from e
+
+    def describe_image_data(self, data: str, mime: str) -> str:
+        """For images that tools return (e.g. an MCP browser's screenshots): a description, or a note."""
+        model = self.vision_model()
+        if not model:
+            return f"[{mime} image not shown: {vision.INSTALL_HINT}]"
+        options = self.options() if model == self.settings.model else None
+        try:
+            with self.console.status(f"Looking at the {mime} image with {model}…", spinner="dots"):
+                text = vision.describe(
+                    self.ollama, model, base64.b64decode(data), "", options, self.settings.keep_alive
+                )
+        except (vision.VisionError, ValueError) as e:
+            return f"[{mime} image not shown: {e}]"
+        return f"[{mime} image, as described by {model}]\n{text}"
+
     def prepare_mcp(self) -> None:
         """Before a request: wait for MCP servers still starting and describe them in the system prompt."""
         if not self.mcp:
@@ -462,6 +531,15 @@ class Agent:
         finally:
             self.checkpoints.end_turn()
 
+    def sandbox_root(self) -> Path | None:
+        """The folder the model is limited to while the sandbox is on (None when it's off)."""
+        if not self.sandbox:
+            return None
+        try:
+            return project_root(self.cwd)
+        except SandboxError:
+            return self.cwd
+
     def checkpoint(self) -> None:
         """Called before the model changes files: snapshot them once per request, for /undo."""
         self.checkpoints.before_change(self.cwd)
@@ -541,7 +619,17 @@ class Agent:
         attached = []
         for ref in re.findall(r"(?<!\S)@([\w./~\-]+)", text):
             p = self.tools.resolve(ref)
-            if p.is_file() and not is_binary(p) and p.stat().st_size < 200_000:
+            if p.is_file() and vision.is_image(p):
+                try:
+                    description = self.look(p, re.sub(r"(?<!\S)@[\w./~\-]+", "", text))
+                    who = f' described_by="{self.vision_model()}"'
+                except ToolError as e:
+                    description, who = f"(lcode couldn't look at this image: {e})", ""
+                    self.console.print(Text(f"  ⎿ {e}", style="yellow"))
+                else:
+                    self.console.print(Text(f"  ⎿ looked at {self.tools.rel(p)}", style="dim"))
+                attached.append(f'<image path="{self.tools.rel(p)}"{who}>\n{description}\n</image>')
+            elif p.is_file() and not is_binary(p) and p.stat().st_size < 200_000:
                 attached.append(f'<file path="{self.tools.rel(p)}">\n{p.read_text(errors="replace")}\n</file>')
                 self.tools.read_mtimes[str(p)] = p.stat().st_mtime
                 self.console.print(Text(f"  ⎿ attached {self.tools.rel(p)}", style="dim"))

lcode/cli.py

@@ -273,6 +273,17 @@ def cmd_doctor(args) -> None:
         if spec:
             detail += f" · ~{spec.memory_gib(ctx):.0f} GB needed, ~{hw.budget_gib:.0f} GB available"
         line("Context", detail + (f" ({note})" if note else ""), None if note else True)
+        from lcode import vision
+
+        seer = vision.pick_model(ollama, model, cfg["vision_model"])
+        if seer:
+            line(
+                "Vision",
+                f"{seer} looks at screenshots and images" + ("" if seer == model else " (loaded when needed)"),
+                True,
+            )
+        else:
+            line("Vision", "off" if cfg["vision_model"] == "off" else vision.INSTALL_HINT, None)
         if limits.get(model):
             line(
                 "Limit",
@@ -321,6 +332,15 @@ def cmd_doctor(args) -> None:
     except ValueError as e:
         line("MCP", str(e), False)
         ok = False
+    if cfg["sandbox"] == "off":
+        line("Sandbox", "off (lcode config set sandbox docker)", True)
+    else:
+        from lcode.sandbox import engine_problem
+
+        problem = engine_problem(cfg["sandbox"])
+        network = "network on" if cfg["sandbox_network"] else "no network"
+        line("Sandbox", problem or f"{cfg['sandbox']} · {network}", problem is None)
+        ok &= problem is None
     node = shutil.which("npx")
     line("Node.js", "found" if node else "not found (some MCP servers need npx)", True if node else None)
     sys.exit(0 if ok else 1)
@@ -485,8 +505,21 @@ def cmd_chat(args) -> None:
         search_backend=cfg["search_backend"],
         searxng_url=cfg["searxng_url"],
         checkpoints=cfg["checkpoints"],
+        sandbox=(cfg["sandbox"] if cfg["sandbox"] != "off" else "docker") if args.sandbox else cfg["sandbox"],
+        sandbox_image=cfg["sandbox_image"],
+        sandbox_network=cfg["sandbox_network"],
+        vision_model=cfg["vision_model"],
     )
     agent = Agent(ollama, settings, cwd, console=console)
+    if agent.sandbox:
+        # Never run commands unsandboxed when the user asked for a sandbox: stop here instead.
+        from lcode.sandbox import SandboxError
+
+        try:
+            with console.status("Starting the sandbox…"):
+                agent.sandbox.ensure(cwd)
+        except SandboxError as e:
+            fail(f"the sandbox can't start: {e}\nTurn it off with: lcode config set sandbox off")
     if not args.no_mcp:
         from lcode.mcp.commands import start_session
 
@@ -496,6 +529,8 @@ def cmd_chat(args) -> None:
     finally:
         if agent.mcp:
             agent.mcp.close()
+        if agent.sandbox:
+            agent.sandbox.stop()
 
 
 def build_parser() -> argparse.ArgumentParser:
@@ -522,6 +557,7 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--no-think", action="store_true", help="disable model reasoning (faster, less accurate)")
     parser.add_argument("--no-web", action="store_true", help="don't let the model search or fetch web pages")
     parser.add_argument("--no-mcp", action="store_true", help="don't start MCP servers in this session")
+    parser.add_argument("--sandbox", action="store_true", help="run shell commands in a container (Docker or Podman)")
     parser.add_argument("--show-thinking", action="store_true", help="print the model's reasoning as it streams")
     parser.add_argument("-V", "--version", action="version", version=f"lcode {__version__}")
     return parser

lcode/config.py

@@ -25,6 +25,7 @@ PERMISSION_MODES = ("ask", "auto-edit", "yolo")
 WEB_MODES = ("on", "ask", "off")
 SEARCH_BACKENDS = ("auto", "ollama", "brave", "tavily", "searxng")
 MCP_TOOL_MODES = ("auto", "direct", "search")
+SANDBOX_ENGINES = ("off", "docker", "podman")
 
 # key -> (default, type, help)
 SETTINGS: dict[str, tuple[object, type, str]] = {
@@ -39,6 +40,10 @@ SETTINGS: dict[str, tuple[object, type, str]] = {
     "search_backend": ("auto", str, "auto | ollama | brave | tavily | searxng (keys come from environment variables)"),
     "searxng_url": (None, str, "your SearXNG instance, e.g. http://localhost:8888"),
     "checkpoints": (True, bool, "snapshot files before the model changes them, so /undo can restore them"),
+    "sandbox": ("off", str, "run the model's shell commands in a container: off | docker | podman"),
+    "sandbox_image": (None, str, "container image for the sandbox (default: lcode's, built on first use)"),
+    "sandbox_network": (False, bool, "let commands in the sandbox use the network"),
+    "vision_model": ("auto", str, "model that looks at images: auto | off | an Ollama model with vision"),
     "mcp_tools": ("auto", str, "how MCP tools reach the model: auto | direct | search (on demand, saves context)"),
 }
 ENV_OVERRIDES = {
@@ -48,6 +53,7 @@ ENV_OVERRIDES = {
     "LCODE_KEEP_ALIVE": "keep_alive",
     "OLLAMA_HOST": "ollama_host",
     "LCODE_WEB": "web",
+    "LCODE_SANDBOX": "sandbox",
 }
 
 
@@ -99,6 +105,11 @@ def coerce(key: str, value: object) -> object:
         if value not in WEB_MODES:
             raise ConfigError(f"web must be one of {', '.join(WEB_MODES)}")
         return value
+    if key == "sandbox":
+        value = {"none": "off", "false": "off", "no": "off"}.get(str(value).lower(), str(value).lower())
+        if value not in SANDBOX_ENGINES:
+            raise ConfigError(f"sandbox must be one of {', '.join(SANDBOX_ENGINES)}")
+        return value
     if key == "mcp_tools" and value not in MCP_TOOL_MODES:
         raise ConfigError(f"mcp_tools must be one of {', '.join(MCP_TOOL_MODES)}")
     if key == "search_backend" and value not in SEARCH_BACKENDS:

lcode/mcp/catalog.toml

@@ -130,6 +130,34 @@ requires = ["npx"]
 setup = "Runs a headless browser; the first use may download it."
 server = { command = "npx", args = ["-y", "@playwright/mcp@latest", "--headless"] }
 
+[comfyui]
+name = "ComfyUI"
+description = "Generate and edit images with models you run locally in ComfyUI: FLUX, SDXL, SD 1.5, Qwen-Image"
+homepage = "https://github.com/Comfy-Org/comfy-mcp"
+requires = ["uvx"]
+setup = """Needs ComfyUI on this machine (http://127.0.0.1:8188) with at least one image model:
+  uv tool install comfy-cli && comfy install
+  comfy launch --background -- --disable-smart-memory
+--disable-smart-memory makes ComfyUI give the GPU back after each image. Before generating, lcode
+unloads its own model so ComfyUI has the GPU; it reloads afterwards. Only the local tools are on;
+Comfy Cloud's partner tools are left out, so nothing leaves this machine."""
+
+[comfyui.server]
+command = "uvx"
+args = ["--python", "3.12", "--from", "comfy-mcp", "--with", "comfy-cli>=1.14.0", "comfy-mcp"]
+env = { COMFYUI_URL = "${COMFYUI_URL}" }
+tools = [
+  "server_info", "generate_image", "run_workflow", "run_template", "search_templates", "get_template", "fetch_template",
+  "list_workflow_slots", "set_workflow_slot", "job", "fetch_outputs", "upload_file", "search_models",
+  "download_model", "system_stats", "free_memory", "launch_comfyui",
+]
+free_gpu = ["generate_image", "run_workflow", "run_template"]
+
+[[comfyui.inputs]]
+var = "COMFYUI_URL"
+prompt = "ComfyUI address (Enter for this machine, 127.0.0.1:8188)"
+optional = true
+
 [context7]
 name = "Context7"
 description = "Current documentation and code examples for thousands of libraries"

lcode/mcp/config.py

@@ -2,7 +2,8 @@
 
 Both use the `mcpServers` format that most MCP servers document, so a snippet from a server's README
 can be pasted in as is. lcode adds a few optional keys per server: `disabled`, `tools` (only offer
-these tools to the model), `allow` (tools that don't need approval), `timeout` and `oauth`.
+these tools to the model), `allow` (tools that don't need approval), `timeout`, `oauth` and
+`free_gpu` (tools that need the GPU to themselves, so lcode unloads its model first).
 Values can refer to environment variables as ${NAME} or ${NAME:-default}.
 """
 
@@ -69,6 +70,7 @@ class ServerConfig:
     timeout: float = DEFAULT_TIMEOUT
     oauth: dict = field(default_factory=dict)
     disabled: bool = False
+    free_gpu: list[str] | bool = False  # tools (or all, if True) that need lcode's model off the GPU
     error: str = ""  # a problem with the settings; the server can't start
 
     @property
@@ -121,6 +123,8 @@ def parse(name: str, raw: dict, source: str = "user") -> ServerConfig:
         cfg.error = f"the environment variable {e} isn't set"
     tools = raw.get("tools")
     cfg.tools = [str(t) for t in tools] if isinstance(tools, list) else None
+    free_gpu = raw.get("free_gpu", False)
+    cfg.free_gpu = [str(t) for t in free_gpu] if isinstance(free_gpu, list) else bool(free_gpu)
     cfg.allow = [str(t) for t in raw.get("allow") or []] if isinstance(raw.get("allow"), list) else []
     try:
         cfg.timeout = float(raw.get("timeout", DEFAULT_TIMEOUT))

lcode/mcp/manager.py

@@ -317,15 +317,20 @@ class McpManager:
             raise McpError("`arguments` must be a JSON object")
         return found[0], found[1], arguments
 
+    def needs_gpu(self, state: ServerState, tool: dict) -> bool:
+        """Whether lcode should free the GPU (unload its model) before this tool runs."""
+        wanted = state.cfg.free_gpu
+        return wanted is True or (isinstance(wanted, list) and tool["name"] in wanted)
+
     def allowed(self, state: ServerState, tool: dict) -> bool:
         """Tools the user allowed in mcp.json run without asking."""
         return "*" in state.cfg.allow or tool["name"] in state.cfg.allow
 
-    def call(self, state: ServerState, tool: dict, arguments: dict) -> str:
+    def call(self, state: ServerState, tool: dict, arguments: dict, image_text=None) -> str:
         try:
             if state.conn is None:
                 raise TransportError("the server isn't connected")
-            return result_text(state.conn.call_tool(tool, arguments, state.cfg.timeout))
+            return result_text(state.conn.call_tool(tool, arguments, state.cfg.timeout), image_text)
         except AuthRequired:
             state.status = "login"
             state.error = f"sign-in expired: run /mcp login {state.name}"
@@ -336,7 +341,7 @@ class McpManager:
                 self.restart(state.name)
                 if state.status == "ready" and state.conn:
                     try:
-                        return result_text(state.conn.call_tool(tool, arguments, state.cfg.timeout))
+                        return result_text(state.conn.call_tool(tool, arguments, state.cfg.timeout), image_text)
                     except McpError as again:
                         return f"Error: {again}"
             return f"Error: {state.name}: {e}"

lcode/mcp/protocol.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 import base64
 import json
 import re
+from collections.abc import Callable
 
 from lcode import __version__
 
@@ -99,8 +100,8 @@ def param_headers(schema: dict, arguments: dict) -> dict[str, str] | None:
     return headers if walk(schema, arguments) else None
 
 
-def result_text(result: dict) -> str:
-    """Turn a tools/call result into text for the model."""
+def result_text(result: dict, image_text: Callable[[str, str], str] | None = None) -> str:
+    """Turn a tools/call result into text for the model. `image_text(data, mime)` describes images."""
     parts = []
     for item in result.get("content") or []:
         if not isinstance(item, dict):
@@ -108,6 +109,8 @@ def result_text(result: dict) -> str:
         kind = item.get("type")
         if kind == "text":
             parts.append(str(item.get("text", "")))
+        elif kind == "image" and image_text and item.get("data"):
+            parts.append(image_text(item["data"], item.get("mimeType", "image/png")))
         elif kind in ("image", "audio"):
             parts.append(f"[{kind} ({item.get('mimeType', 'unknown type')}) not shown]")
         elif kind == "resource_link":

lcode/ollama.py

@@ -68,6 +68,10 @@ class Ollama:
                 names.add(m["name"][: -len(":latest")])
         return names
 
+    def chat(self, payload: dict, timeout: float = 900) -> dict:
+        """One chat request without streaming."""
+        return self._post("/api/chat", {**payload, "stream": False}, timeout=timeout)
+
     def show(self, model: str) -> dict:
         return self._post("/api/show", {"model": model})
 

lcode/repl.py

@@ -39,6 +39,7 @@ COMMANDS = {
     "/undo": "Undo the file changes of the last request (lcode saves a checkpoint before changing files)",
     "/rewind": "Go back to before an earlier request: its files, and optionally the conversation",
     "/checkpoints": "List the requests that changed files, and which files",
+    "/sandbox": "Shell-command sandbox: status, or /sandbox network on|off",
     "/mcp": "MCP servers and their tools: /mcp, /mcp tools NAME, /mcp login NAME, /mcp restart NAME",
     "/compact": "Summarize the conversation to free context (optional: what to focus on)",
     "/context": "Show context usage and change the window size: pick from a list, or /context 128k",
@@ -143,6 +144,11 @@ def banner(agent: Agent) -> None:
                     f"[dim]mode[/]     {agent.perms.mode} [dim](Shift+Tab to cycle)[/]\n"
                     f"[dim]web[/]      {web_status(agent)}\n"
                     + (f"[dim]mcp[/]      {escape(', '.join(agent.mcp.servers))} [dim](/mcp)[/]\n" if agent.mcp else "")
+                    + (
+                        f"[dim]sandbox[/]  {escape(agent.sandbox.describe())} [dim](/sandbox)[/]\n"
+                        if agent.sandbox
+                        else ""
+                    )
                     + "\n"
                     "[dim]/help for commands · @file to attach · Esc+Enter for a newline[/]"
                 ),
@@ -240,6 +246,31 @@ def context_command(agent: Agent, arg: str, hardware: Hardware) -> None:
     apply_context(agent, size, hardware)
 
 
+def sandbox_command(agent: Agent, arg: str) -> None:
+    c, sandbox = agent.console, agent.sandbox
+    if sandbox is None:
+        c.print(
+            "The sandbox is off: shell commands run directly on this machine. Start lcode with --sandbox, or "
+            "turn it on for every session with: lcode config set sandbox docker"
+        )
+        return
+    words = arg.split()
+    if len(words) == 2 and words[0] == "network" and words[1] in ("on", "off"):
+        sandbox.network = words[1] == "on"
+        sandbox.stop()  # the next command starts a container with the new setting
+        c.print(f"Network access in the sandbox is {words[1]} from the next command.")
+        return
+    if arg:
+        c.print("[yellow]Use /sandbox or /sandbox network on|off.[/]")
+        return
+    where = f" · container {sandbox.container}, mounting {sandbox.root}" if sandbox.container else ""
+    c.print(f"Sandbox: {escape(sandbox.describe())}{escape(where)}")
+    c.print(
+        "[dim]Shell commands run in the container and can only see this project; file tools are limited to it "
+        "too. In auto-edit mode, commands run without asking.[/]"
+    )
+
+
 def mcp_command(agent: Agent, arg: str) -> None:
     from lcode.mcp.commands import status_table
     from lcode.mcp.protocol import McpError
@@ -515,6 +546,8 @@ def handle_command(agent: Agent, line: str, hardware: Hardware) -> bool:
         print_checkpoints(agent)
     elif cmd == "/mcp":
         mcp_command(agent, arg)
+    elif cmd == "/sandbox":
+        sandbox_command(agent, arg)
     elif cmd == "/compact":
         agent.compact(arg)
     elif cmd in ("/context", "/ctx"):

lcode/sandbox.py

@@ -0,0 +1,204 @@
+"""An optional sandbox: the model's shell commands run in a container that only sees the project.
+
+One container per session. The project (the git repository around the working directory, or the
+working directory itself) is mounted at the same path, so paths in command output stay valid and
+lcode's file tools, which run on the host, see the same files. Commands run as the host user, with
+no network unless it's allowed, no Linux capabilities, a process limit, and nothing else from the
+host: not the home folder, not the Docker socket.
+
+The default image is built locally on first use from the Dockerfile below. Any image with bash and
+setsid (util-linux or busybox) can be used instead (`sandbox_image`).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import platform
+import secrets
+import shutil
+import subprocess
+from pathlib import Path
+
+from rich.console import Console
+
+DOCKERFILE = """\
+FROM python:3.12-slim-bookworm
+RUN apt-get update \\
+ && apt-get install -y --no-install-recommends \\
+      git curl ca-certificates build-essential ripgrep jq unzip less procps nodejs npm \\
+ && rm -rf /var/lib/apt/lists/*
+"""
+DEFAULT_IMAGE = f"lcode-sandbox:{hashlib.sha256(DOCKERFILE.encode()).hexdigest()[:12]}"
+LABEL = "dev.lcode.sandbox"
+HOME = "/tmp/lcode-home"
+ENGINES = ("docker", "podman")
+
+
+class SandboxError(Exception):
+    """The sandbox can't be used; the message says how to fix it."""
+
+
+def engine_problem(engine: str) -> str | None:
+    """Why `engine` can't run containers here, or None if it can."""
+    if not shutil.which(engine):
+        if engine == "podman":
+            return "podman isn't installed (https://podman.io/docs/installation)"
+        if platform.system() == "Darwin":
+            return "docker isn't installed: install Docker Desktop, OrbStack or colima"
+        return "docker isn't installed (https://docs.docker.com/engine/install/)"
+    try:
+        r = subprocess.run(
+            [engine, "version", "--format", "{{.Server.Version}}"], capture_output=True, text=True, timeout=20
+        )
+    except (OSError, subprocess.SubprocessError) as e:
+        return f"{engine} doesn't respond: {e}"
+    if r.returncode != 0:
+        detail = (r.stderr.strip().splitlines() or [""])[-1]
+        if "permission denied" in detail.lower():
+            return (
+                f"{engine} needs permission: add yourself to the docker group "
+                "(sudo usermod -aG docker $USER, then log in again)"
+            )
+        if platform.system() == "Darwin":
+            return f"{engine} isn't running: start Docker Desktop, OrbStack or colima ({detail})"
+        return f"{engine} isn't running: start it (sudo systemctl start {engine}) ({detail})"
+    return None
+
+
+def remove_orphans(engine: str) -> None:
+    """Remove sandboxes left behind by lcode sessions that ended without cleaning up."""
+    try:
+        r = subprocess.run(
+            [engine, "ps", "-a", "--filter", f"label={LABEL}", "--format", '{{.ID}} {{.Label "dev.lcode.pid"}}'],
+            capture_output=True,
+            text=True,
+            timeout=20,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return
+    stale = []
+    for line in r.stdout.split("\n"):
+        parts = line.split()
+        if len(parts) == 2 and parts[1].isdigit() and not _alive(int(parts[1])):
+            stale.append(parts[0])
+    if stale:
+        subprocess.run([engine, "rm", "-f", *stale], capture_output=True, timeout=60)
+
+
+def _alive(pid: int) -> bool:
+    try:
+        os.kill(pid, 0)
+    except ProcessLookupError:
+        return False
+    except PermissionError:
+        return True
+    return True
+
+
+class Sandbox:
+    def __init__(self, engine: str, image: str | None = None, network: bool = False, console: Console | None = None):
+        if engine not in ENGINES:
+            raise SandboxError(f"unknown sandbox {engine!r}; use docker or podman")
+        self.engine = engine
+        self.image = image or DEFAULT_IMAGE
+        self.network = network
+        self.console = console or Console()
+        self.container: str | None = None
+        self.root: Path | None = None
+
+    # -- lifecycle
+    def check(self) -> None:
+        problem = engine_problem(self.engine)
+        if problem:
+            raise SandboxError(problem)
+
+    def contains(self, path: Path) -> bool:
+        return self.root is not None and (path == self.root or self.root in path.parents)
+
+    def ensure(self, cwd: Path) -> None:
+        """Have a container running whose mounted folder includes `cwd`."""
+        if self.container and self.contains(cwd):
+            return
+        self.stop()
+        self.check()
+        remove_orphans(self.engine)
+        if self.image == DEFAULT_IMAGE:
+            self._build_default_image()
+        root = project_root(cwd)
+        name = f"lcode-sandbox-{os.getpid()}-{secrets.token_hex(3)}"
+        command = [
+            self.engine, "run", "--detach", "--init", "--name", name,
+            "--label", LABEL, "--label", f"dev.lcode.pid={os.getpid()}",
+            "--cap-drop", "ALL", "--security-opt", "no-new-privileges", "--pids-limit", "1024",
+            "--volume", f"{root}:{root}", "--workdir", str(cwd),
+            "--env", f"HOME={HOME}", "--tmpfs", f"{HOME}:exec,mode=1777",
+        ]  # fmt: skip
+        if not self.network:
+            command += ["--network", "none"]
+        if self.engine == "podman":
+            command += ["--userns", "keep-id"]  # rootless podman: files belong to the host user
+        else:
+            command += ["--user", f"{os.getuid()}:{os.getgid()}"]
+        command += [self.image, "sleep", "infinity"]
+        r = subprocess.run(command, capture_output=True, text=True, timeout=300)
+        if r.returncode != 0:
+            raise SandboxError(f"couldn't start the sandbox: {(r.stderr.strip().splitlines() or ['?'])[-1]}")
+        self.container, self.root = name, root
+
+    def _build_default_image(self) -> None:
+        exists = subprocess.run([self.engine, "image", "inspect", self.image], capture_output=True, timeout=30)
+        if exists.returncode == 0:
+            return
+        with self.console.status("Building the sandbox image (once; a minute or two)…"):
+            r = subprocess.run(
+                [self.engine, "build", "--tag", self.image, "-"],
+                input=DOCKERFILE,
+                capture_output=True,
+                text=True,
+                timeout=1800,
+            )
+        if r.returncode != 0:
+            tail = "\n".join(r.stderr.strip().splitlines()[-5:])
+            raise SandboxError(f"couldn't build the sandbox image:\n{tail}")
+
+    def exec_argv(self, cwd: Path, script: str) -> tuple[list[str], str]:
+        """The command that runs `script` with bash inside the container, and a token for kill()."""
+        assert self.container is not None
+        token = secrets.token_hex(6)
+        # Its own session, so a timeout or Ctrl+C can stop everything the command started.
+        script = f"echo $$ > /tmp/.lcode-{token}.pgid\n{script}"
+        argv = [self.engine, "exec", "--interactive", "--workdir", str(cwd), self.container]
+        return [*argv, "setsid", "--wait", "bash", "-c", script], token
+
+    def kill(self, token: str) -> None:
+        """Stop a command and everything it started (after a timeout or Ctrl+C); the container stays."""
+        if self.container:
+            pgid = f"$(cat /tmp/.lcode-{token}.pgid 2>/dev/null)"
+            subprocess.run(
+                # bash, not sh: dash's kill doesn't accept "--" before a negative (process group) id
+                [self.engine, "exec", self.container, "bash", "-c", f'[ -n "{pgid}" ] && kill -KILL -- -{pgid}'],
+                capture_output=True,
+                timeout=30,
+            )
+
+    def stop(self) -> None:
+        if self.container:
+            subprocess.run([self.engine, "rm", "--force", self.container], capture_output=True, timeout=60)
+        self.container, self.root = None, None
+
+    def describe(self) -> str:
+        image = "lcode's image" if self.image == DEFAULT_IMAGE else self.image
+        network = "network on" if self.network else "no network"
+        return f"{self.engine} · {image} · {network}"
+
+
+def project_root(cwd: Path) -> Path:
+    """The folder the sandbox mounts: the git repository around `cwd`, or `cwd` itself."""
+    from lcode.checkpoints import work_tree_for
+
+    root = work_tree_for(cwd)
+    home = Path.home().resolve()
+    if root == home or root in home.parents or root == Path("/"):
+        raise SandboxError(f"won't mount {root} into the sandbox; start lcode in a project folder")
+    return root

lcode/tools.py

@@ -9,11 +9,10 @@ import json
 import os
 import queue
 import re
-import shlex
+import secrets
 import shutil
 import signal
 import subprocess
-import tempfile
 import threading
 import time
 from pathlib import Path
@@ -25,10 +24,16 @@ from rich.text import Text
 
 from lcode import web
 from lcode.permissions import bash_key, is_read_only
+from lcode.sandbox import SandboxError
+from lcode.vision import is_image
 
 if TYPE_CHECKING:
     from lcode.agent import Agent
 
+NO_NETWORK = re.compile(
+    r"Network is unreachable|Temporary failure in name resolution|Could not resolve host|getaddrinfo|ENOTFOUND|"
+    r"EAI_AGAIN|Name or service not known|network is unreachable|No route to host"
+)
 MAX_TOOL_OUTPUT = 30_000  # characters returned to the model per tool call
 IGNORE_DIRS = {
     ".git", "node_modules", "__pycache__", ".venv", "venv", "env", ".mypy_cache", ".pytest_cache",
@@ -158,7 +163,17 @@ WEB_FETCH_SCHEMA = _fn(
     },
     ["url"],
 )
-TOOL_NAMES = {s["function"]["name"] for s in [*SCHEMAS, WEB_SEARCH_SCHEMA, WEB_FETCH_SCHEMA]}
+VIEW_IMAGE_SCHEMA = _fn(
+    "view_image",
+    "Look at an image file (screenshot, diagram, photo, mockup): returns a detailed description with all visible "
+    "text transcribed. Ask a specific question to focus it.",
+    {
+        "path": {"type": "string", "description": "Image file: png, jpg, webp or gif"},
+        "question": {"type": "string", "description": "What you need to know from the image (optional)"},
+    },
+    ["path"],
+)
+TOOL_NAMES = {s["function"]["name"] for s in [*SCHEMAS, WEB_SEARCH_SCHEMA, WEB_FETCH_SCHEMA, VIEW_IMAGE_SCHEMA]}
 
 
 # ----------------------------------------------------------------------------- helpers
@@ -277,6 +292,14 @@ class Toolbox:
         p = Path(os.path.expanduser(path or "."))
         return (p if p.is_absolute() else self.agent.cwd / p).resolve()
 
+    def path(self, path: str | None) -> Path:
+        """Resolve a path from the model; with the sandbox on, it must be inside the project."""
+        p = self.resolve(path)
+        root = self.agent.sandbox_root()
+        if root is not None and p != root and root not in p.parents:
+            raise ToolError(f"{path} is outside the project ({root}); with the sandbox on, that's all you can use")
+        return p
+
     def rel(self, p: Path) -> str:
         try:
             return str(p.relative_to(self.agent.cwd)) or "."
@@ -317,6 +340,11 @@ class Toolbox:
         valid = ", ".join(p if params[p].default is inspect.Parameter.empty else f"{p} (optional)" for p in params)
         return f"{'; '.join(parts)}. Valid arguments: {valid}."
 
+    # -- images
+    def t_view_image(self, path: str, question: str = "") -> str:
+        p = self.path(path)
+        return f"[{self.rel(p)}, as described by {self.agent.vision_model()}]\n" + self.agent.look(p, question)
+
     # -- MCP servers
     def _mcp(self, name: str, args: dict) -> str:
         mcp = self.agent.mcp
@@ -336,7 +364,13 @@ class Toolbox:
             ok, feedback = self.agent.perms.request(f"mcp:{state.name}:{tool['name']}", "mcp", title, body)
             if not ok:
                 return feedback
-        result = mcp.call(state, tool, arguments)
+        if mcp.needs_gpu(state, tool):
+            freed = self.agent.free_gpu()
+            if freed:
+                self.console.print(
+                    Text(f"  ⎿ freed the GPU for {state.name} ({', '.join(freed)} reloads afterwards)", style="dim")
+                )
+        result = mcp.call(state, tool, arguments, image_text=self.agent.describe_image_data)
         if result.startswith("Error:"):
             return result
         self.console.print(Text(f"  ⎿ {result.count(chr(10)) + 1} line(s) from {state.name}", style="dim"))
@@ -344,11 +378,13 @@ class Toolbox:
 
     # -- read-only
     def t_read_file(self, path: str, offset: int = 1, limit: int = 2000) -> str:
-        p = self.resolve(path)
+        p = self.path(path)
         if not p.exists():
             raise ToolError(f"{path} does not exist")
         if p.is_dir():
             raise ToolError(f"{path} is a directory; use list_dir")
+        if is_image(p):
+            raise ToolError(f"{path} is an image; look at it with view_image")
         if is_binary(p):
             raise ToolError(f"{path} is a binary file ({p.stat().st_size} bytes)")
         lines = p.read_text(errors="replace").splitlines()
@@ -364,13 +400,13 @@ class Toolbox:
         return truncate(out, 120_000)
 
     def t_list_dir(self, path: str = ".", depth: int = 2) -> str:
-        p = self.resolve(path)
+        p = self.path(path)
         if not p.is_dir():
             raise ToolError(f"{path} is not a directory")
         return tree(p, depth=max(1, min(int(depth or 2), 6)))
 
     def t_glob(self, pattern: str, path: str = ".") -> str:
-        base = self.resolve(path)
+        base = self.path(path)
         pattern = pattern.removeprefix("./")
         patterns = [pattern] + ([pattern[3:]] if pattern.startswith("**/") else [])
         hits = [
@@ -385,7 +421,7 @@ class Toolbox:
     def t_grep(
         self, pattern: str, path: str = ".", glob: str | None = None, ignore_case: bool = False, context: int = 0
     ) -> str:
-        p = self.resolve(path)
+        p = self.path(path)
         if shutil.which("rg"):
             cmd = ["rg", "--line-number", "--no-heading", "--with-filename", "--hidden", "--color", "never"]
             cmd += ["--max-columns", "400"]
@@ -450,7 +486,7 @@ class Toolbox:
         self.read_mtimes[str(p)] = p.stat().st_mtime
 
     def t_write_file(self, path: str, content: str) -> str:
-        p = self.resolve(path)
+        p = self.path(path)
         exists = p.exists()
         if exists:
             if p.is_dir():
@@ -472,7 +508,7 @@ class Toolbox:
         return f"{'Overwrote' if exists else 'Created'} {self.rel(p)} ({n} lines)."
 
     def t_edit_file(self, path: str, old_string: str, new_string: str, replace_all: bool = False) -> str:
-        p = self.resolve(path)
+        p = self.path(path)
         if not p.exists():
             raise ToolError(f"{path} does not exist (use write_file to create it)")
         self._check_fresh(p)
@@ -515,20 +551,30 @@ class Toolbox:
 
     # -- shell
     def t_bash(self, command: str, timeout: int = 180) -> str:
-        if not is_read_only(command):
+        sandbox = self.agent.sandbox
+        if not is_read_only(command) and not (sandbox and self.agent.perms.mode == "auto-edit"):
             body = Syntax(command, "bash", theme="monokai", word_wrap=True)
-            ok, feedback = self.agent.perms.request(
-                bash_key(command), "bash", f"Run command (in {self.agent.cwd})", body
-            )
+            where = "in the sandbox" if sandbox else f"in {self.agent.cwd}"
+            ok, feedback = self.agent.perms.request(bash_key(command), "bash", f"Run command ({where})", body)
             if not ok:
                 return feedback
+        if not is_read_only(command):
             self.agent.checkpoint()
         self.console.print(Text(f"  $ {command}", style="bold cyan"))
-        fd, cwd_file = tempfile.mkstemp(prefix="lcode_cwd_")
-        os.close(fd)
-        script = f"{command}\n__lcode_ec=$?\npwd -P > {shlex.quote(cwd_file)}\nexit $__lcode_ec\n"
+        marker = f"__lcode_cwd_{secrets.token_hex(8)}__"
+        script = f"{command}\n__lcode_ec=$?\nprintf '\\n{marker}%s\\n' \"$(pwd -P)\"\nexit $__lcode_ec\n"
+        token = ""
+        if sandbox:
+            try:
+                with self.console.status("Starting the sandbox…"):
+                    sandbox.ensure(self.agent.cwd)
+            except SandboxError as e:
+                return f"Error: the sandbox can't start, so the command didn't run: {e}"
+            argv, token = sandbox.exec_argv(self.agent.cwd, script)
+        else:
+            argv = ["bash", "-c", script]
         proc = subprocess.Popen(
-            ["bash", "-c", script],
+            argv,
             cwd=self.agent.cwd,
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,
@@ -546,9 +592,14 @@ class Toolbox:
                 lines.put(line)
             lines.put(None)
 
+        def stop() -> None:
+            if sandbox and token:
+                sandbox.kill(token)  # the command runs in the container, not under our process
+            os.killpg(proc.pid, signal.SIGKILL)
+
         threading.Thread(target=pump, daemon=True).start()
         out: list[str] = []
-        shown, status = 0, ""
+        shown, status, recorded = 0, "", ""
         deadline = time.time() + int(timeout or 180)
         try:
             while True:
@@ -556,30 +607,37 @@ class Toolbox:
                     line = lines.get(timeout=0.2)
                 except queue.Empty:
                     if time.time() > deadline:
-                        os.killpg(proc.pid, signal.SIGKILL)
+                        stop()
                         status = f"\n[Command timed out after {timeout}s and was killed]"
                         break
                     continue
                 if line is None:
                     break
+                if line.startswith(marker):
+                    recorded = line[len(marker) :].strip()
+                    continue
                 out.append(line)
                 if shown <= 40:
                     msg = "    ... (more output hidden)" if shown == 40 else "    " + line.rstrip("\n")[:300]
                     self.console.print(Text(msg, style="dim"))
                     shown += 1
         except KeyboardInterrupt:
-            os.killpg(proc.pid, signal.SIGKILL)
+            stop()
             raise
         code = proc.wait()
-        try:
-            recorded = Path(cwd_file).read_text().strip()
-            if recorded and Path(recorded).is_dir() and Path(recorded).resolve() != self.agent.cwd:
+        if out and out[-1] == "\n":
+            out.pop()  # the blank line printed before the marker
+        if recorded and Path(recorded).is_dir() and Path(recorded).resolve() != self.agent.cwd:
+            if sandbox and not sandbox.contains(Path(recorded).resolve()):
+                status += "\n[That directory is outside the project; the working directory stays the same]"
+            else:
                 self.agent.cwd = Path(recorded).resolve()
                 status += f"\n[Working directory is now {self.agent.cwd}]"
-        except OSError:
-            pass
-        finally:
-            Path(cwd_file).unlink(missing_ok=True)
+        if sandbox and code != 0 and not sandbox.network and NO_NETWORK.search("".join(out[-40:])):
+            status += (
+                "\n[The sandbox has no network access. If this needs the network, ask the user to allow it "
+                "with /sandbox network on]"
+            )
         self.console.print(Text(f"  exit code {code}", style="green" if code == 0 else "red"))
         return truncate("".join(out)) + status + f"\n[exit code: {code}]"
 

lcode/vision.py

@@ -0,0 +1,109 @@
+"""Looking at images: screenshots, diagrams and photos the user attaches or the model opens.
+
+The model that runs the conversation often can't see: lcode's text-only variants leave out the
+vision projector to save GPU memory. So lcode asks a model that can see to describe the image in
+detail (all text transcribed, layout, colors), with the user's question in mind, and gives the
+description to the conversation. Which model looks (`vision_model = "auto"`):
+
+1. the session's model, if it has vision;
+2. otherwise the original Ollama model behind a text-only catalog variant (the same weights plus
+   the vision projector; `lcode setup` already downloaded it), e.g. qwen3.6:35b-a3b-coding;
+3. otherwise none, unless `vision_model` names one (for example qwen3-vl:8b).
+"""
+
+from __future__ import annotations
+
+import base64
+from pathlib import Path
+
+from lcode import catalog
+from lcode.ollama import Ollama, OllamaError
+
+IMAGE_TYPES = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+}
+MAX_IMAGE_BYTES = 20 * 1024 * 1024
+DESCRIBE_CONTEXT = 16384  # enough for one image and a long description
+
+PROMPT = """You are the eyes of a coding assistant that cannot see images. Describe this image so the \
+assistant can act on it without seeing it.
+- Transcribe all visible text exactly: code, error messages, terminal output, labels, menu items, numbers.
+- Describe the layout and every important element: what it is, where it is, its size, color and state \
+(enabled, selected, highlighted, misaligned, overlapping, cut off).
+- For diagrams, charts and architecture drawings, describe the parts and how they connect.
+- Say what looks wrong or unusual, if anything.
+Don't guess at what isn't visible.{question}"""
+
+INSTALL_HINT = (
+    "no model that can see images is available: run `ollama pull qwen3-vl:8b` and "
+    "`lcode config set vision_model qwen3-vl:8b`, or use a catalog model (lcode setup)"
+)
+
+
+class VisionError(Exception):
+    pass
+
+
+def is_image(path: Path) -> bool:
+    return path.suffix.lower() in IMAGE_TYPES
+
+
+def can_see(ollama: Ollama, model: str) -> bool:
+    try:
+        return "vision" in (ollama.show(model).get("capabilities") or [])
+    except (OllamaError, AttributeError, TypeError):
+        return False
+
+
+def pick_model(ollama: Ollama, model: str, setting: str) -> str | None:
+    """The model that looks at images for a session running `model` (see the module docstring)."""
+    if setting == "off":
+        return None
+    if setting != "auto":
+        return setting
+    if can_see(ollama, model):
+        return model
+    spec = catalog.find(model)
+    if spec and spec.tag != model and can_see(ollama, spec.tag):
+        return spec.tag
+    return None
+
+
+def read_image(path: Path) -> bytes:
+    if not path.is_file():
+        raise VisionError(f"{path} doesn't exist")
+    if not is_image(path):
+        raise VisionError(f"{path.name} isn't an image lcode can read ({', '.join(sorted(IMAGE_TYPES))})")
+    size = path.stat().st_size
+    if size > MAX_IMAGE_BYTES:
+        raise VisionError(f"{path.name} is {size // (1024 * 1024)} MB; images up to 20 MB are supported")
+    return path.read_bytes()
+
+
+def describe(ollama: Ollama, model: str, image: bytes, question: str = "", options: dict | None = None,
+             keep_alive: str = "30m") -> str:  # fmt: skip
+    """A detailed description of the image, focused on the question if there is one."""
+    focus = (
+        f"\n\nThe user asks: {question.strip()}\nPay special attention to what that needs." if question.strip() else ""
+    )
+    payload = {
+        "model": model,
+        "messages": [
+            {"role": "user", "content": PROMPT.format(question=focus), "images": [base64.b64encode(image).decode()]}
+        ],
+        "think": False,
+        "keep_alive": keep_alive,
+        "options": options or {"num_ctx": DESCRIBE_CONTEXT},
+    }
+    try:
+        reply = ollama.chat(payload)
+    except OllamaError as e:
+        raise VisionError(f"{model} couldn't look at the image: {e}") from e
+    text = ((reply.get("message") or {}).get("content") or "").strip()
+    if not text:
+        raise VisionError(f"{model} returned no description")
+    return text

{lcode_cli-0.4.1.dist-info → lcode_cli-0.6.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lcode-cli
-Version: 0.4.1
+Version: 0.6.0
 Summary: A local-first terminal coding agent powered by open-weight models on your own GPU or Mac, via Ollama.
 Project-URL: Homepage, https://nasser1941.github.io/lcode/
 Project-URL: Documentation, https://nasser1941.github.io/lcode/
@@ -78,13 +78,18 @@ through [Ollama](https://ollama.com), and when it needs current information it c
   real coding tasks on your machine.
 - **Safe by default.** Every edit is shown as a diff and every command that isn't read-only needs
   your approval. `auto-edit` and `yolo` modes when you want speed.
+- **Sandbox (optional).** `lcode --sandbox` runs the model's shell commands in a container (Docker or
+  Podman) that only sees your project, without network access unless you allow it.
 - **Undo.** lcode saves a checkpoint before the model changes files; `/undo` takes back the last
   request's edits, new files and shell-command changes, without touching your git history.
 - **Bring your own model.** Eight curated open-weight models, all tested end to end, or any Ollama model
   with tool calling.
 - **MCP servers, ready to go.** Connect Jira and Confluence, GitHub, AWS, Google Drive, Grafana,
   Google Cloud, Sentry, Linear, Notion, Postgres, Kubernetes and more with one command
-  (`lcode mcp add atlassian`), or any other MCP server. Browser sign-in (OAuth) is built in.
+  (`lcode mcp add atlassian`), image generation with ComfyUI, or any other MCP server. Browser sign-in (OAuth) is built in.
+- **Sees images.** Attach a screenshot or mockup with `@path` and lcode looks at it, using the
+  vision part of your model. With ComfyUI (`lcode mcp add comfyui`) it can also generate and edit
+  images with local models such as FLUX, SDXL and Qwen-Image.
 - **Web search when needed.** Looks up the latest versions, docs and error messages with Ollama web
   search, Brave, Tavily or your own SearXNG, and reads pages as clean text.
 - **Private.** The model runs on your machine, lcode never uploads your files and has no telemetry.
@@ -184,7 +189,6 @@ fills up. Details: [How it works](https://nasser1941.github.io/lcode/how-it-work
 
 See the pinned [Roadmap issue](https://github.com/nasser1941/lcode/issues/10). Next up:
 
-- An [optional sandbox for shell commands](https://github.com/nasser1941/lcode/issues/9)
 - More models in the catalog, and test reports from your hardware ([report one](https://github.com/nasser1941/lcode/issues/new?template=model_request.yml))
 
 ## Contributing

{lcode_cli-0.4.1.dist-info → lcode_cli-0.6.0.dist-info}/RECORD

@@ -1,34 +1,36 @@
-lcode/__init__.py,sha256=1t5InCerqpe0xlveEpLyHmEy2nEXzOrj4qbGJyWN6WQ,117
+lcode/__init__.py,sha256=FWZV2PnebwvlC4fL-VRqLfpH2njKjqCUWaGd0s-R-5c,117
 lcode/__main__.py,sha256=s5N5pryX2FAu93GGZ3FxUrIXHWGzxz66lKUoaV_h8Ws,35
-lcode/agent.py,sha256=dxW07COUQo8UZnIwNfegCOSX_ZStorYsL93jhZFkvN8,27753
+lcode/agent.py,sha256=AhUf1l0OEjpizU74HI7yfdRz0q_UAnqFddbyQwdmFx0,32256
 lcode/bench.py,sha256=FCn94Gs7L8bpq4hzf6ILoQG8dKrbbd5WC4BRwrTp4LM,37950
 lcode/catalog.py,sha256=pZ1azX9OH2r4JE2c6E5OfwywpgS39-W2oXzoCHJhmtM,4141
 lcode/checkpoints.py,sha256=eqPtmPe44-aweWqc2H21ROogwzIt3NpvcUobsaCHoGY,18354
-lcode/cli.py,sha256=ICyUQ1DQmUhy0cNBrRFYvFqyqvLxdcLWn-21-Q6qSWk,25845
-lcode/config.py,sha256=i7EYhhTPaIFxSWyqHiffIEoL4PgHjkBBpF20gc--MtQ,6306
+lcode/cli.py,sha256=53MucKCHe9NreYXwDaMEwfHtPS-26kxj7Xg3Bl4yoR8,27506
+lcode/config.py,sha256=VyRHq3ElCGmTQqTdtcGRHGuselm2U8-04ZC3tnEQ6L8,7063
 lcode/hardware.py,sha256=2VbknZCxTZJwJUD8YWdQ7ryEQo_LcjtoOBOHOU9Y0fw,3085
 lcode/limits.py,sha256=oJzVQoMyTZ0_Fkpu5t3qxrf9v7Hv9S8U8BRQR5M1aKA,1237
 lcode/models.toml,sha256=lt2G64zzo_Ryxv2ISRSNZoVD_JqCqYqsM01n8WoXGs8,4098
-lcode/ollama.py,sha256=-EB_8DKh87larG7iV0neyndPRom1Hxh4y8AAfI1Ebq8,6690
+lcode/ollama.py,sha256=8zxJcMhcxKF3L0vdgrzcoXAj_4MvbybVDSRPbLek0QE,6892
 lcode/permissions.py,sha256=OcWUDLrSoohUWHDUQ3UuBE3zI2JnBnOPizLE3bIgqyU,3982
 lcode/render.py,sha256=gMvf4W3qkLUJ4Vot3az_hP_zRDAItJC9pP-68dHFkfA,1375
-lcode/repl.py,sha256=vvKndnzchza2FNkluZTOCJ4qZOF5Dhm-Hhj6N_PfFrI,28814
+lcode/repl.py,sha256=2p6UG1xCmn85YEYcWUtgfoLJc3rHLaGLb_VV-RvzYvw,30332
+lcode/sandbox.py,sha256=u_pkrVRXhCGhh-wFDPwuZ3jGG7UeXxXRAeBNsm37ZvE,8608
 lcode/sessions.py,sha256=wOR-J0EHgJxLSPboKPHnvBcp5VTUYTj3tZWgpsa6-K4,4013
-lcode/tools.py,sha256=fK7OOe6IagBrj9aCF3z4faJTZO3jAamzEPF3AaaH5m0,27234
+lcode/tools.py,sha256=iwt7UINg7xkwz1k_BAXFM-siA6KxC6LHuAjaomBHoRU,30287
+lcode/vision.py,sha256=w33QPmdGwP33wM4mvmAH4amFDZ1xzeXhEsSLJ-STSHY,4243
 lcode/web.py,sha256=vyxKbSRJTl1Lj3hj7Yd_NwTgbv0Xi6dup2YfUXjqp-Y,14579
 lcode/mcp/__init__.py,sha256=XujtAmRoXW9S0uq1XPf_CAeCkHh_UvA8FCmoAKP9j1Y,171
 lcode/mcp/auth.py,sha256=vyH3oolgIBNJLYabr2h5Soui99NTY1QxjQEgtczfF6A,16655
 lcode/mcp/catalog.py,sha256=GnIF1fyeHSut9h2y_VJNAHc2FCJT81EIhLFM40V780k,3504
-lcode/mcp/catalog.toml,sha256=rb9Q6NgenYVzlsf5Ej-8yJbFwBMLuLCMegzrU5Rs_kc,7891
+lcode/mcp/catalog.toml,sha256=_kFzKD2FD78KD2URuE5B-kcQehW9Y3Zi2xf5tu3v4Xc,9230
 lcode/mcp/client.py,sha256=3Gen7zRvWehngXn_dAMOAdKqFkFkQZIQW96hQcW4N4k,7119
 lcode/mcp/commands.py,sha256=Rlnc-LFydRjHTiW-CSxjmQqX0d2MSiEViLF9kczYIi4,16420
-lcode/mcp/config.py,sha256=iSjjucG4VuP9u7aJQrTZsPA9k9oeRyMmz4hV1GE5ljw,8454
+lcode/mcp/config.py,sha256=Ej6WX2b_55a84H5WdAwSk9DzERKoq5ifUBQ9uDgSG_o,8780
 lcode/mcp/http.py,sha256=sG9MajwU4_6sqvZhwD4WfyzRKzaR_Lc8C02jwePz18E,7380
-lcode/mcp/manager.py,sha256=UPpY97jwW_KIi2G4hR860Iq4zgfqNFHjsyeu48aEa44,14784
-lcode/mcp/protocol.py,sha256=8uhyzzDQmaXr6pdt9bWD5ccvWZ93rvxd4v3Z5J84vKw,4938
+lcode/mcp/manager.py,sha256=79nNWoT5pxgoQD_Pv4ZH0obHIm7rQ-LyB8OmJnQgc6k,15104
+lcode/mcp/protocol.py,sha256=-xwhA2Tz-vzR2zdSdbPx4IjTu29uRrXMaePg0vEz_Vc,5223
 lcode/mcp/stdio.py,sha256=kC6KHwzMMDjBr-yCZLmyVKS7PZXU299WpZdYRoX5eRQ,6292
-lcode_cli-0.4.1.dist-info/METADATA,sha256=jGUe-zgy_zUWIaqhz9-h6J03eZmXhy9RWwt2BZrgyi0,9869
-lcode_cli-0.4.1.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-lcode_cli-0.4.1.dist-info/entry_points.txt,sha256=pZ_uDQ98UzVAHUQeXn5HeyQWKGSH3r3T5aPHuSB89eI,41
-lcode_cli-0.4.1.dist-info/licenses/LICENSE,sha256=JWjmoL7nNIC1XUa-dZm2hwLUgjUQMFo6k8APb0idNzs,1074
-lcode_cli-0.4.1.dist-info/RECORD,,
+lcode_cli-0.6.0.dist-info/METADATA,sha256=oMYnPQJlwjwLZls7GP4mxJkTRLmWM0LaVzAsyQdcqiM,10251
+lcode_cli-0.6.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+lcode_cli-0.6.0.dist-info/entry_points.txt,sha256=pZ_uDQ98UzVAHUQeXn5HeyQWKGSH3r3T5aPHuSB89eI,41
+lcode_cli-0.6.0.dist-info/licenses/LICENSE,sha256=JWjmoL7nNIC1XUa-dZm2hwLUgjUQMFo6k8APb0idNzs,1074
+lcode_cli-0.6.0.dist-info/RECORD,,