localcode 0.3.23__tar.gz → 0.3.25__tar.gz

{localcode-0.3.23/src/localcode.egg-info → localcode-0.3.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localcode
-Version: 0.3.23
+Version: 0.3.25
 Summary: High-performance AI coding on consumer hardware.
 Author: LocalCode contributors
 License-Expression: Apache-2.0

{localcode-0.3.23 → localcode-0.3.25}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "localcode"
-version = "0.3.23"
+version = "0.3.25"
 description = "High-performance AI coding on consumer hardware."
 readme = "README.md"
 requires-python = ">=3.10"

{localcode-0.3.23 → localcode-0.3.25}/src/localcode/__init__.py

@@ -1,3 +1,3 @@
 __all__ = ["__version__"]
 
-__version__ = "0.3.23"
+__version__ = "0.3.25"

{localcode-0.3.23 → localcode-0.3.25}/src/localcode/agent/loop.py

@@ -424,6 +424,13 @@ def run_agent_loop(
     )
     _completion_gate_retries = 0
     _MAX_COMPLETION_GATE_RETRIES = 1
+    # Open-todo completion discipline: don't let a long task end while the
+    # model's own todo list still has open items. Bounded overall, plus a
+    # diminishing-returns guard (stop nagging if the open-count stops falling).
+    _todo_continue_count = 0
+    _MAX_TODO_CONTINUATIONS = 15
+    _todo_stuck_count = 0
+    _last_todo_remaining = 10**9
     _edit_recovery_nudges = 0
     _MAX_CONSECUTIVE_CORRECTIONS = 2
     _generic_correction_nudges = 0
@@ -593,7 +600,19 @@ def run_agent_loop(
     _verified_launch_summary = ""
     _observed_ttft_ms = 0
 
-    if _goal_state.goal_type == "run_or_launch":
+    # Open todos mean the model is mid-BUILD. It may start a preview dev server,
+    # but a running server is NOT task completion while the plan still has
+    # pending/in_progress items — taking the deterministic launch-and-finish
+    # fast-path here is exactly how the Anki build "completed" with 4 todos
+    # still open ("The app is now running" → done, at ~10% of the work). Only
+    # take the launcher fast-path when nothing is left on the list; otherwise
+    # fall through to normal agentic rounds and let the open-todo completion
+    # gate keep the model building until every item is done.
+    _open_todos_at_launch = [
+        t for t in list(getattr(getattr(app, "session", None), "todos", []) or [])
+        if str(t.get("status", "")).lower() != "completed"
+    ]
+    if _goal_state.goal_type == "run_or_launch" and not _open_todos_at_launch:
         try:
             from ..launcher import launch_project_app
             preferred_port = int(getattr(_task_state, "active_port", 0) or 0)
@@ -1341,6 +1360,54 @@ def run_agent_loop(
             # permission question, the user gets to answer — the runtime
             # does not silently force a retry.
             _blocking_question = is_focused_blocking_question(content)
+            # ── Open-todo completion gate (GENERAL — the goal-typed gates below
+            # are dead because infer_goal_state always returns general_task). If
+            # the model tries to END its turn while its OWN todo list still has
+            # open items, it stopped early: force it to continue to the next item.
+            # `session.todos` is cleared to [] by todo_write only when ALL are
+            # completed, so a non-empty list is real unfinished work. Bounded by
+            # _MAX_TODO_CONTINUATIONS, with a diminishing-returns guard so a model
+            # that can't make progress on its plan isn't nagged forever.
+            _open_todos = list(getattr(app.session, "todos", []) or [])
+            _todo_remaining = sum(
+                1 for t in _open_todos if str(t.get("status", "")).lower() != "completed"
+            )
+            if (
+                not _blocking_question
+                and _todo_remaining > 0
+                and _todo_continue_count < _MAX_TODO_CONTINUATIONS
+                and _todo_stuck_count < 3
+                and _is_enabled(Feature.AUTO_NUDGE_RECOVERY)
+            ):
+                # Diminishing returns: if the open-count didn't fall since the
+                # last continuation, the model isn't advancing its plan.
+                if _todo_remaining >= _last_todo_remaining:
+                    _todo_stuck_count += 1
+                else:
+                    _todo_stuck_count = 0
+                _last_todo_remaining = _todo_remaining
+                if _todo_stuck_count < 3:
+                    _todo_continue_count += 1
+                    _nxt = next(
+                        (t for t in _open_todos if str(t.get("status", "")).lower() == "in_progress"),
+                        None,
+                    ) or next(
+                        (t for t in _open_todos if str(t.get("status", "")).lower() != "completed"),
+                        None,
+                    )
+                    _nxt_label = (_nxt or {}).get("content", "the next item")
+                    out.print_info(
+                        f"{_todo_remaining} todo(s) still open — continuing (not stopping early)."
+                    )
+                    messages.append({"role": "user", "content": (
+                        f"SYSTEM: You still have {_todo_remaining} unfinished todo(s). "
+                        f"The task is NOT complete — do not stop. Continue now with: "
+                        f"{_nxt_label}. Mark a todo completed via todo_write only when it "
+                        f"is genuinely done, and keep going until every item is completed."
+                    )})
+                    _ephemeral_nudge_indices.append(len(messages) - 1)
+                    _last_nudge_kind = "todo_continue"
+                    continue  # force another round — reject the early completion
             # ── Build-verification STOP gate (claude-code query.ts stop-hook) ──
             # The model wants to END a build_app turn that changed CODE. This is
             # a TRUE completion gate, not a one-shot nudge: we RUN the project's

{localcode-0.3.23 → localcode-0.3.25}/src/localcode/bootstrap.py

@@ -250,13 +250,16 @@ def download_turboquant_binary(on_progress: Callable[[str], None] | None = None)
         binary.chmod(0o755)
         return True, str(binary)
     except ssl.SSLCertVerificationError:
-        # Retry without verification as last resort
-        ssl_ctx = ssl._create_unverified_context()
-        opener = urllib.request.build_opener(urllib.request.HTTPSHandler(context=ssl_ctx))
-        urllib.request.install_opener(opener)
-        urllib.request.urlretrieve(url, str(binary))
-        binary.chmod(0o755)
-        return True, str(binary)
+        # SECURITY: never fetch an EXECUTABLE over an unverified connection — a
+        # network attacker could swap in a malicious binary. If cert
+        # verification fails, the fix is to repair the trust store, not to
+        # accept any cert.
+        return False, (
+            "Download failed: TLS certificate verification failed. Update your "
+            "certificates (`pip install -U certifi`), or build llama-cpp-"
+            "turboquant from source. LocalCode will not download an executable "
+            "over an unverified connection."
+        )
     except Exception as e:
         return False, f"Download failed: {e}\nBuild from source instead: clone llama-cpp-turboquant and run cmake."
 
@@ -373,10 +376,11 @@ def _download_parallel(url: str, dest: Path, num_threads: int = 16,
             if _attempt == 0:
                 import certifi
                 ssl_ctx = ssl.create_default_context(cafile=certifi.where())
-            elif _attempt == 1:
-                ssl_ctx = ssl.create_default_context()
             else:
-                ssl_ctx = ssl._create_unverified_context()
+                # SECURITY: stay verified — no unverified-TLS fallback. If the
+                # system trust store can't verify, the download fails cleanly
+                # rather than trusting any cert.
+                ssl_ctx = ssl.create_default_context()
             req = urllib.request.Request(url, method="HEAD")
             with urllib.request.urlopen(req, context=ssl_ctx, timeout=10) as resp:
                 total_size = int(resp.headers.get("Content-Length", 0))
@@ -387,7 +391,8 @@ def _download_parallel(url: str, dest: Path, num_threads: int = 16,
         except Exception:
             continue
     if ssl_ctx is None:
-        ssl_ctx = ssl._create_unverified_context()
+        # SECURITY: verified context only — never fall back to unverified TLS.
+        ssl_ctx = ssl.create_default_context()
 
     part = dest.with_name(dest.name + ".part")
 

{localcode-0.3.23 → localcode-0.3.25}/src/localcode/embeddings.py

@@ -69,15 +69,20 @@ class EmbeddingSearch:
         # Try sentence-transformers
         try:
             from sentence_transformers import SentenceTransformer
-            # Try nomic first (better quality)
-            try:
+            import os as _os
+            # SECURITY: nomic-embed-text-v1.5 gives slightly better quality but
+            # requires trust_remote_code=True, which downloads and EXECUTES
+            # arbitrary Python from the model repo on the user's machine (a real
+            # RCE vector for 1M users). Default to all-MiniLM-L6-v2 — no remote
+            # code, and perfectly adequate for code search. Only use nomic if the
+            # user EXPLICITLY opts into remote code execution.
+            if _os.environ.get("LOCALCODE_TRUST_REMOTE_CODE") == "1":
                 self.model = SentenceTransformer(
                     "nomic-ai/nomic-embed-text-v1.5",
                     trust_remote_code=True,
                 )
                 self.model_name = "nomic-embed-text-v1.5"
-            except Exception:
-                # Fallback to MiniLM (smaller, always works)
+            else:
                 self.model = SentenceTransformer("all-MiniLM-L6-v2")
                 self.model_name = "all-MiniLM-L6-v2"
 

{localcode-0.3.23 → localcode-0.3.25}/src/localcode/tools/todo_write.py

@@ -126,13 +126,18 @@ def execute(ctx: ToolContext, args: dict) -> str:
         return "Task list cleared."
 
     in_progress = [t for t in cleaned if t["status"] == "in_progress"]
-    body = render_todo_reminder(cleaned)
     note = ""
     if len(in_progress) == 0:
-        note = "\nNote: nothing is in_progress — mark the next task in_progress before you start it."
+        note = " Nothing is in_progress — mark the next task in_progress before you start it."
     elif len(in_progress) > 1:
-        note = "\nNote: more than one task is in_progress — keep it to exactly one at a time."
-    return f"Task list updated.\n{body}{note}"
+        note = " More than one task is in_progress — keep it to exactly one."
+    _done = sum(1 for t in cleaned if t["status"] == "completed")
+    # BRIEF result for the user's screen. The full "Your task list …" reminder
+    # is NOT returned here — it's injected as a model-only system message each
+    # round (see loop.py render_todo_reminder), so returning it here too both
+    # duplicated it for the model AND leaked the internal reminder onto the
+    # user's screen.
+    return f"Task list updated — {_done}/{len(cleaned)} done, {len(in_progress)} in progress.{note}"
 
 
 def is_concurrency_safe(args: dict) -> bool:

{localcode-0.3.23 → localcode-0.3.25}/src/localcode/tui/app.py

@@ -444,12 +444,16 @@ class LocalCodeTUI(App):
 def main() -> None:
     """Entry point for lc-tui or localcode --tui."""
     app = LocalCodeTUI(show_mode_picker=False)
-    # Mouse events are required for the chat_log's click-to-expand
-    # thinking blocks and its custom drag-select + OSC 52 clipboard.
-    # Disabling mouse trades terminal-native text selection for both
-    # of those, which is a worse UX. The custom selection path
-    # already covers what the native one would have done.
-    app.run()
+    # Mouse capture is OFF by default so the terminal's NATIVE text selection,
+    # Cmd+C and Cmd+V all work — capturing the mouse disabled native selection,
+    # which made Terminal.app ring its bell on Cmd+C (empty native selection)
+    # and Cmd+V (image clipboard) — the persistent "beep". Native copy/paste is
+    # worth more to most users than click-to-expand thinking + custom drag-
+    # select, and this matches how claude-code behaves (no capture, no beep).
+    # Power users who want the click-to-expand / drag-select can opt back in.
+    import os as _os
+    _mouse = _os.environ.get("LOCALCODE_MOUSE", "0") == "1"
+    app.run(mouse=_mouse)
 
 
 if __name__ == "__main__":

{localcode-0.3.23 → localcode-0.3.25/src/localcode.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localcode
-Version: 0.3.23
+Version: 0.3.25
 Summary: High-performance AI coding on consumer hardware.
 Author: LocalCode contributors
 License-Expression: Apache-2.0