localcode 0.3.29__tar.gz → 0.3.31__tar.gz

{localcode-0.3.29/src/localcode.egg-info → localcode-0.3.31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localcode
-Version: 0.3.29
+Version: 0.3.31
 Summary: High-performance AI coding on consumer hardware.
 Author: LocalCode contributors
 License-Expression: Apache-2.0

{localcode-0.3.29 → localcode-0.3.31}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "localcode"
-version = "0.3.29"
+version = "0.3.31"
 description = "High-performance AI coding on consumer hardware."
 readme = "README.md"
 requires-python = ">=3.10"

{localcode-0.3.29 → localcode-0.3.31}/src/localcode/agent/helpers.py

@@ -53,6 +53,124 @@ __all__: list[str] = []
 _SHRINK_GUARD_SOURCE_EXTS = {".py", ".js", ".jsx", ".ts", ".tsx", ".css", ".html"}
 
 
+# ── Autonomy-independent safety hard-block ─────────────────────────────
+#
+# The approval gate (_needs_confirmation) is a *confirmation* layer: it is
+# skipped in FULL_AUTO and in headless mode (which forces full_auto). That
+# left no backstop at all for those modes — a prompt-injected model could
+# run `curl … | sh` via bash OR background_process, or overwrite
+# ~/.ssh/authorized_keys via write_file, entirely unattended. This layer
+# runs before EVERY dispatch regardless of autonomy level or headless, and
+# cannot be overridden. It blocks only unambiguously destructive operations
+# (no legitimate agent use), so it does not add friction to normal work.
+
+# Tools that hand a raw string to a shell.
+_SHELL_EXEC_TOOLS = {"bash", "background_process"}
+# Tools that write file contents to a path.
+_FILE_WRITE_TOOLS = {"write_file", "append_file", "edit_file", "multi_edit", "edit_diff"}
+
+# Credential / key material that the agent has no legitimate reason to write.
+# Matched on the path BASENAME or a path SEGMENT (never a naive substring, so
+# editing the project's own `tokenizer.py` / `api_keys.py` is never blocked).
+_BLOCKED_WRITE_BASENAMES = frozenset({
+    "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519",
+    "authorized_keys", "known_hosts",
+    ".netrc", ".npmrc", ".pypirc",
+    "credentials", "credentials.json",
+    "shadow", "passwd", "sudoers",
+})
+_BLOCKED_WRITE_SEGMENTS = frozenset({".ssh", ".aws", ".gnupg", ".config/gcloud"})
+
+
+def _is_blocked_write_path(raw_path: str) -> bool:
+    """True if writing this path targets credential/key material.
+
+    Precise matching only: exact basename or an exact path segment. A file
+    named `tokenizer.py` or `password_reset.py` in the project is NOT blocked.
+    """
+    if not raw_path:
+        return False
+    try:
+        p = Path(raw_path).expanduser()
+    except Exception:
+        p = Path(raw_path)
+    name = p.name.lower()
+    if name in _BLOCKED_WRITE_BASENAMES:
+        return True
+    lowered_parts = {part.lower() for part in p.parts}
+    if lowered_parts & _BLOCKED_WRITE_SEGMENTS:
+        return True
+    return False
+
+
+# Catastrophic shell commands with NO legitimate agent use — hard-blocked in
+# every mode, never overridable. Deliberately TIGHT: these are anchored to real
+# device/root/home targets so they don't false-positive on a `grep` for the
+# text. "High-risk but sometimes legitimate" commands (curl|sh installs,
+# force-push, sudo rm) are NOT here — they route through the confirmation gate
+# instead (see _CONFIRM_SHELL_RE), so the user can approve them.
+#
+# NB: SQL patterns (DROP TABLE, DELETE FROM, …) are intentionally absent — bash
+# does not execute SQL, so blocking them here only broke `grep "DROP TABLE"`.
+import re as _re
+
+_HARD_BLOCK_SHELL_RE = [
+    _re.compile(r"\brm\s+-[a-z]*r[a-z]*f[a-z]*\s+(/|~|\$HOME|\$\{HOME\})(\s|/|$)", _re.I),
+    _re.compile(r"\brm\s+-[a-z]*f[a-z]*r[a-z]*\s+(/|~|\$HOME|\$\{HOME\})(\s|/|$)", _re.I),
+    _re.compile(r"\bmkfs\b", _re.I),
+    _re.compile(r"\bdd\b[^\n]*\bof=/dev/", _re.I),
+    _re.compile(r">\s*/dev/(sd|nvme|hd|disk|vd)", _re.I),
+    _re.compile(r"\bchmod\s+-R\s+0*777\s+/(\s|$)", _re.I),
+    _re.compile(r":\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:", _re.I),  # fork bomb
+    _re.compile(r">\s*/etc/", _re.I),
+    _re.compile(r"\bwipefs\b", _re.I),
+]
+
+# High-risk-but-sometimes-legitimate shell: prompt for approval (overridable),
+# never silently run and never hard-blocked. Anchored so a `grep` for the text
+# doesn't trigger it: the pipe-to-shell must be a real pipeline, force-push a
+# real git invocation.
+_CONFIRM_SHELL_RE = _re.compile(
+    r"(?:\b(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:ba|z|k|da)?sh\b)"
+    r"|(?:\bgit\s+push\b[^\n]*(?:--force\b|-f\b))"
+    r"|(?:\bsudo\s+rm\b)"
+    r"|(?:\bgit\s+reset\s+--hard\s+origin\b)",
+    _re.I,
+)
+
+
+def _safety_hard_block(name: str, args: dict) -> str | None:
+    """Autonomy-independent hard block. Returns a rejection reason, or None.
+
+    Runs before every tool dispatch in ALL modes (including FULL_AUTO and
+    headless). Covers only operations with no legitimate agent use:
+      - catastrophic shell (rm -rf /, mkfs, dd of=/dev/…, > /dev/sd*, fork
+        bomb, chmod -R 777 /, > /etc/) — see _HARD_BLOCK_SHELL_RE
+      - writes to SSH/AWS/GPG key material or credential files
+    Everything else — including curl|sh and force-push — falls through to the
+    normal confirmation flow, which can approve it.
+    """
+    if name in _SHELL_EXEC_TOOLS:
+        cmd = str(args.get("command", "") or "")
+        if cmd:
+            for rx in _HARD_BLOCK_SHELL_RE:
+                if rx.search(cmd):
+                    return "blocked: refusing a command that could destroy the disk or system (matched a catastrophic pattern)"
+    if name in _FILE_WRITE_TOOLS:
+        raw_path = str(args.get("path", "") or args.get("file_path", "") or "")
+        if raw_path:
+            # The agent's sanctioned scratch dir is exempt.
+            try:
+                from ..notebook import is_within_notebook
+                if is_within_notebook(Path(raw_path).expanduser()):
+                    return None
+            except Exception:
+                pass
+            if _is_blocked_write_path(raw_path):
+                return f"blocked: refusing to write credential/key file ({Path(raw_path).name})"
+    return None
+
+
 def _path_within(path: Path, root: Path) -> bool:
     try:
         path.resolve().relative_to(root)
@@ -162,6 +280,24 @@ def _execute_tool_result(app: "LocalCodeApp", name: str, args: dict, out: "Outpu
     wrapping plan-mode policy layer that refuses destructive tools
     while the agent is in plan-explore mode.
     """
+    # Autonomy-independent safety hard-block. Runs FIRST, in every mode
+    # (including FULL_AUTO / headless), and cannot be overridden — this is the
+    # backstop the confirmation gate is not. A prompt-injected model cannot use
+    # bash/background_process to run `curl|sh` or wipe a disk, nor a write tool
+    # to overwrite ~/.ssh/authorized_keys, even with no human present.
+    _blocked = _safety_hard_block(name, args)
+    if _blocked is not None:
+        try:
+            from ..events import emit as _emit_block
+            _emit_block("safety_hard_block", tool=name, reason=str(_blocked)[:200])
+        except Exception:
+            pass
+        return ToolResult(
+            text=f"REJECTED: {_blocked}. This operation is blocked by the safety layer and cannot be auto-approved.",
+            ok=False,
+            facts={"tool": name, "ok": False, "safety_blocked": True},
+        )
+
     try:
         hook = getattr(app, "hooks", None)
         decision = hook.on_pre_tool_use(name, args) if hook is not None else None
@@ -277,20 +413,63 @@ def _needs_confirmation(name: str, args: dict, app: "LocalCodeApp | None" = None
     picks option 2 on a prompt ("always allow `git`"). That set is on
     `app._session_allow` — scoped to this process, cleared on next launch.
     """
-    if name != "bash":
+    # Tools that don't execute shell or mutate files never need confirmation.
+    if name != "bash" and name not in _SHELL_EXEC_TOOLS and name not in _FILE_WRITE_TOOLS:
         return False
+
+    level = None
     if app is not None:
         try:
             from ..autonomy import AutonomyLevel
-            if getattr(app, "_autonomy", None) == AutonomyLevel.FULL_AUTO:
+            level = getattr(app, "_autonomy", None)
+            # FULL_AUTO skips confirmation for everything (the hard-block in
+            # _execute_tool_result still applies — it is not an approval).
+            if level == AutonomyLevel.FULL_AUTO:
                 return False
         except Exception:
-            pass
+            level = None
+
+    # File-write tools: auto-approved in auto_edit (the point of that mode);
+    # in suggest (read-only) mode every write is confirmed. Notebook scratch
+    # writes are never prompted.
+    if name in _FILE_WRITE_TOOLS:
+        try:
+            from ..autonomy import AutonomyLevel
+            if level != AutonomyLevel.SUGGEST:
+                return False
+        except Exception:
+            return False
+        raw_path = str(args.get("path", "") or args.get("file_path", "") or "")
+        if raw_path:
+            try:
+                from ..notebook import is_within_notebook
+                if is_within_notebook(Path(raw_path).expanduser()):
+                    return False
+            except Exception:
+                pass
+        return True
+
+    # Shell-executing tools (bash, background_process).
     cmd = args.get("command", "")
     if app is not None:
         allow = getattr(app, "_session_allow", None)
         if allow and _first_token(cmd) in allow:
             return False
+    # background_process hands a raw string straight to /bin/sh with no
+    # destructive-substring shortcut — always confirm it (unless full_auto or
+    # session-allowed above). In suggest mode, confirm any shell command.
+    if name == "background_process":
+        return True
+    try:
+        from ..autonomy import AutonomyLevel
+        if level == AutonomyLevel.SUGGEST:
+            return True
+    except Exception:
+        pass
+    # High-risk-but-sometimes-legit patterns (remote pipe-to-shell, force-push,
+    # sudo rm) are NOT hard-blocked — confirm them so the user can approve.
+    if _CONFIRM_SHELL_RE.search(cmd):
+        return True
     return any(p in cmd for p in DESTRUCTIVE_PATTERNS)
 
 def _render_markdown(text: str, console: Console | None = None) -> None:

{localcode-0.3.29 → localcode-0.3.31}/src/localcode/agent/loop.py

@@ -1657,7 +1657,13 @@ def run_agent_loop(
             # "always" adds the command's first token (e.g. "git") to the
             # session allowlist so we stop asking for that family.
             if _needs_confirmation(tool_name, args, app):
+                # `cmd` drives the approval prompt display and the "always
+                # allow `<token>`" key. Shell tools carry a command; file-write
+                # tools carry a path — show that instead of a blank line.
                 cmd = args.get("command", "")
+                if not cmd:
+                    _wpath = args.get("path") or args.get("file_path") or ""
+                    cmd = f"{tool_name} {_wpath}".strip()
                 verdict = "deny"
                 if out._approval_callback is not None:
                     raw = out._approval_callback(tool_name, cmd)

{localcode-0.3.29 → localcode-0.3.31}/src/localcode/bootstrap.py

@@ -289,6 +289,50 @@ def _is_complete_download(p: Path, catalog_entry) -> bool:
     return size >= int(expected * 0.97)
 
 
+def _verify_download_integrity(choice, path: Path) -> tuple[bool, str]:
+    """Verify a freshly-downloaded model file against its pinned sha256.
+
+    Returns (ok, reason). When the catalog entry has no `sha256` set (the
+    default), this is a no-op that returns (True, "") — behavior is unchanged
+    for unpinned entries. When a hash IS pinned and the file does not match,
+    the file is DELETED (so a poisoned artifact is never loaded or executed)
+    and (False, reason) is returned.
+
+    This is the integrity backstop the size-only completeness check is not:
+    upstream can swap weights under the same filename, and TLS/host pinning
+    alone does not detect a malicious or corrupted artifact served by a
+    compromised upstream repo.
+    """
+    expected = getattr(choice, "sha256", None)
+    if not expected:
+        return True, ""
+    try:
+        import hashlib
+        h = hashlib.sha256()
+        with open(path, "rb") as fh:
+            for chunk in iter(lambda: fh.read(1024 * 1024), b""):
+                h.update(chunk)
+        actual = h.hexdigest()
+    except Exception as e:
+        return False, f"Integrity check could not read {path.name}: {e}"
+    if actual.lower() != str(expected).lower():
+        try:
+            path.unlink()
+        except Exception:
+            pass
+        try:
+            from .events import emit as _emit
+            _emit("download_integrity_fail", filename=choice.filename, expected=str(expected)[:16], actual=actual[:16])
+        except Exception:
+            pass
+        return False, (
+            f"Integrity check FAILED for {choice.filename}: expected sha256 "
+            f"{expected}, got {actual}. The file was deleted — LocalCode will "
+            "not load a model whose contents don't match the pinned hash."
+        )
+    return True, ""
+
+
 def get_model_path(preferred_filename: str | None = None) -> Path | None:
     """Return path to a usable GGUF model, checking multiple locations.
 
@@ -537,7 +581,8 @@ def download_model(
         # fails (exotic FS), fall through and let the download try.
         pass
 
-    url = f"https://huggingface.co/{choice.hf_repo}/resolve/main/{choice.filename}"
+    _rev = getattr(choice, "revision", None) or "main"
+    url = f"https://huggingface.co/{choice.hf_repo}/resolve/{_rev}/{choice.filename}"
     if on_progress:
         on_progress(f"Downloading {choice.filename} (~{choice.size_gb:.1f} GB)...")
 
@@ -559,6 +604,9 @@ def download_model(
         # Resumes via the hub's built-in partial-download handling.
         try:
             if _try_hub_download(choice, model_file, on_progress):
+                ok, reason = _verify_download_integrity(choice, model_file)
+                if not ok:
+                    return False, reason
                 return True, str(model_file)
         except Exception as e:
             last_err = e
@@ -573,6 +621,9 @@ def download_model(
         # Slow path: tuned urllib parallel downloader.
         try:
             _download_parallel(url, model_file, num_threads=32, on_progress=on_progress)
+            ok, reason = _verify_download_integrity(choice, model_file)
+            if not ok:
+                return False, reason
             return True, str(model_file)
         except Exception as e:
             last_err = e
@@ -948,6 +999,10 @@ def _try_hub_download(choice, dest: Path, on_progress: Callable[[str], None] | N
     downloaded_path = hf_hub_download(
         repo_id=choice.hf_repo,
         filename=choice.filename,
+        # Pin to the entry's revision (commit SHA/tag) when set; defaults to
+        # "main" (unchanged behavior). Pinning makes an upstream weight swap
+        # under the same filename visible instead of silent.
+        revision=getattr(choice, "revision", None) or "main",
         local_dir=str(dest.parent),
         tqdm_class=_make_progress_tqdm(on_progress) if on_progress else None,
     )

{localcode-0.3.29 → localcode-0.3.31}/src/localcode/hooks.py

@@ -34,6 +34,83 @@ from pathlib import Path
 from ._subproc_env import clean_env
 
 
+# ── Project-hooks trust store ──────────────────────────────────────────
+#
+# A repo's `.localcode/hooks.toml` runs shell commands at session start / on
+# every prompt / before every tool. Loading it just because you opened the
+# folder is remote code execution on `git clone && localcode` — the classic
+# "workspace trust" hole. So project hooks are gated: they run ONLY if the
+# user has explicitly trusted this repo path AND the file's content hash still
+# matches what was trusted (editing the hooks re-prompts). Global hooks in the
+# user's own ~/.localcode are always trusted (their own machine, their config).
+
+def _trust_store_path() -> Path:
+    return Path.home() / ".localcode" / "trusted_hooks.json"
+
+
+def _hooks_digest(path: Path) -> str:
+    import hashlib
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def _load_trust_store() -> dict:
+    import json
+    p = _trust_store_path()
+    if not p.is_file():
+        return {}
+    try:
+        data = json.loads(p.read_text())
+        return data if isinstance(data, dict) else {}
+    except Exception:
+        return {}
+
+
+def is_project_hooks_trusted(repo_root: str) -> bool:
+    """True if this repo's current hooks.toml content is on the trust store."""
+    project_path = Path(repo_root) / ".localcode" / "hooks.toml"
+    if not project_path.is_file():
+        return True  # nothing to trust
+    # Explicit CI/automation opt-in (env vars are trusted per threat model).
+    if os.environ.get("LOCALCODE_TRUST_PROJECT_HOOKS") == "1":
+        return True
+    store = _load_trust_store()
+    try:
+        key = str(Path(repo_root).resolve())
+    except Exception:
+        key = str(repo_root)
+    recorded = store.get(key)
+    if not recorded:
+        return False
+    try:
+        return recorded == _hooks_digest(project_path)
+    except Exception:
+        return False
+
+
+def trust_project_hooks(repo_root: str) -> bool:
+    """Record the current .localcode/hooks.toml content as trusted for this
+    repo. Returns True on success. Call this from an explicit user action
+    (e.g. a `/hooks trust` command) after the user has reviewed the file.
+    """
+    import json
+    project_path = Path(repo_root) / ".localcode" / "hooks.toml"
+    if not project_path.is_file():
+        return False
+    store = _load_trust_store()
+    try:
+        key = str(Path(repo_root).resolve())
+    except Exception:
+        key = str(repo_root)
+    try:
+        store[key] = _hooks_digest(project_path)
+        dest = _trust_store_path()
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        dest.write_text(json.dumps(store, indent=2))
+        return True
+    except Exception:
+        return False
+
+
 @dataclass
 class HookResult:
     """Result of running a hook."""
@@ -68,6 +145,10 @@ class HookRunner:
         self.repo_root = repo_root
         self.session_id = session_id
         self.model = model
+        # Set by _load_hooks when a repo ships .localcode/hooks.toml that the
+        # user has NOT trusted — the app reads this to warn and offer /hooks
+        # trust. The untrusted hooks are NOT loaded, so nothing runs.
+        self.untrusted_project_hooks = False
         self.config = self._load_hooks()
         self._base_env = {
             **os.environ,
@@ -85,10 +166,16 @@ class HookRunner:
         if global_path.is_file():
             self._merge_hooks(config, global_path)
 
-        # Project hooks (higher priority — overrides global)
+        # Project hooks (higher priority — overrides global), but ONLY if the
+        # user has explicitly trusted this repo. An untrusted repo's hooks are
+        # never loaded or run — this is what stops `git clone && localcode`
+        # from being remote code execution.
         project_path = Path(self.repo_root) / ".localcode" / "hooks.toml"
         if project_path.is_file():
-            self._merge_hooks(config, project_path)
+            if is_project_hooks_trusted(self.repo_root):
+                self._merge_hooks(config, project_path)
+            else:
+                self.untrusted_project_hooks = True
 
         return config