localcode 0.3.29__tar.gz → 0.3.32__tar.gz

{localcode-0.3.29/src/localcode.egg-info → localcode-0.3.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localcode
-Version: 0.3.29
+Version: 0.3.32
 Summary: High-performance AI coding on consumer hardware.
 Author: LocalCode contributors
 License-Expression: Apache-2.0

{localcode-0.3.29 → localcode-0.3.32}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "localcode"
-version = "0.3.29"
+version = "0.3.32"
 description = "High-performance AI coding on consumer hardware."
 readme = "README.md"
 requires-python = ">=3.10"

{localcode-0.3.29 → localcode-0.3.32}/src/localcode/agent/constants.py

@@ -67,24 +67,26 @@ this; interactive sessions don't)."""
 
 MAX_OUTPUT_TOKENS = -1
 """Per-round generation cap. -1 = unlimited; the model stops at its
-natural EOS. Capping mid-stream truncates valid tool-call JSON into
-unparseable garbage, which then triggers a useless recovery round. A
-prior 5.8-minute round burn was caused by an 8192 cap chopping a
-long-but-valid write_file call.
-
-The system-level `--ctx-size 32768` is the absolute ceiling: prompt
-+ generation cannot exceed it, so the model can't run forever even
-without a per-round cap. With prompts in the 5-8K-token range, that
-leaves ~24-27K tokens of generation headroom — enough for any
-single source file we'd reasonably emit in one call.
-
-Historical note: bumped from -1 → 8192 on 2026-04-26 after a
-36-minute turn died with HTTP 500 when the model emitted a 42K-token
-edit_file dict-literal that filled the (then 64K) context mid-decode.
-That regression is no longer reachable — ctx-size is now 32768, the
-mid-stream tool-arg watchdog has been gutted to a 180K hard ceiling
-only, and the model's natural EOS lands well inside the budget for
-normal file writes."""
+natural EOS. This stays -1 deliberately: capping mid-stream truncates
+valid tool-call JSON into unparseable garbage, which then triggers a
+useless recovery round. A prior 5.8-minute round burn was caused by an
+8192 cap chopping a long-but-valid write_file call. So a small per-round
+token cap is the WRONG lever.
+
+The runaway backstop is NOT ctx-size. An earlier version of this note
+claimed `--ctx-size 32768` bounded prompt+generation so "the model can't
+run forever" — that is FALSE for long-context models. LocalCode launches
+Qwen (262K trained) with `--ctx-size 131072`; a 6K-token prompt then
+leaves ~125K tokens of generation headroom ≈ ~28 minutes of nonstop
+decode. A real 40-minute / no-output hang (thinking on, no answer emitted)
+was traced to exactly this.
+
+The correct backstop is the thinking runaway-guard (Feature.THINKING_CAPS
++ MAX_THINKING_SECONDS / MAX_THINKING_CHARS): it aborts a reasoning-only
+phase at 10 min / ~20k tokens regardless of ctx-size, well before the
+context ceiling, and surfaces a clear message. That is why the cap was
+re-enabled 2026-07-19. Leaving MAX_OUTPUT_TOKENS at -1 keeps valid long
+tool calls intact while the thinking guard handles the runaway case."""
 
 
 # ── Thinking-phase safety caps ──────────────────────────────────────
@@ -94,21 +96,24 @@ normal file writes."""
 # `_thinking_abort`, which surfaces a clear user message and ends
 # the turn.
 #
-# Previously only the time cap existed, at 300 s — which a user
-# watching a screen experiences as "frozen for 5 minutes." 90 s is
-# still generous enough for a genuine slow-reason path on IQ2_M
-# (~27 tok/s decode → ~2400 reasoning tokens) but roughly 3×
-# snappier to bail out.
+# These are a RUNAWAY guard, not a reasoning budget. The earlier tight
+# values (90 s / 4000 chars ≈ 1000 tokens) aborted legitimate long
+# reasoning and were disabled 2026-04-27 (see features.THINKING_CAPS).
+# They are re-enabled now with far more generous bounds after a real
+# 29-minute / 94.8k-token runaway on Qwen Q8 with thinking on: the
+# cap must never touch normal reasoning, only a pathological loop.
 #
-# The character cap catches the other failure mode: the model
-# produces reasoning tokens FAST (not slow) but endlessly — tree
-# diagrams, vocabulary lists, full SPAs drafted inline. Rule 23 in
-# the system prompt bans those, but IQ2 compliance is imperfect;
-# 4000 chars ≈ 45 lines ≈ the point where reasoning has clearly
-# exceeded any legit planning budget.
-
-MAX_THINKING_SECONDS = 90
-MAX_THINKING_CHARS = 4000
+#   * 600 s (10 min): a genuine slow-reason path on a heavy Q8 model
+#     (~50-75 tok/s) fits comfortably; a 29-minute loop does not.
+#   * 80000 chars (~20k reasoning tokens): well above any legitimate
+#     planning trace; the observed runaway was ~380k chars.
+#
+# With reasoning now streamed live in the TUI, the user also SEES a
+# runaway and can `esc` — the cap is the backstop for unattended /
+# headless runs where no one is watching.
+
+MAX_THINKING_SECONDS = 600
+MAX_THINKING_CHARS = 80000
 
 
 # ── Tool-result size policy ─────────────────────────────────────────

{localcode-0.3.29 → localcode-0.3.32}/src/localcode/agent/helpers.py

@@ -53,6 +53,124 @@ __all__: list[str] = []
 _SHRINK_GUARD_SOURCE_EXTS = {".py", ".js", ".jsx", ".ts", ".tsx", ".css", ".html"}
 
 
+# ── Autonomy-independent safety hard-block ─────────────────────────────
+#
+# The approval gate (_needs_confirmation) is a *confirmation* layer: it is
+# skipped in FULL_AUTO and in headless mode (which forces full_auto). That
+# left no backstop at all for those modes — a prompt-injected model could
+# run `curl … | sh` via bash OR background_process, or overwrite
+# ~/.ssh/authorized_keys via write_file, entirely unattended. This layer
+# runs before EVERY dispatch regardless of autonomy level or headless, and
+# cannot be overridden. It blocks only unambiguously destructive operations
+# (no legitimate agent use), so it does not add friction to normal work.
+
+# Tools that hand a raw string to a shell.
+_SHELL_EXEC_TOOLS = {"bash", "background_process"}
+# Tools that write file contents to a path.
+_FILE_WRITE_TOOLS = {"write_file", "append_file", "edit_file", "multi_edit", "edit_diff"}
+
+# Credential / key material that the agent has no legitimate reason to write.
+# Matched on the path BASENAME or a path SEGMENT (never a naive substring, so
+# editing the project's own `tokenizer.py` / `api_keys.py` is never blocked).
+_BLOCKED_WRITE_BASENAMES = frozenset({
+    "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519",
+    "authorized_keys", "known_hosts",
+    ".netrc", ".npmrc", ".pypirc",
+    "credentials", "credentials.json",
+    "shadow", "passwd", "sudoers",
+})
+_BLOCKED_WRITE_SEGMENTS = frozenset({".ssh", ".aws", ".gnupg", ".config/gcloud"})
+
+
+def _is_blocked_write_path(raw_path: str) -> bool:
+    """True if writing this path targets credential/key material.
+
+    Precise matching only: exact basename or an exact path segment. A file
+    named `tokenizer.py` or `password_reset.py` in the project is NOT blocked.
+    """
+    if not raw_path:
+        return False
+    try:
+        p = Path(raw_path).expanduser()
+    except Exception:
+        p = Path(raw_path)
+    name = p.name.lower()
+    if name in _BLOCKED_WRITE_BASENAMES:
+        return True
+    lowered_parts = {part.lower() for part in p.parts}
+    if lowered_parts & _BLOCKED_WRITE_SEGMENTS:
+        return True
+    return False
+
+
+# Catastrophic shell commands with NO legitimate agent use — hard-blocked in
+# every mode, never overridable. Deliberately TIGHT: these are anchored to real
+# device/root/home targets so they don't false-positive on a `grep` for the
+# text. "High-risk but sometimes legitimate" commands (curl|sh installs,
+# force-push, sudo rm) are NOT here — they route through the confirmation gate
+# instead (see _CONFIRM_SHELL_RE), so the user can approve them.
+#
+# NB: SQL patterns (DROP TABLE, DELETE FROM, …) are intentionally absent — bash
+# does not execute SQL, so blocking them here only broke `grep "DROP TABLE"`.
+import re as _re
+
+_HARD_BLOCK_SHELL_RE = [
+    _re.compile(r"\brm\s+-[a-z]*r[a-z]*f[a-z]*\s+(/|~|\$HOME|\$\{HOME\})(\s|/|$)", _re.I),
+    _re.compile(r"\brm\s+-[a-z]*f[a-z]*r[a-z]*\s+(/|~|\$HOME|\$\{HOME\})(\s|/|$)", _re.I),
+    _re.compile(r"\bmkfs\b", _re.I),
+    _re.compile(r"\bdd\b[^\n]*\bof=/dev/", _re.I),
+    _re.compile(r">\s*/dev/(sd|nvme|hd|disk|vd)", _re.I),
+    _re.compile(r"\bchmod\s+-R\s+0*777\s+/(\s|$)", _re.I),
+    _re.compile(r":\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:", _re.I),  # fork bomb
+    _re.compile(r">\s*/etc/", _re.I),
+    _re.compile(r"\bwipefs\b", _re.I),
+]
+
+# High-risk-but-sometimes-legitimate shell: prompt for approval (overridable),
+# never silently run and never hard-blocked. Anchored so a `grep` for the text
+# doesn't trigger it: the pipe-to-shell must be a real pipeline, force-push a
+# real git invocation.
+_CONFIRM_SHELL_RE = _re.compile(
+    r"(?:\b(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:ba|z|k|da)?sh\b)"
+    r"|(?:\bgit\s+push\b[^\n]*(?:--force\b|-f\b))"
+    r"|(?:\bsudo\s+rm\b)"
+    r"|(?:\bgit\s+reset\s+--hard\s+origin\b)",
+    _re.I,
+)
+
+
+def _safety_hard_block(name: str, args: dict) -> str | None:
+    """Autonomy-independent hard block. Returns a rejection reason, or None.
+
+    Runs before every tool dispatch in ALL modes (including FULL_AUTO and
+    headless). Covers only operations with no legitimate agent use:
+      - catastrophic shell (rm -rf /, mkfs, dd of=/dev/…, > /dev/sd*, fork
+        bomb, chmod -R 777 /, > /etc/) — see _HARD_BLOCK_SHELL_RE
+      - writes to SSH/AWS/GPG key material or credential files
+    Everything else — including curl|sh and force-push — falls through to the
+    normal confirmation flow, which can approve it.
+    """
+    if name in _SHELL_EXEC_TOOLS:
+        cmd = str(args.get("command", "") or "")
+        if cmd:
+            for rx in _HARD_BLOCK_SHELL_RE:
+                if rx.search(cmd):
+                    return "blocked: refusing a command that could destroy the disk or system (matched a catastrophic pattern)"
+    if name in _FILE_WRITE_TOOLS:
+        raw_path = str(args.get("path", "") or args.get("file_path", "") or "")
+        if raw_path:
+            # The agent's sanctioned scratch dir is exempt.
+            try:
+                from ..notebook import is_within_notebook
+                if is_within_notebook(Path(raw_path).expanduser()):
+                    return None
+            except Exception:
+                pass
+            if _is_blocked_write_path(raw_path):
+                return f"blocked: refusing to write credential/key file ({Path(raw_path).name})"
+    return None
+
+
 def _path_within(path: Path, root: Path) -> bool:
     try:
         path.resolve().relative_to(root)
@@ -162,6 +280,24 @@ def _execute_tool_result(app: "LocalCodeApp", name: str, args: dict, out: "Outpu
     wrapping plan-mode policy layer that refuses destructive tools
     while the agent is in plan-explore mode.
     """
+    # Autonomy-independent safety hard-block. Runs FIRST, in every mode
+    # (including FULL_AUTO / headless), and cannot be overridden — this is the
+    # backstop the confirmation gate is not. A prompt-injected model cannot use
+    # bash/background_process to run `curl|sh` or wipe a disk, nor a write tool
+    # to overwrite ~/.ssh/authorized_keys, even with no human present.
+    _blocked = _safety_hard_block(name, args)
+    if _blocked is not None:
+        try:
+            from ..events import emit as _emit_block
+            _emit_block("safety_hard_block", tool=name, reason=str(_blocked)[:200])
+        except Exception:
+            pass
+        return ToolResult(
+            text=f"REJECTED: {_blocked}. This operation is blocked by the safety layer and cannot be auto-approved.",
+            ok=False,
+            facts={"tool": name, "ok": False, "safety_blocked": True},
+        )
+
     try:
         hook = getattr(app, "hooks", None)
         decision = hook.on_pre_tool_use(name, args) if hook is not None else None
@@ -277,20 +413,63 @@ def _needs_confirmation(name: str, args: dict, app: "LocalCodeApp | None" = None
     picks option 2 on a prompt ("always allow `git`"). That set is on
     `app._session_allow` — scoped to this process, cleared on next launch.
     """
-    if name != "bash":
+    # Tools that don't execute shell or mutate files never need confirmation.
+    if name != "bash" and name not in _SHELL_EXEC_TOOLS and name not in _FILE_WRITE_TOOLS:
         return False
+
+    level = None
     if app is not None:
         try:
             from ..autonomy import AutonomyLevel
-            if getattr(app, "_autonomy", None) == AutonomyLevel.FULL_AUTO:
+            level = getattr(app, "_autonomy", None)
+            # FULL_AUTO skips confirmation for everything (the hard-block in
+            # _execute_tool_result still applies — it is not an approval).
+            if level == AutonomyLevel.FULL_AUTO:
                 return False
         except Exception:
-            pass
+            level = None
+
+    # File-write tools: auto-approved in auto_edit (the point of that mode);
+    # in suggest (read-only) mode every write is confirmed. Notebook scratch
+    # writes are never prompted.
+    if name in _FILE_WRITE_TOOLS:
+        try:
+            from ..autonomy import AutonomyLevel
+            if level != AutonomyLevel.SUGGEST:
+                return False
+        except Exception:
+            return False
+        raw_path = str(args.get("path", "") or args.get("file_path", "") or "")
+        if raw_path:
+            try:
+                from ..notebook import is_within_notebook
+                if is_within_notebook(Path(raw_path).expanduser()):
+                    return False
+            except Exception:
+                pass
+        return True
+
+    # Shell-executing tools (bash, background_process).
     cmd = args.get("command", "")
     if app is not None:
         allow = getattr(app, "_session_allow", None)
         if allow and _first_token(cmd) in allow:
             return False
+    # background_process hands a raw string straight to /bin/sh with no
+    # destructive-substring shortcut — always confirm it (unless full_auto or
+    # session-allowed above). In suggest mode, confirm any shell command.
+    if name == "background_process":
+        return True
+    try:
+        from ..autonomy import AutonomyLevel
+        if level == AutonomyLevel.SUGGEST:
+            return True
+    except Exception:
+        pass
+    # High-risk-but-sometimes-legit patterns (remote pipe-to-shell, force-push,
+    # sudo rm) are NOT hard-blocked — confirm them so the user can approve.
+    if _CONFIRM_SHELL_RE.search(cmd):
+        return True
     return any(p in cmd for p in DESTRUCTIVE_PATTERNS)
 
 def _render_markdown(text: str, console: Console | None = None) -> None:

{localcode-0.3.29 → localcode-0.3.32}/src/localcode/agent/loop.py

@@ -965,12 +965,12 @@ def run_agent_loop(
         # If we bailed on a stuck thinking loop, tell the user explicitly so
         # they know why the turn ended and can try a different prompt.
         if _stream_result.thinking_abort:
-            out.print_info(
+            out.notice(
                 f"Stopped: model reasoning exceeded the per-round cap "
                 f"({MAX_THINKING_SECONDS}s or {MAX_THINKING_CHARS} chars) without "
-                f"emitting a response. Small quantized models (IQ2_M, IQ3_S) often "
-                f"produce better output in fast mode — try `/mode` to switch, or "
-                f"rephrase the task in smaller steps."
+                f"emitting a response. Turn off deep reasoning with `/thinking off`, "
+                f"switch to a faster model with `/model`, or rephrase the task in "
+                f"smaller steps."
             )
 
         # Show thinking summary if present (collapsed, dim)
@@ -1657,7 +1657,13 @@ def run_agent_loop(
             # "always" adds the command's first token (e.g. "git") to the
             # session allowlist so we stop asking for that family.
             if _needs_confirmation(tool_name, args, app):
+                # `cmd` drives the approval prompt display and the "always
+                # allow `<token>`" key. Shell tools carry a command; file-write
+                # tools carry a path — show that instead of a blank line.
                 cmd = args.get("command", "")
+                if not cmd:
+                    _wpath = args.get("path") or args.get("file_path") or ""
+                    cmd = f"{tool_name} {_wpath}".strip()
                 verdict = "deny"
                 if out._approval_callback is not None:
                     raw = out._approval_callback(tool_name, cmd)

{localcode-0.3.29 → localcode-0.3.32}/src/localcode/bootstrap.py

@@ -289,6 +289,50 @@ def _is_complete_download(p: Path, catalog_entry) -> bool:
     return size >= int(expected * 0.97)
 
 
+def _verify_download_integrity(choice, path: Path) -> tuple[bool, str]:
+    """Verify a freshly-downloaded model file against its pinned sha256.
+
+    Returns (ok, reason). When the catalog entry has no `sha256` set (the
+    default), this is a no-op that returns (True, "") — behavior is unchanged
+    for unpinned entries. When a hash IS pinned and the file does not match,
+    the file is DELETED (so a poisoned artifact is never loaded or executed)
+    and (False, reason) is returned.
+
+    This is the integrity backstop the size-only completeness check is not:
+    upstream can swap weights under the same filename, and TLS/host pinning
+    alone does not detect a malicious or corrupted artifact served by a
+    compromised upstream repo.
+    """
+    expected = getattr(choice, "sha256", None)
+    if not expected:
+        return True, ""
+    try:
+        import hashlib
+        h = hashlib.sha256()
+        with open(path, "rb") as fh:
+            for chunk in iter(lambda: fh.read(1024 * 1024), b""):
+                h.update(chunk)
+        actual = h.hexdigest()
+    except Exception as e:
+        return False, f"Integrity check could not read {path.name}: {e}"
+    if actual.lower() != str(expected).lower():
+        try:
+            path.unlink()
+        except Exception:
+            pass
+        try:
+            from .events import emit as _emit
+            _emit("download_integrity_fail", filename=choice.filename, expected=str(expected)[:16], actual=actual[:16])
+        except Exception:
+            pass
+        return False, (
+            f"Integrity check FAILED for {choice.filename}: expected sha256 "
+            f"{expected}, got {actual}. The file was deleted — LocalCode will "
+            "not load a model whose contents don't match the pinned hash."
+        )
+    return True, ""
+
+
 def get_model_path(preferred_filename: str | None = None) -> Path | None:
     """Return path to a usable GGUF model, checking multiple locations.
 
@@ -537,7 +581,8 @@ def download_model(
         # fails (exotic FS), fall through and let the download try.
         pass
 
-    url = f"https://huggingface.co/{choice.hf_repo}/resolve/main/{choice.filename}"
+    _rev = getattr(choice, "revision", None) or "main"
+    url = f"https://huggingface.co/{choice.hf_repo}/resolve/{_rev}/{choice.filename}"
     if on_progress:
         on_progress(f"Downloading {choice.filename} (~{choice.size_gb:.1f} GB)...")
 
@@ -559,6 +604,9 @@ def download_model(
         # Resumes via the hub's built-in partial-download handling.
         try:
             if _try_hub_download(choice, model_file, on_progress):
+                ok, reason = _verify_download_integrity(choice, model_file)
+                if not ok:
+                    return False, reason
                 return True, str(model_file)
         except Exception as e:
             last_err = e
@@ -573,6 +621,9 @@ def download_model(
         # Slow path: tuned urllib parallel downloader.
         try:
             _download_parallel(url, model_file, num_threads=32, on_progress=on_progress)
+            ok, reason = _verify_download_integrity(choice, model_file)
+            if not ok:
+                return False, reason
             return True, str(model_file)
         except Exception as e:
             last_err = e
@@ -948,6 +999,10 @@ def _try_hub_download(choice, dest: Path, on_progress: Callable[[str], None] | N
     downloaded_path = hf_hub_download(
         repo_id=choice.hf_repo,
         filename=choice.filename,
+        # Pin to the entry's revision (commit SHA/tag) when set; defaults to
+        # "main" (unchanged behavior). Pinning makes an upstream weight swap
+        # under the same filename visible instead of silent.
+        revision=getattr(choice, "revision", None) or "main",
         local_dir=str(dest.parent),
         tqdm_class=_make_progress_tqdm(on_progress) if on_progress else None,
     )

{localcode-0.3.29 → localcode-0.3.32}/src/localcode/features.py

@@ -162,11 +162,13 @@ FEATURE_DEFAULTS: dict[Feature, bool] = {
     Feature.TOOL_RESULT_AGING: True,
     Feature.CONTEXT_SHIFT: True,
 
-    # Decode safety. THINKING_CAPS disabled by user request 2026-04-27 —
-    # the per-round caps were aborting useful long-reasoning rounds and
-    # causing more failures than they prevented. Re-enable only if the
-    # "15-minute reasoning" failure mode reappears.
-    Feature.THINKING_CAPS: False,
+    # Decode safety. Re-enabled 2026-07-19 after a real 29-minute /
+    # 94.8k-token thinking runaway (Qwen Q8, thinking on) that never
+    # produced output. Disabled 2026-04-27 because the caps were far too
+    # tight (90 s / 4000 chars) and aborted useful reasoning; now paired
+    # with GENEROUS bounds (600 s / 80000 chars, see constants.py) that
+    # only catch a pathological loop, never normal reasoning.
+    Feature.THINKING_CAPS: True,
     Feature.AUTO_NUDGE_RECOVERY: True,
 
     # Runtime — on. The pressure monitor specifically is what

{localcode-0.3.29 → localcode-0.3.32}/src/localcode/hf_quants.py

@@ -76,18 +76,37 @@ class Quant:
 
 
 def _quant_from_entry(entry: dict) -> Quant | None:
-    """Build a Quant from one HF tree entry, or None if it's not a .gguf."""
+    """Build a Quant from one HF tree entry, or None if it's not a selectable
+    model-weight quant.
+
+    The browser lists things the user PICKS. It must show only real model-weight
+    quants — never sidecar files, which are tiny and confusing next to a
+    multi-GB model (a 12B repo showing "BF16 · 0.9 GB" rows is the vision
+    projector, not a 12B model). Dropped here:
+      - vision projectors (`mmproj-*.gguf`) — auto-paired with the chosen quant
+        via the catalog's mmproj fields, never selected directly
+      - speculative-decoding draft heads (`mtp-*.gguf`) and anything in a
+        subfolder (e.g. `MTP/…`) — not standalone models
+      - any file with no recognizable quant code (`…-it.gguf` extras)
+    """
     path = entry.get("path", "")
     if not path.lower().endswith(".gguf"):
         return None
     base = path.rsplit("/", 1)[-1]
-    is_mmproj = base.lower().startswith("mmproj")
+    lowered = base.lower()
+    # Subfolder files (e.g. `MTP/gemma-…-Q4_0.gguf`) are never top-level
+    # selectable weights.
+    if "/" in path:
+        return None
+    # Vision projectors and MTP draft heads are sidecars, not pickable models.
+    if lowered.startswith("mmproj") or lowered.startswith("mtp-") or lowered.startswith("mtp_"):
+        return None
     label = _parse_label(path)
-    # Keep only real weight quants and vision projectors. Anything else with
-    # no quant code (MTP drafters, `…-it.gguf` extras) is repo noise — drop it
-    # so the picker never shows rows like "it · 0.5 GB" / "MTP · 0.5 GB".
-    if label is None and not is_mmproj:
+    # Real weight quants carry a quant code (Q4_K_M, IQ3_S, BF16, …). Anything
+    # else is repo noise — drop it so the picker never shows junk rows.
+    if label is None:
         return None
+    is_mmproj = False
     # LFS weights store the true size under entry["lfs"]["size"]; fall back to
     # the top-level "size" for non-LFS files.
     lfs = entry.get("lfs") or {}
@@ -95,8 +114,7 @@ def _quant_from_entry(entry: dict) -> Quant | None:
     return Quant(
         filename=path,
         size_gb=round(size_bytes / 1e9, 3),
-        # mmproj sidecars have no quant code — show their precision instead.
-        label=label or (base[:-5].split("-")[-1] if base.lower().endswith(".gguf") else base),
+        label=label,
         is_mmproj=is_mmproj,
     )
 

{localcode-0.3.29 → localcode-0.3.32}/src/localcode/hooks.py

@@ -34,6 +34,83 @@ from pathlib import Path
 from ._subproc_env import clean_env
 
 
+# ── Project-hooks trust store ──────────────────────────────────────────
+#
+# A repo's `.localcode/hooks.toml` runs shell commands at session start / on
+# every prompt / before every tool. Loading it just because you opened the
+# folder is remote code execution on `git clone && localcode` — the classic
+# "workspace trust" hole. So project hooks are gated: they run ONLY if the
+# user has explicitly trusted this repo path AND the file's content hash still
+# matches what was trusted (editing the hooks re-prompts). Global hooks in the
+# user's own ~/.localcode are always trusted (their own machine, their config).
+
+def _trust_store_path() -> Path:
+    return Path.home() / ".localcode" / "trusted_hooks.json"
+
+
+def _hooks_digest(path: Path) -> str:
+    import hashlib
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def _load_trust_store() -> dict:
+    import json
+    p = _trust_store_path()
+    if not p.is_file():
+        return {}
+    try:
+        data = json.loads(p.read_text())
+        return data if isinstance(data, dict) else {}
+    except Exception:
+        return {}
+
+
+def is_project_hooks_trusted(repo_root: str) -> bool:
+    """True if this repo's current hooks.toml content is on the trust store."""
+    project_path = Path(repo_root) / ".localcode" / "hooks.toml"
+    if not project_path.is_file():
+        return True  # nothing to trust
+    # Explicit CI/automation opt-in (env vars are trusted per threat model).
+    if os.environ.get("LOCALCODE_TRUST_PROJECT_HOOKS") == "1":
+        return True
+    store = _load_trust_store()
+    try:
+        key = str(Path(repo_root).resolve())
+    except Exception:
+        key = str(repo_root)
+    recorded = store.get(key)
+    if not recorded:
+        return False
+    try:
+        return recorded == _hooks_digest(project_path)
+    except Exception:
+        return False
+
+
+def trust_project_hooks(repo_root: str) -> bool:
+    """Record the current .localcode/hooks.toml content as trusted for this
+    repo. Returns True on success. Call this from an explicit user action
+    (e.g. a `/hooks trust` command) after the user has reviewed the file.
+    """
+    import json
+    project_path = Path(repo_root) / ".localcode" / "hooks.toml"
+    if not project_path.is_file():
+        return False
+    store = _load_trust_store()
+    try:
+        key = str(Path(repo_root).resolve())
+    except Exception:
+        key = str(repo_root)
+    try:
+        store[key] = _hooks_digest(project_path)
+        dest = _trust_store_path()
+        dest.parent.mkdir(parents=True, exist_ok=True)
+        dest.write_text(json.dumps(store, indent=2))
+        return True
+    except Exception:
+        return False
+
+
 @dataclass
 class HookResult:
     """Result of running a hook."""
@@ -68,6 +145,10 @@ class HookRunner:
         self.repo_root = repo_root
         self.session_id = session_id
         self.model = model
+        # Set by _load_hooks when a repo ships .localcode/hooks.toml that the
+        # user has NOT trusted — the app reads this to warn and offer /hooks
+        # trust. The untrusted hooks are NOT loaded, so nothing runs.
+        self.untrusted_project_hooks = False
         self.config = self._load_hooks()
         self._base_env = {
             **os.environ,
@@ -85,10 +166,16 @@ class HookRunner:
         if global_path.is_file():
             self._merge_hooks(config, global_path)
 
-        # Project hooks (higher priority — overrides global)
+        # Project hooks (higher priority — overrides global), but ONLY if the
+        # user has explicitly trusted this repo. An untrusted repo's hooks are
+        # never loaded or run — this is what stops `git clone && localcode`
+        # from being remote code execution.
         project_path = Path(self.repo_root) / ".localcode" / "hooks.toml"
         if project_path.is_file():
-            self._merge_hooks(config, project_path)
+            if is_project_hooks_trusted(self.repo_root):
+                self._merge_hooks(config, project_path)
+            else:
+                self.untrusted_project_hooks = True
 
         return config