localcode 0.4.10__tar.gz → 0.5.1__tar.gz

{localcode-0.4.10 → localcode-0.5.1}/MANIFEST.in

@@ -2,7 +2,6 @@ include src/localcode/bin/llama-server
 include src/localcode/bin/localcode-ui
 include src/localcode/ui/FORK_COMMIT
 recursive-include src/localcode/ui/plugin *.ts
-recursive-include src/localcode/tui/styles *.tcss
 recursive-include llama-cpp-turboquant/cmake *
 recursive-include llama-cpp-turboquant/common *.cpp *.h *.hpp
 recursive-include llama-cpp-turboquant/ggml *.cpp *.h *.hpp *.c *.m *.metal

{localcode-0.4.10/src/localcode.egg-info → localcode-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localcode
-Version: 0.4.10
+Version: 0.5.1
 Summary: High-performance AI coding on consumer hardware.
 Author: LocalCode contributors
 License-Expression: Apache-2.0
@@ -25,18 +25,10 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: certifi>=2024.0.0
-Requires-Dist: ddgs>=9.0.0
 Requires-Dist: hf_xet>=1.1.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: huggingface_hub>=1.0.0
-Requires-Dist: jedi>=0.19.0
-Requires-Dist: mcp>=1.28.0
-Requires-Dist: prompt_toolkit>=3.0.52
 Requires-Dist: rich>=13.7.1
-Requires-Dist: scikit-learn>=1.3.0
-Requires-Dist: textual>=8.2.4
-Requires-Dist: tree-sitter>=0.23.0
-Requires-Dist: tree-sitter-language-pack>=1.0.0
 Requires-Dist: tomli>=2.0.0; python_version < "3.11"
 Requires-Dist: pywhispercpp>=1.2.0; sys_platform == "darwin"
 Requires-Dist: sounddevice>=0.4.6; sys_platform == "darwin"

{localcode-0.4.10 → localcode-0.5.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "localcode"
-version = "0.4.10"
+version = "0.5.1"
 description = "High-performance AI coding on consumer hardware."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -30,18 +30,10 @@ classifiers = [
 ]
 dependencies = [
   "certifi>=2024.0.0",
-  "ddgs>=9.0.0",
   "hf_xet>=1.1.0",            # Rust download backend for huggingface_hub ≥1.x (replaced hf_transfer)
   "httpx>=0.27.0",
   "huggingface_hub>=1.0.0",   # used as the fast path for GGUF downloads
-  "jedi>=0.19.0",
-  "mcp>=1.28.0",              # official Model Context Protocol SDK (stdio/HTTP/SSE + OAuth)
-  "prompt_toolkit>=3.0.52",
   "rich>=13.7.1",
-  "scikit-learn>=1.3.0",
-  "textual>=8.2.4",
-  "tree-sitter>=0.23.0",              # in-process, offline syntax checking (Tier-1 verify)
-  "tree-sitter-language-pack>=1.0.0", # bundled grammars, 100+ languages, no external tools
   "tomli>=2.0.0;python_version<'3.11'",
   # Voice, bundled on macOS only (the product platform) so /voice and the
   # piper neural voice work out of the box. The markers keep these heavy
@@ -81,7 +73,6 @@ where = ["src"]
 
 [tool.setuptools.package-data]
 "localcode" = [
-    "**/*.tcss",
     "bin/llama-server",
     "bin/localcode-ui",
     "ui/plugin/*.ts",

{localcode-0.4.10 → localcode-0.5.1}/setup.py

@@ -61,7 +61,7 @@ setup(
         "bdist_wheel": {"plat_name": "macosx_13_0_arm64"},
     },
     package_data={
-        "localcode": ["bin/llama-server", "bin/localcode-ui", "bin/*.dylib", "**/*.tcss",
+        "localcode": ["bin/llama-server", "bin/localcode-ui", "bin/*.dylib",
                       "ui/plugin/*.ts", "ui/FORK_COMMIT"],
     },
     exclude_package_data={

{localcode-0.4.10 → localcode-0.5.1}/src/localcode/__init__.py

@@ -8,4 +8,4 @@ from importlib.metadata import PackageNotFoundError, version as _pkg_version
 try:
     __version__ = _pkg_version("localcode")
 except PackageNotFoundError:  # not installed (e.g. raw source checkout)
-    __version__ = "0.4.10"
+    __version__ = "0.5.1"

localcode-0.5.1/src/localcode/bin/localcode-ui

@@ -0,0 +1,4 @@
+[diffend] Oversized file quarantined before diffing.
+name: localcode-0.5.1/src/localcode/bin/localcode-ui
+size: 102794210 bytes
+sha256: abaccffb496fdb806382bb5ef6416d9a5da33ea95892dd402c1131ef0208d1c9

localcode-0.5.1/src/localcode/entrypoint.py

@@ -0,0 +1,69 @@
+"""LocalCode launcher: `localcode [project]` starts the agent runtime."""
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+from pathlib import Path
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="localcode",
+        description="LocalCode — AI coding assistant running entirely on your machine",
+    )
+    parser.add_argument("--version", action="store_true", help="Print the version and exit")
+    parser.add_argument("--model", help="Model alias to load (otherwise the picker asks)")
+    parser.add_argument("-c", "--cwd", type=str, default=None,
+                        help="Working directory for the project (defaults to the current directory)")
+    parser.add_argument("project", nargs="?", default=None,
+                        help="Project directory (same as --cwd)")
+    return parser
+
+
+def _unsupported_platform_message() -> str:
+    import platform
+    return (
+        f"localcode: this release runs on Apple silicon Macs (macOS 13 or newer); "
+        f"this machine reports {platform.system()} {platform.machine()}.\n"
+        "Earlier releases installed on other platforms but bundled an Apple silicon "
+        "model server, so they did not work there either."
+    )
+
+
+def main(argv: list[str] | None = None) -> None:
+    os.environ["HF_HUB_DISABLE_PROGRESS_BARS"] = "1"
+    # macOS malloc-warning silencer: these variables make every subprocess
+    # print "can't turn off malloc stack logging" into stderr.
+    for var in ("MallocStackLogging", "MallocStackLoggingNoCompact", "MallocNanoZone"):
+        os.environ.pop(var, None)
+
+    args = build_parser().parse_args(argv)
+
+    if args.version:
+        from . import __version__
+        print(__version__)
+        return
+
+    project = args.cwd or args.project
+    if project:
+        project_dir = Path(project).resolve()
+        if not project_dir.is_dir():
+            print(f"localcode: directory not found: {project}", file=sys.stderr)
+            sys.exit(1)
+        os.chdir(project_dir)
+
+    from .ui import platform_supported, ui_binary_path
+    if not platform_supported():
+        print(_unsupported_platform_message(), file=sys.stderr)
+        sys.exit(1)
+    if ui_binary_path() is None:
+        print("localcode: the UI binary is missing from this install. "
+              "Reinstall with `pip install -U localcode`.", file=sys.stderr)
+        sys.exit(1)
+    from .ui.launch import main as ui_main
+    sys.exit(ui_main(args.model))
+
+
+if __name__ == "__main__":
+    main()

localcode-0.5.1/src/localcode/ui/FORK_COMMIT

@@ -0,0 +1 @@
+d488184f59a61443362808a57961cd1b15cba4d4

localcode-0.5.1/src/localcode/ui/auth.py

@@ -0,0 +1,94 @@
+"""Per-session secrets for the two local listeners.
+
+Both the model supervisor's control API and llama-server bind to loopback only,
+but any web page in the user's browser can still send requests to localhost
+ports. So every session carries two random secrets:
+
+- the control token: required (as the X-Localcode-Token header) on every
+  control-API request, reads included, since /status and /voice/stop leak on
+  their own;
+- the server key: llama-server's --api-key, sent as a bearer token by the UI
+  runtime and by the supervisor's and warm-up's own requests.
+
+The launcher generates them and hands them to the supervisor and the UI through
+the environment. The supervisor also writes them, owner-readable only, into the
+run directory, so a second `localcode` (which attaches to the running session)
+and developer tooling can find them.
+"""
+from __future__ import annotations
+
+import json
+import os
+import secrets
+from pathlib import Path
+
+TOKEN_ENV = "LOCALCODE_CONTROL_TOKEN"
+KEY_ENV = "LOCALCODE_SERVER_KEY"
+TOKEN_HEADER = "X-Localcode-Token"
+AUTH_FILE = "auth.json"
+
+
+def new_secret() -> str:
+    return secrets.token_urlsafe(32)
+
+
+def control_token() -> str:
+    return os.environ.get(TOKEN_ENV, "")
+
+
+def server_key() -> str:
+    return os.environ.get(KEY_ENV, "")
+
+
+def control_headers(token: str | None = None) -> dict[str, str]:
+    return {TOKEN_HEADER: token if token is not None else control_token()}
+
+
+def server_headers(key: str | None = None) -> dict[str, str]:
+    return {"Authorization": f"Bearer {key if key is not None else server_key()}"}
+
+
+def write_auth_file(run_dir: Path, token: str, key: str) -> Path:
+    """Persist the session secrets owner-readable only (0600, inside a 0700 dir)."""
+    run_dir.mkdir(parents=True, exist_ok=True)
+    try:
+        os.chmod(run_dir, 0o700)
+    except OSError:
+        pass
+    path = run_dir / AUTH_FILE
+    tmp = path.with_suffix(".json.tmp")
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as f:
+        json.dump({"control_token": token, "server_key": key}, f)
+    os.replace(tmp, path)
+    return path
+
+
+def read_auth_file(run_dir: Path) -> tuple[str, str] | None:
+    try:
+        data = json.loads((run_dir / AUTH_FILE).read_text())
+        return str(data["control_token"]), str(data["server_key"])
+    except (OSError, ValueError, KeyError, TypeError):
+        return None
+
+
+def request_allowed(headers, expected_token: str, port: int, *, want_json: bool = False) -> str | None:
+    """Why a control-API request must be refused, or None when it may proceed.
+
+    Checked in order: a browser-originated request (Origin header present),
+    a Host that is not this loopback listener (DNS rebinding), a wrong or
+    missing token, and, for state-changing requests, a non-JSON content type
+    (a cross-site form or no-cors fetch cannot set one).
+    """
+    if headers.get("Origin") is not None:
+        return "cross-origin request refused"
+    host = (headers.get("Host") or "").strip().lower()
+    if host not in {f"127.0.0.1:{port}", f"localhost:{port}", f"[::1]:{port}"}:
+        return "unexpected Host"
+    if not expected_token or not secrets.compare_digest(headers.get(TOKEN_HEADER) or "", expected_token):
+        return "missing or wrong control token"
+    if want_json:
+        ctype = (headers.get("Content-Type") or "").split(";")[0].strip().lower()
+        if ctype != "application/json":
+            return "Content-Type must be application/json"
+    return None

{localcode-0.4.10 → localcode-0.5.1}/src/localcode/ui/launch.py

@@ -19,6 +19,7 @@ import urllib.request
 from pathlib import Path
 
 from localcode.ui import plugin_path, run_dir, ui_binary_path
+from localcode.ui.auth import KEY_ENV, TOKEN_ENV, control_headers, new_secret, read_auth_file, server_key
 from localcode.ui.ports import choose_ports, find_running
 
 WAIT_S = 240
@@ -43,8 +44,10 @@ def _llama_server() -> Path | None:
 
 
 def _get_json(url: str, timeout: float = 1.0) -> dict | None:
+    """GET a control-API route with the session token."""
     try:
-        with urllib.request.urlopen(url, timeout=timeout) as r:
+        req = urllib.request.Request(url, headers=control_headers())
+        with urllib.request.urlopen(req, timeout=timeout) as r:
             return json.load(r)
     except Exception:  # noqa: BLE001
         return None
@@ -52,7 +55,8 @@ def _get_json(url: str, timeout: float = 1.0) -> dict | None:
 
 def _ok(url: str) -> bool:
     try:
-        with urllib.request.urlopen(url, timeout=1.0):
+        req = urllib.request.Request(url, headers=control_headers())
+        with urllib.request.urlopen(req, timeout=1.0):
             return True
     except Exception:  # noqa: BLE001
         return False
@@ -91,7 +95,7 @@ def write_config(path: Path, *, port: int, ctx: int, alias: str | None) -> None:
             "localcode": {
                 "npm": "@ai-sdk/openai-compatible",
                 "name": "localcode",
-                "options": {"baseURL": f"http://127.0.0.1:{port}/v1", "apiKey": "local"},
+                "options": {"baseURL": f"http://127.0.0.1:{port}/v1", "apiKey": server_key() or "local"},
                 "models": {
                     model_key: {
                         "name": alias or "no model loaded",
@@ -124,6 +128,10 @@ def write_config(path: Path, *, port: int, ctx: int, alias: str | None) -> None:
 
 def attach(ctrl: int, status: dict, ui_bin: Path, project_dir: Path, alias: str | None) -> int:
     """Open another UI window on the model server a running session owns."""
+    # The running session's secrets, left owner-only in the run directory.
+    auth = read_auth_file(run_dir())
+    if auth:
+        os.environ[TOKEN_ENV], os.environ[KEY_ENV] = auth
     port = int(status["port"])
     try:
         ctx = int(status.get("ctx") or 0)
@@ -157,7 +165,7 @@ def main(model: str | None = None, project: str | None = None) -> int:
     ui_bin = ui_binary_path()
     if ui_bin is None:
         print("localcode: the UI binary is missing from this install. "
-              "Run `localcode --classic` for the previous interface, or reinstall with `pip install -U localcode`.",
+              "Reinstall with `pip install -U localcode`.",
               file=sys.stderr)
         return 1
     server = _llama_server()
@@ -185,8 +193,16 @@ def main(model: str | None = None, project: str | None = None) -> int:
         print(f"localcode: {error}", file=sys.stderr)
         return 1
 
+    # Fresh secrets for this session; the supervisor and the UI inherit them.
+    os.environ[TOKEN_ENV] = new_secret()
+    os.environ[KEY_ENV] = new_secret()
+
     rd = run_dir()
     rd.mkdir(parents=True, exist_ok=True)
+    try:
+        os.chmod(rd, 0o700)   # server.log, warm-up token files and auth.json live here
+    except OSError:
+        pass
     sup_log = (rd / "supervisor.log").open("ab")
     sup = subprocess.Popen(
         [sys.executable, "-m", "localcode.ui.supervisor",

{localcode-0.4.10 → localcode-0.5.1}/src/localcode/ui/plugin/localcode.ts

@@ -47,6 +47,16 @@ const MAX_TODO_CONTINUATIONS = 15;
 const MAX_TODO_STUCK = 3;
 const MAX_BUILD_VERIFY = 3;
 const NUDGE_PREFIX = "SYSTEM:";
+/** The supervisor's control API requires the session token on every request. */
+const controlHeaders = (): Record<string, string> => ({
+  "content-type": "application/json",
+  "x-localcode-token": process.env.LOCALCODE_CONTROL_TOKEN ?? "",
+});
+/** The build-check gate runs the project's own build or test command. That is
+ *  code from the opened repository executing outside the runtime's permission
+ *  system, so it is off unless the user opts in. The model still runs checks
+ *  itself through the bash tool, where permissions apply. */
+const autoCheck = () => process.env.LOCALCODE_AUTO_CHECK === "1";
 
 const PLANNING_RULE = `WORKSPACE TASK COMPLETION:
 - These execution rules apply ONLY when the user asks for work on project files. Answer general questions, advice, greetings, and unrelated web research directly, without todowrite, repository exploration, build checks, or creating files. Do not invent deliverables, compliance requirements, or project work the user did not request.
@@ -541,7 +551,7 @@ const LocalcodePlugin: Plugin = async ({ client, directory }) => {
     if (!control) return undefined;
     if (Date.now() - loadedName.at < 3_000) return loadedName.name;
     try {
-      const r = await fetch(`${control}/status`, { signal: AbortSignal.timeout(1_000) });
+      const r = await fetch(`${control}/status`, { headers: controlHeaders(), signal: AbortSignal.timeout(1_000) });
       const j = (await r.json()) as { current?: string; state?: string };
       if (j.state === "ready" && j.current) loadedName = { name: j.current, at: Date.now() };
     } catch {}
@@ -643,7 +653,7 @@ const LocalcodePlugin: Plugin = async ({ client, directory }) => {
         // A real turn is about to hit the model: if the supervisor is still
         // pre-reading the prompt prefix (warm-up), stop it so this request runs next.
         const control = process.env.LOCALCODE_CONTROL_URL;
-        if (control) fetch(`${control}/warmup/cancel`, { method: "POST", body: "{}" }).catch(() => {});
+        if (control) fetch(`${control}/warmup/cancel`, { method: "POST", headers: controlHeaders(), body: "{}" }).catch(() => {});
         workspaceActive = false;
         if (activeSession !== input.sessionID || interrupted.has(input.sessionID)) todos = [];
         activeSession = input.sessionID;
@@ -781,7 +791,7 @@ const LocalcodePlugin: Plugin = async ({ client, directory }) => {
         }
       }
 
-      if (buildVerifyNudges < MAX_BUILD_VERIFY) {
+      if (autoCheck() && buildVerifyNudges < MAX_BUILD_VERIFY) {
         const roots = [...new Set(changed.map(checkDirectory).filter((root): root is string => Boolean(root)))];
         if (!roots.length) roots.push(directory);
         for (const root of roots) {

{localcode-0.4.10 → localcode-0.5.1}/src/localcode/ui/ports.py

@@ -5,6 +5,19 @@ import json
 import socket
 import urllib.request
 
+from localcode.ui import run_dir
+from localcode.ui.auth import control_headers, read_auth_file
+
+
+def _status(port: int) -> dict:
+    """/status of a supervisor on this port, authenticated with the session
+    token the supervisor left in the run directory."""
+    auth = read_auth_file(run_dir())
+    req = urllib.request.Request(f"http://127.0.0.1:{port}/status",
+                                 headers=control_headers(auth[0] if auth else ""))
+    with urllib.request.urlopen(req, timeout=0.3) as response:
+        return json.load(response)
+
 
 def available(port: int) -> bool:
     with socket.socket() as sock:
@@ -21,10 +34,9 @@ def find_running(control_ports=range(8323, 8400)) -> tuple[int, dict] | None:
         if available(port):
             continue
         try:
-            with urllib.request.urlopen(f"http://127.0.0.1:{port}/status", timeout=0.3) as response:
-                status = json.load(response)
-                int(status["port"])
-                return port, status
+            status = _status(port)
+            int(status["port"])
+            return port, status
         except (OSError, ValueError, KeyError, TypeError):
             continue
     return None
@@ -38,9 +50,8 @@ def choose_ports(model_ports=range(8123, 8200), control_ports=range(8323, 8400))
                 control = port
             continue
         try:
-            with urllib.request.urlopen(f"http://127.0.0.1:{port}/status", timeout=0.3) as response:
-                int(json.load(response)["port"])
-                raise RuntimeError("localcode is already running in another terminal; a second window attaches to its model server.")
+            int(_status(port)["port"])
+            raise RuntimeError("localcode is already running in another terminal; a second window attaches to its model server.")
         except (OSError, ValueError, KeyError, TypeError):
             continue
     model = next((port for port in model_ports if available(port)), None)

{localcode-0.4.10 → localcode-0.5.1}/src/localcode/ui/server_cmd.py

@@ -20,6 +20,11 @@ def server_command(gguf: str, port: int, alias: str | None = None) -> list[str]:
     g = LocalCodeRuntimeGateway(cfg.runtime)
     cmd = g.llama_server_command(gguf, port)
     cmd[1:1] = ["--host", "127.0.0.1"]
+    # Any web page can reach a localhost port; the key makes the model and its
+    # /slots (which can hold prompt text) unusable without the session secret.
+    from localcode.ui.auth import server_key
+    if server_key():
+        cmd += ["--api-key", server_key()]
     if alias:
         cmd += ["--alias", alias]
     # Hidden thinking is a SERVER property, one switch for every front end and

{localcode-0.4.10 → localcode-0.5.1}/src/localcode/ui/supervisor.py

@@ -52,6 +52,7 @@ from localcode.models_catalog import (
 
 MIN_SPEED_FRACTION = 0.5  # same rule as tui/screens/model_picker.py
 from localcode.ui import run_dir
+from localcode.ui.auth import KEY_ENV, control_token, new_secret, request_allowed, server_headers, server_key, write_auth_file
 
 HERE = run_dir()
 
@@ -110,7 +111,8 @@ class Supervisor:
         """What the server is doing right now: reading the prompt (with a fraction) or
         generating. Lets the TUI show 'reading context 40%' instead of a bare spinner."""
         try:
-            with urllib.request.urlopen(f"http://127.0.0.1:{self.port}/slots", timeout=1) as r:
+            req = urllib.request.Request(f"http://127.0.0.1:{self.port}/slots", headers=server_headers())
+            with urllib.request.urlopen(req, timeout=1) as r:
                 slots = json.loads(r.read().decode())
         except Exception:  # noqa: BLE001
             return {"phase": "unknown"}
@@ -308,7 +310,8 @@ class Supervisor:
         """The context the server really gives each request. With --parallel N the
         flag's --ctx-size is split N ways; /props reports the per-slot figure."""
         try:
-            with urllib.request.urlopen(f"http://127.0.0.1:{self.port}/props", timeout=3) as r:
+            req = urllib.request.Request(f"http://127.0.0.1:{self.port}/props", headers=server_headers())
+            with urllib.request.urlopen(req, timeout=3) as r:
                 props = json.loads(r.read().decode())
             n_ctx = int((props.get("default_generation_settings") or {}).get("n_ctx") or 0)
             slots = int(props.get("total_slots") or 0)
@@ -446,6 +449,18 @@ class Supervisor:
         g = next((g for g in MODEL_GROUPS if g.key == key), None)
         if g is None:
             return {"error": f"unknown group {key}"}
+        # The filename names a file under models_dir and a path in the download
+        # URL, so it must be exactly one the group's listing offers: no
+        # separators, no dot segments, nothing the catalogue did not list.
+        if not _safe_filename(filename):
+            return {"error": "invalid filename"}
+        if not (self.models_dir / filename).is_file():   # installed files work offline
+            try:
+                listed = {q.filename for q in fetch_quants(g.hf_repo)}
+            except Exception as e:  # noqa: BLE001
+                return {"error": f"could not list {g.hf_repo}: {e}"}
+            if filename not in listed:
+                return {"error": f"{filename} is not a file of {g.hf_repo}"}
         if not self.lock.acquire(blocking=False):
             return {"error": "a model switch is already in progress"}
         alias = _alias(filename)
@@ -742,6 +757,11 @@ with wave.open(path, 'wb') as w:
         return dict(self.models_dir_info(), ok=True)
 
 
+def _safe_filename(name: str) -> bool:
+    return bool(name) and name.endswith(".gguf") and "/" not in name and "\\" not in name \
+        and ".." not in name and not name.startswith(".") and name == name.strip() and "\x00" not in name
+
+
 def make_handler(sup: Supervisor):
     class H(BaseHTTPRequestHandler):
         def log_message(self, *a):  # quiet
@@ -756,7 +776,14 @@ def make_handler(sup: Supervisor):
             self.end_headers()
             self.wfile.write(body)
 
+        def _refuse(self, why: str) -> None:
+            log(f"control: refused {self.command} {self.path}: {why}")
+            self._json({"error": why}, 403)
+
         def do_GET(self):
+            why = request_allowed(self.headers, sup.control_token, sup.control_port)
+            if why:
+                return self._refuse(why)
             u = urlparse(self.path)
             if u.path == "/catalog":
                 return self._json(sup.catalog())
@@ -776,6 +803,9 @@ def make_handler(sup: Supervisor):
             self._json({"error": "not found"}, 404)
 
         def do_POST(self):
+            why = request_allowed(self.headers, sup.control_token, sup.control_port, want_json=True)
+            if why:
+                return self._refuse(why)
             u = urlparse(self.path)
             n = int(self.headers.get("Content-Length") or 0)
             try:
@@ -841,6 +871,13 @@ def main() -> int:
         return 1
     sup = Supervisor(a.server, a.port, Path(a.models_dir), 0)
     sup.lease_fd = lease.fileno()
+    # Session secrets: from the launcher's environment, else fresh. Written
+    # owner-only into the run dir for a second `localcode` and dev tooling.
+    sup.control_port = a.control_port
+    sup.control_token = control_token() or new_secret()
+    if not server_key():
+        os.environ[KEY_ENV] = new_secret()
+    write_auth_file(HERE, sup.control_token, server_key())
     httpd = ThreadingHTTPServer(("127.0.0.1", a.control_port), make_handler(sup))
     threading.Thread(target=httpd.serve_forever, daemon=True).start()
 

{localcode-0.4.10 → localcode-0.5.1}/src/localcode/ui/warmup.py

@@ -185,15 +185,18 @@ def forget(alias: str) -> None:
 # ---- server I/O --------------------------------------------------------------
 
 def _post(port: int, path: str, body: dict, timeout: float) -> dict:
+    from localcode.ui.auth import server_headers
     req = urllib.request.Request(f"http://127.0.0.1:{port}{path}", data=json.dumps(body).encode(),
-                                 headers={"Content-Type": "application/json"})
+                                 headers={"Content-Type": "application/json", **server_headers()})
     with urllib.request.urlopen(req, timeout=timeout) as r:
         return json.loads(r.read().decode())
 
 
 def slots(port: int) -> list[dict] | None:
     try:
-        with urllib.request.urlopen(f"http://127.0.0.1:{port}/slots", timeout=2) as r:
+        from localcode.ui.auth import server_headers
+        req = urllib.request.Request(f"http://127.0.0.1:{port}/slots", headers=server_headers())
+        with urllib.request.urlopen(req, timeout=2) as r:
             data = json.loads(r.read().decode())
         return data if isinstance(data, list) else None
     except Exception:  # noqa: BLE001
@@ -216,7 +219,8 @@ class Replay:
 
     def run(self, tokens: list[int]) -> dict:
         body = json.dumps({"prompt": tokens, "n_predict": 1, "cache_prompt": True, "temperature": 0})
-        self.conn.request("POST", "/completion", body=body, headers={"Content-Type": "application/json"})
+        from localcode.ui.auth import server_headers
+        self.conn.request("POST", "/completion", body=body, headers={"Content-Type": "application/json", **server_headers()})
         r = json.loads(self.conn.getresponse().read().decode())
         return r.get("timings") or {}
 

{localcode-0.4.10 → localcode-0.5.1/src/localcode.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localcode
-Version: 0.4.10
+Version: 0.5.1
 Summary: High-performance AI coding on consumer hardware.
 Author: LocalCode contributors
 License-Expression: Apache-2.0
@@ -25,18 +25,10 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: certifi>=2024.0.0
-Requires-Dist: ddgs>=9.0.0
 Requires-Dist: hf_xet>=1.1.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: huggingface_hub>=1.0.0
-Requires-Dist: jedi>=0.19.0
-Requires-Dist: mcp>=1.28.0
-Requires-Dist: prompt_toolkit>=3.0.52
 Requires-Dist: rich>=13.7.1
-Requires-Dist: scikit-learn>=1.3.0
-Requires-Dist: textual>=8.2.4
-Requires-Dist: tree-sitter>=0.23.0
-Requires-Dist: tree-sitter-language-pack>=1.0.0
 Requires-Dist: tomli>=2.0.0; python_version < "3.11"
 Requires-Dist: pywhispercpp>=1.2.0; sys_platform == "darwin"
 Requires-Dist: sounddevice>=0.4.6; sys_platform == "darwin"