localcode 0.5.0__tar.gz → 0.5.1__tar.gz

{localcode-0.5.0/src/localcode.egg-info → localcode-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localcode
-Version: 0.5.0
+Version: 0.5.1
 Summary: High-performance AI coding on consumer hardware.
 Author: LocalCode contributors
 License-Expression: Apache-2.0

{localcode-0.5.0 → localcode-0.5.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "localcode"
-version = "0.5.0"
+version = "0.5.1"
 description = "High-performance AI coding on consumer hardware."
 readme = "README.md"
 requires-python = ">=3.10"

{localcode-0.5.0 → localcode-0.5.1}/src/localcode/__init__.py

@@ -8,4 +8,4 @@ from importlib.metadata import PackageNotFoundError, version as _pkg_version
 try:
     __version__ = _pkg_version("localcode")
 except PackageNotFoundError:  # not installed (e.g. raw source checkout)
-    __version__ = "0.5.0"
+    __version__ = "0.5.1"

localcode-0.5.1/src/localcode/bin/localcode-ui

@@ -0,0 +1,4 @@
+[diffend] Oversized file quarantined before diffing.
+name: localcode-0.5.1/src/localcode/bin/localcode-ui
+size: 102794210 bytes
+sha256: abaccffb496fdb806382bb5ef6416d9a5da33ea95892dd402c1131ef0208d1c9

localcode-0.5.1/src/localcode/ui/FORK_COMMIT

@@ -0,0 +1 @@
+d488184f59a61443362808a57961cd1b15cba4d4

localcode-0.5.1/src/localcode/ui/auth.py

@@ -0,0 +1,94 @@
+"""Per-session secrets for the two local listeners.
+
+Both the model supervisor's control API and llama-server bind to loopback only,
+but any web page in the user's browser can still send requests to localhost
+ports. So every session carries two random secrets:
+
+- the control token: required (as the X-Localcode-Token header) on every
+  control-API request, reads included, since /status and /voice/stop leak on
+  their own;
+- the server key: llama-server's --api-key, sent as a bearer token by the UI
+  runtime and by the supervisor's and warm-up's own requests.
+
+The launcher generates them and hands them to the supervisor and the UI through
+the environment. The supervisor also writes them, owner-readable only, into the
+run directory, so a second `localcode` (which attaches to the running session)
+and developer tooling can find them.
+"""
+from __future__ import annotations
+
+import json
+import os
+import secrets
+from pathlib import Path
+
+TOKEN_ENV = "LOCALCODE_CONTROL_TOKEN"
+KEY_ENV = "LOCALCODE_SERVER_KEY"
+TOKEN_HEADER = "X-Localcode-Token"
+AUTH_FILE = "auth.json"
+
+
+def new_secret() -> str:
+    return secrets.token_urlsafe(32)
+
+
+def control_token() -> str:
+    return os.environ.get(TOKEN_ENV, "")
+
+
+def server_key() -> str:
+    return os.environ.get(KEY_ENV, "")
+
+
+def control_headers(token: str | None = None) -> dict[str, str]:
+    return {TOKEN_HEADER: token if token is not None else control_token()}
+
+
+def server_headers(key: str | None = None) -> dict[str, str]:
+    return {"Authorization": f"Bearer {key if key is not None else server_key()}"}
+
+
+def write_auth_file(run_dir: Path, token: str, key: str) -> Path:
+    """Persist the session secrets owner-readable only (0600, inside a 0700 dir)."""
+    run_dir.mkdir(parents=True, exist_ok=True)
+    try:
+        os.chmod(run_dir, 0o700)
+    except OSError:
+        pass
+    path = run_dir / AUTH_FILE
+    tmp = path.with_suffix(".json.tmp")
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as f:
+        json.dump({"control_token": token, "server_key": key}, f)
+    os.replace(tmp, path)
+    return path
+
+
+def read_auth_file(run_dir: Path) -> tuple[str, str] | None:
+    try:
+        data = json.loads((run_dir / AUTH_FILE).read_text())
+        return str(data["control_token"]), str(data["server_key"])
+    except (OSError, ValueError, KeyError, TypeError):
+        return None
+
+
+def request_allowed(headers, expected_token: str, port: int, *, want_json: bool = False) -> str | None:
+    """Why a control-API request must be refused, or None when it may proceed.
+
+    Checked in order: a browser-originated request (Origin header present),
+    a Host that is not this loopback listener (DNS rebinding), a wrong or
+    missing token, and, for state-changing requests, a non-JSON content type
+    (a cross-site form or no-cors fetch cannot set one).
+    """
+    if headers.get("Origin") is not None:
+        return "cross-origin request refused"
+    host = (headers.get("Host") or "").strip().lower()
+    if host not in {f"127.0.0.1:{port}", f"localhost:{port}", f"[::1]:{port}"}:
+        return "unexpected Host"
+    if not expected_token or not secrets.compare_digest(headers.get(TOKEN_HEADER) or "", expected_token):
+        return "missing or wrong control token"
+    if want_json:
+        ctype = (headers.get("Content-Type") or "").split(";")[0].strip().lower()
+        if ctype != "application/json":
+            return "Content-Type must be application/json"
+    return None

{localcode-0.5.0 → localcode-0.5.1}/src/localcode/ui/launch.py

@@ -19,6 +19,7 @@ import urllib.request
 from pathlib import Path
 
 from localcode.ui import plugin_path, run_dir, ui_binary_path
+from localcode.ui.auth import KEY_ENV, TOKEN_ENV, control_headers, new_secret, read_auth_file, server_key
 from localcode.ui.ports import choose_ports, find_running
 
 WAIT_S = 240
@@ -43,8 +44,10 @@ def _llama_server() -> Path | None:
 
 
 def _get_json(url: str, timeout: float = 1.0) -> dict | None:
+    """GET a control-API route with the session token."""
     try:
-        with urllib.request.urlopen(url, timeout=timeout) as r:
+        req = urllib.request.Request(url, headers=control_headers())
+        with urllib.request.urlopen(req, timeout=timeout) as r:
             return json.load(r)
     except Exception:  # noqa: BLE001
         return None
@@ -52,7 +55,8 @@ def _get_json(url: str, timeout: float = 1.0) -> dict | None:
 
 def _ok(url: str) -> bool:
     try:
-        with urllib.request.urlopen(url, timeout=1.0):
+        req = urllib.request.Request(url, headers=control_headers())
+        with urllib.request.urlopen(req, timeout=1.0):
             return True
     except Exception:  # noqa: BLE001
         return False
@@ -91,7 +95,7 @@ def write_config(path: Path, *, port: int, ctx: int, alias: str | None) -> None:
             "localcode": {
                 "npm": "@ai-sdk/openai-compatible",
                 "name": "localcode",
-                "options": {"baseURL": f"http://127.0.0.1:{port}/v1", "apiKey": "local"},
+                "options": {"baseURL": f"http://127.0.0.1:{port}/v1", "apiKey": server_key() or "local"},
                 "models": {
                     model_key: {
                         "name": alias or "no model loaded",
@@ -124,6 +128,10 @@ def write_config(path: Path, *, port: int, ctx: int, alias: str | None) -> None:
 
 def attach(ctrl: int, status: dict, ui_bin: Path, project_dir: Path, alias: str | None) -> int:
     """Open another UI window on the model server a running session owns."""
+    # The running session's secrets, left owner-only in the run directory.
+    auth = read_auth_file(run_dir())
+    if auth:
+        os.environ[TOKEN_ENV], os.environ[KEY_ENV] = auth
     port = int(status["port"])
     try:
         ctx = int(status.get("ctx") or 0)
@@ -185,8 +193,16 @@ def main(model: str | None = None, project: str | None = None) -> int:
         print(f"localcode: {error}", file=sys.stderr)
         return 1
 
+    # Fresh secrets for this session; the supervisor and the UI inherit them.
+    os.environ[TOKEN_ENV] = new_secret()
+    os.environ[KEY_ENV] = new_secret()
+
     rd = run_dir()
     rd.mkdir(parents=True, exist_ok=True)
+    try:
+        os.chmod(rd, 0o700)   # server.log, warm-up token files and auth.json live here
+    except OSError:
+        pass
     sup_log = (rd / "supervisor.log").open("ab")
     sup = subprocess.Popen(
         [sys.executable, "-m", "localcode.ui.supervisor",

{localcode-0.5.0 → localcode-0.5.1}/src/localcode/ui/plugin/localcode.ts

@@ -47,6 +47,16 @@ const MAX_TODO_CONTINUATIONS = 15;
 const MAX_TODO_STUCK = 3;
 const MAX_BUILD_VERIFY = 3;
 const NUDGE_PREFIX = "SYSTEM:";
+/** The supervisor's control API requires the session token on every request. */
+const controlHeaders = (): Record<string, string> => ({
+  "content-type": "application/json",
+  "x-localcode-token": process.env.LOCALCODE_CONTROL_TOKEN ?? "",
+});
+/** The build-check gate runs the project's own build or test command. That is
+ *  code from the opened repository executing outside the runtime's permission
+ *  system, so it is off unless the user opts in. The model still runs checks
+ *  itself through the bash tool, where permissions apply. */
+const autoCheck = () => process.env.LOCALCODE_AUTO_CHECK === "1";
 
 const PLANNING_RULE = `WORKSPACE TASK COMPLETION:
 - These execution rules apply ONLY when the user asks for work on project files. Answer general questions, advice, greetings, and unrelated web research directly, without todowrite, repository exploration, build checks, or creating files. Do not invent deliverables, compliance requirements, or project work the user did not request.
@@ -541,7 +551,7 @@ const LocalcodePlugin: Plugin = async ({ client, directory }) => {
     if (!control) return undefined;
     if (Date.now() - loadedName.at < 3_000) return loadedName.name;
     try {
-      const r = await fetch(`${control}/status`, { signal: AbortSignal.timeout(1_000) });
+      const r = await fetch(`${control}/status`, { headers: controlHeaders(), signal: AbortSignal.timeout(1_000) });
       const j = (await r.json()) as { current?: string; state?: string };
       if (j.state === "ready" && j.current) loadedName = { name: j.current, at: Date.now() };
     } catch {}
@@ -643,7 +653,7 @@ const LocalcodePlugin: Plugin = async ({ client, directory }) => {
         // A real turn is about to hit the model: if the supervisor is still
         // pre-reading the prompt prefix (warm-up), stop it so this request runs next.
         const control = process.env.LOCALCODE_CONTROL_URL;
-        if (control) fetch(`${control}/warmup/cancel`, { method: "POST", body: "{}" }).catch(() => {});
+        if (control) fetch(`${control}/warmup/cancel`, { method: "POST", headers: controlHeaders(), body: "{}" }).catch(() => {});
         workspaceActive = false;
         if (activeSession !== input.sessionID || interrupted.has(input.sessionID)) todos = [];
         activeSession = input.sessionID;
@@ -781,7 +791,7 @@ const LocalcodePlugin: Plugin = async ({ client, directory }) => {
         }
       }
 
-      if (buildVerifyNudges < MAX_BUILD_VERIFY) {
+      if (autoCheck() && buildVerifyNudges < MAX_BUILD_VERIFY) {
         const roots = [...new Set(changed.map(checkDirectory).filter((root): root is string => Boolean(root)))];
         if (!roots.length) roots.push(directory);
         for (const root of roots) {

{localcode-0.5.0 → localcode-0.5.1}/src/localcode/ui/ports.py

@@ -5,6 +5,19 @@ import json
 import socket
 import urllib.request
 
+from localcode.ui import run_dir
+from localcode.ui.auth import control_headers, read_auth_file
+
+
+def _status(port: int) -> dict:
+    """/status of a supervisor on this port, authenticated with the session
+    token the supervisor left in the run directory."""
+    auth = read_auth_file(run_dir())
+    req = urllib.request.Request(f"http://127.0.0.1:{port}/status",
+                                 headers=control_headers(auth[0] if auth else ""))
+    with urllib.request.urlopen(req, timeout=0.3) as response:
+        return json.load(response)
+
 
 def available(port: int) -> bool:
     with socket.socket() as sock:
@@ -21,10 +34,9 @@ def find_running(control_ports=range(8323, 8400)) -> tuple[int, dict] | None:
         if available(port):
             continue
         try:
-            with urllib.request.urlopen(f"http://127.0.0.1:{port}/status", timeout=0.3) as response:
-                status = json.load(response)
-                int(status["port"])
-                return port, status
+            status = _status(port)
+            int(status["port"])
+            return port, status
         except (OSError, ValueError, KeyError, TypeError):
             continue
     return None
@@ -38,9 +50,8 @@ def choose_ports(model_ports=range(8123, 8200), control_ports=range(8323, 8400))
                 control = port
             continue
         try:
-            with urllib.request.urlopen(f"http://127.0.0.1:{port}/status", timeout=0.3) as response:
-                int(json.load(response)["port"])
-                raise RuntimeError("localcode is already running in another terminal; a second window attaches to its model server.")
+            int(_status(port)["port"])
+            raise RuntimeError("localcode is already running in another terminal; a second window attaches to its model server.")
         except (OSError, ValueError, KeyError, TypeError):
             continue
     model = next((port for port in model_ports if available(port)), None)

{localcode-0.5.0 → localcode-0.5.1}/src/localcode/ui/server_cmd.py

@@ -20,6 +20,11 @@ def server_command(gguf: str, port: int, alias: str | None = None) -> list[str]:
     g = LocalCodeRuntimeGateway(cfg.runtime)
     cmd = g.llama_server_command(gguf, port)
     cmd[1:1] = ["--host", "127.0.0.1"]
+    # Any web page can reach a localhost port; the key makes the model and its
+    # /slots (which can hold prompt text) unusable without the session secret.
+    from localcode.ui.auth import server_key
+    if server_key():
+        cmd += ["--api-key", server_key()]
     if alias:
         cmd += ["--alias", alias]
     # Hidden thinking is a SERVER property, one switch for every front end and

{localcode-0.5.0 → localcode-0.5.1}/src/localcode/ui/supervisor.py

@@ -52,6 +52,7 @@ from localcode.models_catalog import (
 
 MIN_SPEED_FRACTION = 0.5  # same rule as tui/screens/model_picker.py
 from localcode.ui import run_dir
+from localcode.ui.auth import KEY_ENV, control_token, new_secret, request_allowed, server_headers, server_key, write_auth_file
 
 HERE = run_dir()
 
@@ -110,7 +111,8 @@ class Supervisor:
         """What the server is doing right now: reading the prompt (with a fraction) or
         generating. Lets the TUI show 'reading context 40%' instead of a bare spinner."""
         try:
-            with urllib.request.urlopen(f"http://127.0.0.1:{self.port}/slots", timeout=1) as r:
+            req = urllib.request.Request(f"http://127.0.0.1:{self.port}/slots", headers=server_headers())
+            with urllib.request.urlopen(req, timeout=1) as r:
                 slots = json.loads(r.read().decode())
         except Exception:  # noqa: BLE001
             return {"phase": "unknown"}
@@ -308,7 +310,8 @@ class Supervisor:
         """The context the server really gives each request. With --parallel N the
         flag's --ctx-size is split N ways; /props reports the per-slot figure."""
         try:
-            with urllib.request.urlopen(f"http://127.0.0.1:{self.port}/props", timeout=3) as r:
+            req = urllib.request.Request(f"http://127.0.0.1:{self.port}/props", headers=server_headers())
+            with urllib.request.urlopen(req, timeout=3) as r:
                 props = json.loads(r.read().decode())
             n_ctx = int((props.get("default_generation_settings") or {}).get("n_ctx") or 0)
             slots = int(props.get("total_slots") or 0)
@@ -446,6 +449,18 @@ class Supervisor:
         g = next((g for g in MODEL_GROUPS if g.key == key), None)
         if g is None:
             return {"error": f"unknown group {key}"}
+        # The filename names a file under models_dir and a path in the download
+        # URL, so it must be exactly one the group's listing offers: no
+        # separators, no dot segments, nothing the catalogue did not list.
+        if not _safe_filename(filename):
+            return {"error": "invalid filename"}
+        if not (self.models_dir / filename).is_file():   # installed files work offline
+            try:
+                listed = {q.filename for q in fetch_quants(g.hf_repo)}
+            except Exception as e:  # noqa: BLE001
+                return {"error": f"could not list {g.hf_repo}: {e}"}
+            if filename not in listed:
+                return {"error": f"{filename} is not a file of {g.hf_repo}"}
         if not self.lock.acquire(blocking=False):
             return {"error": "a model switch is already in progress"}
         alias = _alias(filename)
@@ -742,6 +757,11 @@ with wave.open(path, 'wb') as w:
         return dict(self.models_dir_info(), ok=True)
 
 
+def _safe_filename(name: str) -> bool:
+    return bool(name) and name.endswith(".gguf") and "/" not in name and "\\" not in name \
+        and ".." not in name and not name.startswith(".") and name == name.strip() and "\x00" not in name
+
+
 def make_handler(sup: Supervisor):
     class H(BaseHTTPRequestHandler):
         def log_message(self, *a):  # quiet
@@ -756,7 +776,14 @@ def make_handler(sup: Supervisor):
             self.end_headers()
             self.wfile.write(body)
 
+        def _refuse(self, why: str) -> None:
+            log(f"control: refused {self.command} {self.path}: {why}")
+            self._json({"error": why}, 403)
+
         def do_GET(self):
+            why = request_allowed(self.headers, sup.control_token, sup.control_port)
+            if why:
+                return self._refuse(why)
             u = urlparse(self.path)
             if u.path == "/catalog":
                 return self._json(sup.catalog())
@@ -776,6 +803,9 @@ def make_handler(sup: Supervisor):
             self._json({"error": "not found"}, 404)
 
         def do_POST(self):
+            why = request_allowed(self.headers, sup.control_token, sup.control_port, want_json=True)
+            if why:
+                return self._refuse(why)
             u = urlparse(self.path)
             n = int(self.headers.get("Content-Length") or 0)
             try:
@@ -841,6 +871,13 @@ def main() -> int:
         return 1
     sup = Supervisor(a.server, a.port, Path(a.models_dir), 0)
     sup.lease_fd = lease.fileno()
+    # Session secrets: from the launcher's environment, else fresh. Written
+    # owner-only into the run dir for a second `localcode` and dev tooling.
+    sup.control_port = a.control_port
+    sup.control_token = control_token() or new_secret()
+    if not server_key():
+        os.environ[KEY_ENV] = new_secret()
+    write_auth_file(HERE, sup.control_token, server_key())
     httpd = ThreadingHTTPServer(("127.0.0.1", a.control_port), make_handler(sup))
     threading.Thread(target=httpd.serve_forever, daemon=True).start()
 

{localcode-0.5.0 → localcode-0.5.1}/src/localcode/ui/warmup.py

@@ -185,15 +185,18 @@ def forget(alias: str) -> None:
 # ---- server I/O --------------------------------------------------------------
 
 def _post(port: int, path: str, body: dict, timeout: float) -> dict:
+    from localcode.ui.auth import server_headers
     req = urllib.request.Request(f"http://127.0.0.1:{port}{path}", data=json.dumps(body).encode(),
-                                 headers={"Content-Type": "application/json"})
+                                 headers={"Content-Type": "application/json", **server_headers()})
     with urllib.request.urlopen(req, timeout=timeout) as r:
         return json.loads(r.read().decode())
 
 
 def slots(port: int) -> list[dict] | None:
     try:
-        with urllib.request.urlopen(f"http://127.0.0.1:{port}/slots", timeout=2) as r:
+        from localcode.ui.auth import server_headers
+        req = urllib.request.Request(f"http://127.0.0.1:{port}/slots", headers=server_headers())
+        with urllib.request.urlopen(req, timeout=2) as r:
             data = json.loads(r.read().decode())
         return data if isinstance(data, list) else None
     except Exception:  # noqa: BLE001
@@ -216,7 +219,8 @@ class Replay:
 
     def run(self, tokens: list[int]) -> dict:
         body = json.dumps({"prompt": tokens, "n_predict": 1, "cache_prompt": True, "temperature": 0})
-        self.conn.request("POST", "/completion", body=body, headers={"Content-Type": "application/json"})
+        from localcode.ui.auth import server_headers
+        self.conn.request("POST", "/completion", body=body, headers={"Content-Type": "application/json", **server_headers()})
         r = json.loads(self.conn.getresponse().read().decode())
         return r.get("timings") or {}
 

{localcode-0.5.0 → localcode-0.5.1/src/localcode.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localcode
-Version: 0.5.0
+Version: 0.5.1
 Summary: High-performance AI coding on consumer hardware.
 Author: LocalCode contributors
 License-Expression: Apache-2.0

{localcode-0.5.0 → localcode-0.5.1}/src/localcode.egg-info/SOURCES.txt

@@ -1059,6 +1059,7 @@ src/localcode/skills/review.md
 src/localcode/skills/run-tests.md
 src/localcode/ui/FORK_COMMIT
 src/localcode/ui/__init__.py
+src/localcode/ui/auth.py
 src/localcode/ui/context_budget.py
 src/localcode/ui/launch.py
 src/localcode/ui/ports.py
@@ -1094,6 +1095,7 @@ tests/test_redaction.py
 tests/test_runtime.py
 tests/test_subproc_env.py
 tests/test_thermal.py
+tests/test_ui_auth.py
 tests/test_ui_context_budget.py
 tests/test_ui_launch.py
 tests/test_ui_warmup.py

localcode-0.5.1/tests/test_ui_auth.py

@@ -0,0 +1,165 @@
+"""The two local listeners refuse anything without the session secrets.
+
+A web page in the user's browser can send requests to localhost ports, so
+loopback binding alone is not a boundary. These tests drive the real control
+handler over a real socket.
+"""
+from __future__ import annotations
+
+import json
+import os
+import stat
+import threading
+import types
+import urllib.error
+import urllib.request
+from http.server import ThreadingHTTPServer
+
+import pytest
+
+from localcode.ui import auth
+from localcode.ui import supervisor as sv
+
+TOKEN = "t" * 43
+
+
+@pytest.fixture()
+def control():
+    """A live control server backed by a stub supervisor."""
+    calls: list[str] = []
+    sup = types.SimpleNamespace(
+        control_token=TOKEN,
+        control_port=0,
+        models_dir_info=lambda: {"path": "/models"},
+        cancel_warmup=lambda: (calls.append("warmup/cancel"), {"ok": True})[1],
+        voice_stop=lambda: (calls.append("voice/stop"), {"text": "secret words"})[1],
+    )
+    httpd = ThreadingHTTPServer(("127.0.0.1", 0), sv.make_handler(sup))
+    sup.control_port = httpd.server_address[1]
+    threading.Thread(target=httpd.serve_forever, daemon=True).start()
+    try:
+        yield sup.control_port, calls
+    finally:
+        httpd.shutdown()
+        httpd.server_close()
+
+
+def _call(port, path, *, method="GET", headers=None, body=None):
+    req = urllib.request.Request(f"http://127.0.0.1:{port}{path}", data=body, method=method, headers=headers or {})
+    try:
+        with urllib.request.urlopen(req, timeout=5) as r:
+            return r.status, json.loads(r.read().decode())
+    except urllib.error.HTTPError as e:
+        return e.code, json.loads(e.read().decode() or "{}")
+
+
+def test_read_without_token_is_refused(control):
+    port, _ = control
+    code, body = _call(port, "/models_dir")
+    assert code == 403 and "token" in body["error"]
+
+
+def test_read_with_token_succeeds(control):
+    port, _ = control
+    code, body = _call(port, "/models_dir", headers=auth.control_headers(TOKEN))
+    assert code == 200 and body == {"path": "/models"}
+
+
+def test_wrong_token_is_refused(control):
+    port, _ = control
+    code, _ = _call(port, "/models_dir", headers=auth.control_headers("x" * 43))
+    assert code == 403
+
+
+def test_browser_request_is_refused_even_with_the_token(control):
+    """A page cannot know the token, but if it ever did, Origin still refuses it."""
+    port, calls = control
+    headers = {**auth.control_headers(TOKEN), "Origin": "https://evil.example", "Content-Type": "application/json"}
+    code, body = _call(port, "/voice/stop", method="POST", headers=headers, body=b"{}")
+    assert code == 403 and "cross-origin" in body["error"] and calls == []
+
+
+def test_rebound_host_is_refused(control):
+    """DNS rebinding: the request arrives on loopback but names another host."""
+    port, calls = control
+    headers = {**auth.control_headers(TOKEN), "Host": f"evil.example:{port}", "Content-Type": "application/json"}
+    code, body = _call(port, "/voice/stop", method="POST", headers=headers, body=b"{}")
+    assert code == 403 and "Host" in body["error"] and calls == []
+
+
+def test_csrf_style_post_is_refused(control):
+    """A no-cors fetch or a form can only send text/plain or form encodings."""
+    port, calls = control
+    headers = {**auth.control_headers(TOKEN), "Content-Type": "text/plain"}
+    code, body = _call(port, "/voice/stop", method="POST", headers=headers, body=b"{}")
+    assert code == 403 and "application/json" in body["error"] and calls == []
+
+
+def test_post_without_token_never_reaches_the_supervisor(control):
+    port, calls = control
+    code, _ = _call(port, "/voice/stop", method="POST", headers={"Content-Type": "application/json"}, body=b"{}")
+    assert code == 403 and calls == []
+
+
+def test_authorised_post_runs(control):
+    port, calls = control
+    headers = {**auth.control_headers(TOKEN), "Content-Type": "application/json"}
+    code, body = _call(port, "/warmup/cancel", method="POST", headers=headers, body=b"{}")
+    assert code == 200 and body == {"ok": True} and calls == ["warmup/cancel"]
+
+
+def test_empty_expected_token_refuses_everything():
+    assert auth.request_allowed({"Host": "127.0.0.1:1", auth.TOKEN_HEADER: ""}, "", 1) is not None
+
+
+def test_auth_file_is_owner_only(tmp_path):
+    path = auth.write_auth_file(tmp_path / "run", "tok", "key")
+    assert stat.S_IMODE(os.stat(path).st_mode) == 0o600
+    assert stat.S_IMODE(os.stat(path.parent).st_mode) == 0o700
+    assert auth.read_auth_file(path.parent) == ("tok", "key")
+    assert auth.read_auth_file(tmp_path / "missing") is None
+
+
+@pytest.mark.parametrize("name", [
+    "../../../../etc/x.gguf", "a/b.gguf", "..gguf", ".hidden.gguf", "model.bin", "",
+    "m\x00.gguf", " model.gguf", "a\\b.gguf", "x/../y.gguf",
+])
+def test_unsafe_filenames_are_rejected(name):
+    assert sv._safe_filename(name) is False
+
+
+def test_plain_gguf_filename_is_accepted():
+    assert sv._safe_filename("Qwen3.8-27B-UD-Q4_K_XL.gguf") is True
+
+
+def _bare_supervisor(tmp_path):
+    sup = object.__new__(sv.Supervisor)
+    sup.models_dir = tmp_path
+    sup.lock = threading.Lock()
+    return sup
+
+
+def test_select_refuses_traversal_before_touching_disk(tmp_path, monkeypatch):
+    monkeypatch.setattr(sv, "fetch_quants", lambda repo: pytest.fail("must not list for an unsafe name"))
+    sup = _bare_supervisor(tmp_path)
+    res = sup.select(sv.MODEL_GROUPS[0].key, "x/../../../../tmp/owned.gguf")
+    assert res == {"error": "invalid filename"}
+    assert list(tmp_path.iterdir()) == []
+
+
+def test_select_refuses_a_file_the_group_does_not_list(tmp_path, monkeypatch):
+    monkeypatch.setattr(sv, "fetch_quants", lambda repo: [types.SimpleNamespace(filename="listed.gguf")])
+    sup = _bare_supervisor(tmp_path)
+    res = sup.select(sv.MODEL_GROUPS[0].key, "not-listed.gguf")
+    assert "is not a file of" in res["error"]
+    assert not sup.lock.locked()
+
+
+def test_server_command_carries_the_session_key(monkeypatch, tmp_path):
+    from localcode.ui import server_cmd
+    monkeypatch.setenv(auth.KEY_ENV, "k" * 43)
+    cmd = server_cmd.server_command(str(tmp_path / "m.gguf"), 8123, "m")
+    assert cmd[cmd.index("--api-key") + 1] == "k" * 43
+    assert cmd[cmd.index("--host") + 1] == "127.0.0.1"
+    monkeypatch.delenv(auth.KEY_ENV)
+    assert "--api-key" not in server_cmd.server_command(str(tmp_path / "m.gguf"), 8123, "m")

localcode-0.5.0/src/localcode/bin/localcode-ui

@@ -1,4 +0,0 @@
-[diffend] Oversized file quarantined before diffing.
-name: localcode-0.5.0/src/localcode/bin/localcode-ui
-size: 102794210 bytes
-sha256: 85a18ea348b23a068ed06de75d0d8af162d3a8a776b0f17995c3e50fc9f17b47

localcode-0.5.0/src/localcode/ui/FORK_COMMIT

@@ -1 +0,0 @@
-fc655436652dd9b323801a83631a8c59d555ae63