[{"data":1,"prerenderedAt":1266},["ShallowReactive",2],{"docs-nav":3,"docs-\u002Fdocs\u002Finstallation":78},[4,9,13,16,21,26,30,34,38,42,46,50,53,58,62,66,69,74],{"path":5,"title":6,"navTitle":6,"group":7,"order":8},"\u002Fdocs\u002Fcommands","Other commands","Guide",999,{"path":10,"title":11,"navTitle":12,"group":7,"order":8},"\u002Fdocs\u002Fcompaction","Context and compaction","Context & compaction",{"path":14,"title":15,"navTitle":15,"group":7,"order":8},"\u002Fdocs\u002Fconfiguration","Configuration",{"path":17,"title":18,"navTitle":18,"group":19,"order":20},"\u002Fdocs\u002Fenvironment","Environment variables","Reference",11,{"path":22,"title":23,"navTitle":23,"group":24,"order":25},"\u002Fdocs\u002Fflags","Flag reference","CLI",8,{"path":27,"title":28,"navTitle":28,"group":7,"order":29},"\u002Fdocs","Introduction",1,{"path":31,"title":32,"navTitle":32,"group":7,"order":33},"\u002Fdocs\u002Finstallation","Installation",2,{"path":35,"title":36,"navTitle":36,"group":19,"order":37},"\u002Fdocs\u002Fproviders","Providers",10,{"path":39,"title":40,"navTitle":40,"group":7,"order":41},"\u002Fdocs\u002Fquickstart","Quickstart",3,{"path":43,"title":44,"navTitle":45,"group":7,"order":8},"\u002Fdocs\u002Freleases","Releases and upgrading","Releases",{"path":47,"title":48,"navTitle":49,"group":7,"order":8},"\u002Fdocs\u002Frun","The run command","Running an audit",{"path":51,"title":52,"navTitle":52,"group":7,"order":8},"\u002Fdocs\u002Fsecurity","Security model",{"path":54,"title":55,"navTitle":56,"group":24,"order":57},"\u002Fdocs\u002Fsessions","Sessions and forking","Sessions",6,{"path":59,"title":60,"navTitle":61,"group":7,"order":8},"\u002Fdocs\u002Fskills-roles","Skills and roles","Skills & roles",{"path":63,"title":64,"navTitle":64,"group":19,"order":65},"\u002Fdocs\u002Ftools","Tool reference",12,{"path":67,"title":68,"navTitle":68,"group":7,"order":8},"\u002Fdocs\u002Ftroubleshooting","Troubleshooting",{"path":70,"title":71,"navTitle":72,"group":24,"order":73},"\u002Fdocs\u002Ftui","The interactive TUI","Interactive TUI",9,{"path":75,"title":76,"navTitle":77,"group":7,"order":8},"\u002Fdocs\u002Fweb-eval","Dashboard and evaluation","Dashboard & evaluation",{"id":79,"title":32,"body":80,"description":1259,"extension":1260,"group":7,"meta":1261,"navTitle":32,"navigation":1262,"order":33,"path":31,"seo":1263,"stem":1264,"__hash__":1265},"docs\u002Fdocs\u002Finstallation.md",{"type":81,"value":82,"toc":1246},"minimark",[83,87,96,117,122,154,186,205,208,264,275,362,380,391,420,424,437,481,495,529,544,549,552,601,615,619,631,639,653,720,733,744,748,751,754,783,786,819,822,920,930,934,948,969,992,1001,1006,1022,1029,1032,1035,1041,1070,1093,1103,1107,1110,1148,1154,1158,1232,1236,1242],[84,85,32],"h1",{"id":86},"installation",[88,89,90,91,95],"p",{},"locac is a ",[92,93,94],"strong",{},"single self-contained executable",". Take it from a release, or build your own: either\nway you end up with one file and no sibling data directories.",[88,97,98,99,103,104,111,112,116],{},"A bash-compatible shell is required on every host. Tool execution and the OS sandbox run commands\nthrough it, and locac never falls back to ",[100,101,102],"code",{},"cmd.exe"," or PowerShell for that. macOS and Linux have one\nalready; on Windows install ",[105,106,110],"a",{"href":107,"rel":108},"https:\u002F\u002Fgit-scm.com\u002Fdownload\u002Fwin",[109],"nofollow","Git for Windows"," and see\n",[105,113,115],{"href":114},"#windows-notes","Windows notes",".",[118,119,121],"h2",{"id":120},"install-a-release","Install a release",[123,124,129],"pre",{"className":125,"code":126,"language":127,"meta":128,"style":128},"language-bash shiki shiki-themes vitesse-dark","curl -fsSL https:\u002F\u002Flocac.dev\u002Finstall.sh | sh\n","bash","",[100,130,131],{"__ignoreMap":128},[132,133,135,139,143,147,151],"span",{"class":134,"line":29},"line",[132,136,138],{"class":137},"sCK9x","curl",[132,140,142],{"class":141},"sXjYR"," -fsSL",[132,144,146],{"class":145},"s7rlk"," https:\u002F\u002Flocac.dev\u002Finstall.sh",[132,148,150],{"class":149},"s_wWq"," |",[132,152,153],{"class":137}," sh\n",[123,155,159],{"className":156,"code":157,"language":158,"meta":128,"style":128},"language-powershell shiki shiki-themes vitesse-dark","irm https:\u002F\u002Flocac.dev\u002Finstall.ps1 | iex\n","powershell",[100,160,161],{"__ignoreMap":128},[132,162,163,167,171,174,177,180,183],{"class":134,"line":29},[132,164,166],{"class":165},"sNpkn","irm https:",[132,168,170],{"class":169},"s_pn2","\u002F\u002F",[132,172,173],{"class":165},"locac.dev",[132,175,176],{"class":169},"\u002F",[132,178,179],{"class":165},"install.ps1 ",[132,181,182],{"class":149},"|",[132,184,185],{"class":165}," iex\n",[88,187,188,189,192,193,196,197,199,200,204],{},"Both scripts pick the archive for your OS and architecture, download the release's ",[100,190,191],{},"SHA256SUMS","\nalongside it, and ",[92,194,195],{},"refuse to unpack an archive the checksum file does not vouch for",". A release\nthat publishes no ",[100,198,191],{}," is a hard failure, not a warning: this script is the supply chain,\nand \"probably fine\" is not a verification step. The check runs ",[201,202,203],"em",{},"before"," the archive is extracted,\nbecause extraction is the first moment a download gets to decide what lands on disk. The binary is\nstaged inside the destination directory and renamed into place, so an interrupted download never\nleaves a half-written file at the name you are about to run.",[88,206,207],{},"Neither script edits your shell profile or your PATH. They print the one line you need and stop.",[209,210,211,227],"table",{},[212,213,214],"thead",{},[215,216,217,221,224],"tr",{},[218,219,220],"th",{},"Variable",[218,222,223],{},"Default",[218,225,226],{},"Effect",[228,229,230,249],"tbody",{},[215,231,232,238,243],{},[233,234,235],"td",{},[100,236,237],{},"LOCAC_VERSION",[233,239,240],{},[100,241,242],{},"latest",[233,244,245,246],{},"Pin a release tag, e.g. ",[100,247,248],{},"v0.5.2",[215,250,251,256,261],{},[233,252,253],{},[100,254,255],{},"LOCAC_INSTALL_DIR",[233,257,258],{},[100,259,260],{},"~\u002F.locac\u002Fbin",[233,262,263],{},"Install somewhere else",[88,265,266,267,270,271,274],{},"Assets are compressed - a single-file Bun binary is around 116 MB and about a third of that on the\nwire. Each archive holds exactly one file, ",[100,268,269],{},"locac"," (or ",[100,272,273],{},"locac.exe","), with no target suffix and no\nenclosing directory.",[209,276,277,290],{},[212,278,279],{},[215,280,281,284,287],{},[218,282,283],{},"Platform",[218,285,286],{},"Asset",[218,288,289],{},"Contains",[228,291,292,306,320,334,348],{},[215,293,294,297,302],{},[233,295,296],{},"Linux x64",[233,298,299],{},[100,300,301],{},"locac-linux-x64.tar.gz",[233,303,304],{},[100,305,269],{},[215,307,308,311,316],{},[233,309,310],{},"Linux arm64",[233,312,313],{},[100,314,315],{},"locac-linux-arm64.tar.gz",[233,317,318],{},[100,319,269],{},[215,321,322,325,330],{},[233,323,324],{},"macOS Intel",[233,326,327],{},[100,328,329],{},"locac-darwin-x64.tar.gz",[233,331,332],{},[100,333,269],{},[215,335,336,339,344],{},[233,337,338],{},"macOS Apple silicon",[233,340,341],{},[100,342,343],{},"locac-darwin-arm64.tar.gz",[233,345,346],{},[100,347,269],{},[215,349,350,353,358],{},[233,351,352],{},"Windows x64",[233,354,355],{},[100,356,357],{},"locac-windows-x64.zip",[233,359,360],{},[100,361,273],{},[88,363,364,365,368,369,371,372,375,376,379],{},"The format follows what the destination can already open: ",[100,366,367],{},"tar"," is present on every image that can\nrun ",[100,370,138],{},", while ",[100,373,374],{},"unzip"," is missing from most minimal ones, and Windows opens a ",[100,377,378],{},".zip"," by\ndouble-click with nothing installed.",[88,381,382,383,385,386,390],{},"Bun has no Windows arm64 target, so arm64 Windows machines install the x64 build and run it under\nthe OS emulation layer. To verify a download by hand instead, take the archive and ",[100,384,191],{}," from\n",[105,387,45],{"href":388,"rel":389},"https:\u002F\u002Fgithub.com\u002FLosec-io\u002Flocac\u002Freleases",[109]," and check it yourself:",[123,392,394],{"className":125,"code":393,"language":127,"meta":128,"style":128},"sha256sum -c --ignore-missing SHA256SUMS\ntar -xzf locac-linux-x64.tar.gz\n",[100,395,396,410],{"__ignoreMap":128},[132,397,398,401,404,407],{"class":134,"line":29},[132,399,400],{"class":137},"sha256sum",[132,402,403],{"class":141}," -c",[132,405,406],{"class":141}," --ignore-missing",[132,408,409],{"class":145}," SHA256SUMS\n",[132,411,412,414,417],{"class":134,"line":33},[132,413,367],{"class":137},[132,415,416],{"class":141}," -xzf",[132,418,419],{"class":145}," locac-linux-x64.tar.gz\n",[118,421,423],{"id":422},"build-from-source","Build from source",[88,425,426,427,432,433,436],{},"Requires ",[105,428,431],{"href":429,"rel":430},"https:\u002F\u002Fbun.sh",[109],"Bun"," ",[100,434,435],{},">= 1.3.0"," and Git. Nothing else.",[123,438,440],{"className":125,"code":439,"language":127,"meta":128,"style":128},"git clone https:\u002F\u002Fgithub.com\u002FLosec-io\u002Flocac.git\ncd locac\nbun install\nbun run build:exe\n",[100,441,442,453,462,470],{"__ignoreMap":128},[132,443,444,447,450],{"class":134,"line":29},[132,445,446],{"class":137},"git",[132,448,449],{"class":145}," clone",[132,451,452],{"class":145}," https:\u002F\u002Fgithub.com\u002FLosec-io\u002Flocac.git\n",[132,454,455,459],{"class":134,"line":33},[132,456,458],{"class":457},"sm68I","cd",[132,460,461],{"class":145}," locac\n",[132,463,464,467],{"class":134,"line":41},[132,465,466],{"class":137},"bun",[132,468,469],{"class":145}," install\n",[132,471,473,475,478],{"class":134,"line":472},4,[132,474,466],{"class":137},[132,476,477],{"class":145}," run",[132,479,480],{"class":145}," build:exe\n",[88,482,483,486,487,490,491,494],{},[100,484,485],{},"build:exe"," compiles ",[100,488,489],{},"src\u002Fcli\u002Fmain.ts"," with ",[100,492,493],{},"bun build --compile"," and writes:",[209,496,497,507],{},[212,498,499],{},[215,500,501,504],{},[218,502,503],{},"Host",[218,505,506],{},"Artifact",[228,508,509,519],{},[215,510,511,514],{},[233,512,513],{},"Windows",[233,515,516],{},[100,517,518],{},"dist\u002Flocac.exe",[215,520,521,524],{},[233,522,523],{},"macOS \u002F Linux",[233,525,526],{},[100,527,528],{},"dist\u002Flocac",[88,530,531,532,535,536,539,540,543],{},"Every piece of runtime data is ",[92,533,534],{},"embedded in that one file",": the tree-sitter WASM grammars, the web\ndashboard assets, the bundled skills, and the platform's sandbox helper - the broker ",[100,537,538],{},"srt-win.exe","\non Windows, the ",[100,541,542],{},"apply-seccomp"," installer on Linux. Copy the single file wherever you want it.",[545,546,548],"h3",{"id":547},"cross-compiling","Cross-compiling",[88,550,551],{},"Pass a Bun target triple to build for another platform. One host can cut every artifact:",[123,553,555],{"className":125,"code":554,"language":127,"meta":128,"style":128},"bun run build:exe --target=bun-linux-x64      # -> dist\u002Flocac-linux-x64\nbun run build:exe --target=bun-darwin-arm64   # -> dist\u002Flocac-darwin-arm64\nbun run build:exe --target=bun-windows-x64    # -> dist\u002Flocac-windows-x64.exe\n",[100,556,557,573,587],{"__ignoreMap":128},[132,558,559,561,563,566,569],{"class":134,"line":29},[132,560,466],{"class":137},[132,562,477],{"class":145},[132,564,565],{"class":145}," build:exe",[132,567,568],{"class":141}," --target=bun-linux-x64",[132,570,572],{"class":571},"sux-A","      # -> dist\u002Flocac-linux-x64\n",[132,574,575,577,579,581,584],{"class":134,"line":33},[132,576,466],{"class":137},[132,578,477],{"class":145},[132,580,565],{"class":145},[132,582,583],{"class":141}," --target=bun-darwin-arm64",[132,585,586],{"class":571},"   # -> dist\u002Flocac-darwin-arm64\n",[132,588,589,591,593,595,598],{"class":134,"line":41},[132,590,466],{"class":137},[132,592,477],{"class":145},[132,594,565],{"class":145},[132,596,597],{"class":141}," --target=bun-windows-x64",[132,599,600],{"class":571},"    # -> dist\u002Flocac-windows-x64.exe\n",[88,602,603,604,607,608,610,611,614],{},"Cross-built artifacts are suffixed so a matrix writing into one ",[100,605,606],{},"dist\u002F"," cannot clobber itself; a\nplain ",[100,609,485],{}," keeps the unsuffixed name. Which sandbox helpers get embedded is decided by the\n",[92,612,613],{},"target",", not the host, so each artifact carries only its own platform's helpers and none of the\nothers' weight.",[118,616,618],{"id":617},"verify-the-build","Verify the build",[123,620,622],{"className":125,"code":621,"language":127,"meta":128,"style":128},"locac selftest\n",[100,623,624],{"__ignoreMap":128},[132,625,626,628],{"class":134,"line":29},[132,627,269],{"class":137},[132,629,630],{"class":145}," selftest\n",[123,632,637],{"className":633,"code":635,"language":636,"meta":128},[634],"language-text","  ✓ tree-sitter AST — 1 call site(s)\n  ✓ bundled skills — srcwalk, variant, verify\n  ✓ web dashboard assets — 52032 bytes embedded\n  ✓ srt-win helper — 2987008 bytes at ~\u002F.locac\u002Fbin\u002Fsrt-win.exe\n  · OS sandbox — os\n\nselftest: OK\n","text",[100,638,635],{"__ignoreMap":128},[88,640,641,644,645,648,649,652],{},[100,642,643],{},"selftest"," exists because a compiled binary can fail in ways the source never does: a dependency that\nresolves an asset relative to its own module URL finds the ",[201,646,647],{},"virtual"," filesystem after ",[100,650,651],{},"--compile",", so\na broken asset is invisible from source and silently degrades the binary. The checks are:",[654,655,656,663,680,690,700],"ul",{},[657,658,659,662],"li",{},[92,660,661],{},"tree-sitter AST."," Loads a grammar and parses a snippet. The hardest asset to keep working in a\ncompiled exe.",[657,664,665,668,669,672,673,672,676,679],{},[92,666,667],{},"bundled skills."," The ",[100,670,671],{},"srcwalk"," \u002F ",[100,674,675],{},"verify",[100,677,678],{},"variant"," skills resolve and load.",[657,681,682,685,686,689],{},[92,683,684],{},"web dashboard assets."," The HTML and JS for ",[100,687,688],{},"locac web"," are embedded.",[657,691,692,695,696,699],{},[92,693,694],{},"srt-win helper"," (Windows only). The sandbox broker was extracted under ",[100,697,698],{},"LOCAC_HOME",". If this\nfails, the Windows sandbox silently never engages.",[657,701,702,705,706,432,708,711,712,715,716,719],{},[92,703,704],{},"apply-seccomp helper"," (Linux only). The seccomp installer was extracted under ",[100,707,698],{},[201,709,710],{},"and\nis executable",", since bwrap execs that path. This check needs to exist more than the Windows one\ndoes: a missing broker drops the mode to ",[100,713,714],{},"direct",", which the run header shouts about, while a\nmissing seccomp filter leaves the mode reading ",[100,717,718],{},"os"," and quietly removes the AF_UNIX layer.",[88,721,722,723,726,727,729,730,732],{},"The last line is a ",[92,724,725],{},"note",", not a check: it reports which sandbox mode this host actually gets\n(",[100,728,718],{}," or ",[100,731,714],{},") and why, proven by running a no-op command through the sandbox. An unprovisioned\nsandbox is a fact about the host, not a broken build, so it never affects the exit code.",[88,734,735,736,739,740,743],{},"Exit code: ",[100,737,738],{},"0"," on OK, ",[100,741,742],{},"1"," on FAILED.",[118,745,747],{"id":746},"put-it-on-your-path","Put it on your PATH",[88,749,750],{},"The installers deliberately do not do this for you, and neither does the build. Pick where it goes.",[88,752,753],{},"On macOS and Linux, either add the install directory:",[123,755,757],{"className":125,"code":756,"language":127,"meta":128,"style":128},"export PATH=\"$HOME\u002F.locac\u002Fbin:$PATH\"    # add to your shell profile to persist\n",[100,758,759],{"__ignoreMap":128},[132,760,761,764,768,771,775,778,780],{"class":134,"line":29},[132,762,763],{"class":149},"export",[132,765,767],{"class":766},"st-jp"," PATH",[132,769,770],{"class":169},"=",[132,772,774],{"class":773},"sNJcY","\"",[132,776,777],{"class":145},"$HOME\u002F.locac\u002Fbin:$PATH",[132,779,774],{"class":773},[132,781,782],{"class":571},"    # add to your shell profile to persist\n",[88,784,785],{},"or copy a source build somewhere already on it:",[123,787,789],{"className":125,"code":788,"language":127,"meta":128,"style":128},"sudo install -m 755 dist\u002Flocac \u002Fusr\u002Flocal\u002Fbin\u002Flocac\nlocac --help\n",[100,790,791,812],{"__ignoreMap":128},[132,792,793,796,799,802,806,809],{"class":134,"line":29},[132,794,795],{"class":137},"sudo",[132,797,798],{"class":145}," install",[132,800,801],{"class":141}," -m",[132,803,805],{"class":804},"sxA9i"," 755",[132,807,808],{"class":145}," dist\u002Flocac",[132,810,811],{"class":145}," \u002Fusr\u002Flocal\u002Fbin\u002Flocac\n",[132,813,814,816],{"class":134,"line":33},[132,815,269],{"class":137},[132,817,818],{"class":141}," --help\n",[88,820,821],{},"On Windows, from PowerShell:",[123,823,825],{"className":156,"code":824,"language":158,"meta":128,"style":128},"[Environment]::SetEnvironmentVariable(\n  \"Path\", [Environment]::GetEnvironmentVariable('Path','User') + \";$HOME\\.locac\\bin\", \"User\")\n",[100,826,827,844],{"__ignoreMap":128},[132,828,829,832,835,838,841],{"class":134,"line":29},[132,830,831],{"class":169},"[",[132,833,834],{"class":149},"Environment",[132,836,837],{"class":169},"]",[132,839,840],{"class":165},"::SetEnvironmentVariable",[132,842,843],{"class":169},"(\n",[132,845,846,849,852,854,857,860,862,864,867,870,873,875,877,879,881,884,886,889,892,895,898,901,904,907,909,911,913,915,917],{"class":134,"line":33},[132,847,848],{"class":773},"  \"",[132,850,851],{"class":145},"Path",[132,853,774],{"class":773},[132,855,856],{"class":149},",",[132,858,859],{"class":169}," [",[132,861,834],{"class":149},[132,863,837],{"class":169},[132,865,866],{"class":165},"::GetEnvironmentVariable",[132,868,869],{"class":169},"(",[132,871,872],{"class":773},"'",[132,874,851],{"class":145},[132,876,872],{"class":773},[132,878,856],{"class":149},[132,880,872],{"class":773},[132,882,883],{"class":145},"User",[132,885,872],{"class":773},[132,887,888],{"class":169},")",[132,890,891],{"class":169}," +",[132,893,894],{"class":773}," \"",[132,896,897],{"class":145},";",[132,899,900],{"class":169},"$",[132,902,903],{"class":141},"HOME",[132,905,906],{"class":145},"\\.locac\\bin",[132,908,774],{"class":773},[132,910,856],{"class":149},[132,912,894],{"class":773},[132,914,883],{"class":145},[132,916,774],{"class":773},[132,918,919],{"class":169},")\n",[88,921,922,923,925,926,929],{},"That reads and writes the ",[92,924,883],{}," PATH specifically. Composing the new value from ",[100,927,928],{},"$env:Path","\ninstead would flatten the machine-wide entries into your user variable, so a later system change\nwould stop reaching you. Open a new terminal afterwards: the change does not reach shells that are\nalready running.",[118,931,933],{"id":932},"sandbox-prerequisites","Sandbox prerequisites",[88,935,936,937,939,940,943,944,947],{},"Tool execution is confined by an OS-level sandbox. When the sandbox is unavailable the run falls back\nto ",[100,938,714],{}," mode, where commands still run but ",[92,941,942],{},"unconfined",". Pass ",[100,945,946],{},"--require-sandbox"," to refuse to start\nin that case.",[88,949,950,953,954,957,958,961,962,965,966,968],{},[92,951,952],{},"Linux"," needs all three of ",[100,955,956],{},"bwrap",", ",[100,959,960],{},"socat"," and ",[100,963,964],{},"rg",". Missing any one drops the host to ",[100,967,714],{},":",[123,970,972],{"className":125,"code":971,"language":127,"meta":128,"style":128},"sudo apt install bubblewrap socat ripgrep\n",[100,973,974],{"__ignoreMap":128},[132,975,976,978,981,983,986,989],{"class":134,"line":29},[132,977,795],{"class":137},[132,979,980],{"class":145}," apt",[132,982,798],{"class":145},[132,984,985],{"class":145}," bubblewrap",[132,987,988],{"class":145}," socat",[132,990,991],{"class":145}," ripgrep\n",[88,993,994,997,998,116],{},[92,995,996],{},"macOS"," needs nothing installed: confinement uses the built-in ",[100,999,1000],{},"sandbox-exec",[88,1002,1003,1005],{},[92,1004,513],{}," needs a one-time provisioning step that creates the low-privilege sandbox account:",[123,1007,1009],{"className":125,"code":1008,"language":127,"meta":128,"style":128},"npx sandbox-runtime windows-install\n",[100,1010,1011],{"__ignoreMap":128},[132,1012,1013,1016,1019],{"class":134,"line":29},[132,1014,1015],{"class":137},"npx",[132,1017,1018],{"class":145}," sandbox-runtime",[132,1020,1021],{"class":145}," windows-install\n",[88,1023,1024,1025,1028],{},"On Ubuntu 24.04 and newer, unprivileged user namespaces are restricted by default, which can block\nthe nested namespace bubblewrap needs. ",[100,1026,1027],{},"locac selftest"," reports the exact reason on the OS sandbox\nline, and that line is the authority rather than this page.",[118,1030,115],{"id":1031},"windows-notes",[88,1033,1034],{},"Windows is a first-class target, with two host-specific requirements:",[88,1036,1037,1040],{},[92,1038,1039],{},"1. A bash-compatible shell."," Install Git for Windows and point locac at it, either per run or\nglobally:",[123,1042,1044],{"className":125,"code":1043,"language":127,"meta":128,"style":128},"locac run \"audit this repo\" --shell-path \"C:\\Program Files\\Git\\bin\\bash.exe\"\n",[100,1045,1046],{"__ignoreMap":128},[132,1047,1048,1050,1052,1054,1057,1059,1062,1064,1067],{"class":134,"line":29},[132,1049,269],{"class":137},[132,1051,477],{"class":145},[132,1053,894],{"class":773},[132,1055,1056],{"class":145},"audit this repo",[132,1058,774],{"class":773},[132,1060,1061],{"class":141}," --shell-path",[132,1063,894],{"class":773},[132,1065,1066],{"class":145},"C:\\Program Files\\Git\\bin\\bash.exe",[132,1068,1069],{"class":773},"\"\n",[88,1071,1072,1073,1076,1077,1080,1081,1084,1085,1088,1089,1092],{},"Or set the ",[100,1074,1075],{},"LOCAC_SHELL"," environment variable, or the ",[100,1078,1079],{},"shellPath"," field in ",[100,1082,1083],{},"~\u002F.locac\u002Fconfig.json",".\nlocac auto-discovers a bash if one is on ",[100,1086,1087],{},"PATH","; ",[100,1090,1091],{},"--shell-path"," is for when it is not.",[88,1094,1095,1098,1099,1102],{},[92,1096,1097],{},"2. The one-time sandbox install"," shown above. Under the Windows sandbox, target commands run as\n",[92,1100,1101],{},"another user",", a low-privilege account provisioned by that installer.",[118,1104,1106],{"id":1105},"running-without-building","Running without building",[88,1108,1109],{},"For development you can skip the compile step entirely:",[123,1111,1113],{"className":125,"code":1112,"language":127,"meta":128,"style":128},"bun run src\u002Fcli\u002Fmain.ts --help\nbun run src\u002Fcli\u002Fmain.ts run \"audit this repo\" --cwd \u002Fpath\u002Fto\u002Ftarget\n",[100,1114,1115,1126],{"__ignoreMap":128},[132,1116,1117,1119,1121,1124],{"class":134,"line":29},[132,1118,466],{"class":137},[132,1120,477],{"class":145},[132,1122,1123],{"class":145}," src\u002Fcli\u002Fmain.ts",[132,1125,818],{"class":141},[132,1127,1128,1130,1132,1134,1136,1138,1140,1142,1145],{"class":134,"line":33},[132,1129,466],{"class":137},[132,1131,477],{"class":145},[132,1133,1123],{"class":145},[132,1135,477],{"class":145},[132,1137,894],{"class":773},[132,1139,1056],{"class":145},[132,1141,774],{"class":773},[132,1143,1144],{"class":141}," --cwd",[132,1146,1147],{"class":145}," \u002Fpath\u002Fto\u002Ftarget\n",[88,1149,1150,1151,1153],{},"This is the same entry point, so behaviour is identical, but it resolves assets from the source tree\nrather than the embedded VFS, which is precisely the difference ",[100,1152,643],{}," exists to catch. Verify\nagainst the compiled binary before you trust a build.",[118,1155,1157],{"id":1156},"repository-scripts","Repository scripts",[209,1159,1160,1170],{},[212,1161,1162],{},[215,1163,1164,1167],{},[218,1165,1166],{},"Script",[218,1168,1169],{},"What it does",[228,1171,1172,1182,1198,1210,1222],{},[215,1173,1174,1179],{},[233,1175,1176],{},[100,1177,1178],{},"bun test",[233,1180,1181],{},"Full test suite",[215,1183,1184,1189],{},[233,1185,1186],{},[100,1187,1188],{},"bun run typecheck",[233,1190,1191,1194,1195],{},[100,1192,1193],{},"tsc --noEmit",", strict with ",[100,1196,1197],{},"noUncheckedIndexedAccess",[215,1199,1200,1205],{},[233,1201,1202],{},[100,1203,1204],{},"bun run lint",[233,1206,1207],{},[100,1208,1209],{},"biome check .",[215,1211,1212,1217],{},[233,1213,1214],{},[100,1215,1216],{},"bun run format",[233,1218,1219],{},[100,1220,1221],{},"biome format --write .",[215,1223,1224,1229],{},[233,1225,1226],{},[100,1227,1228],{},"bun run build:exe",[233,1230,1231],{},"Compile the single-file executable",[118,1233,1235],{"id":1234},"next","Next",[88,1237,1238,1239,1241],{},"Head to the ",[105,1240,40],{"href":39}," to configure a provider and run a first audit.",[1243,1244,1245],"style",{},"html pre.shiki code .sCK9x, html code.shiki .sCK9x{--shiki-default:#80A665}html pre.shiki code .sXjYR, html code.shiki .sXjYR{--shiki-default:#C99076}html pre.shiki code .s7rlk, html code.shiki .s7rlk{--shiki-default:#C98A7D}html pre.shiki code .s_wWq, html code.shiki .s_wWq{--shiki-default:#CB7676}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sm68I, html code.shiki .sm68I{--shiki-default:#B8A965}html pre.shiki code .sux-A, html code.shiki .sux-A{--shiki-default:#758575DD}html pre.shiki code .st-jp, html code.shiki .st-jp{--shiki-default:#BD976A}html pre.shiki code .s_pn2, html code.shiki .s_pn2{--shiki-default:#666666}html pre.shiki code .sNJcY, html code.shiki .sNJcY{--shiki-default:#C98A7D77}html pre.shiki code .sxA9i, html code.shiki .sxA9i{--shiki-default:#4C9A91}html pre.shiki code .sNpkn, html code.shiki .sNpkn{--shiki-default:#DBD7CAEE}",{"title":128,"searchDepth":41,"depth":41,"links":1247},[1248,1249,1252,1253,1254,1255,1256,1257,1258],{"id":120,"depth":33,"text":121},{"id":422,"depth":33,"text":423,"children":1250},[1251],{"id":547,"depth":41,"text":548},{"id":617,"depth":33,"text":618},{"id":746,"depth":33,"text":747},{"id":932,"depth":33,"text":933},{"id":1031,"depth":33,"text":115},{"id":1105,"depth":33,"text":1106},{"id":1156,"depth":33,"text":1157},{"id":1234,"depth":33,"text":1235},"Install locac from a verified release binary or build it from source, verify the embedded runtime assets, and install the per-OS sandbox prerequisites.","md",{},true,{"title":32,"description":1259},"docs\u002Finstallation","rsIhsol41Cr_EXsyDBHaEE7VQK941LZlV0sw-rxVYoI",1786794387118]