feat: enterprise OIDC, scientist onboarding, FastCRW SDK, shieldcn badges

.devin/config.local.json

@@ -0,0 +1,8 @@
+{
+  "permissions": {
+    "allow": [
+      "Exec(git)",
+      "Exec(find)"
+    ]
+  }
+}

.env.example

@@ -21,6 +21,10 @@ LOCAL_STUDIO_API_KEY=
 # Optional browser allowlist for direct controller access (comma-separated origins)
 # LOCAL_STUDIO_CORS_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
 
+# Comma-separated hostnames permitted for controller-managed remote AI providers.
+# Defaults include api.tprime.vlans.ca, api.thalesdigital.io, and pop-os-1.tailadb2c1.ts.net.
+# LOCAL_STUDIO_PROVIDER_HOST_ALLOWLIST=api.tprime.vlans.ca,api.thalesdigital.io
+
 # --- Privileged-capability opt-ins (safe defaults are OFF) ---
 # Allow recipes to specify a raw launch_command/custom_command (arbitrary binary
 # execution). Leave off unless you rely on custom launch commands.

.gitattributes

@@ -0,0 +1,2 @@
+frontend/public/appliances/cortaix-factory/cortaix-tui.ans whitespace=-trailing-space
+frontend/public/appliances/cortaix-factory/cortaix-tui.txt whitespace=-trailing-space

.gitignore

@@ -38,6 +38,7 @@ data/
 node_modules/
 services/node_modules
 .next/
+.next-dev/
 .turbo/
 
 # IDE
@@ -97,3 +98,6 @@ frontend/dist-desktop-dev/
 frontend/dist-installers/
 .vercel
 .env*
+# CocoIndex Code (ccc)
+/.cocoindex_code/
+/shared/node_modules

README.md

@@ -1,5 +1,10 @@
 # Local Studio
 
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/group/github/ci/sybil-solutions/local-studio+github/release/sybil-solutions/local-studio+github/license/sybil-solutions/local-studio+github/stars/sybil-solutions/local-studio+github/issues/sybil-solutions/local-studio.svg?variant=secondary&mode=dark">
+  <img alt="CI, release, license, stars, issues" src="https://shieldcn.dev/group/github/ci/sybil-solutions/local-studio+github/release/sybil-solutions/local-studio+github/license/sybil-solutions/local-studio+github/stars/sybil-solutions/local-studio+github/issues/sybil-solutions/local-studio.svg?variant=secondary&mode=light">
+</picture>
+
 Local Studio is a local-first workstation for running, managing, and using
 self-hosted LLM backends. One machine can launch models, watch GPU/runtime
 state, chat with OpenAI-compatible endpoints, and run agent sessions against
@@ -90,16 +95,22 @@ Start the controller (listens on `127.0.0.1:8080`, data dir + SQLite created
 automatically, model weights in `LOCAL_STUDIO_MODELS_DIR`, default `/models`):
 
 ```bash
-cd controller && bun install && bun src/main.ts
+cd controller && bun install
 ```
 
 Start the frontend in a second terminal, then open
 <http://localhost:3000/setup>:
 
 ```bash
-cd frontend && npm ci && npm run dev
+cd frontend && npm ci
+cd .. && npm run dev
 ```
 
+The root command reserves ports `3000`, `8080`, and `8081` and stops before launch
+when another stack owns any of them. Use `npm run dev:frontend` when the controller
+and agent runtime are managed separately. Development output is isolated in
+`frontend/.next-dev`, so `npm run check` cannot invalidate a running dev server.
+
 `npm ci` runs a postinstall patch against `@earendil-works/pi-ai`. If that step
 prints a warning, agent streaming may misrender. The setup wizard walks through
 choosing a models directory, installing an engine, downloading a model,

controller/README.md

@@ -1,5 +1,10 @@
 # Controller
 
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://shieldcn.dev/group/github/ci/sybil-solutions/local-studio+github/license/sybil-solutions/local-studio+github/release/sybil-solutions/local-studio.svg?variant=secondary&mode=dark">
+  <img alt="CI, license, release" src="https://shieldcn.dev/group/github/ci/sybil-solutions/local-studio+github/license/sybil-solutions/local-studio+github/release/sybil-solutions/local-studio.svg?variant=secondary&mode=light">
+</picture>
+
 `controller/` is the Bun/Hono backend for Local Studio. It exposes the HTTP API that the frontend and desktop app use to manage models, proxy inference requests, read runtime status, and inspect usage/system data.
 
 ## What It Does

controller/assets/notebooks/agent-collaboration-node.ipynb

@@ -0,0 +1,51 @@
+{
+ "cells": [
+  {
+   "cell_type": "markdown",
+   "id": "mission",
+   "metadata": {},
+   "source": [
+    "# Node.js analysis demonstration\n",
+    "\n",
+    "A governed C2 notebook for revision-bound JavaScript analysis and bounded Node.js execution."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "analysis",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "const measurements = [18.4, 19.1, 18.9, 19.4, 18.7];\n",
+    "const mean = measurements.reduce((total, value) => total + value, 0) / measurements.length;\n",
+    "console.log(`Observed mean: ${mean.toFixed(2)} ms`);"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "decision",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "const thresholdMs = 20;\n",
+    "const status = mean <= thresholdMs ? \"within envelope\" : \"review required\";\n",
+    "console.log(`Assessment: ${status}`);"
+   ]
+  }
+ ],
+ "metadata": {
+  "kernelspec": {
+   "display_name": "Node.js",
+   "language": "javascript",
+   "name": "nodejs"
+  },
+  "language_info": {
+   "name": "javascript",
+   "version": "ES2022"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 5
+}

controller/assets/notebooks/agent-collaboration.ipynb

@@ -0,0 +1,51 @@
+{
+ "cells": [
+  {
+   "cell_type": "markdown",
+   "id": "mission",
+   "metadata": {},
+   "source": [
+    "# Agent collaboration demonstration\n",
+    "\n",
+    "A governed C2 notebook used to demonstrate revision-bound inspection, approved edits and bounded execution."
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "analysis",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "measurements = [18.4, 19.1, 18.9, 19.4, 18.7]\n",
+    "mean = sum(measurements) / len(measurements)\n",
+    "print(f\"Observed mean: {mean:.2f} ms\")"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "decision",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "threshold_ms = 20.0\n",
+    "status = \"within envelope\" if mean <= threshold_ms else \"review required\"\n",
+    "print(f\"Assessment: {status}\")"
+   ]
+  }
+ ],
+ "metadata": {
+  "kernelspec": {
+   "display_name": "Python 3",
+   "language": "python",
+   "name": "python3"
+  },
+  "language_info": {
+   "name": "python",
+   "version": "3"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 5
+}

controller/assets/notebooks/python-smolvm/Dockerfile

@@ -0,0 +1,6 @@
+FROM python:3.12.11-slim-bookworm@sha256:519591d6871b7bc437060736b9f7456b8731f1499a57e22e6c285135ae657bf7
+COPY requirements.lock /tmp/requirements.lock
+RUN python -m pip install --no-cache-dir --require-hashes -r /tmp/requirements.lock
+RUN useradd --create-home --uid 65532 notebook
+USER 65532:65532
+WORKDIR /workspace

controller/assets/notebooks/python-smolvm/requirements.in

@@ -0,0 +1,3 @@
+ipykernel==6.30.1
+nbclient==0.10.2
+nbformat==5.10.4