
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
@samiyev/ipuaro
Advanced tools
Local AI Agent for Codebase Operations
"Infinite" context feeling through lazy loading - work with your entire codebase using local LLM.
Status: š Release Candidate (v0.16.0 ā v1.0.0)
All core features complete. Production-ready release coming soon.
Work with codebases of any size using local AI:
| Category | Tools | Description |
|---|---|---|
| Read | get_lines, get_function, get_class, get_structure | Read code without loading everything into context |
| Edit | edit_lines, create_file, delete_file | Make changes with confirmation and undo support |
| Search | find_references, find_definition | Find symbol definitions and usages across codebase |
| Analysis | get_dependencies, get_dependents, get_complexity, get_todos | Analyze code structure, complexity, and TODOs |
| Git | git_status, git_diff, git_commit | Git operations with safety checks |
| Run | run_command, run_tests | Execute commands and tests with security validation |
See Tools Documentation below for detailed usage examples.
āā ipuaro āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā [ctx: 12%] [project: myapp] [main] [47m] ā Ready ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā You: How does the authentication flow work? ā
ā ā
ā Assistant: Let me analyze the auth module... ā
ā [get_structure src/auth/] ā
ā [get_function src/auth/service.ts login] ā
ā ā
ā The authentication flow works as follows: ā
ā 1. User calls POST /auth/login ā
ā 2. AuthService.login() validates credentials... ā
ā ā
ā ā± 3.2s ā 1,247 tokens ā 2 tool calls ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā¤
ā > _ ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
Control your session with built-in commands:
| Command | Description |
|---|---|
/help | Show all commands and hotkeys |
/clear | Clear chat history (keeps session) |
/undo | Revert last file change from undo stack |
/sessions [list|load|delete] [id] | Manage sessions |
/status | Show system status (LLM, context, stats) |
/reindex | Force full project reindexation |
/eval | LLM self-check for hallucinations |
/auto-apply [on|off] | Toggle auto-apply mode for edits |
| Hotkey | Action |
|---|---|
Ctrl+C | Interrupt generation (1st press) / Exit (2nd press within 1s) |
Ctrl+D | Exit and save session |
Ctrl+Z | Undo last file change |
ā / ā | Navigate input history |
Tab | Path autocomplete (coming soon) |
š Smart Code Understanding
š¾ Persistent Sessions
š”ļø Security
npm install @samiyev/ipuaro
# or
pnpm add @samiyev/ipuaro
# Install Ollama (macOS)
brew install ollama
# Start Ollama
ollama serve
# Pull recommended model
ollama pull qwen2.5-coder:7b-instruct
# Install Redis (macOS)
brew install redis
# Start Redis with persistence
redis-server --appendonly yes
# Start ipuaro in current directory
ipuaro
# Start in specific directory
ipuaro /path/to/project
# With custom model
ipuaro --model qwen2.5-coder:32b-instruct
# With auto-apply mode (skip edit confirmations)
ipuaro --auto-apply
Try ipuaro with our demo project:
# Navigate to demo project
cd examples/demo-project
# Install dependencies
npm install
# Start ipuaro
npx @samiyev/ipuaro
See examples/demo-project for detailed usage guide and example conversations.
| Command | Description |
|---|---|
ipuaro [path] | Start TUI in directory |
ipuaro init | Create .ipuaro.json config |
ipuaro index | Index project without TUI |
Create .ipuaro.json in your project root:
{
"redis": {
"host": "localhost",
"port": 6379
},
"llm": {
"model": "qwen2.5-coder:7b-instruct",
"temperature": 0.1
},
"project": {
"ignorePatterns": ["node_modules", "dist", ".git"]
},
"edit": {
"autoApply": false
}
}
Clean Architecture with clear separation:
@samiyev/ipuaro/
āāā domain/ # Business logic (no dependencies)
ā āāā entities/ # Session, Project
ā āāā value-objects/ # FileData, FileAST, ChatMessage, etc.
ā āāā services/ # IStorage, ILLMClient, ITool, IIndexer
āāā application/ # Use cases & orchestration
ā āāā use-cases/ # StartSession, HandleMessage, etc.
ā āāā interfaces/ # IToolRegistry
āāā infrastructure/ # External implementations
ā āāā storage/ # Redis client & storage
ā āāā llm/ # Ollama client & prompts
ā āāā indexer/ # File scanner, AST parser
ā āāā tools/ # 18 tool implementations
āāā tui/ # Terminal UI (Ink/React)
ā āāā components/ # StatusBar, Chat, Input, etc.
āāā cli/ # CLI entry point
āāā shared/ # Config, errors, utils
See ROADMAP.md for detailed development plan and CHANGELOG.md for release history.
The AI agent has access to 18 tools for working with your codebase. Here are the most commonly used ones:
get_lines(path, start?, end?)
Read specific lines from a file.
You: Show me the authentication logic
Assistant: [get_lines src/auth/service.ts 45 67]
# Returns lines 45-67 with line numbers
get_function(path, name)
Get a specific function's source code and metadata.
You: How does the login function work?
Assistant: [get_function src/auth/service.ts login]
# Returns function code, params, return type, and metadata
get_class(path, name)
Get a specific class's source code and metadata.
You: Show me the UserService class
Assistant: [get_class src/services/user.ts UserService]
# Returns class code, methods, properties, and inheritance info
get_structure(path?, depth?)
Get directory tree structure.
You: What's in the src/auth directory?
Assistant: [get_structure src/auth]
# Returns ASCII tree with files and folders
edit_lines(path, start, end, content)
Replace lines in a file (requires confirmation).
You: Update the timeout to 5000ms
Assistant: [edit_lines src/config.ts 23 23 " timeout: 5000,"]
# Shows diff, asks for confirmation
create_file(path, content)
Create a new file (requires confirmation).
You: Create a new utility for date formatting
Assistant: [create_file src/utils/date.ts "export function formatDate..."]
# Creates file after confirmation
delete_file(path)
Delete a file (requires confirmation).
You: Remove the old test file
Assistant: [delete_file tests/old-test.test.ts]
# Deletes after confirmation
find_references(symbol, path?)
Find all usages of a symbol across the codebase.
You: Where is getUserById used?
Assistant: [find_references getUserById]
# Returns all files/lines where it's called
find_definition(symbol)
Find where a symbol is defined.
You: Where is ApiClient defined?
Assistant: [find_definition ApiClient]
# Returns file, line, and context
get_dependencies(path)
Get files that a specific file imports.
You: What does auth.ts depend on?
Assistant: [get_dependencies src/auth/service.ts]
# Returns list of imported files
get_dependents(path)
Get files that import a specific file.
You: What files use the database module?
Assistant: [get_dependents src/db/index.ts]
# Returns list of files importing this
get_complexity(path?, limit?)
Get complexity metrics for files.
You: Which files are most complex?
Assistant: [get_complexity null 10]
# Returns top 10 most complex files with metrics
get_todos(path?, type?)
Find TODO/FIXME/HACK comments.
You: What TODOs are there?
Assistant: [get_todos]
# Returns all TODO comments with locations
git_status()
Get current git repository status.
You: What files have changed?
Assistant: [git_status]
# Returns branch, staged, modified, untracked files
git_diff(path?, staged?)
Get uncommitted changes.
You: Show me what changed in auth.ts
Assistant: [git_diff src/auth/service.ts]
# Returns diff output
git_commit(message, files?)
Create a git commit (requires confirmation).
You: Commit these auth changes
Assistant: [git_commit "feat: add password reset flow" ["src/auth/service.ts"]]
# Creates commit after confirmation
run_command(command, timeout?)
Execute shell commands (with security validation).
You: Run the build
Assistant: [run_command "npm run build"]
# Checks security, then executes
run_tests(path?, filter?, watch?)
Run project tests.
You: Test the auth module
Assistant: [run_tests "tests/auth" null false]
# Auto-detects test runner and executes
For complete tool documentation with all parameters and options, see TOOLS.md.
You can use ipuaro as a library in your own Node.js applications:
import {
createRedisClient,
RedisStorage,
OllamaClient,
ToolRegistry,
StartSession,
HandleMessage
} from "@samiyev/ipuaro"
// Initialize dependencies
const redis = await createRedisClient({ host: "localhost", port: 6379 })
const storage = new RedisStorage(redis, "my-project")
const llm = new OllamaClient({
model: "qwen2.5-coder:7b-instruct",
contextWindow: 128000,
temperature: 0.1
})
const tools = new ToolRegistry()
// Register tools
tools.register(new GetLinesTool(storage, "/path/to/project"))
// ... register other tools
// Start a session
const startSession = new StartSession(storage)
const session = await startSession.execute("my-project")
// Handle a message
const handleMessage = new HandleMessage(storage, llm, tools)
await handleMessage.execute(session, "Show me the auth flow")
// Session is automatically updated in Redis
For full API documentation, see the TypeScript definitions in src/ or explore the source code.
When you start ipuaro, it scans your project and builds an index:
1. File Scanner ā Recursively scans files (.ts, .js, .tsx, .jsx)
2. AST Parser ā Parses with tree-sitter (extracts functions, classes, imports)
3. Meta Analyzer ā Calculates complexity, dependencies, hub detection
4. Index Builder ā Creates symbol index and dependency graph
5. Redis Storage ā Persists everything for instant startup next time
6. Watchdog ā Watches files for changes and updates index in background
Instead of loading entire codebase into context:
Traditional approach:
āāā Load all files ā 500k tokens ā ā Exceeds context window
ipuaro approach:
āāā Load project structure ā ~2k tokens
āāā Load AST metadata ā ~10k tokens
āāā On demand: get_function("auth.ts", "login") ā ~200 tokens
āāā Total: ~12k tokens ā ā
Fits in 128k context window
Context automatically compresses when usage exceeds 80% by summarizing old messages.
The LLM doesn't see your code initially. It only sees structure and metadata. When it needs code, it uses tools:
You: "How does user creation work?"
Agent reasoning:
1. [get_structure src/] ā sees user/ folder exists
2. [get_function src/user/service.ts createUser] ā loads specific function
3. [find_references createUser] ā finds all usages
4. Synthesizes answer with only relevant code loaded
Total tokens used: ~2k (vs loading entire src/ which could be 50k+)
Everything is saved to Redis:
Resume your session anytime with /sessions load <id>.
Three-layer security:
File operations are restricted to project directory only (path traversal prevention).
Error: Redis connection failed
Solutions:
# Check if Redis is running
redis-cli ping # Should return "PONG"
# Start Redis with AOF persistence
redis-server --appendonly yes
# Check Redis logs
tail -f /usr/local/var/log/redis.log # macOS
Error: Model qwen2.5-coder:7b-instruct not found
Solutions:
# Pull the model
ollama pull qwen2.5-coder:7b-instruct
# List installed models
ollama list
# Check Ollama is running
ollama serve
Issue: Indexing takes too long or uses too much memory
Solutions:
# Index only a subdirectory
ipuaro ./src
# Add more ignore patterns to .ipuaro.json
{
"project": {
"ignorePatterns": ["node_modules", "dist", ".git", "coverage", "build"]
}
}
# Increase Node.js memory limit
NODE_OPTIONS="--max-old-space-size=4096" ipuaro
Issue: Context window exceeded errors
Solutions:
/clear historyIssue: Made changes but agent doesn't see them
Solutions:
# Force reindex
/reindex
# Or restart with fresh index
rm -rf ~/.ipuaro/cache
ipuaro
Issue: /undo says no changes to undo
Explanation: Undo stack only tracks the last 10 file edits made through ipuaro. Manual file edits outside ipuaro cannot be undone.
Q: Does ipuaro send my code to any external servers?
A: No. Everything runs locally. Ollama runs on your machine, Redis stores data locally, and no network requests are made except to your local Ollama instance.
Q: What languages are supported?
A: Currently TypeScript, JavaScript (including TSX/JSX). More languages planned for future versions.
Q: Can I use OpenAI/Anthropic/other LLM providers?
A: Currently only Ollama is supported. OpenAI/Anthropic support is planned for v1.2.0.
Q: How much disk space does Redis use?
A: Depends on project size. A typical mid-size project (1000 files) uses ~50-100MB. Redis uses AOF persistence, so data survives restarts.
Q: Can I use ipuaro in a CI/CD pipeline?
A: Yes, but it's designed for interactive use. For automated code analysis, consider the programmatic API.
Q: What's the difference between ipuaro and GitHub Copilot?
A: Copilot is an autocomplete tool. ipuaro is a conversational agent that can read, analyze, modify files, run commands, and has full codebase understanding through AST parsing.
Q: Why Redis instead of SQLite or JSON files?
A: Redis provides fast in-memory access, AOF persistence, and handles concurrent access well. The session model fits Redis's data structures perfectly.
Contributions welcome! This project is in early development.
# Clone
git clone https://github.com/samiyev/puaros.git
cd puaros/packages/ipuaro
# Install
pnpm install
# Build
pnpm build
# Test
pnpm test:run
# Coverage
pnpm test:coverage
MIT Ā© Fozilbek Samiyev
FAQs
Local AI agent for codebase operations with infinite context feeling
The npm package @samiyev/ipuaro receives a total of 24 weekly downloads. As such, @samiyev/ipuaro popularity was classified as not popular.
We found that @samiyev/ipuaro demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Ā It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.