feat(cli): make kontext start local-first

[tumberger]

Summary

• Makes kontext start launch the local runtime by default, with local dashboard and wrapper-owned hook socket setup.
• Adds a reusable runtimehost boundary for local runtime hosting: DB/store setup, embedded model activation, session dir/socket lifecycle, dashboard binding, and session close.
• Keeps hosted sessions explicit through kontext start --managed, and prevents local KONTEXT_MODE from leaking into managed hook behavior.

Reviewer follow-up

• Dashboard binds are loopback-only by default for the new local start path.
• Local session directories use full safe session IDs with collision checks.
• The default risk model is embedded, so release binaries do not depend on the caller's current working directory.
• Startup output reports the resolved observe/enforce mode.
• os.Executable() failures now stop both local and managed settings generation.

Verification

• go test ./cmd/kontext ./internal/run ./internal/runtimehost ./internal/guard/modelsnapshot
• go test ./...
• go test -race ./...
• go vet ./...
• buf generate if protobuf or generated code changed

Release notes

• conventional commit title matches semver intent

[tumberger]

• feat(cli): make kontext start local-first #140 👈 (View in Graphite)
• docs(readme): refresh local guard positioning #130
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[greptile-apps]

Greptile Summary

This PR makes kontext start run a local runtime by default. It changes:

• Adds --managed for hosted sessions.
• Introduces runtimehost for local DB, model, socket, session, and dashboard lifecycle.
• Generates local hook settings with explicit socket and mode values.
• Embeds the default guard model for release builds.
• Tightens local model snapshot and runtime file permissions.

Confidence Score: 4/5

This is close, but the local shutdown path should be fixed before merging.

• The new local runtime can close a session while async hook ingestion is still active.

• That can reopen the session row or drop final telemetry after the agent exits.

• The main local-first flow otherwise has the expected loopback dashboard, embedded model, and explicit mode handling.

• internal/runtimehost/host.go

• internal/localruntime/service.go

Important Files Changed

Filename	Overview
internal/runtimehost/host.go	Adds the local runtime host lifecycle; shutdown ordering can race async hook ingestion.
internal/run/local.go	Adds the default local start flow that launches runtimehost, writes hook settings, and starts the agent.
internal/run/hooks.go	Adds local hook settings with explicit --socket and --mode command arguments.

_{Reviews (3): Last reviewed commit: "feat(cli): make kontext start local-firs..." | Re-trigger Greptile}

[tumberger]

Architecture note for this PR:

This PR intentionally makes kontext start the local-first sidecar entrypoint: it starts the local runtime for one agent session, launches Claude with temporary hook settings, and shuts the runtime down when the agent exits. kontext start --managed remains the explicit hosted/team path.

The key architecture change is the new runtimehost boundary. runtimecore owns hook/session/policy semantics, localruntime owns the Unix socket protocol, and runtimehost owns process-host concerns like model activation, SQLite/store setup, socket/session directory lifecycle, dashboard startup, and cleanup.

That extra abstraction is here so kontext start does not rebuild a one-off local daemon inside internal/run, and so future host modes can share the same model/store/server/socket/dashboard wiring. This does not mean the daemon topology goes away. Issue #104 explicitly separated wrapper-owned sidecar mode from daemon-observed mode: kontext start should launch the agent, while a daemon mode should let already-running or normally-launched Claude sessions connect through persistent hooks.

Follow-up cleanup I would scope separately:

• Add a neutral daemon surface, likely kontext daemon, backed by runtimehost in daemon-observed mode with a stable socket and dashboard.
• Make kontext guard start a compatibility/deprecated alias over that daemon path, instead of keeping its parallel daemon assembly.
• Remove Guard from user-visible product copy and dashboard branding once kontext start is the primary local sidecar path and kontext daemon is the neutral observed-session path.
• Decide whether persistent hook install/uninstall stays as an advanced feature; if it does, move it to a neutral command surface and have it call the canonical kontext hook --agent claude path.
• Only after the runtime paths are unified, consider mechanical package renames out of internal/guard for risk, store, model snapshot, dashboard, and Markov components.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[tumberger]

@greptileai

[tumberger]

Merge activity

• May 17, 10:36 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 17, 10:37 AM UTC: Graphite rebased this pull request as part of a merge.
• May 17, 10:39 AM UTC: @tumberger merged this pull request with Graphite.

The base branch was changed.