LocalForge v2.1.0
What's new in v2.1.0
Layer 1 — Secret detection
- Expanded from 7 → 26 patterns across 13 providers
- New providers: GCP, Azure SAS, Stripe restricted, GitHub Actions secrets, Slack webhooks, Twilio, SendGrid, npm, PyPI, HuggingFace, Anthropic, OpenAI, Shopify, PuTTY, DSA keys,
.envassignments - Patterns compiled once at startup via
once_cell::Lazy— zero per-commit regex cost - Only scans
+diff lines — removing a secret never triggers a false block
Layer 2 — CoreML classifier
- Training set: 81 → 297 samples across 11 languages (Python, JS/TS, Java, Go, Rust, C#, PHP, Ruby, Swift, Kotlin, SQL)
- CV F1 (5-fold stratified): 0.754 ± 0.021 (up from 0.496 ± 0.229)
- Held-out verification: 32/33 cases (97%)
Layer 3 — LLM advisory
- All findings from a commit now written to one consolidated report at
~/.localforge/reports/commit_<ts>.txt - Language auto-detected from diff file extensions
- Only added lines reviewed — no false flags on removed code
- Large diffs chunked at file boundaries, findings merged and deduplicated
Install & packaging
localforge --install— one command sets up everything: directory, binary, model, hook, PATH export to.zshrc- Auto-detects Qwen model from HuggingFace cache
localforge --upgrade-all— syncs hooks across all registered repos- Homebrew formula added (
Formula/localforge.rb) - Notarization and packaging scripts added (
scripts/notarize.sh,scripts/package_homebrew.sh)
Tests
- 43 Rust unit tests (up from 16), including 34 pattern tests: 20 detection, 10 false-positive guards, 4 diff-awareness tests
Installation
curl -L https://github.com/stalzkie/local-forge/releases/download/v2.1.0/localforge-v2.1.0-macos-arm64 \
-o ~/.localforge/bin/localforge
chmod +x ~/.localforge/bin/localforge
localforge --installRequires Apple Silicon (M1/M2/M3/M4). macOS 14+.