Local development - Lookout

For the complete documentation index, see llms.txt. Markdown versions are available by appending .md to page URLs.

Set up the repository

npm ci
npm test
LOOKOUT_CONFIG=./config/lookout.example.json npm start

The server listens at http://127.0.0.1:4173 with the example configuration.

Common checks

npm run check
npm test
npm run test:attacks

Command	Purpose
`npm run check`	Parse-check the main JavaScript entry points
`npm test`	Run the Node.js test suite
`npm run test:attacks`	Replay malicious and near-miss scenarios through the production detection pipeline

Browser configuration

The signup and Setup flows need browser-safe Supabase project values. PostHog is optional.

LOOKOUT_SUPABASE_URL='https://your-project.supabase.co' \
LOOKOUT_SUPABASE_PUBLISHABLE_KEY='sb_publishable_replace_me' \
LOOKOUT_POSTHOG_PROJECT_TOKEN='phc_replace_me' \
LOOKOUT_POSTHOG_HOST='https://us.i.posthog.com' \
LOOKOUT_POSTHOG_UI_HOST='https://us.posthog.com' \
LOOKOUT_CONFIG=./config/lookout.example.json \
npm start

Enable the Google provider in Supabase Auth and add your Lookout /signup URL to the redirect allowlist. For email and password signup with a six-digit verification code, include {{ .Token }} in the confirmation template.

Development boundaries

The local deployment is the source of truth for graph, events, detections, Alerts, and Incidents.
The browser prototype and /api/snapshot are not part of the versioned backend contract.
A non-loopback bind requires API credentials and should be protected by TLS.
Never commit tokens, private keys, state files, backups, or .env files.

Useful directories

Path	Contents
`src/`	Runtime, adapters, collectors, detection, storage, and HTTP server
`bin/lookout.js`	CLI entry point
`config/`	Checked-in configuration examples
`install/`	Fleet and onboarding installers
`test/`	Node.js unit and integration tests
`docs/`	Developer and operator documentation