> ## Documentation Index
> Fetch the complete documentation index at: https://devlookout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Local development

> Develop and test Lookout from a source checkout.

> For the complete documentation index, see [llms.txt](https://devlookout.com/llms.txt). Markdown versions are available by appending `.md` to page URLs.

## Set up the repository

```sh theme={null}
npm ci
npm test
LOOKOUT_CONFIG=./config/lookout.example.json npm start
```

The server listens at `http://127.0.0.1:4173` with the example configuration.

## Common checks

```sh theme={null}
npm run check
npm test
npm run test:attacks
```

| Command                | Purpose                                                                            |
| ---------------------- | ---------------------------------------------------------------------------------- |
| `npm run check`        | Parse-check the main JavaScript entry points                                       |
| `npm test`             | Run the Node.js test suite                                                         |
| `npm run test:attacks` | Replay malicious and near-miss scenarios through the production detection pipeline |

## Browser configuration

The signup and Setup flows need browser-safe Supabase project values. PostHog is optional.

```sh theme={null}
LOOKOUT_SUPABASE_URL='https://your-project.supabase.co' \
LOOKOUT_SUPABASE_PUBLISHABLE_KEY='sb_publishable_replace_me' \
LOOKOUT_POSTHOG_PROJECT_TOKEN='phc_replace_me' \
LOOKOUT_POSTHOG_HOST='https://us.i.posthog.com' \
LOOKOUT_POSTHOG_UI_HOST='https://us.posthog.com' \
LOOKOUT_CONFIG=./config/lookout.example.json \
npm start
```

Enable the Google provider in Supabase Auth and add your Lookout `/signup` URL to the redirect allowlist. For email and password signup with a six-digit verification code, include `{{ .Token }}` in the confirmation template.

## Development boundaries

* The local deployment is the source of truth for graph, events, detections, Alerts, and Incidents.
* The browser prototype and `/api/snapshot` are not part of the versioned backend contract.
* A non-loopback bind requires API credentials and should be protected by TLS.
* Never commit tokens, private keys, state files, backups, or `.env` files.

## Useful directories

| Path             | Contents                                                           |
| ---------------- | ------------------------------------------------------------------ |
| `src/`           | Runtime, adapters, collectors, detection, storage, and HTTP server |
| `bin/lookout.js` | CLI entry point                                                    |
| `config/`        | Checked-in configuration examples                                  |
| `install/`       | Fleet and onboarding installers                                    |
| `test/`          | Node.js unit and integration tests                                 |
| `docs/`          | Developer and operator documentation                               |