The Build hub still owned /app/addons through its legacy Add-ons tab,
so the sidebar lit both Apps and Build on the Apps page. A tab whose
gate is closed now owns no route when the sidebar asks, so only the
Apps entry is active there. The hubs keep their own routes, and the
legacy navigation still gives /app/addons to the Build hub.
Assisted-by: Claude Code:claude-sonnet-5-5 node playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The test reads the redirected URL right after the path changes. The
Backends page then loads the installed list and drops a selected backend
that is not installed, so the backend parameter was sometimes already gone
when the test read it. The mock server has no llama-cpp, and about 15 of
40 repeated runs failed on the backend assertion. The redirect itself was
correct, including show_all.
Serve the selected backend in the installed list, so the page keeps the
selection and the assertions stay as strict as before.
Assisted-by: Claude Code:claude-sonnet-5-5 node playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
When the window is narrower than 1024 px the sidebar shrinks to the icon rail by CSS alone, without the collapsed class. The pinned app links were still drawn there, with the indent meant for the full sidebar, so their icons sat to the right of the rail and were cut off. Hide the pinned app links in both rail states. The Apps entry keeps its centred icon. The e2e spec checks that the rail shows no pinned app and that every icon is centred at 1280 px collapsed and at 1000 px.
Assisted-by: Claude Code:claude-sonnet-5-5 node playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
An administrator who opens Apps with no add-on installed now sees a
short card with three steps: choose a library, browse and install,
start the add-on. Its button opens the Browse tab. The card is hidden
once an add-on is installed and for anyone who cannot install.
Assisted-by: Claude Code:claude-sonnet-5-5 node playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The link repeated the Apps entry, which opens the same drawer, and looked redundant when no app was pinned. Apps is now the only add-on entry; pinned apps still list under it in pin order. The link, its locale key and the style comment are gone, and the e2e spec and the add-ons docs now say that Apps is the only entry.
Assisted-by: Claude Code:claude-sonnet-5-5 node playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
A pinned app now shows as an indented child of the Apps entry, with its icon and title, in pin order. Show all stays the last child. The pins come from GET /api/addons/pins through the navigation context, and the apps from the add-on registry, which the drawer feeds on every list read, so the links follow the drawer. A pin without an installed app is not drawn, nothing extra shows when no app is pinned, and the children are hidden when the sidebar is collapsed to the rail.
Assisted-by: Claude Code:claude-sonnet-5-5 node playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The add-on shell already titles the page "Voice", so these two tabs showed a second heading below it ("Speech voices", "Speak text"). Keep the supporting line, as the Studio and recognition pages do, and remove the unused title strings. The e2e spec now checks that each tab has exactly one h1, the shell title.
Assisted-by: Claude Code:claude-sonnet-5-5 node playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The add-on shell now shows the one title, "Voice" or "Face", and the page no longer repeats it. The tests still looked for the h1 "Voices" and "Faces". Assert that the add-on page has exactly one h1 and that it is the shell title. The core pages keep their own "Voices" and "Faces" titles.
Assisted-by: Claude Code:claude-sonnet-5-5 playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The sidebar no longer lists pinned add-ons. It shows one Apps entry that
opens the add-ons drawer, with a Show all link below it that opens the
same drawer. Pins are used from the drawer, where a pinned tile keeps
its pin and move buttons. The server pins API is unchanged.
Remove the PinnedNav component and its locale title, rename the
items.addons label to Apps, and update the e2e specs and the add-ons
documentation to match.
Assisted-by: Claude Code:claude-sonnet-5-5 playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The "a result made through a hand-off records which result it came from"
spec opens the Studio add-on straight from an address, twice. Each is a
cold load: the page shows "Loading" until the add-on module has run, and
the next assertion had the default five seconds. The load takes about
two seconds on an idle run and seven to ten under CPU load, so the spec
failed on a loaded machine with the hand-off note not yet drawn.
With the CPU throttled to 6x and eight busy loops running, it failed on
21 of 30 runs. The first assertion after each load now waits up to 20
seconds, and the spec then passed 30 of 30 under the same load. The
assertions are unchanged.
Assisted-by: Claude Code:claude-sonnet-5-5 playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The "generic deletion blocks targeted install at confirmation" spec
dispatches a popstate to set the target node, then waits for a button
named Reinstall and clicks it. Until React renders the targeted page,
the page still draws the generic Reinstall button. It is enabled and has
the same name, so the wait passed on it, the click started a global
install, and no node install request was sent. The poll on the install
count timed out with the confirm dialog still open.
With the CPU throttled to 8x, the spec failed on 20 of 20 runs, and the
button it clicked had the title "Reinstall". The spec now waits for the
button titled "Reinstall on <node>". With the throttle it passes 30 of
30 runs. The assertions are unchanged.
Assisted-by: Claude Code:claude-sonnet-5-5 playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The "generic deletion blocks targeted install at confirmation" spec
dispatches a popstate to set the target node, then clicks Reinstall with
a script click. The click can run before the targeted page has rendered
or while the button is still disabled, so no install request is sent and
the poll on the install count times out. It failed 1 run in 10 with two
workers and on every retry in CI.
The spec now waits for the button to be enabled first. The assertions
are unchanged.
Assisted-by: Claude Code:claude-sonnet-5-5 playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The spec expected the register address to carry port 8089, so it failed
on any other port. It now expects the origin the page was opened from.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The spec asserts that the page shows no alert. The Home page raises its
own alert when the model list fails or a staging operation has failed,
and both answers come from the shared test server. A slow reply or a
failed install left there counted as an alert about the pin.
The spec now fixes both answers, so the alert count tells only about the
pin. The assertions are unchanged.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The navigation spec serves the built Fine-tuning bundle, but nothing
built it, so two specs failed on a fresh checkout when the dist folder
was missing. The spec also built the Face bundle in a hook that every
worker runs, and a build rewrites the folder the other workers serve.
The global setup now builds Studio, Talk, Face and Fine-tuning once,
before the workers start. The spec builds the two bundles itself only
when it runs without the global setup.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
pdf.js and its worker load on first use. The other specs in this file
wait up to ten seconds for the result of that load. The first one waited
five, and missed the tag on a busy machine.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The spec delayed the answer by a fixed 800 ms and then looked for the
skeleton. The assertion polls at growing intervals, so on a slow machine
it could step over that window. The answer now waits until the skeleton
has been seen, and the spec then checks that the skeleton goes away.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The mocked roster added the worker on the third read of /api/nodes. The
shell and the page both read it, and which one asks first depends on
load, so the page could take the new worker as part of the roster it
opened with and never show it as found. The worker now joins after the
page shows it is listening.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Each worker built the Studio and Talk bundles into the same dist
directory, and the build empties that directory first. A worker that
started, or restarted after a failure, removed the files another worker
was serving, so a Studio spec saw "the style sheet of the add-on could
not be loaded". Build once in a global setup before the workers start.
A run without the setup still builds per worker.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The add-on unit tests render the tabs instead of the four pages. The
Playwright spec checks the tab strip, the address of each tab, the
missing Library tab for a member, and that the old page addresses of the
add-on redirect to their tab with the query string kept. The migration
table test follows the new targets.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
/app/voice, /app/voice-library and /app/voice-library/new now open the
matching tab of the Voice add-on page while the add-on is installed and
running, and the core pages otherwise. The moved-page helper compares
the first segment of the target with the declared pages, so a target
can name a tab. The docs and the navigation spec list the new addresses.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The spec served the list to the first request and failed the rest. The
first request is not always the one from the page, so the page could
get the failure first and show no list. Serve the list until the page
shows it, then fail the refreshes.
Assisted-by: Claude Code:claude-sonnet-5-5 playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The recommended models are a list inside the second step, so counting
all list items read 3 only while the models were still loading. Count
the step elements, which does not depend on the load order.
Assisted-by: Claude Code:claude-sonnet-5-5 playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The image, video, sound and speech generators are pages of the Studio
add-on now, and the old addresses redirect to it. Install the add-on
with the Studio fixtures, open its pages and use its compose card, so
the specs run against the page that exists.
Assisted-by: Claude Code:claude-sonnet-5-5 playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Settings is a tab of the Operate hub and not a destination of its own,
so the 404 page does not list it. Assert that it is absent.
Assisted-by: Claude Code:claude-sonnet-5-5 playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Settings moved out of the sidebar into the Operate hub. The navigation
spec still expected a sidebar link. Assert that the sidebar has no
Settings entry, and that the Operate hub opens Settings as a tab.
Assisted-by: Claude Code:claude-sonnet-5-5 playwright
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The add-on shell titles the page, and the Studio overview no longer draws
a second title, but the generator tabs keep theirs, so a bare h1 locator
matched two elements. Click the first, which is the shell's.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The drawer drew the icon of a built-in tile (Studio's palette was one)
in a bare 40px box. Only the placeholder box was laid out as a centred
grid with the 20px size, so the real icon sat in the top-left corner at
the size of the page text.
Give the built-in tile the same classes as the placeholder box, and
check in a browser that the icon is centred.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The pages are add-ons now, so a spec that draws one installs the real
built bundle first: the apps list names it and its module and style
sheet are served from the build output, the way the add-on owner serves
them. studio-addon.js holds that helper, and the Studio and Talk
fixtures call it.
Update the specs for the new addresses (/app/addons/studio/studio, the
model as ?model=), the session permission the add-on route needs, the
legacy redirects, the Home /studio command that appears only while the
add-on is installed, and the sidebar without a Create group.
Add specs for the add-ons themselves: every tab draws with no script
error, the shell titles the page once, the old addresses say so when the
add-on is not installed, a button of the page reaches a core page with
the way back, and the drawer lists both only after they are installed.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Studio and Talk were compiled into the web bundle and always listed in
the Add-ons drawer. They are add-ons now, like Voice, Face, fine-tuning
and quantization: a person installs and removes them, the drawer lists
them only while they are installed, and they are packaged the same way.
Move the pages, their components, hooks and helpers into addons/studio
and addons/talk. Each has a manifest, a UI bundle, a release platform
matrix and a catalog template, and is built by the compat mode of the
shared builder. The core API stays where it is: the pages call it with
the signed-in person's session. The history keeps its browser storage
keys. The unit tests of the moved helpers move with them.
In the core, drop the two pages, the Create group of the sidebar (Chat
joins Home and Models in the old layout), the built-in catalog entries
(the catalog is empty) and the talk locale namespace. The old addresses
(/app/studio, /app/talk and the generator links) redirect to the add-on
pages, with the model as ?model=. The Home /studio command is offered
only while the Studio add-on is installed and opens it.
The release workflow and its tests now list seven add-ons.
Assisted-by: Claude Code:claude-sonnet-5-5 go node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
A page written for the web UI imports React, the router, i18next and a
few shared components. The add-on builder refuses a bundle that holds a
host file, so moving such a page into an add-on meant rewriting it.
Add a compat mode to the shared builder. It answers those imports from a
directory of stand-ins that read the SDK, bundles the dynamic import of
the page code into the one output file, and collects the style sheets the
page imports. A relative import that is not in the add-on's own source
resolves to the file at the same path under the compat directory.
Widen the SDK for these pages, without a version change: more host
components (spinner, modal, lightbox, model picker) and hooks (models,
resources, voice profiles, operations, MCP client), a style on icons,
the icon names the pages draw, sdk.navigation.openApp to open a page of
the app (only addresses under /app, and the way back as the only state)
and sdk.portal. The shell passes the query string to the page.
The stand-ins cover the router (the tab in the path, the model in the
query), the translator over the host locale files, the core API calls
through sdk.core.fetch, and byte copies of the pure helpers, with tests
that keep the copies equal to the originals.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
A 403 or 400 answer showed a generic message and hid the reason in the
response body, so a refusal by the browser guard could not be told from
a missing permission. Show error.message from the body as the server
sent it, and keep the generic text when the body has none.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
The Operate hub already has Settings as a tab, so the sidebar no longer shows a separate Settings entry. The /app/settings route stays, and the hub tab still reaches it. The navigation test now expects Chat, Models and Add-ons as the primary items.
Assisted-by: Claude Code:claude-sonnet-5-5 node
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Add the add-on runtime to LocalAI: manifests, the host operation broker,
admin gating by account role, the add-on UI bundle builder and the SDK
for add-on pages. Move the navigation to Chat, Models, Add-ons and
Settings, with pinned add-ons in the sidebar and an Add-ons drawer.
Ship the first-party add-ons (voice, face, fine-tuning, quantization) as
packages for linux/amd64, linux/arm64 and darwin/arm64. Intel macOS
(darwin/amd64) is enabled in the platform files.
Squashed from the review branch. The tree is unchanged; the pre-squash
history is kept on a local backup branch.
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
* fix(ui): reuse Home picker for Sound expansion
Use the shared model chip and listbox for Sound expansion instead of
a native select. Keep explicit Sound selection and Backend default
independent from Home model preferences.
Preserve keyboard navigation and expose the selected value through an
accessible description. Hide runtime badges without loaded-model data.
Assisted-by: nib:gpt-6.1-sol
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
* test(ui): select Sound expansion through shared picker
Update media history coverage to use the model button and listbox.
Assisted-by: nib:gpt-6.1-sol
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
---------
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
The chat page derived MCP availability from GET
/api/models/config-json/:name, which is admin-only. With auth enabled a
regular user holding the `mcp` feature (default ON) therefore never saw
the MCP Servers/Prompts/Resources tabs, although every endpoint behind
them (/v1/mcp/servers|prompts|resources/:model) is gated only by that
feature.
/api/models/capabilities, which the chat already loads for its model
picker and which honours the per-user model allowlist, now reports
`mcp: true` for models whose config declares remote or stdio MCP servers
(never when MCP is disabled on the instance). For non-admins the chat
combines that flag with hasFeature('mcp') and clears a stale MCP
selection otherwise. Admins keep the config-json path unchanged; the
model info panel and automatic context size stay admin-only on purpose,
since they need the full model config.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>
* fix(ci): capture and surface ginkgo errors in run-coverage.sh
The coverage script ran ginkgo per test root with `|| fail=1`, which
swallowed the exit code. Combined with `make --output-sync=target`,
which buffers all output and flushes at the end, the actual ginkgo
error was invisible in interleaved CI logs. Every test suite passed
but the script still exited 1, and the error message was buried in
22 000 lines of buffered output.
Each ginkgo invocation now captures combined stdout+stderr to a
per-root log file. On failure the last 80 lines are printed to
stderr so the error is visible in the CI log. On success the log is
replayed to stdout so test output remains visible.
The build flags (--tags, --coverpkg) are quoted correctly so values
containing spaces (e.g. --tags="debug auth") are preserved through
eval.
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
* fix(ci): create output dir before writing ginkgo logs
The previous commit added per-root log files but forgot to create
the output directory before the first ginkgo invocation. On CI the
coverage/ dir did not exist yet, so the shell redirect to
cover-pkg.out.log failed with "No such file or directory" before
ginkgo even ran.
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
* test(core/http): add canvas preview route to auth coverage allowlist
Commit 9ad78381d8 added GET /api/canvas/preview/:id as a public route
(no auth — the random id is the capability, an iframe cannot send API
key headers) but did not add it to expectedPublicRoutes in the route
auth coverage test. The test flagged the route as an anonymous-access
leak, failing the entire ./core ginkgo suite on every CI run since.
The POST /api/canvas/preview endpoint is auth-gated (returns 401 to
anonymous requests) and is intentionally absent from the allowlist.
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
* fix(ui): restore confirmed per-node installed backend removal
Verify exact node inventory and protection before offering and confirming removal. Capture the node/backend target, guard duplicate requests, and preserve installed data when refresh fails. Reuse the flow for catalog target removal and document scoped retry behavior.
Assisted-by: nib:gpt-6.1-sol
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
* fix(ui): guard targeted backend mutations and refresh feedback
Distinguish ordinary refresh failures from successful deletion with stale data. Lock target installs synchronously and block conflicting install/removal actions through completion-driven refresh. Cover retry wording, deferred mutation races, obsolete inventory responses, and final installation selection cleanup.
Assisted-by: nib:gpt-6.1-sol
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
* fix(ui): block conflicting generic backend deletion
Keep generic deletion blocked during scoped removal and targeted installs.
Recheck conflicts after dependency lookup and before confirmation so
navigation cannot expose a conflicting delete action.
Assisted-by: nib:gpt-6.1-sol
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
---------
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
* feat(schema): add Conversation schema for chat history (#9432)
Persist WebUI chat conversations server-side so browser refresh, private
windows, or device changes preserve user history (issue #9432). This
commit adds the on-disk representation:
- Conversation holds id, name, model, opaque history, MCP / sampling
settings, and timestamps.
- ConversationsFile is the per-user list serialised to JSON.
History is stored as json.RawMessage so the server stays agnostic to
React message shapes (user / assistant / thinking / tool_call /
tool_result mixed with text / image_url / audio_url / file attachments).
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: TLoE419 <tloemizuchizu@gmail.com>
* feat(chathistory): add file-based per-user conversation store (#9432)
File-backed persister for chat history. Each user's conversations live
under {baseDir}/{userID}/conversations.json (anonymous/ when auth is
disabled).
Design choices:
- In-memory cache backed by sync.Mutex so concurrent saves don't
interleave writes.
- Atomic write via tmp file + os.Rename so a crash mid-save never
leaves a corrupted history.
- ID validation regex blocks path-traversal payloads at the store
boundary, in addition to the auth context constraint.
Tests cover round-trip persistence across instances, user isolation,
unsafe-ID rejection, bulk replace migration, and the anonymous fallback
path.
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: TLoE419 <tloemizuchizu@gmail.com>
* feat(api): expose chat conversation CRUD endpoints (#9432)
Wire the chathistory store into the HTTP layer. New endpoints under
/api/conversations:
- GET /api/conversations list
- POST /api/conversations upsert (id in body)
- DELETE /api/conversations delete all
- PUT /api/conversations/bulk replace entire set (localStorage migration)
- GET /api/conversations/:id fetch one
- PUT /api/conversations/:id upsert (id in path; path id wins over body)
- DELETE /api/conversations/:id delete one
All endpoints scope queries to the authenticated user via getUserID(c)
- callers cannot impersonate other users by passing a user_id in the
body. The endpoints are gated behind the new chat_history feature
permission (default ON in APIFeatures), registered through the existing
RouteFeatureRegistry so the unified feature middleware picks them up
automatically.
Application.ChatHistoryStore() returns nil when DisableWebUI is set or
no persistence path is configured, in which case route registration is
skipped entirely rather than registering handlers that always 503.
Also adds the chat-history instruction entry and Swagger tag so the
endpoint surfaces in /api/instructions and /swagger.
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: TLoE419 <tloemizuchizu@gmail.com>
* feat(react-ui): sync chat history to server with localStorage fallback (#9432)
useChat now probes /api/conversations on mount. When the endpoint
responds 200, the server becomes the authoritative source: the hook
merges remote conversations into local state and pushes per-chat PUT
updates on each debounced save. When the endpoint 404s - older LocalAI
deploys or the feature disabled - the hook silently keeps the old
localStorage-only behaviour, so the change is backward-compatible.
Migration: when the server is reachable but empty and the browser has
local conversations with history, the hook fires a single
PUT /api/conversations/bulk to seed the server. The atomic bulk endpoint
avoids partial-upload states where a retry would skip already-uploaded
entries.
Delete operations propagate to the server when it's available; failures
are silently swallowed so the local UI stays responsive on transient
network errors.
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: TLoE419 <tloemizuchizu@gmail.com>
* test(chathistory): rewrite tests in Ginkgo/Gomega
The initial test file used the stdlib testing package (t.Fatalf /
t.Errorf), which is forbidden by the forbidigo linter rule in
.golangci.yml — LocalAI mandates Ginkgo/Gomega for all Go tests (see
.agents/coding-style.md).
Restructured the same six scenarios into Describe / Context / It blocks,
with a chathistory_suite_test.go bootstrap that registers the Ginkgo
fail handler. Test coverage is unchanged: basic CRUD round-trip, cross-
instance persistence, user isolation, unsafe ID rejection (now via
DescribeTable), bulk replace overwrite, and the anonymous fallback
path.
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: TLoE419 <tloemizuchizu@gmail.com>
* refactor(chathistory): switch store to GORM-backed authDB
Addresses mudler's review on #9902. Chat history was the only per-user
state in LocalAI sitting in a separate filesystem store instead of the
shared GORM database — AgentStore and JobStore both live there. Move
it onto Application.authDB so per-user state stays in one place.
* ConversationRecord (GORM model) with composite primary key
(user_id, conv_id) — React mints IDs locally with no global
coordination so per-user uniqueness is the natural shape.
* Store.New(db *gorm.DB) replaces Store.New(baseDir string).
Save / Get / List / Delete / DeleteAll / ReplaceAll keep their
signatures so HTTP handlers and the React UI are untouched.
* ReplaceAll runs in a transaction with an Unscoped() pre-clear so a
future retention sweep cannot resurrect a stale ID on re-upload.
* gorm.DeletedAt in the schema means a future retention pruner is a
one-line query — addresses the second half of the review (unbounded
in-memory map). The map is gone: reads go straight to the DB.
Trade-off worth flagging in the PR reply: chat history persistence
now requires auth.Enabled = true (that's what initialises
Application.authDB). With auth disabled the React UI transparently
falls back to localStorage, the same path the original PR took on
404. Consistent with AgentStore / JobStore; if a "chat history
always on" mode is preferred we can pull DB init out of auth.InitDB
into a shared helper.
Assisted-by: Claude:claude-opus-4-7 [Read Edit Bash]
Signed-off-by: TLoE419 <tloemizuchizu@gmail.com>
* refactor(schema): drop now-unused ConversationsFile envelope
ConversationsFile was the JSON wrapper for the old file-based chat
history store — a {Conversations: [...], UpdatedAt: ...} pair
serialised to disk under {baseDir}/{userID}/conversations.json. The
previous commit replaced that store with a GORM-backed one that
writes rows directly as ConversationRecord, leaving the envelope
without a consumer.
Assisted-by: Claude:claude-opus-4-7 [Read Edit Bash]
Signed-off-by: TLoE419 <tloemizuchizu@gmail.com>
* test(chathistory): switch tests to testutil.SetupTestDB
Mirror the AgentStore test setup: spin up a PostgreSQL 16 container
via testutil.SetupTestDB(), construct a Store on top of it, exercise
CRUD round-trips. The previous file-based fixtures (TempDir,
filepath.Join checks) are no longer meaningful now that the store
talks GORM.
Tests are skipped on macOS (testcontainers needs Docker) and run on
CI, same as the other GORM-backed suites in the repo.
Also reframed two cases:
* "unsafe IDs" → "malformed IDs" — the DB-backed store doesn't care
about path traversal, but idRegex still rejects whitespace /
control characters so IDs stay safe in logs and HTTP responses.
* "anonymous user" no longer pins a directory path (no directory
exists anymore); instead it checks the round-trip plus the
per-user isolation guarantee.
Added a DeleteAll round-trip to cover the bulk-clear endpoint.
Assisted-by: Claude:claude-opus-4-7 [Read Edit Bash]
Signed-off-by: TLoE419 <tloemizuchizu@gmail.com>
* test(chathistory): cover the conversation HTTP handlers
The seven /api/conversations handlers had no tests. Inject the
*chathistory.Store into the handlers instead of the whole Application and
move the route table into RegisterChatHistoryRoutes, so a spec can drive
the real registration and middleware chain (auth.Middleware plus the
chat_history feature gate) against an in-memory SQLite auth database.
The new specs cover 401 without credentials on every route, 403 when an
admin revoked chat_history, the CRUD round trip, path id over body id,
400 on malformed ids and bodies, per-user isolation, bulk replace and
delete-all, and that a nil store registers nothing (the UI then falls
back to localStorage).
The handlers' nil-store branches are gone: the routes are only
registered with a store, so those branches could never run.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>
* fix(chathistory): make deletions final with tombstones and versions
A conversation deleted on one device came back as soon as a client with
a stale copy wrote it again: Delete soft-deleted the row, and the next
Save went through GORM's upsert, which cleared deleted_at and resurrected
it for every device. The lookup that recovered CreatedAt also ran outside
any transaction, so concurrent writers raced on it.
The server is now authoritative over deletions:
* Delete turns the row into a tombstone: content dropped, deleted_at
set. It is idempotent, and deleting an id the server has not seen yet
still records a tombstone, so a delete that overtakes the UI's
in-flight debounced save of the same chat still wins.
* Save runs in a transaction, refuses a tombstoned id with ErrDeleted
(HTTP 410 Gone), and bumps the version with a single
UPDATE ... SET version = version + 1 guarded by deleted_at IS NULL,
so concurrent writers each count and a delete committed between the
lookup and the write still wins. Two concurrent first writes of the
same id retry once (ON CONFLICT DO NOTHING, then update).
* Every row carries a server-assigned version (1 on the first save,
+1 per write including the delete), returned to the client. A non-zero
version tells the UI the server has seen a conversation, which is how
it can tell a never-synced draft from a server-side deletion.
* GET /api/conversations returns the tombstones under "deleted".
* DeleteAll and ReplaceAll leave tombstones too. ReplaceAll no longer
hard-deletes everything first; it upserts the payload, skips ids that
were deleted (reported in "skipped"), and tombstones the rest.
* createdAt/updatedAt are stored as the client sends them (only zero
values are stamped), so clients compare updatedAt from their own
clocks rather than against the server's.
The store specs now run against PostgreSQL (testcontainers) and, with
the auth tag, SQLite through auth.InitDB, since both back the auth
database. The API specs cover a stale client reconnecting after a remote
deletion. Swagger is regenerated with swag v1.16.6 (json.RawMessage
fields get swaggertype), and the feature is documented, including that
it needs user auth.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>
* fix(react-ui): let the server decide which chats were deleted
mergeRemoteAndLocal kept every chat that was only in the browser and
let the server copy win for every shared id. A stale browser therefore
uploaded chats deleted on another device as if they were new drafts,
and a message sent while the list request was still in flight was
replaced by the older server copy and then lost from localStorage too.
The first load now reconciles with the server's tombstones and versions:
* a chat the server lists under "deleted" is dropped locally;
* a chat on both sides keeps the copy with the newer updatedAt, so an
edit made during the load wins and is uploaded afterwards;
* a chat only in the browser is uploaded only if it was never synced
(no version). With a version the server has seen it and no longer
has it, so it is dropped instead of resurrected (this also keeps one
account's cached chats out of another account on a shared browser);
* deletes made while the list is loading are queued and sent once it
arrives.
Saves record the version the server returns, and a 410 on save drops
the chat locally instead of retrying it forever. Chats received from
the server count as already sent, so adopting a server copy no longer
echoes it straight back. The bulk localStorage migration is gone: it
replaced the whole server set from a possibly stale browser, and the
per-chat saves already upload never-synced drafts through the tombstone
check.
The Playwright spec drives each case against a stubbed
/api/conversations that follows the server contract.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>
* fix(chathistory): keep the LocalAI Assistant toggle on synced chats
master's createNewChat sets localaiAssistant, but serializeChat did not
send it and schema.Conversation had no field for it, so a chat with the
Assistant mode on came back with it off after a reload from the server
(and the local cache dropped it too). Add the field on both sides. The
other fields createNewChat sets were already covered; a handler spec now
round-trips all of them, and the UI spec checks the toggle on the way up
and in the local cache.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>
* fix(react-ui): scope chat cache per account, retry unconfirmed deletes
Two gaps in the client half of server-side chat history, both found in
review:
The browser cache was one shared localStorage key. A draft that one
account could not upload (a failed first save) stayed in it, and after
that account signed out and another signed in, the reconcile kept the
unversioned draft and the save pass uploaded it into the second
account. The cache now lives under localai_chats_data:<user id>, Chat
remounts its state when the account changes, and nothing is synced
without a signed-in account. The shared key is left for browser-only
use without auth and is not uploaded when signed in, because nothing
tells which account it belongs to.
Deletes were dropped locally and their DELETE errors swallowed; only
deletes made while the first list was loading were queued, and not
persisted. A delete made while the server was unreachable therefore
came back with the next list. Deletes (single, delete all, and deletes
on the Home page) are now kept as pending deletes in the account's
cache until the server confirms them, override the server list in the
reconcile, and are sent again on the next change, on the online event
and on the next load. While a delete-all is pending no conversation is
uploaded, so a chat started after it is not caught by it.
The Playwright specs replay both review scenarios (account switch after
a failed first save; delete and delete-all while offline) with
counter-checks that the same account keeps and uploads its own draft
and that a confirmed delete is neither re-sent nor resurrected.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>
* fix(react-ui): persist cleared chats immediately
Navigation cancels the debounced cache write and can restore unsynced
chats after Clear all. Save the cleared list with its pending deletion
before returning, and cover immediate navigation in the browser spec.
Assisted-by: Codex:GPT-6
Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>
* test(react-ui): make the chat history sync specs deterministic
- "clear all persists before navigation" opened a single chat, and the menu
offers no Clear all for one chat, so the spec timed out in every run. It
now opens two unsynced chats and checks that neither survives. Reverting
03cd9c115's save in clearAllChats turns it red again.
- "a delete the server confirmed is not sent again" reopened the page as
soon as the server had the request, before the page had the answer; the
unconfirmed delete was then rightly sent again (4 of 5 runs). It now waits
until the cache holds no pending delete.
Docs-Not-Needed: test-only change.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>
* fix(chathistory): keep the chat's reasoning effort on the server
reasoningEffort (#12700, #12716) is part of the chat the UI syncs since the
master merge, but schema.Conversation had no field for it, so the server
dropped it and a reload from the server reset the setting. Add the field.
The handler spec that round-trips every chat field now includes
reasoningEffort. A schema test reads serializeChat in useChat.js and fails
for any key the UI sends that schema.Conversation cannot hold, so the next
such drift shows up as a failing test rather than in review (it reports
reasoningEffort on the previous head). Swagger and docs updated.
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>
* test(chat): use Ginkgo for the schema drift guard
The new drift guard uses testing methods forbidden by repository lint.
Keep its field coverage and fail-fast parser checks in Ginkgo/Gomega.
Assisted-by: nib:gpt-6.1-sol
---------
Signed-off-by: TLoE419 <tloemizuchizu@gmail.com>
Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>
Co-authored-by: TLoE419 <tloemizuchizu@gmail.com>
Co-authored-by: localai-org-maint-bot <306269227+localai-org-maint-bot@users.noreply.github.com>
Co-authored-by: mudler-agent <mudler-bot@c3os.io>
* feat(sound): expand simple prompts with chat models
Allow callers to select an installed chat model for sound prompt
expansion. Validate its JSON before audio generation and preserve
explicit instrumental and language controls. Keep backend defaults
when expansion is omitted, including native Python ACE-Step sampling.
Assisted-by: Codex:gpt-6
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
* feat(sound): map expansion by loaded audio family
Map neutral expanded fields where the resolved audio family is known.
Keep unmarked requests unchanged and reject unsupported expansion before
inference. Clear YuE2 and HeartMuLa transcripts to prevent lyric fallback.
Assisted-by: Codex:gpt-6.1-sol
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
* feat(sound): choose a prompt expansion model
Require an explicit Simple choice and remember it separately from chat.
Clear unavailable choices instead of silently switching language models.
Preserve the choice in history and restore it when editing a past result.
Keep Backend default and Advanced requests compatible with existing APIs.
Document family support and align the published optional request schema.
Verify selection, request fields, persistence and history in the browser.
Assisted-by: Codex:gpt-6.1-sol
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
* fix(sound): authorize both generation models
Check the resolved audio model and explicit expansion model before
loading either. Permission lookup failures stop generation.
Assisted-by: Codex:gpt-6
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
* fix(sound): enforce JSON during prompt expansion
Constrain expansion output with the existing JSON grammar before decoding.
Require a llama-cpp chat model so unsupported backends cannot ignore it.
Keep strict field validation and fail before generating audio.
Assisted-by: Codex:gpt-6
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
---------
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
Two gaps in the chat composer:
- The microphone button only opened a file dialog for audio files; there
was no way to speak a message. Add a dictation button: the first click
records from the microphone, the second stops and sends the recording
to /v1/audio/transcriptions with the first installed transcription
model; the text is appended to the message box for review. The button
is hidden without a transcription model or without a microphone API.
The audio attach button keeps its function and gets the music icon.
- A PDF without a text layer (a scan) was rejected with a toast. Render
its first ten pages to PNG with pdf.js and attach them as images, so a
vision model can read them; a toast says how many pages went along.
PDFs that cannot be parsed at all are still rejected.
Strings for all eight locales, docs in features/chat.md, Playwright
specs for both (with negative cases: no transcription model, failed
transcription, unparsable PDF).
Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Stefan Walcz <stefan.walcz@walcz.de>
fix(ui): serve canvas HTML previews from a route with their own CSP
External scripts in canvas previews (for example three.js from unpkg)
were blocked. The preview used an iframe with srcdoc, which inherits the
global Content-Security-Policy, and a meta tag can only tighten it.
The UI now posts the HTML to POST /api/canvas/preview, gets a random id,
and loads GET /api/canvas/preview/:id in the iframe. That response sets
its own CSP that allows scripts from unpkg, jsdelivr, cdnjs, the
Tailwind CDN and jQuery. The global CSP is unchanged. The iframe keeps
sandbox="allow-scripts" without allow-same-origin.
Previews are kept in memory for 10 minutes and are never written to
disk. The GET route is public because the id is the capability and a
frame navigation cannot send API key headers.
Assisted-by: Claude:claude-haiku-5-5 [go test] [npm]
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
fix(ui): fold the "No reasoning" chip into the effort picker
The chat composer had two controls for one idea: the effort picker
with a "None" level, and a separate "No reasoning" chip. The chip
also hid reasoning traces that a model sends despite
reasoning_effort "none", which "None" did not. The chip disabled the
picker while it was on.
Choosing "None" now hides those traces and stays selectable, so the
chip, its toasts and the /reasoning slash action are removed. A chat
saved with the old reasoningOff flag loads with effort "none", so it
keeps hiding reasoning.
Assisted-by: Claude:claude-sonnet-5-5
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
The chat could not set reasoning_effort or turn reasoning traces off.
Add an effort menu and a "No reasoning" toggle to the composer chips,
and the matching /effort and /reasoning slash actions. Both are stored
per chat. The effort menu defaults to the model default, which sends no
reasoning_effort, so existing chats behave as before.
Chosen effort goes out as the per-request reasoning_effort field. The
toggle sends "none", which the server maps to enable_thinking=false, and
also drops any reasoning the model still returns, so the thread shows
only the answer.
Assisted-by: Claude:claude-sonnet-5-5 eslint playwright
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
Add the GEM-X native backend with live pose and root displacement output, bounded duplex WebSocket streaming, session authorization, metrics and usage accounting. Share the embedded bidirectional RPC channel adapter across streaming backends.
Include backend build and gallery integration, API documentation, schemas and tests.
Assisted-by: Codex:gpt-6
Signed-off-by: Richard Palethorpe <io@richiejp.com>
(cherry picked from commit 016dc3d71a)
The model editor polled a queued import forever: every status error was
swallowed and retried, and nothing stopped the loop when the editor
closed. A job the server had already dropped left the editor stuck on
"saving".
Move the job-status reading into a shared helper used by the import page
and the editor. It classifies cancelled, failed (error field or an
"error:" message) and finished jobs once, gives up after 10 consecutive
status failures or 2 hours of waiting, and stops on unmount. The editor
now shows the failure instead of looping.
Assisted-by: Claude:claude-sonnet-5-5
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Cancelled gallery jobs also set processed. Handle cancellation before
completion so imports do not announce success or open a missing model.
Assisted-by: Codex:gpt-6
Signed-off-by: Plamen K. Kosseff <p.kosseff@gmail.com>
(cherry picked from commit 0f54bdcb38)
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Review round at aec658a99:
- [P1] acquisition is decided by PrimaryArtifactSpec: managed artifacts
(hf:// repos, bare owner/repo, explicit artifacts:) enqueue with no
file entries so the worker's InstallModel runs the artifact binding
and repository materializer — flattening them into file entries routed
repositories through the single-file downloader and skipped the
materializer. Plain remote files keep the legacy file path; malformed
references fail at admission. Covered by endpoint specs and a
worker-level materializer spec.
- [P2] both ModelEditor create paths wait on the returned job before
announcing success and navigating; download failures surface as save
errors instead of after a success toast.
Assisted-by: Claude:claude-fable-5
Signed-off-by: Plamen K. Kosseff <p.kosseff@gmail.com>
(cherry picked from commit 742971c2c4)
Manual /models/import with downloadable assets ran synchronously; it now
enqueues like a gallery install and the import UI polls the job progress.
Assisted-by: Claude:claude-fable-5
Signed-off-by: Plamen K. Kosseff <p.kosseff@gmail.com>
(cherry picked from commit 7420e2e71b)
* fix(ui): keep model actions visible on phones
Let model descriptions wrap without losing the install action offscreen.
Give page table rules precedence over the shared table styles.
Separate background facet probes from navigation assertions and wait for
asynchronous size sorting and masonry layout. Fix the chat fixture clock
so runs near midnight keep the expected conversation groups and order.
Assisted-by: Codex:gpt-6
* test(traffic): match complete percentile labels
Playwright joins adjacent table-cell text. A llama-cpp backend followed
by 99 requests then matches p99, although no percentile is shown.
Require word boundaries while keeping the absence assertion.
Assisted-by: Codex:gpt-6
---------
Co-authored-by: localai-org-maint-bot <306269227+localai-org-maint-bot@users.noreply.github.com>
Ettore Di Giacinto